aboutsummaryrefslogtreecommitdiff
path: root/src/backend/libpq/auth.c
Commit message (Collapse)AuthorAge
* Re-run pgindent, fixing a problem where comment lines after a blankBruce Momjian2005-11-22
| | | | | | | | | comment line where output as too long, and update typedefs for /lib directory. Also fix case where identifiers were used as variable names in the backend, but as typedefs in ecpg (favor the backend for indenting). Backpatch to 8.1.X.
* Clean up libpq's pollution of application namespace by renaming theTom Lane2005-10-17
| | | | | | exported routines of ip.c, md5.c, and fe-auth.c to begin with 'pg_'. Also get rid of the vestigial fe_setauthsvc/fe_getauthsvc routines altogether.
* kerberos error message: localhost -> server hostnameBruce Momjian2005-10-15
|
* Standard pgindent run for 8.1.Bruce Momjian2005-10-15
|
* Update krb_server_name to document that a missing entry defaults toBruce Momjian2005-10-13
| | | | | | 'localhost'. Improve kerberos error message.
* Fix Kerberos authentication in wake of virtual-hosts changes --- needTom Lane2005-10-08
| | | | | | | to call krb5_sname_to_principal() always. Also, use krb_srvname rather than the hardwired string 'postgres' as the appl_version string in the krb5_sendauth/recvauth calls, to avoid breaking compatibility with PG 8.0. Magnus Hagander
* Awhile back we replaced all uses of strcasecmp and strncasecmp withTom Lane2005-07-25
| | | | | | pg_strcasecmp and pg_strncasecmp ... but I see some of the former have crept back in. Eternal vigilance is the price of locale independence, apparently.
* Remove support for Kerberos V4. It seems no one is using this, it hasNeil Conway2005-06-27
| | | | | some security issues, and upstream has declared it "dead". Patch from Magnus Hagander, minor editorialization from Neil Conway.
* Add GUC krb_server_hostname so the server hostname can be specified asBruce Momjian2005-06-14
| | | | | | | | | part of service principal. If not set, any service principal matching an entry in the keytab can be used. NEW KERBEROS MATCHING BEHAVIOR FOR 8.1. Todd Kover
* Allow kerberos name and username case sensitivity to be specified fromBruce Momjian2005-06-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | postgresql.conf. --------------------------------------------------------------------------- Here's an updated version of the patch, with the following changes: 1) No longer uses "service name" as "application version". It's instead hardcoded as "postgres". It could be argued that this part should be backpatched to 8.0, but it doesn't make a big difference until you can start changing it with GUC / connection parameters. This change only affects kerberos 5, not 4. 2) Now downcases kerberos usernames when the client is running on win32. 3) Adds guc option for "krb_caseins_users" to make the server ignore case mismatch which is required by some KDCs such as Active Directory. Off by default, per discussion with Tom. This change only affects kerberos 5, not 4. 4) Updated so it doesn't conflict with the rendevouz/bonjour patch already in ;-) Magnus Hagander
* Use _() macro consistently rather than gettext(). Add translationBruce Momjian2005-02-22
| | | | macros around strings that were missing them.
* Add conditional inclusion of <com_err.h> to support old 'heimdal'Tom Lane2005-01-12
| | | | version of Kerberos. Per report from Reinhard Max.
* Tag appropriate files for rc3PostgreSQL Daemon2004-12-31
| | | | | | | | Also performed an initial run through of upgrading our Copyright date to extend to 2005 ... first run here was very simple ... change everything where: grep 1996-2004 && the word 'Copyright' ... scanned through the generated list with 'less' first, and after, to make sure that I only picked up the right entries ...
* Remove direct inclusions of <com_err.h> as well as configure test forTom Lane2004-12-20
| | | | | | | its presence. This amounts to desupporting Kerberos 5 releases 1.0.*, which is small loss, and simplifies use of our Kerberos code on platforms with Red-Hat-style include file layouts. Per gripe from John Gray and followup discussion.
* Message style revisionsPeter Eisentraut2004-10-12
|
* Pgindent run for 8.0.Bruce Momjian2004-08-29
|
* Update copyright to 2004.Bruce Momjian2004-08-29
|
* Use gettext_noop() to mark strings. errmsg() perform theDennis Bjorklund2004-08-04
| | | | real gettext() later on, so it was called twice before.
* Add some strings for translation and remove some cut'n'pasteDennis Bjorklund2004-08-04
| | | | that makes it impossible to translate to other languages.
* Fix broken IDENT support for FreeBSD (appears to have been broken byTom Lane2003-12-20
| | | | | ill-considered conditional logic in getpeereid patch of 3-Dec-2002). Per bug #1021.
* $Header: -> $PostgreSQL Changes ...PostgreSQL Daemon2003-11-29
|
* Various message fixes, among those fixes for the previous round of fixesPeter Eisentraut2003-09-26
|
* Message editing: remove gratuitous variations in message wording, standardizePeter Eisentraut2003-09-25
| | | | | terms, add some clarifications, fix some untranslatable attempts at dynamic message building.
* Update copyrights to 2003.Bruce Momjian2003-08-04
|
* pgindent run.Bruce Momjian2003-08-04
|
* Localizability improvement.Tom Lane2003-07-28
|
* Have SSL text print only when SSL mode is enabled.Bruce Momjian2003-07-26
|
* At long last I put together a patch to support 4 client SSL negotiationBruce Momjian2003-07-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | modes (and replace the requiressl boolean). The four options were first spelled out by Magnus Hagander <mha@sollentuna.net> on 2000-08-23 in email to pgsql-hackers, archived here: http://archives.postgresql.org/pgsql-hackers/2000-08/msg00639.php My original less-flexible patch and the ensuing thread are archived at: http://dbforums.com/t623845.html Attached is a new patch, including documentation. To sum up, there's a new client parameter "sslmode" and environment variable "PGSSLMODE", with these options: sslmode description ------- ----------- disable Unencrypted non-SSL only allow Negotiate, prefer non-SSL prefer Negotiate, prefer SSL (default) require Require SSL The only change to the server is a new pg_hba.conf line type, "hostnossl", for specifying connections that are not allowed to use SSL (for example, to prevent servers on a local network from accidentally using SSL and wasting cycles). Thus the 3 pg_hba.conf line types are: pg_hba.conf line types ---------------------- host applies to either SSL or regular connections hostssl applies only to SSL connections hostnossl applies only to regular connections These client and server options, the postgresql.conf ssl = false option, and finally the possibility of compiling with no SSL support at all, make quite a range of combinations to test. I threw together a test script to try many of them out. It's in a separate tarball with its config files, a patch to psql so it'll announce SSL connections even in absence of a tty, and the test output. The test is especially informative when run on the same tty the postmaster was started on, so the FATAL: errors during negotiation are interleaved with the psql client output. I saw Tom write that new submissions for 7.4 have to be in before midnight local time, and since I'm on the east coast in the US, this just makes it in before the bell. :) Jon Jensen
* Have a go at fixing various outstanding portability issues in code thatTom Lane2003-07-23
| | | | | | | | | was modified for IPv6. Use a robust definition of struct sockaddr_storage, do a proper configure test to see if ss_len exists, don't assume that getnameinfo() will handle AF_UNIX sockets, don't trust getaddrinfo to return the protocol we ask for, etc. This incorporates several outstanding patches from Kurt Roeckx, but I'm to blame for anything that doesn't work ...
* Error message editing in backend/libpq, backend/postmaster, backend/tcop.Tom Lane2003-07-22
| | | | | Along the way, fix some logic problems in pgstat_initstats, notably the bogus assumption that malloc returns zeroed memory.
* > This change (I'm sure this will wrap poorly -- sorry):Bruce Momjian2003-06-25
| | | | | | | | | | | | | | | | | | | > http://developer.postgresql.org/cvsweb.cgi/pgsql-server/src/include/libpq/pqcomm.h.diff?r1=1.85&r2=1.86 > > modified SockAddr, but no corresponding change was made here > (fe-auth.c:612): > > case AUTH_REQ_KRB5: > #ifdef KRB5 > if (pg_krb5_sendauth(PQerrormsg, conn->sock, &conn->laddr.in, > &conn->raddr.in, > hostname) != STATUS_OK) > > It's not obvious to me what the change ought to be though. This patch should hopefully fix both kerberos 4 and 5. Kurt Roeckx
* IPv6 cleanups.Bruce Momjian2003-06-12
| | | | | Kurt Roeckx Andrew Dunstan
* Fix breakage induced by yours truly in Kerberos and PAM code.Tom Lane2003-04-25
|
* Another round of protocol changes. Backend-to-frontend messages now allTom Lane2003-04-22
| | | | | | | | | | have length words. COPY OUT reimplemented per new protocol: it doesn't need \. anymore, thank goodness. COPY BINARY to/from frontend works, at least as far as the backend is concerned --- libpq's PQgetline API is not up to snuff, and will have to be replaced with something that is null-safe. libpq uses message length words for performance improvement (no cycles wasted rescanning long messages), but not yet for error recovery.
* Second round of FE/BE protocol changes. Frontend->backend messages nowTom Lane2003-04-19
| | | | have length counts, and COPY IN data is packetized into messages.
* First phase of FE/BE protocol modifications: new StartupPacket layoutTom Lane2003-04-17
| | | | | | with variable-width fields. No more truncation of long user names. Also, libpq can now send its environment-variable-driven SET commands as part of the startup packet, saving round trips to server.
* Update FAQ's in head and 7.3.X.Bruce Momjian2003-02-14
|
* Fix for systems that don't have INET_ADDRSTRLEN.Peter Eisentraut2003-01-06
|
* Enable IPv6 connections to the server, and add pg_hba.conf IPv6 entriesBruce Momjian2003-01-06
| | | | | | | if the OS supports it. Code will still compile on non-IPv6-aware machines (feature added by Bruce). Nigel Kukard
* Back out V6 code, caused postmaster startup failure.Bruce Momjian2002-12-06
|
* We have just finished porting the old KAME IPv6 patch over toBruce Momjian2002-12-06
| | | | | | | | | | | postgresql version 7.3, but yea... this patch adds full IPv6 support to postgres. I've tested it out on 7.2.3 and has been running perfectly stable. CREDITS: The KAME Project (Initial patch) Nigel Kukard <nkukard@lbsd.net> Johan Jordaan <johanj@lando.co.za>
* Deal with cases where getpeereid _and_ another creditial method isBruce Momjian2002-12-03
| | | | supported.
* Guard against send-lots-and-lots-of-data DoS attack from unauthenticatedTom Lane2002-09-04
| | | | | users, by limiting the length of string we will accept for a password. Patch by Serguei Mokhov, some editorializing by Tom Lane.
* pgindent run.Bruce Momjian2002-09-04
|
* Remove sys/types.h in files that include postgres.h, and hence c.h,Bruce Momjian2002-09-02
| | | | because c.h has sys/types.h.
* Back out password packet length check.Bruce Momjian2002-08-30
| | | | Improve wording of pre-7.3 syntax mention.
* Prevent problem with extra-long password packets from allocating lots ofBruce Momjian2002-08-29
| | | | | | memory. Neil Conway
* Remove support for version-0 FE/BE protocol, per pghackers discussion.Tom Lane2002-08-29
| | | | This breaks support for 6.2 or older client libraries.
* The attached patch implements the password packet length sanity checkBruce Momjian2002-08-27
| | | | | | (using an elog(LOG) ), as well as includes a few more comment fixes. Neil Conway
* Add most of Neil Conway's cleanups.Bruce Momjian2002-08-27
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-03 02:40:39 +0000