From: Tom Lane <tgl@sss.pgh.pa.us>
To: mdavid@palantir.com
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #16106: Patch - Radius secrets always gets lowercased
Date: Mon, 11 Nov 2019 15:23:07 -0500
Message-ID: <19993.1573503787@sss.pgh.pa.us> (raw)
In-Reply-To: <16106-7d319e4295d08e70@postgresql.org>
References: <16106-7d319e4295d08e70@postgresql.org>
PG Bug reporting form <noreply@postgresql.org> writes:
> I'm using radius authentication in pg_hba.conf and I've run into the
> following issue.
> The radiussecrets is always getting lowercased even if I start it with
> double quotes. Seems the double quotes are removed by the tokenization
> process and then the secret gets lowercased by
> https://github.com/postgres/postgres/blob/REL_12_STABLE/src/backend/utils/adt/varlena.c#L3652
> I'm attaching a patch for this since I don't think the secrets should ever
> be lowercased.
Hm. I know zip about RADIUS but this seems like generally a sane
change to make. The other very-dubious-in-this-context assumption
that is embedded in SplitIdentifierString is that the strings should
be truncated at NAMEDATALEN.
Why did you not change the parsing for all four RADIUS options?
Probably case-folding wouldn't matter for the server names,
but the length limitation could.
(Hmm ... on the same principle, PostmasterMain probably shouldn't
be using this function for parsing ListenAddresses.)
I'm hesitant to back-patch a change like this, because in theory
it could change a working configuration into a non-working one.
But it'd be sensible to do in HEAD.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, mdavid@palantir.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #16106: Patch - Radius secrets always gets lowercased
In-Reply-To: <19993.1573503787@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox