From: Jacob Champion <pchampion@vmware.com>
To: Daniel Gustafsson <daniel@yesql.se>
CC: Heikki Linnakangas <hlinnaka@iki.fi>, Andres Freund <andres@anarazel.de>,
	Postgres hackers <pgsql-hackers@lists.postgresql.org>, Michael Paquier
	<michael@paquier.xyz>, Andrew Dunstan <andrew.dunstan@2ndquadrant.com>,
	Stephen Frost <sfrost@snowman.net>, Thomas Munro <thomas.munro@gmail.com>
Subject: Re: Support for NSS as a libpq TLS backend
Thread-Topic: Support for NSS as a libpq TLS backend
Thread-Index: 
 AQHWM1w61GrKUIsl6UCBcYrYNRBt46kJRsIAgAA+PQCAGQsiAIAEdGUAgAAqk4CAAbpsAIABgI0AgCnqVACAA5UBgIAAY+MAgBTX7ACAACGAAIASngCAgAAfeICABYLFgIAbyjgAgABy24CACw63gIAAAzWAgAwa5QCAA6HPgA==
Date: Fri, 6 Nov 2020 20:37:48 +0000
Message-ID: <0E64F3CB-4731-4FA8-82D8-D8590086654C@vmware.com>
References: <e3c34e7b-900e-7e32-f60b-a278a1eb743a@2ndQuadrant.com>
 <DA91E5F0-5F9D-41A7-A7A6-B91CDE0F1D63@yesql.se>
 <CAA8=A7-suZg90M7Fgyo1Rfymkrpdh_Z547RKXrbHirsAmojQSw@mail.gmail.com>
 <20200904012334.GF19499@paquier.xyz> <20200917074134.GX2873@paquier.xyz>
 <BAD11CCA-E712-4906-8A27-94C2AA0E696E@yesql.se>
 <20200929055939.GF7117@paquier.xyz>
 <DE377D9A-BFFC-492C-A2B8-2AE6EBBBE740@yesql.se>
 <411593A7-E037-474D-BFD7-D3D6683C1D46@yesql.se>
 <B1ADEE76-3E33-4E9D-B830-3AA89B1C42D2@yesql.se>
 <20201020191529.5yverw3ybaube3pg@alap3.anarazel.de>
 <907FA7D1-9BD9-464B-A6EC-DEEB53438D36@yesql.se>
 <7ed636a0-872c-3ea7-dc44-b35dd515bb87@iki.fi>
 <02260088-E0C9-49A2-ACD3-CE51D65A84E3@yesql.se>
In-Reply-To: <02260088-E0C9-49A2-ACD3-CE51D65A84E3@yesql.se>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-ID: <23F1506C58575B40A8999D77E9534380@namprd05.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 1a0d2e4c-6cc1-4beb-eed6-08d88293d2d9
X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Nov 2020 20:37:48.1576
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: b39138ca-3cee-4b4a-a4d6-cd83d9dd62f0
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 
 m0oSh0EyETJaPgfEBvz/omMnbZ+wlSj9MHpyTOFgxHBXM7+kA+C5h3ZhH3i5G6IfdQADuCDcXExuWZb132V3Xg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR0501MB3724
List-Id: <pgsql-hackers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-hackers@lists.postgresql.org>
List-Owner: <mailto:pgsql-hackers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-hackers>
Precedence: bulk

On Nov 4, 2020, at 5:09 AM, Daniel Gustafsson <daniel@yesql.se> wrote:

> (sorry for slow response).  You are absolutely right, the has_password fl=
ag
> must be tracked per connection in PGconn.  The attached v17 implements th=
is as
> well a frontend bugfix which caused dropped connections and some smaller =
fixups
> to make strings more translateable.

Some initial notes from building and testing on macOS Mojave. I'm working w=
ith
both a brew-packaged NSS/NSPR (which includes basic nss-/nspr-config) and a
hand-built NSS/NSPR (which does not).

1. In configure.ac:

> +  LDFLAGS=3D"$LDFLAGS $NSS_LIBS $NSPR_LIBS"
> +  CFLAGS=3D"$CFLAGS $NSS_CFLAGS $NSPR_CFLAGS"
> +
> +  AC_CHECK_LIB(nss3, SSL_VersionRangeSet, [], [AC_MSG_ERROR([library 'ns=
s3' is required for NSS])])

Looks like SSL_VersionRangeSet is part of libssl3, not libnss3. So this fai=
ls
with the hand-built stack, where there is no nss-config to populate LDFLAGS=
. I
changed the function to NSS_InitContext and that seems to work nicely.

2. Among the things to eventually think about when it comes to configuring,=
 it
looks like some platforms [1] install the headers under <nspr4/...> and
<nss3/...> instead of <nspr/...> and <nss/...>. It's unfortunate that the N=
SS
maintainers never chose an official installation layout.

3. I need two more `#define NO_NSPR_10_SUPPORT` guards added in both

  src/include/common/pg_nss.h
  src/port/pg_strong_random.c

before the tree will compile for me. Both of those files include NSS header=
s.

4. be_tls_init() refuses to run correctly for me; I end up getting an NSPR
assertion that looks like

  sslMutex_Init not implemented for multi-process applications !

With assertions disabled, this ends up showing a somewhat unhelpful

  FATAL:  unable to set up TLS connection cache: security library failure. =
(SEC_ERROR_LIBRARY_FAILURE)

It looks like cross-process locking isn't actually enabled on macOS, which =
is a
long-standing bug in NSPR [2, 3]. So calls to SSL_ConfigMPServerSIDCache()
error out.

--Jacob

[1] https://github.com/erthink/ReOpenLDAP/issues/112
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=3D538680
[3] https://bugzilla.mozilla.org/show_bug.cgi?id=3D1192500