62{
65 password_type, validuntil_time,
66 validuntil_null);
67
69 {
70 /*
71 * Unfortunately we cannot perform exhaustive checks on encrypted
72 * passwords - we are restricted to guessing. (Alternatively, we could
73 * insist on the password being presented non-encrypted, but that has
74 * its own security disadvantages.)
75 *
76 * We only check for username = password.
77 */
78 const char *logdetail = NULL;
79
82 (
errcode(ERRCODE_INVALID_PARAMETER_VALUE),
83 errmsg(
"password must not equal user name")));
84 }
85 else
86 {
87 /*
88 * For unencrypted passwords we can perform better checks
89 */
93 bool pwd_has_letter,
94 pwd_has_nonletter;
95#ifdef USE_CRACKLIB
96 const char *reason;
97#endif
98
99 /* enforce minimum length */
102 (
errcode(ERRCODE_INVALID_PARAMETER_VALUE),
103 errmsg(
"password is too short"),
104 errdetail(
"password must be at least \"passwordcheck.min_password_length\" (%d) bytes long",
106
107 /* check if the password contains the username */
110 (
errcode(ERRCODE_INVALID_PARAMETER_VALUE),
111 errmsg(
"password must not contain user name")));
112
113 /* check if the password contains both letters and non-letters */
114 pwd_has_letter = false;
115 pwd_has_nonletter = false;
116 for (
i = 0;
i < pwdlen;
i++)
117 {
118 /*
119 * isalpha() does not work for multibyte encodings but let's
120 * consider non-ASCII characters non-letters
121 */
122 if (isalpha((
unsigned char)
password[
i]))
123 pwd_has_letter = true;
124 else
125 pwd_has_nonletter = true;
126 }
127 if (!pwd_has_letter || !pwd_has_nonletter)
129 (
errcode(ERRCODE_INVALID_PARAMETER_VALUE),
130 errmsg(
"password must contain both letters and nonletters")));
131
132#ifdef USE_CRACKLIB
133 /* call cracklib to check password */
134 if ((reason = FascistCheck(
password, CRACKLIB_DICTPATH)))
136 (
errcode(ERRCODE_INVALID_PARAMETER_VALUE),
137 errmsg(
"password is easily cracked"),
139#endif
140 }
141
142 /* all checks passed, password is ok */
143}
int plain_crypt_verify(const char *role, const char *shadow_pass, const char *client_pass, const char **logdetail)
@ PASSWORD_TYPE_PLAINTEXT
int errdetail(const char *fmt,...)
int errcode(int sqlerrcode)
int errmsg(const char *fmt,...)
int errdetail_log(const char *fmt,...)
#define ereport(elevel,...)