Re: [JDBC] [HACKERS] Channel binding support for SCRAM-SHA-256

On 12/22/17 03:10, Michael Paquier wrote:
> On Fri, Dec 22, 2017 at 11:59 AM, Michael Paquier
> <michael(dot)paquier(at)gmail(dot)com> wrote:
>> I have looked at how things could be done in symmetry for both the frontend
>> and backend code, and I have produced the attached patch 0002, which
>> can be applied on top of 0001 implementing tls-server-end-point. This
>> simplifies the interfaces to initialize the SCRAM status data by saving
>> into scram_state and fe_scram_state respectively Port* and PGconn* which
>> holds most of the data needed for the exchange. With this patch, cbind_data
>> is generated only if a specific channel binding type is used with the
>> appropriate data. So if no channel binding is used there is no additional
>> SSL call done to get the TLS finished data or the server certificate hash.
>>
>> 0001 has no real changes compared to the last versions.
>
> Second thoughts on 0002 as there is actually no need to move around
> errorMessage if the PGconn* pointer is saved in the SCRAM status data
> as both are linked. The attached simplifies the logic even more.
>

That all looks pretty reasonable.

I'm working through patch 0001 now. I haven't found any documentation
on the function OBJ_find_sigid_algs(). What does it do? One might
think that the nid returned by X509_get_signature_nid() is already the
algo_nid we want to use, but there appears to be more to this.

--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services