From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Peter <pmc@citylink.dinoex.sub.org>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: 12.1 not useable: clientlib fails after a dozen queries (GSSAPI ?)
Date: Fri, 10 Jan 2020 15:58:10 -0500
Message-ID: <22249.1578689890@sss.pgh.pa.us> (raw)
In-Reply-To: <20200110203807.GC3195@tamriel.snowman.net>
References: <20200109181822.GA74698@gate.oper.dinoex.org>
<7042.1578595681@sss.pgh.pa.us>
<20200109205319.GA85142@gate.oper.dinoex.org>
<15232.1578605504@sss.pgh.pa.us>
<20200110022342.GA92515@gate.oper.dinoex.org>
<12348.1578679149@sss.pgh.pa.us>
<16362.1578684322@sss.pgh.pa.us>
<20200110203807.GC3195@tamriel.snowman.net>
Stephen Frost <sfrost@snowman.net> writes:
> Ah-hah. Not sure if that was Robbie or myself (probably me, really,
> since I rewrote a great deal of that code). I agree that the regression
> tests don't test with very much data, but I tested pushing quite a bit
> of data through and didn't see any issues with my testing. Apparently I
> was getting pretty lucky. :/
You were *very* lucky, because this code is absolutely full of mistakes
related to incomplete reads, inadequate or outright wrong error handling,
etc.
I was nearly done cleaning that up, when it sank into me that
fe-secure-gssapi.c uses static buffers for partially-read or
partially-encoded data. That means that any client trying to use
multiple GSSAPI-encrypted connections is very likely to see breakage
due to different connections trying to use the same buffers concurrently.
I wonder whether that doesn't explain the complaints mentioned upthread
from the Ruby folks.
(be-secure-gssapi.c is coded identically, but there it's OK since
any backend only has one client connection to deal with.)
>> I'll have a patch in a little while.
> That's fantastic, thanks!
This is gonna take longer than I thought.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-general@postgresql.org
Cc: tgl@sss.pgh.pa.us, sfrost@snowman.net, pmc@citylink.dinoex.sub.org, pgsql-hackers@lists.postgresql.org
Subject: Re: 12.1 not useable: clientlib fails after a dozen queries (GSSAPI ?)
In-Reply-To: <22249.1578689890@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox