proxysql

Commit Graph

Author	SHA1	Message	Date
Rahim Kanji	e7ee68dda5	Add SSL/TLS traffic decryption for PostgreSQL backend connections (#5281 ) Extends the existing NSS keylog-based SSL decryption to PostgreSQL backend connections by patching libpq with a global PQsetSSLKeyLogCallback() API. When admin-ssl_keylog_file is configured, TLS secrets from all PgSQL backend SSL handshakes are written to the keylog file in NSS Key Log Format, enabling traffic decryption with Wireshark/tshark. Approach: - Patch libpq with global callback following the PQsslKeyPassHook pattern - Single startup call covers all backend paths (regular, monitor, kill, harvester) - No new admin variables — existing admin-ssl_keylog_file covers PgSQL backends - Zero changes to ProxySQL PgSQL connection code Includes 9 integration tests (pgsql-ssl_keylog-t) and user guide updates.	3 months ago

Author

SHA1

Message

Date

Rahim Kanji

e7ee68dda5

Add SSL/TLS traffic decryption for PostgreSQL backend connections (#5281 )

Extends the existing NSS keylog-based SSL decryption to PostgreSQL
backend connections by patching libpq with a global PQsetSSLKeyLogCallback()
API. When admin-ssl_keylog_file is configured, TLS secrets from all PgSQL
backend SSL handshakes are written to the keylog file in NSS Key Log Format,
enabling traffic decryption with Wireshark/tshark.

Approach:
- Patch libpq with global callback following the PQsslKeyPassHook pattern
- Single startup call covers all backend paths (regular, monitor, kill, harvester)
- No new admin variables — existing admin-ssl_keylog_file covers PgSQL backends
- Zero changes to ProxySQL PgSQL connection code

Includes 9 integration tests (pgsql-ssl_keylog-t) and user guide updates.

1 Commits (fix/pgsql-unix-socket)