Add validations of wd_lifecheck_password and recovery_password format

wd_lifecheck_password and recovery_password are not allowed to be md5
hashed password format but pgpool did not check them.

diff --git a/src/auth/pool_passwd.c b/src/auth/pool_passwd.c
index 3a9107bcd9c2ccfbd572c284fb76e01c6d82f1a1..81c258b57c97d1f40ecef6d36a886341a228e391 100644 (file)
--- a/src/auth/pool_passwd.c
+++ b/src/auth/pool_passwd.c
@@ -680,3 +680,44 @@ read_pool_key(char *key_file_path)
 
 #undef LINELEN
 }
+
+/*
+ * Check password type is md5 hashed or not. recovery_password and
+ * wd_lifecheck_password are not allowed to be md5 hashed format.
+ * The kind of returns of this function is follow;
+ *  0: password is not md5 hashed
+ * -1: password is md5 hashed
+ * -2: password is not found
+ */
+int
+chceck_password_type_is_not_md5(char *username, char *password_in_config)
+{
+       PasswordType passwordType = PASSWORD_TYPE_UNKNOWN;
+       PasswordMapping *password_mapping = NULL;
+
+       /*
+        * if the password specified in config is empty string or NULL look for the
+        * password in pool_passwd file
+        */
+       if (password_in_config == NULL || strlen(password_in_config) == 0)
+       {
+               password_mapping = pool_get_user_credentials(username);
+               if (password_mapping == NULL)
+               {
+                       return -2;
+               }
+               passwordType = password_mapping->pgpoolUser.passwordType;
+       }
+       else
+       {
+               passwordType = get_password_type(password_in_config);
+       }
+
+       /* if the password type is MD5 hash return -1*/
+       if (passwordType == PASSWORD_TYPE_MD5)
+       {
+               return -1;
+       }
+
+       return 0;
+}
\ No newline at end of file

diff --git a/src/include/auth/pool_passwd.h b/src/include/auth/pool_passwd.h
index bbcaaa8100fb8c407fae1b6d7176f13e3deff4cc..9ec244b31afcada6e91b6f7770a27ed51f2fb512 100644 (file)
--- a/src/include/auth/pool_passwd.h
+++ b/src/include/auth/pool_passwd.h
@@ -85,4 +85,5 @@ extern char *get_decrypted_password(const char *shadow_pass);
 extern char *read_pool_key(char *key_file_path);
 extern char *get_pgpool_config_user_password(char *username, char *password_in_config);
 extern void delete_passwordMapping(PasswordMapping * pwdMapping);
+extern int chceck_password_type_is_not_md5(char *username, char *password_in_config);
 #endif                                                 /* POOL_PASSWD_H */

diff --git a/src/pcp_con/recovery.c b/src/pcp_con/recovery.c
index 088826b7aa86ab09f574486052cae312744537e4..673b5d1037763eb1a708efd5db66debdf6650d02 100644 (file)
--- a/src/pcp_con/recovery.c
+++ b/src/pcp_con/recovery.c
@@ -85,6 +85,14 @@ start_recovery(int recovery_node)
                ereport(ERROR,
                                (errmsg("node recovery failed, node id: %d is alive", recovery_node)));
 
+       if (chceck_password_type_is_not_md5(pool_config->recovery_user, pool_config->recovery_password) == -1)
+       {
+               ereport(ERROR,
+                               (errmsg("invalid password format for recovery_user: %s",
+                                               pool_config->recovery_user),
+                               errdetail("md5 hashed password is not allowed here")));
+       }
+
        /* select main/primary node */
        node_id = MAIN_REPLICA ? PRIMARY_NODE_ID : REAL_MAIN_NODE_ID;
        backend = &pool_config->backend_desc->backend_info[node_id];

diff --git a/src/watchdog/wd_lifecheck.c b/src/watchdog/wd_lifecheck.c
index 1f2fd3af3f2cf75c72744dc81d0b9f98734901b1..f4ff81de2f84339da2fe50fc0d69457f27a6d18c 100644 (file)
--- a/src/watchdog/wd_lifecheck.c
+++ b/src/watchdog/wd_lifecheck.c
@@ -387,6 +387,14 @@ lifecheck_main(void)
        /* Identify myself via ps */
        init_ps_display("", "", "", "");
 
+       if (chceck_password_type_is_not_md5(pool_config->wd_lifecheck_user, pool_config->wd_lifecheck_password) == -1)
+       {
+               ereport(ERROR,
+                               (errmsg("invalid password format for wd_lifecheck_user: %s",
+                                               pool_config->recovery_user),
+                               errdetail("md5 hashed password is not allowed here")));
+       }
+
        pool_signal(SIGTERM, lifecheck_exit_handler);
        pool_signal(SIGINT, lifecheck_exit_handler);
        pool_signal(SIGQUIT, lifecheck_exit_handler);