Remove SO_PASSCRED step in ident_unix --- according to Helge Bahmann,

that call is not needed to prepare for SO_PEERCRED.  Also, simplify code
so that #ifdef SO_PEERCRED appears in only one place, to make it easier
to support other platforms with variants of this capability.

diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index b16571a4542add44f1f13e4191c80e33e6bb0ed5..4846f8fb5f99a077629dea33c0691c0315f2fa61 100644 (file)
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -10,7 +10,7 @@
  *
  *
  * IDENTIFICATION
- *   $Header: /cvsroot/pgsql/src/backend/libpq/hba.c,v 1.59 2001/08/01 23:52:50 tgl Exp $
+ *   $Header: /cvsroot/pgsql/src/backend/libpq/hba.c,v 1.60 2001/08/02 14:27:40 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -290,26 +290,11 @@ parse_hba(List *line, hbaPort *port, bool *found_p, bool *error_p)
            goto hba_syntax;
 
        /*
-        * Disallow auth methods that need AF_INET sockets to work.
-        * Allow "ident" if we can get the identity of the connection
-        * peer on Unix domain sockets from the OS.
+        * Disallow auth methods that always need AF_INET sockets to work.
         */
        if (port->auth_method == uaKrb4 ||
            port->auth_method == uaKrb5)
            goto hba_syntax;
-#ifndef SO_PEERCRED
-       if (port->auth_method == uaIdent)
-       {
-           /* Give a special error message for this case... */
-           snprintf(PQerrormsg, PQERRORMSG_LENGTH,
-                    "parse_hba: \"ident\" auth is not supported on local connections on this platform\n");
-           fputs(PQerrormsg, stderr);
-           pqdebug("%s", PQerrormsg);
-
-           *error_p = true;
-           return;
-       }
-#endif
 
        /*
         * If this record doesn't match the parameters of the connection
@@ -326,10 +311,10 @@ parse_hba(List *line, hbaPort *port, bool *found_p, bool *error_p)
    {
        struct in_addr file_ip_addr, mask;
 
-#ifdef USE_SSL
-       /* If SSL, then check that we are on SSL */
        if (strcmp(token, "hostssl") == 0)
        {
+#ifdef USE_SSL
+           /* Record does not match if we are not on an SSL connection */
            if (!port->ssl)
                return;
 
@@ -337,12 +322,11 @@ parse_hba(List *line, hbaPort *port, bool *found_p, bool *error_p)
            /* Or a client certificate */
 
            /* Since we were on SSL, proceed as with normal 'host' mode */
-       }
 #else
-       /* If not SSL, we don't support this */
-       if (strcmp(token, "hostssl") == 0)
+           /* We don't accept this keyword at all if no SSL support */
            goto hba_syntax;
 #endif
+       }
 
        /* Get the database. */
        line = lnext(line);
@@ -866,8 +850,6 @@ ident_inet(const struct in_addr remote_ip_addr,
    return ident_return;
 }
 
-#ifdef SO_PEERCRED
-
 /*
  *  Ask kernel about the credentials of the connecting process and
  *  determine the symbolic name of the corresponding user.
@@ -878,26 +860,12 @@ ident_inet(const struct in_addr remote_ip_addr,
 static bool
 ident_unix(int sock, char *ident_user)
 {
+#ifdef SO_PEERCRED
+   /* Linux style: use getsockopt(SO_PEERCRED) */
    struct ucred    peercred;
    socklen_t       so_len;
    struct passwd *pass;
 
-#ifdef SO_PASSCRED
-   int passcred = -1;
-
-   so_len = sizeof(passcred);
-   if (setsockopt(sock, SOL_SOCKET, SO_PASSCRED, &passcred, so_len) != 0)
-   {
-       /* We could not set the socket to pass credentials */
-       snprintf(PQerrormsg, PQERRORMSG_LENGTH,
-                "Could not set the UNIX socket to pass credentials: %s\n",
-                strerror(errno));
-       fputs(PQerrormsg, stderr);
-       pqdebug("%s", PQerrormsg);
-       return false;
-   }
-#endif /* SO_PASSCRED */
-
    errno = 0;
    so_len = sizeof(peercred);
    if (getsockopt(sock, SOL_SOCKET, SO_PEERCRED, &peercred, &so_len) != 0 ||
@@ -928,9 +896,17 @@ ident_unix(int sock, char *ident_user)
    StrNCpy(ident_user, pass->pw_name, IDENT_USERNAME_MAX);
 
    return true;
-}
+
+#else /* not SO_PEERCRED */
+
+   snprintf(PQerrormsg, PQERRORMSG_LENGTH,
+            "IDENT auth is not supported on local connections on this platform\n");
+   fputs(PQerrormsg, stderr);
+   pqdebug("%s", PQerrormsg);
+   return false;
 
 #endif /* SO_PEERCRED */
+}
 
 /*
  *  Determine the username of the initiator of the connection described
@@ -954,12 +930,10 @@ authident(hbaPort *port)
                            port->laddr.in.sin_port, ident_user))
                return STATUS_ERROR;
            break;
-#ifdef SO_PEERCRED
        case AF_UNIX:
            if (!ident_unix(port->sock, ident_user))
                return STATUS_ERROR;
            break;
-#endif
        default:
            return STATUS_ERROR;
    }