diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2016-04-08 10:45:16 -0400 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2016-04-08 10:48:44 -0400 |
| commit | 2f1d2b7a75fecad25295cb3f453503eb6a176d4f (patch) | |
| tree | 8404aa676cf8aeb71bce8a76c8e554633686b856 /src/backend/libpq/auth.c | |
| parent | 4e55b3f0335c2aa658cd9d1fda4dea2a1f9ab80d (diff) | |
Set PAM_RHOST item for PAM authentication
The PAM_RHOST item is set to the remote IP address or host name and can
be used by PAM modules. A pg_hba.conf option is provided to choose
between IP address and resolved host name.
From: Grzegorz Sampolski <grzsmp@gmail.com>
Reviewed-by: Haribabu Kommi <kommi.haribabu@gmail.com>
Diffstat (limited to 'src/backend/libpq/auth.c')
| -rw-r--r-- | src/backend/libpq/auth.c | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index f21056e2445..630762cc6b9 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -1739,6 +1739,18 @@ CheckPAMAuth(Port *port, char *user, char *password) { int retval; pam_handle_t *pamh = NULL; + char hostinfo[NI_MAXHOST]; + + retval = pg_getnameinfo_all(&port->raddr.addr, port->raddr.salen, + hostinfo, sizeof(hostinfo), NULL, 0, + port->hba->pam_use_hostname ? 0 : NI_NUMERICHOST | NI_NUMERICSERV); + if (retval != 0) + { + ereport(WARNING, + (errmsg_internal("pg_getnameinfo_all() failed: %s", + gai_strerror(retval)))); + return STATUS_ERROR; + } /* * We can't entirely rely on PAM to pass through appdata --- it appears @@ -1784,6 +1796,17 @@ CheckPAMAuth(Port *port, char *user, char *password) return STATUS_ERROR; } + retval = pam_set_item(pamh, PAM_RHOST, hostinfo); + + if (retval != PAM_SUCCESS) + { + ereport(LOG, + (errmsg("pam_set_item(PAM_RHOST) failed: %s", + pam_strerror(pamh, retval)))); + pam_passwd = NULL; + return STATUS_ERROR; + } + retval = pam_set_item(pamh, PAM_CONV, &pam_passw_conv); if (retval != PAM_SUCCESS) |