Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit9d5a76b

Browse files
committed
Reject extraneous data after SSL or GSS encryption handshake.
The server collects up to a bufferload of data whenever it reads datafrom the client socket. When SSL or GSS encryption is requestedduring startup, any additional data received with the initialrequest message remained in the buffer, and would be treated asalready-decrypted data once the encryption handshake completed.Thus, a man-in-the-middle with the ability to inject data into theTCP connection could stuff some cleartext data into the start ofa supposedly encryption-protected database session.This could be abused to send faked SQL commands to the server,although that would only work if the server did not demand anyauthentication data. (However, a server relying on SSL certificateauthentication might well not do so.)To fix, throw a protocol-violation error if the internal bufferis not empty after the encryption handshake.Our thanks to Jacob Champion for reporting this problem.Security:CVE-2021-23214
1 parent5a75612 commit9d5a76b

File tree

3 files changed

+37
-0
lines changed

3 files changed

+37
-0
lines changed

‎src/backend/libpq/pqcomm.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1141,6 +1141,18 @@ pq_discardbytes(size_t len)
11411141
return0;
11421142
}
11431143

1144+
/* --------------------------------
1145+
*pq_buffer_has_data- is any buffered data available to read?
1146+
*
1147+
* This will *not* attempt to read more data.
1148+
* --------------------------------
1149+
*/
1150+
bool
1151+
pq_buffer_has_data(void)
1152+
{
1153+
return (PqRecvPointer<PqRecvLength);
1154+
}
1155+
11441156

11451157
/* --------------------------------
11461158
*pq_startmsgread - begin reading a message from the client.

‎src/backend/postmaster/postmaster.c

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2054,6 +2054,18 @@ ProcessStartupPacket(Port *port, bool ssl_done, bool gss_done)
20542054
returnSTATUS_ERROR;
20552055
#endif
20562056

2057+
/*
2058+
* At this point we should have no data already buffered. If we do,
2059+
* it was received before we performed the SSL handshake, so it wasn't
2060+
* encrypted and indeed may have been injected by a man-in-the-middle.
2061+
* We report this case to the client.
2062+
*/
2063+
if (pq_buffer_has_data())
2064+
ereport(FATAL,
2065+
(errcode(ERRCODE_PROTOCOL_VIOLATION),
2066+
errmsg("received unencrypted data after SSL request"),
2067+
errdetail("This could be either a client-software bug or evidence of an attempted man-in-the-middle attack.")));
2068+
20572069
/*
20582070
* regular startup packet, cancel, etc packet should follow, but not
20592071
* another SSL negotiation request, and a GSS request should only
@@ -2086,6 +2098,18 @@ ProcessStartupPacket(Port *port, bool ssl_done, bool gss_done)
20862098
returnSTATUS_ERROR;
20872099
#endif
20882100

2101+
/*
2102+
* At this point we should have no data already buffered. If we do,
2103+
* it was received before we performed the GSS handshake, so it wasn't
2104+
* encrypted and indeed may have been injected by a man-in-the-middle.
2105+
* We report this case to the client.
2106+
*/
2107+
if (pq_buffer_has_data())
2108+
ereport(FATAL,
2109+
(errcode(ERRCODE_PROTOCOL_VIOLATION),
2110+
errmsg("received unencrypted data after GSSAPI encryption request"),
2111+
errdetail("This could be either a client-software bug or evidence of an attempted man-in-the-middle attack.")));
2112+
20892113
/*
20902114
* regular startup packet, cancel, etc packet should follow, but not
20912115
* another GSS negotiation request, and an SSL request should only

‎src/include/libpq/libpq.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ extern intpq_getmessage(StringInfo s, int maxlen);
7979
externintpq_getbyte(void);
8080
externintpq_peekbyte(void);
8181
externintpq_getbyte_if_available(unsignedchar*c);
82+
externboolpq_buffer_has_data(void);
8283
externintpq_putmessage_v2(charmsgtype,constchar*s,size_tlen);
8384
externboolpq_check_connection(void);
8485

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp