database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-24 14:22:24 +03:00
Code Activity

Arrange for the authentication request type to be preserved in

Browse Source 
PGconn. Invent a new libpq connection-status function,
PQconnectionUsedPassword() that returns true if the server
demanded a password during authentication, false otherwise.
This may be useful to clients in general, but is immediately
useful to help plug a privilege escalation path in dblink.
Per list discussion and design proposed by Tom Lane.
This commit is contained in:
Joe Conway
2007-07-08 17:11:51 +00:00
parent 8c69d881ce
commit 51bc3dfe4b
6 changed files with 42 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/interfaces/libpq/exports.txt
View File

@ -1,4 +1,4 @@
# $PostgreSQL: pgsql/src/interfaces/libpq/exports.txt,v 1.15 2007/03/03 19:52:46 momjian Exp $
# $PostgreSQL: pgsql/src/interfaces/libpq/exports.txt,v 1.16 2007/07/08 17:11:51 joe Exp $
# Functions to be exported by libpq DLLs
PQconnectdb 1
PQsetdbLogin 2
@ -137,3 +137,4 @@ PQdescribePortal 134
PQsendDescribePrepared 135
PQsendDescribePortal 136
lo_truncate 137
PQconnectionUsedPassword 138

18
src/interfaces/libpq/fe-connect.c
View File

@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.345 2007/03/08 19:27:28 mha Exp $
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.346 2007/07/08 17:11:51 joe Exp $
*
*-------------------------------------------------------------------------
*/
@ -1641,6 +1641,10 @@ keep_going: /* We will come back to here until there is
return PGRES_POLLING_READING;
}
/* save the authentication request type */
if (conn->areq == AUTH_REQ_UNK)
conn->areq = areq;
/* Get the password salt if there is one. */
if (areq == AUTH_REQ_MD5)
{
@ -1873,6 +1877,7 @@ makeEmptyPGconn(void)
conn->std_strings = false; /* unless server says differently */
conn->verbosity = PQERRORS_DEFAULT;
conn->sock = -1;
conn->areq = AUTH_REQ_UNK;
#ifdef USE_SSL
conn->allow_ssl_try = true;
conn->wait_ssl_try = false;
@ -3441,6 +3446,17 @@ PQsetClientEncoding(PGconn *conn, const char *encoding)
return status;
}
bool
PQconnectionUsedPassword(const PGconn *conn)
{
if (conn->areq == AUTH_REQ_MD5 ||
conn->areq == AUTH_REQ_CRYPT ||
conn->areq == AUTH_REQ_PASSWORD)
return true;
else
return false;
}
PGVerbosity
PQsetErrorVerbosity(PGconn *conn, PGVerbosity verbosity)
{

6
src/interfaces/libpq/libpq-fe.h
View File

@ -7,7 +7,7 @@
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-fe.h,v 1.136 2007/03/03 19:52:46 momjian Exp $
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-fe.h,v 1.137 2007/07/08 17:11:51 joe Exp $
*
*-------------------------------------------------------------------------
*/
@ -23,10 +23,11 @@ extern "C"
#include <stdio.h>
/*
* postgres_ext.h defines the backend's externally visible types,
* defines the backend's externally visible types,
* such as Oid.
*/
#include "postgres_ext.h"
#include "postgres_fe.h"
/* Application-visible enum types */
@ -265,6 +266,7 @@ extern int PQsocket(const PGconn *conn);
extern int PQbackendPID(const PGconn *conn);
extern int PQclientEncoding(const PGconn *conn);
extern int PQsetClientEncoding(PGconn *conn, const char *encoding);
extern bool PQconnectionUsedPassword(const PGconn *conn);
/* Get the OpenSSL structure associated with a connection. Returns NULL for
* unencrypted connections or if any other TLS library is in use. */

3
src/interfaces/libpq/libpq-int.h
View File

@ -12,7 +12,7 @@
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.119 2007/03/03 19:52:47 momjian Exp $
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.120 2007/07/08 17:11:51 joe Exp $
*
*-------------------------------------------------------------------------
*/
@ -299,6 +299,7 @@ struct pg_conn
SockAddr raddr; /* Remote address */
ProtocolVersion pversion; /* FE/BE protocol version in use */
int sversion; /* server version, e.g. 70401 for 7.4.1 */
AuthRequest areq; /* server demanded password during auth */
/* Transient state needed while establishing connection */
struct addrinfo *addrlist; /* list of possible backend addresses */