Client certificate authentication

Attached patch implements client certificate authentication.

I kept this sitting in my tree without sending it in before the
commitfest because it is entirely dependent on the
not-yet-reviewed-and-applied patch for how to configure client
certificate requesting. But now that I learned how to do it right in
git, breaking it out was very easy :-) Good learning experience.

Anyway. Here it is. Builds on top of the "clientcert option for pg_hba"
patch already on the list.

//Magnus
*** a/doc/src/sgml/client-auth.sgml
--- b/doc/src/sgml/client-auth.sgml
***************
*** 388,393 **** hostnossl  database  user
--- 388,403 ----
         
  
         
+         cert</>
+         
+          
+           Authenticate using SSL client certificates. See
+            for details.
+          
+         
+        
+ 
+        
          pam</>
          
           
***************
*** 1114,1119 **** ldapserver=ldap.example.net prefix="cn=" suffix="dc=example, dc=net"
--- 1124,1148 ----
  
    
  
+   
+    Certificate authentication
+ 
+    
+     Certificate
+    
+ 
+    
+     This authentication method uses SSL client certificates to perform
+     authentication. It is therefore only available for SSL connections.
+     When using this authentication method, the server will require that
+     the client provide a certificate. No password prompt will be sent
+     to the client. The cn attribute of the certificate
+     will be matched with the username the user is trying to log in as,
+     and if they match the login will be allowed. Username mapping can be
+     used if the usernames don't match.
+    
+   
+ 
    
     PAM authentication
  
*** a/doc/src/sgml/runtime.sgml
--- b/doc/src/sgml/runtime.sgml
***************
*** 1674,1684 **** $ kill -INT `head -1 /usr/local/pgsql/data/postmaster.pid`
  
    
!    PostgreSQL</> currently does not support authentication
!    using client certificates, since it cannot differentiate between
!    different users. As long as the user holds any certificate issued
!    by a trusted CA it will be accepted, regardless of what account the
!    user is trying to connect with.
    
    
  
--- 1674,1682 ----
    
  
    
!    You can use the authentication method cert</> to use the
!    client certificate for authenticating users. See
!     for details.
    
    
  
*** a/src/backend/libpq/auth.c
--- b/src/backend/libpq/auth.c
***************
*** 110,115 **** ULONG(*__ldap_start_tls_sA) (
--- 110,123 ----
  static int	CheckLDAPAuth(Port *port);
  #endif /* USE_LDAP */
  
+ /*----------------------------------------------------------------
+  * Cert authentication
+  *----------------------------------------------------------------
+  */
+ #ifdef USE_SSL
+ static int	CheckCertAuth(Port *port);
+ #endif
+ 
  
  /*----------------------------------------------------------------
   * Kerberos and GSSAPI GUCs
***************
*** 420,425 **** ClientAuthentication(Port *port)
--- 428,441 ----
  #endif
  			break;
  
+ 		case uaCert:
+ #ifdef USE_SSL
+ 			status = CheckCertAuth(port);
+ #else
+ 			Assert(false);
+ #endif
+ 			break;
+ 
  		case uaTrust:
  			status = STATUS_OK;
  			break;
***************
*** 2072,2074 **** CheckLDAPAuth(Port *port)
--- 2088,2115 ----
  }
  #endif   /* USE_LDAP */
  
+ 
+ /*----------------------------------------------------------------
+  * SSL client certificate authentication
+  *----------------------------------------------------------------
+  */
+ #ifdef USE_SSL
+ static int
+ CheckCertAuth(Port *port)
+ {
+ 	Assert(port->ssl);
+ 
+ 	/* Make sure we have received a username in the certificate */
+ 	if (port->peer_cn == NULL ||
+ 		strlen(port->peer_cn) <= 0)
+ 	{
+ 		ereport(LOG,
+ 				(errmsg("Certificate login failed for user \"%s\": client certificate contains no username",
+ 						port->user_name)));
+ 		return STATUS_ERROR;
+ 	}
+ 
+ 	/* Just pass the certificate CN to the usermap check */
+ 	return check_usermap(port->hba->usermap, port->user_name, port->peer_cn, false);
+ }
+ #endif
*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 859,864 **** parse_hba_line(List *line, int line_num, HbaLine *parsedline)
--- 859,870 ----
  #else
  		unsupauth = "ldap";
  #endif
+ 	else if (strcmp(token, "cert") == 0)
+ #ifdef USE_SSL
+ 		parsedline->auth_method = uaCert;
+ #else
+ 		unsupauth = "cert";
+ #endif
  	else
  	{
  		ereport(LOG,
***************
*** 893,898 **** parse_hba_line(List *line, int line_num, HbaLine *parsedline)
--- 899,915 ----
  		return false;
  	}
  
+ 	if (parsedline->conntype != ctHostSSL &&
+ 		parsedline->auth_method == uaCert)
+ 	{
+ 		ereport(LOG,
+ 				(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 				 errmsg("cert authentication is only supported on hostssl connections"),
+ 				 errcontext("line %d of configuration file \"%s\"",
+ 							line_num, HbaFileName)));
+ 		return false;
+ 	}
+ 
  	/* Parse remaining arguments */
  	while ((line_item = lnext(line_item)) != NULL)
  	{
***************
*** 923,930 **** parse_hba_line(List *line, int line_num, HbaLine *parsedline)
  				if (parsedline->auth_method != uaIdent &&
  					parsedline->auth_method != uaKrb5 &&
  					parsedline->auth_method != uaGSS &&
! 					parsedline->auth_method != uaSSPI)
! 					INVALID_AUTH_OPTION("map", "ident, krb5, gssapi and sspi");
  				parsedline->usermap = pstrdup(c);
  			}
  			else if (strcmp(token, "clientcert") == 0)
--- 940,948 ----
  				if (parsedline->auth_method != uaIdent &&
  					parsedline->auth_method != uaKrb5 &&
  					parsedline->auth_method != uaGSS &&
! 					parsedline->auth_method != uaSSPI &&
! 					parsedline->auth_method != uaCert)
! 					INVALID_AUTH_OPTION("map", "ident, krb5, gssapi, sspi and cert");
  				parsedline->usermap = pstrdup(c);
  			}
  			else if (strcmp(token, "clientcert") == 0)
***************
*** 957,963 **** parse_hba_line(List *line, int line_num, HbaLine *parsedline)
--- 975,992 ----
  					parsedline->clientcert = true;
  				}
  				else
+ 				{
+ 					if (parsedline->auth_method == uaCert)
+ 					{
+ 						ereport(LOG,
+ 								(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 								 errmsg("clientcert can not be set to 0 when using \"cert\" authentication"),
+ 								 errcontext("line %d of configuration file \"%s\"",
+ 											line_num, HbaFileName)));
+ 						return false;
+ 					}
  					parsedline->clientcert = false;
+ 				}
  			}
  			else if (strcmp(token, "pamservice") == 0)
  			{
***************
*** 1021,1026 **** parse_hba_line(List *line, int line_num, HbaLine *parsedline)
--- 1050,1063 ----
  	{
  		MANDATORY_AUTH_ARG(parsedline->ldapserver, "ldapserver", "ldap");
  	}
+ 
+ 	/*
+ 	 * Enforce any parameters implied by other settings.
+ 	 */
+ 	if (parsedline->auth_method == uaCert)
+ 	{
+ 		parsedline->clientcert = true;
+ 	}
  	
  	return true;
  }
*** a/src/backend/libpq/pg_hba.conf.sample
--- b/src/backend/libpq/pg_hba.conf.sample
***************
*** 35,41 ****
  # an IP address and netmask in separate columns to specify the set of hosts.
  #
  # METHOD can be "trust", "reject", "md5", "crypt", "password", "gss", "sspi",
! # "krb5", "ident", "pam" or "ldap".  Note that "password" sends passwords
  # in clear text; "md5" is preferred since it sends encrypted passwords.
  #
  # OPTIONS are a set of options for the authentication in the format
--- 35,41 ----
  # an IP address and netmask in separate columns to specify the set of hosts.
  #
  # METHOD can be "trust", "reject", "md5", "crypt", "password", "gss", "sspi",
! # "krb5", "ident", "pam", "ldap" or "cert". Note that "password" sends passwords
  # in clear text; "md5" is preferred since it sends encrypted passwords.
  #
  # OPTIONS are a set of options for the authentication in the format
*** a/src/include/libpq/hba.h
--- b/src/include/libpq/hba.h
***************
*** 26,32 **** typedef enum UserAuth
  	uaGSS,
  	uaSSPI,
  	uaPAM,
! 	uaLDAP
  } UserAuth;
  
  typedef enum ConnType
--- 26,33 ----
  	uaGSS,
  	uaSSPI,
  	uaPAM,
! 	uaLDAP,
! 	uaCert
  } UserAuth;
  
  typedef enum ConnType