db/pgbackrest
1
0
Fork 0
mirror of https://github.com/pgbackrest/pgbackrest.git synced 2026-06-20 01:17:49 +02:00
Code Issues Releases Activity

Fix documentation for specifying multiple stanzas with tls-server-auth.

Browse Source 
The prior documentation said that multiple stanzas should be specified by repeating the tls-server-auth option. This is incorrect -- in fact a comma-separated list of stanza should be used.

Fix the documentation and add a test to confirm this behavior.

In passing add some const qualifiers that were missing in the relevant code.
This commit is contained in:
David Steele
2025-04-08 10:45:06 -05:00
committed by GitHub
parent 37544da56c
commit 53a45d25c3
5 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/xml/release/2025/2.55.0.xml
+15
View File
@@ -221,6 +221,21 @@
</release-core-list>
<release-doc-list>
<release-bug-list>
<release-item>
<github-pull-request id="2538"/>
<release-item-contributor-list>
<release-item-ideator id="terry.macandrew"/>
<release-item-contributor id="david.steele"/>
<release-item-reviewer id="david.christensen"/>
<release-item-reviewer id="stefan.fercot"/>
</release-item-contributor-list>
<p>Fix documentation for specifying multiple stanzas with <br-setting>tls-server-auth</br-setting>.</p>
</release-item>
</release-bug-list>
<release-improvement-list>
<release-item>
<github-pull-request id="2541"/>
doc/xml/release/contributor.xml
+5
View File
@@ -1044,6 +1044,11 @@
<contributor-id type="github">tanelsuurhans</contributor-id>
</contributor>
<contributor id="terry.macandrew">
<contributor-name-display>Terry MacAndrew</contributor-name-display>
<contributor-id type="github">terrymac58</contributor-id>
</contributor>
<contributor id="thibault.vincent">
<contributor-name-display>Thibault Vincent</contributor-name-display>
<contributor-id type="github">npdgm</contributor-id>
src/build/help/help.xml
+2 -2
View File
@@ -1723,10 +1723,10 @@
<text>
<p>Clients are authorized on the server by verifying their certificate and checking their certificate CN (Common Name) against a list on the server configured with the <br-option>tls-server-auth</br-option> option.</p>
<p>A client CN can be authorized for as many stanzas as needed by repeating the <br-option>tls-server-auth</br-option> option, or for all stanzas by specifying <br-option>tls-server-auth=client-cn=*</br-option>. Wildcards may not be specified for the client CN.</p>
<p>A client CN can be authorized for as many stanzas as needed by providing a comma-separated list to the <br-option>tls-server-auth</br-option> option or for all stanzas by specifying <br-option>tls-server-auth=client-cn=*</br-option>. Wildcards may not be specified for the client CN.</p>
</text>
<example>client-cn=stanza1</example>
<example>client-cn=stanza1,stanza2</example>
</config-key>
<config-key id="tls-server-ca-file" name="TLS Server Certificate Authorities">
src/protocol/helper.c
+1 -1
View File
@@ -351,7 +351,7 @@ protocolServerAuthorize(const String *authListStr, const String *const stanza)
// Else check the stanza list for a match with the specified stanza. Each entry will need to be trimmed before comparing.
else if (stanza != NULL)
{
StringList *authList = strLstNewSplitZ(authListStr, ",");
const StringList *const authList = strLstNewSplitZ(authListStr, ",");
for (unsigned int authListIdx = 0; authListIdx < strLstSize(authList); authListIdx++)
{
test/src/module/command/serverTest.c
+1 -1
View File
@@ -132,7 +132,7 @@ testRun(void)
CFGOPT_TLS_SERVER_CA_FILE "=" HRN_SERVER_CA "\n"
CFGOPT_TLS_SERVER_CERT_FILE "=" HRN_SERVER_CERT "\n"
CFGOPT_TLS_SERVER_KEY_FILE "=" HRN_SERVER_KEY "\n"
CFGOPT_TLS_SERVER_AUTH "=pgbackrest-client=db\n"
CFGOPT_TLS_SERVER_AUTH "=pgbackrest-client=bogus1,db,bogus2\n"
"repo1-path=" TEST_PATH "/repo\n");
StringList *argList = strLstNew();