Skip to content

Commit 72f1523

Browse files
levkklevkk
authored
Support SCRAM via TLS for client connections (#530)
* Fix #48 * remove sha * Sleep before checking process * Use tls in CI
1 parent 9c49667 commit 72f1523

File tree

10 files changed

+110
-10
lines changed

10 files changed

+110
-10
lines changed

‎Cargo.lock‎

Lines changed: 1 addition & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎integration/complex/shutdown.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ pushd ${SCRIPT_DIR}
1212
python shutdown.py pgdog
1313
popd
1414

15+
sleep 1
16+
1517
if pgrep pgdog; then
1618
echo "Shutdown failed"
1719
exit 1
@@ -24,6 +26,8 @@ pushd ${SCRIPT_DIR}
2426
python shutdown.py pgdog_sharded
2527
popd
2628

29+
sleep 1
30+
2731
if pgrep pgdog; then
2832
echo "Shutdown failed"
2933
exit 1

‎integration/pgdog.toml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ query_cache_limit = 500
1616
pub_sub_channel_size = 4098
1717
two_phase_commit = false
1818
healthcheck_port = 8080
19+
tls_certificate = "integration/tls/cert.pem"
20+
tls_private_key = "integration/tls/key.pem"
1921

2022
# ------------------------------------------------------------------------------
2123
# ----- Database :: pgdog ------------------------------------------------------

‎integration/tls/cert.pem‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIF7zCCA9egAwIBAgIUbzkoynbPz2lq2enZqe00RMSeQccwDQYJKoZIhvcNAQEL
3+
BQAwgYYxCzAJBgNVBAYTAlhYMRIwEAYDVQQIDAlTdGF0ZU5hbWUxETAPBgNVBAcM
4+
CENpdHlOYW1lMRQwEgYDVQQKDAtDb21wYW55TmFtZTEbMBkGA1UECwwSQ29tcGFu
5+
eVNlY3Rpb25OYW1lMR0wGwYDVQQDDBRDb21tb25OYW1lT3JIb3N0bmFtZTAeFw0y
6+
NDEyMjkwMDEzMjVaFw0zNDEyMjcwMDEzMjVaMIGGMQswCQYDVQQGEwJYWDESMBAG
7+
A1UECAwJU3RhdGVOYW1lMREwDwYDVQQHDAhDaXR5TmFtZTEUMBIGA1UECgwLQ29t
8+
cGFueU5hbWUxGzAZBgNVBAsMEkNvbXBhbnlTZWN0aW9uTmFtZTEdMBsGA1UEAwwU
9+
Q29tbW9uTmFtZU9ySG9zdG5hbWUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
10+
AoICAQCXeyKPV5zhBok+yeGgTYQjO+SakHkJ80NSxkKqXi1bIwlHZukROEt4T7h5
11+
qiV3TlomC5d6iUnLOG8EDFuZfIfRZOsvF99aCzk92MQ+EcezLSm3EXZm2+LjVH5s
12+
hWcDxc7X6T8ZTcOTRnlO0RamYgUtuI/0kPK0mj+cJNF8OKXrz74BdwKvn+VmLY4H
13+
fW1Y49FylSKIZGyb56ki24yzcwSBaSuwW8XkknuTW/w3ScmUTlwKvg55HmAqi2XC
14+
OV0+I09XtoXGxde80DU1e/5NYjXxJ3IokiEByKMLBpVi3/B+p3VxsIHskTKjDSh0
15+
AyNZyacnqHtoWoHaU1iD9k/aJjK3StTJZl3JZr/SrV1u1evRZF9IlayZagaYauTq
16+
Ms5MHie9M822x108viYMfWTtzXai5VNTWBz3Agpr459JD5cL1XFxeuGj1csRQ5dV
17+
SbfeZF8s/lE6aMxUn1uLQyd2W+44RchgGfb1ek6KyDFsS1YB0qQNktaGQVnoKtKC
18+
Y0dhUon6r+DN8biO3zm9v95NFql45BiJFLESImF1Qs/FR7LzU/YeFTVffjEpvuVy
19+
kqOEBPqtnNLKXzxpky6qmuSnI5jD3w5Nw68peSyFcTB5Vc0zBfofEraUN8a81mg9
20+
SL491tkI7/6ZkEL+zEKdoJKS3QfTHa03AOIRLuALJH9m1x0P1QIDAQABo1MwUTAd
21+
BgNVHQ4EFgQU6TmTbgrh4q68CxQbs6D1Ql1UN8UwHwYDVR0jBBgwFoAU6TmTbgrh
22+
4q68CxQbs6D1Ql1UN8UwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
23+
AgEAHWca690XikBloy6WEqm6xz8JAe/+Q9SAImvgkdCsw5k07GWUWAW4vEjNtJK5
24+
6D3Ky+zY13gfDy2n7xyum+Kwt01/tXmRLSTv+OE7tA75reBG2ZY9YzV5sLiW9Fza
25+
+ukJCbLdYOuNG7eOr7rQWFrm7ARmRkqPAKA5QCNKszFYUj8C/nmKvrT6N9CUzryv
26+
xGXEXxcQLIf+S7v1yhI18Vbe0B1aDvwruwuULcMmW+OpKHF37NxbcL5dGLMZv1CZ
27+
ezW+zqOurPNvDXHvz/TSDfmUyP8Kl4wnsHYiX+on4ewcPY/yxwMJKOsdPemP6Neg
28+
anJAL15JDC0k2c0YDS8T2JdSt6YmsczD8EUQgWzOBgvM4K4j3qFbe5z1qCGCoMIG
29+
veEWKschmCUu3WBlYZjye4BnAdKAuM54+PJm3Y385zAPhP4aaoQJuJWE9eTEAOAB
30+
s4yBQyHSMq2W2D/Ku1Rt48kU2/2MdSXr+G3vvs7XzpBcrYF341S+MGDF3ErKxgrT
31+
IDRHZBPPiggkJbCjJSoK2MA7grXnxdNb8RU3ZVPM0tMlB3EojXtZesdGadLP6ej9
32+
fE7VMix81WayoY7JrRKN9Q5jGKYhcmVWie4M0W2Ypl6pZ4Y7L/7jNijYvDeh6j14
33+
m5Z+/IpLsssLk6K1Kdloj3FHZYgHkt1Lh1XphOJ/yL8xmOw=
34+
-----END CERTIFICATE-----

‎integration/tls/key.pem‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCXeyKPV5zhBok+
3+
yeGgTYQjO+SakHkJ80NSxkKqXi1bIwlHZukROEt4T7h5qiV3TlomC5d6iUnLOG8E
4+
DFuZfIfRZOsvF99aCzk92MQ+EcezLSm3EXZm2+LjVH5shWcDxc7X6T8ZTcOTRnlO
5+
0RamYgUtuI/0kPK0mj+cJNF8OKXrz74BdwKvn+VmLY4HfW1Y49FylSKIZGyb56ki
6+
24yzcwSBaSuwW8XkknuTW/w3ScmUTlwKvg55HmAqi2XCOV0+I09XtoXGxde80DU1
7+
e/5NYjXxJ3IokiEByKMLBpVi3/B+p3VxsIHskTKjDSh0AyNZyacnqHtoWoHaU1iD
8+
9k/aJjK3StTJZl3JZr/SrV1u1evRZF9IlayZagaYauTqMs5MHie9M822x108viYM
9+
fWTtzXai5VNTWBz3Agpr459JD5cL1XFxeuGj1csRQ5dVSbfeZF8s/lE6aMxUn1uL
10+
Qyd2W+44RchgGfb1ek6KyDFsS1YB0qQNktaGQVnoKtKCY0dhUon6r+DN8biO3zm9
11+
v95NFql45BiJFLESImF1Qs/FR7LzU/YeFTVffjEpvuVykqOEBPqtnNLKXzxpky6q
12+
muSnI5jD3w5Nw68peSyFcTB5Vc0zBfofEraUN8a81mg9SL491tkI7/6ZkEL+zEKd
13+
oJKS3QfTHa03AOIRLuALJH9m1x0P1QIDAQABAoICABtzVrqzpYv4v3/HnVHLok2x
14+
QZbJ5glJ0lIqd/PAL8dzdK/CBCvY8AI8LiGsFfCGHBuHX7q2rM79Kc8Jv0Kz+LfX
15+
KjBlStYaMRQWV0+pMK91WHkimrp+j+Hi0qsvTJD4NGjXjZX0C+RBMeP4y3o4ypfz
16+
uXCYIMdeKXdOC8FPUbAHPDcvPicd2ngW+sU8M0fXtwGk6XZefnkNNM8KireNOQyL
17+
hr2Fj/nBGtBEK9NIFZXA0nim4uALg2FKVBUriIxlYTAztQ/lk9gVQgMwdk/HI5/R
18+
JmSYQI9+cJ9joMgjbUVCauvAkPbSBCNck89cLziK7LXo1/474oqyLljxlpxhbjCV
19+
8i9BL6la06DXZULrBryKPc2Ds0eRDW45Sp7oYMR0AzE1iC1d11SvtyVVL3QFxyMj
20+
NMTZdt13ypL3x4JCtWSq+cOpmwaQkRhUJMGCeGjBPD37q3wDJW6FePLoIBu4ZeY2
21+
mRj/qTsfuUjqWB29VyqhnVoBuU4ifsmxNJO2Or2NI/sd1mCA9pYVKK2oPNzSPg78
22+
e9USRTOc8XO9XFUgnGUFdGQYNRNEQ4zLf0RnKZGGQodUQXMA8Px01tW0/eIf/aCt
23+
f1xiXpoqM1cFjjPxvpWc6gGgYlhEfcqMpWZ3XjJ4a9XrR5KVW+dWc44JgXKObgmI
24+
0lk9TDAljQr5yfnkEvSRAoIBAQDU2OiMRabtmtFHndreOCiE61B3YJQ1PpxQn/u+
25+
BJ9KZ3TiE+Z4M4yRXy6HqGVPY2mXeSf6eOtXmmRbQX86YBatsj7ibHDX1f54Ijr3
26+
auw+/ywwt7SwXfHeJpr4+HxluF9+A/NrBQoZeyyU0TxhbxHBYQH2RHySwnSidYW9
