diff options
Diffstat (limited to 'src/include')
| -rw-r--r-- | src/include/catalog/pg_proc.dat | 6 | ||||
| -rw-r--r-- | src/include/libpq/hba.h | 4 | ||||
| -rw-r--r-- | src/include/libpq/libpq-be.h | 20 | ||||
| -rw-r--r-- | src/include/libpq/libpq.h | 3 | ||||
| -rw-r--r-- | src/include/libpq/pqcomm.h | 5 | ||||
| -rw-r--r-- | src/include/pgstat.h | 24 |
6 files changed, 55 insertions, 7 deletions
diff --git a/src/include/catalog/pg_proc.dat b/src/include/catalog/pg_proc.dat index a7050edca09..fb257c17c89 100644 --- a/src/include/catalog/pg_proc.dat +++ b/src/include/catalog/pg_proc.dat @@ -5117,9 +5117,9 @@ proname => 'pg_stat_get_activity', prorows => '100', proisstrict => 'f', proretset => 't', provolatile => 's', proparallel => 'r', prorettype => 'record', proargtypes => 'int4', - proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,bool,text,numeric,text}', - proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}', - proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,sslcompression,ssl_client_dn,ssl_client_serial,ssl_issuer_dn}', + proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,bool,text,numeric,text,bool,text,bool}', + proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}', + proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,sslcompression,ssl_client_dn,ssl_client_serial,ssl_issuer_dn,gss_auth,gss_princ,gss_enc}', prosrc => 'pg_stat_get_activity' }, { oid => '3318', descr => 'statistics: information about progress of backends running maintenance command', diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h index c65eb9dc8a5..186e4335748 100644 --- a/src/include/libpq/hba.h +++ b/src/include/libpq/hba.h @@ -55,7 +55,9 @@ typedef enum ConnType ctLocal, ctHost, ctHostSSL, - ctHostNoSSL + ctHostNoSSL, + ctHostGSS, + ctHostNoGSS, } ConnType; typedef enum ClientCertMode diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h index 248055f10b4..059218c85a3 100644 --- a/src/include/libpq/libpq-be.h +++ b/src/include/libpq/libpq-be.h @@ -86,6 +86,10 @@ typedef struct gss_cred_id_t cred; /* GSSAPI connection cred's */ gss_ctx_id_t ctx; /* GSSAPI connection context */ gss_name_t name; /* GSSAPI client name */ + char *princ; /* GSSAPI Principal used for auth, NULL if + * GSSAPI auth was not used */ + bool auth; /* GSSAPI Authentication used */ + bool enc; /* GSSAPI encryption in use */ #endif } pg_gssinfo; #endif @@ -164,6 +168,9 @@ typedef struct Port int keepalives_interval; int keepalives_count; + /* + * GSSAPI structures. + */ #if defined(ENABLE_GSS) || defined(ENABLE_SSPI) /* @@ -263,6 +270,13 @@ extern void be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len); extern void be_tls_get_peer_serial(Port *port, char *ptr, size_t len); /* + * Return information about the GSSAPI authenticated connection + */ +extern bool be_gssapi_get_auth(Port *port); +extern bool be_gssapi_get_enc(Port *port); +extern const char *be_gssapi_get_princ(Port *port); + +/* * Get the server certificate hash for SCRAM channel binding type * tls-server-end-point. * @@ -279,6 +293,12 @@ extern char *be_tls_get_certificate_hash(Port *port, size_t *len); #endif /* USE_SSL */ +#ifdef ENABLE_GSS +/* Read and write to a GSSAPI-encrypted connection. */ +extern ssize_t be_gssapi_read(Port *port, void *ptr, size_t len); +extern ssize_t be_gssapi_write(Port *port, void *ptr, size_t len); +#endif /* ENABLE_GSS */ + extern ProtocolVersion FrontendProtocol; /* TCP keepalives configuration. These are no-ops on an AF_UNIX socket. */ diff --git a/src/include/libpq/libpq.h b/src/include/libpq/libpq.h index 755819cc584..41f9257aa9d 100644 --- a/src/include/libpq/libpq.h +++ b/src/include/libpq/libpq.h @@ -93,6 +93,9 @@ extern ssize_t secure_read(Port *port, void *ptr, size_t len); extern ssize_t secure_write(Port *port, void *ptr, size_t len); extern ssize_t secure_raw_read(Port *port, void *ptr, size_t len); extern ssize_t secure_raw_write(Port *port, const void *ptr, size_t len); +#ifdef ENABLE_GSS +extern ssize_t secure_open_gssapi(Port *port); +#endif extern bool ssl_loaded_verify_locations; diff --git a/src/include/libpq/pqcomm.h b/src/include/libpq/pqcomm.h index 5b84bdda991..baf6a4b6c02 100644 --- a/src/include/libpq/pqcomm.h +++ b/src/include/libpq/pqcomm.h @@ -199,9 +199,10 @@ typedef struct CancelRequestPacket /* - * A client can also start by sending a SSL negotiation request, to get a - * secure channel. + * A client can also start by sending a SSL or GSSAPI negotiation request to + * get a secure channel. */ #define NEGOTIATE_SSL_CODE PG_PROTOCOL(1234,5679) +#define NEGOTIATE_GSS_CODE PG_PROTOCOL(1234,5680) #endif /* PQCOMM_H */ diff --git a/src/include/pgstat.h b/src/include/pgstat.h index 53d4a9c4319..5888242f757 100644 --- a/src/include/pgstat.h +++ b/src/include/pgstat.h @@ -801,7 +801,8 @@ typedef enum WAIT_EVENT_SSL_OPEN_SERVER, WAIT_EVENT_WAL_RECEIVER_WAIT_START, WAIT_EVENT_WAL_SENDER_WAIT_WAL, - WAIT_EVENT_WAL_SENDER_WRITE_DATA + WAIT_EVENT_WAL_SENDER_WRITE_DATA, + WAIT_EVENT_GSS_OPEN_SERVER, } WaitEventClient; /* ---------- @@ -989,6 +990,23 @@ typedef struct PgBackendSSLStatus char ssl_issuer_dn[NAMEDATALEN]; } PgBackendSSLStatus; +/* + * PgBackendGSSStatus + * + * For each backend, we keep the GSS status in a separate struct, that + * is only filled in if GSS is enabled. + * + * All char arrays must be null-terminated. + */ +typedef struct PgBackendGSSStatus +{ + /* Information about GSSAPI connection */ + char gss_princ[NAMEDATALEN]; /* GSSAPI Principal used to auth */ + bool gss_auth; /* If GSSAPI authentication was used */ + bool gss_enc; /* If encryption is being used */ + +} PgBackendGSSStatus; + /* ---------- * PgBackendStatus @@ -1043,6 +1061,10 @@ typedef struct PgBackendStatus bool st_ssl; PgBackendSSLStatus *st_sslstatus; + /* Information about GSSAPI connection */ + bool st_gss; + PgBackendGSSStatus *st_gssstatus; + /* current state */ BackendState st_state; |