← Back to branch summary

~ubuntu-branches/ubuntu/lucid/postgresql-8.4/lucid-proposed

« back to all changes in this revision

Viewing changes to src/backend/libpq/hba.c

  • Committer: Bazaar Package Importer
  • Author(s): Martin Pitt
  • Date: 2009-07-11 16:59:35 UTC
  • mfrom: (5.1.1 karmic)
  • Revision ID: james.westby@ubuntu.com-20090711165935-jfwin6gfrxf0gfsi
Tags: 8.4.0-2
http://bugs.debian.org/536139
* debian/libpq-dev.install: Ship catalog/genbki.h. (Closes: #536139)
* debian/rules: Drop --enable-cassert for final release.

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/backend/libpq/hba.c
10
10
 *
11
11
 *
12
12
 * IDENTIFICATION
13
 
 *        $PostgreSQL: pgsql/src/backend/libpq/hba.c,v 1.185 2009/04/15 21:42:50 alvherre Exp $
 
13
 *        $PostgreSQL: pgsql/src/backend/libpq/hba.c,v 1.188 2009/06/24 13:39:42 mha Exp $
14
14
 *
15
15
 *-------------------------------------------------------------------------
16
16
 */
568
568
/*
569
569
 * Macros used to check and report on invalid configuration options.
570
570
 * INVALID_AUTH_OPTION = reports when an option is specified for a method where it's
571
 
 *                       not supported.
 
571
 *                                               not supported.
572
572
 * REQUIRE_AUTH_OPTION = same as INVALID_AUTH_OPTION, except it also checks if the
573
 
 *                       method is actually the one specified. Used as a shortcut when
574
 
 *                       the option is only valid for one authentication method.
 
573
 *                                               method is actually the one specified. Used as a shortcut when
 
574
 *                                               the option is only valid for one authentication method.
575
575
 * MANDATORY_AUTH_ARG  = check if a required option is set for an authentication method,
576
 
 *                       reporting error if it's not.
 
576
 *                                               reporting error if it's not.
577
577
 */
578
578
#define INVALID_AUTH_OPTION(optname, validmethods) do {\
579
579
        ereport(LOG, \
642
642
                        ereport(LOG,
643
643
                                        (errcode(ERRCODE_CONFIG_FILE_ERROR),
644
644
                                         errmsg("hostssl not supported on this platform"),
645
 
                                         errhint("compile with --enable-ssl to use SSL connections"),
 
645
                                 errhint("compile with --enable-ssl to use SSL connections"),
646
646
                                         errcontext("line %d of configuration file \"%s\"",
647
 
                                                        line_num, HbaFileName)));
 
647
                                                                line_num, HbaFileName)));
648
648
                        return false;
649
649
#endif
650
650
                }
654
654
                        parsedline->conntype = ctHostNoSSL;
655
655
                }
656
656
#endif
657
 
                else 
 
657
                else
658
658
                {
659
659
                        /* "host", or "hostnossl" and SSL support not built in */
660
660
                        parsedline->conntype = ctHost;
661
661
                }
662
 
        } /* record type */
 
662
        }                                                       /* record type */
663
663
        else
664
664
        {
665
665
                ereport(LOG,
667
667
                                 errmsg("invalid connection type \"%s\"",
668
668
                                                token),
669
669
                                 errcontext("line %d of configuration file \"%s\"",
670
 
                                                line_num, HbaFileName)));
 
670
                                                        line_num, HbaFileName)));
671
671
                return false;
672
672
        }
673
673
 
679
679
                                (errcode(ERRCODE_CONFIG_FILE_ERROR),
680
680
                                 errmsg("end-of-line before database specification"),
681
681
                                 errcontext("line %d of configuration file \"%s\"",
682
 
                                                line_num, HbaFileName)));
 
682
                                                        line_num, HbaFileName)));
683
683
                return false;
684
684
        }
685
685
        parsedline->database = pstrdup(lfirst(line_item));
692
692
                                (errcode(ERRCODE_CONFIG_FILE_ERROR),
693
693
                                 errmsg("end-of-line before role specification"),
694
694
                                 errcontext("line %d of configuration file \"%s\"",
695
 
                                                line_num, HbaFileName)));
 
695
                                                        line_num, HbaFileName)));
696
696
                return false;
697
697
        }
698
698
        parsedline->role = pstrdup(lfirst(line_item));
705
705
                {
706
706
                        ereport(LOG,
707
707
                                        (errcode(ERRCODE_CONFIG_FILE_ERROR),
708
 
                                         errmsg("end-of-line before ip address specification"),
 
708
                                         errmsg("end-of-line before IP address specification"),
709
709
                                         errcontext("line %d of configuration file \"%s\"",
710
 
                                                        line_num, HbaFileName)));
 
710
                                                                line_num, HbaFileName)));
711
711
                        return false;
712
712
                }
713
713
                token = pstrdup(lfirst(line_item));
735
735
                                         errmsg("invalid IP address \"%s\": %s",
736
736
                                                        token, gai_strerror(ret)),
737
737
                                         errcontext("line %d of configuration file \"%s\"",
738
 
                                                        line_num, HbaFileName)));
 
738
                                                                line_num, HbaFileName)));
739
739
                        if (cidr_slash)
740
740
                                *cidr_slash = '/';
741
741
                        if (gai_result)
760
760
                                                 errmsg("invalid CIDR mask in address \"%s\"",
761
761
                                                                token),
762
762
                                                 errcontext("line %d of configuration file \"%s\"",
763
 
                                                        line_num, HbaFileName)));
 
763
                                                                        line_num, HbaFileName)));
764
764
                                return false;
765
765
                        }
766
766
                }
774
774
                                                (errcode(ERRCODE_CONFIG_FILE_ERROR),
775
775
                                                 errmsg("end-of-line before netmask specification"),
776
776
                                                 errcontext("line %d of configuration file \"%s\"",
777
 
                                                                line_num, HbaFileName)));
 
777
                                                                        line_num, HbaFileName)));
778
778
                                return false;
779
779
                        }
780
780
                        token = lfirst(line_item);
787
787
                                                 errmsg("invalid IP mask \"%s\": %s",
788
788
                                                                token, gai_strerror(ret)),
789
789
                                                 errcontext("line %d of configuration file \"%s\"",
790
 
                                                        line_num, HbaFileName)));
 
790
                                                                        line_num, HbaFileName)));
791
791
                                if (gai_result)
792
792
                                        pg_freeaddrinfo_all(hints.ai_family, gai_result);
793
793
                                return false;
805
805
                                return false;
806
806
                        }
807
807
                }
808
 
        } /* != ctLocal */
 
808
        }                                                       /* != ctLocal */
809
809
 
810
810
        /* Get the authentication method */
811
811
        line_item = lnext(line_item);
815
815
                                (errcode(ERRCODE_CONFIG_FILE_ERROR),
816
816
                                 errmsg("end-of-line before authentication method"),
817
817
                                 errcontext("line %d of configuration file \"%s\"",
818
 
                                                line_num, HbaFileName)));
 
818
                                                        line_num, HbaFileName)));
819
819
                return false;
820
820
        }
821
821
        token = lfirst(line_item);
883
883
                                 errmsg("invalid authentication method \"%s\"",
884
884
                                                token),
885
885
                                 errcontext("line %d of configuration file \"%s\"",
886
 
                                                line_num, HbaFileName)));
 
886
                                                        line_num, HbaFileName)));
887
887
                return false;
888
888
        }
889
889
 
894
894
                                 errmsg("invalid authentication method \"%s\": not supported on this platform",
895
895
                                                token),
896
896
                                 errcontext("line %d of configuration file \"%s\"",
897
 
                                                line_num, HbaFileName)));
 
897
                                                        line_num, HbaFileName)));
898
898
                return false;
899
899
        }
900
900
 
904
904
        {
905
905
                ereport(LOG,
906
906
                                (errcode(ERRCODE_CONFIG_FILE_ERROR),
907
 
                                 errmsg("krb5 authentication is not supported on local sockets"),
 
907
                         errmsg("krb5 authentication is not supported on local sockets"),
908
908
                                 errcontext("line %d of configuration file \"%s\"",
909
 
                                                line_num, HbaFileName)));
 
909
                                                        line_num, HbaFileName)));
910
910
                return false;
911
911
        }
912
912
 
924
924
        /* Parse remaining arguments */
925
925
        while ((line_item = lnext(line_item)) != NULL)
926
926
        {
927
 
                char *c;
 
927
                char       *c;
928
928
 
929
929
                token = lfirst(line_item);
930
930
 
945
945
                }
946
946
                else
947
947
                {
948
 
                        *c++ = '\0'; /* token now holds "name", c holds "value" */
 
948
                        *c++ = '\0';            /* token now holds "name", c holds "value" */
949
949
                        if (strcmp(token, "map") == 0)
950
950
                        {
951
951
                                if (parsedline->auth_method != uaIdent &&
959
959
                        else if (strcmp(token, "clientcert") == 0)
960
960
                        {
961
961
                                /*
962
 
                                 * Since we require ctHostSSL, this really can never happen on non-SSL-enabled
963
 
                                 * builds, so don't bother checking for USE_SSL.
 
962
                                 * Since we require ctHostSSL, this really can never happen on
 
963
                                 * non-SSL-enabled builds, so don't bother checking for
 
964
                                 * USE_SSL.
964
965
                                 */
965
966
                                if (parsedline->conntype != ctHostSSL)
966
967
                                {
967
968
                                        ereport(LOG,
968
969
                                                        (errcode(ERRCODE_CONFIG_FILE_ERROR),
969
970
                                                         errmsg("clientcert can only be configured for \"hostssl\" rows"),
970
 
                                                         errcontext("line %d of configuration file \"%s\"",
971
 
                                                                                line_num, HbaFileName)));
 
971
                                                   errcontext("line %d of configuration file \"%s\"",
 
972
                                                                          line_num, HbaFileName)));
972
973
                                        return false;
973
974
                                }
974
975
                                if (strcmp(c, "1") == 0)
979
980
                                                                (errcode(ERRCODE_CONFIG_FILE_ERROR),
980
981
                                                                 errmsg("client certificates can only be checked if a root certificate store is available"),
981
982
                                                                 errdetail("make sure the root certificate store is present and readable"),
982
 
                                                                 errcontext("line %d of configuration file \"%s\"",
983
 
                                                                                        line_num, HbaFileName)));
 
983
                                                   errcontext("line %d of configuration file \"%s\"",
 
984
                                                                          line_num, HbaFileName)));
984
985
                                                return false;
985
986
                                        }
986
987
                                        parsedline->clientcert = true;
992
993
                                                ereport(LOG,
993
994
                                                                (errcode(ERRCODE_CONFIG_FILE_ERROR),
994
995
                                                                 errmsg("clientcert can not be set to 0 when using \"cert\" authentication"),
995
 
                                                                 errcontext("line %d of configuration file \"%s\"",
996
 
                                                                                        line_num, HbaFileName)));
 
996
                                                   errcontext("line %d of configuration file \"%s\"",
 
997
                                                                          line_num, HbaFileName)));
997
998
                                                return false;
998
999
                                        }
999
1000
                                        parsedline->clientcert = false;
1026
1027
                                        ereport(LOG,
1027
1028
                                                        (errcode(ERRCODE_CONFIG_FILE_ERROR),
1028
1029
                                                         errmsg("invalid LDAP port number: \"%s\"", c),
1029
 
                                                         errcontext("line %d of configuration file \"%s\"",
1030
 
                                                                                line_num, HbaFileName)));
 
1030
                                                   errcontext("line %d of configuration file \"%s\"",
 
