nss: allow fifos and character devices for certificates.

[gevaerts]

Currently you can do things like --cert <(cat ./cert.crt) with (at least) the
openssl backend, but that doesn't work for nss because is_file rejects fifos.

I don't actually know if this is sufficient, nss might do things internally
(like seeking back) that make this not work, so actual testing is needed.

[gevaerts]

This was reported on irc by pawky

[bagder]

Seems like a fine fix to me. Can you think of any reason this could be bad @kdudka ?

[kdudka]

I am fine with the proposed code change. Unfortunately, I do not think it will make loading of certificates from special files work as expected. The following code in nss-pem expects the file (data) size to be known before reading the data:

https://github.com/kdudka/nss-pem/blob/5c05ed26/src/util.c#L93

[dec0de]

FYI
just to clarify why one might want to use <( ):
script.sh:

read -r -d '' CERT <<CLIENT_CERT
___BEGIN CERT__
MMsfljkjvofjvoe etc...
___END CERT___
CLIENT_CERT

curl --cert <( echo -e "$CERT")   ....

This way you can have have the certs (and key) in your script not needing to keep track of several files.

[kdudka]

Which shell interpreter are you using?

For example zsh provides the =(...) syntax exactly for this -- see the zshexpn(1) man page:

If =(...) is used instead of <(...), then the file passed as an argument will be the name of a temporary file containing the output of the list process. This may be used instead of the < form for a program that expects to lseek (see lseek(2)) on the input file.

[dec0de]

I use bash.

[bagder]

I don't mind this fix either, but as @kdudka points out I don't see how it will help as there's a file size requirement within NSS itself...

[gevaerts]

I agree, if it doesn't actually change anything, it doesn't make much sense to apply it.

The only thing I can think of is that maybe it changes the error message

[kdudka]

I was able to remove the limitation from nss-pem: kdudka/nss-pem#4

Still it might not work as expected when the file given by --cacert is accessed repeatedly, which seems to be the case when --location takes effect.

[kdudka]

I have pushed the proposed change to nss-pem: kdudka/nss-pem@651e0f03

Is anybody against merging this pull request?

[bagder]

Not me, I'm fine with merging it!