granicus.if.org Git - postgresql/blob - src/backend/libpq/hba.c

   1 /*-------------------------------------------------------------------------
   2  *
   3  * hba.c
   4  *        Routines to handle host based authentication (that's the scheme
   5  *        wherein you authenticate a user by seeing what IP address the system
   6  *        says he comes from and choosing authentication method based on it).
   7  *
   8  * Portions Copyright (c) 1996-2011, PostgreSQL Global Development Group
   9  * Portions Copyright (c) 1994, Regents of the University of California
  10  *
  11  *
  12  * IDENTIFICATION
  13  *        src/backend/libpq/hba.c
  14  *
  15  *-------------------------------------------------------------------------
  16  */
  17 #include "postgres.h"
  18
  19 #include <ctype.h>
  20 #include <pwd.h>
  21 #include <fcntl.h>
  22 #include <sys/param.h>
  23 #include <sys/socket.h>
  24 #include <netinet/in.h>
  25 #include <arpa/inet.h>
  26 #include <unistd.h>
  27
  28 #include "catalog/pg_collation.h"
  29 #include "libpq/ip.h"
  30 #include "libpq/libpq.h"
  31 #include "postmaster/postmaster.h"
  32 #include "regex/regex.h"
  33 #include "replication/walsender.h"
  34 #include "storage/fd.h"
  35 #include "utils/acl.h"
  36 #include "utils/guc.h"
  37 #include "utils/lsyscache.h"
  38 #include "utils/memutils.h"
  39
  40
  41 #define atooid(x)  ((Oid) strtoul((x), NULL, 10))
  42 #define atoxid(x)  ((TransactionId) strtoul((x), NULL, 10))
  43
  44 #define MAX_TOKEN       256
  45
  46 /* callback data for check_network_callback */
  47 typedef struct check_network_data
  48 {
  49         IPCompareMethod method;         /* test method */
  50         SockAddr   *raddr;                      /* client's actual address */
  51         bool            result;                 /* set to true if match */
  52 } check_network_data;
  53
  54
  55 #define token_is_keyword(t, k)  (!t->quoted && strcmp(t->string, k) == 0)
  56 #define token_matches(t, k)  (strcmp(t->string, k) == 0)
  57
  58 /*
  59  * A single string token lexed from the HBA config file, together with whether
  60  * the token had been quoted.
  61  */
  62 typedef struct HbaToken
  63 {
  64         char   *string;
  65         bool    quoted;
  66 } HbaToken;
  67
  68 /*
  69  * pre-parsed content of HBA config file: list of HbaLine structs.
  70  * parsed_hba_context is the memory context where it lives.
  71  */
  72 static List *parsed_hba_lines = NIL;
  73 static MemoryContext parsed_hba_context = NULL;
  74
  75 /*
  76  * These variables hold the pre-parsed contents of the ident usermap
  77  * configuration file.  ident_lines is a triple-nested list of lines, fields
  78  * and tokens, as returned by tokenize_file.  There will be one line in
  79  * ident_lines for each (non-empty, non-comment) line of the file.  Note there
  80  * will always be at least one field, since blank lines are not entered in the
  81  * data structure.  ident_line_nums is an integer list containing the actual
  82  * line number for each line represented in ident_lines.  ident_context is
  83  * the memory context holding all this.
  84  */
  85 static List *ident_lines = NIL;
  86 static List *ident_line_nums = NIL;
  87 static MemoryContext ident_context = NULL;
  88
  89
  90 static MemoryContext tokenize_file(const char *filename, FILE *file,
  91                           List **lines, List **line_nums);
  92 static List *tokenize_inc_file(List *tokens, const char *outer_filename,
  93                                   const char *inc_filename);
  94 static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
  95                                    int line_num);
  96
  97 /*
  98  * isblank() exists in the ISO C99 spec, but it's not very portable yet,
  99  * so provide our own version.
 100  */
 101 bool
 102 pg_isblank(const char c)
 103 {
 104         return c == ' ' || c == '\t' || c == '\r';
 105 }
 106
 107
 108 /*
 109  * Grab one token out of fp. Tokens are strings of non-blank
 110  * characters bounded by blank characters, commas, beginning of line, and
 111  * end of line. Blank means space or tab. Tokens can be delimited by
 112  * double quotes (this allows the inclusion of blanks, but not newlines).
 113  *
 114  * The token, if any, is returned at *buf (a buffer of size bufsz).
 115  * Also, we set *initial_quote to indicate whether there was quoting before
 116  * the first character.  (We use that to prevent "@x" from being treated
 117  * as a file inclusion request.  Note that @"x" should be so treated;
 118  * we want to allow that to support embedded spaces in file paths.)
 119  * We set *terminating_comma to indicate whether the token is terminated by a
 120  * comma (which is not returned.)
 121  *
 122  * If successful: store null-terminated token at *buf and return TRUE.
 123  * If no more tokens on line: set *buf = '\0' and return FALSE.
 124  *
 125  * Leave file positioned at the character immediately after the token or EOF,
 126  * whichever comes first. If no more tokens on line, position the file to the
 127  * beginning of the next line or EOF, whichever comes first.
 128  *
 129  * Handle comments.
 130  */
 131 static bool
 132 next_token(FILE *fp, char *buf, int bufsz, bool *initial_quote,
 133                    bool *terminating_comma)
 134 {
 135         int                     c;
 136         char       *start_buf = buf;
 137         char       *end_buf = buf + (bufsz - 2);
 138         bool            in_quote = false;
 139         bool            was_quote = false;
 140         bool            saw_quote = false;
 141
 142         /* end_buf reserves two bytes to ensure we can append \n and \0 */
 143         Assert(end_buf > start_buf);
 144
 145         *initial_quote = false;
 146         *terminating_comma = false;
 147
 148         /* Move over initial whitespace and commas */
 149         while ((c = getc(fp)) != EOF && (pg_isblank(c) || c == ','))
 150                 ;
 151
 152         if (c == EOF || c == '\n')
 153         {
 154                 *buf = '\0';
 155                 return false;
 156         }
 157
 158         /*
 159          * Build a token in buf of next characters up to EOF, EOL, unquoted comma,
 160          * or unquoted whitespace.
 161          */
 162         while (c != EOF && c != '\n' &&
 163                    (!pg_isblank(c) || in_quote))
 164         {
 165                 /* skip comments to EOL */
 166                 if (c == '#' && !in_quote)
 167                 {
 168                         while ((c = getc(fp)) != EOF && c != '\n')
 169                                 ;
 170                         /* If only comment, consume EOL too; return EOL */
 171                         if (c != EOF && buf == start_buf)
 172                                 c = getc(fp);
 173                         break;
 174                 }
 175
 176                 if (buf >= end_buf)
 177                 {
 178                         *buf = '\0';
 179                         ereport(LOG,
 180                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
 181                            errmsg("authentication file token too long, skipping: \"%s\"",
 182                                           start_buf)));
 183                         /* Discard remainder of line */
 184                         while ((c = getc(fp)) != EOF && c != '\n')
 185                                 ;
 186                         break;
 187                 }
 188
 189                 /* we do not pass back the comma in the token */
 190                 if (c == ',' && !in_quote)
 191                 {
 192                         *terminating_comma = true;
 193                         break;
 194                 }
 195
 196                 if (c != '"' || was_quote)
 197                         *buf++ = c;
 198
 199                 /* Literal double-quote is two double-quotes */
 200                 if (in_quote && c == '"')
 201                         was_quote = !was_quote;
 202                 else
 203                         was_quote = false;
 204
 205                 if (c == '"')
 206                 {
 207                         in_quote = !in_quote;
 208                         saw_quote = true;
 209                         if (buf == start_buf)
 210                                 *initial_quote = true;
 211                 }
 212
 213                 c = getc(fp);
 214         }
 215
 216         /*
 217          * Put back the char right after the token (critical in case it is EOL,
 218          * since we need to detect end-of-line at next call).
 219          */
 220         if (c != EOF)
 221                 ungetc(c, fp);
 222
 223         *buf = '\0';
 224
 225         return (saw_quote || buf > start_buf);
 226 }
 227
 228 static HbaToken *
 229 make_hba_token(char *token, bool quoted)
 230 {
 231         HbaToken   *hbatoken;
 232         int                     toklen;
 233
 234         toklen = strlen(token);
 235         hbatoken = (HbaToken *) palloc(sizeof(HbaToken) + toklen + 1);
 236         hbatoken->string = (char *) hbatoken + sizeof(HbaToken);
 237         hbatoken->quoted = quoted;
 238         memcpy(hbatoken->string, token, toklen + 1);
 239
 240         return hbatoken;
 241 }
 242
 243 /*
 244  * Copy a HbaToken struct into freshly palloc'd memory.
 245  */
 246 static HbaToken *
 247 copy_hba_token(HbaToken *in)
 248 {
 249         HbaToken *out = make_hba_token(in->string, in->quoted);
 250
 251         return out;
 252 }
 253
 254
 255 /*
 256  * Tokenize one HBA field from a file, handling file inclusion and comma lists.
 257  *
 258  * The result is a List of HbaToken structs for each individual token,
 259  * or NIL if we reached EOL.
 260  */
 261 static List *
 262 next_field_expand(const char *filename, FILE *file)
 263 {
 264         char            buf[MAX_TOKEN];
 265         bool            trailing_comma;
 266         bool            initial_quote;
 267         List       *tokens = NIL;
 268
 269         do
 270         {
 271                 if (!next_token(file, buf, sizeof(buf), &initial_quote, &trailing_comma))
 272                         break;
 273
 274                 /* Is this referencing a file? */
 275                 if (!initial_quote && buf[0] == '@' && buf[1] != '\0')
 276                         tokens = tokenize_inc_file(tokens, filename, buf + 1);
 277                 else
 278                         tokens = lappend(tokens, make_hba_token(buf, initial_quote));
 279         } while (trailing_comma);
 280
 281         return tokens;
 282 }
 283
 284 /*
 285  * tokenize_inc_file
 286  *              Expand a file included from another file into an hba "field"
 287  *
 288  * Opens and tokenises a file included from another HBA config file with @,
 289  * and returns all values found therein as a flat list of HbaTokens.  If a
 290  * @-token is found, recursively expand it.  The given token list is used as
 291  * initial contents of list (so foo,bar,@baz does what you expect).
 292  */
 293 static List *
 294 tokenize_inc_file(List *tokens,
 295                                   const char *outer_filename,
 296                                   const char *inc_filename)
 297 {
 298         char       *inc_fullname;
 299         FILE       *inc_file;
 300         List       *inc_lines;
 301         List       *inc_line_nums;
 302         ListCell   *inc_line;
 303         MemoryContext linecxt;
 304
 305         if (is_absolute_path(inc_filename))
 306         {
 307                 /* absolute path is taken as-is */
 308                 inc_fullname = pstrdup(inc_filename);
 309         }
 310         else
 311         {
 312                 /* relative path is relative to dir of calling file */
 313                 inc_fullname = (char *) palloc(strlen(outer_filename) + 1 +
 314                                                                            strlen(inc_filename) + 1);
 315                 strcpy(inc_fullname, outer_filename);
 316                 get_parent_directory(inc_fullname);
 317                 join_path_components(inc_fullname, inc_fullname, inc_filename);
 318                 canonicalize_path(inc_fullname);
 319         }
 320
 321         inc_file = AllocateFile(inc_fullname, "r");
 322         if (inc_file == NULL)
 323         {
 324                 ereport(LOG,
 325                                 (errcode_for_file_access(),
 326                                  errmsg("could not open secondary authentication file \"@%s\" as \"%s\": %m",
 327                                                 inc_filename, inc_fullname)));
 328                 pfree(inc_fullname);
 329                 return tokens;
 330         }
 331
 332         /* There is possible recursion here if the file contains @ */
 333         linecxt = tokenize_file(inc_fullname, inc_file, &inc_lines, &inc_line_nums);
 334
 335         FreeFile(inc_file);
 336         pfree(inc_fullname);
 337
 338         foreach(inc_line, inc_lines)
 339         {
 340                 List       *inc_fields = lfirst(inc_line);
 341                 ListCell   *inc_field;
 342
 343                 foreach(inc_field, inc_fields)
 344                 {
 345                         List       *inc_tokens = lfirst(inc_field);
 346                         ListCell   *inc_token;
 347
 348                         foreach(inc_token, inc_tokens)
 349                         {
 350                                 HbaToken   *token = lfirst(inc_token);
 351
 352                                 tokens = lappend(tokens, copy_hba_token(token));
 353                         }
 354                 }
 355         }
 356
 357         MemoryContextDelete(linecxt);
 358         return tokens;
 359 }
 360
 361 /*
 362  * Tokenize the given file, storing the resulting data into two Lists: a
 363  * List of lines, and a List of line numbers.
 364  *
 365  * The list of lines is a triple-nested List structure.  Each line is a List of
 366  * fields, and each field is a List of HbaTokens.
 367  *
 368  * filename must be the absolute path to the target file.
 369  *
 370  * Return value is a memory context which contains all memory allocated by
 371  * this function.
 372  */
 373 static MemoryContext
 374 tokenize_file(const char *filename, FILE *file,
 375                           List **lines, List **line_nums)
 376 {
 377         List       *current_line = NIL;
 378         List       *current_field = NIL;
 379         int                     line_number = 1;
 380         MemoryContext   linecxt;
 381         MemoryContext   oldcxt;
 382
 383         linecxt = AllocSetContextCreate(TopMemoryContext,
 384                                                                         "tokenize file cxt",
 385                                                                         ALLOCSET_DEFAULT_MINSIZE,
 386                                                                         ALLOCSET_DEFAULT_INITSIZE,
 387                                                                         ALLOCSET_DEFAULT_MAXSIZE);
 388         oldcxt = MemoryContextSwitchTo(linecxt);
 389
 390         *lines = *line_nums = NIL;
 391
 392         while (!feof(file) && !ferror(file))
 393         {
 394                 current_field = next_field_expand(filename, file);
 395
 396                 /* add tokens to list, unless we are at EOL or comment start */
 397                 if (list_length(current_field) > 0)
 398                 {
 399                         if (current_line == NIL)
 400                         {
 401                                 /* make a new line List, record its line number */
 402                                 current_line = lappend(current_line, current_field);
 403                                 *lines = lappend(*lines, current_line);
 404                                 *line_nums = lappend_int(*line_nums, line_number);
 405                         }
 406                         else
 407                         {
 408                                 /* append tokens to current line's list */
 409                                 current_line = lappend(current_line, current_field);
 410                         }
 411                 }
 412                 else
 413                 {
 414                         /* we are at real or logical EOL, so force a new line List */
 415                         current_line = NIL;
 416                         line_number++;
 417                 }
 418         }
 419
 420         MemoryContextSwitchTo(oldcxt);
 421
 422         return linecxt;
 423 }
 424
 425
 426 /*
 427  * Does user belong to role?
 428  *
 429  * userid is the OID of the role given as the attempted login identifier.
 430  * We check to see if it is a member of the specified role name.
 431  */
 432 static bool
 433 is_member(Oid userid, const char *role)
 434 {
 435         Oid                     roleid;
 436
 437         if (!OidIsValid(userid))
 438                 return false;                   /* if user not exist, say "no" */
 439
 440         roleid = get_role_oid(role, true);
 441
 442         if (!OidIsValid(roleid))
 443                 return false;                   /* if target role not exist, say "no" */
 444
 445         /* See if user is directly or indirectly a member of role */
 446         return is_member_of_role(userid, roleid);
 447 }
 448
 449 /*
 450  * Check HbaToken list for a match to role, allowing group names.
 451  */
 452 static bool
 453 check_role(const char *role, Oid roleid, List *tokens)
 454 {
 455         ListCell           *cell;
 456         HbaToken           *tok;
 457
 458         foreach(cell, tokens)
 459         {
 460                 tok = lfirst(cell);
 461                 if (!tok->quoted && tok->string[0] == '+')
 462                 {
 463                         if (is_member(roleid, tok->string + 1))
 464                                 return true;
 465                 }
 466                 else if (token_matches(tok, role) ||
 467                                  token_is_keyword(tok, "all"))
 468                         return true;
 469         }
 470         return false;
 471 }
 472
 473 /*
 474  * Check to see if db/role combination matches HbaToken list.
 475  */
 476 static bool
 477 check_db(const char *dbname, const char *role, Oid roleid, List *tokens)
 478 {
 479         ListCell           *cell;
 480         HbaToken           *tok;
 481
 482         foreach(cell, tokens)
 483         {
 484                 tok = lfirst(cell);
 485                 if (am_walsender)
 486                 {
 487                         /* walsender connections can only match replication keyword */
 488                         if (token_is_keyword(tok, "replication"))
 489                                 return true;
 490                 }
 491                 else if (token_is_keyword(tok, "all"))
 492                         return true;
 493                 else if (token_is_keyword(tok, "sameuser"))
 494                 {
 495                         if (strcmp(dbname, role) == 0)
 496                                 return true;
 497                 }
 498                 else if (token_is_keyword(tok, "samegroup") ||
 499                                  token_is_keyword(tok, "samerole"))
 500                 {
 501                         if (is_member(roleid, dbname))
 502                                 return true;
 503                 }
 504                 else if (token_is_keyword(tok, "replication"))
 505                         continue;                       /* never match this if not walsender */
 506                 else if (token_matches(tok, dbname))
 507                         return true;
 508         }
 509         return false;
 510 }
 511
 512 static bool
 513 ipv4eq(struct sockaddr_in * a, struct sockaddr_in * b)
 514 {
 515         return (a->sin_addr.s_addr == b->sin_addr.s_addr);
 516 }
 517
 518 #ifdef HAVE_IPV6
 519
 520 static bool
 521 ipv6eq(struct sockaddr_in6 * a, struct sockaddr_in6 * b)
 522 {
 523         int                     i;
 524
 525         for (i = 0; i < 16; i++)
 526                 if (a->sin6_addr.s6_addr[i] != b->sin6_addr.s6_addr[i])
 527                         return false;
 528
 529         return true;
 530 }
 531 #endif   /* HAVE_IPV6 */
 532
 533 /*
 534  * Check whether host name matches pattern.
 535  */
 536 static bool
 537 hostname_match(const char *pattern, const char *actual_hostname)
 538 {
 539         if (pattern[0] == '.')          /* suffix match */
 540         {
 541                 size_t          plen = strlen(pattern);
 542                 size_t          hlen = strlen(actual_hostname);
 543
 544                 if (hlen < plen)
 545                         return false;
 546
 547                 return (pg_strcasecmp(pattern, actual_hostname + (hlen - plen)) == 0);
 548         }
 549         else
 550                 return (pg_strcasecmp(pattern, actual_hostname) == 0);
 551 }
 552
 553 /*
 554  * Check to see if a connecting IP matches a given host name.
 555  */
 556 static bool
 557 check_hostname(hbaPort *port, const char *hostname)
 558 {
 559         struct addrinfo *gai_result,
 560                            *gai;
 561         int                     ret;
 562         bool            found;
 563
 564         /* Lookup remote host name if not already done */
 565         if (!port->remote_hostname)
 566         {
 567                 char            remote_hostname[NI_MAXHOST];
 568
 569                 if (pg_getnameinfo_all(&port->raddr.addr, port->raddr.salen,
 570                                                            remote_hostname, sizeof(remote_hostname),
 571                                                            NULL, 0,
 572                                                            0))
 573                         return false;
 574
 575                 port->remote_hostname = pstrdup(remote_hostname);
 576         }
 577
 578         if (!hostname_match(hostname, port->remote_hostname))
 579                 return false;
 580
 581         /* Lookup IP from host name and check against original IP */
 582
 583         if (port->remote_hostname_resolv == +1)
 584                 return true;
 585         if (port->remote_hostname_resolv == -1)
 586                 return false;
 587
 588         ret = getaddrinfo(port->remote_hostname, NULL, NULL, &gai_result);
 589         if (ret != 0)
 590                 ereport(ERROR,
 591                                 (errmsg("could not translate host name \"%s\" to address: %s",
 592                                                 port->remote_hostname, gai_strerror(ret))));
 593
 594         found = false;
 595         for (gai = gai_result; gai; gai = gai->ai_next)
 596         {
 597                 if (gai->ai_addr->sa_family == port->raddr.addr.ss_family)
 598                 {
 599                         if (gai->ai_addr->sa_family == AF_INET)
 600                         {
 601                                 if (ipv4eq((struct sockaddr_in *) gai->ai_addr,
 602                                                    (struct sockaddr_in *) & port->raddr.addr))
 603                                 {
 604                                         found = true;
 605                                         break;
 606                                 }
 607                         }
 608 #ifdef HAVE_IPV6
 609                         else if (gai->ai_addr->sa_family == AF_INET6)
 610                         {
 611                                 if (ipv6eq((struct sockaddr_in6 *) gai->ai_addr,
 612                                                    (struct sockaddr_in6 *) & port->raddr.addr))
 613                                 {
 614                                         found = true;
 615                                         break;
 616                                 }
 617                         }
 618 #endif
 619                 }
 620         }
 621
 622         if (gai_result)
 623                 freeaddrinfo(gai_result);
 624
 625         if (!found)
 626                 elog(DEBUG2, "pg_hba.conf host name \"%s\" rejected because address resolution did not return a match with IP address of client",
 627                          hostname);
 628
 629         port->remote_hostname_resolv = found ? +1 : -1;
 630
 631         return found;
 632 }
 633
 634 /*
 635  * Check to see if a connecting IP matches the given address and netmask.
 636  */
 637 static bool
 638 check_ip(SockAddr *raddr, struct sockaddr * addr, struct sockaddr * mask)
 639 {
 640         if (raddr->addr.ss_family == addr->sa_family)
 641         {
 642                 /* Same address family */
 643                 if (!pg_range_sockaddr(&raddr->addr,
 644                                                            (struct sockaddr_storage *) addr,
 645                                                            (struct sockaddr_storage *) mask))
 646                         return false;
 647         }
 648 #ifdef HAVE_IPV6
 649         else if (addr->sa_family == AF_INET &&
 650                          raddr->addr.ss_family == AF_INET6)
 651         {
 652                 /*
 653                  * If we're connected on IPv6 but the file specifies an IPv4 address
 654                  * to match against, promote the latter to an IPv6 address before
 655                  * trying to match the client's address.
 656                  */
 657                 struct sockaddr_storage addrcopy,
 658                                         maskcopy;
 659
 660                 memcpy(&addrcopy, &addr, sizeof(addrcopy));
 661                 memcpy(&maskcopy, &mask, sizeof(maskcopy));
 662                 pg_promote_v4_to_v6_addr(&addrcopy);
 663                 pg_promote_v4_to_v6_mask(&maskcopy);
 664
 665                 if (!pg_range_sockaddr(&raddr->addr, &addrcopy, &maskcopy))
 666                         return false;
 667         }
 668 #endif   /* HAVE_IPV6 */
 669         else
 670         {
 671                 /* Wrong address family, no IPV6 */
 672                 return false;
 673         }
 674
 675         return true;
 676 }
 677
 678 /*
 679  * pg_foreach_ifaddr callback: does client addr match this machine interface?
 680  */
 681 static void
 682 check_network_callback(struct sockaddr * addr, struct sockaddr * netmask,
 683                                            void *cb_data)
 684 {
 685         check_network_data *cn = (check_network_data *) cb_data;
 686         struct sockaddr_storage mask;
 687
 688         /* Already found a match? */
 689         if (cn->result)
 690                 return;
 691
 692         if (cn->method == ipCmpSameHost)
 693         {
 694                 /* Make an all-ones netmask of appropriate length for family */
 695                 pg_sockaddr_cidr_mask(&mask, NULL, addr->sa_family);
 696                 cn->result = check_ip(cn->raddr, addr, (struct sockaddr *) & mask);
 697         }
 698         else
 699         {
 700                 /* Use the netmask of the interface itself */
 701                 cn->result = check_ip(cn->raddr, addr, netmask);
 702         }
 703 }
 704
 705 /*
 706  * Use pg_foreach_ifaddr to check a samehost or samenet match
 707  */
 708 static bool
 709 check_same_host_or_net(SockAddr *raddr, IPCompareMethod method)
 710 {
 711         check_network_data cn;
 712
 713         cn.method = method;
 714         cn.raddr = raddr;
 715         cn.result = false;
 716
 717         errno = 0;
 718         if (pg_foreach_ifaddr(check_network_callback, &cn) < 0)
 719         {
 720                 elog(LOG, "error enumerating network interfaces: %m");
 721                 return false;
 722         }
 723
 724         return cn.result;
 725 }
 726
 727
 728 /*
 729  * Macros used to check and report on invalid configuration options.
 730  * INVALID_AUTH_OPTION = reports when an option is specified for a method where it's
 731  *                                               not supported.
 732  * REQUIRE_AUTH_OPTION = same as INVALID_AUTH_OPTION, except it also checks if the
 733  *                                               method is actually the one specified. Used as a shortcut when
 734  *                                               the option is only valid for one authentication method.
 735  * MANDATORY_AUTH_ARG  = check if a required option is set for an authentication method,
 736  *                                               reporting error if it's not.
 737  */
 738 #define INVALID_AUTH_OPTION(optname, validmethods) do {\
 739         ereport(LOG, \
 740                         (errcode(ERRCODE_CONFIG_FILE_ERROR), \
 741                          /* translator: the second %s is a list of auth methods */ \
 742                          errmsg("authentication option \"%s\" is only valid for authentication methods %s", \
 743                                         optname, _(validmethods)), \
 744                          errcontext("line %d of configuration file \"%s\"", \
 745                                         line_num, HbaFileName))); \
 746         return false; \
 747 } while (0);
 748
 749 #define REQUIRE_AUTH_OPTION(methodval, optname, validmethods) do {\
 750         if (hbaline->auth_method != methodval) \
 751                 INVALID_AUTH_OPTION(optname, validmethods); \
 752 } while (0);
 753
 754 #define MANDATORY_AUTH_ARG(argvar, argname, authname) do {\
 755         if (argvar == NULL) {\
 756                 ereport(LOG, \
 757                                 (errcode(ERRCODE_CONFIG_FILE_ERROR), \
 758                                  errmsg("authentication method \"%s\" requires argument \"%s\" to be set", \
 759                                                 authname, argname), \
 760                                  errcontext("line %d of configuration file \"%s\"", \
 761                                                 line_num, HbaFileName))); \
 762                 return false; \
 763         } \
 764 } while (0);
 765
 766 /*
 767  * IDENT_FIELD_ABSENT:
 768  * Throw an error and exit the function if the given ident field ListCell is
 769  * not populated.
 770  *
 771  * IDENT_MULTI_VALUE:
 772  * Throw an error and exit the function if the given ident token List has more
 773  * than one element.
 774  */
 775 #define IDENT_FIELD_ABSENT(field) do {\
 776         if (!field) { \
 777                 ereport(LOG, \
 778                                 (errcode(ERRCODE_CONFIG_FILE_ERROR), \
 779                                  errmsg("missing entry in file \"%s\" at end of line %d", \
 780                                                 IdentFileName, line_number))); \
 781                 *error_p = true; \
 782                 return; \
 783         } \
 784 } while (0);
 785
 786 #define IDENT_MULTI_VALUE(tokens) do {\
 787         if (tokens->length > 1) { \
 788                 ereport(LOG, \
 789                                 (errcode(ERRCODE_CONFIG_FILE_ERROR), \
 790                                  errmsg("multiple values in ident field"), \
 791                                  errcontext("line %d of configuration file \"%s\"", \
 792                                                 line_number, IdentFileName))); \
 793                 *error_p = true; \
 794                 return; \
 795         } \
 796 } while (0);
 797
 798
 799 /*
 800  * Parse one tokenised line from the hba config file and store the result in a
 801  * HbaLine structure, or NULL if parsing fails.
 802  *
 803  * The tokenised line is a List of fields, each field being a List of
 804  * HbaTokens.
 805  *
 806  * Note: this function leaks memory when an error occurs.  Caller is expected
 807  * to have set a memory context that will be reset if this function returns
 808  * NULL.
 809  */
 810 static HbaLine *
 811 parse_hba_line(List *line, int line_num)
 812 {
 813         char       *str;
 814         struct addrinfo *gai_result;
 815         struct addrinfo hints;
 816         int                     ret;
 817         char       *cidr_slash;
 818         char       *unsupauth;
 819         ListCell   *field;
 820         List       *tokens;
 821         ListCell   *tokencell;
 822         HbaToken   *token;
 823         HbaLine    *parsedline;
 824
 825         parsedline = palloc0(sizeof(HbaLine));
 826         parsedline->linenumber = line_num;
 827
 828         /* Check the record type. */
 829         field = list_head(line);
 830         tokens = lfirst(field);
 831         if (tokens->length > 1)
 832         {
 833                 ereport(LOG,
 834                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
 835                                  errmsg("multiple values specified for connection type"),
 836                                  errhint("Specify exactly one connection type per line."),
 837                                  errcontext("line %d of configuration file \"%s\"",
 838                                                         line_num, HbaFileName)));
 839                 return NULL;
 840         }
 841         token = linitial(tokens);
 842         if (strcmp(token->string, "local") == 0)
 843         {
 844 #ifdef HAVE_UNIX_SOCKETS
 845                 parsedline->conntype = ctLocal;
 846 #else
 847                 ereport(LOG,
 848                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
 849                                  errmsg("local connections are not supported by this build"),
 850                                  errcontext("line %d of configuration file \"%s\"",
 851                                                         line_num, HbaFileName)));
 852                 return NULL;
 853 #endif
 854         }
 855         else if (strcmp(token->string, "host") == 0 ||
 856                          strcmp(token->string, "hostssl") == 0 ||
 857                          strcmp(token->string, "hostnossl") == 0)
 858         {
 859
 860                 if (token->string[4] == 's')    /* "hostssl" */
 861                 {
 862                         /* SSL support must be actually active, else complain */
 863 #ifdef USE_SSL
 864                         if (EnableSSL)
 865                                 parsedline->conntype = ctHostSSL;
 866                         else
 867                         {
 868                                 ereport(LOG,
 869                                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
 870                                                  errmsg("hostssl requires SSL to be turned on"),
 871                                                  errhint("Set ssl = on in postgresql.conf."),
 872                                                  errcontext("line %d of configuration file \"%s\"",
 873                                                                         line_num, HbaFileName)));
 874                                 return NULL;
 875                         }
 876 #else
 877                         ereport(LOG,
 878                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
 879                                          errmsg("hostssl is not supported by this build"),
 880                           errhint("Compile with --with-openssl to use SSL connections."),
 881                                          errcontext("line %d of configuration file \"%s\"",
 882                                                                 line_num, HbaFileName)));
 883                         return NULL;
 884 #endif
 885                 }
 886 #ifdef USE_SSL
 887                 else if (token->string[4] == 'n')               /* "hostnossl" */
 888                 {
 889                         parsedline->conntype = ctHostNoSSL;
 890                 }
 891 #endif
 892                 else
 893                 {
 894                         /* "host", or "hostnossl" and SSL support not built in */
 895                         parsedline->conntype = ctHost;
 896                 }
 897         }                                                       /* record type */
 898         else
 899         {
 900                 ereport(LOG,
 901                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
 902                                  errmsg("invalid connection type \"%s\"",
 903                                                 token->string),
 904                                  errcontext("line %d of configuration file \"%s\"",
 905                                                         line_num, HbaFileName)));
 906                 return NULL;
 907         }
 908
 909         /* Get the databases. */
 910         field = lnext(field);
 911         if (!field)
 912         {
 913                 ereport(LOG,
 914                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
 915                                  errmsg("end-of-line before database specification"),
 916                                  errcontext("line %d of configuration file \"%s\"",
 917                                                         line_num, HbaFileName)));
 918                 return NULL;
 919         }
 920         parsedline->databases = NIL;
 921         tokens = lfirst(field);
 922         foreach(tokencell, tokens)
 923         {
 924                 parsedline->databases = lappend(parsedline->databases,
 925                                                                                 copy_hba_token(lfirst(tokencell)));
 926         }
 927
 928         /* Get the roles. */
 929         field = lnext(field);
 930         if (!field)
 931         {
 932                 ereport(LOG,
 933                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
 934                                  errmsg("end-of-line before role specification"),
 935                                  errcontext("line %d of configuration file \"%s\"",
 936                                                         line_num, HbaFileName)));
 937                 return NULL;
 938         }
 939         parsedline->roles = NIL;
 940         tokens = lfirst(field);
 941         foreach(tokencell, tokens)
 942         {
 943                 parsedline->roles = lappend(parsedline->roles,
 944                                                                         copy_hba_token(lfirst(tokencell)));
 945         }
 946
 947         if (parsedline->conntype != ctLocal)
 948         {
 949                 /* Read the IP address field. (with or without CIDR netmask) */
 950                 field = lnext(field);
 951                 if (!field)
 952                 {
 953                         ereport(LOG,
 954                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
 955                                          errmsg("end-of-line before IP address specification"),
 956                                          errcontext("line %d of configuration file \"%s\"",
 957                                                                 line_num, HbaFileName)));
 958                         return NULL;
 959                 }
 960                 tokens = lfirst(field);
 961                 if (tokens->length > 1)
 962                 {
 963                         ereport(LOG,
 964                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
 965                                          errmsg("multiple values specified for host address"),
 966                                          errhint("Specify one address range per line."),
 967                                          errcontext("line %d of configuration file \"%s\"",
 968                                                                 line_num, HbaFileName)));
 969                         return NULL;
 970                 }
 971                 token = linitial(tokens);
 972
 973                 if (token_is_keyword(token, "all"))
 974                 {
 975                         parsedline->ip_cmp_method = ipCmpAll;
 976                 }
 977                 else if (token_is_keyword(token, "samehost"))
 978                 {
 979                         /* Any IP on this host is allowed to connect */
 980                         parsedline->ip_cmp_method = ipCmpSameHost;
 981                 }
 982                 else if (token_is_keyword(token, "samenet"))
 983                 {
 984                         /* Any IP on the host's subnets is allowed to connect */
 985                         parsedline->ip_cmp_method = ipCmpSameNet;
 986                 }
 987                 else
 988                 {
 989                         /* IP and netmask are specified */
 990                         parsedline->ip_cmp_method = ipCmpMask;
 991
 992                         /* need a modifiable copy of token */
 993                         str = pstrdup(token->string);
 994
 995                         /* Check if it has a CIDR suffix and if so isolate it */
 996                         cidr_slash = strchr(str, '/');
 997                         if (cidr_slash)
 998                                 *cidr_slash = '\0';
 999
1000                         /* Get the IP address either way */
1001                         hints.ai_flags = AI_NUMERICHOST;
1002                         hints.ai_family = PF_UNSPEC;
1003                         hints.ai_socktype = 0;
1004                         hints.ai_protocol = 0;
1005                         hints.ai_addrlen = 0;
1006                         hints.ai_canonname = NULL;
1007                         hints.ai_addr = NULL;
1008                         hints.ai_next = NULL;
1009
1010                         ret = pg_getaddrinfo_all(str, NULL, &hints, &gai_result);
1011                         if (ret == 0 && gai_result)
1012                                 memcpy(&parsedline->addr, gai_result->ai_addr,
1013                                            gai_result->ai_addrlen);
1014                         else if (ret == EAI_NONAME)
1015                                 parsedline->hostname = str;
1016                         else
1017                         {
1018                                 ereport(LOG,
1019                                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1020                                                  errmsg("invalid IP address \"%s\": %s",
1021                                                                 str, gai_strerror(ret)),
1022                                                  errcontext("line %d of configuration file \"%s\"",
1023                                                                         line_num, HbaFileName)));
1024                                 if (gai_result)
1025                                         pg_freeaddrinfo_all(hints.ai_family, gai_result);
1026                                 return NULL;
1027                         }
1028
1029                         pg_freeaddrinfo_all(hints.ai_family, gai_result);
1030
1031                         /* Get the netmask */
1032                         if (cidr_slash)
1033                         {
1034                                 if (parsedline->hostname)
1035                                 {
1036                                         ereport(LOG,
1037                                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1038                                                          errmsg("specifying both host name and CIDR mask is invalid: \"%s\"",
1039                                                                         token->string),
1040                                                          errcontext("line %d of configuration file \"%s\"",
1041                                                                                 line_num, HbaFileName)));
1042                                         return NULL;
1043                                 }
1044
1045                                 if (pg_sockaddr_cidr_mask(&parsedline->mask, cidr_slash + 1,
1046                                                                                   parsedline->addr.ss_family) < 0)
1047                                 {
1048                                         ereport(LOG,
1049                                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1050                                                          errmsg("invalid CIDR mask in address \"%s\"",
1051                                                                         token->string),
1052                                                    errcontext("line %d of configuration file \"%s\"",
1053                                                                           line_num, HbaFileName)));
1054                                         return NULL;
1055                                 }
1056                                 pfree(str);
1057                         }
1058                         else if (!parsedline->hostname)
1059                         {
1060                                 /* Read the mask field. */
1061                                 pfree(str);
1062                                 field = lnext(field);
1063                                 if (!field)
1064                                 {
1065                                         ereport(LOG,
1066                                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1067                                                   errmsg("end-of-line before netmask specification"),
1068                                                          errhint("Specify an address range in CIDR notation, or provide a separate netmask."),
1069                                                    errcontext("line %d of configuration file \"%s\"",
1070                                                                           line_num, HbaFileName)));
1071                                         return NULL;
1072                                 }
1073                                 tokens = lfirst(field);
1074                                 if (tokens->length > 1)
1075                                 {
1076                                         ereport(LOG,
1077                                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1078                                                      errmsg("multiple values specified for netmask"),
1079                                                          errcontext("line %d of configuration file \"%s\"",
1080                                                                                 line_num, HbaFileName)));
1081                                         return NULL;
1082                                 }
1083                                 token = linitial(tokens);
1084
1085                                 ret = pg_getaddrinfo_all(token->string, NULL,
1086                                                                                  &hints, &gai_result);
1087                                 if (ret || !gai_result)
1088                                 {
1089                                         ereport(LOG,
1090                                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1091                                                          errmsg("invalid IP mask \"%s\": %s",
1092                                                                         token->string, gai_strerror(ret)),
1093                                                    errcontext("line %d of configuration file \"%s\"",
1094                                                                           line_num, HbaFileName)));
1095                                         if (gai_result)
1096                                                 pg_freeaddrinfo_all(hints.ai_family, gai_result);
1097                                         return NULL;
1098                                 }
1099
1100                                 memcpy(&parsedline->mask, gai_result->ai_addr,
1101                                            gai_result->ai_addrlen);
1102                                 pg_freeaddrinfo_all(hints.ai_family, gai_result);
1103
1104                                 if (parsedline->addr.ss_family != parsedline->mask.ss_family)
1105                                 {
1106                                         ereport(LOG,
1107                                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1108                                                          errmsg("IP address and mask do not match"),
1109                                                    errcontext("line %d of configuration file \"%s\"",
1110                                                                           line_num, HbaFileName)));
1111                                         return NULL;
1112                                 }
1113                         }
1114                 }
1115         }                                                       /* != ctLocal */
1116
1117         /* Get the authentication method */
1118         field = lnext(field);
1119         if (!field)
1120         {
1121                 ereport(LOG,
1122                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1123                                  errmsg("end-of-line before authentication method"),
1124                                  errcontext("line %d of configuration file \"%s\"",
1125                                                         line_num, HbaFileName)));
1126                 return NULL;
1127         }
1128         tokens = lfirst(field);
1129         if (tokens->length > 1)
1130         {
1131                 ereport(LOG,
1132                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1133                                  errmsg("multiple values specified for authentication type"),
1134                                  errhint("Specify exactly one authentication type per line."),
1135                                  errcontext("line %d of configuration file \"%s\"",
1136                                                         line_num, HbaFileName)));
1137                 return NULL;
1138         }
1139         token = linitial(tokens);
1140
1141         unsupauth = NULL;
1142         if (strcmp(token->string, "trust") == 0)
1143                 parsedline->auth_method = uaTrust;
1144         else if (strcmp(token->string, "ident") == 0)
1145                 parsedline->auth_method = uaIdent;
1146         else if (strcmp(token->string, "peer") == 0)
1147                 parsedline->auth_method = uaPeer;
1148         else if (strcmp(token->string, "password") == 0)
1149                 parsedline->auth_method = uaPassword;
1150         else if (strcmp(token->string, "krb5") == 0)
1151 #ifdef KRB5
1152                 parsedline->auth_method = uaKrb5;
1153 #else
1154                 unsupauth = "krb5";
1155 #endif
1156         else if (strcmp(token->string, "gss") == 0)
1157 #ifdef ENABLE_GSS
1158                 parsedline->auth_method = uaGSS;
1159 #else
1160                 unsupauth = "gss";
1161 #endif
1162         else if (strcmp(token->string, "sspi") == 0)
1163 #ifdef ENABLE_SSPI
1164                 parsedline->auth_method = uaSSPI;
1165 #else
1166                 unsupauth = "sspi";
1167 #endif
1168         else if (strcmp(token->string, "reject") == 0)
1169                 parsedline->auth_method = uaReject;
1170         else if (strcmp(token->string, "md5") == 0)
1171         {
1172                 if (Db_user_namespace)
1173                 {
1174                         ereport(LOG,
1175                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1176                                          errmsg("MD5 authentication is not supported when \"db_user_namespace\" is enabled"),
1177                                          errcontext("line %d of configuration file \"%s\"",
1178                                                                 line_num, HbaFileName)));
1179                         return NULL;
1180                 }
1181                 parsedline->auth_method = uaMD5;
1182         }
1183         else if (strcmp(token->string, "pam") == 0)
1184 #ifdef USE_PAM
1185                 parsedline->auth_method = uaPAM;
1186 #else
1187                 unsupauth = "pam";
1188 #endif
1189         else if (strcmp(token->string, "ldap") == 0)
1190 #ifdef USE_LDAP
1191                 parsedline->auth_method = uaLDAP;
1192 #else
1193                 unsupauth = "ldap";
1194 #endif
1195         else if (strcmp(token->string, "cert") == 0)
1196 #ifdef USE_SSL
1197                 parsedline->auth_method = uaCert;
1198 #else
1199                 unsupauth = "cert";
1200 #endif
1201         else if (strcmp(token->string, "radius") == 0)
1202                 parsedline->auth_method = uaRADIUS;
1203         else
1204         {
1205                 ereport(LOG,
1206                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1207                                  errmsg("invalid authentication method \"%s\"",
1208                                                 token->string),
1209                                  errcontext("line %d of configuration file \"%s\"",
1210                                                         line_num, HbaFileName)));
1211                 return NULL;
1212         }
1213
1214         if (unsupauth)
1215         {
1216                 ereport(LOG,
1217                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1218                                  errmsg("invalid authentication method \"%s\": not supported by this build",
1219                                                 token->string),
1220                                  errcontext("line %d of configuration file \"%s\"",
1221                                                         line_num, HbaFileName)));
1222                 return NULL;
1223         }
1224
1225         /*
1226          * XXX: When using ident on local connections, change it to peer, for
1227          * backwards compatibility.
1228          */
1229         if (parsedline->conntype == ctLocal &&
1230                 parsedline->auth_method == uaIdent)
1231                 parsedline->auth_method = uaPeer;
1232
1233         /* Invalid authentication combinations */
1234         if (parsedline->conntype == ctLocal &&
1235                 parsedline->auth_method == uaKrb5)
1236         {
1237                 ereport(LOG,
1238                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1239                          errmsg("krb5 authentication is not supported on local sockets"),
1240                                  errcontext("line %d of configuration file \"%s\"",
1241                                                         line_num, HbaFileName)));
1242                 return NULL;
1243         }
1244
1245         if (parsedline->conntype == ctLocal &&
1246                 parsedline->auth_method == uaGSS)
1247         {
1248                 ereport(LOG,
1249                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1250                    errmsg("gssapi authentication is not supported on local sockets"),
1251                                  errcontext("line %d of configuration file \"%s\"",
1252                                                         line_num, HbaFileName)));
1253                 return NULL;
1254         }
1255
1256         if (parsedline->conntype != ctLocal &&
1257                 parsedline->auth_method == uaPeer)
1258         {
1259                 ereport(LOG,
1260                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1261                         errmsg("peer authentication is only supported on local sockets"),
1262                                  errcontext("line %d of configuration file \"%s\"",
1263                                                         line_num, HbaFileName)));
1264                 return NULL;
1265         }
1266
1267         /*
1268          * SSPI authentication can never be enabled on ctLocal connections,
1269          * because it's only supported on Windows, where ctLocal isn't supported.
1270          */
1271         if (parsedline->conntype != ctHostSSL &&
1272                 parsedline->auth_method == uaCert)
1273         {
1274                 ereport(LOG,
1275                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1276                                  errmsg("cert authentication is only supported on hostssl connections"),
1277                                  errcontext("line %d of configuration file \"%s\"",
1278                                                         line_num, HbaFileName)));
1279                 return NULL;
1280         }
1281
1282         /* Parse remaining arguments */
1283         while ((field = lnext(field)) != NULL)
1284         {
1285                 tokens = lfirst(field);
1286                 foreach(tokencell, tokens)
1287                 {
1288                         char       *val;
1289                         token = lfirst(tokencell);
1290
1291                         str = pstrdup(token->string);
1292                         val = strchr(str, '=');
1293                         if (val == NULL)
1294                         {
1295                                 /*
1296                                  * Got something that's not a name=value pair.
1297                                  */
1298                                 ereport(LOG,
1299                                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1300                                                  errmsg("authentication option not in name=value format: %s", token->string),
1301                                                  errcontext("line %d of configuration file \"%s\"",
1302                                                                         line_num, HbaFileName)));
1303                                 return NULL;
1304                         }
1305
1306                         *val++ = '\0';  /* str now holds "name", val holds "value" */
1307                         if (!parse_hba_auth_opt(str, val, parsedline, line_num))
1308                                 /* parse_hba_auth_opt already logged the error message */
1309                                 return NULL;
1310                         pfree(str);
1311                 }
1312         }
1313
1314         /*
1315          * Check if the selected authentication method has any mandatory arguments
1316          * that are not set.
1317          */
1318         if (parsedline->auth_method == uaLDAP)
1319         {
1320                 MANDATORY_AUTH_ARG(parsedline->ldapserver, "ldapserver", "ldap");
1321
1322                 /*
1323                  * LDAP can operate in two modes: either with a direct bind, using
1324                  * ldapprefix and ldapsuffix, or using a search+bind, using
1325                  * ldapbasedn, ldapbinddn, ldapbindpasswd and ldapsearchattribute.
1326                  * Disallow mixing these parameters.
1327                  */
1328                 if (parsedline->ldapprefix || parsedline->ldapsuffix)
1329                 {
1330                         if (parsedline->ldapbasedn ||
1331                                 parsedline->ldapbinddn ||
1332                                 parsedline->ldapbindpasswd ||
1333                                 parsedline->ldapsearchattribute)
1334                         {
1335                                 ereport(LOG,
1336                                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1337                                                  errmsg("cannot use ldapbasedn, ldapbinddn, ldapbindpasswd, or ldapsearchattribute together with ldapprefix"),
1338                                                  errcontext("line %d of configuration file \"%s\"",
1339                                                                         line_num, HbaFileName)));
1340                                 return NULL;
1341                         }
1342                 }
1343                 else if (!parsedline->ldapbasedn)
1344                 {
1345                         ereport(LOG,
1346                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1347                                          errmsg("authentication method \"ldap\" requires argument \"ldapbasedn\", \"ldapprefix\", or \"ldapsuffix\" to be set"),
1348                                          errcontext("line %d of configuration file \"%s\"",
1349                                                                 line_num, HbaFileName)));
1350                         return NULL;
1351                 }
1352         }
1353
1354         if (parsedline->auth_method == uaRADIUS)
1355         {
1356                 MANDATORY_AUTH_ARG(parsedline->radiusserver, "radiusserver", "radius");
1357                 MANDATORY_AUTH_ARG(parsedline->radiussecret, "radiussecret", "radius");
1358         }
1359
1360         /*
1361          * Enforce any parameters implied by other settings.
1362          */
1363         if (parsedline->auth_method == uaCert)
1364         {
1365                 parsedline->clientcert = true;
1366         }
1367
1368         return parsedline;
1369 }
1370
1371 /*
1372  * Parse one name-value pair as an authentication option into the given
1373  * HbaLine.  Return true if we successfully parse the option, false if we
1374  * encounter an error.
1375  */
1376 static bool
1377 parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
1378 {
1379         if (strcmp(name, "map") == 0)
1380         {
1381                 if (hbaline->auth_method != uaIdent &&
1382                         hbaline->auth_method != uaPeer &&
1383                         hbaline->auth_method != uaKrb5 &&
1384                         hbaline->auth_method != uaGSS &&
1385                         hbaline->auth_method != uaSSPI &&
1386                         hbaline->auth_method != uaCert)
1387                         INVALID_AUTH_OPTION("map", gettext_noop("ident, peer, krb5, gssapi, sspi and cert"));
1388                 hbaline->usermap = pstrdup(val);
1389         }
1390         else if (strcmp(name, "clientcert") == 0)
1391         {
1392                 /*
1393                  * Since we require ctHostSSL, this really can never happen
1394                  * on non-SSL-enabled builds, so don't bother checking for
1395                  * USE_SSL.
1396                  */
1397                 if (hbaline->conntype != ctHostSSL)
1398                 {
1399                         ereport(LOG,
1400                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1401                                          errmsg("clientcert can only be configured for \"hostssl\" rows"),
1402                                    errcontext("line %d of configuration file \"%s\"",
1403                                                           line_num, HbaFileName)));
1404                         return false;
1405                 }
1406                 if (strcmp(val, "1") == 0)
1407                 {
1408                         if (!secure_loaded_verify_locations())
1409                         {
1410                                 ereport(LOG,
1411                                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1412                                                  errmsg("client certificates can only be checked if a root certificate store is available"),
1413                                                  errhint("Make sure the root.crt file is present and readable."),
1414                                    errcontext("line %d of configuration file \"%s\"",
1415                                                           line_num, HbaFileName)));
1416                                 return false;
1417                         }
1418                         hbaline->clientcert = true;
1419                 }
1420                 else
1421                 {
1422                         if (hbaline->auth_method == uaCert)
1423                         {
1424                                 ereport(LOG,
1425                                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1426                                                  errmsg("clientcert can not be set to 0 when using \"cert\" authentication"),
1427                                    errcontext("line %d of configuration file \"%s\"",
1428                                                           line_num, HbaFileName)));
1429                                 return false;
1430                         }
1431                         hbaline->clientcert = false;
1432                 }
1433         }
1434         else if (strcmp(name, "pamservice") == 0)
1435         {
1436                 REQUIRE_AUTH_OPTION(uaPAM, "pamservice", "pam");
1437                 hbaline->pamservice = pstrdup(val);
1438         }
1439         else if (strcmp(name, "ldaptls") == 0)
1440         {
1441                 REQUIRE_AUTH_OPTION(uaLDAP, "ldaptls", "ldap");
1442                 if (strcmp(val, "1") == 0)
1443                         hbaline->ldaptls = true;
1444                 else
1445                         hbaline->ldaptls = false;
1446         }
1447         else if (strcmp(name, "ldapserver") == 0)
1448         {
1449                 REQUIRE_AUTH_OPTION(uaLDAP, "ldapserver", "ldap");
1450                 hbaline->ldapserver = pstrdup(val);
1451         }
1452         else if (strcmp(name, "ldapport") == 0)
1453         {
1454                 REQUIRE_AUTH_OPTION(uaLDAP, "ldapport", "ldap");
1455                 hbaline->ldapport = atoi(val);
1456                 if (hbaline->ldapport == 0)
1457                 {
1458                         ereport(LOG,
1459                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1460                                          errmsg("invalid LDAP port number: \"%s\"", val),
1461                                    errcontext("line %d of configuration file \"%s\"",
1462                                                           line_num, HbaFileName)));
1463                         return false;
1464                 }
1465         }
1466         else if (strcmp(name, "ldapbinddn") == 0)
1467         {
1468                 REQUIRE_AUTH_OPTION(uaLDAP, "ldapbinddn", "ldap");
1469                 hbaline->ldapbinddn = pstrdup(val);
1470         }
1471         else if (strcmp(name, "ldapbindpasswd") == 0)
1472         {
1473                 REQUIRE_AUTH_OPTION(uaLDAP, "ldapbindpasswd", "ldap");
1474                 hbaline->ldapbindpasswd = pstrdup(val);
1475         }
1476         else if (strcmp(name, "ldapsearchattribute") == 0)
1477         {
1478                 REQUIRE_AUTH_OPTION(uaLDAP, "ldapsearchattribute", "ldap");
1479                 hbaline->ldapsearchattribute = pstrdup(val);
1480         }
1481         else if (strcmp(name, "ldapbasedn") == 0)
1482         {
1483                 REQUIRE_AUTH_OPTION(uaLDAP, "ldapbasedn", "ldap");
1484                 hbaline->ldapbasedn = pstrdup(val);
1485         }
1486         else if (strcmp(name, "ldapprefix") == 0)
1487         {
1488                 REQUIRE_AUTH_OPTION(uaLDAP, "ldapprefix", "ldap");
1489                 hbaline->ldapprefix = pstrdup(val);
1490         }
1491         else if (strcmp(name, "ldapsuffix") == 0)
1492         {
1493                 REQUIRE_AUTH_OPTION(uaLDAP, "ldapsuffix", "ldap");
1494                 hbaline->ldapsuffix = pstrdup(val);
1495         }
1496         else if (strcmp(name, "krb_server_hostname") == 0)
1497         {
1498                 REQUIRE_AUTH_OPTION(uaKrb5, "krb_server_hostname", "krb5");
1499                 hbaline->krb_server_hostname = pstrdup(val);
1500         }
1501         else if (strcmp(name, "krb_realm") == 0)
1502         {
1503                 if (hbaline->auth_method != uaKrb5 &&
1504                         hbaline->auth_method != uaGSS &&
1505                         hbaline->auth_method != uaSSPI)
1506                         INVALID_AUTH_OPTION("krb_realm", gettext_noop("krb5, gssapi and sspi"));
1507                 hbaline->krb_realm = pstrdup(val);
1508         }
1509         else if (strcmp(name, "include_realm") == 0)
1510         {
1511                 if (hbaline->auth_method != uaKrb5 &&
1512                         hbaline->auth_method != uaGSS &&
1513                         hbaline->auth_method != uaSSPI)
1514                         INVALID_AUTH_OPTION("include_realm", gettext_noop("krb5, gssapi and sspi"));
1515                 if (strcmp(val, "1") == 0)
1516                         hbaline->include_realm = true;
1517                 else
1518                         hbaline->include_realm = false;
1519         }
1520         else if (strcmp(name, "radiusserver") == 0)
1521         {
1522                 struct addrinfo *gai_result;
1523                 struct addrinfo hints;
1524                 int ret;
1525
1526                 REQUIRE_AUTH_OPTION(uaRADIUS, "radiusserver", "radius");
1527
1528                 MemSet(&hints, 0, sizeof(hints));
1529                 hints.ai_socktype = SOCK_DGRAM;
1530                 hints.ai_family = AF_UNSPEC;
1531
1532                 ret = pg_getaddrinfo_all(val, NULL, &hints, &gai_result);
1533                 if (ret || !gai_result)
1534                 {
1535                         ereport(LOG,
1536                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1537                                          errmsg("could not translate RADIUS server name \"%s\" to address: %s",
1538                                                         val, gai_strerror(ret)),
1539                                    errcontext("line %d of configuration file \"%s\"",
1540                                                           line_num, HbaFileName)));
1541                         if (gai_result)
1542                                 pg_freeaddrinfo_all(hints.ai_family, gai_result);
1543                         return false;
1544                 }
1545                 pg_freeaddrinfo_all(hints.ai_family, gai_result);
1546                 hbaline->radiusserver = pstrdup(val);
1547         }
1548         else if (strcmp(name, "radiusport") == 0)
1549         {
1550                 REQUIRE_AUTH_OPTION(uaRADIUS, "radiusport", "radius");
1551                 hbaline->radiusport = atoi(val);
1552                 if (hbaline->radiusport == 0)
1553                 {
1554                         ereport(LOG,
1555                                         (errcode(ERRCODE_CONFIG_FILE_ERROR),
1556                                          errmsg("invalid RADIUS port number: \"%s\"", val),
1557                                    errcontext("line %d of configuration file \"%s\"",
1558                                                           line_num, HbaFileName)));
1559                         return false;
1560                 }
1561         }
1562         else if (strcmp(name, "radiussecret") == 0)
1563         {
1564                 REQUIRE_AUTH_OPTION(uaRADIUS, "radiussecret", "radius");
1565                 hbaline->radiussecret = pstrdup(val);
1566         }
1567         else if (strcmp(name, "radiusidentifier") == 0)
1568         {
1569                 REQUIRE_AUTH_OPTION(uaRADIUS, "radiusidentifier", "radius");
1570                 hbaline->radiusidentifier = pstrdup(val);
1571         }
1572         else
1573         {
1574                 ereport(LOG,
1575                                 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1576                         errmsg("unrecognized authentication option name: \"%s\"",
1577                                    name),
1578                                  errcontext("line %d of configuration file \"%s\"",
1579                                                         line_num, HbaFileName)));
1580                 return false;
1581         }
1582         return true;
1583 }
1584
1585 /*
1586  *      Scan the pre-parsed hba file, looking for a match to the port's connection
1587  *      request.
1588  */
1589 static void
1590 check_hba(hbaPort *port)
1591 {
1592         Oid                     roleid;
1593         ListCell   *line;
1594         HbaLine    *hba;
1595
1596         /* Get the target role's OID.  Note we do not error out for bad role. */
1597         roleid = get_role_oid(port->user_name, true);
1598
1599         foreach(line, parsed_hba_lines)
1600         {
1601                 hba = (HbaLine *) lfirst(line);
1602
1603                 /* Check connection type */
1604                 if (hba->conntype == ctLocal)
1605                 {
1606                         if (!IS_AF_UNIX(port->raddr.addr.ss_family))
1607                                 continue;
1608                 }
1609                 else
1610                 {
1611                         if (IS_AF_UNIX(port->raddr.addr.ss_family))
1612                                 continue;
1613
1614                         /* Check SSL state */
1615 #ifdef USE_SSL
1616                         if (port->ssl)
1617                         {
1618                                 /* Connection is SSL, match both "host" and "hostssl" */
1619                                 if (hba->conntype == ctHostNoSSL)
1620                                         continue;
1621                         }
1622                         else
1623                         {
1624                                 /* Connection is not SSL, match both "host" and "hostnossl" */
1625                                 if (hba->conntype == ctHostSSL)
1626                                         continue;
1627                         }
1628 #else
1629                         /* No SSL support, so reject "hostssl" lines */
1630                         if (hba->conntype == ctHostSSL)
1631                                 continue;
1632 #endif
1633
1634                         /* Check IP address */
1635                         switch (hba->ip_cmp_method)
1636                         {
1637                                 case ipCmpMask:
1638                                         if (hba->hostname)
1639                                         {
1640                                                 if (!check_hostname(port,
1641                                                                                         hba->hostname))
1642                                                         continue;
1643                                         }
1644                                         else
1645                                         {
1646                                                 if (!check_ip(&port->raddr,
1647                                                                           (struct sockaddr *) & hba->addr,
1648                                                                           (struct sockaddr *) & hba->mask))
1649                                                         continue;
1650                                         }
1651                                         break;
1652                                 case ipCmpAll:
1653                                         break;
1654                                 case ipCmpSameHost:
1655                                 case ipCmpSameNet:
1656                                         if (!check_same_host_or_net(&port->raddr,
1657                                                                                                 hba->ip_cmp_method))
1658                                                 continue;
1659                                         break;
1660                                 default:
1661                                         /* shouldn't get here, but deem it no-match if so */
1662                                         continue;
1663                         }
1664                 }                                               /* != ctLocal */
1665
1666                 /* Check database and role */
1667                 if (!check_db(port->database_name, port->user_name, roleid,
1668                                           hba->databases))
1669                         continue;
1670
1671                 if (!check_role(port->user_name, roleid, hba->roles))
1672                         continue;
1673
1674                 /* Found a record that matched! */
1675                 port->hba = hba;
1676                 return;
1677         }
1678
1679         /* If no matching entry was found, then implicitly reject. */
1680         hba = palloc0(sizeof(HbaLine));
1681         hba->auth_method = uaImplicitReject;
1682         port->hba = hba;
1683 }
1684
1685 /*
1686  * Read the config file and create a List of HbaLine records for the contents.
1687  *
1688  * The configuration is read into a temporary list, and if any parse error occurs
1689  * the old list is kept in place and false is returned. Only if the whole file
1690  * parses Ok is the list replaced, and the function returns true.
1691  */
1692 bool
1693 load_hba(void)
1694 {
1695         FILE       *file;
1696         List       *hba_lines = NIL;
1697         List       *hba_line_nums = NIL;
1698         ListCell   *line,
1699                            *line_num;
1700         List       *new_parsed_lines = NIL;
1701         bool            ok = true;
1702         MemoryContext   linecxt;
1703         MemoryContext   oldcxt;
1704         MemoryContext   hbacxt;
1705
1706         file = AllocateFile(HbaFileName, "r");
1707         if (file == NULL)
1708         {
1709                 ereport(LOG,
1710                                 (errcode_for_file_access(),
1711                                  errmsg("could not open configuration file \"%s\": %m",
1712                                                 HbaFileName)));
1713
1714                 /*
1715                  * Caller will take care of making this a FATAL error in case this is
1716                  * the initial startup. If it happens on reload, we just keep the old
1717                  * version around.
1718                  */
1719                 return false;
1720         }
1721
1722         linecxt = tokenize_file(HbaFileName, file, &hba_lines, &hba_line_nums);
1723         FreeFile(file);
1724
1725         /* Now parse all the lines */
1726         hbacxt = AllocSetContextCreate(TopMemoryContext,
1727                                                                    "hba parser context",
1728                                                                    ALLOCSET_DEFAULT_MINSIZE,
1729                                                                    ALLOCSET_DEFAULT_MINSIZE,
1730                                                                    ALLOCSET_DEFAULT_MAXSIZE);
1731         oldcxt = MemoryContextSwitchTo(hbacxt);
1732         forboth(line, hba_lines, line_num, hba_line_nums)
1733         {
1734                 HbaLine    *newline;
1735
1736                 if ((newline = parse_hba_line(lfirst(line), lfirst_int(line_num))) == NULL)
1737                 {
1738                         /*
1739                          * Parse error in the file, so indicate there's a problem.  NB: a
1740                          * problem in a line will free the memory for all previous lines as
1741                          * well!
1742                          */
1743                         MemoryContextReset(hbacxt);
1744                         new_parsed_lines = NIL;
1745                         ok = false;
1746
1747                         /*
1748                          * Keep parsing the rest of the file so we can report errors on
1749                          * more than the first row. Error has already been reported in the
1750                          * parsing function, so no need to log it here.
1751                          */
1752                         continue;
1753                 }
1754
1755                 new_parsed_lines = lappend(new_parsed_lines, newline);
1756         }
1757
1758         /* Free tokenizer memory */
1759         MemoryContextDelete(linecxt);
1760         MemoryContextSwitchTo(oldcxt);
1761
1762         if (!ok)
1763         {
1764                 /* Parsing failed at one or more rows, so bail out */
1765                 MemoryContextDelete(hbacxt);
1766                 return false;
1767         }
1768
1769         /* Loaded new file successfully, replace the one we use */
1770         if (parsed_hba_context != NULL)
1771                 MemoryContextDelete(parsed_hba_context);
1772         parsed_hba_context = hbacxt;
1773         parsed_hba_lines = new_parsed_lines;
1774
1775         return true;
1776 }
1777
1778 /*
1779  *      Process one line from the ident config file.
1780  *
1781  *      Take the line and compare it to the needed map, pg_role and ident_user.
1782  *      *found_p and *error_p are set according to our results.
1783  */
1784 static void
1785 parse_ident_usermap(List *line, int line_number, const char *usermap_name,
1786                                         const char *pg_role, const char *ident_user,
1787                                         bool case_insensitive, bool *found_p, bool *error_p)
1788 {
1789         ListCell   *field;
1790         List       *tokens;
1791         HbaToken   *token;
1792         char       *file_map;
1793         char       *file_pgrole;
1794         char       *file_ident_user;
1795
1796         *found_p = false;
1797         *error_p = false;
1798
1799         Assert(line != NIL);
1800         field = list_head(line);
1801
1802         /* Get the map token (must exist) */
1803         tokens = lfirst(field);
1804         IDENT_MULTI_VALUE(tokens);
1805         token = linitial(tokens);
1806         file_map = token->string;
1807
1808         /* Get the ident user token */
1809         field = lnext(field);
1810         IDENT_FIELD_ABSENT(field);
1811         tokens = lfirst(field);
1812         IDENT_MULTI_VALUE(tokens);
1813         token = linitial(tokens);
1814         file_ident_user = token->string;
1815
1816         /* Get the PG rolename token */
1817         field = lnext(field);
1818         IDENT_FIELD_ABSENT(field);
1819         tokens = lfirst(field);
1820         IDENT_MULTI_VALUE(tokens);
1821         token = linitial(tokens);
1822         file_pgrole = token->string;
1823
1824         if (strcmp(file_map, usermap_name) != 0)
1825                 /* Line does not match the map name we're looking for, so just abort */
1826                 return;
1827
1828         /* Match? */
1829         if (file_ident_user[0] == '/')
1830         {
1831                 /*
1832                  * When system username starts with a slash, treat it as a regular
1833                  * expression. In this case, we process the system username as a
1834                  * regular expression that returns exactly one match. This is replaced
1835                  * for \1 in the database username string, if present.
1836                  */
1837                 int                     r;
1838                 regex_t         re;
1839                 regmatch_t      matches[2];
1840                 pg_wchar   *wstr;
1841                 int                     wlen;
1842                 char       *ofs;
1843                 char       *regexp_pgrole;
1844
1845                 wstr = palloc((strlen(file_ident_user + 1) + 1) * sizeof(pg_wchar));
1846                 wlen = pg_mb2wchar_with_len(file_ident_user + 1, wstr, strlen(file_ident_user + 1));
1847
1848                 /*
1849                  * XXX: Major room for optimization: regexps could be compiled when
1850                  * the file is loaded and then re-used in every connection.
1851                  */
1852                 r = pg_regcomp(&re, wstr, wlen, REG_ADVANCED, C_COLLATION_OID);
1853                 if (r)
1854                 {
1855                         char            errstr[100];
1856
1857                         pg_regerror(r, &re, errstr, sizeof(errstr));
1858                         ereport(LOG,
1859                                         (errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
1860                                          errmsg("invalid regular expression \"%s\": %s",
1861                                                         file_ident_user + 1, errstr)));
1862
1863                         pfree(wstr);
1864                         *error_p = true;
1865                         return;
1866                 }
1867                 pfree(wstr);
1868
1869                 wstr = palloc((strlen(ident_user) + 1) * sizeof(pg_wchar));
1870                 wlen = pg_mb2wchar_with_len(ident_user, wstr, strlen(ident_user));
1871
1872                 r = pg_regexec(&re, wstr, wlen, 0, NULL, 2, matches, 0);
1873                 if (r)
1874                 {
1875                         char            errstr[100];
1876
1877                         if (r != REG_NOMATCH)
1878                         {
1879                                 /* REG_NOMATCH is not an error, everything else is */
1880                                 pg_regerror(r, &re, errstr, sizeof(errstr));
1881                                 ereport(LOG,
1882                                                 (errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
1883                                          errmsg("regular expression match for \"%s\" failed: %s",
1884                                                         file_ident_user + 1, errstr)));
1885                                 *error_p = true;
1886                         }
1887
1888                         pfree(wstr);
1889                         pg_regfree(&re);
1890                         return;
1891                 }
1892                 pfree(wstr);
1893
1894                 if ((ofs = strstr(file_pgrole, "\\1")) != NULL)
1895                 {
1896                         /* substitution of the first argument requested */
1897                         if (matches[1].rm_so < 0)
1898                         {
1899                                 ereport(LOG,
1900                                                 (errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
1901                                                  errmsg("regular expression \"%s\" has no subexpressions as requested by backreference in \"%s\"",
1902                                                                 file_ident_user + 1, file_pgrole)));
1903                                 pg_regfree(&re);
1904                                 *error_p = true;
1905                                 return;
1906                         }
1907
1908                         /*
1909                          * length: original length minus length of \1 plus length of match
1910                          * plus null terminator
1911                          */
1912                         regexp_pgrole = palloc0(strlen(file_pgrole) - 2 + (matches[1].rm_eo - matches[1].rm_so) + 1);
1913                         strncpy(regexp_pgrole, file_pgrole, (ofs - file_pgrole));
1914                         memcpy(regexp_pgrole + strlen(regexp_pgrole),
1915                                    ident_user + matches[1].rm_so,
1916                                    matches[1].rm_eo - matches[1].rm_so);
1917                         strcat(regexp_pgrole, ofs + 2);
1918                 }
1919                 else
1920                 {
1921                         /* no substitution, so copy the match */
1922                         regexp_pgrole = pstrdup(file_pgrole);
1923                 }
1924
1925                 pg_regfree(&re);
1926
1927                 /*
1928                  * now check if the username actually matched what the user is trying
1929                  * to connect as
1930                  */
1931                 if (case_insensitive)
1932                 {
1933                         if (pg_strcasecmp(regexp_pgrole, pg_role) == 0)
1934                                 *found_p = true;
1935                 }
1936                 else
1937                 {
1938                         if (strcmp(regexp_pgrole, pg_role) == 0)
1939                                 *found_p = true;
1940                 }
1941                 pfree(regexp_pgrole);
1942
1943                 return;
1944         }
1945         else
1946         {
1947                 /* Not regular expression, so make complete match */
1948                 if (case_insensitive)
1949                 {
1950                         if (pg_strcasecmp(file_pgrole, pg_role) == 0 &&
1951                                 pg_strcasecmp(file_ident_user, ident_user) == 0)
1952                                 *found_p = true;
1953                 }
1954                 else
1955                 {
1956                         if (strcmp(file_pgrole, pg_role) == 0 &&
1957                                 strcmp(file_ident_user, ident_user) == 0)
1958                                 *found_p = true;
1959                 }
1960         }
1961         return;
1962 }
1963
1964
1965 /*
1966  *      Scan the (pre-parsed) ident usermap file line by line, looking for a match
1967  *
1968  *      See if the user with ident username "auth_user" is allowed to act
1969  *      as Postgres user "pg_role" according to usermap "usermap_name".
1970  *
1971  *      Special case: Usermap NULL, equivalent to what was previously called
1972  *      "sameuser" or "samerole", means don't look in the usermap file.
1973  *      That's an implied map wherein "pg_role" must be identical to
1974  *      "auth_user" in order to be authorized.
1975  *
1976  *      Iff authorized, return STATUS_OK, otherwise return STATUS_ERROR.
1977  */
1978 int
1979 check_usermap(const char *usermap_name,
1980                           const char *pg_role,
1981                           const char *auth_user,
1982                           bool case_insensitive)
1983 {
1984         bool            found_entry = false,
1985                                 error = false;
1986
1987         if (usermap_name == NULL || usermap_name[0] == '\0')
1988         {
1989                 if (case_insensitive)
1990                 {
1991                         if (pg_strcasecmp(pg_role, auth_user) == 0)
1992                                 return STATUS_OK;
1993                 }
1994                 else
1995                 {
1996                         if (strcmp(pg_role, auth_user) == 0)
1997                                 return STATUS_OK;
1998                 }
1999                 ereport(LOG,
2000                                 (errmsg("provided user name (%s) and authenticated user name (%s) do not match",
2001                                                 pg_role, auth_user)));
2002                 return STATUS_ERROR;
2003         }
2004         else
2005         {
2006                 ListCell   *line_cell,
2007                                    *num_cell;
2008
2009                 forboth(line_cell, ident_lines, num_cell, ident_line_nums)
2010                 {
2011                         parse_ident_usermap(lfirst(line_cell), lfirst_int(num_cell),
2012                                                   usermap_name, pg_role, auth_user, case_insensitive,
2013                                                                 &found_entry, &error);
2014                         if (found_entry || error)
2015                                 break;
2016                 }
2017         }
2018         if (!found_entry && !error)
2019         {
2020                 ereport(LOG,
2021                                 (errmsg("no match in usermap \"%s\" for user \"%s\" authenticated as \"%s\"",
2022                                                 usermap_name, pg_role, auth_user)));
2023         }
2024         return found_entry ? STATUS_OK : STATUS_ERROR;
2025 }
2026
2027
2028 /*
2029  * Read the ident config file and populate ident_lines and ident_line_nums.
2030  *
2031  * Like parsed_hba_lines, ident_lines is a triple-nested List of lines, fields
2032  * and tokens.
2033  */
2034 void
2035 load_ident(void)
2036 {
2037         FILE       *file;
2038
2039         if (ident_context != NULL)
2040         {
2041                 MemoryContextDelete(ident_context);
2042                 ident_context = NULL;
2043         }
2044
2045         file = AllocateFile(IdentFileName, "r");
2046         if (file == NULL)
2047         {
2048                 /* not fatal ... we just won't do any special ident maps */
2049                 ereport(LOG,
2050                                 (errcode_for_file_access(),
2051                                  errmsg("could not open usermap file \"%s\": %m",
2052                                                 IdentFileName)));
2053         }
2054         else
2055         {
2056                 ident_context = tokenize_file(IdentFileName, file, &ident_lines,
2057                                                                           &ident_line_nums);
2058                 FreeFile(file);
2059         }
2060 }
2061
2062
2063
2064 /*
2065  *      Determine what authentication method should be used when accessing database
2066  *      "database" from frontend "raddr", user "user".  Return the method and
2067  *      an optional argument (stored in fields of *port), and STATUS_OK.
2068  *
2069  *      If the file does not contain any entry matching the request, we return
2070  *      method = uaImplicitReject.
2071  */
2072 void
2073 hba_getauthmethod(hbaPort *port)
2074 {
2075         check_hba(port);
2076 }