8000 Overhaul pg_hba.conf clientcert's API · postgrespro/postgres@253f102 · GitHub
[go: up one dir, main page]
Skip to content

Commit 253f102

Browse files
bmomjianbmomjian
committed
Overhaul pg_hba.conf clientcert's API
Since PG 12, clientcert no longer supported only on/off, so remove 1/0 as possible values, and instead support only the text strings 'verify-ca' and 'verify-full'. Remove support for 'no-verify' since that is possible by just not specifying clientcert. Also, throw an error if 'verify-ca' is used and 'cert' authentication is used, since cert authentication requires verify-full. Also improve the docs. THIS IS A BACKWARD INCOMPATIBLE API CHANGE. Reported-by: Kyotaro Horiguchi Discussion: https://postgr.es/m/20200716.093012.1627751694396009053.horikyota.ntt@gmail.com Author: Kyotaro Horiguchi Backpatch-through: master
1 parent 18c170a commit 253f102

File tree

3 files changed

+13
-21
lines changed
  • doc/src/sgml
  • src/backend/libpq

    • 3 files changed

    +13
    -21
    lines changed

    ‎doc/src/sgml/client-auth.sgml

    Lines changed: 4 additions & 7 deletions
    Original file line numberDiff line numberDiff line change
    @@ -2044,13 +2044,10 @@ host ... radius radiusservers="server1,server2" radiussecrets="""secret one"",""
    20442044
    </para>
    20452045

    20462046
    <para>
    2047-
    In a <filename>pg_hba.conf</filename> record specifying certificate
    2048-
    authentication, the authentication option <literal>clientcert</literal> is
    2049-
    assumed to be <literal>verify-ca</literal> or <literal>verify-full</literal>,
    2050-
    and it cannot be turned off since a client certificate is necessary for this
    2051-
    method. What the <literal>cert</literal> method adds to the basic
    2052-
    <literal>clientcert</literal> certificate validity test is a check that the
    2053-
    <literal>cn</literal> attribute matches the database user name.
    2047+
    It is redundant to use the <literal>clientcert</literal> option with
    2048+
    <literal>cert</literal> authentication because <literal>cert</literal>
    2049+
    authentication is effectively <literal>trust</literal> authentication
    2050+
    with <literal>clientcert=verify-full</literal>.
    20542051
    </para>
    20552052
    </sect1>
    20562053

    ‎doc/src/sgml/runtime.sgml

    Lines changed: 2 additions & 3 deletions
    Original file line numberDiff line numberDiff line change
    @@ -2345,9 +2345,8 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
    23452345
    The <literal>clientcert</literal> authentication option is available for
    23462346
    all authentication methods, but only in <filename>pg_hba.conf</filename> lines
    23472347
    specified as <literal>hostssl</literal>. When <literal>clientcert</literal> is
    2348-
    not specified or is set to <literal>no-verify</literal>, the server will still
    2349-
    verify any presented client certificates against its CA file, if one is
    2350-
    configured &mdash; but it will not insist that a client certificate be presented.
    2348+
    not specified, the server verifies the client certificate against its CA
    2349+
    file only if a client certificate is presented and the CA is configured.
    23512350
    </para>
    23522351

    23532352
    <para>

    ‎src/backend/libpq/hba.c

    Lines changed: 7 additions & 11 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1730,29 +1730,25 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
    17301730
    *err_msg = "clientcert can only be configured for \"hostssl\" rows";
    17311731
    return false;
    17321732
    }
    1733-
    if (strcmp(val, "1") == 0
    1734-
    || strcmp(val, "verify-ca") == 0)
    1735-
    {
    1736-
    hbaline->clientcert = clientCertCA;
    1737-
    }
    1738-
    else if (strcmp(val, "verify-full") == 0)
    1733+
    1734+
    if (strcmp(val, "verify-full") == 0)
    17391735
    {
    17401736
    hbaline->clientcert = clientCertFull;
    17411737
    }
    1742-
    else if (strcmp(val, "0") == 0
    1743-
    || strcmp(val, "no-verify") == 0)
    1738+
    else if (strcmp(val, "verify-ca") == 0)
    17441739
    {
    17451740
    if (hbaline->auth_method == uaCert)
    17461741
    {
    17471742
    ereport(elevel,
    17481743
    (errcode(ERRCODE_CONFIG_FILE_ERROR),
    1749-
    errmsg("clientcert cannot be set to \"no-verify\" when using \"cert\" authentication"),
    1744+
    errmsg("clientcert only accepts \"verify-full\" when using \"cert\" authentication"),
    17501745
    errcontext("line %d of configuration file \"%s\"",
    17511746
    line_num, HbaFileName)));
    1752-
    *err_msg = "clientcert cannot be set to \"no-verify\" when using \"cert\" authentication";
    1747+
    *err_msg = "clientcert can only be set to \"verify-full\" when using \"cert\" authentication";
    17531748
    return false;
    17541749
    }
    1755-
    hbaline->clientcert = clientCertOff;
    1750+
    1751+
    hbaline->clientcert = clientCertCA;
    17561752
    }
    17571753
    else
    17581754
    {

    0 commit comments

    Comments
     (0)
    0