pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #16695: pg_hba_file_rules NULL address and netmask
5+ messages / 3 participants
[nested] [flat]
Commits from this thread:
2020-11-03 0a4b340312 d3befe9b98 f28b089cbd 7827497ba2 a58a631b4a Fix unportable use of getnameinfo() in pg_hba_file_rules view.
* BUG #16695: pg_hba_file_rules NULL address and netmask
@ 2020-11-02 21:01 PG Bug reporting form <noreply@postgresql.org>
0 siblings, 2 replies; 5+ messages in thread
From: PG Bug reporting form @ 2020-11-02 21:01 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: petervandivier@gmail.com
The following bug has been logged on the website:
Bug reference: 16695
Logged by: Peter Vandivier
Email address: petervandivier@gmail.com
PostgreSQL version: 13.0
Operating system: FreeBSD 11
Description:
Greetings,
pg_hba_file_rules reports NULL address and netmask values incorrectly on
FreeBSD 11 for tested postgres versions 10-13 (at least). e.g.
```
sudo su
pkg update -f
pkg install postgresql10-server postgresql10-client
sysrc postgresql_enable=yes
service postgresql initdb
service postgresql start
psql -U postgres -c 'select * from pg_hba_file_rules'
sudo -u postgres cat $(psql -Xtc 'show hba_file') | tail -13
```
All postgres versions appear to report correct values for pg_hba_file_rules
on FreeBSD 12
Cheers,
Peter V
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #16695: pg_hba_file_rules NULL address and netmask
@ 2020-11-02 22:15 Tom Lane <tgl@sss.pgh.pa.us>
parent: PG Bug reporting form <noreply@postgresql.org>
1 sibling, 1 reply; 5+ messages in thread
From: Tom Lane @ 2020-11-02 22:15 UTC (permalink / raw)
To: petervandivier@gmail.com; +Cc: pgsql-bugs@lists.postgresql.org
PG Bug reporting form <noreply@postgresql.org> writes:
> pg_hba_file_rules reports NULL address and netmask values incorrectly on
> FreeBSD 11 for tested postgres versions 10-13 (at least). e.g.
This is kind of an unhelpful bug report: you did not show what results
you got, nor what you expected to get.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #16695: pg_hba_file_rules NULL address and netmask
@ 2020-11-02 22:26 Peter Vandivier <petervandivier@gmail.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 5+ messages in thread
From: Peter Vandivier @ 2020-11-02 22:26 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-bugs@lists.postgresql.org
Apologies - please find screencaps and context at the following
- https://postgresteam.slack.com/archives/C0FS3UTAP/p1603440839348800
- https://topanswers.xyz/transcript?room=2&id=78663&year=2020&month=10#c78663
By way of description - IP address/netmask pairs given in pg_hba.conf are not read into the system view pg_hba_file_rules even in well formed and default installations. The shell commands given in the initial email are meant to give a minimum reproduction of this behavior when executed on FreeBSD 11
A default install on RHEL querying pg_hba_file_rules would show corresponding non-null values as appropriate
Kind regards
Peter Vandivier
Sent from my iPhone
Please excuse typos and brevity
On Nov 2, 2020, at 22:15, Tom Lane <tgl@sss.pgh.pa.us> wrote:
PG Bug reporting form <noreply@postgresql.org> writes:
> pg_hba_file_rules reports NULL address and netmask values incorrectly on
> FreeBSD 11 for tested postgres versions 10-13 (at least). e.g.
This is kind of an unhelpful bug report: you did not show what results
you got, nor what you expected to get.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #16695: pg_hba_file_rules NULL address and netmask
@ 2020-11-02 23:55 Tom Lane <tgl@sss.pgh.pa.us>
parent: PG Bug reporting form <noreply@postgresql.org>
1 sibling, 1 reply; 5+ messages in thread
From: Tom Lane @ 2020-11-02 23:55 UTC (permalink / raw)
To: petervandivier@gmail.com; +Cc: pgsql-bugs@lists.postgresql.org
PG Bug reporting form <noreply@postgresql.org> writes:
> pg_hba_file_rules reports NULL address and netmask values incorrectly on
> FreeBSD 11 for tested postgres versions 10-13 (at least). e.g.
So for the archives' sake: what I suppose Peter means is that the addr
and netmask come out as NULL on every line, even where they should not.
At least, that's what I've reproduced here on FreeBSD 11.0.
I traced through this, and the proximate cause seems to be that
getnameinfo(3) is failing because it is expecting the passed "salen"
to be exactly the length it is expecting for the given sa_family.
Which it is not, because alone among our callers of pg_getnameinfo_all(),
fill_hba_line() thinks it can get away with passing sizeof(struct
sockaddr_storage) rather than the actual addrlen previously returned by
getaddrinfo().
The POSIX specification for getnameinfo() saith
The sa argument points to a socket address structure to be
translated. The salen argument contains the length of the address
pointed to by sa.
so it seems to me that fill_hba_line() is clearly in the wrong. There
are evidently a lot of implementations that either don't check salen
or only insist it be >= required length, but POSIX doesn't say they
need to be that lax. (It'd be interesting to know if anyone sees
similar failures on any other BSDen.)
The core of the problem is somebody being lazy about what they needed
to put into HbaLine. Unfortunately that's an exported structure so
there's some small risk of an ABI break, but I guess we can add the
length fields at the end in released branches to minimize the hazard.
Thanks for the report!
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #16695: pg_hba_file_rules NULL address and netmask
@ 2020-11-03 01:27 Tom Lane <tgl@sss.pgh.pa.us>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 5+ messages in thread
From: Tom Lane @ 2020-11-03 01:27 UTC (permalink / raw)
To: petervandivier@gmail.com; +Cc: pgsql-bugs@lists.postgresql.org
I wrote:
> PG Bug reporting form <noreply@postgresql.org> writes:
>> pg_hba_file_rules reports NULL address and netmask values incorrectly on
>> FreeBSD 11 for tested postgres versions 10-13 (at least). e.g.
> So for the archives' sake: what I suppose Peter means is that the addr
> and netmask come out as NULL on every line, even where they should not.
> At least, that's what I've reproduced here on FreeBSD 11.0.
> I traced through this, and the proximate cause seems to be that
> getnameinfo(3) is failing because it is expecting the passed "salen"
> to be exactly the length it is expecting for the given sa_family.
> Which it is not, because alone among our callers of pg_getnameinfo_all(),
> fill_hba_line() thinks it can get away with passing sizeof(struct
> sockaddr_storage) rather than the actual addrlen previously returned by
> getaddrinfo().
The attached seems to fix it for me. (This is against HEAD, but a quick
check suggests it will apply cleanly down to v10.) As I mentioned,
I'm planning to put the new fields at the end of struct HbaLine in
the back branches.
regards, tom lane
Attachments:
fix-bogus-addrlen-in-hba-view.patch (text/x-diff, 3.1K) download
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index 4c86fb6087..3a78d2043e 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -1188,8 +1188,11 @@ parse_hba_line(TokenizedLine *tok_line, int elevel)
ret = pg_getaddrinfo_all(str, NULL, &hints, &gai_result);
if (ret == 0 && gai_result)
+ {
memcpy(&parsedline->addr, gai_result->ai_addr,
gai_result->ai_addrlen);
+ parsedline->addrlen = gai_result->ai_addrlen;
+ }
else if (ret == EAI_NONAME)
parsedline->hostname = str;
else
@@ -1238,6 +1241,7 @@ parse_hba_line(TokenizedLine *tok_line, int elevel)
token->string);
return NULL;
}
+ parsedline->masklen = parsedline->addrlen;
pfree(str);
}
else if (!parsedline->hostname)
@@ -1288,6 +1292,7 @@ parse_hba_line(TokenizedLine *tok_line, int elevel)
memcpy(&parsedline->mask, gai_result->ai_addr,
gai_result->ai_addrlen);
+ parsedline->masklen = gai_result->ai_addrlen;
pg_freeaddrinfo_all(hints.ai_family, gai_result);
if (parsedline->addr.ss_family != parsedline->mask.ss_family)
@@ -2538,20 +2543,26 @@ fill_hba_line(Tuplestorestate *tuple_store, TupleDesc tupdesc,
}
else
{
- if (pg_getnameinfo_all(&hba->addr, sizeof(hba->addr),
- buffer, sizeof(buffer),
- NULL, 0,
- NI_NUMERICHOST) == 0)
+ /*
+ * Note: if pg_getnameinfo_all fails, it'll set buffer to
+ * "???", which we want to return.
+ */
+ if (hba->addrlen > 0)
{
- clean_ipv6_addr(hba->addr.ss_family, buffer);
+ if (pg_getnameinfo_all(&hba->addr, hba->addrlen,
+ buffer, sizeof(buffer),
+ NULL, 0,
+ NI_NUMERICHOST) == 0)
+ clean_ipv6_addr(hba->addr.ss_family, buffer);
addrstr = pstrdup(buffer);
}
- if (pg_getnameinfo_all(&hba->mask, sizeof(hba->mask),
- buffer, sizeof(buffer),
- NULL, 0,
- NI_NUMERICHOST) == 0)
+ if (hba->masklen > 0)
{
- clean_ipv6_addr(hba->mask.ss_family, buffer);
+ if (pg_getnameinfo_all(&hba->mask, hba->masklen,
+ buffer, sizeof(buffer),
+ NULL, 0,
+ NI_NUMERICHOST) == 0)
+ clean_ipv6_addr(hba->mask.ss_family, buffer);
maskstr = pstrdup(buffer);
}
}
diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h
index d638479d88..8f09b5638f 100644
--- a/src/include/libpq/hba.h
+++ b/src/include/libpq/hba.h
@@ -42,6 +42,10 @@ typedef enum UserAuth
#define USER_AUTH_LAST uaPeer /* Must be last value of this enum */
} UserAuth;
+/*
+ * Data structures representing pg_hba.conf entries
+ */
+
typedef enum IPCompareMethod
{
ipCmpMask,
@@ -75,11 +79,12 @@ typedef struct HbaLine
List *databases;
List *roles;
struct sockaddr_storage addr;
+ int addrlen; /* zero if we don't have a valid addr */
struct sockaddr_storage mask;
+ int masklen; /* zero if we don't have a valid mask */
IPCompareMethod ip_cmp_method;
char *hostname;
UserAuth auth_method;
-
char *usermap;
char *pamservice;
bool pam_use_hostname;
end of thread, other threads:[~2020-11-03 01:27 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2020-11-02 21:01 BUG #16695: pg_hba_file_rules NULL address and netmask PG Bug reporting form <noreply@postgresql.org>
2020-11-02 22:15 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-11-02 22:26 ` Peter Vandivier <petervandivier@gmail.com>
2020-11-02 23:55 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-11-03 01:27 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox