From: Michael Paquier <michael@paquier.xyz>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jeff Davis <jdavis@postgresql.org>
Cc: pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add libpq parameter 'channel_binding'.
Date: Mon, 30 Sep 2019 15:45:39 +0900
Message-ID: <20190930064539.GK2888@paquier.xyz> (raw)
In-Reply-To: <20190929234733.GA2888@paquier.xyz>
References: <E1iCVWg-00057D-8U@gemulon.postgresql.org>
<24857.1569775891@sss.pgh.pa.us>
<20190929234733.GA2888@paquier.xyz>
On Mon, Sep 30, 2019 at 08:47:33AM +0900, Michael Paquier wrote:
> On Sun, Sep 29, 2019 at 12:51:31PM -0400, Tom Lane wrote:
>> Another point is that this error message is misleading --- or at least
>> would be misleading if the server had X509_get_signature_nid and the
>> client didn't.
>>
>> -#ifdef HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
>> if (conn->channel_binding[0] != 'd') /* disable */
>> + {
>> +#ifdef HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
>> selected_mechanism = SCRAM_SHA_256_PLUS_NAME;
>> +#else
>> + printfPQExpBuffer(&conn->errorMessage,
>> + libpq_gettext("client does not support SCRAM-SHA-256-PLUS authentication\n"));
>> + goto error;
>> + }
>> #endif
>> }
>
> Yes, it looks sensible to do that.
If the server publishes SCRAM-SHA-256-PLUS and the server does not
support channel binding, then we get this error message:
"channel binding is required, but server did not offer an
authentication method that supports channel binding."
So that's the part which is wrong.
Now, I am not completely sure that the suggested change is completely
right either as we would get an error in this scenario when
channel_binding is "prefer" or "require". For "require", this error
message is fine. However, for "prefer", shouldn't we do what we do on
HEAD, aka *not* select SCRAM-SHA-256-PLUS and switch to SCRAM-SHA-256?
This would have the advantage to make the connection work with default
parameters.
--
Michael
Attachments:
[application/pgp-signature] signature.asc (832B, ../20190930064539.GK2888@paquier.xyz/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: michael@paquier.xyz, tgl@sss.pgh.pa.us, jdavis@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add libpq parameter 'channel_binding'.
In-Reply-To: <20190930064539.GK2888@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox