From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jeff Davis <jdavis@postgresql.org>
Cc: pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add libpq parameter 'channel_binding'.
Date: Sun, 29 Sep 2019 12:51:31 -0400
Message-ID: <24857.1569775891@sss.pgh.pa.us> (raw)
In-Reply-To: <E1iCVWg-00057D-8U@gemulon.postgresql.org>
References: <E1iCVWg-00057D-8U@gemulon.postgresql.org>
Jeff Davis <jdavis@postgresql.org> writes:
> Add libpq parameter 'channel_binding'.
I found out the hard way that the added ssl tests fall over on a
platform that doesn't HAVE_X509_GET_SIGNATURE_NID:
# Running: psql -X -A -t -c SELECT $$connected with user=ssltestuser channel_bin
ding=require$$ -d dbname=trustdb sslmode=require sslcert=invalid sslrootcert=inv
alid hostaddr=127.0.0.1 user=ssltestuser channel_binding=require
psql: error: could not connect to server: channel binding is required, but serve
r did not offer an authentication method that supports channel binding
not ok 5 - SCRAM with SSL and channel_binding=require
# Failed test 'SCRAM with SSL and channel_binding=require'
# at t/002_scram.pl line 63.
I don't think that it's acceptable for the test to fail on a platform
that we're willing to compile on. Maybe just skip these tests if we
lack X509_get_signature_nid?
Another point is that this error message is misleading --- or at least
would be misleading if the server had X509_get_signature_nid and the
client didn't. Perhaps do something like
diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.cindex 04118d5..4289551 100644--- a/src/interfaces/libpq/fe-auth.c+++ b/src/interfaces/libpq/fe-auth.c@@ -476,9 +476,15 @@ pg_SASL_init(PGconn *conn, int payloadlen)
* supported by the client if a hash of the peer certificate
* can be created, and if channel_binding is not disabled.
*/
-#ifdef HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
if (conn->channel_binding[0] != 'd') /* disable */
+ {+#ifdef HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
selected_mechanism = SCRAM_SHA_256_PLUS_NAME;
+#else+ printfPQExpBuffer(&conn->errorMessage,+ libpq_gettext("client does not support SCRAM-SHA-256-PLUS authentication\n"));+ goto error;+ }
#endif
}
else
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: tgl@sss.pgh.pa.us, jdavis@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add libpq parameter 'channel_binding'.
In-Reply-To: <24857.1569775891@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox