Postgresql passwordcheck.c modification - c

Question

I need to modify the https://github.com/postgres/postgres/blob/REL9_5_13/contrib/passwordcheck/passwordcheck.c in order to check the password before set it.
I'm not very good with C.
So I added this check:
if (validuntil_null)
ereport(ERROR,
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
errmsg("password expiriration missing")));
and it works, it checks if the expiration date is set.
Now I want to check if this expiration date is reasonable, like no more than 3 months (using "validuntil_time") and if it is different from the previous set.
Any idea?
thanks in advance.

Answer 1

I am not familiar with the internals of PostgreSQL or the configuration of PostgreSQL. My first approach would be to study the documentation to determine if it is possible to set a maximum password expiration time using the admin privileges. I am guessing that you have studied that in detail already and feel that this is the best option.
Based on that, I did review some of the timestamp code in the Postgres github repository. I have not compiled this, but believe this is close. It was not clear to me what Datum is, whether that is already a TimeStampTz type, or if that needs to be converted in some way. It might not compile properly without answering that question. Let me know if this works for you:
At the top of the file, add this to the includes:
#include "utils/timestamp.h"
Later, at the same place where you placed your current code, replace your code with this:
if (validuntil_null) {
ereport(ERROR,
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
errmsg("password expiriration missing")));
} else {
TimestampTz now = GetCurrentTimestamp();
const int ThreeMonthsInMiliSeconds = 90 * 24 * 3600 * 1000;
if(TimestampDifferenceExceeds(now, validuntil_time, ThreeMonthsInMiliSeconds) {
ereport(ERROR,
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
errmsg("password expiriration time is greater than 90 days")));
}
}
Here is the source code for that timedifference function from timestamp.c:
/*
* TimestampDifferenceExceeds -- report whether the difference between two
* timestamps is >= a threshold (expressed in milliseconds)
*
* Both inputs must be ordinary finite timestamps (in current usage,
* they'll be results from GetCurrentTimestamp()).
*/
bool
TimestampDifferenceExceeds(TimestampTz start_time,
TimestampTz stop_time,
int msec)
{
TimestampTz diff = stop_time - start_time;
return (diff >= msec * INT64CONST(1000));
}

Answer 2

Thanks John, at the end I managed in that way:
if (validuntil_null) {
ereport(ERROR,
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
errmsg("password expiriration missing")));
} else {
TimestampTz now = GetCurrentTimestamp();
const off64_t threshold = (const off64_t)((off64_t)90 * 24 * 3600 * 1000 );
if (now > validuntil_time) {
ereport(ERROR,
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
errmsg("\nERROR now: %ld validuntil_time: %ld threshold: %ld",now,validuntil_time,threshold)));
} else {
const off64_t diff= (const off64_t)((off64_t)(validuntil_time - now)/1000);
if (diff >= threshold) {
ereport(ERROR,
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
errmsg("\nERROR: DATE is more than 90 days: now: %ld validuntil_time: %ld threshold: %ld",now,validuntil_time,threshold)));
}
elog(INFO,"\nnow: %ld validuntil_time: %ld threshold: %ld diff: %ld",now,validuntil_time,threshold,diff);
}
}
Thanks