Date: Mon, 30 Sep 2019 08:47:33 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jeff Davis <jdavis@postgresql.org>,
	pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add libpq parameter 'channel_binding'.
Message-ID: <20190929234733.GA2888@paquier.xyz>
References: <E1iCVWg-00057D-8U@gemulon.postgresql.org>
 <24857.1569775891@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="X1bOJ3K7DJ5YkBrT"
Content-Disposition: inline
In-Reply-To: <24857.1569775891@sss.pgh.pa.us>
Precedence: bulk


--X1bOJ3K7DJ5YkBrT
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Sep 29, 2019 at 12:51:31PM -0400, Tom Lane wrote:
> I found out the hard way that the added ssl tests fall over on a
> platform that doesn't HAVE_X509_GET_SIGNATURE_NID:
>
> [...]
>=20
> I don't think that it's acceptable for the test to fail on a platform
> that we're willing to compile on.  Maybe just skip these tests if we
> lack X509_get_signature_nid?

Yes, that's the bug I found three days ago for which I have posted a
patch here:
https://www.postgresql.org/message-id/20190927024457.GA8485@paquier.xyz

In short, I think that the proper way is to adapt the test if
X509_get_signature_nid is not around.

> Another point is that this error message is misleading --- or at least
> would be misleading if the server had X509_get_signature_nid and the
> client didn't.
>
> -#ifdef HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
>                 if (conn->channel_binding[0] !=3D 'd')    /* disable */
> +               {
> +#ifdef HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
>                     selected_mechanism =3D SCRAM_SHA_256_PLUS_NAME;
> +#else
> +                   printfPQExpBuffer(&conn->errorMessage,
> +                                     libpq_gettext("client does not supp=
ort SCRAM-SHA-256-PLUS authentication\n"));
> +                   goto error;
> +               }
>  #endif
>             }

Yes, it looks sensible to do that.
--
Michael

--X1bOJ3K7DJ5YkBrT
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAl2RQpUACgkQnvQgOdby
QH1ctw//Sb/dqlECRiv4xuWjtR3NXeiWSzmXv7/uwHnFDSCVf7qk+S4hdIjq/3mG
R5SBpfug3EIvh+Aqx4dfcddbAF6uvkoqT9Q1kcBgpgjat87GJEi/zOrLiXADGtww
PzuZJxrhcrf695tsTA8y8tYaf2WfUsEBGfZkz/zsyZKMMF967gEiCk9hehM94SS5
vdYp6aZR2UniyYUmPswaWrq9FurD/DbrwellQIa4U8bgqQRg1mvFoS5dksFCznyI
xmIDtHLuyVeXcgHBfuPqQ6XxuTOghWiB9jZCJy5SiBFPQDrA3EjbG13aFlVXg4MO
8VCYErDODV1PbJwzUb5CQtOYlFPsdtFU8zInzxdy2SPoM7SXAdaH8Z5LVEP9RHNl
Ue4AkhpEXn7RmCtsEaQEuFojoV/lIh1azN5TDmgDQmTQ2uPSgZthrEyACXBXV/nH
jdp/afZAIfNZA9bUGLcmsdP7vSx3SA0VB39C6EIOk+Swp8feCPvbioR6kalMISbq
iptzdZg+kUUMdDDnPujdGKbaG1Q/SGb9KxukR4wmN1sqwHiIqNi59vxZJNyN92SH
82ZpQfmy15TDT/IIKdVLVW72z62SIe1qpOwNse9D+JE9iodvVqbddpHYrNvZxxR2
OfxHLqguyVwNBUpomQUAjcSIRnfTkDs0SqaK5vPZ+hY1RnB4GiY=
=/T0Y
-----END PGP SIGNATURE-----

--X1bOJ3K7DJ5YkBrT--