Horton

Re: Support for NSS as a libpq TLS backend

Joshua Brindle <joshua.brindle@crunchydata.com>

View thread View on postgr.es
From: Joshua Brindle <joshua.brindle@crunchydata.com>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Kevin Burke <kevin@burke.dev>, Jacob Champion <pchampion@vmware.com>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>, "hlinnaka@iki.fi" <hlinnaka@iki.fi>, "andrew.dunstan@2ndquadrant.com" <andrew.dunstan@2ndquadrant.com>, "sfrost@snowman.net" <sfrost@snowman.net>, "rachelmheaton@gmail.com" <rachelmheaton@gmail.com>, "thomas.munro@gmail.com" <thomas.munro@gmail.com>, "michael@paquier.xyz" <michael@paquier.xyz>, "andres@anarazel.de" <andres@anarazel.de>
Date: 2021-11-23T22:39:12Z
Lists: pgsql-hackers 
On Tue, Nov 23, 2021 at 9:12 AM Daniel Gustafsson <daniel@yesql.se> wrote:
>
> > On 17 Nov 2021, at 19:42, Joshua Brindle <joshua.brindle@crunchydata.com> wrote:
> > On Tue, Nov 16, 2021 at 1:26 PM Joshua Brindle
> > <joshua.brindle@crunchydata.com> wrote:
>
> >> I think there it a typo in the docs here that prevents them from
> >> building (this diff seems to fix it):
>
> Ah yes, thanks, I had noticed that one but forgot to send out a new version to
> make the CFBot green.
>
> > After a bit more testing, the server is up and running with an nss
> > database but before configuring the client database I tried connecting
> > and got a segfault:
>
> Interesting.  I'm unable to reproduce this crash, can you show the sequence of
> commands which led to this?

It no longer happens with v49, since it was a null deref of the pr_fd
which no longer happens.

I'll continue testing now, so far it's looking better.

Did the build issue with --with-llvm get fixed in this update also? I
haven't tried building with it yet.

> > It looks like the ssl connection falls through to attempt a non-ssl
> > connection but at some point conn->ssl_in_use gets set to true,
> > despite pr_fd and nss_context being null.
>
> pgtls_close missed setting ssl_in_use to false, fixed in the attached.  I've
> also added some assertions to the connection setup for debugging this.
>
> > This patch fixes the segfault but I suspect is not the correct fix,
> > due to the error when connecting saying "Success":
>
> Right, without an SSL enabled FD we should never get here.
>

Thank you.

Commits

  1. Add tab-completion for CREATE FOREIGN TABLE.

  2. Add tap tests for the schema publications.

  3. Move Perl test modules to a better namespace

  4. Adjust configure to insist on Perl version >= 5.8.3.

  5. Simplify code related to compilation of SSL and OpenSSL

  6. Introduce --with-ssl={openssl} as a configure option

  7. Implement support for bulk inserts in postgres_fdw

  8. Fix redundant error messages in client tools

  9. doc: Apply more consistently <productname> markup for OpenSSL

  10. Check ssl_in_use flag when reporting statistics