pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #17354: pg_hba_file_rules always shows verify-ca when auth_method=cert
2+ messages / 2 participants
[nested] [flat]
* BUG #17354: pg_hba_file_rules always shows verify-ca when auth_method=cert
@ 2022-01-04 14:57 PG Bug reporting form <noreply@postgresql.org>
2022-01-26 09:03 ` Re: BUG #17354: pg_hba_file_rules always shows verify-ca when auth_method=cert Magnus Hagander <magnus@hagander.net>
0 siblings, 1 reply; 2+ messages in thread
From: PG Bug reporting form @ 2022-01-04 14:57 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: feikesteenbergen@gmail.com
The following bug has been logged on the website:
Bug reference: 17354
Logged by: Feike Steenbergen
Email address: feikesteenbergen@gmail.com
PostgreSQL version: 10.0
Operating system: Ubuntu x86_64
Description:
When adding a line to my pg_hba.conf as follows:
hostssl all all all cert clientcert=verify-full
It baffled me that pg_hba_file_rules showed me the following entry:
line_number | 106
type | hostssl
database | {all}
user_name | {all}
address | all
netmask | (null)
auth_method | cert
options | {clientcert=verify-ca}
error | (null)
Which AFAIK, authentication method cert implies verify-full nowadays
(PG14).
I've observed this on PostgreSQL 14 and 13, my guess is that this piece of
code:
src/backend/libpq/hba.c
/*
* Enforce any parameters implied by other settings.
*/
if (parsedline->auth_method == uaCert)
{
parsedline->clientcert = clientCertCA;
}
Is the culprit as it seems to set clientcert=verify-ca unconditionally.
As my C hacking skills are almost non-existent, I dared not write a patch
myself for this one.
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: BUG #17354: pg_hba_file_rules always shows verify-ca when auth_method=cert
2022-01-04 14:57 BUG #17354: pg_hba_file_rules always shows verify-ca when auth_method=cert PG Bug reporting form <noreply@postgresql.org>
@ 2022-01-26 09:03 ` Magnus Hagander <magnus@hagander.net>
0 siblings, 0 replies; 2+ messages in thread
From: Magnus Hagander @ 2022-01-26 09:03 UTC (permalink / raw)
To: feikesteenbergen@gmail.com; pgsql-bugs@lists.postgresql.org
On Tue, Jan 4, 2022 at 4:14 PM PG Bug reporting form
<noreply@postgresql.org> wrote:
>
> The following bug has been logged on the website:
>
> Bug reference: 17354
> Logged by: Feike Steenbergen
> Email address: feikesteenbergen@gmail.com
> PostgreSQL version: 10.0
> Operating system: Ubuntu x86_64
> Description:
>
> When adding a line to my pg_hba.conf as follows:
>
> hostssl all all all cert clientcert=verify-full
>
> It baffled me that pg_hba_file_rules showed me the following entry:
>
> line_number | 106
> type | hostssl
> database | {all}
> user_name | {all}
> address | all
> netmask | (null)
> auth_method | cert
> options | {clientcert=verify-ca}
> error | (null)
>
> Which AFAIK, authentication method cert implies verify-full nowadays
> (PG14).
> I've observed this on PostgreSQL 14 and 13, my guess is that this piece of
> code:
>
> src/backend/libpq/hba.c
>
> /*
> * Enforce any parameters implied by other settings.
> */
> if (parsedline->auth_method == uaCert)
> {
> parsedline->clientcert = clientCertCA;
> }
>
> Is the culprit as it seems to set clientcert=verify-ca unconditionally.
>
> As my C hacking skills are almost non-existent, I dared not write a patch
> myself for this one.
Thanks -- your analysis and identification is correct. I've pushed a
patch for this.
Apologies for the delay, I actually had a patch a long time ago, went
for an extra round to verify that this really was just a display issue
and not a security issue, and then promptly forgot to actually commit
it.
--
Magnus Hagander
Me: https://www.hagander.net/
Work: https://www.redpill-linpro.com/
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2022-01-26 09:03 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2022-01-04 14:57 BUG #17354: pg_hba_file_rules always shows verify-ca when auth_method=cert PG Bug reporting form <noreply@postgresql.org>
2022-01-26 09:03 ` Magnus Hagander <magnus@hagander.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox