Support SCRAM channel binding for Postgres 11

postgres-openssl/Cargo.toml

@@ -4,6 +4,6 @@ version = "0.1.0"
 authors = ["Steven Fackler <sfackler@gmail.com>"]
 
 [dependencies]
-openssl = "0.10"
+openssl = "0.10.9"
 
 postgres = { version = "0.15", path = "../postgres" }

postgres-openssl/src/lib.rs

@@ -2,6 +2,8 @@ pub extern crate openssl;
 extern crate postgres;
 
 use openssl::error::ErrorStack;
+use openssl::hash::MessageDigest;
+use openssl::nid::Nid;
 use openssl::ssl::{ConnectConfiguration, SslConnector, SslMethod, SslStream};
 use postgres::tls::{Stream, TlsHandshake, TlsStream};
 use std::error::Error;
@@ -84,4 +86,19 @@ impl TlsStream for OpenSslStream {
     fn get_mut(&mut self) -> &mut Stream {
         self.0.get_mut()
     }
+
+    fn tls_server_end_point(&self) -> Option<Vec<u8>> {
+        let cert = self.0.ssl().peer_certificate()?;
+        let algo_nid = cert.signature_algorithm().object().nid();
+        let signature_algorithms = algo_nid.signature_algorithms()?;
+
+        let md = match signature_algorithms.digest {
+            Nid::MD5 | Nid::SHA1 => MessageDigest::sha256(),
+            nid => MessageDigest::from_nid(nid)?,
+        };
+
+        let digest = cert.digest(md).ok()?;
+
+        Some(digest.to_vec())
+    }
 }

postgres-openssl/src/test.rs

@@ -4,7 +4,7 @@ use postgres::{Connection, TlsMode};
 use OpenSsl;
 
 #[test]
-fn test_require_ssl_conn() {
+fn require() {
     let mut builder = SslConnector::builder(SslMethod::tls()).unwrap();
     builder.set_ca_file("../test/server.crt").unwrap();
     let negotiator = OpenSsl::with_connector(builder.build());
@@ -16,7 +16,7 @@ fn test_require_ssl_conn() {
 }
 
 #[test]
-fn test_prefer_ssl_conn() {
+fn prefer() {
     let mut builder = SslConnector::builder(SslMethod::tls()).unwrap();
     builder.set_ca_file("../test/server.crt").unwrap();
     let negotiator = OpenSsl::with_connector(builder.build());
@@ -26,3 +26,15 @@ fn test_prefer_ssl_conn() {
     ).unwrap();
     conn.execute("SELECT 1::VARCHAR", &[]).unwrap();
 }
+
+#[test]
+fn scram_user() {
+    let mut builder = SslConnector::builder(SslMethod::tls()).unwrap();
+    builder.set_ca_file("../test/server.crt").unwrap();
+    let negotiator = OpenSsl::with_connector(builder.build());
+    let conn = Connection::connect(
+        "postgres://scram_user:password@localhost:5433/postgres",
+        TlsMode::Require(&negotiator),
+    ).unwrap();
+    conn.execute("SELECT 1::VARCHAR", &[]).unwrap();
+}