Re: [HACKERS] New functions in sslinfo module

2014-07-18 Thread Michael Paquier 
On Fri, Jul 18, 2014 at 3:12 PM, Воронин Дмитрий
 wrote:
> I make a new version of patch. I corrected your notes for my previous
> version of patch. Could you test it? Thank you.

I just had a look at the new version of this patch, and this is
lacking a couple of things.

First, this patch has been developed using a tarball of 9.3.4. sslinfo
is not a module changing frequently so you are lucky that this is not
generating diffs with HEAD but you should try to get yourself familiar
with git and submit patches that are based on HEAD to facilitate their
review and integration. You can have a look here to begin with:
https://wiki.postgresql.org/wiki/Working_with_GIT

Then, here are more comments about the patch:
- Update sslinfo to 1.1. Here are all the details about how to do it:
http://www.postgresql.org/docs/devel/static/extend-extensions.html#AEN57147
Well, basically this is only creating sslinfo--1.0--1.1.sql to be able
to do an upgrade, copy sslinfo--1.0.sql to sslinfo--1.1.sql with the
new objects defined and dumping sslinfo.control.
- In your previous patches I saw that you defined the new functions in
sslinfo--1.0.sql but in the new version of your patch it is not the
case.
- Please remove all the diff noise in sslinfo.sgml, like this one:
*** 157,167 
 
  
   ssl_client_dn_field(fieldname text) returns text
-  
-   ssl_client_dn_field
-  
  
  
  
--- 157,167 
 

 
+ 
+  ssl_client_dn_field
+ 
Your patch should only include documentation for the new functions.
- Please remove whitespaces, there are quite a lot of them.
- in 9.5, PG_FUNCTION_INFO_V1 does the function declaration for you,
making following block useless:
[...]
+Datum  ssl_is_used(PG_FUNCTION_ARGS);
+Datum  ssl_version(PG_FUNCTION_ARGS);
+Datum  ssl_cipher(PG_FUNCTION_ARGS);
[...]
- Please avoid if blocks of this type, this is not consistent with the
project style:
if (SRF_IS_FIRSTCALL()) {
[...]
}
One newline for each bracket. Here is the manual page referencing code
conventions:
http://www.postgresql.org/docs/current/static/source.html

Most of those comments have been already mentioned by Andreas in one
of his emails upthread but you have obviously not solved the issues he
has reported.

This looks like a useful feature, but at this point of the commit fest
and considering the number of structural changes still needed I will
mark this patch as "Returned with feedback". Feel free to resubmit to
the next commit fest in August with an updated patch of course!

Regards,
-- 
Michael


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers

Re: [HACKERS] New functions in sslinfo module

2014-07-17 Thread Воронин Дмитрий 
Hello, Andreas and others!I make a new version of patch. I corrected your notes for my previous version of patch. Could you test it? Thank you.03.07.2014, 01:54, "Andreas Karlsson" : On 07/02/2014 02:17 PM, Воронин Дмитрий wrote:  I apologize, that I am writing this message today. Thank you for testing  my patch! You are welcome!  I will modify functions ssl_extensions(), that it returns a set (key,  value). Could you get me an example of code those function? You can look at hstore_each() in hstore_op.c.  - Why are X509_NAME_field_to_text(), X509_NAME_to_text(),  ASN1_STRING_to_text() and get_extension() not static? None of these are  a symbol which should be exported.  Why do you use pg_do_encoding_conversion() over pg_any_to_server()?  pg_any_to_server() is implemented using pg_do_encoding_conversion().  I don't write a code of those functions and I can't answer on your question. Hm, I thought I saw them changed from static to not in the diff after applying your patch. Maybe I just misread the patch. -- Andreas Karlsson-- Best regards, Dmitry Voronin*** a/contrib/sslinfo/sslinfo.c
--- b/contrib/sslinfo/sslinfo.c
***
*** 5,10 
--- 5,12 
   * This file is distributed under BSD-style license.
   *
   * contrib/sslinfo/sslinfo.c
+  * 
+  * Extension functions written by Dmitry Voronin carriingfat...@yandex.ru, CNIIEISU.
   */
  
  #include "postgres.h"
***
*** 14,29 
  #include "miscadmin.h"
  #include "utils/builtins.h"
  #include "mb/pg_wchar.h"
  
  #include 
  #include 
  
  PG_MODULE_MAGIC;
  
- static Datum X509_NAME_field_to_text(X509_NAME *name, text *fieldName);
- static Datum X509_NAME_to_text(X509_NAME *name);
- static Datum ASN1_STRING_to_text(ASN1_STRING *str);
  
  
  /*
   * Indicates whether current session uses SSL
--- 16,49 
  #include "miscadmin.h"
  #include "utils/builtins.h"
  #include "mb/pg_wchar.h"
+ #include "funcapi.h"
  
  #include 
  #include 
+ #include 
+ 
  
  PG_MODULE_MAGIC;
  
  
+ Datum		ssl_is_used(PG_FUNCTION_ARGS);
+ Datum		ssl_version(PG_FUNCTION_ARGS);
+ Datum		ssl_cipher(PG_FUNCTION_ARGS);
+ Datum		ssl_client_cert_present(PG_FUNCTION_ARGS);
+ Datum		ssl_client_serial(PG_FUNCTION_ARGS);
+ Datum		ssl_client_dn_field(PG_FUNCTION_ARGS);
+ Datum		ssl_issuer_field(PG_FUNCTION_ARGS);
+ Datum		ssl_client_dn(PG_FUNCTION_ARGS);
+ Datum		ssl_issuer_dn(PG_FUNCTION_ARGS);
+ Datum		X509_NAME_field_to_text(X509_NAME *name, text *fieldName);
+ Datum		X509_NAME_to_text(X509_NAME *name);
+ Datum		ASN1_STRING_to_text(ASN1_STRING *str);
+ 
+ X509_EXTENSION	*get_extension(X509* certificate, char *name);
+ Datum 		ssl_get_extension_value(PG_FUNCTION_ARGS);
+ Datum		ssl_is_critical_extension(PG_FUNCTION_ARGS);
+ Datum 		ssl_get_count_of_extensions(PG_FUNCTION_ARGS);
+ Datum		ssl_get_extension_names(PG_FUNCTION_ARGS);
  
  /*
   * Indicates whether current session uses SSL
***
*** 40,46  ssl_is_used(PG_FUNCTION_ARGS)
  
  
  /*
!  * Returns SSL version currently in use.
   */
  PG_FUNCTION_INFO_V1(ssl_version);
  Datum
--- 60,66 
  
  
  /*
!  * Returns SSL cipher currently in use.
   */
  PG_FUNCTION_INFO_V1(ssl_version);
  Datum
***
*** 66,72  ssl_cipher(PG_FUNCTION_ARGS)
  
  
  /*
!  * Indicates whether current client provided a certificate
   *
   * Function has no arguments.  Returns bool.  True if current session
   * is SSL session and client certificate is verified, otherwise false.
--- 86,92 
  
  
  /*
!  * Indicates whether current client have provided a certificate
   *
   * Function has no arguments.  Returns bool.  True if current session
   * is SSL session and client certificate is verified, otherwise false.
***
*** 121,133  ssl_client_serial(PG_FUNCTION_ARGS)
   * current database encoding if possible.  Any invalid characters are
   * replaced by question marks.
   *
!  * Parameter: str - OpenSSL ASN1_STRING structure.  Memory management
   * of this structure is responsibility of caller.
   *
   * Returns Datum, which can be directly returned from a C language SQL
   * function.
   */
! static Datum
  ASN1_STRING_to_text(ASN1_STRING *str)
  {
  	BIO		   *membuf;
--- 141,153 
   * current database encoding if possible.  Any invalid characters are
   * replaced by question marks.
   *
!  * Parameter: str - OpenSSL ASN1_STRING structure.	Memory management
   * of this structure is responsibility of caller.
   *
   * Returns Datum, which can be directly returned from a C language SQL
   * function.
   */
! Datum
  ASN1_STRING_to_text(ASN1_STRING *str)
  {
  	BIO		   *membuf;
***
*** 146,152  ASN1_STRING_to_text(ASN1_STRING *str)
  	nullterm = '\0';
  	BIO_write(membuf, &nullterm, 1);
  	size = BIO_get_mem_data(membuf, &sp);
! 	dp = pg_any_to_server(sp, size - 1, PG_UTF8);
  	result = cstring_to_text(dp);
  	if (dp != sp)
  		pfree(dp);
--- 166,175 
  	nullterm = '\0';
  	BIO_write(membuf, &nullterm, 1);
  	size = BIO_get_mem_data(membuf, &

Re: [HACKERS] New functions in sslinfo module

2014-07-02 Thread Andreas Karlsson 

On 07/02/2014 02:17 PM, Воронин Дмитрий wrote:

I apologize, that I am writing this message today. Thank you for testing
my patch!


You are welcome!


I will modify functions ssl_extensions(), that it returns a set (key,
value). Could you get me an example of code those function?


You can look at hstore_each() in hstore_op.c.


  >>> - Why are X509_NAME_field_to_text(), X509_NAME_to_text(),
ASN1_STRING_to_text() and get_extension() not static? None of these are
a symbol which should be exported.
 >>> Why do you use pg_do_encoding_conversion() over pg_any_to_server()?
pg_any_to_server() is implemented using pg_do_encoding_conversion().

I don't write a code of those functions and I can't answer on your question.


Hm, I thought I saw them changed from static to not in the diff after 
applying your patch. Maybe I just misread the patch.


--
Andreas Karlsson


--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers

Re: [HACKERS] New functions in sslinfo module

2014-07-02 Thread Michael Paquier 
On Wed, Jul 2, 2014 at 9:19 PM, Воронин Дмитрий
 wrote:
>
> Oh, how can I write a documentation for my functions?

You will need to edit the sgml documentation and to include the diffs
in your patch. Hence in your case simply list the new functions and a
description of what they do in doc/src/sgml/sslinfo.sgml.
-- 
Michael


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers

Re: [HACKERS] New functions in sslinfo module

2014-07-02 Thread Воронин Дмитрий 
Oh, how can I write a documentation for my functions?

02.07.2014, 16:17, "Воронин Дмитрий" :
> 24.06.2014, 00:07, "Andreas Karlsson" :
>>  On 04/21/2014 07:51 AM, Воронин Дмитрий wrote:
>>>   I put patch generated on git diffs to this letter. I make an a thread in
>>>   postgresql commit fest:
>>>   https://commitfest.postgresql.org/action/patch_view?id=1438
>>  Thanks for the patch, it seems like a useful feature.
>>
>>  === General ===
>>
>>  - Applies cleanly to HEAD and compiles without warnings.
>>
>>  - The test suite passes.
>>
>>  - x509v3 support was added in OpenSSL 0.9.2 and sslinfo already depends
>>  heavily on OpenSSL so no new dependencies.
>>
>>  === User functionality ===
>>
>>  - If you are a user of the sslinfo extension the new functions should be
>>  useful additions.
>>
>>  - I tested the code without SSL, with certificate but without client
>>  certificate, with client certificates first without extensions and the
>>  with. All of this worked fine except for some usability which could be
>>  improved, see below.
>>
>>  - I cannot see the use for ssl_get_count_of_extensions(). When would
>>  anyone need to know the number of extensions? I think this is an
>>  implementation detail of OpenSSL which we do not need to expose. If any
>>  user wants this feature he can count the extension names.
>>
>>  - Documentation is missing for the new functions.
>>
>>  - I think the names of the new functions should be change. Below are my
>>  suggestions. Other suggestions are welcome.
>>
>>  * ssl_extension_value(text)
>>  * ssl_extension_is_critical()
>>  * ssl_extension_names()
>>  * ssl_extension_count() (If we should keep it.)
>>
>>  - Would it be interesting to have a set returning function which returns
>>  all extensions with both the names and the values? Like the below.
>>
>>  $ SELECT * FROM ssl_extensions();
>>  name   |    value
>>  --+--
>>    basicConstraints | CA:FALSE
>>    keyUsage | Digital Signature, Non Repudiation, Key Encipherment
>>  (2 rows)
>>
>>  - I do not think that ssl_get_extension_names() should return a single
>>  row with NULL when the certificate has no extensions or when there is no
>>  certificate at all. Returning zero rows in this case should make it
>>  easier to use.
>>
>>  - Currently ssl_is_critical_extension() and ssl_get_extension_value()
>>  throw an error when the requested extension is not in the certificate.
>>
>>  I am not sure if I like this behavior. I think I would prefer if the
>>  code always throws an error when name lookup fails, and never when it is
>>  successful. For a valid extension name I think NULL should be returned
>>  when it does not exist.
>>
>>  === Code review: main ===
>>
>>  - Why are X509_NAME_field_to_text(), X509_NAME_to_text(),
>>  ASN1_STRING_to_text() and get_extension() not static? None of these are
>>  a symbol which should be exported.
>>
>>  - I have not worked with extension myself, but since your change adds
>>  functions to the extension I think you need to create a version 1.1
>>  instead of modifying 1.0 in place. If so you also need to write an
>>  upgrade script from 1.0 to 1.1. See dblink--1.0--1.1.sql for an example.
>>
>>  - Please break out the comment fix for ssl_cipher() into a separate patch.
>>
>>  - Why do you use pg_do_encoding_conversion() over pg_any_to_server()?
>>  pg_any_to_server() is implemented using pg_do_encoding_conversion().
>>
>>  - I think you should use OBJ_txt2nid() rather than OBJ_sn2nid() +
>>  OBJ_ln2nid(). You should probably also use OBJ_txt2obj() since
>>  X509_get_ext_by_NID() will call OBJ_nid2obj() anyway.
>>
>>  - You should free the extension_name string. I do not think it is ok to
>>  leak it to the end of the query.
>>
>>  - I think you need to convert the extension values and names to the
>>  server encoding. I just wonder if we need to support data which is
>>  incorrectly encoded.
>>
>>  === Code review: style issues ===
>>
>>  - Trailing whitespace in sslinfo--1.0.sql and sslinfo.c.q
>>
>>  - sslinfo--1.0.sql does not end in a newline.
>>
>>  - I do not think the PostgreSQL project adds authors in the top comment
>>  of files in cases like this. Authors get credit in the commit messages.
>>
>>  - I think you can remove the prototypes of all the ssl_* functions.
>>
>>  - Adding the have in "Indicates whether current client have provided a
>>  certificate" is not necessary. The previous wording looks correct to my
>>  non-native speaker eyes.
>>
>>  - Too much white space in variable declarations in get_extension().
>>
>>  - Extra space before -1 in "X509_get_ext_by_NID(certificate,
>>  extension_nid,  -1);"
>>
>>  - Please do not initialize variables unless necessary. Compilers are
>>  pretty good at warning about uninitialized usage. For example both
>>  locate and extension_nid do not need to be initialized.
>>
>>  - Remove empty line directly before ssl_get_ex

Re: [HACKERS] New functions in sslinfo module

2014-07-02 Thread Воронин Дмитрий 
24.06.2014, 00:07, "Andreas Karlsson" : On 04/21/2014 07:51 AM, Воронин Дмитрий wrote:  I put patch generated on git diffs to this letter. I make an a thread in  postgresql commit fest:  https://commitfest.postgresql.org/action/patch_view?id=1438 Thanks for the patch, it seems like a useful feature. === General === - Applies cleanly to HEAD and compiles without warnings. - The test suite passes. - x509v3 support was added in OpenSSL 0.9.2 and sslinfo already depends heavily on OpenSSL so no new dependencies. === User functionality === - If you are a user of the sslinfo extension the new functions should be useful additions. - I tested the code without SSL, with certificate but without client certificate, with client certificates first without extensions and the with. All of this worked fine except for some usability which could be improved, see below. - I cannot see the use for ssl_get_count_of_extensions(). When would anyone need to know the number of extensions? I think this is an implementation detail of OpenSSL which we do not need to expose. If any user wants this feature he can count the extension names. - Documentation is missing for the new functions. - I think the names of the new functions should be change. Below are my suggestions. Other suggestions are welcome. * ssl_extension_value(text) * ssl_extension_is_critical() * ssl_extension_names() * ssl_extension_count() (If we should keep it.) - Would it be interesting to have a set returning function which returns all extensions with both the names and the values? Like the below. $ SELECT * FROM ssl_extensions(); name   |    value --+--   basicConstraints | CA:FALSE   keyUsage | Digital Signature, Non Repudiation, Key Encipherment (2 rows) - I do not think that ssl_get_extension_names() should return a single row with NULL when the certificate has no extensions or when there is no certificate at all. Returning zero rows in this case should make it easier to use. - Currently ssl_is_critical_extension() and ssl_get_extension_value() throw an error when the requested extension is not in the certificate. I am not sure if I like this behavior. I think I would prefer if the code always throws an error when name lookup fails, and never when it is successful. For a valid extension name I think NULL should be returned when it does not exist. === Code review: main === - Why are X509_NAME_field_to_text(), X509_NAME_to_text(), ASN1_STRING_to_text() and get_extension() not static? None of these are a symbol which should be exported. - I have not worked with extension myself, but since your change adds functions to the extension I think you need to create a version 1.1 instead of modifying 1.0 in place. If so you also need to write an upgrade script from 1.0 to 1.1. See dblink--1.0--1.1.sql for an example. - Please break out the comment fix for ssl_cipher() into a separate patch. - Why do you use pg_do_encoding_conversion() over pg_any_to_server()? pg_any_to_server() is implemented using pg_do_encoding_conversion(). - I think you should use OBJ_txt2nid() rather than OBJ_sn2nid() + OBJ_ln2nid(). You should probably also use OBJ_txt2obj() since X509_get_ext_by_NID() will call OBJ_nid2obj() anyway. - You should free the extension_name string. I do not think it is ok to leak it to the end of the query. - I think you need to convert the extension values and names to the server encoding. I just wonder if we need to support data which is incorrectly encoded. === Code review: style issues === - Trailing whitespace in sslinfo--1.0.sql and sslinfo.c.q - sslinfo--1.0.sql does not end in a newline. - I do not think the PostgreSQL project adds authors in the top comment of files in cases like this. Authors get credit in the commit messages. - I think you can remove the prototypes of all the ssl_* functions. - Adding the have in "Indicates whether current client have provided a certificate" is not necessary. The previous wording looks correct to my non-native speaker eyes. - Too much white space in variable declarations in get_extension(). - Extra space before -1 in "X509_get_ext_by_NID(certificate, extension_nid,  -1);" - Please do not initialize variables unless necessary. Compilers are pretty good at warning about uninitialized usage. For example both locate and extension_nid do not need to be initialized. - Remove empty line directly before ssl_get_extension_value(). - Try to follow variable naming conventions from other functions (e.g. use nid rather than extension_nid, membuf rather than bio, sp rather than value). - I am pretty sure the variable you call locate should be called location (or loc for short). - There should not be any spaces around "->". - The declaration of *extension in ssl_get_extension_value is not aligned properly. - Remove white space in variable declaration in ssl_get_count_of_extensions(). - Incorrectly alignment of variab

Re: [HACKERS] New functions in sslinfo module

2014-06-23 Thread Andreas Karlsson 

On 04/21/2014 07:51 AM, Воронин Дмитрий wrote:

I put patch generated on git diffs to this letter. I make an a thread in
postgresql commit fest:
https://commitfest.postgresql.org/action/patch_view?id=1438


Thanks for the patch, it seems like a useful feature.

=== General ===

- Applies cleanly to HEAD and compiles without warnings.

- The test suite passes.

- x509v3 support was added in OpenSSL 0.9.2 and sslinfo already depends 
heavily on OpenSSL so no new dependencies.


=== User functionality ===

- If you are a user of the sslinfo extension the new functions should be 
useful additions.


- I tested the code without SSL, with certificate but without client 
certificate, with client certificates first without extensions and the 
with. All of this worked fine except for some usability which could be 
improved, see below.


- I cannot see the use for ssl_get_count_of_extensions(). When would 
anyone need to know the number of extensions? I think this is an 
implementation detail of OpenSSL which we do not need to expose. If any 
user wants this feature he can count the extension names.


- Documentation is missing for the new functions.

- I think the names of the new functions should be change. Below are my 
suggestions. Other suggestions are welcome.


* ssl_extension_value(text)
* ssl_extension_is_critical()
* ssl_extension_names()
* ssl_extension_count() (If we should keep it.)

- Would it be interesting to have a set returning function which returns 
all extensions with both the names and the values? Like the below.


$ SELECT * FROM ssl_extensions();
   name   |value
--+--
 basicConstraints | CA:FALSE
 keyUsage | Digital Signature, Non Repudiation, Key Encipherment
(2 rows)

- I do not think that ssl_get_extension_names() should return a single 
row with NULL when the certificate has no extensions or when there is no 
certificate at all. Returning zero rows in this case should make it 
easier to use.


- Currently ssl_is_critical_extension() and ssl_get_extension_value() 
throw an error when the requested extension is not in the certificate.


I am not sure if I like this behavior. I think I would prefer if the 
code always throws an error when name lookup fails, and never when it is 
successful. For a valid extension name I think NULL should be returned 
when it does not exist.


=== Code review: main ===

- Why are X509_NAME_field_to_text(), X509_NAME_to_text(), 
ASN1_STRING_to_text() and get_extension() not static? None of these are 
a symbol which should be exported.


- I have not worked with extension myself, but since your change adds 
functions to the extension I think you need to create a version 1.1 
instead of modifying 1.0 in place. If so you also need to write an 
upgrade script from 1.0 to 1.1. See dblink--1.0--1.1.sql for an example.


- Please break out the comment fix for ssl_cipher() into a separate patch.

- Why do you use pg_do_encoding_conversion() over pg_any_to_server()? 
pg_any_to_server() is implemented using pg_do_encoding_conversion().


- I think you should use OBJ_txt2nid() rather than OBJ_sn2nid() + 
OBJ_ln2nid(). You should probably also use OBJ_txt2obj() since 
X509_get_ext_by_NID() will call OBJ_nid2obj() anyway.


- You should free the extension_name string. I do not think it is ok to 
leak it to the end of the query.


- I think you need to convert the extension values and names to the 
server encoding. I just wonder if we need to support data which is 
incorrectly encoded.


=== Code review: style issues ===

- Trailing whitespace in sslinfo--1.0.sql and sslinfo.c.q

- sslinfo--1.0.sql does not end in a newline.

- I do not think the PostgreSQL project adds authors in the top comment 
of files in cases like this. Authors get credit in the commit messages.


- I think you can remove the prototypes of all the ssl_* functions.

- Adding the have in "Indicates whether current client have provided a 
certificate" is not necessary. The previous wording looks correct to my 
non-native speaker eyes.


- Too much white space in variable declarations in get_extension().

- Extra space before -1 in "X509_get_ext_by_NID(certificate, 
extension_nid,  -1);"


- Please do not initialize variables unless necessary. Compilers are 
pretty good at warning about uninitialized usage. For example both 
locate and extension_nid do not need to be initialized.


- Remove empty line directly before ssl_get_extension_value().

- Try to follow variable naming conventions from other functions (e.g. 
use nid rather than extension_nid, membuf rather than bio, sp rather 
than value).


- I am pretty sure the variable you call locate should be called 
location (or loc for short).


- There should not be any spaces around "->".

- The declaration of *extension in ssl_get_extension_value is not 
aligned properly.


- Remove white space in variable declaration in 
ssl_get_count_of_extensio

Re: [HACKERS] New functions in sslinfo module

2014-04-20 Thread Michael Paquier 
On Mon, Apr 21, 2014 at 2:51 PM, Воронин Дмитрий
wrote:

> I put patch generated on git diffs to this letter. I make an a thread in
> postgresql commit fest:
> https://commitfest.postgresql.org/action/patch_view?id=1438
>
Thanks!
-- 
Michael

Re: [HACKERS] New functions in sslinfo module

2014-04-20 Thread Воронин Дмитрий 
I put patch generated on git diffs to this letter. I make an a thread in postgresql commit fest: https://commitfest.postgresql.org/action/patch_view?id=1438 21.04.2014, 09:12, "Michael Paquier" :On Mon, Apr 21, 2014 at 1:48 PM, Воронин Дмитрий  wrote:> Hello,>  > I make an a patch, which adds 4 functions to sslinfo extension module: > 1) ssl_get_count_of_extensions() --- get count of X509v3 extensions from> client certificate;> 2) ssl_get_extension_names() --- get short names of X509v3 extensions from> client certificate;> 3) ssl_get_extension_value(text) --- get value of extension from certificate > (argument --- short name of extension);> 4) ssl_is_critical_extension(text) --- returns true, if extension is> critical and false, if is not (argument --- short name of extension).>  > You can view some information of certificate's extensions via those > functions.> I want, that my functions will be included in PostgreSQL release.>  > What do you think about it?Please avoid creating a new thread each time you send a new version of the same patch. Previous message was here: http://www.postgresql.org/message-id/1135491397673...@web9m.yandex.ruWith my previous answer here:http://www.postgresql.org/message-id/CAB7nPqRVFhnPnQL9ND+K=WA-YF_N1fAirx=s6fawk9f6anl...@mail.gmail.com As I already mentioned last time, please register this patch to the upcoming commit fest beginning in June:https://commitfest.postgresql.org/action/commitfest_view?id=22This way, you will be sure that your patch will get at least one fair review and that progress will be made on the feature you are proposing.The development cycle of 9.4 is over, but your patch could get into 9.5. You seem as well to have developed this patch using a tarball of 9.3.4 code by generating diffs from it, you will need a development environment with git. Here are some guidelines you can refer to (those are the same URLs as in my previous email btw...): https://wiki.postgresql.org/wiki/Submitting_a_Patch https://wiki.postgresql.org/wiki/Working_with_Git https://wiki.postgresql.org/wiki/Creating_Clean_PatchesRegards,-- Michael Best regrads, Dmitry Voronin  *** a/contrib/sslinfo/sslinfo--1.0.sql
--- b/contrib/sslinfo/sslinfo--1.0.sql
***
*** 38,40  LANGUAGE C STRICT;
--- 38,56 
  CREATE FUNCTION ssl_issuer_dn() RETURNS text
  AS 'MODULE_PATHNAME', 'ssl_issuer_dn'
  LANGUAGE C STRICT;
+ 
+ CREATE OR REPLACE FUNCTION ssl_get_extension_value(text) RETURNS text
+ AS 'MODULE_PATHNAME', 'ssl_get_extension_value'
+ LANGUAGE C STRICT;
+ 
+ CREATE OR REPLACE FUNCTION ssl_is_critical_extension(text) RETURNS boolean
+ AS 'MODULE_PATHNAME', 'ssl_is_critical_extension'
+ LANGUAGE C STRICT;
+ 
+ CREATE OR REPLACE FUNCTION ssl_get_count_of_extensions() RETURNS integer
+ AS 'MODULE_PATHNAME', 'ssl_get_count_of_extensions'
+ LANGUAGE C STRICT;
+ 
+ CREATE OR REPLACE FUNCTION ssl_get_extension_names() RETURNS SETOF text 
+ AS 'MODULE_PATHNAME', 'ssl_get_extension_names'
+ LANGUAGE C STRICT;
\ No newline at end of file
\ No newline at end of file
*** a/contrib/sslinfo/sslinfo--unpackaged--1.0.sql
--- b/contrib/sslinfo/sslinfo--unpackaged--1.0.sql
***
*** 11,16  ALTER EXTENSION sslinfo ADD function ssl_issuer_field(text);
--- 11,21 
  ALTER EXTENSION sslinfo ADD function ssl_client_dn();
  ALTER EXTENSION sslinfo ADD function ssl_issuer_dn();
  
+ ALTER EXTENSION sslinfo ADD function ssl_get_extension_value();
+ ALTER EXTENSION sslinfo ADD function ssl_is_critical_extension();
+ ALTER EXTENSION sslinfo ADD function ssl_count_of_extensions();
+ ALTER EXTENSION sslinfo ADD function ssl_get_extension_names();
+ 
  -- These functions were not in 9.0:
  
  CREATE FUNCTION ssl_version() RETURNS text
*** a/contrib/sslinfo/sslinfo.c
--- b/contrib/sslinfo/sslinfo.c
***
*** 5,10 
--- 5,12 
   * This file is distributed under BSD-style license.
   *
   * contrib/sslinfo/sslinfo.c
+  * 
+  * Extension functions written by Dmitry Voronin carriingfat...@yandex.ru, CNIIEISU.
   */
  
  #include "postgres.h"
***
*** 14,31 
  #include "miscadmin.h"
  #include "utils/builtins.h"
  #include "mb/pg_wchar.h"
  
  #include 
  #include 
  
  
  PG_MODULE_MAGIC;
  
  
! static Datum X509_NAME_field_to_text(X509_NAME *name, text *fieldName);
! static Datum X509_NAME_to_text(X509_NAME *name);
! static Datum ASN1_STRING_to_text(ASN1_STRING *str);
  
  
  /*
   * Indicates whether current session uses SSL
--- 16,49 
  #include "miscadmin.h"
  #include "utils/builtins.h"
  #include "mb/pg_wchar.h"
+ #include "funcapi.h"
  
  #include 
  #include 
+ #include 
  
  
  PG_MODULE_MAGIC;
  
  
! Datum		ssl_is_used(PG_FUNCTION_ARGS);
! Datum		ssl_version(PG_FUNCTION_ARGS);
! Datum		ssl_cipher(PG_FUNCTION_ARGS);
! Datum		ssl_client_cert_present(PG_FUNCTION_ARGS);
! Datum		ssl_client_serial(PG_FUNCTION_ARGS);
! Datum		ssl_client_dn_field(PG_FUNCTION_ARGS);
! Datum		ssl_issuer_field(PG_FUNCTION_ARGS);
! Datum		ssl_client_

Re: [HACKERS] New functions in sslinfo module

2014-04-20 Thread Michael Paquier 
On Mon, Apr 21, 2014 at 1:48 PM, Воронин Дмитрий 
wrote:
> Hello,
>
> I make an a patch, which adds 4 functions to sslinfo extension module:
> 1) ssl_get_count_of_extensions() --- get count of X509v3 extensions from
> client certificate;
> 2) ssl_get_extension_names() --- get short names of X509v3 extensions from
> client certificate;
> 3) ssl_get_extension_value(text) --- get value of extension from
certificate
> (argument --- short name of extension);
> 4) ssl_is_critical_extension(text) --- returns true, if extension is
> critical and false, if is not (argument --- short name of extension).
>
> You can view some information of certificate's extensions via those
> functions.
> I want, that my functions will be included in PostgreSQL release.
>
> What do you think about it?
Please avoid creating a new thread each time you send a new version of the
same patch. Previous message was here:
http://www.postgresql.org/message-id/1135491397673...@web9m.yandex.ru
With my previous answer here:
http://www.postgresql.org/message-id/CAB7nPqRVFhnPnQL9ND+K=WA-YF_N1fAirx=s6fawk9f6anl...@mail.gmail.com

As I already mentioned last time, please register this patch to the
upcoming commit fest beginning in June:
https://commitfest.postgresql.org/action/commitfest_view?id=22
This way, you will be sure that your patch will get at least one fair
review and that progress will be made on the feature you are proposing.

The development cycle of 9.4 is over, but your patch could get into 9.5.
You seem as well to have developed this patch using a tarball of 9.3.4 code
by generating diffs from it, you will need a development environment with
git. Here are some guidelines you can refer to (those are the same URLs as
in my previous email btw...):
https://wiki.postgresql.org/wiki/Submitting_a_Patch
https://wiki.postgresql.org/wiki/Working_with_Git
https://wiki.postgresql.org/wiki/Creating_Clean_Patches
Regards,
-- 
Michael

[HACKERS] New functions in sslinfo module

2014-04-20 Thread Воронин Дмитрий 
Hello, I make an a patch, which adds 4 functions to sslinfo extension module:1) ssl_get_count_of_extensions() --- get count of X509v3 extensions from client certificate;2) ssl_get_extension_names() --- get short names of X509v3 extensions from client certificate;3) ssl_get_extension_value(text) --- get value of extension from certificate (argument --- short name of extension);4) ssl_is_critical_extension(text) --- returns true, if extension is critical and false, if is not (argument --- short name of extension). You can view some information of certificate's extensions via those functions.I want, that my functions will be included in PostgreSQL release. What do you think about it? -- Best regards, Dmitry Voronin  --- contrib/sslinfo/sslinfo.c	2014-03-17 23:35:47.0 +0400
+++ contrib/sslinfo/sslinfo.c	2014-04-18 11:09:49.567775647 +0400
@@ -5,6 +5,8 @@
  * This file is distributed under BSD-style license.
  *
  * contrib/sslinfo/sslinfo.c
+ * 
+ * Extension functions written by Dmitry Voronin carriingfat...@yandex.ru, CNIIEISU.
  */
 
 #include "postgres.h"
@@ -14,9 +16,11 @@
 #include "miscadmin.h"
 #include "utils/builtins.h"
 #include "mb/pg_wchar.h"
+#include "funcapi.h"
 
 #include 
 #include 
+#include 
 
 
 PG_MODULE_MAGIC;
@@ -35,6 +39,11 @@
 Datum		X509_NAME_to_text(X509_NAME *name);
 Datum		ASN1_STRING_to_text(ASN1_STRING *str);
 
+X509_EXTENSION	*get_extension(X509* certificate, char *name);
+Datum 		ssl_get_extension_value(PG_FUNCTION_ARGS);
+Datum		ssl_is_critical_extension(PG_FUNCTION_ARGS);
+Datum 		ssl_get_count_of_extensions(PG_FUNCTION_ARGS);
+Datum		ssl_get_extension_names(PG_FUNCTION_ARGS);
 
 /*
  * Indicates whether current session uses SSL
@@ -371,3 +380,146 @@
 		PG_RETURN_NULL();
 	return X509_NAME_to_text(X509_get_issuer_name(MyProcPort->peer));
 }
+
+
+X509_EXTENSION *get_extension(X509* certificate, char *name) {
+	int 			extension_nid = 0;
+	int 			locate = 0;
+	
+	extension_nid = OBJ_sn2nid(name);
+	if (extension_nid == NID_undef) {
+		extension_nid = OBJ_ln2nid(name);
+		if (extension_nid == NID_undef) 
+			return NULL;
+	}
+	locate = X509_get_ext_by_NID(certificate, extension_nid,  -1);
+	return X509_get_ext(certificate, locate);
+}
+
+/* Returns value of extension. 
+ * 
+ * This function returns value of extension by short name in client certificate. 
+ * 
+ * Returns text datum. 
+ */
+
+PG_FUNCTION_INFO_V1(ssl_get_extension_value);
+Datum
+ssl_get_extension_value(PG_FUNCTION_ARGS) {	
+	X509 			*certificate = MyProcPort -> peer;
+	X509_EXTENSION 		*extension = NULL;
+	char 			*extension_name = text_to_cstring(PG_GETARG_TEXT_P(0));
+	BIO 			*bio = NULL;
+	char 			*value = NULL;
+	char 			nullterm = '\0';
+	text 			*result = NULL;
+
+	if (certificate == NULL)
+		PG_RETURN_NULL();
+
+	extension = get_extension(certificate, extension_name);
+	if (extension == NULL)
+		elog(ERROR, "Extension by name \"%s\" is not found in certificate", extension_name);
+
+	bio = BIO_new(BIO_s_mem());
+	X509V3_EXT_print(bio, extension, -1, -1);
+	BIO_write(bio, &nullterm, 1);
+	BIO_get_mem_data(bio, &value);
+
+	result = cstring_to_text(value);
+	BIO_free(bio);
+
+	PG_RETURN_TEXT_P(result);
+}
+
+/* Returns status of extension 
+ * 
+ * Returns true, if extension is critical and false, if it is not.
+ * 
+ * Returns bool datum
+ */
+PG_FUNCTION_INFO_V1(ssl_is_critical_extension);
+Datum
+ssl_is_critical_extension(PG_FUNCTION_ARGS) {
+	X509 			*certificate = MyProcPort -> peer;
+	X509_EXTENSION 		*extension = NULL;
+	char 			*extension_name = text_to_cstring(PG_GETARG_TEXT_P(0));
+	int 			critical = 0;
+	
+	if (certificate == NULL)
+		PG_RETURN_NULL();
+	
+	extension = get_extension(certificate, extension_name);
+	if (extension == NULL) 
+		elog(ERROR, "Extension name \"%s\" is not found in certificate", extension_name);
+	
+	critical = X509_EXTENSION_get_critical(extension);
+	PG_RETURN_BOOL(critical);
+}
+
+/* Returns count of extensions in client certificate
+ * 
+ * Returns int datum
+ */
+PG_FUNCTION_INFO_V1(ssl_get_count_of_extensions);
+Datum
+ssl_get_count_of_extensions(PG_FUNCTION_ARGS) {
+	X509 			*certificate = MyProcPort -> peer;
+	
+	if (certificate == NULL)
+		PG_RETURN_NULL();
+	
+	PG_RETURN_INT32(X509_get_ext_count(certificate));
+}
+
+/* Returns short names of extensions in client certificate
+ * 
+ * Returns setof text datum
+ */
+PG_FUNCTION_INFO_V1(ssl_get_extension_names);
+Datum
+ssl_get_extension_names(PG_FUNCTION_ARGS) {
+	X509*certificate = MyProcPort -> peer;
+	FuncCallContext 		*funcctx;
+	STACK_OF(X509_EXTENSION) 	*extension_stack = NULL;
+	MemoryContext 			oldcontext;
+	int call = 0;
+	int max_calls = 0;
+	X509_EXTENSION			*extension = NULL;
+	ASN1_OBJECT			*object = NULL;
+	int extension_nid = 0;
+	text*result = NULL;
+	
+	if (certificate == NULL)
+		PG_RETURN_NULL();
+	
+	extension_stack = certificate -> cert_info -> extensions;
+	if (extension_stack == NULL) 
+		PG_RETURN_NULL();
+	
+	if (SRF_IS_FIRSTCALL()) {
+		funcctx = SRF_FIRSTCALL_I