Add new MD5 pg_hba.conf keyword. Prevent fallback to crypt.

4 files changed, 19 insertions, 20 deletions

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 2fd417e6130..c139f93f715 100644
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *	  $Header: /cvsroot/pgsql/src/backend/libpq/auth.c,v 1.58 2001/08/16 04:27:18 momjian Exp $
+ *	  $Header: /cvsroot/pgsql/src/backend/libpq/auth.c,v 1.59 2001/08/16 16:24:15 momjian Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -501,19 +501,16 @@ ClientAuthentication(Port *port)
 			status = recv_and_check_password_packet(port);
 			break;
 
-		case uaMD5:
-			sendAuthRequest(port, AUTH_REQ_MD5);
-			if ((status = recv_and_check_password_packet(port)) == STATUS_OK)
-				break;
-			port->auth_method = uaCrypt;
-			/* Try crypt() for old client */
-			/* FALL THROUGH */
-			
 		case uaCrypt:
 			sendAuthRequest(port, AUTH_REQ_CRYPT);
 			status = recv_and_check_password_packet(port);
 			break;
 
+		case uaMD5:
+			sendAuthRequest(port, AUTH_REQ_MD5);
+			status = recv_and_check_password_packet(port);
+			break;
+
 		case uaTrust:
 			status = STATUS_OK;
 			break;
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index f9e7898fb1a..cfafa712e12 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -10,7 +10,7 @@
  *
  *
  * IDENTIFICATION
- *	  $Header: /cvsroot/pgsql/src/backend/libpq/hba.c,v 1.63 2001/08/16 04:27:18 momjian Exp $
+ *	  $Header: /cvsroot/pgsql/src/backend/libpq/hba.c,v 1.64 2001/08/16 16:24:15 momjian Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -226,9 +226,10 @@ parse_hba_auth(List *line, ProtocolVersion proto, UserAuth *userauth_p,
 			*userauth_p = uaKrb5;
 		else if (strcmp(token, "reject") == 0)
 			*userauth_p = uaReject;
-		else if (strcmp(token, "crypt") == 0)
-			/* Try MD5 first; on failure, switch to crypt() */
+		else if (strcmp(token, "md5") == 0)
 			*userauth_p = uaMD5;
+		else if (strcmp(token, "crypt") == 0)
+			*userauth_p = uaCrypt;
 		else
 			*error_p = true;
 		line = lnext(line);
diff --git a/src/backend/libpq/pg_hba.conf.sample b/src/backend/libpq/pg_hba.conf.sample
index a489b78a70b..d7498717b59 100644
--- a/src/backend/libpq/pg_hba.conf.sample
+++ b/src/backend/libpq/pg_hba.conf.sample
@@ -115,13 +115,15 @@
 # 		utility. Remember, these passwords override pg_shadow
 # 		passwords.
 # 
-#   crypt:  	Same as "password", but authentication is done by
+#   md5:  	Same as "password", but authentication is done by
 #		encrypting the password sent over the network. This is
 #		always preferable to "password" except for old clients
-#		that don't support "crypt". Also, crypt can use
-#		usernames stored in secondary password files but not
-#		secondary passwords.
+#		that don't support it. Also, md5 can use usernames stored
+#		in secondary password files but not secondary passwords.
 # 
+#   crypt:  	Same as "md5", but uses crypt for pre-7.2 clients.  You can
+#		not store encrypted passwords if you use this option.
+#
 #   ident:	For TCP/IP connections, authentication is done by contacting
 #		the ident server on the client host.  (CAUTION: this is only
 #		as secure as the client machine!)  On machines that support
@@ -173,7 +175,7 @@
 # if the user's password in pg_shadow is correctly supplied:
 # 
 # TYPE       DATABASE    IP_ADDRESS    MASK               AUTH_TYPE  AUTH_ARGUMENT
-# host       template1   192.168.12.10 255.255.255.255    crypt
+# host       template1   192.168.12.10 255.255.255.255    md5
 # 
 # In the absence of preceding "host" lines, these two lines will reject
 # all connection from 192.168.54.1 (since that entry will be matched
diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h
index 11f052d3634..da506d7aee8 100644
--- a/src/include/libpq/hba.h
+++ b/src/include/libpq/hba.h
@@ -4,7 +4,7 @@
  *	  Interface to hba.c
  *
  *
- * $Id: hba.h,v 1.23 2001/08/15 18:42:15 momjian Exp $
+ * $Id: hba.h,v 1.24 2001/08/16 16:24:16 momjian Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -36,8 +36,7 @@ typedef enum UserAuth
 	uaIdent,
 	uaPassword,
 	uaCrypt,
-	uaMD5		/* 	This starts as uaCrypt from pg_hba.conf, but gets 
-					overridden if the client supports MD5 */
+	uaMD5
 } UserAuth;
 
 typedef struct Port hbaPort;