• Tom Lane's avatar
    Fix assorted issues in client host name lookup. · fc752505
    Tom Lane authored
    The code for matching clients to pg_hba.conf lines that specify host names
    (instead of IP address ranges) failed to complain if reverse DNS lookup
    failed; instead it silently didn't match, so that you might end up getting
    a surprising "no pg_hba.conf entry for ..." error, as seen in bug #9518
    from Mike Blackwell.  Since we don't want to make this a fatal error in
    situations where pg_hba.conf contains a mixture of host names and IP
    addresses (clients matching one of the numeric entries should not have to
    have rDNS data), remember the lookup failure and mention it as DETAIL if
    we get to "no pg_hba.conf entry".  Apply the same approach to forward-DNS
    lookup failures, too, rather than treating them as immediate hard errors.
    
    Along the way, fix a couple of bugs that prevented us from detecting an
    rDNS lookup error reliably, and make sure that we make only one rDNS lookup
    attempt; formerly, if the lookup attempt failed, the code would try again
    for each host name entry in pg_hba.conf.  Since more or less the whole
    point of this design is to ensure there's only one lookup attempt not one
    per entry, the latter point represents a performance bug that seems
    sufficient justification for back-patching.
    
    Also, adjust src/port/getaddrinfo.c so that it plays as well as it can
    with this code.  Which is not all that well, since it does not have actual
    support for rDNS lookup, but at least it should return the expected (and
    required by spec) error codes so that the main code correctly perceives the
    lack of functionality as a lookup failure.  It's unlikely that PG is still
    being used in production on any machines that require our getaddrinfo.c,
    so I'm not excited about working harder than this.
    
    To keep the code in the various branches similar, this includes
    back-patching commits c424d0d1 and
    1997f34d into 9.2 and earlier.
    
    Back-patch to 9.1 where the facility for hostnames in pg_hba.conf was
    introduced.
    fc752505
auth.c 68.8 KB