Revert "Add notBefore and notAfter to SSL cert info display"

Due to an oversight in reviewing, this used functionality not
compatible with old versions of OpenSSL.

This reverts commit 75ec5e7.

Author: danielgustafsson

contrib/sslinfo/Makefile

@@ -6,7 +6,7 @@ OBJS = \
 	sslinfo.o
 
 EXTENSION = sslinfo
-DATA = sslinfo--1.2--1.3.sql sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
+DATA = sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
 PGFILEDESC = "sslinfo - information about client SSL certificate"
 
 ifdef USE_PGXS

contrib/sslinfo/meson.build

@@ -26,7 +26,6 @@ install_data(
   'sslinfo--1.0--1.1.sql',
   'sslinfo--1.1--1.2.sql',
   'sslinfo--1.2.sql',
-  'sslinfo--1.2--1.3.sql',
   'sslinfo.control',
   kwargs: contrib_data_args,
 )

contrib/sslinfo/sslinfo--1.2--1.3.sql

@@ -18,7 +18,6 @@
 #include "libpq/libpq-be.h"
 #include "miscadmin.h"
 #include "utils/builtins.h"
-#include "utils/timestamp.h"
 
 /*
  * On Windows, <wincrypt.h> includes a #define for X509_NAME, which breaks our
@@ -35,7 +34,6 @@ PG_MODULE_MAGIC;
 
 static Datum X509_NAME_field_to_text(X509_NAME *name, text *fieldName);
 static Datum ASN1_STRING_to_text(ASN1_STRING *str);
-static Datum ASN1_TIME_to_timestamp(ASN1_TIME *time);
 
 /*
  * Function context for data persisting over repeated calls.
@@ -227,39 +225,6 @@ X509_NAME_field_to_text(X509_NAME *name, text *fieldName)
 }
 
 
-/*
- * Converts OpenSSL ASN1_TIME structure into timestamp
- *
- * Parameter: time - OpenSSL ASN1_TIME structure.
- *
- * Returns Datum, which can be directly returned from a C language SQL
- * function.
- */
-static Datum
-ASN1_TIME_to_timestamp(ASN1_TIME * time)
-{
-	struct tm	tm_time;
-	struct pg_tm pgtm_time;
-	Timestamp	ts;
-
-	ASN1_TIME_to_tm(time, &tm_time);
-
-	pgtm_time.tm_sec = tm_time.tm_sec;
-	pgtm_time.tm_min = tm_time.tm_min;
-	pgtm_time.tm_hour = tm_time.tm_hour;
-	pgtm_time.tm_mday = tm_time.tm_mday;
-	pgtm_time.tm_mon = tm_time.tm_mon + 1;
-	pgtm_time.tm_year = tm_time.tm_year + 1900;
-
-	if (tm2timestamp(&pgtm_time, 0, NULL, &ts))
-		ereport(ERROR,
-				(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
-				 errmsg("failed to convert tm to timestamp")));
-
-	PG_RETURN_TIMESTAMP(ts);
-}
-
-
 /*
  * Returns specified field of client certificate distinguished name
  *
@@ -517,35 +482,3 @@ ssl_extension_info(PG_FUNCTION_ARGS)
 	/* All done */
 	SRF_RETURN_DONE(funcctx);
 }
-
-/*
- * Returns current client certificate notBefore timestamp in
- * timestamp data type
- */
-PG_FUNCTION_INFO_V1(ssl_client_get_notbefore);
-Datum
-ssl_client_get_notbefore(PG_FUNCTION_ARGS)
-{
-	X509	   *cert = MyProcPort->peer;
-
-	if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
-		PG_RETURN_NULL();
-
-	return ASN1_TIME_to_timestamp(X509_get_notBefore(cert));
-}
-
-/*
- * Returns current client certificate notAfter timestamp in
- * timestamp data type
- */
-PG_FUNCTION_INFO_V1(ssl_client_get_notafter);
-Datum
-ssl_client_get_notafter(PG_FUNCTION_ARGS)
-{
-	X509	   *cert = MyProcPort->peer;
-
-	if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
-		PG_RETURN_NULL();
-
-	return ASN1_TIME_to_timestamp(X509_get_notAfter(cert));
-}

contrib/sslinfo/sslinfo.c

@@ -1,5 +1,5 @@
 # sslinfo extension
 comment = 'information about SSL certificates'
-default_version = '1.3'
+default_version = '1.2'
 module_pathname = '$libdir/sslinfo'
 relocatable = true

contrib/sslinfo/sslinfo.control

@@ -2257,26 +2257,6 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i
        This field is truncated like <structfield>client_dn</structfield>.
       </para></entry>
      </row>
-
-     <row>
-      <entry role="catalog_table_entry"><para role="column_definition">
-       <structfield>not_before</structfield> <type>text</type>
-      </para>
-      <para>
-       Not before UTC timestamp of the client certificate, or NULL if no client
-       certificate was supplied.
-      </para></entry>
-     </row>
-
-     <row>
-      <entry role="catalog_table_entry"><para role="column_definition">
-       <structfield>not_after</structfield> <type>text</type>
-      </para>
-      <para>
-       Not after UTC timestamp of the client certificate, or NULL if no client
-       certificate was supplied.
-      </para></entry>
-     </row>
     </tbody>
    </tgroup>
   </table>

doc/src/sgml/monitoring.sgml

@@ -240,36 +240,6 @@ emailAddress
     </para>
     </listitem>
    </varlistentry>
-
-   <varlistentry>
-    <term>
-     <function>ssl_client_get_notbefore() returns text</function>
-     <indexterm>
-      <primary>ssl_client_get_notbefore</primary>
-     </indexterm>
-    </term>
-    <listitem>
-    <para>
-     Return the <structfield>not before</structfield> UTC timestamp of the client
-     certificate.
-    </para>
-    </listitem>
-   </varlistentry>
-
-   <varlistentry>
-    <term>
-     <function>ssl_client_get_notafter() returns text</function>
-     <indexterm>
-      <primary>ssl_client_get_notafter</primary>
-     </indexterm>
-    </term>
-    <listitem>
-    <para>
-     Return the <structfield>not after</structfield> UTC timestamp of the client
-     certificate.
-    </para>
-    </listitem>
-   </varlistentry>
   </variablelist>
  </sect2>
 

doc/src/sgml/sslinfo.sgml

@@ -970,9 +970,7 @@ CREATE VIEW pg_stat_ssl AS
             S.sslbits AS bits,
             S.ssl_client_dn AS client_dn,
             S.ssl_client_serial AS client_serial,
-            S.ssl_issuer_dn AS issuer_dn,
-            S.ssl_not_before AS not_before,
-            S.ssl_not_after AS not_after
+            S.ssl_issuer_dn AS issuer_dn
     FROM pg_stat_get_activity(NULL) AS S
     WHERE S.client_port IS NOT NULL;
 

src/backend/catalog/system_views.sql

@@ -36,7 +36,6 @@
 #include "tcop/tcopprot.h"
 #include "utils/builtins.h"
 #include "utils/memutils.h"
-#include "utils/timestamp.h"
 
 /*
  * These SSL-related #includes must come after all system-provided headers.
@@ -73,7 +72,6 @@ static bool initialize_ecdh(SSL_CTX *context, bool isServerStart);
 static const char *SSLerrmessage(unsigned long ecode);
 
 static char *X509_NAME_to_cstring(X509_NAME *name);
-static Timestamp ASN1_TIME_to_timestamp(ASN1_TIME *time);
 
 static SSL_CTX *SSL_context = NULL;
 static bool SSL_initialized = false;
@@ -1408,24 +1406,6 @@ be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len)
 		ptr[0] = '\0';
 }
 
-void
-be_tls_get_peer_not_before(Port *port, Timestamp *ptr)
-{
-	if (port->peer)
-		*ptr = ASN1_TIME_to_timestamp(X509_get_notBefore(port->peer));
-	else
-		*ptr = 0;
-}
-
-void
-be_tls_get_peer_not_after(Port *port, Timestamp *ptr)
-{
-	if (port->peer)
-		*ptr = ASN1_TIME_to_timestamp(X509_get_notAfter(port->peer));
-	else
-		*ptr = 0;
-}
-
 void
 be_tls_get_peer_serial(Port *port, char *ptr, size_t len)
 {
@@ -1569,33 +1549,6 @@ X509_NAME_to_cstring(X509_NAME *name)
 	return result;
 }
 
-/*
- * Convert an ASN1_TIME to a Timestamp
- */
-static Timestamp
-ASN1_TIME_to_timestamp(ASN1_TIME * time)
-{
-	struct tm	tm_time;
-	struct pg_tm pgtm_time;
-	Timestamp	ts;
-
-	ASN1_TIME_to_tm(time, &tm_time);
-
-	pgtm_time.tm_sec = tm_time.tm_sec;
-	pgtm_time.tm_min = tm_time.tm_min;
-	pgtm_time.tm_hour = tm_time.tm_hour;
-	pgtm_time.tm_mday = tm_time.tm_mday;
-	pgtm_time.tm_mon = tm_time.tm_mon + 1;
-	pgtm_time.tm_year = tm_time.tm_year + 1900;
-
-	if (tm2timestamp(&pgtm_time, 0, NULL, &ts))
-		ereport(ERROR,
-				(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
-				 errmsg("timestamp out of range")));
-
-	return ts;
-}
-
 /*
  * Convert TLS protocol version GUC enum to OpenSSL values
  *

src/backend/libpq/be-secure-openssl.c

@@ -367,8 +367,6 @@ pgstat_bestart(void)
 		be_tls_get_peer_subject_name(MyProcPort, lsslstatus.ssl_client_dn, NAMEDATALEN);
 		be_tls_get_peer_serial(MyProcPort, lsslstatus.ssl_client_serial, NAMEDATALEN);
 		be_tls_get_peer_issuer_name(MyProcPort, lsslstatus.ssl_issuer_dn, NAMEDATALEN);
-		be_tls_get_peer_not_before(MyProcPort, &lsslstatus.ssl_not_before);
-		be_tls_get_peer_not_after(MyProcPort, &lsslstatus.ssl_not_after);
 	}
 	else
 	{