Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitc464a06

Browse files
committed
Complain if pg_hba.conf contains "hostssl" but SSL is disabled.
Most commenters agreed that this is more friendly than silently failingto match the line during actual connection attempts. Also, this willprevent corner cases that might arise when trying to handle such a linewhen the SSL code isn't turned on. An example is that specifyingclientcert=1 in such a line would formerly result in a completelymisleading complaint that root.crt wasn't present, as seen in a recentreport from Marc-Andre Laverdiere. While we could have instead fixedthat specific behavior, it seems likely that we'd have a continuing streamof such bizarre behaviors if we keep on allowing hostssl lines when SSL isdisabled.Back-patch to 8.4, where clientcert was introduced. Earlier versions don'thave this specific issue, and the code is enough different to make thispatch not applicable without more work than it seems worth.
1 parent0cdbef6 commitc464a06

File tree

1 file changed

+14
-1
lines changed

1 file changed

+14
-1
lines changed

‎src/backend/libpq/hba.c

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
#include"catalog/pg_collation.h"
2929
#include"libpq/ip.h"
3030
#include"libpq/libpq.h"
31+
#include"postmaster/postmaster.h"
3132
#include"regex/regex.h"
3233
#include"replication/walsender.h"
3334
#include"storage/fd.h"
@@ -832,8 +833,20 @@ parse_hba_line(List *line, int line_num, HbaLine *parsedline)
832833

833834
if (token[4]=='s')/* "hostssl" */
834835
{
836+
/* SSL support must be actually active, else complain */
835837
#ifdefUSE_SSL
836-
parsedline->conntype=ctHostSSL;
838+
if (EnableSSL)
839+
parsedline->conntype=ctHostSSL;
840+
else
841+
{
842+
ereport(LOG,
843+
(errcode(ERRCODE_CONFIG_FILE_ERROR),
844+
errmsg("hostssl requires SSL to be turned on"),
845+
errhint("Set ssl = on in postgresql.conf."),
846+
errcontext("line %d of configuration file \"%s\"",
847+
line_num,HbaFileName)));
848+
return false;
849+
}
837850
#else
838851
ereport(LOG,
839852
(errcode(ERRCODE_CONFIG_FILE_ERROR),

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp