database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-26 01:22:12 +03:00
Code Activity

Improve error handling of cryptohash computations

Browse Source 
The existing cryptohash facility was causing problems in some code paths
related to MD5 (frontend and backend) that relied on the fact that the
only type of error that could happen would be an OOM, as the MD5
implementation used in PostgreSQL ~13 (the in-core implementation is
used when compiling with or without OpenSSL in those older versions),
could fail only under this circumstance.

The new cryptohash facilities can fail for reasons other than OOMs, like
attempting MD5 when FIPS is enabled (upstream OpenSSL allows that up to
1.0.2, Fedora and Photon patch OpenSSL 1.1.1 to allow that), so this
would cause incorrect reports to show up.

This commit extends the cryptohash APIs so as callers of those routines
can fetch more context when an error happens, by using a new routine
called pg_cryptohash_error().  The error states are stored within each
implementation's internal context data, so as it is possible to extend
the logic depending on what's suited for an implementation.  The default
implementation requires few error states, but OpenSSL could report
various issues depending on its internal state so more is needed in
cryptohash_openssl.c, and the code is shaped so as we are always able to
grab the necessary information.

The core code is changed to adapt to the new error routine, painting
more "const" across the call stack where the static errors are stored,
particularly in authentication code paths on variables that provide
log details.  This way, any future changes would warn if attempting to
free these strings.  The MD5 authentication code was also a bit blurry
about the handling of "logdetail" (LOG sent to the postmaster), so
improve the comments related that, while on it.

The origin of the problem is 87ae969, that introduced the centralized
cryptohash facility.  Extra changes are done for pgcrypto in v14 for the
non-OpenSSL code path to cope with the improvements done by this
commit.

Reported-by: Michael Mühlbeyer
Author: Michael Paquier
Reviewed-by: Tom Lane
Discussion: https://postgr.es/m/89B7F072-5BBE-4C92-903E-D83E865D9367@trivadis.com
Backpatch-through: 14
This commit is contained in:
Michael Paquier
2022-01-11 09:55:24 +09:00
parent 05cdda68f8
commit 3a0cced86d
19 changed files with 290 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
src/backend/libpq/auth.c
View File

@ -47,7 +47,7 @@
*/
static void sendAuthRequest(Port *port, AuthRequest areq, const char *extradata,
int extralen);
static void auth_failed(Port *port, int status, char *logdetail);
static void auth_failed(Port *port, int status, const char *logdetail);
static char *recv_password_packet(Port *port);
static void set_authn_id(Port *port, const char *id);
@ -56,11 +56,11 @@ static void set_authn_id(Port *port, const char *id);
* Password-based authentication methods (password, md5, and scram-sha-256)
*----------------------------------------------------------------
*/
static int CheckPasswordAuth(Port *port, char **logdetail);
static int CheckPWChallengeAuth(Port *port, char **logdetail);
static int CheckPasswordAuth(Port *port, const char **logdetail);
static int CheckPWChallengeAuth(Port *port, const char **logdetail);
static int CheckMD5Auth(Port *port, char *shadow_pass, char **logdetail);
static int CheckSCRAMAuth(Port *port, char *shadow_pass, char **logdetail);
static int CheckMD5Auth(Port *port, char *shadow_pass, const char **logdetail);
static int CheckSCRAMAuth(Port *port, char *shadow_pass, const char **logdetail);
/*----------------------------------------------------------------
@ -258,7 +258,7 @@ ClientAuthentication_hook_type ClientAuthentication_hook = NULL;
* particular, if logdetail isn't NULL, we send that string to the log.
*/
static void
auth_failed(Port *port, int status, char *logdetail)
auth_failed(Port *port, int status, const char *logdetail)
{
const char *errstr;
char *cdetail;
@ -394,7 +394,7 @@ void
ClientAuthentication(Port *port)
{
int status = STATUS_ERROR;
char *logdetail = NULL;
const char *logdetail = NULL;
/*
* Get the authentication method to use for this frontend/database
@ -780,7 +780,7 @@ recv_password_packet(Port *port)
* Plaintext password authentication.
*/
static int
CheckPasswordAuth(Port *port, char **logdetail)
CheckPasswordAuth(Port *port, const char **logdetail)
{
char *passwd;
int result;
@ -815,7 +815,7 @@ CheckPasswordAuth(Port *port, char **logdetail)
* MD5 and SCRAM authentication.
*/
static int
CheckPWChallengeAuth(Port *port, char **logdetail)
CheckPWChallengeAuth(Port *port, const char **logdetail)
{
int auth_result;
char *shadow_pass;
@ -875,7 +875,7 @@ CheckPWChallengeAuth(Port *port, char **logdetail)
}
static int
CheckMD5Auth(Port *port, char *shadow_pass, char **logdetail)
CheckMD5Auth(Port *port, char *shadow_pass, const char **logdetail)
{
char md5Salt[4]; /* Password salt */
char *passwd;
@ -912,7 +912,7 @@ CheckMD5Auth(Port *port, char *shadow_pass, char **logdetail)
}
static int
CheckSCRAMAuth(Port *port, char *shadow_pass, char **logdetail)
CheckSCRAMAuth(Port *port, char *shadow_pass, const char **logdetail)
{
StringInfoData sasl_mechs;
int mtype;
@ -3240,6 +3240,8 @@ PerformRadiusTransaction(const char *server, const char *secret, const char *por
md5trailer = packet->vector;
for (i = 0; i < encryptedpasswordlen; i += RADIUS_VECTOR_LENGTH)
{
const char *errstr = NULL;
memcpy(cryptvector + strlen(secret), md5trailer, RADIUS_VECTOR_LENGTH);
/*
@ -3248,10 +3250,12 @@ PerformRadiusTransaction(const char *server, const char *secret, const char *por
*/
md5trailer = encryptedpassword + i;
if (!pg_md5_binary(cryptvector, strlen(secret) + RADIUS_VECTOR_LENGTH, encryptedpassword + i))
if (!pg_md5_binary(cryptvector, strlen(secret) + RADIUS_VECTOR_LENGTH,
encryptedpassword + i, &errstr))
{
ereport(LOG,
(errmsg("could not perform MD5 encryption of password")));
(errmsg("could not perform MD5 encryption of password: %s",
errstr)));
pfree(cryptvector);
pg_freeaddrinfo_all(hint.ai_family, serveraddrs);
return STATUS_ERROR;
@ -3336,6 +3340,7 @@ PerformRadiusTransaction(const char *server, const char *secret, const char *por
struct timeval timeout;
struct timeval now;
int64 timeoutval;
const char *errstr = NULL;
gettimeofday(&now, NULL);
timeoutval = (endtime.tv_sec * 1000000 + endtime.tv_usec) - (now.tv_sec * 1000000 + now.tv_usec);
@ -3454,10 +3459,11 @@ PerformRadiusTransaction(const char *server, const char *secret, const char *por
if (!pg_md5_binary(cryptvector,
packetlength + strlen(secret),
encryptedpassword))
encryptedpassword, &errstr))
{
ereport(LOG,
(errmsg("could not perform MD5 encryption of received packet")));
(errmsg("could not perform MD5 encryption of received packet: %s",
errstr)));
pfree(cryptvector);
continue;
}