Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitfe7bdf0

Browse files
committed
Clean up password authentication code a bit.
Commitfe0a0b5, which moved code to do MD5 authentication to a separateCheckMD5Auth() function, left behind a comment that really belongs insidethe function, too. Also move the check for db_user_namespace inside thefunction, seems clearer that way.Now that the md5 salt is passed as argument to md5_crypt_verify, it's a bitsilly that it peeks into the Port struct to see if MD5 authentication wasused. Seems more straightforward to treat it as an MD5 authentication, ifthe md5 salt argument is given. And after that, md5_crypt_verify only usedthe Port argument to look at port->user_name, but that is redundant,because it is also passed as a separate 'role' argument. So remove the Portargument altogether.
1 parentf7d54f4 commitfe7bdf0

File tree

3 files changed

+70
-63
lines changed

3 files changed

+70
-63
lines changed

‎src/backend/libpq/auth.c

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,14 @@ static char *recv_password_packet(Port *port);
5050
* MD5 authentication
5151
*----------------------------------------------------------------
5252
*/
53-
staticintCheckMD5Auth(Port*port,char**logdetail);
53+
staticintCheckMD5Auth(Port*port,char**logdetail);
5454

5555
/*----------------------------------------------------------------
5656
* Plaintext password authentication
5757
*----------------------------------------------------------------
5858
*/
5959

60-
staticintCheckPasswordAuth(Port*port,char**logdetail);
60+
staticintCheckPasswordAuth(Port*port,char**logdetail);
6161

6262
/*----------------------------------------------------------------
6363
* Ident authentication
@@ -544,11 +544,6 @@ ClientAuthentication(Port *port)
544544
break;
545545

546546
caseuaMD5:
547-
if (Db_user_namespace)
548-
ereport(FATAL,
549-
(errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
550-
errmsg("MD5 authentication is not supported when \"db_user_namespace\" is enabled")));
551-
/* include the salt to use for computing the response */
552547
status=CheckMD5Auth(port,&logdetail);
553548
break;
554549

@@ -714,6 +709,12 @@ CheckMD5Auth(Port *port, char **logdetail)
714709
char*passwd;
715710
intresult;
716711

712+
if (Db_user_namespace)
713+
ereport(FATAL,
714+
(errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
715+
errmsg("MD5 authentication is not supported when \"db_user_namespace\" is enabled")));
716+
717+
/* include the salt to use for computing the response */
717718
pg_backend_random(md5Salt,4);
718719

719720
sendAuthRequest(port,AUTH_REQ_MD5,md5Salt,4);
@@ -723,7 +724,7 @@ CheckMD5Auth(Port *port, char **logdetail)
723724
if (passwd==NULL)
724725
returnSTATUS_EOF;/* client wouldn't send password */
725726

726-
result=md5_crypt_verify(port,port->user_name,passwd,md5Salt,4,logdetail);
727+
result=md5_crypt_verify(port->user_name,passwd,md5Salt,4,logdetail);
727728

728729
pfree(passwd);
729730

@@ -748,7 +749,7 @@ CheckPasswordAuth(Port *port, char **logdetail)
748749
if (passwd==NULL)
749750
returnSTATUS_EOF;/* client wouldn't send password */
750751

751-
result=md5_crypt_verify(port,port->user_name,passwd,NULL,0,logdetail);
752+
result=md5_crypt_verify(port->user_name,passwd,NULL,0,logdetail);
752753

753754
pfree(passwd);
754755

‎src/backend/libpq/crypt.c

Lines changed: 57 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,16 @@
3131

3232
/*
3333
* Check given password for given user, and return STATUS_OK or STATUS_ERROR.
34+
*
35+
* 'client_pass' is the password response given by the remote user. If
36+
* 'md5_salt' is not NULL, it is a response to an MD5 authentication
37+
* challenge, with the given salt. Otherwise, it is a plaintext password.
38+
*
3439
* In the error case, optionally store a palloc'd string at *logdetail
3540
* that will be sent to the postmaster log (but not the client).
3641
*/
3742
int
38-
md5_crypt_verify(constPort*port,constchar*role,char*client_pass,
43+
md5_crypt_verify(constchar*role,char*client_pass,
3944
char*md5_salt,intmd5_salt_len,char**logdetail)
4045
{
4146
intretval=STATUS_ERROR;
@@ -88,63 +93,64 @@ md5_crypt_verify(const Port *port, const char *role, char *client_pass,
8893
* error is out-of-memory, which is unlikely, and if it did happen adding
8994
* a psprintf call would only make things worse.)
9095
*/
91-
switch (port->hba->auth_method)
96+
if (md5_salt)
9297
{
93-
caseuaMD5:
94-
Assert(md5_salt!=NULL&&md5_salt_len>0);
95-
crypt_pwd=palloc(MD5_PASSWD_LEN+1);
96-
if (isMD5(shadow_pass))
98+
/* MD5 authentication */
99+
Assert(md5_salt_len>0);
100+
crypt_pwd=palloc(MD5_PASSWD_LEN+1);
101+
if (isMD5(shadow_pass))
102+
{
103+
/* stored password already encrypted, only do salt */
104+
if (!pg_md5_encrypt(shadow_pass+strlen("md5"),
105+
md5_salt,md5_salt_len,
106+
crypt_pwd))
97107
{
98-
/* stored password already encrypted, only do salt */
99-
if (!pg_md5_encrypt(shadow_pass+strlen("md5"),
100-
md5_salt,md5_salt_len,
101-
crypt_pwd))
102-
{
103-
pfree(crypt_pwd);
104-
returnSTATUS_ERROR;
105-
}
108+
pfree(crypt_pwd);
109+
returnSTATUS_ERROR;
106110
}
107-
else
108-
{
109-
/* stored password is plain, double-encrypt */
110-
char*crypt_pwd2=palloc(MD5_PASSWD_LEN+1);
111+
}
112+
else
113+
{
114+
/* stored password is plain, double-encrypt */
115+
char*crypt_pwd2=palloc(MD5_PASSWD_LEN+1);
111116

112-
if (!pg_md5_encrypt(shadow_pass,
113-
port->user_name,
114-
strlen(port->user_name),
115-
crypt_pwd2))
116-
{
117-
pfree(crypt_pwd);
118-
pfree(crypt_pwd2);
119-
returnSTATUS_ERROR;
120-
}
121-
if (!pg_md5_encrypt(crypt_pwd2+strlen("md5"),
122-
md5_salt,md5_salt_len,
123-
crypt_pwd))
124-
{
125-
pfree(crypt_pwd);
126-
pfree(crypt_pwd2);
127-
returnSTATUS_ERROR;
128-
}
117+
if (!pg_md5_encrypt(shadow_pass,
118+
role,
119+
strlen(role),
120+
crypt_pwd2))
121+
{
122+
pfree(crypt_pwd);
129123
pfree(crypt_pwd2);
124+
returnSTATUS_ERROR;
130125
}
131-
break;
132-
default:
133-
if (isMD5(shadow_pass))
126+
if (!pg_md5_encrypt(crypt_pwd2+strlen("md5"),
127+
md5_salt,md5_salt_len,
128+
crypt_pwd))
134129
{
135-
/* Encrypt user-supplied password to match stored MD5 */
136-
crypt_client_pass=palloc(MD5_PASSWD_LEN+1);
137-
if (!pg_md5_encrypt(client_pass,
138-
port->user_name,
139-
strlen(port->user_name),
140-
crypt_client_pass))
141-
{
142-
pfree(crypt_client_pass);
143-
returnSTATUS_ERROR;
144-
}
130+
pfree(crypt_pwd);
131+
pfree(crypt_pwd2);
132+
returnSTATUS_ERROR;
145133
}
146-
crypt_pwd=shadow_pass;
147-
break;
134+
pfree(crypt_pwd2);
135+
}
136+
}
137+
else
138+
{
139+
/* Client sent password in plaintext */
140+
if (isMD5(shadow_pass))
141+
{
142+
/* Encrypt user-supplied password to match stored MD5 */
143+
crypt_client_pass=palloc(MD5_PASSWD_LEN+1);
144+
if (!pg_md5_encrypt(client_pass,
145+
role,
146+
strlen(role),
147+
crypt_client_pass))
148+
{
149+
pfree(crypt_client_pass);
150+
returnSTATUS_ERROR;
151+
}
152+
}
153+
crypt_pwd=shadow_pass;
148154
}
149155

150156
if (strcmp(crypt_client_pass,crypt_pwd)==0)
@@ -167,7 +173,7 @@ md5_crypt_verify(const Port *port, const char *role, char *client_pass,
167173
*logdetail=psprintf(_("Password does not match for user \"%s\"."),
168174
role);
169175

170-
if (port->hba->auth_method==uaMD5)
176+
if (crypt_pwd!=shadow_pass)
171177
pfree(crypt_pwd);
172178
if (crypt_client_pass!=client_pass)
173179
pfree(crypt_client_pass);

‎src/include/libpq/crypt.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@
1313
#ifndefPG_CRYPT_H
1414
#definePG_CRYPT_H
1515

16-
#include"libpq/libpq-be.h"
16+
#include"datatype/timestamp.h"
1717

18-
externintmd5_crypt_verify(constPort*port,constchar*role,
19-
char*client_pass,char*md5_salt,intmd5_salt_len,char**logdetail);
18+
externintmd5_crypt_verify(constchar*role,char*client_pass,
19+
char*md5_salt,intmd5_salt_len,char**logdetail);
2020

2121
#endif

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp