Re: Securing "make check" (CVE-2014-0067)

On 25 December 2014 at 18:27, Noah Misch <noah(at)leadboat(dot)com> wrote:

> On Thu, Dec 25, 2014 at 03:55:02PM +1300, David Rowley wrote:
> > f6dc6dd seems to have broken vcregress check for me:
>
> > FATAL: no pg_hba.conf entry for host "::1", user "David", database
> > "postgres"
> > ...
> > FATAL: no pg_hba.conf entry for host "::1", user "David", database
> > "postgres"
>
> Thanks. I bet this is the reason buildfarm members hamerkop, jacana and
> bowerbird have not been reporting in.
>
> > @@ -1085,6 +1085,8 @@ config_sspi_auth(const char *pgdata)
> > CW(fputs("# Configuration written by config_sspi_auth()\n", hba)
> >= 0);
> > CW(fputs("host all all 127.0.0.1/32 sspi include_realm=1
> map=regress\n",
> > hba) >= 0);
> > + CW(fputs("host all all ::1/128 sspi include_realm=1
> map=regress\n",
> > + hba) >= 0);
>
> This needs to be conditional on whether the platform supports IPv6, like
> we do
> in setup_config(). The attached patch works on these configurations:
>
> 64-bit Windows Server 2003, 32-bit VS2010
> 64-bit Windows Server 2003, MinGW (always 32-bit)
> 64-bit Windows Server 2008, 64-bit VS2012
> 64-bit Windows Server 2008, 64-bit MinGW-w64
>
> If the patch looks reasonable, I will commit it.
>

I'm just looking at initdb.c I see that there's this:

#ifdef HAVE_IPV6

/*
* Probe to see if there is really any platform support for IPv6, and
* comment out the relevant pg_hba line if not. This avoids runtime
* warnings if getaddrinfo doesn't actually cope with IPv6. Particularly
* useful on Windows, where executables built on a machine with IPv6 may
* have to run on a machine without.
*/
The comment does seem to indicate that getaddrinfo might give a warning on
an IPv4 only machine when given an IPv6 address to resolve. I think likely
we want that here too. Though I don't have an IPv4 only machine to test on.

I'll test the patch with IPv4 disabled and see if I get a warning...

Ok, it seems to still write the Ipv6 entry into the pg_hba.conf with IPv6
disabled, so perhaps disabling IPv6 is not sufficient, maybe it needs to be
tested on a machine that does not support IPv6 at all.

Regards

David Rowley