* Initialize SASL authentication exchange. */
| 421 | * Initialize SASL authentication exchange. |
| 422 | */ |
| 423 | static int |
| 424 | pg_SASL_init(PGconn *conn, int payloadlen) |
| 425 | { |
| 426 | char *initialresponse = NULL; |
| 427 | int initialresponselen; |
| 428 | bool done; |
| 429 | bool success; |
| 430 | const char *selected_mechanism; |
| 431 | PQExpBufferData mechanism_buf; |
| 432 | char *password; |
| 433 | |
| 434 | initPQExpBuffer(&mechanism_buf); |
| 435 | |
| 436 | if (conn->channel_binding[0] == 'r' && /* require */ |
| 437 | !conn->ssl_in_use) |
| 438 | { |
| 439 | appendPQExpBufferStr(&conn->errorMessage, |
| 440 | libpq_gettext("channel binding required, but SSL not in use\n")); |
| 441 | goto error; |
| 442 | } |
| 443 | |
| 444 | if (conn->sasl_state) |
| 445 | { |
| 446 | appendPQExpBufferStr(&conn->errorMessage, |
| 447 | libpq_gettext("duplicate SASL authentication request\n")); |
| 448 | goto error; |
| 449 | } |
| 450 | |
| 451 | /* |
| 452 | * Parse the list of SASL authentication mechanisms in the |
| 453 | * AuthenticationSASL message, and select the best mechanism that we |
| 454 | * support. SCRAM-SHA-256-PLUS and SCRAM-SHA-256 are the only ones |
| 455 | * supported at the moment, listed by order of decreasing importance. |
| 456 | */ |
| 457 | selected_mechanism = NULL; |
| 458 | for (;;) |
| 459 | { |
| 460 | if (pqGets(&mechanism_buf, conn)) |
| 461 | { |
| 462 | appendPQExpBufferStr(&conn->errorMessage, |
| 463 | "fe_sendauth: invalid authentication request from server: invalid list of authentication mechanisms\n"); |
| 464 | goto error; |
| 465 | } |
| 466 | if (PQExpBufferDataBroken(mechanism_buf)) |
| 467 | goto oom_error; |
| 468 | |
| 469 | /* An empty string indicates end of list */ |
| 470 | if (mechanism_buf.data[0] == '\0') |
| 471 | break; |
| 472 | |
| 473 | /* |
| 474 | * Select the mechanism to use. Pick SCRAM-SHA-256-PLUS over anything |
| 475 | * else if a channel binding type is set and if the client supports it |
| 476 | * (and did not set channel_binding=disable). Pick SCRAM-SHA-256 if |
| 477 | * nothing else has already been picked. If we add more mechanisms, a |
| 478 | * more refined priority mechanism might become necessary. |
| 479 | */ |
| 480 | if (strcmp(mechanism_buf.data, SCRAM_SHA_256_PLUS_NAME) == 0) |
no test coverage detected