1031
                                                                          line_num, HbaFileName)));
1031
1032
                                        return false;
1032
1033
                                }
1033
1034
                        }
1069
1070
                        {
1070
1071
                                ereport(LOG,
1071
1072
                                                (errcode(ERRCODE_CONFIG_FILE_ERROR),
1072
 
                                                 errmsg("unknown authentication option name: \"%s\"", token),
 
1073
                                 errmsg("unknown authentication option name: \"%s\"", token),
1073
1074
                                                 errcontext("line %d of configuration file \"%s\"",
1074
1075
                                                                        line_num, HbaFileName)));
1075
1076
                                return false;
1078
1079
        }
1079
1080
 
1080
1081
        /*
1081
 
         * Check if the selected authentication method has any mandatory arguments that
1082
 
         * are not set.
 
1082
         * Check if the selected authentication method has any mandatory arguments
 
1083
         * that are not set.
1083
1084
         */
1084
1085
        if (parsedline->auth_method == uaLDAP)
1085
1086
        {
1093
1094
        {
1094
1095
                parsedline->clientcert = true;
1095
1096
        }
1096
 
        
 
1097
 
1097
1098
        return true;
1098
1099
}
1099
1100
 
1106
1107
check_hba(hbaPort *port)
1107
1108
{
1108
1109
        ListCell   *line;
1109
 
        HbaLine    *hba;
 
1110
        HbaLine    *hba;
1110
1111
 
1111
1112
        foreach(line, parsed_hba_lines)
1112
1113
        {
1150
1151
                                        continue;
1151
1152
                        }
1152
1153
#ifdef HAVE_IPV6
1153
 
                        else  if (hba->addr.ss_family == AF_INET &&
1154
 
                                          port->raddr.addr.ss_family == AF_INET6)
 
1154
                        else if (hba->addr.ss_family == AF_INET &&
 
1155
                                         port->raddr.addr.ss_family == AF_INET6)
1155
1156
                        {
1156
1157
                                /*
1157
 
                                 * Wrong address family.  We allow only one case: if the file has
1158
 
                                 * IPv4 and the port is IPv6, promote the file address to IPv6 and
1159
 
                                 * try to match that way.
 
1158
                                 * Wrong address family.  We allow only one case: if the file
 
1159
                                 * has IPv4 and the port is IPv6, promote the file address to
 
1160
                                 * IPv6 and try to match that way.
1160
1161
                                 */
1161
 
                                struct sockaddr_storage addrcopy, maskcopy;
 
1162
                                struct sockaddr_storage addrcopy,
 
1163
                                                        maskcopy;
 
1164
 
1162
1165
                                memcpy(&addrcopy, &hba->addr, sizeof(addrcopy));
1163
1166
                                memcpy(&maskcopy, &hba->mask, sizeof(maskcopy));
1164
1167
                                pg_promote_v4_to_v6_addr(&addrcopy);
1165
1168
                                pg_promote_v4_to_v6_mask(&maskcopy);
1166
 
                                
 
1169
 
1167
1170
                                if (!pg_range_sockaddr(&port->raddr.addr, &addrcopy, &maskcopy))
1168
1171
                                        continue;
1169
1172
                        }
1170
 
#endif /* HAVE_IPV6 */
 
1173
#endif   /* HAVE_IPV6 */
1171
1174
                        else
1172
1175
                                /* Wrong address family, no IPV6 */
1173
1176
                                continue;
1174
 
                } /* != ctLocal */
 
1177
                }                                               /* != ctLocal */
1175
1178
 
1176
1179
                /* Check database and role */
1177
1180
                if (!check_db(port->database_name, port->user_name, hba->database))
1191
1194
        port->hba = hba;
1192
1195
        return true;
1193
1196
 
1194
 
        /* XXX:
1195
 
         * Return false only happens if we have a parsing error, which we can 
 
1197
        /*
 
1198
         * XXX: Return false only happens if we have a parsing error, which we can
1196
1199
         * no longer have (parsing now in postmaster). Consider changing API.
1197
1200
         */
1198
1201
}
1279
1282
static void
1280
1283
clean_hba_list(List *lines)
1281
1284
{
1282
 
        ListCell        *line;
 
1285
        ListCell   *line;
1283
1286
 
1284
1287
        foreach(line, lines)
1285
1288
        {
1286
 
                HbaLine *parsed = (HbaLine *)lfirst(line);
 
1289
                HbaLine    *parsed = (HbaLine *) lfirst(line);
 
1290
 
1287
1291
                if (parsed)
1288
1292
                        free_hba_record(parsed);
1289
1293
        }
1301
1305
load_hba(void)
1302
1306
{
1303
1307
        FILE       *file;
1304
 
        List *hba_lines = NIL;
1305
 
        List *hba_line_nums = NIL;
1306
 
        ListCell   *line, *line_num;
1307
 
        List *new_parsed_lines = NIL;
1308
 
        bool ok = true;
 
1308
        List       *hba_lines = NIL;
 
1309
        List       *hba_line_nums = NIL;
 
1310
        ListCell   *line,
 
1311
                           *line_num;
 
1312
        List       *new_parsed_lines = NIL;
 
1313
        bool            ok = true;
1309
1314
 
1310
1315
        file = AllocateFile(HbaFileName, "r");
1311
1316
        if (file == NULL)
1314
1319
                                (errcode_for_file_access(),
1315
1320
                                 errmsg("could not open configuration file \"%s\": %m",
1316
1321
                                                HbaFileName)));
 
1322
 
1317
1323
                /*
1318
1324
                 * Caller will take care of making this a FATAL error in case this is
1319
 
                 * the initial startup. If it happens on reload, we just keep the
1320
 
                 * old version around.
 
1325
                 * the initial startup. If it happens on reload, we just keep the old
 
1326
                 * version around.
1321
1327
                 */
1322
1328
                return false;
1323
1329
        }
1328
1334
        /* Now parse all the lines */
1329
1335
        forboth(line, hba_lines, line_num, hba_line_nums)
1330
1336
        {
1331
 
                HbaLine *newline;
 
1337
                HbaLine    *newline;
1332
1338
 
1333
1339
                newline = palloc0(sizeof(HbaLine));
1334
1340
 
1339
1345
                        pfree(newline);
1340
1346
 
1341
1347
                        /*
1342
 
                         * Keep parsing the rest of the file so we can report errors
1343
 
                         * on more than the first row. Error has already been reported
1344
 
                         * in the parsing function, so no need to log it here.
 
1348
                         * Keep parsing the rest of the file so we can report errors on
 
1349
                         * more than the first row. Error has already been reported in the
 
1350
                         * parsing function, so no need to log it here.
1345
1351
                         */
1346
1352
                        ok = false;
1347
1353
                        continue;
1461
1467
        if (file_ident_user[0] == '/')
1462
1468
        {
1463
1469
                /*
1464
 
                 * When system username starts with a slash, treat it as a regular expression.
1465
 
                 * In this case, we process the system username as a regular expression that
1466
 
                 * returns exactly one match. This is replaced for \1 in the database username
1467
 
                 * string, if present.
 
1470
                 * When system username starts with a slash, treat it as a regular
 
1471
                 * expression. In this case, we process the system username as a
 
1472
                 * regular expression that returns exactly one match. This is replaced
 
1473
                 * for \1 in the database username string, if present.
1468
1474
                 */
1469
1475
                int                     r;
1470
1476
                regex_t         re;
1474
1480
                char       *ofs;
1475
1481
                char       *regexp_pgrole;
1476
1482
 
1477
 
                wstr = palloc((strlen(file_ident_user+1) + 1) * sizeof(pg_wchar));
1478
 
                wlen = pg_mb2wchar_with_len(file_ident_user+1, wstr, strlen(file_ident_user+1));
 
1483
                wstr = palloc((strlen(file_ident_user + 1) + 1) * sizeof(pg_wchar));
 
1484
                wlen = pg_mb2wchar_with_len(file_ident_user + 1, wstr, strlen(file_ident_user + 1));
1479
1485
 
1480
1486
                /*
1481
 
                 * XXX: Major room for optimization: regexps could be compiled when the file is loaded
1482
 
                 * and then re-used in every connection.
 
1487
                 * XXX: Major room for optimization: regexps could be compiled when
 
1488
                 * the file is loaded and then re-used in every connection.
1483
1489
                 */
1484
1490
                r = pg_regcomp(&re, wstr, wlen, REG_ADVANCED);
1485
1491
                if (r)
1486
1492
                {
1487
 
                        char errstr[100];
 
1493
                        char            errstr[100];
1488
1494
 
1489
1495
                        pg_regerror(r, &re, errstr, sizeof(errstr));
1490
 
                        ereport(ERROR,
 
1496
                        ereport(LOG,
1491
1497
                                        (errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
1492
 
                                         errmsg("invalid regular expression \"%s\": %s", file_ident_user+1, errstr)));
 
1498
                                         errmsg("invalid regular expression \"%s\": %s", file_ident_user + 1, errstr)));
1493
1499
 
1494
1500
                        pfree(wstr);
1495
1501
                        *error_p = true;
1500
1506
                wstr = palloc((strlen(ident_user) + 1) * sizeof(pg_wchar));
1501
1507
                wlen = pg_mb2wchar_with_len(ident_user, wstr, strlen(ident_user));
1502
1508
 
1503
 
                r = pg_regexec(&re, wstr, wlen, 0, NULL, 2, matches,0);
 
1509
                r = pg_regexec(&re, wstr, wlen, 0, NULL, 2, matches, 0);
1504
1510
                if (r)
1505
1511
                {
1506
 
                        char errstr[100];
 
1512
                        char            errstr[100];
1507
1513
 
1508
1514
                        if (r != REG_NOMATCH)
1509
1515
                        {
1510
1516
                                /* REG_NOMATCH is not an error, everything else is */
1511
1517
                                pg_regerror(r, &re, errstr, sizeof(errstr));
1512
 
                                ereport(ERROR,
 
1518
                                ereport(LOG,
1513
1519
                                                (errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
1514
 
                                                 errmsg("regular expression match for \"%s\" failed: %s", file_ident_user+1, errstr)));
 
1520
                                                 errmsg("regular expression match for \"%s\" failed: %s", file_ident_user + 1, errstr)));
1515
1521
                                *error_p = true;
1516
1522
                        }
1517
1523
 
1525
1531
                {
1526
1532
                        /* substitution of the first argument requested */
1527
1533
                        if (matches[1].rm_so < 0)
1528
 
                                ereport(ERROR,
 
1534
                        {
 
1535
                                ereport(LOG,
1529
1536
                                                (errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
1530
1537
                                                 errmsg("regular expression \"%s\" has no subexpressions as requested by backreference in \"%s\"",
1531
 
                                                                file_ident_user+1, file_pgrole)));
1532
 
                        /* length: original length minus length of \1 plus length of match plus null terminator */
1533
 
                        regexp_pgrole = palloc0(strlen(file_pgrole) - 2 + (matches[1].rm_eo-matches[1].rm_so) + 1);
1534
 
                        strncpy(regexp_pgrole, file_pgrole, (ofs-file_pgrole));
1535
 
                        memcpy(regexp_pgrole+strlen(regexp_pgrole),
1536
 
                                   ident_user+matches[1].rm_so,
1537
 
                                   matches[1].rm_eo-matches[1].rm_so);
1538
 
                        strcat(regexp_pgrole, ofs+2);
 
1538
                                                                file_ident_user + 1, file_pgrole)));
 
1539
                                pg_regfree(&re);
 
1540
                                *error_p = true;
 
1541
                                return;
 
1542
                        }
 
1543
 
 
1544
                        /*
 
1545
                         * length: original length minus length of \1 plus length of match
 
1546
                         * plus null terminator
 
1547
                         */
 
1548
                        regexp_pgrole = palloc0(strlen(file_pgrole) - 2 + (matches[1].rm_eo - matches[1].rm_so) + 1);
 
1549
                        strncpy(regexp_pgrole, file_pgrole, (ofs - file_pgrole));
 
1550
                        memcpy(regexp_pgrole + strlen(regexp_pgrole),
 
1551
                                   ident_user + matches[1].rm_so,
 
1552
                                   matches[1].rm_eo - matches[1].rm_so);
 
1553
                        strcat(regexp_pgrole, ofs + 2);
1539
1554
                }
1540
1555
                else
1541
1556
                {
1545
1560
 
1546
1561
                pg_regfree(&re);
1547
1562
 
1548
 
                /* now check if the username actually matched what the user is trying to connect as */
 
1563
                /*
 
1564
                 * now check if the username actually matched what the user is trying
 
1565
                 * to connect as
 
1566
                 */
1549
1567
                if (case_insensitive)
1550
1568
                {
1551
1569
                        if (pg_strcasecmp(regexp_pgrole, pg_role) == 0)
1594
1612
 *      See if the user with ident username "ident_user" is allowed to act
1595
1613
 *      as Postgres user "pgrole" according to usermap "usermap_name".
1596
1614
 *
1597
 
 *  Special case: Usermap NULL, equivalent to what was previously called
1598
 
 *  "sameuser" or "samerole", don't look in the usermap
 
1615
 *      Special case: Usermap NULL, equivalent to what was previously called
 
1616
 *      "sameuser" or "samerole", don't look in the usermap
1599
1617
 *      file.  That's an implied map where "pgrole" must be identical to
1600
1618
 *      "ident_user" in order to be authorized.
1601
1619
 *
1603
1621
 */
1604
1622
int
1605
1623
check_usermap(const char *usermap_name,
1606
 
                                        const char *pg_role,
1607
 
                                        const char *auth_user,
1608
 
                                        bool case_insensitive)
 
1624
                          const char *pg_role,
 
1625
                          const char *auth_user,
 
1626
                          bool case_insensitive)
1609
1627
{
1610
1628
        bool            found_entry = false,
1611
1629
                                error = false;
1617
1635
                        if (pg_strcasecmp(pg_role, auth_user) == 0)
1618
1636
                                return STATUS_OK;
1619
1637
                }
1620
 
                else {
 
1638
                else
 
1639
                {
1621
1640
                        if (strcmp(pg_role, auth_user) == 0)
1622
1641
                                return STATUS_OK;
1623
1642
                }
1634
1653
                forboth(line_cell, ident_lines, num_cell, ident_line_nums)
1635
1654
                {
1636
1655
                        parse_ident_usermap(lfirst(line_cell), lfirst_int(num_cell),
1637
 
                                                                usermap_name, pg_role, auth_user, case_insensitive,
 
1656
                                                  usermap_name, pg_role, auth_user, case_insensitive,
1638
1657
                                                                &found_entry, &error);
1639
1658
                        if (found_entry || error)
1640
1659
                                break;
1643
1662
        if (!found_entry && !error)
1644
1663
        {
1645
1664
                ereport(LOG,
1646
 
                                (errmsg("no match in usermap for user \"%s\" authenticated as \"%s\"",
1647
 
                                                pg_role, auth_user),
1648
 
                                 errcontext("usermap \"%s\"", usermap_name)));
 
1665
                (errmsg("no match in usermap for user \"%s\" authenticated as \"%s\"",
 
1666
                                pg_role, auth_user),
 
1667
                 errcontext("usermap \"%s\"", usermap_name)));
1649
1668
        }
1650
 
        return found_entry?STATUS_OK:STATUS_ERROR;
 
1669
        return found_entry ? STATUS_OK : STATUS_ERROR;
1651
1670
}
1652
1671
 
1653
1672