Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
Greenplum
Gpdb
提交
bca9d0cd
G
Gpdb
项目概览
Greenplum
/
Gpdb
通知
7
Star
1
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
DevOps
流水线
流水线任务
计划
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
G
Gpdb
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
DevOps
DevOps
流水线
流水线任务
计划
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
流水线任务
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
bca9d0cd
编写于
8月 21, 2001
作者:
B
Bruce Momjian
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Add SCM_CREDS to get owner of unix-domain socket on BSD-like systems.
上级
04fdf73a
变更
9
展开全部
隐藏空白更改
内联
并排
Showing
9 changed file
with
1019 addition
and
783 deletion
+1019
-783
doc/FAQ_japanese
doc/FAQ_japanese
+701
-653
doc/src/FAQ/FAQ_japanese.html
doc/src/FAQ/FAQ_japanese.html
+125
-104
src/backend/libpq/auth.c
src/backend/libpq/auth.c
+29
-5
src/backend/libpq/hba.c
src/backend/libpq/hba.c
+79
-11
src/backend/libpq/pg_hba.conf.sample
src/backend/libpq/pg_hba.conf.sample
+6
-6
src/include/libpq/pqcomm.h
src/include/libpq/pqcomm.h
+2
-1
src/interfaces/libpq/fe-auth.c
src/interfaces/libpq/fe-auth.c
+71
-3
src/interfaces/odbc/connection.c
src/interfaces/odbc/connection.c
+5
-0
src/interfaces/odbc/connection.h
src/interfaces/odbc/connection.h
+1
-0
未找到文件。
doc/FAQ_japanese
浏览文件 @
bca9d0cd
此差异已折叠。
点击以展开。
doc/src/FAQ/FAQ_japanese.html
浏览文件 @
bca9d0cd
此差异已折叠。
点击以展开。
src/backend/libpq/auth.c
浏览文件 @
bca9d0cd
...
...
@@ -8,17 +8,22 @@
*
*
* IDENTIFICATION
* $Header: /cvsroot/pgsql/src/backend/libpq/auth.c,v 1.6
2 2001/08/17 15:44:1
7 momjian Exp $
* $Header: /cvsroot/pgsql/src/backend/libpq/auth.c,v 1.6
3 2001/08/21 00:33:2
7 momjian Exp $
*
*-------------------------------------------------------------------------
*/
#include "postgres.h"
#include <sys/types.h>
/* needed by in.h on Ultrix */
#include <sys/types.h>
#include <sys/socket.h>
/* for SCM_CREDS */
#ifdef SCM_CREDS
#include <sys/uio.h>
/* for struct iovec */
#include <sys/ucred.h>
#include <errno.h>
#endif
#include <netinet/in.h>
#include <arpa/inet.h>
#include "libpq/auth.h"
#include "libpq/crypt.h"
#include "libpq/hba.h"
...
...
@@ -28,12 +33,10 @@
#include "miscadmin.h"
static
void
sendAuthRequest
(
Port
*
port
,
AuthRequest
areq
);
static
int
checkPassword
(
Port
*
port
,
char
*
user
,
char
*
password
);
static
int
old_be_recvauth
(
Port
*
port
);
static
int
map_old_to_new
(
Port
*
port
,
UserAuth
old
,
int
status
);
static
void
auth_failed
(
Port
*
port
);
static
int
recv_and_check_password_packet
(
Port
*
port
);
static
int
recv_and_check_passwordv0
(
Port
*
port
);
...
...
@@ -493,6 +496,26 @@ ClientAuthentication(Port *port)
break
;
case
uaIdent
:
#if !defined(SO_PEERCRED) && defined(SCM_CREDS)
/*
* If we are doing ident on unix-domain sockets,
* use SCM_CREDS only if it is defined and SO_PEERCRED isn't.
*/
#ifdef fc_uid
/* Receive credentials on next message receipt, BSD/OS */
{
int
on
=
1
;
if
(
setsockopt
(
port
->
sock
,
0
,
LOCAL_CREDS
,
&
on
,
sizeof
(
on
))
<
0
)
{
elog
(
FATAL
,
"pg_local_sendauth: can't do setsockopt: %s
\n
"
,
strerror
(
errno
));
return
;
}
}
#endif
if
(
port
->
raddr
.
sa
.
sa_family
==
AF_UNIX
)
sendAuthRequest
(
port
,
AUTH_REQ_SCM_CREDS
);
#endif
status
=
authident
(
port
);
break
;
...
...
@@ -676,3 +699,4 @@ map_old_to_new(Port *port, UserAuth old, int status)
return
status
;
}
src/backend/libpq/hba.c
浏览文件 @
bca9d0cd
...
...
@@ -10,7 +10,7 @@
*
*
* IDENTIFICATION
* $Header: /cvsroot/pgsql/src/backend/libpq/hba.c,v 1.6
4 2001/08/16 16:24:15
momjian Exp $
* $Header: /cvsroot/pgsql/src/backend/libpq/hba.c,v 1.6
5 2001/08/21 00:33:27
momjian Exp $
*
*-------------------------------------------------------------------------
*/
...
...
@@ -18,9 +18,13 @@
#include <errno.h>
#include <pwd.h>
#include <sys/types.h>
#include <fcntl.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/socket.h>
/* for SCM_CREDS */
#ifdef SCM_CREDS
#include <sys/uio.h>
/* for struct iovec */
#include <sys/ucred.h>
#endif
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
...
...
@@ -876,39 +880,103 @@ ident_unix(int sock, char *ident_user)
{
/* We didn't get a valid credentials struct. */
snprintf
(
PQerrormsg
,
PQERRORMSG_LENGTH
,
"
Could not get valid credentials from the UNIX socket
: %s
\n
"
,
"
ident_unix: error receiving credentials
: %s
\n
"
,
strerror
(
errno
));
fputs
(
PQerrormsg
,
stderr
);
pqdebug
(
"%s"
,
PQerrormsg
);
return
false
;
}
/* Convert UID to user login name */
pass
=
getpwuid
(
peercred
.
uid
);
if
(
pass
==
NULL
)
{
/* Error - no username with the given uid */
snprintf
(
PQerrormsg
,
PQERRORMSG_LENGTH
,
"There is no entry in /etc/passwd with the socket's uid
\n
"
);
"ident_unix: unknown local user with uid %d
\n
"
,
fputs
(
PQerrormsg
,
stderr
);
pqdebug
(
"%s"
,
PQerrormsg
);
return
false
;
}
StrNCpy
(
ident_user
,
pass
->
pw_name
,
IDENT_USERNAME_MAX
);
StrNCpy
(
ident_user
,
pass
->
pw_name
,
IDENT_USERNAME_MAX
+
1
);
return
true
;
#else
/* not SO_PEERCRED */
#elif defined(SCM_CREDS)
struct
msghdr
msg
;
/* Credentials structure */
#ifndef fc_uid
typedef
struct
cmsgcred
Cred
;
#define cruid cmcred_uid
#else
typedef
struct
fcred
Cred
;
#define cruid fc_uid
#endif
Cred
*
cred
;
/* Compute size without padding */
char
cmsgmem
[
sizeof
(
struct
cmsghdr
)
+
sizeof
(
Cred
)];
/* Point to start of first structure */
struct
cmsghdr
*
cmsg
=
(
struct
cmsghdr
*
)
cmsgmem
;
struct
iovec
iov
;
char
buf
;
struct
passwd
*
pw
;
memset
(
&
msg
,
0
,
sizeof
(
msg
));
msg
.
msg_iov
=
&
iov
;
msg
.
msg_iovlen
=
1
;
msg
.
msg_control
=
(
char
*
)
cmsg
;
msg
.
msg_controllen
=
sizeof
(
cmsgmem
);
memset
(
cmsg
,
0
,
sizeof
(
cmsgmem
));
/*
* The one character which is received here is not meaningful;
* its purposes is only to make sure that recvmsg() blocks
* long enough for the other side to send its credentials.
*/
iov
.
iov_base
=
&
buf
;
iov
.
iov_len
=
1
;
if
(
recvmsg
(
sock
,
&
msg
,
0
)
<
0
||
cmsg
->
cmsg_len
<
sizeof
(
cmsgmem
)
||
cmsg
->
cmsg_type
!=
SCM_CREDS
)
{
snprintf
(
PQerrormsg
,
PQERRORMSG_LENGTH
,
"ident_unix: error receiving credentials: %s
\n
"
,
strerror
(
errno
));
fputs
(
PQerrormsg
,
stderr
);
pqdebug
(
"%s"
,
PQerrormsg
);
return
false
;
}
cred
=
(
Cred
*
)
CMSG_DATA
(
cmsg
);
pw
=
getpwuid
(
cred
->
fc_uid
);
if
(
pw
==
NULL
)
{
snprintf
(
PQerrormsg
,
PQERRORMSG_LENGTH
,
"ident_unix: unknown local user with uid %d
\n
"
,
cred
->
fc_uid
);
fputs
(
PQerrormsg
,
stderr
);
pqdebug
(
"%s"
,
PQerrormsg
);
return
false
;
}
StrNCpy
(
ident_user
,
pw
->
pw_name
,
IDENT_USERNAME_MAX
+
1
);
return
true
;
#else
snprintf
(
PQerrormsg
,
PQERRORMSG_LENGTH
,
"
IDENT
auth is not supported on local connections on this platform
\n
"
);
"
'ident'
auth is not supported on local connections on this platform
\n
"
);
fputs
(
PQerrormsg
,
stderr
);
pqdebug
(
"%s"
,
PQerrormsg
);
return
false
;
#endif
/* SO_PEERCRED */
#endif
}
/*
...
...
src/backend/libpq/pg_hba.conf.sample
浏览文件 @
bca9d0cd
...
...
@@ -127,12 +127,12 @@
# ident: For TCP/IP connections, authentication is done by contacting
# the ident server on the client host. (CAUTION: this is only
# as secure as the client machine!) On machines that support
# SO_PEERCRED
socket requests, this method also works for
#
local Unix-domain connections. AUTH_ARGUMENT is required:
#
it determines how to map remote user names to Postgres user
#
names. The AUTH_ARGUMENT is a map name found in the
#
$PGDATA/pg_ident.conf file. The connection is accepted if
# that file contains an entry for this map name with the
# SO_PEERCRED
or SCM_CREDS socket requests, this method also
#
works for local Unix-domain connections. AUTH_ARGUMENT is
#
required: it determines how to map remote user names to
#
Postgres user names. The AUTH_ARGUMENT is a map name found
#
in the $PGDATA/pg_ident.conf file. The connection is accepted
#
if
that file contains an entry for this map name with the
# ident-supplied username and the requested Postgres username.
# The special map name "sameuser" indicates an implied map
# (not in pg_ident.conf) that maps each ident username to the
...
...
src/include/libpq/pqcomm.h
浏览文件 @
bca9d0cd
...
...
@@ -9,7 +9,7 @@
* Portions Copyright (c) 1996-2001, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
* $Id: pqcomm.h,v 1.5
7 2001/08/16 04:27:18
momjian Exp $
* $Id: pqcomm.h,v 1.5
8 2001/08/21 00:33:27
momjian Exp $
*
*-------------------------------------------------------------------------
*/
...
...
@@ -133,6 +133,7 @@ typedef struct StartupPacket
#define AUTH_REQ_PASSWORD 3
/* Password */
#define AUTH_REQ_CRYPT 4
/* crypt password */
#define AUTH_REQ_MD5 5
/* md5 password */
#define AUTH_REQ_SCM_CREDS 6
/* transfer SCM credentials */
typedef
uint32
AuthRequest
;
...
...
src/interfaces/libpq/fe-auth.c
浏览文件 @
bca9d0cd
...
...
@@ -10,7 +10,7 @@
* exceed INITIAL_EXPBUFFER_SIZE (currently 256 bytes).
*
* IDENTIFICATION
* $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-auth.c,v 1.5
5 2001/08/17 15:40:0
7 momjian Exp $
* $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-auth.c,v 1.5
6 2001/08/21 00:33:2
7 momjian Exp $
*
*-------------------------------------------------------------------------
*/
...
...
@@ -30,6 +30,7 @@
#include "postgres_fe.h"
/* XXX is there a reason these appear before the system defines? */
#include "libpq-fe.h"
#include "libpq-int.h"
#include "fe-auth.h"
...
...
@@ -40,6 +41,13 @@
#else
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
/* for SCM_CREDS */
#ifdef SCM_CREDS
#include <sys/uio.h>
/* for struct iovec */
#include <sys/ucred.h>
#endif
#include <sys/param.h>
/* for MAXHOSTNAMELEN on most */
#ifndef MAXHOSTNAMELEN
#include <netdb.h>
/* for MAXHOSTNAMELEN on some */
...
...
@@ -428,6 +436,53 @@ pg_krb5_sendauth(char *PQerrormsg, int sock,
#endif
/* KRB5 */
#ifdef SCM_CREDS
static
int
pg_local_sendauth
(
char
*
PQerrormsg
,
PGconn
*
conn
)
{
char
buf
;
struct
iovec
iov
;
struct
msghdr
msg
;
#ifndef fc_uid
/* Prevent padding */
char
cmsgmem
[
sizeof
(
struct
cmsghdr
)
+
sizeof
(
struct
cmsgcred
)];
/* Point to start of first structure */
struct
cmsghdr
*
cmsg
=
(
struct
cmsghdr
*
)
cmsgmem
;
#endif
/*
* The backend doesn't care what we send here, but it wants
* exactly one character to force recvmsg() to block and wait
* for us.
*/
buf
=
'\0'
;
iov
.
iov_base
=
&
buf
;
iov
.
iov_len
=
1
;
memset
(
&
msg
,
0
,
sizeof
(
msg
));
msg
.
msg_iov
=
&
iov
;
msg
.
msg_iovlen
=
1
;
#ifndef fc_uid
/* Create control header, FreeBSD */
msg
.
msg_control
=
cmsg
;
msg
.
msg_controllen
=
sizeof
(
cmsgmem
);
memset
(
cmsg
,
0
,
sizeof
(
cmsgmem
));
cmsg
.
hdr
.
cmsg_len
=
sizeof
(
cmsgmem
);
cmsg
.
hdr
.
cmsg_level
=
SOL_SOCKET
;
cmsg
.
hdr
.
cmsg_type
=
SCM_CREDS
;
#endif
if
(
sendmsg
(
conn
->
sock
,
&
msg
,
0
)
==
-
1
)
{
snprintf
(
PQerrormsg
,
PQERRORMSG_LENGTH
,
"pg_local_sendauth: sendmsg: %s
\n
"
,
strerror
(
errno
));
return
STATUS_ERROR
;
}
return
STATUS_OK
;
}
#endif
static
int
pg_password_sendauth
(
PGconn
*
conn
,
const
char
*
password
,
AuthRequest
areq
)
{
...
...
@@ -473,12 +528,13 @@ pg_password_sendauth(PGconn *conn, const char *password, AuthRequest areq)
crypt_pwd
=
crypt
(
password
,
salt
);
break
;
}
default
:
case
AUTH_REQ_PASSWORD
:
/* discard const so we can assign it */
crypt_pwd
=
(
char
*
)
password
;
break
;
default:
return
STATUS_ERROR
;
}
ret
=
pqPacketSend
(
conn
,
crypt_pwd
,
strlen
(
crypt_pwd
)
+
1
);
if
(
areq
==
AUTH_REQ_MD5
)
free
(
crypt_pwd
);
...
...
@@ -551,6 +607,18 @@ fe_sendauth(AuthRequest areq, PGconn *conn, const char *hostname,
return
STATUS_ERROR
;
}
break
;
case
AUTH_REQ_SCM_CREDS
:
#ifdef SCM_CREDS
if
(
pg_local_sendauth
(
PQerrormsg
,
conn
)
!=
STATUS_OK
)
return
STATUS_ERROR
;
#else
snprintf
(
PQerrormsg
,
PQERRORMSG_LENGTH
,
libpq_gettext
(
"SCM_CRED authentication method not supported
\n
"
));
return
STATUS_ERROR
;
#endif
break
;
default:
snprintf
(
PQerrormsg
,
PQERRORMSG_LENGTH
,
libpq_gettext
(
"authentication method %u not supported
\n
"
),
areq
);
...
...
src/interfaces/odbc/connection.c
浏览文件 @
bca9d0cd
...
...
@@ -726,6 +726,11 @@ CC_connect(ConnectionClass *self, char do_password)
self
->
errornumber
=
CONN_AUTH_TYPE_UNSUPPORTED
;
return
0
;
case
AUTH_REQ_SCM_CREDS
:
self
->
errormsg
=
"Unix socket credential authentication not supported"
;
self
->
errornumber
=
CONN_AUTH_TYPE_UNSUPPORTED
;
return
0
;
default:
self
->
errormsg
=
"Unknown authentication type"
;
self
->
errornumber
=
CONN_AUTH_TYPE_UNSUPPORTED
;
...
...
src/interfaces/odbc/connection.h
浏览文件 @
bca9d0cd
...
...
@@ -94,6 +94,7 @@ typedef enum
#define AUTH_REQ_PASSWORD 3
#define AUTH_REQ_CRYPT 4
#define AUTH_REQ_MD5 5
#define AUTH_REQ_SCM_CREDS 6
/* Startup Packet sizes */
#define SM_DATABASE 64
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录