mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-07-13 11:26:14 +02:00
818fd4a67d
This introduces a new generic SASL authentication method, similar to the GSS and SSPI methods. The server first tells the client which SASL authentication mechanism to use, and then the mechanism-specific SASL messages are exchanged in AuthenticationSASLcontinue and PasswordMessage messages. Only SCRAM-SHA-256 is supported at the moment, but this allows adding more SASL mechanisms in the future, without changing the overall protocol. Support for channel binding, aka SCRAM-SHA-256-PLUS is left for later. The SASLPrep algorithm, for pre-processing the password, is not yet implemented. That could cause trouble, if you use a password with non-ASCII characters, and a client library that does implement SASLprep. That will hopefully be added later. Authorization identities, as specified in the SCRAM-SHA-256 specification, are ignored. SET SESSION AUTHORIZATION provides more or less the same functionality, anyway. If a user doesn't exist, perform a "mock" authentication, by constructing an authentic-looking challenge on the fly. The challenge is derived from a new system-wide random value, "mock authentication nonce", which is created at initdb, and stored in the control file. We go through these motions, in order to not give away the information on whether the user exists, to unauthenticated users. Bumps PG_CONTROL_VERSION, because of the new field in control file. Patch by Michael Paquier and Heikki Linnakangas, reviewed at different stages by Robert Haas, Stephen Frost, David Steele, Aleksander Alekseev, and many others. Discussion: https://www.postgresql.org/message-id/CAB7nPqRbR3GmFYdedCAhzukfKrgBLTLtMvENOmPrVWREsZkF8g%40mail.gmail.com Discussion: https://www.postgresql.org/message-id/CAB7nPqSMXU35g%3DW9X74HVeQp0uvgJxvYOuA4A-A3M%2B0wfEBv-w%40mail.gmail.com Discussion: https://www.postgresql.org/message-id/55192AFE.6080106@iki.fi
67 lines
2.0 KiB
Makefile
67 lines
2.0 KiB
Makefile
# contrib/pgcrypto/Makefile
|
|
|
|
INT_SRCS = md5.c sha1.c internal.c internal-sha2.c blf.c rijndael.c \
|
|
pgp-mpi-internal.c imath.c
|
|
INT_TESTS = sha2
|
|
|
|
OSSL_SRCS = openssl.c pgp-mpi-openssl.c
|
|
OSSL_TESTS = sha2 des 3des cast5
|
|
|
|
ZLIB_TST = pgp-compression
|
|
ZLIB_OFF_TST = pgp-zlib-DISABLED
|
|
|
|
CF_SRCS = $(if $(subst no,,$(with_openssl)), $(OSSL_SRCS), $(INT_SRCS))
|
|
CF_TESTS = $(if $(subst no,,$(with_openssl)), $(OSSL_TESTS), $(INT_TESTS))
|
|
CF_PGP_TESTS = $(if $(subst no,,$(with_zlib)), $(ZLIB_TST), $(ZLIB_OFF_TST))
|
|
|
|
SRCS = pgcrypto.c px.c px-hmac.c px-crypt.c \
|
|
crypt-gensalt.c crypt-blowfish.c crypt-des.c \
|
|
crypt-md5.c $(CF_SRCS) \
|
|
mbuf.c pgp.c pgp-armor.c pgp-cfb.c pgp-compress.c \
|
|
pgp-decrypt.c pgp-encrypt.c pgp-info.c pgp-mpi.c \
|
|
pgp-pubdec.c pgp-pubenc.c pgp-pubkey.c pgp-s2k.c \
|
|
pgp-pgsql.c
|
|
|
|
MODULE_big = pgcrypto
|
|
OBJS = $(SRCS:.c=.o) $(WIN32RES)
|
|
|
|
EXTENSION = pgcrypto
|
|
DATA = pgcrypto--1.3.sql pgcrypto--1.2--1.3.sql pgcrypto--1.1--1.2.sql \
|
|
pgcrypto--1.0--1.1.sql pgcrypto--unpackaged--1.0.sql
|
|
PGFILEDESC = "pgcrypto - cryptographic functions"
|
|
|
|
REGRESS = init md5 sha1 hmac-md5 hmac-sha1 blowfish rijndael \
|
|
$(CF_TESTS) \
|
|
crypt-des crypt-md5 crypt-blowfish crypt-xdes \
|
|
pgp-armor pgp-decrypt pgp-encrypt $(CF_PGP_TESTS) \
|
|
pgp-pubkey-decrypt pgp-pubkey-encrypt pgp-info
|
|
|
|
EXTRA_CLEAN = gen-rtab
|
|
|
|
ifdef USE_PGXS
|
|
PG_CONFIG = pg_config
|
|
PGXS := $(shell $(PG_CONFIG) --pgxs)
|
|
include $(PGXS)
|
|
else
|
|
subdir = contrib/pgcrypto
|
|
top_builddir = ../..
|
|
include $(top_builddir)/src/Makefile.global
|
|
include $(top_srcdir)/contrib/contrib-global.mk
|
|
endif
|
|
|
|
# Add libraries that pgcrypto depends (or might depend) on into the
|
|
# shared library link. (The order in which you list them here doesn't
|
|
# matter.)
|
|
SHLIB_LINK += $(filter -lcrypto -lz, $(LIBS))
|
|
ifeq ($(PORTNAME), win32)
|
|
SHLIB_LINK += $(filter -leay32, $(LIBS))
|
|
# those must be at the end
|
|
SHLIB_LINK += -lws2_32
|
|
endif
|
|
|
|
rijndael.o: rijndael.tbl
|
|
|
|
rijndael.tbl:
|
|
$(CC) $(CPPFLAGS) $(CFLAGS) -DPRINT_TABS rijndael.c -o gen-rtab
|
|
./gen-rtab > rijndael.tbl
|