| blob | 8945050ad251f3ecbe4d5c1e50cdcd28298c091a |
1 /*-------------------------------------------------------------------------
2 * saslprep.c
3 * SASLprep normalization, for SCRAM authentication
4 *
5 * The SASLprep algorithm is used to process a user-supplied password into
6 * canonical form. For more details, see:
7 *
8 * [RFC3454] Preparation of Internationalized Strings ("stringprep"),
9 * http://www.ietf.org/rfc/rfc3454.txt
10 *
11 * [RFC4013] SASLprep: Stringprep Profile for User Names and Passwords
12 * http://www.ietf.org/rfc/rfc4013.txt
13 *
14 *
15 * Portions Copyright (c) 2017-2021, PostgreSQL Global Development Group
16 *
17 * IDENTIFICATION
18 * src/common/saslprep.c
19 *
20 *-------------------------------------------------------------------------
21 */
22 #ifndef FRONTEND
24 #else
26 #endif
33 /*
34 * In backend, we will use palloc/pfree. In frontend, use malloc, and
35 * return SASLPREP_OOM on out-of-memory.
36 */
37 #ifndef FRONTEND
38 #define STRDUP(s) pstrdup(s)
39 #define ALLOC(size) palloc(size)
40 #define FREE(size) pfree(size)
41 #else
42 #define STRDUP(s) strdup(s)
43 #define ALLOC(size) malloc(size)
44 #define FREE(size) free(size)
45 #endif
47 /* Prototypes for local functions */
52 /*
53 * Stringprep Mapping Tables.
54 *
55 * The stringprep specification includes a number of tables of Unicode
56 * codepoints, used in different parts of the algorithm. They are below,
57 * as arrays of codepoint ranges. Each range is a pair of codepoints,
58 * for the first and last codepoint included the range (inclusive!).
59 */
61 /*
62 * C.1.2 Non-ASCII space characters
63 *
64 * These are all mapped to the ASCII space character (U+00A0).
65 */
67 {
74 };
76 /*
77 * B.1 Commonly mapped to nothing
78 *
79 * If any of these appear in the input, they are removed.
80 */
82 {
91 };
93 /*
94 * prohibited_output_ranges is a union of all the characters from
95 * the following tables:
96 *
97 * C.1.2 Non-ASCII space characters
98 * C.2.1 ASCII control characters
99 * C.2.2 Non-ASCII control characters
100 * C.3 Private Use characters
101 * C.4 Non-character code points
102 * C.5 Surrogate code points
103 * C.6 Inappropriate for plain text characters
104 * C.7 Inappropriate for canonical representation characters
105 * C.7 Change display properties or deprecated characters
106 * C.8 Tagging characters
107 *
108 * These are the tables that are listed as "prohibited output"
109 * characters in the SASLprep profile.
110 *
111 * The comment after each code range indicates which source table
112 * the code came from. Note that there is some overlap in the source
113 * tables, so one code might originate from multiple source tables.
114 * Adjacent ranges have also been merged together, to save space.
115 */
117 {
154 };
156 /* A.1 Unassigned code points in Unicode 3.2 */
158 {
555 };
557 /* D.1 Characters with bidirectional property "R" or "AL" */
559 {
594 };
596 /* D.2 Characters with bidirectional property "L" */
598 {
959 };
961 /* End of stringprep tables */
964 /* Is the given Unicode codepoint in the given table of ranges? */
965 #define IS_CODE_IN_TABLE(code, map) is_code_in_table(code, map, lengthof(map))
967 static int
969 {
979 }
981 static bool
983 {
990 codepoint_range_cmp))
992 else
994 }
996 /*
997 * Calculate the length in characters of a null-terminated UTF-8 string.
998 *
999 * Returns -1 if the input is not valid UTF-8.
1000 */
1001 static int
1003 {
1009 {
1016 num_chars++;
1017 }
1020 }
1023 /*
1024 * pg_saslprep - Normalize a password with SASLprep.
1025 *
1026 * SASLprep requires the input to be in UTF-8 encoding, but PostgreSQL
1027 * supports many encodings, so we don't blindly assume that. pg_saslprep
1028 * will check if the input looks like valid UTF-8, and returns
1029 * SASLPREP_INVALID_UTF8 if not.
1030 *
1031 * If the string contains prohibited characters (or more precisely, if the
1032 * output string would contain prohibited characters after normalization),
1033 * returns SASLPREP_PROHIBITED.
1034 *
1035 * On success, returns SASLPREP_SUCCESS, and the normalized string in
1036 * *output.
1037 *
1038 * In frontend, the normalized string is malloc'd, and the caller is
1039 * responsible for freeing it. If an allocation fails, returns
1040 * SASLPREP_OOM. In backend, the normalized string is palloc'd instead,
1041 * and a failed allocation leads to ereport(ERROR).
1042 */
1043 pg_saslprep_rc
1045 {
1057 /* Ensure we return *output as NULL on failure */
1060 /*
1061 * Quick check if the input is pure ASCII. An ASCII string requires no
1062 * further processing.
1063 */
1065 {
1070 }
1072 /*
1073 * Convert the input from UTF-8 to an array of Unicode codepoints.
1074 *
1075 * This also checks that the input is a legal UTF-8 string.
1076 */
1087 {
1090 }
1093 /*
1094 * The steps below correspond to the steps listed in [RFC3454], Section
1095 * "2. Preparation Overview"
1096 */
1098 /*
1099 * 1) Map -- For each character in the input, check if it has a mapping
1100 * and, if so, replace it with its mapping.
1101 */
1104 {
1110 {
1111 /* map to nothing */
1112 }
1113 else
1115 }
1122 /*
1123 * 2) Normalize -- Normalize the result of step 1 using Unicode
1124 * normalization.
1125 */
1130 /*
1131 * 3) Prohibit -- Check for any characters that are not allowed in the
1132 * output. If any are found, return an error.
1133 */
1135 {
1142 }
1144 /*
1145 * 4) Check bidi -- Possibly check for right-to-left characters, and if
1146 * any are found, make sure that the whole string satisfies the
1147 * requirements for bidirectional strings. If the string does not satisfy
1148 * the requirements for bidirectional strings, return an error.
1149 *
1150 * [RFC3454], Section "6. Bidirectional Characters" explains in more
1151 * detail what that means:
1152 *
1153 * "In any profile that specifies bidirectional character handling, all
1154 * three of the following requirements MUST be met:
1155 *
1156 * 1) The characters in section 5.8 MUST be prohibited.
1157 *
1158 * 2) If a string contains any RandALCat character, the string MUST NOT
1159 * contain any LCat character.
1160 *
1161 * 3) If a string contains any RandALCat character, a RandALCat character
1162 * MUST be the first character of the string, and a RandALCat character
1163 * MUST be the last character of the string."
1164 */
1167 {
1171 {
1174 }
1175 }
1178 {
1183 {
1188 }
1193 }
1195 /*
1196 * Finally, convert the result back to UTF-8.
1197 */
1200 {
1205 }
1211 /*
1212 * There are no error exits below here, so the error exit paths don't need
1213 * to worry about possibly freeing "result".
1214 */
1217 {
1220 }
1230 prohibited:
1238 oom:
1245 }