diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2018-01-04 15:18:39 -0500 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2018-01-04 15:29:50 -0500 |
| commit | d3fb72ea6de58d285e278459bca9d7cdf7f6a38b (patch) | |
| tree | 27a374b84f98441e85da97a68dd4d144c699f38a /src/backend/libpq/auth-scram.c | |
| parent | 39cfe86195f0b5cbc5fbe8d4e3aa6e2b0e322d0b (diff) | |
| download | postgresql-d3fb72ea6de58d285e278459bca9d7cdf7f6a38b.tar.gz postgresql-d3fb72ea6de58d285e278459bca9d7cdf7f6a38b.zip | |
Implement channel binding tls-server-end-point for SCRAM
This adds a second standard channel binding type for SCRAM. It is
mainly intended for third-party clients that cannot implement
tls-unique, for example JDBC.
Author: Michael Paquier <michael.paquier@gmail.com>
Diffstat (limited to 'src/backend/libpq/auth-scram.c')
| -rw-r--r-- | src/backend/libpq/auth-scram.c | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/src/backend/libpq/auth-scram.c b/src/backend/libpq/auth-scram.c index 1b07eaebfac..48eb531d0f0 100644 --- a/src/backend/libpq/auth-scram.c +++ b/src/backend/libpq/auth-scram.c @@ -849,13 +849,14 @@ read_client_first_message(scram_state *state, char *input) } /* - * Read value provided by client; only tls-unique is supported - * for now. (It is not safe to print the name of an - * unsupported binding type in the error message. Pranksters - * could print arbitrary strings into the log that way.) + * Read value provided by client. (It is not safe to print + * the name of an unsupported binding type in the error + * message. Pranksters could print arbitrary strings into the + * log that way.) */ channel_binding_type = read_attr_value(&input, 'p'); - if (strcmp(channel_binding_type, SCRAM_CHANNEL_BINDING_TLS_UNIQUE) != 0) + if (strcmp(channel_binding_type, SCRAM_CHANNEL_BINDING_TLS_UNIQUE) != 0 && + strcmp(channel_binding_type, SCRAM_CHANNEL_BINDING_TLS_END_POINT) != 0) ereport(ERROR, (errcode(ERRCODE_PROTOCOL_VIOLATION), (errmsg("unsupported SCRAM channel-binding type")))); @@ -1116,6 +1117,15 @@ read_client_final_message(scram_state *state, char *input) cbind_data = be_tls_get_peer_finished(state->port, &cbind_data_len); #endif } + else if (strcmp(state->channel_binding_type, + SCRAM_CHANNEL_BINDING_TLS_END_POINT) == 0) + { + /* Fetch hash data of server's SSL certificate */ +#ifdef USE_SSL + cbind_data = be_tls_get_certificate_hash(state->port, + &cbind_data_len); +#endif + } else { /* should not happen */ |