27+
l2PgoaVfEYc+/cuadwB333UuKNdPXFY6mhQt9NjqofflkEP720icSIfCzFUvRIgd
28+
3+H3SXb9ry5lXNn8b/TUTPQyA1Ni+lp+6p8bT6rD7VanuEUeKtCb/Ie2xwoTbGd7
29+
sTQRURdG3is2y94kLRwdP7cjGO+M5vZITkexGV4m7km0CsuRAoIBAQC2MTljmXOM
30+
sMNcHx3WKGzQYNPjf2XWmW3wP/rrt5lVt7WYlkart+whgcDWJVqMDOuviJdHbFCh
31+
LxfIjHoe8T/ZLDT0CynUMfsoxRkLedYEp1TVkLD+9P89ZnGYUSJ28uBflQ3RHzOg
32+
1kkne1LqYjyOkKuBFI9oGHlN6MsHxD8KkbY6cMIXZdPFABGwgewATW5/pvs4UztS
33+
Dhte0ma7NU/A68K+aVUXm35+akIhNxd535afz+XWuiBZc13kThhExFBZEh19upCc
34+
e1DLCVhHefKLnoO0AS89KtoNs7aHXQucr/MEI93imNz/IMC32YPUmzHQw8tN6o4Y
35+
U2lu81KgTrYFAoIBAGUneM1BROXjD9bDVIMLmWYiFynEwmrTiKJghdl2hOVtaYUQ
36+
BBXYGdP0sj5Sb2NdUY9lSvSkhuQpQcyEwhxSEjUWYwBknPRWhQs+6Vswe3os9ylo
37+
BP1UiGAVZM0x+py1FNzkr8iKqpQVj8hh8Bo2GPAYVEBfp/xvYdLbm2XRDuxwphEa
38+
WXY8U4jjSVuu3RfE3R6gOXK8Sx7UIErSEugMueJ2AnoTlkGjrlA6d54LCm7lgSFr
39+
IdeWWxq3cll7AQrLvdNqO5vZkSf/op5eqzImRuLhYibfyve4fDdi64NDYgVgznkl
40+
mM//72Ct95CG+Vg6v43tLdqLKVMnRTGnSWvBPaECggEAKtTRqA+YMZgQpWSPUBx6
41+
0FYjGhWGLHgvd06jP60O+C7TG0cg4BfCBHKLkgyAB/K1qbOT1O+q2OnITpZv0zxm
42+
BTk2TbUeJUuGvyPu6lq/LKLl97snURjptFaUF/ni/1HD29Sfxezu5z3ZPtXoPT/Q
43+
+rcaCqN5v0AZrG4w5OeG5oYw7/Y4OuXubh7BCdzRTZTmiE4KO0id5oF4f8c47YPv
44+
9uu2AaujnIQqra9vUn2wIC+nKnTmlJ93IXBUv2p4nBoGxZnTow4sFw2KheDxhwQt
45+
OBOQ5M1ufJPJZXU9UP9XzoMyv2NrM206byQVCmOxcVb21BxjfDLLKv7ZB4Nehl9a
46+
vQKCAQAvj/s5kaxv5BKGOce0GYkMUgEHXqHLp5hg07EDuuJbEev5Vq1zZdFffBEc
47+
xWxXU8gChIsfiTzYDZdoAxJN4M6OoVPFz2LKSPlxRkesD8+bZA5xhGphLk0jR6Ly
48+
lZJD7lqgG6F1NfzcqYnjZoPlYeaSLvkCoNkJmwYFNTXoK6b+wZj/ghsFj98sZZv/
49+
daNN/0BACowwrvJX6cJfN1MOkbe4rvuMBdgUMG2nb4kOr9uB2yHt4cPDfoLBDiSw
50+
0hsPmpvOhof9VnUyQFFSzgr0Au5943DjLVMAtbAdnoqhjePnyNteq2grIcmVZ/oL
51+
WwV6cBrpOmlqZKPrar6DXY2NLWf/
52+
-----END PRIVATE KEY-----

‎integration/tls/pgdog.toml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
[general]
2+
tls_certificate = "cert.pem"
3+
tls_private_key = "key.pem"
4+
5+
[[databases]]
6+
name = "pgdog"
7+
host = "127.0.0.1"

‎integration/tls/users.toml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[[users]]
2+
name = "pgdog"
3+
password = "pgdog"
4+
database = "pgdog"

‎pgdog/Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ toml = "0.8"
3838
pgdog-plugin = { path = "../pgdog-plugin", version = "0.1.8" }
3939
tokio-util = { version = "0.7", features = ["rt"] }
4040
fnv = "1"
41-
scram = "0.6"
41+
scram = { git = "https://github.com/pgdogdev/scram.git", rev = "848003d" }
4242
base64 = "0.22"
4343
md5 = "0.7"
4444
futures = "0.3"

‎pgdog/src/config/general.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ use super::networking::TlsVerifyMode;
1010
use super::pooling::{PoolerMode, PreparedStatements};
1111

1212
#[derive(Serialize, Deserialize, Debug, Clone)]
13+
#[serde(deny_unknown_fields)]
1314
pub struct General {
1415
/// Run on this address.
1516
#[serde(default = "General::host")]

‎pgdog/src/frontend/client/mod.rs‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -188,11 +188,8 @@ impl Client {
188188
};
189189

190190
let auth_type = &config.config.general.auth_type;
191-
let auth_ok = match (auth_type, stream.is_tls()) {
192-
// TODO: SCRAM doesn't work with TLS currently because of
193-
// lack of support for channel binding in our scram library.
194-
// Defaulting to MD5.
195-
(AuthType::Scram, true) | (AuthType::Md5, _) => {
191+
let auth_ok = match auth_type {
192+
AuthType::Md5 => {
196193
let md5 = md5::Client::new(user, password);
197194
stream.send_flush(&md5.challenge()).await?;
198195
let password = Password::from_bytes(stream.read().await?.to_bytes()?)?;
@@ -203,15 +200,15 @@ impl Client {
203200
}
204201
}
205202

206-
(AuthType::Scram, false) => {
203+
AuthType::Scram => {
207204
stream.send_flush(&Authentication::scram()).await?;
208205

209206
let scram = Server::new(password);
210207
let res = scram.handle(&mut stream).await;
211208
matches!(res, Ok(true))
212209
}
213210

214-
(AuthType::Trust, _) => true,
211+
AuthType::Trust => true,
215212
};
216213

217214
if !auth_ok {

0 commit comments

Comments
 (0)