Skip to content

Commit c727f12

Browse files
hlinnakahlinnaka
committed
Rename "scram" to "scram-sha-256" in pg_hba.conf and password_encryption.
Per discussion, plain "scram" is confusing because we actually implement SCRAM-SHA-256 rather than the original SCRAM that uses SHA-1 as the hash algorithm. If we add support for SCRAM-SHA-512 or some other mechanism in the SCRAM family in the future, that would become even more confusing. Most of the internal files and functions still use just "scram" as a shorthand for SCRMA-SHA-256, but I did change PASSWORD_TYPE_SCRAM to PASSWORD_TYPE_SCRAM_SHA_256, as that could potentially be used by 3rd party extensions that hook into the password-check hook. Michael Paquier did this in an earlier version of the SCRAM patch set already, but I didn't include that in the version that was committed. Discussion: https://www.postgresql.org/message-id/fde71ff1-5858-90c8-99a9-1c2427e7bafb@iki.fi
1 parent 123aaff commit c727f12

File tree

15 files changed

+60
-59
lines changed

15 files changed

+60
-59
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -412,7 +412,7 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
412412
</varlistentry>
413413

414414
<varlistentry>
415-
<term><literal>scram</></term>
415+
<term><literal>scram-sha-256</></term>
416416
<listitem>
417417
<para>
418418
Perform SCRAM-SHA-256 authentication to verify the user's
@@ -683,7 +683,7 @@ host postgres all 192.168.93.0/24 ident
683683
# "postgres" if the user's password is correctly supplied.
684684
#
685685
# TYPE DATABASE USER ADDRESS METHOD
686-
host postgres all 192.168.12.10/32 scram
686+
host postgres all 192.168.12.10/32 scram-sha-256
687687

688688
# Allow any user from hosts in the example.com domain to connect to
689689
# any database if the user's password is correctly supplied.
@@ -694,7 +694,7 @@ host postgres all 192.168.12.10/32 scram
694694
#
695695
# TYPE DATABASE USER ADDRESS METHOD
696696
host all mike .example.com md5
697-
host all all .example.com scram
697+
host all all .example.com scram-sha-256
698698

699699
# In the absence of preceding "host" lines, these two lines will
700700
# reject all connections from 192.168.54.1 (since that entry will be
@@ -922,7 +922,7 @@ omicron bryanh guest1
922922
</indexterm>
923923

924924
<para>
925-
The password-based authentication methods are <literal>scram</>,
925+
The password-based authentication methods are <literal>scram-sha-256</>,
926926
<literal>md5</>, and <literal>password</>. These methods operate
927927
similarly except for the way that the password is sent across the
928928
connection.
@@ -939,8 +939,9 @@ omicron bryanh guest1
939939

940940

941941
<para>
942-
<literal>scram</> performs SCRAM-SHA-256 authentication, as described
943-
in <ulink url="https://tools.ietf.org/html/rfc5802">RFC5802</ulink>. It
942+
<literal>scram-sha-256</> performs SCRAM-SHA-256 authentication, as
943+
described in
944+
<ulink url="https://tools.ietf.org/html/rfc5802">RFC5802</ulink>. It
944945
is a challenge-response scheme, that prevents password sniffing on
945946
untrusted connections. It is more secure than the <literal>md5</>
946947
method, but might not be supported by older clients.
@@ -953,7 +954,7 @@ omicron bryanh guest1
953954
protection if an attacker manages to steal the password hash from the
954955
server, and it cannot be used with the <xref
955956
linkend="guc-db-user-namespace"> feature. For all other users,
956-
<literal>md5</> works the same as <literal>scram</>.
957+
<literal>md5</> works the same as <literal>scram-sha-256</>.
957958
</para>
958959

959960
<para>

‎doc/src/sgml/config.sgml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1194,8 +1194,8 @@ include_dir 'conf.d'
11941194
stores the password as an MD5 hash. Setting this to <literal>plain</> stores
11951195
it in plaintext. <literal>on</> and <literal>off</> are also accepted, as
11961196
aliases for <literal>md5</> and <literal>plain</>, respectively. Setting
1197-
this parameter to <literal>scram</> will encrypt the password with
1198-
SCRAM-SHA-256.
1197+
this parameter to <literal>scram-sha-256</> will encrypt the password
1198+
with SCRAM-SHA-256.
11991199
</para>
12001200
</listitem>
12011201
</varlistentry>

‎src/backend/commands/user.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -140,8 +140,8 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
140140
dpassword = defel;
141141
if (strcmp(defel->defname, "encryptedPassword") == 0)
142142
{
143-
if (Password_encryption == PASSWORD_TYPE_SCRAM)
144-
password_type = PASSWORD_TYPE_SCRAM;
143+
if (Password_encryption == PASSWORD_TYPE_SCRAM_SHA_256)
144+
password_type = PASSWORD_TYPE_SCRAM_SHA_256;
145145
else
146146
password_type = PASSWORD_TYPE_MD5;
147147
}
@@ -548,8 +548,8 @@ AlterRole(AlterRoleStmt *stmt)
548548
dpassword = defel;
549549
if (strcmp(defel->defname, "encryptedPassword") == 0)
550550
{
551-
if (Password_encryption == PASSWORD_TYPE_SCRAM)
552-
password_type = PASSWORD_TYPE_SCRAM;
551+
if (Password_encryption == PASSWORD_TYPE_SCRAM_SHA_256)
552+
password_type = PASSWORD_TYPE_SCRAM_SHA_256;
553553
else
554554
password_type = PASSWORD_TYPE_MD5;
555555
}

‎src/backend/libpq/auth-scram.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ pg_be_scram_init(const char *username, const char *shadow_pass)
183183
{
184184
int password_type = get_password_type(shadow_pass);
185185

186-
if (password_type == PASSWORD_TYPE_SCRAM)
186+
if (password_type == PASSWORD_TYPE_SCRAM_SHA_256)
187187
{
188188
if (parse_scram_verifier(shadow_pass, &state->salt, &state->iterations,
189189
state->StoredKey, state->ServerKey))

‎src/backend/libpq/auth.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ static char *recv_password_packet(Port *port);
5050

5151

5252
/*----------------------------------------------------------------
53-
* Password-based authentication methods (password, md5, and scram)
53+
* Password-based authentication methods (password, md5, and scram-sha-256)
5454
*----------------------------------------------------------------
5555
*/
5656
static int CheckPasswordAuth(Port *port, char **logdetail);
@@ -757,10 +757,10 @@ CheckPWChallengeAuth(Port *port, char **logdetail)
757757
* If the user does not exist, or has no password, we still go through the
758758
* motions of authentication, to avoid revealing to the client that the
759759
* user didn't exist. If 'md5' is allowed, we choose whether to use 'md5'
760-
* or 'scram' authentication based on current password_encryption setting.
761-
* The idea is that most genuine users probably have a password of that
762-
* type, if we pretend that this user had a password of that type, too, it
763-
* "blends in" best.
760+
* or 'scram-sha-256' authentication based on current password_encryption
761+
* setting. The idea is that most genuine users probably have a password
762+
* of that type, if we pretend that this user had a password of that type,
763+
* too, it "blends in" best.
764764
*
765765
* If the user had a password, but it was expired, we'll use the details
766766
* of the expired password for the authentication, but report it as
@@ -773,9 +773,9 @@ CheckPWChallengeAuth(Port *port, char **logdetail)
773773

774774
/*
775775
* If 'md5' authentication is allowed, decide whether to perform 'md5' or
776-
* 'scram' authentication based on the type of password the user has. If
777-
* it's an MD5 hash, we must do MD5 authentication, and if it's a SCRAM
778-
* verifier, we must do SCRAM authentication. If it's stored in
776+
* 'scram-sha-256' authentication based on the type of password the user
777+
* has. If it's an MD5 hash, we must do MD5 authentication, and if it's
778+
* a SCRAM verifier, we must do SCRAM authentication. If it's stored in
779779
* plaintext, we could do either one, so we opt for the more secure
780780
* mechanism, SCRAM.
781781
*

‎src/backend/libpq/crypt.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ get_password_type(const char *shadow_pass)
101101
if (strncmp(shadow_pass, "md5", 3) == 0 && strlen(shadow_pass) == MD5_PASSWD_LEN)
102102
return PASSWORD_TYPE_MD5;
103103
if (strncmp(shadow_pass, "scram-sha-256:", strlen("scram-sha-256:")) == 0)
104-
return PASSWORD_TYPE_SCRAM;
104+
return PASSWORD_TYPE_SCRAM_SHA_256;
105105
return PASSWORD_TYPE_PLAINTEXT;
106106
}
107107

@@ -141,7 +141,7 @@ encrypt_password(PasswordType target_type, const char *role,
141141
elog(ERROR, "password encryption failed");
142142
return encrypted_password;
143143

144-
case PASSWORD_TYPE_SCRAM:
144+
case PASSWORD_TYPE_SCRAM_SHA_256:
145145

146146
/*
147147
* cannot convert a SCRAM verifier to an MD5 hash, so fall
@@ -152,7 +152,7 @@ encrypt_password(PasswordType target_type, const char *role,
152152
}
153153
break;
154154

155-
case PASSWORD_TYPE_SCRAM:
155+
case PASSWORD_TYPE_SCRAM_SHA_256:
156156
switch (guessed_type)
157157
{
158158
case PASSWORD_TYPE_PLAINTEXT:
@@ -164,7 +164,7 @@ encrypt_password(PasswordType target_type, const char *role,
164164
* cannot convert an MD5 hash to a SCRAM verifier, so fall
165165
* through to save the MD5 hash instead.
166166
*/
167-
case PASSWORD_TYPE_SCRAM:
167+
case PASSWORD_TYPE_SCRAM_SHA_256:
168168
return pstrdup(password);
169169
}
170170
break;
@@ -280,7 +280,7 @@ plain_crypt_verify(const char *role, const char *shadow_pass,
280280
*/
281281
switch (get_password_type(shadow_pass))
282282
{
283-
case PASSWORD_TYPE_SCRAM:
283+
case PASSWORD_TYPE_SCRAM_SHA_256:
284284
if (scram_verify_plain_password(role,
285285
client_pass,
286286
shadow_pass))

‎src/backend/libpq/hba.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ static const char *const UserAuthName[] =
126126
"ident",
127127
"password",
128128
"md5",
129-
"scram",
129+
"scram-sha256",
130130
"gss",
131131
"sspi",
132132
"pam",
@@ -1327,7 +1327,7 @@ parse_hba_line(TokenizedLine *tok_line, int elevel)
13271327
}
13281328
parsedline->auth_method = uaMD5;
13291329
}
1330-
else if (strcmp(token->string, "scram") == 0)
1330+
else if (strcmp(token->string, "scram-sha-256") == 0)
13311331
parsedline->auth_method = uaSCRAM;
13321332
else if (strcmp(token->string, "pam") == 0)
13331333
#ifdef USE_PAM

‎src/backend/libpq/pg_hba.conf.sample

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,10 @@
4242
# or "samenet" to match any address in any subnet that the server is
4343
# directly connected to.
4444
#
45-
# METHOD can be "trust", "reject", "md5", "password", "scram", "gss",
46-
# "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert". Note that
47-
# "password" sends passwords in clear text; "md5" or "scram" are preferred
48-
# since they send encrypted passwords.
45+
# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256",
46+
# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".
47+
# Note that "password" sends passwords in clear text; "md5" or
48+
# "scram-sha-256" are preferred since they send encrypted passwords.
4949
#
5050
# OPTIONS are a set of options for the authentication in the format
5151
# NAME=VALUE. The available options depend on the different

‎src/backend/utils/misc/guc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -410,7 +410,7 @@ static const struct config_enum_entry force_parallel_mode_options[] = {
410410
static const struct config_enum_entry password_encryption_options[] = {
411411
{"plain", PASSWORD_TYPE_PLAINTEXT, false},
412412
{"md5", PASSWORD_TYPE_MD5, false},
413-
{"scram", PASSWORD_TYPE_SCRAM, false},
413+
{"scram-sha-256", PASSWORD_TYPE_SCRAM_SHA_256, false},
414414
{"off", PASSWORD_TYPE_PLAINTEXT, false},
415415
{"on", PASSWORD_TYPE_MD5, false},
416416
{"true", PASSWORD_TYPE_MD5, true},

‎src/bin/initdb/initdb.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@
7777
extern const char *select_default_timezone(const char *share_path);
7878

7979
static const char *const auth_methods_host[] = {
80-
"trust", "reject", "md5", "password", "scram", "ident", "radius",
80+
"trust", "reject", "scram-sha-256", "md5", "password", "ident", "radius",
8181
#ifdef ENABLE_GSS
8282
"gss",
8383
#endif
@@ -99,7 +99,7 @@ static const char *const auth_methods_host[] = {
9999
NULL
100100
};
101101
static const char *const auth_methods_local[] = {
102-
"trust", "reject", "md5", "scram", "password", "peer", "radius",
102+
"trust", "reject", "scram-sha-256", "md5", "password", "peer", "radius",
103103
#ifdef USE_PAM
104104
"pam", "pam ",
105105
#endif
@@ -1130,12 +1130,12 @@ setup_config(void)
11301130
"#update_process_title = off");
11311131
#endif
11321132

1133-
if (strcmp(authmethodlocal, "scram") == 0 ||
1134-
strcmp(authmethodhost, "scram") == 0)
1133+
if (strcmp(authmethodlocal, "scram-sha-256") == 0 ||
1134+
strcmp(authmethodhost, "scram-sha-256") == 0)
11351135
{
11361136
conflines = replace_token(conflines,
11371137
"#password_encryption = md5",
1138-
"password_encryption = scram");
1138+
"password_encryption = scram-sha-256");
11391139
}
11401140

11411141
snprintf(path, sizeof(path), "%s/postgresql.conf", pg_data);
@@ -2329,16 +2329,16 @@ check_need_password(const char *authmethodlocal, const char *authmethodhost)
23292329
{
23302330
if ((strcmp(authmethodlocal, "md5") == 0 ||
23312331
strcmp(authmethodlocal, "password") == 0 ||
2332-
strcmp(authmethodlocal, "scram") == 0) &&
2332+
strcmp(authmethodlocal, "scram-sha-256") == 0) &&
23332333
(strcmp(authmethodhost, "md5") == 0 ||
23342334
strcmp(authmethodhost, "password") == 0 ||
2335-
strcmp(authmethodhost, "scram") == 0) &&
2335+
strcmp(authmethodhost, "scram-sha-256") == 0) &&
23362336
!(pwprompt || pwfilename))
23372337
{
23382338
fprintf(stderr, _("%s: must specify a password for the superuser to enable %s authentication\n"), progname,
23392339
(strcmp(authmethodlocal, "md5") == 0 ||
23402340
strcmp(authmethodlocal, "password") == 0 ||
2341-
strcmp(authmethodlocal, "scram") == 0)
2341+
strcmp(authmethodlocal, "scram-sha-256") == 0)
23422342
? authmethodlocal
23432343
: authmethodhost);
23442344
exit(1);

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy