Re: Support for NSS as a libpq TLS backend

On Mon, 2021-02-22 at 14:31 +0100, Daniel Gustafsson wrote:
> The attached fixes that as well as implements the sslcrldir
> support that was committed recently. The crldir parameter isn't applicable to
> NSS per se since all CRL's are loaded into the NSS database, but it does need
> to be supported for the tests.
>
> The crldir commit also made similar changes to the test harness as I had done
> to support the NSS database, which made these incompatible. To fix that I've
> implemented named parameters in switch_server_cert to make it less magic with
> multiple optional parameters.

The named parameters are a big improvement!

Couple things I've noticed with this patch, back on the OpenSSL side.
In SSL::Backend::OpenSSL's set_server_conf() implementation:

> + my $sslconf =
> + "ssl_ca_file='$params->{cafile}.crt'\n"
> + . "ssl_cert_file='$params->{certfile}.crt'\n"
> + . "ssl_key_file='$params->{keyfile}.key'\n"
> + . "ssl_crl_file='$params->{crlfile}'\n";
> + $sslconf .= "ssl_crl_dir='$params->{crldir}'\n" if defined $params->{crldir};
> }

this is missing a `return $sslconf` at the end.

In 001_ssltests.pl:

> -set_server_cert($node, 'server-cn-only', 'root+client_ca',
> - 'server-password', 'echo wrongpassword');
> -command_fails(
> - [ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
> - 'restart fails with password-protected key file with wrong password');
> -$node->_update_pid(0);
> +# Since the passphrase callbacks operate at different stages in OpenSSL and
> +# NSS we have two separate blocks for them
> +SKIP:
> +{
> + skip "Certificate passphrases aren't checked on server restart in NSS", 2
> + if ($nss);
> +
> + switch_server_cert($node,
> + certfile => 'server-cn-only',
> + cafile => 'root+client_ca',
> + keyfile => 'server-password',
> + nssdatabase => 'server-cn-only.crt__server-password.key.db',
> + passphrase_cmd => 'echo wrongpassword');
> +
> + command_fails(
> + [ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
> + 'restart fails with password-protected key file with wrong password');
> + $node->_update_pid(0);

The removal of set_server_cert() in favor of switch_server_cert()
breaks these tests in OpenSSL, because the restart that
switch_server_cert performs will fail as designed. (The new comment
above switch_server_cert() suggests maybe you had a switch in mind to
skip the restart?)

NSS is not affected because we expect the restart to succeed:

> + command_ok(
> + [ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
> + 'restart fails with password-protected key file with wrong password');

but I'd argue that that NSS test and the one after it should probably
be removed. We already know restart succeeded; otherwise
switch_server_cert() would have failed. (The test descriptions also
have the old "restart fails" verbiage.)

--Jacob