Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\))
Subject: Re: Support for NSS as a libpq TLS backend
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: <4b4e3a27cc56921d2acba2c25823fd2fc325b842.camel@vmware.com>
Date: Wed, 17 Feb 2021 22:19:35 +0100
Cc: "thomas.munro@gmail.com" <thomas.munro@gmail.com>,
 "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>,
 "sfrost@snowman.net" <sfrost@snowman.net>
Content-Transfer-Encoding: quoted-printable
Message-Id: <06EFBB38-C0D2-440F-95CB-9B3AE4F97E82@yesql.se>
References: <FAB21FC8-0F62-434F-AA78-6BD9336D630A@yesql.se>
 <C066809B-0D9C-4262-A7B4-1CB45450C0E9@yesql.se>
 <B0C862B8-198D-453E-8E10-2A18CE2B9B3A@yesql.se>
 <CA+hUKGLpx6KZJOf=iPQNs_aJjJqVKWM4MuDUES_nUXpfk9ysoA@mail.gmail.com>
 <3D2C67F8-7EE6-4534-BE8A-BDD828562672@yesql.se>
 <383EE7EE-ADEE-4C48-8E7B-28B361E5EA3B@yesql.se>
 <054312F2-4D32-4ED9-A6A9-CA05221858CF@yesql.se>
 <4b4e3a27cc56921d2acba2c25823fd2fc325b842.camel@vmware.com>
To: Jacob Champion <pchampion@vmware.com>
Precedence: bulk

> On 17 Feb 2021, at 02:02, Jacob Champion <pchampion@vmware.com> wrote:

> On Mon, 2020-07-20 at 15:35 +0200, Daniel Gustafsson wrote:
>> This version adds support for sslinfo on NSS for most the functions.
>=20
> I've poked around to see what can be done about the
> unimplemented ssl_client_dn_field/ssl_issuer_field functions. There's =
a
> nasty soup of specs to wade around in, and it's not really clear to me
> which ones take precedence since they're mostly centered on LDAP.

Thanks for digging!

> we could hardcode the list of OpenSSL-compatible names, and just
> translate manually in sslinfo. Then leave the rest up to =
dotted-decimal=20
> OIDs.
>=20
> Would that be desirable, or do we want this interface to be something
> more generally compatible with (some as-of-yet unspecified) spec?

Regardless of approach taken I think this sounds like something that =
should be
tackled in a follow-up patch if the NSS patch is merged - and probably =
only as
a follow-up to a patch that adds test coverage to sslinfo.  =46rom the =
sounds of
things me may not be able to guarantee stability across OpenSSL versions =
as it
is right now?

--
Daniel Gustafsson		https://vmware.com/