Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hytoX-00054Q-KW for pgsql-hackers@arkaria.postgresql.org; Sat, 17 Aug 2019 08:11:54 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hytoU-0007NU-TI for pgsql-hackers@arkaria.postgresql.org; Sat, 17 Aug 2019 08:11:50 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hytoS-0007D3-TX for pgsql-hackers@lists.postgresql.org; Sat, 17 Aug 2019 08:11:49 +0000 Received: from [64.147.123.21] (helo=wout5-smtp.messagingengine.com) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1hytoL-0001Wg-QP for pgsql-hackers@postgresql.org; Sat, 17 Aug 2019 08:11:47 +0000 Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.west.internal (Postfix) with ESMTP id 37F71587 for ; Sat, 17 Aug 2019 04:11:30 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute7.internal (MEProxy); Sat, 17 Aug 2019 04:11:30 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=hO+rSnM6JiyW9XJH9/+/rXg0GOYeq ZvSfObuLqQ+OHg=; b=szLOB1Zg1Dk0nbBtWU4GHsxPOKjcvL0qQJBREk+47451q tBg/5g+Is7RNE3rBgCTmsBnQQWest67xcSk+l17ZsKKa9G8mNBPK7AQ37S9xp39i uwvm7gn/Os9zCK20OSZFEI7TEuqsvm7CEhHB7ZW50FM+YQdupUtd8cnAdrYnn0zI Lotr0S859pIEwPNuTJyMektMwhO0g6evEb4G9+LYwVuF6JrxkGHfqVIkTaUOCR/X Q5gjbMW+6ZMQkaHDm6AxFZbkD1XjbMpnRPXw2m3HVsJRBAwh66D9BSh/X3D3AG0q ZBNeOGrx9YwOxd4IV/R8kyMiQhNxy+TGTFKGOjfPw== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrudefhedgtdduucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefvhffuohfkffgfgggtsehmtderre dtfeejnecuhfhrohhmpefrvghtvghrucfgihhsvghnthhrrghuthcuoehpvghtvghrrdgv ihhsvghnthhrrghuthesvdhnughquhgrughrrghnthdrtghomheqnecuffhomhgrihhnpe dvnhguqhhurggurhgrnhhtrdgtohhmnecukfhppeelfedrvdegvddrgedtrddvtddvnecu rfgrrhgrmhepmhgrihhlfhhrohhmpehpvghtvghrrdgvihhsvghnthhrrghuthesvdhnug hquhgrughrrghnthdrtghomhenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: from april.pezone.net (p5df228ca.dip0.t-ipconnect.de [93.242.40.202]) by mail.messagingengine.com (Postfix) with ESMTPA id DC57D80059 for ; Sat, 17 Aug 2019 04:11:28 -0400 (EDT) To: pgsql-hackers From: Peter Eisentraut Subject: some SCRAM read_any_attr() confusion Openpgp: preference=signencrypt Autocrypt: addr=peter.eisentraut@2ndquadrant.com; prefer-encrypt=mutual; keydata= xsFNBFUUt6kBEADZd9NNTBJbHmAXXJgPGOdd6Q73l80oifIVgn2tRxP9dYkCfTlo/yLqbKTl JNqTcyM6XrJDnB2sMEUGYCewYZXl+9C4bBJWyNqcEI1ae9u71vEq/fknFLArJ+2wN+f7QuRx Q8d94ZJAiJQ5g3fNk2HVeedCQCKP5dCzU+ZLt2dbsx1PDZLjTO9gf+JswWuGFb5wY5PZVM5V hq66Xk7ZJzHuARacza2RT7J2fkMmQBY+kr7L98Perb0GhafnlhXB0PvUB+N3xpmggMfwuhTu BngS/G/r3GvemxJuFxouw8xsMqrsfdksJXA2gLXYtwRCssdPV3PO0rlD9twqDo8URfIJ5fb6 1g/MV8aTOKjg3Q8MpJPtkwJqN4o3PvbwYdedeFnOVkkYAJdu/aX1v1BeCBDu7Hy3sF52scD3 pQbyQSl9vUDpTLarASAxNbAV0NRJE8dp4vfW6AH1ccryGiFqw/czPK/iN0+MT8wsjAW6WW4w hvjm5UPA1KTwi3ZT8eT5uycuH7QpuNk7LnGGXQ6KaRALFywzkr0A0V0AvFNa+l4wstMaXaB6 dmMXyF0/hfryqyOeu1gAdq4q0/PNC2dPgb/6uoh4eMjN6A5GXcprilhz5DulmsilY21hfSoU S64ODed96pKhprsOxjZiDRsN1QM5MwB+uwVWUNfsX7fIxE0BrwARAQABzSdQZXRlciBFaXNl bnRyYXV0IDxwZXRlckBlaXNlbnRyYXV0Lm9yZz7CwXoEEwEIACQCGwMFCwkIBwMFFQoJCAsF FgIDAQACHgECF4AFAlUUuKQCGQEACgkQoZ8SQ+xBJp8llw//RbGoXnF72FZTlOFsnNyxnWbF vViPCfdAlZl1GGK9OYCvV1dp/956HuhB0wpaGQHiBmQfOPJf/jLOPjXFYm2iEChEycrBChuE j4TSYemMp5BSPILYk9Uwd16kVD/+U6fQfK6H5pOhfBvbM6asMnmpY2wQuvktxHvaGlytFw84 EzFWNZtAZfxkw28w3AhIQkKe9hJanfyDL750RcbyEr8AAHty5IErrvS7tM5vQwIeh5BF26ND CyKPRdZgOgMpcwFfROKBDpAt052CgWIpNdhBdfIKlkCs4/ILxmC3rT/Mb/qZiHcoMMwEu6k+ T7vRAFZZAk62Yrr/U8/vUGKlzRZQoo86fyojCfI0ibCIc0z8rwCVY9P40G9wD9BTCZS/z8Vh jjpBlNnIKw2hM6hbxavKndCJjFFJD08rXrTyrLF/of18xD37vNdYooP9VATB5QjOWFRrscSZ 4a89e+to3m7YVnd4xdXwGp47dYusoax84C8tg1gZrH38ol9dPmnKX6GZrXeS7tH9k8VeUpJ8 HQbRThQRWAT936QpYbLConBmOtmbLmjQOGtiXPo1oK57X/7U/WBja5vWmm2q+Yxtt+3uHGVg DdDU4CJpXo4lX0v2n3QV5EBSW9hjdF3bNfl6GFBb1pPEhqNcMDUc7zkx/2uENdAdk/BnqMgH umip7b0pVfvOwU0EVRS3qQEQAJf6p0P7D+hMYUgCPkvgrcz6OJYsAYdUMUmokfqmkKwK0oJM ew8TNGM53ocKAgQGma5f10rwbZNPlpVPNRX5hwUmwVlcwSut0oE+JfUBH7mpysWvpF05RKIy q9RCoJZrAbXS7Tig56A1QD8IcM00rERZMcCOlI1+q9m4u9AOI+0LyGGSH+VvoyDHD/Jew4R2 TmPEF8Pu7lYiNYK88Q6u0kBkc+Tz3BNlyc6fi3HxnFfp0b75HLXPSTu2SwA/0Q31wHZXwrEU BR9KgSn/qbgy8ydPc97i82fhiFE3cbGexfPrQSMYmDGi+dcQ0s+AMQwC3XyMC0JkHpYUuFkR QdlIvaIhgFUUN2Vr4xF2ADaNTNFc4DYaiPHFAgHZw+3pZWqS4uIiWgJynrEaHw4F3QWU8/JB iyEWDhNq4WBrRA0u914TCCAoFOOKMnRdl8eJrRQKM/5/lXbHFjjlI/LDKhLRFsuQsnJJ3331 RjCzpHPZG5/p5KR1RHiAXa0p/DW5lXyq21hS3kjDlleoHqOxCN/cy0Jgz7qLDq1vZoCl67Sy RAH60c2Xu4may9SVltmot0OzWVHdrfS+85FQGp9580DaeLio7YMFKy2bfEvwQJ/c9xD2QPB+ oSb3V8ueSznXBG5+dyfOsZFRPxceA0wA2rSWZSjxLdKxvyGTj9vsCjaDu13rABEBAAHCwV8E GAEIAAkFAlUUt6kCGwwACgkQoZ8SQ+xBJp+HJhAAxmSTsC5y7p9Zu+nnLpucv/h88oEx985e qWeXzQiwM3pfRZS+PdTH9TyzHK0KOgKoAiubk0vt+BrT91D9d0G5kVQaTctAErGBoMkTaZJT XVEcNphiPzysdSqvprjojMp1y7rG8AP+Xd6m0rE1LRnkRRm8HyI8vdXsuLQPITGWXDLMjaNq AOV3BUnzkgtjMuIYw7SCr+12ZOb5dEKvaG4kjC4kaJ/TLbuBhVANcXkC90yp0AOZLs/cB1Dj OAXno/RUUruJ3r27a+pFv768UAi9QWcdw58yPxreMNMLqAgsS9oTHwHfGNWcB2dJ4UW+GMLJ hTf9TjQ2f+N/sIx5XMQ9pYw6CAJMK29qPx6/ZayrPxf22EXf0D3zTwIEZgwfSkynFVwV25L7 awQq60fifdMYheSxq7GbhpsixmcD+e161cCmLIt75YDt5bQ0B1yf7EmxG8n7pGZAOM6LoNsU fkSldba5XVwh8LuN5mK0nQBELGW6Os4TDq4REggLpfcvFC215zpuo0iCGnmE/Bns4nowqUSP u4tkWL+nxW4qgv8wo8HJ52jd79EJ8iqfIBoidBfy9AIUiEUApGQzWPu6yWcI8fY0rN5D+tc+ Yw1Zt6Mm+huYJpgCRsTcfzEcahnBn521CWcWvhW1ff3KFileFMtNmnBBhMncmRKHphtTKEpN 3jI= Organization: 2ndQuadrant Message-ID: <2fb8a15b-de35-682d-a77b-edcc9c52fa12@2ndquadrant.com> Date: Sat, 17 Aug 2019 10:11:27 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="------------06EFDA930D3A12D910F385A1" Content-Language: en-US X-Host-Lookup-Failed: Reverse DNS lookup failed for 64.147.123.21 (deferred) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk This is a multi-part message in MIME format. --------------06EFDA930D3A12D910F385A1 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit I was a bit confused by some of the comments around the SCRAM function read_any_attr(), used to skip over extensions. The comment "Returns NULL if there is attribute.", besides being strangely worded, appears to be wrong anyway, because the function never returns NULL. This lead me to wonder how this loop would terminate if there is no "p" attribute in the message: /* ignore optional extensions */ do { proof = p - 1; value = read_any_attr(&p, &attr); } while (attr != 'p'); What actually happens is ERROR: malformed SCRAM message DETAIL: Attribute expected, but found invalid character "0x00". which serves the purpose but was probably not quite intended that way. I propose the attached patch to clean this up a bit, with better comments and a better error message. -- Peter Eisentraut http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services --------------06EFDA930D3A12D910F385A1 Content-Type: text/plain; charset=UTF-8; x-mac-type="0"; x-mac-creator="0"; name="0001-Clean-up-some-SCRAM-attribute-processing.patch" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="0001-Clean-up-some-SCRAM-attribute-processing.patch" RnJvbSA0OGMzODg1N2NiNWRiY2NiZTUxMmJiNDg5YTRhNjkyMTRkMDNkMmU0IE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBQZXRlciBFaXNlbnRyYXV0IDxwZXRlckBlaXNlbnRy YXV0Lm9yZz4KRGF0ZTogU2F0LCAxNyBBdWcgMjAxOSAxMDowNDoxMSArMDIwMApTdWJqZWN0 OiBbUEFUQ0hdIENsZWFuIHVwIHNvbWUgU0NSQU0gYXR0cmlidXRlIHByb2Nlc3NpbmcKCkNv cnJlY3QgdGhlIGNvbW1lbnQgZm9yIHJlYWRfYW55X2F0dHIoKS4gIEdpdmUgYSBjbGVhcmVy IGVycm9yIG1lc3NhZ2UKd2hlbiBwYXJzaW5nIGF0IHRoZSBlbmQgb2YgdGhlIHN0cmluZywg d2hlbiB0aGUgY2xpZW50LWZpbmFsLW1lc3NhZ2UKZG9lcyBub3QgY29udGFpbiBhICJwIiBh dHRyaWJ1dGUgKGZvciBzb21lIHJlYXNvbikuCi0tLQogc3JjL2JhY2tlbmQvbGlicHEvYXV0 aC1zY3JhbS5jIHwgMTEgKysrKysrKysrLS0KIDEgZmlsZSBjaGFuZ2VkLCA5IGluc2VydGlv bnMoKyksIDIgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvbGlicHEv YXV0aC1zY3JhbS5jIGIvc3JjL2JhY2tlbmQvbGlicHEvYXV0aC1zY3JhbS5jCmluZGV4IGFh OTE4ODM5ZmIuLjY4NzkyY2I0NWUgMTAwNjQ0Ci0tLSBhL3NyYy9iYWNrZW5kL2xpYnBxL2F1 dGgtc2NyYW0uYworKysgYi9zcmMvYmFja2VuZC9saWJwcS9hdXRoLXNjcmFtLmMKQEAgLTc5 MCw3ICs3OTAsOCBAQCBzYW5pdGl6ZV9zdHIoY29uc3QgY2hhciAqcykKIC8qCiAgKiBSZWFk IHRoZSBuZXh0IGF0dHJpYnV0ZSBhbmQgdmFsdWUgaW4gYSBTQ1JBTSBleGNoYW5nZSBtZXNz YWdlLgogICoKLSAqIFJldHVybnMgTlVMTCBpZiB0aGVyZSBpcyBhdHRyaWJ1dGUuCisgKiBU aGUgYXR0cmlidXRlIGNoYXJhY3RlciBpcyBzZXQgaW4gKmF0dHJfcCwgdGhlIGF0dHJpYnV0 ZSB2YWx1ZSBpcyB0aGUKKyAqIHJldHVybiB2YWx1ZS4KICAqLwogc3RhdGljIGNoYXIgKgog cmVhZF9hbnlfYXR0cihjaGFyICoqaW5wdXQsIGNoYXIgKmF0dHJfcCkKQEAgLTc5OSw2ICs4 MDAsMTIgQEAgcmVhZF9hbnlfYXR0cihjaGFyICoqaW5wdXQsIGNoYXIgKmF0dHJfcCkKIAlj aGFyCSAgICplbmQ7CiAJY2hhcgkJYXR0ciA9ICpiZWdpbjsKIAorCWlmIChhdHRyID09ICdc MCcpCisJCWVyZXBvcnQoRVJST1IsCisJCQkJKGVycmNvZGUoRVJSQ09ERV9QUk9UT0NPTF9W SU9MQVRJT04pLAorCQkJCSBlcnJtc2coIm1hbGZvcm1lZCBTQ1JBTSBtZXNzYWdlIiksCisJ CQkJIGVycmRldGFpbCgiQXR0cmlidXRlIGV4cGVjdGVkLCBidXQgZm91bmQgZW5kIG9mIHN0 cmluZy4iKSkpOworCiAJLyotLS0tLS0KIAkgKiBhdHRyLXZhbAkJICAgPSBBTFBIQSAiPSIg dmFsdWUKIAkgKgkJCQkJIDs7IEdlbmVyaWMgc3ludGF4IG9mIGFueSBhdHRyaWJ1dGUgc2Vu dApAQCAtMTI5OCw3ICsxMzA1LDcgQEAgcmVhZF9jbGllbnRfZmluYWxfbWVzc2FnZShzY3Jh bV9zdGF0ZSAqc3RhdGUsIGNvbnN0IGNoYXIgKmlucHV0KQogCiAJc3RhdGUtPmNsaWVudF9m aW5hbF9ub25jZSA9IHJlYWRfYXR0cl92YWx1ZSgmcCwgJ3InKTsKIAotCS8qIGlnbm9yZSBv cHRpb25hbCBleHRlbnNpb25zICovCisJLyogaWdub3JlIG9wdGlvbmFsIGV4dGVuc2lvbnMs IHJlYWQgdW50aWwgd2UgZmluZCAicCIgYXR0cmlidXRlICovCiAJZG8KIAl7CiAJCXByb29m ID0gcCAtIDE7Ci0tIAoyLjIyLjAKCg== --------------06EFDA930D3A12D910F385A1--