RE: Replace current implementations in crypt() and gen_salt() to OpenSSL
Hayato Kuroda (Fujitsu) <kuroda.hayato@fujitsu.com>
From: "Hayato Kuroda (Fujitsu)" <kuroda.hayato@fujitsu.com>
To: 'Daniel Gustafsson' <daniel@yesql.se>
Cc: Peter Eisentraut <peter@eisentraut.org>, Robert Haas <robertmhaas@gmail.com>, "Koshi Shibagaki (Fujitsu)" <shibagaki.koshi@fujitsu.com>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>, Joe Conway <mail@joeconway.com>
Date: 2025-01-14T12:12:50Z
Lists: pgsql-hackers
Dear Daniel,
Thanks for working on the project. I have few cosmetic comments.
```
+ built in legacy crypto functions <literal>gen_salt()</literal>,
```
According to other lines, `<literal>gen_salt()</literal>` should be `<function>gen_salt()</function>`.
```
+ <literal>pg_gen_salt_rounds()</literal>, and <literal>crypt()</literal>
```
Similar with [1], `pg_gen_salt_rounds` is not an SQL function.
I think we do not have to mention the function because it's just another implementation of gen_salt().
Also, use <function> instead of <literal>.
```
+void
+_PG_init(void)
+{
+ DefineCustomEnumVariable("pgcrypto.legacy_crypto_enabled",
+ "Sets if builtin crypto functions are enabled.",
+ "\"on\" enables builtin crypto, \"off\" unconditionally disables and \"fips\" "
+ "will disable builtin crypto if OpenSSL is in FIPS mode",
+ &legacy_crypto_enabled,
+ LGC_ON,
+ legacy_crypto_options,
+ PGC_SUSET,
+ 0,
+ NULL,
+ NULL,
+ NULL);
+}
```
I think we must call MarkGUCPrefixReserved() to catch the mis-spell.
Also: I'm not sure whether we should bump the version of pgcrypto. It should be done when
the API is changed, but the patch does not do. Thought?
[1]: https://www.postgresql.org/message-id/1f32ff67-255d-4c0c-8433-c8c721842aa3%40eisentraut.org
Best regards,
Hayato Kuroda
FUJITSU LIMITED
Commits
-
pgcrypto: Make it possible to disable built-in crypto
- 035f99cbebe5 18.0 landed
-
pgcrypto: Add function to check FIPS mode
- 924d89a35475 18.0 landed
-
citext: Allow tests to pass in OpenSSL FIPS mode
- 3c551ebede46 17.0 cited
-
pgcrypto: Remove non-OpenSSL support
- db7d1a7b0530 15.0 cited