pgsql: Add notBefore and notAfter to SSL cert info display

From: Daniel Gustafsson <dgustafsson(at)postgresql(dot)org>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Add notBefore and notAfter to SSL cert info display
Date: 2024-03-22 20:30:20
Message-ID: E1rnlWu-0058t3-5c@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Add notBefore and notAfter to SSL cert info display

This adds the X509 attributes notBefore and notAfter to sslinfo
as well as pg_stat_ssl to allow verifying and identifying the
validity period of the current client certificate. OpenSSL has
APIs for extracting notAfter and notBefore, but they are only
supported in recent versions so we have to calculate the dates
by hand in order to make this work for the older versions of
OpenSSL that we still support.

Original patch by Cary Huang with additional hacking by Jacob
and myself.

Author: Cary Huang <cary(dot)huang(at)highgo(dot)ca>
Co-author: Jacob Champion <jacob(dot)champion(at)enterprisedb(dot)com>
Co-author: Daniel Gustafsson <daniel(at)yesql(dot)se>
Discussion: https://postgr.es/m/182b8565486.10af1a86f158715.2387262617218380588@highgo.ca

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/6acb0a628eccab8764e0306582c2b7e2a1441b9b

Modified Files
--------------
contrib/sslinfo/Makefile | 2 +-
contrib/sslinfo/meson.build | 1 +
contrib/sslinfo/sslinfo--1.2--1.3.sql | 12 ++++
contrib/sslinfo/sslinfo.c | 95 +++++++++++++++++++++++++++++
contrib/sslinfo/sslinfo.control | 2 +-
doc/src/sgml/monitoring.sgml | 20 ++++++
doc/src/sgml/sslinfo.sgml | 30 +++++++++
src/backend/catalog/system_views.sql | 4 +-
src/backend/libpq/be-secure-openssl.c | 78 +++++++++++++++++++++++
src/backend/utils/activity/backend_status.c | 2 +
src/backend/utils/adt/pgstatfuncs.c | 46 ++++++++------
src/include/catalog/catversion.h | 2 +-
src/include/catalog/pg_proc.dat | 6 +-
src/include/libpq/libpq-be.h | 2 +
src/include/utils/backend_status.h | 3 +
src/test/regress/expected/rules.out | 12 ++--
src/test/ssl/t/001_ssltests.pl | 10 +--
src/test/ssl/t/003_sslinfo.pl | 14 +++++
src/tools/pgindent/typedefs.list | 1 +
19 files changed, 308 insertions(+), 34 deletions(-)

Responses

Browse pgsql-committers by date

  From Date Subject
Next Message Tom Lane 2024-03-22 21:14:04 pgsql: Use a hash table for catcache.c's CatCList objects.
Previous Message Robert Haas 2024-03-22 16:52:15 Re: pgsql: Allow using syncfs() in frontend utilities.