aboutsummaryrefslogtreecommitdiff
path: root/src/backend/libpq/auth.c
Commit message (Collapse)AuthorAge
...
* Replace printf format %i by %dPeter Eisentraut2011-07-26
| | | | | They are identical, but the overwhelming majority of the code uses %d, so standardize on that.
* Replace errdetail("%s", ...) with errdetail_internal("%s", ...).Tom Lane2011-07-16
| | | | | | There may be some other places where we should use errdetail_internal, but they'll have to be evaluated case-by-case. This commit just hits a bunch of places where invoking gettext is obviously a waste of cycles.
* Fix SSPI login when multiple roundtrips are requiredMagnus Hagander2011-07-16
| | | | | | | | | | This fixes SSPI login failures showing "The function requested is not supported", often showing up when connecting to localhost. The reason was not properly updating the SSPI handle when multiple roundtrips were required to complete the authentication sequence. Report and analysis by Ahmed Shinwari, patch by Magnus Hagander
* Message style improvements of errmsg_internal() callsPeter Eisentraut2011-07-05
|
* Modernise pg_hba.conf token processingAlvaro Herrera2011-06-28
| | | | | | | | | | | | | | | | | | | | | | | The previous coding was ugly, as it marked special tokens as such in the wrong stage, relying on workarounds to figure out if they had been quoted in the original or not. This made it impossible to have specific keywords be recognized as such only in certain positions in HBA lines, for example. Fix by restructuring the parser code so that it remembers whether tokens were quoted or not. This eliminates widespread knowledge of possible known keywords for all fields. Also improve memory management in this area, to use memory contexts that are reset as a whole instead of using retail pfrees; this removes a whole lotta crufty (and probably slow) code. Instead of calling strlen() three times in next_field_expand on the returned token to find out whether there was a comma (and strip it), pass back the info directly from the callee, which is simpler. In passing, update historical artifacts in hba.c API. Authors: Brendan Jurd, Alvaro Herrera Reviewed by Pavel Stehule
* Pgindent run before 9.1 beta2.Bruce Momjian2011-06-09
|
* Implement getpeereid() as a src/port compatibility function.Tom Lane2011-06-02
| | | | | | | This unifies a bunch of ugly #ifdef's in one place. Per discussion, we only need this where HAVE_UNIX_SOCKETS, so no need to cover Windows. Marko Kreen, some adjustment by Tom Lane
* Replace use of credential control messages with getsockopt(LOCAL_PEERCRED).Tom Lane2011-05-31
| | | | | | | | | | | | | | | | | | | | | | | | It turns out the reason we hadn't found out about the portability issues with our credential-control-message code is that almost no modern platforms use that code at all; the ones that used to need it now offer getpeereid(), which we choose first. The last holdout was NetBSD, and they added getpeereid() as of 5.0. So far as I can tell, the only live platform on which that code was being exercised was Debian/kFreeBSD, ie, FreeBSD kernel with Linux userland --- since glibc doesn't provide getpeereid(), we fell back to the control message code. However, the FreeBSD kernel provides a LOCAL_PEERCRED socket parameter that's functionally equivalent to Linux's SO_PEERCRED. That is both much simpler to use than control messages, and superior because it doesn't require receiving a message from the other end at just the right time. Therefore, add code to use LOCAL_PEERCRED when necessary, and rip out all the credential-control-message code in the backend. (libpq still has such code so that it can still talk to pre-9.1 servers ... but eventually we can get rid of it there too.) Clean up related autoconf probes, too. This means that libpq's requirepeer parameter now works on exactly the same platforms where the backend supports peer authentication, so adjust the documentation accordingly.
* Fix portability bugs in use of credentials control messages for peer auth.Tom Lane2011-05-30
| | | | | | | | | | | | | | | | | Even though our existing code for handling credentials control messages has been basically unchanged since 2001, it was fundamentally wrong: it did not ensure proper alignment of the supplied buffer, and it was calculating buffer sizes and message sizes incorrectly. This led to failures on platforms where alignment padding is relevant, for instance FreeBSD on 64-bit platforms, as seen in a recent Debian bug report passed on by Martin Pitt (http://bugs.debian.org//cgi-bin/bugreport.cgi?bug=612888). Rewrite to do the message-whacking using the macros specified in RFC 2292, following a suggestion from Theo de Raadt in that thread. Tested by me on Debian/kFreeBSD-amd64; since OpenBSD and NetBSD document the identical CMSG API, it should work there too. Back-patch to all supported branches.
* Clean up most -Wunused-but-set-variable warnings from gcc 4.6Peter Eisentraut2011-04-11
| | | | | | This warning is new in gcc 4.6 and part of -Wall. This patch cleans up most of the noise, but there are some still warnings that are trickier to remove.
* pgindent run before PG 9.1 beta 1.Bruce Momjian2011-04-10
|
* Suppress platform-dependent unused-variable warning.Tom Lane2011-03-20
| | | | | | The local variable "sock" can be unused depending on compilation flags. But there seems no particular need for it, since the kernel calls can just as easily say port->sock instead.
* Rename ident authentication over local connections to peerMagnus Hagander2011-03-19
| | | | | | | | | | | | | This removes an overloading of two authentication options where one is very secure (peer) and one is often insecure (ident). Peer is also the name used in libpq from 9.1 to specify the same type of authentication. Also make initdb select peer for local connections when ident is chosen, and ident for TCP connections when peer is chosen. ident keyword in pg_hba.conf is still accepted and maps to peer authentication.
* Stamp copyrights for year 2011.Bruce Momjian2011-01-01
|
* Add a client authentication hook.Robert Haas2010-10-26
| | | | KaiGai Kohei, with minor cleanup of the comments by me.
* Fix low-risk potential denial of service against RADIUS login.Magnus Hagander2010-10-15
| | | | | | | | | | | | | | | | Corrupt RADIUS responses were treated as errors and not ignored (which the RFC2865 states they should be). This meant that a user with unfiltered access to the network of the PostgreSQL or RADIUS server could send a spoofed RADIUS response to the PostgreSQL server causing it to reject a valid login, provided the attacker could also guess (or brute-force) the correct port number. Fix is to simply retry the receive in a loop until the timeout has expired or a valid (signed by the correct RADIUS server) packet arrives. Reported by Alan DeKok in bug #5687.
* Remove cvs keywords from all files.Magnus Hagander2010-09-20
|
* pgindent run for 9.0, second runBruce Momjian2010-07-06
|
* Message tuningPeter Eisentraut2010-06-29
|
* Fix bogus error message for SSL-cert authentication, due to lack ofTom Lane2010-05-26
| | | | | a uaCert entry in auth_failed(). Put the switch entries into a sane order, namely the one the enum is declared in.
* Fix pg_hba.conf matching so that replication connections only match recordsTom Lane2010-04-21
| | | | | | | | | with database = replication. The previous coding would allow them to match ordinary records too, but that seems like a recipe for security breaches. Improve the messages associated with no-such-pg_hba.conf entry to report replication connections as such, since that's now a critical aspect of whether the connection matches. Make some cursory improvements in the related documentation, too.
* Add new message for explicit rejection by pg_hba.conf. ImplicitSimon Riggs2010-04-19
| | | | rejection retains same message as before.
* Message tuningPeter Eisentraut2010-03-30
|
* Message tuningPeter Eisentraut2010-03-21
|
* Add libpq warning message if the .pgpass-retrieved password fails.Bruce Momjian2010-03-13
| | | | Add ERRCODE_INVALID_PASSWORD sqlstate error code.
* pgindent run for 9.0Bruce Momjian2010-02-26
|
* Make RADIUS authentication use pg_getaddrinfo_all() to get address ofMagnus Hagander2010-02-02
| | | | | | | the server. Gets rid of a fairly ugly hack for Solaris, and also provides hostname and IPV6 support.
* Get rid of unportable use of socklen_t --- we have a configure testTom Lane2010-01-31
| | | | for that, so use it.
* Add support for RADIUS authentication.Magnus Hagander2010-01-27
|
* Create typedef pgsocket for storing socket descriptors.Magnus Hagander2010-01-10
| | | | | | | | This silences some warnings on Win64. Not using the proper SOCKET datatype was actually wrong on Win32 as well, but didn't cause any warnings there. Also create define PGINVALID_SOCKET to indicate an invalid/non-existing socket, instead of using a hardcoded -1 value.
* Update copyright for the year 2010.Bruce Momjian2010-01-02
|
* Suppress compiler warning, per buildfarm member narwhalTom Lane2009-12-31
|
* Allow LDAP authentication to operate in search+bind mode, meaning itMagnus Hagander2009-12-12
| | | | | | | | | | | | | | does a search for the user in the directory first, and then binds with the DN found for this user. This allows for LDAP logins in scenarios where the DN of the user cannot be determined simply by prefix and suffix, such as the case where different users are located in different containers. The old way of authentication can be significantly faster, so it's kept as an option. Robert Fleming and Magnus Hagander
* Rewrite pam_passwd_conv_proc to be more robust: avoid assuming that theTom Lane2009-10-16
| | | | | | | | | | | | | | pam_message array contains exactly one PAM_PROMPT_ECHO_OFF message. Instead, deal with however many messages there are, and don't throw error for PAM_ERROR_MSG and PAM_TEXT_INFO messages. This logic is borrowed from openssh 5.2p1, which hopefully has seen more real-world PAM usage than we have. Per bug #5121 from Ryan Douglas, which turned out to be caused by the conv_proc being called with zero messages. Apparently that is normal behavior given the combination of Linux pam_krb5 with MS Active Directory as the domain controller. Patch all the way back, since this code has been essentially untouched since 7.4. (Surprising we've not heard complaints before.)
* Rename the new MAX_AUTH_TOKEN_LENGTH #define to PG_MAX_AUTH_MAX_TOKEN_LENGTH,Heikki Linnakangas2009-10-14
| | | | | to make it more obvious that it's a PostgreSQL internal limit, not something that comes from system header files.
* Raise the maximum authentication token (Kerberos ticket) size in GSSAPIHeikki Linnakangas2009-10-14
| | | | | | | | and SSPI athentication methods. While the old 2000 byte limit was more than enough for Unix Kerberos implementations, tickets issued by Windows Domain Controllers can be much larger. Ian Turner
* Remove the use of the pg_auth flat file for client authentication.Tom Lane2009-08-29
| | | | | | | | | | | | | | | | | | | | | | | | | | (That flat file is now completely useless, but removal will come later.) To do this, postpone client authentication into the startup transaction that's run by InitPostgres. We still collect the startup packet and do SSL initialization (if needed) at the same time we did before. The AuthenticationTimeout is applied separately to startup packet collection and the actual authentication cycle. (This is a bit annoying, since it means a couple extra syscalls; but the signal handling requirements inside and outside a transaction are sufficiently different that it seems best to treat the timeouts as completely independent.) A small security disadvantage is that if the given database name is invalid, this will be reported to the client before any authentication happens. We could work around that by connecting to database "postgres" instead, but consensus seems to be that it's not worth introducing such surprising behavior. Processing of all command-line switches and GUC options received from the client is now postponed until after authentication. This means that PostAuthDelay is much less useful than it used to be --- if you need to investigate problems during InitPostgres you'll have to set PreAuthDelay instead. However, allowing an unauthenticated user to set any GUC options whatever seems a bit too risky, so we'll live with that.
* Disallow empty passwords in LDAP authentication, the same wayMagnus Hagander2009-06-25
| | | | we already do it for PAM.
* 8.4 pgindent run, with new combined Linux/FreeBSD/MinGW typedef listBruce Momjian2009-06-11
| | | | provided by Andrew.
* Properly return the usermap result when doing gssapi authentication. WithoutMagnus Hagander2009-05-27
| | | | | this, the username was in practice never matched against the kerberos principal used to log in.
* Remove last references to the crypt auth method, per Andreas Scherbaum.Tom Lane2009-04-01
|
* Clean up pg_SSPI_error() coding a little bit: make the messages moreTom Lane2009-03-22
| | | | | consistent, translate where intended, const-ify declarations. Resolves a gripe from Alvaro as well as some stuff I didn't like.
* Make krb_realm and krb_server_hostname be pg_hba options only, and removeMagnus Hagander2009-01-09
| | | | | | | their GUCs. In passing, noted that the pg_hba options for krb5 authentication weren't listed at all - so add this.
* Add hba parameter include_realm to krb5, gss and sspi authentication, usedMagnus Hagander2009-01-07
| | | | | | to pass the full username@realm string to the authentication instead of just the username. This makes it possible to use pg_ident.conf to authenticate users from multiple realms as different database users.
* Allow krb_realm (krb5, gssapi and sspi) and krb_server_hostname (krb5 only)Magnus Hagander2009-01-07
| | | | | authentication options to be set in pg_hba.conf on a per-line basis, to override the defaults set in postgresql.conf.
* Update copyright for 2009.Bruce Momjian2009-01-01
|
* Issue a proper error message when MD5 is attempted whenBruce Momjian2008-11-20
| | | | | | db_user_namespace is enabled. Also document this limitation.
* Add support for using SSL client certificates to authenticate to theMagnus Hagander2008-11-20
| | | | database (only for SSL connections, obviously).
* Control client certificate requesting with the pg_hba option "clientcert"Magnus Hagander2008-11-20
| | | | instead of just relying on the root certificate file to be present.
* Ident authentication over Unix-domain sockets on Solaris, usingPeter Eisentraut2008-11-18
| | | | | | getpeerucred() function. Author: Garick Hamlin <ghamlin@isc.upenn.edu>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-26 19:43:42 +0000