Commit c5e1df95 authored by Peter Eisentraut's avatar Peter Eisentraut

Remove one use of IDENT_USERNAME_MAX

IDENT_USERNAME_MAX is the maximum length of the information returned
by an ident server, per RFC 1413.  Using it as the buffer size in peer
authentication is inappropriate.  It was done here because of the
historical relationship between peer and ident authentication.  To
reduce confusion between the two authenticaton methods and disentangle
their code, use a dynamically allocated buffer instead.

Discussion: https://www.postgresql.org/message-id/flat/c798fba5-8b71-4f27-c78e-37714037ea31%402ndquadrant.com
parent 5cc1e64f
...@@ -65,7 +65,7 @@ static int CheckSCRAMAuth(Port *port, char *shadow_pass, char **logdetail); ...@@ -65,7 +65,7 @@ static int CheckSCRAMAuth(Port *port, char *shadow_pass, char **logdetail);
* Ident authentication * Ident authentication
*---------------------------------------------------------------- *----------------------------------------------------------------
*/ */
/* Max size of username ident server can return */ /* Max size of username ident server can return (per RFC 1413) */
#define IDENT_USERNAME_MAX 512 #define IDENT_USERNAME_MAX 512
/* Standard TCP port number for Ident service. Assigned by IANA */ /* Standard TCP port number for Ident service. Assigned by IANA */
...@@ -1990,10 +1990,11 @@ ident_inet_done: ...@@ -1990,10 +1990,11 @@ ident_inet_done:
static int static int
auth_peer(hbaPort *port) auth_peer(hbaPort *port)
{ {
char ident_user[IDENT_USERNAME_MAX + 1];
uid_t uid; uid_t uid;
gid_t gid; gid_t gid;
struct passwd *pw; struct passwd *pw;
char *peer_user;
int ret;
if (getpeereid(port->sock, &uid, &gid) != 0) if (getpeereid(port->sock, &uid, &gid) != 0)
{ {
...@@ -2022,9 +2023,14 @@ auth_peer(hbaPort *port) ...@@ -2022,9 +2023,14 @@ auth_peer(hbaPort *port)
return STATUS_ERROR; return STATUS_ERROR;
} }
strlcpy(ident_user, pw->pw_name, IDENT_USERNAME_MAX + 1); /* Make a copy of static getpw*() result area. */
peer_user = pstrdup(pw->pw_name);
return check_usermap(port->hba->usermap, port->user_name, ident_user, false); ret = check_usermap(port->hba->usermap, port->user_name, peer_user, false);
pfree(peer_user);
return ret;
} }
#endif /* HAVE_UNIX_SOCKETS */ #endif /* HAVE_UNIX_SOCKETS */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment