Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita66cded

Browse files
michaelpqpull[bot]
authored andcommitted
Rename some variables related to ident files in hba.{c,h}
The code that handles authentication for user maps was pretty confusingwith its choice of variable names. It involves two types of users: asystem user and a Postgres user (well, role), and these were not namedconsistently throughout the code that processes the user maps loadedfrom pg_ident.conf at authentication.This commit changes the following things to improve the situation:- Rename "pg_role" to "pg_user" and "token" to "system_user" inIndetLine. These choices are more consistent with the pg_ident.confexample in the docs, as well. "token" has been introduced recently infc579e1, and it is way worse than the choice before that, "ident_user".- Switch the order of the fields in IdentLine to map with the order ofthe items in the ident files, as of map name, system user and PG user.- In check_ident_usermap(), rename "regexp_pgrole" to "expanded_pg_user"when processing a regexp for the system user entry in a user map. Thisvariable does not store a regular expression at all: it would be eithera string or a substitution to \1 if the Postgres role is specified assuch.Author: Jelte FennemaDiscussion:https://postgr.es/m/CAGECzQTkwELHUOAKhvdA+m3tWbUQySHHkExJV8GAZ1pwgbEgXg@mail.gmail.com
1 parent69b39a7 commita66cded

File tree

3 files changed

+44
-44
lines changed

3 files changed

+44
-44
lines changed

‎src/backend/libpq/hba.c

Lines changed: 39 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -2792,21 +2792,21 @@ parse_ident_line(TokenizedAuthLine *tok_line, int elevel)
27922792
token=linitial(tokens);
27932793

27942794
/* Copy the ident user token */
2795-
parsedline->token=copy_auth_token(token);
2795+
parsedline->system_user=copy_auth_token(token);
27962796

27972797
/* Get the PG rolename token */
27982798
field=lnext(tok_line->fields,field);
27992799
IDENT_FIELD_ABSENT(field);
28002800
tokens=lfirst(field);
28012801
IDENT_MULTI_VALUE(tokens);
28022802
token=linitial(tokens);
2803-
parsedline->pg_role=pstrdup(token->string);
2803+
parsedline->pg_user=pstrdup(token->string);
28042804

28052805
/*
28062806
* Now that the field validation is done, compile a regex from the user
28072807
* token, if necessary.
28082808
*/
2809-
if (regcomp_auth_token(parsedline->token,file_name,line_num,
2809+
if (regcomp_auth_token(parsedline->system_user,file_name,line_num,
28102810
err_msg,elevel))
28112811
{
28122812
/* err_msg includes the error to report */
@@ -2819,12 +2819,12 @@ parse_ident_line(TokenizedAuthLine *tok_line, int elevel)
28192819
/*
28202820
*Process one line from the parsed ident config lines.
28212821
*
2822-
*Compare input parsed ident line to the needed map,pg_role andident_user.
2822+
*Compare input parsed ident line to the needed map,pg_user andsystem_user.
28232823
**found_p and *error_p are set according to our results.
28242824
*/
28252825
staticvoid
28262826
check_ident_usermap(IdentLine*identLine,constchar*usermap_name,
2827-
constchar*pg_role,constchar*ident_user,
2827+
constchar*pg_user,constchar*system_user,
28282828
boolcase_insensitive,bool*found_p,bool*error_p)
28292829
{
28302830
*found_p= false;
@@ -2835,7 +2835,7 @@ check_ident_usermap(IdentLine *identLine, const char *usermap_name,
28352835
return;
28362836

28372837
/* Match? */
2838-
if (token_has_regexp(identLine->token))
2838+
if (token_has_regexp(identLine->system_user))
28392839
{
28402840
/*
28412841
* Process the system username as a regular expression that returns
@@ -2845,27 +2845,27 @@ check_ident_usermap(IdentLine *identLine, const char *usermap_name,
28452845
intr;
28462846
regmatch_tmatches[2];
28472847
char*ofs;
2848-
char*regexp_pgrole;
2848+
char*expanded_pg_user;
28492849

2850-
r=regexec_auth_token(ident_user,identLine->token,2,matches);
2850+
r=regexec_auth_token(system_user,identLine->system_user,2,matches);
28512851
if (r)
28522852
{
28532853
charerrstr[100];
28542854

28552855
if (r!=REG_NOMATCH)
28562856
{
28572857
/* REG_NOMATCH is not an error, everything else is */
2858-
pg_regerror(r,identLine->token->regex,errstr,sizeof(errstr));
2858+
pg_regerror(r,identLine->system_user->regex,errstr,sizeof(errstr));
28592859
ereport(LOG,
28602860
(errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
28612861
errmsg("regular expression match for \"%s\" failed: %s",
2862-
identLine->token->string+1,errstr)));
2862+
identLine->system_user->string+1,errstr)));
28632863
*error_p= true;
28642864
}
28652865
return;
28662866
}
28672867

2868-
if ((ofs=strstr(identLine->pg_role,"\\1"))!=NULL)
2868+
if ((ofs=strstr(identLine->pg_user,"\\1"))!=NULL)
28692869
{
28702870
intoffset;
28712871

@@ -2875,7 +2875,7 @@ check_ident_usermap(IdentLine *identLine, const char *usermap_name,
28752875
ereport(LOG,
28762876
(errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
28772877
errmsg("regular expression \"%s\" has no subexpressions as requested by backreference in \"%s\"",
2878-
identLine->token->string+1,identLine->pg_role)));
2878+
identLine->system_user->string+1,identLine->pg_user)));
28792879
*error_p= true;
28802880
return;
28812881
}
@@ -2884,18 +2884,18 @@ check_ident_usermap(IdentLine *identLine, const char *usermap_name,
28842884
* length: original length minus length of \1 plus length of match
28852885
* plus null terminator
28862886
*/
2887-
regexp_pgrole=palloc0(strlen(identLine->pg_role)-2+ (matches[1].rm_eo-matches[1].rm_so)+1);
2888-
offset=ofs-identLine->pg_role;
2889-
memcpy(regexp_pgrole,identLine->pg_role,offset);
2890-
memcpy(regexp_pgrole+offset,
2891-
ident_user+matches[1].rm_so,
2887+
expanded_pg_user=palloc0(strlen(identLine->pg_user)-2+ (matches[1].rm_eo-matches[1].rm_so)+1);
2888+
offset=ofs-identLine->pg_user;
2889+
memcpy(expanded_pg_user,identLine->pg_user,offset);
2890+
memcpy(expanded_pg_user+offset,
2891+
system_user+matches[1].rm_so,
28922892
matches[1].rm_eo-matches[1].rm_so);
2893-
strcat(regexp_pgrole,ofs+2);
2893+
strcat(expanded_pg_user,ofs+2);
28942894
}
28952895
else
28962896
{
28972897
/* no substitution, so copy the match */
2898-
regexp_pgrole=pstrdup(identLine->pg_role);
2898+
expanded_pg_user=pstrdup(identLine->pg_user);
28992899
}
29002900

29012901
/*
@@ -2904,15 +2904,15 @@ check_ident_usermap(IdentLine *identLine, const char *usermap_name,
29042904
*/
29052905
if (case_insensitive)
29062906
{
2907-
if (pg_strcasecmp(regexp_pgrole,pg_role)==0)
2907+
if (pg_strcasecmp(expanded_pg_user,pg_user)==0)
29082908
*found_p= true;
29092909
}
29102910
else
29112911
{
2912-
if (strcmp(regexp_pgrole,pg_role)==0)
2912+
if (strcmp(expanded_pg_user,pg_user)==0)
29132913
*found_p= true;
29142914
}
2915-
pfree(regexp_pgrole);
2915+
pfree(expanded_pg_user);
29162916

29172917
return;
29182918
}
@@ -2921,14 +2921,14 @@ check_ident_usermap(IdentLine *identLine, const char *usermap_name,
29212921
/* Not regular expression, so make complete match */
29222922
if (case_insensitive)
29232923
{
2924-
if (pg_strcasecmp(identLine->pg_role,pg_role)==0&&
2925-
pg_strcasecmp(identLine->token->string,ident_user)==0)
2924+
if (pg_strcasecmp(identLine->pg_user,pg_user)==0&&
2925+
pg_strcasecmp(identLine->system_user->string,system_user)==0)
29262926
*found_p= true;
29272927
}
29282928
else
29292929
{
2930-
if (strcmp(identLine->pg_role,pg_role)==0&&
2931-
strcmp(identLine->token->string,ident_user)==0)
2930+
if (strcmp(identLine->pg_user,pg_user)==0&&
2931+
strcmp(identLine->system_user->string,system_user)==0)
29322932
*found_p= true;
29332933
}
29342934
}
@@ -2938,20 +2938,20 @@ check_ident_usermap(IdentLine *identLine, const char *usermap_name,
29382938
/*
29392939
*Scan the (pre-parsed) ident usermap file line by line, looking for a match
29402940
*
2941-
*See if the user with ident username "auth_user" is allowed to act
2942-
*asPostgres user "pg_role" according to usermap "usermap_name".
2941+
*See if thesystemuser with ident username "system_user" is allowed to act as
2942+
*Postgres user "pg_user" according to usermap "usermap_name".
29432943
*
29442944
*Special case: Usermap NULL, equivalent to what was previously called
29452945
*"sameuser" or "samerole", means don't look in the usermap file.
2946-
*That's an implied map wherein "pg_role" must be identical to
2947-
*"auth_user" in order to be authorized.
2946+
*That's an implied map wherein "pg_user" must be identical to
2947+
*"system_user" in order to be authorized.
29482948
*
29492949
*Iff authorized, return STATUS_OK, otherwise return STATUS_ERROR.
29502950
*/
29512951
int
29522952
check_usermap(constchar*usermap_name,
2953-
constchar*pg_role,
2954-
constchar*auth_user,
2953+
constchar*pg_user,
2954+
constchar*system_user,
29552955
boolcase_insensitive)
29562956
{
29572957
boolfound_entry= false,
@@ -2961,17 +2961,17 @@ check_usermap(const char *usermap_name,
29612961
{
29622962
if (case_insensitive)
29632963
{
2964-
if (pg_strcasecmp(pg_role,auth_user)==0)
2964+
if (pg_strcasecmp(pg_user,system_user)==0)
29652965
returnSTATUS_OK;
29662966
}
29672967
else
29682968
{
2969-
if (strcmp(pg_role,auth_user)==0)
2969+
if (strcmp(pg_user,system_user)==0)
29702970
returnSTATUS_OK;
29712971
}
29722972
ereport(LOG,
29732973
(errmsg("provided user name (%s) and authenticated user name (%s) do not match",
2974-
pg_role,auth_user)));
2974+
pg_user,system_user)));
29752975
returnSTATUS_ERROR;
29762976
}
29772977
else
@@ -2981,7 +2981,7 @@ check_usermap(const char *usermap_name,
29812981
foreach(line_cell,parsed_ident_lines)
29822982
{
29832983
check_ident_usermap(lfirst(line_cell),usermap_name,
2984-
pg_role,auth_user,case_insensitive,
2984+
pg_user,system_user,case_insensitive,
29852985
&found_entry,&error);
29862986
if (found_entry||error)
29872987
break;
@@ -2991,7 +2991,7 @@ check_usermap(const char *usermap_name,
29912991
{
29922992
ereport(LOG,
29932993
(errmsg("no match in usermap \"%s\" for user \"%s\" authenticated as \"%s\"",
2994-
usermap_name,pg_role,auth_user)));
2994+
usermap_name,pg_user,system_user)));
29952995
}
29962996
returnfound_entry ?STATUS_OK :STATUS_ERROR;
29972997
}
@@ -3073,7 +3073,7 @@ load_ident(void)
30733073
foreach(parsed_line_cell,new_parsed_lines)
30743074
{
30753075
newline= (IdentLine*)lfirst(parsed_line_cell);
3076-
free_auth_token(newline->token);
3076+
free_auth_token(newline->system_user);
30773077
}
30783078
MemoryContextDelete(ident_context);
30793079
return false;
@@ -3085,7 +3085,7 @@ load_ident(void)
30853085
foreach(parsed_line_cell,parsed_ident_lines)
30863086
{
30873087
newline= (IdentLine*)lfirst(parsed_line_cell);
3088-
free_auth_token(newline->token);
3088+
free_auth_token(newline->system_user);
30893089
}
30903090
}
30913091
if (parsed_ident_context!=NULL)

‎src/backend/utils/adt/hbafuncs.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -492,8 +492,8 @@ fill_ident_line(Tuplestorestate *tuple_store, TupleDesc tupdesc,
492492
if (ident!=NULL)
493493
{
494494
values[index++]=CStringGetTextDatum(ident->usermap);
495-
values[index++]=CStringGetTextDatum(ident->token->string);
496-
values[index++]=CStringGetTextDatum(ident->pg_role);
495+
values[index++]=CStringGetTextDatum(ident->system_user->string);
496+
values[index++]=CStringGetTextDatum(ident->pg_user);
497497
}
498498
else
499499
{

‎src/include/libpq/hba.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -142,8 +142,8 @@ typedef struct IdentLine
142142
intlinenumber;
143143

144144
char*usermap;
145-
char*pg_role;
146-
AuthToken*token;
145+
AuthToken*system_user;
146+
char*pg_user;
147147
}IdentLine;
148148

149149
/*
@@ -172,7 +172,7 @@ extern bool load_ident(void);
172172
externconstchar*hba_authname(UserAuthauth_method);
173173
externvoidhba_getauthmethod(hbaPort*port);
174174
externintcheck_usermap(constchar*usermap_name,
175-
constchar*pg_role,constchar*auth_user,
175+
constchar*pg_user,constchar*system_user,
176176
boolcase_insensitive);
177177
externHbaLine*parse_hba_line(TokenizedAuthLine*tok_line,intelevel);
178178
externIdentLine*parse_ident_line(TokenizedAuthLine*tok_line,intelevel);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp