From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Gustavsson Mikael <mikael.gustavsson@smhi.se>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Cc: pgsql-general@postgresql.org <pgsql-general@postgresql.org>
Cc: Svensson Peter <peter.svensson@smhi.se>
Subject: Re: Problem with ssl and psql in Postgresql 13
Date: Sat, 26 Dec 2020 17:06:17 -0500
Message-ID: <1333636.1609020377@sss.pgh.pa.us> (raw)
In-Reply-To: <1308863.1609016410@sss.pgh.pa.us>
References: <89909.1608222331@sss.pgh.pa.us>
<61e2a65bbc2f47d297a6f3cdac2cc6cc@smhi.se>
<d3ab9042bce34aae85d323d69e3ee430@smhi.se>
<169637.1608321770@sss.pgh.pa.us>
<c347c62b507743ceac0aaebd0ccff533@smhi.se>
<de4dc5a4f22d43a28300bccb70d99db6@smhi.se>
<723586.1608740901@sss.pgh.pa.us>
<737386.1608757126@sss.pgh.pa.us>
<20201223211448.GR27507@tamriel.snowman.net>
<738715.1608758847@sss.pgh.pa.us>
<20201223214534.GS27507@tamriel.snowman.net>
<740093.1608760567@sss.pgh.pa.us>
<742641.1608762845@sss.pgh.pa.us>
<1308863.1609016410@sss.pgh.pa.us>
Here's a draft patch for the libpq-side issues. The core of the
fix is to get rid of pqsecure_open_gss's clearing of allow_ssl_try,
and instead check whether GSS encryption is already enabled before
we try to enable SSL. While I was at it I also fixed the places
where we drop an attempted GSS connection: they should set
need_new_connection = true rather than incompletely doing it for
themselves. Notably that coding misses resetting auth_req_received
and password_needed; the consequences of that are minor but not zero.
There are things to fix on the server side, and the documentation
needs work, but this should be enough to solve Mikael's problem
if he's in a position to apply the patch locally.
regards, tom lane
Attachments:0001-fix-libpq-gss-bugs.patch (text/x-diff, 3.2K) downloaddiff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.cindex 7d04d3664e..ec7c4c5e87 100644--- a/src/interfaces/libpq/fe-connect.c+++ b/src/interfaces/libpq/fe-connect.c@@ -2909,11 +2909,16 @@ keep_going: /* We will come back to here until there is
#ifdef USE_SSL
/*
- * If SSL is enabled and we haven't already got it running,- * request it instead of sending the startup message.+ * If SSL is enabled and we haven't already got encryption of+ * some sort running, request SSL instead of sending the+ * startup message.
*/
if (conn->allow_ssl_try && !conn->wait_ssl_try &&
- !conn->ssl_in_use)+ !conn->ssl_in_use+#ifdef ENABLE_GSS+ && !conn->gssenc+#endif+ )
{
ProtocolVersion pv;
@@ -3042,6 +3047,7 @@ keep_going: /* We will come back to here until there is
}
/* Otherwise, proceed with normal startup */
conn->allow_ssl_try = false;
+ /* We can proceed using this connection */
conn->status = CONNECTION_MADE;
return PGRES_POLLING_WRITING;
}
@@ -3139,8 +3145,7 @@ keep_going: /* We will come back to here until there is
* don't hang up the socket, though.
*/
conn->try_gss = false;
- pqDropConnection(conn, true);- conn->status = CONNECTION_NEEDED;+ need_new_connection = true;
goto keep_going;
}
@@ -3158,6 +3163,7 @@ keep_going: /* We will come back to here until there is
}
conn->try_gss = false;
+ /* We can proceed using this connection */
conn->status = CONNECTION_MADE;
return PGRES_POLLING_WRITING;
}
@@ -3186,8 +3192,7 @@ keep_going: /* We will come back to here until there is
* the current connection to do so, though.
*/
conn->try_gss = false;
- pqDropConnection(conn, true);- conn->status = CONNECTION_NEEDED;+ need_new_connection = true;
goto keep_going;
}
return pollres;
@@ -3354,10 +3359,9 @@ keep_going: /* We will come back to here until there is
*/
if (conn->gssenc && conn->gssencmode[0] == 'p')
{
- /* postmaster expects us to drop the connection */+ /* only retry once */
conn->try_gss = false;
- pqDropConnection(conn, true);- conn->status = CONNECTION_NEEDED;+ need_new_connection = true;
goto keep_going;
}
#endif
diff --git a/src/interfaces/libpq/fe-secure-gssapi.c b/src/interfaces/libpq/fe-secure-gssapi.cindex bfc0f55214..9416306eea 100644--- a/src/interfaces/libpq/fe-secure-gssapi.c+++ b/src/interfaces/libpq/fe-secure-gssapi.c@@ -647,17 +647,14 @@ pqsecure_open_gss(PGconn *conn)
if (output.length == 0)
{
/*
- * We're done - hooray! Kind of gross, but we need to disable SSL- * here so that we don't accidentally tunnel one over the other.+ * We're done - hooray! Set flag to tell the low-level I/O routines+ * to do GSS wrapping/unwrapping.
*/
-#ifdef USE_SSL- conn->allow_ssl_try = false;-#endif+ conn->gssenc = true;
/* Clean up */
gss_release_cred(&minor, &conn->gcred);
conn->gcred = GSS_C_NO_CREDENTIAL;
- conn->gssenc = true;
gss_release_buffer(&minor, &output);
/*
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-general@postgresql.org
Cc: tgl@sss.pgh.pa.us, sfrost@snowman.net, mikael.gustavsson@smhi.se, magnus@hagander.net, horikyota.ntt@gmail.com, peter.svensson@smhi.se
Subject: Re: Problem with ssl and psql in Postgresql 13
In-Reply-To: <1333636.1609020377@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox