Re: Password identifiers, protocol aging and SCRAM protocol
Michael Paquier <michael.paquier@gmail.com>
From: Michael Paquier <michael.paquier@gmail.com>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
Heikki Linnakangas <hlinnaka@iki.fi>, David Steele <david@pgmasters.net>, Tom Lane <tgl@sss.pgh.pa.us>,
David Fetter <david@fetter.org>, Alvaro Herrera <alvherre@2ndquadrant.com>,
Magnus Hagander <magnus@hagander.net>, Julian Markwort <julian.markwort@uni-muenster.de>,
Stephen Frost <sfrost@snowman.net>, PostgreSQL mailing lists <pgsql-hackers@postgresql.org>,
Valery Popov <v.popov@postgrespro.ru>
Date: 2016-11-16T23:56:13Z
Lists: pgsql-hackers
On Wed, Nov 16, 2016 at 11:24 AM, Robert Haas <robertmhaas@gmail.com> wrote:
> diff --git a/contrib/pgcrypto/Makefile b/contrib/pgcrypto/Makefile
> index 805db76..ddb0183 100644
> --- a/contrib/pgcrypto/Makefile
> +++ b/contrib/pgcrypto/Makefile
> @@ -1,6 +1,6 @@
> # contrib/pgcrypto/Makefile
>
> -INT_SRCS = md5.c sha1.c sha2.c internal.c internal-sha2.c blf.c rijndael.c \
> +INT_SRCS = md5.c sha1.c internal.c internal-sha2.c blf.c rijndael.c \
> fortuna.c random.c pgp-mpi-internal.c imath.c
> INT_TESTS = sha2
I would like to do so. And while Linux is happy with that, macOS is
not, this results in linking resolution errors when compiling the
library.
> And for Mkvcbuild.pm I think you could just do this:
>
> diff --git a/src/tools/msvc/Mkvcbuild.pm b/src/tools/msvc/Mkvcbuild.pm
> index de764dd..1993764 100644
> --- a/src/tools/msvc/Mkvcbuild.pm
> +++ b/src/tools/msvc/Mkvcbuild.pm
> @@ -114,6 +114,15 @@ sub mkvcbuild
> md5.c pg_lzcompress.c pgfnames.c psprintf.c relpath.c rmtree.c
> string.c username.c wait_error.c);
>
> + if ($solution->{options}->{openssl})
> + {
> + push(@pgcommonallfiles, 'sha2_openssl.c');
> + }
> + else
> + {
> + push(@pgcommonallfiles, 'sha2.c');
> + }
> +
> our @pgcommonfrontendfiles = (
> @pgcommonallfiles, qw(fe_memutils.c file_utils.c
> restricted_token.c));
> @@ -422,7 +431,7 @@ sub mkvcbuild
> {
> $pgcrypto->AddFiles(
> 'contrib/pgcrypto', 'md5.c',
> - 'sha1.c', 'sha2.c',
> + 'sha1.c',
> 'internal.c', 'internal-sha2.c',
> 'blf.c', 'rijndael.c',
> 'fortuna.c', 'random.c',
>
> Is there some reason that won't work?
Yes we could do that for consistency with the other nix platforms. But
is that really necessary as libpgcommon already has those objects?
--
Michael
Commits
-
Support SCRAM-SHA-256 authentication (RFC 5802 and 7677).
- 818fd4a67d61 10.0 landed
-
Refactor SHA2 functions and move them to src/common/.
- 273c458a2b3a 10.0 landed
-
Replace isMD5() with a more future-proof way to check if pw is encrypted.
- dbd69118c05d 10.0 landed
-
Remove bogus notice that older clients might not work with MD5 passwords.
- 7e3ae5455948 9.2.20 landed
- 470af1f41c8b 9.3.16 landed
- ada2cdb61015 9.4.11 landed
- 65a7f190b253 9.5.6 landed
- 7546c135dc30 9.6.2 landed
- 31c54096a18f 10.0 landed
-
Refactor the code for verifying user's password.
- e7f051b8f9a6 10.0 landed
-
Replace PostmasterRandom() with a stronger source, second attempt.
- fe0a0b5993df 10.0 landed
-
Remove support for (insecure) crypt authentication.
- 53a5026b5cb3 8.4.0 cited