From 5750bafe6169a239f6084d8d2e12b40da422fced Mon Sep 17 00:00:00 2001
From: David Fetter <david.fetter@onelogin.com>
Date: Wed, 11 Dec 2019 18:55:03 -0800
Subject: [PATCH v1] Enable setting pg_hba.conf permissions from initdb
To: hackers
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="------------2.23.0"

This is a multi-part message in MIME format.
--------------2.23.0
Content-Type: text/plain; charset=UTF-8; format=fixed
Content-Transfer-Encoding: 8bit


The new optional arguments are --auth-hostssl and --auth-hostnossl

diff --git a/doc/src/sgml/ref/initdb.sgml b/doc/src/sgml/ref/initdb.sgml
index da5c8f5307..03b76732d1 100644
--- a/doc/src/sgml/ref/initdb.sgml
+++ b/doc/src/sgml/ref/initdb.sgml
@@ -154,6 +154,28 @@ PostgreSQL documentation
       </listitem>
      </varlistentry>
 
+     <varlistentry>
+      <term><option>--auth-hostssl=<replaceable class="parameter">authmethod</replaceable></option></term>
+      <listitem>
+       <para>
+        This option specifies the authentication method for users via
+        TLS connections used in <filename>pg_hba.conf</filename>
+        (<literal>hostssl</literal> lines).
+       </para>
+      </listitem>
+     </varlistentry>
+
+     <varlistentry>
+      <term><option>--auth-hostnossl=<replaceable class="parameter">authmethod</replaceable></option></term>
+      <listitem>
+       <para>
+        This option specifies the authentication method for users via
+        non-TLS connections used in <filename>pg_hba.conf</filename>
+        (<literal>hostnossl</literal> lines).
+       </para>
+      </listitem>
+     </varlistentry>
+
      <varlistentry>
       <term><option>--auth-local=<replaceable class="parameter">authmethod</replaceable></option></term>
       <listitem>
diff --git a/src/backend/libpq/pg_hba.conf.sample b/src/backend/libpq/pg_hba.conf.sample
index c853e36232..48ef465cca 100644
--- a/src/backend/libpq/pg_hba.conf.sample
+++ b/src/backend/libpq/pg_hba.conf.sample
@@ -87,3 +87,9 @@ host    all             all             ::1/128                 @authmethodhost@
 @remove-line-for-nolocal@local   replication     all                                     @authmethodlocal@
 host    replication     all             127.0.0.1/32            @authmethodhost@
 host    replication     all             ::1/128                 @authmethodhost@
+
+# hostnossl all           all             0.0.0.0/0               @authmethodhostnossl@
+# hostnossl all           all             ::/0                    @authmethodhostnossl@
+
+# hostssl all             all             0.0.0.0/0               @authmethodhostssl@
+# hostssl all             all             ::/0                    @authmethodhostssl@
diff --git a/src/bin/initdb/initdb.c b/src/bin/initdb/initdb.c
index 1f6d8939be..392f52d21f 100644
--- a/src/bin/initdb/initdb.c
+++ b/src/bin/initdb/initdb.c
@@ -136,6 +136,8 @@ static char *pwfilename = NULL;
 static char *superuser_password = NULL;
 static const char *authmethodhost = NULL;
 static const char *authmethodlocal = NULL;
+static const char *authmethodhostssl = NULL;
+static const char *authmethodhostnossl = NULL;
 static bool debug = false;
 static bool noclean = false;
 static bool do_sync = true;
@@ -438,7 +440,6 @@ replace_token(char **lines, const char *token, const char *replacement)
  *
  * a sort of poor man's grep -v
  */
-#ifndef HAVE_UNIX_SOCKETS
 static char **
 filter_lines_with_token(char **lines, const char *token)
 {
@@ -461,7 +462,6 @@ filter_lines_with_token(char **lines, const char *token)
 
 	return result;
 }
-#endif
 
 /*
  * get the lines from a text file
@@ -1326,6 +1326,40 @@ setup_config(void)
 							  "@authcomment@",
 							  (strcmp(authmethodlocal, "trust") == 0 || strcmp(authmethodhost, "trust") == 0) ? AUTHTRUST_WARNING : "");
 
+	if (authmethodhostssl != NULL)
+	{
+		conflines = replace_token(conflines,
+								  "# hostssl all             all             0.0.0.0/0               @authmethodhostssl@",
+								  "hostssl all             all             0.0.0.0/0               @authmethodhostssl@");
+		conflines = replace_token(conflines,
+								  "# hostssl all             all             ::/0                    @authmethodhostssl@",
+								  "hostssl all             all             ::/0                    @authmethodhostssl@");
+		conflines = replace_token(conflines,
+								  "@authmethodhostssl@",
+								  authmethodhostssl);
+	}
+	else
+	{
+		conflines = filter_lines_with_token(conflines, "@authmethodhostssl@");
+	}
+
+	if (authmethodhostnossl != NULL)
+	{
+		conflines = replace_token(conflines,
+								  "# hostnossl all           all             0.0.0.0/0               @authmethodhostnossl@",
+								  "hostnossl all           all             0.0.0.0/0               @authmethodhostnossl@");
+		conflines = replace_token(conflines,
+								  "# hostnossl all           all             ::/0                    @authmethodhostnossl@",
+								  "hostnossl all           all             ::/0                    @authmethodhostnossl@");
+		conflines = replace_token(conflines,
+								  "@authmethodhostnossl@",
+								  authmethodhostnossl);
+	}
+	else
+	{
+		conflines = filter_lines_with_token(conflines, "@authmethodhostnossl@");
+	}
+
 	snprintf(path, sizeof(path), "%s/pg_hba.conf", pg_data);
 
 	writefile(path, conflines);
@@ -2327,36 +2361,38 @@ usage(const char *progname)
 	printf(_("Usage:\n"));
 	printf(_("  %s [OPTION]... [DATADIR]\n"), progname);
 	printf(_("\nOptions:\n"));
-	printf(_("  -A, --auth=METHOD         default authentication method for local connections\n"));
-	printf(_("      --auth-host=METHOD    default authentication method for local TCP/IP connections\n"));
-	printf(_("      --auth-local=METHOD   default authentication method for local-socket connections\n"));
-	printf(_(" [-D, --pgdata=]DATADIR     location for this database cluster\n"));
-	printf(_("  -E, --encoding=ENCODING   set default encoding for new databases\n"));
-	printf(_("  -g, --allow-group-access  allow group read/execute on data directory\n"));
-	printf(_("      --locale=LOCALE       set default locale for new databases\n"));
+	printf(_("  -A, --auth=METHOD           default authentication method for local connections\n"));
+	printf(_("      --auth-host=METHOD      default authentication method for local TCP/IP connections\n"));
+	printf(_("      --auth-local=METHOD     default authentication method for local-socket connections\n"));
+	printf(_("      --auth-hostssl=METHOD   default authentication method for TLS connections\n"));
+	printf(_("      --auth-hostnossl=METHOD default authentication method for non-TLS connections\n"));
+	printf(_(" [-D, --pgdata=]DATADIR       location for this database cluster\n"));
+	printf(_("  -E, --encoding=ENCODING     set default encoding for new databases\n"));
+	printf(_("  -g, --allow-group-access    allow group read/execute on data directory\n"));
+	printf(_("      --locale=LOCALE         set default locale for new databases\n"));
 	printf(_("      --lc-collate=, --lc-ctype=, --lc-messages=LOCALE\n"
 			 "      --lc-monetary=, --lc-numeric=, --lc-time=LOCALE\n"
-			 "                            set default locale in the respective category for\n"
-			 "                            new databases (default taken from environment)\n"));
-	printf(_("      --no-locale           equivalent to --locale=C\n"));
-	printf(_("      --pwfile=FILE         read password for the new superuser from file\n"));
+			 "                              set default locale in the respective category for\n"
+			 "                              new databases (default taken from environment)\n"));
+	printf(_("      --no-locale             equivalent to --locale=C\n"));
+	printf(_("      --pwfile=FILE           read password for the new superuser from file\n"));
 	printf(_("  -T, --text-search-config=CFG\n"
-			 "                            default text search configuration\n"));
-	printf(_("  -U, --username=NAME       database superuser name\n"));
-	printf(_("  -W, --pwprompt            prompt for a password for the new superuser\n"));
-	printf(_("  -X, --waldir=WALDIR       location for the write-ahead log directory\n"));
-	printf(_("      --wal-segsize=SIZE    size of WAL segments, in megabytes\n"));
+			 "                              default text search configuration\n"));
+	printf(_("  -U, --username=NAME         database superuser name\n"));
+	printf(_("  -W, --pwprompt              prompt for a password for the new superuser\n"));
+	printf(_("  -X, --waldir=WALDIR         location for the write-ahead log directory\n"));
+	printf(_("      --wal-segsize=SIZE      size of WAL segments, in megabytes\n"));
 	printf(_("\nLess commonly used options:\n"));
-	printf(_("  -d, --debug               generate lots of debugging output\n"));
-	printf(_("  -k, --data-checksums      use data page checksums\n"));
-	printf(_("  -L DIRECTORY              where to find the input files\n"));
-	printf(_("  -n, --no-clean            do not clean up after errors\n"));
-	printf(_("  -N, --no-sync             do not wait for changes to be written safely to disk\n"));
-	printf(_("  -s, --show                show internal settings\n"));
-	printf(_("  -S, --sync-only           only sync data directory\n"));
+	printf(_("  -d, --debug                 generate lots of debugging output\n"));
+	printf(_("  -k, --data-checksums        use data page checksums\n"));
+	printf(_("  -L DIRECTORY                where to find the input files\n"));
+	printf(_("  -n, --no-clean              do not clean up after errors\n"));
+	printf(_("  -N, --no-sync               do not wait for changes to be written safely to disk\n"));
+	printf(_("  -s, --show                  show internal settings\n"));
+	printf(_("  -S, --sync-only             only sync data directory\n"));
 	printf(_("\nOther options:\n"));
-	printf(_("  -V, --version             output version information, then exit\n"));
-	printf(_("  -?, --help                show this help, then exit\n"));
+	printf(_("  -V, --version               output version information, then exit\n"));
+	printf(_("  -?, --help                  show this help, then exit\n"));
 	printf(_("\nIf the data directory is not specified, the environment variable PGDATA\n"
 			 "is used.\n"));
 	printf(_("\nReport bugs to <pgsql-bugs@lists.postgresql.org>.\n"));
@@ -3010,6 +3046,8 @@ main(int argc, char *argv[])
 		{"auth", required_argument, NULL, 'A'},
 		{"auth-local", required_argument, NULL, 10},
 		{"auth-host", required_argument, NULL, 11},
+		{"auth-hostssl", required_argument, NULL, 13},
+		{"auth-hostnossl", required_argument, NULL, 14},
 		{"pwprompt", no_argument, NULL, 'W'},
 		{"pwfile", required_argument, NULL, 9},
 		{"username", required_argument, NULL, 'U'},
@@ -3090,6 +3128,12 @@ main(int argc, char *argv[])
 			case 11:
 				authmethodhost = pg_strdup(optarg);
 				break;
+			case 13:
+				authmethodhostssl = pg_strdup(optarg);
+				break;
+			case 14:
+				authmethodhostnossl = pg_strdup(optarg);
+				break;
 			case 'D':
 				pg_data = pg_strdup(optarg);
 				break;
@@ -3224,6 +3268,10 @@ main(int argc, char *argv[])
 
 	check_authmethod_valid(authmethodlocal, auth_methods_local, "local");
 	check_authmethod_valid(authmethodhost, auth_methods_host, "host");
+	if (authmethodhostssl != NULL)
+		check_authmethod_valid(authmethodhostssl, auth_methods_host, "hostssl");
+	if (authmethodhostnossl != NULL)
+		check_authmethod_valid(authmethodhostnossl, auth_methods_host, "hostnossl");
 
 	check_need_password(authmethodlocal, authmethodhost);
 

--------------2.23.0--


