|
24 | 24 |
|
25 | 25 | #include "common/percentrepl.h" |
26 | 26 | #include "common/string.h" |
| 27 | +#include "libpq/hba.h" |
27 | 28 | #include "libpq/libpq.h" |
28 | 29 | #include "storage/fd.h" |
| 30 | +#include "utils/guc.h" |
| 31 | +#include "utils/memutils.h" |
| 32 | + |
| 33 | +static HostsLine *parse_hosts_line(TokenizedAuthLine *tok_line, int elevel); |
29 | 34 |
|
30 | 35 | /* |
31 | 36 | * Run ssl_passphrase_command |
|
37 | 42 | * value is the length of the actual result. |
38 | 43 | */ |
39 | 44 | int |
40 | | -run_ssl_passphrase_command(const char *prompt, bool is_server_start, char *buf, int size) |
| 45 | +run_ssl_passphrase_command(const char *prompt, bool is_server_start, char *buf, int size, void *userdata) |
41 | 46 | { |
42 | 47 | int loglevel = is_server_start ? ERROR : LOG; |
43 | 48 | char *command; |
44 | 49 | FILE *fh; |
45 | 50 | int pclose_rc; |
46 | 51 | size_t len = 0; |
| 52 | + char *cmd = (char *) userdata; |
47 | 53 |
|
48 | 54 | Assert(prompt); |
49 | 55 | Assert(size > 0); |
50 | 56 | buf[0] = '\0'; |
51 | 57 |
|
52 | | - command = replace_percent_placeholders(ssl_passphrase_command, "ssl_passphrase_command", "p", prompt); |
| 58 | + command = replace_percent_placeholders(cmd, "ssl_passphrase_command", "p", prompt); |
53 | 59 |
|
54 | 60 | fh = OpenPipeStream(command, "r"); |
55 | 61 | if (fh == NULL) |
@@ -175,3 +181,196 @@ check_ssl_key_file_permissions(const char *ssl_key_file, bool isServerStart) |
175 | 181 |
|
176 | 182 | return true; |
177 | 183 | } |
| 184 | + |
| 185 | +/* |
| 186 | + * parse_hosts_line |
| 187 | + * |
| 188 | + * Parses a loaded line from the pg_hosts.conf configuration and pulls out the |
| 189 | + * hostname, certificate, key and CA parts in order to build an SNI config in |
| 190 | + * the TLS backend. Validation of the parsed values is left for the TLS backend |
| 191 | + * to implement. |
| 192 | + */ |
| 193 | +static HostsLine * |
| 194 | +parse_hosts_line(TokenizedAuthLine *tok_line, int elevel) |
| 195 | +{ |
| 196 | + HostsLine *parsedline; |
| 197 | + List *tokens; |
| 198 | + ListCell *field; |
| 199 | + AuthToken *token; |
| 200 | + |
| 201 | + parsedline = palloc0(sizeof(HostsLine)); |
| 202 | + parsedline->sourcefile = pstrdup(tok_line->file_name); |
| 203 | + parsedline->linenumber = tok_line->line_num; |
| 204 | + parsedline->rawline = pstrdup(tok_line->raw_line); |
| 205 | + |
| 206 | + /* Initialize optional fields */ |
| 207 | + parsedline->ssl_passphrase_cmd = NULL; |
| 208 | + parsedline->ssl_passphrase_reload = false; |
| 209 | + |
| 210 | + /* Hostname */ |
| 211 | + field = list_head(tok_line->fields); |
| 212 | + tokens = lfirst(field); |
| 213 | + token = linitial(tokens); |
| 214 | + parsedline->hostname = pstrdup(token->string); |
| 215 | + |
| 216 | + /* SSL Certificate (Required) */ |
| 217 | + field = lnext(tok_line->fields, field); |
| 218 | + if (!field) |
| 219 | + { |
| 220 | + ereport(elevel, |
| 221 | + errcode(ERRCODE_CONFIG_FILE_ERROR), |
| 222 | + errmsg("missing entry at end of line"), |
| 223 | + errcontext("line %d of configuration file \"%s\"", |
| 224 | + tok_line->line_num, tok_line->file_name)); |
| 225 | + return NULL; |
| 226 | + } |
| 227 | + tokens = lfirst(field); |
| 228 | + token = linitial(tokens); |
| 229 | + parsedline->ssl_cert = pstrdup(token->string); |
| 230 | + |
| 231 | + /* SSL key (Required) */ |
| 232 | + field = lnext(tok_line->fields, field); |
| 233 | + if (!field) |
| 234 | + { |
| 235 | + ereport(elevel, |
| 236 | + errcode(ERRCODE_CONFIG_FILE_ERROR), |
| 237 | + errmsg("missing entry at end of line"), |
| 238 | + errcontext("line %d of configuration file \"%s\"", |
| 239 | + tok_line->line_num, tok_line->file_name)); |
| 240 | + return NULL; |
| 241 | + } |
| 242 | + tokens = lfirst(field); |
| 243 | + token = linitial(tokens); |
| 244 | + parsedline->ssl_key = pstrdup(token->string); |
| 245 | + |
| 246 | + /* SSL CA (Required) */ |
| 247 | + field = lnext(tok_line->fields, field); |
| 248 | + if (!field) |
| 249 | + { |
| 250 | + ereport(elevel, |
| 251 | + errcode(ERRCODE_CONFIG_FILE_ERROR), |
| 252 | + errmsg("missing entry at end of line"), |
| 253 | + errcontext("line %d of configuration file \"%s\"", |
| 254 | + tok_line->line_num, tok_line->file_name)); |
| 255 | + return NULL; |
| 256 | + } |
| 257 | + tokens = lfirst(field); |
| 258 | + token = linitial(tokens); |
| 259 | + parsedline->ssl_ca = pstrdup(token->string); |
| 260 | + |
| 261 | + /* SSL Passphrase Command (optional) */ |
| 262 | + field = lnext(tok_line->fields, field); |
| 263 | + if (field) |
| 264 | + { |
| 265 | + tokens = lfirst(field); |
| 266 | + token = linitial(tokens); |
| 267 | + parsedline->ssl_passphrase_cmd = pstrdup(token->string); |
| 268 | + |
| 269 | + /* |
| 270 | + * SSL Passphrase Command support reload (optional). This field is |
| 271 | + * only supported if there was a passphrase command parsed first, so |
| 272 | + * nest it under the previous token. |
| 273 | + */ |
| 274 | + field = lnext(tok_line->fields, field); |
| 275 | + if (field) |
| 276 | + { |
| 277 | + tokens = lfirst(field); |
| 278 | + token = linitial(tokens); |
| 279 | + |
| 280 | + if (token->string[0] == '1' |
| 281 | + || pg_strcasecmp(token->string, "true") == 0 |
| 282 | + || pg_strcasecmp(token->string, "on") == 0 |
| 283 | + || pg_strcasecmp(token->string, "yes") == 0) |
| 284 | + parsedline->ssl_passphrase_reload = true; |
| 285 | + else if (token->string[0] == '0' |
| 286 | + || pg_strcasecmp(token->string, "false") == 0 |
| 287 | + || pg_strcasecmp(token->string, "off") == 0 |
| 288 | + || pg_strcasecmp(token->string, "no") == 0) |
| 289 | + parsedline->ssl_passphrase_reload = false; |
| 290 | + else |
| 291 | + ereport(elevel, |
| 292 | + errcode(ERRCODE_CONFIG_FILE_ERROR), |
| 293 | + errmsg("incorrect syntax for boolean value SSL_passphrase_cmd_reload"), |
| 294 | + errcontext("line %d of configuration file \"%s\"", |
| 295 | + tok_line->line_num, tok_line->file_name)); |
| 296 | + } |
| 297 | + } |
| 298 | + |
| 299 | + return parsedline; |
| 300 | +} |
| 301 | + |
| 302 | +/* |
| 303 | + * load_hosts |
| 304 | + * |
| 305 | + * Reads pg_hosts.conf and passes back a List of parsed lines, or NIL in case |
| 306 | + * of errors. |
| 307 | + */ |
| 308 | +List * |
| 309 | +load_hosts(void) |
| 310 | +{ |
| 311 | + FILE *file; |
| 312 | + ListCell *line; |
| 313 | + List *hosts_lines = NIL; |
| 314 | + List *parsed_lines = NIL; |
| 315 | + HostsLine *newline; |
| 316 | + bool ok = true; |
| 317 | + MemoryContext oldcxt; |
| 318 | + MemoryContext hostcxt; |
| 319 | + |
| 320 | + file = open_auth_file(HostsFileName, LOG, 0, NULL); |
| 321 | + if (file == NULL) |
| 322 | + { |
| 323 | + /* An error has already been logged so no need to add one here */ |
| 324 | + return NIL; |
| 325 | + } |
| 326 | + |
| 327 | + tokenize_auth_file(HostsFileName, file, &hosts_lines, LOG, 0); |
| 328 | + |
| 329 | + hostcxt = AllocSetContextCreate(PostmasterContext, |
| 330 | + "hosts file parser context", |
| 331 | + ALLOCSET_SMALL_SIZES); |
| 332 | + oldcxt = MemoryContextSwitchTo(hostcxt); |
| 333 | + |
| 334 | + foreach(line, hosts_lines) |
| 335 | + { |
| 336 | + TokenizedAuthLine *tok_line = (TokenizedAuthLine *) lfirst(line); |
| 337 | + |
| 338 | + if (tok_line->err_msg != NULL) |
| 339 | + { |
| 340 | + ok = false; |
| 341 | + continue; |
| 342 | + } |
| 343 | + |
| 344 | + if ((newline = parse_hosts_line(tok_line, LOG)) == NULL) |
| 345 | + { |
| 346 | + ok = false; |
| 347 | + continue; |
| 348 | + } |
| 349 | + |
| 350 | + parsed_lines = lappend(parsed_lines, newline); |
| 351 | + } |
| 352 | + |
| 353 | + free_auth_file(file, 0); |
| 354 | + MemoryContextSwitchTo(oldcxt); |
| 355 | + |
| 356 | + /* |
| 357 | + * If we didn't find any SNI configuration then that's not an error since |
| 358 | + * the pg_hosts file is additive to the default SSL configuration. |
| 359 | + */ |
| 360 | + if (ok && parsed_lines == NIL) |
| 361 | + { |
| 362 | + ereport(DEBUG1, |
| 363 | + errmsg("no SNI configuration added from configuration file \"%s\"", |
| 364 | + HostsFileName)); |
| 365 | + MemoryContextDelete(hostcxt); |
| 366 | + return NIL; |
| 367 | + } |
| 368 | + |
| 369 | + if (!ok) |
| 370 | + { |
| 371 | + MemoryContextDelete(hostcxt); |
| 372 | + return NIL; |
| 373 | + } |
| 374 | + |
| 375 | + return parsed_lines; |
| 376 | +} |
0 commit comments