database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

Add libpq parameter 'channel_binding'.

Browse Source 
Allow clients to require channel binding to enhance security against
untrusted servers.

Author: Jeff Davis
Reviewed-by: Michael Paquier
Discussion: https://postgr.es/m/227015d8417f2b4fef03f8966dbfa5cbcc4f44da.camel%40j-davis.com
This commit is contained in:
Jeff Davis
2019-09-23 13:45:23 -07:00
parent 13cd97e6c8
commit d6e612f837
9 changed files with 233 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
doc/src/sgml/libpq.sgml
View File

@ -1122,6 +1122,28 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
</listitem>
</varlistentry>
<varlistentry id="libpq-connect-channel-binding" xreflabel="channel_binding">
<term><literal>channel_binding</literal></term>
<listitem>
<para>
This option controls the client's use of channel binding. A setting
of <literal>require</literal> means that the connection must employ
channel binding, <literal>prefer</literal> means that the client will
choose channel binding if available, and <literal>disable</literal>
prevents the use of channel binding. The default
is <literal>prefer</literal> if
<productname>PostgreSQL</productname> is compiled with SSL support;
otherwise the default is <literal>disable</literal>.
</para>
<para>
Channel binding is a method for the server to authenticate itself to
the client. It is only supported over SSL connections
with <productname>PostgreSQL</productname> 11 or later servers using
the <literal>SCRAM</literal> authentication method.
</para>
</listitem>
</varlistentry>
<varlistentry id="libpq-connect-connect-timeout" xreflabel="connect_timeout">
<term><literal>connect_timeout</literal></term>
<listitem>
@ -6864,6 +6886,16 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
</para>
</listitem>
<listitem>
<para>
<indexterm>
<primary><envar>PGCHANNELBINDING</envar></primary>
</indexterm>
<envar>PGCHANNELBINDING</envar> behaves the same as the <xref
linkend="libpq-connect-channel-binding"/> connection parameter.
</para>
</listitem>
<listitem>
<para>
<indexterm>