mirror of
https://github.com/GreptimeTeam/greptimedb.git
synced 2026-08-20 04:58:25 +00:00
dennis zhuang
67683cef2e
* feat: support SCRAM auth for Postgres Signed-off-by: Dennis Zhuang <killme2008@gmail.com> * feat: add pg_scram_sha256 format to hash-password command Signed-off-by: Dennis Zhuang <killme2008@gmail.com> * fix: harden Postgres SCRAM auth - Verify the client-final nonce matches the server-issued nonce, per RFC 5802 transcript validation, instead of only checking the channel-binding field. - Replace the per-connection PBKDF2 over a random password for unknown users with a deterministic mock verifier keyed by the username and a process-wide secret. This avoids a CPU-exhaustion DoS on unknown usernames and removes a username-enumeration oracle: the SCRAM server-first salt and iteration count are now stable per username and indistinguishable from a real user, with no PBKDF2 cost and random keys that never accept a proof. Signed-off-by: Dennis Zhuang <killme2008@gmail.com> * style: format PG_SCRAM_MOCK_SECRET declaration Signed-off-by: Dennis Zhuang <killme2008@gmail.com> * fix: precompute stable SCRAM verifier for plaintext users Plaintext-backed credentials derived a Postgres SCRAM verifier on the fly on every connection, using a fresh random salt and running PBKDF2 each time. That made a known plaintext user distinguishable from stored-hash and unknown (mock) users through both the unstable server-first salt and the per-connection timing, enabling username enumeration. Precompute the SCRAM verifier once at load time (stable salt, default iteration count) and reuse it, matching the mock verifier handed to unknown users. Document that non-default iteration counts remain observable in the SCRAM handshake and weaken enumeration resistance. Signed-off-by: Dennis Zhuang <killme2008@gmail.com> * fix: normalize passwords for Postgres SCRAM Signed-off-by: Dennis Zhuang <killme2008@gmail.com> * chore: docs Signed-off-by: Dennis Zhuang <killme2008@gmail.com> --------- Signed-off-by: Dennis Zhuang <killme2008@gmail.com>