Re: Support for NSS as a libpq TLS backend

Daniel Gustafsson <daniel@yesql.se>

From: Daniel Gustafsson <daniel@yesql.se>

To: Jacob Champion <pchampion@vmware.com>

Cc: "michael@paquier.xyz" <michael@paquier.xyz>, "hlinnaka@iki.fi" <hlinnaka@iki.fi>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>, "andrew.dunstan@2ndquadrant.com" <andrew.dunstan@2ndquadrant.com>, "thomas.munro@gmail.com" <thomas.munro@gmail.com>, "andres@anarazel.de" <andres@anarazel.de>, "sfrost@snowman.net" <sfrost@snowman.net>

Date: 2021-01-20T11:58:13Z

Lists: pgsql-hackers

Attachments

v22-0001-NSS-Frontend-Backend-and-build-infrastructure.patch (application/octet-stream) patch v22-0001
v22-0002-NSS-Testharness-updates.patch (application/octet-stream) patch v22-0002
v22-0003-NSS-pg_strong_random-support.patch (application/octet-stream) patch v22-0003
v22-0004-NSS-Documentation.patch (application/octet-stream) patch v22-0004
v22-0005-NSS-contrib-modules.patch (application/octet-stream) patch v22-0005
v22-0006-NSS-cryptohash-support.patch (application/octet-stream) patch v22-0006

> On 20 Jan 2021, at 01:40, Jacob Champion <pchampion@vmware.com> wrote:
> 
> On Tue, 2021-01-19 at 21:21 +0100, Daniel Gustafsson wrote:
>> There is something iffy with these certs (the test fails
>> on mismatching ciphers and/or signature algorithms) that I haven't been able to
>> pin down, but to get more eyes on this I'm posting the patch with the test
>> enabled.
> 
> Removing `--keyUsage keyEncipherment` from the native_server-* CSR
> generation seems to let the tests pass for me, but I'm wary of just
> pushing that as a solution because I don't understand why that would
> have anything to do with the failure mode
> (SSL_ERROR_NO_SUPPORTED_SIGNATURE_ALGORITHM).

Aha, that was a good clue, I had overlooked the required extensions in the CSR.
Re-reading RFC 5280 it seems we need keyEncipherment, dataEncipherment and
digitalSignature to create a valid SSL Server certificate.  Adding those indeed
make the test pass.  Skimming the certutil code *I think* removing it as you
did cause a set of defaults to kick in that made it work based on the parameter
"--nsCertType sslServer", but it's not entirely easy to make out.  Either way,
relying on defaults in a test suite seems less than good, so I've extended the
Makefile to be explicit about the extensions.

The attached v22 rebase incorporates the fixup to the test Makefile, with not
further changes on top of that.

cheers ./daniel

Commits

Add tab-completion for CREATE FOREIGN TABLE.
- 74527c3e022d 15.0 cited
Add tap tests for the schema publications.
- 6b0f6f79eef2 15.0 cited
Move Perl test modules to a better namespace
- b3b4d8e68ae8 15.0 cited
Adjust configure to insist on Perl version >= 5.8.3.
- 92e6a98c3636 15.0 cited
Simplify code related to compilation of SSL and OpenSSL
- 092b785fad3d 14.0 landed
Introduce --with-ssl={openssl} as a configure option
- fe61df7f82aa 14.0 landed
Implement support for bulk inserts in postgres_fdw
- b663a4136331 14.0 cited
Fix redundant error messages in client tools
- 6be725e70161 14.0 cited
doc: Apply more consistently <productname> markup for OpenSSL
- 089da3c4778f 14.0 landed
Check ssl_in_use flag when reporting statistics
- 6a5c750f3f72 14.0 cited