Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit215cb4f

Browse files
committed
Revert "Apply 0005-Refactor-decision-making-of-password-encryption-into.patch + cherry-pickbabe05b"
This reverts commit2cc896b.
1 parentdedd3ba commit215cb4f

File tree

5 files changed

+56
-120
lines changed

5 files changed

+56
-120
lines changed

‎doc/src/sgml/config.sgml

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1166,22 +1166,21 @@ include_dir 'conf.d'
11661166
</varlistentry>
11671167

11681168
<varlistentry id="guc-password-encryption" xreflabel="password_encryption">
1169-
<term><varname>password_encryption</varname> (<type>enum</type>)
1169+
<term><varname>password_encryption</varname> (<type>boolean</type>)
11701170
<indexterm>
11711171
<primary><varname>password_encryption</> configuration parameter</primary>
11721172
</indexterm>
11731173
</term>
11741174
<listitem>
11751175
<para>
1176-
When a password is specified in <xref linkend="sql-createuser"> or
1177-
<xreflinkend="sql-alterrole">without writing either <literal>ENCRYPTED</>
1178-
or <literal>UNENCRYPTED</>, this parameter determines whether the
1179-
password is to be encrypted. The default value is<literal>md5</>, which
1180-
stores the password as an MD5 hash. Setting this to<literal>plain</> stores
1181-
it in plaintext. <literal>on</> and<literal>off</> are also accepted, as
1182-
aliases for <literal>md5</> and <literal>plain</>, respectively.
1176+
When a password is specified in <xref
1177+
linkend="sql-createuser">or
1178+
<xref linkend="sql-alterrole">
1179+
without writing either<literal>ENCRYPTED</> or
1180+
<literal>UNENCRYPTED</>, this parameter determines whether the
1181+
password is to be encrypted. The default is<literal>on</>
1182+
(encrypt the password).
11831183
</para>
1184-
11851184
</listitem>
11861185
</varlistentry>
11871186

‎src/backend/commands/user.c

Lines changed: 31 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ Oidbinary_upgrade_next_pg_authid_oid = InvalidOid;
4444

4545

4646
/* GUC parameter */
47-
intPassword_encryption=PASSWORD_TYPE_MD5;
47+
externboolPassword_encryption;
4848

4949
/* Hook to check passwords in CreateRole() and AlterRole() */
5050
check_password_hook_typecheck_password_hook=NULL;
@@ -55,8 +55,6 @@ static void AddRoleMems(const char *rolename, Oid roleid,
5555
staticvoidDelRoleMems(constchar*rolename,Oidroleid,
5656
List*memberSpecs,List*memberIds,
5757
booladmin_opt);
58-
staticchar*encrypt_password(char*passwd,char*rolname,
59-
intpasswd_type);
6058

6159

6260
/* Check if current user has createrole privileges */
@@ -66,48 +64,6 @@ have_createrole_privilege(void)
6664
returnhas_createrole_privilege(GetUserId());
6765
}
6866

69-
/*
70-
* Encrypt a password if necessary for insertion in pg_authid.
71-
*
72-
* If a password is found as already MD5-encrypted, no error is raised
73-
* to ease the dump and reload of such data. Returns a palloc'ed string
74-
* holding the encrypted password.
75-
*/
76-
staticchar*
77-
encrypt_password(char*password,char*rolname,intpasswd_type)
78-
{
79-
char*res;
80-
81-
Assert(password!=NULL);
82-
83-
/*
84-
* If a password is already identified as MD5-encrypted, it is used
85-
* as such. If the password given is not encrypted, adapt it depending
86-
* on the type wanted by the caller of this routine.
87-
*/
88-
if (isMD5(password))
89-
res=pstrdup(password);
90-
else
91-
{
92-
switch (passwd_type)
93-
{
94-
casePASSWORD_TYPE_PLAINTEXT:
95-
res=pstrdup(password);
96-
break;
97-
casePASSWORD_TYPE_MD5:
98-
res= (char*)palloc(MD5_PASSWD_LEN+1);
99-
if (!pg_md5_encrypt(password,rolname,
100-
strlen(rolname),
101-
res))
102-
elog(ERROR,"password encryption failed");
103-
break;
104-
default:
105-
Assert(0);/* should not come here */
106-
}
107-
}
108-
109-
returnres;
110-
}
11167

11268
/*
11369
* CREATE ROLE
@@ -124,8 +80,8 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
12480
ListCell*item;
12581
ListCell*option;
12682
char*password=NULL;/* user password */
127-
intpassword_type=Password_encryption;/* encrypt password? */
128-
char*encrypted_passwd;
83+
boolencrypt_password=Password_encryption;/* encrypt password? */
84+
charencrypted_password[MD5_PASSWD_LEN+1];
12985
boolissuper= false;/* Make the user a superuser? */
13086
boolinherit= true;/* Auto inherit privileges? */
13187
boolcreaterole= false;/* Can this user create roles? */
@@ -184,9 +140,9 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
184140
parser_errposition(pstate,defel->location)));
185141
dpassword=defel;
186142
if (strcmp(defel->defname,"encryptedPassword")==0)
187-
password_type=PASSWORD_TYPE_MD5;
143+
encrypt_password=true;
188144
elseif (strcmp(defel->defname,"unencryptedPassword")==0)
189-
password_type=PASSWORD_TYPE_PLAINTEXT;
145+
encrypt_password=false;
190146
}
191147
elseif (strcmp(defel->defname,"sysid")==0)
192148
{
@@ -437,13 +393,17 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
437393

438394
if (password)
439395
{
440-
encrypted_passwd=encrypt_password(password,
441-
stmt->role,
442-
password_type);
443-
444-
new_record[Anum_pg_authid_rolpassword-1]=
445-
CStringGetTextDatum(encrypted_passwd);
446-
pfree(encrypted_passwd);
396+
if (!encrypt_password||isMD5(password))
397+
new_record[Anum_pg_authid_rolpassword-1]=
398+
CStringGetTextDatum(password);
399+
else
400+
{
401+
if (!pg_md5_encrypt(password,stmt->role,strlen(stmt->role),
402+
encrypted_password))
403+
elog(ERROR,"password encryption failed");
404+
new_record[Anum_pg_authid_rolpassword-1]=
405+
CStringGetTextDatum(encrypted_password);
406+
}
447407
}
448408
else
449409
new_record_nulls[Anum_pg_authid_rolpassword-1]= true;
@@ -545,8 +505,8 @@ AlterRole(AlterRoleStmt *stmt)
545505
ListCell*option;
546506
char*rolename=NULL;
547507
char*password=NULL;/* user password */
548-
intpassword_type=Password_encryption;/* encrypt password? */
549-
char*encrypted_passwd;
508+
boolencrypt_password=Password_encryption;/* encrypt password? */
509+
charencrypted_password[MD5_PASSWD_LEN+1];
550510
intissuper=-1;/* Make the user a superuser? */
551511
intinherit=-1;/* Auto inherit privileges? */
552512
intcreaterole=-1;/* Can this user create roles? */
@@ -590,9 +550,9 @@ AlterRole(AlterRoleStmt *stmt)
590550
errmsg("conflicting or redundant options")));
591551
dpassword=defel;
592552
if (strcmp(defel->defname,"encryptedPassword")==0)
593-
password_type=PASSWORD_TYPE_MD5;
553+
encrypt_password=true;
594554
elseif (strcmp(defel->defname,"unencryptedPassword")==0)
595-
password_type=PASSWORD_TYPE_PLAINTEXT;
555+
encrypt_password=false;
596556
}
597557
elseif (strcmp(defel->defname,"superuser")==0)
598558
{
@@ -844,14 +804,18 @@ AlterRole(AlterRoleStmt *stmt)
844804
/* password */
845805
if (password)
846806
{
847-
encrypted_passwd=encrypt_password(password,
848-
rolename,
849-
password_type);
850-
851-
new_record[Anum_pg_authid_rolpassword-1]=
852-
CStringGetTextDatum(encrypted_passwd);
807+
if (!encrypt_password||isMD5(password))
808+
new_record[Anum_pg_authid_rolpassword-1]=
809+
CStringGetTextDatum(password);
810+
else
811+
{
812+
if (!pg_md5_encrypt(password,rolename,strlen(rolename),
813+
encrypted_password))
814+
elog(ERROR,"password encryption failed");
815+
new_record[Anum_pg_authid_rolpassword-1]=
816+
CStringGetTextDatum(encrypted_password);
817+
}
853818
new_record_repl[Anum_pg_authid_rolpassword-1]= true;
854-
pfree(encrypted_passwd);
855819
}
856820

857821
/* unset password */

‎src/backend/utils/misc/guc.c

Lines changed: 13 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@
3535
#include"catalog/namespace.h"
3636
#include"commands/async.h"
3737
#include"commands/prepare.h"
38-
#include"commands/user.h"
3938
#include"commands/vacuum.h"
4039
#include"commands/variable.h"
4140
#include"commands/trigger.h"
@@ -396,24 +395,6 @@ static const struct config_enum_entry force_parallel_mode_options[] = {
396395
{NULL,0, false}
397396
};
398397

399-
/*
400-
* password_encryption used to be a boolean, so accept all the likely
401-
* variants of "on" and "off", too.
402-
*/
403-
staticconststructconfig_enum_entrypassword_encryption_options[]= {
404-
{"plain",PASSWORD_TYPE_PLAINTEXT, false},
405-
{"md5",PASSWORD_TYPE_MD5, false},
406-
{"off",PASSWORD_TYPE_PLAINTEXT, false},
407-
{"on",PASSWORD_TYPE_MD5, false},
408-
{"true",PASSWORD_TYPE_MD5, true},
409-
{"false",PASSWORD_TYPE_PLAINTEXT, true},
410-
{"yes",PASSWORD_TYPE_MD5, true},
411-
{"no",PASSWORD_TYPE_PLAINTEXT, true},
412-
{"1",PASSWORD_TYPE_MD5, true},
413-
{"0",PASSWORD_TYPE_PLAINTEXT, true},
414-
{NULL,0, false}
415-
};
416-
417398
/*
418399
* Options for enum values stored in other modules
419400
*/
@@ -444,6 +425,8 @@ boolcheck_function_bodies = true;
444425
booldefault_with_oids= false;
445426
boolSQL_inheritance= true;
446427

428+
boolPassword_encryption= true;
429+
447430
intlog_min_error_statement=ERROR;
448431
intlog_min_messages=WARNING;
449432
intclient_min_messages=NOTICE;
@@ -1342,6 +1325,17 @@ static struct config_bool ConfigureNamesBool[] =
13421325
true,
13431326
NULL,NULL,NULL
13441327
},
1328+
{
1329+
{"password_encryption",PGC_USERSET,CONN_AUTH_SECURITY,
1330+
gettext_noop("Encrypt passwords."),
1331+
gettext_noop("When a password is specified in CREATE USER or "
1332+
"ALTER USER without writing either ENCRYPTED or UNENCRYPTED, "
1333+
"this parameter determines whether the password is to be encrypted.")
1334+
},
1335+
&Password_encryption,
1336+
true,
1337+
NULL,NULL,NULL
1338+
},
13451339
{
13461340
{"transform_null_equals",PGC_USERSET,COMPAT_OPTIONS_CLIENT,
13471341
gettext_noop("Treats \"expr=NULL\" as \"expr IS NULL\"."),
@@ -3913,18 +3907,6 @@ static struct config_enum ConfigureNamesEnum[] =
39133907
NULL,NULL,NULL
39143908
},
39153909

3916-
{
3917-
{"password_encryption",PGC_USERSET,CONN_AUTH_SECURITY,
3918-
gettext_noop("Encrypt passwords."),
3919-
gettext_noop("When a password is specified in CREATE USER or "
3920-
"ALTER USER without writing either ENCRYPTED or UNENCRYPTED, "
3921-
"this parameter determines whether the password is to be encrypted.")
3922-
},
3923-
&Password_encryption,
3924-
PASSWORD_TYPE_MD5,password_encryption_options,
3925-
NULL,NULL,NULL
3926-
},
3927-
39283910
/* End-of-list marker */
39293911
{
39303912
{NULL,0,0,NULL,NULL},NULL,0,NULL,NULL,NULL,NULL

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ listen_addresses = '*'# what IP address(es) to listen on;
8585
#ssl_key_file = 'server.key'# (change requires restart)
8686
#ssl_ca_file = ''# (change requires restart)
8787
#ssl_crl_file = ''# (change requires restart)
88-
#password_encryption =md5# md5 or plain
88+
#password_encryption =on
8989
#db_user_namespace = off
9090
#row_security = on
9191

‎src/include/commands/user.h

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -16,19 +16,10 @@
1616
#include"parser/parse_node.h"
1717

1818

19-
/*
20-
* Types of password, for Password_encryption GUC and the password_type
21-
* argument of the check-password hook.
22-
*/
23-
typedefenumPasswordType
24-
{
25-
PASSWORD_TYPE_PLAINTEXT=0,
26-
PASSWORD_TYPE_MD5
27-
}PasswordType;
28-
29-
externintPassword_encryption;/* GUC */
30-
3119
/* Hook to check passwords in CreateRole() and AlterRole() */
20+
#definePASSWORD_TYPE_PLAINTEXT0
21+
#definePASSWORD_TYPE_MD51
22+
3223
typedefvoid (*check_password_hook_type) (constchar*username,constchar*password,intpassword_type,Datumvaliduntil_time,boolvaliduntil_null);
3324

3425
externPGDLLIMPORTcheck_password_hook_typecheck_password_hook;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp