pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Michael Paquier <michael@paquier.xyz>
To: Jacob Champion <jchampion@timescale.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Cc: Aleksander Alekseev <aleksander@timescale.com>
Cc: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Cc: David G. Johnston <david.g.johnston@gmail.com>
Subject: Re: [PoC] Let libpq reject unexpected authentication requests
Date: Fri, 24 Mar 2023 14:18:02 +0900
Message-ID: <ZB0yitjRNWE9Aimc@paquier.xyz> (raw)
In-Reply-To: <CAAWbhmjoOzcwXvOjhBf7gP1WFirL+JDMnDWT76ocozt_x-UJVQ@mail.gmail.com>
References: <CAAWbhmjRHYG_HN-yuej5Q7tUYuViodXm7BusjUkUyv2fW-+KPQ@mail.gmail.com>
	<ZAl+Lj+4Q8+aHimx@paquier.xyz>
	<c136387c-731e-729b-a49f-c1f17768aaf0@timescale.com>
	<ZAu4rdSKQTHvBqS7@paquier.xyz>
	<CAAWbhmgNoAp2gfdzrH0BmYbmsMo-k4FjN2OAhtLm0VjaS_9=Cg@mail.gmail.com>
	<CAAWbhmg+GzNMK5Li182BKSbzoFVaKk_dDJ628NnuV80GqYgFFg@mail.gmail.com>
	<ZBAIe1gnGxknLT7t@paquier.xyz>
	<CAAWbhmiotN3k6q5Q5SnPe=5P1V8Vq=XKkuZQf5UprPhNiUAv_A@mail.gmail.com>
	<ZBqZl+mTiHqWJ2Yr@paquier.xyz>
	<CAAWbhmjoOzcwXvOjhBf7gP1WFirL+JDMnDWT76ocozt_x-UJVQ@mail.gmail.com>

On Thu, Mar 23, 2023 at 03:40:55PM -0700, Jacob Champion wrote:
> On Tue, Mar 21, 2023 at 11:01 PM Michael Paquier <michael@paquier.xyz> wrote:
>> contrib/sslinfo/ has ssl_client_cert_present(), that we could use in
>> the tests to make sure that the client has actually sent a
>> certificate?  How about adding some of these tests to 003_sslinfo.pl
>> for the "allow" and "require" cases?
> 
> Added; see what you think.

That's a pretty good test design, covering all 4 cases.  Nice.

>> freePGconn() is missing a free(sslcertmode).
> 
> Argh, I keep forgetting that. Fixed, thanks!

I have spent a couple of hours looking at the whole again today,
testing that with OpenSSL to make sure that everything was OK.  Apart
from a few tweaks, that seemed pretty good.  So, applied.
--
Michael

Attachments:

  signature.asc (application/pgp-signature, 832B) download

view thread (64+ messages)  latest in thread

Message-ID: <ZB0yitjRNWE9Aimc@paquier.xyz>
Permalink:  ../ZB0yitjRNWE9Aimc@paquier.xyz/
Also on:    postgresql.org/message-id/ZB0yitjRNWE9Aimc@paquier.xyz

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: michael@paquier.xyz, jchampion@timescale.com, aleksander@timescale.com, peter.eisentraut@enterprisedb.com, david.g.johnston@gmail.com
  Subject: Re: [PoC] Let libpq reject unexpected authentication requests
  In-Reply-To: <ZB0yitjRNWE9Aimc@paquier.xyz>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox