| 1 | From edf340e359fe209797c584a387f897ac09c90b8b Mon Sep 17 00:00:00 2001
|
| 2 | From: Alex Dowad <[email protected]>
|
| 3 | Date: Mon, 18 Apr 2022 11:47:49 +0200
|
| 4 | Subject: [PATCH] Support 'trust' authentication method
|
| 5 |
|
| 6 | In the PostgreSQL server's response to the initial login packet, it
|
| 7 | includes a field indicating what kind of authentication the server
|
| 8 | would like the client to use. We were not checking that field. If it
|
| 9 | is 0, that means no authentication is needed and the client can just
|
| 10 | go ahead.
|
| 11 |
|
| 12 | As a bonus, since we are now checking the value of that field, we can
|
| 13 | provide a more specific error message if the server wants to use an
|
| 14 | authentication type which this library does not currently support.
|
| 15 | ---
|
| 16 | lib/resty/postgres.lua | 40 ++++++++++++++++++++++++----------------
|
| 17 | 1 file changed, 24 insertions(+), 16 deletions(-)
|
| 18 |
|
| 19 | diff --git a/lib/resty/postgres.lua b/lib/resty/postgres.lua
|
| 20 | index 6907180..3e481ba 100644
|
| 21 | |
| 22 | |
| 23 | @@ -230,23 +230,31 @@ function connect(self, opts)
|
| 24 | if typ ~= 'R' then
|
| 25 | return nil, "handshake error, got packet type:" .. typ
|
| 26 | end
|
| 27 | - local auth_type = string.sub(packet, 1, 4)
|
| 28 | - local salt = string.sub(packet, 5, 8)
|
| 29 | - -- send passsowrd
|
| 30 | - req = {_to_cstring(_compute_token(self, user, password, salt))}
|
| 31 | - req_len = 40
|
| 32 | - local bytes, err = _send_packet(self, req, req_len, 'p')
|
| 33 | - if not bytes then
|
| 34 | - return nil, "failed to send client authentication packet2: " .. err
|
| 35 | - end
|
| 36 | - -- receive response
|
| 37 | - packet, typ, err = _recv_packet(self)
|
| 38 | - if typ ~= 'R' then
|
| 39 | - return nil, "auth return type not support"
|
| 40 | - end
|
| 41 | - if packet ~= AUTH_REQ_OK then
|
| 42 | - return nil, "authentication failed"
|
| 43 | + local auth_type = _get_byte4(packet, 1)
|
| 44 | +
|
| 45 | + if auth_type == 5 then
|
| 46 | + -- Authentication type 5 is MD5 password encryption
|
| 47 | + local salt = string.sub(packet, 5, 8)
|
| 48 | + -- send password
|
| 49 | + req = {_to_cstring(_compute_token(self, user, password, salt))}
|
| 50 | + req_len = 40
|
| 51 | + local bytes, err = _send_packet(self, req, req_len, 'p')
|
| 52 | + if not bytes then
|
| 53 | + return nil, "failed to send client authentication packet2: " .. err
|
| 54 | + end
|
| 55 | + -- receive response
|
| 56 | + packet, typ, err = _recv_packet(self)
|
| 57 | + if typ ~= 'R' then
|
| 58 | + return nil, "authentication response packet type was '"..typ.."'; expected 'R'"
|
| 59 | + end
|
| 60 | + if packet ~= AUTH_REQ_OK then
|
| 61 | + return nil, "authentication failed"
|
| 62 | + end
|
| 63 | + elseif auth_type ~= 0 then
|
| 64 | + -- 0 means authentication was already successful (with no password required)
|
| 65 | + return nil, "authentication failed: server wants to use type "..auth_type..", but we only support MD5 password encryption (type 5)"
|
| 66 | end
|
| 67 | +
|
| 68 | while true do
|
| 69 | packet, typ, err = _recv_packet(self)
|
| 70 | if not packet then
|