Re: Support for NSS as a libpq TLS backend

Michael Paquier <michael@paquier.xyz>

From: Michael Paquier <michael@paquier.xyz>

To: Daniel Gustafsson <daniel@yesql.se>

Cc: Stephen Frost <sfrost@snowman.net>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>, Jacob Champion <pchampion@vmware.com>, "hlinnaka@iki.fi" <hlinnaka@iki.fi>, "andrew.dunstan@2ndquadrant.com" <andrew.dunstan@2ndquadrant.com>, "thomas.munro@gmail.com" <thomas.munro@gmail.com>, "andres@anarazel.de" <andres@anarazel.de>

Date: 2021-04-05T02:12:22Z

Lists: pgsql-hackers

Attachments

v35-0001-nss-Support-libnss-as-TLS-library-in-libpq.patch (text/x-diff) patch v35-0001
v35-0002-Refactor-SSL-testharness-for-multiple-library.patch (text/x-diff) patch v35-0002
v35-0003-nss-Add-NSS-specific-tests.patch (text/x-diff) patch v35-0003
v35-0004-nss-pg_strong_random-support.patch (text/x-diff) patch v35-0004
v35-0005-nss-Documentation.patch (text/x-diff) patch v35-0005
v35-0006-nss-Support-NSS-in-pgcrypto.patch (text/x-diff) patch v35-0006
v35-0007-nss-Support-NSS-in-sslinfo.patch (text/x-diff) patch v35-0007
v35-0008-nss-Support-NSS-in-cryptohash.patch (text/x-diff) patch v35-0008
v35-0009-nss-Build-infrastructure.patch (text/x-diff) patch v35-0009

On Mon, Apr 05, 2021 at 12:13:43AM +0200, Daniel Gustafsson wrote:
> Another rebase to cope with recent changes (hmac, ssl tests etc) that
> conflicted and broke this patchset.

Please find an updated set, v35, attached, and my apologies for
breaking again your patch set.  While testing this patch set and
adjusting the SSL tests with HEAD, I have noticed what looks like a
bug with the DN mapping that NSS does not run.  The connection strings
are the same in v35 and in v34, with dbname only changing in-between.

Just to be sure, because I could have done something wrong with the
rebase of v35, I have done the same test with v34 applied on top of
dfc843d and things are failing.  So it seems to me that there is an
issue with the DN mapping part.
--
Michael

Commits

Add tab-completion for CREATE FOREIGN TABLE.
- 74527c3e022d 15.0 cited
Add tap tests for the schema publications.
- 6b0f6f79eef2 15.0 cited
Move Perl test modules to a better namespace
- b3b4d8e68ae8 15.0 cited
Adjust configure to insist on Perl version >= 5.8.3.
- 92e6a98c3636 15.0 cited
Simplify code related to compilation of SSL and OpenSSL
- 092b785fad3d 14.0 landed
Introduce --with-ssl={openssl} as a configure option
- fe61df7f82aa 14.0 landed
Implement support for bulk inserts in postgres_fdw
- b663a4136331 14.0 cited
Fix redundant error messages in client tools
- 6be725e70161 14.0 cited
doc: Apply more consistently <productname> markup for OpenSSL
- 089da3c4778f 14.0 landed
Check ssl_in_use flag when reporting statistics
- 6a5c750f3f72 14.0 cited