Skip to content
Open
Show file tree
Hide file tree
Changes from 24 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions rebar.config
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,6 @@
{deps, [
{bson, ".*",
{git, "https://github.com/comtihon/bson-erlang.git", {tag, "v0.2.4"}}},
{pbkdf2, ".*",
{git, "https://github.com/comtihon/erlang-pbkdf2.git", {tag, "2.0.1"}}},
{poolboy, ".*",
{git, "https://github.com/comtihon/poolboy.git", {branch, "1.6.1"}}}
]}.
Expand Down
3 changes: 1 addition & 2 deletions src/connection/mc_auth_logic.erl
Original file line number Diff line number Diff line change
Expand Up @@ -125,8 +125,7 @@ generate_sig(SaltedPassword, AuthMessage) ->

%% @private
hi(Password, Salt, Iterations) ->
{ok, Key} = pbkdf2:pbkdf2(sha, Password, Salt, Iterations, 20),
Key.
crypto:pbkdf2_hmac(sha, Password, Salt, Iterations, 20).
Copy link
Contributor

@dmsnell dmsnell Sep 10, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We probably want to follow the pattern in #232 to avoid breaking the library on older releases of OTP. That is, crypto:pbkdf2_hmac is new in OTP 24 and missing from older versions, so if we run this patch on OTP 23 we'll crash for the same reason this fix exists.

Checking for OTP version

-define(OLD_CRYPTO_API, true).
-ifdef(OTP_RELEASE).
-if(?OTP_RELEASE >= 23).
-undef(OLD_CRYPTO_API).
-endif.
-endif.

Conditionally using newer functions

-ifdef(OLD_CRYPTO_API).
hmac(One, Two) -> crypto:hmac(sha, One, Two).
-else.
hmac(One, Two) -> crypto:mac(hmac, sha, One, Two).
-endif.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated, didn't know crypto in OTP < 24 doesn't have pbkdf2_hmac, thanks for the info

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My read on the docs is that it came in with OTP 24.2, with crypto 5.0.5

Come to think of it, do we need to check for 24.2 even? I guess OTP 24.0 and OTP 24.1 won't have it either. I'm not sure off-hand how to check for the minor version and I hope we can do it in the macro so this doesn't have to be a runtime check.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I couldn't find a predefined macro returns the minor/patch version

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I couldn't find a predefined macro returns the minor/patch version


%% @private
xorKeys(<<>>, _, Res) -> Res;
Expand Down
2 changes: 1 addition & 1 deletion src/mongodb.app.src
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,6 @@
{description, "Client interface to MongoDB, also known as the driver. See www.mongodb.org"},
{vsn, "3.4.6"},
{registered, []},
{applications, [kernel, stdlib, bson, crypto, poolboy, pbkdf2]},
{applications, [kernel, stdlib, bson, crypto, poolboy]},
{mod, {mongo_app, []}}
]}.