Feedback-ID: i131946ab:Fastmail
Message-ID: <61aa4b6c-9de2-d61b-821a-a34ab1e515e2@enterprisedb.com>
Date: Thu, 7 Jul 2022 11:50:08 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0)
 Gecko/20100101 Thunderbird/91.11.0
Subject: Re: [PATCH] Log details for client certificate failures
Content-Language: en-US
To: Jacob Champion <jchampion@timescale.com>
Cc: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
References: <d13c4a5787c2a3f83705124f0391e0738c796751.camel@vmware.com>
 <cd03fa63-d4d9-8d3b-f9f5-13206a28d888@enterprisedb.com>
 <a922e857c4e4a073f219bc5005b862eb22255c20.camel@vmware.com>
 <290871e5-f1d9-54a8-5df4-dbd9e604c08d@enterprisedb.com>
 <7c0468dcadbc0d0c987daf9ca08c8d111948eae6.camel@vmware.com>
 <9b8338210b865d79239ec35ca523792ce331c0a3.camel@vmware.com>
 <c60a8948-00a0-147d-75df-62699193371f@enterprisedb.com>
 <CAAWbhmggsEacYW+cahN7USucsTgK9P4c5VMLaxWRdXvGQ=+BHA@mail.gmail.com>
 <CAAWbhmiHyYajeN-SGRo_Nix+XbLtMyVkWinAoFVFy1kpbWT-zg@mail.gmail.com>
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
In-Reply-To: 
 <CAAWbhmiHyYajeN-SGRo_Nix+XbLtMyVkWinAoFVFy1kpbWT-zg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/61aa4b6c-9de2-d61b-821a-a34ab1e515e2%40enterprisedb.com>
Precedence: bulk

On 05.07.22 18:34, Jacob Champion wrote:
> On Fri, Jul 1, 2022 at 1:51 PM Jacob Champion <jchampion@timescale.com> wrote:
>> Sorry for the misunderstanding! v3 adds the Issuer to the logs as well.
> 
> Resending v3; I messed up the certificate diff with my gitconfig.

This patch looks pretty good to me.  Some minor details:

I looked into how you decode the serial number.  I have found some code 
elsewhere that passed the result of X509_get_serialNumber() directly to 
ASN1_INTEGER_set().  But I guess a serial number of maximum length 20 
octets wouldn't fit into a 32-bit long.  (There is 
ASN1_INTEGER_set_int64(), but that requires OpenSSL 1.1.0.)  Does that 
match your understanding?

For the detail string, I think we could do something like:

DETAIL:  Failed certificate data (unverified): subject '%s', serial 
number %s, issuer '%s'