database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

Lock down regression testing temporary clusters on Windows.

Browse Source 
Use SSPI authentication to allow connections exclusively from the OS
user that launched the test suite.  This closes on Windows the
vulnerability that commit be76a6d39e
closed on other platforms.  Users of "make installcheck" or custom test
harnesses can run "pg_regress --config-auth=DATADIR" to activate the
same authentication configuration that "make check" would use.
Back-patch to 9.0 (all supported versions).

Security: CVE-2014-0067
This commit is contained in:
Noah Misch
2014-12-17 22:48:40 -05:00
parent 83fffec600
commit 442dc2c358
7 changed files with 195 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
contrib/dblink/Makefile
View File

@ -10,7 +10,8 @@ EXTENSION = dblink
DATA = dblink--1.1.sql dblink--1.0--1.1.sql dblink--unpackaged--1.0.sql
REGRESS = paths dblink
REGRESS_OPTS = --dlpath=$(top_builddir)/src/test/regress
REGRESS_OPTS = --dlpath=$(top_builddir)/src/test/regress \
--create-role=dblink_regression_test
EXTRA_CLEAN = sql/paths.sql expected/paths.out
# the db name is hard-coded in the tests

2
contrib/dblink/expected/dblink.out
View File

@ -809,7 +809,6 @@ SELECT dblink_disconnect('dtest1');
(1 row)
-- test foreign data wrapper functionality
CREATE USER dblink_regression_test;
CREATE SERVER fdtest FOREIGN DATA WRAPPER dblink_fdw
OPTIONS (dbname 'contrib_regression');
CREATE USER MAPPING FOR public SERVER fdtest
@ -851,7 +850,6 @@ SELECT * FROM dblink('myconn','SELECT * FROM foo') AS t(a int, b text, c text[])
\c - :ORIGINAL_USER
REVOKE USAGE ON FOREIGN SERVER fdtest FROM dblink_regression_test;
REVOKE EXECUTE ON FUNCTION dblink_connect_u(text, text) FROM dblink_regression_test;
DROP USER dblink_regression_test;
DROP USER MAPPING FOR public SERVER fdtest;
DROP SERVER fdtest;
-- test asynchronous notifications

2
contrib/dblink/sql/dblink.sql
View File

@ -387,7 +387,6 @@ SELECT dblink_error_message('dtest1');
SELECT dblink_disconnect('dtest1');
-- test foreign data wrapper functionality
CREATE USER dblink_regression_test;
CREATE SERVER fdtest FOREIGN DATA WRAPPER dblink_fdw
OPTIONS (dbname 'contrib_regression');
CREATE USER MAPPING FOR public SERVER fdtest
@ -408,7 +407,6 @@ SELECT * FROM dblink('myconn','SELECT * FROM foo') AS t(a int, b text, c text[])
\c - :ORIGINAL_USER
REVOKE USAGE ON FOREIGN SERVER fdtest FROM dblink_regression_test;
REVOKE EXECUTE ON FUNCTION dblink_connect_u(text, text) FROM dblink_regression_test;
DROP USER dblink_regression_test;
DROP USER MAPPING FOR public SERVER fdtest;
DROP SERVER fdtest;

15
contrib/pg_upgrade/test.sh
View File

@ -17,13 +17,20 @@ set -e
unset MAKEFLAGS
unset MAKELEVEL
# Run a given "initdb" binary and overlay the regression testing
# authentication configuration.
standard_initdb() {
"$1" -N
../../src/test/regress/pg_regress --config-auth "$PGDATA"
}
# Establish how the server will listen for connections
testhost=`uname -s`
case $testhost in
MINGW*)
LISTEN_ADDRESSES="localhost"
PGHOST=""; unset PGHOST
PGHOST=localhost
;;
*)
LISTEN_ADDRESSES=""
@ -49,11 +56,11 @@ case $testhost in
trap 'rm -rf "$PGHOST"' 0
trap 'exit 3' 1 2 13 15
fi
export PGHOST
;;
esac
POSTMASTER_OPTS="-F -c listen_addresses=$LISTEN_ADDRESSES -k \"$PGHOST\""
export PGHOST
temp_root=$PWD/tmp_check
@ -141,7 +148,7 @@ export EXTRA_REGRESS_OPTS
# enable echo so the user can see what is being executed
set -x
$oldbindir/initdb -N
standard_initdb "$oldbindir"/initdb
$oldbindir/pg_ctl start -l "$logdir/postmaster1.log" -o "$POSTMASTER_OPTS" -w
if "$MAKE" -C "$oldsrc" installcheck; then
pg_dumpall -f "$temp_root"/dump1.sql || pg_dumpall1_status=$?
@ -181,7 +188,7 @@ fi
PGDATA=$BASE_PGDATA
initdb -N
standard_initdb 'initdb'
pg_upgrade $PG_UPGRADE_OPTS -d "${PGDATA}.old" -D "${PGDATA}" -b "$oldbindir" -B "$bindir" -p "$PGPORT" -P "$PGPORT"