codekingpro/portable-devtools

1/*-------------------------------------------------------------------------2 *3 * libpq-be.h4 *	  This file contains definitions for structures and externs used5 *	  by the postmaster during client authentication.6 *7 *	  Note that this is backend-internal and is NOT exported to clients.8 *	  Structs that need to be client-visible are in pqcomm.h.9 *10 *11 * Portions Copyright (c) 1996-2023, PostgreSQL Global Development Group12 * Portions Copyright (c) 1994, Regents of the University of California13 *14 * src/include/libpq/libpq-be.h15 *16 *-------------------------------------------------------------------------17 */18#ifndef LIBPQ_BE_H19#define LIBPQ_BE_H20 21#include <sys/time.h>22#ifdef USE_OPENSSL23#include <openssl/ssl.h>24#include <openssl/err.h>25#endif26#include <netinet/tcp.h>27 28#ifdef ENABLE_GSS29#if defined(HAVE_GSSAPI_H)30#include <gssapi.h>31#else32#include <gssapi/gssapi.h>33#endif							/* HAVE_GSSAPI_H */34#endif							/* ENABLE_GSS */35 36#ifdef ENABLE_SSPI37#define SECURITY_WIN3238#if defined(WIN32) && !defined(_MSC_VER)39#include <ntsecapi.h>40#endif41#include <security.h>42#undef SECURITY_WIN3243 44#ifndef ENABLE_GSS45/*46 * Define a fake structure compatible with GSSAPI on Unix.47 */48typedef struct49{50	void	   *value;51	int			length;52} gss_buffer_desc;53#endif54#endif							/* ENABLE_SSPI */55 56#include "datatype/timestamp.h"57#include "libpq/hba.h"58#include "libpq/pqcomm.h"59 60 61typedef enum CAC_state62{63	CAC_OK,64	CAC_STARTUP,65	CAC_SHUTDOWN,66	CAC_RECOVERY,67	CAC_NOTCONSISTENT,68	CAC_TOOMANY69} CAC_state;70 71 72/*73 * GSSAPI specific state information74 */75#if defined(ENABLE_GSS) | defined(ENABLE_SSPI)76typedef struct77{78	gss_buffer_desc outbuf;		/* GSSAPI output token buffer */79#ifdef ENABLE_GSS80	gss_cred_id_t cred;			/* GSSAPI connection cred's */81	gss_ctx_id_t ctx;			/* GSSAPI connection context */82	gss_name_t	name;			/* GSSAPI client name */83	char	   *princ;			/* GSSAPI Principal used for auth, NULL if84								 * GSSAPI auth was not used */85	bool		auth;			/* GSSAPI Authentication used */86	bool		enc;			/* GSSAPI encryption in use */87	bool		delegated_creds;	/* GSSAPI Delegated credentials */88#endif89} pg_gssinfo;90#endif91 92/*93 * ClientConnectionInfo includes the fields describing the client connection94 * that are copied over to parallel workers as nothing from Port does that.95 * The same rules apply for allocations here as for Port (everything must be96 * malloc'd or palloc'd in TopMemoryContext).97 *98 * If you add a struct member here, remember to also handle serialization in99 * SerializeClientConnectionInfo() and co.100 */101typedef struct ClientConnectionInfo102{103	/*104	 * Authenticated identity.  The meaning of this identifier is dependent on105	 * auth_method; it is the identity (if any) that the user presented during106	 * the authentication cycle, before they were assigned a database role.107	 * (It is effectively the "SYSTEM-USERNAME" of a pg_ident usermap --108	 * though the exact string in use may be different, depending on pg_hba109	 * options.)110	 *111	 * authn_id is NULL if the user has not actually been authenticated, for112	 * example if the "trust" auth method is in use.113	 */114	const char *authn_id;115 116	/*117	 * The HBA method that determined the above authn_id.  This only has118	 * meaning if authn_id is not NULL; otherwise it's undefined.119	 */120	UserAuth	auth_method;121} ClientConnectionInfo;122 123/*124 * This is used by the postmaster in its communication with frontends.  It125 * contains all state information needed during this communication before the126 * backend is run.  The Port structure is kept in malloc'd memory and is127 * still available when a backend is running (see MyProcPort).  The data128 * it points to must also be malloc'd, or else palloc'd in TopMemoryContext,129 * so that it survives into PostgresMain execution!130 *131 * remote_hostname is set if we did a successful reverse lookup of the132 * client's IP address during connection setup.133 * remote_hostname_resolv tracks the state of hostname verification:134 *	+1 = remote_hostname is known to resolve to client's IP address135 *	-1 = remote_hostname is known NOT to resolve to client's IP address136 *	 0 = we have not done the forward DNS lookup yet137 *	-2 = there was an error in name resolution138 * If reverse lookup of the client IP address fails, remote_hostname will be139 * left NULL while remote_hostname_resolv is set to -2.  If reverse lookup140 * succeeds but forward lookup fails, remote_hostname_resolv is also set to -2141 * (the case is distinguishable because remote_hostname isn't NULL).  In142 * either of the -2 cases, remote_hostname_errcode saves the lookup return143 * code for possible later use with gai_strerror.144 */145 146typedef struct Port147{148	pgsocket	sock;			/* File descriptor */149	bool		noblock;		/* is the socket in non-blocking mode? */150	ProtocolVersion proto;		/* FE/BE protocol version */151	SockAddr	laddr;			/* local addr (postmaster) */152	SockAddr	raddr;			/* remote addr (client) */153	char	   *remote_host;	/* name (or ip addr) of remote host */154	char	   *remote_hostname;	/* name (not ip addr) of remote host, if155									 * available */156	int			remote_hostname_resolv; /* see above */157	int			remote_hostname_errcode;	/* see above */158	char	   *remote_port;	/* text rep of remote port */159	CAC_state	canAcceptConnections;	/* postmaster connection status */160 161	/*162	 * Information that needs to be saved from the startup packet and passed163	 * into backend execution.  "char *" fields are NULL if not set.164	 * guc_options points to a List of alternating option names and values.165	 */166	char	   *database_name;167	char	   *user_name;168	char	   *cmdline_options;169	List	   *guc_options;170 171	/*172	 * The startup packet application name, only used here for the "connection173	 * authorized" log message. We shouldn't use this post-startup, instead174	 * the GUC should be used as application can change it afterward.175	 */176	char	   *application_name;177 178	/*179	 * Information that needs to be held during the authentication cycle.180	 */181	HbaLine    *hba;182 183	/*184	 * TCP keepalive and user timeout settings.185	 *186	 * default values are 0 if AF_UNIX or not yet known; current values are 0187	 * if AF_UNIX or using the default. Also, -1 in a default value means we188	 * were unable to find out the default (getsockopt failed).189	 */190	int			default_keepalives_idle;191	int			default_keepalives_interval;192	int			default_keepalives_count;193	int			default_tcp_user_timeout;194	int			keepalives_idle;195	int			keepalives_interval;196	int			keepalives_count;197	int			tcp_user_timeout;198 199	/*200	 * GSSAPI structures.201	 */202#if defined(ENABLE_GSS) || defined(ENABLE_SSPI)203 204	/*205	 * If GSSAPI is supported and used on this connection, store GSSAPI206	 * information.  Even when GSSAPI is not compiled in, store a NULL pointer207	 * to keep struct offsets the same (for extension ABI compatibility).208	 */209	pg_gssinfo *gss;210#else211	void	   *gss;212#endif213 214	/*215	 * SSL structures.216	 */217	bool		ssl_in_use;218	char	   *peer_cn;219	char	   *peer_dn;220	bool		peer_cert_valid;221 222	/*223	 * OpenSSL structures. (Keep these last so that the locations of other224	 * fields are the same whether or not you build with SSL enabled.)225	 */226#ifdef USE_OPENSSL227	SSL		   *ssl;228	X509	   *peer;229#endif230} Port;231 232#ifdef USE_SSL233/*234 *	Hardcoded DH parameters, used in ephemeral DH keying.  (See also235 *	README.SSL for more details on EDH.)236 *237 *	This is the 2048-bit DH parameter from RFC 3526.  The generation of the238 *	prime is specified in RFC 2412 Appendix E, which also discusses the239 *	design choice of the generator.  Note that when loaded with OpenSSL240 *	this causes DH_check() to fail on DH_NOT_SUITABLE_GENERATOR, where241 *	leaking a bit is preferred.242 */243#define FILE_DH2048 \244"-----BEGIN DH PARAMETERS-----\n\245MIIBCAKCAQEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxOb\n\246IlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjft\n\247awv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXT\n\248mmkWP6j9JM9fg2VdI9yjrZYcYvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhgh\n\249fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq\n\2505RXSJhiY+gUQFXKOWoqsqmj//////////wIBAg==\n\251-----END DH PARAMETERS-----\n"252 253/*254 * These functions are implemented by the glue code specific to each255 * SSL implementation (e.g. be-secure-openssl.c)256 */257 258/*259 * Initialize global SSL context.260 *261 * If isServerStart is true, report any errors as FATAL (so we don't return).262 * Otherwise, log errors at LOG level and return -1 to indicate trouble,263 * preserving the old SSL state if any.  Returns 0 if OK.264 */265extern int	be_tls_init(bool isServerStart);266 267/*268 * Destroy global SSL context, if any.269 */270extern void be_tls_destroy(void);271 272/*273 * Attempt to negotiate SSL connection.274 */275extern int	be_tls_open_server(Port *port);276 277/*278 * Close SSL connection.279 */280extern void be_tls_close(Port *port);281 282/*283 * Read data from a secure connection.284 */285extern ssize_t be_tls_read(Port *port, void *ptr, size_t len, int *waitfor);286 287/*288 * Write data to a secure connection.289 */290extern ssize_t be_tls_write(Port *port, void *ptr, size_t len, int *waitfor);291 292/*293 * Return information about the SSL connection.294 */295extern int	be_tls_get_cipher_bits(Port *port);296extern const char *be_tls_get_version(Port *port);297extern const char *be_tls_get_cipher(Port *port);298extern void be_tls_get_peer_subject_name(Port *port, char *ptr, size_t len);299extern void be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len);300extern void be_tls_get_peer_serial(Port *port, char *ptr, size_t len);301 302/*303 * Get the server certificate hash for SCRAM channel binding type304 * tls-server-end-point.305 *306 * The result is a palloc'd hash of the server certificate with its307 * size, and NULL if there is no certificate available.308 *309 * This is not supported with old versions of OpenSSL that don't have310 * the X509_get_signature_nid() function.311 */312#if defined(USE_OPENSSL) && (defined(HAVE_X509_GET_SIGNATURE_NID) || defined(HAVE_X509_GET_SIGNATURE_INFO))313#define HAVE_BE_TLS_GET_CERTIFICATE_HASH314extern char *be_tls_get_certificate_hash(Port *port, size_t *len);315#endif316 317/* init hook for SSL, the default sets the password callback if appropriate */318#ifdef USE_OPENSSL319typedef void (*openssl_tls_init_hook_typ) (SSL_CTX *context, bool isServerStart);320extern PGDLLIMPORT openssl_tls_init_hook_typ openssl_tls_init_hook;321#endif322 323#endif							/* USE_SSL */324 325#ifdef ENABLE_GSS326/*327 * Return information about the GSSAPI authenticated connection328 */329extern bool be_gssapi_get_auth(Port *port);330extern bool be_gssapi_get_enc(Port *port);331extern const char *be_gssapi_get_princ(Port *port);332extern bool be_gssapi_get_delegation(Port *port);333 334/* Read and write to a GSSAPI-encrypted connection. */335extern ssize_t be_gssapi_read(Port *port, void *ptr, size_t len);336extern ssize_t be_gssapi_write(Port *port, void *ptr, size_t len);337#endif							/* ENABLE_GSS */338 339extern PGDLLIMPORT ProtocolVersion FrontendProtocol;340extern PGDLLIMPORT ClientConnectionInfo MyClientConnectionInfo;341 342/* TCP keepalives configuration. These are no-ops on an AF_UNIX socket. */343 344extern int	pq_getkeepalivesidle(Port *port);345extern int	pq_getkeepalivesinterval(Port *port);346extern int	pq_getkeepalivescount(Port *port);347extern int	pq_gettcpusertimeout(Port *port);348 349extern int	pq_setkeepalivesidle(int idle, Port *port);350extern int	pq_setkeepalivesinterval(int interval, Port *port);351extern int	pq_setkeepalivescount(int count, Port *port);352extern int	pq_settcpusertimeout(int timeout, Port *port);353 354#endif							/* LIBPQ_BE_H */355