Re: Support for NSS as a libpq TLS backend

Daniel Gustafsson <daniel@yesql.se>

From: Daniel Gustafsson <daniel@yesql.se>

To: Andres Freund <andres@anarazel.de>

Cc: Postgres hackers <pgsql-hackers@lists.postgresql.org>, Michael Paquier <michael@paquier.xyz>, Andrew Dunstan <andrew.dunstan@2ndquadrant.com>, Stephen Frost <sfrost@snowman.net>, Thomas Munro <thomas.munro@gmail.com>

Date: 2020-10-28T10:56:26Z

Lists: pgsql-hackers

Attachments

v14-0001-NSS-Frontend-Backend-and-build-infra.patch (application/octet-stream) patch v14-0001
v14-0002-NSS-Testharness-updates.patch (application/octet-stream) patch v14-0002
v14-0003-NSS-pg_strong_random-support.patch (application/octet-stream) patch v14-0003
v14-0004-NSS-Documentation.patch (application/octet-stream) patch v14-0004
v14-0005-NSS-contrib-modules.patch (application/octet-stream) patch v14-0005
v14-0006-NSS-to-be-submitted-separately.patch (application/octet-stream) patch v14-0006

>>> Personally I'd like to see this patch broken up a bit - it's quite
>>> large. Several of the changes could easily be committed separately, no?
>> 
>> Not sure how much of this makes sense committed separately (unless separately
>> means in quick succession), but it could certainly be broken up for the sake of
>> making review easier.
> 
> Committing e.g. the pgcrypto pieces separately from the backend code
> seems unproblematic. But yes, I would expect them to go in close to each
> other. I'm mainly concerned with smaller review-able units.

Attached is a v14 where the logical units are separated into individual
commits.  I hope this split makes it easier to read.

The 0006 commit were things not really related to NSS at all that can be
submitted to -hackers independently of this work, but they're still there since
this version wasn't supposed to change anything.

Most of the changes to sslinfo in 0005 are really only needed in case OpenSSL
isn't the only TLS library, but I would argue that they should be considered
regardless.  There we are still accessing the ->ssl member directly and passing
it to OpenSSL rather than using the be_tls_* API that we have.  I can extract
that portion as a separate patch submission unless there are objections.

cheers ./daniel

Commits

Add tab-completion for CREATE FOREIGN TABLE.
- 74527c3e022d 15.0 cited
Add tap tests for the schema publications.
- 6b0f6f79eef2 15.0 cited
Move Perl test modules to a better namespace
- b3b4d8e68ae8 15.0 cited
Adjust configure to insist on Perl version >= 5.8.3.
- 92e6a98c3636 15.0 cited
Simplify code related to compilation of SSL and OpenSSL
- 092b785fad3d 14.0 landed
Introduce --with-ssl={openssl} as a configure option
- fe61df7f82aa 14.0 landed
Implement support for bulk inserts in postgres_fdw
- b663a4136331 14.0 cited
Fix redundant error messages in client tools
- 6be725e70161 14.0 cited
doc: Apply more consistently <productname> markup for OpenSSL
- 089da3c4778f 14.0 landed
Check ssl_in_use flag when reporting statistics
- 6a5c750f3f72 14.0 cited