postgres.git / summary / log / commit / refs

commit    64e258f8d71374dd9416ca75262a7b65f4a789b2
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Tue Apr 26 19:40:18 2011 +0000
First released in: 9.1.0, 8.4.9, 9.0.5

    Complain if pg_hba.conf contains "hostssl" but SSL is disabled.
    
    Most commenters agreed that this is more friendly than silently failing
    to match the line during actual connection attempts.  Also, this will
    prevent corner cases that might arise when trying to handle such a line
    when the SSL code isn't turned on.  An example is that specifying
    clientcert=1 in such a line would formerly result in a completely
    misleading complaint that root.crt wasn't present, as seen in a recent
    report from Marc-Andre Laverdiere.  While we could have instead fixed
    that specific behavior, it seems likely that we'd have a continuing stream
    of such bizarre behaviors if we keep on allowing hostssl lines when SSL is
    disabled.
    
    Back-patch to 8.4, where clientcert was introduced.  Earlier versions don't
    have this specific issue, and the code is enough different to make this
    patch not applicable without more work than it seems worth.


 src/backend/libpq/hba.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index a14d265676f..b679e946538 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -27,6 +27,7 @@
 
 #include "libpq/ip.h"
 #include "libpq/libpq.h"
+#include "postmaster/postmaster.h"
 #include "regex/regex.h"
 #include "storage/fd.h"
 #include "utils/flatfiles.h"
@@ -646,8 +647,20 @@ parse_hba_line(List *line, int line_num, HbaLine *parsedline)
 
 		if (token[4] == 's')	/* "hostssl" */
 		{
+			/* SSL support must be actually active, else complain */
 #ifdef USE_SSL
-			parsedline->conntype = ctHostSSL;
+			if (EnableSSL)
+				parsedline->conntype = ctHostSSL;
+			else
+			{
+				ereport(LOG,
+						(errcode(ERRCODE_CONFIG_FILE_ERROR),
+						 errmsg("hostssl requires SSL to be turned on"),
+						 errhint("Set ssl = on in postgresql.conf."),
+						 errcontext("line %d of configuration file \"%s\"",
+									line_num, HbaFileName)));
+				return false;
+			}
 #else
 			ereport(LOG,
 					(errcode(ERRCODE_CONFIG_FILE_ERROR),


[parent: 13ec0bda2a12]