Date: Tue, 1 Oct 2019 09:43:42 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jeff Davis <pgsql@j-davis.com>, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add libpq parameter 'channel_binding'.
Message-ID: <20191001004342.GC2781@paquier.xyz>
References: <E1iCVWg-00057D-8U@gemulon.postgresql.org>
 <24857.1569775891@sss.pgh.pa.us>
 <20190929234733.GA2888@paquier.xyz>
 <20190930064539.GK2888@paquier.xyz>
 <20190930070826.GM2888@paquier.xyz>
 <55c81610cba6bcc5289268ae46c686cabc439a0f.camel@j-davis.com>
 <28779.1569879706@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="rQ2U398070+RC21q"
Content-Disposition: inline
In-Reply-To: <28779.1569879706@sss.pgh.pa.us>
Precedence: bulk


--rQ2U398070+RC21q
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Sep 30, 2019 at 05:41:46PM -0400, Tom Lane wrote:
> Jeff Davis <pgsql@j-davis.com> writes:
>> Looks good to me, though I think you need to update the expected error
>> message in the test you just added.
>=20
> The test case did pass for me when I tried it on an old-openssl machine
> a few hours ago.  I don't think this test has any way to exercise the
> code path where the server has support and the client doesn't (or
> vice versa).

The behaviors of "prefer" which make sense with or without channel
binding support on the client-side is actually what matters here when
the server sends back SCRAM-SHA-256-PLUS over SSL.  We could use a
compile flag and enforce it in a buildfarm animal, or have more modes
within the parameter, but the gains are not really worth the
code complications in my opinion, and the parameter is already
complicated enough.
--
Michael

--rQ2U398070+RC21q
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAl2SoT4ACgkQnvQgOdby
QH2ROA/+PQHHxLsG/uCA6nVoZrP10uMNupWcxSyxh+3J0q5HtrgaL0Z5xHRir8Np
iF6OXTxzCgGCw6PJLHWar6CxIQlrgKWuzejl+3BsWvG+KW13ft2vx/a3NBMgcZnc
eDCvsD4W7hSTu4vnAT1dneXNdJdoPdWnuNpnw/90VPIXX2jfgoHZpAtbKL5bGbiT
8c0bei+qxnQ6CcrmUXsQZe6OouBBGngUn35/JuHbF7MK5fWmD4EeBkCbz+qo6gzp
oI0UR2vkAQz07D2LLYN+5vJfD84QuOKUxKG2aiBxWl5rXmWVWVHGpz5mHf/2rte+
5ymxmPlRVGRRYnGKBGxVmMxWIXyQ6mxgfuZYtGIH/7/QvEnNnoM4cDLSQfOamzt1
prAsopJGN9OMzpsPZ/5boWqvp+X9nzkdkZaOG+iWEMBTMIafvL54wT4ihhUW/Dq8
9jO1hNV9F8/NzH7wLc3gMpqQU7YXOFfKsdgLVkz6bPW+9/e0XbQWCF2m1dhG4Da0
hT+3ENiYjEVUYcjFpK1cwxEhutL/LnQvC3YhmbrR2fmlzv2rexzI3UmOOEJ0fjF2
ucf2RbKC5PhWUUx9iqlaBnFiBzaApR6NCPYZeR3o1tAE89aQ2t1WnCNr5FsqZ2JP
u14u7NMWshf5O/+9T/5SnzJidh4cBi7INp0hia9CoLZM0bZLRyc=
=JOsj
-----END PGP SIGNATURE-----

--rQ2U398070+RC21q--