mirror of
https://git.postgresql.org/git/postgresql.git
synced 2026-02-14 10:27:04 +08:00
5513dc6a30
This is similar to b69aba7, except that this completes the work for HMAC with a new routine called pg_hmac_error() that would provide more context about the type of error that happened during a HMAC computation: - The fallback HMAC implementation in hmac.c relies on cryptohashes, so in some code paths it is necessary to return back the error generated by cryptohashes. - For the OpenSSL implementation (hmac_openssl.c), the logic is very similar to cryptohash_openssl.c, where the error context comes from OpenSSL if one of its internal routines failed, with different error codes if something internal to hmac_openssl.c failed or was incorrect. Any in-core code paths that use the centralized HMAC interface are related to SCRAM, for errors that are unlikely going to happen, with only SHA-256. It would be possible to see errors when computing some HMACs with MD5 for example and OpenSSL FIPS enabled, and this commit would help in reporting the correct errors but nothing in core uses that. So, at the end, no backpatch to v14 is done, at least for now. Errors in SCRAM related to the computation of the server key, stored key, etc. need to pass down the potential error context string across more layers of their respective call stacks for the frontend and the backend, so each surrounding routine is adapted for this purpose. Reviewed-by: Sergey Shinderuk Discussion: https://postgr.es/m/Yd0N9tSAIIkFd+qi@paquier.xyz
31 lines
977 B
C
31 lines
977 B
C
/*-------------------------------------------------------------------------
|
|
*
|
|
* hmac.h
|
|
* Generic headers for HMAC
|
|
*
|
|
* Portions Copyright (c) 1996-2022, PostgreSQL Global Development Group
|
|
* Portions Copyright (c) 1994, Regents of the University of California
|
|
*
|
|
* IDENTIFICATION
|
|
* src/include/common/hmac.h
|
|
*
|
|
*-------------------------------------------------------------------------
|
|
*/
|
|
|
|
#ifndef PG_HMAC_H
|
|
#define PG_HMAC_H
|
|
|
|
#include "common/cryptohash.h"
|
|
|
|
/* opaque context, private to each HMAC implementation */
|
|
typedef struct pg_hmac_ctx pg_hmac_ctx;
|
|
|
|
extern pg_hmac_ctx *pg_hmac_create(pg_cryptohash_type type);
|
|
extern int pg_hmac_init(pg_hmac_ctx *ctx, const uint8 *key, size_t len);
|
|
extern int pg_hmac_update(pg_hmac_ctx *ctx, const uint8 *data, size_t len);
|
|
extern int pg_hmac_final(pg_hmac_ctx *ctx, uint8 *dest, size_t len);
|
|
extern void pg_hmac_free(pg_hmac_ctx *ctx);
|
|
extern const char *pg_hmac_error(pg_hmac_ctx *ctx);
|
|
|
|
#endif /* PG_HMAC_H */
|