mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-09-28 00:01:51 +02:00
Arrange for the authentication request type to be preserved in
PGconn. Invent a new libpq connection-status function, PQconnectionUsedPassword() that returns true if the server demanded a password during authentication, false otherwise. This may be useful to clients in general, but is immediately useful to help plug a privilege escalation path in dblink. Per list discussion and design proposed by Tom Lane.
This commit is contained in:
parent
8c69d881ce
commit
51bc3dfe4b
@ -1,4 +1,4 @@
|
||||
<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.235 2007/03/30 03:19:02 momjian Exp $ -->
|
||||
<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.236 2007/07/08 17:11:50 joe Exp $ -->
|
||||
|
||||
<chapter id="libpq">
|
||||
<title><application>libpq</application> - C Library</title>
|
||||
@ -1059,6 +1059,20 @@ SSL *PQgetssl(const PGconn *conn);
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><function>PQconnectionUsedPassword</function><indexterm><primary>PQconnectionUsedPassword</></></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Returns true (1) if the connection authentication method
|
||||
required a password to be supplied. Returns false (0)
|
||||
otherwise.
|
||||
<synopsis>
|
||||
bool PQconnectionUsedPassword(const PGconn *conn);
|
||||
</synopsis>
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
</variablelist>
|
||||
</para>
|
||||
|
||||
|
@ -9,7 +9,7 @@
|
||||
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
|
||||
* Portions Copyright (c) 1994, Regents of the University of California
|
||||
*
|
||||
* $PostgreSQL: pgsql/src/include/libpq/pqcomm.h,v 1.102 2007/01/05 22:19:55 momjian Exp $
|
||||
* $PostgreSQL: pgsql/src/include/libpq/pqcomm.h,v 1.103 2007/07/08 17:11:51 joe Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
@ -156,6 +156,7 @@ extern bool Db_user_namespace;
|
||||
#define AUTH_REQ_CRYPT 4 /* crypt password */
|
||||
#define AUTH_REQ_MD5 5 /* md5 password */
|
||||
#define AUTH_REQ_SCM_CREDS 6 /* transfer SCM credentials */
|
||||
#define AUTH_REQ_UNK 7 /* User has not yet attempted to authenticate */
|
||||
|
||||
typedef uint32 AuthRequest;
|
||||
|
||||
|
@ -1,4 +1,4 @@
|
||||
# $PostgreSQL: pgsql/src/interfaces/libpq/exports.txt,v 1.15 2007/03/03 19:52:46 momjian Exp $
|
||||
# $PostgreSQL: pgsql/src/interfaces/libpq/exports.txt,v 1.16 2007/07/08 17:11:51 joe Exp $
|
||||
# Functions to be exported by libpq DLLs
|
||||
PQconnectdb 1
|
||||
PQsetdbLogin 2
|
||||
@ -137,3 +137,4 @@ PQdescribePortal 134
|
||||
PQsendDescribePrepared 135
|
||||
PQsendDescribePortal 136
|
||||
lo_truncate 137
|
||||
PQconnectionUsedPassword 138
|
||||
|
@ -8,7 +8,7 @@
|
||||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.345 2007/03/08 19:27:28 mha Exp $
|
||||
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.346 2007/07/08 17:11:51 joe Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
@ -1641,6 +1641,10 @@ keep_going: /* We will come back to here until there is
|
||||
return PGRES_POLLING_READING;
|
||||
}
|
||||
|
||||
/* save the authentication request type */
|
||||
if (conn->areq == AUTH_REQ_UNK)
|
||||
conn->areq = areq;
|
||||
|
||||
/* Get the password salt if there is one. */
|
||||
if (areq == AUTH_REQ_MD5)
|
||||
{
|
||||
@ -1873,6 +1877,7 @@ makeEmptyPGconn(void)
|
||||
conn->std_strings = false; /* unless server says differently */
|
||||
conn->verbosity = PQERRORS_DEFAULT;
|
||||
conn->sock = -1;
|
||||
conn->areq = AUTH_REQ_UNK;
|
||||
#ifdef USE_SSL
|
||||
conn->allow_ssl_try = true;
|
||||
conn->wait_ssl_try = false;
|
||||
@ -3441,6 +3446,17 @@ PQsetClientEncoding(PGconn *conn, const char *encoding)
|
||||
return status;
|
||||
}
|
||||
|
||||
bool
|
||||
PQconnectionUsedPassword(const PGconn *conn)
|
||||
{
|
||||
if (conn->areq == AUTH_REQ_MD5 ||
|
||||
conn->areq == AUTH_REQ_CRYPT ||
|
||||
conn->areq == AUTH_REQ_PASSWORD)
|
||||
return true;
|
||||
else
|
||||
return false;
|
||||
}
|
||||
|
||||
PGVerbosity
|
||||
PQsetErrorVerbosity(PGconn *conn, PGVerbosity verbosity)
|
||||
{
|
||||
|
@ -7,7 +7,7 @@
|
||||
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
|
||||
* Portions Copyright (c) 1994, Regents of the University of California
|
||||
*
|
||||
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-fe.h,v 1.136 2007/03/03 19:52:46 momjian Exp $
|
||||
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-fe.h,v 1.137 2007/07/08 17:11:51 joe Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
@ -23,10 +23,11 @@ extern "C"
|
||||
#include <stdio.h>
|
||||
|
||||
/*
|
||||
* postgres_ext.h defines the backend's externally visible types,
|
||||
* defines the backend's externally visible types,
|
||||
* such as Oid.
|
||||
*/
|
||||
#include "postgres_ext.h"
|
||||
#include "postgres_fe.h"
|
||||
|
||||
/* Application-visible enum types */
|
||||
|
||||
@ -265,6 +266,7 @@ extern int PQsocket(const PGconn *conn);
|
||||
extern int PQbackendPID(const PGconn *conn);
|
||||
extern int PQclientEncoding(const PGconn *conn);
|
||||
extern int PQsetClientEncoding(PGconn *conn, const char *encoding);
|
||||
extern bool PQconnectionUsedPassword(const PGconn *conn);
|
||||
|
||||
/* Get the OpenSSL structure associated with a connection. Returns NULL for
|
||||
* unencrypted connections or if any other TLS library is in use. */
|
||||
|
@ -12,7 +12,7 @@
|
||||
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
|
||||
* Portions Copyright (c) 1994, Regents of the University of California
|
||||
*
|
||||
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.119 2007/03/03 19:52:47 momjian Exp $
|
||||
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.120 2007/07/08 17:11:51 joe Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
@ -299,6 +299,7 @@ struct pg_conn
|
||||
SockAddr raddr; /* Remote address */
|
||||
ProtocolVersion pversion; /* FE/BE protocol version in use */
|
||||
int sversion; /* server version, e.g. 70401 for 7.4.1 */
|
||||
AuthRequest areq; /* server demanded password during auth */
|
||||
|
||||
/* Transient state needed while establishing connection */
|
||||
struct addrinfo *addrlist; /* list of possible backend addresses */
|
||||
|
Loading…
Reference in New Issue
Block a user