public inbox for [email protected]help / color / mirror / Atom feed
Re: Kerberos delegation support in libpq and postgres_fdw 17+ messages / 6 participants [nested] [flat]
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-03-01 01:28 Stephen Frost <[email protected]> 0 siblings, 1 reply; 17+ messages in thread From: Stephen Frost @ 2022-03-01 01:28 UTC (permalink / raw) To: Peter Eisentraut <[email protected]>; +Cc: [email protected] <[email protected]>; Magnus Hagander <[email protected]>; Tom Lane <[email protected]> Greetings, (Dropping the original poster as their email address apparently no longer works) * Peter Eisentraut ([email protected]) wrote: > On 22.07.21 10:39, Peifeng Qiu wrote: > >I've slightly modified the patch to support "gssencmode" and added TAP > >tests. > > For the TAP tests, please put then under src/test/kerberos/, instead of > copying the whole infrastructure to contrib/postgres_fdw/. Just make a new > file, for example t/002_postgres_fdw_proxy.pl, and put your tests there. I've incorporated the tests into the existing kerberos/001_auth.pl as there didn't seem any need to create another file. > Also, you can put code and tests in one patch, no need to separate. Done. Also rebased and updated for the changes in the TAP testing infrastructure and other changes. Also added code to track if credentials were forwarded or not and to log that information. > I wonder if this feature would also work in dblink. Since there is no > substantial code changes in postgres_fdw itself as part of this patch, I > would suspect yes. Can you check? Yup, this should work fine. I didn't include any explicit testing of postgres_fdw or dblink in this, yet. Instead, for the moment at least, I've added to the connection log message an indiciation of if credentials were passed along with the connection along with tests of both the negative case and the positive case. Not sure if that's useful information to have in pg_stat_gssapi, but if so, then we could add it there pretty easily. I'm happy to try and get testing with postgres_fdw and dblink working soon though, assuming there aren't any particular objections to moving this forward. Will add to the CF for consideration. Thanks, Stephen Attachments: [text/x-diff] v3-0001-kerberos-delegation.patch (17.8K, ../../[email protected]/2-v3-0001-kerberos-delegation.patch) download | inline diff: From c8aff4ae7595647fb5c82ea2f726c2d5b866765c Mon Sep 17 00:00:00 2001 From: Stephen Frost <[email protected]> Date: Mon, 28 Feb 2022 20:17:55 -0500 Subject: [PATCH] Add support for Kerberos credential delegation Accept GSSAPI/Kerberos delegated credentials. With this, a user could authenticate to PostgreSQL using Kerberos credentials, delegate credentials to the PostgreSQL server, and then the PostgreSQL server could use those credentials to connect to another service, such as with postgres_fdw or dblink or theoretically any other authenticated connection which is able to use delegated credentials. Original patch by: Peifeng Qiu, whacked around some by me. --- .../postgres_fdw/expected/postgres_fdw.out | 2 +- contrib/postgres_fdw/option.c | 3 ++ src/backend/libpq/auth.c | 12 ++++- src/backend/libpq/be-gssapi-common.c | 44 +++++++++++++++++++ src/backend/libpq/be-secure-gssapi.c | 26 ++++++++++- src/backend/utils/init/postinit.c | 8 ++-- src/include/libpq/be-gssapi-common.h | 3 ++ src/include/libpq/libpq-be.h | 2 + src/interfaces/libpq/fe-auth.c | 9 +++- src/interfaces/libpq/fe-secure-gssapi.c | 2 +- src/test/kerberos/t/001_auth.pl | 25 +++++++---- src/test/perl/PostgreSQL/Test/Utils.pm | 27 ++++++++++++ 12 files changed, 146 insertions(+), 17 deletions(-) diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out index f210f91188..a73a468d89 100644 --- a/contrib/postgres_fdw/expected/postgres_fdw.out +++ b/contrib/postgres_fdw/expected/postgres_fdw.out @@ -188,7 +188,7 @@ ALTER USER MAPPING FOR public SERVER testserver1 ALTER USER MAPPING FOR public SERVER testserver1 OPTIONS (ADD sslmode 'require'); ERROR: invalid option "sslmode" -HINT: Valid options in this context are: user, password, sslpassword, password_required, sslcert, sslkey +HINT: Valid options in this context are: user, password, sslpassword, password_required, sslcert, sslkey, gssencmode -- But we can add valid ones fine ALTER USER MAPPING FOR public SERVER testserver1 OPTIONS (ADD sslpassword 'dummy'); diff --git a/contrib/postgres_fdw/option.c b/contrib/postgres_fdw/option.c index 572591a558..05922cfe6d 100644 --- a/contrib/postgres_fdw/option.c +++ b/contrib/postgres_fdw/option.c @@ -262,6 +262,9 @@ InitPgFdwOptions(void) {"sslcert", UserMappingRelationId, true}, {"sslkey", UserMappingRelationId, true}, + /* gssencmode is also libpq option, same to above. */ + {"gssencmode", UserMappingRelationId, true}, + {NULL, InvalidOid, false} }; diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index efc53f3135..6f820a34f1 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -920,6 +920,7 @@ pg_GSS_recvauth(Port *port) int mtype; StringInfoData buf; gss_buffer_desc gbuf; + gss_cred_id_t proxy; /* * Use the configured keytab, if there is one. Unfortunately, Heimdal @@ -949,6 +950,9 @@ pg_GSS_recvauth(Port *port) */ port->gss->ctx = GSS_C_NO_CONTEXT; + proxy = NULL; + port->gss->proxy_creds = false; + /* * Loop through GSSAPI message exchange. This exchange can consist of * multiple messages sent in both directions. First message is always from @@ -999,7 +1003,7 @@ pg_GSS_recvauth(Port *port) &port->gss->outbuf, &gflags, NULL, - NULL); + &proxy); /* gbuf no longer used */ pfree(buf.data); @@ -1011,6 +1015,12 @@ pg_GSS_recvauth(Port *port) CHECK_FOR_INTERRUPTS(); + if (proxy != NULL) + { + pg_store_proxy_credential(proxy); + port->gss->proxy_creds = true; + } + if (port->gss->outbuf.length != 0) { /* diff --git a/src/backend/libpq/be-gssapi-common.c b/src/backend/libpq/be-gssapi-common.c index 71b796d5a2..d649d86dbf 100644 --- a/src/backend/libpq/be-gssapi-common.c +++ b/src/backend/libpq/be-gssapi-common.c @@ -92,3 +92,47 @@ pg_GSS_error(const char *errmsg, (errmsg_internal("%s", errmsg), errdetail_internal("%s: %s", msg_major, msg_minor))); } + +/* + * Store the credentials passed in into the memory cache for later usage. + * + * This allows credentials to be delegated to us for us to use to connect + * to other systems with, using, e.g. postgres_fdw or dblink. + */ +#define GSS_MEMORY_CACHE "MEMORY:" +void +pg_store_proxy_credential(gss_cred_id_t cred) +{ + OM_uint32 major, minor; + gss_OID_set mech; + gss_cred_usage_t usage; + gss_key_value_element_desc cc; + gss_key_value_set_desc ccset; + + cc.key = "ccache"; + cc.value = GSS_MEMORY_CACHE; + ccset.count = 1; + ccset.elements = &cc; + + /* Make the proxy credential only available to current process */ + major = gss_store_cred_into(&minor, + cred, + GSS_C_INITIATE, /* credential only used for starting libpq connection */ + GSS_C_NULL_OID, /* store all */ + true, /* overwrite */ + true, /* make default */ + &ccset, + &mech, + &usage); + + + if (major != GSS_S_COMPLETE) + { + pg_GSS_error("gss_store_cred", major, minor); + } + + /* quite strange that gss_store_cred doesn't work with "KRB5CCNAME=MEMORY:", + * we have to use gss_store_cred_into instead and set the env for later + * gss_acquire_cred calls. */ + setenv("KRB5CCNAME", GSS_MEMORY_CACHE, 1); +} diff --git a/src/backend/libpq/be-secure-gssapi.c b/src/backend/libpq/be-secure-gssapi.c index 2844c5aa4b..bece580f61 100644 --- a/src/backend/libpq/be-secure-gssapi.c +++ b/src/backend/libpq/be-secure-gssapi.c @@ -497,6 +497,7 @@ secure_open_gssapi(Port *port) bool complete_next = false; OM_uint32 major, minor; + gss_cred_id_t proxy; /* * Allocate subsidiary Port data for GSSAPI operations. @@ -504,6 +505,9 @@ secure_open_gssapi(Port *port) port->gss = (pg_gssinfo *) MemoryContextAllocZero(TopMemoryContext, sizeof(pg_gssinfo)); + proxy = NULL; + port->gss->proxy_creds = false; + /* * Allocate buffers and initialize state variables. By malloc'ing the * buffers at this point, we avoid wasting static data space in processes @@ -588,7 +592,8 @@ secure_open_gssapi(Port *port) GSS_C_NO_CREDENTIAL, &input, GSS_C_NO_CHANNEL_BINDINGS, &port->gss->name, NULL, &output, NULL, - NULL, NULL); + NULL, &proxy); + if (GSS_ERROR(major)) { pg_GSS_error(_("could not accept GSSAPI security context"), @@ -605,6 +610,12 @@ secure_open_gssapi(Port *port) complete_next = true; } + if (proxy != NULL) + { + pg_store_proxy_credential(proxy); + port->gss->proxy_creds = true; + } + /* Done handling the incoming packet, reset our buffer */ PqGSSRecvLength = 0; @@ -731,3 +742,16 @@ be_gssapi_get_princ(Port *port) return port->gss->princ; } + +/* + * Return if GSSAPI delegated/proxy credentials were included on this + * connection. + */ +bool +be_gssapi_get_proxy(Port *port) +{ + if (!port || !port->gss) + return NULL; + + return port->gss->proxy_creds; +} diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c index 86d193c89f..3b850fc9ef 100644 --- a/src/backend/utils/init/postinit.c +++ b/src/backend/utils/init/postinit.c @@ -284,15 +284,17 @@ PerformAuthentication(Port *port) if (princ) appendStringInfo(&logmsg, - _(" GSS (authenticated=%s, encrypted=%s, principal=%s)"), + _(" GSS (authenticated=%s, encrypted=%s, proxy_credentials=%s, principal=%s)"), be_gssapi_get_auth(port) ? _("yes") : _("no"), be_gssapi_get_enc(port) ? _("yes") : _("no"), + be_gssapi_get_proxy(port) ? _("yes") : _("no"), princ); else appendStringInfo(&logmsg, - _(" GSS (authenticated=%s, encrypted=%s)"), + _(" GSS (authenticated=%s, encrypted=%s, proxy_credentials=%s)"), be_gssapi_get_auth(port) ? _("yes") : _("no"), - be_gssapi_get_enc(port) ? _("yes") : _("no")); + be_gssapi_get_enc(port) ? _("yes") : _("no"), + be_gssapi_get_proxy(port) ? _("yes") : _("no")); } #endif diff --git a/src/include/libpq/be-gssapi-common.h b/src/include/libpq/be-gssapi-common.h index ae8411245d..6953157f05 100644 --- a/src/include/libpq/be-gssapi-common.h +++ b/src/include/libpq/be-gssapi-common.h @@ -18,13 +18,16 @@ #if defined(HAVE_GSSAPI_H) #include <gssapi.h> +#include <gssapi_ext.h> #else #include <gssapi/gssapi.h> +#include <gssapi/gssapi_ext.h> #endif extern void pg_GSS_error(const char *errmsg, OM_uint32 maj_stat, OM_uint32 min_stat); +extern void pg_store_proxy_credential(gss_cred_id_t cred); #endif /* ENABLE_GSS */ #endif /* BE_GSSAPI_COMMON_H */ diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h index dd3e5efba3..d9d70b9e1d 100644 --- a/src/include/libpq/libpq-be.h +++ b/src/include/libpq/libpq-be.h @@ -95,6 +95,7 @@ typedef struct * GSSAPI auth was not used */ bool auth; /* GSSAPI Authentication used */ bool enc; /* GSSAPI encryption in use */ + bool proxy_creds; /* GSSAPI Delegated/proxy credentials */ #endif } pg_gssinfo; #endif @@ -321,6 +322,7 @@ extern PGDLLIMPORT openssl_tls_init_hook_typ openssl_tls_init_hook; extern bool be_gssapi_get_auth(Port *port); extern bool be_gssapi_get_enc(Port *port); extern const char *be_gssapi_get_princ(Port *port); +extern bool be_gssapi_get_proxy(Port *port); /* Read and write to a GSSAPI-encrypted connection. */ extern ssize_t be_gssapi_read(Port *port, void *ptr, size_t len); diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c index 6fceff561b..3f75834eb8 100644 --- a/src/interfaces/libpq/fe-auth.c +++ b/src/interfaces/libpq/fe-auth.c @@ -61,6 +61,7 @@ pg_GSS_continue(PGconn *conn, int payloadlen) lmin_s; gss_buffer_desc ginbuf; gss_buffer_desc goutbuf; + gss_cred_id_t proxy; /* * On first call, there's no input token. On subsequent calls, read the @@ -93,12 +94,16 @@ pg_GSS_continue(PGconn *conn, int payloadlen) ginbuf.value = NULL; } + /* Check if we can aquire a proxy credential. */ + if (!pg_GSS_have_cred_cache(&proxy)) + proxy = GSS_C_NO_CREDENTIAL; + maj_stat = gss_init_sec_context(&min_stat, - GSS_C_NO_CREDENTIAL, + proxy, &conn->gctx, conn->gtarg_nam, GSS_C_NO_OID, - GSS_C_MUTUAL_FLAG, + GSS_C_MUTUAL_FLAG | GSS_C_DELEG_FLAG, 0, GSS_C_NO_CHANNEL_BINDINGS, (ginbuf.value == NULL) ? GSS_C_NO_BUFFER : &ginbuf, diff --git a/src/interfaces/libpq/fe-secure-gssapi.c b/src/interfaces/libpq/fe-secure-gssapi.c index 6ea52ed866..566c89f52f 100644 --- a/src/interfaces/libpq/fe-secure-gssapi.c +++ b/src/interfaces/libpq/fe-secure-gssapi.c @@ -631,7 +631,7 @@ pqsecure_open_gss(PGconn *conn) */ major = gss_init_sec_context(&minor, conn->gcred, &conn->gctx, conn->gtarg_nam, GSS_C_NO_OID, - GSS_REQUIRED_FLAGS, 0, 0, &input, NULL, + GSS_REQUIRED_FLAGS | GSS_C_DELEG_FLAG, 0, 0, &input, NULL, &output, NULL, NULL); /* GSS Init Sec Context uses the whole packet, so clear it */ diff --git a/src/test/kerberos/t/001_auth.pl b/src/test/kerberos/t/001_auth.pl index 62e0542639..7cc07f982d 100644 --- a/src/test/kerberos/t/001_auth.pl +++ b/src/test/kerberos/t/001_auth.pl @@ -45,6 +45,7 @@ elsif ($^O eq 'linux') my $krb5_config = 'krb5-config'; my $kinit = 'kinit'; +my $klist = 'klist'; my $kdb5_util = 'kdb5_util'; my $kadmin_local = 'kadmin.local'; my $krb5kdc = 'krb5kdc'; @@ -53,6 +54,7 @@ if ($krb5_bin_dir && -d $krb5_bin_dir) { $krb5_config = $krb5_bin_dir . '/' . $krb5_config; $kinit = $krb5_bin_dir . '/' . $kinit; + $klist = $krb5_bin_dir . '/' . $klist; } if ($krb5_sbin_dir && -d $krb5_sbin_dir) { @@ -97,6 +99,7 @@ kdc = FILE:$kdc_log [libdefaults] default_realm = $realm +forwardable = false [realms] $realm = { @@ -240,6 +243,7 @@ $node->restart; test_access($node, 'test1', 'SELECT true', 2, '', 'fails without ticket'); run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?); +run_log [ $klist, '-f' ] or BAIL_OUT($?); test_access( $node, @@ -262,7 +266,7 @@ test_access( '', 'succeeds with mapping with default gssencmode and host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access( @@ -273,7 +277,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred with host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access( $node, @@ -283,7 +287,7 @@ test_access( 'gssencmode=require', 'succeeds with GSS-encrypted access required with host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); # Test that we can transport a reasonable amount of data. @@ -312,6 +316,11 @@ $node->append_conf('pg_hba.conf', qq{hostgssenc all all $hostaddr/32 gss map=mymap}); $node->restart; +string_replace_file($krb5_conf, "forwardable = false", "forwardable = true"); + +run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?); +run_log [ $klist, '-f' ] or BAIL_OUT($?); + test_access( $node, 'test1', @@ -320,7 +329,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred and hostgssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); test_access( $node, @@ -330,7 +339,7 @@ test_access( 'gssencmode=require', 'succeeds with GSS-encrypted access required and hostgssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); test_access($node, 'test1', 'SELECT true', 2, 'gssencmode=disable', 'fails with GSS encryption disabled and hostgssenc hba'); @@ -348,7 +357,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred and hostnogssenc hba, but no encryption', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, proxy_credentials=yes, principal=test1\@$realm)" ); test_access($node, 'test1', 'SELECT true', 2, 'gssencmode=require', 'fails with GSS-encrypted access required and hostnogssenc hba'); @@ -360,7 +369,7 @@ test_access( 'gssencmode=disable', 'succeeds with GSS encryption disabled and hostnogssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, proxy_credentials=yes, principal=test1\@$realm)" ); truncate($node->data_dir . '/pg_ident.conf', 0); @@ -377,7 +386,7 @@ test_access( '', 'succeeds with include_realm=0 and defaults', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); # Reset pg_hba.conf, and cause a usermap failure with an authentication diff --git a/src/test/perl/PostgreSQL/Test/Utils.pm b/src/test/perl/PostgreSQL/Test/Utils.pm index 46cd746796..e49ee3662c 100644 --- a/src/test/perl/PostgreSQL/Test/Utils.pm +++ b/src/test/perl/PostgreSQL/Test/Utils.pm @@ -65,6 +65,7 @@ our @EXPORT = qw( slurp_dir slurp_file append_to_file + string_replace_file check_mode_recursive chmod_recursive check_pg_config @@ -532,6 +533,32 @@ sub append_to_file =pod +=item string_replace_file(filename, find, replace) + +Find and replace string of a given file. + +=cut + +sub string_replace_file +{ + my ($filename, $find, $replace) = @_; + open(my $in, '<', $filename); + my $content; + while(<$in>) + { + $_ =~ s/$find/$replace/; + $content = $content.$_; + } + close $in; + open(my $out, '>', $filename); + print $out $content; + close($out); + + return; +} + +=pod + =item check_mode_recursive(dir, expected_dir_mode, expected_file_mode, ignore_list) Check that all file/dir modes in a directory match the expected values, -- 2.30.2 [application/pgp-signature] signature.asc (819B, ../../[email protected]/3-signature.asc) download ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-03-11 23:55 Jacob Champion <[email protected]> parent: Stephen Frost <[email protected]> 0 siblings, 1 reply; 17+ messages in thread From: Jacob Champion @ 2022-03-11 23:55 UTC (permalink / raw) To: [email protected] <[email protected]>; [email protected] <[email protected]>; +Cc: [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]> On Mon, 2022-02-28 at 20:28 -0500, Stephen Frost wrote: > Will add to the CF for consideration. GSSAPI newbie here, so caveat lector. > diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c > index efc53f3135..6f820a34f1 100644 > --- a/src/backend/libpq/auth.c > +++ b/src/backend/libpq/auth.c > @@ -920,6 +920,7 @@ pg_GSS_recvauth(Port *port) > int mtype; > StringInfoData buf; > gss_buffer_desc gbuf; > + gss_cred_id_t proxy; > > /* > * Use the configured keytab, if there is one. Unfortunately, Heimdal > @@ -949,6 +950,9 @@ pg_GSS_recvauth(Port *port) > */ > port->gss->ctx = GSS_C_NO_CONTEXT; > > + proxy = NULL; > + port->gss->proxy_creds = false; > + > /* > * Loop through GSSAPI message exchange. This exchange can consist of > * multiple messages sent in both directions. First message is always from > @@ -999,7 +1003,7 @@ pg_GSS_recvauth(Port *port) > &port->gss->outbuf, > &gflags, > NULL, > - NULL); > + &proxy); > > /* gbuf no longer used */ > pfree(buf.data); > @@ -1011,6 +1015,12 @@ pg_GSS_recvauth(Port *port) > > CHECK_FOR_INTERRUPTS(); > > + if (proxy != NULL) > + { > + pg_store_proxy_credential(proxy); > + port->gss->proxy_creds = true; > + } > + Some implementation docs [1] imply that a delegated_cred_handle is only valid if the ret_flags include GSS_C_DELEG_FLAG. The C-binding RFC [2], though, says that we can rely on it being set to GSS_C_NO_CREDENTIAL if no handle was sent... I don't know if there are any implementation differences here, but in any case I think it'd be more clear to use the GSS_C_NO_CREDENTIAL spelling (instead of NULL) here, if we do decide not to check ret_flags. [5] says we have to free the proxy credential with GSS_Release_cred(); I don't see that happening anywhere, but I may have missed it. > maj_stat = gss_init_sec_context(&min_stat, > - GSS_C_NO_CREDENTIAL, > + proxy, > &conn->gctx, > conn->gtarg_nam, > GSS_C_NO_OID, > - GSS_C_MUTUAL_FLAG, > + GSS_C_MUTUAL_FLAG | GSS_C_DELEG_FLAG, > 0, > GSS_C_NO_CHANNEL_BINDINGS, > (ginbuf.value == NULL) ? GSS_C_NO_BUFFER : &ginbuf, > diff --git a/src/interfaces/libpq/fe-secure-gssapi.c b/src/interfaces/libpq/fe-secure-gssapi.c > index 6ea52ed866..566c89f52f 100644 > --- a/src/interfaces/libpq/fe-secure-gssapi.c > +++ b/src/interfaces/libpq/fe-secure-gssapi.c > @@ -631,7 +631,7 @@ pqsecure_open_gss(PGconn *conn) > */ > major = gss_init_sec_context(&minor, conn->gcred, &conn->gctx, > conn->gtarg_nam, GSS_C_NO_OID, > - GSS_REQUIRED_FLAGS, 0, 0, &input, NULL, > + GSS_REQUIRED_FLAGS | GSS_C_DELEG_FLAG, 0, 0, &input, NULL, It seems like there should be significant security implications to allowing delegation across the board. Especially since one postgres_fdw might delegate to another server, and then another... Should this be opt-in, maybe via a connection parameter? (It also looks like there are some mechanisms for further constraining delegation scope, either by administrator policy or otherwise [3, 4]. Might be a good thing for a v2 of this feature to have.) Similarly, it feels a little strange that the server would allow the client to unilaterally force the use of a delegated credential. I think that should be opt-in on the server side too, unless there's some context I'm missing around why that's safe. > + /* Make the proxy credential only available to current process */ > + major = gss_store_cred_into(&minor, > + cred, > + GSS_C_INITIATE, /* credential only used for starting libpq connection */ > + GSS_C_NULL_OID, /* store all */ > + true, /* overwrite */ > + true, /* make default */ > + &ccset, > + &mech, > + &usage); > + > + > + if (major != GSS_S_COMPLETE) > + { > + pg_GSS_error("gss_store_cred", major, minor); > + } > + > + /* quite strange that gss_store_cred doesn't work with "KRB5CCNAME=MEMORY:", > + * we have to use gss_store_cred_into instead and set the env for later > + * gss_acquire_cred calls. */ > + setenv("KRB5CCNAME", GSS_MEMORY_CACHE, 1); If I'm reading it right, we're resetting the default credential in the MEMORY cache, so if you're a libpq client doing your own GSSAPI work, I'm guessing you might not be happy with this behavior. Also, we're globally ignoring whatever ccache was set by an administrator. Can't two postgres_fdw connections from the same backend process require different settings? I notice that gss_store_cred_into() has a companion, gss_acquire_cred_from(). Is it possible to use that to pull out our delegated credential explicitly by name, instead of stomping on the global setup? Thanks, --Jacob [1] https://docs.oracle.com/cd/E36784_01/html/E36875/gss-accept-sec-context-3gss.html [2] https://datatracker.ietf.org/doc/html/rfc2744#section-5.1 [3] https://datatracker.ietf.org/doc/html/rfc5896 [4] https://web.mit.edu/kerberos/krb5-latest/doc/appdev/gssapi.html#constrained-delegation-s4u [5] https://datatracker.ietf.org/doc/html/rfc2743#page-50 ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-03-12 00:39 Stephen Frost <[email protected]> parent: Jacob Champion <[email protected]> 0 siblings, 1 reply; 17+ messages in thread From: Stephen Frost @ 2022-03-12 00:39 UTC (permalink / raw) To: Jacob Champion <[email protected]>; +Cc: [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]> Greetings, On Fri, Mar 11, 2022 at 18:55 Jacob Champion <[email protected]> wrote: > On Mon, 2022-02-28 at 20:28 -0500, Stephen Frost wrote: > > Will add to the CF for consideration. > > GSSAPI newbie here, so caveat lector. No worries, thanks for your interest! > diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c > > index efc53f3135..6f820a34f1 100644 > > --- a/src/backend/libpq/auth.c > > +++ b/src/backend/libpq/auth.c > > @@ -920,6 +920,7 @@ pg_GSS_recvauth(Port *port) > > int mtype; > > StringInfoData buf; > > gss_buffer_desc gbuf; > > + gss_cred_id_t proxy; > > > > /* > > * Use the configured keytab, if there is one. Unfortunately, > Heimdal > > @@ -949,6 +950,9 @@ pg_GSS_recvauth(Port *port) > > */ > > port->gss->ctx = GSS_C_NO_CONTEXT; > > > > + proxy = NULL; > > + port->gss->proxy_creds = false; > > + > > /* > > * Loop through GSSAPI message exchange. This exchange can consist > of > > * multiple messages sent in both directions. First message is > always from > > @@ -999,7 +1003,7 @@ pg_GSS_recvauth(Port *port) > > > &port->gss->outbuf, > > > &gflags, > > > NULL, > > - > NULL); > > + > &proxy); > > > > /* gbuf no longer used */ > > pfree(buf.data); > > @@ -1011,6 +1015,12 @@ pg_GSS_recvauth(Port *port) > > > > CHECK_FOR_INTERRUPTS(); > > > > + if (proxy != NULL) > > + { > > + pg_store_proxy_credential(proxy); > > + port->gss->proxy_creds = true; > > + } > > + > > Some implementation docs [1] imply that a delegated_cred_handle is only > valid if the ret_flags include GSS_C_DELEG_FLAG. The C-binding RFC [2], > though, says that we can rely on it being set to GSS_C_NO_CREDENTIAL if > no handle was sent... > > I don't know if there are any implementation differences here, but in > any case I think it'd be more clear to use the GSS_C_NO_CREDENTIAL > spelling (instead of NULL) here, if we do decide not to check > ret_flags. Hmmm, yeah, that seems like it might be better and is something I’ll take a look at. [5] says we have to free the proxy credential with GSS_Release_cred(); > I don't see that happening anywhere, but I may have missed it. I’m not sure that it’s really necessary or worthwhile to do that at process end since … the process is about to end. I suppose we could provide a function that a user could call to ask for it to be released sooner if we really wanted..? > maj_stat = gss_init_sec_context(&min_stat, > > - > GSS_C_NO_CREDENTIAL, > > + > proxy, > > > &conn->gctx, > > > conn->gtarg_nam, > > > GSS_C_NO_OID, > > - > GSS_C_MUTUAL_FLAG, > > + > GSS_C_MUTUAL_FLAG | GSS_C_DELEG_FLAG, > > 0, > > > GSS_C_NO_CHANNEL_BINDINGS, > > > (ginbuf.value == NULL) ? GSS_C_NO_BUFFER : &ginbuf, > > diff --git a/src/interfaces/libpq/fe-secure-gssapi.c > b/src/interfaces/libpq/fe-secure-gssapi.c > > index 6ea52ed866..566c89f52f 100644 > > --- a/src/interfaces/libpq/fe-secure-gssapi.c > > +++ b/src/interfaces/libpq/fe-secure-gssapi.c > > @@ -631,7 +631,7 @@ pqsecure_open_gss(PGconn *conn) > > */ > > major = gss_init_sec_context(&minor, conn->gcred, &conn->gctx, > > > conn->gtarg_nam, GSS_C_NO_OID, > > - > GSS_REQUIRED_FLAGS, 0, 0, &input, NULL, > > + > GSS_REQUIRED_FLAGS | GSS_C_DELEG_FLAG, 0, 0, &input, NULL, > > It seems like there should be significant security implications to > allowing delegation across the board. Especially since one postgres_fdw > might delegate to another server, and then another... Should this be > opt-in, maybe via a connection parameter? This is already opt-in- at kinit time a user can decide if they’d like a proxy-able ticket or not. I don’t know that we really need to have our own option for it … tho I’m not really against adding such an option either. (It also looks like there are some mechanisms for further constraining > delegation scope, either by administrator policy or otherwise [3, 4]. > Might be a good thing for a v2 of this feature to have.) Yes, constrained delegation is a pretty neat extension to Kerberos and one I’d like to look at later as a future enhancement but I don’t think it needs to be in the initial version. Similarly, it feels a little strange that the server would allow the > client to unilaterally force the use of a delegated credential. I think > that should be opt-in on the server side too, unless there's some > context I'm missing around why that's safe. Perhaps you could explain what isn’t safe about accepting a delegated credential from a client..? I am not away of a risk to accepting such a delegated credential. Even so, I’m not against adding an option… but exactly how would that option be configured? Server level? On the HBA line? role level..? > + /* Make the proxy credential only available to current process */ > > + major = gss_store_cred_into(&minor, > > + cred, > > + GSS_C_INITIATE, /* credential only used for starting libpq > connection */ > > + GSS_C_NULL_OID, /* store all */ > > + true, /* overwrite */ > > + true, /* make default */ > > + &ccset, > > + &mech, > > + &usage); > > + > > + > > + if (major != GSS_S_COMPLETE) > > + { > > + pg_GSS_error("gss_store_cred", major, minor); > > + } > > + > > + /* quite strange that gss_store_cred doesn't work with > "KRB5CCNAME=MEMORY:", > > + * we have to use gss_store_cred_into instead and set the env for > later > > + * gss_acquire_cred calls. */ > > + setenv("KRB5CCNAME", GSS_MEMORY_CACHE, 1); > > If I'm reading it right, we're resetting the default credential in the > MEMORY cache, so if you're a libpq client doing your own GSSAPI work, > I'm guessing you might not be happy with this behavior. This is just done on the server side and not the client side..? Also, we're > globally ignoring whatever ccache was set by an administrator. Can't > two postgres_fdw connections from the same backend process require > different settings? Settings..? Perhaps, but delegated credentials aren’t really settings, so not really sure what you’re suggesting here. I notice that gss_store_cred_into() has a companion, > gss_acquire_cred_from(). Is it possible to use that to pull out our > delegated credential explicitly by name, instead of stomping on the > global setup? Not really sure what is meant here by global setup..? Feeling like this is a follow on confusion from maybe mixing server vs client libpq? Thanks, Stephen > ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-03-15 17:59 Jacob Champion <[email protected]> parent: Stephen Frost <[email protected]> 0 siblings, 1 reply; 17+ messages in thread From: Jacob Champion @ 2022-03-15 17:59 UTC (permalink / raw) To: [email protected] <[email protected]>; +Cc: [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]> On Fri, 2022-03-11 at 19:39 -0500, Stephen Frost wrote: > > On Fri, Mar 11, 2022 at 18:55 Jacob Champion <[email protected]> wrote: > > > > [5] says we have to free the proxy credential with GSS_Release_cred(); > > I don't see that happening anywhere, but I may have missed it. > > I’m not sure that it’s really necessary or worthwhile to do that at > process end since … the process is about to end. I suppose we could > provide a function that a user could call to ask for it to be > released sooner if we really wanted..? Do we have to keep the credential handle around once we've stored it into the MEMORY: cache, though? Just seems like a leak that someone will have to plug eventually, even if it doesn't really impact things now. > > It seems like there should be significant security implications to > > allowing delegation across the board. Especially since one postgres_fdw > > might delegate to another server, and then another... Should this be > > opt-in, maybe via a connection parameter? > > This is already opt-in- at kinit time a user can decide if they’d > like a proxy-able ticket or not. I don’t know that we really need to > have our own option for it … tho I’m not really against adding such > an option either. I don't really have experience with the use case. Is it normal for kinit users to have to decide once, globally, whether they want everything they interact with to be able to proxy their credentials? It just seems like you'd want more fine-grained control over who gets to masquerade as you. > > Similarly, it feels a little strange that the server would allow the > > client to unilaterally force the use of a delegated credential. I think > > that should be opt-in on the server side too, unless there's some > > context I'm missing around why that's safe. > > Perhaps you could explain what isn’t safe about accepting a delegated > credential from a client..? I am not away of a risk to accepting > such a delegated credential. My initial impression is that this is effectively modifying the USER MAPPING that the admin has set up. I'd be worried about an open credential proxy being used to bypass firewall or HBA restrictions, for instance -- you might not be able to connect as an admin from your machine, but you might be able to connect by bouncing through a proxy. (What damage you can do is going to be limited by what the server extensions can do, of course.) Another danger might be disclosure/compromise of middlebox secrets? Is it possible for someone who has one half of the credentials to snoop on a gssenc connection between the proxy Postgres and the backend Postgres? > Even so, I’m not against adding an option… but exactly how would that > option be configured? Server level? On the HBA line? role level..? In the OPTIONS for CREATE SERVER, maybe? At least for the FDW case. > > If I'm reading it right, we're resetting the default credential in the > > MEMORY cache, so if you're a libpq client doing your own GSSAPI work, > > I'm guessing you might not be happy with this behavior. > > This is just done on the server side and not the client side..? Yeah, I misread the patch, sorry. > > Also, we're > > globally ignoring whatever ccache was set by an administrator. Can't > > two postgres_fdw connections from the same backend process require > > different settings? > > Settings..? Perhaps, but delegated credentials aren’t really > settings, so not really sure what you’re suggesting here. I mean that one backend server might require delegated credentials, and another might require whatever the admin has already set up in the ccache, and the user might want to use tables from both servers in the same session. > > I notice that gss_store_cred_into() has a companion, > > gss_acquire_cred_from(). Is it possible to use that to pull out our > > delegated credential explicitly by name, instead of stomping on the > > global setup? > > Not really sure what is meant here by global setup..? Feeling like > this is a follow on confusion from maybe mixing server vs client > libpq? By my reading, the gss_store_cred_into() call followed by the setenv("KRB5CCNAME", ...) is effectively performing global configuration for the process. Any KRB5CCNAME already set up by the server admin is going to be ignored from that point onward. Is that accurate? Thanks, --Jacob ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-04-06 19:27 Stephen Frost <[email protected]> parent: Jacob Champion <[email protected]> 0 siblings, 1 reply; 17+ messages in thread From: Stephen Frost @ 2022-04-06 19:27 UTC (permalink / raw) To: Jacob Champion <[email protected]>; +Cc: [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]> Greetinsg, * Jacob Champion ([email protected]) wrote: > On Fri, 2022-03-11 at 19:39 -0500, Stephen Frost wrote: > > On Fri, Mar 11, 2022 at 18:55 Jacob Champion <[email protected]> wrote: > > > [5] says we have to free the proxy credential with GSS_Release_cred(); > > > I don't see that happening anywhere, but I may have missed it. > > > > I’m not sure that it’s really necessary or worthwhile to do that at > > process end since … the process is about to end. I suppose we could > > provide a function that a user could call to ask for it to be > > released sooner if we really wanted..? > > Do we have to keep the credential handle around once we've stored it > into the MEMORY: cache, though? Just seems like a leak that someone > will have to plug eventually, even if it doesn't really impact things > now. We don't, so I've fixed that in the attached. Not sure it's that big a deal but I don't think it hurts anything either. > > > It seems like there should be significant security implications to > > > allowing delegation across the board. Especially since one postgres_fdw > > > might delegate to another server, and then another... Should this be > > > opt-in, maybe via a connection parameter? > > > > This is already opt-in- at kinit time a user can decide if they’d > > like a proxy-able ticket or not. I don’t know that we really need to > > have our own option for it … tho I’m not really against adding such > > an option either. > > I don't really have experience with the use case. Is it normal for > kinit users to have to decide once, globally, whether they want > everything they interact with to be able to proxy their credentials? It > just seems like you'd want more fine-grained control over who gets to > masquerade as you. Yes, that's pretty typical for kinit users- they usually go with whatever the org policy is. Now, you're not wrong about wanting more fine-grained control, which is what's known as 'constrained delegation'. That's something that Kerberos in general supports these days though it's more complicated and requires additional code to do. That's something that I think we could certainly add later on. > > > Similarly, it feels a little strange that the server would allow the > > > client to unilaterally force the use of a delegated credential. I think > > > that should be opt-in on the server side too, unless there's some > > > context I'm missing around why that's safe. > > > > Perhaps you could explain what isn’t safe about accepting a delegated > > credential from a client..? I am not away of a risk to accepting > > such a delegated credential. > > My initial impression is that this is effectively modifying the USER > MAPPING that the admin has set up. I'd be worried about an open > credential proxy being used to bypass firewall or HBA restrictions, for > instance -- you might not be able to connect as an admin from your > machine, but you might be able to connect by bouncing through a proxy. > (What damage you can do is going to be limited by what the server > extensions can do, of course.) I'm not sure that I really see the concern here. Also, in order for this to work, the user mapping would have to be created with "password required = false". Maybe that's something we revisit later, but it seems like a good way to allow an admin to have control over this. > Another danger might be disclosure/compromise of middlebox secrets? Is > it possible for someone who has one half of the credentials to snoop on > a gssenc connection between the proxy Postgres and the backend > Postgres? A compromised middlebox would, of course, be an issue- for any kind of delegated credentials (which certainly goes for cleartext passwords being passed along, and that's currently the only thing we support..). One nice thing about GSSAPI is that the client and the server validate each other, so it wouldn't just be 'any' middle-box but would have to be one that was actually a trusted system in the infrastructure which has somehow been compromised and was still trusted. > > Even so, I’m not against adding an option… but exactly how would that > > option be configured? Server level? On the HBA line? role level..? > > In the OPTIONS for CREATE SERVER, maybe? At least for the FDW case. I'm a bit confused on this. The option to allow or not allow delegated credentials couldn't be something that's in the CREATE SERVER for FDWs as it applies to more than just FDWs but also dblink and anything else where we reach out from PG to contact some other system. > > > If I'm reading it right, we're resetting the default credential in the > > > MEMORY cache, so if you're a libpq client doing your own GSSAPI work, > > > I'm guessing you might not be happy with this behavior. > > > > This is just done on the server side and not the client side..? > > Yeah, I misread the patch, sorry. No worries. > > > Also, we're > > > globally ignoring whatever ccache was set by an administrator. Can't > > > two postgres_fdw connections from the same backend process require > > > different settings? > > > > Settings..? Perhaps, but delegated credentials aren’t really > > settings, so not really sure what you’re suggesting here. > > I mean that one backend server might require delegated credentials, and > another might require whatever the admin has already set up in the > ccache, and the user might want to use tables from both servers in the > same session. That an admin might have a credential cache that's picked up and used for connections from a regular user backend to another system strikes me as an altogether concerning idea. Even so, in such a case, the admin would have had to set up the user mapping with 'password required = false' or it wouldn't have worked for a non-superuser anyway, so I'm not sure that I'm too worried about this case. > > > I notice that gss_store_cred_into() has a companion, > > > gss_acquire_cred_from(). Is it possible to use that to pull out our > > > delegated credential explicitly by name, instead of stomping on the > > > global setup? > > > > Not really sure what is meant here by global setup..? Feeling like > > this is a follow on confusion from maybe mixing server vs client > > libpq? > > By my reading, the gss_store_cred_into() call followed by > the setenv("KRB5CCNAME", ...) is effectively performing global > configuration for the process. Any KRB5CCNAME already set up by the > server admin is going to be ignored from that point onward. Is that > accurate? The process, yes, but I guess I disagree on that being 'global'- it's just for that PG backend process. Attached is an updated patch which adds the gss_release_creds call, a function in libpq to allow checking if the libpq connection was made using GSS, changes to dblink to have it check for password-or-gss when connecting to a remote system, and tests for dblink and postgres_fdw to make sure that this all works correctly. Thoughts? Thanks! Stephen Attachments: [text/x-diff] v4-0001-kerberos-delegation.patch (25.2K, ../../[email protected]/2-v4-0001-kerberos-delegation.patch) download | inline diff: From b9aaf1705d9de6ac9e95d97980551ac27343bcab Mon Sep 17 00:00:00 2001 From: Stephen Frost <[email protected]> Date: Mon, 28 Feb 2022 20:17:55 -0500 Subject: [PATCH] Add support for Kerberos credential delegation Accept GSSAPI/Kerberos delegated credentials. With this, a user could authenticate to PostgreSQL using Kerberos credentials, delegate credentials to the PostgreSQL server, and then the PostgreSQL server could use those credentials to connect to another service, such as with postgres_fdw or dblink or theoretically any other authenticated connection which is able to use delegated credentials. Original patch by: Peifeng Qiu, whacked around some by me. --- contrib/dblink/dblink.c | 6 +- .../postgres_fdw/expected/postgres_fdw.out | 2 +- contrib/postgres_fdw/option.c | 3 + doc/src/sgml/libpq.sgml | 19 +++++ src/backend/libpq/auth.c | 12 +++- src/backend/libpq/be-gssapi-common.c | 51 +++++++++++++ src/backend/libpq/be-secure-gssapi.c | 26 ++++++- src/backend/utils/init/postinit.c | 8 ++- src/include/libpq/be-gssapi-common.h | 3 + src/include/libpq/libpq-be.h | 2 + src/interfaces/libpq/exports.txt | 1 + src/interfaces/libpq/fe-auth.c | 12 +++- src/interfaces/libpq/fe-connect.c | 12 ++++ src/interfaces/libpq/fe-secure-gssapi.c | 3 +- src/interfaces/libpq/libpq-fe.h | 1 + src/interfaces/libpq/libpq-int.h | 1 + src/test/kerberos/Makefile | 3 + src/test/kerberos/t/001_auth.pl | 71 ++++++++++++++++--- src/test/perl/PostgreSQL/Test/Utils.pm | 27 +++++++ 19 files changed, 243 insertions(+), 20 deletions(-) diff --git a/contrib/dblink/dblink.c b/contrib/dblink/dblink.c index a06d4bd12d..e5b70e084e 100644 --- a/contrib/dblink/dblink.c +++ b/contrib/dblink/dblink.c @@ -2643,7 +2643,7 @@ dblink_security_check(PGconn *conn, remoteConn *rconn) { if (!superuser()) { - if (!PQconnectionUsedPassword(conn)) + if (!(PQconnectionUsedPassword(conn) || PQconnectionUsedGSSAPI(conn))) { PQfinish(conn); ReleaseExternalFD(); @@ -2652,8 +2652,8 @@ dblink_security_check(PGconn *conn, remoteConn *rconn) ereport(ERROR, (errcode(ERRCODE_S_R_E_PROHIBITED_SQL_STATEMENT_ATTEMPTED), - errmsg("password is required"), - errdetail("Non-superuser cannot connect if the server does not request a password."), + errmsg("password or GSSAPI is required"), + errdetail("Non-superuser cannot connect if the server does not request a password or use GSSAPI."), errhint("Target server's authentication method must be changed."))); } } diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out index 30e95f585f..d472c24601 100644 --- a/contrib/postgres_fdw/expected/postgres_fdw.out +++ b/contrib/postgres_fdw/expected/postgres_fdw.out @@ -188,7 +188,7 @@ ALTER USER MAPPING FOR public SERVER testserver1 ALTER USER MAPPING FOR public SERVER testserver1 OPTIONS (ADD sslmode 'require'); ERROR: invalid option "sslmode" -HINT: Valid options in this context are: user, password, sslpassword, password_required, sslcert, sslkey +HINT: Valid options in this context are: user, password, sslpassword, password_required, sslcert, sslkey, gssencmode -- But we can add valid ones fine ALTER USER MAPPING FOR public SERVER testserver1 OPTIONS (ADD sslpassword 'dummy'); diff --git a/contrib/postgres_fdw/option.c b/contrib/postgres_fdw/option.c index 572591a558..05922cfe6d 100644 --- a/contrib/postgres_fdw/option.c +++ b/contrib/postgres_fdw/option.c @@ -262,6 +262,9 @@ InitPgFdwOptions(void) {"sslcert", UserMappingRelationId, true}, {"sslkey", UserMappingRelationId, true}, + /* gssencmode is also libpq option, same to above. */ + {"gssencmode", UserMappingRelationId, true}, + {NULL, InvalidOid, false} }; diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index 1c20901c3c..22ba41ea10 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -2489,6 +2489,25 @@ int PQconnectionUsedPassword(const PGconn *conn); </para> </listitem> </varlistentry> + + <varlistentry id="libpq-PQconnectionUsedGSSAPI"> + <term><function>PQconnectionUsedGSSAPI</function><indexterm><primary>PQconnectionUsedGSSAPI</primary></indexterm></term> + <listitem> + <para> + Returns true (1) if the connection authentication method + used GSSAPI. Returns false (0) if not. + +<synopsis> +int PQconnectionUsedGSSAPI(const PGconn *conn); +</synopsis> + </para> + + <para> + This function can be applied to detect whether the connection was + authenticated with GSSAPI. + </para> + </listitem> + </varlistentry> </variablelist> </para> diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index efc53f3135..6f820a34f1 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -920,6 +920,7 @@ pg_GSS_recvauth(Port *port) int mtype; StringInfoData buf; gss_buffer_desc gbuf; + gss_cred_id_t proxy; /* * Use the configured keytab, if there is one. Unfortunately, Heimdal @@ -949,6 +950,9 @@ pg_GSS_recvauth(Port *port) */ port->gss->ctx = GSS_C_NO_CONTEXT; + proxy = NULL; + port->gss->proxy_creds = false; + /* * Loop through GSSAPI message exchange. This exchange can consist of * multiple messages sent in both directions. First message is always from @@ -999,7 +1003,7 @@ pg_GSS_recvauth(Port *port) &port->gss->outbuf, &gflags, NULL, - NULL); + &proxy); /* gbuf no longer used */ pfree(buf.data); @@ -1011,6 +1015,12 @@ pg_GSS_recvauth(Port *port) CHECK_FOR_INTERRUPTS(); + if (proxy != NULL) + { + pg_store_proxy_credential(proxy); + port->gss->proxy_creds = true; + } + if (port->gss->outbuf.length != 0) { /* diff --git a/src/backend/libpq/be-gssapi-common.c b/src/backend/libpq/be-gssapi-common.c index 71b796d5a2..9e7e7b5c85 100644 --- a/src/backend/libpq/be-gssapi-common.c +++ b/src/backend/libpq/be-gssapi-common.c @@ -92,3 +92,54 @@ pg_GSS_error(const char *errmsg, (errmsg_internal("%s", errmsg), errdetail_internal("%s: %s", msg_major, msg_minor))); } + +/* + * Store the credentials passed in into the memory cache for later usage. + * + * This allows credentials to be delegated to us for us to use to connect + * to other systems with, using, e.g. postgres_fdw or dblink. + */ +#define GSS_MEMORY_CACHE "MEMORY:" +void +pg_store_proxy_credential(gss_cred_id_t cred) +{ + OM_uint32 major, minor; + gss_OID_set mech; + gss_cred_usage_t usage; + gss_key_value_element_desc cc; + gss_key_value_set_desc ccset; + + cc.key = "ccache"; + cc.value = GSS_MEMORY_CACHE; + ccset.count = 1; + ccset.elements = &cc; + + /* Make the proxy credential only available to current process */ + major = gss_store_cred_into(&minor, + cred, + GSS_C_INITIATE, /* credential only used for starting libpq connection */ + GSS_C_NULL_OID, /* store all */ + true, /* overwrite */ + true, /* make default */ + &ccset, + &mech, + &usage); + + if (major != GSS_S_COMPLETE) + { + pg_GSS_error("gss_store_cred", major, minor); + } + + /* Credential stored, so we can release our credential handle. */ + major = gss_release_cred(&minor, &cred); + if (major != GSS_S_COMPLETE) + { + pg_GSS_error("gss_release_cred", major, minor); + } + + /* + * Set KRB5CCNAME for this backend, so that later calls to gss_acquire_cred + * will find the proxied credentials we stored. + */ + setenv("KRB5CCNAME", GSS_MEMORY_CACHE, 1); +} diff --git a/src/backend/libpq/be-secure-gssapi.c b/src/backend/libpq/be-secure-gssapi.c index 2844c5aa4b..bece580f61 100644 --- a/src/backend/libpq/be-secure-gssapi.c +++ b/src/backend/libpq/be-secure-gssapi.c @@ -497,6 +497,7 @@ secure_open_gssapi(Port *port) bool complete_next = false; OM_uint32 major, minor; + gss_cred_id_t proxy; /* * Allocate subsidiary Port data for GSSAPI operations. @@ -504,6 +505,9 @@ secure_open_gssapi(Port *port) port->gss = (pg_gssinfo *) MemoryContextAllocZero(TopMemoryContext, sizeof(pg_gssinfo)); + proxy = NULL; + port->gss->proxy_creds = false; + /* * Allocate buffers and initialize state variables. By malloc'ing the * buffers at this point, we avoid wasting static data space in processes @@ -588,7 +592,8 @@ secure_open_gssapi(Port *port) GSS_C_NO_CREDENTIAL, &input, GSS_C_NO_CHANNEL_BINDINGS, &port->gss->name, NULL, &output, NULL, - NULL, NULL); + NULL, &proxy); + if (GSS_ERROR(major)) { pg_GSS_error(_("could not accept GSSAPI security context"), @@ -605,6 +610,12 @@ secure_open_gssapi(Port *port) complete_next = true; } + if (proxy != NULL) + { + pg_store_proxy_credential(proxy); + port->gss->proxy_creds = true; + } + /* Done handling the incoming packet, reset our buffer */ PqGSSRecvLength = 0; @@ -731,3 +742,16 @@ be_gssapi_get_princ(Port *port) return port->gss->princ; } + +/* + * Return if GSSAPI delegated/proxy credentials were included on this + * connection. + */ +bool +be_gssapi_get_proxy(Port *port) +{ + if (!port || !port->gss) + return NULL; + + return port->gss->proxy_creds; +} diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c index 342169b195..27b3404b86 100644 --- a/src/backend/utils/init/postinit.c +++ b/src/backend/utils/init/postinit.c @@ -284,15 +284,17 @@ PerformAuthentication(Port *port) if (princ) appendStringInfo(&logmsg, - _(" GSS (authenticated=%s, encrypted=%s, principal=%s)"), + _(" GSS (authenticated=%s, encrypted=%s, proxy_credentials=%s, principal=%s)"), be_gssapi_get_auth(port) ? _("yes") : _("no"), be_gssapi_get_enc(port) ? _("yes") : _("no"), + be_gssapi_get_proxy(port) ? _("yes") : _("no"), princ); else appendStringInfo(&logmsg, - _(" GSS (authenticated=%s, encrypted=%s)"), + _(" GSS (authenticated=%s, encrypted=%s, proxy_credentials=%s)"), be_gssapi_get_auth(port) ? _("yes") : _("no"), - be_gssapi_get_enc(port) ? _("yes") : _("no")); + be_gssapi_get_enc(port) ? _("yes") : _("no"), + be_gssapi_get_proxy(port) ? _("yes") : _("no")); } #endif diff --git a/src/include/libpq/be-gssapi-common.h b/src/include/libpq/be-gssapi-common.h index ae8411245d..6953157f05 100644 --- a/src/include/libpq/be-gssapi-common.h +++ b/src/include/libpq/be-gssapi-common.h @@ -18,13 +18,16 @@ #if defined(HAVE_GSSAPI_H) #include <gssapi.h> +#include <gssapi_ext.h> #else #include <gssapi/gssapi.h> +#include <gssapi/gssapi_ext.h> #endif extern void pg_GSS_error(const char *errmsg, OM_uint32 maj_stat, OM_uint32 min_stat); +extern void pg_store_proxy_credential(gss_cred_id_t cred); #endif /* ENABLE_GSS */ #endif /* BE_GSSAPI_COMMON_H */ diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h index c3bf514652..5cc221617e 100644 --- a/src/include/libpq/libpq-be.h +++ b/src/include/libpq/libpq-be.h @@ -94,6 +94,7 @@ typedef struct * GSSAPI auth was not used */ bool auth; /* GSSAPI Authentication used */ bool enc; /* GSSAPI encryption in use */ + bool proxy_creds; /* GSSAPI Delegated/proxy credentials */ #endif } pg_gssinfo; #endif @@ -320,6 +321,7 @@ extern PGDLLIMPORT openssl_tls_init_hook_typ openssl_tls_init_hook; extern bool be_gssapi_get_auth(Port *port); extern bool be_gssapi_get_enc(Port *port); extern const char *be_gssapi_get_princ(Port *port); +extern bool be_gssapi_get_proxy(Port *port); /* Read and write to a GSSAPI-encrypted connection. */ extern ssize_t be_gssapi_read(Port *port, void *ptr, size_t len); diff --git a/src/interfaces/libpq/exports.txt b/src/interfaces/libpq/exports.txt index e8bcc88370..7ded77aff3 100644 --- a/src/interfaces/libpq/exports.txt +++ b/src/interfaces/libpq/exports.txt @@ -186,3 +186,4 @@ PQpipelineStatus 183 PQsetTraceFlags 184 PQmblenBounded 185 PQsendFlushRequest 186 +PQconnectionUsedGSSAPI 187 diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c index 6fceff561b..943db5c722 100644 --- a/src/interfaces/libpq/fe-auth.c +++ b/src/interfaces/libpq/fe-auth.c @@ -61,6 +61,7 @@ pg_GSS_continue(PGconn *conn, int payloadlen) lmin_s; gss_buffer_desc ginbuf; gss_buffer_desc goutbuf; + gss_cred_id_t proxy; /* * On first call, there's no input token. On subsequent calls, read the @@ -93,12 +94,16 @@ pg_GSS_continue(PGconn *conn, int payloadlen) ginbuf.value = NULL; } + /* Check if we can aquire a proxy credential. */ + if (!pg_GSS_have_cred_cache(&proxy)) + proxy = GSS_C_NO_CREDENTIAL; + maj_stat = gss_init_sec_context(&min_stat, - GSS_C_NO_CREDENTIAL, + proxy, &conn->gctx, conn->gtarg_nam, GSS_C_NO_OID, - GSS_C_MUTUAL_FLAG, + GSS_C_MUTUAL_FLAG | GSS_C_DELEG_FLAG, 0, GSS_C_NO_CHANNEL_BINDINGS, (ginbuf.value == NULL) ? GSS_C_NO_BUFFER : &ginbuf, @@ -138,7 +143,10 @@ pg_GSS_continue(PGconn *conn, int payloadlen) } if (maj_stat == GSS_S_COMPLETE) + { gss_release_name(&lmin_s, &conn->gtarg_nam); + conn->gssapi_used = true; + } return STATUS_OK; } diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c index cf554d389f..a296c82d1d 100644 --- a/src/interfaces/libpq/fe-connect.c +++ b/src/interfaces/libpq/fe-connect.c @@ -600,6 +600,7 @@ pqDropServerData(PGconn *conn) conn->last_sqlstate[0] = '\0'; conn->auth_req_received = false; conn->password_needed = false; + conn->gssapi_used = false; conn->write_failed = false; if (conn->write_err_msg) free(conn->write_err_msg); @@ -6981,6 +6982,17 @@ PQconnectionUsedPassword(const PGconn *conn) return false; } +int +PQconnectionUsedGSSAPI(const PGconn *conn) +{ + if (!conn) + return false; + if (conn->gssapi_used) + return true; + else + return false; +} + int PQclientEncoding(const PGconn *conn) { diff --git a/src/interfaces/libpq/fe-secure-gssapi.c b/src/interfaces/libpq/fe-secure-gssapi.c index 6ea52ed866..5eeaca542d 100644 --- a/src/interfaces/libpq/fe-secure-gssapi.c +++ b/src/interfaces/libpq/fe-secure-gssapi.c @@ -631,7 +631,7 @@ pqsecure_open_gss(PGconn *conn) */ major = gss_init_sec_context(&minor, conn->gcred, &conn->gctx, conn->gtarg_nam, GSS_C_NO_OID, - GSS_REQUIRED_FLAGS, 0, 0, &input, NULL, + GSS_REQUIRED_FLAGS | GSS_C_DELEG_FLAG, 0, 0, &input, NULL, &output, NULL, NULL); /* GSS Init Sec Context uses the whole packet, so clear it */ @@ -651,6 +651,7 @@ pqsecure_open_gss(PGconn *conn) * to do GSS wrapping/unwrapping. */ conn->gssenc = true; + conn->gssapi_used = true; /* Clean up */ gss_release_cred(&minor, &conn->gcred); diff --git a/src/interfaces/libpq/libpq-fe.h b/src/interfaces/libpq/libpq-fe.h index 7986445f1a..bdd073c645 100644 --- a/src/interfaces/libpq/libpq-fe.h +++ b/src/interfaces/libpq/libpq-fe.h @@ -354,6 +354,7 @@ extern int PQbackendPID(const PGconn *conn); extern PGpipelineStatus PQpipelineStatus(const PGconn *conn); extern int PQconnectionNeedsPassword(const PGconn *conn); extern int PQconnectionUsedPassword(const PGconn *conn); +extern int PQconnectionUsedGSSAPI(const PGconn *conn); extern int PQclientEncoding(const PGconn *conn); extern int PQsetClientEncoding(PGconn *conn, const char *encoding); diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h index e0cee4b142..5dd9a52305 100644 --- a/src/interfaces/libpq/libpq-int.h +++ b/src/interfaces/libpq/libpq-int.h @@ -449,6 +449,7 @@ struct pg_conn int sversion; /* server version, e.g. 70401 for 7.4.1 */ bool auth_req_received; /* true if any type of auth req received */ bool password_needed; /* true if server demanded a password */ + bool gssapi_used; /* true if authenticated via gssapi */ bool sigpipe_so; /* have we masked SIGPIPE via SO_NOSIGPIPE? */ bool sigpipe_flag; /* can we mask SIGPIPE via MSG_NOSIGNAL? */ bool write_failed; /* have we had a write failure on sock? */ diff --git a/src/test/kerberos/Makefile b/src/test/kerberos/Makefile index c531998835..67dfaae901 100644 --- a/src/test/kerberos/Makefile +++ b/src/test/kerberos/Makefile @@ -13,6 +13,9 @@ subdir = src/test/kerberos top_builddir = ../../.. include $(top_builddir)/src/Makefile.global +EXTRA_INSTALL += contrib/postgres_fdw +EXTRA_INSTALL += contrib/dblink + export with_gssapi with_krb_srvnam check: diff --git a/src/test/kerberos/t/001_auth.pl b/src/test/kerberos/t/001_auth.pl index 62e0542639..c5dc552d15 100644 --- a/src/test/kerberos/t/001_auth.pl +++ b/src/test/kerberos/t/001_auth.pl @@ -45,6 +45,7 @@ elsif ($^O eq 'linux') my $krb5_config = 'krb5-config'; my $kinit = 'kinit'; +my $klist = 'klist'; my $kdb5_util = 'kdb5_util'; my $kadmin_local = 'kadmin.local'; my $krb5kdc = 'krb5kdc'; @@ -53,6 +54,7 @@ if ($krb5_bin_dir && -d $krb5_bin_dir) { $krb5_config = $krb5_bin_dir . '/' . $krb5_config; $kinit = $krb5_bin_dir . '/' . $kinit; + $klist = $krb5_bin_dir . '/' . $klist; } if ($krb5_sbin_dir && -d $krb5_sbin_dir) { @@ -97,6 +99,7 @@ kdc = FILE:$kdc_log [libdefaults] default_realm = $realm +forwardable = false [realms] $realm = { @@ -174,7 +177,21 @@ lc_messages = 'C' }); $node->start; +my $port = $node->port(); + $node->safe_psql('postgres', 'CREATE USER test1;'); +$node->safe_psql('postgres', 'CREATE EXTENSION postgres_fdw;'); +$node->safe_psql('postgres', 'CREATE EXTENSION dblink;'); +$node->safe_psql('postgres', "CREATE SERVER s1 FOREIGN DATA WRAPPER postgres_fdw OPTIONS (host '$host', hostaddr '$hostaddr', port '$port', dbname 'postgres');"); + +$node->safe_psql('postgres', 'GRANT USAGE ON FOREIGN SERVER s1 TO test1;'); + +$node->safe_psql('postgres', "CREATE USER MAPPING FOR test1 SERVER s1 OPTIONS (user 'test1', password_required 'false');"); +$node->safe_psql('postgres', "CREATE TABLE t1 (c1 int);"); +$node->safe_psql('postgres', "INSERT INTO t1 VALUES (1);"); +$node->safe_psql('postgres', "CREATE FOREIGN TABLE tf1 (c1 int) SERVER s1 OPTIONS (schema_name 'public', table_name 't1');"); +$node->safe_psql('postgres', "GRANT SELECT ON t1 TO test1;"); +$node->safe_psql('postgres', "GRANT SELECT ON tf1 TO test1;"); note "running tests"; @@ -240,6 +257,7 @@ $node->restart; test_access($node, 'test1', 'SELECT true', 2, '', 'fails without ticket'); run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?); +run_log [ $klist, '-f' ] or BAIL_OUT($?); test_access( $node, @@ -262,7 +280,7 @@ test_access( '', 'succeeds with mapping with default gssencmode and host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access( @@ -273,7 +291,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred with host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access( $node, @@ -283,7 +301,7 @@ test_access( 'gssencmode=require', 'succeeds with GSS-encrypted access required with host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); # Test that we can transport a reasonable amount of data. @@ -312,6 +330,11 @@ $node->append_conf('pg_hba.conf', qq{hostgssenc all all $hostaddr/32 gss map=mymap}); $node->restart; +string_replace_file($krb5_conf, "forwardable = false", "forwardable = true"); + +run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?); +run_log [ $klist, '-f' ] or BAIL_OUT($?); + test_access( $node, 'test1', @@ -320,7 +343,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred and hostgssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); test_access( $node, @@ -330,7 +353,7 @@ test_access( 'gssencmode=require', 'succeeds with GSS-encrypted access required and hostgssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); test_access($node, 'test1', 'SELECT true', 2, 'gssencmode=disable', 'fails with GSS encryption disabled and hostgssenc hba'); @@ -348,7 +371,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred and hostnogssenc hba, but no encryption', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, proxy_credentials=yes, principal=test1\@$realm)" ); test_access($node, 'test1', 'SELECT true', 2, 'gssencmode=require', 'fails with GSS-encrypted access required and hostnogssenc hba'); @@ -360,9 +383,25 @@ test_access( 'gssencmode=disable', 'succeeds with GSS encryption disabled and hostnogssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, proxy_credentials=yes, principal=test1\@$realm)" ); +test_query( + $node, + 'test1', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + qr/^1$/s, + 'gssencmode=prefer', + 'dblink works not-encrypted'); + +test_query( + $node, + 'test1', + "TABLE tf1;", + qr/^1$/s, + 'gssencmode=prefer', + 'postgres_fdw works not-encrypted'); + truncate($node->data_dir . '/pg_ident.conf', 0); unlink($node->data_dir . '/pg_hba.conf'); $node->append_conf('pg_hba.conf', @@ -377,9 +416,25 @@ test_access( '', 'succeeds with include_realm=0 and defaults', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); +test_query( + $node, + 'test1', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + qr/^1$/s, + 'gssencmode=require', + 'dblink works encrypted'); + +test_query( + $node, + 'test1', + "TABLE tf1;", + qr/^1$/s, + 'gssencmode=require', + 'postgres_fdw works encrypted'); + # Reset pg_hba.conf, and cause a usermap failure with an authentication # that has passed. unlink($node->data_dir . '/pg_hba.conf'); diff --git a/src/test/perl/PostgreSQL/Test/Utils.pm b/src/test/perl/PostgreSQL/Test/Utils.pm index dca1b3b17c..0f94a628a5 100644 --- a/src/test/perl/PostgreSQL/Test/Utils.pm +++ b/src/test/perl/PostgreSQL/Test/Utils.pm @@ -65,6 +65,7 @@ our @EXPORT = qw( slurp_dir slurp_file append_to_file + string_replace_file check_mode_recursive chmod_recursive check_pg_config @@ -544,6 +545,32 @@ sub append_to_file =pod +=item string_replace_file(filename, find, replace) + +Find and replace string of a given file. + +=cut + +sub string_replace_file +{ + my ($filename, $find, $replace) = @_; + open(my $in, '<', $filename); + my $content; + while(<$in>) + { + $_ =~ s/$find/$replace/; + $content = $content.$_; + } + close $in; + open(my $out, '>', $filename); + print $out $content; + close($out); + + return; +} + +=pod + =item check_mode_recursive(dir, expected_dir_mode, expected_file_mode, ignore_list) Check that all file/dir modes in a directory match the expected values, -- 2.32.0 [application/pgp-signature] signature.asc (819B, ../../[email protected]/3-signature.asc) download ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-04-08 04:21 Stephen Frost <[email protected]> parent: Stephen Frost <[email protected]> 0 siblings, 1 reply; 17+ messages in thread From: Stephen Frost @ 2022-04-08 04:21 UTC (permalink / raw) To: Jacob Champion <[email protected]>; +Cc: [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]> Greetings, * Stephen Frost ([email protected]) wrote: > * Jacob Champion ([email protected]) wrote: > > On Fri, 2022-03-11 at 19:39 -0500, Stephen Frost wrote: > > > Even so, I’m not against adding an option… but exactly how would that > > > option be configured? Server level? On the HBA line? role level..? > > > > In the OPTIONS for CREATE SERVER, maybe? At least for the FDW case. > > I'm a bit confused on this. The option to allow or not allow delegated > credentials couldn't be something that's in the CREATE SERVER for FDWs > as it applies to more than just FDWs but also dblink and anything else > where we reach out from PG to contact some other system. Thinking it through further, it seems like the right place to allow an administrator to control if credentials are allowed to be delegated is through a pg_hba option. Attached patch adds such an option. > > > > Also, we're > > > > globally ignoring whatever ccache was set by an administrator. Can't > > > > two postgres_fdw connections from the same backend process require > > > > different settings? > > > > > > Settings..? Perhaps, but delegated credentials aren’t really > > > settings, so not really sure what you’re suggesting here. > > > > I mean that one backend server might require delegated credentials, and > > another might require whatever the admin has already set up in the > > ccache, and the user might want to use tables from both servers in the > > same session. > > That an admin might have a credential cache that's picked up and used > for connections from a regular user backend to another system strikes me > as an altogether concerning idea. Even so, in such a case, the admin > would have had to set up the user mapping with 'password required = > false' or it wouldn't have worked for a non-superuser anyway, so I'm not > sure that I'm too worried about this case. To address this, I also added a new GUC which allows an administrator to control what the credential cache is set to for user-authenticated backends, with a default of MEMORY:, which should generally be safe and won't cause a user backend to pick up on a file-based credential cache which might exist on the server somewhere. This gives the administrator the option to set it to more-or-less whatever they'd like though, so if they want to set it to a file-based credential cache, then they can do so (I did put some caveats about doing that into the documentation as I don't think it's generally a good idea to do...). > > > > I notice that gss_store_cred_into() has a companion, > > > > gss_acquire_cred_from(). Is it possible to use that to pull out our > > > > delegated credential explicitly by name, instead of stomping on the > > > > global setup? > > > > > > Not really sure what is meant here by global setup..? Feeling like > > > this is a follow on confusion from maybe mixing server vs client > > > libpq? > > > > By my reading, the gss_store_cred_into() call followed by > > the setenv("KRB5CCNAME", ...) is effectively performing global > > configuration for the process. Any KRB5CCNAME already set up by the > > server admin is going to be ignored from that point onward. Is that > > accurate? > > The process, yes, but I guess I disagree on that being 'global'- it's > just for that PG backend process. The new krb_user_ccache is a lot closer to 'global', though it's specifically for user-authenticated backends (allowing the postmaster and other things like replication connections to use whatever the credential cache is set to by the administrator on startup), but that seems like it makes sense to me- generally you're not going to want regular user backends to be accessing the credential cache of the 'postgres' unix account on the server. > Attached is an updated patch which adds the gss_release_creds call, a > function in libpq to allow checking if the libpq connection was made > using GSS, changes to dblink to have it check for password-or-gss when > connecting to a remote system, and tests for dblink and postgres_fdw to > make sure that this all works correctly. I've added a couple more tests to address the new options too, along with documentation for them. This is starting to feel reasonably decent to me, at least as a first pass at supporting kerberos credential delegation, which is definitely a feature I've been hoping we would get into PG for quite a while. Would certainly appreciate some feedback on this (from anyone who'd like to comment), though I know we're getting into the last few hours before feature freeze ends. Updated patch attached. Thanks! Stephen Attachments: [text/x-diff] v5-0001-kerberos-delegation.patch (34.0K, ../../[email protected]/2-v5-0001-kerberos-delegation.patch) download | inline diff: From 83b2979e252866ce86a9bfb3d0b631db2f5b8404 Mon Sep 17 00:00:00 2001 From: Stephen Frost <[email protected]> Date: Thu, 7 Apr 2022 15:34:39 -0400 Subject: [PATCH] Add support for Kerberos credential delegation Accept GSSAPI/Kerberos delegated credentials. With this, a user could authenticate to PostgreSQL using Kerberos credentials, delegate credentials to the PostgreSQL server, and then the PostgreSQL server could use those credentials to connect to another service, such as with postgres_fdw or dblink or theoretically any other authenticated connection which is able to use delegated credentials. If an administrator prefers to not allow credentials to be delegated to the server, they can be disallowed using a new pg_hba option for gss called 'allow_cred_delegation'. A new server GUC has also been introduced to allow an administrator to control what the kerberos credential cache is configured to for user authenticated backends, krb_user_ccache. This defaults to MEMORY:, which is where delegated credentials are stored (and is otherwise empty, avoiding the risk of an administrator's credentials on the server being mistakenly picked up and used). Original patch by: Peifeng Qiu, whacked around some by me. Reviewed-by: Jacob Champion Discussion: https://postgr.es/m/CO1PR05MB8023CC2CB575E0FAAD7DF4F8A8E29@CO1PR05MB8023.namprd05.prod.outlook.com --- contrib/dblink/dblink.c | 6 +- .../postgres_fdw/expected/postgres_fdw.out | 2 +- contrib/postgres_fdw/option.c | 3 + doc/src/sgml/client-auth.sgml | 13 +++ doc/src/sgml/config.sgml | 25 ++++++ doc/src/sgml/libpq.sgml | 19 ++++ src/backend/libpq/auth.c | 24 +++++- src/backend/libpq/be-gssapi-common.c | 51 +++++++++++ src/backend/libpq/be-secure-gssapi.c | 19 +++- src/backend/libpq/hba.c | 19 ++++ src/backend/utils/adt/hbafuncs.c | 4 + src/backend/utils/init/postinit.c | 8 +- src/backend/utils/misc/guc.c | 15 ++++ src/backend/utils/misc/postgresql.conf.sample | 1 + src/include/libpq/auth.h | 1 + src/include/libpq/be-gssapi-common.h | 3 + src/include/libpq/hba.h | 1 + src/include/libpq/libpq-be.h | 3 + src/interfaces/libpq/exports.txt | 1 + src/interfaces/libpq/fe-auth.c | 12 ++- src/interfaces/libpq/fe-connect.c | 12 +++ src/interfaces/libpq/fe-secure-gssapi.c | 3 +- src/interfaces/libpq/libpq-fe.h | 1 + src/interfaces/libpq/libpq-int.h | 1 + src/test/kerberos/Makefile | 3 + src/test/kerberos/t/001_auth.pl | 86 +++++++++++++++++-- src/test/perl/PostgreSQL/Test/Utils.pm | 27 ++++++ 27 files changed, 343 insertions(+), 20 deletions(-) diff --git a/contrib/dblink/dblink.c b/contrib/dblink/dblink.c index a06d4bd12d..e5b70e084e 100644 --- a/contrib/dblink/dblink.c +++ b/contrib/dblink/dblink.c @@ -2643,7 +2643,7 @@ dblink_security_check(PGconn *conn, remoteConn *rconn) { if (!superuser()) { - if (!PQconnectionUsedPassword(conn)) + if (!(PQconnectionUsedPassword(conn) || PQconnectionUsedGSSAPI(conn))) { PQfinish(conn); ReleaseExternalFD(); @@ -2652,8 +2652,8 @@ dblink_security_check(PGconn *conn, remoteConn *rconn) ereport(ERROR, (errcode(ERRCODE_S_R_E_PROHIBITED_SQL_STATEMENT_ATTEMPTED), - errmsg("password is required"), - errdetail("Non-superuser cannot connect if the server does not request a password."), + errmsg("password or GSSAPI is required"), + errdetail("Non-superuser cannot connect if the server does not request a password or use GSSAPI."), errhint("Target server's authentication method must be changed."))); } } diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out index 11e9b4e8cc..c3bd8fe6b4 100644 --- a/contrib/postgres_fdw/expected/postgres_fdw.out +++ b/contrib/postgres_fdw/expected/postgres_fdw.out @@ -188,7 +188,7 @@ ALTER USER MAPPING FOR public SERVER testserver1 ALTER USER MAPPING FOR public SERVER testserver1 OPTIONS (ADD sslmode 'require'); ERROR: invalid option "sslmode" -HINT: Valid options in this context are: user, password, sslpassword, password_required, sslcert, sslkey +HINT: Valid options in this context are: user, password, sslpassword, password_required, sslcert, sslkey, gssencmode -- But we can add valid ones fine ALTER USER MAPPING FOR public SERVER testserver1 OPTIONS (ADD sslpassword 'dummy'); diff --git a/contrib/postgres_fdw/option.c b/contrib/postgres_fdw/option.c index 572591a558..05922cfe6d 100644 --- a/contrib/postgres_fdw/option.c +++ b/contrib/postgres_fdw/option.c @@ -262,6 +262,9 @@ InitPgFdwOptions(void) {"sslcert", UserMappingRelationId, true}, {"sslkey", UserMappingRelationId, true}, + /* gssencmode is also libpq option, same to above. */ + {"gssencmode", UserMappingRelationId, true}, + {NULL, InvalidOid, false} }; diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index 142b0affcb..9d35aa3c67 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -1369,6 +1369,19 @@ omicron bryanh guest1 </para> </listitem> </varlistentry> + + <varlistentry> + <term><literal>allow_cred_delegation</literal></term> + <listitem> + <para> + If set to 0, credential delegation will not be allowed. The default + setting (1) allows an authenticated client to delegate credentials to the + server which will allow the server to then use those credentials to + authenticate when connecting to other systems such as with dblink or when + using a foreign data wrapper (FDW). + </para> + </listitem> + </varlistentry> </variablelist> </para> diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 43e4ade83e..c1d9a0502d 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1126,6 +1126,31 @@ include_dir 'conf.d' </listitem> </varlistentry> + <varlistentry id="guc-krb-user-ccache" xreflabel="krb_user_ccache"> + <term><varname>krb_user_ccache</varname> (<type>string</type>) + <indexterm> + <primary><varname>krb_user_ccache</varname> configuration parameter</primary> + </indexterm> + </term> + <listitem> + <para> + Sets the location of the Kerberos credential cache to be used for + regular user backends which go through authentication. The default is + <filename>MEMORY:</filename>, which is where delegated credentials + are stored (and is otherwise empty). Care should be used when changing + this value- setting it to a file-based credential cache will mean that + user backends could potentially use any credentials stored to access + other systems. + If this parameter is set to an empty string, then the system-dependent + default is used, which may be a file-based credential cache with the same + caveats as previously mentioned. + This parameter can only be set in the + <filename>postgresql.conf</filename> file or on the server command line. + See <xref linkend="gssapi-auth"/> for more information. + </para> + </listitem> + </varlistentry> + <varlistentry id="guc-db-user-namespace" xreflabel="db_user_namespace"> <term><varname>db_user_namespace</varname> (<type>boolean</type>) <indexterm> diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index 1c20901c3c..22ba41ea10 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -2489,6 +2489,25 @@ int PQconnectionUsedPassword(const PGconn *conn); </para> </listitem> </varlistentry> + + <varlistentry id="libpq-PQconnectionUsedGSSAPI"> + <term><function>PQconnectionUsedGSSAPI</function><indexterm><primary>PQconnectionUsedGSSAPI</primary></indexterm></term> + <listitem> + <para> + Returns true (1) if the connection authentication method + used GSSAPI. Returns false (0) if not. + +<synopsis> +int PQconnectionUsedGSSAPI(const PGconn *conn); +</synopsis> + </para> + + <para> + This function can be applied to detect whether the connection was + authenticated with GSSAPI. + </para> + </listitem> + </varlistentry> </variablelist> </para> diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index efc53f3135..08544e370a 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -170,6 +170,7 @@ static int CheckCertAuth(Port *port); */ char *pg_krb_server_keyfile; bool pg_krb_caseins_users; +char *pg_krb_user_ccache; /*---------------------------------------------------------------- @@ -422,6 +423,14 @@ ClientAuthentication(Port *port) errmsg("connection requires a valid client certificate"))); } +#ifdef ENABLE_GSS + /* + * Set the credential cache to use for user backends which go through + * regular authentication. + */ + setenv("KRB5CCNAME", pg_krb_user_ccache, 1); +#endif + /* * Now proceed to do the actual authentication check */ @@ -564,6 +573,16 @@ ClientAuthentication(Port *port) sendAuthRequest(port, AUTH_REQ_GSS, NULL, 0); status = pg_GSS_recvauth(port); } + + /* + * If the HBA line allows and we were delegated credentials then + * store them. + */ + if (port->hba->allow_cred_delegation && port->gss->proxy) + { + pg_store_proxy_credential(port->gss->proxy); + port->gss->proxy_creds = true; + } #else Assert(false); #endif @@ -949,6 +968,9 @@ pg_GSS_recvauth(Port *port) */ port->gss->ctx = GSS_C_NO_CONTEXT; + port->gss->proxy = NULL; + port->gss->proxy_creds = false; + /* * Loop through GSSAPI message exchange. This exchange can consist of * multiple messages sent in both directions. First message is always from @@ -999,7 +1021,7 @@ pg_GSS_recvauth(Port *port) &port->gss->outbuf, &gflags, NULL, - NULL); + &port->gss->proxy); /* gbuf no longer used */ pfree(buf.data); diff --git a/src/backend/libpq/be-gssapi-common.c b/src/backend/libpq/be-gssapi-common.c index 71b796d5a2..f439cac4b6 100644 --- a/src/backend/libpq/be-gssapi-common.c +++ b/src/backend/libpq/be-gssapi-common.c @@ -92,3 +92,54 @@ pg_GSS_error(const char *errmsg, (errmsg_internal("%s", errmsg), errdetail_internal("%s: %s", msg_major, msg_minor))); } + +/* + * Store the credentials passed in into the memory cache for later usage. + * + * This allows credentials to be delegated to us for us to use to connect + * to other systems with, using, e.g. postgres_fdw or dblink. + */ +#define GSS_MEMORY_CACHE "MEMORY:" +void +pg_store_proxy_credential(gss_cred_id_t cred) +{ + OM_uint32 major, minor; + gss_OID_set mech; + gss_cred_usage_t usage; + gss_key_value_element_desc cc; + gss_key_value_set_desc ccset; + + cc.key = "ccache"; + cc.value = GSS_MEMORY_CACHE; + ccset.count = 1; + ccset.elements = &cc; + + /* Make the proxy credential only available to current process */ + major = gss_store_cred_into(&minor, + cred, + GSS_C_INITIATE, /* credential only used for starting libpq connection */ + GSS_C_NULL_OID, /* store all */ + true, /* overwrite */ + true, /* make default */ + &ccset, + &mech, + &usage); + + if (major != GSS_S_COMPLETE) + { + pg_GSS_error("gss_store_cred", major, minor); + } + + /* Credential stored, so we can release our credential handle. */ + major = gss_release_cred(&minor, &cred); + if (major != GSS_S_COMPLETE) + { + pg_GSS_error("gss_release_cred", major, minor); + } + + /* + * Be sure that KRB5CCNAME is set to MEMORY: for this backend, so that later + * calls to gss_acquire_cred will find the proxied credentials we stored. + */ + setenv("KRB5CCNAME", GSS_MEMORY_CACHE, 1); +} diff --git a/src/backend/libpq/be-secure-gssapi.c b/src/backend/libpq/be-secure-gssapi.c index 2844c5aa4b..8e7abff849 100644 --- a/src/backend/libpq/be-secure-gssapi.c +++ b/src/backend/libpq/be-secure-gssapi.c @@ -504,6 +504,9 @@ secure_open_gssapi(Port *port) port->gss = (pg_gssinfo *) MemoryContextAllocZero(TopMemoryContext, sizeof(pg_gssinfo)); + port->gss->proxy = NULL; + port->gss->proxy_creds = false; + /* * Allocate buffers and initialize state variables. By malloc'ing the * buffers at this point, we avoid wasting static data space in processes @@ -588,7 +591,8 @@ secure_open_gssapi(Port *port) GSS_C_NO_CREDENTIAL, &input, GSS_C_NO_CHANNEL_BINDINGS, &port->gss->name, NULL, &output, NULL, - NULL, NULL); + NULL, &port->gss->proxy); + if (GSS_ERROR(major)) { pg_GSS_error(_("could not accept GSSAPI security context"), @@ -731,3 +735,16 @@ be_gssapi_get_princ(Port *port) return port->gss->princ; } + +/* + * Return if GSSAPI delegated/proxy credentials were included on this + * connection. + */ +bool +be_gssapi_get_proxy(Port *port) +{ + if (!port || !port->gss) + return NULL; + + return port->gss->proxy_creds; +} diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c index f8393ca8ed..d286ab59b9 100644 --- a/src/backend/libpq/hba.c +++ b/src/backend/libpq/hba.c @@ -1471,6 +1471,16 @@ parse_hba_line(TokenizedAuthLine *tok_line, int elevel) parsedline->upn_username = false; } + /* + * For GSS, set the default value of allow_cred_delegation to true. + * This should generally be safe as the delegated credentials are those of + * the user who has been authorized, and will only happen if the user chooses + * to authenticate with a credential that can be delegated, but admins are + * able to disable it if they wish to. + */ + if (parsedline->auth_method == uaGSS) + parsedline->allow_cred_delegation = true; + /* Parse remaining arguments */ while ((field = lnext(tok_line->fields, field)) != NULL) { @@ -1941,6 +1951,15 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, else hbaline->upn_username = false; } + else if (strcmp(name, "allow_cred_delegation") == 0) + { + if (hbaline->auth_method != uaGSS) + INVALID_AUTH_OPTION("allow_cred_delegation", gettext_noop("gssapi")); + if (strcmp(val, "1") == 0) + hbaline->allow_cred_delegation = true; + else + hbaline->allow_cred_delegation = false; + } else if (strcmp(name, "radiusservers") == 0) { struct addrinfo *gai_result; diff --git a/src/backend/utils/adt/hbafuncs.c b/src/backend/utils/adt/hbafuncs.c index 9fe7b62c9a..2167c7ba9e 100644 --- a/src/backend/utils/adt/hbafuncs.c +++ b/src/backend/utils/adt/hbafuncs.c @@ -64,6 +64,10 @@ get_hba_options(HbaLine *hba) if (hba->krb_realm) options[noptions++] = CStringGetTextDatum(psprintf("krb_realm=%s", hba->krb_realm)); + + if (hba->allow_cred_delegation) + options[noptions++] = + CStringGetTextDatum("allow_cred_delegation=true"); } if (hba->usermap) diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c index 6452b42dbf..e9b7cdc216 100644 --- a/src/backend/utils/init/postinit.c +++ b/src/backend/utils/init/postinit.c @@ -284,15 +284,17 @@ PerformAuthentication(Port *port) if (princ) appendStringInfo(&logmsg, - _(" GSS (authenticated=%s, encrypted=%s, principal=%s)"), + _(" GSS (authenticated=%s, encrypted=%s, proxy_credentials=%s, principal=%s)"), be_gssapi_get_auth(port) ? _("yes") : _("no"), be_gssapi_get_enc(port) ? _("yes") : _("no"), + be_gssapi_get_proxy(port) ? _("yes") : _("no"), princ); else appendStringInfo(&logmsg, - _(" GSS (authenticated=%s, encrypted=%s)"), + _(" GSS (authenticated=%s, encrypted=%s, proxy_credentials=%s)"), be_gssapi_get_auth(port) ? _("yes") : _("no"), - be_gssapi_get_enc(port) ? _("yes") : _("no")); + be_gssapi_get_enc(port) ? _("yes") : _("no"), + be_gssapi_get_proxy(port) ? _("yes") : _("no")); } #endif diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index 9e8ab1420d..7fdb9ed58a 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -117,6 +117,10 @@ #define PG_KRB_SRVTAB "" #endif +#ifndef PG_KRB_USER_CCACHE +#define PG_KRB_USER_CCACHE "MEMORY:" +#endif + #define CONFIG_FILENAME "postgresql.conf" #define HBA_FILENAME "pg_hba.conf" #define IDENT_FILENAME "pg_ident.conf" @@ -4146,6 +4150,17 @@ static struct config_string ConfigureNamesString[] = NULL, NULL, NULL }, + { + {"krb_user_ccache", PGC_SIGHUP, CONN_AUTH_AUTH, + gettext_noop("Sets the Kerberos credential cache location for user authenticated backends."), + NULL, + GUC_SUPERUSER_ONLY + }, + &pg_krb_user_ccache, + PG_KRB_USER_CCACHE, + NULL, NULL, NULL + }, + { {"bonjour_name", PGC_POSTMASTER, CONN_AUTH_SETTINGS, gettext_noop("Sets the Bonjour service name."), diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index 93d221a37b..fa668b6ea1 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -99,6 +99,7 @@ # GSSAPI using Kerberos #krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab' #krb_caseins_users = off +#krb_user_ccache = MEMORY: # - SSL - diff --git a/src/include/libpq/auth.h b/src/include/libpq/auth.h index 6d7ee1acb9..c032e4224c 100644 --- a/src/include/libpq/auth.h +++ b/src/include/libpq/auth.h @@ -19,6 +19,7 @@ extern char *pg_krb_server_keyfile; extern bool pg_krb_caseins_users; extern char *pg_krb_realm; +extern char *pg_krb_user_ccache; extern void ClientAuthentication(Port *port); extern void sendAuthRequest(Port *port, AuthRequest areq, const char *extradata, diff --git a/src/include/libpq/be-gssapi-common.h b/src/include/libpq/be-gssapi-common.h index ae8411245d..6953157f05 100644 --- a/src/include/libpq/be-gssapi-common.h +++ b/src/include/libpq/be-gssapi-common.h @@ -18,13 +18,16 @@ #if defined(HAVE_GSSAPI_H) #include <gssapi.h> +#include <gssapi_ext.h> #else #include <gssapi/gssapi.h> +#include <gssapi/gssapi_ext.h> #endif extern void pg_GSS_error(const char *errmsg, OM_uint32 maj_stat, OM_uint32 min_stat); +extern void pg_store_proxy_credential(gss_cred_id_t cred); #endif /* ENABLE_GSS */ #endif /* BE_GSSAPI_COMMON_H */ diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h index 90036f7bcd..99affd91fe 100644 --- a/src/include/libpq/hba.h +++ b/src/include/libpq/hba.h @@ -112,6 +112,7 @@ typedef struct HbaLine bool include_realm; bool compat_realm; bool upn_username; + bool allow_cred_delegation; List *radiusservers; char *radiusservers_s; List *radiussecrets; diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h index dd3e5efba3..0938ee7ce2 100644 --- a/src/include/libpq/libpq-be.h +++ b/src/include/libpq/libpq-be.h @@ -95,6 +95,8 @@ typedef struct * GSSAPI auth was not used */ bool auth; /* GSSAPI Authentication used */ bool enc; /* GSSAPI encryption in use */ + bool proxy_creds; /* GSSAPI Delegated/proxy credentials? */ + gss_cred_id_t proxy; /* GSSAPI Proxy credentials */ #endif } pg_gssinfo; #endif @@ -321,6 +323,7 @@ extern PGDLLIMPORT openssl_tls_init_hook_typ openssl_tls_init_hook; extern bool be_gssapi_get_auth(Port *port); extern bool be_gssapi_get_enc(Port *port); extern const char *be_gssapi_get_princ(Port *port); +extern bool be_gssapi_get_proxy(Port *port); /* Read and write to a GSSAPI-encrypted connection. */ extern ssize_t be_gssapi_read(Port *port, void *ptr, size_t len); diff --git a/src/interfaces/libpq/exports.txt b/src/interfaces/libpq/exports.txt index e8bcc88370..7ded77aff3 100644 --- a/src/interfaces/libpq/exports.txt +++ b/src/interfaces/libpq/exports.txt @@ -186,3 +186,4 @@ PQpipelineStatus 183 PQsetTraceFlags 184 PQmblenBounded 185 PQsendFlushRequest 186 +PQconnectionUsedGSSAPI 187 diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c index 6fceff561b..943db5c722 100644 --- a/src/interfaces/libpq/fe-auth.c +++ b/src/interfaces/libpq/fe-auth.c @@ -61,6 +61,7 @@ pg_GSS_continue(PGconn *conn, int payloadlen) lmin_s; gss_buffer_desc ginbuf; gss_buffer_desc goutbuf; + gss_cred_id_t proxy; /* * On first call, there's no input token. On subsequent calls, read the @@ -93,12 +94,16 @@ pg_GSS_continue(PGconn *conn, int payloadlen) ginbuf.value = NULL; } + /* Check if we can aquire a proxy credential. */ + if (!pg_GSS_have_cred_cache(&proxy)) + proxy = GSS_C_NO_CREDENTIAL; + maj_stat = gss_init_sec_context(&min_stat, - GSS_C_NO_CREDENTIAL, + proxy, &conn->gctx, conn->gtarg_nam, GSS_C_NO_OID, - GSS_C_MUTUAL_FLAG, + GSS_C_MUTUAL_FLAG | GSS_C_DELEG_FLAG, 0, GSS_C_NO_CHANNEL_BINDINGS, (ginbuf.value == NULL) ? GSS_C_NO_BUFFER : &ginbuf, @@ -138,7 +143,10 @@ pg_GSS_continue(PGconn *conn, int payloadlen) } if (maj_stat == GSS_S_COMPLETE) + { gss_release_name(&lmin_s, &conn->gtarg_nam); + conn->gssapi_used = true; + } return STATUS_OK; } diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c index cf554d389f..a296c82d1d 100644 --- a/src/interfaces/libpq/fe-connect.c +++ b/src/interfaces/libpq/fe-connect.c @@ -600,6 +600,7 @@ pqDropServerData(PGconn *conn) conn->last_sqlstate[0] = '\0'; conn->auth_req_received = false; conn->password_needed = false; + conn->gssapi_used = false; conn->write_failed = false; if (conn->write_err_msg) free(conn->write_err_msg); @@ -6981,6 +6982,17 @@ PQconnectionUsedPassword(const PGconn *conn) return false; } +int +PQconnectionUsedGSSAPI(const PGconn *conn) +{ + if (!conn) + return false; + if (conn->gssapi_used) + return true; + else + return false; +} + int PQclientEncoding(const PGconn *conn) { diff --git a/src/interfaces/libpq/fe-secure-gssapi.c b/src/interfaces/libpq/fe-secure-gssapi.c index 6ea52ed866..5eeaca542d 100644 --- a/src/interfaces/libpq/fe-secure-gssapi.c +++ b/src/interfaces/libpq/fe-secure-gssapi.c @@ -631,7 +631,7 @@ pqsecure_open_gss(PGconn *conn) */ major = gss_init_sec_context(&minor, conn->gcred, &conn->gctx, conn->gtarg_nam, GSS_C_NO_OID, - GSS_REQUIRED_FLAGS, 0, 0, &input, NULL, + GSS_REQUIRED_FLAGS | GSS_C_DELEG_FLAG, 0, 0, &input, NULL, &output, NULL, NULL); /* GSS Init Sec Context uses the whole packet, so clear it */ @@ -651,6 +651,7 @@ pqsecure_open_gss(PGconn *conn) * to do GSS wrapping/unwrapping. */ conn->gssenc = true; + conn->gssapi_used = true; /* Clean up */ gss_release_cred(&minor, &conn->gcred); diff --git a/src/interfaces/libpq/libpq-fe.h b/src/interfaces/libpq/libpq-fe.h index 7986445f1a..bdd073c645 100644 --- a/src/interfaces/libpq/libpq-fe.h +++ b/src/interfaces/libpq/libpq-fe.h @@ -354,6 +354,7 @@ extern int PQbackendPID(const PGconn *conn); extern PGpipelineStatus PQpipelineStatus(const PGconn *conn); extern int PQconnectionNeedsPassword(const PGconn *conn); extern int PQconnectionUsedPassword(const PGconn *conn); +extern int PQconnectionUsedGSSAPI(const PGconn *conn); extern int PQclientEncoding(const PGconn *conn); extern int PQsetClientEncoding(PGconn *conn, const char *encoding); diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h index e0cee4b142..5dd9a52305 100644 --- a/src/interfaces/libpq/libpq-int.h +++ b/src/interfaces/libpq/libpq-int.h @@ -449,6 +449,7 @@ struct pg_conn int sversion; /* server version, e.g. 70401 for 7.4.1 */ bool auth_req_received; /* true if any type of auth req received */ bool password_needed; /* true if server demanded a password */ + bool gssapi_used; /* true if authenticated via gssapi */ bool sigpipe_so; /* have we masked SIGPIPE via SO_NOSIGPIPE? */ bool sigpipe_flag; /* can we mask SIGPIPE via MSG_NOSIGNAL? */ bool write_failed; /* have we had a write failure on sock? */ diff --git a/src/test/kerberos/Makefile b/src/test/kerberos/Makefile index c531998835..67dfaae901 100644 --- a/src/test/kerberos/Makefile +++ b/src/test/kerberos/Makefile @@ -13,6 +13,9 @@ subdir = src/test/kerberos top_builddir = ../../.. include $(top_builddir)/src/Makefile.global +EXTRA_INSTALL += contrib/postgres_fdw +EXTRA_INSTALL += contrib/dblink + export with_gssapi with_krb_srvnam check: diff --git a/src/test/kerberos/t/001_auth.pl b/src/test/kerberos/t/001_auth.pl index 62e0542639..92bfb7c46a 100644 --- a/src/test/kerberos/t/001_auth.pl +++ b/src/test/kerberos/t/001_auth.pl @@ -45,6 +45,7 @@ elsif ($^O eq 'linux') my $krb5_config = 'krb5-config'; my $kinit = 'kinit'; +my $klist = 'klist'; my $kdb5_util = 'kdb5_util'; my $kadmin_local = 'kadmin.local'; my $krb5kdc = 'krb5kdc'; @@ -53,6 +54,7 @@ if ($krb5_bin_dir && -d $krb5_bin_dir) { $krb5_config = $krb5_bin_dir . '/' . $krb5_config; $kinit = $krb5_bin_dir . '/' . $kinit; + $klist = $krb5_bin_dir . '/' . $klist; } if ($krb5_sbin_dir && -d $krb5_sbin_dir) { @@ -97,6 +99,7 @@ kdc = FILE:$kdc_log [libdefaults] default_realm = $realm +forwardable = false [realms] $realm = { @@ -174,7 +177,21 @@ lc_messages = 'C' }); $node->start; +my $port = $node->port(); + $node->safe_psql('postgres', 'CREATE USER test1;'); +$node->safe_psql('postgres', 'CREATE EXTENSION postgres_fdw;'); +$node->safe_psql('postgres', 'CREATE EXTENSION dblink;'); +$node->safe_psql('postgres', "CREATE SERVER s1 FOREIGN DATA WRAPPER postgres_fdw OPTIONS (host '$host', hostaddr '$hostaddr', port '$port', dbname 'postgres');"); + +$node->safe_psql('postgres', 'GRANT USAGE ON FOREIGN SERVER s1 TO test1;'); + +$node->safe_psql('postgres', "CREATE USER MAPPING FOR test1 SERVER s1 OPTIONS (user 'test1', password_required 'false');"); +$node->safe_psql('postgres', "CREATE TABLE t1 (c1 int);"); +$node->safe_psql('postgres', "INSERT INTO t1 VALUES (1);"); +$node->safe_psql('postgres', "CREATE FOREIGN TABLE tf1 (c1 int) SERVER s1 OPTIONS (schema_name 'public', table_name 't1');"); +$node->safe_psql('postgres', "GRANT SELECT ON t1 TO test1;"); +$node->safe_psql('postgres', "GRANT SELECT ON tf1 TO test1;"); note "running tests"; @@ -240,6 +257,7 @@ $node->restart; test_access($node, 'test1', 'SELECT true', 2, '', 'fails without ticket'); run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?); +run_log [ $klist, '-f' ] or BAIL_OUT($?); test_access( $node, @@ -262,7 +280,7 @@ test_access( '', 'succeeds with mapping with default gssencmode and host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access( @@ -273,7 +291,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred with host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access( $node, @@ -283,7 +301,7 @@ test_access( 'gssencmode=require', 'succeeds with GSS-encrypted access required with host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); # Test that we can transport a reasonable amount of data. @@ -312,6 +330,11 @@ $node->append_conf('pg_hba.conf', qq{hostgssenc all all $hostaddr/32 gss map=mymap}); $node->restart; +string_replace_file($krb5_conf, "forwardable = false", "forwardable = true"); + +run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?); +run_log [ $klist, '-f' ] or BAIL_OUT($?); + test_access( $node, 'test1', @@ -320,7 +343,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred and hostgssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); test_access( $node, @@ -330,7 +353,7 @@ test_access( 'gssencmode=require', 'succeeds with GSS-encrypted access required and hostgssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); test_access($node, 'test1', 'SELECT true', 2, 'gssencmode=disable', 'fails with GSS encryption disabled and hostgssenc hba'); @@ -348,7 +371,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred and hostnogssenc hba, but no encryption', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, proxy_credentials=yes, principal=test1\@$realm)" ); test_access($node, 'test1', 'SELECT true', 2, 'gssencmode=require', 'fails with GSS-encrypted access required and hostnogssenc hba'); @@ -360,9 +383,25 @@ test_access( 'gssencmode=disable', 'succeeds with GSS encryption disabled and hostnogssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, proxy_credentials=yes, principal=test1\@$realm)" ); +test_query( + $node, + 'test1', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + qr/^1$/s, + 'gssencmode=prefer', + 'dblink works not-encrypted'); + +test_query( + $node, + 'test1', + "TABLE tf1;", + qr/^1$/s, + 'gssencmode=prefer', + 'postgres_fdw works not-encrypted'); + truncate($node->data_dir . '/pg_ident.conf', 0); unlink($node->data_dir . '/pg_hba.conf'); $node->append_conf('pg_hba.conf', @@ -377,9 +416,25 @@ test_access( '', 'succeeds with include_realm=0 and defaults', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); +test_query( + $node, + 'test1', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + qr/^1$/s, + 'gssencmode=require', + 'dblink works encrypted'); + +test_query( + $node, + 'test1', + "TABLE tf1;", + qr/^1$/s, + 'gssencmode=require', + 'postgres_fdw works encrypted'); + # Reset pg_hba.conf, and cause a usermap failure with an authentication # that has passed. unlink($node->data_dir . '/pg_hba.conf'); @@ -396,4 +451,19 @@ test_access( 'fails with wrong krb_realm, but still authenticates', "connection authenticated: identity=\"test1\@$realm\" method=gss"); +# Reset pg_hba.conf, and have the server refuse delegated credentials. +unlink($node->data_dir . '/pg_hba.conf'); +$node->append_conf('pg_hba.conf', + qq{host all all $hostaddr/32 gss include_realm=0 allow_cred_delegation=0}); +$node->restart; + +my ($psql_stdout, $psql_stderr, $psql_timed_out); +my $psql_cmdret = $node->psql('postgres', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + stdout => \$psql_stdout, stderr => \$psql_stderr, + connstr => $node->connstr('postgres') . " user=test1 host=$host hostaddr=$hostaddr gssencmode=require"); + +ok ($psql_cmdret == 3, 'error result from dblink failing without delegated credentials'); +like ($psql_stderr, qr/could not establish connection/, 'dblink fails due to missing delegated credentials'); + done_testing(); diff --git a/src/test/perl/PostgreSQL/Test/Utils.pm b/src/test/perl/PostgreSQL/Test/Utils.pm index dca1b3b17c..0f94a628a5 100644 --- a/src/test/perl/PostgreSQL/Test/Utils.pm +++ b/src/test/perl/PostgreSQL/Test/Utils.pm @@ -65,6 +65,7 @@ our @EXPORT = qw( slurp_dir slurp_file append_to_file + string_replace_file check_mode_recursive chmod_recursive check_pg_config @@ -544,6 +545,32 @@ sub append_to_file =pod +=item string_replace_file(filename, find, replace) + +Find and replace string of a given file. + +=cut + +sub string_replace_file +{ + my ($filename, $find, $replace) = @_; + open(my $in, '<', $filename); + my $content; + while(<$in>) + { + $_ =~ s/$find/$replace/; + $content = $content.$_; + } + close $in; + open(my $out, '>', $filename); + print $out $content; + close($out); + + return; +} + +=pod + =item check_mode_recursive(dir, expected_dir_mode, expected_file_mode, ignore_list) Check that all file/dir modes in a directory match the expected values, -- 2.30.2 [application/pgp-signature] signature.asc (819B, ../../[email protected]/3-signature.asc) download ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-04-08 12:21 Stephen Frost <[email protected]> parent: Stephen Frost <[email protected]> 0 siblings, 2 replies; 17+ messages in thread From: Stephen Frost @ 2022-04-08 12:21 UTC (permalink / raw) To: Jacob Champion <[email protected]>; +Cc: [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]> Greetings, * Stephen Frost ([email protected]) wrote: > The new krb_user_ccache is a lot closer to 'global', though it's > specifically for user-authenticated backends (allowing the postmaster > and other things like replication connections to use whatever the > credential cache is set to by the administrator on startup), but that > seems like it makes sense to me- generally you're not going to want > regular user backends to be accessing the credential cache of the > 'postgres' unix account on the server. Added an explicit 'environment' option to allow for, basically, existing behavior, where we don't mess with the environment variable at all, though I kept the default as MEMORY since I don't think it's really typical that folks actually want regular user backends to inherit the credential cache of the server. Added a few more tests and updated the documentation too. Sadly, seems we've missed the deadline for v15 though for lack of feedback on these. Would really like to get some other folks commenting as these are new pg_hba and postgresql.conf options being added. Thanks! Stephen Attachments: [text/x-diff] v6-0001-kerberos-delegation.patch (35.9K, ../../[email protected]/2-v6-0001-kerberos-delegation.patch) download | inline diff: From bd248c3fd82d04d3c12bf6c777f861134a45a101 Mon Sep 17 00:00:00 2001 From: Stephen Frost <[email protected]> Date: Thu, 7 Apr 2022 15:34:39 -0400 Subject: [PATCH] Add support for Kerberos credential delegation Accept GSSAPI/Kerberos delegated credentials. With this, a user could authenticate to PostgreSQL using Kerberos credentials, delegate credentials to the PostgreSQL server, and then the PostgreSQL server could use those credentials to connect to another service, such as with postgres_fdw or dblink or theoretically any other authenticated connection which is able to use delegated credentials. If an administrator prefers to not allow credentials to be delegated to the server, they can be disallowed using a new pg_hba option for gss called 'allow_cred_delegation'. A new server GUC has also been introduced to allow an administrator to control what the kerberos credential cache is configured to for user authenticated backends, krb_user_ccache. This defaults to MEMORY:, which is where delegated credentials are stored (and is otherwise empty, avoiding the risk of an administrator's credentials on the server being mistakenly picked up and used). Original patch by: Peifeng Qiu, whacked around some by me. Reviewed-by: Jacob Champion Discussion: https://postgr.es/m/CO1PR05MB8023CC2CB575E0FAAD7DF4F8A8E29@CO1PR05MB8023.namprd05.prod.outlook.com --- contrib/dblink/dblink.c | 6 +- .../postgres_fdw/expected/postgres_fdw.out | 2 +- contrib/postgres_fdw/option.c | 3 + doc/src/sgml/client-auth.sgml | 13 ++ doc/src/sgml/config.sgml | 28 ++++ doc/src/sgml/libpq.sgml | 19 +++ src/backend/libpq/auth.c | 27 +++- src/backend/libpq/be-gssapi-common.c | 51 +++++++ src/backend/libpq/be-secure-gssapi.c | 19 ++- src/backend/libpq/hba.c | 19 +++ src/backend/utils/adt/hbafuncs.c | 4 + src/backend/utils/init/postinit.c | 8 +- src/backend/utils/misc/guc.c | 15 ++ src/backend/utils/misc/postgresql.conf.sample | 1 + src/include/libpq/auth.h | 1 + src/include/libpq/be-gssapi-common.h | 3 + src/include/libpq/hba.h | 1 + src/include/libpq/libpq-be.h | 3 + src/interfaces/libpq/exports.txt | 1 + src/interfaces/libpq/fe-auth.c | 12 +- src/interfaces/libpq/fe-connect.c | 12 ++ src/interfaces/libpq/fe-secure-gssapi.c | 3 +- src/interfaces/libpq/libpq-fe.h | 1 + src/interfaces/libpq/libpq-int.h | 1 + src/test/kerberos/Makefile | 3 + src/test/kerberos/t/001_auth.pl | 128 ++++++++++++++++-- src/test/perl/PostgreSQL/Test/Utils.pm | 27 ++++ 27 files changed, 391 insertions(+), 20 deletions(-) diff --git a/contrib/dblink/dblink.c b/contrib/dblink/dblink.c index a06d4bd12d..e5b70e084e 100644 --- a/contrib/dblink/dblink.c +++ b/contrib/dblink/dblink.c @@ -2643,7 +2643,7 @@ dblink_security_check(PGconn *conn, remoteConn *rconn) { if (!superuser()) { - if (!PQconnectionUsedPassword(conn)) + if (!(PQconnectionUsedPassword(conn) || PQconnectionUsedGSSAPI(conn))) { PQfinish(conn); ReleaseExternalFD(); @@ -2652,8 +2652,8 @@ dblink_security_check(PGconn *conn, remoteConn *rconn) ereport(ERROR, (errcode(ERRCODE_S_R_E_PROHIBITED_SQL_STATEMENT_ATTEMPTED), - errmsg("password is required"), - errdetail("Non-superuser cannot connect if the server does not request a password."), + errmsg("password or GSSAPI is required"), + errdetail("Non-superuser cannot connect if the server does not request a password or use GSSAPI."), errhint("Target server's authentication method must be changed."))); } } diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out index 30e95f585f..d472c24601 100644 --- a/contrib/postgres_fdw/expected/postgres_fdw.out +++ b/contrib/postgres_fdw/expected/postgres_fdw.out @@ -188,7 +188,7 @@ ALTER USER MAPPING FOR public SERVER testserver1 ALTER USER MAPPING FOR public SERVER testserver1 OPTIONS (ADD sslmode 'require'); ERROR: invalid option "sslmode" -HINT: Valid options in this context are: user, password, sslpassword, password_required, sslcert, sslkey +HINT: Valid options in this context are: user, password, sslpassword, password_required, sslcert, sslkey, gssencmode -- But we can add valid ones fine ALTER USER MAPPING FOR public SERVER testserver1 OPTIONS (ADD sslpassword 'dummy'); diff --git a/contrib/postgres_fdw/option.c b/contrib/postgres_fdw/option.c index 572591a558..05922cfe6d 100644 --- a/contrib/postgres_fdw/option.c +++ b/contrib/postgres_fdw/option.c @@ -262,6 +262,9 @@ InitPgFdwOptions(void) {"sslcert", UserMappingRelationId, true}, {"sslkey", UserMappingRelationId, true}, + /* gssencmode is also libpq option, same to above. */ + {"gssencmode", UserMappingRelationId, true}, + {NULL, InvalidOid, false} }; diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index 142b0affcb..9d35aa3c67 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -1369,6 +1369,19 @@ omicron bryanh guest1 </para> </listitem> </varlistentry> + + <varlistentry> + <term><literal>allow_cred_delegation</literal></term> + <listitem> + <para> + If set to 0, credential delegation will not be allowed. The default + setting (1) allows an authenticated client to delegate credentials to the + server which will allow the server to then use those credentials to + authenticate when connecting to other systems such as with dblink or when + using a foreign data wrapper (FDW). + </para> + </listitem> + </varlistentry> </variablelist> </para> diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 6e3e27bed7..ee5c506d64 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1129,6 +1129,34 @@ include_dir 'conf.d' </listitem> </varlistentry> + <varlistentry id="guc-krb-user-ccache" xreflabel="krb_user_ccache"> + <term><varname>krb_user_ccache</varname> (<type>string</type>) + <indexterm> + <primary><varname>krb_user_ccache</varname> configuration parameter</primary> + </indexterm> + </term> + <listitem> + <para> + Sets the location of the Kerberos credential cache to be used for + regular user backends which go through authentication. The default is + <filename>MEMORY:</filename>, which is where delegated credentials + are stored (and is otherwise empty). Care should be used when changing + this value- setting it to a file-based credential cache will mean that + user backends could potentially use any credentials stored to access + other systems. + If this parameter is set to an empty string, then the variable will be + explicit un-set and the system-dependent default is used, which may be a + file-based credential cache with the same caveats as previously + mentioned. If the special value 'environment' is used, then the variable + is left untouched and will be whatever was set in the environment at + startup time. + This parameter can only be set in the + <filename>postgresql.conf</filename> file or on the server command line. + See <xref linkend="gssapi-auth"/> for more information. + </para> + </listitem> + </varlistentry> + <varlistentry id="guc-db-user-namespace" xreflabel="db_user_namespace"> <term><varname>db_user_namespace</varname> (<type>boolean</type>) <indexterm> diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index 1c20901c3c..22ba41ea10 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -2489,6 +2489,25 @@ int PQconnectionUsedPassword(const PGconn *conn); </para> </listitem> </varlistentry> + + <varlistentry id="libpq-PQconnectionUsedGSSAPI"> + <term><function>PQconnectionUsedGSSAPI</function><indexterm><primary>PQconnectionUsedGSSAPI</primary></indexterm></term> + <listitem> + <para> + Returns true (1) if the connection authentication method + used GSSAPI. Returns false (0) if not. + +<synopsis> +int PQconnectionUsedGSSAPI(const PGconn *conn); +</synopsis> + </para> + + <para> + This function can be applied to detect whether the connection was + authenticated with GSSAPI. + </para> + </listitem> + </varlistentry> </variablelist> </para> diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index efc53f3135..c3cfe9de00 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -170,6 +170,7 @@ static int CheckCertAuth(Port *port); */ char *pg_krb_server_keyfile; bool pg_krb_caseins_users; +char *pg_krb_user_ccache; /*---------------------------------------------------------------- @@ -422,6 +423,17 @@ ClientAuthentication(Port *port) errmsg("connection requires a valid client certificate"))); } +#ifdef ENABLE_GSS + /* + * Set the credential cache to use for user backends which go through + * regular authentication. + */ + if (!pg_krb_user_ccache || pg_krb_user_ccache[0] == '\0') + unsetenv("KRB5CCNAME"); + else if (pg_strcasecmp(pg_krb_user_ccache, "environment") != 0) + setenv("KRB5CCNAME", pg_krb_user_ccache, 1); +#endif + /* * Now proceed to do the actual authentication check */ @@ -564,6 +576,16 @@ ClientAuthentication(Port *port) sendAuthRequest(port, AUTH_REQ_GSS, NULL, 0); status = pg_GSS_recvauth(port); } + + /* + * If the HBA line allows and we were delegated credentials then + * store them. + */ + if (port->hba->allow_cred_delegation && port->gss->proxy) + { + pg_store_proxy_credential(port->gss->proxy); + port->gss->proxy_creds = true; + } #else Assert(false); #endif @@ -949,6 +971,9 @@ pg_GSS_recvauth(Port *port) */ port->gss->ctx = GSS_C_NO_CONTEXT; + port->gss->proxy = NULL; + port->gss->proxy_creds = false; + /* * Loop through GSSAPI message exchange. This exchange can consist of * multiple messages sent in both directions. First message is always from @@ -999,7 +1024,7 @@ pg_GSS_recvauth(Port *port) &port->gss->outbuf, &gflags, NULL, - NULL); + &port->gss->proxy); /* gbuf no longer used */ pfree(buf.data); diff --git a/src/backend/libpq/be-gssapi-common.c b/src/backend/libpq/be-gssapi-common.c index 71b796d5a2..f439cac4b6 100644 --- a/src/backend/libpq/be-gssapi-common.c +++ b/src/backend/libpq/be-gssapi-common.c @@ -92,3 +92,54 @@ pg_GSS_error(const char *errmsg, (errmsg_internal("%s", errmsg), errdetail_internal("%s: %s", msg_major, msg_minor))); } + +/* + * Store the credentials passed in into the memory cache for later usage. + * + * This allows credentials to be delegated to us for us to use to connect + * to other systems with, using, e.g. postgres_fdw or dblink. + */ +#define GSS_MEMORY_CACHE "MEMORY:" +void +pg_store_proxy_credential(gss_cred_id_t cred) +{ + OM_uint32 major, minor; + gss_OID_set mech; + gss_cred_usage_t usage; + gss_key_value_element_desc cc; + gss_key_value_set_desc ccset; + + cc.key = "ccache"; + cc.value = GSS_MEMORY_CACHE; + ccset.count = 1; + ccset.elements = &cc; + + /* Make the proxy credential only available to current process */ + major = gss_store_cred_into(&minor, + cred, + GSS_C_INITIATE, /* credential only used for starting libpq connection */ + GSS_C_NULL_OID, /* store all */ + true, /* overwrite */ + true, /* make default */ + &ccset, + &mech, + &usage); + + if (major != GSS_S_COMPLETE) + { + pg_GSS_error("gss_store_cred", major, minor); + } + + /* Credential stored, so we can release our credential handle. */ + major = gss_release_cred(&minor, &cred); + if (major != GSS_S_COMPLETE) + { + pg_GSS_error("gss_release_cred", major, minor); + } + + /* + * Be sure that KRB5CCNAME is set to MEMORY: for this backend, so that later + * calls to gss_acquire_cred will find the proxied credentials we stored. + */ + setenv("KRB5CCNAME", GSS_MEMORY_CACHE, 1); +} diff --git a/src/backend/libpq/be-secure-gssapi.c b/src/backend/libpq/be-secure-gssapi.c index 2844c5aa4b..8e7abff849 100644 --- a/src/backend/libpq/be-secure-gssapi.c +++ b/src/backend/libpq/be-secure-gssapi.c @@ -504,6 +504,9 @@ secure_open_gssapi(Port *port) port->gss = (pg_gssinfo *) MemoryContextAllocZero(TopMemoryContext, sizeof(pg_gssinfo)); + port->gss->proxy = NULL; + port->gss->proxy_creds = false; + /* * Allocate buffers and initialize state variables. By malloc'ing the * buffers at this point, we avoid wasting static data space in processes @@ -588,7 +591,8 @@ secure_open_gssapi(Port *port) GSS_C_NO_CREDENTIAL, &input, GSS_C_NO_CHANNEL_BINDINGS, &port->gss->name, NULL, &output, NULL, - NULL, NULL); + NULL, &port->gss->proxy); + if (GSS_ERROR(major)) { pg_GSS_error(_("could not accept GSSAPI security context"), @@ -731,3 +735,16 @@ be_gssapi_get_princ(Port *port) return port->gss->princ; } + +/* + * Return if GSSAPI delegated/proxy credentials were included on this + * connection. + */ +bool +be_gssapi_get_proxy(Port *port) +{ + if (!port || !port->gss) + return NULL; + + return port->gss->proxy_creds; +} diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c index f8393ca8ed..d286ab59b9 100644 --- a/src/backend/libpq/hba.c +++ b/src/backend/libpq/hba.c @@ -1471,6 +1471,16 @@ parse_hba_line(TokenizedAuthLine *tok_line, int elevel) parsedline->upn_username = false; } + /* + * For GSS, set the default value of allow_cred_delegation to true. + * This should generally be safe as the delegated credentials are those of + * the user who has been authorized, and will only happen if the user chooses + * to authenticate with a credential that can be delegated, but admins are + * able to disable it if they wish to. + */ + if (parsedline->auth_method == uaGSS) + parsedline->allow_cred_delegation = true; + /* Parse remaining arguments */ while ((field = lnext(tok_line->fields, field)) != NULL) { @@ -1941,6 +1951,15 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, else hbaline->upn_username = false; } + else if (strcmp(name, "allow_cred_delegation") == 0) + { + if (hbaline->auth_method != uaGSS) + INVALID_AUTH_OPTION("allow_cred_delegation", gettext_noop("gssapi")); + if (strcmp(val, "1") == 0) + hbaline->allow_cred_delegation = true; + else + hbaline->allow_cred_delegation = false; + } else if (strcmp(name, "radiusservers") == 0) { struct addrinfo *gai_result; diff --git a/src/backend/utils/adt/hbafuncs.c b/src/backend/utils/adt/hbafuncs.c index 9fe7b62c9a..2167c7ba9e 100644 --- a/src/backend/utils/adt/hbafuncs.c +++ b/src/backend/utils/adt/hbafuncs.c @@ -64,6 +64,10 @@ get_hba_options(HbaLine *hba) if (hba->krb_realm) options[noptions++] = CStringGetTextDatum(psprintf("krb_realm=%s", hba->krb_realm)); + + if (hba->allow_cred_delegation) + options[noptions++] = + CStringGetTextDatum("allow_cred_delegation=true"); } if (hba->usermap) diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c index a85c2e0260..1d8b831615 100644 --- a/src/backend/utils/init/postinit.c +++ b/src/backend/utils/init/postinit.c @@ -285,15 +285,17 @@ PerformAuthentication(Port *port) if (princ) appendStringInfo(&logmsg, - _(" GSS (authenticated=%s, encrypted=%s, principal=%s)"), + _(" GSS (authenticated=%s, encrypted=%s, proxy_credentials=%s, principal=%s)"), be_gssapi_get_auth(port) ? _("yes") : _("no"), be_gssapi_get_enc(port) ? _("yes") : _("no"), + be_gssapi_get_proxy(port) ? _("yes") : _("no"), princ); else appendStringInfo(&logmsg, - _(" GSS (authenticated=%s, encrypted=%s)"), + _(" GSS (authenticated=%s, encrypted=%s, proxy_credentials=%s)"), be_gssapi_get_auth(port) ? _("yes") : _("no"), - be_gssapi_get_enc(port) ? _("yes") : _("no")); + be_gssapi_get_enc(port) ? _("yes") : _("no"), + be_gssapi_get_proxy(port) ? _("yes") : _("no")); } #endif diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index 22b5571a70..56cd788869 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -119,6 +119,10 @@ #define PG_KRB_SRVTAB "" #endif +#ifndef PG_KRB_USER_CCACHE +#define PG_KRB_USER_CCACHE "MEMORY:" +#endif + #define CONFIG_FILENAME "postgresql.conf" #define HBA_FILENAME "pg_hba.conf" #define IDENT_FILENAME "pg_ident.conf" @@ -4190,6 +4194,17 @@ static struct config_string ConfigureNamesString[] = NULL, NULL, NULL }, + { + {"krb_user_ccache", PGC_SIGHUP, CONN_AUTH_AUTH, + gettext_noop("Sets the Kerberos credential cache location for user authenticated backends."), + NULL, + GUC_SUPERUSER_ONLY + }, + &pg_krb_user_ccache, + PG_KRB_USER_CCACHE, + NULL, NULL, NULL + }, + { {"bonjour_name", PGC_POSTMASTER, CONN_AUTH_SETTINGS, gettext_noop("Sets the Bonjour service name."), diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index 94270eb0ec..b8d69cd80c 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -99,6 +99,7 @@ # GSSAPI using Kerberos #krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab' #krb_caseins_users = off +#krb_user_ccache = MEMORY: # - SSL - diff --git a/src/include/libpq/auth.h b/src/include/libpq/auth.h index 6d7ee1acb9..c032e4224c 100644 --- a/src/include/libpq/auth.h +++ b/src/include/libpq/auth.h @@ -19,6 +19,7 @@ extern char *pg_krb_server_keyfile; extern bool pg_krb_caseins_users; extern char *pg_krb_realm; +extern char *pg_krb_user_ccache; extern void ClientAuthentication(Port *port); extern void sendAuthRequest(Port *port, AuthRequest areq, const char *extradata, diff --git a/src/include/libpq/be-gssapi-common.h b/src/include/libpq/be-gssapi-common.h index ae8411245d..6953157f05 100644 --- a/src/include/libpq/be-gssapi-common.h +++ b/src/include/libpq/be-gssapi-common.h @@ -18,13 +18,16 @@ #if defined(HAVE_GSSAPI_H) #include <gssapi.h> +#include <gssapi_ext.h> #else #include <gssapi/gssapi.h> +#include <gssapi/gssapi_ext.h> #endif extern void pg_GSS_error(const char *errmsg, OM_uint32 maj_stat, OM_uint32 min_stat); +extern void pg_store_proxy_credential(gss_cred_id_t cred); #endif /* ENABLE_GSS */ #endif /* BE_GSSAPI_COMMON_H */ diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h index 90036f7bcd..99affd91fe 100644 --- a/src/include/libpq/hba.h +++ b/src/include/libpq/hba.h @@ -112,6 +112,7 @@ typedef struct HbaLine bool include_realm; bool compat_realm; bool upn_username; + bool allow_cred_delegation; List *radiusservers; char *radiusservers_s; List *radiussecrets; diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h index c3bf514652..30afe5a591 100644 --- a/src/include/libpq/libpq-be.h +++ b/src/include/libpq/libpq-be.h @@ -94,6 +94,8 @@ typedef struct * GSSAPI auth was not used */ bool auth; /* GSSAPI Authentication used */ bool enc; /* GSSAPI encryption in use */ + bool proxy_creds; /* GSSAPI Delegated/proxy credentials? */ + gss_cred_id_t proxy; /* GSSAPI Proxy credentials */ #endif } pg_gssinfo; #endif @@ -320,6 +322,7 @@ extern PGDLLIMPORT openssl_tls_init_hook_typ openssl_tls_init_hook; extern bool be_gssapi_get_auth(Port *port); extern bool be_gssapi_get_enc(Port *port); extern const char *be_gssapi_get_princ(Port *port); +extern bool be_gssapi_get_proxy(Port *port); /* Read and write to a GSSAPI-encrypted connection. */ extern ssize_t be_gssapi_read(Port *port, void *ptr, size_t len); diff --git a/src/interfaces/libpq/exports.txt b/src/interfaces/libpq/exports.txt index e8bcc88370..7ded77aff3 100644 --- a/src/interfaces/libpq/exports.txt +++ b/src/interfaces/libpq/exports.txt @@ -186,3 +186,4 @@ PQpipelineStatus 183 PQsetTraceFlags 184 PQmblenBounded 185 PQsendFlushRequest 186 +PQconnectionUsedGSSAPI 187 diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c index 6fceff561b..943db5c722 100644 --- a/src/interfaces/libpq/fe-auth.c +++ b/src/interfaces/libpq/fe-auth.c @@ -61,6 +61,7 @@ pg_GSS_continue(PGconn *conn, int payloadlen) lmin_s; gss_buffer_desc ginbuf; gss_buffer_desc goutbuf; + gss_cred_id_t proxy; /* * On first call, there's no input token. On subsequent calls, read the @@ -93,12 +94,16 @@ pg_GSS_continue(PGconn *conn, int payloadlen) ginbuf.value = NULL; } + /* Check if we can aquire a proxy credential. */ + if (!pg_GSS_have_cred_cache(&proxy)) + proxy = GSS_C_NO_CREDENTIAL; + maj_stat = gss_init_sec_context(&min_stat, - GSS_C_NO_CREDENTIAL, + proxy, &conn->gctx, conn->gtarg_nam, GSS_C_NO_OID, - GSS_C_MUTUAL_FLAG, + GSS_C_MUTUAL_FLAG | GSS_C_DELEG_FLAG, 0, GSS_C_NO_CHANNEL_BINDINGS, (ginbuf.value == NULL) ? GSS_C_NO_BUFFER : &ginbuf, @@ -138,7 +143,10 @@ pg_GSS_continue(PGconn *conn, int payloadlen) } if (maj_stat == GSS_S_COMPLETE) + { gss_release_name(&lmin_s, &conn->gtarg_nam); + conn->gssapi_used = true; + } return STATUS_OK; } diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c index cf554d389f..a296c82d1d 100644 --- a/src/interfaces/libpq/fe-connect.c +++ b/src/interfaces/libpq/fe-connect.c @@ -600,6 +600,7 @@ pqDropServerData(PGconn *conn) conn->last_sqlstate[0] = '\0'; conn->auth_req_received = false; conn->password_needed = false; + conn->gssapi_used = false; conn->write_failed = false; if (conn->write_err_msg) free(conn->write_err_msg); @@ -6981,6 +6982,17 @@ PQconnectionUsedPassword(const PGconn *conn) return false; } +int +PQconnectionUsedGSSAPI(const PGconn *conn) +{ + if (!conn) + return false; + if (conn->gssapi_used) + return true; + else + return false; +} + int PQclientEncoding(const PGconn *conn) { diff --git a/src/interfaces/libpq/fe-secure-gssapi.c b/src/interfaces/libpq/fe-secure-gssapi.c index 6ea52ed866..5eeaca542d 100644 --- a/src/interfaces/libpq/fe-secure-gssapi.c +++ b/src/interfaces/libpq/fe-secure-gssapi.c @@ -631,7 +631,7 @@ pqsecure_open_gss(PGconn *conn) */ major = gss_init_sec_context(&minor, conn->gcred, &conn->gctx, conn->gtarg_nam, GSS_C_NO_OID, - GSS_REQUIRED_FLAGS, 0, 0, &input, NULL, + GSS_REQUIRED_FLAGS | GSS_C_DELEG_FLAG, 0, 0, &input, NULL, &output, NULL, NULL); /* GSS Init Sec Context uses the whole packet, so clear it */ @@ -651,6 +651,7 @@ pqsecure_open_gss(PGconn *conn) * to do GSS wrapping/unwrapping. */ conn->gssenc = true; + conn->gssapi_used = true; /* Clean up */ gss_release_cred(&minor, &conn->gcred); diff --git a/src/interfaces/libpq/libpq-fe.h b/src/interfaces/libpq/libpq-fe.h index 7986445f1a..bdd073c645 100644 --- a/src/interfaces/libpq/libpq-fe.h +++ b/src/interfaces/libpq/libpq-fe.h @@ -354,6 +354,7 @@ extern int PQbackendPID(const PGconn *conn); extern PGpipelineStatus PQpipelineStatus(const PGconn *conn); extern int PQconnectionNeedsPassword(const PGconn *conn); extern int PQconnectionUsedPassword(const PGconn *conn); +extern int PQconnectionUsedGSSAPI(const PGconn *conn); extern int PQclientEncoding(const PGconn *conn); extern int PQsetClientEncoding(PGconn *conn, const char *encoding); diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h index e0cee4b142..5dd9a52305 100644 --- a/src/interfaces/libpq/libpq-int.h +++ b/src/interfaces/libpq/libpq-int.h @@ -449,6 +449,7 @@ struct pg_conn int sversion; /* server version, e.g. 70401 for 7.4.1 */ bool auth_req_received; /* true if any type of auth req received */ bool password_needed; /* true if server demanded a password */ + bool gssapi_used; /* true if authenticated via gssapi */ bool sigpipe_so; /* have we masked SIGPIPE via SO_NOSIGPIPE? */ bool sigpipe_flag; /* can we mask SIGPIPE via MSG_NOSIGNAL? */ bool write_failed; /* have we had a write failure on sock? */ diff --git a/src/test/kerberos/Makefile b/src/test/kerberos/Makefile index c531998835..67dfaae901 100644 --- a/src/test/kerberos/Makefile +++ b/src/test/kerberos/Makefile @@ -13,6 +13,9 @@ subdir = src/test/kerberos top_builddir = ../../.. include $(top_builddir)/src/Makefile.global +EXTRA_INSTALL += contrib/postgres_fdw +EXTRA_INSTALL += contrib/dblink + export with_gssapi with_krb_srvnam check: diff --git a/src/test/kerberos/t/001_auth.pl b/src/test/kerberos/t/001_auth.pl index 62e0542639..7e6de8d458 100644 --- a/src/test/kerberos/t/001_auth.pl +++ b/src/test/kerberos/t/001_auth.pl @@ -45,6 +45,7 @@ elsif ($^O eq 'linux') my $krb5_config = 'krb5-config'; my $kinit = 'kinit'; +my $klist = 'klist'; my $kdb5_util = 'kdb5_util'; my $kadmin_local = 'kadmin.local'; my $krb5kdc = 'krb5kdc'; @@ -53,6 +54,7 @@ if ($krb5_bin_dir && -d $krb5_bin_dir) { $krb5_config = $krb5_bin_dir . '/' . $krb5_config; $kinit = $krb5_bin_dir . '/' . $kinit; + $klist = $krb5_bin_dir . '/' . $klist; } if ($krb5_sbin_dir && -d $krb5_sbin_dir) { @@ -97,6 +99,7 @@ kdc = FILE:$kdc_log [libdefaults] default_realm = $realm +forwardable = false [realms] $realm = { @@ -174,7 +177,21 @@ lc_messages = 'C' }); $node->start; +my $port = $node->port(); + $node->safe_psql('postgres', 'CREATE USER test1;'); +$node->safe_psql('postgres', 'CREATE EXTENSION postgres_fdw;'); +$node->safe_psql('postgres', 'CREATE EXTENSION dblink;'); +$node->safe_psql('postgres', "CREATE SERVER s1 FOREIGN DATA WRAPPER postgres_fdw OPTIONS (host '$host', hostaddr '$hostaddr', port '$port', dbname 'postgres');"); + +$node->safe_psql('postgres', 'GRANT USAGE ON FOREIGN SERVER s1 TO test1;'); + +$node->safe_psql('postgres', "CREATE USER MAPPING FOR test1 SERVER s1 OPTIONS (user 'test1', password_required 'false');"); +$node->safe_psql('postgres', "CREATE TABLE t1 (c1 int);"); +$node->safe_psql('postgres', "INSERT INTO t1 VALUES (1);"); +$node->safe_psql('postgres', "CREATE FOREIGN TABLE tf1 (c1 int) SERVER s1 OPTIONS (schema_name 'public', table_name 't1');"); +$node->safe_psql('postgres', "GRANT SELECT ON t1 TO test1;"); +$node->safe_psql('postgres', "GRANT SELECT ON tf1 TO test1;"); note "running tests"; @@ -240,6 +257,7 @@ $node->restart; test_access($node, 'test1', 'SELECT true', 2, '', 'fails without ticket'); run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?); +run_log [ $klist, '-f' ] or BAIL_OUT($?); test_access( $node, @@ -262,7 +280,7 @@ test_access( '', 'succeeds with mapping with default gssencmode and host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access( @@ -273,7 +291,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred with host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access( $node, @@ -283,7 +301,7 @@ test_access( 'gssencmode=require', 'succeeds with GSS-encrypted access required with host hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); # Test that we can transport a reasonable amount of data. @@ -312,6 +330,11 @@ $node->append_conf('pg_hba.conf', qq{hostgssenc all all $hostaddr/32 gss map=mymap}); $node->restart; +string_replace_file($krb5_conf, "forwardable = false", "forwardable = true"); + +run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?); +run_log [ $klist, '-f' ] or BAIL_OUT($?); + test_access( $node, 'test1', @@ -320,7 +343,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred and hostgssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); test_access( $node, @@ -330,7 +353,7 @@ test_access( 'gssencmode=require', 'succeeds with GSS-encrypted access required and hostgssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); test_access($node, 'test1', 'SELECT true', 2, 'gssencmode=disable', 'fails with GSS encryption disabled and hostgssenc hba'); @@ -348,7 +371,7 @@ test_access( 'gssencmode=prefer', 'succeeds with GSS-encrypted access preferred and hostnogssenc hba, but no encryption', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, proxy_credentials=yes, principal=test1\@$realm)" ); test_access($node, 'test1', 'SELECT true', 2, 'gssencmode=require', 'fails with GSS-encrypted access required and hostnogssenc hba'); @@ -360,9 +383,25 @@ test_access( 'gssencmode=disable', 'succeeds with GSS encryption disabled and hostnogssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, proxy_credentials=yes, principal=test1\@$realm)" ); +test_query( + $node, + 'test1', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + qr/^1$/s, + 'gssencmode=prefer', + 'dblink works not-encrypted'); + +test_query( + $node, + 'test1', + "TABLE tf1;", + qr/^1$/s, + 'gssencmode=prefer', + 'postgres_fdw works not-encrypted'); + truncate($node->data_dir . '/pg_ident.conf', 0); unlink($node->data_dir . '/pg_hba.conf'); $node->append_conf('pg_hba.conf', @@ -377,9 +416,25 @@ test_access( '', 'succeeds with include_realm=0 and defaults', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); +test_query( + $node, + 'test1', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + qr/^1$/s, + 'gssencmode=require', + 'dblink works encrypted'); + +test_query( + $node, + 'test1', + "TABLE tf1;", + qr/^1$/s, + 'gssencmode=require', + 'postgres_fdw works encrypted'); + # Reset pg_hba.conf, and cause a usermap failure with an authentication # that has passed. unlink($node->data_dir . '/pg_hba.conf'); @@ -396,4 +451,61 @@ test_access( 'fails with wrong krb_realm, but still authenticates', "connection authenticated: identity=\"test1\@$realm\" method=gss"); +# Reset pg_hba.conf, and have the server refuse delegated credentials. +unlink($node->data_dir . '/pg_hba.conf'); +$node->append_conf('pg_hba.conf', + qq{host all all $hostaddr/32 gss include_realm=0 allow_cred_delegation=0}); +$node->restart; + +my ($psql_stdout, $psql_stderr, $psql_timed_out); +my $psql_cmdret = $node->psql('postgres', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + stdout => \$psql_stdout, stderr => \$psql_stderr, + connstr => $node->connstr('postgres') . " user=test1 host=$host hostaddr=$hostaddr gssencmode=require"); + +ok ($psql_cmdret == 3, 'error result from dblink failing without delegated credentials'); +like ($psql_stderr, qr/could not establish connection/, 'dblink fails due to missing delegated credentials'); + +$node->append_conf( + 'postgresql.conf', qq{ +krb_user_ccache = 'blah' +}); +$node->restart; + +$psql_cmdret = $node->psql('postgres', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + stdout => \$psql_stdout, stderr => \$psql_stderr, + connstr => $node->connstr('postgres') . " user=test1 host=$host hostaddr=$hostaddr gssencmode=require"); + +ok ($psql_cmdret == 3, 'error result from dblink failing due to invalid credential cache'); +like ($psql_stderr, qr/could not establish connection/, 'dblink fails due to invalid credential cache'); + +$node->append_conf( + 'postgresql.conf', qq{ +krb_user_ccache = '' +}); +$node->restart; + +$psql_cmdret = $node->psql('postgres', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + stdout => \$psql_stdout, stderr => \$psql_stderr, + connstr => $node->connstr('postgres') . " user=test1 host=$host hostaddr=$hostaddr gssencmode=require"); + +ok ($psql_cmdret == 3, 'error result from dblink failing with un-set credential cache'); +like ($psql_stderr, qr/could not establish connection/, 'dblink fails with un-set credential cache'); + +$node->append_conf( + 'postgresql.conf', qq{ +krb_user_ccache = 'environment' +}); +$node->restart; + +test_query( + $node, + 'test1', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + qr/^1$/s, + 'gssencmode=require', + 'dblink works with environment ccache and not delegated credentials'); + done_testing(); diff --git a/src/test/perl/PostgreSQL/Test/Utils.pm b/src/test/perl/PostgreSQL/Test/Utils.pm index dca1b3b17c..0f94a628a5 100644 --- a/src/test/perl/PostgreSQL/Test/Utils.pm +++ b/src/test/perl/PostgreSQL/Test/Utils.pm @@ -65,6 +65,7 @@ our @EXPORT = qw( slurp_dir slurp_file append_to_file + string_replace_file check_mode_recursive chmod_recursive check_pg_config @@ -544,6 +545,32 @@ sub append_to_file =pod +=item string_replace_file(filename, find, replace) + +Find and replace string of a given file. + +=cut + +sub string_replace_file +{ + my ($filename, $find, $replace) = @_; + open(my $in, '<', $filename); + my $content; + while(<$in>) + { + $_ =~ s/$find/$replace/; + $content = $content.$_; + } + close $in; + open(my $out, '>', $filename); + print $out $content; + close($out); + + return; +} + +=pod + =item check_mode_recursive(dir, expected_dir_mode, expected_file_mode, ignore_list) Check that all file/dir modes in a directory match the expected values, -- 2.30.2 [application/pgp-signature] signature.asc (819B, ../../[email protected]/3-signature.asc) download ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-04-08 15:01 Robert Haas <[email protected]> parent: Stephen Frost <[email protected]> 1 sibling, 1 reply; 17+ messages in thread From: Robert Haas @ 2022-04-08 15:01 UTC (permalink / raw) To: Stephen Frost <[email protected]>; +Cc: Jacob Champion <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]> On Fri, Apr 8, 2022 at 8:21 AM Stephen Frost <[email protected]> wrote: > Added an explicit 'environment' option to allow for, basically, existing > behavior, where we don't mess with the environment variable at all, > though I kept the default as MEMORY since I don't think it's really > typical that folks actually want regular user backends to inherit the > credential cache of the server. > > Added a few more tests and updated the documentation too. Sadly, seems > we've missed the deadline for v15 though for lack of feedback on these. > Would really like to get some other folks commenting as these are new > pg_hba and postgresql.conf options being added. Hi, I don't think this patch is quite baked enough to go in even if the deadline hadn't formally passed, but I'm happy to offer a few opinions ... especially if we can also try to sort out a plan for getting that wider-checksums thing you mentioned done for v16. + /* gssencmode is also libpq option, same to above. */ + {"gssencmode", UserMappingRelationId, true}, I really hate names like this that are just a bunch of stuff strung together with no punctuation and some arbitrary abbreviations thrown in for good measure. But since the libpq parameter already exists it's hard to argue we should do anything else here. + <term><literal>allow_cred_delegation</literal></term> First, I again recommend not choosing words at random to abbreviate. "delegate_credentials" would be shorter and clearer. Second, I think we need to decide whether we envision just having one parameter here for every kind of credential delegation that libpq might ever support, or whether this is really something specific to GSS. If the latter, the name should mention GSS. I also suggest that the default value of this option should be false, rather than true. I would be unhappy if ssh started defaulting to ForwardAgent=yes, because that's less secure and I don't want my credentials shared with random servers without me making a choice to do that. Similarly here I think we should default to the more secure option. + <listitem> + <para> + Sets the location of the Kerberos credential cache to be used for + regular user backends which go through authentication. The default is + <filename>MEMORY:</filename>, which is where delegated credentials + are stored (and is otherwise empty). Care should be used when changing + this value- setting it to a file-based credential cache will mean that + user backends could potentially use any credentials stored to access + other systems. + If this parameter is set to an empty string, then the variable will be + explicit un-set and the system-dependent default is used, which may be a + file-based credential cache with the same caveats as previously + mentioned. If the special value 'environment' is used, then the variable + is left untouched and will be whatever was set in the environment at + startup time. "MEMORY:" seems like a pretty weird choice of arbitrary string. Is it supposed to look like a Windows drive letter or pseudo-device, or what? I'm not sure exactly what's better here, but I just think this doesn't look like anything else we've got today. And then we've got a second special environment, "environment", which looks completely different: now it's lower-case and without the colon. And then empty string is special too. I wonder whether we really quite this many cases. But if we do they probably need better and more consistent naming. The formatting here also looks weird. +#ifndef PG_KRB_USER_CCACHE +#define PG_KRB_USER_CCACHE "MEMORY:" +#endif At the risk of stating the obvious, the general idea of a #define is that you define things in one place and then use the defined symbol rather than the original value everywhere. This patch takes the less-useful approach of defining two different symbols for the same string in different files. This one has this #ifndef/#endif guard here which I think it probably shouldn't, since the choice of string probably shouldn't be compile-time configurable, but it also won't work, because there's no similar guard in the other file. -- Robert Haas EDB: http://www.enterprisedb.com ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-04-08 15:29 Stephen Frost <[email protected]> parent: Robert Haas <[email protected]> 0 siblings, 1 reply; 17+ messages in thread From: Stephen Frost @ 2022-04-08 15:29 UTC (permalink / raw) To: Robert Haas <[email protected]>; +Cc: Jacob Champion <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]> Greetings, * Robert Haas ([email protected]) wrote: > On Fri, Apr 8, 2022 at 8:21 AM Stephen Frost <[email protected]> wrote: > > Added an explicit 'environment' option to allow for, basically, existing > > behavior, where we don't mess with the environment variable at all, > > though I kept the default as MEMORY since I don't think it's really > > typical that folks actually want regular user backends to inherit the > > credential cache of the server. > > > > Added a few more tests and updated the documentation too. Sadly, seems > > we've missed the deadline for v15 though for lack of feedback on these. > > Would really like to get some other folks commenting as these are new > > pg_hba and postgresql.conf options being added. > > I don't think this patch is quite baked enough to go in even if the > deadline hadn't formally passed, but I'm happy to offer a few opinions > ... especially if we can also try to sort out a plan for getting that > wider-checksums thing you mentioned done for v16. Sure. > + /* gssencmode is also libpq option, same to above. */ > + {"gssencmode", UserMappingRelationId, true}, > > I really hate names like this that are just a bunch of stuff strung > together with no punctuation and some arbitrary abbreviations thrown > in for good measure. But since the libpq parameter already exists it's > hard to argue we should do anything else here. Well, yeah. > + <term><literal>allow_cred_delegation</literal></term> > > First, I again recommend not choosing words at random to abbreviate. > "delegate_credentials" would be shorter and clearer. Second, I think > we need to decide whether we envision just having one parameter here > for every kind of credential delegation that libpq might ever support, > or whether this is really something specific to GSS. If the latter, > the name should mention GSS. delegate_credentials seems to imply that the server has some kind of control over the act of delegating credentials, which isn't really the case. The client has to decide to delegate credentials and it does that independent of the server- the server side just gets to either accept those delegated credentials, or ignore them. In terms of having a prefix, this is certainly something that I'd like to see SSPI support added for as well (perhaps that can be in v16 too) and so it's definitely not GSS-exclusive among the authentication methods that we have today. In that sense, this option falls into the same category as 'include_realm' and 'krb_realm' in that it applies to more than one, but not all, of our authentication methods. > I also suggest that the default value of this option should be false, > rather than true. I would be unhappy if ssh started defaulting to > ForwardAgent=yes, because that's less secure and I don't want my > credentials shared with random servers without me making a choice to > do that. Similarly here I think we should default to the more secure > option. This is a bit backwards from how it works though- this option is about if the server will accept delegated credentials, not if the client sends them. If your client was set to ForwardAgent=yes, would you be happy if the server's default was AllowAgentForwarding=no? (At least on the system I'm looking at, the current default is AllowAgentForwarding=yes in sshd_config). Regarding the client side, it is the case that GSSAPIDelegateCredentials in ssh defaults to no, so it seems like the next iteration of the patch should probably include a libpq option similar to that ssh_config option. As I mentioned before, users already can decide if they'd like proxyable credentials or not when they kinit, though more generally this is set as a environment-wide policy, but we can add an option and disable it by default. > + <listitem> > + <para> > + Sets the location of the Kerberos credential cache to be used for > + regular user backends which go through authentication. The default is > + <filename>MEMORY:</filename>, which is where delegated credentials > + are stored (and is otherwise empty). Care should be used when changing > + this value- setting it to a file-based credential cache will mean that > + user backends could potentially use any credentials stored to access > + other systems. > + If this parameter is set to an empty string, then the variable will be > + explicit un-set and the system-dependent default is used, which may be a > + file-based credential cache with the same caveats as previously > + mentioned. If the special value 'environment' is used, then the variable > + is left untouched and will be whatever was set in the environment at > + startup time. > > "MEMORY:" seems like a pretty weird choice of arbitrary string. Is it > supposed to look like a Windows drive letter or pseudo-device, or > what? I'm not sure exactly what's better here, but I just think this > doesn't look like anything else we've got today. And then we've got a > second special environment, "environment", which looks completely > different: now it's lower-case and without the colon. And then empty > string is special too. This isn't actually something we have a choice in, really, it's from the Kerberos library. MEMORY is the library's in-memory credential cache. Other possible values are FILE:/some/file, DIR:/some/dir, API:, and others. Documentaton is available here: https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html > I wonder whether we really quite this many cases. But if we do they > probably need better and more consistent naming. I wouldn't want to end up with values that could end up conflicting with real values that a user might want to specify, so the choice of 'environment' and empty-value were specifically chosen to avoid that risk. If we're worried that doing so isn't sufficient or is too confusing, the better option would likely be to have another GUC that controls if we unset, ignore, or set the value to what the other GUC says to set it to. I'm fine with that if you agree. > The formatting here also looks weird. > > +#ifndef PG_KRB_USER_CCACHE > +#define PG_KRB_USER_CCACHE "MEMORY:" > +#endif > > At the risk of stating the obvious, the general idea of a #define is > that you define things in one place and then use the defined symbol > rather than the original value everywhere. This patch takes the > less-useful approach of defining two different symbols for the same > string in different files. This one has this #ifndef/#endif guard here > which I think it probably shouldn't, since the choice of string > probably shouldn't be compile-time configurable, but it also won't > work, because there's no similar guard in the other file. Yeah, the other #define should have gone away and been changed to use the above. That should be easy enough to fix. Thanks! Stephen Attachments: [application/pgp-signature] signature.asc (819B, ../../[email protected]/2-signature.asc) download ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-04-08 15:35 Robert Haas <[email protected]> parent: Stephen Frost <[email protected]> 0 siblings, 0 replies; 17+ messages in thread From: Robert Haas @ 2022-04-08 15:35 UTC (permalink / raw) To: Stephen Frost <[email protected]>; +Cc: Jacob Champion <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]> On Fri, Apr 8, 2022 at 11:29 AM Stephen Frost <[email protected]> wrote: > > + <term><literal>allow_cred_delegation</literal></term> > > > > First, I again recommend not choosing words at random to abbreviate. > > "delegate_credentials" would be shorter and clearer. Second, I think > > we need to decide whether we envision just having one parameter here > > for every kind of credential delegation that libpq might ever support, > > or whether this is really something specific to GSS. If the latter, > > the name should mention GSS. > > delegate_credentials seems to imply that the server has some kind of > control over the act of delegating credentials, which isn't really the > case. The client has to decide to delegate credentials and it does that > independent of the server- the server side just gets to either accept > those delegated credentials, or ignore them. Oh ... I thought this was a libpq parameter to control the client behavior. I guess I didn't read it carefully enough. > Regarding the client side, it is the case that GSSAPIDelegateCredentials > in ssh defaults to no, so it seems like the next iteration of the patch > should probably include a libpq option similar to that ssh_config > option. As I mentioned before, users already can decide if they'd like > proxyable credentials or not when they kinit, though more generally this > is set as a environment-wide policy, but we can add an option and > disable it by default. +1. > This isn't actually something we have a choice in, really, it's from the > Kerberos library. MEMORY is the library's in-memory credential cache. > Other possible values are FILE:/some/file, DIR:/some/dir, API:, and > others. Documentaton is available here: > https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html Well, I was just going by the fact that this string ("MEMORY:") seems to be being interpreted in our code, not the library. > > I wonder whether we really quite this many cases. But if we do they > > probably need better and more consistent naming. > > I wouldn't want to end up with values that could end up conflicting with > real values that a user might want to specify, so the choice of > 'environment' and empty-value were specifically chosen to avoid that > risk. If we're worried that doing so isn't sufficient or is too > confusing, the better option would likely be to have another GUC that > controls if we unset, ignore, or set the value to what the other GUC > says to set it to. I'm fine with that if you agree. Yeah, I thought of that, and it might be the way to go. I wasn't too sure we needed the explicit-unset behavior as an option, but I defer to you on that. -- Robert Haas EDB: http://www.enterprisedb.com ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-07-07 23:24 Jacob Champion <[email protected]> parent: Stephen Frost <[email protected]> 