pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
To: Jacob Champion <jchampion@timescale.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Log details for client certificate failures
Date: Thu, 7 Jul 2022 11:50:08 +0200
Message-ID: <61aa4b6c-9de2-d61b-821a-a34ab1e515e2@enterprisedb.com> (raw)
In-Reply-To: <CAAWbhmiHyYajeN-SGRo_Nix+XbLtMyVkWinAoFVFy1kpbWT-zg@mail.gmail.com>
References: <d13c4a5787c2a3f83705124f0391e0738c796751.camel@vmware.com>
	<cd03fa63-d4d9-8d3b-f9f5-13206a28d888@enterprisedb.com>
	<a922e857c4e4a073f219bc5005b862eb22255c20.camel@vmware.com>
	<290871e5-f1d9-54a8-5df4-dbd9e604c08d@enterprisedb.com>
	<7c0468dcadbc0d0c987daf9ca08c8d111948eae6.camel@vmware.com>
	<9b8338210b865d79239ec35ca523792ce331c0a3.camel@vmware.com>
	<c60a8948-00a0-147d-75df-62699193371f@enterprisedb.com>
	<CAAWbhmggsEacYW+cahN7USucsTgK9P4c5VMLaxWRdXvGQ=+BHA@mail.gmail.com>
	<CAAWbhmiHyYajeN-SGRo_Nix+XbLtMyVkWinAoFVFy1kpbWT-zg@mail.gmail.com>

On 05.07.22 18:34, Jacob Champion wrote:
> On Fri, Jul 1, 2022 at 1:51 PM Jacob Champion <jchampion@timescale.com> wrote:
>> Sorry for the misunderstanding! v3 adds the Issuer to the logs as well.
> 
> Resending v3; I messed up the certificate diff with my gitconfig.

This patch looks pretty good to me.  Some minor details:

I looked into how you decode the serial number.  I have found some code 
elsewhere that passed the result of X509_get_serialNumber() directly to 
ASN1_INTEGER_set().  But I guess a serial number of maximum length 20 
octets wouldn't fit into a 32-bit long.  (There is 
ASN1_INTEGER_set_int64(), but that requires OpenSSL 1.1.0.)  Does that 
match your understanding?

For the detail string, I think we could do something like:

DETAIL:  Failed certificate data (unverified): subject '%s', serial 
number %s, issuer '%s'





view thread (54+ messages)  latest in thread

Message-ID: <61aa4b6c-9de2-d61b-821a-a34ab1e515e2@enterprisedb.com>
Permalink:  ../61aa4b6c-9de2-d61b-821a-a34ab1e515e2@enterprisedb.com/
Also on:    postgresql.org/message-id/61aa4b6c-9de2-d61b-821a-a34ab1e515e2@enterprisedb.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: peter.eisentraut@enterprisedb.com, jchampion@timescale.com
  Subject: Re: [PATCH] Log details for client certificate failures
  In-Reply-To: <61aa4b6c-9de2-d61b-821a-a34ab1e515e2@enterprisedb.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox