Support channel binding 'tls-unique' in SCRAM
authorPeter Eisentraut <peter_e@gmx.net>
Sat, 18 Nov 2017 15:07:57 +0000 (10:07 -0500)
committerPeter Eisentraut <peter_e@gmx.net>
Sat, 18 Nov 2017 15:15:54 +0000 (10:15 -0500)
commit9288d62bb4b6f302bf13bb2fed3783b61385f315
tree2b6fa3bf8940b1f8d2ec77fc367fd750de82390d
parent611fe7d4793ba6516e839dc50b5319b990283f4f
Support channel binding 'tls-unique' in SCRAM

This is the basic feature set using OpenSSL to support the feature.  In
order to allow the frontend and the backend to fetch the sent and
expected TLS Finished messages, a PG-like API is added to be able to
make the interface pluggable for other SSL implementations.

This commit also adds a infrastructure to facilitate the addition of
future channel binding types as well as libpq parameters to control the
SASL mechanism names and channel binding names.  Those will be added by
upcoming commits.

Some tests are added to the SSL test suite to test SCRAM authentication
with channel binding.

Author: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
14 files changed:
doc/src/sgml/protocol.sgml
src/backend/libpq/auth-scram.c
src/backend/libpq/auth.c
src/backend/libpq/be-secure-openssl.c
src/include/libpq/libpq-be.h
src/include/libpq/scram.h
src/interfaces/libpq/fe-auth-scram.c
src/interfaces/libpq/fe-auth.c
src/interfaces/libpq/fe-auth.h
src/interfaces/libpq/fe-secure-openssl.c
src/interfaces/libpq/libpq-int.h
src/test/ssl/ServerSetup.pm
src/test/ssl/t/001_ssltests.pl
src/test/ssl/t/002_scram.pl [new file with mode: 0644]