Re: Adding support for SSLKEYLOGFILE in the frontend

Peter Eisentraut <peter@eisentraut.org>

From: Peter Eisentraut <peter@eisentraut.org>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>, Tom Lane <tgl@sss.pgh.pa.us>, Jacob Champion <jacob.champion@enterprisedb.com>, Abhishek Chanda <abhishek.becs@gmail.com>, Álvaro Herrera <alvherre@alvh.no-ip.org>
Date: 2025-07-05T08:56:44Z
Lists: pgsql-hackers
On 01.07.25 10:47, Daniel Gustafsson wrote:
>> On 29 Jun 2025, at 12:56, Peter Eisentraut <peter@eisentraut.org> wrote:
>>
>> On 27.06.25 11:15, Daniel Gustafsson wrote:
>>>> On 26 Jun 2025, at 23:06, Daniel Gustafsson <daniel@yesql.se> wrote:
>>>> I'll propose changes for these comments in the morning when coffee has been
>>>> had.
>>> The attached moves to logging on stderr along with a test for this, and also
>>> removes the WARNING prefix that was added to the other stderr loggings since
>>> that seems out of place compared to other stderr loggings in libpq (the
>>> sslpassword trunction WARNING is clearly warranted, these were not).
>>
>> Hmm, I thought the WARNING prefixes were good.  I think these are similar to
>>
>> "WARNING: password file \"%s\" is not a plain file\n"
>>
>> in that something during the connection setup is being ignored.
>>
>> Otherwise, if you just write something but don't tag it with something like warning or error, it's not clear how the user is supposed to interpret it.  Is it a progress message, is it something bad, etc.?
> 
> Fair.  As this is a connection debugging tool and not for regular use I wasn't
> thinking of them as warnings per se (I was more classifying them as the "out of
> memory" errors which are printed without a prefix), but I also don't mind
> adding them back.  Done in v2 with other comments addressed as well.

This patch version looks good to me.




Commits

  1. Fix sslkeylogfile error handling logging

  2. Mark sslkeylogfile as Debug option

  3. libpq: Add support for dumping SSL key material to file