pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #17032: wrong password cause double connect and double error
5+ messages / 5 participants
[nested] [flat]
* BUG #17032: wrong password cause double connect and double error
@ 2021-05-25 11:50 PG Bug reporting form <noreply@postgresql.org>
0 siblings, 2 replies; 5+ messages in thread
From: PG Bug reporting form @ 2021-05-25 11:50 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: rekgrpth@gmail.com
The following bug has been logged on the website:
Bug reference: 17032
Logged by: RekGRpth
Email address: rekgrpth@gmail.com
PostgreSQL version: 13.3
Operating system: docker alpine
Description:
1) create user test with password test and database test with owner test
2) add md5 auth for this user in pg_hba.conf like host test test
172.19.0.0/16 md5
3) compile test program src/postgres/src/test/examples/testlibpq.c
4) run test program with argument "host=postgres user=test password=wrong"
5) get double error on client side:
Connection to database failed: FATAL: password authentication failed for
user "test"
FATAL: password authentication failed for user "test"
6) and get double connection and double error on server side:
2021-05-25 16:49:42.868 +05 [46654] postgres(43832)
[unknown]@[unknown]/[unknown] LOG: connection received: host=postgres
port=43832
2021-05-25 16:49:42.876 +05 [46654] postgres(43832) test@test/[unknown]
FATAL: password authentication failed for user "test"
2021-05-25 16:49:42.876 +05 [46654] postgres(43832) test@test/[unknown]
DETAIL: Password does not match for user "test".
Connection matched pg_hba.conf line 99: "host test test 172.19.0.0/16
md5"
2021-05-25 16:49:42.877 +05 [46655] postgres(43834)
[unknown]@[unknown]/[unknown] LOG: connection received: host=postgres
port=43834
2021-05-25 16:49:42.878 +05 [46655] postgres(43834) test@test/[unknown]
FATAL: password authentication failed for user "test"
2021-05-25 16:49:42.878 +05 [46655] postgres(43834) test@test/[unknown]
DETAIL: Password does not match for user "test".
Connection matched pg_hba.conf line 99: "host test test 172.19.0.0/16 md5"
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #17032: wrong password cause double connect and double error
@ 2021-05-25 14:02 Jeff Janes <jeff.janes@gmail.com>
parent: PG Bug reporting form <noreply@postgresql.org>
1 sibling, 1 reply; 5+ messages in thread
From: Jeff Janes @ 2021-05-25 14:02 UTC (permalink / raw)
To: RekGRpth <rekgrpth@gmail.com>; pgsql-bugs <pgsql-bugs@lists.postgresql.org>
On Tue, May 25, 2021 at 7:55 AM PG Bug reporting form <
noreply@postgresql.org> wrote:
> The following bug has been logged on the website:
>
> Bug reference: 17032
> Logged by: RekGRpth
> Email address: rekgrpth@gmail.com
> PostgreSQL version: 13.3
> Operating system: docker alpine
> Description:
>
> 1) create user test with password test and database test with owner test
> 2) add md5 auth for this user in pg_hba.conf like host test test
> 172.19.0.0/16 md5
> 3) compile test program src/postgres/src/test/examples/testlibpq.c
> 4) run test program with argument "host=postgres user=test password=wrong"
> 5) get double error on client side:
>
You have described the behavior, but not what about it is buggy. This
looks expected to me.
It tries to connect with encryption and fails, then tries to connect
without encryption and also fails.
If you set sslmode to 'disable' or to 'require' (or higher) then you will
only get one connection attempt. But if it is 'allow' or 'prefer' (the
default), then you will get two.
Cheers,
Jeff
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #17032: wrong password cause double connect and double error
@ 2021-05-25 14:10 RekGRpth <rekgrpth@gmail.com>
parent: Jeff Janes <jeff.janes@gmail.com>
0 siblings, 1 reply; 5+ messages in thread
From: RekGRpth @ 2021-05-25 14:10 UTC (permalink / raw)
To: Jeff Janes <jeff.janes@gmail.com>; +Cc: pgsql-bugs <pgsql-bugs@lists.postgresql.org>
Ok, thanks. But, Why try to re-establish a known unsuccessful
connection? (because wrong password)
вт, 25 мая 2021 г. в 19:02, Jeff Janes <jeff.janes@gmail.com>:
>
> On Tue, May 25, 2021 at 7:55 AM PG Bug reporting form <noreply@postgresql.org> wrote:
>>
>> The following bug has been logged on the website:
>>
>> Bug reference: 17032
>> Logged by: RekGRpth
>> Email address: rekgrpth@gmail.com
>> PostgreSQL version: 13.3
>> Operating system: docker alpine
>> Description:
>>
>> 1) create user test with password test and database test with owner test
>> 2) add md5 auth for this user in pg_hba.conf like host test test
>> 172.19.0.0/16 md5
>> 3) compile test program src/postgres/src/test/examples/testlibpq.c
>> 4) run test program with argument "host=postgres user=test password=wrong"
>> 5) get double error on client side:
>
>
> You have described the behavior, but not what about it is buggy. This looks expected to me.
>
> It tries to connect with encryption and fails, then tries to connect without encryption and also fails.
>
> If you set sslmode to 'disable' or to 'require' (or higher) then you will only get one connection attempt. But if it is 'allow' or 'prefer' (the default), then you will get two.
>
> Cheers,
>
> Jeff
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #17032: wrong password cause double connect and double error
@ 2021-05-25 14:12 Tom Lane <tgl@sss.pgh.pa.us>
parent: PG Bug reporting form <noreply@postgresql.org>
1 sibling, 0 replies; 5+ messages in thread
From: Tom Lane @ 2021-05-25 14:12 UTC (permalink / raw)
To: rekgrpth@gmail.com; +Cc: pgsql-bugs@lists.postgresql.org
PG Bug reporting form <noreply@postgresql.org> writes:
> 5) get double error on client side:
That's normal behavior, if you're using an SSL-capable libpq over a TCP
socket; it will try once with SSL and once without. (This isn't quite
as insane as it perhaps sounds, because the server might have different
pg_hba rules for the two cases.) If you don't want that, you can force
the matter using the sslmode connection option.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #17032: wrong password cause double connect and double error
@ 2021-05-26 02:14 Michael Paquier <michael@paquier.xyz>
parent: RekGRpth <rekgrpth@gmail.com>
0 siblings, 0 replies; 5+ messages in thread
From: Michael Paquier @ 2021-05-26 02:14 UTC (permalink / raw)
To: RekGRpth <rekgrpth@gmail.com>; +Cc: Jeff Janes <jeff.janes@gmail.com>; pgsql-bugs <pgsql-bugs@lists.postgresql.org>
On Tue, May 25, 2021 at 07:10:11PM +0500, RekGRpth wrote:
> Ok, thanks. But, Why try to re-establish a known unsuccessful
> connection? (because wrong password)
Because that's the way the default behavior of sslmode works, and
because it is simpler to work this way in libpq by making all failures
reported by the backend work the same way on the client side:
https://www.postgresql.org/docs/devel/libpq-connect.html#LIBPQ-CONNECT-SSLMODE
(I agree that this is an unsafe default choice, and we've discussed
about changing to a saner default.)
--
Michael
Attachments:
signature.asc (application/pgp-signature, 832B) download
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2021-05-26 02:14 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-05-25 11:50 BUG #17032: wrong password cause double connect and double error PG Bug reporting form <noreply@postgresql.org>
2021-05-25 14:02 ` Jeff Janes <jeff.janes@gmail.com>
2021-05-25 14:10 ` RekGRpth <rekgrpth@gmail.com>
2021-05-26 02:14 ` Michael Paquier <michael@paquier.xyz>
2021-05-25 14:12 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox