Skip to content

Commit b69ace0

Browse files
authored
Merge pull request #1406 from cruelsmith/defaulting_password_encryption_for_version_above_14
Defaulting password encryption for version above 14
2 parents 40de8ec + 6dee3b8 commit b69ace0

28 files changed

+795
-294
lines changed

REFERENCE.md

Lines changed: 259 additions & 118 deletions
Large diffs are not rendered by default.

lib/puppet/functions/postgresql/postgresql_password.rb

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,19 +22,25 @@
2222
required_param 'Variant[String[1], Integer]', :username
2323
required_param 'Variant[String[1], Sensitive[String[1]], Integer]', :password
2424
optional_param 'Boolean', :sensitive
25-
optional_param "Optional[Enum['md5', 'scram-sha-256']]", :hash
25+
optional_param 'Optional[Postgresql::Pg_password_encryption]', :hash
2626
optional_param 'Optional[Variant[String[1], Integer]]', :salt
2727
return_type 'Variant[String, Sensitive[String]]'
2828
end
2929

3030
def default_impl(username, password, sensitive = false, hash = 'md5', salt = nil)
31-
return password if password.is_a?(String) && password.match?(%r{^(md5|SCRAM-SHA-256).+})
32-
3331
password = password.unwrap if password.respond_to?(:unwrap)
34-
pass = if hash == 'md5'
32+
if password.is_a?(String) && password.match?(%r{^(md5[0-9a-f]{32}$|SCRAM-SHA-256\$)})
33+
return Puppet::Pops::Types::PSensitiveType::Sensitive.new(password) if sensitive
34+
35+
return password
36+
end
37+
pass = case hash
38+
when 'md5', nil # ensure default value when definded with nil
3539
"md5#{Digest::MD5.hexdigest(password.to_s + username.to_s)}"
36-
else
40+
when 'scram-sha-256'
3741
pg_sha256(password, (salt || username))
42+
else
43+
raise(Puppet::ParseError, "postgresql::postgresql_password(): got unkown hash type '#{hash}'")
3844
end
3945
if sensitive
4046
Puppet::Pops::Types::PSensitiveType::Sensitive.new(pass)

manifests/backup/pg_dump.pp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@
2626
# @param manage_user
2727
# Manage creation of the backup user.
2828
# @param optional_args
29-
# Specifies an array of optional arguments which should be passed through to the backup tool. These options are not validated, unsupported options may break the backup.
29+
# Specifies an array of optional arguments which should be passed through to the backup tool. These options are not validated,
30+
# unsupported options may break the backup.
3031
# @param post_script
3132
# One or more scripts that are executed when the backup is finished. This could be used to sync the backup to a central store.
3233
# @param pre_script
@@ -39,7 +40,6 @@
3940
# An array of two elements to set the backup time. Allows `['23', '5']` (i.e., 23:05) or `['3', '45']` (i.e., 03:45) for HH:MM times.
4041
# @param weekday
4142
# Weekdays on which the backup job should run. Defaults to `*`. This parameter is passed directly to the cron resource.
42-
#
4343
class postgresql::backup::pg_dump (
4444
String[1] $dir,
4545
Variant[Enum['present', 'absent', 'purged', 'disabled', 'installed', 'latest'], String[1]] $ensure = 'present',
@@ -83,7 +83,7 @@
8383
# Create user with superuser privileges
8484
postgresql::server::role { $db_user:
8585
ensure => $ensure,
86-
password_hash => postgresql::postgresql_password($db_user, $db_password),
86+
password_hash => postgresql::postgresql_password($db_user, $db_password, true, pick($postgresql::server::password_encryption, 'md5')),
8787
superuser => true,
8888
}
8989

@@ -92,7 +92,7 @@
9292
type => 'local',
9393
database => 'all',
9494
user => $db_user,
95-
auth_method => 'md5',
95+
auth_method => pick($postgresql::server::password_encryption, 'md5'),
9696
order => 1,
9797
}
9898
}

manifests/globals.pp

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
#
33
# @note
44
# Most server-specific defaults should be overridden in the postgresql::server class.
5-
# This class should be used only if you are using a non-standard OS, or if you are changing elements that can only be changed here, such as version or manage_package_repo.
5+
# This class should be used only if you are using a non-standard OS, or if you are changing elements that can only be changed here, such
6+
# as version or manage_package_repo.
67
#
78
#
89
# @param client_package_name Overrides the default PostgreSQL client package name.
@@ -40,8 +41,10 @@
4041
# Overrides the default PostgreSQL data directory for the target platform.
4142
# Changing the datadir after installation causes the server to come to a full stop before making the change.
4243
# For Red Hat systems, the data directory must be labeled appropriately for SELinux.
43-
# On Ubuntu, you must explicitly set needs_initdb = true to allow Puppet to initialize the database in the new datadir (needs_initdb defaults to true on other systems).
44-
# Warning! If datadir is changed from the default, Puppet does not manage purging of the original data directory, which causes it to fail if the data directory is changed back to the original
44+
# On Ubuntu, you must explicitly set needs_initdb = true to allow Puppet to initialize the database in the new datadir (needs_initdb
45+
# defaults to true on other systems).
46+
# Warning! If datadir is changed from the default, Puppet does not manage purging of the original data directory, which causes it to fail
47+
# if the data directory is changed back to the original
4548
#
4649
# @param confdir Overrides the default PostgreSQL configuration directory for the target platform.
4750
# @param bindir Overrides the default PostgreSQL binaries directory for the target platform.
@@ -59,20 +62,24 @@
5962
# @param repo_baseurl Sets the baseurl for the PostgreSQL repository. Useful if you host your own mirror of the repository.
6063
# @param yum_repo_commonurl Sets the url for the PostgreSQL common Yum repository. Useful if you host your own mirror of the YUM repository.
6164
#
62-
# @param needs_initdb Explicitly calls the initdb operation after the server package is installed and before the PostgreSQL service is started.
65+
# @param needs_initdb
66+
# Explicitly calls the initdb operation after the server package is installed and before the PostgreSQL service is started.
6367
#
6468
# @param encoding
6569
# Sets the default encoding for all databases created with this module.
66-
# On certain operating systems, this is also used during the template1 initialization, so it becomes a default outside of the module as well.
70+
# On certain operating systems, this is also used during the template1 initialization,
71+
# so it becomes a default outside of the module as well.
6772
# @param locale
6873
# Sets the default database locale for all databases created with this module.
69-
# On certain operating systems, this is also used during the template1 initialization, so it becomes a default outside of the module as well.
74+
# On certain operating systems, this is also used during the template1 initialization,
75+
# so it becomes a default outside of the module as well.
7076
# On Debian, you'll need to ensure that the 'locales-all' package is installed for full functionality of PostgreSQL.
7177
# @param data_checksums
7278
# Use checksums on data pages to help detect corruption by the I/O system that would otherwise be silent.
7379
# Warning: This option is used during initialization by initdb, and cannot be changed later.
7480
#
75-
# @param timezone Sets the default timezone of the postgresql server. The postgresql built-in default is taking the systems timezone information.
81+
# @param timezone
82+
# Sets the default timezone of the postgresql server. The postgresql built-in default is taking the systems timezone information.
7683
#
7784
# @param manage_pg_hba_conf Allow Puppet to manage the pg_hba.conf file.
7885
# @param manage_pg_ident_conf Allow Puppet to manage the pg_ident.conf file.
@@ -92,8 +99,9 @@
9299
# Manage the DNF module. This only makes sense on distributions that use DNF
93100
# package manager, such as EL8 or Fedora. It also requires Puppet 5.5.20+ or
94101
# Puppet 6.15.0+ since they ship the dnfmodule provider.
95-
# @param module_workdir Specifies working directory under which the psql command should be executed. May need to specify if '/tmp' is on volume mounted with noexec option.
96-
#
102+
# @param module_workdir
103+
# Specifies working directory under which the psql command should be executed.
104+
# May need to specify if '/tmp' is on volume mounted with noexec option.
97105
#
98106
class postgresql::globals (
99107
Optional[String[1]] $client_package_name = undef,

manifests/lib/devel.pp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
1-
# @summary This class installs postgresql development libraries.
1+
# @summary This class installs postgresql development libraries.
22
#
33
# @param package_name
44
# Override devel package name
55
# @param package_ensure
66
# Ensure the development libraries are installed
77
# @param link_pg_config
8-
# If the bin directory used by the PostgreSQL page is not /usr/bin or /usr/local/bin, symlinks pg_config from the package's bin dir into usr/bin (not applicable to Debian systems). Set to false to disable this behavior.
8+
# If the bin directory used by the PostgreSQL page is not /usr/bin or /usr/local/bin, symlinks pg_config from the package's bin dir
9+
# into usr/bin (not applicable to Debian systems). Set to false to disable this behavior.
910
#
1011
#
1112
class postgresql::lib::devel (

manifests/lib/docs.pp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
# @summary Installs PostgreSQL bindings for Postgres-Docs. Set the following parameters if you have a custom version you would like to install.
1+
# @summary
2+
# Installs PostgreSQL bindings for Postgres-Docs. Set the following parameters if you have a custom version you would like to install.
23
#
34
# @note
45
# Make sure to add any necessary yum or apt repositories if specifying a custom version.
@@ -7,7 +8,7 @@
78
# Specifies the name of the PostgreSQL docs package.
89
# @param package_ensure
910
# Whether the PostgreSQL docs package resource should be present.
10-
#
11+
#
1112
#
1213
class postgresql::lib::docs (
1314
String $package_name = $postgresql::params::docs_package_name,

manifests/params.pp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
$manage_selinux = pick($manage_selinux, false)
2626
$package_ensure = 'present'
2727
$module_workdir = pick($module_workdir,'/tmp')
28-
$password_encryption = undef
28+
$password_encryption = if versioncmp($version, '14') >= 0 { 'scram-sha-256' } else { undef }
2929
$extra_systemd_config = undef
3030
$manage_datadir = true
3131
$manage_logdir = true
@@ -298,7 +298,7 @@
298298
# Since we can't determine defaults on our own, we rely on users setting
299299
# parameters with the postgresql::globals class. Here we are checking
300300
# that the mandatory minimum is set for the module to operate.
301-
$err_prefix = "Module ${module_name} does not provide defaults for osfamily: ${facts['os']['family']} operatingsystem: ${facts['os']['name']}; please specify a value for ${module_name}::globals::"
301+
$err_prefix = "Module ${module_name} does not provide defaults for osfamily: ${facts['os']['family']} operatingsystem: ${facts['os']['name']}; please specify a value for ${module_name}::globals::" # lint:ignore:140chars
302302
if ($needs_initdb == undef) { fail("${err_prefix}needs_initdb") }
303303
if ($service_name == undef) { fail("${err_prefix}service_name") }
304304
if ($client_package_name == undef) { fail("${err_prefix}client_package_name") }

manifests/repo.pp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
}
1919

2020
default: {
21-
fail("Unsupported managed repository for osfamily: ${facts['os']['family']}, operatingsystem: ${facts['os']['name']}, module ${module_name} currently only supports managing repos for osfamily RedHat and Debian")
21+
fail("Unsupported managed repository for osfamily: ${facts['os']['family']}, operatingsystem: ${facts['os']['name']}, module ${module_name} currently only supports managing repos for osfamily RedHat and Debian") # lint:ignore:140chars
2222
}
2323
}
2424
}

0 commit comments

Comments
 (0)