Warn upon successful MD5 password authentication.

This uses the "connection warning" infrastructure introduced by
commit 1d92e0c2cc to emit a WARNING when an MD5 password is used to
authenticate.  MD5 password support was marked as deprecated in
v18 and will be removed in a future release of Postgres.  These
warnings are on by default but can be turned off via the existing
md5_password_warnings parameter.

Reviewed-by: Andreas Karlsson <andreas@proxel.se>
Reviewed-by: Xiangyu Liang <liangxiangyu_2013@163.com>
Discussion: https://postgr.es/m/aYzeAYEbodkkg5e-%40nathan

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 20dbcaeb3eeb273bf63b04b5719538db52d6f297..f670e2d4c31d2dd2a40e04c9c82c9b1721493544 100644 (file)
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1188,7 +1188,8 @@ include_dir 'conf.d'
       <listitem>
        <para>
         Controls whether a <literal>WARNING</literal> about MD5 password
-        deprecation is produced when a <command>CREATE ROLE</command> or
+        deprecation is produced upon successful MD5 password authentication or
+        when a <command>CREATE ROLE</command> or
         <command>ALTER ROLE</command> statement sets an MD5-encrypted password.
         The default value is <literal>on</literal>.
        </para>

diff --git a/src/backend/libpq/crypt.c b/src/backend/libpq/crypt.c
index dbdd0e40f41b4964e197c254ecec753ce7dd77ff..37ccec355c79c62314ae21888c7086a015d71b43 100644 (file)
--- a/src/backend/libpq/crypt.c
+++ b/src/backend/libpq/crypt.c
@@ -294,7 +294,24 @@ md5_crypt_verify(const char *role, const char *shadow_pass,
        }
 
        if (strcmp(client_pass, crypt_pwd) == 0)
+       {
                retval = STATUS_OK;
+
+               if (md5_password_warnings)
+               {
+                       MemoryContext oldcontext;
+                       char       *warning;
+                       char       *detail;
+
+                       oldcontext = MemoryContextSwitchTo(TopMemoryContext);
+
+                       warning = pstrdup(_("authenticated with an MD5-encrypted password"));
+                       detail = pstrdup(_("MD5 password support is deprecated and will be removed in a future release of PostgreSQL."));
+                       StoreConnectionWarning(warning, detail);
+
+                       MemoryContextSwitchTo(oldcontext);
+               }
+       }
        else
        {
                *logdetail = psprintf(_("Password does not match for user \"%s\"."),

diff --git a/src/test/authentication/t/001_password.pl b/src/test/authentication/t/001_password.pl
index 0ec9aa9f4e86bfab04b4b4ea3b0a4fb6165084a3..a4b11673c26e42624ecaad0a617d09c3a92c769c 100644 (file)
--- a/src/test/authentication/t/001_password.pl
+++ b/src/test/authentication/t/001_password.pl
@@ -499,6 +499,8 @@ SKIP:
 {
        skip "MD5 not supported" unless $md5_works;
        test_conn($node, 'user=md5_role', 'md5', 0,
+               expected_stderr =>
+                 qr/authenticated with an MD5-encrypted password/,
                log_like =>
                  [qr/connection authenticated: identity="md5_role" method=md5/]);
 }