Cause pg_hba.conf file inclusion (@file stuff) to behave as documented,

that is, files are sought in the same directory as the referencing file.
Also allow absolute paths in @file constructs.  Improve documentation
to actually say what is allowed in an included file.

Author: tglsfdc

doc/src/sgml/client-auth.sgml

@@ -1,5 +1,5 @@
 <!--
-$PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.69 2004/12/26 23:06:56 tgl Exp $
+$PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.70 2004/12/27 19:19:23 tgl Exp $
 -->
 
 <chapter id="client-authentication">
@@ -175,8 +175,7 @@ hostnossl  <replaceable>database</replaceable>  <replaceable>user</replaceable>
        a specific <productname>PostgreSQL</productname> database.
        Multiple database names can be supplied by separating them with
        commas.  A file containing database names can be specified by
-       preceding the file name with <literal>@</>. The file must be in
-       the same directory as <filename>pg_hba.conf</>.
+       preceding the file name with <literal>@</>.
       </para>
      </listitem>
     </varlistentry>
@@ -192,8 +191,7 @@ hostnossl  <replaceable>database</replaceable>  <replaceable>user</replaceable>
        can be supplied by separating them with commas. Group names can
        be specified by preceding the group name with <literal>+</>. A
        file containing user names can be specified by preceding the
-       file name with <literal>@</>. The file must be in the same
-       directory as <filename>pg_hba.conf</>.
+       file name with <literal>@</>.
       </para>
      </listitem>
     </varlistentry>
@@ -393,6 +391,16 @@ hostnossl  <replaceable>database</replaceable>  <replaceable>user</replaceable>
    </variablelist>
   </para>
 
+  <para>
+   Files included by <literal>@</> constructs are read as lists of names,
+   which can be separated by either whitespace or commas.  Comments are
+   introduced by <literal>#</literal>, just as in
+   <filename>pg_hba.conf</filename>, and nested <literal>@</> constructs are
+   allowed.  Unless the file name following <literal>@</> is an absolute
+   path, it is taken to be relative to the directory containing the
+   referencing file.
+  </para>
+
   <para>
    Since the <filename>pg_hba.conf</filename> records are examined
    sequentially for each connection attempt, the order of the records is

src/backend/libpq/hba.c

@@ -10,7 +10,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/libpq/hba.c,v 1.134 2004/11/17 19:54:24 tgl Exp $
+ *	  $PostgreSQL: pgsql/src/backend/libpq/hba.c,v 1.135 2004/12/27 19:19:24 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -82,8 +82,10 @@ static List **group_sorted = NULL;		/* sorted group list, for
 static int	user_length;
 static int	group_length;
 
-static void tokenize_file(FILE *file, List **lines, List **line_nums);
-static char *tokenize_inc_file(const char *inc_filename);
+static void tokenize_file(const char *filename, FILE *file,
+						  List **lines, List **line_nums);
+static char *tokenize_inc_file(const char *outer_filename,
+							   const char *inc_filename);
 
 /*
  * isblank() exists in the ISO C99 spec, but it's not very portable yet,
@@ -212,7 +214,7 @@ next_token(FILE *fp, char *buf, int bufsz)
  * we have reached EOL.
  */
 static char *
-next_token_expand(FILE *file)
+next_token_expand(const char *filename, FILE *file)
 {
 	char		buf[MAX_TOKEN];
 	char	   *comma_str = pstrdup("");
@@ -236,7 +238,7 @@ next_token_expand(FILE *file)
 
 		/* Is this referencing a file? */
 		if (buf[0] == '@')
-			incbuf = tokenize_inc_file(buf + 1);
+			incbuf = tokenize_inc_file(filename, buf + 1);
 		else
 			incbuf = pstrdup(buf);
 
@@ -301,40 +303,53 @@ free_lines(List **lines, List **line_nums)
 
 
 static char *
-tokenize_inc_file(const char *inc_filename)
+tokenize_inc_file(const char *outer_filename,
+				  const char *inc_filename)
 {
 	char	   *inc_fullname;
 	FILE	   *inc_file;
 	List	   *inc_lines;
 	List	   *inc_line_nums;
 	ListCell   *line;
-	char	   *comma_str = pstrdup("");
+	char	   *comma_str;
 
-	inc_fullname = (char *) palloc(strlen(DataDir) + 1 +
-								   strlen(inc_filename) + 1);
-	strcpy(inc_fullname, DataDir);
-	strcat(inc_fullname, "/");
-	strcat(inc_fullname, inc_filename);
+	if (is_absolute_path(inc_filename))
+	{
+		/* absolute path is taken as-is */
+		inc_fullname = pstrdup(inc_filename);
+	}
+	else
+	{
+		/* relative path is relative to dir of calling file */
+		inc_fullname = (char *) palloc(strlen(outer_filename) + 1 +
+									   strlen(inc_filename) + 1);
+		strcpy(inc_fullname, outer_filename);
+		get_parent_directory(inc_fullname);
+		join_path_components(inc_fullname, inc_fullname, inc_filename);
+		canonicalize_path(inc_fullname);
+	}
 
 	inc_file = AllocateFile(inc_fullname, "r");
-	if (!inc_file)
+	if (inc_file == NULL)
 	{
 		ereport(LOG,
 				(errcode_for_file_access(),
 				 errmsg("could not open secondary authentication file \"@%s\" as \"%s\": %m",
 						inc_filename, inc_fullname)));
 		pfree(inc_fullname);
 
-		/* return empty string, it matches nothing */
-		return comma_str;
+		/* return single space, it matches nothing */
+		return pstrdup(" ");
 	}
-	pfree(inc_fullname);
 
 	/* There is possible recursion here if the file contains @ */
-	tokenize_file(inc_file, &inc_lines, &inc_line_nums);
+	tokenize_file(inc_fullname, inc_file, &inc_lines, &inc_line_nums);
+
 	FreeFile(inc_file);
+	pfree(inc_fullname);
 
 	/* Create comma-separated string from List */
+	comma_str = pstrdup("");
 	foreach(line, inc_lines)
 	{
 		List	   *token_list = (List *) lfirst(line);
@@ -357,6 +372,13 @@ tokenize_inc_file(const char *inc_filename)
 
 	free_lines(&inc_lines, &inc_line_nums);
 
+	/* if file is empty, return single space rather than empty string */
+	if (strlen(comma_str) == 0)
+	{
+		pfree(comma_str);
+		return pstrdup(" ");
+	}
+
 	return comma_str;
 }
 
@@ -365,9 +387,12 @@ tokenize_inc_file(const char *inc_filename)
  * Tokenize the given file, storing the resulting data into two lists:
  * a list of sublists, each sublist containing the tokens in a line of
  * the file, and a list of line numbers.
+ *
+ * filename must be the absolute path to the target file.
  */
 static void
-tokenize_file(FILE *file, List **lines, List **line_nums)
+tokenize_file(const char *filename, FILE *file,
+			  List **lines, List **line_nums)
 {
 	List	   *current_line = NIL;
 	int			line_number = 1;
@@ -377,7 +402,7 @@ tokenize_file(FILE *file, List **lines, List **line_nums)
 
 	while (!feof(file))
 	{
-		buf = next_token_expand(file);
+		buf = next_token_expand(filename, file);
 
 		/* add token to list, unless we are at EOL or comment start */
 		if (buf[0])
@@ -893,61 +918,13 @@ check_hba(hbaPort *port)
 }
 
 
-
-/*
- * Open the group file if possible (return NULL if not)
- */
-static FILE *
-group_openfile(void)
-{
-	char	   *filename;
-	FILE	   *groupfile;
-
-	filename = group_getfilename();
-	groupfile = AllocateFile(filename, "r");
-
-	if (groupfile == NULL && errno != ENOENT)
-		ereport(LOG,
-				(errcode_for_file_access(),
-				 errmsg("could not open file \"%s\": %m", filename)));
-
-	pfree(filename);
-
-	return groupfile;
-}
-
-
-
-/*
- * Open the password file if possible (return NULL if not)
- */
-static FILE *
-user_openfile(void)
-{
-	char	   *filename;
-	FILE	   *pwdfile;
-
-	filename = user_getfilename();
-	pwdfile = AllocateFile(filename, "r");
-
-	if (pwdfile == NULL && errno != ENOENT)
-		ereport(LOG,
-				(errcode_for_file_access(),
-				 errmsg("could not open file \"%s\": %m", filename)));
-
-	pfree(filename);
-
-	return pwdfile;
-}
-
-
-
 /*
  *	 Load group/user name mapping file
  */
 void
 load_group(void)
 {
+	char	   *filename;
 	FILE	   *group_file;
 
 	/* Discard any old data */
@@ -958,11 +935,25 @@ load_group(void)
 	group_sorted = NULL;
 	group_length = 0;
 
-	group_file = group_openfile();
-	if (!group_file)
+	/* Read in the file contents */
+	filename = group_getfilename();
+	group_file = AllocateFile(filename, "r");
+
+	if (group_file == NULL)
+	{
+		/* no complaint if not there */
+		if (errno != ENOENT)
+			ereport(LOG,
+					(errcode_for_file_access(),
+					 errmsg("could not open file \"%s\": %m", filename)));
+		pfree(filename);
 		return;
-	tokenize_file(group_file, &group_lines, &group_line_nums);
+	}
+
+	tokenize_file(filename, group_file, &group_lines, &group_line_nums);
+
 	FreeFile(group_file);
+	pfree(filename);
 
 	/* create sorted lines for binary searching */
 	group_length = list_length(group_lines);
@@ -990,6 +981,7 @@ load_group(void)
 void
 load_user(void)
 {
+	char	   *filename;
 	FILE	   *user_file;
 
 	/* Discard any old data */
@@ -1000,11 +992,25 @@ load_user(void)
 	user_sorted = NULL;
 	user_length = 0;
 
-	user_file = user_openfile();
-	if (!user_file)
+	/* Read in the file contents */
+	filename = user_getfilename();
+	user_file = AllocateFile(filename, "r");
+
+	if (user_file == NULL)
+	{
+		/* no complaint if not there */
+		if (errno != ENOENT)
+			ereport(LOG,
+					(errcode_for_file_access(),
+					 errmsg("could not open file \"%s\": %m", filename)));
+		pfree(filename);
 		return;
-	tokenize_file(user_file, &user_lines, &user_line_nums);
+	}
+
+	tokenize_file(filename, user_file, &user_lines, &user_line_nums);
+
 	FreeFile(user_file);
+	pfree(filename);
 
 	/* create sorted lines for binary searching */
 	user_length = list_length(user_lines);
@@ -1045,7 +1051,7 @@ load_hba(void)
 				 errmsg("could not open configuration file \"%s\": %m",
 						HbaFileName)));
 
-	tokenize_file(file, &hba_lines, &hba_line_nums);
+	tokenize_file(HbaFileName, file, &hba_lines, &hba_line_nums);
 	FreeFile(file);
 }
 
@@ -1189,7 +1195,7 @@ load_ident(void)
 	}
 	else
 	{
-		tokenize_file(file, &ident_lines, &ident_line_nums);
+		tokenize_file(IdentFileName, file, &ident_lines, &ident_line_nums);
 		FreeFile(file);
 	}
 }