From: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Be more wary about OpenSSL not setting errno on error.
Date: Mon, 11 Dec 2023 16:52:27 +0000
Message-ID: <E1rCjW7-009i9S-1p@gemulon.postgresql.org> (raw)
Be more wary about OpenSSL not setting errno on error.
OpenSSL will sometimes return SSL_ERROR_SYSCALL without having set
errno; this is apparently a reflection of recv(2)'s habit of not
setting errno when reporting EOF. Ensure that we treat such cases
the same as read EOF. Previously, we'd frequently report them like
"could not accept SSL connection: Success" which is confusing, or
worse report them with an unrelated errno left over from some
previous syscall.
To fix, ensure that errno is zeroed immediately before the call,
and report its value only when it's not zero afterwards; otherwise
report EOF.
For consistency, I've applied the same coding pattern in libpq's
pqsecure_raw_read(). Bare recv(2) shouldn't really return -1 without
setting errno, but in case it does we might as well cope.
Per report from Andres Freund. Back-patch to all supported versions.
Discussion: https://postgr.es/m/20231208181451.deqnflwxqoehhxpe@awork3.anarazel.de
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/0a5c46a7a488f2f4260a90843bb9de6c584c7f4e
Modified Files
--------------
src/backend/libpq/be-secure-openssl.c | 15 +++++++++++----
src/backend/libpq/pqcomm.c | 22 ++++++++++++++++------
src/interfaces/libpq/fe-secure-openssl.c | 15 +++++++++++----
src/interfaces/libpq/fe-secure.c | 7 +++++++
4 files changed, 45 insertions(+), 14 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: tgl@sss.pgh.pa.us, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Be more wary about OpenSSL not setting errno on error.
In-Reply-To: <E1rCjW7-009i9S-1p@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox