Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitbf723a2

Browse files
committed
Forbid gen_random_uuid() with --disable-strong-random
Previously, gen_random_uuid() would fall back to a weak random numbergenerator, unlike gen_random_bytes() which would just fail. And this wasnot made very clear in the docs. For consistency, also makegen_random_uuid() fail outright, if compiled with --disable-strong-random.Re-word the error message you get with --disable-strong-random. It is alsoused by pgp functions that require random salts, and now alsogen_random_uuid().Reported by Radek Slupik.Discussion:https://www.postgresql.org/message-id/20170101232054.10135.50528@wrigleys.postgresql.org
1 parent6476752 commitbf723a2

File tree

6 files changed

+41
-41
lines changed

6 files changed

+41
-41
lines changed

‎contrib/pgcrypto/expected/pgp-compression_1.out

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,26 +17,26 @@ DMcmR53SXfLoDJOv/M8uKj3QSq7oWNIp95pxfA==
1717
select pgp_sym_decrypt(
1818
pgp_sym_encrypt('Secret message', 'key', 'compress-algo=0'),
1919
'key', 'expect-compress-algo=0');
20-
ERROR:pg_random_bytes() is not supported by this build
20+
ERROR:generating random data is not supported by this build
2121
DETAIL: This functionality requires a source of strong random numbers
2222
HINT: You need to rebuild PostgreSQL using --enable-strong-random
2323
select pgp_sym_decrypt(
2424
pgp_sym_encrypt('Secret message', 'key', 'compress-algo=1'),
2525
'key', 'expect-compress-algo=1');
26-
ERROR:pg_random_bytes() is not supported by this build
26+
ERROR:generating random data is not supported by this build
2727
DETAIL: This functionality requires a source of strong random numbers
2828
HINT: You need to rebuild PostgreSQL using --enable-strong-random
2929
select pgp_sym_decrypt(
3030
pgp_sym_encrypt('Secret message', 'key', 'compress-algo=2'),
3131
'key', 'expect-compress-algo=2');
32-
ERROR:pg_random_bytes() is not supported by this build
32+
ERROR:generating random data is not supported by this build
3333
DETAIL: This functionality requires a source of strong random numbers
3434
HINT: You need to rebuild PostgreSQL using --enable-strong-random
3535
-- level=0 should turn compression off
3636
select pgp_sym_decrypt(
3737
pgp_sym_encrypt('Secret message', 'key',
3838
'compress-algo=2, compress-level=0'),
3939
'key', 'expect-compress-algo=0');
40-
ERROR:pg_random_bytes() is not supported by this build
40+
ERROR:generating random data is not supported by this build
4141
DETAIL: This functionality requires a source of strong random numbers
4242
HINT: You need to rebuild PostgreSQL using --enable-strong-random

‎contrib/pgcrypto/expected/pgp-decrypt_1.out

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -366,7 +366,7 @@ a3nsOzKTXUfS9VyaXo8IrncM6n7fdaXpwba/3tNsAhJG4lDv1k4g9v8Ix2dfv6Rs
366366
-- expected: 7efefcab38467f7484d6fa43dc86cf5281bd78e2
367367
-- check BUG #11905, problem with messages 6 less than a power of 2.
368368
select pgp_sym_decrypt(pgp_sym_encrypt(repeat('x',65530),'1'),'1') = repeat('x',65530);
369-
ERROR:pg_random_bytes() is not supported by this build
369+
ERROR:generating random data is not supported by this build
370370
DETAIL: This functionality requires a source of strong random numbers
371371
HINT: You need to rebuild PostgreSQL using --enable-strong-random
372372
-- expected: true
@@ -389,7 +389,7 @@ NOTICE: dbg: mdcbuf_finish: bad MDC pkt hdr
389389
ERROR: Wrong key or corrupt data
390390
-- Routine text/binary mismatch.
391391
select pgp_sym_decrypt(pgp_sym_encrypt_bytea('P', 'key'), 'key', 'debug=1');
392-
ERROR:pg_random_bytes() is not supported by this build
392+
ERROR:generating random data is not supported by this build
393393
DETAIL: This functionality requires a source of strong random numbers
394394
HINT: You need to rebuild PostgreSQL using --enable-strong-random
395395
-- Decryption with a certain incorrect key yields an apparent BZip2-compressed

‎contrib/pgcrypto/expected/pgp-encrypt_1.out

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
-- ensure consistent test output regardless of the default bytea format
55
SET bytea_output TO escape;
66
select pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key'), 'key');
7-
ERROR:pg_random_bytes() is not supported by this build
7+
ERROR:generating random data is not supported by this build
88
DETAIL: This functionality requires a source of strong random numbers
99
HINT: You need to rebuild PostgreSQL using --enable-strong-random
1010
-- check whether the defaults are ok
@@ -16,7 +16,7 @@ select pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key'),
1616
expect-s2k-digest-algo=sha1,
1717
expect-compress-algo=0
1818
');
19-
ERROR:pg_random_bytes() is not supported by this build
19+
ERROR:generating random data is not supported by this build
2020
DETAIL: This functionality requires a source of strong random numbers
2121
HINT: You need to rebuild PostgreSQL using --enable-strong-random
2222
-- maybe the expect- stuff simply does not work
@@ -28,134 +28,134 @@ select pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key'),
2828
expect-s2k-digest-algo=md5,
2929
expect-compress-algo=1
3030
');
31-
ERROR:pg_random_bytes() is not supported by this build
31+
ERROR:generating random data is not supported by this build
3232
DETAIL: This functionality requires a source of strong random numbers
3333
HINT: You need to rebuild PostgreSQL using --enable-strong-random
3434
-- bytea as text
3535
select pgp_sym_decrypt(pgp_sym_encrypt_bytea('Binary', 'baz'), 'baz');
36-
ERROR:pg_random_bytes() is not supported by this build
36+
ERROR:generating random data is not supported by this build
3737
DETAIL: This functionality requires a source of strong random numbers
3838
HINT: You need to rebuild PostgreSQL using --enable-strong-random
3939
-- text as bytea
4040
select pgp_sym_decrypt_bytea(pgp_sym_encrypt('Text', 'baz'), 'baz');
41-
ERROR:pg_random_bytes() is not supported by this build
41+
ERROR:generating random data is not supported by this build
4242
DETAIL: This functionality requires a source of strong random numbers
4343
HINT: You need to rebuild PostgreSQL using --enable-strong-random
4444
-- algorithm change
4545
select pgp_sym_decrypt(
4646
pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=bf'),
4747
'key', 'expect-cipher-algo=bf');
48-
ERROR:pg_random_bytes() is not supported by this build
48+
ERROR:generating random data is not supported by this build
4949
DETAIL: This functionality requires a source of strong random numbers
5050
HINT: You need to rebuild PostgreSQL using --enable-strong-random
5151
select pgp_sym_decrypt(
5252
pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=aes'),
5353
'key', 'expect-cipher-algo=aes128');
54-
ERROR:pg_random_bytes() is not supported by this build
54+
ERROR:generating random data is not supported by this build
5555
DETAIL: This functionality requires a source of strong random numbers
5656
HINT: You need to rebuild PostgreSQL using --enable-strong-random
5757
select pgp_sym_decrypt(
5858
pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=aes192'),
5959
'key', 'expect-cipher-algo=aes192');
60-
ERROR:pg_random_bytes() is not supported by this build
60+
ERROR:generating random data is not supported by this build
