From: Michael Paquier <michael@paquier.xyz>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jeff Davis <pgsql@j-davis.com>
Cc: Jeff Davis <jdavis@postgresql.org>
Cc: pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add libpq parameter 'channel_binding'.
Date: Tue, 1 Oct 2019 11:04:30 +0900
Message-ID: <20191001020430.GD2781@paquier.xyz> (raw)
In-Reply-To: <19002.1569867629@sss.pgh.pa.us>
References: <E1iCVWg-00057D-8U@gemulon.postgresql.org>
<24857.1569775891@sss.pgh.pa.us>
<20190929234733.GA2888@paquier.xyz>
<20190930064539.GK2888@paquier.xyz>
<20190930070826.GM2888@paquier.xyz>
<11a5c3b483f1c0140f9fc5cf863d8ac61a28e60a.camel@j-davis.com>
<19002.1569867629@sss.pgh.pa.us>
On Mon, Sep 30, 2019 at 02:20:29PM -0400, Tom Lane wrote:
> Jeff Davis <pgsql@j-davis.com> writes:
>> For 2-3, shouldn't we error at an earlier stage? The user of the client
>> has requested something impossible to satisfy.
>
> Can't get excited about that. It'd require duplicating this code
> somewhere else, which is a maintenance issue. And the case of building
> with obsolete OpenSSL ought to be fairly infrequent and getting more so
> as time goes on, so I'm not really eager to expend lots of work on it.
Neither am I, and there is one extra reason on top of what Tom has
mentioned: there is still value in warning the client if a rogue
server sends SCRAM-SHA-256-PLUS without SSL even if channel_binding is
required.
I have double-checked the patch and done more tests (server publishing
SCRAM-SHA-256-PLUS with various libpq clients). I have included the
full description of the behavior in the commit log, and applied it.
--
Michael
Attachments:
[application/pgp-signature] signature.asc (832B, ../20191001020430.GD2781@paquier.xyz/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: michael@paquier.xyz, tgl@sss.pgh.pa.us, pgsql@j-davis.com, jdavis@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add libpq parameter 'channel_binding'.
In-Reply-To: <20191001020430.GD2781@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox