Re: Securing "make check" (CVE-2014-0067)

On Thu, Dec 25, 2014 at 03:55:02PM +1300, David Rowley wrote:
> f6dc6dd seems to have broken vcregress check for me:

> FATAL: no pg_hba.conf entry for host "::1", user "David", database
> "postgres"
> ...
> FATAL: no pg_hba.conf entry for host "::1", user "David", database
> "postgres"

Thanks. I bet this is the reason buildfarm members hamerkop, jacana and
bowerbird have not been reporting in.

> @@ -1085,6 +1085,8 @@ config_sspi_auth(const char *pgdata)
> CW(fputs("# Configuration written by config_sspi_auth()\n", hba) >= 0);
> CW(fputs("host all all 127.0.0.1/32 sspi include_realm=1 map=regress\n",
> hba) >= 0);
> + CW(fputs("host all all ::1/128 sspi include_realm=1 map=regress\n",
> + hba) >= 0);

This needs to be conditional on whether the platform supports IPv6, like we do
in setup_config(). The attached patch works on these configurations:

64-bit Windows Server 2003, 32-bit VS2010
64-bit Windows Server 2003, MinGW (always 32-bit)
64-bit Windows Server 2008, 64-bit VS2012
64-bit Windows Server 2008, 64-bit MinGW-w64

If the patch looks reasonable, I will commit it.