Date: Mon, 22 Apr 2019 10:50:51 +0900
From: Michael Paquier <michael@paquier.xyz>
To: "Jonathan S. Katz" <jkatz@postgresql.org>
Cc: pgsql-bugs@lists.postgresql.org, Stephen Frost <sfrost@snowman.net>
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Message-ID: <20190422015051.GA3433@paquier.xyz>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
 <4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="EeQfGwPcQSOJBaQU"
Content-Disposition: inline
In-Reply-To: <4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
Precedence: bulk


--EeQfGwPcQSOJBaQU
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Apr 20, 2019 at 04:12:56PM -0400, Jonathan S. Katz wrote:
> I modified the "get_password_type" function to perform a SCRAM
> verification to see if it is a properly hashed SCRAM password. If it is,
> we treat the password as a SCRAM hashed one. Otherwise, we proceed to
> the next step, which is to treat it as a plainly stored one.

Since v10, we don't allow the storage of plain verifiers so if a
string does not match what we think is a correct SCRAM or MD5
verifier, then it should be processed according to
password_encryption when storing the verifier or processed according
to the auth protocol with the HBA entry matching.  Your patch looks
fine to me, I would have just added a test case in password.sql (no=20
need to send a new patch I can take care of it).

Any objections to back-patch that stuff to v10?
--
Michael

--EeQfGwPcQSOJBaQU
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAly9HfsACgkQnvQgOdby
QH3wCw/8CSkK7vsZUEziY2wT3s3OzVnT2k/8RZMXKikocVBKVJYIk6FB22lXLh67
K6SG7tzBRfS9u+hvE3SKqw04Uszabb5mKKablsI+7W0a70d8AYErPPyHy3AKQr2C
ezYCXF9RVDAaHTxc/63HIrGHPZWSCKGZzn0EQ5FTt/IdjfR7Z6XntU6m2mXgyudn
2cOcDXTNepqrRmQ3NUstqC9jhohagabOdNnC3f1GMrpGDQb5xqEnA6ipCovlTciH
vZkFtkfaajmB7LN7EO/lEeYH7EI60dZ7NDZxyJgNbn6fRLcSH4rzWt7+A/YRGKvE
vcFT4EG0ZiaUpWyYUAA72ZZQjITVVK6fo+sl5zDve3A0h9lnb5DjRBZ8e6YOGYhr
wOFr1DA2B5Ws5MrjCupFSLH/huWN1teS3ouNzZN3VuL7Qqb9Jdjx6eDO5N0pp5iH
QpXRLJSxVwNv1HFajckpNBmpqtg6MtMV+KXldw1jcRtT1hhEx3ECtmBVIUGxHQcc
vc4anTs8AxFRGtzZ771HXa9yMEjmP3eRMl5L1bJowppDcP1GhH8ElRcLIcsINdcF
QT1P5W/B+O0iJyhJX1w9B7zlqjhtVfgg/lUNzlfgkxwvec0abL7ytqCpIcwzCbxn
Rs8YmHRUmNWpoxmzjYd6o5AqL+Lovfs00UkQyoSHEri4xEQsWlE=
=54HE
-----END PGP SIGNATURE-----

--EeQfGwPcQSOJBaQU--