pg.ddx.io pgsql-committers@postgresql.org mailing list archive
help / color / mirror / Atom feedpgsql: Use SASLprep to normalize passwords for SCRAM authentication.
3+ messages / 3 participants
[nested] [flat]
* pgsql: Use SASLprep to normalize passwords for SCRAM authentication.
@ 2017-04-07 11:58 Heikki Linnakangas <heikki.linnakangas@iki.fi>
2017-04-08 01:23 ` Re: pgsql: Use SASLprep to normalize passwords for SCRAM authentication. Tom Lane <tgl@sss.pgh.pa.us>
2017-04-11 04:22 ` Re: pgsql: Use SASLprep to normalize passwords for SCRAM authentication. Noah Misch <noah@leadboat.com>
0 siblings, 2 replies; 3+ messages in thread
From: Heikki Linnakangas @ 2017-04-07 11:58 UTC (permalink / raw)
To: pgsql-committers
Use SASLprep to normalize passwords for SCRAM authentication.
An important step of SASLprep normalization, is to convert the string to
Unicode normalization form NFKC. Unicode normalization requires a fairly
large table of character decompositions, which is generated from data
published by the Unicode consortium. The script to generate the table is
put in src/common/unicode, as well test code for the normalization.
A pre-generated version of the tables is included in src/include/common,
so you don't need the code in src/common/unicode to build PostgreSQL, only
if you wish to modify the normalization tables.
The SASLprep implementation depends on the UTF-8 functions from
src/backend/utils/mb/wchar.c. So to use it, you must also compile and link
that. That doesn't change anything for the current users of these
functions, the backend and libpq, as they both already link with wchar.o.
It would be good to move those functions into a separate file in
src/commmon, but I'll leave that for another day.
No documentation changes included, because there is no details on the
SCRAM mechanism in the docs anyway. An overview on that in the protocol
specification would probably be good, even though SCRAM is documented in
detail in RFC5802. I'll write that as a separate patch. An important thing
to mention there is that we apply SASLprep even on invalid UTF-8 strings,
to support other encodings.
Patch by Michael Paquier and me.
Discussion: https://www.postgresql.org/message-id/CAB7nPqSByyEmAVLtEf1KxTRh=PWNKiWKEKQR=e1yGehz=wbymQ@mail.gmail...
Branch
------
master
Details
-------
http://git.postgresql.org/pg/commitdiff/60f11b87a2349985230c08616fa8a34ffde934c8
Modified Files
--------------
src/backend/libpq/auth-scram.c | 63 +-
src/common/Makefile | 3 +-
src/common/saslprep.c | 1279 +++
src/common/scram-common.c | 25 +-
src/common/unicode/.gitignore | 7 +
src/common/unicode/Makefile | 53 +
src/common/unicode/README | 35 +
src/common/unicode/generate-norm_test_table.pl | 102 +
src/common/unicode/generate-unicode_norm_table.pl | 226 +
src/common/unicode/norm_test.c | 80 +
src/common/unicode_norm.c | 437 +
src/include/common/saslprep.h | 30 +
src/include/common/unicode_norm.h | 21 +
src/include/common/unicode_norm_table.h | 8859 +++++++++++++++++++++
src/interfaces/libpq/.gitignore | 2 +
src/interfaces/libpq/Makefile | 4 +-
src/interfaces/libpq/fe-auth-scram.c | 27 +-
src/test/authentication/t/002_saslprep.pl | 98 +
src/tools/msvc/Mkvcbuild.pm | 3 +-
19 files changed, 11322 insertions(+), 32 deletions(-)
--
Sent via pgsql-committers mailing list (pgsql-committers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-committers
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: pgsql: Use SASLprep to normalize passwords for SCRAM authentication.
2017-04-07 11:58 pgsql: Use SASLprep to normalize passwords for SCRAM authentication. Heikki Linnakangas <heikki.linnakangas@iki.fi>
@ 2017-04-08 01:23 ` Tom Lane <tgl@sss.pgh.pa.us>
1 sibling, 0 replies; 3+ messages in thread
From: Tom Lane @ 2017-04-08 01:23 UTC (permalink / raw)
To: Heikki Linnakangas <heikki.linnakangas@iki.fi>; +Cc: pgsql-committers
Heikki Linnakangas <heikki.linnakangas@iki.fi> writes:
> Use SASLprep to normalize passwords for SCRAM authentication.
The test script that this adds appears to fail unless the environment
selects a UTF8-based locale. On my RHEL6 machine, I see:
LANG=C make check fail
LANG=en_US.iso88591 make check fail
LANG=en_US.utf8 make check ok
I'm surprised that more of the buildfarm hasn't fallen over.
Please do something about that.
regards, tom lane
--
Sent via pgsql-committers mailing list (pgsql-committers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-committers
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: pgsql: Use SASLprep to normalize passwords for SCRAM authentication.
2017-04-07 11:58 pgsql: Use SASLprep to normalize passwords for SCRAM authentication. Heikki Linnakangas <heikki.linnakangas@iki.fi>
@ 2017-04-11 04:22 ` Noah Misch <noah@leadboat.com>
1 sibling, 0 replies; 3+ messages in thread
From: Noah Misch @ 2017-04-11 04:22 UTC (permalink / raw)
To: Heikki Linnakangas <heikki.linnakangas@iki.fi>; +Cc: pgsql-hackers@postgresql.org
On Fri, Apr 07, 2017 at 11:58:10AM +0000, Heikki Linnakangas wrote:
> No documentation changes included, because there is no details on the
> SCRAM mechanism in the docs anyway. An overview on that in the protocol
> specification would probably be good, even though SCRAM is documented in
> detail in RFC5802. I'll write that as a separate patch. An important thing
> to mention there is that we apply SASLprep even on invalid UTF-8 strings,
> to support other encodings.
[Action required within three days. This is a generic notification.]
The above-described topic is currently a PostgreSQL 10 open item. Heikki,
since you committed the patch believed to have created it, you own this open
item. If some other commit is more relevant or if this does not belong as a
v10 open item, please let us know. Otherwise, please observe the policy on
open item ownership[1] and send a status update within three calendar days of
this message. Include a date for your subsequent status update. Testers may
discover new open items at any time, and I want to plan to get them all fixed
well in advance of shipping v10. Consequently, I will appreciate your efforts
toward speedy resolution. Thanks.
[1] https://www.postgresql.org/message-id/20170404140717.GA2675809%40tornado.leadboat.com
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2017-04-11 04:22 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2017-04-07 11:58 pgsql: Use SASLprep to normalize passwords for SCRAM authentication. Heikki Linnakangas <heikki.linnakangas@iki.fi>
2017-04-08 01:23 ` Tom Lane <tgl@sss.pgh.pa.us>
2017-04-11 04:22 ` Noah Misch <noah@leadboat.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox