Re: Unfriendly handling of pg_hba SSL options with SSL off

Magnus Hagander <magnus@hagander.net> writes:
> Yeah, better make any misconfiguration very clear - let's throw an error.

OK, so we need something like (untested)

         if (token[4] == 's')    /* "hostssl" */
         {
 #ifdef USE_SSL
+            if (!EnableSSL)
+            {
+                ereport(LOG,
+                        (errcode(ERRCODE_CONFIG_FILE_ERROR),
+                         errmsg("hostssl requires SSL to be turned on"),
+                         errhint("Set ssl = on in postgresql.conf."),
+                         errcontext("line %d of configuration file \"%s\"",
+                                    line_num, HbaFileName)));
+                return false;
+            }
             parsedline->conntype = ctHostSSL;
 #else
             ereport(LOG,
                     (errcode(ERRCODE_CONFIG_FILE_ERROR),
                      errmsg("hostssl not supported on this platform"),
               errhint("Compile with --with-openssl to use SSL connections."),
                      errcontext("line %d of configuration file \"%s\"",
                                 line_num, HbaFileName)));
             return false;
 #endif
         }

While I'm looking at this, I notice that here (and in some other places
in pg_hba.conf) we say "not supported on this platform" which seems
rather bogus to me.  It implies that it's not possible to have SSL
support on the user's machine, which is most likely not the case.
I'd be happier with "not supported by this build of PostgreSQL" or some
such wording.  Thoughts?

			regards, tom lane