Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit24b29ca

Browse files
committed
Support suffix matching of host names in pg_hba.conf
A name starting with a dot can be used to match a suffix of the actualhost name (e.g., .example.com matches foo.example.com).
1 parentdd15870 commit24b29ca

File tree

3 files changed

+43
-2
lines changed

3 files changed

+43
-2
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -282,6 +282,14 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
282282
to resolve an IP address.)
283283
</para>
284284

285+
<para>
286+
A host name specification that starts with a dot
287+
(<literal>.</literal>) matches a suffix of the actual host
288+
name. So <literal>.example.com</literal> would match
289+
<literal>foo.example.com</literal> (but not just
290+
<literal>example.com</literal>).
291+
</para>
292+
285293
<para>
286294
When host names are specified
287295
in <filename>pg_hba.conf</filename>, you should make sure that
@@ -310,6 +318,12 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
310318
everyone's problem.
311319
</para>
312320

321+
<para>
322+
Also, a reverse lookup is necessary to implement the suffix
323+
matching feature, because the actual client host name needs to
324+
be known in order to match it against the pattern.
325+
</para>
326+
313327
<para>
314328
Note that this behavior is consistent with other popular
315329
implementations of host name-based access control, such as the
@@ -605,6 +619,12 @@ host postgres all 192.168.93.0/24 ident
605619
# TYPE DATABASE USER ADDRESS METHOD
606620
host postgres all 192.168.12.10/32 md5
607621

622+
# Allow any user from hosts in the example.com domain to connect to
623+
# any database if the user's password is correctly supplied.
624+
#
625+
# TYPE DATABASE USER ADDRESS METHOD
626+
host all all .example.com md5
627+
608628
# In the absence of preceding "host" lines, these two lines will
609629
# reject all connections from 192.168.54.1 (since that entry will be
610630
# matched first), but allow Kerberos 5 connections from anywhere else

‎src/backend/libpq/hba.c

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -564,6 +564,26 @@ ipv6eq(struct sockaddr_in6 *a, struct sockaddr_in6 *b)
564564

565565
#endif/* HAVE_IPV6 */
566566

567+
/*
568+
* Check whether host name matches pattern.
569+
*/
570+
staticbool
571+
hostname_match(constchar*pattern,constchar*actual_hostname)
572+
{
573+
if (pattern[0]=='.')/* suffix match */
574+
{
575+
size_tplen=strlen(pattern);
576+
size_thlen=strlen(actual_hostname);
577+
578+
if (hlen<plen)
579+
return false;
580+
581+
return (pg_strcasecmp(pattern,actual_hostname+ (hlen-plen))==0);
582+
}
583+
else
584+
return (pg_strcasecmp(pattern,actual_hostname)==0);
585+
}
586+
567587
/*
568588
* Check to see if a connecting IP matches a given host name.
569589
*/
@@ -588,7 +608,7 @@ check_hostname(hbaPort *port, const char *hostname)
588608
port->remote_hostname=pstrdup(remote_hostname);
589609
}
590610

591-
if (pg_strcasecmp(port->remote_hostname,hostname)!=0)
611+
if (!hostname_match(hostname,port->remote_hostname))
592612
return false;
593613

594614
/* Lookup IP from host name and check against original IP */

‎src/backend/libpq/pg_hba.conf.sample

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,8 @@
3232
# ADDRESS specifies the set of hosts the record matches. It can be a
3333
# host name, or it is made up of an IP address and a CIDR mask that is
3434
# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that
35-
# specifies the number of significant bits in the mask.
35+
# specifies the number of significant bits in the mask. A host name
36+
# that starts with a dot (.) matches a suffix of the actual host name.
3637
# Alternatively, you can write an IP address and netmask in separate
3738
# columns to specify the set of hosts. Instead of a CIDR-address, you
3839
# can write "samehost" to match any of the server's own IP addresses,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp