Feedback-ID: i131946ab:Fastmail
Message-ID: <c60a8948-00a0-147d-75df-62699193371f@enterprisedb.com>
Date: Thu, 30 Jun 2022 10:43:21 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0)
 Gecko/20100101 Thunderbird/91.10.0
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Subject: Re: [PATCH] Log details for client certificate failures
To: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>,
 Jacob Champion <jchampion@timescale.com>
References: <d13c4a5787c2a3f83705124f0391e0738c796751.camel@vmware.com>
 <cd03fa63-d4d9-8d3b-f9f5-13206a28d888@enterprisedb.com>
 <a922e857c4e4a073f219bc5005b862eb22255c20.camel@vmware.com>
 <290871e5-f1d9-54a8-5df4-dbd9e604c08d@enterprisedb.com>
 <7c0468dcadbc0d0c987daf9ca08c8d111948eae6.camel@vmware.com>
 <9b8338210b865d79239ec35ca523792ce331c0a3.camel@vmware.com>
Content-Language: en-US
In-Reply-To: <9b8338210b865d79239ec35ca523792ce331c0a3.camel@vmware.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/c60a8948-00a0-147d-75df-62699193371f%40enterprisedb.com>
Precedence: bulk

On 13.05.22 00:36, Jacob Champion wrote:
> On Thu, 2022-05-05 at 15:12 +0000, Jacob Champion wrote:
>> On Wed, 2022-05-04 at 15:53 +0200, Peter Eisentraut wrote:
>>> In terms of aligning what is printed, I meant that pg_stat_ssl uses the
>>> issuer plus serial number to identify the certificate unambiguously.
>>
>> Oh, that's a great idea. I'll do that too.
> 
> v2 limits the maximum subject length and adds the serial number to the
> logs.

I wrote that pg_stat_ssl uses the *issuer* plus serial number to 
identify a certificate.  What your patch shows is the subject and the 
serial number, which isn't the same thing.  Let's get that sorted out 
one way or the other.

Another point, your patch produces

     LOG:  connection received: host=localhost port=44120
     LOG:  client certificate verification failed at depth 1: ...
     DETAIL:  failed certificate had subject ...
     LOG:  could not accept SSL connection: certificate verify failed

I guess what we really would like is

     LOG:  connection received: host=localhost port=44120
     LOG:  could not accept SSL connection: certificate verify failed
     DETAIL:  client certificate verification failed at depth 1: ...
     failed certificate had subject ...

But I suppose that would be very cumbersome to produce with the callback 
structure provided by OpenSSL?

I'm not saying the proposed way is unacceptable, but maybe it's worth 
being explicit about this tradeoff.