aboutsummaryrefslogtreecommitdiff
path: root/src/interfaces/libpq/fe-auth.c
Commit message (Collapse)AuthorAge
* Remove cvs keywords from all files.Magnus Hagander2010-09-20
|
* Allow full SSL certificate verification (wherein libpq checks its host nameTom Lane2010-07-14
| | | | | | | | | | | | | | | parameter against server cert's CN field) to succeed in the case where both host and hostaddr are specified. As with the existing precedents for Kerberos, GSSAPI, SSPI, it is the calling application's responsibility that host and hostaddr match up --- we just use the host name as given. Per bug #5559 from Christopher Head. In passing, make the error handling and messages for the no-host-name-given failure more consistent among these four cases, and correct a lie in the documentation: we don't attempt to reverse-lookup host from hostaddr if host is missing. Back-patch to 8.4 where SSL cert verification was introduced.
* Require hostname to be set when using GSSAPI authentication. Without it,Magnus Hagander2010-03-08
| | | | | | the GSSAPI libraries crash. Noted by Zdenek Kotala
* Update copyright for the year 2010.Bruce Momjian2010-01-02
|
* 8.4 pgindent run, with new combined Linux/FreeBSD/MinGW typedef listBruce Momjian2009-06-11
| | | | provided by Andrew.
* Clean up pg_SSPI_error() coding a little bit: make the messages moreTom Lane2009-03-22
| | | | | consistent, translate where intended, const-ify declarations. Resolves a gripe from Alvaro as well as some stuff I didn't like.
* Remove special-handling of usernames with Kerberos authentication. We willMagnus Hagander2009-01-13
| | | | | | | | | now always use the system username as the default, and not try to pick it up from the kerberos ticket. This fixes the spurious error messages that show up on kerberos-enabled builds when not actually using kerberos, and puts it in line with how other authentication methods work.
* Update copyright for 2009.Bruce Momjian2009-01-01
|
* Remove support for (insecure) crypt authentication.Magnus Hagander2008-10-28
| | | | This breaks compatibility with pre-7.2 versions.
* Fix pg_GSS_error to use conn->errorMessage more sanely, ie, actuallyTom Lane2008-01-31
| | | | | | work with the PQExpBuffer code instead of fighting it. This avoids an unnecessary limit on message length and fixes the latent bug that errorMessage.len wasn't getting set.
* Update copyrights in source tree to 2008.Bruce Momjian2008-01-01
|
* Fix up the PQconnectionUsedPassword mess: create a separateTom Lane2007-12-09
| | | | | | | | PQconnectionNeedsPassword function that tells the right thing for whether to prompt for a password, and improve PQconnectionUsedPassword so that it checks whether the password used by the connection was actually supplied as a connection argument, instead of coming from environment or a password file. Per bug report from Mark Cave-Ayland and subsequent discussion.
* Don't send an empty SSPI negotiation packet at the end of the negotiation.Magnus Hagander2007-12-04
| | | | Fixes bug #3750
* pgindent run for 8.3.Bruce Momjian2007-11-15
|
* Small string tweaksPeter Eisentraut2007-09-25
|
* Make it possible, and default, for MingW to build with SSPI supportMagnus Hagander2007-07-24
| | | | | by dynamically loading the function that's missing from the MingW headers and library.
* Use PQExpBuffer for error message in fe-auth.c.Magnus Hagander2007-07-23
| | | | | In passing, change functions that passedin both PGconn and parts of it to just pass in the PGconn.
* Stupid typo.Magnus Hagander2007-07-23
|
* SSPI authentication on Windows. GSSAPI compatible client when doing KerberosMagnus Hagander2007-07-23
| | | | | | | against a Unix server, and Windows-specific server-side authentication using SSPI "negotiate" method (Kerberos or NTLM). Only builds properly with MSVC for now.
* Enable GSSAPI to build using MSVC. Always build GSSAPI when Kerberos isMagnus Hagander2007-07-12
| | | | enabled, because the only Kerberos library supported always contains it.
* Support GSSAPI builds where the header is <gssapi.h> and not <gssapi/gssapi.h>,Magnus Hagander2007-07-12
| | | | | | such as OpenBSD (possibly all Heimdal). Stefan Kaltenbrunner
* Fix freenig of names in Kerberos when using MIT - need to use theMagnus Hagander2007-07-12
| | | | | | free function provided in the Kerberos library. This fixes a very hard to track down heap corruption on windows when using debug runtimes.
* Add support for GSSAPI authentication.Magnus Hagander2007-07-10
| | | | | | Documentation still being written, will be committed later. Henry B. Hotz and Magnus Hagander
* StrNCpy -> strlcpy (not complete)Peter Eisentraut2007-02-10
|
* Update CVS HEAD for 2007 copyright. Back branches are typically notBruce Momjian2007-01-05
| | | | back-stamped for this.
* pgindent run for 8.2.Bruce Momjian2006-10-04
|
* Fix bugs in plpgsql and ecpg caused by assuming that isspace() would onlyTom Lane2006-09-22
| | | | | | | | | return true for exactly the characters treated as whitespace by their flex scanners. Per report from Victor Snezhko and subsequent investigation. Also fix a passel of unsafe usages of <ctype.h> functions, that is, ye olde char-vs-unsigned-char issue. I won't miss <ctype.h> when we are finally able to stop using it.
* Remove 576 references of include files that were not needed.Bruce Momjian2006-07-14
|
* Revert part of recent include patch not ready for application.Bruce Momjian2006-07-14
|
* Add additional includes needed on some platforms.Bruce Momjian2006-07-14
|
* Clean up for warning:Joe Conway2006-07-12
| | | | | | | | | fe-auth.c:573: warning: passing argument 1 of 'free' discards qualifiers from pointer target type pg_krb5_authname used to return a (const char *) to memory allocated by krb. Somewhere along the lines this was changed so that a copy was made, returned, and freed instead. However the const modifier was never removed.
* Split definitions for md5.c out of crypt.h and into their own headerTom Lane2006-06-20
| | | | | | | | | libpq/md5.h, so that there's a clear separation between backend-only definitions and shared frontend/backend definitions. (Turns out this is reversing a bad decision from some years ago...) Fix up references to crypt.h as needed. I looked into moving the code into src/port, but the headers in src/include/libpq are sufficiently intertwined that it seems more work than it's worth to do that.
* * Stephen Frost (sfrost@snowman.net) wrote:Bruce Momjian2006-03-06
| | | | | | | | | | | | | | | | | | | | | | | | | > I've now tested this patch at home w/ 8.2HEAD and it seems to fix the > bug. I plan on testing it under 8.1.2 at work tommorow with > mod_auth_krb5, etc, and expect it'll work there. Assuming all goes > well and unless someone objects I'll forward the patch to -patches. > It'd be great to have this fixed as it'll allow us to use Kerberos to > authenticate to phppgadmin and other web-based tools which use > Postgres. While playing with this patch under 8.1.2 at home I discovered a mistake in how I manually applied one of the hunks to fe-auth.c. Basically, the base code had changed and so the patch needed to be modified slightly. This is because the code no longer either has a freeable pointer under 'name' or has 'name' as NULL. The attached patch correctly frees the string from pg_krb5_authname (where it had been strdup'd) if and only if pg_krb5_authname returned a string (as opposed to falling through and having name be set using name = pw->name;). Also added a comment to this effect. Backpatch to 8.1.X. Stephen Frost
* Update copyright for 2006. Update scripts.Bruce Momjian2006-03-05
|
* Back out patch pending review.Bruce Momjian2006-02-12
| | | | | | | | | | | | | | | | | | | | | | | | | | --------------------------------------------------------------------------- > I've now tested this patch at home w/ 8.2HEAD and it seems to fix the > bug. I plan on testing it under 8.1.2 at work tommorow with > mod_auth_krb5, etc, and expect it'll work there. Assuming all goes > well and unless someone objects I'll forward the patch to -patches. > It'd be great to have this fixed as it'll allow us to use Kerberos to > authenticate to phppgadmin and other web-based tools which use > Postgres. While playing with this patch under 8.1.2 at home I discovered a mistake in how I manually applied one of the hunks to fe-auth.c. Basically, the base code had changed and so the patch needed to be modified slightly. This is because the code no longer either has a freeable pointer under 'name' or has 'name' as NULL. The attached patch correctly frees the string from pg_krb5_authname (where it had been strdup'd) if and only if pg_krb5_authname returned a string (as opposed to falling through and having name be set using name = pw->name;). Also added a comment to this effect. Please review. Stephen Frost (sfrost@snowman.net) wrote:
* > I've now tested this patch at home w/ 8.2HEAD and it seems to fix theBruce Momjian2006-02-12
| | | | | | | | | | | | | | | | | | | | | | | > bug. I plan on testing it under 8.1.2 at work tommorow with > mod_auth_krb5, etc, and expect it'll work there. Assuming all goes > well and unless someone objects I'll forward the patch to -patches. > It'd be great to have this fixed as it'll allow us to use Kerberos to > authenticate to phppgadmin and other web-based tools which use > Postgres. While playing with this patch under 8.1.2 at home I discovered a mistake in how I manually applied one of the hunks to fe-auth.c. Basically, the base code had changed and so the patch needed to be modified slightly. This is because the code no longer either has a freeable pointer under 'name' or has 'name' as NULL. The attached patch correctly frees the string from pg_krb5_authname (where it had been strdup'd) if and only if pg_krb5_authname returned a string (as opposed to falling through and having name be set using name = pw->name;). Also added a comment to this effect. Please review. Stephen Frost (sfrost@snowman.net) wrote:
* Rename pg_make_encrypted_password to PQencryptPassword.Peter Eisentraut2005-12-26
|
* Add an officially exported libpq function to encrypt passwords, andTom Lane2005-12-23
| | | | | modify the previous \password patch to use it instead of depending on a not-officially-exported function. Per discussion.
* Re-run pgindent, fixing a problem where comment lines after a blankBruce Momjian2005-11-22
| | | | | | | | | comment line where output as too long, and update typedefs for /lib directory. Also fix case where identifiers were used as variable names in the backend, but as typedefs in ecpg (favor the backend for indenting). Backpatch to 8.1.X.
* I have applied the following patch to document PQinitSSL() andBruce Momjian2005-10-24
| | | | | | | | | | | PQregisterThreadLock(). I also remove the crypt() mention in the libpq threading section and added a single sentence in the client-auth manual page under crypt(). Crypt authentication is so old now that a separate paragraph about it seemed unwise. I also added a comment about our use of locking around pqGetpwuid().
* Clean up libpq's pollution of application namespace by renaming theTom Lane2005-10-17
| | | | | | exported routines of ip.c, md5.c, and fe-auth.c to begin with 'pg_'. Also get rid of the vestigial fe_setauthsvc/fe_getauthsvc routines altogether.
* Standard pgindent run for 8.1.Bruce Momjian2005-10-15
|
* Fix Kerberos authentication in wake of virtual-hosts changes --- needTom Lane2005-10-08
| | | | | | | to call krb5_sname_to_principal() always. Also, use krb_srvname rather than the hardwired string 'postgres' as the appl_version string in the krb5_sendauth/recvauth calls, to avoid breaking compatibility with PG 8.0. Magnus Hagander
* Fix a theoretical memory leak in pg_password_sendauth(). If the firstNeil Conway2005-06-30
| | | | | | | | malloc() succeeded but the second failed, the buffer allocated by the first malloc() would be leaked. Fix this by allocating both buffers via a single malloc(), as suggested by Tom. Per Coverity static analysis performed by EnterpriseDB.
* Remove support for Kerberos V4. It seems no one is using this, it hasNeil Conway2005-06-27
| | | | | some security issues, and upstream has declared it "dead". Patch from Magnus Hagander, minor editorialization from Neil Conway.
* Allow kerberos name and username case sensitivity to be specified fromBruce Momjian2005-06-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | postgresql.conf. --------------------------------------------------------------------------- Here's an updated version of the patch, with the following changes: 1) No longer uses "service name" as "application version". It's instead hardcoded as "postgres". It could be argued that this part should be backpatched to 8.0, but it doesn't make a big difference until you can start changing it with GUC / connection parameters. This change only affects kerberos 5, not 4. 2) Now downcases kerberos usernames when the client is running on win32. 3) Adds guc option for "krb_caseins_users" to make the server ignore case mismatch which is required by some KDCs such as Active Directory. Off by default, per discussion with Tom. This change only affects kerberos 5, not 4. 4) Updated so it doesn't conflict with the rendevouz/bonjour patch already in ;-) Magnus Hagander
* Kerberos fixes from Magnus Hagander --- in theory Kerberos 5 authTom Lane2005-03-25
| | | | | | should work on Windows now. Also, rename set_noblock to pg_set_noblock; since it is included in libpq, the former name polluted application namespace.
* Add conditional inclusion of <com_err.h> to support old 'heimdal'Tom Lane2005-01-12
| | | | version of Kerberos. Per report from Reinhard Max.
* Clean up code in libpq that obtains user's home directory: make a singleTom Lane2005-01-04
| | | | | | subroutine that can hide platform dependencies. The WIN32 path is still a stub, but I await a fix from one of the win32 hackers. Also clean up unnecessary #ifdef WIN32 ugliness in a couple of places.
* Tag appropriate files for rc3PostgreSQL Daemon2004-12-31
| | | | | | | | Also performed an initial run through of upgrading our Copyright date to extend to 2005 ... first run here was very simple ... change everything where: grep 1996-2004 && the word 'Copyright' ... scanned through the generated list with 'less' first, and after, to make sure that I only picked up the right entries ...
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-07 01:12:37 +0000