diff --git a/src/auth/pool_passwd.c b/src/auth/pool_passwd.c index 3a9107bc..f1c1dde3 100644 --- a/src/auth/pool_passwd.c +++ b/src/auth/pool_passwd.c @@ -680,3 +680,46 @@ read_pool_key(char *key_file_path) #undef LINELEN } + +/* + * Check password type is md5 hashed or not. recovery_password and + * wd_lifecheck_password are not allowed to be md5 hashed format. + * The kind of returns of this function is follow; + * 0: password is not md5 hashed + * -1: password is md5 hashed + * -2: password is not found + */ +int +chceck_password_type_is_not_md5(char *username, char *password_in_config) +{ + PasswordType passwordType = PASSWORD_TYPE_UNKNOWN; + PasswordMapping *password_mapping = NULL; + + /* + * if the password specified in config is empty string or NULL look for the + * password in pool_passwd file + */ + if (password_in_config == NULL || strlen(password_in_config) == 0) + { + password_mapping = pool_get_user_credentials(username); + if (password_mapping == NULL) + { + return -2; + } + passwordType = password_mapping->pgpoolUser.passwordType; + password = password_mapping->pgpoolUser.password; + } + else + { + passwordType = get_password_type(password_in_config); + password = password_in_config; + } + + /* if the password type is MD5 hash return -1*/ + if (passwordType == PASSWORD_TYPE_MD5) + { + return -1; + } + + return 0; +} \ No newline at end of file diff --git a/src/include/auth/pool_passwd.h b/src/include/auth/pool_passwd.h index bbcaaa81..9ec244b3 100644 --- a/src/include/auth/pool_passwd.h +++ b/src/include/auth/pool_passwd.h @@ -85,4 +85,5 @@ extern char *get_decrypted_password(const char *shadow_pass); extern char *read_pool_key(char *key_file_path); extern char *get_pgpool_config_user_password(char *username, char *password_in_config); extern void delete_passwordMapping(PasswordMapping * pwdMapping); +extern int chceck_password_type_is_not_md5(char *username, char *password_in_config); #endif /* POOL_PASSWD_H */ diff --git a/src/pcp_con/recovery.c b/src/pcp_con/recovery.c index 088826b7..75fa7d01 100644 --- a/src/pcp_con/recovery.c +++ b/src/pcp_con/recovery.c @@ -85,6 +85,14 @@ start_recovery(int recovery_node) ereport(ERROR, (errmsg("node recovery failed, node id: %d is alive", recovery_node))); + if(chceck_password_type_is_not_md5(pool_config->recovery_user, pool_config->recovery_password) == -1) + { + ereport(ERROR, + (errmsg("the password of recovery_user %s is invalid format", + pool_config->recovery_user), + errdetail("recovery_password is not allowed to be md5 hashed format"))); + } + /* select main/primary node */ node_id = MAIN_REPLICA ? PRIMARY_NODE_ID : REAL_MAIN_NODE_ID; backend = &pool_config->backend_desc->backend_info[node_id]; diff --git a/src/watchdog/wd_lifecheck.c b/src/watchdog/wd_lifecheck.c index 1f2fd3af..a51e8ef0 100644 --- a/src/watchdog/wd_lifecheck.c +++ b/src/watchdog/wd_lifecheck.c @@ -387,6 +387,14 @@ lifecheck_main(void) /* Identify myself via ps */ init_ps_display("", "", "", ""); + if(chceck_password_type_is_not_md5(pool_config->wd_lifecheck_user, pool_config->wd_lifecheck_password) == -1) + { + ereport(ERROR, + (errmsg("the password of wd_lifecheck_user %s is invalid format", + pool_config->recovery_user), + errdetail("wd_lifecheck_password is not allowed to be md5 hashed format"))); + } + pool_signal(SIGTERM, lifecheck_exit_handler); pool_signal(SIGINT, lifecheck_exit_handler); pool_signal(SIGQUIT, lifecheck_exit_handler);