feat: include crypto diagnostics in /debug/vars output

services/httpd/handler.go

@@ -872,7 +872,6 @@ func (h *Handler) async(q *influxql.Query, results <-chan *query.Result) {
 // in the database URL query value.  It is encoded using a forward slash like
 // "database/retentionpolicy" and we should be able to simply split that string
 // on the forward slash.
-//
 func bucket2dbrp(bucket string) (string, string, error) {
 	// test for a slash in our bucket name.
 	switch idx := strings.IndexByte(bucket, '/'); idx {
@@ -2250,6 +2249,35 @@ func (h *Handler) serveExpvar(w http.ResponseWriter, r *http.Request) {
 		first = false
 		fmt.Fprintf(w, "\"cmdline\": %s", val)
 	}
+
+	// We're going to print some kind of crypto data, we just
+	// need to find the proper source for it.
+	{
+		var jv map[string]interface{}
+		val := diags["crypto"]
+		if val != nil {
+			jv, err = parseCryptoDiagnostics(val)
+			if err != nil {
+				h.httpError(w, err.Error(), http.StatusInternalServerError)
+				return
+			}
+		} else {
+			jv = ossCryptoDiagnostics()
+		}
+
+		data, err := json.Marshal(jv)
+		if err != nil {
+			h.httpError(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		if !first {
+			fmt.Fprintln(w, ",")
+		}
+		first = false
+		fmt.Fprintf(w, "\"crypto\": %s", data)
+	}
+
 	if val := expvar.Get("memstats"); val != nil {
 		if !first {
 			fmt.Fprintln(w, ",")
@@ -2434,6 +2462,47 @@ func parseBuildInfo(d *diagnostics.Diagnostics) (map[string]interface{}, error)
 	return m, nil
 }
 
+// ossCryptoDiagnostics creates a default crypto diagnostics map that
+// can be marshaled into JSON for /debug/vars.
+func ossCryptoDiagnostics() map[string]interface{} {
+	return map[string]interface{}{
+		"ensureFIPS":     false,
+		"FIPS":           false,
+		"implementation": "Go",
+		"passwordHash":   "bcrypt",
+	}
+}
+
+// parseCryptoDiagnostics converts the crypto diagnostics into an appropriate
+// format for marshaling to JSON in the /debug/vars format.
+func parseCryptoDiagnostics(d *diagnostics.Diagnostics) (map[string]interface{}, error) {
+	// No defaults (eg ossCryptoDiagnostics) to avoid lying if values are missing
+	m := make(map[string]interface{})
+
+	for key := range m {
+		// Find the associated column.
+		ci := -1
+		for i, col := range d.Columns {
+			if col == key {
+				ci = i
+				break
+			}
+		}
+
+		// Don't error out if we can't find the column or cell for a given key.
+		// There could still be useful information we gather.
+		if ci == -1 { // column not found
+			continue
+		}
+		if len(d.Rows) < 1 || len(d.Rows[0]) <= ci { // data cell not found
+			continue
+		}
+
+		m[key] = d.Rows[0][ci]
+	}
+	return m, nil
+}
+
 // httpError writes an error to the client in a standard format.
 func (h *Handler) httpError(w http.ResponseWriter, errmsg string, code int) {
 	if code == http.StatusUnauthorized {

services/httpd/handler_test.go

@@ -2645,6 +2645,7 @@ func TestHandlerDebugVars(t *testing.T) {
 			h := NewHandler(false)
 			h.Monitor.StatisticsFn = func(_ map[string]string) ([]*monitor.Statistic, error) {
 				return stats(
+					stat("crypto", tags("FIPS", "ensureFIPS", "passwordHash", "implementation"), nil),
 					stat("database", tags("database", "foo"), nil),
 					stat("hh", tags("path", "/mnt/foo/bar"), nil),
 					stat("httpd", tags("bind", "127.0.0.1:8088", "proto", "https"), nil),
@@ -2656,7 +2657,7 @@ func TestHandlerDebugVars(t *testing.T) {
 			w := httptest.NewRecorder()
 			h.ServeHTTP(w, req)
 			got := keys(read(t, w.Body, Ignored...))
-			exp := []string{"database:foo", "hh:/mnt/foo/bar", "httpd:https:127.0.0.1:8088", "other", "shard:/mnt/foo:111"}
+			exp := []string{"crypto", "database:foo", "hh:/mnt/foo/bar", "httpd:https:127.0.0.1:8088", "other", "shard:/mnt/foo:111"}
 			if !cmp.Equal(got, exp) {
 				t.Errorf("unexpected keys; -got/+exp\n%s", cmp.Diff(got, exp))
 			}
@@ -2677,6 +2678,12 @@ func TestHandlerDebugVars(t *testing.T) {
 			h.ServeHTTP(w, req)
 			got := read(t, w.Body, Ignored...)
 			exp := map[string]interface{}{
+				"crypto": map[string]interface{}{
+					"FIPS":           false,
+					"ensureFIPS":     false,
+					"passwordHash":   "bcrypt",
+					"implementation": "Go",
+				},
 				"hh_processor": map[string]interface{}{
 					"name":   "hh_processor",
 					"tags":   map[string]interface{}{"db": "foo", "shardID": "10"},