Re: Securing "make check" (CVE-2014-0067)

On 25 December 2014 at 18:27, Noah Misch <noah@leadboat.com> wrote:

> On Thu, Dec 25, 2014 at 03:55:02PM +1300, David Rowley wrote:
> > f6dc6dd seems to have broken vcregress check for me:
>
> > FATAL:  no pg_hba.conf entry for host "::1", user "David", database
> > "postgres"
> > ...
> > FATAL:  no pg_hba.conf entry for host "::1", user "David", database
> > "postgres"
>
> Thanks.  I bet this is the reason buildfarm members hamerkop, jacana and
> bowerbird have not been reporting in.
>
> > @@ -1085,6 +1085,8 @@ config_sspi_auth(const char *pgdata)
> >       CW(fputs("# Configuration written by config_sspi_auth()\n", hba)
> >= 0);
> >       CW(fputs("host all all 127.0.0.1/32  sspi include_realm=1
> map=regress\n",
> >                        hba) >= 0);
> > +     CW(fputs("host all all ::1/128  sspi include_realm=1
> map=regress\n",
> > +                      hba) >= 0);
>
> This needs to be conditional on whether the platform supports IPv6, like
> we do
> in setup_config().  The attached patch works on these configurations:
>
> 64-bit Windows Server 2003, 32-bit VS2010
> 64-bit Windows Server 2003, MinGW (always 32-bit)
> 64-bit Windows Server 2008, 64-bit VS2012
> 64-bit Windows Server 2008, 64-bit MinGW-w64
>
> If the patch looks reasonable, I will commit it.
>

I'm just looking at initdb.c I see that there's this:

#ifdef HAVE_IPV6

/*
 * Probe to see if there is really any platform support for IPv6, and
 * comment out the relevant pg_hba line if not.  This avoids runtime
 * warnings if getaddrinfo doesn't actually cope with IPv6.  Particularly
 * useful on Windows, where executables built on a machine with IPv6 may
 * have to run on a machine without.
 */
The comment does seem to indicate that getaddrinfo might give a warning on
an IPv4 only machine when given an IPv6 address to resolve. I think likely
we want that here too. Though I don't have an IPv4 only machine to test on.

I'll test the patch with IPv4 disabled and see if I get a warning...

Ok, it seems to still write the Ipv6 entry into the pg_hba.conf with IPv6
disabled, so perhaps disabling IPv6 is not sufficient, maybe it needs to be
tested on a machine that does not support IPv6 at all.

Regards

David Rowley