Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit860fe27

Browse files
committed
Fix up usage of krb_server_keyfile GUC parameter.
secure_open_gssapi() installed the krb_server_keyfile setting asKRB5_KTNAME unconditionally, so long as it's not empty. However,pg_GSS_recvauth() only installed it if KRB5_KTNAME wasn't set already,leading to a troubling inconsistency: in theory, clients could seedifferent sets of server principal names depending on whether theyuse GSSAPI encryption. Always using krb_server_keyfile seems likethe right thing, so make both places do that. Also fix upsecure_open_gssapi()'s lack of a check for setenv() failure ---it's unlikely, surely, but security-critical actions are no placeto be sloppy.Also improve the associated documentation.This patch does nothing about secure_open_gssapi()'s use of setenv(),and indeed causes pg_GSS_recvauth() to use it too. That's nominallyagainst project portability rules, but since this code is only builtwith --with-gssapi, I do not feel a need to do something about thisin the back branches. A fix will be forthcoming for HEAD though.Back-patch to v12 where GSSAPI encryption was introduced. Thedubious behavior in pg_GSS_recvauth() goes back further, but itdidn't have anything to be inconsistent with, so let it be.Discussion:https://postgr.es/m/2187460.1609263156@sss.pgh.pa.us
1 parente665769 commit860fe27

File tree

5 files changed

+31
-32
lines changed

5 files changed

+31
-32
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1265,11 +1265,7 @@ omicron bryanh guest1
12651265

12661266
<para>
12671267
The location of the server's keytab file is specified by the <xref
1268-
linkend="guc-krb-server-keyfile"/> configuration
1269-
parameter. The default is
1270-
<filename>FILE:/usr/local/pgsql/etc/krb5.keytab</filename>
1271-
(where the directory part is whatever was specified
1272-
as <varname>sysconfdir</varname> at build time).
1268+
linkend="guc-krb-server-keyfile"/> configuration parameter.
12731269
For security reasons, it is recommended to use a separate keytab
12741270
just for the <productname>PostgreSQL</productname> server rather
12751271
than allowing the server to read the system keytab file.

‎doc/src/sgml/config.sgml

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1057,10 +1057,16 @@ include_dir 'conf.d'
10571057
</term>
10581058
<listitem>
10591059
<para>
1060-
Sets the location of the Kerberos server key file. See
1061-
<xref linkend="gssapi-auth"/>
1062-
for details. This parameter can only be set in the
1060+
Sets the location of the server's Kerberos key file. The default is
1061+
<filename>FILE:/usr/local/pgsql/etc/krb5.keytab</filename>
1062+
(where the directory part is whatever was specified
1063+
as <varname>sysconfdir</varname> at build time; use
1064+
<literal>pg_config --sysconfdir</literal> to determine that).
1065+
If this parameter is set to an empty string, it is ignored and a
1066+
system-dependent default is used.
1067+
This parameter can only be set in the
10631068
<filename>postgresql.conf</filename> file or on the server command line.
1069+
See <xref linkend="gssapi-auth"/> for more information.
10641070
</para>
10651071
</listitem>
10661072
</varlistentry>

‎src/backend/libpq/auth.c

Lines changed: 10 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1054,29 +1054,18 @@ pg_GSS_recvauth(Port *port)
10541054
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
10551055
errmsg("GSSAPI is not supported in protocol version 2")));
10561056

1057-
if (pg_krb_server_keyfile&&strlen(pg_krb_server_keyfile)>0)
1057+
/*
1058+
* Use the configured keytab, if there is one. Unfortunately, Heimdal
1059+
* doesn't support the cred store extensions, so use the env var.
1060+
*/
1061+
if (pg_krb_server_keyfile!=NULL&&pg_krb_server_keyfile[0]!='\0')
10581062
{
1059-
/*
1060-
* Set default Kerberos keytab file for the Krb5 mechanism.
1061-
*
1062-
* setenv("KRB5_KTNAME", pg_krb_server_keyfile, 0); except setenv()
1063-
* not always available.
1064-
*/
1065-
if (getenv("KRB5_KTNAME")==NULL)
1063+
if (setenv("KRB5_KTNAME",pg_krb_server_keyfile,1)!=0)
10661064
{
1067-
size_tkt_len=strlen(pg_krb_server_keyfile)+14;
1068-
char*kt_path=malloc(kt_len);
1069-
1070-
if (!kt_path||
1071-
snprintf(kt_path,kt_len,"KRB5_KTNAME=%s",
1072-
pg_krb_server_keyfile)!=kt_len-2||
1073-
putenv(kt_path)!=0)
1074-
{
1075-
ereport(LOG,
1076-
(errcode(ERRCODE_OUT_OF_MEMORY),
1077-
errmsg("out of memory")));
1078-
returnSTATUS_ERROR;
1079-
}
1065+
/* The only likely failure cause is OOM, so use that errcode */
1066+
ereport(FATAL,
1067+
(errcode(ERRCODE_OUT_OF_MEMORY),
1068+
errmsg("could not set environment: %m")));
10801069
}
10811070
}
10821071

‎src/backend/libpq/be-secure-gssapi.c

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -525,8 +525,16 @@ secure_open_gssapi(Port *port)
525525
* Use the configured keytab, if there is one. Unfortunately, Heimdal
526526
* doesn't support the cred store extensions, so use the env var.
527527
*/
528-
if (pg_krb_server_keyfile!=NULL&&strlen(pg_krb_server_keyfile)>0)
529-
setenv("KRB5_KTNAME",pg_krb_server_keyfile,1);
528+
if (pg_krb_server_keyfile!=NULL&&pg_krb_server_keyfile[0]!='\0')
529+
{
530+
if (setenv("KRB5_KTNAME",pg_krb_server_keyfile,1)!=0)
531+
{
532+
/* The only likely failure cause is OOM, so use that errcode */
533+
ereport(FATAL,
534+
(errcode(ERRCODE_OUT_OF_MEMORY),
535+
errmsg("could not set environment: %m")));
536+
}
537+
}
530538

531539
while (true)
532540
{

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@
9292
#db_user_namespace = off
9393

9494
# GSSAPI using Kerberos
95-
#krb_server_keyfile = ''
95+
#krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab'
9696
#krb_caseins_users = off
9797

9898
# - SSL -

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp