From: Jacob Champion <pchampion@vmware.com>
To: michael@paquier.xyz <michael@paquier.xyz>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Pull general SASL framework out of SCRAM
Date: Wed, 7 Jul 2021 15:07:14 +0000
Message-ID: <5cf3c71d51a215d4103abcc686c69e79619e7b60.camel@vmware.com> (raw)
In-Reply-To: <YOU2xFL/WoHl6ny0@paquier.xyz>
References: <3d2a6f5d50e741117d6baf83eb67ebf1a8a35a11.camel@vmware.com>
<YNLlBncQGBIAMWho@paquier.xyz>
<9dc553fe86ba34bff1e0b636c493b527fc7bc030.camel@vmware.com>
<YNZ5Bqq4GvhNvbp0@paquier.xyz>
<0907fda41fb40b23e2cbdf7eb05a8d61dd5307b3.camel@vmware.com>
<YOLAIngluq5wOmgE@paquier.xyz>
<39a6bd825fd776f5f9c3a8eb7ca1c62f77cea433.camel@vmware.com>
<YOU2xFL/WoHl6ny0@paquier.xyz>
On Wed, 2021-07-07 at 14:08 +0900, Michael Paquier wrote:
> On Tue, Jul 06, 2021 at 06:20:49PM +0000, Jacob Champion wrote:
> > On Mon, 2021-07-05 at 17:17 +0900, Michael Paquier wrote:
> >
> > > Hmm. Does the RFCs tell us anything about that?
> >
> > Just in general terms:
> >
> > > Each authentication exchange consists of a message from the client to
> > > the server requesting authentication via a particular mechanism,
> > > followed by one or more pairs of challenges from the server and
> > > responses from the client, followed by a message from the server
> > > indicating the outcome of the authentication exchange. (Note:
> > > exchanges may also be aborted as discussed in Section 3.5.)
> >
> > So a challenge must be met with a response, or the exchange must be
> > aborted. (And I don't think our protocol implementation provides a
> > client abort message; if something goes wrong, we just tear down the
> > connection.)
>
> Thanks. At the same time, section 3.5 also says that the client may
> send a message to abort. So one can interpret that the client has
> also the choice to abort without sending a response back to the
> server? Or I am just interpreting incorrectly the use of "may" in
> this context?
That's correct. But the client may not simply ignore the challenge and
keep the exchange open waiting for a new one, as pg_SASL_continue()
currently allows. That's what my TODO is referring to.
--Jacob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: pchampion@vmware.com, michael@paquier.xyz
Subject: Re: [PATCH] Pull general SASL framework out of SCRAM
In-Reply-To: <5cf3c71d51a215d4103abcc686c69e79619e7b60.camel@vmware.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox