Re: Support for NSS as a libpq TLS backend
Daniel Gustafsson <daniel@yesql.se>
From: Daniel Gustafsson <daniel@yesql.se>
To: Jacob Champion <pchampion@vmware.com>
Cc: "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>,
"hlinnaka@iki.fi" <hlinnaka@iki.fi>,
"andrew.dunstan@2ndquadrant.com" <andrew.dunstan@2ndquadrant.com>,
"sfrost@snowman.net" <sfrost@snowman.net>,
"thomas.munro@gmail.com" <thomas.munro@gmail.com>,
"michael@paquier.xyz" <michael@paquier.xyz>,
"andres@anarazel.de" <andres@anarazel.de>
Date: 2021-07-26T13:26:16Z
Lists: pgsql-hackers
Attachments
- v39-0010-nss-Build-infrastructure.patch (application/octet-stream) patch v39-0010
- v39-0009-nss-Support-NSS-in-cryptohash.patch (application/octet-stream) patch v39-0009
- v39-0008-nss-Support-NSS-in-sslinfo.patch (application/octet-stream) patch v39-0008
- v39-0007-nss-Support-NSS-in-pgcrypto.patch (application/octet-stream) patch v39-0007
- v39-0006-nss-Documentation.patch (application/octet-stream) patch v39-0006
- v39-0005-nss-pg_strong_random-support.patch (application/octet-stream) patch v39-0005
- v39-0004-test-check-for-empty-stderr-during-connect_ok.patch (application/octet-stream) patch v39-0004
- v39-0003-nss-Add-NSS-specific-tests.patch (application/octet-stream) patch v39-0003
- v39-0002-Refactor-SSL-testharness-for-multiple-library.patch (application/octet-stream) patch v39-0002
- v39-0001-nss-Support-libnss-as-TLS-library-in-libpq.patch (application/octet-stream) patch v39-0001
> On 19 Jul 2021, at 21:33, Jacob Champion <pchampion@vmware.com> wrote: > ..client connections will crash if > hostaddr is provided rather than host, because SSL_SetURL can't handle > a NULL argument. I'm running with 0002 to fix it for the moment, but > I'm not sure yet if it does the right thing for IP addresses, which the > OpenSSL side has a special case for. AFAICT the idea is to handle it in the cert auth callback, so I've added some PoC code to check for sslsni there and updated the TODO comment to reflect that. I've applied your patches in the attached rebase which passes all tests for me. -- Daniel Gustafsson https://vmware.com/
Commits
-
Add tab-completion for CREATE FOREIGN TABLE.
- 74527c3e022d 15.0 cited
-
Add tap tests for the schema publications.
- 6b0f6f79eef2 15.0 cited
-
Move Perl test modules to a better namespace
- b3b4d8e68ae8 15.0 cited
-
Adjust configure to insist on Perl version >= 5.8.3.
- 92e6a98c3636 15.0 cited
-
Simplify code related to compilation of SSL and OpenSSL
- 092b785fad3d 14.0 landed
-
Introduce --with-ssl={openssl} as a configure option
- fe61df7f82aa 14.0 landed
-
Implement support for bulk inserts in postgres_fdw
- b663a4136331 14.0 cited
-
Fix redundant error messages in client tools
- 6be725e70161 14.0 cited
-
doc: Apply more consistently <productname> markup for OpenSSL
- 089da3c4778f 14.0 landed
-
Check ssl_in_use flag when reporting statistics
- 6a5c750f3f72 14.0 cited