be-secure.c patch

=?iso-8859-2?Q?Libor_Hoho=B9?= <liho@d-prog.cz> writes:

the attachement contains a simple patch to adding of verification of client=
's certificate(s)
against CRL on server side in mutual SSL authentication.
The CRL file has name "root.crl" and it must be stored in PGDATA directory.

Uh, why exactly would we want that? It sounds like it duplicates the
existing root.crt functionality.

regards, tom lane

=?iso-8859-2?Q?Libor_Hoho=B9?= <liho@d-prog.cz> writes:

It sounds like it duplicates the
existing root.crt functionality.

root.crT is file with X509 certificate of Certification Authority
root.crL is file with X509 Certificate Revocation List issued by this
Certification Authority

Oh, is that what it does? Is this documented anywhere?

regards, tom lane

This has been saved for the 8.2 release:

http://momjian.postgresql.org/cgi-bin/pgpatches_hold

---------------------------------------------------------------------------

Libor Hoho��� wrote:

Hello PG folks,
the attachement contains a simple patch to adding of verification of client's certificate(s)
against CRL on server side in mutual SSL authentication.
The CRL file has name "root.crl" and it must be stored in PGDATA directory.

With best regards
L. Hohos

[ Attachment, skipping... ]

---------------------------(end of broadcast)---------------------------
TIP 4: Have you searched our list archives?

http://archives.postgresql.org

-- 
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 359-1001
  +  If your life is a hard drive,     |  13 Roberts Road
  +  Christ can be your backup.        |  Newtown Square, Pennsylvania 19073

Does this need any documentation adjustments?

Your patch has been added to the PostgreSQL unapplied patches list at:

http://momjian.postgresql.org/cgi-bin/pgpatches

It will be applied as soon as one of the PostgreSQL committers reviews
and approves it.

---------------------------------------------------------------------------

Libor Hoho��� wrote:

Hello PG folks,
the attachement contains a simple patch to adding of verification of client's certificate(s)
against CRL on server side in mutual SSL authentication.
The CRL file has name "root.crl" and it must be stored in PGDATA directory.

With best regards
L. Hohos

[ Attachment, skipping... ]

---------------------------(end of broadcast)---------------------------
TIP 4: Have you searched our list archives?

http://archives.postgresql.org

--
Bruce Momjian http://candle.pha.pa.us
SRA OSS, Inc. http://www.sraoss.com

+ If your life is a hard drive, Christ can be your backup. +

Bruce Momjian <pgman@candle.pha.pa.us> writes:

Does this need any documentation adjustments?

It's pretty useless without any documentation ... which was my original
complaint about it IIRC.

regards, tom lane

Patch adjusted and applied. Thanks.

I added documentation about SSL Certificate Revocation List (CRL) files.

We throw a log message of "root.crl" does exist. Perhaps we should just
silently say nothing, but that seems dangerous.

---------------------------------------------------------------------------

Libor Hoho��� wrote:

Hello PG folks,
the attachement contains a simple patch to adding of verification of client's certificate(s)
against CRL on server side in mutual SSL authentication.
The CRL file has name "root.crl" and it must be stored in PGDATA directory.

With best regards
L. Hohos

[ Attachment, skipping... ]

---------------------------(end of broadcast)---------------------------
TIP 4: Have you searched our list archives?

http://archives.postgresql.org

--
Bruce Momjian http://candle.pha.pa.us
EnterpriseDB http://www.enterprisedb.com

+ If your life is a hard drive, Christ can be your backup. +

I am now wondering if fe-secure.c, the front-end code, should also check
for "root.crl". The attached patch implents it. Is it a good idea?

Also, if you look in interfaces/libpq/fe-secure.c at some NOT_USED
macros you can see there are a few things we don't implement. Can that
be improved?

---------------------------------------------------------------------------

Patch adjusted and applied. Thanks.

I added documentation about SSL Certificate Revocation List (CRL) files.

We throw a log message of "root.crl" does exist. Perhaps we should just
silently say nothing, but that seems dangerous.

---------------------------------------------------------------------------

Libor Hoho<B9> wrote:

Hello PG folks,
the attachement contains a simple patch to adding of verification of

client's certificate(s)

against CRL on server side in mutual SSL authentication.
The CRL file has name "root.crl" and it must be stored in PGDATA

directory.

--
Bruce Momjian http://candle.pha.pa.us
EnterpriseDB http://www.enterprisedb.com

+ If your life is a hard drive, Christ can be your backup. +

Bruce Momjian wrote:

I am now wondering if fe-secure.c, the front-end code, should also check
for "root.crl". The attached patch implents it.

Updated patch attached and applied. It adds CRL checking to libpq. It
returns an error if the CRL file exists, but the library can't process
it, just like the backend.

--
Bruce Momjian http://candle.pha.pa.us
EnterpriseDB http://www.enterprisedb.com

+ If your life is a hard drive, Christ can be your backup. +