Re: Securing "make check" (CVE-2014-0067) - Mailing list pgsql-hackers

From Noah Misch
Subject Re: Securing "make check" (CVE-2014-0067)
Date
Msg-id 20141226010245.GB1971688@tornado.leadboat.com
Whole thread Raw
In response to Re: Securing "make check" (CVE-2014-0067)  (David Rowley <dgrowleyml@gmail.com>)
Responses hamerkop is stuck
List pgsql-hackers
On Thu, Dec 25, 2014 at 11:35:31PM +1300, David Rowley wrote:
> On 25 December 2014 at 18:27, Noah Misch <noah@leadboat.com> wrote:
> > This needs to be conditional on whether the platform supports IPv6, like
> > we do
> > in setup_config().  The attached patch works on these configurations:
> >
> > 64-bit Windows Server 2003, 32-bit VS2010
> > 64-bit Windows Server 2003, MinGW (always 32-bit)
> > 64-bit Windows Server 2008, 64-bit VS2012
> > 64-bit Windows Server 2008, 64-bit MinGW-w64
> >
> > If the patch looks reasonable, I will commit it.
> >
> 
> I'm just looking at initdb.c I see that there's this:
> 
> #ifdef HAVE_IPV6
> 
> /*
>  * Probe to see if there is really any platform support for IPv6, and
>  * comment out the relevant pg_hba line if not.  This avoids runtime
>  * warnings if getaddrinfo doesn't actually cope with IPv6.  Particularly
>  * useful on Windows, where executables built on a machine with IPv6 may
>  * have to run on a machine without.
>  */
> The comment does seem to indicate that getaddrinfo might give a warning on
> an IPv4 only machine when given an IPv6 address to resolve. I think likely
> we want that here too. Though I don't have an IPv4 only machine to test on.

A default installation of Windows Server 2003 is IPv4-only.  Putting a ::1/128
line in pg_hba.conf makes the postmaster fail to start there, reporting error
"specifying both host name and CIDR mask is invalid".

> I'll test the patch with IPv4 disabled and see if I get a warning...
> 
> Ok, it seems to still write the Ipv6 entry into the pg_hba.conf with IPv6
> disabled, so perhaps disabling IPv6 is not sufficient, maybe it needs to be
> tested on a machine that does not support IPv6 at all.

It is fine to emit the IPv6 entry on any system where it does not impede
postmaster start, even systems that won't actually use IPv6 to connect.

I went ahead and committed this.  Andrew, would you unstick buildfarm members
jacana and bowerbird on all branches?  SRA, would you do the same for
hamerkop?  Thanks.



pgsql-hackers by date:

Previous
From: Tomas Vondra
Date:
Subject: Re: Better way of dealing with pgstat wait timeout during buildfarm runs?
Next
From: Andres Freund
Date:
Subject: Re: Some other odd buildfarm failures