Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit0170b10

Browse files
committed
Restore PGREQUIRESSL recognition in libpq.
Commit65c3bf1 moved handling of the,already then, deprecated requiressl parameter into conninfo_storeval().The default PGREQUIRESSL environment variable was however lost in thechange resulting in a potentially silent accept of a non-SSL connectioneven when set. Its documentation remained. Restore its implementation.Also amend the documentation to mark PGREQUIRESSL as deprecated forthose not following the link to requiressl. Back-patch to 9.3, wherecommit65c3bf1 first appeared.Behavior has been more complex when the user provides both deprecatedand non-deprecated settings. Before commit65c3bf1, libpq operatedaccording to the first of these found: requiressl=1 PGREQUIRESSL=1 sslmode=* PGSSLMODE=*(Note requiressl=0 didn't override sslmode=*; it would only suppressPGREQUIRESSL=1 or a previous requiressl=1. PGREQUIRESSL=0 had no effectwhatsoever.) Starting with commit65c3bf1, libpq ignored PGREQUIRESSL,and order of precedence changed to this: last of requiressl=* or sslmode=* PGSSLMODE=*Starting now, adopt the following order of precedence: last of requiressl=* or sslmode=* PGSSLMODE=* PGREQUIRESSL=1This retains the65c3bf1 behavior for connection strings that containboth requiressl=* and sslmode=*. It retains the65c3bf1 change thateither connection string option overrides both environment variables.For the first time, PGSSLMODE has precedence over PGREQUIRESSL; thisavoids reducing security of "PGREQUIRESSL=1 PGSSLMODE=verify-full"configurations originating under v9.3 and later.Daniel GustafssonSecurity:CVE-2017-7485
1 parent74cadea commit0170b10

File tree

2 files changed

+27
-0
lines changed

2 files changed

+27
-0
lines changed

‎doc/src/sgml/libpq.sgml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7061,6 +7061,9 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
70617061
</indexterm>
70627062
<envar>PGREQUIRESSL</envar> behaves the same as the <xref
70637063
linkend="libpq-connect-requiressl"> connection parameter.
7064+
This environment variable is deprecated in favor of the
7065+
<envar>PGSSLMODE</envar> variable; setting both variables suppresses the
7066+
effect of this one.
70647067
</para>
70657068
</listitem>
70667069

‎src/interfaces/libpq/fe-connect.c

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5083,6 +5083,30 @@ conninfo_add_defaults(PQconninfoOption *options, PQExpBuffer errorMessage)
50835083
}
50845084
}
50855085

5086+
/*
5087+
* Interpret the deprecated PGREQUIRESSL environment variable. Per
5088+
* tradition, translate values starting with "1" to sslmode=require,
5089+
* and ignore other values. Given both PGREQUIRESSL=1 and PGSSLMODE,
5090+
* PGSSLMODE takes precedence; the opposite was true before v9.3.
5091+
*/
5092+
if (strcmp(option->keyword,"sslmode")==0)
5093+
{
5094+
constchar*requiresslenv=getenv("PGREQUIRESSL");
5095+
5096+
if (requiresslenv!=NULL&&requiresslenv[0]=='1')
5097+
{
5098+
option->val=strdup("require");
5099+
if (!option->val)
5100+
{
5101+
if (errorMessage)
5102+
printfPQExpBuffer(errorMessage,
5103+
libpq_gettext("out of memory\n"));
5104+
return false;
5105+
}
5106+
continue;
5107+
}
5108+
}
5109+
50865110
/*
50875111
* No environment variable specified or the variable isn't set - try
50885112
* compiled-in default

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp