On 10/31/19 7:27 PM, Andrew Dunstan wrote:
> On 10/31/19 6:34 PM, Andrew Dunstan wrote:
>> This time with attachment.
>>
>>
>> On 10/31/19 6:33 PM, Andrew Dunstan wrote:
>>> This patch provides for an sslpassword parameter for libpq, and a hook
>>> that a client can fill in for a callback function to set the password.
>>>
>>>
>>> This provides similar facilities to those already available in the JDBC
>>> driver.
>>>
>>>
>>> There is also a function to fetch the sslpassword from the connection
>>> parameters, in the same way that other settings can be fetched.
>>>
>>>
>>> This is mostly the excellent work of my colleague Craig Ringer, with a
>>> few embellishments from me.
>>>
>>>
>>> Here are his notes:
>>>
>>>
>>> Allow libpq to non-interactively decrypt client certificates that
>>> are stored
>>> encrypted by adding a new "sslpassword" connection option.
>>>
>>> The sslpassword option offers a middle ground between a cleartext
>>> key and
>>> setting up advanced key mangement via openssl engines, PKCS#11, USB
>>> crypto
>>> offload and key escrow, etc.
>>>
>>> Previously use of encrypted client certificate keys only worked if
>>> the user
>>> could enter the key's password interactively on stdin, in response
>>> to openssl's
>>> default prompt callback:
>>>
>>> Enter PEM passhprase:
>>>
>>> That's infesible in many situations, especially things like use from
>>> postgres_fdw.
>>>
>>> This change also allows admins to prevent libpq from ever prompting
>>> for a
>>> password by calling:
>>>
>>> PQsetSSLKeyPassHook(PQdefaultSSLKeyPassHook);
>>>
>>> which is useful since OpenSSL likes to open /dev/tty to prompt for a
>>> password,
>>> so even closing stdin won't stop it blocking if there's no user
>>> input available.
>>> Applications may also override or extend SSL password fetching with
>>> their own
>>> callback.
>>>
>>> There is deliberately no environment variable equivalent for the
>>> sslpassword
>>> option.
>>>
>>>
> I should also mention that this patch provides for support for DER
> format certificates and keys.
>
>
Here's an updated version of the patch, adjusted to the now committed
changes to TestLib.pm.
cheers
andrew
--
Andrew Dunstan https://www.2ndQuadrant.com
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