6161
DETAIL: This functionality requires a source of strong random numbers
6262
HINT: You need to rebuild PostgreSQL using --enable-strong-random
6363
-- s2k change
6464
select pgp_sym_decrypt(
6565
pgp_sym_encrypt('Secret.', 'key', 's2k-mode=0'),
6666
'key', 'expect-s2k-mode=0');
67-
ERROR:pg_random_bytes() is not supported by this build
67+
ERROR:generating random data is not supported by this build
6868
DETAIL: This functionality requires a source of strong random numbers
6969
HINT: You need to rebuild PostgreSQL using --enable-strong-random
7070
select pgp_sym_decrypt(
7171
pgp_sym_encrypt('Secret.', 'key', 's2k-mode=1'),
7272
'key', 'expect-s2k-mode=1');
73-
ERROR:pg_random_bytes() is not supported by this build
73+
ERROR:generating random data is not supported by this build
7474
DETAIL: This functionality requires a source of strong random numbers
7575
HINT: You need to rebuild PostgreSQL using --enable-strong-random
7676
select pgp_sym_decrypt(
7777
pgp_sym_encrypt('Secret.', 'key', 's2k-mode=3'),
7878
'key', 'expect-s2k-mode=3');
79-
ERROR:pg_random_bytes() is not supported by this build
79+
ERROR:generating random data is not supported by this build
8080
DETAIL: This functionality requires a source of strong random numbers
8181
HINT: You need to rebuild PostgreSQL using --enable-strong-random
8282
-- s2k count change
8383
select pgp_sym_decrypt(
8484
pgp_sym_encrypt('Secret.', 'key', 's2k-count=1024'),
8585
'key', 'expect-s2k-count=1024');
86-
ERROR:pg_random_bytes() is not supported by this build
86+
ERROR:generating random data is not supported by this build
8787
DETAIL: This functionality requires a source of strong random numbers
8888
HINT: You need to rebuild PostgreSQL using --enable-strong-random
8989
-- s2k_count rounds up
9090
select pgp_sym_decrypt(
9191
pgp_sym_encrypt('Secret.', 'key', 's2k-count=65000000'),
9292
'key', 'expect-s2k-count=65000000');
93-
ERROR:pg_random_bytes() is not supported by this build
93+
ERROR:generating random data is not supported by this build
9494
DETAIL: This functionality requires a source of strong random numbers
9595
HINT: You need to rebuild PostgreSQL using --enable-strong-random
9696
-- s2k digest change
9797
select pgp_sym_decrypt(
9898
pgp_sym_encrypt('Secret.', 'key', 's2k-digest-algo=md5'),
9999
'key', 'expect-s2k-digest-algo=md5');
100-
ERROR:pg_random_bytes() is not supported by this build
100+
ERROR:generating random data is not supported by this build
101101
DETAIL: This functionality requires a source of strong random numbers
102102
HINT: You need to rebuild PostgreSQL using --enable-strong-random
103103
select pgp_sym_decrypt(
104104
pgp_sym_encrypt('Secret.', 'key', 's2k-digest-algo=sha1'),
105105
'key', 'expect-s2k-digest-algo=sha1');
106-
ERROR:pg_random_bytes() is not supported by this build
106+
ERROR:generating random data is not supported by this build
107107
DETAIL: This functionality requires a source of strong random numbers
108108
HINT: You need to rebuild PostgreSQL using --enable-strong-random
109109
-- sess key
110110
select pgp_sym_decrypt(
111111
pgp_sym_encrypt('Secret.', 'key', 'sess-key=0'),
112112
'key', 'expect-sess-key=0');
113-
ERROR:pg_random_bytes() is not supported by this build
113+
ERROR:generating random data is not supported by this build
114114
DETAIL: This functionality requires a source of strong random numbers
115115
HINT: You need to rebuild PostgreSQL using --enable-strong-random
116116
select pgp_sym_decrypt(
117117
pgp_sym_encrypt('Secret.', 'key', 'sess-key=1'),
118118
'key', 'expect-sess-key=1');
119-
ERROR:pg_random_bytes() is not supported by this build
119+
ERROR:generating random data is not supported by this build
120120
DETAIL: This functionality requires a source of strong random numbers
121121
HINT: You need to rebuild PostgreSQL using --enable-strong-random
122122
select pgp_sym_decrypt(
123123
pgp_sym_encrypt('Secret.', 'key', 'sess-key=1, cipher-algo=bf'),
124124
'key', 'expect-sess-key=1, expect-cipher-algo=bf');
125-
ERROR:pg_random_bytes() is not supported by this build
125+
ERROR:generating random data is not supported by this build
126126
DETAIL: This functionality requires a source of strong random numbers
127127
HINT: You need to rebuild PostgreSQL using --enable-strong-random
128128
select pgp_sym_decrypt(
129129
pgp_sym_encrypt('Secret.', 'key', 'sess-key=1, cipher-algo=aes192'),
130130
'key', 'expect-sess-key=1, expect-cipher-algo=aes192');
131-
ERROR:pg_random_bytes() is not supported by this build
131+
ERROR:generating random data is not supported by this build
132132
DETAIL: This functionality requires a source of strong random numbers
133133
HINT: You need to rebuild PostgreSQL using --enable-strong-random
134134
select pgp_sym_decrypt(
135135
pgp_sym_encrypt('Secret.', 'key', 'sess-key=1, cipher-algo=aes256'),
136136
'key', 'expect-sess-key=1, expect-cipher-algo=aes256');
137-
ERROR:pg_random_bytes() is not supported by this build
137+
ERROR:generating random data is not supported by this build
138138
DETAIL: This functionality requires a source of strong random numbers
139139
HINT: You need to rebuild PostgreSQL using --enable-strong-random
140140
-- no mdc
141141
select pgp_sym_decrypt(
142142
pgp_sym_encrypt('Secret.', 'key', 'disable-mdc=1'),
143143
'key', 'expect-disable-mdc=1');
144-
ERROR:pg_random_bytes() is not supported by this build
144+
ERROR:generating random data is not supported by this build
145145
DETAIL: This functionality requires a source of strong random numbers
146146
HINT: You need to rebuild PostgreSQL using --enable-strong-random
147147
-- crlf
148148
select encode(pgp_sym_decrypt_bytea(
149149
pgp_sym_encrypt(E'1\n2\n3\r\n', 'key', 'convert-crlf=1'),
150150
'key'), 'hex');
151-
ERROR:pg_random_bytes() is not supported by this build
151+
ERROR:generating random data is not supported by this build
152152
DETAIL: This functionality requires a source of strong random numbers
153153
HINT: You need to rebuild PostgreSQL using --enable-strong-random
154154
-- conversion should be lossless
155155
select encode(digest(pgp_sym_decrypt(
156156
pgp_sym_encrypt(E'\r\n0\n1\r\r\n\n2\r', 'key', 'convert-crlf=1'),
157157
'key', 'convert-crlf=1'), 'sha1'), 'hex') as result,
158158
encode(digest(E'\r\n0\n1\r\r\n\n2\r', 'sha1'), 'hex') as expect;
159-
ERROR:pg_random_bytes() is not supported by this build
159+
ERROR:generating random data is not supported by this build
160160
DETAIL: This functionality requires a source of strong random numbers
161161
HINT: You need to rebuild PostgreSQL using --enable-strong-random

‎contrib/pgcrypto/expected/pgp-pubkey-encrypt_1.out

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,28 +8,28 @@ select pgp_pub_decrypt(
88
pgp_pub_encrypt('Secret msg', dearmor(pubkey)),
99
dearmor(seckey))
1010
from keytbl where keytbl.id=1;
11-
ERROR:pg_random_bytes() is not supported by this build
11+
ERROR:generating random data is not supported by this build
1212
DETAIL: This functionality requires a source of strong random numbers
1313
HINT: You need to rebuild PostgreSQL using --enable-strong-random
1414
select pgp_pub_decrypt(
1515
pgp_pub_encrypt('Secret msg', dearmor(pubkey)),
1616
dearmor(seckey))
1717
from keytbl where keytbl.id=2;
18-
ERROR:pg_random_bytes() is not supported by this build
18+
ERROR:generating random data is not supported by this build
1919
DETAIL: This functionality requires a source of strong random numbers
2020
HINT: You need to rebuild PostgreSQL using --enable-strong-random
2121
select pgp_pub_decrypt(
2222
pgp_pub_encrypt('Secret msg', dearmor(pubkey)),
2323
dearmor(seckey))
2424
from keytbl where keytbl.id=3;
25-
ERROR:pg_random_bytes() is not supported by this build
25+
ERROR:generating random data is not supported by this build
2626
DETAIL: This functionality requires a source of strong random numbers
2727
HINT: You need to rebuild PostgreSQL using --enable-strong-random
2828
select pgp_pub_decrypt(
2929
pgp_pub_encrypt('Secret msg', dearmor(pubkey)),
3030
dearmor(seckey))
3131
from keytbl where keytbl.id=6;
32-
ERROR:pg_random_bytes() is not supported by this build
32+
ERROR:generating random data is not supported by this build
3333
DETAIL: This functionality requires a source of strong random numbers
3434
HINT: You need to rebuild PostgreSQL using --enable-strong-random
3535
-- try with rsa-sign only
@@ -49,14 +49,14 @@ select pgp_pub_decrypt_bytea(
4949
pgp_pub_encrypt('Secret msg', dearmor(pubkey)),
5050
dearmor(seckey))
5151
from keytbl where keytbl.id=1;
52-
ERROR:pg_random_bytes() is not supported by this build
52+
ERROR:generating random data is not supported by this build
5353
DETAIL: This functionality requires a source of strong random numbers
5454
HINT: You need to rebuild PostgreSQL using --enable-strong-random
5555
-- and bytea-to-text?
5656
select pgp_pub_decrypt(
5757
pgp_pub_encrypt_bytea('Secret msg', dearmor(pubkey)),
5858
dearmor(seckey))
5959
from keytbl where keytbl.id=1;
60-
ERROR:pg_random_bytes() is not supported by this build
60+
ERROR:generating random data is not supported by this build
6161
DETAIL: This functionality requires a source of strong random numbers
6262
HINT: You need to rebuild PostgreSQL using --enable-strong-random

‎contrib/pgcrypto/pgcrypto.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -451,13 +451,10 @@ PG_FUNCTION_INFO_V1(pg_random_uuid);
451451
Datum
452452
pg_random_uuid(PG_FUNCTION_ARGS)
453453
{
454+
#ifdefHAVE_STRONG_RANDOM
454455
uint8*buf= (uint8*)palloc(UUID_LEN);
455456

456-
/*
457-
* Generate random bits. pg_backend_random() will do here, we don't promis
458-
* UUIDs to be cryptographically random, when built with
459-
* --disable-strong-random.
460-
*/
457+
/* Generate random bits. */
461458
if (!pg_backend_random((char*)buf,UUID_LEN))
462459
px_THROW_ERROR(PXE_NO_RANDOM);
463460

@@ -469,6 +466,9 @@ pg_random_uuid(PG_FUNCTION_ARGS)
469466
buf[8]= (buf[8]&0x3f) |0x80;/* "variant" field */
470467

471468
PG_RETURN_UUID_P((pg_uuid_t*)buf);
469+
#else
470+
px_THROW_ERROR(PXE_NO_RANDOM);
471+
#endif
472472
}
473473

474474
staticvoid*

‎contrib/pgcrypto/px.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ px_THROW_ERROR(int err)
104104
#else
105105
ereport(ERROR,
106106
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
107-
errmsg("pg_random_bytes() is not supported by this build"),
107+
errmsg("generating random data is not supported by this build"),
108108
errdetail("This functionality requires a source of strong random numbers"),
109109
errhint("You need to rebuild PostgreSQL using --enable-strong-random")));
110110
#endif

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp