diff options
Diffstat (limited to 'src/backend/libpq/crypt.c')
| -rw-r--r-- | src/backend/libpq/crypt.c | 61 |
1 files changed, 39 insertions, 22 deletions
diff --git a/src/backend/libpq/crypt.c b/src/backend/libpq/crypt.c index 9f0ae15b00e..ac10751ec20 100644 --- a/src/backend/libpq/crypt.c +++ b/src/backend/libpq/crypt.c @@ -283,7 +283,6 @@ plain_crypt_verify(const char *role, const char *shadow_pass, const char *client_pass, char **logdetail) { - int retval; char crypt_client_pass[MD5_PASSWD_LEN + 1]; /* @@ -293,6 +292,21 @@ plain_crypt_verify(const char *role, const char *shadow_pass, */ switch (get_password_type(shadow_pass)) { + case PASSWORD_TYPE_SCRAM: + if (scram_verify_plain_password(role, + client_pass, + shadow_pass)) + { + return STATUS_OK; + } + else + { + *logdetail = psprintf(_("Password does not match for user \"%s\"."), + role); + return STATUS_ERROR; + } + break; + case PASSWORD_TYPE_MD5: if (!pg_md5_encrypt(client_pass, role, @@ -307,30 +321,33 @@ plain_crypt_verify(const char *role, const char *shadow_pass, */ return STATUS_ERROR; } - client_pass = crypt_client_pass; + if (strcmp(crypt_client_pass, shadow_pass) == 0) + return STATUS_OK; + else + { + *logdetail = psprintf(_("Password does not match for user \"%s\"."), + role); + return STATUS_ERROR; + } break; + case PASSWORD_TYPE_PLAINTEXT: + if (strcmp(client_pass, shadow_pass) == 0) + return STATUS_OK; + else + { + *logdetail = psprintf(_("Password does not match for user \"%s\"."), + role); + return STATUS_ERROR; + } break; - - default: - - /* - * This shouldn't happen. Plain "password" authentication should - * be possible with any kind of stored password hash. - */ - *logdetail = psprintf(_("Password of user \"%s\" is in unrecognized format."), - role); - return STATUS_ERROR; } - if (strcmp(client_pass, shadow_pass) == 0) - retval = STATUS_OK; - else - { - *logdetail = psprintf(_("Password does not match for user \"%s\"."), - role); - retval = STATUS_ERROR; - } - - return retval; + /* + * This shouldn't happen. Plain "password" authentication is possible + * with any kind of stored password hash. + */ + *logdetail = psprintf(_("Password of user \"%s\" is in unrecognized format."), + role); + return STATUS_ERROR; } |