diff options
| author | Magnus Hagander <magnus@hagander.net> | 2008-11-20 09:29:36 +0000 |
|---|---|---|
| committer | Magnus Hagander <magnus@hagander.net> | 2008-11-20 09:29:36 +0000 |
| commit | 3c486fbd1c8e8f79902a40ef929c4ed54f122561 (patch) | |
| tree | a72f7d12449747de29b1e0e50c953eba8df4a132 /src/backend/libpq/auth.c | |
| parent | 5054867632a3e3be6c7507b982ac20fbd04d3717 (diff) | |
| download | postgresql-3c486fbd1c8e8f79902a40ef929c4ed54f122561.tar.gz postgresql-3c486fbd1c8e8f79902a40ef929c4ed54f122561.zip | |
Control client certificate requesting with the pg_hba option "clientcert"
instead of just relying on the root certificate file to be present.
Diffstat (limited to 'src/backend/libpq/auth.c')
| -rw-r--r-- | src/backend/libpq/auth.c | 36 |
1 files changed, 35 insertions, 1 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index bccb0a516f2..dfa3ff2e9a9 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -8,7 +8,7 @@ * * * IDENTIFICATION - * $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.171 2008/11/18 13:10:20 petere Exp $ + * $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.172 2008/11/20 09:29:36 mha Exp $ * *------------------------------------------------------------------------- */ @@ -275,6 +275,40 @@ ClientAuthentication(Port *port) errmsg("missing or erroneous pg_hba.conf file"), errhint("See server log for details."))); + /* + * This is the first point where we have access to the hba record for + * the current connection, so perform any verifications based on the + * hba options field that should be done *before* the authentication + * here. + */ + if (port->hba->clientcert) + { + /* + * When we parse pg_hba.conf, we have already made sure that we have + * been able to load a certificate store. Thus, if a certificate is + * present on the client, it has been verified against our root + * certificate store, and the connection would have been aborted + * already if it didn't verify ok. + */ +#ifdef USE_SSL + if (!port->peer) + { + ereport(FATAL, + (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION), + errmsg("connection requires a valid client certificate"))); + } +#else + /* + * hba.c makes sure hba->clientcert can't be set unless OpenSSL + * is present. + */ + Assert(false); +#endif + } + + /* + * Now proceed to do the actual authentication check + */ switch (port->hba->auth_method) { case uaReject: |