From: Tom Lane <tgl@sss.pgh.pa.us>
To: Marcos David <mdavid@palantir.com>
Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: Re: BUG #16106: Patch - Radius secrets always gets lowercased
Date: Tue, 12 Nov 2019 11:33:46 -0500
Message-ID: <7942.1573576426@sss.pgh.pa.us> (raw)
In-Reply-To: <BC05948D-9509-4F30-A350-7E2C36570CF1@palantir.com>
References: <16106-7d319e4295d08e70@postgresql.org>
<19993.1573503787@sss.pgh.pa.us>
<BC05948D-9509-4F30-A350-7E2C36570CF1@palantir.com>
Marcos David <mdavid@palantir.com> writes:
> On 11/11/2019, 20:24, "Tom Lane" <tgl@sss.pgh.pa.us> wrote:
>> I'm hesitant to back-patch a change like this, because in theory
>> it could change a working configuration into a non-working one.
>> But it'd be sensible to do in HEAD.
> We only noticed this because we were upgrading from 9.6 and it seems this bug was introduced in 10 in this commit:
> https://github.com/postgres/postgres/commit/6b76f1bb58f53aec25cfec76391270ea36ad1170
Oh! Hm, if it can be painted as a regression, that changes the calculus
a bit. In that case I'd be inclined to go ahead and back-patch.
> I don't think patch would break anything in current configs since the secret would currently need to be lowercased anyway for the radius auth to work.
The case I was imagining was where the secret was entered in the PG
configuration with some uppercase letters, but the server actually
expects lowercase, so the forced lowercasing makes it work. I admit
that's a bit of a stretch, but if it had always worked like that
then it's at least possible someone was relying on the behavior.
But if we changed the behavior from correct to less correct, that's
another story.
BTW, it looks to me like it should work to double-quote the
secret, although doing so is really tedious because there is an
additional layer of double-quoting required by the pg_hba syntax:
host ... radiussecrets="""ServerSecret"",""OtherServersSecret"""
However, while you can defeat the downcasing that way, you can't
bypass the truncation to NAMEDATALEN. So it's arguably broken
even if this point had been documented, which it was not,
at least not in any adequate way (the reference to quoting in
the docs is mighty unclear to my eyes, and for sure it doesn't
give a working example).
Unfortunately, we've missed the window to get it into this week's
releases, but I'll see about getting this committed after the release
cycle finishes.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, mdavid@palantir.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #16106: Patch - Radius secrets always gets lowercased
In-Reply-To: <7942.1573576426@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox