Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit253f102

Browse files
committed
Overhaul pg_hba.conf clientcert's API
Since PG 12, clientcert no longer supported only on/off, so remove 1/0as possible values, and instead support only the text strings'verify-ca' and 'verify-full'.Remove support for 'no-verify' since that is possible by just notspecifying clientcert.Also, throw an error if 'verify-ca' is used and 'cert' authentication isused, since cert authentication requires verify-full.Also improve the docs.THIS IS A BACKWARD INCOMPATIBLE API CHANGE.Reported-by: Kyotaro HoriguchiDiscussion:https://postgr.es/m/20200716.093012.1627751694396009053.horikyota.ntt@gmail.comAuthor: Kyotaro HoriguchiBackpatch-through: master
1 parent18c170a commit253f102

File tree

3 files changed

+13
-21
lines changed

3 files changed

+13
-21
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2044,13 +2044,10 @@ host ... radius radiusservers="server1,server2" radiussecrets="""secret one"",""
20442044
</para>
20452045

20462046
<para>
2047-
In a <filename>pg_hba.conf</filename> record specifying certificate
2048-
authentication, the authentication option <literal>clientcert</literal> is
2049-
assumed to be <literal>verify-ca</literal> or <literal>verify-full</literal>,
2050-
and it cannot be turned off since a client certificate is necessary for this
2051-
method. What the <literal>cert</literal> method adds to the basic
2052-
<literal>clientcert</literal> certificate validity test is a check that the
2053-
<literal>cn</literal> attribute matches the database user name.
2047+
It is redundant to use the <literal>clientcert</literal> option with
2048+
<literal>cert</literal> authentication because <literal>cert</literal>
2049+
authentication is effectively <literal>trust</literal> authentication
2050+
with <literal>clientcert=verify-full</literal>.
20542051
</para>
20552052
</sect1>
20562053

‎doc/src/sgml/runtime.sgml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2345,9 +2345,8 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
23452345
The <literal>clientcert</literal> authentication option is available for
23462346
all authentication methods, but only in <filename>pg_hba.conf</filename> lines
23472347
specified as <literal>hostssl</literal>. When <literal>clientcert</literal> is
2348-
not specified or is set to <literal>no-verify</literal>, the server will still
2349-
verify any presented client certificates against its CA file, if one is
2350-
configured &mdash; but it will not insist that a client certificate be presented.
2348+
not specified, the server verifies the client certificate against its CA
2349+
file only if a client certificate is presented and the CA is configured.
23512350
</para>
23522351

23532352
<para>

‎src/backend/libpq/hba.c

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1730,29 +1730,25 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
17301730
*err_msg="clientcert can only be configured for \"hostssl\" rows";
17311731
return false;
17321732
}
1733-
if (strcmp(val,"1")==0
1734-
||strcmp(val,"verify-ca")==0)
1735-
{
1736-
hbaline->clientcert=clientCertCA;
1737-
}
1738-
elseif (strcmp(val,"verify-full")==0)
1733+
1734+
if (strcmp(val,"verify-full")==0)
17391735
{
17401736
hbaline->clientcert=clientCertFull;
17411737
}
1742-
elseif (strcmp(val,"0")==0
1743-
||strcmp(val,"no-verify")==0)
1738+
elseif (strcmp(val,"verify-ca")==0)
17441739
{
17451740
if (hbaline->auth_method==uaCert)
17461741
{
17471742
ereport(elevel,
17481743
(errcode(ERRCODE_CONFIG_FILE_ERROR),
1749-
errmsg("clientcertcannot be set to \"no-verify\" when using \"cert\" authentication"),
1744+
errmsg("clientcertonly accepts \"verify-full\" when using \"cert\" authentication"),
17501745
errcontext("line %d of configuration file \"%s\"",
17511746
line_num,HbaFileName)));
1752-
*err_msg="clientcertcannotbe set to \"no-verify\" when using \"cert\" authentication";
1747+
*err_msg="clientcertcan onlybe set to \"verify-full\" when using \"cert\" authentication";
17531748
return false;
17541749
}
1755-
hbaline->clientcert=clientCertOff;
1750+
1751+
hbaline->clientcert=clientCertCA;
17561752
}
17571753
else
17581754
{

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp