Re: Support for NSS as a libpq TLS backend

On Wed, Nov 24, 2021 at 8:49 AM Joshua Brindle
<joshua.brindle@crunchydata.com> wrote:
>
> On Wed, Nov 24, 2021 at 8:46 AM Joshua Brindle
> <joshua.brindle@crunchydata.com> wrote:
> >
> > On Wed, Nov 24, 2021 at 6:59 AM Daniel Gustafsson <daniel@yesql.se> wrote:
> > >
> > > > On 23 Nov 2021, at 23:39, Joshua Brindle <joshua.brindle@crunchydata.com> wrote:
> > >
> > > > It no longer happens with v49, since it was a null deref of the pr_fd
> > > > which no longer happens.
> > > >
> > > > I'll continue testing now, so far it's looking better.
> > >
> > > Great, thanks for confirming.  I'm still keen on knowing how you triggered the
> > > segfault so I can ensure there are no further bugs around there.
> > >
> >
> > It happened when I ran psql with hostssl on the server but before I'd
> > initialized my client certificate store.
>
> I don't know enough about NSS to know if this is problematic or not
> but if I try verify-full without having the root CA in the certificate
> store I get:
>
> $ /usr/pgsql-15/bin/psql "host=localhost sslmode=verify-full user=postgres"
> psql: error: SSL error: Issuer certificate is invalid.
> unable to shut down NSS context: NSS could not shutdown. Objects are
> still in use.

Something is strange with ssl downgrading and a bad ssldatabase
[postgres@11cdfa30f763 ~]$ /usr/pgsql-15/bin/psql "ssldatabase=oops
sslcert=client_cert host=localhost"
Password for user postgres:

<freezes here>

On the server side:
2021-11-25 01:52:01.984 UTC [269] LOG:  unable to handshake:
Encountered end of file (PR_END_OF_FILE_ERROR)

Other than that and I still haven't tested --with-llvm I've gotten
everything working, including with an openssl client. Attached is a
dockerfile that gets to the point where a client can connect with
clientcert=verify-full. I've removed some of the old cruft and
debugging from the previous versions.

Thank you.