database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-12-19 17:02:53 +03:00
Code Activity

libpq: Add support for dumping SSL key material to file

Browse Source 
This adds a new connection parameter which instructs libpq to
write out keymaterial clientside into a file in order to make
connection debugging with Wireshark and similar tools possible.
The file format used is the standardized NSS format.

Author: Abhishek Chanda <abhishek.becs@gmail.com>
Co-authored-by: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Discussion: https://postgr.es/m/CAKiP-K85C8uQbzXKWf5wHQPkuygGUGcufke713iHmYWOe9q2dA@mail.gmail.com
This commit is contained in:
Daniel Gustafsson
2025-04-03 13:16:43 +02:00
parent e4309f73f6
commit 2da74d8d64
9 changed files with 120 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/test/ssl/t/001_ssltests.pl
View File

@@ -147,6 +147,33 @@ my $default_ssl_connstr =
$common_connstr =
"$default_ssl_connstr user=ssltestuser dbname=trustdb hostaddr=$SERVERHOSTADDR host=common-name.pg-ssltest.test";
SKIP:
{
skip "Keylogging is not supported with LibreSSL", 5 if $libressl;
my $tempdir = PostgreSQL::Test::Utils::tempdir;
my @status;
# Properly escape backslashes in the path
$tempdir =~ s/\\/\\\\/g;
# Connect should work with a given sslkeylogfile
$node->connect_ok(
"$common_connstr sslrootcert=ssl/root+server_ca.crt sslkeylogfile=$tempdir/key.txt sslmode=require",
"connect with server root cert and sslkeylogfile=$tempdir/key.txt");
# Verify the key file exists
ok(-f "$tempdir/key.txt", "keylog file exists at: $tempdir/key.txt");
# Skip permission checks on Windows/Cygwin
skip "Permissions check not enforced on Windows", 2
if ($windows_os || $Config::Config{osname} eq 'cygwin');
ok( (@status = stat("$tempdir/key.txt")),
"keylog file exists and returned status");
ok(@status && !($status[2] & 0006), "keylog file is not world readable");
}
# The server should not accept non-SSL connections.
$node->connect_fails(
"$common_connstr sslmode=disable",