8000 Change wildcard cerfificate mapping to be much simler - we now only m… · postgrespro/postgres_cluster@2c69fa0 · GitHub
[go: up one dir, main page]
Skip to content

Commit 2c69fa0

Browse files
mhagandermhagander
committed
Change wildcard cerfificate mapping to be much simler - we now only match
the * character at the beginning of a pattern, and it does not match subdomains. Since this means we no longer need fnmatch, remove the imported implementation from port, along with the autoconf check for it.
1 parent c98c911 commit 2c69fa0

File tree

8 files changed

+55
-344
lines changed
  • tools/msvc

    • 8 files changed

    +55
    -344
    lines changed

    ‎configure

    Lines changed: 0 additions & 92 deletions
    Original file line numberDiff line numberDiff line change
    @@ -24822,98 +24822,6 @@ esac
    2482224822

    2482324823

    2482424824

    24825-
    # Check for fnmatch()
    24826-
    { echo "$as_me:$LINENO: checking for working POSIX fnmatch" >&5
    24827-
    echo $ECHO_N "checking for working POSIX fnmatch... $ECHO_C" >&6; }
    24828-
    if test "${ac_cv_func_fnmatch_works+set}" = set; then
    24829-
    echo $ECHO_N "(cached) $ECHO_C" >&6
    24830-
    else
    24831-
    # Some versions of Solaris, SCO, and the GNU C Library
    24832-
    # have a broken or incompatible fnmatch.
    24833-
    # So we run a test program. If we are cross-compiling, take no chance.
    24834-
    # Thanks to John Oleynick, Franc,ois Pinard, and Paul Eggert for this test.
    24835-
    if test "$cross_compiling" = yes; then
    24836-
    ac_cv_func_fnmatch_works=cross
    24837-
    else
    24838-
    cat >conftest.$ac_ext <<_ACEOF
    24839-
    /* confdefs.h. */
    24840-
    _ACEOF
    24841-
    cat confdefs.h >>conftest.$ac_ext
    24842-
    cat >>conftest.$ac_ext <<_ACEOF
    24843-
    /* end confdefs.h. */
    24844-
    #include <fnmatch.h>
    24845-
    # define y(a, b, c) (fnmatch (a, b, c) == 0)
    24846-
    # define n(a, b, c) (fnmatch (a, b, c) == FNM_NOMATCH)
    24847-
    24848-
    int
    24849-
    main ()
    24850-
    {
    24851-
    return
    24852-
    (!(y ("a*", "abc", 0)
    24853-
    && n ("d*/*1", "d/s/1", FNM_PATHNAME)
    24854-
    && y ("a\\\\bc", "abc", 0)
    24855-
    && n ("a\\\\bc", "abc", FNM_NOESCAPE)
    24856-
    && y ("*x", ".x", 0)
    24857-
    && n ("*x", ".x", FNM_PERIOD)
    24858-
    && 1));
    24859-
    ;
    24860-
    return 0;
    24861-
    }
    24862-
    _ACEOF
    24863-
    rm -f conftest$ac_exeext
    24864-
    if { (ac_try="$ac_link"
    24865-
    case "(($ac_try" in
    24866-
    *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
    24867-
    *) ac_try_echo=$ac_try;;
    24868-
    esac
    24869-
    eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
    24870-
    (eval "$ac_link") 2>&5
    24871-
    ac_status=$?
    24872-
    echo "$as_me:$LINENO: \$? = $ac_status" >&5
    24873-
    (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
    24874-
    { (case "(($ac_try" in
    24875-
    *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
    24876-
    *) ac_try_echo=$ac_try;;
    24877-
    esac
    24878-
    eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
    24879-
    (eval "$ac_try") 2>&5
    24880-
    ac_status=$?
    24881-
    echo "$as_me:$LINENO: \$? = $ac_status" >&5
    24882-
    (exit $ac_status); }; }; then
    24883-
    ac_cv_func_fnmatch_works=yes
    24884-
    else
    24885-
    echo "$as_me: program exited with status $ac_status" >&5
    24886-
    echo "$as_me: failed program was:" >&5
    24887-
    sed 's/^/| /' conftest.$ac_ext >&5
    24888-
    24889-
    ( exit $ac_status )
    24890-
    ac_cv_func_fnmatch_works=no
    24891-
    fi
    24892-
    rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
    24893-
    fi
    24894-
    24895-
    24896-
    fi
    24897-
    { echo "$as_me:$LINENO: result: $ac_cv_func_fnmatch_works" >&5
    24898-
    echo "${ECHO_T}$ac_cv_func_fnmatch_works" >&6; }
    24899-
    if test $ac_cv_func_fnmatch_works = yes; then
    24900-
    24901-
    cat >>confdefs.h <<\_ACEOF
    24902-
    #define HAVE_FNMATCH 1
    24903-
    _ACEOF
    24904-
    24905-
    fi
    24906-
    24907-
    24908-
    24909-
    if test x"$ac_cv_func_fnmatch_works" != x"yes"; then
    24910-
    case " $LIBOBJS " in
    24911-
    *" fnmatch.$ac_objext "* ) ;;
    24912-
    *) LIBOBJS="$LIBOBJS fnmatch.$ac_objext"
    24913-
    ;;
    24914-
    esac
    24915-
    24916-
    fi
    2491724825

    2491824826
    # Select semaphore implementation type.
    2491924827
    if test "$PORTNAME" != "win32"; then

    ‎configure.in

    Lines changed: 1 addition & 6 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    dnl Process this file with autoconf to produce a configure script.
    2-
    dnl $PostgreSQL: pgsql/configure.in,v 1.574 2008/11/26 11:26:54 petere Exp $
    2+
    dnl $PostgreSQL: pgsql/configure.in,v 1.575 2008/12/02 10:39:30 mha Exp $
    33
    dnl
    44
    dnl Developers, please strive to achieve this order:
    55
    dnl
    @@ -1625,11 +1625,6 @@ fi
    16251625
    # SunOS doesn't handle negative byte comparisons properly with +/- return
    16261626
    AC_FUNC_MEMCMP
    16271627

    1628-
    # Check for fnmatch()
    1629-
    AC_FUNC_FNMATCH
    1630-
    if test x"$ac_cv_func_fnmatch_works" != x"yes"; then
    1631-
    AC_LIBOBJ(fnmatch)
    1632-
    fi
    16331628

    16341629
    # Select semaphore implementation type.
    16351630
    if test "$PORTNAME" != "win32"; then

    ‎src/include/fnmatchstub.h

    Lines changed: 0 additions & 27 deletions
    This file was deleted.

    ‎src/include/pg_config.h.in

    Lines changed: 0 additions & 3 deletions
    Original file line numberDiff line numberDiff line change
    @@ -143,9 +143,6 @@
    143143
    /* Define to 1 if you have the `fdatasync' function. */
    144144
    #undef HAVE_FDATASYNC
    145145

    146-
    /* Define to 1 if your system has a working POSIX `fnmatch' function. */
    147-
    #undef HAVE_FNMATCH
    148-
    149146
    /* Define to 1 if you have the `fpclass' function. */
    150147
    #undef HAVE_FPCLASS
    151148

    ‎src/interfaces/libpq/Makefile

    Lines changed: 4 additions & 4 deletions
    Original file line numberDiff line numberDiff line change
    @@ -5,7 +5,7 @@
    55
    # Portions Copyright (c) 1996-2008, PostgreSQL Global Development Group
    66
    # Portions Copyright (c) 1994, Regents of the University of California
    77
    #
    8-
    # $PostgreSQL: pgsql/src/interfaces/libpq/Makefile,v 1.169 2008/11/24 09:15:16 mha Exp $
    8+
    # $PostgreSQL: pgsql/src/interfaces/libpq/Makefile,v 1.170 2008/12/02 10:39:30 mha Exp $
    99
    #
    1010
    #-------------------------------------------------------------------------
    1111

    @@ -34,7 +34,7 @@ OBJS= fe-auth.o fe-connect.o fe-exec.o fe-misc.o fe-print.o fe-lobj.o \
    3434
    fe-protocol2.o fe-protocol3.o pqexpbuffer.o pqsignal.o fe-secure.o \
    3535
    libpq-events.o \
    3636
    md5.o ip.o wchar.o encnames.o noblock.o pgstrcasecmp.o thread.o \
    37-
    $(filter crypt.o fnmatch.o getaddrinfo.o inet_aton.o open.o snprintf.o strerror.o strlcpy.o win32error.o, $(LIBOBJS))
    37+
    $(filter crypt.o getaddrinfo.o inet_aton.o open.o snprintf.o strerror.o strlcpy.o win32error.o, $(LIBOBJS))
    3838

    3939
    ifeq ($(PORTNAME), cygwin)
    4040
    override shlib = cyg$(NAME)$(DLSUFFIX)
    @@ -80,7 +80,7 @@ backend_src = $(top_srcdir)/src/backend
    8080
    # For port modules, this only happens if configure decides the module
    8181
    # is needed (see filter hack in OBJS, above).
    8282

    83-
    crypt.c fnmatch.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c thread.c win32error.c pgsleep.c: % : $(top_srcdir)/src/port/%
    83+
    crypt.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c thread.c win32error.c pgsleep.c: % : $(top_srcdir)/src/port/%
    8484
    rm -f $@ && $(LN_S) $< .
    8585

    8686
    md5.c ip.c: % : $(backend_src)/libpq/%
    @@ -123,7 +123,7 @@ uninstall: uninstall-lib
    123123
    rm -f '$(DESTDIR)$(datadir)/pg_service.conf.sample'
    124124

    125125
    clean distclean: clean-lib
    126-
    rm -f $(OBJS) pg_config_paths.h crypt.c fnmatch.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c thread.c md5.c ip.c encnames.c wchar.c win32error.c pgsleep.c pthread.h libpq.rc
    126+
    rm -f $(OBJS) pg_config_paths.h crypt.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c thread.c md5.c ip.c encnames.c wchar.c win32error.c pgsleep.c pthread.h libpq.rc
    127127
    # Might be left over from a Win32 client-only build
    128128
    rm -f pg_config_paths.h
    129129

    ‎src/interfaces/libpq/fe-secure.c

    Lines changed: 48 additions & 12 deletions
    Original file line numberDiff line numberDiff line change
    @@ -11,7 +11,7 @@
    1111
    *
    1212
    *
    1313
    * IDENTIFICATION
    14-
    * $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.109 2008/11/24 19:19:46 mha Exp $
    14+
    * $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.110 2008/12/02 10:39:30 mha Exp $
    1515
    *
    1616
    * NOTES
    1717
    *
    @@ -55,6 +55,7 @@
    5555
    #endif
    5656

    5757
    #ifdef USE_SSL
    58+
    5859
    #include <openssl/ssl.h>
    5960
    #include <openssl/bio.h>
    6061
    #if (SSLEAY_VERSION_NUMBER >= 0x00907000L)
    @@ -64,16 +65,6 @@
    6465
    #include <openssl/engine.h>
    6566
    #endif
    6667

    67-
    /* fnmatch() needed for client certificate checking */
    68-
    #ifdef HAVE_FNMATCH
    69-
    #include <fnmatch.h>
    70-
    #else
    71-
    #include "fnmatchstub.h"
    72-
    #endif
    73-
    #endif /* USE_SSL */
    74-
    75-
    76-
    #ifdef USE_SSL
    7768

    7869
    #ifndef WIN32
    7970
    #define USER_CERT_FILE ".postgresql/postgresql.crt"
    @@ -443,6 +434,51 @@ verify_cb(int ok, X509_STORE_CTX *ctx)
    443434
    return ok;
    444435
    }
    445436

    437+
    438+
    /*
    439+
    * Check if a wildcard certificate matches the server hostname.
    440+
    *
    441+
    * The rule for this is:
    442+
    * 1. We only match the '*' character as wildcard
    443+
    * 2. We match only wildcards at the start of the string
    444+
    * 3. The '*' character does *not* match '.', meaning that we match only
    445+
    * a single pathname component.
    446+
    * 4. We don't support more than one '*' in a single pattern.
    447+
    *
    448+
    * This is roughly in line with RFC2818, but contrary to what most browsers
    449+
    * appear to be implementing (point 3 being the difference)
    450+
    *
    451+
    * Matching is always cone case-insensitive, since DNS is case insensitive.
    452+
    */
    453+
    static int
    454+
    wildcard_certificate_match(const char *pattern, const char *string)
    455+
    {
    456+
    int lenpat = strlen(pattern);
    457+
    int lenstr = strlen(string);
    458+
    459+
    /* If we don't start with a wildcard, it's not a match (rule 1 & 2) */
    460+
    if (lenpat < 3 ||
    461+
    pattern[0] != '*' ||
    462+
    pattern[1] != '.')
    463+
    return 0;
    464+
    465+
    if (lenpat > lenstr)
    466+
    /* If pattern is longer than the string, we can never match */
    467+
    return 0;
    468+
    469+
    if (pg_strcasecmp(pattern+1, string+lenstr-lenpat+1) != 0)
    470+
    /* If string does not end in pattern (minus the wildcard), we don't match */
    471+
    return 0;
    472+
    473+
    if (strchr(string, '.') < string+lenstr-lenpat)
    474+
    /* If there is a dot left of where the pattern started to match, we don't match (rule 3) */
    475+
    return 0;
    476+
    477+
    /* String ended with pattern, and didn't have a dot before, so we match */
    478+
    return 1;
    479+
    }
    480+
    481+
    446482
    /*
    447483
    * Verify that common name resolves to peer.
    448484
    */
    @@ -472,7 +508,7 @@ verify_peer_name_matches_certificate(PGconn *conn)
    472508
    if (pg_strcasecmp(conn->peer_cn, conn->pghost) == 0)
    473509
    /* Exact name match */
    474510
    return true;
    475-
    else if (fnmatch(conn->peer_cn, conn->pghost, FNM_NOESCAPE/* | FNM_CASEFOLD*/) == 0)
    511+
    else if (wildcard_certificate_match(conn->peer_cn, conn->pghost))
    476512
    /* Matched wildcard certificate */
    477513
    return true;
    478514
    else

    0 commit comments

    Comments
     (0)
    0