hba.h File Reference

#include "libpq/pqcomm.h"
#include "nodes/pg_list.h"
#include "regex/regex.h"

Include dependency graph for hba.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures
struct	AuthToken
struct	HbaLine
struct	IdentLine
struct	TokenizedAuthLine

Macros
#define	USER_AUTH_LAST   uaOAuth /* Must be last value of this enum */

Typedefs
typedef enum UserAuth	UserAuth
typedef enum IPCompareMethod	IPCompareMethod
typedef enum ConnType	ConnType
typedef enum ClientCertMode	ClientCertMode
typedef enum ClientCertName	ClientCertName
typedef struct AuthToken	AuthToken
typedef struct HbaLine	HbaLine
typedef struct IdentLine	IdentLine
typedef struct TokenizedAuthLine	TokenizedAuthLine
typedef struct Port	hbaPort

Enumerations
enum	UserAuth {   uaReject , uaImplicitReject , uaTrust , uaIdent ,   uaPassword , uaMD5 , uaSCRAM , uaGSS ,   uaSSPI , uaPAM , uaBSD , uaLDAP ,   uaCert , uaRADIUS , uaPeer , uaOAuth }
enum	IPCompareMethod { ipCmpMask , ipCmpSameHost , ipCmpSameNet , ipCmpAll }
enum	ConnType {   ctLocal , ctHost , ctHostSSL , ctHostNoSSL ,   ctHostGSS , ctHostNoGSS }
enum	ClientCertMode { clientCertOff , clientCertCA , clientCertFull }
enum	ClientCertName { clientCertCN , clientCertDN }

Functions
bool	load_hba (void)
bool	load_ident (void)
const char *	hba_authname (UserAuth auth_method)
void	hba_getauthmethod (hbaPort *port)
int	check_usermap (const char *usermap_name, const char *pg_user, const char *system_user, bool case_insensitive)
HbaLine *	parse_hba_line (TokenizedAuthLine *tok_line, int elevel)
IdentLine *	parse_ident_line (TokenizedAuthLine *tok_line, int elevel)
bool	pg_isblank (const char c)
FILE *	open_auth_file (const char *filename, int elevel, int depth, char **err_msg)
void	free_auth_file (FILE *file, int depth)
void	tokenize_auth_file (const char *filename, FILE *file, List **tok_lines, int elevel, int depth)

Macro Definition Documentation

USER_AUTH_LAST

#define USER_AUTH_LAST   uaOAuth /* Must be last value of this enum */

Definition at line 43 of file hba.h.

Typedef Documentation

AuthToken

typedef struct AuthToken AuthToken

ClientCertMode

typedef enum ClientCertMode ClientCertMode

ClientCertName

typedef enum ClientCertName ClientCertName

ConnType

typedef enum ConnType ConnType

HbaLine

typedef struct HbaLine HbaLine

hbaPort

typedef struct Port hbaPort

Definition at line 173 of file hba.h.

IdentLine

typedef struct IdentLine IdentLine

IPCompareMethod

typedef enum IPCompareMethod IPCompareMethod

TokenizedAuthLine

typedef struct TokenizedAuthLine TokenizedAuthLine

UserAuth

typedef enum UserAuth UserAuth

Enumeration Type Documentation

ClientCertMode

enum ClientCertMode

Enumerator
clientCertOff
clientCertCA
clientCertFull

Definition at line 68 of file hba.h.

{
    clientCertOff,
    clientCertCA,
    clientCertFull,
} ClientCertMode;

ClientCertName

enum ClientCertName

Enumerator
clientCertCN
clientCertDN

Definition at line 75 of file hba.h.

{
    clientCertCN,
    clientCertDN,
} ClientCertName;

ConnType

enum ConnType

Enumerator
ctLocal
ctHost
ctHostSSL
ctHostNoSSL
ctHostGSS
ctHostNoGSS

Definition at line 58 of file hba.h.

{
    ctLocal,
    ctHost,
    ctHostSSL,
    ctHostNoSSL,
    ctHostGSS,
    ctHostNoGSS,
} ConnType;

IPCompareMethod

enum IPCompareMethod

Enumerator
ipCmpMask
ipCmpSameHost
ipCmpSameNet
ipCmpAll

Definition at line 50 of file hba.h.

{
    ipCmpMask,
    ipCmpSameHost,
    ipCmpSameNet,
    ipCmpAll,
} IPCompareMethod;

UserAuth

enum UserAuth

Enumerator
uaReject
uaImplicitReject
uaTrust
uaIdent
uaPassword
uaMD5
uaSCRAM
uaGSS
uaSSPI
uaPAM
uaBSD
uaLDAP
uaCert
uaRADIUS
uaPeer
uaOAuth

Definition at line 25 of file hba.h.

{
    uaReject,
    uaImplicitReject,           /* Not a user-visible option */
    uaTrust,
    uaIdent,
    uaPassword,
    uaMD5,
    uaSCRAM,
    uaGSS,
    uaSSPI,
    uaPAM,
    uaBSD,
    uaLDAP,
    uaCert,
    uaRADIUS,
    uaPeer,
    uaOAuth,
#define USER_AUTH_LAST uaOAuth  /* Must be last value of this enum */
} UserAuth;

Function Documentation

check_usermap()

int check_usermap	(	const char *	usermap_name,
		const char *	pg_user,
		const char *	system_user,
		bool	case_insensitive
	)

Definition at line 2966 of file hba.c.

{
    bool        found_entry = false,
                error = false;
 
    if (usermap_name == NULL || usermap_name[0] == '\0')
    {
        if (case_insensitive)
        {
            if (pg_strcasecmp(pg_user, system_user) == 0)
                return STATUS_OK;
        }
        else
        {
            if (strcmp(pg_user, system_user) == 0)
                return STATUS_OK;
        }
        ereport(LOG,
                (errmsg("provided user name (%s) and authenticated user name (%s) do not match",
                        pg_user, system_user)));
        return STATUS_ERROR;
    }
    else
    {
        ListCell   *line_cell;
 
        foreach(line_cell, parsed_ident_lines)
        {
            check_ident_usermap(lfirst(line_cell), usermap_name,
                                pg_user, system_user, case_insensitive,
                                &found_entry, &error);
            if (found_entry || error)
                break;
        }
    }
    if (!found_entry && !error)
    {
        ereport(LOG,
                (errmsg("no match in usermap \"%s\" for user \"%s\" authenticated as \"%s\"",
                        usermap_name, pg_user, system_user)));
    }
    return found_entry ? STATUS_OK : STATUS_ERROR;
}

References check_ident_usermap(), ereport, errmsg(), error(), lfirst, LOG, parsed_ident_lines, pg_strcasecmp(), STATUS_ERROR, STATUS_OK, and system_user().

Referenced by auth_peer(), ident_inet(), and validate().

free_auth_file()

void free_auth_file	(	FILE *	file,
		int	depth
	)

Definition at line 572 of file hba.c.

{
    FreeFile(file);
 
    /* If this is the last cleanup, remove the tokenization context */
    if (depth == CONF_FILE_START_DEPTH)
    {
        MemoryContextDelete(tokenize_context);
        tokenize_context = NULL;
    }
}

References CONF_FILE_START_DEPTH, FreeFile(), MemoryContextDelete(), and tokenize_context.

Referenced by fill_hba_view(), fill_ident_view(), load_hba(), load_ident(), tokenize_expand_file(), and tokenize_include_file().

hba_authname()

const char * hba_authname

(

UserAuth

auth_method

)

Definition at line 3123 of file hba.c.

{
    return UserAuthName[auth_method];
}

References UserAuthName.

Referenced by ClientAuthentication(), fill_hba_line(), InitPostgres(), ParallelWorkerMain(), and set_authn_id().

hba_getauthmethod()

void hba_getauthmethod

(

hbaPort *

port

)

Definition at line 3110 of file hba.c.

{
    check_hba(port);
}

References check_hba(), and port.

Referenced by ClientAuthentication().

load_hba()

bool load_hba

(

void

)

Definition at line 2645 of file hba.c.

{
    FILE       *file;
    List       *hba_lines = NIL;
    ListCell   *line;
    List       *new_parsed_lines = NIL;
    bool        ok = true;
    MemoryContext oldcxt;
    MemoryContext hbacxt;
 
    file = open_auth_file(HbaFileName, LOG, 0, NULL);
    if (file == NULL)
    {
        /* error already logged */
        return false;
    }
 
    tokenize_auth_file(HbaFileName, file, &hba_lines, LOG, 0);
 
    /* Now parse all the lines */
    Assert(PostmasterContext);
    hbacxt = AllocSetContextCreate(PostmasterContext,
                                   "hba parser context",
                                   ALLOCSET_SMALL_SIZES);
    oldcxt = MemoryContextSwitchTo(hbacxt);
    foreach(line, hba_lines)
    {
        TokenizedAuthLine *tok_line = (TokenizedAuthLine *) lfirst(line);
        HbaLine    *newline;
 
        /* don't parse lines that already have errors */
        if (tok_line->err_msg != NULL)
        {
            ok = false;
            continue;
        }
 
        if ((newline = parse_hba_line(tok_line, LOG)) == NULL)
        {
            /* Parse error; remember there's trouble */
            ok = false;
 
            /*
             * Keep parsing the rest of the file so we can report errors on
             * more than the first line.  Error has already been logged, no
             * need for more chatter here.
             */
            continue;
        }
 
        new_parsed_lines = lappend(new_parsed_lines, newline);
    }
 
    /*
     * A valid HBA file must have at least one entry; else there's no way to
     * connect to the postmaster.  But only complain about this if we didn't
     * already have parsing errors.
     */
    if (ok && new_parsed_lines == NIL)
    {
        ereport(LOG,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("configuration file \"%s\" contains no entries",
                        HbaFileName)));
        ok = false;
    }
 
    /* Free tokenizer memory */
    free_auth_file(file, 0);
    MemoryContextSwitchTo(oldcxt);
 
    if (!ok)
    {
        /*
         * File contained one or more errors, so bail out. MemoryContextDelete
         * is enough to clean up everything, including regexes.
         */
        MemoryContextDelete(hbacxt);
        return false;
    }
 
    /* Loaded new file successfully, replace the one we use */
    if (parsed_hba_context != NULL)
        MemoryContextDelete(parsed_hba_context);
    parsed_hba_context = hbacxt;
    parsed_hba_lines = new_parsed_lines;
 
    return true;
}

References ALLOCSET_SMALL_SIZES, AllocSetContextCreate, Assert(), ereport, TokenizedAuthLine::err_msg, errcode(), errmsg(), free_auth_file(), HbaFileName, lappend(), lfirst, LOG, MemoryContextDelete(), MemoryContextSwitchTo(), newline, NIL, open_auth_file(), parse_hba_line(), parsed_hba_context, parsed_hba_lines, PostmasterContext, and tokenize_auth_file().

Referenced by PerformAuthentication(), PostmasterMain(), and process_pm_reload_request().

load_ident()

bool load_ident

(

void

)

Definition at line 3021 of file hba.c.

{
    FILE       *file;
    List       *ident_lines = NIL;
    ListCell   *line_cell;
    List       *new_parsed_lines = NIL;
    bool        ok = true;
    MemoryContext oldcxt;
    MemoryContext ident_context;
    IdentLine  *newline;
 
    /* not FATAL ... we just won't do any special ident maps */
    file = open_auth_file(IdentFileName, LOG, 0, NULL);
    if (file == NULL)
    {
        /* error already logged */
        return false;
    }
 
    tokenize_auth_file(IdentFileName, file, &ident_lines, LOG, 0);
 
    /* Now parse all the lines */
    Assert(PostmasterContext);
    ident_context = AllocSetContextCreate(PostmasterContext,
                                          "ident parser context",
                                          ALLOCSET_SMALL_SIZES);
    oldcxt = MemoryContextSwitchTo(ident_context);
    foreach(line_cell, ident_lines)
    {
        TokenizedAuthLine *tok_line = (TokenizedAuthLine *) lfirst(line_cell);
 
        /* don't parse lines that already have errors */
        if (tok_line->err_msg != NULL)
        {
            ok = false;
            continue;
        }
 
        if ((newline = parse_ident_line(tok_line, LOG)) == NULL)
        {
            /* Parse error; remember there's trouble */
            ok = false;
 
            /*
             * Keep parsing the rest of the file so we can report errors on
             * more than the first line.  Error has already been logged, no
             * need for more chatter here.
             */
            continue;
        }
 
        new_parsed_lines = lappend(new_parsed_lines, newline);
    }
 
    /* Free tokenizer memory */
    free_auth_file(file, 0);
    MemoryContextSwitchTo(oldcxt);
 
    if (!ok)
    {
        /*
         * File contained one or more errors, so bail out. MemoryContextDelete
         * is enough to clean up everything, including regexes.
         */
        MemoryContextDelete(ident_context);
        return false;
    }
 
    /* Loaded new file successfully, replace the one we use */
    if (parsed_ident_context != NULL)
        MemoryContextDelete(parsed_ident_context);
 
    parsed_ident_context = ident_context;
    parsed_ident_lines = new_parsed_lines;
 
    return true;
}

References ALLOCSET_SMALL_SIZES, AllocSetContextCreate, Assert(), TokenizedAuthLine::err_msg, free_auth_file(), IdentFileName, lappend(), lfirst, LOG, MemoryContextDelete(), MemoryContextSwitchTo(), newline, NIL, open_auth_file(), parse_ident_line(), parsed_ident_context, parsed_ident_lines, PostmasterContext, and tokenize_auth_file().

Referenced by PerformAuthentication(), PostmasterMain(), and process_pm_reload_request().

open_auth_file()

FILE * open_auth_file	(	const char *	filename,
		int	elevel,
		int	depth,
		char **	err_msg
	)

Definition at line 597 of file hba.c.

{
    FILE       *file;
 
    /*
     * Reject too-deep include nesting depth.  This is just a safety check to
     * avoid dumping core due to stack overflow if an include file loops back
     * to itself.  The maximum nesting depth is pretty arbitrary.
     */
    if (depth > CONF_FILE_MAX_DEPTH)
    {
        ereport(elevel,
                (errcode_for_file_access(),
                 errmsg("could not open file \"%s\": maximum nesting depth exceeded",
                        filename)));
        if (err_msg)
            *err_msg = psprintf("could not open file \"%s\": maximum nesting depth exceeded",
                                filename);
        return NULL;
    }
 
    file = AllocateFile(filename, "r");
    if (file == NULL)
    {
        int         save_errno = errno;
 
        ereport(elevel,
                (errcode_for_file_access(),
                 errmsg("could not open file \"%s\": %m",
                        filename)));
        if (err_msg)
        {
            errno = save_errno;
            *err_msg = psprintf("could not open file \"%s\": %m",
                                filename);
        }
        /* the caller may care about some specific errno */
        errno = save_errno;
        return NULL;
    }
 
    /*
     * When opening the top-level file, create the memory context used for the
     * tokenization.  This will be closed with this file when coming back to
     * this level of cleanup.
     */
    if (depth == CONF_FILE_START_DEPTH)
    {
        /*
         * A context may be present, but assume that it has been eliminated
         * already.
         */
        tokenize_context = AllocSetContextCreate(CurrentMemoryContext,
                                                 "tokenize_context",
                                                 ALLOCSET_START_SMALL_SIZES);
    }
 
    return file;
}

References AllocateFile(), ALLOCSET_START_SMALL_SIZES, AllocSetContextCreate, CONF_FILE_MAX_DEPTH, CONF_FILE_START_DEPTH, CurrentMemoryContext, ereport, errcode_for_file_access(), errmsg(), filename, psprintf(), and tokenize_context.

Referenced by fill_hba_view(), fill_ident_view(), load_hba(), load_ident(), tokenize_expand_file(), and tokenize_include_file().

parse_hba_line()

HbaLine * parse_hba_line	(	TokenizedAuthLine *	tok_line,
		int	elevel
	)

Definition at line 1328 of file hba.c.

{
    int         line_num = tok_line->line_num;
    char       *file_name = tok_line->file_name;
    char      **err_msg = &tok_line->err_msg;
    char       *str;
    struct addrinfo *gai_result;
    struct addrinfo hints;
    int         ret;
    char       *cidr_slash;
    char       *unsupauth;
    ListCell   *field;
    List       *tokens;
    ListCell   *tokencell;
    AuthToken  *token;
    HbaLine    *parsedline;
 
    parsedline = palloc0(sizeof(HbaLine));
    parsedline->sourcefile = pstrdup(file_name);
    parsedline->linenumber = line_num;
    parsedline->rawline = pstrdup(tok_line->raw_line);
 
    /* Check the record type. */
    Assert(tok_line->fields != NIL);
    field = list_head(tok_line->fields);
    tokens = lfirst(field);
    if (tokens->length > 1)
    {
        ereport(elevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("multiple values specified for connection type"),
                 errhint("Specify exactly one connection type per line."),
                 errcontext("line %d of configuration file \"%s\"",
                            line_num, file_name)));
        *err_msg = "multiple values specified for connection type";
        return NULL;
    }
    token = linitial(tokens);
    if (strcmp(token->string, "local") == 0)
    {
        parsedline->conntype = ctLocal;
    }
    else if (strcmp(token->string, "host") == 0 ||
             strcmp(token->string, "hostssl") == 0 ||
             strcmp(token->string, "hostnossl") == 0 ||
             strcmp(token->string, "hostgssenc") == 0 ||
             strcmp(token->string, "hostnogssenc") == 0)
    {
 
        if (token->string[4] == 's')    /* "hostssl" */
        {
            parsedline->conntype = ctHostSSL;
            /* Log a warning if SSL support is not active */
#ifdef USE_SSL
            if (!EnableSSL)
            {
                ereport(elevel,
                        (errcode(ERRCODE_CONFIG_FILE_ERROR),
                         errmsg("hostssl record cannot match because SSL is disabled"),
                         errhint("Set \"ssl = on\" in postgresql.conf."),
                         errcontext("line %d of configuration file \"%s\"",
                                    line_num, file_name)));
                *err_msg = "hostssl record cannot match because SSL is disabled";
            }
#else
            ereport(elevel,
                    (errcode(ERRCODE_CONFIG_FILE_ERROR),
                     errmsg("hostssl record cannot match because SSL is not supported by this build"),
                     errcontext("line %d of configuration file \"%s\"",
                                line_num, file_name)));
            *err_msg = "hostssl record cannot match because SSL is not supported by this build";
#endif
        }
        else if (token->string[4] == 'g')   /* "hostgssenc" */
        {
            parsedline->conntype = ctHostGSS;
#ifndef ENABLE_GSS
            ereport(elevel,
                    (errcode(ERRCODE_CONFIG_FILE_ERROR),
                     errmsg("hostgssenc record cannot match because GSSAPI is not supported by this build"),
                     errcontext("line %d of configuration file \"%s\"",
                                line_num, file_name)));
            *err_msg = "hostgssenc record cannot match because GSSAPI is not supported by this build";
#endif
        }
        else if (token->string[4] == 'n' && token->string[6] == 's')
            parsedline->conntype = ctHostNoSSL;
        else if (token->string[4] == 'n' && token->string[6] == 'g')
            parsedline->conntype = ctHostNoGSS;
        else
        {
            /* "host" */
            parsedline->conntype = ctHost;
        }
    }                           /* record type */
    else
    {
        ereport(elevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("invalid connection type \"%s\"",
                        token->string),
                 errcontext("line %d of configuration file \"%s\"",
                            line_num, file_name)));
        *err_msg = psprintf("invalid connection type \"%s\"", token->string);
        return NULL;
    }
 
    /* Get the databases. */
    field = lnext(tok_line->fields, field);
    if (!field)
    {
        ereport(elevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("end-of-line before database specification"),
                 errcontext("line %d of configuration file \"%s\"",
                            line_num, file_name)));
        *err_msg = "end-of-line before database specification";
        return NULL;
    }
    parsedline->databases = NIL;
    tokens = lfirst(field);
    foreach(tokencell, tokens)
    {
        AuthToken  *tok = copy_auth_token(lfirst(tokencell));
 
        /* Compile a regexp for the database token, if necessary */
        if (regcomp_auth_token(tok, file_name, line_num, err_msg, elevel))
            return NULL;
 
        parsedline->databases = lappend(parsedline->databases, tok);
    }
 
    /* Get the roles. */
    field = lnext(tok_line->fields, field);
    if (!field)
    {
        ereport(elevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("end-of-line before role specification"),
                 errcontext("line %d of configuration file \"%s\"",
                            line_num, file_name)));
        *err_msg = "end-of-line before role specification";
        return NULL;
    }
    parsedline->roles = NIL;
    tokens = lfirst(field);
    foreach(tokencell, tokens)
    {
        AuthToken  *tok = copy_auth_token(lfirst(tokencell));
 
        /* Compile a regexp from the role token, if necessary */
        if (regcomp_auth_token(tok, file_name, line_num, err_msg, elevel))
            return NULL;
 
        parsedline->roles = lappend(parsedline->roles, tok);
    }
 
    if (parsedline->conntype != ctLocal)
    {
        /* Read the IP address field. (with or without CIDR netmask) */
        field = lnext(tok_line->fields, field);
        if (!field)
        {
            ereport(elevel,
                    (errcode(ERRCODE_CONFIG_FILE_ERROR),
                     errmsg("end-of-line before IP address specification"),
                     errcontext("line %d of configuration file \"%s\"",
                                line_num, file_name)));
            *err_msg = "end-of-line before IP address specification";
            return NULL;
        }
        tokens = lfirst(field);
        if (tokens->length > 1)
        {
            ereport(elevel,
                    (errcode(ERRCODE_CONFIG_FILE_ERROR),
                     errmsg("multiple values specified for host address"),
                     errhint("Specify one address range per line."),
                     errcontext("line %d of configuration file \"%s\"",
                                line_num, file_name)));
            *err_msg = "multiple values specified for host address";
            return NULL;
        }
        token = linitial(tokens);
 
        if (token_is_keyword(token, "all"))
        {
            parsedline->ip_cmp_method = ipCmpAll;
        }
        else if (token_is_keyword(token, "samehost"))
        {
            /* Any IP on this host is allowed to connect */
            parsedline->ip_cmp_method = ipCmpSameHost;
        }
        else if (token_is_keyword(token, "samenet"))
        {
            /* Any IP on the host's subnets is allowed to connect */
            parsedline->ip_cmp_method = ipCmpSameNet;
        }
        else
        {
            /* IP and netmask are specified */
            parsedline->ip_cmp_method = ipCmpMask;
 
            /* need a modifiable copy of token */
            str = pstrdup(token->string);
 
            /* Check if it has a CIDR suffix and if so isolate it */
            cidr_slash = strchr(str, '/');
            if (cidr_slash)
                *cidr_slash = '\0';
 
            /* Get the IP address either way */
            hints.ai_flags = AI_NUMERICHOST;
            hints.ai_family = AF_UNSPEC;
            hints.ai_socktype = 0;
            hints.ai_protocol = 0;
            hints.ai_addrlen = 0;
            hints.ai_canonname = NULL;
            hints.ai_addr = NULL;
            hints.ai_next = NULL;
 
            ret = pg_getaddrinfo_all(str, NULL, &hints, &gai_result);
            if (ret == 0 && gai_result)
            {
                memcpy(&parsedline->addr, gai_result->ai_addr,
                       gai_result->ai_addrlen);
                parsedline->addrlen = gai_result->ai_addrlen;
            }
            else if (ret == EAI_NONAME)
                parsedline->hostname = str;
            else
            {
                ereport(elevel,
                        (errcode(ERRCODE_CONFIG_FILE_ERROR),
                         errmsg("invalid IP address \"%s\": %s",
                                str, gai_strerror(ret)),
                         errcontext("line %d of configuration file \"%s\"",
                                    line_num, file_name)));
                *err_msg = psprintf("invalid IP address \"%s\": %s",
                                    str, gai_strerror(ret));
                if (gai_result)
                    pg_freeaddrinfo_all(hints.ai_family, gai_result);
                return NULL;
            }
 
            pg_freeaddrinfo_all(hints.ai_family, gai_result);
 
            /* Get the netmask */
            if (cidr_slash)
            {
                if (parsedline->hostname)
                {
                    ereport(elevel,
                            (errcode(ERRCODE_CONFIG_FILE_ERROR),
                             errmsg("specifying both host name and CIDR mask is invalid: \"%s\"",
                                    token->string),
                             errcontext("line %d of configuration file \"%s\"",
                                        line_num, file_name)));
                    *err_msg = psprintf("specifying both host name and CIDR mask is invalid: \"%s\"",
                                        token->string);
                    return NULL;
                }
 
                if (pg_sockaddr_cidr_mask(&parsedline->mask, cidr_slash + 1,
                                          parsedline->addr.ss_family) < 0)
                {
                    ereport(elevel,
                            (errcode(ERRCODE_CONFIG_FILE_ERROR),
                             errmsg("invalid CIDR mask in address \"%s\"",
                                    token->string),
                             errcontext("line %d of configuration file \"%s\"",
                                        line_num, file_name)));
                    *err_msg = psprintf("invalid CIDR mask in address \"%s\"",
                                        token->string);
                    return NULL;
                }
                parsedline->masklen = parsedline->addrlen;
                pfree(str);
            }
            else if (!parsedline->hostname)
            {
                /* Read the mask field. */
                pfree(str);
                field = lnext(tok_line->fields, field);
                if (!field)
                {
                    ereport(elevel,
                            (errcode(ERRCODE_CONFIG_FILE_ERROR),
                             errmsg("end-of-line before netmask specification"),
                             errhint("Specify an address range in CIDR notation, or provide a separate netmask."),
                             errcontext("line %d of configuration file \"%s\"",
                                        line_num, file_name)));
                    *err_msg = "end-of-line before netmask specification";
                    return NULL;
                }
                tokens = lfirst(field);
                if (tokens->length > 1)
                {
                    ereport(elevel,
                            (errcode(ERRCODE_CONFIG_FILE_ERROR),
                             errmsg("multiple values specified for netmask"),
                             errcontext("line %d of configuration file \"%s\"",
                                        line_num, file_name)));
                    *err_msg = "multiple values specified for netmask";
                    return NULL;
                }
                token = linitial(tokens);
 
                ret = pg_getaddrinfo_all(token->string, NULL,
                                         &hints, &gai_result);
                if (ret || !gai_result)
                {
                    ereport(elevel,
                            (errcode(ERRCODE_CONFIG_FILE_ERROR),
                             errmsg("invalid IP mask \"%s\": %s",
                                    token->string, gai_strerror(ret)),
                             errcontext("line %d of configuration file \"%s\"",
                                        line_num, file_name)));
                    *err_msg = psprintf("invalid IP mask \"%s\": %s",
                                        token->string, gai_strerror(ret));
                    if (gai_result)
                        pg_freeaddrinfo_all(hints.ai_family, gai_result);
                    return NULL;
                }
 
                memcpy(&parsedline->mask, gai_result->ai_addr,
                       gai_result->ai_addrlen);
                parsedline->masklen = gai_result->ai_addrlen;
                pg_freeaddrinfo_all(hints.ai_family, gai_result);
 
                if (parsedline->addr.ss_family != parsedline->mask.ss_family)
                {
                    ereport(elevel,
                            (errcode(ERRCODE_CONFIG_FILE_ERROR),
                             errmsg("IP address and mask do not match"),
                             errcontext("line %d of configuration file \"%s\"",
                                        line_num, file_name)));
                    *err_msg = "IP address and mask do not match";
                    return NULL;
                }
            }
        }
    }                           /* != ctLocal */
 
    /* Get the authentication method */
    field = lnext(tok_line->fields, field);
    if (!field)
    {
        ereport(elevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("end-of-line before authentication method"),
                 errcontext("line %d of configuration file \"%s\"",
                            line_num, file_name)));
        *err_msg = "end-of-line before authentication method";
        return NULL;
    }
    tokens = lfirst(field);
    if (tokens->length > 1)
    {
        ereport(elevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("multiple values specified for authentication type"),
                 errhint("Specify exactly one authentication type per line."),
                 errcontext("line %d of configuration file \"%s\"",
                            line_num, file_name)));
        *err_msg = "multiple values specified for authentication type";
        return NULL;
    }
    token = linitial(tokens);
 
    unsupauth = NULL;
    if (strcmp(token->string, "trust") == 0)
        parsedline->auth_method = uaTrust;
    else if (strcmp(token->string, "ident") == 0)
        parsedline->auth_method = uaIdent;
    else if (strcmp(token->string, "peer") == 0)
        parsedline->auth_method = uaPeer;
    else if (strcmp(token->string, "password") == 0)
        parsedline->auth_method = uaPassword;
    else if (strcmp(token->string, "gss") == 0)
#ifdef ENABLE_GSS
        parsedline->auth_method = uaGSS;
#else
        unsupauth = "gss";
#endif
    else if (strcmp(token->string, "sspi") == 0)
#ifdef ENABLE_SSPI
        parsedline->auth_method = uaSSPI;
#else
        unsupauth = "sspi";
#endif
    else if (strcmp(token->string, "reject") == 0)
        parsedline->auth_method = uaReject;
    else if (strcmp(token->string, "md5") == 0)
        parsedline->auth_method = uaMD5;
    else if (strcmp(token->string, "scram-sha-256") == 0)
        parsedline->auth_method = uaSCRAM;
    else if (strcmp(token->string, "pam") == 0)
#ifdef USE_PAM
        parsedline->auth_method = uaPAM;
#else
        unsupauth = "pam";
#endif
    else if (strcmp(token->string, "bsd") == 0)
#ifdef USE_BSD_AUTH
        parsedline->auth_method = uaBSD;
#else
        unsupauth = "bsd";
#endif
    else if (strcmp(token->string, "ldap") == 0)
#ifdef USE_LDAP
        parsedline->auth_method = uaLDAP;
#else
        unsupauth = "ldap";
#endif
    else if (strcmp(token->string, "cert") == 0)
#ifdef USE_SSL
        parsedline->auth_method = uaCert;
#else
        unsupauth = "cert";
#endif
    else if (strcmp(token->string, "radius") == 0)
        parsedline->auth_method = uaRADIUS;
    else if (strcmp(token->string, "oauth") == 0)
        parsedline->auth_method = uaOAuth;
    else
    {
        ereport(elevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("invalid authentication method \"%s\"",
                        token->string),
                 errcontext("line %d of configuration file \"%s\"",
                            line_num, file_name)));
        *err_msg = psprintf("invalid authentication method \"%s\"",
                            token->string);
        return NULL;
    }
 
    if (unsupauth)
    {
        ereport(elevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("invalid authentication method \"%s\": not supported by this build",
                        token->string),
                 errcontext("line %d of configuration file \"%s\"",
                            line_num, file_name)));
        *err_msg = psprintf("invalid authentication method \"%s\": not supported by this build",
                            token->string);
        return NULL;
    }
 
    /*
     * XXX: When using ident on local connections, change it to peer, for
     * backwards compatibility.
     */
    if (parsedline->conntype == ctLocal &&
        parsedline->auth_method == uaIdent)
        parsedline->auth_method = uaPeer;
 
    /* Invalid authentication combinations */
    if (parsedline->conntype == ctLocal &&
        parsedline->auth_method == uaGSS)
    {
        ereport(elevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("gssapi authentication is not supported on local sockets"),
                 errcontext("line %d of configuration file \"%s\"",
                            line_num, file_name)));
        *err_msg = "gssapi authentication is not supported on local sockets";
        return NULL;
    }
 
    if (parsedline->conntype != ctLocal &&
        parsedline->auth_method == uaPeer)
    {
        ereport(elevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("peer authentication is only supported on local sockets"),
                 errcontext("line %d of configuration file \"%s\"",
                            line_num, file_name)));
        *err_msg = "peer authentication is only supported on local sockets";
        return NULL;
    }
 
    /*
     * SSPI authentication can never be enabled on ctLocal connections,
     * because it's only supported on Windows, where ctLocal isn't supported.
     */
 
 
    if (parsedline->conntype != ctHostSSL &&
        parsedline->auth_method == uaCert)
    {
        ereport(elevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("cert authentication is only supported on hostssl connections"),
                 errcontext("line %d of configuration file \"%s\"",
                            line_num, file_name)));
        *err_msg = "cert authentication is only supported on hostssl connections";
        return NULL;
    }
 
    /*
     * For GSS and SSPI, set the default value of include_realm to true.
     * Having include_realm set to false is dangerous in multi-realm
     * situations and is generally considered bad practice.  We keep the
     * capability around for backwards compatibility, but we might want to
     * remove it at some point in the future.  Users who still need to strip
     * the realm off would be better served by using an appropriate regex in a
     * pg_ident.conf mapping.
     */
    if (parsedline->auth_method == uaGSS ||
        parsedline->auth_method == uaSSPI)
        parsedline->include_realm = true;
 
    /*
     * For SSPI, include_realm defaults to the SAM-compatible domain (aka
     * NetBIOS name) and user names instead of the Kerberos principal name for
     * compatibility.
     */
    if (parsedline->auth_method == uaSSPI)
    {
        parsedline->compat_realm = true;
        parsedline->upn_username = false;
    }
 
    /* Parse remaining arguments */
    while ((field = lnext(tok_line->fields, field)) != NULL)
    {
        tokens = lfirst(field);
        foreach(tokencell, tokens)
        {
            char       *val;
 
            token = lfirst(tokencell);
 
            str = pstrdup(token->string);
            val = strchr(str, '=');
            if (val == NULL)
            {
                /*
                 * Got something that's not a name=value pair.
                 */
                ereport(elevel,
                        (errcode(ERRCODE_CONFIG_FILE_ERROR),
                         errmsg("authentication option not in name=value format: %s", token->string),
                         errcontext("line %d of configuration file \"%s\"",
                                    line_num, file_name)));
                *err_msg = psprintf("authentication option not in name=value format: %s",
                                    token->string);
                return NULL;
            }
 
            *val++ = '\0';      /* str now holds "name", val holds "value" */
            if (!parse_hba_auth_opt(str, val, parsedline, elevel, err_msg))
                /* parse_hba_auth_opt already logged the error message */
                return NULL;
            pfree(str);
        }
    }
 
    /*
     * Check if the selected authentication method has any mandatory arguments
     * that are not set.
     */
    if (parsedline->auth_method == uaLDAP)
    {
#ifndef HAVE_LDAP_INITIALIZE
        /* Not mandatory for OpenLDAP, because it can use DNS SRV records */
        MANDATORY_AUTH_ARG(parsedline->ldapserver, "ldapserver", "ldap");
#endif
 
        /*
         * LDAP can operate in two modes: either with a direct bind, using
         * ldapprefix and ldapsuffix, or using a search+bind, using
         * ldapbasedn, ldapbinddn, ldapbindpasswd and one of
         * ldapsearchattribute or ldapsearchfilter.  Disallow mixing these
         * parameters.
         */
        if (parsedline->ldapprefix || parsedline->ldapsuffix)
        {
            if (parsedline->ldapbasedn ||
                parsedline->ldapbinddn ||
                parsedline->ldapbindpasswd ||
                parsedline->ldapsearchattribute ||
                parsedline->ldapsearchfilter)
            {
                ereport(elevel,
                        (errcode(ERRCODE_CONFIG_FILE_ERROR),
                         errmsg("cannot mix options for simple bind and search+bind modes"),
                         errcontext("line %d of configuration file \"%s\"",
                                    line_num, file_name)));
                *err_msg = "cannot mix options for simple bind and search+bind modes";
                return NULL;
            }
        }
        else if (!parsedline->ldapbasedn)
        {
            ereport(elevel,
                    (errcode(ERRCODE_CONFIG_FILE_ERROR),
                     errmsg("authentication method \"ldap\" requires argument \"ldapbasedn\", \"ldapprefix\", or \"ldapsuffix\" to be set"),
                     errcontext("line %d of configuration file \"%s\"",
                                line_num, file_name)));
            *err_msg = "authentication method \"ldap\" requires argument \"ldapbasedn\", \"ldapprefix\", or \"ldapsuffix\" to be set";
            return NULL;
        }
 
        /*
         * When using search+bind, you can either use a simple attribute
         * (defaulting to "uid") or a fully custom search filter.  You can't
         * do both.
         */
        if (parsedline->ldapsearchattribute && parsedline->ldapsearchfilter)
        {
            ereport(elevel,
                    (errcode(ERRCODE_CONFIG_FILE_ERROR),
                     errmsg("cannot use ldapsearchattribute together with ldapsearchfilter"),
                     errcontext("line %d of configuration file \"%s\"",
                                line_num, file_name)));
            *err_msg = "cannot use ldapsearchattribute together with ldapsearchfilter";
            return NULL;
        }
    }
 
    if (parsedline->auth_method == uaRADIUS)
    {
        MANDATORY_AUTH_ARG(parsedline->radiusservers, "radiusservers", "radius");
        MANDATORY_AUTH_ARG(parsedline->radiussecrets, "radiussecrets", "radius");
 
        if (parsedline->radiusservers == NIL)
        {
            ereport(elevel,
                    (errcode(ERRCODE_CONFIG_FILE_ERROR),
                     errmsg("list of RADIUS servers cannot be empty"),
                     errcontext("line %d of configuration file \"%s\"",
                                line_num, file_name)));
            *err_msg = "list of RADIUS servers cannot be empty";
            return NULL;
        }
 
        if (parsedline->radiussecrets == NIL)
        {
            ereport(elevel,
                    (errcode(ERRCODE_CONFIG_FILE_ERROR),
                     errmsg("list of RADIUS secrets cannot be empty"),
                     errcontext("line %d of configuration file \"%s\"",
                                line_num, file_name)));
            *err_msg = "list of RADIUS secrets cannot be empty";
            return NULL;
        }
 
        /*
         * Verify length of option lists - each can be 0 (except for secrets,
         * but that's already checked above), 1 (use the same value
         * everywhere) or the same as the number of servers.
         */
        if (!(list_length(parsedline->radiussecrets) == 1 ||
              list_length(parsedline->radiussecrets) == list_length(parsedline->radiusservers)))
        {
            ereport(elevel,
                    (errcode(ERRCODE_CONFIG_FILE_ERROR),
                     errmsg("the number of RADIUS secrets (%d) must be 1 or the same as the number of RADIUS servers (%d)",
                            list_length(parsedline->radiussecrets),
                            list_length(parsedline->radiusservers)),
                     errcontext("line %d of configuration file \"%s\"",
                                line_num, file_name)));
            *err_msg = psprintf("the number of RADIUS secrets (%d) must be 1 or the same as the number of RADIUS servers (%d)",
                                list_length(parsedline->radiussecrets),
                                list_length(parsedline->radiusservers));
            return NULL;
        }
        if (!(list_length(parsedline->radiusports) == 0 ||
              list_length(parsedline->radiusports) == 1 ||
              list_length(parsedline->radiusports) == list_length(parsedline->radiusservers)))
        {
            ereport(elevel,
                    (errcode(ERRCODE_CONFIG_FILE_ERROR),
                     errmsg("the number of RADIUS ports (%d) must be 1 or the same as the number of RADIUS servers (%d)",
                            list_length(parsedline->radiusports),
                            list_length(parsedline->radiusservers)),
                     errcontext("line %d of configuration file \"%s\"",
                                line_num, file_name)));
            *err_msg = psprintf("the number of RADIUS ports (%d) must be 1 or the same as the number of RADIUS servers (%d)",
                                list_length(parsedline->radiusports),
                                list_length(parsedline->radiusservers));
            return NULL;
        }
        if (!(list_length(parsedline->radiusidentifiers) == 0 ||
              list_length(parsedline->radiusidentifiers) == 1 ||
              list_length(parsedline->radiusidentifiers) == list_length(parsedline->radiusservers)))
        {
            ereport(elevel,
                    (errcode(ERRCODE_CONFIG_FILE_ERROR),
                     errmsg("the number of RADIUS identifiers (%d) must be 1 or the same as the number of RADIUS servers (%d)",
                            list_length(parsedline->radiusidentifiers),
                            list_length(parsedline->radiusservers)),
                     errcontext("line %d of configuration file \"%s\"",
                                line_num, file_name)));
            *err_msg = psprintf("the number of RADIUS identifiers (%d) must be 1 or the same as the number of RADIUS servers (%d)",
                                list_length(parsedline->radiusidentifiers),
                                list_length(parsedline->radiusservers));
            return NULL;
        }
    }
 
    /*
     * Enforce any parameters implied by other settings.
     */
    if (parsedline->auth_method == uaCert)
    {
        /*
         * For auth method cert, client certificate validation is mandatory,
         * and it implies the level of verify-full.
         */
        parsedline->clientcert = clientCertFull;
    }
 
    /*
     * Enforce proper configuration of OAuth authentication.
     */
    if (parsedline->auth_method == uaOAuth)
    {
        MANDATORY_AUTH_ARG(parsedline->oauth_scope, "scope", "oauth");
        MANDATORY_AUTH_ARG(parsedline->oauth_issuer, "issuer", "oauth");
 
        /* Ensure a validator library is set and permitted by the config. */
        if (!check_oauth_validator(parsedline, elevel, err_msg))
            return NULL;
 
        /*
         * Supplying a usermap combined with the option to skip usermapping is
         * nonsensical and indicates a configuration error.
         */
        if (parsedline->oauth_skip_usermap && parsedline->usermap != NULL)
        {
            ereport(elevel,
                    errcode(ERRCODE_CONFIG_FILE_ERROR),
            /* translator: strings are replaced with hba options */
                    errmsg("%s cannot be used in combination with %s",
                           "map", "delegate_ident_mapping"),
                    errcontext("line %d of configuration file \"%s\"",
                               line_num, file_name));
            *err_msg = "map cannot be used in combination with delegate_ident_mapping";
            return NULL;
        }
    }
 
    return parsedline;
}

References HbaLine::addr, HbaLine::addrlen, Assert(), HbaLine::auth_method, check_oauth_validator(), HbaLine::clientcert, clientCertFull, HbaLine::compat_realm, HbaLine::conntype, copy_auth_token(), ctHost, ctHostGSS, ctHostNoGSS, ctHostNoSSL, ctHostSSL, ctLocal, HbaLine::databases, EnableSSL, ereport, TokenizedAuthLine::err_msg, errcode(), errcontext, errhint(), errmsg(), TokenizedAuthLine::fields, TokenizedAuthLine::file_name, gai_strerror(), HbaLine::hostname, HbaLine::include_realm, HbaLine::ip_cmp_method, ipCmpAll, ipCmpMask, ipCmpSameHost, ipCmpSameNet, lappend(), HbaLine::ldapbasedn, HbaLine::ldapbinddn, HbaLine::ldapbindpasswd, HbaLine::ldapprefix, HbaLine::ldapsearchattribute, HbaLine::ldapsearchfilter, HbaLine::ldapserver, HbaLine::ldapsuffix, List::length, lfirst, TokenizedAuthLine::line_num, HbaLine::linenumber, linitial, list_head(), list_length(), lnext(), MANDATORY_AUTH_ARG, HbaLine::mask, HbaLine::masklen, NIL, HbaLine::oauth_issuer, HbaLine::oauth_scope, HbaLine::oauth_skip_usermap, palloc0(), parse_hba_auth_opt(), pfree(), pg_freeaddrinfo_all(), pg_getaddrinfo_all(), pg_sockaddr_cidr_mask(), psprintf(), pstrdup(), HbaLine::radiusidentifiers, HbaLine::radiusports, HbaLine::radiussecrets, HbaLine::radiusservers, TokenizedAuthLine::raw_line, HbaLine::rawline, regcomp_auth_token(), HbaLine::roles, HbaLine::sourcefile, str, token, token_is_keyword, uaBSD, uaCert, uaGSS, uaIdent, uaLDAP, uaMD5, uaOAuth, uaPAM, uaPassword, uaPeer, uaRADIUS, uaReject, uaSCRAM, uaSSPI, uaTrust, HbaLine::upn_username, HbaLine::usermap, and val.

Referenced by fill_hba_view(), and load_hba().

parse_ident_line()

IdentLine * parse_ident_line	(	TokenizedAuthLine *	tok_line,
		int	elevel
	)

Definition at line 2751 of file hba.c.

{
    int         line_num = tok_line->line_num;
    char       *file_name = tok_line->file_name;
    char      **err_msg = &tok_line->err_msg;
    ListCell   *field;
    List       *tokens;
    AuthToken  *token;
    IdentLine  *parsedline;
 
    Assert(tok_line->fields != NIL);
    field = list_head(tok_line->fields);
 
    parsedline = palloc0(sizeof(IdentLine));
    parsedline->linenumber = line_num;
 
    /* Get the map token (must exist) */
    tokens = lfirst(field);
    IDENT_MULTI_VALUE(tokens);
    token = linitial(tokens);
    parsedline->usermap = pstrdup(token->string);
 
    /* Get the ident user token */
    field = lnext(tok_line->fields, field);
    IDENT_FIELD_ABSENT(field);
    tokens = lfirst(field);
    IDENT_MULTI_VALUE(tokens);
    token = linitial(tokens);
 
    /* Copy the ident user token */
    parsedline->system_user = copy_auth_token(token);
 
    /* Get the PG rolename token */
    field = lnext(tok_line->fields, field);
    IDENT_FIELD_ABSENT(field);
    tokens = lfirst(field);
    IDENT_MULTI_VALUE(tokens);
    token = linitial(tokens);
    parsedline->pg_user = copy_auth_token(token);
 
    /*
     * Now that the field validation is done, compile a regex from the user
     * tokens, if necessary.
     */
    if (regcomp_auth_token(parsedline->system_user, file_name, line_num,
                           err_msg, elevel))
    {
        /* err_msg includes the error to report */
        return NULL;
    }
 
    if (regcomp_auth_token(parsedline->pg_user, file_name, line_num,
                           err_msg, elevel))
    {
        /* err_msg includes the error to report */
        return NULL;
    }
 
    return parsedline;
}

References Assert(), copy_auth_token(), TokenizedAuthLine::err_msg, TokenizedAuthLine::fields, TokenizedAuthLine::file_name, IDENT_FIELD_ABSENT, IDENT_MULTI_VALUE, lfirst, TokenizedAuthLine::line_num, IdentLine::linenumber, linitial, list_head(), lnext(), NIL, palloc0(), IdentLine::pg_user, pstrdup(), regcomp_auth_token(), IdentLine::system_user, token, and IdentLine::usermap.

Referenced by fill_ident_view(), and load_ident().

pg_isblank()

bool pg_isblank

(

const char

c

)

Definition at line 146 of file hba.c.

{
    return c == ' ' || c == '\t' || c == '\r';
}

Referenced by interpret_ident_response(), and next_token().

tokenize_auth_file()

void tokenize_auth_file	(	const char *	filename,
		FILE *	file,
		List **	tok_lines,
		int	elevel,
		int	depth
	)

Definition at line 691 of file hba.c.

{
    int         line_number = 1;
    StringInfoData buf;
    MemoryContext linecxt;
    MemoryContext funccxt;      /* context of this function's caller */
    ErrorContextCallback tokenerrcontext;
    tokenize_error_callback_arg callback_arg;
 
    Assert(tokenize_context);
 
    callback_arg.filename = filename;
    callback_arg.linenum = line_number;
 
    tokenerrcontext.callback = tokenize_error_callback;
    tokenerrcontext.arg = &callback_arg;
    tokenerrcontext.previous = error_context_stack;
    error_context_stack = &tokenerrcontext;
 
    /*
     * Do all the local tokenization in its own context, to ease the cleanup
     * of any memory allocated while tokenizing.
     */
    linecxt = AllocSetContextCreate(CurrentMemoryContext,
                                    "tokenize_auth_file",
                                    ALLOCSET_SMALL_SIZES);
    funccxt = MemoryContextSwitchTo(linecxt);
 
    initStringInfo(&buf);
 
    if (depth == CONF_FILE_START_DEPTH)
        *tok_lines = NIL;
 
    while (!feof(file) && !ferror(file))
    {
        TokenizedAuthLine *tok_line;
        MemoryContext oldcxt;
        char       *lineptr;
        List       *current_line = NIL;
        char       *err_msg = NULL;
        int         last_backslash_buflen = 0;
        int         continuations = 0;
 
        /* Collect the next input line, handling backslash continuations */
        resetStringInfo(&buf);
 
        while (pg_get_line_append(file, &buf, NULL))
        {
            /* Strip trailing newline, including \r in case we're on Windows */
            buf.len = pg_strip_crlf(buf.data);
 
            /*
             * Check for backslash continuation.  The backslash must be after
             * the last place we found a continuation, else two backslashes
             * followed by two \n's would behave surprisingly.
             */
            if (buf.len > last_backslash_buflen &&
                buf.data[buf.len - 1] == '\\')
            {
                /* Continuation, so strip it and keep reading */
                buf.data[--buf.len] = '\0';
                last_backslash_buflen = buf.len;
                continuations++;
                continue;
            }
 
            /* Nope, so we have the whole line */
            break;
        }
 
        if (ferror(file))
        {
            /* I/O error! */
            int         save_errno = errno;
 
            ereport(elevel,
                    (errcode_for_file_access(),
                     errmsg("could not read file \"%s\": %m", filename)));
            errno = save_errno;
            err_msg = psprintf("could not read file \"%s\": %m",
                               filename);
            break;
        }
 
        /* Parse fields */
        lineptr = buf.data;
        while (*lineptr && err_msg == NULL)
        {
            List       *current_field;
 
            current_field = next_field_expand(filename, &lineptr,
                                              elevel, depth, &err_msg);
            /* add field to line, unless we are at EOL or comment start */
            if (current_field != NIL)
            {
                /*
                 * lappend() may do its own allocations, so move to the
                 * context for the list of tokens.
                 */
                oldcxt = MemoryContextSwitchTo(tokenize_context);
                current_line = lappend(current_line, current_field);
                MemoryContextSwitchTo(oldcxt);
            }
        }
 
        /*
         * Reached EOL; no need to emit line to TokenizedAuthLine list if it's
         * boring.
         */
        if (current_line == NIL && err_msg == NULL)
            goto next_line;
 
        /* If the line is valid, check if that's an include directive */
        if (err_msg == NULL && list_length(current_line) == 2)
        {
            AuthToken  *first,
                       *second;
 
            first = linitial(linitial_node(List, current_line));
            second = linitial(lsecond_node(List, current_line));
 
            if (strcmp(first->string, "include") == 0)
            {
                tokenize_include_file(filename, second->string, tok_lines,
                                      elevel, depth + 1, false, &err_msg);
 
                if (err_msg)
                    goto process_line;
 
                /*
                 * tokenize_auth_file() has taken care of creating the
                 * TokenizedAuthLines.
                 */
                goto next_line;
            }
            else if (strcmp(first->string, "include_dir") == 0)
            {
                char      **filenames;
                char       *dir_name = second->string;
                int         num_filenames;
                StringInfoData err_buf;
 
                filenames = GetConfFilesInDir(dir_name, filename, elevel,
                                              &num_filenames, &err_msg);
 
                if (!filenames)
                {
                    /* the error is in err_msg, so create an entry */
                    goto process_line;
                }
 
                initStringInfo(&err_buf);
                for (int i = 0; i < num_filenames; i++)
                {
                    tokenize_include_file(filename, filenames[i], tok_lines,
                                          elevel, depth + 1, false, &err_msg);
                    /* cumulate errors if any */
                    if (err_msg)
                    {
                        if (err_buf.len > 0)
                            appendStringInfoChar(&err_buf, '\n');
                        appendStringInfoString(&err_buf, err_msg);
                    }
                }
 
                /* clean up things */
                for (int i = 0; i < num_filenames; i++)
                    pfree(filenames[i]);
                pfree(filenames);
 
                /*
                 * If there were no errors, the line is fully processed,
                 * bypass the general TokenizedAuthLine processing.
                 */
                if (err_buf.len == 0)
                    goto next_line;
 
                /* Otherwise, process the cumulated errors, if any. */
                err_msg = err_buf.data;
                goto process_line;
            }
            else if (strcmp(first->string, "include_if_exists") == 0)
            {
 
                tokenize_include_file(filename, second->string, tok_lines,
                                      elevel, depth + 1, true, &err_msg);
                if (err_msg)
                    goto process_line;
 
                /*
                 * tokenize_auth_file() has taken care of creating the
                 * TokenizedAuthLines.
                 */
                goto next_line;
            }
        }
 
process_line:
 
        /*
         * General processing: report the error if any and emit line to the
         * TokenizedAuthLine.  This is saved in the memory context dedicated
         * to this list.
         */
        oldcxt = MemoryContextSwitchTo(tokenize_context);
        tok_line = (TokenizedAuthLine *) palloc0(sizeof(TokenizedAuthLine));
        tok_line->fields = current_line;
        tok_line->file_name = pstrdup(filename);
        tok_line->line_num = line_number;
        tok_line->raw_line = pstrdup(buf.data);
        tok_line->err_msg = err_msg ? pstrdup(err_msg) : NULL;
        *tok_lines = lappend(*tok_lines, tok_line);
        MemoryContextSwitchTo(oldcxt);
 
next_line:
        line_number += continuations + 1;
        callback_arg.linenum = line_number;
    }
 
    MemoryContextSwitchTo(funccxt);
    MemoryContextDelete(linecxt);
 
    error_context_stack = tokenerrcontext.previous;
}

References ALLOCSET_SMALL_SIZES, AllocSetContextCreate, appendStringInfoChar(), appendStringInfoString(), ErrorContextCallback::arg, Assert(), buf, ErrorContextCallback::callback, CONF_FILE_START_DEPTH, CurrentMemoryContext, StringInfoData::data, ereport, TokenizedAuthLine::err_msg, errcode_for_file_access(), errmsg(), error_context_stack, TokenizedAuthLine::fields, TokenizedAuthLine::file_name, tokenize_error_callback_arg::filename, filename, GetConfFilesInDir(), i, initStringInfo(), lappend(), StringInfoData::len, TokenizedAuthLine::line_num, tokenize_error_callback_arg::linenum, linitial, linitial_node, list_length(), lsecond_node, MemoryContextDelete(), MemoryContextSwitchTo(), next_field_expand(), NIL, palloc0(), pfree(), pg_get_line_append(), pg_strip_crlf(), ErrorContextCallback::previous, psprintf(), pstrdup(), TokenizedAuthLine::raw_line, resetStringInfo(), AuthToken::string, tokenize_context, tokenize_error_callback(), and tokenize_include_file().

Referenced by fill_hba_view(), fill_ident_view(), load_hba(), load_ident(), tokenize_expand_file(), and tokenize_include_file().