Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit81e7708

Browse files
committed
Since GSSAPI and SSPI authentication don't work in protocol version 2,
issue a helpful error message instead of sending unparsable garbage.(It is clearly a design error that this doesn't work, but fixing itis not worth the trouble at this point.) Per discussion.
1 parent9b43c24 commit81e7708

File tree

1 file changed

+44
-6
lines changed

1 file changed

+44
-6
lines changed

‎src/backend/libpq/auth.c

Lines changed: 44 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.163 2008/01/30 04:11:19 tgl Exp $
11+
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.164 2008/02/08 17:58:46 tgl Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -307,12 +307,13 @@ pg_krb5_recvauth(Port *port)
307307
}
308308
#endif/* KRB5 */
309309

310-
#ifdefENABLE_GSS
311310
/*----------------------------------------------------------------
312311
* GSSAPI authentication system
313312
*----------------------------------------------------------------
314313
*/
315314

315+
#ifdefENABLE_GSS
316+
316317
#if defined(HAVE_GSSAPI_H)
317318
#include<gssapi.h>
318319
#else
@@ -389,6 +390,19 @@ pg_GSS_recvauth(Port *port)
389390
StringInfoDatabuf;
390391
gss_buffer_descgbuf;
391392

393+
/*
394+
* GSS auth is not supported for protocol versions before 3, because it
395+
* relies on the overall message length word to determine the GSS payload
396+
* size in AuthenticationGSSContinue and PasswordMessage messages.
397+
* (This is, in fact, a design error in our GSS support, because protocol
398+
* messages are supposed to be parsable without relying on the length
399+
* word; but it's not worth changing it now.)
400+
*/
401+
if (PG_PROTOCOL_MAJOR(FrontendProtocol)<3)
402+
ereport(FATAL,
403+
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
404+
errmsg("GSSAPI is not supported in protocol version 2")));
405+
392406
if (pg_krb_server_keyfile&&strlen(pg_krb_server_keyfile)>0)
393407
{
394408
/*
@@ -594,7 +608,9 @@ pg_GSS_recvauth(Port *port)
594608

595609
returnSTATUS_OK;
596610
}
611+
597612
#else/* no ENABLE_GSS */
613+
598614
staticint
599615
pg_GSS_recvauth(Port*port)
600616
{
@@ -603,9 +619,20 @@ pg_GSS_recvauth(Port *port)
603619
errmsg("GSSAPI not implemented on this server")));
604620
returnSTATUS_ERROR;
605621
}
622+
606623
#endif/* ENABLE_GSS */
607624

625+
/*----------------------------------------------------------------
626+
* SSPI authentication system
627+
*----------------------------------------------------------------
628+
*/
629+
608630
#ifdefENABLE_SSPI
631+
632+
typedefSECURITY_STATUS
633+
(WINAPI*QUERY_SECURITY_CONTEXT_TOKEN_FN) (
634+
PCtxtHandle,void**);
635+
609636
staticvoid
610637
pg_SSPI_error(intseverity,char*errmsg,SECURITY_STATUSr)
611638
{
@@ -621,10 +648,6 @@ pg_SSPI_error(int severity, char *errmsg, SECURITY_STATUS r)
621648
errdetail("%s (%x)",sysmsg, (unsignedint)r)));
622649
}
623650

624-
typedefSECURITY_STATUS
625-
(WINAPI*QUERY_SECURITY_CONTEXT_TOKEN_FN) (
626-
PCtxtHandle,void**);
627-
628651
staticint
629652
pg_SSPI_recvauth(Port*port)
630653
{
@@ -651,6 +674,18 @@ pg_SSPI_recvauth(Port *port)
651674
HMODULEsecur32;
652675
QUERY_SECURITY_CONTEXT_TOKEN_FN_QuerySecurityContextToken;
653676

677+
/*
678+
* SSPI auth is not supported for protocol versions before 3, because it
679+
* relies on the overall message length word to determine the SSPI payload
680+
* size in AuthenticationGSSContinue and PasswordMessage messages.
681+
* (This is, in fact, a design error in our SSPI support, because protocol
682+
* messages are supposed to be parsable without relying on the length
683+
* word; but it's not worth changing it now.)
684+
*/
685+
if (PG_PROTOCOL_MAJOR(FrontendProtocol)<3)
686+
ereport(FATAL,
687+
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
688+
errmsg("SSPI is not supported in protocol version 2")));
654689

655690
/*
656691
* Acquire a handle to the server credentials.
@@ -878,7 +913,9 @@ pg_SSPI_recvauth(Port *port)
878913

879914
returnSTATUS_OK;
880915
}
916+
881917
#else/* no ENABLE_SSPI */
918+
882919
staticint
883920
pg_SSPI_recvauth(Port*port)
884921
{
@@ -887,6 +924,7 @@ pg_SSPI_recvauth(Port *port)
887924
errmsg("SSPI not implemented on this server")));
888925
returnSTATUS_ERROR;
889926
}
927+
890928
#endif/* ENABLE_SSPI */
891929

892930

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp