Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit37f51ba

Browse files
committed
revertbee9be2
1 parentafe281d commit37f51ba

File tree

28 files changed

+76
-2196
lines changed

28 files changed

+76
-2196
lines changed

‎contrib/passwordcheck/passwordcheck.c

Lines changed: 3 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@
2121
#endif
2222

2323
#include"commands/user.h"
24-
#include"libpq/scram.h"
2524
#include"fmgr.h"
2625
#include"libpq/md5.h"
2726

@@ -58,15 +57,14 @@ check_password(const char *username,
5857
{
5958
intnamelen=strlen(username);
6059
intpwdlen=strlen(password);
61-
char*encrypted;
60+
charencrypted[MD5_PASSWD_LEN+1];
6261
inti;
6362
boolpwd_has_letter,
6463
pwd_has_nonletter;
6564

6665
switch (password_type)
6766
{
6867
casePASSWORD_TYPE_MD5:
69-
casePASSWORD_TYPE_SCRAM:
7068

7169
/*
7270
* Unfortunately we cannot perform exhaustive checks on encrypted
@@ -76,23 +74,12 @@ check_password(const char *username,
7674
*
7775
* We only check for username = password.
7876
*/
79-
if (password_type==PASSWORD_TYPE_MD5)
80-
{
81-
encrypted=palloc(MD5_PASSWD_LEN+1);
82-
if (pg_md5_encrypt(username,username,namelen,encrypted))
83-
elog(ERROR,"password encryption failed");
84-
}
85-
elseif (password_type==PASSWORD_TYPE_SCRAM)
86-
{
87-
encrypted=scram_build_verifier(username,password,0);
88-
}
89-
else
90-
Assert(0);/* should not happen */
77+
if (!pg_md5_encrypt(username,username,namelen,encrypted))
78+
elog(ERROR,"password encryption failed");
9179
if (strcmp(password,encrypted)==0)
9280
ereport(ERROR,
9381
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
9482
errmsg("password must not contain user name")));
95-
pfree(encrypted);
9683
break;
9784

9885
casePASSWORD_TYPE_PLAINTEXT:

‎doc/src/sgml/config.sgml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1181,8 +1181,7 @@ include_dir 'conf.d'
11811181
<para>
11821182
A value set to <literal>on</> or <literal>md5</> corresponds to a
11831183
MD5-encrypted password, <literal>off</> or <literal>plain</>
1184-
corresponds to an unencrypted password. Setting this parameter to
1185-
<literal>scram</> will encrypt the password with SCRAM-SHA-256.
1184+
corresponds to an unencrypted password.
11861185
</para>
11871186

11881187
<para>

‎doc/src/sgml/protocol.sgml

Lines changed: 5 additions & 142 deletions
Original file line numberDiff line numberDiff line change
@@ -228,11 +228,11 @@
228228
The server then sends an appropriate authentication request message,
229229
to which the frontend must reply with an appropriate authentication
230230
response message (such as a password).
231-
For all authentication methods except GSSAPI, SSPIandSASL, there is at
232-
mostone request and one response. In some methods, no response
231+
For all authentication methods except GSSAPIandSSPI, there is at most
232+
one request and one response. In some methods, no response
233233
at all is needed from the frontend, and so no authentication request
234-
occurs. For GSSAPI, SSPIandSASL, multiple exchanges of packets may be
235-
neededto complete the authentication.
234+
occurs. For GSSAPIandSSPI, multiple exchanges of packets may be needed
235+
to complete the authentication.
236236
</para>
237237

238238
<para>
@@ -366,35 +366,6 @@
366366
</listitem>
367367
</varlistentry>
368368

369-
<varlistentry>
370-
<term>AuthenticationSASL</term>
371-
<listitem>
372-
<para>
373-
The frontend must now initiate a SASL negotiation, using the SASL
374-
mechanism specified in the message. The frontend will send a
375-
PasswordMessage with the first part of the SASL data stream in
376-
response to this. If further messages are needed, the server will
377-
respond with AuthenticationSASLContinue.
378-
</para>
379-
</listitem>
380-
381-
</varlistentry>
382-
<varlistentry>
383-
<term>AuthenticationSASLContinue</term>
384-
<listitem>
385-
<para>
386-
This message contains the response data from the previous step
387-
of SASL negotiation (AuthenticationSASL, or a previous
388-
AuthenticationSASLContinue). If the SASL data in this message
389-
indicates more data is needed to complete the authentication,
390-
the frontend must send that data as another PasswordMessage. If
391-
SASL authentication is completed by this message, the server
392-
will next send AuthenticationOk to indicate successful authentication
393-
or ErrorResponse to indicate failure.
394-
</para>
395-
</listitem>
396-
</varlistentry>
397-
398369
</variablelist>
399370
</para>
400371

@@ -2607,114 +2578,6 @@ AuthenticationGSSContinue (B)
26072578
</listitem>
26082579
</varlistentry>
26092580

2610-
<varlistentry>
2611-
<term>
2612-
AuthenticationSASL (B)
2613-
</term>
2614-
<listitem>
2615-
<para>
2616-
2617-
<variablelist>
2618-
<varlistentry>
2619-
<term>
2620-
Byte1('R')
2621-
</term>
2622-
<listitem>
2623-
<para>
2624-
Identifies the message as an authentication request.
2625-
</para>
2626-
</listitem>
2627-
</varlistentry>
2628-
<varlistentry>
2629-
<term>
2630-
Int32
2631-
</term>
2632-
<listitem>
2633-
<para>
2634-
Length of message contents in bytes, including self.
2635-
</para>
2636-
</listitem>
2637-
</varlistentry>
2638-
<varlistentry>
2639-
<term>
2640-
Int32(10)
2641-
</term>
2642-
<listitem>
2643-
<para>
2644-
Specifies that SASL authentication is started.
2645-
</para>
2646-
</listitem>
2647-
</varlistentry>
2648-
<varlistentry>
2649-
<term>
2650-
String
2651-
</term>
2652-
<listitem>
2653-
<para>
2654-
Name of a SASL authentication mechanism.
2655-
</para>
2656-
</listitem>
2657-
</varlistentry>
2658-
</variablelist>
2659-
2660-
</para>
2661-
</listitem>
2662-
</varlistentry>
2663-
2664-
<varlistentry>
2665-
<term>
2666-
AuthenticationSASLContinue (B)
2667-
</term>
2668-
<listitem>
2669-
<para>
2670-
2671-
<variablelist>
2672-
<varlistentry>
2673-
<term>
2674-
Byte1('R')
2675-
</term>
2676-
<listitem>
2677-
<para>
2678-
Identifies the message as an authentication request.
2679-
</para>
2680-
</listitem>
2681-
</varlistentry>
2682-
<varlistentry>
2683-
<term>
2684-
Int32
2685-
</term>
2686-
<listitem>
2687-
<para>
2688-
Length of message contents in bytes, including self.
2689-
</para>
2690-
</listitem>
2691-
</varlistentry>
2692-
<varlistentry>
2693-
<term>
2694-
Int32(11)
2695-
</term>
2696-
<listitem>
2697-
<para>
2698-
Specifies that this message contains SASL-mechanism specific
2699-
data.
2700-
</para>
2701-
</listitem>
2702-
</varlistentry>
2703-
<varlistentry>
2704-
<term>
2705-
Byte<replaceable>n</replaceable>
2706-
</term>
2707-
<listitem>
2708-
<para>
2709-
SASL data, specific to the SASL mechanism being used.
2710-
</para>
2711-
</listitem>
2712-
</varlistentry>
2713-
</variablelist>
2714-
2715-
</para>
2716-
</listitem>
2717-
</varlistentry>
27182581

27192582
<varlistentry>
27202583
<term>
@@ -4477,7 +4340,7 @@ PasswordMessage (F)
44774340
<listitem>
44784341
<para>
44794342
Identifies the message as a password response. Note that
4480-
this is also used for GSSAPI, SSPIandSASL response messages
4343+
this is also used for GSSAPIandSSPI response messages
44814344
(which is really a design error, since the contained data
44824345
is not a null-terminated string in that case, but can be
44834346
arbitrary binary data).

‎doc/src/sgml/ref/create_role.sgml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -228,16 +228,16 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
228228
encrypted in the system catalogs. (If neither is specified,
229229
the default behavior is determined by the configuration
230230
parameter <xref linkend="guc-password-encryption">.) If the
231-
presented password string is already in MD5-encryptedor
232-
SCRAM-encrypted format,then it is stored encrypted as-is,
233-
regardless of whether<literal>ENCRYPTED</> or <literal>UNENCRYPTED</>
234-
is specified(since the system cannot decrypt the specified encrypted
235-
password string). This allows reloading of encrypted passwords
236-
during dump/restore.
231+
presented password string is already in MD5-encryptedformat,
232+
then it is stored encrypted as-is, regardless of whether
233+
<literal>ENCRYPTED</> or <literal>UNENCRYPTED</> is specified
234+
(since the system cannot decrypt the specified encrypted
235+
password string). This allows reloading of encrypted
236+
passwordsduring dump/restore.
237237
</para>
238238

239239
<para>
240-
Note that older clients might lack support for the MD5 or SCRAM
240+
Note that older clients might lack support for the MD5
241241
authentication mechanism that is needed to work with passwords
242242
that are stored encrypted.
243243
</para>

‎src/backend/commands/user.c

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@
3030
#include"commands/seclabel.h"
3131
#include"commands/user.h"
3232
#include"libpq/md5.h"
33-
#include"libpq/scram.h"
3433
#include"miscadmin.h"
3534
#include"storage/lmgr.h"
3635
#include"utils/acl.h"
@@ -70,9 +69,9 @@ have_createrole_privilege(void)
7069
/*
7170
* Encrypt a password if necessary for insertion in pg_authid.
7271
*
73-
* If a password is found as already MD5-encrypted or SCRAM-encrypted, no
74-
*error is raisedto ease the dump and reload of such data. Returns a
75-
*palloc'ed stringholding the encrypted password.
72+
* If a password is found as already MD5-encrypted, no error is raised
73+
* to ease the dump and reload of such data. Returns a palloc'ed string
74+
* holding the encrypted password.
7675
*/
7776
staticchar*
7877
encrypt_password(char*password,char*rolname,intpasswd_type)
@@ -82,11 +81,11 @@ encrypt_password(char *password, char *rolname, int passwd_type)
8281
Assert(password!=NULL);
8382

8483
/*
85-
*Apassword already identified asa SCRAM-encrypted or MD5-encrypted
86-
*those are usedas such. If the password given is not encrypted,
87-
*adapt it dependingon the type wanted by the caller of this routine.
84+
*If apasswordisalready identified asMD5-encrypted, it is used
85+
* as such. If the password given is not encrypted, adapt it depending
86+
* on the type wanted by the caller of this routine.
8887
*/
89-
if (isMD5(password)||is_scram_verifier(password))
88+
if (isMD5(password))
9089
res=pstrdup(password);
9190
else
9291
{
@@ -102,9 +101,6 @@ encrypt_password(char *password, char *rolname, int passwd_type)
102101
res))
103102
elog(ERROR,"password encryption failed");
104103
break;
105-
casePASSWORD_TYPE_SCRAM:
106-
res=scram_build_verifier(rolname,password,0);
107-
break;
108104
default:
109105
Assert(0);/* should not come here */
110106
}

‎src/backend/libpq/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ include $(top_builddir)/src/Makefile.global
1515
# be-fsstubs is here for historical reasons, probably belongs elsewhere
1616

1717
OBJS = be-fsstubs.o be-secure.o auth.o crypt.o hba.o ip.o md5.o pqcomm.o\
18-
pqformat.o pqmq.o pqsignal.o auth-scram.o
18+
pqformat.o pqmq.o pqsignal.o
1919

2020
ifeq ($(with_openssl),yes)
2121
OBJS += be-secure-openssl.o

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp