Feedback-ID: i0fe9450f:Fastmail
Date: Fri, 24 Mar 2023 14:18:02 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Jacob Champion <jchampion@timescale.com>
Cc: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>,
	Aleksander Alekseev <aleksander@timescale.com>,
	Peter Eisentraut <peter.eisentraut@enterprisedb.com>,
	"David G. Johnston" <david.g.johnston@gmail.com>
Subject: Re: [PoC] Let libpq reject unexpected authentication requests
Message-ID: <ZB0yitjRNWE9Aimc@paquier.xyz>
References: 
 <CAAWbhmjRHYG_HN-yuej5Q7tUYuViodXm7BusjUkUyv2fW-+KPQ@mail.gmail.com>
 <ZAl+Lj+4Q8+aHimx@paquier.xyz>
 <c136387c-731e-729b-a49f-c1f17768aaf0@timescale.com>
 <ZAu4rdSKQTHvBqS7@paquier.xyz>
 <CAAWbhmgNoAp2gfdzrH0BmYbmsMo-k4FjN2OAhtLm0VjaS_9=Cg@mail.gmail.com>
 <CAAWbhmg+GzNMK5Li182BKSbzoFVaKk_dDJ628NnuV80GqYgFFg@mail.gmail.com>
 <ZBAIe1gnGxknLT7t@paquier.xyz>
 <CAAWbhmiotN3k6q5Q5SnPe=5P1V8Vq=XKkuZQf5UprPhNiUAv_A@mail.gmail.com>
 <ZBqZl+mTiHqWJ2Yr@paquier.xyz>
 <CAAWbhmjoOzcwXvOjhBf7gP1WFirL+JDMnDWT76ocozt_x-UJVQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="HUU1STFRXgROOcNi"
Content-Disposition: inline
In-Reply-To: 
 <CAAWbhmjoOzcwXvOjhBf7gP1WFirL+JDMnDWT76ocozt_x-UJVQ@mail.gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/ZB0yitjRNWE9Aimc%40paquier.xyz>
Precedence: bulk


--HUU1STFRXgROOcNi
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Mar 23, 2023 at 03:40:55PM -0700, Jacob Champion wrote:
> On Tue, Mar 21, 2023 at 11:01=E2=80=AFPM Michael Paquier <michael@paquier=
=2Exyz> wrote:
>> contrib/sslinfo/ has ssl_client_cert_present(), that we could use in
>> the tests to make sure that the client has actually sent a
>> certificate?  How about adding some of these tests to 003_sslinfo.pl
>> for the "allow" and "require" cases?
>=20
> Added; see what you think.

That's a pretty good test design, covering all 4 cases.  Nice.

>> freePGconn() is missing a free(sslcertmode).
>=20
> Argh, I keep forgetting that. Fixed, thanks!

I have spent a couple of hours looking at the whole again today,
testing that with OpenSSL to make sure that everything was OK.  Apart
=66rom a few tweaks, that seemed pretty good.  So, applied.
--
Michael

--HUU1STFRXgROOcNi
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmQdMooACgkQnvQgOdby
QH3Dkg//QFSa6nr2GAhj1AsYXsJW5ZdBQCSk43tWoQjq556DQLvsppo6jyTEczik
8WLypz02yDPSlU9golHvobgAY5Ceqsv3fahmNANEGX5MpzOLctP539VWQ7bY0DPu
bziSgcdDZOlCNftQMHCDCdsd4FeyuVh61Dyg/M86s0oN2RfdlIlSvZRorjU6Ghew
lwsahY+rKNETQXWdkVGcvZE46YwSAhZKTwb4UtbqLRdYisbB8A2WaU9rqN13+UJ3
NsYGnJkKet5I59TbXkhly8NGZiEyy4M9c4IMnwIBusjJyBywJ71ghbYMcJWA+3ma
nFAcomdlPWVdlBLkyujA2aOSmKBwywNOrTvOg8qnQpxKlprjF48A83Khj/gStMRr
ucDDOR0/TK+rGI2a3MOprYfdRCtdFCG1eKQfRBpwJZ7nYKX8usZR85SoGslpxr32
2tjxFr2dq4JWvJsC1KAEPscSPcx77tocEMHxJ9Tz33UT1h6HFCtDUm5zlEqquY3U
r+/jmYN0pIQj2t3f+iT5yJ0/8WdHdDzpi3IIHp28dr+OPNA18KycggDO/EwQD37S
3cWSRiFkmz+JXwFxy2GJBM2Xp0cf138B8FkiTSjjgXaAD6cZiIzNM/0xrYLfzd6x
7b4VG3r0mM6xdVhtvd7vQtHOPLUoz7KkWnk/+19kSbWANs/bZXY=
=8ZGa
-----END PGP SIGNATURE-----

--HUU1STFRXgROOcNi--