From: | Michael Paquier <michael(dot)paquier(at)gmail(dot)com> |
---|---|
To: | Peter Eisentraut <peter(dot)eisentraut(at)2ndquadrant(dot)com> |
Cc: | PostgreSQL mailing lists <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Allowing SSL connection of v11 client to v10 server with SCRAM channel binding |
Date: | 2017-11-23 02:08:39 |
Message-ID: | CAB7nPqTLB6=hrDPMiPJ+eUPYbv7bKR+N32xPj1mYZfSTQMRU6g@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Thu, Nov 23, 2017 at 4:08 AM, Peter Eisentraut
<peter(dot)eisentraut(at)2ndquadrant(dot)com> wrote:
> On 11/19/17 23:08, Michael Paquier wrote:
>> When using "n" or "y", the data sent by the client to the server about
>> the use of channel binding is a base64-encoded string of respectively
>> "n,," (biws) and "y,," (eSws). However, as noticed by Peter E here, a
>> v10 server is able to allow connections with "n,,", but not with
>> "y,,":
>> https://www.postgresql.org/message-id/887b6fb7-15fe-239e-2aad-5911d2b0945b@2ndquadrant.com
>>
>> When trying to connect to a v11 client based on current HEAD to a v10
>> server using SSL, then the connection would fail. The attached patch,
>> for REL_10_STABLE, allows a server to accept as well as input "eSws",
>> which is a combination that can now happen. This way, a v10 server
>> accepts connections from a v11 and newer client with SSL.
>
> I noticed what I think is an omission in the current v11 code. We also
> need to check whether the channel binding flag (n/y/p) encoded in the
> client-final-message is the same one used in the client-first-message.
> See attached patch. This would also affect what we might end up
> backpatching.
Yes, agreed. This patch looks good to me. In fe-auth-scram.c, it would
be also nice to add a comment to keep in sync the logics in
build_client_first_message() and build_client_final_message() which
assign the cbind flag value. I don't see much need for an assertion or
such.
--
Michael
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2017-11-23 03:58:05 | Re: has_sequence_privilege() never got the memo |
Previous Message | Joe Conway | 2017-11-23 02:01:38 | has_sequence_privilege() never got the memo |