Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix error printout on correct security label #3799

Merged
merged 1 commit into from
Nov 18, 2021
Merged

Fix error printout on correct security label #3799

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 42 additions & 1 deletion src/loader/loader.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -470,6 +470,42 @@ post_analyze_hook(ParseState *pstate, Query *query, JumbleState *jstate)
}
}

/*
* Check if a string is an UUID and error out otherwise.
*/
static void
check_uuid(const char *label)
{
const MemoryContext oldcontext = CurrentMemoryContext;
const char *uuid = strchr(label, SECLABEL_DIST_TAG_SEPARATOR);
if (!uuid || strncmp(label, SECLABEL_DIST_TAG, uuid - label) != 0)
ereport(ERROR,
(errcode(ERRCODE_INVALID_TEXT_REPRESENTATION),
errmsg("TimescaleDB label is for internal use only"),
errdetail("Security label is \"%s\".", label),
errhint("Security label has to be of format \"dist_uuid:<UUID>\".")));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My previous comment about dropping the hint still applies.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I prefer to have this present for debugging purposes and trust users rather than to hide useful information that could help in resolving an issue.


PG_TRY();
{
DirectFunctionCall1(uuid_in, CStringGetDatum(&uuid[1]));
}
PG_CATCH();
{
ErrorData *edata;
MemoryContextSwitchTo(oldcontext);
edata = CopyErrorData();
if (edata->sqlerrcode == ERRCODE_INVALID_TEXT_REPRESENTATION)
{
FlushErrorState();
edata->detail = edata->message;
edata->hint = psprintf("Security label has to be of format \"dist_uuid:<UUID>\".");
edata->message = psprintf("TimescaleDB label is for internal use only");
}
ReThrowError(edata);
}
PG_END_TRY();
}

static void
loader_process_utility_hook(PlannedStmt *pstmt, const char *query_string,
#if PG14_GE
Expand Down Expand Up @@ -505,8 +541,13 @@ loader_process_utility_hook(PlannedStmt *pstmt, const char *query_string,
{
SecLabelStmt *stmt = castNode(SecLabelStmt, pstmt->utilityStmt);

/*
* Since this statement can be in a dump output, we only print an
* error on anything that doesn't looks like a sane distributed
* UUID.
*/
if (stmt->provider && strcmp(stmt->provider, SECLABEL_DIST_PROVIDER) == 0)
ereport(ERROR, (errmsg("TimescaleDB label is for internal use only")));
check_uuid(stmt->label);
break;
}
default:
Expand Down
87 changes: 85 additions & 2 deletions tsl/test/expected/data_node_bootstrap.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -452,12 +452,95 @@ SELECT substr(label, 0, 10) || ':uuid'
(1 row)

\c :TEST_DBNAME :ROLE_CLUSTER_SUPERUSER;
-- Check that timescaledb security label cannot be used directly
-- Check that timescaledb security label cannot be used directly. To
-- support pg_dump, we do not print an error when a proper label is
-- used, but print an error if something that doesn't look like a
-- distributed uuid is used.
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bc-438f-11ec-8919-23804e22321a';
\set ON_ERROR_STOP 0
\set VERBOSITY default
-- No colon
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'bad_label';
ERROR: TimescaleDB label is for internal use only
DETAIL: Security label is "bad_label".
HINT: Security label has to be of format "dist_uuid:<UUID>".
-- Bad tag, but still an UUID
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'uuid:4ab3b1bc-438f-11ec-8919-23804e22321a';
ERROR: TimescaleDB label is for internal use only
DETAIL: Security label is "uuid:4ab3b1bc-438f-11ec-8919-23804e22321a".
HINT: Security label has to be of format "dist_uuid:<UUID>".
-- Length is not correct
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bcd-438f-11ec-8919-23804e2232';
ERROR: TimescaleDB label is for internal use only
DETAIL: invalid input syntax for type uuid: "4ab3b1bcd-438f-11ec-8919-23804e2232"
HINT: Security label has to be of format "dist_uuid:<UUID>".
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bcd-438f-11ec-8919-23804e223215';
ERROR: TimescaleDB label is for internal use only
DETAIL: invalid input syntax for type uuid: "4ab3b1bcd-438f-11ec-8919-23804e223215"
HINT: Security label has to be of format "dist_uuid:<UUID>".
-- Length is correct, but it contains something that is not a
-- hexadecimal digit.
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bcd-4x8f-11ec-8919-23804e22321';
ERROR: TimescaleDB label is for internal use only
DETAIL: invalid input syntax for type uuid: "4ab3b1bcd-4x8f-11ec-8919-23804e22321"
HINT: Security label has to be of format "dist_uuid:<UUID>".
-- Total length is correct, but not the right number of hyphens.
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3-1bcd-438f-11ec-8919-23804e22321';
ERROR: TimescaleDB label is for internal use only
DETAIL: invalid input syntax for type uuid: "4ab3-1bcd-438f-11ec-8919-23804e22321"
HINT: Security label has to be of format "dist_uuid:<UUID>".
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bcd438f-11ec-8919-23804e223213';
ERROR: TimescaleDB label is for internal use only
DETAIL: invalid input syntax for type uuid: "4ab3b1bcd438f-11ec-8919-23804e223213"
HINT: Security label has to be of format "dist_uuid:<UUID>".
-- Total length is correct, but length of groups is not
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bcd-438f-11ec-8919-23804e22321';
ERROR: TimescaleDB label is for internal use only
DETAIL: invalid input syntax for type uuid: "4ab3b1bcd-438f-11ec-8919-23804e22321"
HINT: Security label has to be of format "dist_uuid:<UUID>".
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bc-438f-11ec-891-23804e22321ab';
ERROR: TimescaleDB label is for internal use only
DETAIL: invalid input syntax for type uuid: "4ab3b1bc-438f-11ec-891-23804e22321ab"
HINT: Security label has to be of format "dist_uuid:<UUID>".
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bc-438f-11e-8919-23804e22321ab';
ERROR: TimescaleDB label is for internal use only
DETAIL: invalid input syntax for type uuid: "4ab3b1bc-438f-11e-8919-23804e22321ab"
HINT: Security label has to be of format "dist_uuid:<UUID>".
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bc-438-11ec-8919-23804e22321ab';
ERROR: TimescaleDB label is for internal use only
DETAIL: invalid input syntax for type uuid: "4ab3b1bc-438-11ec-8919-23804e22321ab"
HINT: Security label has to be of format "dist_uuid:<UUID>".
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:00000000-0000-0000-0000-00000000000';
IS 'dist_uuid:4ab3b1bca-438f-11ec-8919-23804e22321';
ERROR: TimescaleDB label is for internal use only
DETAIL: invalid input syntax for type uuid: "4ab3b1bca-438f-11ec-8919-23804e22321"
HINT: Security label has to be of format "dist_uuid:<UUID>".
\set VERBOSITY terse
\set ON_ERROR_STOP 1
-- Check that security label functionality is working
CREATE TABLE seclabel_test(id int);
Expand Down
52 changes: 50 additions & 2 deletions tsl/test/sql/data_node_bootstrap.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -358,11 +358,59 @@ SELECT substr(label, 0, 10) || ':uuid'

\c :TEST_DBNAME :ROLE_CLUSTER_SUPERUSER;

-- Check that timescaledb security label cannot be used directly
-- Check that timescaledb security label cannot be used directly. To
-- support pg_dump, we do not print an error when a proper label is
-- used, but print an error if something that doesn't look like a
-- distributed uuid is used.
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bc-438f-11ec-8919-23804e22321a';
\set ON_ERROR_STOP 0
\set VERBOSITY default
-- No colon
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'bad_label';
-- Bad tag, but still an UUID
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'uuid:4ab3b1bc-438f-11ec-8919-23804e22321a';
-- Length is not correct
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bcd-438f-11ec-8919-23804e2232';
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bcd-438f-11ec-8919-23804e223215';
-- Length is correct, but it contains something that is not a
-- hexadecimal digit.
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bcd-4x8f-11ec-8919-23804e22321';
-- Total length is correct, but not the right number of hyphens.
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3-1bcd-438f-11ec-8919-23804e22321';
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bcd438f-11ec-8919-23804e223213';
-- Total length is correct, but length of groups is not
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bcd-438f-11ec-8919-23804e22321';
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bc-438f-11ec-891-23804e22321ab';
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bc-438f-11e-8919-23804e22321ab';
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:4ab3b1bc-438-11ec-8919-23804e22321ab';
SECURITY LABEL FOR timescaledb
ON DATABASE drop_db_test
IS 'dist_uuid:00000000-0000-0000-0000-00000000000';
IS 'dist_uuid:4ab3b1bca-438f-11ec-8919-23804e22321';
\set VERBOSITY terse
\set ON_ERROR_STOP 1

-- Check that security label functionality is working
Expand Down