1 sibling, 1 reply; 17+ messages in thread From: Jacob Champion @ 2022-07-07 23:24 UTC (permalink / raw) To: Stephen Frost <[email protected]>; +Cc: pgsql-hackers <[email protected]>; Magnus Hagander <[email protected]>; Peter Eisentraut <[email protected]>; Tom Lane <[email protected]>; Robert Haas <[email protected]> On 4/8/22 05:21, Stephen Frost wrote: > Added a few more tests and updated the documentation too. Sadly, seems > we've missed the deadline for v15 though for lack of feedback on these. > Would really like to get some other folks commenting as these are new > pg_hba and postgresql.conf options being added. Sorry for the incredibly long delay; I lost track of this thread during the email switch. I'm testing the patch with various corner cases to try to figure out how it behaves, so this isn't a full review, but I wanted to jump through some of the emails I missed and at least give you some responses. As an overall note, I think the patch progression, and adding more explicit control over when credentials may be delegated, is very positive, and +1 for the proposed libpq connection option elsewhere in the thread. On 4/7/22 21:21, Stephen Frost wrote: >> That an admin might have a credential cache that's picked up and used >> for connections from a regular user backend to another system strikes me >> as an altogether concerning idea. Even so, in such a case, the admin >> would have had to set up the user mapping with 'password required = >> false' or it wouldn't have worked for a non-superuser anyway, so I'm not >> sure that I'm too worried about this case. > > To address this, I also added a new GUC which allows an administrator to > control what the credential cache is set to for user-authenticated > backends, with a default of MEMORY:, which should generally be safe and > won't cause a user backend to pick up on a file-based credential cache > which might exist on the server somewhere. This gives the administrator > the option to set it to more-or-less whatever they'd like though, so if > they want to set it to a file-based credential cache, then they can do > so (I did put some caveats about doing that into the documentation as I > don't think it's generally a good idea to do...). I'm not clear on how this handles the collision case. My concern was with a case where you have more than one foreign table/server, and they need to use separate credentials. It's not obvious to me how changing the location of a (single, backend-global) cache mitigates that problem. I'm also missing something about why password_required=false is necessary (as opposed to simply setting a password in the USER MAPPING). My current test case doesn't make use of password_required=false and it appears to work just fine. On 4/6/22 12:27, Stephen Frost wrote: >> Another danger might be disclosure/compromise of middlebox secrets? Is >> it possible for someone who has one half of the credentials to snoop on >> a gssenc connection between the proxy Postgres and the backend >> Postgres? > > A compromised middlebox would, of course, be an issue- for any kind of > delegated credentials (which certainly goes for cleartext passwords > being passed along, and that's currently the only thing we support..). > One nice thing about GSSAPI is that the client and the server validate > each other, so it wouldn't just be 'any' middle-box but would have to be > one that was actually a trusted system in the infrastructure which has > somehow been compromised and was still trusted. I wasn't clear enough, sorry -- I mean that we have to prove that defaulting allow_cred_delegation to true doesn't cause the compromise of existing deployments. As an example, right now I'm trying to characterize behavior with the following pg_hba setup on the foreign server: hostgssenc all all ... password So in other words we're using GSS as transport encryption only, not as an authentication provider. On the middlebox, we create a FOREIGN SERVER/TABLE that points to this, and set up a USER MAPPING (with no USAGE rights) that contains the necessary password. (I'm using a plaintext password to make it more obvious what the danger is, not suggesting that this would be good practice.) As far as I can tell, to make this work today, a server admin has to set up a local credential cache with the keys for some one-off principal. It doesn't have to be an admin principal, because the point is just to provide transport protection for the password, so it's not really particularly scary to make it available to user backends. But this new proposed feature lets the client override that credential cache, substituting their own credentials, for which they have all the Kerberos symmetric key material. So my question is this: does substituting my credentials for the admin's credentials let me weaken or break the transport encryption on the backend connection, and grab the password that I'm not supposed to have access to as a front-end client? I honestly don't know the answer; GSSAPI is a black box that defers to Kerberos and there's a huge number of specs that I've been slowly making my way through. But in my tests, if I turn on credential forwarding, Wireshark is suddenly able to use the *client's* keys to decrypt pieces of the TGS's conversations with the *middlebox*, including session keys, and that doesn't make me feel very good about the strength of the crypto when the middlebox starts talking to the backend foreign server. Maybe there's some ephemeral exchange going on that makes it too hard to attack in practice, or some other mitigations. But Wireshark doesn't understand how to dissect the libpq gssenc exchange, and I don't know the specs well enough yet, so I can't really prove it either way. Do you know more about the underlying GSS exchange, or else which specs cover the low-level details? I'm trying to avoid writing Wireshark dissector code, but maybe that'd be useful either way... --Jacob ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-09-16 00:06 Jacob Champion <[email protected]> parent: Jacob Champion <[email protected]> 0 siblings, 1 reply; 17+ messages in thread From: Jacob Champion @ 2022-09-16 00:06 UTC (permalink / raw) To: Stephen Frost <[email protected]>; +Cc: pgsql-hackers <[email protected]>; Magnus Hagander <[email protected]>; Peter Eisentraut <[email protected]>; Tom Lane <[email protected]>; Robert Haas <[email protected]> On Thu, Jul 7, 2022 at 4:24 PM Jacob Champion <[email protected]> wrote: > So my question is this: does substituting my credentials for the admin's > credentials let me weaken or break the transport encryption on the > backend connection, and grab the password that I'm not supposed to have > access to as a front-end client? With some further research: yes, it does. If a DBA is using a GSS encrypted tunnel to communicate to a foreign server, accepting delegation by default means that clients will be able to break that backend encryption at will, because the keys in use will be under their control. > Maybe there's some ephemeral exchange going on that makes it too hard to > attack in practice, or some other mitigations. There is no forward secrecy, ephemeral exchange, etc. to mitigate this [1]: The Kerberos protocol in its basic form does not provide perfect forward secrecy for communications. If traffic has been recorded by an eavesdropper, then messages encrypted using the KRB_PRIV message, or messages encrypted using application-specific encryption under keys exchanged using Kerberos can be decrypted if the user's, application server's, or KDC's key is subsequently discovered. So the client can decrypt backend communications that make use of its delegated key material. (This also means that gssencmode is a lot weaker than I expected.) > I'm trying to avoid writing Wireshark dissector > code, but maybe that'd be useful either way... I did end up filling out the existing PGSQL dissector so that it could decrypt GSSAPI exchanges (with the use of a keytab, that is). If you'd like to give it a try, the patch, based on Wireshark 3.7.1, is attached. Note the GPLv2 license. It isn't correct code yet, because I didn't understand how packet reassembly worked in Wireshark when I started writing the code, so really large GSSAPI messages that are split across multiple TCP packets will confuse the dissector. But it's enough to prove the concept. To see this in action, set up an FDW connection that uses gssencmode (so the server in the middle will need its own Kerberos credentials). Capture traffic starting from the kinit through the query on the foreign table. Export the client's key material into a keytab, and set up Wireshark to use that keytab for decryption. When credential forwarding is *not* in use, Wireshark will be able to decrypt the initial client connection, but it won't be able to see anything inside the foreign server connection. When credential forwarding is in use, Wireshark will be able to decrypt both connections. Thanks, --Jacob [1] https://www.rfc-editor.org/rfc/rfc4120 From 0cf31522223a6044edae42037e45aee0fc88352f Mon Sep 17 00:00:00 2001 From: Jacob Champion <[email protected]> Date: Wed, 14 Sep 2022 13:08:22 -0700 Subject: [PATCH] pgsql: decrypt GSS-encrypted channels and tokens if possible License: GPLv2 Add dissection for a conversation that starts with a GSSAPI encryption request, and pass those packets along to the gssapi dissector. This allows parts of the conversation to be decrypted if Wireshark has been set up with a KRB5 keytab. Additionally, break apart the PGSQL_AUTH_GSSAPI_SSPI_DATA case into separate GSSAPI and SSPI cases, and when we're using GSSAPI, dissect the authentication tokens that are passed between the client and server. This incidentally fixes an off-by-four bug in the PGSQL_AUTH_TYPE_GSSAPI_SSPI_CONTINUE case; the offset was not being updated correctly before. The new code copies the dissection strategy of multipart, and adds a new last_nongss_frame marker similar to the STARTTLS handling code's last_nontls_frame. --- epan/dissectors/packet-pgsql.c | 121 +++++++++++++++++++++++++++++++-- 1 file changed, 116 insertions(+), 5 deletions(-) diff --git a/epan/dissectors/packet-pgsql.c b/epan/dissectors/packet-pgsql.c index c935eec1f8..7efe1c003f 100644 --- a/epan/dissectors/packet-pgsql.c +++ b/epan/dissectors/packet-pgsql.c @@ -14,6 +14,8 @@ #include <epan/packet.h> +#include "packet-dcerpc.h" +#include "packet-gssapi.h" #include "packet-tls-utils.h" #include "packet-tcp.h" @@ -22,6 +24,7 @@ void proto_reg_handoff_pgsql(void); static dissector_handle_t pgsql_handle; static dissector_handle_t tls_handle; +static dissector_handle_t gssapi_handle; static int proto_pgsql = -1; static int hf_frontend = -1; @@ -80,10 +83,13 @@ static int hf_constraint_name = -1; static int hf_file = -1; static int hf_line = -1; static int hf_routine = -1; +static int hf_gssapi_length = -1; static gint ett_pgsql = -1; static gint ett_values = -1; +static expert_field ei_gssapi_decryption_not_possible = EI_INIT; + #define PGSQL_PORT 5432 static gboolean pgsql_desegment = TRUE; static gboolean first_message = TRUE; @@ -92,11 +98,14 @@ typedef enum { PGSQL_AUTH_STATE_NONE, /* No authentication seen or used */ PGSQL_AUTH_SASL_REQUESTED, /* Server sends SASL auth request with supported SASL mechanisms*/ PGSQL_AUTH_SASL_CONTINUE, /* Server and/or client send further SASL challange-response messages */ - PGSQL_AUTH_GSSAPI_SSPI_DATA, /* GSSAPI/SSPI in use */ + PGSQL_AUTH_GSSAPI, /* GSSAPI in use */ + PGSQL_AUTH_SSPI, /* SSPI in use */ } pgsql_auth_state_t; typedef struct pgsql_conn_data { gboolean ssl_requested; + gboolean gss_requested; + guint32 last_nongss_frame; pgsql_auth_state_t auth_state; /* Current authentication state */ } pgsql_conn_data_t; @@ -189,6 +198,22 @@ static const value_string format_vals[] = { { 0, NULL } }; +static void +dissect_gssapi_data(tvbuff_t *tvb, gint offset, guint len, packet_info *pinfo, + proto_tree *tree, gssapi_encrypt_info_t *encrypt) +{ + tvbuff_t *gssapi_tvb; + guint8 *data; + + DISSECTOR_ASSERT(tvb_bytes_exist(tvb, offset, len)); + + data = (guint8 *)tvb_memdup(pinfo->pool, tvb, offset, len); + gssapi_tvb = tvb_new_child_real_data(tvb, data, len, len); + + add_new_data_source(pinfo, gssapi_tvb, "GSSAPI Data"); + call_dissector_with_data(gssapi_handle, gssapi_tvb, pinfo, tree, encrypt); +} + static void dissect_pgsql_fe_msg(guchar type, guint length, tvbuff_t *tvb, gint n, proto_tree *tree, packet_info *pinfo, pgsql_conn_data_t *conv_data) @@ -220,7 +245,12 @@ static void dissect_pgsql_fe_msg(guchar type, guint length, tvbuff_t *tvb, proto_tree_add_item(tree, hf_sasl_auth_data, tvb, n, length-4, ENC_NA); break; - case PGSQL_AUTH_GSSAPI_SSPI_DATA: + case PGSQL_AUTH_GSSAPI: + proto_tree_add_item(tree, hf_gssapi_sspi_data, tvb, n, length-4, ENC_NA); + dissect_gssapi_data(tvb, n, length-4, pinfo, tree, NULL); + break; + + case PGSQL_AUTH_SSPI: proto_tree_add_item(tree, hf_gssapi_sspi_data, tvb, n, length-4, ENC_NA); break; @@ -356,6 +386,12 @@ static void dissect_pgsql_fe_msg(guchar type, guint length, tvbuff_t *tvb, conv_data->ssl_requested = TRUE; break; + /* GSS request */ + case 80877104: + /* Next reply will be a single byte. */ + conv_data->gss_requested = TRUE; + break; + /* Cancellation request */ case 80877102: proto_tree_add_item(tree, hf_pid, tvb, n, 4, ENC_BIG_ENDIAN); @@ -430,9 +466,17 @@ static void dissect_pgsql_be_msg(guchar type, guint length, tvbuff_t *tvb, siz = (auth_type == PGSQL_AUTH_TYPE_CRYPT ? 2 : 4); proto_tree_add_item(tree, hf_salt, tvb, n, siz, ENC_NA); break; + case PGSQL_AUTH_TYPE_GSSAPI: + conv_data->auth_state = PGSQL_AUTH_GSSAPI; + break; + case PGSQL_AUTH_TYPE_SSPI: + conv_data->auth_state = PGSQL_AUTH_SSPI; + break; case PGSQL_AUTH_TYPE_GSSAPI_SSPI_CONTINUE: - conv_data->auth_state = PGSQL_AUTH_GSSAPI_SSPI_DATA; + n += 4; proto_tree_add_item(tree, hf_gssapi_sspi_data, tvb, n, length-8, ENC_NA); + if (conv_data->auth_state == PGSQL_AUTH_GSSAPI) + dissect_gssapi_data(tvb, n, length-8, pinfo, tree, NULL); break; case PGSQL_AUTH_TYPE_SASL: conv_data->auth_state = PGSQL_AUTH_SASL_REQUESTED; @@ -665,6 +709,8 @@ dissect_pgsql_msg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* dat if (!conn_data) { conn_data = wmem_new(wmem_file_scope(), pgsql_conn_data_t); conn_data->ssl_requested = FALSE; + conn_data->gss_requested = FALSE; + conn_data->last_nongss_frame = G_MAXUINT32; conn_data->auth_state = PGSQL_AUTH_STATE_NONE; conversation_add_proto_data(conversation, proto_pgsql, conn_data); } @@ -703,7 +749,8 @@ dissect_pgsql_msg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* dat case PGSQL_AUTH_SASL_CONTINUE: typestr = "SASLResponse message"; break; - case PGSQL_AUTH_GSSAPI_SSPI_DATA: + case PGSQL_AUTH_GSSAPI: /* fallthrough */ + case PGSQL_AUTH_SSPI: typestr = "GSSResponse message"; break; default: @@ -746,6 +793,18 @@ dissect_pgsql_msg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* dat return tvb_captured_length(tvb); } +static void +dissect_gssenc_msg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gssapi_encrypt_info_t *encrypt) +{ + gint offset = 0, len; + + proto_tree_add_item(tree, hf_gssapi_length, tvb, offset, 4, ENC_BIG_ENDIAN); + offset += 4; + len = tvb_reported_length_remaining(tvb, offset); + + dissect_gssapi_data(tvb, offset, len, pinfo, tree, encrypt); +} + /* This function is called once per TCP packet. It sets COL_PROTOCOL and * identifies FE/BE messages by adding a ">" or "<" to COL_INFO. Then it * arranges for each message to be dissected individually. */ @@ -782,6 +841,43 @@ dissect_pgsql(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data) return tvb_captured_length(tvb); } + if (conn_data && conn_data->gss_requested) { + /* Response to GSS request. */ + switch (tvb_get_guint8(tvb, 0)) { + case 'G': /* Willing to perform GSS encryption */ + /* Next packet will start using GSS encryption. */ + conn_data->last_nongss_frame = pinfo->num; + break; + case 'N': /* Unwilling to perform GSS encryption */ + default: /* ErrorMessage when server does not support SSL. */ + /* TODO: maybe add expert info here? */ + break; + } + conn_data->gss_requested = FALSE; + return tvb_captured_length(tvb); + } + + if (conn_data && (pinfo->num > conn_data->last_nongss_frame)) { + tvbuff_t *subtvb; + gssapi_encrypt_info_t encrypt; + + memset(&encrypt, 0, sizeof(encrypt)); + encrypt.decrypt_gssapi_tvb = DECRYPT_GSSAPI_NORMAL; + + dissect_gssenc_msg(tvb, pinfo, tree, &encrypt); + + if (encrypt.gssapi_decrypted_tvb){ + subtvb = encrypt.gssapi_decrypted_tvb; + tcp_dissect_pdus(subtvb, pinfo, tree, pgsql_desegment, 5, + pgsql_length, dissect_pgsql_msg, data); + } else if (encrypt.gssapi_encrypted_tvb) { + subtvb = encrypt.gssapi_encrypted_tvb; + proto_tree_add_expert(tree, pinfo, &ei_gssapi_decryption_not_possible, subtvb, 0, -1); + } + + return tvb_captured_length(tvb); + } + tcp_dissect_pdus(tvb, pinfo, tree, pgsql_desegment, 5, pgsql_length, dissect_pgsql_msg, data); return tvb_captured_length(tvb); @@ -1021,7 +1117,12 @@ proto_register_pgsql(void) { &hf_routine, { "Routine", "pgsql.routine", FT_STRINGZ, BASE_NONE, NULL, 0, "The routine that reported an error.", HFILL } - } + }, + { &hf_gssapi_length, + { "Length of GSSAPI encrypted data", "pgsql.gss.length", FT_UINT32, BASE_DEC, NULL, 0, + "The length of the GSSAPI encrypted blob.", + HFILL } + }, }; static gint *ett[] = { @@ -1029,9 +1130,18 @@ proto_register_pgsql(void) &ett_values }; + expert_module_t* expert_pgsql; + + static ei_register_info ei[] = { + { &ei_gssapi_decryption_not_possible, { "pgsql.gss.decryption_not_possible", PI_UNDECODED, PI_WARN, "The PGSQL dissector could not decrypt the message.", EXPFILL }}, + }; + proto_pgsql = proto_register_protocol("PostgreSQL", "PGSQL", "pgsql"); proto_register_field_array(proto_pgsql, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + + expert_pgsql = expert_register_protocol(proto_pgsql); + expert_register_field_array(expert_pgsql, ei, array_length(ei)); } void @@ -1042,6 +1152,7 @@ proto_reg_handoff_pgsql(void) dissector_add_uint_with_preference("tcp.port", PGSQL_PORT, pgsql_handle); tls_handle = find_dissector_add_dependency("tls", proto_pgsql); + gssapi_handle = find_dissector_add_dependency("gssapi", proto_pgsql); } /* -- 2.25.1 Attachments: [text/plain] GPLv2-Wireshark3.7.1-pgsql-decrypt-GSS.patch.txt (10.5K, ../../CAAWbhmjwUC4kHb+yvJiTi4XQOKEqbOujErXXOx_phC9c8qN7pQ@mail.gmail.com/2-GPLv2-Wireshark3.7.1-pgsql-decrypt-GSS.patch.txt) download | inline diff: From 0cf31522223a6044edae42037e45aee0fc88352f Mon Sep 17 00:00:00 2001 From: Jacob Champion <[email protected]> Date: Wed, 14 Sep 2022 13:08:22 -0700 Subject: [PATCH] pgsql: decrypt GSS-encrypted channels and tokens if possible License: GPLv2 Add dissection for a conversation that starts with a GSSAPI encryption request, and pass those packets along to the gssapi dissector. This allows parts of the conversation to be decrypted if Wireshark has been set up with a KRB5 keytab. Additionally, break apart the PGSQL_AUTH_GSSAPI_SSPI_DATA case into separate GSSAPI and SSPI cases, and when we're using GSSAPI, dissect the authentication tokens that are passed between the client and server. This incidentally fixes an off-by-four bug in the PGSQL_AUTH_TYPE_GSSAPI_SSPI_CONTINUE case; the offset was not being updated correctly before. The new code copies the dissection strategy of multipart, and adds a new last_nongss_frame marker similar to the STARTTLS handling code's last_nontls_frame. --- epan/dissectors/packet-pgsql.c | 121 +++++++++++++++++++++++++++++++-- 1 file changed, 116 insertions(+), 5 deletions(-) diff --git a/epan/dissectors/packet-pgsql.c b/epan/dissectors/packet-pgsql.c index c935eec1f8..7efe1c003f 100644 --- a/epan/dissectors/packet-pgsql.c +++ b/epan/dissectors/packet-pgsql.c @@ -14,6 +14,8 @@ #include <epan/packet.h> +#include "packet-dcerpc.h" +#include "packet-gssapi.h" #include "packet-tls-utils.h" #include "packet-tcp.h" @@ -22,6 +24,7 @@ void proto_reg_handoff_pgsql(void); static dissector_handle_t pgsql_handle; static dissector_handle_t tls_handle; +static dissector_handle_t gssapi_handle; static int proto_pgsql = -1; static int hf_frontend = -1; @@ -80,10 +83,13 @@ static int hf_constraint_name = -1; static int hf_file = -1; static int hf_line = -1; static int hf_routine = -1; +static int hf_gssapi_length = -1; static gint ett_pgsql = -1; static gint ett_values = -1; +static expert_field ei_gssapi_decryption_not_possible = EI_INIT; + #define PGSQL_PORT 5432 static gboolean pgsql_desegment = TRUE; static gboolean first_message = TRUE; @@ -92,11 +98,14 @@ typedef enum { PGSQL_AUTH_STATE_NONE, /* No authentication seen or used */ PGSQL_AUTH_SASL_REQUESTED, /* Server sends SASL auth request with supported SASL mechanisms*/ PGSQL_AUTH_SASL_CONTINUE, /* Server and/or client send further SASL challange-response messages */ - PGSQL_AUTH_GSSAPI_SSPI_DATA, /* GSSAPI/SSPI in use */ + PGSQL_AUTH_GSSAPI, /* GSSAPI in use */ + PGSQL_AUTH_SSPI, /* SSPI in use */ } pgsql_auth_state_t; typedef struct pgsql_conn_data { gboolean ssl_requested; + gboolean gss_requested; + guint32 last_nongss_frame; pgsql_auth_state_t auth_state; /* Current authentication state */ } pgsql_conn_data_t; @@ -189,6 +198,22 @@ static const value_string format_vals[] = { { 0, NULL } }; +static void +dissect_gssapi_data(tvbuff_t *tvb, gint offset, guint len, packet_info *pinfo, + proto_tree *tree, gssapi_encrypt_info_t *encrypt) +{ + tvbuff_t *gssapi_tvb; + guint8 *data; + + DISSECTOR_ASSERT(tvb_bytes_exist(tvb, offset, len)); + + data = (guint8 *)tvb_memdup(pinfo->pool, tvb, offset, len); + gssapi_tvb = tvb_new_child_real_data(tvb, data, len, len); + + add_new_data_source(pinfo, gssapi_tvb, "GSSAPI Data"); + call_dissector_with_data(gssapi_handle, gssapi_tvb, pinfo, tree, encrypt); +} + static void dissect_pgsql_fe_msg(guchar type, guint length, tvbuff_t *tvb, gint n, proto_tree *tree, packet_info *pinfo, pgsql_conn_data_t *conv_data) @@ -220,7 +245,12 @@ static void dissect_pgsql_fe_msg(guchar type, guint length, tvbuff_t *tvb, proto_tree_add_item(tree, hf_sasl_auth_data, tvb, n, length-4, ENC_NA); break; - case PGSQL_AUTH_GSSAPI_SSPI_DATA: + case PGSQL_AUTH_GSSAPI: + proto_tree_add_item(tree, hf_gssapi_sspi_data, tvb, n, length-4, ENC_NA); + dissect_gssapi_data(tvb, n, length-4, pinfo, tree, NULL); + break; + + case PGSQL_AUTH_SSPI: proto_tree_add_item(tree, hf_gssapi_sspi_data, tvb, n, length-4, ENC_NA); break; @@ -356,6 +386,12 @@ static void dissect_pgsql_fe_msg(guchar type, guint length, tvbuff_t *tvb, conv_data->ssl_requested = TRUE; break; + /* GSS request */ + case 80877104: + /* Next reply will be a single byte. */ + conv_data->gss_requested = TRUE; + break; + /* Cancellation request */ case 80877102: proto_tree_add_item(tree, hf_pid, tvb, n, 4, ENC_BIG_ENDIAN); @@ -430,9 +466,17 @@ static void dissect_pgsql_be_msg(guchar type, guint length, tvbuff_t *tvb, siz = (auth_type == PGSQL_AUTH_TYPE_CRYPT ? 2 : 4); proto_tree_add_item(tree, hf_salt, tvb, n, siz, ENC_NA); break; + case PGSQL_AUTH_TYPE_GSSAPI: + conv_data->auth_state = PGSQL_AUTH_GSSAPI; + break; + case PGSQL_AUTH_TYPE_SSPI: + conv_data->auth_state = PGSQL_AUTH_SSPI; + break; case PGSQL_AUTH_TYPE_GSSAPI_SSPI_CONTINUE: - conv_data->auth_state = PGSQL_AUTH_GSSAPI_SSPI_DATA; + n += 4; proto_tree_add_item(tree, hf_gssapi_sspi_data, tvb, n, length-8, ENC_NA); + if (conv_data->auth_state == PGSQL_AUTH_GSSAPI) + dissect_gssapi_data(tvb, n, length-8, pinfo, tree, NULL); break; case PGSQL_AUTH_TYPE_SASL: conv_data->auth_state = PGSQL_AUTH_SASL_REQUESTED; @@ -665,6 +709,8 @@ dissect_pgsql_msg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* dat if (!conn_data) { conn_data = wmem_new(wmem_file_scope(), pgsql_conn_data_t); conn_data->ssl_requested = FALSE; + conn_data->gss_requested = FALSE; + conn_data->last_nongss_frame = G_MAXUINT32; conn_data->auth_state = PGSQL_AUTH_STATE_NONE; conversation_add_proto_data(conversation, proto_pgsql, conn_data); } @@ -703,7 +749,8 @@ dissect_pgsql_msg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* dat case PGSQL_AUTH_SASL_CONTINUE: typestr = "SASLResponse message"; break; - case PGSQL_AUTH_GSSAPI_SSPI_DATA: + case PGSQL_AUTH_GSSAPI: /* fallthrough */ + case PGSQL_AUTH_SSPI: typestr = "GSSResponse message"; break; default: @@ -746,6 +793,18 @@ dissect_pgsql_msg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* dat return tvb_captured_length(tvb); } +static void +dissect_gssenc_msg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gssapi_encrypt_info_t *encrypt) +{ + gint offset = 0, len; + + proto_tree_add_item(tree, hf_gssapi_length, tvb, offset, 4, ENC_BIG_ENDIAN); + offset += 4; + len = tvb_reported_length_remaining(tvb, offset); + + dissect_gssapi_data(tvb, offset, len, pinfo, tree, encrypt); +} + /* This function is called once per TCP packet. It sets COL_PROTOCOL and * identifies FE/BE messages by adding a ">" or "<" to COL_INFO. Then it * arranges for each message to be dissected individually. */ @@ -782,6 +841,43 @@ dissect_pgsql(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data) return tvb_captured_length(tvb); } + if (conn_data && conn_data->gss_requested) { + /* Response to GSS request. */ + switch (tvb_get_guint8(tvb, 0)) { + case 'G': /* Willing to perform GSS encryption */ + /* Next packet will start using GSS encryption. */ + conn_data->last_nongss_frame = pinfo->num; + break; + case 'N': /* Unwilling to perform GSS encryption */ + default: /* ErrorMessage when server does not support SSL. */ + /* TODO: maybe add expert info here? */ + break; + } + conn_data->gss_requested = FALSE; + return tvb_captured_length(tvb); + } + + if (conn_data && (pinfo->num > conn_data->last_nongss_frame)) { + tvbuff_t *subtvb; + gssapi_encrypt_info_t encrypt; + + memset(&encrypt, 0, sizeof(encrypt)); + encrypt.decrypt_gssapi_tvb = DECRYPT_GSSAPI_NORMAL; + + dissect_gssenc_msg(tvb, pinfo, tree, &encrypt); + + if (encrypt.gssapi_decrypted_tvb){ + subtvb = encrypt.gssapi_decrypted_tvb; + tcp_dissect_pdus(subtvb, pinfo, tree, pgsql_desegment, 5, + pgsql_length, dissect_pgsql_msg, data); + } else if (encrypt.gssapi_encrypted_tvb) { + subtvb = encrypt.gssapi_encrypted_tvb; + proto_tree_add_expert(tree, pinfo, &ei_gssapi_decryption_not_possible, subtvb, 0, -1); + } + + return tvb_captured_length(tvb); + } + tcp_dissect_pdus(tvb, pinfo, tree, pgsql_desegment, 5, pgsql_length, dissect_pgsql_msg, data); return tvb_captured_length(tvb); @@ -1021,7 +1117,12 @@ proto_register_pgsql(void) { &hf_routine, { "Routine", "pgsql.routine", FT_STRINGZ, BASE_NONE, NULL, 0, "The routine that reported an error.", HFILL } - } + }, + { &hf_gssapi_length, + { "Length of GSSAPI encrypted data", "pgsql.gss.length", FT_UINT32, BASE_DEC, NULL, 0, + "The length of the GSSAPI encrypted blob.", + HFILL } + }, }; static gint *ett[] = { @@ -1029,9 +1130,18 @@ proto_register_pgsql(void) &ett_values }; + expert_module_t* expert_pgsql; + + static ei_register_info ei[] = { + { &ei_gssapi_decryption_not_possible, { "pgsql.gss.decryption_not_possible", PI_UNDECODED, PI_WARN, "The PGSQL dissector could not decrypt the message.", EXPFILL }}, + }; + proto_pgsql = proto_register_protocol("PostgreSQL", "PGSQL", "pgsql"); proto_register_field_array(proto_pgsql, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + + expert_pgsql = expert_register_protocol(proto_pgsql); + expert_register_field_array(expert_pgsql, ei, array_length(ei)); } void @@ -1042,6 +1152,7 @@ proto_reg_handoff_pgsql(void) dissector_add_uint_with_preference("tcp.port", PGSQL_PORT, pgsql_handle); tls_handle = find_dissector_add_dependency("tls", proto_pgsql); + gssapi_handle = find_dissector_add_dependency("gssapi", proto_pgsql); } /* -- 2.25.1 ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-09-19 17:05 Stephen Frost <[email protected]> parent: Jacob Champion <[email protected]> 0 siblings, 1 reply; 17+ messages in thread From: Stephen Frost @ 2022-09-19 17:05 UTC (permalink / raw) To: Jacob Champion <[email protected]>; +Cc: pgsql-hackers <[email protected]>; Magnus Hagander <[email protected]>; Peter Eisentraut <[email protected]>; Tom Lane <[email protected]>; Robert Haas <[email protected]> Greetings, * Jacob Champion ([email protected]) wrote: > On Thu, Jul 7, 2022 at 4:24 PM Jacob Champion <[email protected]> wrote: > > So my question is this: does substituting my credentials for the admin's > > credentials let me weaken or break the transport encryption on the > > backend connection, and grab the password that I'm not supposed to have > > access to as a front-end client? > > With some further research: yes, it does. > > If a DBA is using a GSS encrypted tunnel to communicate to a foreign > server, accepting delegation by default means that clients will be > able to break that backend encryption at will, because the keys in use > will be under their control. This is coming across as if it's a surprise of some kind when it certainly isn't.. If the delegated credentials are being used to authenticate and establish the connection from that backend to another system then, yes, naturally that means that the keys provided are coming from the client and the client knows them. The idea of arranging to have an admin's credentials used to authenticate to another system where the backend is actually controlled by a non-admin user is, in fact, the issue in what is being outlined above as that's clearly a situation where the user's connection is being elevated to an admin level. That's also something that we try to avoid having happen because it's not really a good idea, which is why we require a password today for the connection to be established (postgres_fdw/connection.c: Non-superuser cannot connect if the server does not request a password. ). Consider that, in general, the user could also simply directly connect to the other system themselves instead of having a PG backend make that connection for them- the point in doing it from PG would be to avoid having to pass all the data back through the client's system. Consider SSH instead of PG. What you're pointing out, accurately, is that if an admin were to install their keys into a user's .ssh directory unencrypted and then the user logged into the system, they'd then be able to SSH to another system with the admin's credentials and then they'd need the admin's credentials to decrypt the traffic, but that if, instead, the user brings their own credentials then they could potentially decrypt the connection between the systems. Is that really the issue here? Doesn't seem like that's where the concern should be in this scenario. > > Maybe there's some ephemeral exchange going on that makes it too hard to > > attack in practice, or some other mitigations. > > There is no forward secrecy, ephemeral exchange, etc. to mitigate this [1]: > > The Kerberos protocol in its basic form does not provide perfect > forward secrecy for communications. If traffic has been recorded by > an eavesdropper, then messages encrypted using the KRB_PRIV message, > or messages encrypted using application-specific encryption under > keys exchanged using Kerberos can be decrypted if the user's, > application server's, or KDC's key is subsequently discovered. > > So the client can decrypt backend communications that make use of its > delegated key material. (This also means that gssencmode is a lot > weaker than I expected.) The backend wouldn't be able to establish the connection in the first place without those delegated credentials. > > I'm trying to avoid writing Wireshark dissector > > code, but maybe that'd be useful either way... > > I did end up filling out the existing PGSQL dissector so that it could > decrypt GSSAPI exchanges (with the use of a keytab, that is). If you'd > like to give it a try, the patch, based on Wireshark 3.7.1, is > attached. Note the GPLv2 license. It isn't correct code yet, because I > didn't understand how packet reassembly worked in Wireshark when I > started writing the code, so really large GSSAPI messages that are > split across multiple TCP packets will confuse the dissector. But it's > enough to prove the concept. > > To see this in action, set up an FDW connection that uses gssencmode > (so the server in the middle will need its own Kerberos credentials). The server in the middle should *not* be using its own Kerberos credentials to establish the connection to the other system- that's elevating the credentials used for that connection and is something that should be prevented for non-superusers already (see above). We do allow that when a superuser is involved because they are considered to essentially have OS-level privileges and therefore could see those credentials anyway, but that's not the case for non-superusers. Thanks, Stephen Attachments: [application/pgp-signature] signature.asc (833B, ../../[email protected]/2-signature.asc) download ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-09-19 21:05 Jacob Champion <[email protected]> parent: Stephen Frost <[email protected]> 0 siblings, 1 reply; 17+ messages in thread From: Jacob Champion @ 2022-09-19 21:05 UTC (permalink / raw) To: Stephen Frost <[email protected]>; +Cc: pgsql-hackers <[email protected]>; Magnus Hagander <[email protected]>; Peter Eisentraut <[email protected]>; Tom Lane <[email protected]>; Robert Haas <[email protected]> On 9/19/22 10:05, Stephen Frost wrote: > This is coming across as if it's a surprise of some kind when it > certainly isn't.. If the delegated credentials are being used to > authenticate and establish the connection from that backend to another > system then, yes, naturally that means that the keys provided are coming > from the client and the client knows them. I think it may be surprising to end users that credential delegation lets them trivially break transport encryption. Like I said before, it was a surprise to me, because the cryptosystems I'm familiar with prevent that. If it wasn't surprising to you, I could really have used a heads up back when I asked you about it. > The idea of arranging to > have an admin's credentials used to authenticate to another system where > the backend is actually controlled by a non-admin user is, in fact, the > issue in what is being outlined above as that's clearly a situation > where the user's connection is being elevated to an admin level. Yes, controlled elevation is the goal in the scenario I'm describing. > That's > also something that we try to avoid having happen because it's not > really a good idea, which is why we require a password today for the > connection to be established (postgres_fdw/connection.c: > > Non-superuser cannot connect if the server does not request a password. A password is being used in this scenario. The password is the secret being stolen. The rest of your email describes a scenario different from what I'm attacking here. Here's my sample HBA line for the backend again: hostgssenc all all ... password I'm using password authentication with a Kerberos-encrypted channel. It's similar to protecting password authentication with TLS and a client cert: hostssl all all ... password clientcert=verify-* > Consider that, in general, the user could also simply directly connect > to the other system themselves No, because they don't have the password. They don't have USAGE on the foreign table, so they can't see the password in the USER MAPPING. With the new default introduced in this patch, they can now steal the password by delegating their credentials and cracking the transport encryption. This bypasses the protections that are documented for the pg_user_mappings view. > Consider SSH instead of PG. What you're pointing out, accurately, is > that if an admin were to install their keys into a user's .ssh directory > unencrypted and then the user logged into the system, they'd then be > able to SSH to another system with the admin's credentials and then > they'd need the admin's credentials to decrypt the traffic, but that if, > instead, the user brings their own credentials then they could > potentially decrypt the connection between the systems. Is that really > the issue here? No, it's not the issue here. This is more like setting up a restricted shell that provides limited access to a resource on another machine (analogous to the foreign table). The user SSHs into this restricted shell, and then invokes an admin-blessed command whose implementation uses some credentials (which they cannot read, analogous to the USER MAPPING) over an encrypted channel to access the backend resource. In this situation an admin would want to ensure that the encrypted tunnel couldn't be weakened by the client, so that they can't learn how to bypass the blessed command and connect to the backend directly. Unlike SSH, we've never supported credential delegation, and now we're introducing it. So my claim is, it's possible for someone who was previously in a secure situation to be broken by the new default. >> So the client can decrypt backend communications that make use of its >> delegated key material. (This also means that gssencmode is a lot >> weaker than I expected.) > > The backend wouldn't be able to establish the connection in the first > place without those delegated credentials. That's not true in the situation I'm describing; hopefully my comments above help clarify. > The server in the middle should *not* be using its own Kerberos > credentials to establish the connection to the other system- that's > elevating the credentials used for that connection and is something that > should be prevented for non-superusers already (see above). It's not prevented, because a password is being used. In my tests I'm connecting as an unprivileged user. You're claiming that the middlebox shouldn't be doing this. If this new default behavior were the historical behavior, then I would have agreed. But the cat's already out of the bag on that, right? It's safe today. And if it's not safe today for some other reason, please share why, and maybe I can work on a patch to try to prevent people from doing it. Thanks, --Jacob ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2022-10-12 05:32 Michael Paquier <[email protected]> parent: Jacob Champion <[email protected]> 0 siblings, 1 reply; 17+ messages in thread From: Michael Paquier @ 2022-10-12 05:32 UTC (permalink / raw) To: Jacob Champion <[email protected]>; +Cc: Stephen Frost <[email protected]>; pgsql-hackers <[email protected]>; Magnus Hagander <[email protected]>; Peter Eisentraut <[email protected]>; Tom Lane <[email protected]>; Robert Haas <[email protected]> On Mon, Sep 19, 2022 at 02:05:39PM -0700, Jacob Champion wrote: > It's not prevented, because a password is being used. In my tests I'm > connecting as an unprivileged user. > > You're claiming that the middlebox shouldn't be doing this. If this new > default behavior were the historical behavior, then I would have agreed. > But the cat's already out of the bag on that, right? It's safe today. > And if it's not safe today for some other reason, please share why, and > maybe I can work on a patch to try to prevent people from doing it. Please note that this has been marked as returned with feedback in the current CF, as this has remained unanswered for a bit more than three weeks. -- Michael Attachments: [application/pgp-signature] signature.asc (833B, ../../[email protected]/2-signature.asc) download ^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Kerberos delegation support in libpq and postgres_fdw @ 2023-02-17 09:27 Stephen Frost <[email protected]> parent: Michael Paquier <[email protected]> 0 siblings, 0 replies; 17+ messages in thread From: Stephen Frost @ 2023-02-17 09:27 UTC (permalink / raw) To: Michael Paquier <[email protected]>; +Cc: Jacob Champion <[email protected]>; pgsql-hackers <[email protected]>; Magnus Hagander <[email protected]>; Peter Eisentraut <[email protected]>; Tom Lane <[email protected]>; Robert Haas <[email protected]> Greetings, * Michael Paquier ([email protected]) wrote: > On Mon, Sep 19, 2022 at 02:05:39PM -0700, Jacob Champion wrote: > > It's not prevented, because a password is being used. In my tests I'm > > connecting as an unprivileged user. > > > > You're claiming that the middlebox shouldn't be doing this. If this new > > default behavior were the historical behavior, then I would have agreed. > > But the cat's already out of the bag on that, right? It's safe today. > > And if it's not safe today for some other reason, please share why, and > > maybe I can work on a patch to try to prevent people from doing it. > > Please note that this has been marked as returned with feedback in the > current CF, as this has remained unanswered for a bit more than three > weeks. There's some ongoing discussion about how to handle outbound connections from the server ending up picking up credentials from the server's environment (that really shouldn't be allowed unless specifically asked for..), that's ultimately an independent change from what this patch is doing. Here's an updated version which does address Robert's concerns around having this disabled by default and having options on both the server and client side saying if it is to be enabled or not. Also added to pg_stat_gssapi a field that indicates if credentials were proxied or not and made some other improvements and added additional regression tests to test out various combinations. Thanks, Stephen Attachments: [text/x-diff] gss_delegation_v2.patch (49.1K, ../../[email protected]/2-gss_delegation_v2.patch) download | inline diff: diff --git a/contrib/dblink/dblink.c b/contrib/dblink/dblink.c index 78a8bcee6e..713ef7c248 100644 --- a/contrib/dblink/dblink.c +++ b/contrib/dblink/dblink.c @@ -2589,7 +2589,7 @@ dblink_security_check(PGconn *conn, remoteConn *rconn) { if (!superuser()) { - if (!PQconnectionUsedPassword(conn)) + if (!(PQconnectionUsedPassword(conn) || PQconnectionUsedGSSAPI(conn))) { libpqsrv_disconnect(conn); if (rconn) @@ -2597,8 +2597,8 @@ dblink_security_check(PGconn *conn, remoteConn *rconn) ereport(ERROR, (errcode(ERRCODE_S_R_E_PROHIBITED_SQL_STATEMENT_ATTEMPTED), - errmsg("password is required"), - errdetail("Non-superuser cannot connect if the server does not request a password."), + errmsg("password or GSSAPI is required"), + errdetail("Non-superuser cannot connect if the server does not request a password or use GSSAPI."), errhint("Target server's authentication method must be changed."))); } } diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out index d5fc61446a..77656ccf80 100644 --- a/contrib/postgres_fdw/expected/postgres_fdw.out +++ b/contrib/postgres_fdw/expected/postgres_fdw.out @@ -171,7 +171,8 @@ ALTER SERVER testserver1 OPTIONS ( sslcrl 'value', --requirepeer 'value', krbsrvname 'value', - gsslib 'value' + gsslib 'value', + gssdeleg 'value' --replication 'value' ); -- Error, invalid list syntax diff --git a/contrib/postgres_fdw/option.c b/contrib/postgres_fdw/option.c index 984e4d168a..bb6f309907 100644 --- a/contrib/postgres_fdw/option.c +++ b/contrib/postgres_fdw/option.c @@ -286,6 +286,9 @@ InitPgFdwOptions(void) {"sslcert", UserMappingRelationId, true}, {"sslkey", UserMappingRelationId, true}, + /* gssencmode is also libpq option, same to above. */ + {"gssencmode", UserMappingRelationId, true}, + {NULL, InvalidOid, false} }; diff --git a/contrib/postgres_fdw/sql/postgres_fdw.sql b/contrib/postgres_fdw/sql/postgres_fdw.sql index 1e50be137b..1a43bdf55b 100644 --- a/contrib/postgres_fdw/sql/postgres_fdw.sql +++ b/contrib/postgres_fdw/sql/postgres_fdw.sql @@ -185,7 +185,8 @@ ALTER SERVER testserver1 OPTIONS ( sslcrl 'value', --requirepeer 'value', krbsrvname 'value', - gsslib 'value' + gsslib 'value', + gssdeleg 'value' --replication 'value' ); diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index ecd9aa73ef..a931996968 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1170,6 +1170,23 @@ include_dir 'conf.d' </listitem> </varlistentry> + <varlistentry id="guc-gss-accept-deleg" xreflabel="gss_accept_deleg"> + <term><varname>gss_accept_deleg</varname> (<type>boolean</type>) + <indexterm> + <primary><varname>gss_accept_deleg</varname> configuration parameter</primary> + </indexterm> + </term> + <listitem> + <para> + Sets whether GSSAPI delegation should be accepted from the client. + The default is <literal>off</literal> meaning credentials from the client will + NOT be accepted. Changing this to <literal>on</literal> will make the server + accept credentials delegated to it from the client. This parameter can only be + set in the <filename>postgresql.conf</filename> file or on the server command line. + </para> + </listitem> + </varlistentry> + <varlistentry id="guc-db-user-namespace" xreflabel="db_user_namespace"> <term><varname>db_user_namespace</varname> (<type>boolean</type>) <indexterm> diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index 0e7ae70c70..9f3e12b2a7 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -1879,6 +1879,18 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname </listitem> </varlistentry> + <varlistentry id="libpq-connect-gssdeleg" xreflabel="gssdeleg"> + <term><literal>gssdeleg</literal></term> + <listitem> + <para> + Forward (delegate) GSS credentials to the server. The default is + <literal>disable</literal> which means credentials will not be forwarded + to the server. Set this to <literal>enable</literal> to have + credentials forwarded when possible. + </para> + </listitem> + </varlistentry> + <varlistentry id="libpq-connect-service" xreflabel="service"> <term><literal>service</literal></term> <listitem> @@ -2479,6 +2491,25 @@ int PQconnectionUsedPassword(const PGconn *conn); </para> </listitem> </varlistentry> + + <varlistentry id="libpq-PQconnectionUsedGSSAPI"> + <term><function>PQconnectionUsedGSSAPI</function><indexterm><primary>PQconnectionUsedGSSAPI</primary></indexterm></term> + <listitem> + <para> + Returns true (1) if the connection authentication method + used GSSAPI. Returns false (0) if not. + +<synopsis> +int PQconnectionUsedGSSAPI(const PGconn *conn); +</synopsis> + </para> + + <para> + This function can be applied to detect whether the connection was + authenticated with GSSAPI. + </para> + </listitem> + </varlistentry> </variablelist> </para> @@ -7981,6 +8012,16 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough) </para> </listitem> + <listitem> + <para> + <indexterm> + <primary><envar>PGGSSDELEG</envar></primary> + </indexterm> + <envar>PGGSSDELEG</envar> behaves the same as the <xref + linkend="libpq-connect-gssdeleg"/> connection parameter. + </para> + </listitem> + <listitem> <para> <indexterm> diff --git a/doc/src/sgml/monitoring.sgml b/doc/src/sgml/monitoring.sgml index b0b997f092..48cc5608b6 100644 --- a/doc/src/sgml/monitoring.sgml +++ b/doc/src/sgml/monitoring.sgml @@ -3573,6 +3573,15 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i True if GSSAPI encryption is in use on this connection </para></entry> </row> + + <row> + <entry role="catalog_table_entry"><para role="column_definition"> + <structfield>credentials_proxied</structfield> <type>boolean</type> + </para> + <para> + True if GSSAPI credentials were forwarded/proxied on this connection. + </para></entry> + </row> </tbody> </tgroup> </table> diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql index 34ca0e739f..1843de1c77 100644 --- a/src/backend/catalog/system_views.sql +++ b/src/backend/catalog/system_views.sql @@ -977,7 +977,8 @@ CREATE VIEW pg_stat_gssapi AS S.pid, S.gss_auth AS gss_authenticated, S.gss_princ AS principal, - S.gss_enc AS encrypted + S.gss_enc AS encrypted, + S.gss_proxy AS credentials_proxied FROM pg_stat_get_activity(NULL) AS S WHERE S.client_port IS NOT NULL; diff --git a/src/backend/foreign/foreign.c b/src/backend/foreign/foreign.c index dca02271dc..6e1977fa62 100644 --- a/src/backend/foreign/foreign.c +++ b/src/backend/foreign/foreign.c @@ -574,6 +574,7 @@ static const struct ConnectionOption libpq_conninfo_options[] = { {"requiressl", ForeignServerRelationId}, {"sslmode", ForeignServerRelationId}, {"gsslib", ForeignServerRelationId}, + {"gssdeleg", ForeignServerRelationId}, {NULL, InvalidOid} }; diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index 25b3a781cd..963bc26b97 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -161,6 +161,7 @@ static int CheckCertAuth(Port *port); */ char *pg_krb_server_keyfile; bool pg_krb_caseins_users; +bool pg_gss_accept_deleg; /*---------------------------------------------------------------- @@ -914,6 +915,7 @@ pg_GSS_recvauth(Port *port) int mtype; StringInfoData buf; gss_buffer_desc gbuf; + gss_cred_id_t proxy; /* * Use the configured keytab, if there is one. Unfortunately, Heimdal @@ -943,6 +945,9 @@ pg_GSS_recvauth(Port *port) */ port->gss->ctx = GSS_C_NO_CONTEXT; + proxy = NULL; + port->gss->proxy_creds = false; + /* * Loop through GSSAPI message exchange. This exchange can consist of * multiple messages sent in both directions. First message is always from @@ -993,7 +998,7 @@ pg_GSS_recvauth(Port *port) &port->gss->outbuf, &gflags, NULL, - NULL); + pg_gss_accept_deleg ? &proxy : NULL); /* gbuf no longer used */ pfree(buf.data); @@ -1005,6 +1010,12 @@ pg_GSS_recvauth(Port *port) CHECK_FOR_INTERRUPTS(); + if (proxy != NULL) + { + pg_store_proxy_credential(proxy); + port->gss->proxy_creds = true; + } + if (port->gss->outbuf.length != 0) { /* diff --git a/src/backend/libpq/be-gssapi-common.c b/src/backend/libpq/be-gssapi-common.c index fb39c760d8..d5a9926d5c 100644 --- a/src/backend/libpq/be-gssapi-common.c +++ b/src/backend/libpq/be-gssapi-common.c @@ -92,3 +92,54 @@ pg_GSS_error(const char *errmsg, (errmsg_internal("%s", errmsg), errdetail_internal("%s: %s", msg_major, msg_minor))); } + +/* + * Store the credentials passed in into the memory cache for later usage. + * + * This allows credentials to be delegated to us for us to use to connect + * to other systems with, using, e.g. postgres_fdw or dblink. + */ +#define GSS_MEMORY_CACHE "MEMORY:" +void +pg_store_proxy_credential(gss_cred_id_t cred) +{ + OM_uint32 major, minor; + gss_OID_set mech; + gss_cred_usage_t usage; + gss_key_value_element_desc cc; + gss_key_value_set_desc ccset; + + cc.key = "ccache"; + cc.value = GSS_MEMORY_CACHE; + ccset.count = 1; + ccset.elements = &cc; + + /* Make the proxy credential only available to current process */ + major = gss_store_cred_into(&minor, + cred, + GSS_C_INITIATE, /* credential only used for starting libpq connection */ + GSS_C_NULL_OID, /* store all */ + true, /* overwrite */ + true, /* make default */ + &ccset, + &mech, + &usage); + + if (major != GSS_S_COMPLETE) + { + pg_GSS_error("gss_store_cred", major, minor); + } + + /* Credential stored, so we can release our credential handle. */ + major = gss_release_cred(&minor, &cred); + if (major != GSS_S_COMPLETE) + { + pg_GSS_error("gss_release_cred", major, minor); + } + + /* + * Set KRB5CCNAME for this backend, so that later calls to gss_acquire_cred + * will find the proxied credentials we stored. + */ + setenv("KRB5CCNAME", GSS_MEMORY_CACHE, 1); +} diff --git a/src/backend/libpq/be-secure-gssapi.c b/src/backend/libpq/be-secure-gssapi.c index 3b55f43199..9ff91534e1 100644 --- a/src/backend/libpq/be-secure-gssapi.c +++ b/src/backend/libpq/be-secure-gssapi.c @@ -497,6 +497,7 @@ secure_open_gssapi(Port *port) bool complete_next = false; OM_uint32 major, minor; + gss_cred_id_t proxy; /* * Allocate subsidiary Port data for GSSAPI operations. @@ -504,6 +505,9 @@ secure_open_gssapi(Port *port) port->gss = (pg_gssinfo *) MemoryContextAllocZero(TopMemoryContext, sizeof(pg_gssinfo)); + proxy = NULL; + port->gss->proxy_creds = false; + /* * Allocate buffers and initialize state variables. By malloc'ing the * buffers at this point, we avoid wasting static data space in processes @@ -588,7 +592,8 @@ secure_open_gssapi(Port *port) GSS_C_NO_CREDENTIAL, &input, GSS_C_NO_CHANNEL_BINDINGS, &port->gss->name, NULL, &output, NULL, - NULL, NULL); + NULL, pg_gss_accept_deleg ? &proxy : NULL); + if (GSS_ERROR(major)) { pg_GSS_error(_("could not accept GSSAPI security context"), @@ -605,6 +610,12 @@ secure_open_gssapi(Port *port) complete_next = true; } + if (proxy != NULL) + { + pg_store_proxy_credential(proxy); + port->gss->proxy_creds = true; + } + /* Done handling the incoming packet, reset our buffer */ PqGSSRecvLength = 0; @@ -731,3 +742,16 @@ be_gssapi_get_princ(Port *port) return port->gss->princ; } + +/* + * Return if GSSAPI delegated/proxy credentials were included on this + * connection. + */ +bool +be_gssapi_get_proxy(Port *port) +{ + if (!port || !port->gss) + return NULL; + + return port->gss->proxy_creds; +} diff --git a/src/backend/utils/activity/backend_status.c b/src/backend/utils/activity/backend_status.c index 608d01ea0d..778d5769fd 100644 --- a/src/backend/utils/activity/backend_status.c +++ b/src/backend/utils/activity/backend_status.c @@ -384,6 +384,7 @@ pgstat_bestart(void) lbeentry.st_gss = true; lgssstatus.gss_auth = be_gssapi_get_auth(MyProcPort); lgssstatus.gss_enc = be_gssapi_get_enc(MyProcPort); + lgssstatus.gss_proxy = be_gssapi_get_proxy(MyProcPort); if (princ) strlcpy(lgssstatus.gss_princ, princ, NAMEDATALEN); } diff --git a/src/backend/utils/adt/pgstatfuncs.c b/src/backend/utils/adt/pgstatfuncs.c index 9d707c3521..cf774a6848 100644 --- a/src/backend/utils/adt/pgstatfuncs.c +++ b/src/backend/utils/adt/pgstatfuncs.c @@ -303,7 +303,7 @@ pg_stat_get_progress_info(PG_FUNCTION_ARGS) Datum pg_stat_get_activity(PG_FUNCTION_ARGS) { -#define PG_STAT_GET_ACTIVITY_COLS 30 +#define PG_STAT_GET_ACTIVITY_COLS 31 int num_backends = pgstat_fetch_stat_numbackends(); int curr_backend; int pid = PG_ARGISNULL(0) ? -1 : PG_GETARG_INT32(0); @@ -395,7 +395,7 @@ pg_stat_get_activity(PG_FUNCTION_ARGS) pfree(clipped_activity); /* leader_pid */ - nulls[28] = true; + nulls[29] = true; proc = BackendPidGetProc(beentry->st_procpid); @@ -432,8 +432,8 @@ pg_stat_get_activity(PG_FUNCTION_ARGS) */ if (leader && leader->pid != beentry->st_procpid) { - values[28] = Int32GetDatum(leader->pid); - nulls[28] = false; + values[29] = Int32GetDatum(leader->pid); + nulls[29] = false; } else if (beentry->st_backendType == B_BG_WORKER) { @@ -441,8 +441,8 @@ pg_stat_get_activity(PG_FUNCTION_ARGS) if (leader_pid != InvalidPid) { - values[28] = Int32GetDatum(leader_pid); - nulls[28] = false; + values[29] = Int32GetDatum(leader_pid); + nulls[29] = false; } } } @@ -600,6 +600,7 @@ pg_stat_get_activity(PG_FUNCTION_ARGS) values[25] = BoolGetDatum(beentry->st_gssstatus->gss_auth); /* gss_auth */ values[26] = CStringGetTextDatum(beentry->st_gssstatus->gss_princ); values[27] = BoolGetDatum(beentry->st_gssstatus->gss_enc); /* GSS Encryption in use */ + values[28] = BoolGetDatum(beentry->st_gssstatus->gss_proxy); /* GSS credentials proxied */ } else { @@ -607,11 +608,13 @@ pg_stat_get_activity(PG_FUNCTION_ARGS) nulls[26] = true; /* No GSS principal */ values[27] = BoolGetDatum(false); /* GSS Encryption not in * use */ + values[28] = BoolGetDatum(false); /* GSS credentials not + * proxied */ } if (beentry->st_query_id == 0) - nulls[29] = true; + nulls[30] = true; else - values[29] = UInt64GetDatum(beentry->st_query_id); + values[30] = UInt64GetDatum(beentry->st_query_id); } else { @@ -640,6 +643,7 @@ pg_stat_get_activity(PG_FUNCTION_ARGS) nulls[27] = true; nulls[28] = true; nulls[29] = true; + nulls[30] = true; } tuplestore_putvalues(rsinfo->setResult, rsinfo->setDesc, values, nulls); diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c index 2f07ca7a0e..c872512bbc 100644 --- a/src/backend/utils/init/postinit.c +++ b/src/backend/utils/init/postinit.c @@ -282,15 +282,17 @@ PerformAuthentication(Port *port) if (princ) appendStringInfo(&logmsg, - _(" GSS (authenticated=%s, encrypted=%s, principal=%s)"), + _(" GSS (authenticated=%s, encrypted=%s, proxy_credentials=%s, principal=%s)"), be_gssapi_get_auth(port) ? _("yes") : _("no"), be_gssapi_get_enc(port) ? _("yes") : _("no"), + be_gssapi_get_proxy(port) ? _("yes") : _("no"), princ); else appendStringInfo(&logmsg, - _(" GSS (authenticated=%s, encrypted=%s)"), + _(" GSS (authenticated=%s, encrypted=%s, proxy_credentials=%s)"), be_gssapi_get_auth(port) ? _("yes") : _("no"), - be_gssapi_get_enc(port) ? _("yes") : _("no")); + be_gssapi_get_enc(port) ? _("yes") : _("no"), + be_gssapi_get_proxy(port) ? _("yes") : _("no")); } #endif diff --git a/src/backend/utils/misc/guc_tables.c b/src/backend/utils/misc/guc_tables.c index 1c0583fe26..6d7d5908ef 100644 --- a/src/backend/utils/misc/guc_tables.c +++ b/src/backend/utils/misc/guc_tables.c @@ -1708,6 +1708,16 @@ struct config_bool ConfigureNamesBool[] = NULL, NULL, NULL }, + { + {"gss_accept_deleg", PGC_SIGHUP, CONN_AUTH_AUTH, + gettext_noop("Sets whether GSSAPI delegation should be accepted from the client."), + NULL + }, + &pg_gss_accept_deleg, + false, + NULL, NULL, NULL + }, + { {"escape_string_warning", PGC_USERSET, COMPAT_OPTIONS_PREVIOUS, gettext_noop("Warn about backslash escapes in ordinary string literals."), diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index d06074b86f..7d26d58de3 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -100,6 +100,7 @@ # GSSAPI using Kerberos #krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab' #krb_caseins_users = off +#gss_accept_deleg = off # - SSL - diff --git a/src/include/catalog/pg_proc.dat b/src/include/catalog/pg_proc.dat index 66b73c3900..44f05cfac0 100644 --- a/src/include/catalog/pg_proc.dat +++ b/src/include/catalog/pg_proc.dat @@ -5404,9 +5404,9 @@ proname => 'pg_stat_get_activity', prorows => '100', proisstrict => 'f', proretset => 't', provolatile => 's', proparallel => 'r', prorettype => 'record', proargtypes => 'int4', - proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,text,numeric,text,bool,text,bool,int4,int8}', - proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}', - proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,ssl_client_dn,ssl_client_serial,ssl_issuer_dn,gss_auth,gss_princ,gss_enc,leader_pid,query_id}', + proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,text,numeric,text,bool,text,bool,bool,int4,int8}', + proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}', + proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,ssl_client_dn,ssl_client_serial,ssl_issuer_dn,gss_auth,gss_princ,gss_enc,gss_proxy,leader_pid,query_id}', prosrc => 'pg_stat_get_activity' }, { oid => '3318', descr => 'statistics: information about progress of backends running maintenance command', diff --git a/src/include/libpq/auth.h b/src/include/libpq/auth.h index 137bee7c45..9105d6757d 100644 --- a/src/include/libpq/auth.h +++ b/src/include/libpq/auth.h @@ -18,6 +18,7 @@ extern PGDLLIMPORT char *pg_krb_server_keyfile; extern PGDLLIMPORT bool pg_krb_caseins_users; +extern PGDLLIMPORT bool pg_gss_accept_deleg; extern PGDLLIMPORT char *pg_krb_realm; extern void ClientAuthentication(Port *port); diff --git a/src/include/libpq/be-gssapi-common.h b/src/include/libpq/be-gssapi-common.h index facd24ff7f..841facde12 100644 --- a/src/include/libpq/be-gssapi-common.h +++ b/src/include/libpq/be-gssapi-common.h @@ -18,13 +18,16 @@ #if defined(HAVE_GSSAPI_H) #include <gssapi.h> +#include <gssapi_ext.h> #else #include <gssapi/gssapi.h> +#include <gssapi/gssapi_ext.h> #endif extern void pg_GSS_error(const char *errmsg, OM_uint32 maj_stat, OM_uint32 min_stat); +extern void pg_store_proxy_credential(gss_cred_id_t cred); #endif /* ENABLE_GSS */ #endif /* BE_GSSAPI_COMMON_H */ diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h index ac6407e9f6..4d6a8c31cb 100644 --- a/src/include/libpq/libpq-be.h +++ b/src/include/libpq/libpq-be.h @@ -84,6 +84,7 @@ typedef struct * GSSAPI auth was not used */ bool auth; /* GSSAPI Authentication used */ bool enc; /* GSSAPI encryption in use */ + bool proxy_creds; /* GSSAPI Delegated/proxy credentials */ #endif } pg_gssinfo; #endif @@ -328,6 +329,7 @@ extern PGDLLIMPORT openssl_tls_init_hook_typ openssl_tls_init_hook; extern bool be_gssapi_get_auth(Port *port); extern bool be_gssapi_get_enc(Port *port); extern const char *be_gssapi_get_princ(Port *port); +extern bool be_gssapi_get_proxy(Port *port); /* Read and write to a GSSAPI-encrypted connection. */ extern ssize_t be_gssapi_read(Port *port, void *ptr, size_t len); diff --git a/src/include/utils/backend_status.h b/src/include/utils/backend_status.h index f7bd83113a..0e680f0332 100644 --- a/src/include/utils/backend_status.h +++ b/src/include/utils/backend_status.h @@ -77,6 +77,7 @@ typedef struct PgBackendGSSStatus char gss_princ[NAMEDATALEN]; /* GSSAPI Principal used to auth */ bool gss_auth; /* If GSSAPI authentication was used */ bool gss_enc; /* If encryption is being used */ + bool gss_proxy; /* If credentials proxied */ } PgBackendGSSStatus; diff --git a/src/interfaces/libpq/exports.txt b/src/interfaces/libpq/exports.txt index e8bcc88370..7ded77aff3 100644 --- a/src/interfaces/libpq/exports.txt +++ b/src/interfaces/libpq/exports.txt @@ -186,3 +186,4 @@ PQpipelineStatus 183 PQsetTraceFlags 184 PQmblenBounded 185 PQsendFlushRequest 186 +PQconnectionUsedGSSAPI 187 diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c index 9afc6f19b9..a518378915 100644 --- a/src/interfaces/libpq/fe-auth.c +++ b/src/interfaces/libpq/fe-auth.c @@ -58,9 +58,11 @@ pg_GSS_continue(PGconn *conn, int payloadlen) { OM_uint32 maj_stat, min_stat, - lmin_s; + lmin_s, + gss_flags = GSS_C_MUTUAL_FLAG; gss_buffer_desc ginbuf; gss_buffer_desc goutbuf; + gss_cred_id_t proxy = GSS_C_NO_CREDENTIAL; /* * On first call, there's no input token. On subsequent calls, read the @@ -92,12 +94,19 @@ pg_GSS_continue(PGconn *conn, int payloadlen) ginbuf.value = NULL; } + /* Only try to acquire credentials if GSS delegation isn't disabled. */ + if (!pg_GSS_have_cred_cache(&proxy)) + proxy = GSS_C_NO_CREDENTIAL; + + if (conn->gssdeleg && pg_strcasecmp(conn->gssdeleg,"enable") == 0) + gss_flags |= GSS_C_DELEG_FLAG; + maj_stat = gss_init_sec_context(&min_stat, - GSS_C_NO_CREDENTIAL, + proxy, &conn->gctx, conn->gtarg_nam, GSS_C_NO_OID, - GSS_C_MUTUAL_FLAG, + gss_flags, 0, GSS_C_NO_CHANNEL_BINDINGS, (ginbuf.value == NULL) ? GSS_C_NO_BUFFER : &ginbuf, @@ -136,7 +145,10 @@ pg_GSS_continue(PGconn *conn, int payloadlen) } if (maj_stat == GSS_S_COMPLETE) + { gss_release_name(&lmin_s, &conn->gtarg_nam); + conn->gssapi_used = true; + } return STATUS_OK; } diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c index 50b5df3490..69c7e1346a 100644 --- a/src/interfaces/libpq/fe-connect.c +++ b/src/interfaces/libpq/fe-connect.c @@ -332,6 +332,10 @@ static const internalPQconninfoOption PQconninfoOptions[] = { "GSS-library", "", 7, /* sizeof("gssapi") == 7 */ offsetof(struct pg_conn, gsslib)}, + {"gssdeleg", "PGGSSDELEG", NULL, NULL, + "GSS-delegation", "", 8, /* sizeof("disable") == 8 */ + offsetof(struct pg_conn, gssdeleg)}, + {"replication", NULL, NULL, NULL, "Replication", "D", 5, offsetof(struct pg_conn, replication)}, @@ -596,6 +600,7 @@ pqDropServerData(PGconn *conn) conn->last_sqlstate[0] = '\0'; conn->auth_req_received = false; conn->password_needed = false; + conn->gssapi_used = false; conn->write_failed = false; free(conn->write_err_msg); conn->write_err_msg = NULL; @@ -4028,6 +4033,7 @@ freePGconn(PGconn *conn) free(conn->gssencmode); free(conn->krbsrvname); free(conn->gsslib); + free(conn->gssdeleg); free(conn->connip); /* Note that conn->Pfdebug is not ours to close or free */ free(conn->write_err_msg); @@ -6816,6 +6822,17 @@ PQconnectionUsedPassword(const PGconn *conn) return false; } +int +PQconnectionUsedGSSAPI(const PGconn *conn) +{ + if (!conn) + return false; + if (conn->gssapi_used) + return true; + else + return false; +} + int PQclientEncoding(const PGconn *conn) { diff --git a/src/interfaces/libpq/fe-secure-gssapi.c b/src/interfaces/libpq/fe-secure-gssapi.c index 038e847b7e..372bfdd21e 100644 --- a/src/interfaces/libpq/fe-secure-gssapi.c +++ b/src/interfaces/libpq/fe-secure-gssapi.c @@ -477,11 +477,13 @@ pqsecure_open_gss(PGconn *conn) { ssize_t ret; OM_uint32 major, - minor; + minor, + gss_flags = GSS_REQUIRED_FLAGS; uint32 netlen; PostgresPollingStatusType result; gss_buffer_desc input = GSS_C_EMPTY_BUFFER, output = GSS_C_EMPTY_BUFFER; + static gss_cred_id_t proxy = GSS_C_NO_CREDENTIAL; /* * If first time through for this connection, allocate buffers and @@ -621,13 +623,30 @@ pqsecure_open_gss(PGconn *conn) if (ret != STATUS_OK) return PGRES_POLLING_FAILED; + if (conn->gssdeleg && pg_strcasecmp(conn->gssdeleg,"enable") == 0) + { + /* Acquire credentials if possbile */ + if (proxy == GSS_C_NO_CREDENTIAL) + (void) pg_GSS_have_cred_cache(&proxy); + + /* + * We have credentials and gssdeleg is enabled, so request + * credential delegation. This may or may not actually result in + * credentials being delegated- it depends on if the forwardable + * flag has been set in the credential and if the server is + * configured to accept delegated credentials. + */ + if (proxy != GSS_C_NO_CREDENTIAL) + gss_flags |= GSS_C_DELEG_FLAG; + } + /* * Call GSS init context, either with an empty input, or with a complete * packet from the server. */ - major = gss_init_sec_context(&minor, conn->gcred, &conn->gctx, + major = gss_init_sec_context(&minor, proxy, &conn->gctx, conn->gtarg_nam, GSS_C_NO_OID, - GSS_REQUIRED_FLAGS, 0, 0, &input, NULL, + gss_flags, 0, 0, &input, NULL, &output, NULL, NULL); /* GSS Init Sec Context uses the whole packet, so clear it */ @@ -647,6 +666,7 @@ pqsecure_open_gss(PGconn *conn) * to do GSS wrapping/unwrapping. */ conn->gssenc = true; + conn->gssapi_used = true; /* Clean up */ gss_release_cred(&minor, &conn->gcred); diff --git a/src/interfaces/libpq/libpq-fe.h b/src/interfaces/libpq/libpq-fe.h index f3d9220496..7476dbe0e9 100644 --- a/src/interfaces/libpq/libpq-fe.h +++ b/src/interfaces/libpq/libpq-fe.h @@ -354,6 +354,7 @@ extern int PQbackendPID(const PGconn *conn); extern PGpipelineStatus PQpipelineStatus(const PGconn *conn); extern int PQconnectionNeedsPassword(const PGconn *conn); extern int PQconnectionUsedPassword(const PGconn *conn); +extern int PQconnectionUsedGSSAPI(const PGconn *conn); extern int PQclientEncoding(const PGconn *conn); extern int PQsetClientEncoding(PGconn *conn, const char *encoding); diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h index d7ec5ed429..4828917d38 100644 --- a/src/interfaces/libpq/libpq-int.h +++ b/src/interfaces/libpq/libpq-int.h @@ -393,6 +393,7 @@ struct pg_conn char *krbsrvname; /* Kerberos service name */ char *gsslib; /* What GSS library to use ("gssapi" or * "sspi") */ + char *gssdeleg; /* Try to delegate GSS credentials? */ char *ssl_min_protocol_version; /* minimum TLS protocol version */ char *ssl_max_protocol_version; /* maximum TLS protocol version */ char *target_session_attrs; /* desired session properties */ @@ -452,6 +453,7 @@ struct pg_conn int sversion; /* server version, e.g. 70401 for 7.4.1 */ bool auth_req_received; /* true if any type of auth req received */ bool password_needed; /* true if server demanded a password */ + bool gssapi_used; /* true if authenticated via gssapi */ bool sigpipe_so; /* have we masked SIGPIPE via SO_NOSIGPIPE? */ bool sigpipe_flag; /* can we mask SIGPIPE via MSG_NOSIGNAL? */ bool write_failed; /* have we had a write failure on sock? */ diff --git a/src/test/kerberos/Makefile b/src/test/kerberos/Makefile index 7765f3f93b..f460d2c0e7 100644 --- a/src/test/kerberos/Makefile +++ b/src/test/kerberos/Makefile @@ -13,6 +13,9 @@ subdir = src/test/kerberos top_builddir = ../../.. include $(top_builddir)/src/Makefile.global +EXTRA_INSTALL += contrib/postgres_fdw +EXTRA_INSTALL += contrib/dblink + export with_gssapi with_krb_srvnam check: diff --git a/src/test/kerberos/t/001_auth.pl b/src/test/kerberos/t/001_auth.pl index d610ce63ab..6e76ef6373 100644 --- a/src/test/kerberos/t/001_auth.pl +++ b/src/test/kerberos/t/001_auth.pl @@ -56,6 +56,7 @@ elsif ($^O eq 'linux') my $krb5_config = 'krb5-config'; my $kinit = 'kinit'; +my $klist = 'klist'; my $kdb5_util = 'kdb5_util'; my $kadmin_local = 'kadmin.local'; my $krb5kdc = 'krb5kdc'; @@ -64,6 +65,7 @@ if ($krb5_bin_dir && -d $krb5_bin_dir) { $krb5_config = $krb5_bin_dir . '/' . $krb5_config; $kinit = $krb5_bin_dir . '/' . $kinit; + $klist = $krb5_bin_dir . '/' . $klist; } if ($krb5_sbin_dir && -d $krb5_sbin_dir) { @@ -108,6 +110,7 @@ kdc = FILE:$kdc_log [libdefaults] default_realm = $realm +forwardable = false [realms] $realm = { @@ -185,7 +188,21 @@ lc_messages = 'C' }); $node->start; +my $port = $node->port(); + $node->safe_psql('postgres', 'CREATE USER test1;'); +$node->safe_psql('postgres', 'CREATE EXTENSION postgres_fdw;'); +$node->safe_psql('postgres', 'CREATE EXTENSION dblink;'); +$node->safe_psql('postgres', "CREATE SERVER s1 FOREIGN DATA WRAPPER postgres_fdw OPTIONS (host '$host', hostaddr '$hostaddr', port '$port', dbname 'postgres');"); + +$node->safe_psql('postgres', 'GRANT USAGE ON FOREIGN SERVER s1 TO test1;'); + +$node->safe_psql('postgres', "CREATE USER MAPPING FOR test1 SERVER s1 OPTIONS (user 'test1', password_required 'false');"); +$node->safe_psql('postgres', "CREATE TABLE t1 (c1 int);"); +$node->safe_psql('postgres', "INSERT INTO t1 VALUES (1);"); +$node->safe_psql('postgres', "CREATE FOREIGN TABLE tf1 (c1 int) SERVER s1 OPTIONS (schema_name 'public', table_name 't1');"); +$node->safe_psql('postgres', "GRANT SELECT ON t1 TO test1;"); +$node->safe_psql('postgres', "GRANT SELECT ON tf1 TO test1;"); # Set up a table for SYSTEM_USER parallel worker testing. $node->safe_psql('postgres', @@ -258,6 +275,7 @@ $node->restart; test_access($node, 'test1', 'SELECT true', 2, '', 'fails without ticket'); run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?); +run_log [ $klist, '-f' ] or BAIL_OUT($?); test_access( $node, @@ -275,34 +293,56 @@ $node->restart; test_access( $node, 'test1', - 'SELECT gss_authenticated AND encrypted from pg_stat_gssapi where pid = pg_backend_pid();', + 'SELECT gss_authenticated AND encrypted AND NOT credentials_proxied FROM pg_stat_gssapi WHERE pid = pg_backend_pid();', 0, '', - 'succeeds with mapping with default gssencmode and host hba', + 'succeeds with mapping with default gssencmode and host hba, ticket not forwardable', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access( $node, 'test1', - 'SELECT gss_authenticated AND encrypted from pg_stat_gssapi where pid = pg_backend_pid();', + 'SELECT gss_authenticated AND encrypted AND NOT credentials_proxied FROM pg_stat_gssapi WHERE pid = pg_backend_pid();', 0, 'gssencmode=prefer', - 'succeeds with GSS-encrypted access preferred with host hba', + 'succeeds with GSS-encrypted access preferred with host hba, ticket not forwardable', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access( $node, 'test1', - 'SELECT gss_authenticated AND encrypted from pg_stat_gssapi where pid = pg_backend_pid();', + 'SELECT gss_authenticated AND encrypted AND NOT credentials_proxied FROM pg_stat_gssapi WHERE pid = pg_backend_pid();', 0, 'gssencmode=require', - 'succeeds with GSS-encrypted access required with host hba', + 'succeeds with GSS-encrypted access required with host hba, ticket not forwardable', + "connection authenticated: identity=\"test1\@$realm\" method=gss", + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" +); + +test_access( + $node, + 'test1', + 'SELECT gss_authenticated AND encrypted AND NOT credentials_proxied FROM pg_stat_gssapi WHERE pid = pg_backend_pid();', + 0, + 'gssencmode=prefer gssdeleg=enable', + 'succeeds with GSS-encrypted access preferred with host hba and credentials not delegated even though asked for (ticket not forwardable)', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); +test_access( + $node, + 'test1', + 'SELECT gss_authenticated AND encrypted AND NOT credentials_proxied FROM pg_stat_gssapi WHERE pid = pg_backend_pid();', + 0, + 'gssencmode=require gssdeleg=enable', + 'succeeds with GSS-encrypted access required with host hba and credentials not delegated even though asked for (ticket not forwardable)', + "connection authenticated: identity=\"test1\@$realm\" method=gss", + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" +); + # Test that we can transport a reasonable amount of data. test_query( @@ -345,27 +385,101 @@ test_query( unlink($node->data_dir . '/pg_hba.conf'); $node->append_conf('pg_hba.conf', qq{hostgssenc all all $hostaddr/32 gss map=mymap}); + +string_replace_file($krb5_conf, "forwardable = false", "forwardable = true"); + +run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?); +run_log [ $klist, '-f' ] or BAIL_OUT($?); + +test_access( + $node, + 'test1', + 'SELECT gss_authenticated AND encrypted AND NOT credentials_proxied from pg_stat_gssapi where pid = pg_backend_pid();', + 0, + 'gssencmode=prefer gssdeleg=enable', + 'succeeds with GSS-encrypted access preferred and hostgssenc hba and credentials not forwarded (server does not accept them, default)', + "connection authenticated: identity=\"test1\@$realm\" method=gss", + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" +); +test_access( + $node, + 'test1', + 'SELECT gss_authenticated AND encrypted AND NOT credentials_proxied from pg_stat_gssapi where pid = pg_backend_pid();', + 0, + 'gssencmode=require gssdeleg=enable', + 'succeeds with GSS-encrypted access required and hostgssenc hba and credentials not forwarded (server does not accept them, default)', + "connection authenticated: identity=\"test1\@$realm\" method=gss", + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" +); + +$node->append_conf('postgresql.conf', + qq{gss_accept_deleg=off}); +$node->restart; + +test_access( + $node, + 'test1', + 'SELECT gss_authenticated AND encrypted AND NOT credentials_proxied from pg_stat_gssapi where pid = pg_backend_pid();', + 0, + 'gssencmode=prefer gssdeleg=enable', + 'succeeds with GSS-encrypted access preferred and hostgssenc hba and credentials not forwarded (server does not accept them, explicitly disabled)', + "connection authenticated: identity=\"test1\@$realm\" method=gss", + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" +); +test_access( + $node, + 'test1', + 'SELECT gss_authenticated AND encrypted AND NOT credentials_proxied from pg_stat_gssapi where pid = pg_backend_pid();', + 0, + 'gssencmode=require gssdeleg=enable', + 'succeeds with GSS-encrypted access required and hostgssenc hba and credentials not forwarded (server does not accept them, explicitly disabled)', + "connection authenticated: identity=\"test1\@$realm\" method=gss", + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" +); + +$node->append_conf('postgresql.conf', + qq{gss_accept_deleg=on}); $node->restart; test_access( $node, 'test1', - 'SELECT gss_authenticated AND encrypted from pg_stat_gssapi where pid = pg_backend_pid();', + 'SELECT gss_authenticated AND encrypted AND credentials_proxied from pg_stat_gssapi where pid = pg_backend_pid();', + 0, + 'gssencmode=prefer gssdeleg=enable', + 'succeeds with GSS-encrypted access preferred and hostgssenc hba and credentials forwarded', + "connection authenticated: identity=\"test1\@$realm\" method=gss", + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" +); +test_access( + $node, + 'test1', + 'SELECT gss_authenticated AND encrypted AND credentials_proxied from pg_stat_gssapi where pid = pg_backend_pid();', + 0, + 'gssencmode=require gssdeleg=enable', + 'succeeds with GSS-encrypted access required and hostgssenc hba and credentials forwarded', + "connection authenticated: identity=\"test1\@$realm\" method=gss", + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" +); +test_access( + $node, + 'test1', + 'SELECT gss_authenticated AND encrypted AND NOT credentials_proxied FROM pg_stat_gssapi WHERE pid = pg_backend_pid();', 0, 'gssencmode=prefer', - 'succeeds with GSS-encrypted access preferred and hostgssenc hba', + 'succeeds with GSS-encrypted access preferred and hostgssenc hba and credentials not forwarded', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access( $node, 'test1', - 'SELECT gss_authenticated AND encrypted from pg_stat_gssapi where pid = pg_backend_pid();', + 'SELECT gss_authenticated AND encrypted AND NOT credentials_proxied FROM pg_stat_gssapi WHERE pid = pg_backend_pid();', 0, - 'gssencmode=require', - 'succeeds with GSS-encrypted access required and hostgssenc hba', + 'gssencmode=require gssdeleg=disable', + 'succeeds with GSS-encrypted access required and hostgssenc hba and credentials not forwarded', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=no, principal=test1\@$realm)" ); test_access($node, 'test1', 'SELECT true', 2, 'gssencmode=disable', 'fails with GSS encryption disabled and hostgssenc hba'); @@ -378,26 +492,42 @@ $node->restart; test_access( $node, 'test1', - 'SELECT gss_authenticated and not encrypted from pg_stat_gssapi where pid = pg_backend_pid();', + 'SELECT gss_authenticated AND NOT encrypted AND credentials_proxied FROM pg_stat_gssapi WHERE pid = pg_backend_pid();', 0, - 'gssencmode=prefer', + 'gssencmode=prefer gssdeleg=enable', 'succeeds with GSS-encrypted access preferred and hostnogssenc hba, but no encryption', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, proxy_credentials=yes, principal=test1\@$realm)" ); test_access($node, 'test1', 'SELECT true', 2, 'gssencmode=require', 'fails with GSS-encrypted access required and hostnogssenc hba'); test_access( $node, 'test1', - 'SELECT gss_authenticated and not encrypted from pg_stat_gssapi where pid = pg_backend_pid();', + 'SELECT gss_authenticated AND NOT encrypted AND credentials_proxied FROM pg_stat_gssapi WHERE pid = pg_backend_pid();', 0, - 'gssencmode=disable', + 'gssencmode=disable gssdeleg=enable', 'succeeds with GSS encryption disabled and hostnogssenc hba', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, proxy_credentials=yes, principal=test1\@$realm)" ); +test_query( + $node, + 'test1', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + qr/^1$/s, + 'gssencmode=prefer gssdeleg=enable', + 'dblink works not-encrypted'); + +test_query( + $node, + 'test1', + "TABLE tf1;", + qr/^1$/s, + 'gssencmode=prefer gssdeleg=enable', + 'postgres_fdw works not-encrypted'); + truncate($node->data_dir . '/pg_ident.conf', 0); unlink($node->data_dir . '/pg_hba.conf'); $node->append_conf('pg_hba.conf', @@ -407,14 +537,30 @@ $node->restart; test_access( $node, 'test1', - 'SELECT gss_authenticated AND encrypted from pg_stat_gssapi where pid = pg_backend_pid();', + 'SELECT gss_authenticated AND encrypted AND credentials_proxied FROM pg_stat_gssapi WHERE pid = pg_backend_pid();', 0, - '', + 'gssdeleg=enable', 'succeeds with include_realm=0 and defaults', "connection authenticated: identity=\"test1\@$realm\" method=gss", - "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, principal=test1\@$realm)" + "connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, proxy_credentials=yes, principal=test1\@$realm)" ); +test_query( + $node, + 'test1', + "SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);", + qr/^1$/s, + 'gssencmode=require gssdeleg=enable', + 'dblink works encrypted'); + +test_query( + $node, + 'test1', + "TABLE tf1;", + qr/^1$/s, + 'gssencmode=require gssdeleg=enable', + 'postgres_fdw works encrypted'); + # Reset pg_hba.conf, and cause a usermap failure with an authentication # that has passed. unlink($node->data_dir . '/pg_hba.conf'); diff --git a/src/test/perl/PostgreSQL/Test/Utils.pm b/src/test/perl/PostgreSQL/Test/Utils.pm index 878e12b15e..9249954b49 100644 --- a/src/test/perl/PostgreSQL/Test/Utils.pm +++ b/src/test/perl/PostgreSQL/Test/Utils.pm @@ -65,6 +65,7 @@ our @EXPORT = qw( slurp_dir slurp_file append_to_file + string_replace_file check_mode_recursive chmod_recursive check_pg_config @@ -549,6 +550,32 @@ sub append_to_file =pod +=item string_replace_file(filename, find, replace) + +Find and replace string of a given file. + +=cut + +sub string_replace_file +{ + my ($filename, $find, $replace) = @_; + open(my $in, '<', $filename); + my $content; + while(<$in>) + { + $_ =~ s/$find/$replace/; + $content = $content.$_; + } + close $in; + open(my $out, '>', $filename); + print $out $content; + close($out); + + return; +} + +=pod + =item check_mode_recursive(dir, expected_dir_mode, expected_file_mode, ignore_list) Check that all file/dir modes in a directory match the expected values, diff --git a/src/test/regress/expected/rules.out b/src/test/regress/expected/rules.out index 174b725fff..9596a673ad 100644 --- a/src/test/regress/expected/rules.out +++ b/src/test/regress/expected/rules.out @@ -1759,7 +1759,7 @@ pg_stat_activity| SELECT s.datid, s.query_id, s.query, s.backend_type - FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, leader_pid, query_id) + FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_proxy, leader_pid, query_id) LEFT JOIN pg_database d ON ((s.datid = d.oid))) LEFT JOIN pg_authid u ON ((s.usesysid = u.oid))); pg_stat_all_indexes| SELECT c.oid AS relid, @@ -1873,8 +1873,9 @@ pg_stat_database_conflicts| SELECT oid AS datid, pg_stat_gssapi| SELECT pid, gss_auth AS gss_authenticated, gss_princ AS principal, - gss_enc AS encrypted - FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, leader_pid, query_id) + gss_enc AS encrypted, + gss_proxy AS credentials_proxied + FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_proxy, leader_pid, query_id) WHERE (client_port IS NOT NULL); pg_stat_io| SELECT backend_type, io_object, @@ -2067,7 +2068,7 @@ pg_stat_replication| SELECT s.pid, w.sync_priority, w.sync_state, w.reply_time - FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, leader_pid, query_id) + FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_proxy, leader_pid, query_id) JOIN pg_stat_get_wal_senders() w(pid, state, sent_lsn, write_lsn, flush_lsn, replay_lsn, write_lag, flush_lag, replay_lag, sync_priority, sync_state, reply_time) ON ((s.pid = w.pid))) LEFT JOIN pg_authid u ON ((s.usesysid = u.oid))); pg_stat_replication_slots| SELECT s.slot_name, @@ -2101,7 +2102,7 @@ pg_stat_ssl| SELECT pid, ssl_client_dn AS client_dn, ssl_client_serial AS client_serial, ssl_issuer_dn AS issuer_dn - FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, leader_pid, query_id) + FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_proxy, leader_pid, query_id) WHERE (client_port IS NOT NULL); pg_stat_subscription| SELECT su.oid AS subid, su.subname, [application/pgp-signature] signature.asc (833B, ../../[email protected]/3-signature.asc) download ^ permalink raw reply [nested|flat] 17+ messages in thread
* [PATCH v7 10/16] Improve sentences about the significance of the search path's first schema @ 2023-09-24 21:39 Karl O. Pinc <[email protected]> 0 siblings, 0 replies; 17+ messages in thread From: Karl O. Pinc @ 2023-09-24 21:39 UTC (permalink / raw) These two sentences have extra words, and can be improved with small word re-ordering. The word "again" could probably be removed as well but it reads ok with it and it does not hurt to pound the point into the reader's brain. Note however that the original last sentence still isn't 100% correct, because the default configuration includes "$user" at the start of the search path. So if an object is in the user's schema an unqualified mention refers to something in the user's schema. Hence, the qualification that comes after the semicolon. I thought about a separate sentence, but the 2 parts are closely intertwined. So, semicolon. It's all kind of a lot. But, although I do believe in removing extra content from sentences to make them shorter, more clear, and memorable, I do think it's ok to repeat things when writing narrative. And the existing documentation is going for repetition so I stuck with that. Line break after each end of sentence to improve readability of future patches. --- doc/src/sgml/ddl.sgml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/doc/src/sgml/ddl.sgml b/doc/src/sgml/ddl.sgml index 075ff32991..ee30b7b575 100644 --- a/doc/src/sgml/ddl.sgml +++ b/doc/src/sgml/ddl.sgml @@ -3106,12 +3106,14 @@ SHOW search_path; <para> The first schema in the search path that exists is the default location for creating new objects. That is the reason that by - default objects are created in the public schema. When objects - are referenced in any other context without schema qualification - (table modification, data modification, or query commands) the - search path is traversed until a matching object is found. - Therefore, in the default configuration, any unqualified access - again can only refer to the public schema. + default objects are created in the public schema. + When objects are referenced in a context without schema qualification + (table modification, data modification, or query commands) the search path + is traversed until a matching object is found. + Therefore, again, in the default configuration, any unqualified name + refers to an object in the public schema; unless, given the default search + path, there is an object with that name accessible in the schema having + the name of the current user. </para> <para> -- 2.30.2 --MP_/VSGM3xNEmY7iJyL2wuWRCjV Content-Type: text/x-patch Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=v7-0011-Add-a-sub-section-to-describe-schema-resolution.patch ^ permalink raw reply [nested|flat] 17+ messages in thread
end of thread, other threads:[~2023-09-24 21:39 UTC | newest] Thread overview: 17+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2022-03-01 01:28 Re: Kerberos delegation support in libpq and postgres_fdw Stephen Frost <[email protected]> 2022-03-11 23:55 ` Jacob Champion <[email protected]> 2022-03-12 00:39 ` Stephen Frost <[email protected]> 2022-03-15 17:59 ` Jacob Champion <[email protected]> 2022-04-06 19:27 ` Stephen Frost <[email protected]> 2022-04-08 04:21 ` Stephen Frost <[email protected]> 2022-04-08 12:21 ` Stephen Frost <[email protected]> 2022-04-08 15:01 ` Robert Haas <[email protected]> 2022-04-08 15:29 ` Stephen Frost <[email protected]> 2022-04-08 15:35 ` Robert Haas <[email protected]> 2022-07-07 23:24 ` Jacob Champion <[email protected]> 2022-09-16 00:06 ` Jacob Champion <[email protected]> 2022-09-19 17:05 ` Stephen Frost <[email protected]> 2022-09-19 21:05 ` Jacob Champion <[email protected]> 2022-10-12 05:32 ` Michael Paquier <[email protected]> 2023-02-17 09:27 ` Stephen Frost <[email protected]> 2023-09-24 21:39 [PATCH v7 10/16] Improve sentences about the significance of the search path's first schema Karl O. Pinc <[email protected]>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox