postgres.git / summary / log / commit / refs

commit    4afae689ead4ffbfdbaac1cd72794c729446596e
Author:   Magnus Hagander <magnus@hagander.net>
Date:     Wed Jan 26 08:52:41 2022 +0000

    Fix pg_hba_file_rules for authentication method cert
    
    For authentication method cert, clientcert=verify-full is implied. But
    the pg_hba_file_rules entry would incorrectly show clientcert=verify-ca.
    
    Per bug #17354
    
    Reported-By: Feike Steenbergen
    Reviewed-By: Jonathan Katz
    Backpatch-through: 12


 src/backend/libpq/hba.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index 3be8778d216..64e59d4d88a 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -1684,7 +1684,11 @@ parse_hba_line(TokenizedLine *tok_line, int elevel)
 	 */
 	if (parsedline->auth_method == uaCert)
 	{
-		parsedline->clientcert = clientCertCA;
+		/*
+		 * For auth method cert, client certificate validation is mandatory, and it implies
+		 * the level of verify-full.
+		 */
+		parsedline->clientcert = clientCertFull;
 	}
 
 	return parsedline;


[parent: 75674c7ec1b1]