diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2020-12-28 17:58:58 -0500 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2020-12-28 17:58:58 -0500 |
| commit | 7ed616f818f0a5842a927493d049cc393b09b9a1 (patch) | |
| tree | fc8132b4ac93b9762a94e2f7e0f9d4c0dd43dfe8 /src | |
| parent | 4cfdd8a47a9e865a45d38f944c6b0e6c7bc50628 (diff) | |
| download | postgresql-7ed616f818f0a5842a927493d049cc393b09b9a1.tar.gz postgresql-7ed616f818f0a5842a927493d049cc393b09b9a1.zip | |
Improve log messages related to pg_hba.conf not matching a connection.
Include details on whether GSS encryption has been activated;
since we added "hostgssenc" type HBA entries, that's relevant info.
Kyotaro Horiguchi and Tom Lane. Back-patch to v12 where
GSS encryption was introduced.
Discussion: https://postgr.es/m/e5b0b6ed05764324a2f3fe7acfc766d5@smhi.se
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/libpq/auth.c | 72 |
1 files changed, 28 insertions, 44 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index fbc591f0c31..72644f12e92 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -400,44 +400,37 @@ ClientAuthentication(Port *port) */ { char hostinfo[NI_MAXHOST]; + const char *encryption_state; pg_getnameinfo_all(&port->raddr.addr, port->raddr.salen, hostinfo, sizeof(hostinfo), NULL, 0, NI_NUMERICHOST); - if (am_walsender) - { + encryption_state = +#ifdef ENABLE_GSS + (port->gss && port->gss->enc) ? _("GSS encryption") : +#endif #ifdef USE_SSL + port->ssl_in_use ? _("SSL on") : +#endif + _("SSL off"); + + if (am_walsender) ereport(FATAL, (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION), + /* translator: last %s describes encryption state */ errmsg("pg_hba.conf rejects replication connection for host \"%s\", user \"%s\", %s", hostinfo, port->user_name, - port->ssl_in_use ? _("SSL on") : _("SSL off")))); -#else - ereport(FATAL, - (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION), - errmsg("pg_hba.conf rejects replication connection for host \"%s\", user \"%s\"", - hostinfo, port->user_name))); -#endif - } + encryption_state))); else - { -#ifdef USE_SSL ereport(FATAL, (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION), + /* translator: last %s describes encryption state */ errmsg("pg_hba.conf rejects connection for host \"%s\", user \"%s\", database \"%s\", %s", hostinfo, port->user_name, port->database_name, - port->ssl_in_use ? _("SSL on") : _("SSL off")))); -#else - ereport(FATAL, - (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION), - errmsg("pg_hba.conf rejects connection for host \"%s\", user \"%s\", database \"%s\"", - hostinfo, port->user_name, - port->database_name))); -#endif - } + encryption_state))); break; } @@ -453,12 +446,22 @@ ClientAuthentication(Port *port) */ { char hostinfo[NI_MAXHOST]; + const char *encryption_state; pg_getnameinfo_all(&port->raddr.addr, port->raddr.salen, hostinfo, sizeof(hostinfo), NULL, 0, NI_NUMERICHOST); + encryption_state = +#ifdef ENABLE_GSS + (port->gss && port->gss->enc) ? _("GSS encryption") : +#endif +#ifdef USE_SSL + port->ssl_in_use ? _("SSL on") : +#endif + _("SSL off"); + #define HOSTNAME_LOOKUP_DETAIL(port) \ (port->remote_hostname ? \ (port->remote_hostname_resolv == +1 ? \ @@ -481,41 +484,22 @@ ClientAuthentication(Port *port) 0)) if (am_walsender) - { -#ifdef USE_SSL ereport(FATAL, (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION), + /* translator: last %s describes encryption state */ errmsg("no pg_hba.conf entry for replication connection from host \"%s\", user \"%s\", %s", hostinfo, port->user_name, - port->ssl_in_use ? _("SSL on") : _("SSL off")), + encryption_state), HOSTNAME_LOOKUP_DETAIL(port))); -#else - ereport(FATAL, - (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION), - errmsg("no pg_hba.conf entry for replication connection from host \"%s\", user \"%s\"", - hostinfo, port->user_name), - HOSTNAME_LOOKUP_DETAIL(port))); -#endif - } else - { -#ifdef USE_SSL ereport(FATAL, (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION), + /* translator: last %s describes encryption state */ errmsg("no pg_hba.conf entry for host \"%s\", user \"%s\", database \"%s\", %s", hostinfo, port->user_name, port->database_name, - port->ssl_in_use ? _("SSL on") : _("SSL off")), - HOSTNAME_LOOKUP_DETAIL(port))); -#else - ereport(FATAL, - (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION), - errmsg("no pg_hba.conf entry for host \"%s\", user \"%s\", database \"%s\"", - hostinfo, port->user_name, - port->database_name), + encryption_state), HOSTNAME_LOOKUP_DETAIL(port))); -#endif - } break; } |