Skip to content

Commit 7c544ec

Browse files
peterepetere
committed
Fix RADIUS error reporting in hba file parsing
The RADIUS-related checks in parse_hba_line() did not respect elevel and did not fill in *err_msg. Also, verify_option_list_length() pasted together error messages in an untranslatable way. To fix the latter, remove the function and do the error checking inline. It's a bit more verbose but only minimally longer, and it makes fixing the first two issues straightforward. Reviewed-by: Magnus Hagander <magnus@hagander.net> Discussion: https://www.postgresql.org/message-id/flat/8381e425-8c23-99b3-15ec-3115001db1b2%40enterprisedb.com
1 parent 6ee41a3 commit 7c544ec

File tree

1 file changed

+48
-42
lines changed

1 file changed

+48
-42
lines changed

‎src/backend/libpq/hba.c

+48-42
Original file line numberDiff line numberDiff line change
@@ -144,8 +144,6 @@ static List *tokenize_inc_file(List *tokens, const char *outer_filename,
144144
const char *inc_filename, int elevel, char **err_msg);
145145
static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
146146
int elevel, char **err_msg);
147-
static bool verify_option_list_length(List *options, const char *optionname,
148-
List *comparelist, const char *comparename, int line_num);
149147
static ArrayType *gethba_options(HbaLine *hba);
150148
static void fill_hba_line(Tuplestorestate *tuple_store, TupleDesc tupdesc,
151149
int lineno, HbaLine *hba, const char *err_msg);
@@ -1607,21 +1605,23 @@ parse_hba_line(TokenizedLine *tok_line, int elevel)
16071605

16081606
if (list_length(parsedline->radiusservers) < 1)
16091607
{
1610-
ereport(LOG,
1608+
ereport(elevel,
16111609
(errcode(ERRCODE_CONFIG_FILE_ERROR),
16121610
errmsg("list of RADIUS servers cannot be empty"),
16131611
errcontext("line %d of configuration file \"%s\"",
16141612
line_num, HbaFileName)));
1613+
*err_msg = "list of RADIUS servers cannot be empty";
16151614
return NULL;
16161615
}
16171616

16181617
if (list_length(parsedline->radiussecrets) < 1)
16191618
{
1620-
ereport(LOG,
1619+
ereport(elevel,
16211620
(errcode(ERRCODE_CONFIG_FILE_ERROR),
16221621
errmsg("list of RADIUS secrets cannot be empty"),
16231622
errcontext("line %d of configuration file \"%s\"",
16241623
line_num, HbaFileName)));
1624+
*err_msg = "list of RADIUS secrets cannot be empty";
16251625
return NULL;
16261626
}
16271627

@@ -1630,24 +1630,53 @@ parse_hba_line(TokenizedLine *tok_line, int elevel)
16301630
* but that's already checked above), 1 (use the same value
16311631
* everywhere) or the same as the number of servers.
16321632
*/
1633-
if (!verify_option_list_length(parsedline->radiussecrets,
1634-
"RADIUS secrets",
1635-
parsedline->radiusservers,
1636-
"RADIUS servers",
1637-
line_num))
1633+
if (!(list_length(parsedline->radiussecrets) == 1 ||
1634+
list_length(parsedline->radiussecrets) == list_length(parsedline->radiusservers)))
1635+
{
1636+
ereport(elevel,
1637+
(errcode(ERRCODE_CONFIG_FILE_ERROR),
1638+
errmsg("the number of RADIUS secrets (%d) must be 1 or the same as the number of RADIUS servers (%d)",
1639+
list_length(parsedline->radiussecrets),
1640+
list_length(parsedline->radiusservers)),
1641+
errcontext("line %d of configuration file \"%s\"",
1642+
line_num, HbaFileName)));
1643+
*err_msg = psprintf("the number of RADIUS secrets (%d) must be 1 or the same as the number of RADIUS servers (%d)",
1644+
list_length(parsedline->radiussecrets),
1645+
list_length(parsedline->radiusservers));
16381646
return NULL;
1639-
if (!verify_option_list_length(parsedline->radiusports,
1640-
"RADIUS ports",
1641-
parsedline->radiusservers,
1642-
"RADIUS servers",
1643-
line_num))
1647+
}
1648+
if (!(list_length(parsedline->radiusports) == 0 ||
1649+
list_length(parsedline->radiusports) == 1 ||
1650+
list_length(parsedline->radiusports) == list_length(parsedline->radiusservers)))
1651+
{
1652+
ereport(elevel,
1653+
(errcode(ERRCODE_CONFIG_FILE_ERROR),
1654+
errmsg("the number of RADIUS ports (%d) must be 1 or the same as the number of RADIUS servers (%d)",
1655+
list_length(parsedline->radiusports),
1656+
list_length(parsedline->radiusservers)),
1657+
errcontext("line %d of configuration file \"%s\"",
1658+
line_num, HbaFileName)));
1659+
*err_msg = psprintf("the number of RADIUS ports (%d) must be 1 or the same as the number of RADIUS servers (%d)",
1660+
list_length(parsedline->radiusports),
1661+
list_length(parsedline->radiusservers));
16441662
return NULL;
1645-
if (!verify_option_list_length(parsedline->radiusidentifiers,
1646-
"RADIUS identifiers",
1647-
parsedline->radiusservers,
1648-
"RADIUS servers",
1649-
line_num))
1663+
}
1664+
if (!(list_length(parsedline->radiusidentifiers) == 0 ||
1665+
list_length(parsedline->radiusidentifiers) == 1 ||
1666+
list_length(parsedline->radiusidentifiers) == list_length(parsedline->radiusservers)))
1667+
{
1668+
ereport(elevel,
1669+
(errcode(ERRCODE_CONFIG_FILE_ERROR),
1670+
errmsg("the number of RADIUS identifiers (%d) must be 1 or the same as the number of RADIUS servers (%d)",
1671+
list_length(parsedline->radiusidentifiers),
1672+
list_length(parsedline->radiusservers)),
1673+
errcontext("line %d of configuration file \"%s\"",
1674+
line_num, HbaFileName)));
1675+
*err_msg = psprintf("the number of RADIUS identifiers (%d) must be 1 or the same as the number of RADIUS servers (%d)",
1676+
list_length(parsedline->radiusidentifiers),
1677+
list_length(parsedline->radiusservers));
16501678
return NULL;
1679+
}
16511680
}
16521681

16531682
/*
@@ -1662,29 +1691,6 @@ parse_hba_line(TokenizedLine *tok_line, int elevel)
16621691
}
16631692

16641693

1665-
static bool
1666-
verify_option_list_length(List *options, const char *optionname,
1667-
List *comparelist, const char *comparename,
1668-
int line_num)
1669-
{
1670-
if (list_length(options) == 0 ||
1671-
list_length(options) == 1 ||
1672-
list_length(options) == list_length(comparelist))
1673-
return true;
1674-
1675-
ereport(LOG,
1676-
(errcode(ERRCODE_CONFIG_FILE_ERROR),
1677-
errmsg("the number of %s (%d) must be 1 or the same as the number of %s (%d)",
1678-
optionname,
1679-
list_length(options),
1680-
comparename,
1681-
list_length(comparelist)
1682-
),
1683-
errcontext("line %d of configuration file \"%s\"",
1684-
line_num, HbaFileName)));
1685-
return false;
1686-
}
1687-
16881694
/*
16891695
* Parse one name-value pair as an authentication option into the given
16901696
* HbaLine. Return true if we successfully parse the option, false if we

0 commit comments

Comments
 (0)