1
0
mirror of https://github.com/postgres/postgres.git synced 2025-06-27 23:21:58 +03:00
Files
postgres/contrib/pg_upgrade/server.c
Noah Misch e8f4922c86 Obstruct shell, SQL, and conninfo injection via database and role names.
Due to simplistic quoting and confusion of database names with conninfo
strings, roles with the CREATEDB or CREATEROLE option could escalate to
superuser privileges when a superuser next ran certain maintenance
commands.  The new coding rule for PQconnectdbParams() calls, documented
at conninfo_array_parse(), is to pass expand_dbname=true and wrap
literal database names in a trivial connection string.  Escape
zero-length values in appendConnStrVal().  Back-patch to 9.1 (all
supported versions).

Nathan Bossart, Michael Paquier, and Noah Misch.  Reviewed by Peter
Eisentraut.  Reported by Nathan Bossart.

Security: CVE-2016-5424
2016-08-08 10:07:53 -04:00

330 lines
8.4 KiB
C

/*
* server.c
*
* database server functions
*
* Copyright (c) 2010-2012, PostgreSQL Global Development Group
* contrib/pg_upgrade/server.c
*/
#include "postgres.h"
#include "pg_upgrade.h"
static PGconn *get_db_conn(ClusterInfo *cluster, const char *db_name);
/*
* connectToServer()
*
* Connects to the desired database on the designated server.
* If the connection attempt fails, this function logs an error
* message and calls exit() to kill the program.
*/
PGconn *
connectToServer(ClusterInfo *cluster, const char *db_name)
{
PGconn *conn = get_db_conn(cluster, db_name);
if (conn == NULL || PQstatus(conn) != CONNECTION_OK)
{
pg_log(PG_REPORT, "connection to database failed: %s\n",
PQerrorMessage(conn));
if (conn)
PQfinish(conn);
printf("Failure, exiting\n");
exit(1);
}
return conn;
}
/*
* get_db_conn()
*
* get database connection, using named database + standard params for cluster
*/
static PGconn *
get_db_conn(ClusterInfo *cluster, const char *db_name)
{
PQExpBufferData conn_opts;
PGconn *conn;
/* Build connection string with proper quoting */
initPQExpBuffer(&conn_opts);
appendPQExpBufferStr(&conn_opts, "dbname=");
appendConnStrVal(&conn_opts, db_name);
appendPQExpBufferStr(&conn_opts, " user=");
appendConnStrVal(&conn_opts, os_info.user);
appendPQExpBuffer(&conn_opts, " port=%d", cluster->port);
if (cluster->sockdir)
{
appendPQExpBufferStr(&conn_opts, " host=");
appendConnStrVal(&conn_opts, cluster->sockdir);
}
conn = PQconnectdb(conn_opts.data);
termPQExpBuffer(&conn_opts);
return conn;
}
/*
* cluster_conn_opts()
*
* Return standard command-line options for connecting to this cluster when
* using psql, pg_dump, etc. Ideally this would match what get_db_conn()
* sets, but the utilities we need aren't very consistent about the treatment
* of database name options, so we leave that out.
*
* Result is valid until the next call to this function.
*/
char *
cluster_conn_opts(ClusterInfo *cluster)
{
static PQExpBuffer buf;
if (buf == NULL)
buf = createPQExpBuffer();
else
resetPQExpBuffer(buf);
if (cluster->sockdir)
{
appendPQExpBufferStr(buf, "--host ");
appendShellString(buf, cluster->sockdir);
appendPQExpBufferChar(buf, ' ');
}
appendPQExpBuffer(buf, "--port %d --username ", cluster->port);
appendShellString(buf, os_info.user);
return buf->data;
}
/*
* executeQueryOrDie()
*
* Formats a query string from the given arguments and executes the
* resulting query. If the query fails, this function logs an error
* message and calls exit() to kill the program.
*/
PGresult *
executeQueryOrDie(PGconn *conn, const char *fmt,...)
{
static char command[8192];
va_list args;
PGresult *result;
ExecStatusType status;
va_start(args, fmt);
vsnprintf(command, sizeof(command), fmt, args);
va_end(args);
pg_log(PG_VERBOSE, "executing: %s\n", command);
result = PQexec(conn, command);
status = PQresultStatus(result);
if ((status != PGRES_TUPLES_OK) && (status != PGRES_COMMAND_OK))
{
pg_log(PG_REPORT, "SQL command failed\n%s\n%s\n", command,
PQerrorMessage(conn));
PQclear(result);
PQfinish(conn);
printf("Failure, exiting\n");
exit(1);
}
else
return result;
}
/*
* get_major_server_version()
*
* gets the version (in unsigned int form) for the given datadir. Assumes
* that datadir is an absolute path to a valid pgdata directory. The version
* is retrieved by reading the PG_VERSION file.
*/
uint32
get_major_server_version(ClusterInfo *cluster)
{
FILE *version_fd;
char ver_filename[MAXPGPATH];
int integer_version = 0;
int fractional_version = 0;
snprintf(ver_filename, sizeof(ver_filename), "%s/PG_VERSION",
cluster->pgdata);
if ((version_fd = fopen(ver_filename, "r")) == NULL)
pg_log(PG_FATAL, "could not open version file: %s\n", ver_filename);
if (fscanf(version_fd, "%63s", cluster->major_version_str) == 0 ||
sscanf(cluster->major_version_str, "%d.%d", &integer_version,
&fractional_version) != 2)
pg_log(PG_FATAL, "could not get version from %s\n", cluster->pgdata);
fclose(version_fd);
return (100 * integer_version + fractional_version) * 100;
}
static void
stop_postmaster_atexit(void)
{
stop_postmaster(true);
}
void
start_postmaster(ClusterInfo *cluster)
{
char cmd[MAXPGPATH * 4 + 1000];
PGconn *conn;
bool pg_ctl_return = false;
char socket_string[MAXPGPATH + 200];
static bool exit_hook_registered = false;
if (!exit_hook_registered)
{
atexit(stop_postmaster_atexit);
exit_hook_registered = true;
}
socket_string[0] = '\0';
#ifdef HAVE_UNIX_SOCKETS
/* prevent TCP/IP connections, restrict socket access */
strcat(socket_string,
" -c listen_addresses='' -c unix_socket_permissions=0700");
/* Have a sockdir? Tell the postmaster. */
if (cluster->sockdir)
snprintf(socket_string + strlen(socket_string),
sizeof(socket_string) - strlen(socket_string),
" -c %s='%s'",
(GET_MAJOR_VERSION(cluster->major_version) < 903) ?
"unix_socket_directory" : "unix_socket_directories",
cluster->sockdir);
#endif
/*
* Using autovacuum=off disables cleanup vacuum and analyze, but freeze
* vacuums can still happen, so we set autovacuum_freeze_max_age to its
* maximum. We assume all datfrozenxid and relfrozen values are less than
* a gap of 2000000000 from the current xid counter, so autovacuum will
* not touch them.
*
* synchronous_commit=off improves object creation speed, and we only
* modify the new cluster, so only use it there. If there is a crash,
* the new cluster has to be recreated anyway.
*/
snprintf(cmd, sizeof(cmd),
"\"%s/pg_ctl\" -w -l \"%s\" -D \"%s\" -o \"-p %d%s%s %s%s\" start",
cluster->bindir, SERVER_LOG_FILE, cluster->pgconfig, cluster->port,
(cluster->controldata.cat_ver >=
BINARY_UPGRADE_SERVER_FLAG_CAT_VER) ? " -b" :
" -c autovacuum=off -c autovacuum_freeze_max_age=2000000000",
(cluster == &new_cluster) ? " -c synchronous_commit=off" : "",
cluster->pgopts ? cluster->pgopts : "", socket_string);
/*
* Don't throw an error right away, let connecting throw the error because
* it might supply a reason for the failure.
*/
pg_ctl_return = exec_prog(SERVER_START_LOG_FILE,
/* pass both file names if they differ */
(strcmp(SERVER_LOG_FILE,
SERVER_START_LOG_FILE) != 0) ?
SERVER_LOG_FILE : NULL,
false,
"%s", cmd);
/* Check to see if we can connect to the server; if not, report it. */
if ((conn = get_db_conn(cluster, "template1")) == NULL ||
PQstatus(conn) != CONNECTION_OK)
{
pg_log(PG_REPORT, "\nconnection to database failed: %s\n",
PQerrorMessage(conn));
if (conn)
PQfinish(conn);
pg_log(PG_FATAL, "could not connect to %s postmaster started with the command:\n"
"%s\n",
CLUSTER_NAME(cluster), cmd);
}
PQfinish(conn);
/* If the connection didn't fail, fail now */
if (!pg_ctl_return)
pg_log(PG_FATAL, "pg_ctl failed to start the %s server, or connection failed\n",
CLUSTER_NAME(cluster));
os_info.running_cluster = cluster;
}
void
stop_postmaster(bool fast)
{
ClusterInfo *cluster;
if (os_info.running_cluster == &old_cluster)
cluster = &old_cluster;
else if (os_info.running_cluster == &new_cluster)
cluster = &new_cluster;
else
return; /* no cluster running */
exec_prog(SERVER_STOP_LOG_FILE, NULL, !fast,
"\"%s/pg_ctl\" -w -D \"%s\" -o \"%s\" %s stop",
cluster->bindir, cluster->pgconfig,
cluster->pgopts ? cluster->pgopts : "",
fast ? "-m fast" : "");
os_info.running_cluster = NULL;
}
/*
* check_pghost_envvar()
*
* Tests that PGHOST does not point to a non-local server
*/
void
check_pghost_envvar(void)
{
PQconninfoOption *option;
PQconninfoOption *start;
/* Get valid libpq env vars from the PQconndefaults function */
start = PQconndefaults();
for (option = start; option->keyword != NULL; option++)
{
if (option->envvar && (strcmp(option->envvar, "PGHOST") == 0 ||
strcmp(option->envvar, "PGHOSTADDR") == 0))
{
const char *value = getenv(option->envvar);
if (value && strlen(value) > 0 &&
/* check for 'local' host values */
(strcmp(value, "localhost") != 0 && strcmp(value, "127.0.0.1") != 0 &&
strcmp(value, "::1") != 0 && value[0] != '/'))
pg_log(PG_FATAL,
"libpq environment variable %s has a non-local server value: %s\n",
option->envvar, value);
}
}
/* Free the memory that libpq allocated on our behalf */
PQconninfoFree(start);
}