-<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.247 2007/11/28 15:42:31 petere Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.248 2007/12/09 19:01:40 tgl Exp $ -->
<chapter id="libpq">
<title><application>libpq</application> - C Library</title>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><function>PQconnectionNeedsPassword</function><indexterm><primary>PQconnectionNeedsPassword</></></term>
+ <listitem>
+ <para>
+ Returns true (1) if the connection authentication method
+ required a password, but none was available.
+ Returns false (0) if not.
+
+ <synopsis>
+ int PQconnectionNeedsPassword(const PGconn *conn);
+ </synopsis>
+
+ </para>
+
+ <para>
+ This function can be applied after a failed connection attempt
+ to decide whether to prompt the user for a password.
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term><function>PQconnectionUsedPassword</function><indexterm><primary>PQconnectionUsedPassword</></></term>
<listitem>
<para>
Returns true (1) if the connection authentication method
- required a password to be supplied. Returns false (0) if not.
+ used a caller-supplied password. Returns false (0) if not.
<synopsis>
int PQconnectionUsedPassword(const PGconn *conn);
</para>
<para>
- This function can be applied after either successful or failed
- connection attempts. In the case of failure, it can for example
- be used to decide whether to prompt the user for a password.
+ This function detects whether a password supplied to the connection
+ function was actually used. Passwords obtained from other
+ sources (such as the <filename>.pgpass</> file) are not considered
+ caller-supplied.
</para>
</listitem>
</varlistentry>
-<!-- $PostgreSQL: pgsql/doc/src/sgml/release.sgml,v 1.563 2007/12/08 17:24:03 momjian Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/release.sgml,v 1.564 2007/12/09 19:01:40 tgl Exp $ -->
<!--
Typical markup:
<listitem>
<para>
- Add <function>PQconnectionUsedPassword()</function> that returns
- true if the server required a password (Joe Conway)
+ Add <function>PQconnectionNeedsPassword()</function> that returns
+ true if the server required a password but none was supplied
+ (Joe Conway, Tom)
</para>
<para>
</para>
</listitem>
+ <listitem>
+ <para>
+ Add <function>PQconnectionUsedPassword()</function> that returns
+ true if the supplied password was actually used
+ (Joe Conway, Tom)
+ </para>
+
+ <para>
+ This is useful in some security contexts where it is important
+ to know whether a user-supplied password is actually valid.
+ </para>
+ </listitem>
+
</itemizedlist>
</sect3>
*
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
*
- * $PostgreSQL: pgsql/src/bin/pg_ctl/pg_ctl.c,v 1.90 2007/11/20 19:24:26 momjian Exp $
+ * $PostgreSQL: pgsql/src/bin/pg_ctl/pg_ctl.c,v 1.91 2007/12/09 19:01:40 tgl Exp $
*
*-------------------------------------------------------------------------
*/
{
if ((conn = PQconnectdb(connstr)) != NULL &&
(PQstatus(conn) == CONNECTION_OK ||
- PQconnectionUsedPassword(conn)))
+ PQconnectionNeedsPassword(conn)))
{
PQfinish(conn);
success = true;
* Implements the basic DB functions used by the archiver.
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/bin/pg_dump/pg_backup_db.c,v 1.76 2007/07/08 19:07:38 tgl Exp $
+ * $PostgreSQL: pgsql/src/bin/pg_dump/pg_backup_db.c,v 1.77 2007/12/09 19:01:40 tgl Exp $
*
*-------------------------------------------------------------------------
*/
if (PQstatus(newConn) == CONNECTION_BAD)
{
- if (!PQconnectionUsedPassword(newConn))
+ if (!PQconnectionNeedsPassword(newConn))
die_horribly(AH, modulename, "could not reconnect to database: %s",
PQerrorMessage(newConn));
PQfinish(newConn);
die_horribly(AH, modulename, "failed to connect to database\n");
if (PQstatus(AH->connection) == CONNECTION_BAD &&
- PQconnectionUsedPassword(AH->connection) &&
+ PQconnectionNeedsPassword(AH->connection) &&
password == NULL &&
!feof(stdin))
{
* Portions Copyright (c) 1994, Regents of the University of California
*
*
- * $PostgreSQL: pgsql/src/bin/pg_dump/pg_dumpall.c,v 1.98 2007/11/15 21:14:42 momjian Exp $
+ * $PostgreSQL: pgsql/src/bin/pg_dump/pg_dumpall.c,v 1.99 2007/12/09 19:01:40 tgl Exp $
*
*-------------------------------------------------------------------------
*/
}
if (PQstatus(conn) == CONNECTION_BAD &&
- PQconnectionUsedPassword(conn) &&
+ PQconnectionNeedsPassword(conn) &&
password == NULL &&
!feof(stdin))
{
*
* Copyright (c) 2000-2007, PostgreSQL Global Development Group
*
- * $PostgreSQL: pgsql/src/bin/psql/command.c,v 1.183 2007/11/15 21:14:42 momjian Exp $
+ * $PostgreSQL: pgsql/src/bin/psql/command.c,v 1.184 2007/12/09 19:01:40 tgl Exp $
*/
#include "postgres_fe.h"
#include "command.h"
* Connection attempt failed; either retry the connection attempt with
* a new password, or give up.
*/
- if (!password && PQconnectionUsedPassword(n_conn))
+ if (!password && PQconnectionNeedsPassword(n_conn))
{
PQfinish(n_conn);
password = prompt_for_password(user);
*
* Copyright (c) 2000-2007, PostgreSQL Global Development Group
*
- * $PostgreSQL: pgsql/src/bin/psql/startup.c,v 1.141 2007/07/08 19:07:38 tgl Exp $
+ * $PostgreSQL: pgsql/src/bin/psql/startup.c,v 1.142 2007/12/09 19:01:40 tgl Exp $
*/
#include "postgres_fe.h"
username, password);
if (PQstatus(pset.db) == CONNECTION_BAD &&
- PQconnectionUsedPassword(pset.db) &&
+ PQconnectionNeedsPassword(pset.db) &&
password == NULL &&
!feof(stdin))
{
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
- * $PostgreSQL: pgsql/src/bin/scripts/common.c,v 1.29 2007/11/15 21:14:42 momjian Exp $
+ * $PostgreSQL: pgsql/src/bin/scripts/common.c,v 1.30 2007/12/09 19:01:40 tgl Exp $
*
*-------------------------------------------------------------------------
*/
}
if (PQstatus(conn) == CONNECTION_BAD &&
- PQconnectionUsedPassword(conn) &&
+ PQconnectionNeedsPassword(conn) &&
password == NULL &&
!feof(stdin))
{
-# $PostgreSQL: pgsql/src/interfaces/libpq/exports.txt,v 1.17 2007/10/13 20:18:41 tgl Exp $
+# $PostgreSQL: pgsql/src/interfaces/libpq/exports.txt,v 1.18 2007/12/09 19:01:40 tgl Exp $
# Functions to be exported by libpq DLLs
PQconnectdb 1
PQsetdbLogin 2
lo_truncate 137
PQconnectionUsedPassword 138
pg_valid_server_encoding_id 139
+PQconnectionNeedsPassword 140
* Portions Copyright (c) 1994, Regents of the University of California
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/interfaces/libpq/fe-auth.c,v 1.134 2007/12/04 13:02:53 mha Exp $
+ * $PostgreSQL: pgsql/src/interfaces/libpq/fe-auth.c,v 1.135 2007/12/09 19:01:40 tgl Exp $
*
*-------------------------------------------------------------------------
*/
case AUTH_REQ_MD5:
case AUTH_REQ_CRYPT:
case AUTH_REQ_PASSWORD:
- if (conn->pgpass == NULL || *conn->pgpass == '\0')
+ conn->password_needed = true;
+ if (conn->pgpass == NULL || conn->pgpass[0] == '\0')
{
printfPQExpBuffer(&conn->errorMessage,
PQnoPasswordSupplied);
*
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.353 2007/11/15 21:14:46 momjian Exp $
+ * $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.354 2007/12/09 19:01:40 tgl Exp $
*
*-------------------------------------------------------------------------
*/
static void freePGconn(PGconn *conn);
static void closePGconn(PGconn *conn);
static PQconninfoOption *conninfo_parse(const char *conninfo,
- PQExpBuffer errorMessage);
+ PQExpBuffer errorMessage, bool *password_from_string);
static char *conninfo_getval(PQconninfoOption *connOptions,
const char *keyword);
static void defaultNoticeReceiver(void *arg, const PGresult *res);
/*
* Parse the conninfo string
*/
- connOptions = conninfo_parse(conninfo, &conn->errorMessage);
+ connOptions = conninfo_parse(conninfo, &conn->errorMessage,
+ &conn->pgpass_from_client);
if (connOptions == NULL)
{
conn->status = CONNECTION_BAD;
conn->dbName, conn->pguser);
if (conn->pgpass == NULL)
conn->pgpass = strdup(DefaultPassword);
+ conn->pgpass_from_client = false;
}
/*
PQconndefaults(void)
{
PQExpBufferData errorBuf;
+ bool password_from_string;
PQconninfoOption *connOptions;
initPQExpBuffer(&errorBuf);
- connOptions = conninfo_parse("", &errorBuf);
+ connOptions = conninfo_parse("", &errorBuf, &password_from_string);
termPQExpBuffer(&errorBuf);
return connOptions;
}
if (conn->pgpass)
free(conn->pgpass);
conn->pgpass = strdup(pwd);
+ conn->pgpass_from_client = true;
}
/*
*/
conn->inStart = conn->inCursor;
- /* Save the authentication request type, if first one. */
- if (conn->areq == AUTH_REQ_OK)
- conn->areq = areq;
-
/* Respond to the request if necessary. */
/*
conn->std_strings = false; /* unless server says differently */
conn->verbosity = PQERRORS_DEFAULT;
conn->sock = -1;
- conn->areq = AUTH_REQ_OK; /* until we receive something else */
+ conn->password_needed = false;
#ifdef USE_SSL
conn->allow_ssl_try = true;
conn->wait_ssl_try = false;
* If successful, a malloc'd PQconninfoOption array is returned.
* If not successful, NULL is returned and an error message is
* left in errorMessage.
+ * *password_from_string is set TRUE if we got a password from the
+ * conninfo string, otherwise FALSE.
*/
static PQconninfoOption *
-conninfo_parse(const char *conninfo, PQExpBuffer errorMessage)
+conninfo_parse(const char *conninfo, PQExpBuffer errorMessage,
+ bool *password_from_string)
{
char *pname;
char *pval;
PQconninfoOption *options;
PQconninfoOption *option;
+ *password_from_string = false; /* default result */
+
/* Make a working copy of PQconninfoOptions */
options = malloc(sizeof(PQconninfoOptions));
if (options == NULL)
free(buf);
return NULL;
}
+
+ /*
+ * Special handling for password
+ */
+ if (strcmp(option->keyword, "password") == 0)
+ *password_from_string = (option->val[0] != '\0');
}
/* Done with the modifiable input string */
return conn->be_pid;
}
+int
+PQconnectionNeedsPassword(const PGconn *conn)
+{
+ if (!conn)
+ return false;
+ if (conn->password_needed &&
+ (conn->pgpass == NULL || conn->pgpass[0] == '\0'))
+ return true;
+ else
+ return false;
+}
+
int
PQconnectionUsedPassword(const PGconn *conn)
{
if (!conn)
return false;
- if (conn->areq == AUTH_REQ_MD5 ||
- conn->areq == AUTH_REQ_CRYPT ||
- conn->areq == AUTH_REQ_PASSWORD)
+ if (conn->password_needed && conn->pgpass_from_client)
return true;
else
return false;
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
- * $PostgreSQL: pgsql/src/interfaces/libpq/libpq-fe.h,v 1.139 2007/10/13 20:18:42 tgl Exp $
+ * $PostgreSQL: pgsql/src/interfaces/libpq/libpq-fe.h,v 1.140 2007/12/09 19:01:40 tgl Exp $
*
*-------------------------------------------------------------------------
*/
extern char *PQerrorMessage(const PGconn *conn);
extern int PQsocket(const PGconn *conn);
extern int PQbackendPID(const PGconn *conn);
+extern int PQconnectionNeedsPassword(const PGconn *conn);
extern int PQconnectionUsedPassword(const PGconn *conn);
extern int PQclientEncoding(const PGconn *conn);
extern int PQsetClientEncoding(PGconn *conn, const char *encoding);
#define PQfreeNotify(ptr) PQfreemem(ptr)
/* Error when no password was given. */
-/* Note: depending on this is deprecated; use PQconnectionUsedPassword(). */
+/* Note: depending on this is deprecated; use PQconnectionNeedsPassword(). */
#define PQnoPasswordSupplied "fe_sendauth: no password supplied\n"
/*
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
- * $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.127 2007/11/15 21:14:46 momjian Exp $
+ * $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.128 2007/12/09 19:01:40 tgl Exp $
*
*-------------------------------------------------------------------------
*/
char *dbName; /* database name */
char *pguser; /* Postgres username and password, if any */
char *pgpass;
+ bool pgpass_from_client; /* did password come from connect args? */
char *sslmode; /* SSL mode (require,prefer,allow,disable) */
#if defined(KRB5) || defined(ENABLE_GSS) || defined(ENABLE_SSPI)
char *krbsrvname; /* Kerberos service name */
SockAddr raddr; /* Remote address */
ProtocolVersion pversion; /* FE/BE protocol version in use */
int sversion; /* server version, e.g. 70401 for 7.4.1 */
- AuthRequest areq; /* auth type demanded by server */
+ bool password_needed; /* true if server demanded a password */
/* Transient state needed while establishing connection */
struct addrinfo *addrlist; /* list of possible backend addresses */
projects / postgresql / commitdiff