Skip to content

Commit 985309e

Browse files
cruelsmithbastelfreak
cruelsmith
authored and
bastelfreak
committed
Defaulting password_encryption to scram-sha-256 with version >= 14
* Fix missing handling of allowed undef value of parameter hash of postgresql::postgresql_password * Fix edgecase where passwords starting with md5 but are not followed by 32 base64 chars will not be hashed by postgresql::postgresql_password * Fix case of postgresql::postgresql_password where sensitive hashes are wrongly handled * Extend spec tests for 'postgresql_password function' to cover this * Add respecting password_encryption for all internal postgresql::postgresql_password calls * Add respecting password_encryption for postgresql::backup::pg_dump * Add spec tests for new hash type handling of postgresql::server::role See https://www.postgresql.org/docs/14/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION
1 parent 40de8ec commit 985309e

File tree

9 files changed

+352
-88
lines changed

9 files changed

+352
-88
lines changed

‎lib/puppet/functions/postgresql/postgresql_password.rb‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,19 +22,25 @@
2222
required_param 'Variant[String[1], Integer]', :username
2323
required_param 'Variant[String[1], Sensitive[String[1]], Integer]', :password
2424
optional_param 'Boolean', :sensitive
25-
optional_param "Optional[Enum['md5', 'scram-sha-256']]", :hash
25+
optional_param 'Optional[Postgresql::Pg_password_encryption]', :hash
2626
optional_param 'Optional[Variant[String[1], Integer]]', :salt
2727
return_type 'Variant[String, Sensitive[String]]'
2828
end
2929

3030
def default_impl(username, password, sensitive = false, hash = 'md5', salt = nil)
31-
return password if password.is_a?(String) && password.match?(%r{^(md5|SCRAM-SHA-256).+})
32-
3331
password = password.unwrap if password.respond_to?(:unwrap)
34-
pass = if hash == 'md5'
32+
if password.is_a?(String) && password.match?(%r{^(md5[0-9a-f]{32}$|SCRAM-SHA-256\$)})
33+
return Puppet::Pops::Types::PSensitiveType::Sensitive.new(password) if sensitive
34+
35+
return password
36+
end
37+
pass = case hash
38+
when 'md5', nil # ensure default value when definded with nil
3539
"md5#{Digest::MD5.hexdigest(password.to_s + username.to_s)}"
36-
else
40+
when 'scram-sha-256'
3741
pg_sha256(password, (salt || username))
42+
else
43+
raise(Puppet::ParseError, "postgresql::postgresql_password(): got unkown hash type '#{hash}'")
3844
end
3945
if sensitive
4046
Puppet::Pops::Types::PSensitiveType::Sensitive.new(pass)

‎manifests/backup/pg_dump.pp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@
8383
# Create user with superuser privileges
8484
postgresql::server::role { $db_user:
8585
ensure => $ensure,
86-
password_hash => postgresql::postgresql_password($db_user, $db_password),
86+
password_hash => postgresql::postgresql_password($db_user, $db_password, true, pick($postgresql::server::password_encryption, 'md5')),
8787
superuser => true,
8888
}
8989

@@ -92,7 +92,7 @@
9292
type => 'local',
9393
database => 'all',
9494
user => $db_user,
95-
auth_method => 'md5',
95+
auth_method => pick($postgresql::server::password_encryption, 'md5'),
9696
order => 1,
9797
}
9898
}

‎manifests/params.pp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
$manage_selinux = pick($manage_selinux, false)
2626
$package_ensure = 'present'
2727
$module_workdir = pick($module_workdir,'/tmp')
28-
$password_encryption = undef
28+
$password_encryption = if versioncmp($version, '14') >= 0 { 'scram-sha-256' } else { undef }
2929
$extra_systemd_config = undef
3030
$manage_datadir = true
3131
$manage_logdir = true
@@ -298,7 +298,7 @@
298298
# Since we can't determine defaults on our own, we rely on users setting
299299
# parameters with the postgresql::globals class. Here we are checking
300300
# that the mandatory minimum is set for the module to operate.
301-
$err_prefix = "Module ${module_name} does not provide defaults for osfamily: ${facts['os']['family']} operatingsystem: ${facts['os']['name']}; please specify a value for ${module_name}::globals::"
301+
$err_prefix = "Module ${module_name} does not provide defaults for osfamily: ${facts['os']['family']} operatingsystem: ${facts['os']['name']}; please specify a value for ${module_name}::globals::" # lint:ignore:140chars
302302
if ($needs_initdb == undef) { fail("${err_prefix}needs_initdb") }
303303
if ($service_name == undef) { fail("${err_prefix}service_name") }
304304
if ($client_package_name == undef) { fail("${err_prefix}client_package_name") }

‎manifests/server.pp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@
9595
class postgresql::server (
9696
Optional[Variant[String[1], Sensitive[String[1]], Integer]] $postgres_password = undef,
9797

98-
Variant[Enum['present', 'absent', 'purged', 'disabled', 'installed', 'latest'], String[1]] $package_ensure = $postgresql::params::package_ensure,
98+
Variant[Enum['present', 'absent', 'purged', 'disabled', 'installed', 'latest'], String[1]] $package_ensure = $postgresql::params::package_ensure, # lint:ignore:140chars
9999
String[1] $package_name = $postgresql::params::server_package_name,
100100

101101
Optional[String[1]] $plperl_package_name = $postgresql::params::plperl_package_name,
@@ -159,7 +159,7 @@
159159
Boolean $manage_datadir = $postgresql::params::manage_datadir,
160160
Boolean $manage_logdir = $postgresql::params::manage_logdir,
161161
Boolean $manage_xlogdir = $postgresql::params::manage_xlogdir,
162-
Optional[String] $password_encryption = $postgresql::params::password_encryption,
162+
Optional[Postgresql::Pg_password_encryption] $password_encryption = $postgresql::params::password_encryption,
163163
Optional[String] $extra_systemd_config = $postgresql::params::extra_systemd_config,
164164

165165
Hash[String, Hash] $roles = {},

‎manifests/server/instance/config.pp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@
6060
Boolean $service_enable = $postgresql::server::service_enable,
6161
Optional[String[1]] $log_line_prefix = $postgresql::server::log_line_prefix,
6262
Optional[String[1]] $timezone = $postgresql::server::timezone,
63-
Optional[String] $password_encryption = $postgresql::server::password_encryption,
63+
Optional[Postgresql::Pg_password_encryption] $password_encryption = $postgresql::server::password_encryption,
6464
Optional[String] $extra_systemd_config = $postgresql::server::extra_systemd_config,
6565
) {
6666
if ($manage_pg_hba_conf == true) {

‎manifests/server/role.pp‎

Lines changed: 35 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -21,26 +21,26 @@
2121
# @param hash Specify the hash method for pg password
2222
# @param salt Specify the salt use for the scram-sha-256 encoding password (default username)
2323
define postgresql::server::role (
24-
Boolean $update_password = true,
25-
Variant[Boolean, String, Sensitive[String]] $password_hash = false,
26-
Boolean $createdb = false,
27-
Boolean $createrole = false,
28-
String[1] $db = $postgresql::server::default_database,
29-
Optional[Variant[String[1], Stdlib::Port, Integer]] $port = undef,
30-
Boolean $login = true,
31-
Boolean $inherit = true,
32-
Boolean $superuser = false,
33-
Boolean $replication = false,
34-
String[1] $connection_limit = '-1',
35-
String[1] $username = $title,
36-
Hash $connect_settings = $postgresql::server::default_connect_settings,
37-
String[1] $psql_user = $postgresql::server::user,
38-
String[1] $psql_group = $postgresql::server::group,
39-
Variant[String[1], Stdlib::Absolutepath] $psql_path = $postgresql::server::psql_path,
40-
String[1] $module_workdir = $postgresql::server::module_workdir,
41-
Enum['present', 'absent'] $ensure = 'present',
42-
Enum['md5', 'scram-sha-256'] $hash = 'md5',
43-
Optional[Variant[String[1], Integer]] $salt = undef,
24+
Boolean $update_password = true,
25+
Variant[Boolean, String, Sensitive[String]] $password_hash = false,
26+
Boolean $createdb = false,
27+
Boolean $createrole = false,
28+
String[1] $db = $postgresql::server::default_database,
29+
Optional[Variant[String[1], Stdlib::Port, Integer]] $port = undef,
30+
Boolean $login = true,
31+
Boolean $inherit = true,
32+
Boolean $superuser = false,
33+
Boolean $replication = false,
34+
String[1] $connection_limit = '-1',
35+
String[1] $username = $title,
36+
Hash $connect_settings = $postgresql::server::default_connect_settings,
37+
String[1] $psql_user = $postgresql::server::user,
38+
String[1] $psql_group = $postgresql::server::group,
39+
Variant[String[1], Stdlib::Absolutepath] $psql_path = $postgresql::server::psql_path,
40+
String[1] $module_workdir = $postgresql::server::module_workdir,
41+
Enum['present', 'absent'] $ensure = 'present',
42+
Optional[Enum['md5', 'scram-sha-256']] $hash = undef,
43+
Optional[Variant[String[1], Integer]] $salt = undef,
4444
) {
4545
$password_hash_unsensitive = if $password_hash =~ Sensitive[String] {
4646
$password_hash.unwrap
@@ -106,7 +106,7 @@
106106
]
107107
)
108108
} else {
109-
$create_role_command = "CREATE ROLE \"${username}\" ${password_sql} ${login_sql} ${createrole_sql} ${createdb_sql} ${superuser_sql} ${replication_sql} CONNECTION LIMIT ${connection_limit}"
109+
$create_role_command = "CREATE ROLE \"${username}\" ${password_sql} ${login_sql} ${createrole_sql} ${createdb_sql} ${superuser_sql} ${replication_sql} CONNECTION LIMIT ${connection_limit}" # lint:ignore:140chars
110110
}
111111

112112
postgresql_psql { "CREATE ROLE ${username} ENCRYPTED PASSWORD ****":
@@ -152,22 +152,29 @@
152152
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolconnlimit = ${connection_limit}",
153153
}
154154

155+
$_hash = if $hash {
156+
$hash
157+
} elsif $connect_settings != undef and 'DBVERSION' in $connect_settings {
158+
if (versioncmp($version, '14') >= 0) { 'scram-sha-256' } else { undef }
159+
} else {
160+
$postgresql::server::password_encryption
161+
}
155162
if $password_hash_unsensitive and $update_password {
156163
if $password_hash_unsensitive =~ Deferred {
157-
$pwd_hash_sql = Deferred ( 'postgresql::postgresql_password', [$username,
158-
$password_hash,
164+
$pwd_hash_sql = Deferred ( 'postgresql::postgresql_password', [
165+
$username,
166+
$password_hash_unsensitive,
159167
false,
160-
$hash,
168+
$_hash,
161169
$salt,
162170
]
163171
)
164-
}
165-
else {
172+
} else {
166173
$pwd_hash_sql = postgresql::postgresql_password(
167174
$username,
168-
$password_hash,
175+
$password_hash_unsensitive,
169176
false,
170-
$hash,
177+
$_hash,
171178
$salt,
172179
)
173180
}

0 commit comments

Comments
 (0)