Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitd1bd267

Browse files
committed
Reject extraneous data after SSL or GSS encryption handshake.
The server collects up to a bufferload of data whenever it reads datafrom the client socket. When SSL or GSS encryption is requestedduring startup, any additional data received with the initialrequest message remained in the buffer, and would be treated asalready-decrypted data once the encryption handshake completed.Thus, a man-in-the-middle with the ability to inject data into theTCP connection could stuff some cleartext data into the start ofa supposedly encryption-protected database session.This could be abused to send faked SQL commands to the server,although that would only work if the server did not demand anyauthentication data. (However, a server relying on SSL certificateauthentication might well not do so.)To fix, throw a protocol-violation error if the internal bufferis not empty after the encryption handshake.Our thanks to Jacob Champion for reporting this problem.Security:CVE-2021-23214
1 parentf914b8b commitd1bd267

File tree

3 files changed

+39
-0
lines changed

3 files changed

+39
-0
lines changed

‎src/backend/libpq/pqcomm.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1197,6 +1197,18 @@ pq_getstring(StringInfo s)
11971197
}
11981198
}
11991199

1200+
/* --------------------------------
1201+
*pq_buffer_has_data- is any buffered data available to read?
1202+
*
1203+
* This will *not* attempt to read more data.
1204+
* --------------------------------
1205+
*/
1206+
bool
1207+
pq_buffer_has_data(void)
1208+
{
1209+
return (PqRecvPointer<PqRecvLength);
1210+
}
1211+
12001212

12011213
/* --------------------------------
12021214
*pq_startmsgread - begin reading a message from the client.

‎src/backend/postmaster/postmaster.c

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2034,6 +2034,19 @@ ProcessStartupPacket(Port *port, bool ssl_done, bool gss_done)
20342034
if (SSLok=='S'&&secure_open_server(port)==-1)
20352035
returnSTATUS_ERROR;
20362036
#endif
2037+
2038+
/*
2039+
* At this point we should have no data already buffered. If we do,
2040+
* it was received before we performed the SSL handshake, so it wasn't
2041+
* encrypted and indeed may have been injected by a man-in-the-middle.
2042+
* We report this case to the client.
2043+
*/
2044+
if (pq_buffer_has_data())
2045+
ereport(FATAL,
2046+
(errcode(ERRCODE_PROTOCOL_VIOLATION),
2047+
errmsg("received unencrypted data after SSL request"),
2048+
errdetail("This could be either a client-software bug or evidence of an attempted man-in-the-middle attack.")));
2049+
20372050
/*
20382051
* regular startup packet, cancel, etc packet should follow, but not
20392052
* another SSL negotiation request, and a GSS request should only
@@ -2065,6 +2078,19 @@ ProcessStartupPacket(Port *port, bool ssl_done, bool gss_done)
20652078
if (GSSok=='G'&&secure_open_gssapi(port)==-1)
20662079
returnSTATUS_ERROR;
20672080
#endif
2081+
2082+
/*
2083+
* At this point we should have no data already buffered. If we do,
2084+
* it was received before we performed the GSS handshake, so it wasn't
2085+
* encrypted and indeed may have been injected by a man-in-the-middle.
2086+
* We report this case to the client.
2087+
*/
2088+
if (pq_buffer_has_data())
2089+
ereport(FATAL,
2090+
(errcode(ERRCODE_PROTOCOL_VIOLATION),
2091+
errmsg("received unencrypted data after GSSAPI encryption request"),
2092+
errdetail("This could be either a client-software bug or evidence of an attempted man-in-the-middle attack.")));
2093+
20682094
/*
20692095
* regular startup packet, cancel, etc packet should follow, but not
20702096
* another GSS negotiation request, and an SSL request should only

‎src/include/libpq/libpq.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ extern intpq_getmessage(StringInfo s, int maxlen);
7272
externintpq_getbyte(void);
7373
externintpq_peekbyte(void);
7474
externintpq_getbyte_if_available(unsignedchar*c);
75+
externboolpq_buffer_has_data(void);
7576
externintpq_putbytes(constchar*s,size_tlen);
7677

7778
/*

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp