Skip to content

Commit a6c1cea

Browse files
bmomjianbmomjian
committed
Add libpq warning message if the .pgpass-retrieved password fails.
Add ERRCODE_INVALID_PASSWORD sqlstate error code.
1 parent 8b2ae44 commit a6c1cea

File tree

6 files changed

+80
-20
lines changed

6 files changed

+80
-20
lines changed

‎doc/src/sgml/errcodes.sgml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/errcodes.sgml,v 1.28 2009/12/07 05:22:21 tgl Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/errcodes.sgml,v 1.29 2010/03/13 14:55:57 momjian Exp $ -->
22

33
<appendix id="errcodes-appendix">
44
<title><productname>PostgreSQL</productname> Error Codes</title>
@@ -761,6 +761,12 @@
761761
<entry>invalid_authorization_specification</entry>
762762
</row>
763763

764+
<row>
765+
<entry><literal>28P01</literal></entry>
766+
<entry>INVALID PASSWORD</entry>
767+
<entry>invalid_password</entry>
768+
</row>
769+
764770

765771
<row>
766772
<entry spanname="span13"><emphasis role="bold">Class 2B &mdash; Dependent Privilege Descriptors Still Exist</></entry>

‎src/backend/libpq/auth.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.195 2010/02/26 02:00:42 momjian Exp $
11+
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.196 2010/03/13 14:55:57 momjian Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -232,7 +232,8 @@ static void
232232
auth_failed(Port *port, int status)
233233
{
234234
const char *errstr;
235-
235+
int errcode_return = ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION;
236+
236237
/*
237238
* If we failed due to EOF from client, just quit; there's no point in
238239
* trying to send a message to the client, and not much point in logging
@@ -269,6 +270,8 @@ auth_failed(Port *port, int status)
269270
case uaMD5:
270271
case uaPassword:
271272
errstr = gettext_noop("password authentication failed for user \"%s\"");
273+
/* We use it to indicate if a .pgpass password failed. */
274+
errcode_return = ERRCODE_INVALID_PASSWORD;
272275
break;
273276
case uaPAM:
274277
errstr = gettext_noop("PAM authentication failed for user \"%s\"");
@@ -285,7 +288,7 @@ auth_failed(Port *port, int status)
285288
}
286289

287290
ereport(FATAL,
288-
(errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
291+
(errcode(errcode_return),
289292
errmsg(errstr, port->user_name)));
290293
/* doesn't return */
291294
}

‎src/include/utils/errcodes.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
* Copyright (c) 2003-2010, PostgreSQL Global Development Group
1313
*
14-
* $PostgreSQL: pgsql/src/include/utils/errcodes.h,v 1.31 2010/01/02 16:58:10 momjian Exp $
14+
* $PostgreSQL: pgsql/src/include/utils/errcodes.h,v 1.32 2010/03/13 14:55:57 momjian Exp $
1515
*
1616
*-------------------------------------------------------------------------
1717
*/
@@ -194,6 +194,7 @@
194194

195195
/* Class 28 - Invalid Authorization Specification */
196196
#define ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION MAKE_SQLSTATE('2','8', '0','0','0')
197+
#define ERRCODE_INVALID_PASSWORD MAKE_SQLSTATE('2','8', 'P','0','1')
197198

198199
/* Class 2B - Dependent Privilege Descriptors Still Exist */
199200
#define ERRCODE_DEPENDENT_PRIVILEGE_DESCRIPTORS_STILL_EXIST MAKE_SQLSTATE('2','B', '0','0','0')

‎src/interfaces/libpq/fe-connect.c

Lines changed: 58 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.389 2010/03/03 20:31:09 tgl Exp $
11+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.390 2010/03/13 14:55:57 momjian Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -91,6 +91,9 @@ static int ldapServiceLookup(const char *purl, PQconninfoOption *options,
9191
*/
9292
#define ERRCODE_APPNAME_UNKNOWN "42704"
9393

94+
/* This is part of the protocol so just define it */
95+
#define ERRCODE_INVALID_PASSWORD "28P01"
96+
9497
/*
9598
* fall back options if they are not specified by arguments or defined
9699
* by environment variables
@@ -284,6 +287,8 @@ static int parseServiceFile(const char *serviceFile,
284287
static char *pwdfMatchesString(char *buf, char *token);
285288
static char *PasswordFromFile(char *hostname, char *port, char *dbname,
286289
char *username);
290+
static bool getPgPassFilename(char *pgpassfile);
291+
static void dot_pg_pass_warning(PGconn *conn);
287292
static void default_threadlock(int acquire);
288293

289294

@@ -652,6 +657,8 @@ connectOptions2(PGconn *conn)
652657
conn->dbName, conn->pguser);
653658
if (conn->pgpass == NULL)
654659
conn->pgpass = strdup(DefaultPassword);
660+
else
661+
conn->dot_pgpass_used = true;
655662
}
656663

657664
/*
@@ -2133,6 +2140,8 @@ PQconnectPoll(PGconn *conn)
21332140

21342141
error_return:
21352142

2143+
dot_pg_pass_warning(conn);
2144+
21362145
/*
21372146
* We used to close the socket at this point, but that makes it awkward
21382147
* for those above us if they wish to remove this socket from their own
@@ -2191,6 +2200,7 @@ makeEmptyPGconn(void)
21912200
conn->verbosity = PQERRORS_DEFAULT;
21922201
conn->sock = -1;
21932202
conn->password_needed = false;
2203+
conn->dot_pgpass_used = false;
21942204
#ifdef USE_SSL
21952205
conn->allow_ssl_try = true;
21962206
conn->wait_ssl_try = false;
@@ -4323,7 +4333,6 @@ PasswordFromFile(char *hostname, char *port, char *dbname, char *username)
43234333
FILE *fp;
43244334
char pgpassfile[MAXPGPATH];
43254335
struct stat stat_buf;
4326-
char *passfile_env;
43274336

43284337
#define LINELEN NAMEDATALEN*5
43294338
char buf[LINELEN];
@@ -4349,17 +4358,8 @@ PasswordFromFile(char *hostname, char *port, char *dbname, char *username)
43494358
if (port == NULL)
43504359
port = DEF_PGPORT_STR;
43514360

4352-
if ((passfile_env = getenv("PGPASSFILE")) != NULL)
4353-
/* use the literal path from the environment, if set */
4354-
strlcpy(pgpassfile, passfile_env, sizeof(pgpassfile));
4355-
else
4356-
{
4357-
char homedir[MAXPGPATH];
4358-
4359-
if (!pqGetHomeDirectory(homedir, sizeof(homedir)))
4360-
return NULL;
4361-
snprintf(pgpassfile, MAXPGPATH, "%s/%s", homedir, PGPASSFILE);
4362-
}
4361+
if (!getPgPassFilename(pgpassfile))
4362+
return NULL;
43634363

43644364
/* If password file cannot be opened, ignore it. */
43654365
if (stat(pgpassfile, &stat_buf) != 0)
@@ -4426,6 +4426,51 @@ PasswordFromFile(char *hostname, char *port, char *dbname, char *username)
44264426
#undef LINELEN
44274427
}
44284428

4429+
4430+
static bool getPgPassFilename(char *pgpassfile)
4431+
{
4432+
char *passfile_env;
4433+
4434+
if ((passfile_env = getenv("PGPASSFILE")) != NULL)
4435+
/* use the literal path from the environment, if set */
4436+
strlcpy(pgpassfile, passfile_env, MAXPGPATH);
4437+
else
4438+
{
4439+
char homedir[MAXPGPATH];
4440+
4441+
if (!pqGetHomeDirectory(homedir, sizeof(homedir)))
4442+
return false;
4443+
snprintf(pgpassfile, MAXPGPATH, "%s/%s", homedir, PGPASSFILE);
4444+
}
4445+
return true;
4446+
}
4447+
4448+
/*
4449+
* If the connection failed, we should mention if
4450+
* we got the password from .pgpass in case that
4451+
* password is wrong.
4452+
*/
4453+
static void
4454+
dot_pg_pass_warning(PGconn *conn)
4455+
{
4456+
/* If it was 'invalid authorization', add .pgpass mention */
4457+
if (conn->dot_pgpass_used && conn->password_needed && conn->result &&
4458+
/* only works with >= 9.0 servers */
4459+
strcmp(PQresultErrorField(conn->result, PG_DIAG_SQLSTATE),
4460+
ERRCODE_INVALID_PASSWORD) == 0)
4461+
{
4462+
char pgpassfile[MAXPGPATH];
4463+
4464+
if (!getPgPassFilename(pgpassfile))
4465+
return;
4466+
appendPQExpBufferStr(&conn->errorMessage,
4467+
libpq_gettext("password retrieved from "));
4468+
appendPQExpBufferStr(&conn->errorMessage, pgpassfile);
4469+
appendPQExpBufferChar(&conn->errorMessage, '\n');
4470+
}
4471+
}
4472+
4473+
44294474
/*
44304475
* Obtain user's home directory, return in given buffer
44314476
*

‎src/interfaces/libpq/libpq-int.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
* Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
1313
* Portions Copyright (c) 1994, Regents of the University of California
1414
*
15-
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.149 2010/02/26 02:01:33 momjian Exp $
15+
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.150 2010/03/13 14:55:57 momjian Exp $
1616
*
1717
*-------------------------------------------------------------------------
1818
*/
@@ -343,6 +343,7 @@ struct pg_conn
343343
ProtocolVersion pversion; /* FE/BE protocol version in use */
344344
int sversion; /* server version, e.g. 70401 for 7.4.1 */
345345
bool password_needed; /* true if server demanded a password */
346+
bool dot_pgpass_used; /* true if used .pgpass */
346347
bool sigpipe_so; /* have we masked SIGPIPE via SO_NOSIGPIPE? */
347348
bool sigpipe_flag; /* can we mask SIGPIPE via MSG_NOSIGNAL? */
348349

‎src/pl/plpgsql/src/plerrcodes.h

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
*
1010
* Copyright (c) 2003-2010, PostgreSQL Global Development Group
1111
*
12-
* $PostgreSQL: pgsql/src/pl/plpgsql/src/plerrcodes.h,v 1.20 2010/01/02 16:58:13 momjian Exp $
12+
* $PostgreSQL: pgsql/src/pl/plpgsql/src/plerrcodes.h,v 1.21 2010/03/13 14:55:57 momjian Exp $
1313
*
1414
*-------------------------------------------------------------------------
1515
*/
@@ -367,6 +367,10 @@
367367
"invalid_authorization_specification", ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION
368368
},
369369

370+
{
371+
"invalid_password", ERRCODE_INVALID_PASSWORD
372+
},
373+
370374
{
371375
"dependent_privilege_descriptors_still_exist", ERRCODE_DEPENDENT_PRIVILEGE_DESCRIPTORS_STILL_EXIST
372376
},

0 commit comments

Comments
 (0)