From: | Magnus Hagander <magnus(at)hagander(dot)net> |
---|---|
To: | David Fetter <david(at)fetter(dot)org> |
Cc: | PG Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Re: [BUGS] BUG #6189: libpq: sslmode=require verifies server certificate if root.crt is present |
Date: | 2011-09-12 17:37:23 |
Message-ID: | CABUevEzmT7rQSa33hxOcXC7c3mq_mfVaJzWyNCYpVawfUZudXw@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-bugs pgsql-hackers |
On Mon, Sep 12, 2011 at 19:21, David Fetter <david(at)fetter(dot)org> wrote:
> On Wed, Aug 31, 2011 at 09:59:18AM +0000, Srinivas Aji wrote:
>>
>> The following bug has been logged online:
>>
>> Bug reference: 6189
>> Logged by: Srinivas Aji
>> Email address: srinivas(dot)aji(at)emc(dot)com
>> PostgreSQL version: 9.0.4
>> Operating system: Linux
>> Description: libpq: sslmode=require verifies server certificate if
>> root.crt is present
>> Details:
>>
>> >From the documentation of sslmode values in
>> http://www.postgresql.org/docs/9.0/static/libpq-ssl.html ,
>> it looks like libpq will not verify the server certificate when the option
>> sslmode=require is used, and will perform different levels of certificate
>> verification in the cases sslmode=verify-ca and sslmode=verify-full.
>>
>> The observed behaviour is a bit different. If the ~/.postgresql/root.crt
>> file (or any other filename set through sslrootcert option) is found,
>> sslmode=require also performs the same level of certificate verification as
>> verify-ca. The difference between require and verify-ca is that it is an
>> error for the file to not exist when sslmode is verify-ca.
>>
>> Thanks,
>> Srinivas
>
> It looks to me like there could at least in theory be an attack vector
> or two that we're not covering with this bug. Anybody want to tackle
> same?
I haven't checked the code yet, but from the report it sounds like
we're checking *too much* - how could that be an attack vector?
--
Magnus Hagander
Me: http://www.hagander.net/
Work: http://www.redpill-linpro.com/
From | Date | Subject | |
---|---|---|---|
Next Message | David Fetter | 2011-09-12 18:20:20 | Re: Re: [BUGS] BUG #6189: libpq: sslmode=require verifies server certificate if root.crt is present |
Previous Message | David Fetter | 2011-09-12 17:21:26 | Re: [BUGS] BUG #6189: libpq: sslmode=require verifies server certificate if root.crt is present |
From | Date | Subject | |
---|---|---|---|
Next Message | Peter Eisentraut | 2011-09-12 18:04:05 | Re: Alpha 1 for 9.2 |
Previous Message | David E. Wheeler | 2011-09-12 17:25:29 | Re: What Would You Like To Do? |