PostgreSQL Source Code  git master
hba.c File Reference
#include "postgres.h"
#include <ctype.h>
#include <pwd.h>
#include <fcntl.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include "access/htup_details.h"
#include "catalog/pg_collation.h"
#include "catalog/pg_type.h"
#include "common/ip.h"
#include "common/string.h"
#include "funcapi.h"
#include "libpq/ifaddr.h"
#include "libpq/libpq.h"
#include "miscadmin.h"
#include "postmaster/postmaster.h"
#include "regex/regex.h"
#include "replication/walsender.h"
#include "storage/fd.h"
#include "utils/acl.h"
#include "utils/builtins.h"
#include "utils/guc.h"
#include "utils/lsyscache.h"
#include "utils/memutils.h"
#include "utils/varlena.h"
Include dependency graph for hba.c:

Go to the source code of this file.

Data Structures

struct  check_network_data
 
struct  HbaToken
 
struct  TokenizedLine
 

Macros

#define MAX_TOKEN   256
 
#define token_is_keyword(t, k)   (!t->quoted && strcmp(t->string, k) == 0)
 
#define token_matches(t, k)   (strcmp(t->string, k) == 0)
 
#define INVALID_AUTH_OPTION(optname, validmethods)
 
#define REQUIRE_AUTH_OPTION(methodval, optname, validmethods)
 
#define MANDATORY_AUTH_ARG(argvar, argname, authname)
 
#define IDENT_FIELD_ABSENT(field)
 
#define IDENT_MULTI_VALUE(tokens)
 
#define MAX_HBA_OPTIONS   14
 
#define NUM_PG_HBA_FILE_RULES_ATTS   9
 

Typedefs

typedef struct check_network_data check_network_data
 
typedef struct HbaToken HbaToken
 
typedef struct TokenizedLine TokenizedLine
 

Functions

static MemoryContext tokenize_file (const char *filename, FILE *file, List **tok_lines, int elevel)
 
static Listtokenize_inc_file (List *tokens, const char *outer_filename, const char *inc_filename, int elevel, char **err_msg)
 
static bool parse_hba_auth_opt (char *name, char *val, HbaLine *hbaline, int elevel, char **err_msg)
 
static bool verify_option_list_length (List *options, const char *optionname, List *comparelist, const char *comparename, int line_num)
 
static ArrayTypegethba_options (HbaLine *hba)
 
static void fill_hba_line (Tuplestorestate *tuple_store, TupleDesc tupdesc, int lineno, HbaLine *hba, const char *err_msg)
 
static void fill_hba_view (Tuplestorestate *tuple_store, TupleDesc tupdesc)
 
bool pg_isblank (const char c)
 
static bool next_token (char **lineptr, char *buf, int bufsz, bool *initial_quote, bool *terminating_comma, int elevel, char **err_msg)
 
static HbaTokenmake_hba_token (const char *token, bool quoted)
 
static HbaTokencopy_hba_token (HbaToken *in)
 
static Listnext_field_expand (const char *filename, char **lineptr, int elevel, char **err_msg)
 
static bool is_member (Oid userid, const char *role)
 
static bool check_role (const char *role, Oid roleid, List *tokens)
 
static bool check_db (const char *dbname, const char *role, Oid roleid, List *tokens)
 
static bool ipv4eq (struct sockaddr_in *a, struct sockaddr_in *b)
 
static bool hostname_match (const char *pattern, const char *actual_hostname)
 
static bool check_hostname (hbaPort *port, const char *hostname)
 
static bool check_ip (SockAddr *raddr, struct sockaddr *addr, struct sockaddr *mask)
 
static void check_network_callback (struct sockaddr *addr, struct sockaddr *netmask, void *cb_data)
 
static bool check_same_host_or_net (SockAddr *raddr, IPCompareMethod method)
 
static HbaLineparse_hba_line (TokenizedLine *tok_line, int elevel)
 
static void check_hba (hbaPort *port)
 
bool load_hba (void)
 
Datum pg_hba_file_rules (PG_FUNCTION_ARGS)
 
static IdentLineparse_ident_line (TokenizedLine *tok_line)
 
static void check_ident_usermap (IdentLine *identLine, const char *usermap_name, const char *pg_role, const char *ident_user, bool case_insensitive, bool *found_p, bool *error_p)
 
int check_usermap (const char *usermap_name, const char *pg_role, const char *auth_user, bool case_insensitive)
 
bool load_ident (void)
 
void hba_getauthmethod (hbaPort *port)
 

Variables

static Listparsed_hba_lines = NIL
 
static MemoryContext parsed_hba_context = NULL
 
static Listparsed_ident_lines = NIL
 
static MemoryContext parsed_ident_context = NULL
 
static const char *const UserAuthName []
 

Macro Definition Documentation

◆ IDENT_FIELD_ABSENT

#define IDENT_FIELD_ABSENT (   field)
Value:
do { \
if (!field) { \
ereport(LOG, \
(errcode(ERRCODE_CONFIG_FILE_ERROR), \
errmsg("missing entry in file \"%s\" at end of line %d", \
IdentFileName, line_num))); \
return NULL; \
} \
} while (0)
int errcode(int sqlerrcode)
Definition: elog.c:694
#define LOG
Definition: elog.h:26
char * IdentFileName
Definition: guc.c:560
int errmsg(const char *fmt,...)
Definition: elog.c:905

Definition at line 931 of file hba.c.

Referenced by parse_ident_line().

◆ IDENT_MULTI_VALUE

#define IDENT_MULTI_VALUE (   tokens)
Value:
do { \
if (tokens->length > 1) { \
ereport(LOG, \
(errcode(ERRCODE_CONFIG_FILE_ERROR), \
errmsg("multiple values in ident field"), \
errcontext("line %d of configuration file \"%s\"", \
line_num, IdentFileName))); \
return NULL; \
} \
} while (0)
int errcode(int sqlerrcode)
Definition: elog.c:694
#define LOG
Definition: elog.h:26
char * IdentFileName
Definition: guc.c:560
int errmsg(const char *fmt,...)
Definition: elog.c:905
#define errcontext
Definition: elog.h:199

Definition at line 942 of file hba.c.

Referenced by parse_ident_line().

◆ INVALID_AUTH_OPTION

#define INVALID_AUTH_OPTION (   optname,
  validmethods 
)
Value:
do { \
ereport(elevel, \
(errcode(ERRCODE_CONFIG_FILE_ERROR), \
/* translator: the second %s is a list of auth methods */ \
errmsg("authentication option \"%s\" is only valid for authentication methods %s", \
optname, _(validmethods)), \
errcontext("line %d of configuration file \"%s\"", \
line_num, HbaFileName))); \
*err_msg = psprintf("authentication option \"%s\" is only valid for authentication methods %s", \
optname, validmethods); \
return false; \
} while (0)
char * psprintf(const char *fmt,...)
Definition: psprintf.c:46
int errcode(int sqlerrcode)
Definition: elog.c:694
char * HbaFileName
Definition: guc.c:559
static int elevel
Definition: vacuumlazy.c:333
int errmsg(const char *fmt,...)
Definition: elog.c:905
#define errcontext
Definition: elog.h:199
#define _(x)
Definition: elog.c:89

Definition at line 883 of file hba.c.

Referenced by parse_hba_auth_opt().

◆ MANDATORY_AUTH_ARG

#define MANDATORY_AUTH_ARG (   argvar,
  argname,
  authname 
)
Value:
do { \
if (argvar == NULL) { \
ereport(elevel, \
(errcode(ERRCODE_CONFIG_FILE_ERROR), \
errmsg("authentication method \"%s\" requires argument \"%s\" to be set", \
authname, argname), \
errcontext("line %d of configuration file \"%s\"", \
line_num, HbaFileName))); \
*err_msg = psprintf("authentication method \"%s\" requires argument \"%s\" to be set", \
authname, argname); \
return NULL; \
} \
} while (0)
char * psprintf(const char *fmt,...)
Definition: psprintf.c:46
int errcode(int sqlerrcode)
Definition: elog.c:694
char * HbaFileName
Definition: guc.c:559
static int elevel
Definition: vacuumlazy.c:333
int errmsg(const char *fmt,...)
Definition: elog.c:905
#define errcontext
Definition: elog.h:199

Definition at line 903 of file hba.c.

Referenced by parse_hba_line().

◆ MAX_HBA_OPTIONS

#define MAX_HBA_OPTIONS   14

Definition at line 2298 of file hba.c.

Referenced by gethba_options().

◆ MAX_TOKEN

#define MAX_TOKEN   256

Definition at line 57 of file hba.c.

Referenced by next_field_expand().

◆ NUM_PG_HBA_FILE_RULES_ATTS

#define NUM_PG_HBA_FILE_RULES_ATTS   9

Definition at line 2414 of file hba.c.

Referenced by fill_hba_line().

◆ REQUIRE_AUTH_OPTION

#define REQUIRE_AUTH_OPTION (   methodval,
  optname,
  validmethods 
)
Value:
do { \
if (hbaline->auth_method != methodval) \
INVALID_AUTH_OPTION(optname, validmethods); \
} while (0)

Definition at line 897 of file hba.c.

Referenced by parse_hba_auth_opt().

◆ token_is_keyword

#define token_is_keyword (   t,
 
)    (!t->quoted && strcmp(t->string, k) == 0)

Definition at line 68 of file hba.c.

Referenced by check_db(), check_role(), and parse_hba_line().

◆ token_matches

#define token_matches (   t,
 
)    (strcmp(t->string, k) == 0)

Definition at line 69 of file hba.c.

Referenced by check_db(), and check_role().

Typedef Documentation

◆ check_network_data

◆ HbaToken

typedef struct HbaToken HbaToken

◆ TokenizedLine

typedef struct TokenizedLine TokenizedLine

Function Documentation

◆ check_db()

static bool check_db ( const char *  dbname,
const char *  role,
Oid  roleid,
List tokens 
)
static

Definition at line 632 of file hba.c.

References am_db_walsender, am_walsender, is_member(), lfirst, token_is_keyword, and token_matches.

Referenced by check_hba().

633 {
634  ListCell *cell;
635  HbaToken *tok;
636 
637  foreach(cell, tokens)
638  {
639  tok = lfirst(cell);
641  {
642  /*
643  * physical replication walsender connections can only match
644  * replication keyword
645  */
646  if (token_is_keyword(tok, "replication"))
647  return true;
648  }
649  else if (token_is_keyword(tok, "all"))
650  return true;
651  else if (token_is_keyword(tok, "sameuser"))
652  {
653  if (strcmp(dbname, role) == 0)
654  return true;
655  }
656  else if (token_is_keyword(tok, "samegroup") ||
657  token_is_keyword(tok, "samerole"))
658  {
659  if (is_member(roleid, dbname))
660  return true;
661  }
662  else if (token_is_keyword(tok, "replication"))
663  continue; /* never match this if not walsender */
664  else if (token_matches(tok, dbname))
665  return true;
666  }
667  return false;
668 }
#define token_matches(t, k)
Definition: hba.c:69
bool am_walsender
Definition: walsender.c:115
Definition: hba.c:75
bool am_db_walsender
Definition: walsender.c:118
#define lfirst(lc)
Definition: pg_list.h:169
char * dbname
Definition: streamutil.c:51
static bool is_member(Oid userid, const char *role)
Definition: hba.c:584
#define token_is_keyword(t, k)
Definition: hba.c:68

◆ check_hba()

static void check_hba ( hbaPort port)
static

Definition at line 2084 of file hba.c.

References SockAddr::addr, HbaLine::addr, HbaLine::auth_method, check_db(), check_hostname(), check_ip(), check_role(), check_same_host_or_net(), HbaLine::conntype, ctHostGSS, ctHostNoGSS, ctHostNoSSL, ctHostSSL, ctLocal, Port::database_name, HbaLine::databases, get_role_oid(), Port::gss, Port::hba, HbaLine::hostname, HbaLine::ip_cmp_method, ipCmpAll, ipCmpMask, ipCmpSameHost, ipCmpSameNet, IS_AF_UNIX, lfirst, HbaLine::mask, palloc0(), Port::raddr, HbaLine::roles, Port::ssl_in_use, uaImplicitReject, and Port::user_name.

Referenced by hba_getauthmethod().

2085 {
2086  Oid roleid;
2087  ListCell *line;
2088  HbaLine *hba;
2089 
2090  /* Get the target role's OID. Note we do not error out for bad role. */
2091  roleid = get_role_oid(port->user_name, true);
2092 
2093  foreach(line, parsed_hba_lines)
2094  {
2095  hba = (HbaLine *) lfirst(line);
2096 
2097  /* Check connection type */
2098  if (hba->conntype == ctLocal)
2099  {
2100  if (!IS_AF_UNIX(port->raddr.addr.ss_family))
2101  continue;
2102  }
2103  else
2104  {
2105  if (IS_AF_UNIX(port->raddr.addr.ss_family))
2106  continue;
2107 
2108  /* Check SSL state */
2109  if (port->ssl_in_use)
2110  {
2111  /* Connection is SSL, match both "host" and "hostssl" */
2112  if (hba->conntype == ctHostNoSSL)
2113  continue;
2114  }
2115  else
2116  {
2117  /* Connection is not SSL, match both "host" and "hostnossl" */
2118  if (hba->conntype == ctHostSSL)
2119  continue;
2120  }
2121 
2122  /* Check GSSAPI state */
2123 #ifdef ENABLE_GSS
2124  if (port->gss && port->gss->enc &&
2125  hba->conntype == ctHostNoGSS)
2126  continue;
2127  else if (!(port->gss && port->gss->enc) &&
2128  hba->conntype == ctHostGSS)
2129  continue;
2130 #else
2131  if (hba->conntype == ctHostGSS)
2132  continue;
2133 #endif
2134 
2135  /* Check IP address */
2136  switch (hba->ip_cmp_method)
2137  {
2138  case ipCmpMask:
2139  if (hba->hostname)
2140  {
2141  if (!check_hostname(port,
2142  hba->hostname))
2143  continue;
2144  }
2145  else
2146  {
2147  if (!check_ip(&port->raddr,
2148  (struct sockaddr *) &hba->addr,
2149  (struct sockaddr *) &hba->mask))
2150  continue;
2151  }
2152  break;
2153  case ipCmpAll:
2154  break;
2155  case ipCmpSameHost:
2156  case ipCmpSameNet:
2157  if (!check_same_host_or_net(&port->raddr,
2158  hba->ip_cmp_method))
2159  continue;
2160  break;
2161  default:
2162  /* shouldn't get here, but deem it no-match if so */
2163  continue;
2164  }
2165  } /* != ctLocal */
2166 
2167  /* Check database and role */
2168  if (!check_db(port->database_name, port->user_name, roleid,
2169  hba->databases))
2170  continue;
2171 
2172  if (!check_role(port->user_name, roleid, hba->roles))
2173  continue;
2174 
2175  /* Found a record that matched! */
2176  port->hba = hba;
2177  return;
2178  }
2179 
2180  /* If no matching entry was found, then implicitly reject. */
2181  hba = palloc0(sizeof(HbaLine));
2183  port->hba = hba;
2184 }
List * databases
Definition: hba.h:79
Definition: hba.h:74
struct sockaddr_storage mask
Definition: hba.h:83
Definition: hba.h:51
struct sockaddr_storage addr
Definition: pqcomm.h:64
bool ssl_in_use
Definition: libpq-be.h:191
unsigned int Oid
Definition: postgres_ext.h:31
static bool check_hostname(hbaPort *port, const char *hostname)
Definition: hba.c:715
static List * parsed_hba_lines
Definition: hba.c:101
Oid get_role_oid(const char *rolname, bool missing_ok)
Definition: acl.c:5178
SockAddr raddr
Definition: libpq-be.h:126
ConnType conntype
Definition: hba.h:78
Definition: hba.h:61
struct sockaddr_storage addr
Definition: hba.h:81
#define IS_AF_UNIX(fam)
Definition: ip.h:24
Definition: hba.h:63
static bool check_ip(SockAddr *raddr, struct sockaddr *addr, struct sockaddr *mask)
Definition: hba.c:808
char * user_name
Definition: libpq-be.h:141
static bool check_role(const char *role, Oid roleid, List *tokens)
Definition: hba.c:608
Definition: hba.h:59
HbaLine * hba
Definition: libpq-be.h:155
Definition: hba.h:54
void * palloc0(Size size)
Definition: mcxt.c:981
char * hostname
Definition: hba.h:86
List * roles
Definition: hba.h:80
#define lfirst(lc)
Definition: pg_list.h:169
static bool check_db(const char *dbname, const char *role, Oid roleid, List *tokens)
Definition: hba.c:632
void * gss
Definition: libpq-be.h:185
static bool check_same_host_or_net(SockAddr *raddr, IPCompareMethod method)
Definition: hba.c:849
IPCompareMethod ip_cmp_method
Definition: hba.h:85
char * database_name
Definition: libpq-be.h:140
UserAuth auth_method
Definition: hba.h:87

◆ check_hostname()

static bool check_hostname ( hbaPort port,
const char *  hostname 
)
static

Definition at line 715 of file hba.c.

References SockAddr::addr, addrinfo::ai_addr, addrinfo::ai_next, DEBUG2, elog, freeaddrinfo, getaddrinfo, hostname_match(), ipv4eq(), NI_MAXHOST, NI_NAMEREQD, pg_getnameinfo_all(), pstrdup(), Port::raddr, Port::remote_hostname, Port::remote_hostname_errcode, Port::remote_hostname_resolv, and SockAddr::salen.

Referenced by check_hba().

716 {
717  struct addrinfo *gai_result,
718  *gai;
719  int ret;
720  bool found;
721 
722  /* Quick out if remote host name already known bad */
723  if (port->remote_hostname_resolv < 0)
724  return false;
725 
726  /* Lookup remote host name if not already done */
727  if (!port->remote_hostname)
728  {
729  char remote_hostname[NI_MAXHOST];
730 
731  ret = pg_getnameinfo_all(&port->raddr.addr, port->raddr.salen,
732  remote_hostname, sizeof(remote_hostname),
733  NULL, 0,
734  NI_NAMEREQD);
735  if (ret != 0)
736  {
737  /* remember failure; don't complain in the postmaster log yet */
738  port->remote_hostname_resolv = -2;
739  port->remote_hostname_errcode = ret;
740  return false;
741  }
742 
743  port->remote_hostname = pstrdup(remote_hostname);
744  }
745 
746  /* Now see if remote host name matches this pg_hba line */
748  return false;
749 
750  /* If we already verified the forward lookup, we're done */
751  if (port->remote_hostname_resolv == +1)
752  return true;
753 
754  /* Lookup IP from host name and check against original IP */
755  ret = getaddrinfo(port->remote_hostname, NULL, NULL, &gai_result);
756  if (ret != 0)
757  {
758  /* remember failure; don't complain in the postmaster log yet */
759  port->remote_hostname_resolv = -2;
760  port->remote_hostname_errcode = ret;
761  return false;
762  }
763 
764  found = false;
765  for (gai = gai_result; gai; gai = gai->ai_next)
766  {
767  if (gai->ai_addr->sa_family == port->raddr.addr.ss_family)
768  {
769  if (gai->ai_addr->sa_family == AF_INET)
770  {
771  if (ipv4eq((struct sockaddr_in *) gai->ai_addr,
772  (struct sockaddr_in *) &port->raddr.addr))
773  {
774  found = true;
775  break;
776  }
777  }
778 #ifdef HAVE_IPV6
779  else if (gai->ai_addr->sa_family == AF_INET6)
780  {
781  if (ipv6eq((struct sockaddr_in6 *) gai->ai_addr,
782  (struct sockaddr_in6 *) &port->raddr.addr))
783  {
784  found = true;
785  break;
786  }
787  }
788 #endif
789  }
790  }
791 
792  if (gai_result)
793  freeaddrinfo(gai_result);
794 
795  if (!found)
796  elog(DEBUG2, "pg_hba.conf host name \"%s\" rejected because address resolution did not return a match with IP address of client",
797  hostname);
798 
799  port->remote_hostname_resolv = found ? +1 : -1;
800 
801  return found;
802 }
#define getaddrinfo
Definition: getaddrinfo.h:136
#define NI_NAMEREQD
Definition: getaddrinfo.h:84
char * pstrdup(const char *in)
Definition: mcxt.c:1187
#define freeaddrinfo
Definition: getaddrinfo.h:141
struct sockaddr_storage addr
Definition: pqcomm.h:64
static bool ipv4eq(struct sockaddr_in *a, struct sockaddr_in *b)
Definition: hba.c:671
char * remote_hostname
Definition: libpq-be.h:128
SockAddr raddr
Definition: libpq-be.h:126
#define NI_MAXHOST
Definition: getaddrinfo.h:88
static bool hostname_match(const char *pattern, const char *actual_hostname)
Definition: hba.c:695
#define DEBUG2
Definition: elog.h:24
int remote_hostname_errcode
Definition: libpq-be.h:131
ACCEPT_TYPE_ARG3 salen
Definition: pqcomm.h:65
int pg_getnameinfo_all(const struct sockaddr_storage *addr, int salen, char *node, int nodelen, char *service, int servicelen, int flags)
Definition: ip.c:122
int remote_hostname_resolv
Definition: libpq-be.h:130
struct addrinfo * ai_next
Definition: getaddrinfo.h:107
#define elog(elevel,...)
Definition: elog.h:227
static char * hostname
Definition: pg_regress.c:91
struct sockaddr * ai_addr
Definition: getaddrinfo.h:105

◆ check_ident_usermap()

static void check_ident_usermap ( IdentLine identLine,
const char *  usermap_name,
const char *  pg_role,
const char *  ident_user,
bool  case_insensitive,
bool found_p,
bool error_p 
)
static

Definition at line 2808 of file hba.c.

References ereport, errcode(), errmsg(), IdentLine::ident_user, LOG, palloc(), palloc0(), pfree(), pg_mb2wchar_with_len(), pg_regerror(), pg_regexec(), IdentLine::pg_role, pg_strcasecmp(), pstrdup(), IdentLine::re, REG_NOMATCH, regmatch_t::rm_eo, regmatch_t::rm_so, and IdentLine::usermap.

Referenced by check_usermap().

2811 {
2812  *found_p = false;
2813  *error_p = false;
2814 
2815  if (strcmp(identLine->usermap, usermap_name) != 0)
2816  /* Line does not match the map name we're looking for, so just abort */
2817  return;
2818 
2819  /* Match? */
2820  if (identLine->ident_user[0] == '/')
2821  {
2822  /*
2823  * When system username starts with a slash, treat it as a regular
2824  * expression. In this case, we process the system username as a
2825  * regular expression that returns exactly one match. This is replaced
2826  * for \1 in the database username string, if present.
2827  */
2828  int r;
2829  regmatch_t matches[2];
2830  pg_wchar *wstr;
2831  int wlen;
2832  char *ofs;
2833  char *regexp_pgrole;
2834 
2835  wstr = palloc((strlen(ident_user) + 1) * sizeof(pg_wchar));
2836  wlen = pg_mb2wchar_with_len(ident_user, wstr, strlen(ident_user));
2837 
2838  r = pg_regexec(&identLine->re, wstr, wlen, 0, NULL, 2, matches, 0);
2839  if (r)
2840  {
2841  char errstr[100];
2842 
2843  if (r != REG_NOMATCH)
2844  {
2845  /* REG_NOMATCH is not an error, everything else is */
2846  pg_regerror(r, &identLine->re, errstr, sizeof(errstr));
2847  ereport(LOG,
2848  (errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
2849  errmsg("regular expression match for \"%s\" failed: %s",
2850  identLine->ident_user + 1, errstr)));
2851  *error_p = true;
2852  }
2853 
2854  pfree(wstr);
2855  return;
2856  }
2857  pfree(wstr);
2858 
2859  if ((ofs = strstr(identLine->pg_role, "\\1")) != NULL)
2860  {
2861  int offset;
2862 
2863  /* substitution of the first argument requested */
2864  if (matches[1].rm_so < 0)
2865  {
2866  ereport(LOG,
2867  (errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
2868  errmsg("regular expression \"%s\" has no subexpressions as requested by backreference in \"%s\"",
2869  identLine->ident_user + 1, identLine->pg_role)));
2870  *error_p = true;
2871  return;
2872  }
2873 
2874  /*
2875  * length: original length minus length of \1 plus length of match
2876  * plus null terminator
2877  */
2878  regexp_pgrole = palloc0(strlen(identLine->pg_role) - 2 + (matches[1].rm_eo - matches[1].rm_so) + 1);
2879  offset = ofs - identLine->pg_role;
2880  memcpy(regexp_pgrole, identLine->pg_role, offset);
2881  memcpy(regexp_pgrole + offset,
2882  ident_user + matches[1].rm_so,
2883  matches[1].rm_eo - matches[1].rm_so);
2884  strcat(regexp_pgrole, ofs + 2);
2885  }
2886  else
2887  {
2888  /* no substitution, so copy the match */
2889  regexp_pgrole = pstrdup(identLine->pg_role);
2890  }
2891 
2892  /*
2893  * now check if the username actually matched what the user is trying
2894  * to connect as
2895  */
2896  if (case_insensitive)
2897  {
2898  if (pg_strcasecmp(regexp_pgrole, pg_role) == 0)
2899  *found_p = true;
2900  }
2901  else
2902  {
2903  if (strcmp(regexp_pgrole, pg_role) == 0)
2904  *found_p = true;
2905  }
2906  pfree(regexp_pgrole);
2907 
2908  return;
2909  }
2910  else
2911  {
2912  /* Not regular expression, so make complete match */
2913  if (case_insensitive)
2914  {
2915  if (pg_strcasecmp(identLine->pg_role, pg_role) == 0 &&
2916  pg_strcasecmp(identLine->ident_user, ident_user) == 0)
2917  *found_p = true;
2918  }
2919  else
2920  {
2921  if (strcmp(identLine->pg_role, pg_role) == 0 &&
2922  strcmp(identLine->ident_user, ident_user) == 0)
2923  *found_p = true;
2924  }
2925  }
2926 }
regex_t re
Definition: hba.h:125
char * pstrdup(const char *in)
Definition: mcxt.c:1187
regoff_t rm_so
Definition: regex.h:87
int errcode(int sqlerrcode)
Definition: elog.c:694
int pg_strcasecmp(const char *s1, const char *s2)
Definition: pgstrcasecmp.c:36
#define LOG
Definition: elog.h:26
regoff_t rm_eo
Definition: regex.h:88
void pfree(void *pointer)
Definition: mcxt.c:1057
char * usermap
Definition: hba.h:122
size_t pg_regerror(int errcode, const regex_t *preg, char *errbuf, size_t errbuf_size)
Definition: regerror.c:60
unsigned int pg_wchar
Definition: mbprint.c:31
void * palloc0(Size size)
Definition: mcxt.c:981
int pg_mb2wchar_with_len(const char *from, pg_wchar *to, int len)
Definition: mbutils.c:870
#define ereport(elevel,...)
Definition: elog.h:155
char * ident_user
Definition: hba.h:123
int pg_regexec(regex_t *re, const chr *string, size_t len, size_t search_start, rm_detail_t *details, size_t nmatch, regmatch_t pmatch[], int flags)
Definition: regexec.c:176
void * palloc(Size size)
Definition: mcxt.c:950
int errmsg(const char *fmt,...)
Definition: elog.c:905
#define REG_NOMATCH
Definition: regex.h:140
char * pg_role
Definition: hba.h:124

◆ check_ip()

static bool check_ip ( SockAddr raddr,
struct sockaddr *  addr,
struct sockaddr *  mask 
)
static

Definition at line 808 of file hba.c.

References SockAddr::addr, and pg_range_sockaddr().

Referenced by check_hba(), and check_network_callback().

809 {
810  if (raddr->addr.ss_family == addr->sa_family &&
811  pg_range_sockaddr(&raddr->addr,
812  (struct sockaddr_storage *) addr,
813  (struct sockaddr_storage *) mask))
814  return true;
815  return false;
816 }
struct sockaddr_storage addr
Definition: pqcomm.h:64
int pg_range_sockaddr(const struct sockaddr_storage *addr, const struct sockaddr_storage *netaddr, const struct sockaddr_storage *netmask)
Definition: ifaddr.c:53

◆ check_network_callback()

static void check_network_callback ( struct sockaddr *  addr,
struct sockaddr *  netmask,
void *  cb_data 
)
static

Definition at line 822 of file hba.c.

References check_ip(), ipCmpSameHost, check_network_data::method, pg_sockaddr_cidr_mask(), check_network_data::raddr, and check_network_data::result.

Referenced by check_same_host_or_net().

824 {
825  check_network_data *cn = (check_network_data *) cb_data;
826  struct sockaddr_storage mask;
827 
828  /* Already found a match? */
829  if (cn->result)
830  return;
831 
832  if (cn->method == ipCmpSameHost)
833  {
834  /* Make an all-ones netmask of appropriate length for family */
835  pg_sockaddr_cidr_mask(&mask, NULL, addr->sa_family);
836  cn->result = check_ip(cn->raddr, addr, (struct sockaddr *) &mask);
837  }
838  else
839  {
840  /* Use the netmask of the interface itself */
841  cn->result = check_ip(cn->raddr, addr, netmask);
842  }
843 }
SockAddr * raddr
Definition: hba.c:63
IPCompareMethod method
Definition: hba.c:62
int pg_sockaddr_cidr_mask(struct sockaddr_storage *mask, char *numbits, int family)
Definition: ifaddr.c:115
static bool check_ip(SockAddr *raddr, struct sockaddr *addr, struct sockaddr *mask)
Definition: hba.c:808
bool result
Definition: hba.c:64

◆ check_role()

static bool check_role ( const char *  role,
Oid  roleid,
List tokens 
)
static

Definition at line 608 of file hba.c.

References is_member(), lfirst, HbaToken::quoted, HbaToken::string, token_is_keyword, and token_matches.

Referenced by check_hba().

609 {
610  ListCell *cell;
611  HbaToken *tok;
612 
613  foreach(cell, tokens)
614  {
615  tok = lfirst(cell);
616  if (!tok->quoted && tok->string[0] == '+')
617  {
618  if (is_member(roleid, tok->string + 1))
619  return true;
620  }
621  else if (token_matches(tok, role) ||
622  token_is_keyword(tok, "all"))
623  return true;
624  }
625  return false;
626 }
#define token_matches(t, k)
Definition: hba.c:69
Definition: hba.c:75
char * string
Definition: hba.c:77
bool quoted
Definition: hba.c:78
#define lfirst(lc)
Definition: pg_list.h:169
static bool is_member(Oid userid, const char *role)
Definition: hba.c:584
#define token_is_keyword(t, k)
Definition: hba.c:68

◆ check_same_host_or_net()

static bool check_same_host_or_net ( SockAddr raddr,
IPCompareMethod  method 
)
static

Definition at line 849 of file hba.c.

References check_network_callback(), ereport, errmsg(), LOG, check_network_data::method, pg_foreach_ifaddr(), check_network_data::raddr, and check_network_data::result.

Referenced by check_hba().

850 {
852 
853  cn.method = method;
854  cn.raddr = raddr;
855  cn.result = false;
856 
857  errno = 0;
859  {
860  ereport(LOG,
861  (errmsg("error enumerating network interfaces: %m")));
862  return false;
863  }
864 
865  return cn.result;
866 }
SockAddr * raddr
Definition: hba.c:63
#define LOG
Definition: elog.h:26
IPCompareMethod method
Definition: hba.c:62
int pg_foreach_ifaddr(PgIfAddrCallback callback, void *cb_data)
Definition: ifaddr.c:559
static void check_network_callback(struct sockaddr *addr, struct sockaddr *netmask, void *cb_data)
Definition: hba.c:822
#define ereport(elevel,...)
Definition: elog.h:155
bool result
Definition: hba.c:64
int errmsg(const char *fmt,...)
Definition: elog.c:905

◆ check_usermap()

int check_usermap ( const char *  usermap_name,
const char *  pg_role,
const char *  auth_user,
bool  case_insensitive 
)

Definition at line 2943 of file hba.c.

References check_ident_usermap(), ereport, errmsg(), error(), lfirst, LOG, pg_strcasecmp(), STATUS_ERROR, and STATUS_OK.

Referenced by auth_peer(), CheckSCRAMAuth(), and ident_inet().

2947 {
2948  bool found_entry = false,
2949  error = false;
2950 
2951  if (usermap_name == NULL || usermap_name[0] == '\0')
2952  {
2953  if (case_insensitive)
2954  {
2955  if (pg_strcasecmp(pg_role, auth_user) == 0)
2956  return STATUS_OK;
2957  }
2958  else
2959  {
2960  if (strcmp(pg_role, auth_user) == 0)
2961  return STATUS_OK;
2962  }
2963  ereport(LOG,
2964  (errmsg("provided user name (%s) and authenticated user name (%s) do not match",
2965  pg_role, auth_user)));
2966  return STATUS_ERROR;
2967  }
2968  else
2969  {
2970  ListCell *line_cell;
2971 
2972  foreach(line_cell, parsed_ident_lines)
2973  {
2974  check_ident_usermap(lfirst(line_cell), usermap_name,
2975  pg_role, auth_user, case_insensitive,
2976  &found_entry, &error);
2977  if (found_entry || error)
2978  break;
2979  }
2980  }
2981  if (!found_entry && !error)
2982  {
2983  ereport(LOG,
2984  (errmsg("no match in usermap \"%s\" for user \"%s\" authenticated as \"%s\"",
2985  usermap_name, pg_role, auth_user)));
2986  }
2987  return found_entry ? STATUS_OK : STATUS_ERROR;
2988 }
static void check_ident_usermap(IdentLine *identLine, const char *usermap_name, const char *pg_role, const char *ident_user, bool case_insensitive, bool *found_p, bool *error_p)
Definition: hba.c:2808
static void error(void)
Definition: sql-dyntest.c:147
#define STATUS_ERROR
Definition: c.h:1171
int pg_strcasecmp(const char *s1, const char *s2)
Definition: pgstrcasecmp.c:36
#define LOG
Definition: elog.h:26
#define STATUS_OK
Definition: c.h:1170
#define ereport(elevel,...)
Definition: elog.h:155
static List * parsed_ident_lines
Definition: hba.c:112
#define lfirst(lc)
Definition: pg_list.h:169
int errmsg(const char *fmt,...)
Definition: elog.c:905

◆ copy_hba_token()

static HbaToken* copy_hba_token ( HbaToken in)
static

Definition at line 315 of file hba.c.

References make_hba_token(), HbaToken::quoted, and HbaToken::string.

Referenced by parse_hba_line(), and tokenize_inc_file().

316 {
317  HbaToken *out = make_hba_token(in->string, in->quoted);
318 
319  return out;
320 }
Definition: hba.c:75
char * string
Definition: hba.c:77
bool quoted
Definition: hba.c:78
static HbaToken * make_hba_token(const char *token, bool quoted)
Definition: hba.c:296

◆ fill_hba_line()

static void fill_hba_line ( Tuplestorestate tuple_store,
TupleDesc  tupdesc,
int  lineno,
HbaLine hba,
const char *  err_msg 
)
static

Definition at line 2429 of file hba.c.

References HbaLine::addr, HbaLine::addrlen, Assert, HbaLine::auth_method, clean_ipv6_addr(), HbaLine::conntype, CStringGetTextDatum, ctHost, ctHostGSS, ctHostNoGSS, ctHostNoSSL, ctHostSSL, ctLocal, HbaLine::databases, gethba_options(), heap_form_tuple(), HbaLine::hostname, Int32GetDatum, HbaLine::ip_cmp_method, ipCmpAll, ipCmpMask, ipCmpSameHost, ipCmpSameNet, lappend(), lengthof, lfirst, HbaLine::mask, HbaLine::masklen, TupleDescData::natts, NI_MAXHOST, NI_NUMERICHOST, NIL, NUM_PG_HBA_FILE_RULES_ATTS, options, pg_getnameinfo_all(), PointerGetDatum, pstrdup(), HbaLine::roles, StaticAssertStmt, HbaToken::string, strlist_to_textarray(), tuplestore_puttuple(), USER_AUTH_LAST, UserAuthName, and values.

Referenced by fill_hba_view().

2431 {
2433  bool nulls[NUM_PG_HBA_FILE_RULES_ATTS];
2434  char buffer[NI_MAXHOST];
2435  HeapTuple tuple;
2436  int index;
2437  ListCell *lc;
2438  const char *typestr;
2439  const char *addrstr;
2440  const char *maskstr;
2441  ArrayType *options;
2442 
2444 
2445  memset(values, 0, sizeof(values));
2446  memset(nulls, 0, sizeof(nulls));
2447  index = 0;
2448 
2449  /* line_number */
2450  values[index++] = Int32GetDatum(lineno);
2451 
2452  if (hba != NULL)
2453  {
2454  /* type */
2455  /* Avoid a default: case so compiler will warn about missing cases */
2456  typestr = NULL;
2457  switch (hba->conntype)
2458  {
2459  case ctLocal:
2460  typestr = "local";
2461  break;
2462  case ctHost:
2463  typestr = "host";
2464  break;
2465  case ctHostSSL:
2466  typestr = "hostssl";
2467  break;
2468  case ctHostNoSSL:
2469  typestr = "hostnossl";
2470  break;
2471  case ctHostGSS:
2472  typestr = "hostgssenc";
2473  break;
2474  case ctHostNoGSS:
2475  typestr = "hostnogssenc";
2476  break;
2477  }
2478  if (typestr)
2479  values[index++] = CStringGetTextDatum(typestr);
2480  else
2481  nulls[index++] = true;
2482 
2483  /* database */
2484  if (hba->databases)
2485  {
2486  /*
2487  * Flatten HbaToken list to string list. It might seem that we
2488  * should re-quote any quoted tokens, but that has been rejected
2489  * on the grounds that it makes it harder to compare the array
2490  * elements to other system catalogs. That makes entries like
2491  * "all" or "samerole" formally ambiguous ... but users who name
2492  * databases/roles that way are inflicting their own pain.
2493  */
2494  List *names = NIL;
2495 
2496  foreach(lc, hba->databases)
2497  {
2498  HbaToken *tok = lfirst(lc);
2499 
2500  names = lappend(names, tok->string);
2501  }
2502  values[index++] = PointerGetDatum(strlist_to_textarray(names));
2503  }
2504  else
2505  nulls[index++] = true;
2506 
2507  /* user */
2508  if (hba->roles)
2509  {
2510  /* Flatten HbaToken list to string list; see comment above */
2511  List *roles = NIL;
2512 
2513  foreach(lc, hba->roles)
2514  {
2515  HbaToken *tok = lfirst(lc);
2516 
2517  roles = lappend(roles, tok->string);
2518  }
2519  values[index++] = PointerGetDatum(strlist_to_textarray(roles));
2520  }
2521  else
2522  nulls[index++] = true;
2523 
2524  /* address and netmask */
2525  /* Avoid a default: case so compiler will warn about missing cases */
2526  addrstr = maskstr = NULL;
2527  switch (hba->ip_cmp_method)
2528  {
2529  case ipCmpMask:
2530  if (hba->hostname)
2531  {
2532  addrstr = hba->hostname;
2533  }
2534  else
2535  {
2536  /*
2537  * Note: if pg_getnameinfo_all fails, it'll set buffer to
2538  * "???", which we want to return.
2539  */
2540  if (hba->addrlen > 0)
2541  {
2542  if (pg_getnameinfo_all(&hba->addr, hba->addrlen,
2543  buffer, sizeof(buffer),
2544  NULL, 0,
2545  NI_NUMERICHOST) == 0)
2546  clean_ipv6_addr(hba->addr.ss_family, buffer);
2547  addrstr = pstrdup(buffer);
2548  }
2549  if (hba->masklen > 0)
2550  {
2551  if (pg_getnameinfo_all(&hba->mask, hba->masklen,
2552  buffer, sizeof(buffer),
2553  NULL, 0,
2554  NI_NUMERICHOST) == 0)
2555  clean_ipv6_addr(hba->mask.ss_family, buffer);
2556  maskstr = pstrdup(buffer);
2557  }
2558  }
2559  break;
2560  case ipCmpAll:
2561  addrstr = "all";
2562  break;
2563  case ipCmpSameHost:
2564  addrstr = "samehost";
2565  break;
2566  case ipCmpSameNet:
2567  addrstr = "samenet";
2568  break;
2569  }
2570  if (addrstr)
2571  values[index++] = CStringGetTextDatum(addrstr);
2572  else
2573  nulls[index++] = true;
2574  if (maskstr)
2575  values[index++] = CStringGetTextDatum(maskstr);
2576  else
2577  nulls[index++] = true;
2578 
2579  /*
2580  * Make sure UserAuthName[] tracks additions to the UserAuth enum
2581  */
2583  "UserAuthName[] must match the UserAuth enum");
2584 
2585  /* auth_method */
2586  values[index++] = CStringGetTextDatum(UserAuthName[hba->auth_method]);
2587 
2588  /* options */
2589  options = gethba_options(hba);
2590  if (options)
2591  values[index++] = PointerGetDatum(options);
2592  else
2593  nulls[index++] = true;
2594  }
2595  else
2596  {
2597  /* no parsing result, so set relevant fields to nulls */
2598  memset(&nulls[1], true, (NUM_PG_HBA_FILE_RULES_ATTS - 2) * sizeof(bool));
2599  }
2600 
2601  /* error */
2602  if (err_msg)
2603  values[NUM_PG_HBA_FILE_RULES_ATTS - 1] = CStringGetTextDatum(err_msg);
2604  else
2605  nulls[NUM_PG_HBA_FILE_RULES_ATTS - 1] = true;
2606 
2607  tuple = heap_form_tuple(tupdesc, values, nulls);
2608  tuplestore_puttuple(tuple_store, tuple);
2609 }
List * databases
Definition: hba.h:79
#define NIL
Definition: pg_list.h:65
struct sockaddr_storage mask
Definition: hba.h:83
#define NI_NUMERICHOST
Definition: getaddrinfo.h:78
#define PointerGetDatum(X)
Definition: postgres.h:556
Definition: hba.h:51
char * pstrdup(const char *in)
Definition: mcxt.c:1187
HeapTuple heap_form_tuple(TupleDesc tupleDescriptor, Datum *values, bool *isnull)
Definition: heaptuple.c:1020
static const char *const UserAuthName[]
Definition: hba.c:121
#define lengthof(array)
Definition: c.h:734
Definition: type.h:89
#define StaticAssertStmt(condition, errmessage)
Definition: c.h:918
ConnType conntype
Definition: hba.h:78
Definition: hba.h:61
#define NI_MAXHOST
Definition: getaddrinfo.h:88
struct sockaddr_storage addr
Definition: hba.h:81
Definition: hba.h:63
void tuplestore_puttuple(Tuplestorestate *state, HeapTuple tuple)
Definition: tuplestore.c:730
Definition: hba.c:75
#define USER_AUTH_LAST
Definition: hba.h:42
Definition: hba.h:59
List * lappend(List *list, void *datum)
Definition: list.c:336
static char ** options
Definition: hba.h:54
uintptr_t Datum
Definition: postgres.h:367
char * hostname
Definition: hba.h:86
char * string
Definition: hba.c:77
List * roles
Definition: hba.h:80
#define Assert(condition)
Definition: c.h:804
#define lfirst(lc)
Definition: pg_list.h:169
int pg_getnameinfo_all(const struct sockaddr_storage *addr, int salen, char *node, int nodelen, char *service, int servicelen, int flags)
Definition: ip.c:122
#define NUM_PG_HBA_FILE_RULES_ATTS
Definition: hba.c:2414
void clean_ipv6_addr(int addr_family, char *addr)
Definition: network.c:2118
static Datum values[MAXATTR]
Definition: bootstrap.c:165
#define Int32GetDatum(X)
Definition: postgres.h:479
#define CStringGetTextDatum(s)
Definition: builtins.h:82
ArrayType * strlist_to_textarray(List *list)
IPCompareMethod ip_cmp_method
Definition: hba.h:85
int masklen
Definition: hba.h:84
int addrlen
Definition: hba.h:82
Definition: pg_list.h:50
Definition: hba.h:60
UserAuth auth_method
Definition: hba.h:87
static ArrayType * gethba_options(HbaLine *hba)
Definition: hba.c:2305

◆ fill_hba_view()

static void fill_hba_view ( Tuplestorestate tuple_store,
TupleDesc  tupdesc 
)
static

Definition at line 2615 of file hba.c.

References AllocateFile(), ALLOCSET_SMALL_SIZES, AllocSetContextCreate, CurrentMemoryContext, DEBUG3, ereport, TokenizedLine::err_msg, errcode_for_file_access(), errmsg(), ERROR, fill_hba_line(), FreeFile(), HbaFileName, lfirst, TokenizedLine::line_num, MemoryContextDelete(), MemoryContextSwitchTo(), NIL, parse_hba_line(), and tokenize_file().

Referenced by pg_hba_file_rules().

2616 {
2617  FILE *file;
2618  List *hba_lines = NIL;
2619  ListCell *line;
2620  MemoryContext linecxt;
2621  MemoryContext hbacxt;
2622  MemoryContext oldcxt;
2623 
2624  /*
2625  * In the unlikely event that we can't open pg_hba.conf, we throw an
2626  * error, rather than trying to report it via some sort of view entry.
2627  * (Most other error conditions should result in a message in a view
2628  * entry.)
2629  */
2630  file = AllocateFile(HbaFileName, "r");
2631  if (file == NULL)
2632  ereport(ERROR,
2634  errmsg("could not open configuration file \"%s\": %m",
2635  HbaFileName)));
2636 
2637  linecxt = tokenize_file(HbaFileName, file, &hba_lines, DEBUG3);
2638  FreeFile(file);
2639 
2640  /* Now parse all the lines */
2642  "hba parser context",
2644  oldcxt = MemoryContextSwitchTo(hbacxt);
2645  foreach(line, hba_lines)
2646  {
2647  TokenizedLine *tok_line = (TokenizedLine *) lfirst(line);
2648  HbaLine *hbaline = NULL;
2649 
2650  /* don't parse lines that already have errors */
2651  if (tok_line->err_msg == NULL)
2652  hbaline = parse_hba_line(tok_line, DEBUG3);
2653 
2654  fill_hba_line(tuple_store, tupdesc, tok_line->line_num,
2655  hbaline, tok_line->err_msg);
2656  }
2657 
2658  /* Free tokenizer memory */
2659  MemoryContextDelete(linecxt);
2660  /* Free parse_hba_line memory */
2661  MemoryContextSwitchTo(oldcxt);
2662  MemoryContextDelete(hbacxt);
2663 }
Definition: hba.h:74
#define NIL
Definition: pg_list.h:65
void MemoryContextDelete(MemoryContext context)
Definition: mcxt.c:212
#define AllocSetContextCreate
Definition: memutils.h:170
#define DEBUG3
Definition: elog.h:23
#define ALLOCSET_SMALL_SIZES
Definition: memutils.h:202
static MemoryContext MemoryContextSwitchTo(MemoryContext context)
Definition: palloc.h:109
char * HbaFileName
Definition: guc.c:559
#define ERROR
Definition: elog.h:45
int line_num
Definition: hba.c:92
char * err_msg
Definition: hba.c:94
int errcode_for_file_access(void)
Definition: elog.c:717
FILE * AllocateFile(const char *name, const char *mode)
Definition: fd.c:2354
MemoryContext CurrentMemoryContext
Definition: mcxt.c:38
static HbaLine * parse_hba_line(TokenizedLine *tok_line, int elevel)
Definition: hba.c:968
static void fill_hba_line(Tuplestorestate *tuple_store, TupleDesc tupdesc, int lineno, HbaLine *hba, const char *err_msg)
Definition: hba.c:2429
#define ereport(elevel,...)
Definition: elog.h:155
#define lfirst(lc)
Definition: pg_list.h:169
static MemoryContext tokenize_file(const char *filename, FILE *file, List **tok_lines, int elevel)
Definition: hba.c:478
int FreeFile(FILE *file)
Definition: fd.c:2553
int errmsg(const char *fmt,...)
Definition: elog.c:905
Definition: pg_list.h:50

◆ gethba_options()

static ArrayType * gethba_options ( HbaLine hba)
static

Definition at line 2305 of file hba.c.

References Assert, HbaLine::auth_method, HbaLine::clientcert, clientCertCA, clientCertOff, construct_array(), CStringGetTextDatum, HbaLine::include_realm, HbaLine::krb_realm, HbaLine::ldapbasedn, HbaLine::ldapbinddn, HbaLine::ldapbindpasswd, HbaLine::ldapport, HbaLine::ldapprefix, HbaLine::ldapscope, HbaLine::ldapsearchattribute, HbaLine::ldapsearchfilter, HbaLine::ldapserver, HbaLine::ldapsuffix, HbaLine::ldaptls, MAX_HBA_OPTIONS, noptions, HbaLine::pamservice, psprintf(), HbaLine::radiusidentifiers_s, HbaLine::radiusports_s, HbaLine::radiussecrets_s, HbaLine::radiusservers_s, uaGSS, uaLDAP, uaRADIUS, uaSSPI, and HbaLine::usermap.

Referenced by fill_hba_line().

2306 {
2307  int noptions;
2309 
2310  noptions = 0;
2311 
2312  if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
2313  {
2314  if (hba->include_realm)
2315  options[noptions++] =
2316  CStringGetTextDatum("include_realm=true");
2317 
2318  if (hba->krb_realm)
2319  options[noptions++] =
2320  CStringGetTextDatum(psprintf("krb_realm=%s", hba->krb_realm));
2321  }
2322 
2323  if (hba->usermap)
2324  options[noptions++] =
2325  CStringGetTextDatum(psprintf("map=%s", hba->usermap));
2326 
2327  if (hba->clientcert != clientCertOff)
2328  options[noptions++] =
2329  CStringGetTextDatum(psprintf("clientcert=%s", (hba->clientcert == clientCertCA) ? "verify-ca" : "verify-full"));
2330 
2331  if (hba->pamservice)
2332  options[noptions++] =
2333  CStringGetTextDatum(psprintf("pamservice=%s", hba->pamservice));
2334 
2335  if (hba->auth_method == uaLDAP)
2336  {
2337  if (hba->ldapserver)
2338  options[noptions++] =
2339  CStringGetTextDatum(psprintf("ldapserver=%s", hba->ldapserver));
2340 
2341  if (hba->ldapport)
2342  options[noptions++] =
2343  CStringGetTextDatum(psprintf("ldapport=%d", hba->ldapport));
2344 
2345  if (hba->ldaptls)
2346  options[noptions++] =
2347  CStringGetTextDatum("ldaptls=true");
2348 
2349  if (hba->ldapprefix)
2350  options[noptions++] =
2351  CStringGetTextDatum(psprintf("ldapprefix=%s", hba->ldapprefix));
2352 
2353  if (hba->ldapsuffix)
2354  options[noptions++] =
2355  CStringGetTextDatum(psprintf("ldapsuffix=%s", hba->ldapsuffix));
2356 
2357  if (hba->ldapbasedn)
2358  options[noptions++] =
2359  CStringGetTextDatum(psprintf("ldapbasedn=%s", hba->ldapbasedn));
2360 
2361  if (hba->ldapbinddn)
2362  options[noptions++] =
2363  CStringGetTextDatum(psprintf("ldapbinddn=%s", hba->ldapbinddn));
2364 
2365  if (hba->ldapbindpasswd)
2366  options[noptions++] =
2367  CStringGetTextDatum(psprintf("ldapbindpasswd=%s",
2368  hba->ldapbindpasswd));
2369 
2370  if (hba->ldapsearchattribute)
2371  options[noptions++] =
2372  CStringGetTextDatum(psprintf("ldapsearchattribute=%s",
2373  hba->ldapsearchattribute));
2374 
2375  if (hba->ldapsearchfilter)
2376  options[noptions++] =
2377  CStringGetTextDatum(psprintf("ldapsearchfilter=%s",
2378  hba->ldapsearchfilter));
2379 
2380  if (hba->ldapscope)
2381  options[noptions++] =
2382  CStringGetTextDatum(psprintf("ldapscope=%d", hba->ldapscope));
2383  }
2384 
2385  if (hba->auth_method == uaRADIUS)
2386  {
2387  if (hba->radiusservers_s)
2388  options[noptions++] =
2389  CStringGetTextDatum(psprintf("radiusservers=%s", hba->radiusservers_s));
2390 
2391  if (hba->radiussecrets_s)
2392  options[noptions++] =
2393  CStringGetTextDatum(psprintf("radiussecrets=%s", hba->radiussecrets_s));
2394 
2395  if (hba->radiusidentifiers_s)
2396  options[noptions++] =
2397  CStringGetTextDatum(psprintf("radiusidentifiers=%s", hba->radiusidentifiers_s));
2398 
2399  if (hba->radiusports_s)
2400  options[noptions++] =
2401  CStringGetTextDatum(psprintf("radiusports=%s", hba->radiusports_s));
2402  }
2403 
2404  /* If you add more options, consider increasing MAX_HBA_OPTIONS. */
2405  Assert(noptions <= MAX_HBA_OPTIONS);
2406 
2407  if (noptions > 0)
2408  return construct_array(options, noptions, TEXTOID, -1, false, TYPALIGN_INT);
2409  else
2410  return NULL;
2411 }
int ldapscope
Definition: hba.h:100
char * radiusports_s
Definition: hba.h:115
char * ldapserver
Definition: hba.h:93
Definition: hba.h:38
int ldapport
Definition: hba.h:94
char * ldapbasedn
Definition: hba.h:99
char * pamservice
Definition: hba.h:89
char * psprintf(const char *fmt,...)
Definition: psprintf.c:46
Definition: hba.h:35
ArrayType * construct_array(Datum *elems, int nelems, Oid elmtype, int elmlen, bool elmbyval, char elmalign)
Definition: arrayfuncs.c:3318
char * ldapsuffix
Definition: hba.h:102
Definition: hba.h:34
char * radiusservers_s
Definition: hba.h:109
char * usermap
Definition: hba.h:88
bool include_realm
Definition: hba.h:105
char * ldapbinddn
Definition: hba.h:95
char * krb_realm
Definition: hba.h:104
char * ldapbindpasswd
Definition: hba.h:96
char * ldapprefix
Definition: hba.h:101
uintptr_t Datum
Definition: postgres.h:367
char * radiusidentifiers_s
Definition: hba.h:113
char * radiussecrets_s
Definition: hba.h:111
#define Assert(condition)
Definition: c.h:804
char * ldapsearchfilter
Definition: hba.h:98
ClientCertMode clientcert
Definition: hba.h:103
bool ldaptls
Definition: hba.h:91
char * ldapsearchattribute
Definition: hba.h:97
#define CStringGetTextDatum(s)
Definition: builtins.h:82
static size_t noptions
Definition: hba.h:40
UserAuth auth_method
Definition: hba.h:87
#define MAX_HBA_OPTIONS
Definition: hba.c:2298

◆ hba_getauthmethod()

void hba_getauthmethod ( hbaPort port)

Definition at line 3109 of file hba.c.

References check_hba().

Referenced by ClientAuthentication().

3110 {
3111  check_hba(port);
3112 }
static void check_hba(hbaPort *port)
Definition: hba.c:2084

◆ hostname_match()

static bool hostname_match ( const char *  pattern,
const char *  actual_hostname 
)
static

Definition at line 695 of file hba.c.

References pg_strcasecmp().

Referenced by check_hostname().

696 {
697  if (pattern[0] == '.') /* suffix match */
698  {
699  size_t plen = strlen(pattern);
700  size_t hlen = strlen(actual_hostname);
701 
702  if (hlen < plen)
703  return false;
704 
705  return (pg_strcasecmp(pattern, actual_hostname + (hlen - plen)) == 0);
706  }
707  else
708  return (pg_strcasecmp(pattern, actual_hostname) == 0);
709 }
int pg_strcasecmp(const char *s1, const char *s2)
Definition: pgstrcasecmp.c:36

◆ ipv4eq()

static bool ipv4eq ( struct sockaddr_in *  a,
struct sockaddr_in *  b 
)
static

Definition at line 671 of file hba.c.

References i.

Referenced by check_hostname().

672 {
673  return (a->sin_addr.s_addr == b->sin_addr.s_addr);
674 }

◆ is_member()

static bool is_member ( Oid  userid,
const char *  role 
)
static

Definition at line 584 of file hba.c.

References get_role_oid(), is_member_of_role_nosuper(), and OidIsValid.

Referenced by check_db(), and check_role().

585 {
586  Oid roleid;
587 
588  if (!OidIsValid(userid))
589  return false; /* if user not exist, say "no" */
590 
591  roleid = get_role_oid(role, true);
592 
593  if (!OidIsValid(roleid))
594  return false; /* if target role not exist, say "no" */
595 
596  /*
597  * See if user is directly or indirectly a member of role. For this
598  * purpose, a superuser is not considered to be automatically a member of
599  * the role, so group auth only applies to explicit membership.
600  */
601  return is_member_of_role_nosuper(userid, roleid);
602 }
unsigned int Oid
Definition: postgres_ext.h:31
#define OidIsValid(objectId)
Definition: c.h:710
Oid get_role_oid(const char *rolname, bool missing_ok)
Definition: acl.c:5178
bool is_member_of_role_nosuper(Oid member, Oid role)
Definition: acl.c:4957

◆ load_hba()

bool load_hba ( void  )

Definition at line 2198 of file hba.c.

References AllocateFile(), ALLOCSET_SMALL_SIZES, AllocSetContextCreate, Assert, ereport, TokenizedLine::err_msg, errcode(), errcode_for_file_access(), errmsg(), FreeFile(), HbaFileName, lappend(), lfirst, LOG, MemoryContextDelete(), MemoryContextSwitchTo(), newline(), NIL, parse_hba_line(), PostmasterContext, and tokenize_file().

Referenced by PerformAuthentication(), PostmasterMain(), and SIGHUP_handler().

2199 {
2200  FILE *file;
2201  List *hba_lines = NIL;
2202  ListCell *line;
2203  List *new_parsed_lines = NIL;
2204  bool ok = true;
2205  MemoryContext linecxt;
2206  MemoryContext oldcxt;
2207  MemoryContext hbacxt;
2208 
2209  file = AllocateFile(HbaFileName, "r");
2210  if (file == NULL)
2211  {
2212  ereport(LOG,
2214  errmsg("could not open configuration file \"%s\": %m",
2215  HbaFileName)));
2216  return false;
2217  }
2218 
2219  linecxt = tokenize_file(HbaFileName, file, &hba_lines, LOG);
2220  FreeFile(file);
2221 
2222  /* Now parse all the lines */
2225  "hba parser context",
2227  oldcxt = MemoryContextSwitchTo(hbacxt);
2228  foreach(line, hba_lines)
2229  {
2230  TokenizedLine *tok_line = (TokenizedLine *) lfirst(line);
2231  HbaLine *newline;
2232 
2233  /* don't parse lines that already have errors */
2234  if (tok_line->err_msg != NULL)
2235  {
2236  ok = false;
2237  continue;
2238  }
2239 
2240  if ((newline = parse_hba_line(tok_line, LOG)) == NULL)
2241  {
2242  /* Parse error; remember there's trouble */
2243  ok = false;
2244 
2245  /*
2246  * Keep parsing the rest of the file so we can report errors on
2247  * more than the first line. Error has already been logged, no
2248  * need for more chatter here.
2249  */
2250  continue;
2251  }
2252 
2253  new_parsed_lines = lappend(new_parsed_lines, newline);
2254  }
2255 
2256  /*
2257  * A valid HBA file must have at least one entry; else there's no way to
2258  * connect to the postmaster. But only complain about this if we didn't
2259  * already have parsing errors.
2260  */
2261  if (ok && new_parsed_lines == NIL)
2262  {
2263  ereport(LOG,
2264  (errcode(ERRCODE_CONFIG_FILE_ERROR),
2265  errmsg("configuration file \"%s\" contains no entries",
2266  HbaFileName)));
2267  ok = false;
2268  }
2269 
2270  /* Free tokenizer memory */
2271  MemoryContextDelete(linecxt);
2272  MemoryContextSwitchTo(oldcxt);
2273 
2274  if (!ok)
2275  {
2276  /* File contained one or more errors, so bail out */
2277  MemoryContextDelete(hbacxt);
2278  return false;
2279  }
2280 
2281  /* Loaded new file successfully, replace the one we use */
2282  if (parsed_hba_context != NULL)
2284  parsed_hba_context = hbacxt;
2285  parsed_hba_lines = new_parsed_lines;
2286 
2287  return true;
2288 }
Definition: hba.h:74
#define NIL
Definition: pg_list.h:65
void MemoryContextDelete(MemoryContext context)
Definition: mcxt.c:212
#define AllocSetContextCreate
Definition: memutils.h:170
#define ALLOCSET_SMALL_SIZES
Definition: memutils.h:202
static MemoryContext MemoryContextSwitchTo(MemoryContext context)
Definition: palloc.h:109
int errcode(int sqlerrcode)
Definition: elog.c:694
#define LOG
Definition: elog.h:26
static chr newline(void)
Definition: regc_lex.c:1004
static List * parsed_hba_lines
Definition: hba.c:101
char * HbaFileName
Definition: guc.c:559
static MemoryContext parsed_hba_context
Definition: hba.c:102
char * err_msg
Definition: hba.c:94
int errcode_for_file_access(void)
Definition: elog.c:717
FILE * AllocateFile(const char *name, const char *mode)
Definition: fd.c:2354
List * lappend(List *list, void *datum)
Definition: list.c:336
static HbaLine * parse_hba_line(TokenizedLine *tok_line, int elevel)
Definition: hba.c:968
#define ereport(elevel,...)
Definition: elog.h:155
#define Assert(condition)
Definition: c.h:804
#define lfirst(lc)
Definition: pg_list.h:169
static MemoryContext tokenize_file(const char *filename, FILE *file, List **tok_lines, int elevel)
Definition: hba.c:478
int FreeFile(FILE *file)
Definition: fd.c:2553
int errmsg(const char *fmt,...)
Definition: elog.c:905
Definition: pg_list.h:50
MemoryContext PostmasterContext
Definition: mcxt.c:46

◆ load_ident()

bool load_ident ( void  )

Definition at line 2998 of file hba.c.

References AllocateFile(), ALLOCSET_SMALL_SIZES, AllocSetContextCreate, Assert, ereport, TokenizedLine::err_msg, errcode_for_file_access(), errmsg(), FreeFile(), IdentLine::ident_user, IdentFileName, lappend(), lfirst, LOG, MemoryContextDelete(), MemoryContextSwitchTo(), newline(), NIL, parse_ident_line(), pg_regfree(), PostmasterContext, IdentLine::re, and tokenize_file().

Referenced by PerformAuthentication(), PostmasterMain(), and SIGHUP_handler().

2999 {
3000  FILE *file;
3001  List *ident_lines = NIL;
3002  ListCell *line_cell,
3003  *parsed_line_cell;
3004  List *new_parsed_lines = NIL;
3005  bool ok = true;
3006  MemoryContext linecxt;
3007  MemoryContext oldcxt;
3008  MemoryContext ident_context;
3009  IdentLine *newline;
3010 
3011  file = AllocateFile(IdentFileName, "r");
3012  if (file == NULL)
3013  {
3014  /* not fatal ... we just won't do any special ident maps */
3015  ereport(LOG,
3017  errmsg("could not open usermap file \"%s\": %m",
3018  IdentFileName)));
3019  return false;
3020  }
3021 
3022  linecxt = tokenize_file(IdentFileName, file, &ident_lines, LOG);
3023  FreeFile(file);
3024 
3025  /* Now parse all the lines */
3027  ident_context = AllocSetContextCreate(PostmasterContext,
3028  "ident parser context",
3030  oldcxt = MemoryContextSwitchTo(ident_context);
3031  foreach(line_cell, ident_lines)
3032  {
3033  TokenizedLine *tok_line = (TokenizedLine *) lfirst(line_cell);
3034 
3035  /* don't parse lines that already have errors */
3036  if (tok_line->err_msg != NULL)
3037  {
3038  ok = false;
3039  continue;
3040  }
3041 
3042  if ((newline = parse_ident_line(tok_line)) == NULL)
3043  {
3044  /* Parse error; remember there's trouble */
3045  ok = false;
3046 
3047  /*
3048  * Keep parsing the rest of the file so we can report errors on
3049  * more than the first line. Error has already been logged, no
3050  * need for more chatter here.
3051  */
3052  continue;
3053  }
3054 
3055  new_parsed_lines = lappend(new_parsed_lines, newline);
3056  }
3057 
3058  /* Free tokenizer memory */
3059  MemoryContextDelete(linecxt);
3060  MemoryContextSwitchTo(oldcxt);
3061 
3062  if (!ok)
3063  {
3064  /*
3065  * File contained one or more errors, so bail out, first being careful
3066  * to clean up whatever we allocated. Most stuff will go away via
3067  * MemoryContextDelete, but we have to clean up regexes explicitly.
3068  */
3069  foreach(parsed_line_cell, new_parsed_lines)
3070  {
3071  newline = (IdentLine *) lfirst(parsed_line_cell);
3072  if (newline->ident_user[0] == '/')
3073  pg_regfree(&newline->re);
3074  }
3075  MemoryContextDelete(ident_context);
3076  return false;
3077  }
3078 
3079  /* Loaded new file successfully, replace the one we use */
3080  if (parsed_ident_lines != NIL)
3081  {
3082  foreach(parsed_line_cell, parsed_ident_lines)
3083  {
3084  newline = (IdentLine *) lfirst(parsed_line_cell);
3085  if (newline->ident_user[0] == '/')
3086  pg_regfree(&newline->re);
3087  }
3088  }
3089  if (parsed_ident_context != NULL)
3091 
3092  parsed_ident_context = ident_context;
3093  parsed_ident_lines = new_parsed_lines;
3094 
3095  return true;
3096 }
#define NIL
Definition: pg_list.h:65
void MemoryContextDelete(MemoryContext context)
Definition: mcxt.c:212
#define AllocSetContextCreate
Definition: memutils.h:170
regex_t re
Definition: hba.h:125
#define ALLOCSET_SMALL_SIZES
Definition: memutils.h:202
static MemoryContext MemoryContextSwitchTo(MemoryContext context)
Definition: palloc.h:109
#define LOG
Definition: elog.h:26
static chr newline(void)
Definition: regc_lex.c:1004
char * err_msg
Definition: hba.c:94
int errcode_for_file_access(void)
Definition: elog.c:717
FILE * AllocateFile(const char *name, const char *mode)
Definition: fd.c:2354
char * IdentFileName
Definition: guc.c:560
List * lappend(List *list, void *datum)
Definition: list.c:336
#define ereport(elevel,...)
Definition: elog.h:155
static List * parsed_ident_lines
Definition: hba.c:112
static MemoryContext parsed_ident_context
Definition: hba.c:113
#define Assert(condition)
Definition: c.h:804
#define lfirst(lc)
Definition: pg_list.h:169
static MemoryContext tokenize_file(const char *filename, FILE *file, List **tok_lines, int elevel)
Definition: hba.c:478
Definition: hba.h:118
int FreeFile(FILE *file)
Definition: fd.c:2553
char * ident_user
Definition: hba.h:123
int errmsg(const char *fmt,...)
Definition: elog.c:905
static IdentLine * parse_ident_line(TokenizedLine *tok_line)
Definition: hba.c:2731
void pg_regfree(regex_t *re)
Definition: regfree.c:49
Definition: pg_list.h:50
MemoryContext PostmasterContext
Definition: mcxt.c:46

◆ make_hba_token()

static HbaToken* make_hba_token ( const char *  token,
bool  quoted 
)
static

Definition at line 296 of file hba.c.

References palloc(), HbaToken::quoted, and HbaToken::string.

Referenced by copy_hba_token(), and next_field_expand().

297 {
298  HbaToken *hbatoken;
299  int toklen;
300 
301  toklen = strlen(token);
302  /* we copy string into same palloc block as the struct */
303  hbatoken = (HbaToken *) palloc(sizeof(HbaToken) + toklen + 1);
304  hbatoken->string = (char *) hbatoken + sizeof(HbaToken);
305  hbatoken->quoted = quoted;
306  memcpy(hbatoken->string, token, toklen + 1);
307 
308  return hbatoken;
309 }
Definition: hba.c:75
char * string
Definition: hba.c:77
bool quoted
Definition: hba.c:78
void * palloc(Size size)
Definition: mcxt.c:950

◆ next_field_expand()

static List* next_field_expand ( const char *  filename,
char **  lineptr,
int  elevel,
char **  err_msg 
)
static

Definition at line 338 of file hba.c.

References buf, lappend(), make_hba_token(), MAX_TOKEN, next_token(), NIL, and tokenize_inc_file().

Referenced by tokenize_file().

340 {
341  char buf[MAX_TOKEN];
342  bool trailing_comma;
343  bool initial_quote;
344  List *tokens = NIL;
345 
346  do
347  {
348  if (!next_token(lineptr, buf, sizeof(buf),
349  &initial_quote, &trailing_comma,
350  elevel, err_msg))
351  break;
352 
353  /* Is this referencing a file? */
354  if (!initial_quote && buf[0] == '@' && buf[1] != '\0')
355  tokens = tokenize_inc_file(tokens, filename, buf + 1,
356  elevel, err_msg);
357  else
358  tokens = lappend(tokens, make_hba_token(buf, initial_quote));
359  } while (trailing_comma && (*err_msg == NULL));
360 
361  return tokens;
362 }
#define NIL
Definition: pg_list.h:65
static bool next_token(char **lineptr, char *buf, int bufsz, bool *initial_quote, bool *terminating_comma, int elevel, char **err_msg)
Definition: hba.c:203
static char * buf
Definition: pg_test_fsync.c:68
List * lappend(List *list, void *datum)
Definition: list.c:336
static int elevel
Definition: vacuumlazy.c:333
#define MAX_TOKEN
Definition: hba.c:57
static char * filename
Definition: pg_dumpall.c:91
Definition: pg_list.h:50
static List * tokenize_inc_file(List *tokens, const char *outer_filename, const char *inc_filename, int elevel, char **err_msg)
Definition: hba.c:380
static HbaToken * make_hba_token(const char *token, bool quoted)
Definition: hba.c:296

◆ next_token()

static bool next_token ( char **  lineptr,
char *  buf,
int  bufsz,
bool initial_quote,
bool terminating_comma,
int  elevel,
char **  err_msg 
)
static

Definition at line 203 of file hba.c.

References Assert, buf, ereport, errcode(), errmsg(), and pg_isblank().

Referenced by base_yylex(), filtered_base_yylex(), and next_field_expand().

206 {
207  int c;
208  char *start_buf = buf;
209  char *end_buf = buf + (bufsz - 1);
210  bool in_quote = false;
211  bool was_quote = false;
212  bool saw_quote = false;
213 
214  Assert(end_buf > start_buf);
215 
216  *initial_quote = false;
217  *terminating_comma = false;
218 
219  /* Move over any whitespace and commas preceding the next token */
220  while ((c = (*(*lineptr)++)) != '\0' && (pg_isblank(c) || c == ','))
221  ;
222 
223  /*
224  * Build a token in buf of next characters up to EOL, unquoted comma, or
225  * unquoted whitespace.
226  */
227  while (c != '\0' &&
228  (!pg_isblank(c) || in_quote))
229  {
230  /* skip comments to EOL */
231  if (c == '#' && !in_quote)
232  {
233  while ((c = (*(*lineptr)++)) != '\0')
234  ;
235  break;
236  }
237 
238  if (buf >= end_buf)
239  {
240  *buf = '\0';
241  ereport(elevel,
242  (errcode(ERRCODE_CONFIG_FILE_ERROR),
243  errmsg("authentication file token too long, skipping: \"%s\"",
244  start_buf)));
245  *err_msg = "authentication file token too long";
246  /* Discard remainder of line */
247  while ((c = (*(*lineptr)++)) != '\0')
248  ;
249  /* Un-eat the '\0', in case we're called again */
250  (*lineptr)--;
251  return false;
252  }
253 
254  /* we do not pass back a terminating comma in the token */
255  if (c == ',' && !in_quote)
256  {
257  *terminating_comma = true;
258  break;
259  }
260 
261  if (c != '"' || was_quote)
262  *buf++ = c;
263 
264  /* Literal double-quote is two double-quotes */
265  if (in_quote && c == '"')
266  was_quote = !was_quote;
267  else
268  was_quote = false;
269 
270  if (c == '"')
271  {
272  in_quote = !in_quote;
273  saw_quote = true;
274  if (buf == start_buf)
275  *initial_quote = true;
276  }
277 
278  c = *(*lineptr)++;
279  }
280 
281  /*
282  * Un-eat the char right after the token (critical in case it is '\0',
283  * else next call will read past end of string).
284  */
285  (*lineptr)--;
286 
287  *buf = '\0';
288 
289  return (saw_quote || buf > start_buf);
290 }
bool pg_isblank(const char c)
Definition: hba.c:160
int errcode(int sqlerrcode)
Definition: elog.c:694
char * c
static char * buf
Definition: pg_test_fsync.c:68
static int elevel
Definition: vacuumlazy.c:333
#define ereport(elevel,...)
Definition: elog.h:155
#define Assert(condition)
Definition: c.h:804
int errmsg(const char *fmt,...)
Definition: elog.c:905

◆ parse_hba_auth_opt()

static bool parse_hba_auth_opt ( char *  name,
char *  val,
HbaLine hbaline,
int  elevel,
char **  err_msg 
)
static

Definition at line 1695 of file hba.c.

References addrinfo::ai_family, addrinfo::ai_socktype, HbaLine::auth_method, HbaLine::clientcert, clientCertCA, clientCertFull, HbaLine::compat_realm, HbaLine::conntype, ctHostSSL, ereport, errcode(), errcontext, errmsg(), gai_strerror, gettext_noop, HbaFileName, HbaLine::include_realm, INVALID_AUTH_OPTION, HbaLine::krb_realm, HbaLine::ldapbasedn, HbaLine::ldapbinddn, HbaLine::ldapbindpasswd, HbaLine::ldapport, HbaLine::ldapprefix, HbaLine::ldapscheme, HbaLine::ldapscope, HbaLine::ldapsearchattribute, HbaLine::ldapsearchfilter, HbaLine::ldapserver, HbaLine::ldapsuffix, HbaLine::ldaptls, lfirst, HbaLine::linenumber, list_free(), MemSet, HbaLine::pam_use_hostname, HbaLine::pamservice, pg_freeaddrinfo_all(), pg_getaddrinfo_all(), psprintf(), pstrdup(), HbaLine::radiusidentifiers, HbaLine::radiusidentifiers_s, HbaLine::radiusports, HbaLine::radiusports_s, HbaLine::radiussecrets, HbaLine::radiussecrets_s, HbaLine::radiusservers, HbaLine::radiusservers_s, REQUIRE_AUTH_OPTION, SplitGUCList(), uaCert, uaGSS, uaIdent, uaLDAP, uaPAM, uaRADIUS, uaSSPI, HbaLine::upn_username, and HbaLine::usermap.

Referenced by parse_hba_line().

1697 {
1698  int line_num = hbaline->linenumber;
1699 
1700 #ifdef USE_LDAP
1701  hbaline->ldapscope = LDAP_SCOPE_SUBTREE;
1702 #endif
1703 
1704  if (strcmp(name, "map") == 0)
1705  {
1706  if (hbaline->auth_method != uaIdent &&
1707  hbaline->auth_method != uaPeer &&
1708  hbaline->auth_method != uaGSS &&
1709  hbaline->auth_method != uaSSPI &&
1710  hbaline->auth_method != uaCert)
1711  INVALID_AUTH_OPTION("map", gettext_noop("ident, peer, gssapi, sspi, and cert"));
1712  hbaline->usermap = pstrdup(val);
1713  }
1714  else if (strcmp(name, "clientcert") == 0)
1715  {
1716  if (hbaline->conntype != ctHostSSL)
1717  {
1718  ereport(elevel,
1719  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1720  errmsg("clientcert can only be configured for \"hostssl\" rows"),
1721  errcontext("line %d of configuration file \"%s\"",
1722  line_num, HbaFileName)));
1723  *err_msg = "clientcert can only be configured for \"hostssl\" rows";
1724  return false;
1725  }
1726 
1727  if (strcmp(val, "verify-full") == 0)
1728  {
1729  hbaline->clientcert = clientCertFull;
1730  }
1731  else if (strcmp(val, "verify-ca") == 0)
1732  {
1733  if (hbaline->auth_method == uaCert)
1734  {
1735  ereport(elevel,
1736  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1737  errmsg("clientcert only accepts \"verify-full\" when using \"cert\" authentication"),
1738  errcontext("line %d of configuration file \"%s\"",
1739  line_num, HbaFileName)));
1740  *err_msg = "clientcert can only be set to \"verify-full\" when using \"cert\" authentication";
1741  return false;
1742  }
1743 
1744  hbaline->clientcert = clientCertCA;
1745  }
1746  else
1747  {
1748  ereport(elevel,
1749  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1750  errmsg("invalid value for clientcert: \"%s\"", val),
1751  errcontext("line %d of configuration file \"%s\"",
1752  line_num, HbaFileName)));
1753  return false;
1754  }
1755  }
1756  else if (strcmp(name, "pamservice") == 0)
1757  {
1758  REQUIRE_AUTH_OPTION(uaPAM, "pamservice", "pam");
1759  hbaline->pamservice = pstrdup(val);
1760  }
1761  else if (strcmp(name, "pam_use_hostname") == 0)
1762  {
1763  REQUIRE_AUTH_OPTION(uaPAM, "pam_use_hostname", "pam");
1764  if (strcmp(val, "1") == 0)
1765  hbaline->pam_use_hostname = true;
1766  else
1767  hbaline->pam_use_hostname = false;
1768 
1769  }
1770  else if (strcmp(name, "ldapurl") == 0)
1771  {
1772 #ifdef LDAP_API_FEATURE_X_OPENLDAP
1773  LDAPURLDesc *urldata;
1774  int rc;
1775 #endif
1776 
1777  REQUIRE_AUTH_OPTION(uaLDAP, "ldapurl", "ldap");
1778 #ifdef LDAP_API_FEATURE_X_OPENLDAP
1779  rc = ldap_url_parse(val, &urldata);
1780  if (rc != LDAP_SUCCESS)
1781  {
1782  ereport(elevel,
1783  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1784  errmsg("could not parse LDAP URL \"%s\": %s", val, ldap_err2string(rc))));
1785  *err_msg = psprintf("could not parse LDAP URL \"%s\": %s",
1786  val, ldap_err2string(rc));
1787  return false;
1788  }
1789 
1790  if (strcmp(urldata->lud_scheme, "ldap") != 0 &&
1791  strcmp(urldata->lud_scheme, "ldaps") != 0)
1792  {
1793  ereport(elevel,
1794  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1795  errmsg("unsupported LDAP URL scheme: %s", urldata->lud_scheme)));
1796  *err_msg = psprintf("unsupported LDAP URL scheme: %s",
1797  urldata->lud_scheme);
1798  ldap_free_urldesc(urldata);
1799  return false;
1800  }
1801 
1802  if (urldata->lud_scheme)
1803  hbaline->ldapscheme = pstrdup(urldata->lud_scheme);
1804  if (urldata->lud_host)
1805  hbaline->ldapserver = pstrdup(urldata->lud_host);
1806  hbaline->ldapport = urldata->lud_port;
1807  if (urldata->lud_dn)
1808  hbaline->ldapbasedn = pstrdup(urldata->lud_dn);
1809 
1810  if (urldata->lud_attrs)
1811  hbaline->ldapsearchattribute = pstrdup(urldata->lud_attrs[0]); /* only use first one */
1812  hbaline->ldapscope = urldata->lud_scope;
1813  if (urldata->lud_filter)
1814  hbaline->ldapsearchfilter = pstrdup(urldata->lud_filter);
1815  ldap_free_urldesc(urldata);
1816 #else /* not OpenLDAP */
1817  ereport(elevel,
1818  (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
1819  errmsg("LDAP URLs not supported on this platform")));
1820  *err_msg = "LDAP URLs not supported on this platform";
1821 #endif /* not OpenLDAP */
1822  }
1823  else if (strcmp(name, "ldaptls") == 0)
1824  {
1825  REQUIRE_AUTH_OPTION(uaLDAP, "ldaptls", "ldap");
1826  if (strcmp(val, "1") == 0)
1827  hbaline->ldaptls = true;
1828  else
1829  hbaline->ldaptls = false;
1830  }
1831  else if (strcmp(name, "ldapscheme") == 0)
1832  {
1833  REQUIRE_AUTH_OPTION(uaLDAP, "ldapscheme", "ldap");
1834  if (strcmp(val, "ldap") != 0 && strcmp(val, "ldaps") != 0)
1835  ereport(elevel,
1836  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1837  errmsg("invalid ldapscheme value: \"%s\"", val),
1838  errcontext("line %d of configuration file \"%s\"",
1839  line_num, HbaFileName)));
1840  hbaline->ldapscheme = pstrdup(val);
1841  }
1842  else if (strcmp(name, "ldapserver") == 0)
1843  {
1844  REQUIRE_AUTH_OPTION(uaLDAP, "ldapserver", "ldap");
1845  hbaline->ldapserver = pstrdup(val);
1846  }
1847  else if (strcmp(name, "ldapport") == 0)
1848  {
1849  REQUIRE_AUTH_OPTION(uaLDAP, "ldapport", "ldap");
1850  hbaline->ldapport = atoi(val);
1851  if (hbaline->ldapport == 0)
1852  {
1853  ereport(elevel,
1854  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1855  errmsg("invalid LDAP port number: \"%s\"", val),
1856  errcontext("line %d of configuration file \"%s\"",
1857  line_num, HbaFileName)));
1858  *err_msg = psprintf("invalid LDAP port number: \"%s\"", val);
1859  return false;
1860  }
1861  }
1862  else if (strcmp(name, "ldapbinddn") == 0)
1863  {
1864  REQUIRE_AUTH_OPTION(uaLDAP, "ldapbinddn", "ldap");
1865  hbaline->ldapbinddn = pstrdup(val);
1866  }
1867  else if (strcmp(name, "ldapbindpasswd") == 0)
1868  {
1869  REQUIRE_AUTH_OPTION(uaLDAP, "ldapbindpasswd", "ldap");
1870  hbaline->ldapbindpasswd = pstrdup(val);
1871  }
1872  else if (strcmp(name, "ldapsearchattribute") == 0)
1873  {
1874  REQUIRE_AUTH_OPTION(uaLDAP, "ldapsearchattribute", "ldap");
1875  hbaline->ldapsearchattribute = pstrdup(val);
1876  }
1877  else if (strcmp(name, "ldapsearchfilter") == 0)
1878  {
1879  REQUIRE_AUTH_OPTION(uaLDAP, "ldapsearchfilter", "ldap");
1880  hbaline->ldapsearchfilter = pstrdup(val);
1881  }
1882  else if (strcmp(name, "ldapbasedn") == 0)
1883  {
1884  REQUIRE_AUTH_OPTION(uaLDAP, "ldapbasedn", "ldap");
1885  hbaline->ldapbasedn = pstrdup(val);
1886  }
1887  else if (strcmp(name, "ldapprefix") == 0)
1888  {
1889  REQUIRE_AUTH_OPTION(uaLDAP, "ldapprefix", "ldap");
1890  hbaline->ldapprefix = pstrdup(val);
1891  }
1892  else if (strcmp(name, "ldapsuffix") == 0)
1893  {
1894  REQUIRE_AUTH_OPTION(uaLDAP, "ldapsuffix", "ldap");
1895  hbaline->ldapsuffix = pstrdup(val);
1896  }
1897  else if (strcmp(name, "krb_realm") == 0)
1898  {
1899  if (hbaline->auth_method != uaGSS &&
1900  hbaline->auth_method != uaSSPI)
1901  INVALID_AUTH_OPTION("krb_realm", gettext_noop("gssapi and sspi"));
1902  hbaline->krb_realm = pstrdup(val);
1903  }
1904  else if (strcmp(name, "include_realm") == 0)
1905  {
1906  if (hbaline->auth_method != uaGSS &&
1907  hbaline->auth_method != uaSSPI)
1908  INVALID_AUTH_OPTION("include_realm", gettext_noop("gssapi and sspi"));
1909  if (strcmp(val, "1") == 0)
1910  hbaline->include_realm = true;
1911  else
1912  hbaline->include_realm = false;
1913  }
1914  else if (strcmp(name, "compat_realm") == 0)
1915  {
1916  if (hbaline->auth_method != uaSSPI)
1917  INVALID_AUTH_OPTION("compat_realm", gettext_noop("sspi"));
1918  if (strcmp(val, "1") == 0)
1919  hbaline->compat_realm = true;
1920  else
1921  hbaline->compat_realm = false;
1922  }
1923  else if (strcmp(name, "upn_username") == 0)
1924  {
1925  if (hbaline->auth_method != uaSSPI)
1926  INVALID_AUTH_OPTION("upn_username", gettext_noop("sspi"));
1927  if (strcmp(val, "1") == 0)
1928  hbaline->upn_username = true;
1929  else
1930  hbaline->upn_username = false;
1931  }
1932  else if (strcmp(name, "radiusservers") == 0)
1933  {
1934  struct addrinfo *gai_result;
1935  struct addrinfo hints;
1936  int ret;
1937  List *parsed_servers;
1938  ListCell *l;
1939  char *dupval = pstrdup(val);
1940 
1941  REQUIRE_AUTH_OPTION(uaRADIUS, "radiusservers", "radius");
1942 
1943  if (!SplitGUCList(dupval, ',', &parsed_servers))
1944  {
1945  /* syntax error in list */
1946  ereport(elevel,
1947  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1948  errmsg("could not parse RADIUS server list \"%s\"",
1949  val),
1950  errcontext("line %d of configuration file \"%s\"",
1951  line_num, HbaFileName)));
1952  return false;
1953  }
1954 
1955  /* For each entry in the list, translate it */
1956  foreach(l, parsed_servers)
1957  {
1958  MemSet(&hints, 0, sizeof(hints));
1959  hints.ai_socktype = SOCK_DGRAM;
1960  hints.ai_family = AF_UNSPEC;
1961 
1962  ret = pg_getaddrinfo_all((char *) lfirst(l), NULL, &hints, &gai_result);
1963  if (ret || !gai_result)
1964  {
1965  ereport(elevel,
1966  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1967  errmsg("could not translate RADIUS server name \"%s\" to address: %s",
1968  (char *) lfirst(l), gai_strerror(ret)),
1969  errcontext("line %d of configuration file \"%s\"",
1970  line_num, HbaFileName)));
1971  if (gai_result)
1972  pg_freeaddrinfo_all(hints.ai_family, gai_result);
1973 
1974  list_free(parsed_servers);
1975  return false;
1976  }
1977  pg_freeaddrinfo_all(hints.ai_family, gai_result);
1978  }
1979 
1980  /* All entries are OK, so store them */
1981  hbaline->radiusservers = parsed_servers;
1982  hbaline->radiusservers_s = pstrdup(val);
1983  }
1984  else if (strcmp(name, "radiusports") == 0)
1985  {
1986  List *parsed_ports;
1987  ListCell *l;
1988  char *dupval = pstrdup(val);
1989 
1990  REQUIRE_AUTH_OPTION(uaRADIUS, "radiusports", "radius");
1991 
1992  if (!SplitGUCList(dupval, ',', &parsed_ports))
1993  {
1994  ereport(elevel,
1995  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1996  errmsg("could not parse RADIUS port list \"%s\"",
1997  val),
1998  errcontext("line %d of configuration file \"%s\"",
1999  line_num, HbaFileName)));
2000  *err_msg = psprintf("invalid RADIUS port number: \"%s\"", val);
2001  return false;
2002  }
2003 
2004  foreach(l, parsed_ports)
2005  {
2006  if (atoi(lfirst(l)) == 0)
2007  {
2008  ereport(elevel,
2009  (errcode(ERRCODE_CONFIG_FILE_ERROR),
2010  errmsg("invalid RADIUS port number: \"%s\"", val),
2011  errcontext("line %d of configuration file \"%s\"",
2012  line_num, HbaFileName)));
2013 
2014  return false;
2015  }
2016  }
2017  hbaline->radiusports = parsed_ports;
2018  hbaline->radiusports_s = pstrdup(val);
2019  }
2020  else if (strcmp(name, "radiussecrets") == 0)
2021  {
2022  List *parsed_secrets;
2023  char *dupval = pstrdup(val);
2024 
2025  REQUIRE_AUTH_OPTION(uaRADIUS, "radiussecrets", "radius");
2026 
2027  if (!SplitGUCList(dupval, ',', &parsed_secrets))
2028  {
2029  /* syntax error in list */
2030  ereport(elevel,
2031  (errcode(ERRCODE_CONFIG_FILE_ERROR),
2032  errmsg("could not parse RADIUS secret list \"%s\"",
2033  val),
2034  errcontext("line %d of configuration file \"%s\"",
2035  line_num, HbaFileName)));
2036  return false;
2037  }
2038 
2039  hbaline->radiussecrets = parsed_secrets;
2040  hbaline->radiussecrets_s = pstrdup(val);
2041  }
2042  else if (strcmp(name, "radiusidentifiers") == 0)
2043  {
2044  List *parsed_identifiers;
2045  char *dupval = pstrdup(val);
2046 
2047  REQUIRE_AUTH_OPTION(uaRADIUS, "radiusidentifiers", "radius");
2048 
2049  if (!SplitGUCList(dupval, ',', &parsed_identifiers))
2050  {
2051  /* syntax error in list */
2052  ereport(elevel,
2053  (errcode(ERRCODE_CONFIG_FILE_ERROR),
2054  errmsg("could not parse RADIUS identifiers list \"%s\"",
2055  val),
2056  errcontext("line %d of configuration file \"%s\"",
2057  line_num, HbaFileName)));
2058  return false;
2059  }
2060 
2061  hbaline->radiusidentifiers = parsed_identifiers;
2062  hbaline->radiusidentifiers_s = pstrdup(val);
2063  }
2064  else
2065  {
2066  ereport(elevel,
2067  (errcode(ERRCODE_CONFIG_FILE_ERROR),
2068  errmsg("unrecognized authentication option name: \"%s\"",
2069  name),
2070  errcontext("line %d of configuration file \"%s\"",
2071  line_num, HbaFileName)));
2072  *err_msg = psprintf("unrecognized authentication option name: \"%s\"",
2073  name);
2074  return false;
2075  }
2076  return true;
2077 }
int ldapscope
Definition: hba.h:100
char * radiusports_s
Definition: hba.h:115
Definition: hba.h:30
char * ldapserver
Definition: hba.h:93
#define REQUIRE_AUTH_OPTION(methodval, optname, validmethods)
Definition: hba.c:897
void pg_freeaddrinfo_all(int hint_ai_family, struct addrinfo *ai)
Definition: ip.c:88
Definition: hba.h:38
int ldapport
Definition: hba.h:94
char * ldapbasedn
Definition: hba.h:99
char * ldapscheme
Definition: hba.h:92
char * pamservice
Definition: hba.h:89
char * pstrdup(const char *in)
Definition: mcxt.c:1187
char * psprintf(const char *fmt,...)
Definition: psprintf.c:46
Definition: hba.h:35
#define gettext_noop(x)
Definition: c.h:1197
int errcode(int sqlerrcode)
Definition: elog.c:694
#define MemSet(start, val, len)
Definition: c.h:1008
List * radiussecrets
Definition: hba.h:110
#define gai_strerror
Definition: getaddrinfo.h:146
char * ldapsuffix
Definition: hba.h:102
char * HbaFileName
Definition: guc.c:559
int pg_getaddrinfo_all(const char *hostname, const char *servname, const struct addrinfo *hintp, struct addrinfo **result)
Definition: ip.c:57
#define INVALID_AUTH_OPTION(optname, validmethods)
Definition: hba.c:883
Definition: hba.h:34
ConnType conntype
Definition: hba.h:78
char * radiusservers_s
Definition: hba.h:109
Definition: hba.h:61
bool pam_use_hostname
Definition: hba.h:90
Definition: hba.h:39
char * usermap
Definition: hba.h:88
List * radiusports
Definition: hba.h:114
List * radiusservers
Definition: hba.h:108
bool include_realm
Definition: hba.h:105
char * ldapbinddn
Definition: hba.h:95
char * krb_realm
Definition: hba.h:104
int linenumber
Definition: hba.h:76
char * ldapbindpasswd
Definition: hba.h:96
char * ldapprefix
Definition: hba.h:101
static int elevel
Definition: vacuumlazy.c:333
char * radiusidentifiers_s
Definition: hba.h:113
List * radiusidentifiers
Definition: hba.h:112
char * radiussecrets_s
Definition: hba.h:111
#define ereport(elevel,...)
Definition: elog.h:155
#define lfirst(lc)
Definition: pg_list.h:169
char * ldapsearchfilter
Definition: hba.h:98
ClientCertMode clientcert
Definition: hba.h:103
bool ldaptls
Definition: hba.h:91
char * ldapsearchattribute
Definition: hba.h:97
const char * name
Definition: encode.c:515
bool upn_username
Definition: hba.h:107
int errmsg(const char *fmt,...)
Definition: elog.c:905
void list_free(List *list)
Definition: list.c:1391
#define errcontext
Definition: elog.h:199
bool SplitGUCList(char *rawstring, char separator, List **namelist)
Definition: varlena.c:3989
Definition: pg_list.h:50
Definition: hba.h:36
bool compat_realm
Definition: hba.h:106
long val
Definition: informix.c:664
Definition: hba.h:40
UserAuth auth_method
Definition: hba.h:87

◆ parse_hba_line()

static HbaLine* parse_hba_line ( TokenizedLine tok_line,
int  elevel 
)
static

Definition at line 968 of file hba.c.

References HbaLine::addr, HbaLine::addrlen, addrinfo::ai_addr, addrinfo::ai_addrlen, addrinfo::ai_canonname, addrinfo::ai_family, addrinfo::ai_flags, addrinfo::ai_next, AI_NUMERICHOST, addrinfo::ai_protocol, addrinfo::ai_socktype, Assert, HbaLine::auth_method, HbaLine::clientcert, clientCertCA, HbaLine::compat_realm, HbaLine::conntype, copy_hba_token(), ctHost, ctHostGSS, ctHostNoGSS, ctHostNoSSL, ctHostSSL, ctLocal, HbaLine::databases, Db_user_namespace, EAI_NONAME, EnableSSL, ereport, TokenizedLine::err_msg, errcode(), errcontext, errhint(), errmsg(), TokenizedLine::fields, gai_strerror, HbaFileName, HbaLine::hostname, HbaLine::include_realm, HbaLine::ip_cmp_method, ipCmpAll, ipCmpMask, ipCmpSameHost, ipCmpSameNet, lappend(), HbaLine::ldapbasedn, HbaLine::ldapbinddn, HbaLine::ldapbindpasswd, HbaLine::ldapprefix, HbaLine::ldapsearchattribute, HbaLine::ldapsearchfilter, HbaLine::ldapserver, HbaLine::ldapsuffix, List::length, lfirst, TokenizedLine::line_num, HbaLine::linenumber, linitial, list_head(), list_length(), lnext(), LOG, MANDATORY_AUTH_ARG, HbaLine::mask, HbaLine::masklen, NIL, palloc0(), parse_hba_auth_opt(), pfree(), pg_freeaddrinfo_all(), pg_getaddrinfo_all(), pg_sockaddr_cidr_mask(), psprintf(), pstrdup(), HbaLine::radiusidentifiers, HbaLine::radiusports, HbaLine::radiussecrets, HbaLine::radiusservers, TokenizedLine::raw_line, HbaLine::rawline, HbaLine::roles, generate_unaccent_rules::str, HbaToken::string, token_is_keyword, uaBSD, uaCert, uaGSS, uaIdent, uaLDAP, uaMD5, uaPAM, uaPassword, uaRADIUS, uaReject, uaSCRAM, uaSSPI, uaTrust, HbaLine::upn_username, val, and verify_option_list_length().

Referenced by fill_hba_view(), and load_hba().

969 {
970  int line_num = tok_line->line_num;
971  char **err_msg = &tok_line->err_msg;
972  char *str;
973  struct addrinfo *gai_result;
974  struct addrinfo hints;
975  int ret;
976  char *cidr_slash;
977  char *unsupauth;
978  ListCell *field;
979  List *tokens;
980  ListCell *tokencell;
981  HbaToken *token;
982  HbaLine *parsedline;
983 
984  parsedline = palloc0(sizeof(HbaLine));
985  parsedline->linenumber = line_num;
986  parsedline->rawline = pstrdup(tok_line->raw_line);
987 
988  /* Check the record type. */
989  Assert(tok_line->fields != NIL);
990  field = list_head(tok_line->fields);
991  tokens = lfirst(field);
992  if (tokens->length > 1)
993  {
994  ereport(elevel,
995  (errcode(ERRCODE_CONFIG_FILE_ERROR),
996  errmsg("multiple values specified for connection type"),
997  errhint("Specify exactly one connection type per line."),
998  errcontext("line %d of configuration file \"%s\"",
999  line_num, HbaFileName)));
1000  *err_msg = "multiple values specified for connection type";
1001  return NULL;
1002  }
1003  token = linitial(tokens);
1004  if (strcmp(token->string, "local") == 0)
1005  {
1006 #ifdef HAVE_UNIX_SOCKETS
1007  parsedline->conntype = ctLocal;
1008 #else
1009  ereport(elevel,
1010  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1011  errmsg("local connections are not supported by this build"),
1012  errcontext("line %d of configuration file \"%s\"",
1013  line_num, HbaFileName)));
1014  *err_msg = "local connections are not supported by this build";
1015  return NULL;
1016 #endif
1017  }
1018  else if (strcmp(token->string, "host") == 0 ||
1019  strcmp(token->string, "hostssl") == 0 ||
1020  strcmp(token->string, "hostnossl") == 0 ||
1021  strcmp(token->string, "hostgssenc") == 0 ||
1022  strcmp(token->string, "hostnogssenc") == 0)
1023  {
1024 
1025  if (token->string[4] == 's') /* "hostssl" */
1026  {
1027  parsedline->conntype = ctHostSSL;
1028  /* Log a warning if SSL support is not active */
1029 #ifdef USE_SSL
1030  if (!EnableSSL)
1031  {
1032  ereport(elevel,
1033  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1034  errmsg("hostssl record cannot match because SSL is disabled"),
1035  errhint("Set ssl = on in postgresql.conf."),
1036  errcontext("line %d of configuration file \"%s\"",
1037  line_num, HbaFileName)));
1038  *err_msg = "hostssl record cannot match because SSL is disabled";
1039  }
1040 #else
1041  ereport(elevel,
1042  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1043  errmsg("hostssl record cannot match because SSL is not supported by this build"),
1044  errhint("Compile with --with-ssl to use SSL connections."),
1045  errcontext("line %d of configuration file \"%s\"",
1046  line_num, HbaFileName)));
1047  *err_msg = "hostssl record cannot match because SSL is not supported by this build";
1048 #endif
1049  }
1050  else if (token->string[4] == 'g') /* "hostgssenc" */
1051  {
1052  parsedline->conntype = ctHostGSS;
1053 #ifndef ENABLE_GSS
1054  ereport(elevel,
1055  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1056  errmsg("hostgssenc record cannot match because GSSAPI is not supported by this build"),
1057  errhint("Compile with --with-gssapi to use GSSAPI connections."),
1058  errcontext("line %d of configuration file \"%s\"",
1059  line_num, HbaFileName)));
1060  *err_msg = "hostgssenc record cannot match because GSSAPI is not supported by this build";
1061 #endif
1062  }
1063  else if (token->string[4] == 'n' && token->string[6] == 's')
1064  parsedline->conntype = ctHostNoSSL;
1065  else if (token->string[4] == 'n' && token->string[6] == 'g')
1066  parsedline->conntype = ctHostNoGSS;
1067  else
1068  {
1069  /* "host" */
1070  parsedline->conntype = ctHost;
1071  }
1072  } /* record type */
1073  else
1074  {
1075  ereport(elevel,
1076  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1077  errmsg("invalid connection type \"%s\"",
1078  token->string),
1079  errcontext("line %d of configuration file \"%s\"",
1080  line_num, HbaFileName)));
1081  *err_msg = psprintf("invalid connection type \"%s\"", token->string);
1082  return NULL;
1083  }
1084 
1085  /* Get the databases. */
1086  field = lnext(tok_line->fields, field);
1087  if (!field)
1088  {
1089  ereport(elevel,
1090  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1091  errmsg("end-of-line before database specification"),
1092  errcontext("line %d of configuration file \"%s\"",
1093  line_num, HbaFileName)));
1094  *err_msg = "end-of-line before database specification";
1095  return NULL;
1096  }
1097  parsedline->databases = NIL;
1098  tokens = lfirst(field);
1099  foreach(tokencell, tokens)
1100  {
1101  parsedline->databases = lappend(parsedline->databases,
1102  copy_hba_token(lfirst(tokencell)));
1103  }
1104 
1105  /* Get the roles. */
1106  field = lnext(tok_line->fields, field);
1107  if (!field)
1108  {
1109  ereport(elevel,
1110  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1111  errmsg("end-of-line before role specification"),
1112  errcontext("line %d of configuration file \"%s\"",
1113  line_num, HbaFileName)));
1114  *err_msg = "end-of-line before role specification";
1115  return NULL;
1116  }
1117  parsedline->roles = NIL;
1118  tokens = lfirst(field);
1119  foreach(tokencell, tokens)
1120  {
1121  parsedline->roles = lappend(parsedline->roles,
1122  copy_hba_token(lfirst(tokencell)));
1123  }
1124 
1125  if (parsedline->conntype != ctLocal)
1126  {
1127  /* Read the IP address field. (with or without CIDR netmask) */
1128  field = lnext(tok_line->fields, field);
1129  if (!field)
1130  {
1131  ereport(elevel,
1132  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1133  errmsg("end-of-line before IP address specification"),
1134  errcontext("line %d of configuration file \"%s\"",
1135  line_num, HbaFileName)));
1136  *err_msg = "end-of-line before IP address specification";
1137  return NULL;
1138  }
1139  tokens = lfirst(field);
1140  if (tokens->length > 1)
1141  {
1142  ereport(elevel,
1143  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1144  errmsg("multiple values specified for host address"),
1145  errhint("Specify one address range per line."),
1146  errcontext("line %d of configuration file \"%s\"",
1147  line_num, HbaFileName)));
1148  *err_msg = "multiple values specified for host address";
1149  return NULL;
1150  }
1151  token = linitial(tokens);
1152 
1153  if (token_is_keyword(token, "all"))
1154  {
1155  parsedline->ip_cmp_method = ipCmpAll;
1156  }
1157  else if (token_is_keyword(token, "samehost"))
1158  {
1159  /* Any IP on this host is allowed to connect */
1160  parsedline->ip_cmp_method = ipCmpSameHost;
1161  }
1162  else if (token_is_keyword(token, "samenet"))
1163  {
1164  /* Any IP on the host's subnets is allowed to connect */
1165  parsedline->ip_cmp_method = ipCmpSameNet;
1166  }
1167  else
1168  {
1169  /* IP and netmask are specified */
1170  parsedline->ip_cmp_method = ipCmpMask;
1171 
1172  /* need a modifiable copy of token */
1173  str = pstrdup(token->string);
1174 
1175  /* Check if it has a CIDR suffix and if so isolate it */
1176  cidr_slash = strchr(str, '/');
1177  if (cidr_slash)
1178  *cidr_slash = '\0';
1179 
1180  /* Get the IP address either way */
1181  hints.ai_flags = AI_NUMERICHOST;
1182  hints.ai_family = AF_UNSPEC;
1183  hints.ai_socktype = 0;
1184  hints.ai_protocol = 0;
1185  hints.ai_addrlen = 0;
1186  hints.ai_canonname = NULL;
1187  hints.ai_addr = NULL;
1188  hints.ai_next = NULL;
1189 
1190  ret = pg_getaddrinfo_all(str, NULL, &hints, &gai_result);
1191  if (ret == 0 && gai_result)
1192  {
1193  memcpy(&parsedline->addr, gai_result->ai_addr,
1194  gai_result->ai_addrlen);
1195  parsedline->addrlen = gai_result->ai_addrlen;
1196  }
1197  else if (ret == EAI_NONAME)
1198  parsedline->hostname = str;
1199  else
1200  {
1201  ereport(elevel,
1202  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1203  errmsg("invalid IP address \"%s\": %s",
1204  str, gai_strerror(ret)),
1205  errcontext("line %d of configuration file \"%s\"",
1206  line_num, HbaFileName)));
1207  *err_msg = psprintf("invalid IP address \"%s\": %s",
1208  str, gai_strerror(ret));
1209  if (gai_result)
1210  pg_freeaddrinfo_all(hints.ai_family, gai_result);
1211  return NULL;
1212  }
1213 
1214  pg_freeaddrinfo_all(hints.ai_family, gai_result);
1215 
1216  /* Get the netmask */
1217  if (cidr_slash)
1218  {
1219  if (parsedline->hostname)
1220  {
1221  ereport(elevel,
1222  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1223  errmsg("specifying both host name and CIDR mask is invalid: \"%s\"",
1224  token->string),
1225  errcontext("line %d of configuration file \"%s\"",
1226  line_num, HbaFileName)));
1227  *err_msg = psprintf("specifying both host name and CIDR mask is invalid: \"%s\"",
1228  token->string);
1229  return NULL;
1230  }
1231 
1232  if (pg_sockaddr_cidr_mask(&parsedline->mask, cidr_slash + 1,
1233  parsedline->addr.ss_family) < 0)
1234  {
1235  ereport(elevel,
1236  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1237  errmsg("invalid CIDR mask in address \"%s\"",
1238  token->string),
1239  errcontext("line %d of configuration file \"%s\"",
1240  line_num, HbaFileName)));
1241  *err_msg = psprintf("invalid CIDR mask in address \"%s\"",
1242  token->string);
1243  return NULL;
1244  }
1245  parsedline->masklen = parsedline->addrlen;
1246  pfree(str);
1247  }
1248  else if (!parsedline->hostname)
1249  {
1250  /* Read the mask field. */
1251  pfree(str);
1252  field = lnext(tok_line->fields, field);
1253  if (!field)
1254  {
1255  ereport(elevel,
1256  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1257  errmsg("end-of-line before netmask specification"),
1258  errhint("Specify an address range in CIDR notation, or provide a separate netmask."),
1259  errcontext("line %d of configuration file \"%s\"",
1260  line_num, HbaFileName)));
1261  *err_msg = "end-of-line before netmask specification";
1262  return NULL;
1263  }
1264  tokens = lfirst(field);
1265  if (tokens->length > 1)
1266  {
1267  ereport(elevel,
1268  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1269  errmsg("multiple values specified for netmask"),
1270  errcontext("line %d of configuration file \"%s\"",
1271  line_num, HbaFileName)));
1272  *err_msg = "multiple values specified for netmask";
1273  return NULL;
1274  }
1275  token = linitial(tokens);
1276 
1277  ret = pg_getaddrinfo_all(token->string, NULL,
1278  &hints, &gai_result);
1279  if (ret || !gai_result)
1280  {
1281  ereport(elevel,
1282  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1283  errmsg("invalid IP mask \"%s\": %s",
1284  token->string, gai_strerror(ret)),
1285  errcontext("line %d of configuration file \"%s\"",
1286  line_num, HbaFileName)));
1287  *err_msg = psprintf("invalid IP mask \"%s\": %s",
1288  token->string, gai_strerror(ret));
1289  if (gai_result)
1290  pg_freeaddrinfo_all(hints.ai_family, gai_result);
1291  return NULL;
1292  }
1293 
1294  memcpy(&parsedline->mask, gai_result->ai_addr,
1295  gai_result->ai_addrlen);
1296  parsedline->masklen = gai_result->ai_addrlen;
1297  pg_freeaddrinfo_all(hints.ai_family, gai_result);
1298 
1299  if (parsedline->addr.ss_family != parsedline->mask.ss_family)
1300  {
1301  ereport(elevel,
1302  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1303  errmsg("IP address and mask do not match"),
1304  errcontext("line %d of configuration file \"%s\"",
1305  line_num, HbaFileName)));
1306  *err_msg = "IP address and mask do not match";
1307  return NULL;
1308  }
1309  }
1310  }
1311  } /* != ctLocal */
1312 
1313  /* Get the authentication method */
1314  field = lnext(tok_line->fields, field);
1315  if (!field)
1316  {
1317  ereport(elevel,
1318  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1319  errmsg("end-of-line before authentication method"),
1320  errcontext("line %d of configuration file \"%s\"",
1321  line_num, HbaFileName)));
1322  *err_msg = "end-of-line before authentication method";
1323  return NULL;
1324  }
1325  tokens = lfirst(field);
1326  if (tokens->length > 1)
1327  {
1328  ereport(elevel,
1329  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1330  errmsg("multiple values specified for authentication type"),
1331  errhint("Specify exactly one authentication type per line."),
1332  errcontext("line %d of configuration file \"%s\"",
1333  line_num, HbaFileName)));
1334  *err_msg = "multiple values specified for authentication type";
1335  return NULL;
1336  }
1337  token = linitial(tokens);
1338 
1339  unsupauth = NULL;
1340  if (strcmp(token->string, "trust") == 0)
1341  parsedline->auth_method = uaTrust;
1342  else if (strcmp(token->string, "ident") == 0)
1343  parsedline->auth_method = uaIdent;
1344  else if (strcmp(token->string, "peer") == 0)
1345  parsedline->auth_method = uaPeer;
1346  else if (strcmp(token->string, "password") == 0)
1347  parsedline->auth_method = uaPassword;
1348  else if (strcmp(token->string, "gss") == 0)
1349 #ifdef ENABLE_GSS
1350  parsedline->auth_method = uaGSS;
1351 #else
1352  unsupauth = "gss";
1353 #endif
1354  else if (strcmp(token->string, "sspi") == 0)
1355 #ifdef ENABLE_SSPI
1356  parsedline->auth_method = uaSSPI;
1357 #else
1358  unsupauth = "sspi";
1359 #endif
1360  else if (strcmp(token->string, "reject") == 0)
1361  parsedline->auth_method = uaReject;
1362  else if (strcmp(token->string, "md5") == 0)
1363  {
1364  if (Db_user_namespace)
1365  {
1366  ereport(elevel,
1367  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1368  errmsg("MD5 authentication is not supported when \"db_user_namespace\" is enabled"),
1369  errcontext("line %d of configuration file \"%s\"",
1370  line_num, HbaFileName)));
1371  *err_msg = "MD5 authentication is not supported when \"db_user_namespace\" is enabled";
1372  return NULL;
1373  }
1374  parsedline->auth_method = uaMD5;
1375  }
1376  else if (strcmp(token->string, "scram-sha-256") == 0)
1377  parsedline->auth_method = uaSCRAM;
1378  else if (strcmp(token->string, "pam") == 0)
1379 #ifdef USE_PAM
1380  parsedline->auth_method = uaPAM;
1381 #else
1382  unsupauth = "pam";
1383 #endif
1384  else if (strcmp(token->string, "bsd") == 0)
1385 #ifdef USE_BSD_AUTH
1386  parsedline->auth_method = uaBSD;
1387 #else
1388  unsupauth = "bsd";
1389 #endif
1390  else if (strcmp(token->string, "ldap") == 0)
1391 #ifdef USE_LDAP
1392  parsedline->auth_method = uaLDAP;
1393 #else
1394  unsupauth = "ldap";
1395 #endif
1396  else if (strcmp(token->string, "cert") == 0)
1397 #ifdef USE_SSL
1398  parsedline->auth_method = uaCert;
1399 #else
1400  unsupauth = "cert";
1401 #endif
1402  else if (strcmp(token->string, "radius") == 0)
1403  parsedline->auth_method = uaRADIUS;
1404  else
1405  {
1406  ereport(elevel,
1407  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1408  errmsg("invalid authentication method \"%s\"",
1409  token->string),
1410  errcontext("line %d of configuration file \"%s\"",
1411  line_num, HbaFileName)));
1412  *err_msg = psprintf("invalid authentication method \"%s\"",
1413  token->string);
1414  return NULL;
1415  }
1416 
1417  if (unsupauth)
1418  {
1419  ereport(elevel,
1420  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1421  errmsg("invalid authentication method \"%s\": not supported by this build",
1422  token->string),
1423  errcontext("line %d of configuration file \"%s\"",
1424  line_num, HbaFileName)));
1425  *err_msg = psprintf("invalid authentication method \"%s\": not supported by this build",
1426  token->string);
1427  return NULL;
1428  }
1429 
1430  /*
1431  * XXX: When using ident on local connections, change it to peer, for
1432  * backwards compatibility.
1433  */
1434  if (parsedline->conntype == ctLocal &&
1435  parsedline->auth_method == uaIdent)
1436  parsedline->auth_method = uaPeer;
1437 
1438  /* Invalid authentication combinations */
1439  if (parsedline->conntype == ctLocal &&
1440  parsedline->auth_method == uaGSS)
1441  {
1442  ereport(elevel,
1443  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1444  errmsg("gssapi authentication is not supported on local sockets"),
1445  errcontext("line %d of configuration file \"%s\"",
1446  line_num, HbaFileName)));
1447  *err_msg = "gssapi authentication is not supported on local sockets";
1448  return NULL;
1449  }
1450 
1451  if (parsedline->conntype != ctLocal &&
1452  parsedline->auth_method == uaPeer)
1453  {
1454  ereport(elevel,
1455  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1456  errmsg("peer authentication is only supported on local sockets"),
1457  errcontext("line %d of configuration file \"%s\"",
1458  line_num, HbaFileName)));
1459  *err_msg = "peer authentication is only supported on local sockets";
1460  return NULL;
1461  }
1462 
1463  /*
1464  * SSPI authentication can never be enabled on ctLocal connections,
1465  * because it's only supported on Windows, where ctLocal isn't supported.
1466  */
1467 
1468 
1469  if (parsedline->conntype != ctHostSSL &&
1470  parsedline->auth_method == uaCert)
1471  {
1472  ereport(elevel,
1473  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1474  errmsg("cert authentication is only supported on hostssl connections"),
1475  errcontext("line %d of configuration file \"%s\"",
1476  line_num, HbaFileName)));
1477  *err_msg = "cert authentication is only supported on hostssl connections";
1478  return NULL;
1479  }
1480 
1481  /*
1482  * For GSS and SSPI, set the default value of include_realm to true.
1483  * Having include_realm set to false is dangerous in multi-realm
1484  * situations and is generally considered bad practice. We keep the
1485  * capability around for backwards compatibility, but we might want to
1486  * remove it at some point in the future. Users who still need to strip
1487  * the realm off would be better served by using an appropriate regex in a
1488  * pg_ident.conf mapping.
1489  */
1490  if (parsedline->auth_method == uaGSS ||
1491  parsedline->auth_method == uaSSPI)
1492  parsedline->include_realm = true;
1493 
1494  /*
1495  * For SSPI, include_realm defaults to the SAM-compatible domain (aka
1496  * NetBIOS name) and user names instead of the Kerberos principal name for
1497  * compatibility.
1498  */
1499  if (parsedline->auth_method == uaSSPI)
1500  {
1501  parsedline->compat_realm = true;
1502  parsedline->upn_username = false;
1503  }
1504 
1505  /* Parse remaining arguments */
1506  while ((field = lnext(tok_line->fields, field)) != NULL)
1507  {
1508  tokens = lfirst(field);
1509  foreach(tokencell, tokens)
1510  {
1511  char *val;
1512 
1513  token = lfirst(tokencell);
1514 
1515  str = pstrdup(token->string);
1516  val = strchr(str, '=');
1517  if (val == NULL)
1518  {
1519  /*
1520  * Got something that's not a name=value pair.
1521  */
1522  ereport(elevel,
1523  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1524  errmsg("authentication option not in name=value format: %s", token->string),
1525  errcontext("line %d of configuration file \"%s\"",
1526  line_num, HbaFileName)));
1527  *err_msg = psprintf("authentication option not in name=value format: %s",
1528  token->string);
1529  return NULL;
1530  }
1531 
1532  *val++ = '\0'; /* str now holds "name", val holds "value" */
1533  if (!parse_hba_auth_opt(str, val, parsedline, elevel, err_msg))
1534  /* parse_hba_auth_opt already logged the error message */
1535  return NULL;
1536  pfree(str);
1537  }
1538  }
1539 
1540  /*
1541  * Check if the selected authentication method has any mandatory arguments
1542  * that are not set.
1543  */
1544  if (parsedline->auth_method == uaLDAP)
1545  {
1546 #ifndef HAVE_LDAP_INITIALIZE
1547  /* Not mandatory for OpenLDAP, because it can use DNS SRV records */
1548  MANDATORY_AUTH_ARG(parsedline->ldapserver, "ldapserver", "ldap");
1549 #endif
1550 
1551  /*
1552  * LDAP can operate in two modes: either with a direct bind, using
1553  * ldapprefix and ldapsuffix, or using a search+bind, using
1554  * ldapbasedn, ldapbinddn, ldapbindpasswd and one of
1555  * ldapsearchattribute or ldapsearchfilter. Disallow mixing these
1556  * parameters.
1557  */
1558  if (parsedline->ldapprefix || parsedline->ldapsuffix)
1559  {
1560  if (parsedline->ldapbasedn ||
1561  parsedline->ldapbinddn ||
1562  parsedline->ldapbindpasswd ||
1563  parsedline->ldapsearchattribute ||
1564  parsedline->ldapsearchfilter)
1565  {
1566  ereport(elevel,
1567  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1568  errmsg("cannot use ldapbasedn, ldapbinddn, ldapbindpasswd, ldapsearchattribute, ldapsearchfilter, or ldapurl together with ldapprefix"),
1569  errcontext("line %d of configuration file \"%s\"",
1570  line_num, HbaFileName)));
1571  *err_msg = "cannot use ldapbasedn, ldapbinddn, ldapbindpasswd, ldapsearchattribute, ldapsearchfilter, or ldapurl together with ldapprefix";
1572  return NULL;
1573  }
1574  }
1575  else if (!parsedline->ldapbasedn)
1576  {
1577  ereport(elevel,
1578  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1579  errmsg("authentication method \"ldap\" requires argument \"ldapbasedn\", \"ldapprefix\", or \"ldapsuffix\" to be set"),
1580  errcontext("line %d of configuration file \"%s\"",
1581  line_num, HbaFileName)));
1582  *err_msg = "authentication method \"ldap\" requires argument \"ldapbasedn\", \"ldapprefix\", or \"ldapsuffix\" to be set";
1583  return NULL;
1584  }
1585 
1586  /*
1587  * When using search+bind, you can either use a simple attribute
1588  * (defaulting to "uid") or a fully custom search filter. You can't
1589  * do both.
1590  */
1591  if (parsedline->ldapsearchattribute && parsedline->ldapsearchfilter)
1592  {
1593  ereport(elevel,
1594  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1595  errmsg("cannot use ldapsearchattribute together with ldapsearchfilter"),
1596  errcontext("line %d of configuration file \"%s\"",
1597  line_num, HbaFileName)));
1598  *err_msg = "cannot use ldapsearchattribute together with ldapsearchfilter";
1599  return NULL;
1600  }
1601  }
1602 
1603  if (parsedline->auth_method == uaRADIUS)
1604  {
1605  MANDATORY_AUTH_ARG(parsedline->radiusservers, "radiusservers", "radius");
1606  MANDATORY_AUTH_ARG(parsedline->radiussecrets, "radiussecrets", "radius");
1607 
1608  if (list_length(parsedline->radiusservers) < 1)
1609  {
1610  ereport(LOG,
1611  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1612  errmsg("list of RADIUS servers cannot be empty"),
1613  errcontext("line %d of configuration file \"%s\"",
1614  line_num, HbaFileName)));
1615  return NULL;
1616  }
1617 
1618  if (list_length(parsedline->radiussecrets) < 1)
1619  {
1620  ereport(LOG,
1621  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1622  errmsg("list of RADIUS secrets cannot be empty"),
1623  errcontext("line %d of configuration file \"%s\"",
1624  line_num, HbaFileName)));
1625  return NULL;
1626  }
1627 
1628  /*
1629  * Verify length of option lists - each can be 0 (except for secrets,
1630  * but that's already checked above), 1 (use the same value
1631  * everywhere) or the same as the number of servers.
1632  */
1633  if (!verify_option_list_length(parsedline->radiussecrets,
1634  "RADIUS secrets",
1635  parsedline->radiusservers,
1636  "RADIUS servers",
1637  line_num))
1638  return NULL;
1639  if (!verify_option_list_length(parsedline->radiusports,
1640  "RADIUS ports",
1641  parsedline->radiusservers,
1642  "RADIUS servers",
1643  line_num))
1644  return NULL;
1646  "RADIUS identifiers",
1647  parsedline->radiusservers,
1648  "RADIUS servers",
1649  line_num))
1650  return NULL;
1651  }
1652 
1653  /*
1654  * Enforce any parameters implied by other settings.
1655  */
1656  if (parsedline->auth_method == uaCert)
1657  {
1658  parsedline->clientcert = clientCertCA;
1659  }
1660 
1661  return parsedline;
1662 }
List * databases
Definition: hba.h:79
Definition: hba.h:74
#define NIL
Definition: pg_list.h:65
Definition: hba.h:30
bool EnableSSL
Definition: postmaster.c:233
char * ldapserver
Definition: hba.h:93
void pg_freeaddrinfo_all(int hint_ai_family, struct addrinfo *ai)
Definition: ip.c:88
struct sockaddr_storage mask
Definition: hba.h:83
int errhint(const char *fmt,...)
Definition: elog.c:1152
Definition: hba.h:38
char * ldapbasedn
Definition: hba.h:99
static ListCell * lnext(const List *l, const ListCell *c)
Definition: pg_list.h:322
Definition: hba.h:32
static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int elevel, char **err_msg)
Definition: hba.c:1695
Definition: hba.h:51
char * pstrdup(const char *in)
Definition: mcxt.c:1187
char * psprintf(const char *fmt,...)
Definition: psprintf.c:46
Definition: hba.h:35
int errcode(int sqlerrcode)
Definition: elog.c:694
#define LOG
Definition: elog.h:26
#define AI_NUMERICHOST
Definition: getaddrinfo.h:73
List * radiussecrets
Definition: hba.h:110
#define gai_strerror
Definition: getaddrinfo.h:146
char * ldapsuffix
Definition: hba.h:102
char * HbaFileName
Definition: guc.c:559
int pg_getaddrinfo_all(const char *hostname, const char *servname, const struct addrinfo *hintp, struct addrinfo **result)
Definition: ip.c:57
Definition: hba.h:34
Definition: hba.h:31
ConnType conntype
Definition: hba.h:78
void pfree(void *pointer)
Definition: mcxt.c:1057
Definition: hba.h:61
#define linitial(l)
Definition: pg_list.h:174
Definition: hba.h:39
int pg_sockaddr_cidr_mask(struct sockaddr_storage *mask, char *numbits, int family)
Definition: ifaddr.c:115
struct sockaddr_storage addr
Definition: hba.h:81
Definition: hba.h:63
int line_num
Definition: hba.c:92
List * radiusports
Definition: hba.h:114
Definition: hba.h:27
List * radiusservers
Definition: hba.h:108
bool include_realm
Definition: hba.h:105
Definition: hba.h:29
bool Db_user_namespace
Definition: postmaster.c:240
char * err_msg
Definition: hba.c:94
Definition: hba.c:75
char * ldapbinddn
Definition: hba.h:95
#define EAI_NONAME
Definition: getaddrinfo.h:34
static ListCell * list_head(const List *l)
Definition: pg_list.h:125
int linenumber
Definition: hba.h:76
#define MANDATORY_AUTH_ARG(argvar, argname, authname)
Definition: hba.c:903
char * ldapbindpasswd
Definition: hba.h:96
List * fields
Definition: hba.c:91
static bool verify_option_list_length(List *options, const char *optionname, List *comparelist, const char *comparename, int line_num)
Definition: hba.c:1666
char * ldapprefix
Definition: hba.h:101
Definition: hba.h:59
List * lappend(List *list, void *datum)
Definition: list.c:336
static int elevel
Definition: vacuumlazy.c:333
Definition: hba.h:33
Definition: hba.h:54
void * palloc0(Size size)
Definition: mcxt.c:981
char * hostname
Definition: hba.h:86
char * string
Definition: hba.c:77
List * radiusidentifiers
Definition: hba.h:112
Definition: hba.h:37
#define ereport(elevel,...)
Definition: elog.h:155
List * roles
Definition: hba.h:80
#define Assert(condition)
Definition: c.h:804
#define lfirst(lc)
Definition: pg_list.h:169
char * ldapsearchfilter
Definition: hba.h:98
ClientCertMode clientcert
Definition: hba.h:103
static int list_length(const List *l)
Definition: pg_list.h:149
char * ldapsearchattribute
Definition: hba.h:97
int length
Definition: pg_list.h:53
char * rawline
Definition: hba.h:77
static HbaToken * copy_hba_token(HbaToken *in)
Definition: hba.c:315
bool upn_username
Definition: hba.h:107
int errmsg(const char *fmt,...)
Definition: elog.c:905
#define token_is_keyword(t, k)
Definition: hba.c:68
#define errcontext
Definition: elog.h:199
size_t ai_addrlen
Definition: getaddrinfo.h:104
char * raw_line
Definition: hba.c:93
IPCompareMethod ip_cmp_method
Definition: hba.h:85
int masklen
Definition: hba.h:84
int addrlen
Definition: hba.h:82
Definition: pg_list.h:50
Definition: hba.h:36
bool compat_realm
Definition: hba.h:106
long val
Definition: informix.c:664
Definition: hba.h:60
Definition: hba.h:40
UserAuth auth_method
Definition: hba.h:87
struct sockaddr * ai_addr
Definition: getaddrinfo.h:105

◆ parse_ident_line()

static IdentLine* parse_ident_line ( TokenizedLine tok_line)
static

Definition at line 2731 of file hba.c.

References Assert, ereport, errcode(), errmsg(), TokenizedLine::fields, IDENT_FIELD_ABSENT, IDENT_MULTI_VALUE, IdentLine::ident_user, lfirst, TokenizedLine::line_num, IdentLine::linenumber, linitial, list_head(), lnext(), LOG, NIL, palloc(), palloc0(), pfree(), pg_mb2wchar_with_len(), pg_regcomp(), pg_regerror(), IdentLine::pg_role, pstrdup(), IdentLine::re, REG_ADVANCED, HbaToken::string, and IdentLine::usermap.

Referenced by load_ident().

2732 {
2733  int line_num = tok_line->line_num;
2734  ListCell *field;
2735  List *tokens;
2736  HbaToken *token;
2737  IdentLine *parsedline;
2738 
2739  Assert(tok_line->fields != NIL);
2740  field = list_head(tok_line->fields);
2741 
2742  parsedline = palloc0(sizeof(IdentLine));
2743  parsedline->linenumber = line_num;
2744 
2745  /* Get the map token (must exist) */
2746  tokens = lfirst(field);
2747  IDENT_MULTI_VALUE(tokens);
2748  token = linitial(tokens);
2749  parsedline->usermap = pstrdup(token->string);
2750 
2751  /* Get the ident user token */
2752  field = lnext(tok_line->fields, field);
2753  IDENT_FIELD_ABSENT(field);
2754  tokens = lfirst(field);
2755  IDENT_MULTI_VALUE(tokens);
2756  token = linitial(tokens);
2757  parsedline->ident_user = pstrdup(token->string);
2758 
2759  /* Get the PG rolename token */
2760  field = lnext(tok_line->fields, field);
2761  IDENT_FIELD_ABSENT(field);
2762  tokens = lfirst(field);
2763  IDENT_MULTI_VALUE(tokens);
2764  token = linitial(tokens);
2765  parsedline->pg_role = pstrdup(token->string);
2766 
2767  if (parsedline->ident_user[0] == '/')
2768  {
2769  /*
2770  * When system username starts with a slash, treat it as a regular
2771  * expression. Pre-compile it.
2772  */
2773  int r;
2774  pg_wchar *wstr;
2775  int wlen;
2776 
2777  wstr = palloc((strlen(parsedline->ident_user + 1) + 1) * sizeof(pg_wchar));
2778  wlen = pg_mb2wchar_with_len(parsedline->ident_user + 1,
2779  wstr, strlen(parsedline->ident_user + 1));
2780 
2781  r = pg_regcomp(&parsedline->re, wstr, wlen, REG_ADVANCED, C_COLLATION_OID);
2782  if (r)
2783  {
2784  char errstr[100];
2785 
2786  pg_regerror(r, &parsedline->re, errstr, sizeof(errstr));
2787  ereport(LOG,
2788  (errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
2789  errmsg("invalid regular expression \"%s\": %s",
2790  parsedline->ident_user + 1, errstr)));
2791 
2792  pfree(wstr);
2793  return NULL;
2794  }
2795  pfree(wstr);
2796  }
2797 
2798  return parsedline;
2799 }
#define NIL
Definition: pg_list.h:65
static ListCell * lnext(const List *l, const ListCell *c)
Definition: pg_list.h:322
regex_t re
Definition: hba.h:125
char * pstrdup(const char *in)
Definition: mcxt.c:1187
int errcode(int sqlerrcode)
Definition: elog.c:694
#define LOG
Definition: elog.h:26
int pg_regcomp(regex_t *re, const chr *string, size_t len, int flags, Oid collation)
Definition: regcomp.c:329
#define IDENT_FIELD_ABSENT(field)
Definition: hba.c:931
int linenumber
Definition: hba.h:120
void pfree(void *pointer)
Definition: mcxt.c:1057
#define linitial(l)
Definition: pg_list.h:174
int line_num
Definition: hba.c:92
char * usermap
Definition: hba.h:122
Definition: hba.c:75
static ListCell * list_head(const List *l)
Definition: pg_list.h:125
size_t pg_regerror(int errcode, const regex_t *preg, char *errbuf, size_t errbuf_size)
Definition: regerror.c:60
#define REG_ADVANCED
Definition: regex.h:105
List * fields
Definition: hba.c:91
unsigned int pg_wchar
Definition: mbprint.c:31
#define IDENT_MULTI_VALUE(tokens)
Definition: hba.c:942
void * palloc0(Size size)
Definition: mcxt.c:981
char * string
Definition: hba.c:77
int pg_mb2wchar_with_len(const char *from, pg_wchar *to, int len)
Definition: mbutils.c:870
#define ereport(elevel,...)
Definition: elog.h:155
#define Assert(condition)
Definition: c.h:804
#define lfirst(lc)
Definition: pg_list.h:169
Definition: hba.h:118
char * ident_user
Definition: hba.h:123
void * palloc(Size size)
Definition: mcxt.c:950
int errmsg(const char *fmt,...)
Definition: elog.c:905
Definition: pg_list.h:50
char * pg_role
Definition: hba.h:124

◆ pg_hba_file_rules()

Datum pg_hba_file_rules ( PG_FUNCTION_ARGS  )

Definition at line 2669 of file hba.c.

References ReturnSetInfo::allowedModes, ReturnSetInfo::econtext, ExprContext::ecxt_per_query_memory, elog, ereport, errcode(), errmsg(), ERROR, fill_hba_view(), get_call_result_type(), IsA, MemoryContextSwitchTo(), PG_RETURN_NULL, ReturnSetInfo::returnMode, ReturnSetInfo::setDesc, ReturnSetInfo::setResult, SFRM_Materialize, SFRM_Materialize_Random, tuplestore_begin_heap(), TYPEFUNC_COMPOSITE, and work_mem.

2670 {
2671  Tuplestorestate *tuple_store;
2672  TupleDesc tupdesc;
2673  MemoryContext old_cxt;
2674  ReturnSetInfo *rsi;
2675 
2676  /*
2677  * We must use the Materialize mode to be safe against HBA file changes
2678  * while the cursor is open. It's also more efficient than having to look
2679  * up our current position in the parsed list every time.
2680  */
2681  rsi = (ReturnSetInfo *) fcinfo->resultinfo;
2682 
2683  /* Check to see if caller supports us returning a tuplestore */
2684  if (rsi == NULL || !IsA(rsi, ReturnSetInfo))
2685  ereport(ERROR,
2686  (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
2687  errmsg("set-valued function called in context that cannot accept a set")));
2688  if (!(rsi->allowedModes & SFRM_Materialize))
2689  ereport(ERROR,
2690  (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
2691  errmsg("materialize mode required, but it is not allowed in this context")));
2692 
2694 
2695  /* Build a tuple descriptor for our result type */
2696  if (get_call_result_type(fcinfo, NULL, &tupdesc) != TYPEFUNC_COMPOSITE)
2697  elog(ERROR, "return type must be a row type");
2698 
2699  /* Build tuplestore to hold the result rows */
2701 
2702  tuple_store =
2704  false, work_mem);
2705  rsi->setDesc = tupdesc;
2706  rsi->setResult = tuple_store;
2707 
2708  MemoryContextSwitchTo(old_cxt);
2709 
2710  /* Fill the tuplestore */
2711  fill_hba_view(tuple_store, tupdesc);
2712 
2713  PG_RETURN_NULL();
2714 }
#define IsA(nodeptr, _type_)
Definition: nodes.h:584
TypeFuncClass get_call_result_type(FunctionCallInfo fcinfo, Oid *resultTypeId, TupleDesc *resultTupleDesc)
Definition: funcapi.c:207
static MemoryContext MemoryContextSwitchTo(MemoryContext context)
Definition: palloc.h:109
int errcode(int sqlerrcode)
Definition: elog.c:694
#define ERROR
Definition: elog.h:45
Tuplestorestate * tuplestore_begin_heap(bool randomAccess, bool interXact, int maxKBytes)
Definition: tuplestore.c:318
static void fill_hba_view(Tuplestorestate *tuple_store, TupleDesc tupdesc)
Definition: hba.c:2615
int work_mem
Definition: globals.c:122
#define ereport(elevel,...)
Definition: elog.h:155
int allowedModes
Definition: execnodes.h:304
SetFunctionReturnMode returnMode
Definition: execnodes.h:306
MemoryContext ecxt_per_query_memory
Definition: execnodes.h:232
Tuplestorestate * setResult
Definition: execnodes.h:309
ExprContext * econtext
Definition: execnodes.h:302
TupleDesc setDesc
Definition: execnodes.h:310
int errmsg(const char *fmt,...)
Definition: elog.c:905
#define elog(elevel,...)
Definition: elog.h:227
#define PG_RETURN_NULL()
Definition: fmgr.h:345

◆ pg_isblank()

bool pg_isblank ( const char  c)

Definition at line 160 of file hba.c.

Referenced by interpret_ident_response(), and next_token().

161 {
162  return c == ' ' || c == '\t' || c == '\r';
163 }
char * c

◆ tokenize_file()

static MemoryContext tokenize_file ( const char *  filename,
FILE *  file,
List **  tok_lines,
int  elevel 
)
static

Definition at line 478 of file hba.c.

References ALLOCSET_SMALL_SIZES, AllocSetContextCreate, buf, CurrentMemoryContext, StringInfoData::data, ereport, TokenizedLine::err_msg, errcode_for_file_access(), errmsg(), TokenizedLine::fields, initStringInfo(), lappend(), StringInfoData::len, TokenizedLine::line_num, MemoryContextSwitchTo(), next_field_expand(), NIL, palloc(), pg_get_line_append(), pg_strip_crlf(), psprintf(), pstrdup(), TokenizedLine::raw_line, resetStringInfo(), and strerror.

Referenced by fill_hba_view(), load_hba(), load_ident(), and tokenize_inc_file().

479 {
480  int line_number = 1;
482  MemoryContext linecxt;
483  MemoryContext oldcxt;
484 
486  "tokenize_file",
488  oldcxt = MemoryContextSwitchTo(linecxt);
489 
490  initStringInfo(&buf);
491 
492  *tok_lines = NIL;
493 
494  while (!feof(file) && !ferror(file))
495  {
496  char *lineptr;
497  List *current_line = NIL;
498  char *err_msg = NULL;
499  int last_backslash_buflen = 0;
500  int continuations = 0;
501 
502  /* Collect the next input line, handling backslash continuations */
503  resetStringInfo(&buf);
504 
505  while (pg_get_line_append(file, &buf))
506  {
507  /* Strip trailing newline, including \r in case we're on Windows */
508  buf.len = pg_strip_crlf(buf.data);
509 
510  /*
511  * Check for backslash continuation. The backslash must be after
512  * the last place we found a continuation, else two backslashes
513  * followed by two \n's would behave surprisingly.
514  */
515  if (buf.len > last_backslash_buflen &&
516  buf.data[buf.len - 1] == '\\')
517  {
518  /* Continuation, so strip it and keep reading */
519  buf.data[--buf.len] = '\0';
520  last_backslash_buflen = buf.len;
521  continuations++;
522  continue;
523  }
524 
525  /* Nope, so we have the whole line */
526  break;
527  }
528 
529  if (ferror(file))
530  {
531  /* I/O error! */
532  int save_errno = errno;
533 
534  ereport(elevel,
536  errmsg("could not read file \"%s\": %m", filename)));
537  err_msg = psprintf("could not read file \"%s\": %s",
538  filename, strerror(save_errno));
539  break;
540  }
541 
542  /* Parse fields */
543  lineptr = buf.data;
544  while (*lineptr && err_msg == NULL)
545  {
546  List *current_field;
547 
548  current_field = next_field_expand(filename, &lineptr,
549  elevel, &err_msg);
550  /* add field to line, unless we are at EOL or comment start */
551  if (current_field != NIL)
552  current_line = lappend(current_line, current_field);
553  }
554 
555  /* Reached EOL; emit line to TokenizedLine list unless it's boring */
556  if (current_line != NIL || err_msg != NULL)
557  {
558  TokenizedLine *tok_line;
559 
560  tok_line = (TokenizedLine *) palloc(sizeof(TokenizedLine));
561  tok_line->fields = current_line;
562  tok_line->line_num = line_number;
563  tok_line->raw_line = pstrdup(buf.data);
564  tok_line->err_msg = err_msg;
565  *tok_lines = lappend(*tok_lines, tok_line);
566  }
567 
568  line_number += continuations + 1;
569  }
570 
571  MemoryContextSwitchTo(oldcxt);
572 
573  return linecxt;
574 }
#define NIL
Definition: pg_list.h:65
#define AllocSetContextCreate
Definition: memutils.h:170
int pg_strip_crlf(char *str)
Definition: string.c:121
char * pstrdup(const char *in)
Definition: mcxt.c:1187
char * psprintf(const char *fmt,...)
Definition: psprintf.c:46
#define ALLOCSET_SMALL_SIZES
Definition: memutils.h:202
static MemoryContext MemoryContextSwitchTo(MemoryContext context)
Definition: palloc.h:109
int line_num
Definition: hba.c:92
static char * buf
Definition: pg_test_fsync.c:68
char * err_msg
Definition: hba.c:94
int errcode_for_file_access(void)
Definition: elog.c:717
void resetStringInfo(StringInfo str)
Definition: stringinfo.c:75
MemoryContext CurrentMemoryContext
Definition: mcxt.c:38
List * fields
Definition: hba.c:91
List * lappend(List *list, void *datum)
Definition: list.c:336
void initStringInfo(StringInfo str)
Definition: stringinfo.c:59
static int elevel
Definition: vacuumlazy.c:333
#define ereport(elevel,...)
Definition: elog.h:155
#define strerror
Definition: port.h:229
bool pg_get_line_append(FILE *stream, StringInfo buf)
Definition: pg_get_line.c:112
static char * filename
Definition: pg_dumpall.c:91
void * palloc(Size size)
Definition: mcxt.c:950
int errmsg(const char *fmt,...)
Definition: elog.c:905
char * raw_line
Definition: hba.c:93
Definition: pg_list.h:50
static List * next_field_expand(const char *filename, char **lineptr, int elevel, char **err_msg)
Definition: hba.c:338

◆ tokenize_inc_file()

static List * tokenize_inc_file ( List tokens,
const char *  outer_filename,
const char *  inc_filename,
int  elevel,
char **  err_msg 
)
static

Definition at line 380 of file hba.c.

References AllocateFile(), canonicalize_path(), copy_hba_token(), ereport, TokenizedLine::err_msg, errcode_for_file_access(), errmsg(), TokenizedLine::fields, FreeFile(), get_parent_directory(), is_absolute_path, join_path_components(), lappend(), lfirst, MemoryContextDelete(), palloc(), pfree(), psprintf(), pstrdup(), strerror, and tokenize_file().

Referenced by next_field_expand().

385 {
386  char *inc_fullname;
387  FILE *inc_file;
388  List *inc_lines;
389  ListCell *inc_line;
390  MemoryContext linecxt;
391 
392  if (is_absolute_path(inc_filename))
393  {
394  /* absolute path is taken as-is */
395  inc_fullname = pstrdup(inc_filename);
396  }
397  else
398  {
399  /* relative path is relative to dir of calling file */
400  inc_fullname = (char *) palloc(strlen(outer_filename) + 1 +
401  strlen(inc_filename) + 1);
402  strcpy(inc_fullname, outer_filename);
403  get_parent_directory(inc_fullname);
404  join_path_components(inc_fullname, inc_fullname, inc_filename);
405  canonicalize_path(inc_fullname);
406  }
407 
408  inc_file = AllocateFile(inc_fullname, "r");
409  if (inc_file == NULL)
410  {
411  int save_errno = errno;
412 
413  ereport(elevel,
415  errmsg("could not open secondary authentication file \"@%s\" as \"%s\": %m",
416  inc_filename, inc_fullname)));
417  *err_msg = psprintf("could not open secondary authentication file \"@%s\" as \"%s\": %s",
418  inc_filename, inc_fullname, strerror(save_errno));
419  pfree(inc_fullname);
420  return tokens;
421  }
422 
423  /* There is possible recursion here if the file contains @ */
424  linecxt = tokenize_file(inc_fullname, inc_file, &inc_lines, elevel);
425 
426  FreeFile(inc_file);
427  pfree(inc_fullname);
428 
429  /* Copy all tokens found in the file and append to the tokens list */
430  foreach(inc_line, inc_lines)
431  {
432  TokenizedLine *tok_line = (TokenizedLine *) lfirst(inc_line);
433  ListCell *inc_field;
434 
435  /* If any line has an error, propagate that up to caller */
436  if (tok_line->err_msg)
437  {
438  *err_msg = pstrdup(tok_line->err_msg);
439  break;
440  }
441 
442  foreach(inc_field, tok_line->fields)
443  {
444  List *inc_tokens = lfirst(inc_field);
445  ListCell *inc_token;
446 
447  foreach(inc_token, inc_tokens)
448  {
449  HbaToken *token = lfirst(inc_token);
450 
451  tokens = lappend(tokens, copy_hba_token(token));
452  }
453  }
454  }
455 
456  MemoryContextDelete(linecxt);
457  return tokens;
458 }
void MemoryContextDelete(MemoryContext context)
Definition: mcxt.c:212
char * pstrdup(const char *in)
Definition: mcxt.c:1187
char * psprintf(const char *fmt,...)
Definition: psprintf.c:46
void canonicalize_path(char *path)
Definition: path.c:254
void pfree(void *pointer)
Definition: mcxt.c:1057
char * err_msg
Definition: hba.c:94
Definition: hba.c:75
int errcode_for_file_access(void)
Definition: elog.c:717
#define is_absolute_path(filename)
Definition: port.h:86
void get_parent_directory(char *path)
Definition: path.c:854
FILE * AllocateFile(const char *name, const char *mode)
Definition: fd.c:2354
List * fields
Definition: hba.c:91
List * lappend(List *list, void *datum)
Definition: list.c:336
static int elevel
Definition: vacuumlazy.c:333
#define ereport(elevel,...)
Definition: elog.h:155
#define lfirst(lc)
Definition: pg_list.h:169
#define strerror
Definition: port.h:229
static MemoryContext tokenize_file(const char *filename, FILE *file, List **tok_lines, int elevel)
Definition: hba.c:478
void join_path_components(char *ret_path, const char *head, const char *tail)
Definition: path.c:218
static HbaToken * copy_hba_token(HbaToken *in)
Definition: hba.c:315
int FreeFile(FILE *file)
Definition: fd.c:2553
void * palloc(Size size)
Definition: mcxt.c:950
int errmsg(const char *fmt,...)
Definition: elog.c:905
Definition: pg_list.h:50

◆ verify_option_list_length()

static bool verify_option_list_length ( List options,
const char *  optionname,
List comparelist,
const char *  comparename,
int  line_num 
)
static

Definition at line 1666 of file hba.c.

References ereport, errcode(), errcontext, errmsg(), HbaFileName, list_length(), and LOG.

Referenced by parse_hba_line().

1669 {
1670  if (list_length(options) == 0 ||
1671  list_length(options) == 1 ||
1672  list_length(options) == list_length(comparelist))
1673  return true;
1674 
1675  ereport(LOG,
1676  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1677  errmsg("the number of %s (%d) must be 1 or the same as the number of %s (%d)",
1678  optionname,
1679  list_length(options),
1680  comparename,
1681  list_length(comparelist)
1682  ),
1683  errcontext("line %d of configuration file \"%s\"",
1684  line_num, HbaFileName)));
1685  return false;
1686 }
int errcode(int sqlerrcode)
Definition: elog.c:694
#define LOG
Definition: elog.h:26
char * HbaFileName
Definition: guc.c:559
#define ereport(elevel,...)
Definition: elog.h:155
static int list_length(const List *l)
Definition: pg_list.h:149
int errmsg(const char *fmt,...)
Definition: elog.c:905
#define errcontext
Definition: elog.h:199

Variable Documentation

◆ parsed_hba_context

MemoryContext parsed_hba_context = NULL
static

Definition at line 102 of file hba.c.

◆ parsed_hba_lines

List* parsed_hba_lines = NIL
static

Definition at line 101 of file hba.c.

◆ parsed_ident_context

MemoryContext parsed_ident_context = NULL
static

Definition at line 113 of file hba.c.

◆ parsed_ident_lines

List* parsed_ident_lines = NIL
static

Definition at line 112 of file hba.c.

◆ UserAuthName

const char* const UserAuthName[]
static
Initial value:
=
{
"reject",
"implicit reject",
"trust",
"ident",
"password",
"md5",
"scram-sha-256",
"gss",
"sspi",
"pam",
"bsd",
"ldap",
"cert",
"radius",
"peer"
}

Definition at line 121 of file hba.c.

Referenced by fill_hba_line().