Skip to content

Commit a6c1cea

Browse files
bmomjianbmomjian
committed
Add libpq warning message if the .pgpass-retrieved password fails.
Add ERRCODE_INVALID_PASSWORD sqlstate error code.
1 parent 8b2ae44 commit a6c1cea

File tree

6 files changed

+80
-20
lines changed

6 files changed

+80
-20
lines changed

‎doc/src/sgml/errcodes.sgml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/errcodes.sgml,v 1.28 2009/12/07 05:22:21 tgl Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/errcodes.sgml,v 1.29 2010/03/13 14:55:57 momjian Exp $ -->
22

33
<appendix id="errcodes-appendix">
44
<title><productname>PostgreSQL</productname> Error Codes</title>
@@ -761,6 +761,12 @@
761761
<entry>invalid_authorization_specification</entry>
762762
</row>
763763

764+
<row>
765+
<entry><literal>28P01</literal></entry>
766+
<entry>INVALID PASSWORD</entry>
767+
<entry>invalid_password</entry>
768+
</row>
769+
764770

765771
<row>
766772
<entry spanname="span13"><emphasis role="bold">Class 2B &mdash; Dependent Privilege Descriptors Still Exist</></entry>

‎src/backend/libpq/auth.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.195 2010/02/26 02:00:42 momjian Exp $
11+
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.196 2010/03/13 14:55:57 momjian Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -232,7 +232,8 @@ static void
232232
auth_failed(Port *port, int status)
233233
{
234234
const char *errstr;
235-
235+
int errcode_return = ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION;
236+
236237
/*
237238
* If we failed due to EOF from client, just quit; there's no point in
238239
* trying to send a message to the client, and not much point in logging
@@ -269,6 +270,8 @@ auth_failed(Port *port, int status)
269270
case uaMD5:
270271
case uaPassword:
271272
errstr = gettext_noop("password authentication failed for user \"%s\"");
273+
/* We use it to indicate if a .pgpass password failed. */
274+
errcode_return = ERRCODE_INVALID_PASSWORD;
272275
break;
273276
case uaPAM:
274277
errstr = gettext_noop("PAM authentication failed for user \"%s\"");
@@ -285,7 +288,7 @@ auth_failed(Port *port, int status)
285288
}
286289

287290
ereport(FATAL,
288-
(errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
291+
(errcode(errcode_return),
289292
errmsg(errstr, port->user_name)));
290293
/* doesn't return */
291294
}

‎src/include/utils/errcodes.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
* Copyright (c) 2003-2010, PostgreSQL Global Development Group
1313
*
14-
* $PostgreSQL: pgsql/src/include/utils/errcodes.h,v 1.31 2010/01/02 16:58:10 momjian Exp $
14+
* $PostgreSQL: pgsql/src/include/utils/errcodes.h,v 1.32 2010/03/13 14:55:57 momjian Exp $
1515
*
1616
*-------------------------------------------------------------------------
1717
*/
@@ -194,6 +194,7 @@
194194

195195
/* Class 28 - Invalid Authorization Specification */
196196
#define ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION MAKE_SQLSTATE('2','8', '0','0','0')
197+
#define ERRCODE_INVALID_PASSWORD MAKE_SQLSTATE('2','8', 'P','0','1')
197198

198199
/* Class 2B - Dependent Privilege Descriptors Still Exist */
199200
#define ERRCODE_DEPENDENT_PRIVILEGE_DESCRIPTORS_STILL_EXIST MAKE_SQLSTATE('2','B', '0','0','0')

‎src/interfaces/libpq/fe-connect.c

Lines changed: 58 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.389 2010/03/03 20:31:09 tgl Exp $
11+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.390 2010/03/13 14:55:57 momjian Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -91,6 +91,9 @@ static int ldapServiceLookup(const char *purl, PQconninfoOption *options,
9191
*/
9292
#define ERRCODE_APPNAME_UNKNOWN "42704"
9393

94+
/* This is part of the protocol so just define it */
95+
#define ERRCODE_INVALID_PASSWORD "28P01"
96+
9497
/*
9598
* fall back options if they are not specified by arguments or defined
9699
* by environment variables
@@ -284,6 +287,8 @@ static int parseServiceFile(const char *serviceFile,
284287
static char *pwdfMatchesString(char *buf, char *token);
285288
static char *PasswordFromFile(char *hostname, char *port, char *dbname,
286289
char *username);
290+
static bool getPgPassFilename(char *pgpassfile);
291+
static void dot_pg_pass_warning(PGconn *conn);
287292
static void default_threadlock(int acquire);
288293

289294

@@ -652,6 +657,8 @@ connectOptions2(PGconn *conn)
652657
conn->dbName, conn->pguser);
653658
if (conn->pgpass == NULL)
654659
conn->pgpass = strdup(DefaultPassword);
660+
else
661+
conn->dot_pgpass_used = true;
655662
}
656663

657664
/*
@@ -2133,6 +2140,8 @@ PQconnectPoll(PGconn *conn)
21332140

21342141
error_return:
21352142

2143+
dot_pg_pass_warning(conn);
2144+
21362145
/*
21372146
* We used to close the socket at this point, but that makes it awkward
21382147
* for those above us if they wish to remove this socket from their own
@@ -2191,6 +2200,7 @@ makeEmptyPGconn(void)
21912200
conn->verbosity = PQERRORS_DEFAULT;
21922201
conn->sock = -1;
21932202
conn->password_needed = false;
2203+
conn->dot_pgpass_used = false;
21942204
#ifdef USE_SSL
21952205
conn->allow_ssl_try = true;
21962206
conn->wait_ssl_try = false;
@@ -4323,7 +4333,6 @@ PasswordFromFile(char *hostname, char *port, char *dbname, char *username)
43234333
FILE *fp;
43244334
char pgpassfile[MAXPGPATH];
43254335
struct stat stat_buf;
4326-
char *passfile_env;
43274336

43284337
#define LINELEN NAMEDATALEN*5
43294338
char buf[LINELEN];
@@ -4349,17 +4358,8 @@ PasswordFromFile(char *hostname, char *port, char *dbname, char *username)
43494358
if (port == NULL)
43504359
port = DEF_PGPORT_STR;
43514360

4352-
if ((passfile_env = getenv("PGPASSFILE")) != NULL)
4353-
/* use the literal path from the environment, if set */
4354-
strlcpy(pgpassfile, passfile_env, sizeof(pgpassfile));
4355-
else
4356-
{
4357-
char homedir[MAXPGPATH];
4358-
4359-
if (!pqGetHomeDirectory(homedir, sizeof(homedir)))
4360-
return NULL;
4361-
snprintf(pgpassfile, MAXPGPATH, "%s/%s", homedir, PGPASSFILE);
4362-
}
4361+
if (!getPgPassFilename(pgpassfile))
4362+
return NULL;
43634363

43644364
/* If password file cannot be opened, ignore it. */
43654365
if (stat(pgpassfile, &stat_buf) != 0)
@@ -4426,6 +4426,51 @@ PasswordFromFile(char *hostname, char *port, char *dbname, char *username)
44264426
#undef LINELEN
44274427
}
44284428

4429+
4430+
static bool getPgPassFilename(char *pgpassfile)
4431+
{
4432+
char *passfile_env;
4433+
4434+
if ((passfile_env = getenv("PGPASSFILE")) != NULL)
4435+
/* use the literal path from the environment, if set */
4436+
strlcpy(pgpassfile, passfile_env, MAXPGPATH);
4437+
else
4438+
{
4439+
char homedir[MAXPGPATH];
4440+
4441+
if (!pqGetHomeDirectory(homedir, sizeof(homedir)))
4442+
return false;
4443+
snprintf(pgpassfile, MAXPGPATH, "%s/%s", homedir, PGPASSFILE);
4444+
}
4445+
return true;
4446+
}
4447+
4448+
/*
4449+
* If the connection failed, we should mention if
4450+
* we got the password from .pgpass in case that
4451+
* password is wrong.
4452+
*/
4453+
static void
4454+
dot_pg_pass_warning(PGconn *conn)
4455+
{
4456+
/* If it was 'invalid authorization', add .pgpass mention */
4457+
if (conn->dot_pgpass_used && conn->password_needed && conn->result &&
4458+
/* only works with >= 9.0 servers */
4459+
strcmp(PQresultErrorField(conn->result, PG_DIAG_SQLSTATE),
4460+
ERRCODE_INVALID_PASSWORD) == 0)
4461+
{
4462+
char pgpassfile[MAXPGPATH];
4463+
4464+
if (!getPgPassFilename(pgpassfile))
4465+
return;
4466+
appendPQExpBufferStr(&conn->errorMessage,
4467+
libpq_gettext("password retrieved from "));
4468+
appendPQExpBufferStr(&conn->errorMessage, pgpassfile);
4469+
appendPQExpBufferChar(&conn->errorMessage, '\n');
4470+
}
4471+
}
4472+
4473+
44294474
/*
44304475
* Obtain user's home directory, return in given buffer
44314476
*

‎src/interfaces/libpq/libpq-int.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
* Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
1313
* Portions Copyright (c) 1994, Regents of the University of California
1414
*
15-
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.149 2010/02/26 02:01:33 momjian Exp $
15+
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.150 2010/03/13 14:55:57 momjian Exp $
1616
*
1717
*-------------------------------------------------------------------------
1818
*/
@@ -343,6 +343,7 @@ struct pg_conn
343343
ProtocolVersion pversion; /* FE/BE protocol version in use */
344344
int sversion; /* server version, e.g. 70401 for 7.4.1 */
345345
bool password_needed; /* true if server demanded a password */
346+
bool dot_pgpass_used; /* true if used .pgpass */
346347
bool sigpipe_so; /* have we masked SIGPIPE via SO_NOSIGPIPE? */
347348
bool sigpipe_flag; /* can we mask SIGPIPE via MSG_NOSIGNAL? */
348349

‎src/pl/plpgsql/src/plerrcodes.h

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
*
1010
* Copyright (c) 2003-2010, PostgreSQL Global Development Group
1111
*
12-
* $PostgreSQL: pgsql/src/pl/plpgsql/src/plerrcodes.h,v 1.20 2010/01/02 16:58:13 momjian Exp $
12+
* $PostgreSQL: pgsql/src/pl/plpgsql/src/plerrcodes.h,v 1.21 2010/03/13 14:55:57 momjian Exp $
1313
*
1414
*-------------------------------------------------------------------------
1515
*/
@@ -367,6 +367,10 @@
367367
"invalid_authorization_specification", ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION
368368
},
369369

370+
{
371+
"invalid_password", ERRCODE_INVALID_PASSWORD
372+
},
373+
370374
{
371375
"dependent_privilege_descriptors_still_exist", ERRCODE_DEPENDENT_PRIVILEGE_DESCRIPTORS_STILL_EXIST
372376
},

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy