Re: Support for NSS as a libpq TLS backend

Jacob Champion <pchampion@vmware.com>

From: Jacob Champion <pchampion@vmware.com>

To: "daniel@yesql.se" <daniel@yesql.se>

Cc: "hlinnaka@iki.fi" <hlinnaka@iki.fi>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>, "andrew.dunstan@2ndquadrant.com" <andrew.dunstan@2ndquadrant.com>, "sfrost@snowman.net" <sfrost@snowman.net>, "thomas.munro@gmail.com" <thomas.munro@gmail.com>, "michael@paquier.xyz" <michael@paquier.xyz>, "andres@anarazel.de" <andres@anarazel.de>

Date: 2021-01-20T17:07:08Z

Lists: pgsql-hackers

Attachments

since-v22.diff (text/x-patch) patch v22
v23-0001-NSS-Frontend-Backend-and-build-infrastructure.patch (text/x-patch) patch v23-0001
v23-0002-NSS-Testharness-updates.patch (text/x-patch) patch v23-0002
v23-0003-NSS-pg_strong_random-support.patch (text/x-patch) patch v23-0003
v23-0004-NSS-Documentation.patch (text/x-patch) patch v23-0004
v23-0005-NSS-contrib-modules.patch (text/x-patch) patch v23-0005
v23-0006-NSS-cryptohash-support.patch (text/x-patch) patch v23-0006

On Wed, 2021-01-20 at 12:58 +0100, Daniel Gustafsson wrote:
> Aha, that was a good clue, I had overlooked the required extensions in the CSR.
> Re-reading RFC 5280 it seems we need keyEncipherment, dataEncipherment and
> digitalSignature to create a valid SSL Server certificate.  Adding those indeed
> make the test pass.  Skimming the certutil code *I think* removing it as you
> did cause a set of defaults to kick in that made it work based on the parameter
> "--nsCertType sslServer", but it's not entirely easy to make out.

Lovely. I didn't expect *removing* an extension to effectively *add*
more, but I'm glad it works now.

==

To continue the Subject Common Name discussion [1] from a different
part of the thread:

Attached is a v23 version of the patchset that peels the raw Common
Name out from a client cert's Subject. This allows the following cases
that the OpenSSL implementation currently handles:

- subjects that don't begin with a CN
- subjects with quotable characters
- subjects that have no CN at all
Embedded NULLs are now handled in a similar manner to the OpenSSL side,
though because this failure happens during the certificate
authentication callback, it results in a TLS alert rather than simply
closing the connection.

For easier review of just the parts I've changed, I've also attached a
since-v22.diff, which is part of the 0001 patch.

--Jacob

[1] 
https://www.postgresql.org/message-id/7d6a23a7e30540b486abc823f7ced7a93e1da1e8.camel%40vmware.com

Commits

Add tab-completion for CREATE FOREIGN TABLE.
- 74527c3e022d 15.0 cited
Add tap tests for the schema publications.
- 6b0f6f79eef2 15.0 cited
Move Perl test modules to a better namespace
- b3b4d8e68ae8 15.0 cited
Adjust configure to insist on Perl version >= 5.8.3.
- 92e6a98c3636 15.0 cited
Simplify code related to compilation of SSL and OpenSSL
- 092b785fad3d 14.0 landed
Introduce --with-ssl={openssl} as a configure option
- fe61df7f82aa 14.0 landed
Implement support for bulk inserts in postgres_fdw
- b663a4136331 14.0 cited
Fix redundant error messages in client tools
- 6be725e70161 14.0 cited
doc: Apply more consistently <productname> markup for OpenSSL
- 089da3c4778f 14.0 landed
Check ssl_in_use flag when reporting statistics
- 6a5c750f3f72 14.0 cited