From: Michael Paquier <michael@paquier.xyz>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jeff Davis <pgsql@j-davis.com>
Cc: pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add libpq parameter 'channel_binding'.
Date: Tue, 1 Oct 2019 09:43:42 +0900
Message-ID: <20191001004342.GC2781@paquier.xyz> (raw)
In-Reply-To: <28779.1569879706@sss.pgh.pa.us>
References: <E1iCVWg-00057D-8U@gemulon.postgresql.org>
<24857.1569775891@sss.pgh.pa.us>
<20190929234733.GA2888@paquier.xyz>
<20190930064539.GK2888@paquier.xyz>
<20190930070826.GM2888@paquier.xyz>
<55c81610cba6bcc5289268ae46c686cabc439a0f.camel@j-davis.com>
<28779.1569879706@sss.pgh.pa.us>
On Mon, Sep 30, 2019 at 05:41:46PM -0400, Tom Lane wrote:
> Jeff Davis <pgsql@j-davis.com> writes:
>> Looks good to me, though I think you need to update the expected error
>> message in the test you just added.
>
> The test case did pass for me when I tried it on an old-openssl machine
> a few hours ago. I don't think this test has any way to exercise the
> code path where the server has support and the client doesn't (or
> vice versa).
The behaviors of "prefer" which make sense with or without channel
binding support on the client-side is actually what matters here when
the server sends back SCRAM-SHA-256-PLUS over SSL. We could use a
compile flag and enforce it in a buildfarm animal, or have more modes
within the parameter, but the gains are not really worth the
code complications in my opinion, and the parameter is already
complicated enough.
--
Michael
Attachments:
[application/pgp-signature] signature.asc (832B, ../20191001004342.GC2781@paquier.xyz/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: michael@paquier.xyz, tgl@sss.pgh.pa.us, pgsql@j-davis.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add libpq parameter 'channel_binding'.
In-Reply-To: <20191001004342.GC2781@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox