Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit3ca1949

Browse files
committed
Fix up usage of krb_server_keyfile GUC parameter.
secure_open_gssapi() installed the krb_server_keyfile setting asKRB5_KTNAME unconditionally, so long as it's not empty. However,pg_GSS_recvauth() only installed it if KRB5_KTNAME wasn't set already,leading to a troubling inconsistency: in theory, clients could seedifferent sets of server principal names depending on whether theyuse GSSAPI encryption. Always using krb_server_keyfile seems likethe right thing, so make both places do that. Also fix upsecure_open_gssapi()'s lack of a check for setenv() failure ---it's unlikely, surely, but security-critical actions are no placeto be sloppy.Also improve the associated documentation.This patch does nothing about secure_open_gssapi()'s use of setenv(),and indeed causes pg_GSS_recvauth() to use it too. That's nominallyagainst project portability rules, but since this code is only builtwith --with-gssapi, I do not feel a need to do something about thisin the back branches. A fix will be forthcoming for HEAD though.Back-patch to v12 where GSSAPI encryption was introduced. Thedubious behavior in pg_GSS_recvauth() goes back further, but itdidn't have anything to be inconsistent with, so let it be.Discussion:https://postgr.es/m/2187460.1609263156@sss.pgh.pa.us
1 parent635140a commit3ca1949

File tree

5 files changed

+31
-32
lines changed

5 files changed

+31
-32
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1262,11 +1262,7 @@ omicron bryanh guest1
12621262

12631263
<para>
12641264
The location of the server's keytab file is specified by the <xref
1265-
linkend="guc-krb-server-keyfile"/> configuration
1266-
parameter. The default is
1267-
<filename>FILE:/usr/local/pgsql/etc/krb5.keytab</filename>
1268-
(where the directory part is whatever was specified
1269-
as <varname>sysconfdir</varname> at build time).
1265+
linkend="guc-krb-server-keyfile"/> configuration parameter.
12701266
For security reasons, it is recommended to use a separate keytab
12711267
just for the <productname>PostgreSQL</productname> server rather
12721268
than allowing the server to read the system keytab file.

‎doc/src/sgml/config.sgml

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1040,10 +1040,16 @@ include_dir 'conf.d'
10401040
</term>
10411041
<listitem>
10421042
<para>
1043-
Sets the location of the Kerberos server key file. See
1044-
<xref linkend="gssapi-auth"/>
1045-
for details. This parameter can only be set in the
1043+
Sets the location of the server's Kerberos key file. The default is
1044+
<filename>FILE:/usr/local/pgsql/etc/krb5.keytab</filename>
1045+
(where the directory part is whatever was specified
1046+
as <varname>sysconfdir</varname> at build time; use
1047+
<literal>pg_config --sysconfdir</literal> to determine that).
1048+
If this parameter is set to an empty string, it is ignored and a
1049+
system-dependent default is used.
1050+
This parameter can only be set in the
10461051
<filename>postgresql.conf</filename> file or on the server command line.
1052+
See <xref linkend="gssapi-auth"/> for more information.
10471053
</para>
10481054
</listitem>
10491055
</varlistentry>

‎src/backend/libpq/auth.c

Lines changed: 10 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1057,29 +1057,18 @@ pg_GSS_recvauth(Port *port)
10571057
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
10581058
errmsg("GSSAPI is not supported in protocol version 2")));
10591059

1060-
if (pg_krb_server_keyfile&&strlen(pg_krb_server_keyfile)>0)
1060+
/*
1061+
* Use the configured keytab, if there is one. Unfortunately, Heimdal
1062+
* doesn't support the cred store extensions, so use the env var.
1063+
*/
1064+
if (pg_krb_server_keyfile!=NULL&&pg_krb_server_keyfile[0]!='\0')
10611065
{
1062-
/*
1063-
* Set default Kerberos keytab file for the Krb5 mechanism.
1064-
*
1065-
* setenv("KRB5_KTNAME", pg_krb_server_keyfile, 0); except setenv()
1066-
* not always available.
1067-
*/
1068-
if (getenv("KRB5_KTNAME")==NULL)
1066+
if (setenv("KRB5_KTNAME",pg_krb_server_keyfile,1)!=0)
10691067
{
1070-
size_tkt_len=strlen(pg_krb_server_keyfile)+14;
1071-
char*kt_path=malloc(kt_len);
1072-
1073-
if (!kt_path||
1074-
snprintf(kt_path,kt_len,"KRB5_KTNAME=%s",
1075-
pg_krb_server_keyfile)!=kt_len-2||
1076-
putenv(kt_path)!=0)
1077-
{
1078-
ereport(LOG,
1079-
(errcode(ERRCODE_OUT_OF_MEMORY),
1080-
errmsg("out of memory")));
1081-
returnSTATUS_ERROR;
1082-
}
1068+
/* The only likely failure cause is OOM, so use that errcode */
1069+
ereport(FATAL,
1070+
(errcode(ERRCODE_OUT_OF_MEMORY),
1071+
errmsg("could not set environment: %m")));
10831072
}
10841073
}
10851074

‎src/backend/libpq/be-secure-gssapi.c

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -525,8 +525,16 @@ secure_open_gssapi(Port *port)
525525
* Use the configured keytab, if there is one. Unfortunately, Heimdal
526526
* doesn't support the cred store extensions, so use the env var.
527527
*/
528-
if (pg_krb_server_keyfile!=NULL&&strlen(pg_krb_server_keyfile)>0)
529-
setenv("KRB5_KTNAME",pg_krb_server_keyfile,1);
528+
if (pg_krb_server_keyfile!=NULL&&pg_krb_server_keyfile[0]!='\0')
529+
{
530+
if (setenv("KRB5_KTNAME",pg_krb_server_keyfile,1)!=0)
531+
{
532+
/* The only likely failure cause is OOM, so use that errcode */
533+
ereport(FATAL,
534+
(errcode(ERRCODE_OUT_OF_MEMORY),
535+
errmsg("could not set environment: %m")));
536+
}
537+
}
530538

531539
while (true)
532540
{

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@
9292
#db_user_namespace = off
9393

9494
# GSSAPI using Kerberos
95-
#krb_server_keyfile = ''
95+
#krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab'
9696
#krb_caseins_users = off
9797

9898
# - SSL -

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp