• Tom Lane's avatar
    Replace use of credential control messages with getsockopt(LOCAL_PEERCRED). · be4585b1
    Tom Lane authored
    It turns out the reason we hadn't found out about the portability issues
    with our credential-control-message code is that almost no modern platforms
    use that code at all; the ones that used to need it now offer getpeereid(),
    which we choose first.  The last holdout was NetBSD, and they added
    getpeereid() as of 5.0.  So far as I can tell, the only live platform on
    which that code was being exercised was Debian/kFreeBSD, ie, FreeBSD kernel
    with Linux userland --- since glibc doesn't provide getpeereid(), we fell
    back to the control message code.  However, the FreeBSD kernel provides a
    LOCAL_PEERCRED socket parameter that's functionally equivalent to Linux's
    SO_PEERCRED.  That is both much simpler to use than control messages, and
    superior because it doesn't require receiving a message from the other end
    at just the right time.
    
    Therefore, add code to use LOCAL_PEERCRED when necessary, and rip out all
    the credential-control-message code in the backend.  (libpq still has such
    code so that it can still talk to pre-9.1 servers ... but eventually we can
    get rid of it there too.)  Clean up related autoconf probes, too.
    
    This means that libpq's requirepeer parameter now works on exactly the same
    platforms where the backend supports peer authentication, so adjust the
    documentation accordingly.
    be4585b1
auth.c 74.6 KB