Re: Securing "make check" (CVE-2014-0067) - Mailing list pgsql-hackers

From David Rowley
Subject Re: Securing "make check" (CVE-2014-0067)
Date
Msg-id CAApHDvqsBUGPXeDVY=JtVE+1HZNu7RQizFF4SC3hbxh0sLKxRA@mail.gmail.com
Whole thread Raw
In response to Re: Securing "make check" (CVE-2014-0067)  (Noah Misch <noah@leadboat.com>)
Responses Re: Securing "make check" (CVE-2014-0067)  (Noah Misch <noah@leadboat.com>)
List pgsql-hackers
On 25 December 2014 at 18:27, Noah Misch <noah@leadboat.com> wrote:
On Thu, Dec 25, 2014 at 03:55:02PM +1300, David Rowley wrote:
> f6dc6dd seems to have broken vcregress check for me:

> FATAL:  no pg_hba.conf entry for host "::1", user "David", database
> "postgres"
> ...
> FATAL:  no pg_hba.conf entry for host "::1", user "David", database
> "postgres"

Thanks.  I bet this is the reason buildfarm members hamerkop, jacana and
bowerbird have not been reporting in.

> @@ -1085,6 +1085,8 @@ config_sspi_auth(const char *pgdata)
>       CW(fputs("# Configuration written by config_sspi_auth()\n", hba) >= 0);
>       CW(fputs("host all all 127.0.0.1/32  sspi include_realm=1 map=regress\n",
>                        hba) >= 0);
> +     CW(fputs("host all all ::1/128  sspi include_realm=1 map=regress\n",
> +                      hba) >= 0);

This needs to be conditional on whether the platform supports IPv6, like we do
in setup_config().  The attached patch works on these configurations:

64-bit Windows Server 2003, 32-bit VS2010
64-bit Windows Server 2003, MinGW (always 32-bit)
64-bit Windows Server 2008, 64-bit VS2012
64-bit Windows Server 2008, 64-bit MinGW-w64

If the patch looks reasonable, I will commit it.

I'm just looking at initdb.c I see that there's this:

#ifdef HAVE_IPV6

/*
 * Probe to see if there is really any platform support for IPv6, and
 * comment out the relevant pg_hba line if not.  This avoids runtime
 * warnings if getaddrinfo doesn't actually cope with IPv6.  Particularly
 * useful on Windows, where executables built on a machine with IPv6 may
 * have to run on a machine without.
 */
The comment does seem to indicate that getaddrinfo might give a warning on an IPv4 only machine when given an IPv6 address to resolve. I think likely we want that here too. Though I don't have an IPv4 only machine to test on.

I'll test the patch with IPv4 disabled and see if I get a warning...

Ok, it seems to still write the Ipv6 entry into the pg_hba.conf with IPv6 disabled, so perhaps disabling IPv6 is not sufficient, maybe it needs to be tested on a machine that does not support IPv6 at all.

Regards

David Rowley

pgsql-hackers by date:

Previous
From: Abhijit Menon-Sen
Date:
Subject: Re: What exactly is our CRC algorithm?
Next
From: Abhijit Menon-Sen
Date:
Subject: Re: pgaudit - an auditing extension for PostgreSQL