From: Tom Lane <tgl@sss.pgh.pa.us>
To: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Cc: sfrost@snowman.net
Cc: mikael.gustavsson@smhi.se
Cc: magnus@hagander.net
Cc: pgsql-general@postgresql.org
Cc: peter.svensson@smhi.se
Subject: Re: Problem with ssl and psql in Postgresql 13
Date: Thu, 24 Dec 2020 11:54:32 -0500
Message-ID: <795101.1608828872@sss.pgh.pa.us> (raw)
In-Reply-To: <755331.1608780141@sss.pgh.pa.us>
References: <20201223214534.GS27507@tamriel.snowman.net>
<740093.1608760567@sss.pgh.pa.us>
<742641.1608762845@sss.pgh.pa.us>
<20201224.120520.788085853846287470.horikyota.ntt@gmail.com>
<755331.1608780141@sss.pgh.pa.us>
I wrote:
> Kyotaro Horiguchi <horikyota.ntt@gmail.com> writes:
>> The attached the first patch does that.
> +1, it seems like a clear oversight that the GSSENC patches didn't adjust
> these messages. The reason SSL state is mentioned is that it's relevant
> to which pg_hba entry gets chosen; and once we invented "hostgssenc"
> entries, GSSENC state is also relevant.
Thinking a little more about that: there are not four distinct states,
because GSS and SSL can't both be enabled (ProcessStartupPacket enforces
that). So I propose that instead of adding a new field, we make the
existing field say one of three things: "GSS encryption", "SSL
encryption", or "no encryption". As per attached. In the back branches,
it might be best to spell these as "GSS encryption", "SSL on", and "SSL
off", just to minimize the cosmetic change.
regards, tom lane
Attachments:improve-pg_hba-rejection-messages-2.patch (text/x-diff, 4.1K) downloaddiff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.cindex 3d80930968..45572161cb 100644--- a/src/backend/libpq/auth.c+++ b/src/backend/libpq/auth.c@@ -412,44 +412,37 @@ ClientAuthentication(Port *port)
*/
{
char hostinfo[NI_MAXHOST];
+ const char *encryption_state;
pg_getnameinfo_all(&port->raddr.addr, port->raddr.salen,
hostinfo, sizeof(hostinfo),
NULL, 0,
NI_NUMERICHOST);
- if (am_walsender)- {+ encryption_state =+#ifdef ENABLE_GSS+ port->gss->enc ? _("GSS encryption") :+#endif
#ifdef USE_SSL
+ port->ssl_in_use ? _("SSL encryption") :+#endif+ _("no encryption");++ if (am_walsender)
ereport(FATAL,
(errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
+ /* translator: last %s describes encryption state */
errmsg("pg_hba.conf rejects replication connection for host \"%s\", user \"%s\", %s",
hostinfo, port->user_name,
- port->ssl_in_use ? _("SSL on") : _("SSL off"))));-#else- ereport(FATAL,- (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),- errmsg("pg_hba.conf rejects replication connection for host \"%s\", user \"%s\"",- hostinfo, port->user_name)));-#endif- }+ encryption_state)));
else
- {-#ifdef USE_SSL
ereport(FATAL,
(errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
+ /* translator: last %s describes encryption state */
errmsg("pg_hba.conf rejects connection for host \"%s\", user \"%s\", database \"%s\", %s",
hostinfo, port->user_name,
port->database_name,
- port->ssl_in_use ? _("SSL on") : _("SSL off"))));-#else- ereport(FATAL,- (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),- errmsg("pg_hba.conf rejects connection for host \"%s\", user \"%s\", database \"%s\"",- hostinfo, port->user_name,- port->database_name)));-#endif- }+ encryption_state)));
break;
}
@@ -465,12 +458,22 @@ ClientAuthentication(Port *port)
*/
{
char hostinfo[NI_MAXHOST];
+ const char *encryption_state;
pg_getnameinfo_all(&port->raddr.addr, port->raddr.salen,
hostinfo, sizeof(hostinfo),
NULL, 0,
NI_NUMERICHOST);
+ encryption_state =+#ifdef ENABLE_GSS+ port->gss->enc ? _("GSS encryption") :+#endif+#ifdef USE_SSL+ port->ssl_in_use ? _("SSL encryption") :+#endif+ _("no encryption");+
#define HOSTNAME_LOOKUP_DETAIL(port) \
(port->remote_hostname ? \
(port->remote_hostname_resolv == +1 ? \
@@ -493,41 +496,22 @@ ClientAuthentication(Port *port)
0))
if (am_walsender)
- {-#ifdef USE_SSL
ereport(FATAL,
(errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
+ /* translator: last %s describes encryption state */
errmsg("no pg_hba.conf entry for replication connection from host \"%s\", user \"%s\", %s",
hostinfo, port->user_name,
- port->ssl_in_use ? _("SSL on") : _("SSL off")),+ encryption_state),
HOSTNAME_LOOKUP_DETAIL(port)));
-#else- ereport(FATAL,- (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),- errmsg("no pg_hba.conf entry for replication connection from host \"%s\", user \"%s\"",- hostinfo, port->user_name),- HOSTNAME_LOOKUP_DETAIL(port)));-#endif- }
else
- {-#ifdef USE_SSL
ereport(FATAL,
(errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
+ /* translator: last %s describes encryption state */
errmsg("no pg_hba.conf entry for host \"%s\", user \"%s\", database \"%s\", %s",
hostinfo, port->user_name,
port->database_name,
- port->ssl_in_use ? _("SSL on") : _("SSL off")),- HOSTNAME_LOOKUP_DETAIL(port)));-#else- ereport(FATAL,- (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),- errmsg("no pg_hba.conf entry for host \"%s\", user \"%s\", database \"%s\"",- hostinfo, port->user_name,- port->database_name),+ encryption_state),
HOSTNAME_LOOKUP_DETAIL(port)));
-#endif- }
break;
}
=
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-general@postgresql.org
Cc: tgl@sss.pgh.pa.us, horikyota.ntt@gmail.com, sfrost@snowman.net, mikael.gustavsson@smhi.se, magnus@hagander.net, peter.svensson@smhi.se
Subject: Re: Problem with ssl and psql in Postgresql 13
In-Reply-To: <795101.1608828872@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox