diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2017-11-18 10:07:57 -0500 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2017-11-18 10:15:54 -0500 |
| commit | 9288d62bb4b6f302bf13bb2fed3783b61385f315 (patch) | |
| tree | 2b6fa3bf8940b1f8d2ec77fc367fd750de82390d /src/interfaces/libpq/libpq-int.h | |
| parent | 611fe7d4793ba6516e839dc50b5319b990283f4f (diff) | |
Support channel binding 'tls-unique' in SCRAM
This is the basic feature set using OpenSSL to support the feature. In
order to allow the frontend and the backend to fetch the sent and
expected TLS Finished messages, a PG-like API is added to be able to
make the interface pluggable for other SSL implementations.
This commit also adds a infrastructure to facilitate the addition of
future channel binding types as well as libpq parameters to control the
SASL mechanism names and channel binding names. Those will be added by
upcoming commits.
Some tests are added to the SSL test suite to test SCRAM authentication
with channel binding.
Author: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Diffstat (limited to 'src/interfaces/libpq/libpq-int.h')
| -rw-r--r-- | src/interfaces/libpq/libpq-int.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h index 42913604e39..8412ee81607 100644 --- a/src/interfaces/libpq/libpq-int.h +++ b/src/interfaces/libpq/libpq-int.h @@ -453,11 +453,13 @@ struct pg_conn /* Assorted state for SASL, SSL, GSS, etc */ void *sasl_state; + /* SSL structures */ + bool ssl_in_use; + #ifdef USE_SSL bool allow_ssl_try; /* Allowed to try SSL negotiation */ bool wait_ssl_try; /* Delay SSL negotiation until after * attempting normal connection */ - bool ssl_in_use; #ifdef USE_OPENSSL SSL *ssl; /* SSL status, if have SSL connection */ X509 *peer; /* X509 cert of server */ @@ -668,6 +670,7 @@ extern void pgtls_close(PGconn *conn); extern ssize_t pgtls_read(PGconn *conn, void *ptr, size_t len); extern bool pgtls_read_pending(PGconn *conn); extern ssize_t pgtls_write(PGconn *conn, const void *ptr, size_t len); +extern char *pgtls_get_finished(PGconn *conn, size_t *len); /* * this is so that we can check if a connection is non-blocking internally |