Skip to content

Commit 6b8921c

Browse files
afiskonafiskon
committed
apply 0003-Switch-password_encryption-to-a-enum.patch
1 parent 54ab79d commit 6b8921c

File tree

5 files changed

+58
-31
lines changed

5 files changed

+58
-31
lines changed

‎doc/src/sgml/config.sgml

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1163,7 +1163,7 @@ include_dir 'conf.d'
11631163
</varlistentry>
11641164

11651165
<varlistentry id="guc-password-encryption" xreflabel="password_encryption">
1166-
<term><varname>password_encryption</varname> (<type>boolean</type>)
1166+
<term><varname>password_encryption</varname> (<type>enum</type>)
11671167
<indexterm>
11681168
<primary><varname>password_encryption</> configuration parameter</primary>
11691169
</indexterm>
@@ -1175,8 +1175,17 @@ include_dir 'conf.d'
11751175
<xref linkend="sql-alterrole">
11761176
without writing either <literal>ENCRYPTED</> or
11771177
<literal>UNENCRYPTED</>, this parameter determines whether the
1178-
password is to be encrypted. The default is <literal>on</>
1179-
(encrypt the password).
1178+
password is to be encrypted.
1179+
</para>
1180+
1181+
<para>
1182+
A value set to <literal>on</> or <literal>md5</> corresponds to a
1183+
MD5-encrypted password, <literal>off</> or <literal>plain</>
1184+
corresponds to an unencrypted password.
1185+
</para>
1186+
1187+
<para>
1188+
The default is <literal>md5</>.
11801189
</para>
11811190
</listitem>
11821191
</varlistentry>

‎src/backend/commands/user.c

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ Oid binary_upgrade_next_pg_authid_oid = InvalidOid;
4444

4545

4646
/* GUC parameter */
47-
extern bool Password_encryption;
47+
int Password_encryption = PASSWORD_TYPE_MD5;
4848

4949
/* Hook to check passwords in CreateRole() and AlterRole() */
5050
check_password_hook_type check_password_hook = NULL;
@@ -80,7 +80,7 @@ CreateRole(CreateRoleStmt *stmt)
8080
ListCell *item;
8181
ListCell *option;
8282
char *password = NULL; /* user password */
83-
bool encrypt_password = Password_encryption; /* encrypt password? */
83+
int password_type = Password_encryption;
8484
char encrypted_password[MD5_PASSWD_LEN + 1];
8585
bool issuper = false; /* Make the user a superuser? */
8686
bool inherit = true; /* Auto inherit privileges? */
@@ -139,9 +139,9 @@ CreateRole(CreateRoleStmt *stmt)
139139
errmsg("conflicting or redundant options")));
140140
dpassword = defel;
141141
if (strcmp(defel->defname, "encryptedPassword") == 0)
142-
encrypt_password = true;
142+
password_type = PASSWORD_TYPE_MD5;
143143
else if (strcmp(defel->defname, "unencryptedPassword") == 0)
144-
encrypt_password = false;
144+
password_type = PASSWORD_TYPE_PLAINTEXT;
145145
}
146146
else if (strcmp(defel->defname, "sysid") == 0)
147147
{
@@ -357,7 +357,7 @@ CreateRole(CreateRoleStmt *stmt)
357357
if (check_password_hook && password)
358358
(*check_password_hook) (stmt->role,
359359
password,
360-
isMD5(password) ? PASSWORD_TYPE_MD5 : PASSWORD_TYPE_PLAINTEXT,
360+
password_type,
361361
validUntil_datum,
362362
validUntil_null);
363363

@@ -380,7 +380,7 @@ CreateRole(CreateRoleStmt *stmt)
380380

381381
if (password)
382382
{
383-
if (!encrypt_password || isMD5(password))
383+
if (password_type == PASSWORD_TYPE_PLAINTEXT || isMD5(password))
384384
new_record[Anum_pg_authid_rolpassword - 1] =
385385
CStringGetTextDatum(password);
386386
else
@@ -492,7 +492,7 @@ AlterRole(AlterRoleStmt *stmt)
492492
ListCell *option;
493493
char *rolename = NULL;
494494
char *password = NULL; /* user password */
495-
bool encrypt_password = Password_encryption; /* encrypt password? */
495+
int password_type = Password_encryption;
496496
char encrypted_password[MD5_PASSWD_LEN + 1];
497497
int issuper = -1; /* Make the user a superuser? */
498498
int inherit = -1; /* Auto inherit privileges? */
@@ -537,9 +537,9 @@ AlterRole(AlterRoleStmt *stmt)
537537
errmsg("conflicting or redundant options")));
538538
dpassword = defel;
539539
if (strcmp(defel->defname, "encryptedPassword") == 0)
540-
encrypt_password = true;
540+
password_type = PASSWORD_TYPE_MD5;
541541
else if (strcmp(defel->defname, "unencryptedPassword") == 0)
542-
encrypt_password = false;
542+
password_type = PASSWORD_TYPE_PLAINTEXT;
543543
}
544544
else if (strcmp(defel->defname, "superuser") == 0)
545545
{
@@ -732,7 +732,7 @@ AlterRole(AlterRoleStmt *stmt)
732732
if (check_password_hook && password)
733733
(*check_password_hook) (rolename,
734734
password,
735-
isMD5(password) ? PASSWORD_TYPE_MD5 : PASSWORD_TYPE_PLAINTEXT,
735+
password_type,
736736
validUntil_datum,
737737
validUntil_null);
738738

@@ -791,7 +791,7 @@ AlterRole(AlterRoleStmt *stmt)
791791
/* password */
792792
if (password)
793793
{
794-
if (!encrypt_password || isMD5(password))
794+
if (password_type == PASSWORD_TYPE_PLAINTEXT || isMD5(password))
795795
new_record[Anum_pg_authid_rolpassword - 1] =
796796
CStringGetTextDatum(password);
797797
else

‎src/backend/utils/misc/guc.c

Lines changed: 27 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
#include "catalog/namespace.h"
3636
#include "commands/async.h"
3737
#include "commands/prepare.h"
38+
#include "commands/user.h"
3839
#include "commands/vacuum.h"
3940
#include "commands/variable.h"
4041
#include "commands/trigger.h"
@@ -394,6 +395,20 @@ static const struct config_enum_entry force_parallel_mode_options[] = {
394395
{NULL, 0, false}
395396
};
396397

398+
static const struct config_enum_entry password_encryption_options[] = {
399+
{"off", PASSWORD_TYPE_PLAINTEXT, false},
400+
{"on", PASSWORD_TYPE_MD5, false},
401+
{"md5", PASSWORD_TYPE_MD5, false},
402+
{"plain", PASSWORD_TYPE_PLAINTEXT, false},
403+
{"true", PASSWORD_TYPE_MD5, true},
404+
{"false", PASSWORD_TYPE_PLAINTEXT, true},
405+
{"yes", PASSWORD_TYPE_MD5, true},
406+
{"no", PASSWORD_TYPE_PLAINTEXT, true},
407+
{"1", PASSWORD_TYPE_MD5, true},
408+
{"0", PASSWORD_TYPE_PLAINTEXT, true},
409+
{NULL, 0, false}
410+
};
411+
397412
/*
398413
* Options for enum values stored in other modules
399414
*/
@@ -424,8 +439,6 @@ bool check_function_bodies = true;
424439
bool default_with_oids = false;
425440
bool SQL_inheritance = true;
426441

427-
bool Password_encryption = true;
428-
429442
int log_min_error_statement = ERROR;
430443
int log_min_messages = WARNING;
431444
int client_min_messages = NOTICE;
@@ -1324,17 +1337,6 @@ static struct config_bool ConfigureNamesBool[] =
13241337
true,
13251338
NULL, NULL, NULL
13261339
},
1327-
{
1328-
{"password_encryption", PGC_USERSET, CONN_AUTH_SECURITY,
1329-
gettext_noop("Encrypt passwords."),
1330-
gettext_noop("When a password is specified in CREATE USER or "
1331-
"ALTER USER without writing either ENCRYPTED or UNENCRYPTED, "
1332-
"this parameter determines whether the password is to be encrypted.")
1333-
},
1334-
&Password_encryption,
1335-
true,
1336-
NULL, NULL, NULL
1337-
},
13381340
{
13391341
{"transform_null_equals", PGC_USERSET, COMPAT_OPTIONS_CLIENT,
13401342
gettext_noop("Treats \"expr=NULL\" as \"expr IS NULL\"."),
@@ -3821,6 +3823,18 @@ static struct config_enum ConfigureNamesEnum[] =
38213823
NULL, NULL, NULL
38223824
},
38233825

3826+
{
3827+
{"password_encryption", PGC_USERSET, CONN_AUTH_SECURITY,
3828+
gettext_noop("Encrypt passwords."),
3829+
gettext_noop("When a password is specified in CREATE USER or "
3830+
"ALTER USER without writing either ENCRYPTED or UNENCRYPTED, "
3831+
"this parameter determines whether the password is to be encrypted.")
3832+
},
3833+
&Password_encryption,
3834+
PASSWORD_TYPE_MD5, password_encryption_options,
3835+
NULL, NULL, NULL
3836+
},
3837+
38243838
/* End-of-list marker */
38253839
{
38263840
{NULL, 0, 0, NULL, NULL}, NULL, 0, NULL, NULL, NULL, NULL

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@
8585
#ssl_key_file = 'server.key' # (change requires restart)
8686
#ssl_ca_file = '' # (change requires restart)
8787
#ssl_crl_file = '' # (change requires restart)
88-
#password_encryption = on
88+
#password_encryption = md5 # on, off, md5 or plain
8989
#db_user_namespace = off
9090
#row_security = on
9191

‎src/include/commands/user.h

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,14 @@
1414
#include "catalog/objectaddress.h"
1515
#include "nodes/parsenodes.h"
1616

17+
/* Types of password */
18+
typedef enum PasswordType
19+
{
20+
PASSWORD_TYPE_PLAINTEXT = 0,
21+
PASSWORD_TYPE_MD5
22+
} PasswordType;
1723

18-
/* Hook to check passwords in CreateRole() and AlterRole() */
19-
#define PASSWORD_TYPE_PLAINTEXT 0
20-
#define PASSWORD_TYPE_MD5 1
24+
extern int Password_encryption;
2125

2226
typedef void (*check_password_hook_type) (const char *username, const char *password, int password_type, Datum validuntil_time, bool validuntil_null);
2327

0 commit comments

Comments
 (0)