Content-Type: multipart/mixed; boundary="------------nveu0geLSgQOHG81vGvhOIjl"
Message-ID: <23787477-5fe1-a161-6d2a-e459f74c4713@timescale.com>
Date: Mon, 13 Feb 2023 10:49:17 -0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.7.1
Content-Language: en-US
Cc: Michael Paquier <michael@paquier.xyz>
From: Jacob Champion <jchampion@timescale.com>
Subject: [PATCH] Align GSS and TLS error handling in PQconnectPoll()
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Archived-At: <https://www.postgresql.org/message-id/23787477-5fe1-a161-6d2a-e459f74c4713%40timescale.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------nveu0geLSgQOHG81vGvhOIjl
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

Hi all,

During the gssencmode CVE discussion, we noticed that PQconnectPoll()
handles the error cases for TLS and GSS transport encryption slightly
differently. After TLS fails, the connection handle is dead and future
calls to PQconnectPoll() return immediately. But after GSS encryption
fails, the connection handle can still be used to reenter the GSS
handling code.

This doesn't appear to have any security implications today -- and a
client has to actively try to reuse a handle that's already failed --
but it seems undesirable. Michael (cc'd) came up with a patch, which I
have attached here and will register in the CF.

Thanks,
--Jacob
--------------nveu0geLSgQOHG81vGvhOIjl
Content-Type: text/x-patch; charset=UTF-8;
 name="PQconnectPoll-poison-connection-on-gssenc-error.patch"
Content-Disposition: attachment;
 filename="PQconnectPoll-poison-connection-on-gssenc-error.patch"
Content-Transfer-Encoding: base64

RnJvbSA3NWIxYmU1ZjQ4NGEyOGU1NDMyOTBlMjA4NDc0ZDM2MDNhMzI3MGJmIE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBKYWNvYiBDaGFtcGlvbiA8amNoYW1waW9uQHRpbWVz
Y2FsZS5jb20+CkRhdGU6IE1vbiwgMTMgRmViIDIwMjMgMTA6MzA6NDMgLTA4MDAKU3ViamVj
dDogW1BBVENIXSBQUWNvbm5lY3RQb2xsOiBwb2lzb24gY29ubmVjdGlvbiBvbiBnc3NlbmMg
ZXJyb3IKCkN1cnJlbnRseSwgY29ubi0+c3RhdHVzIGlzbid0IHVwZGF0ZWQgd2hlbiBnc3Nl
bmMgZXN0YWJsaXNobWVudCBmYWlscywKd2hpY2ggYWxsb3dzIGFueSAobWlzYmVoYXZlZCkg
ZnV0dXJlIGNhbGxzIHRvIFBRY29ubmVjdFBvbGwoKSB0byByZWVudGVyCkNPTk5FQ1RJT05f
R1NTX1NUQVJUVVAuIEFsaWduIHRoaXMgY29kZSB3aXRoIHRoZSBDT05ORUNUSU9OX1NTTF9T
VEFSVFVQCmNhc2UsIHdoaWNoIGp1bXBzIHRvIGVycm9yX3JldHVybiBhbmQgcG9pc29ucyB0
aGUgY29ubmVjdGlvbiBoYW5kbGUuCgpQYXRjaCBpcyBieSBNaWNoYWVsIFBhcXVpZXI7IEkg
anVzdCByZWJhc2VkIG92ZXIgSEVBRC4KLS0tCiBzcmMvaW50ZXJmYWNlcy9saWJwcS9mZS1j
b25uZWN0LmMgfCAyMyArKysrKysrKysrKysrKy0tLS0tLS0tLQogMSBmaWxlIGNoYW5nZWQs
IDE0IGluc2VydGlvbnMoKyksIDkgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvc3JjL2lu
dGVyZmFjZXMvbGlicHEvZmUtY29ubmVjdC5jIGIvc3JjL2ludGVyZmFjZXMvbGlicHEvZmUt
Y29ubmVjdC5jCmluZGV4IDUwYjVkZjM0OTAuLjEwNzBiNmRiMjQgMTAwNjQ0Ci0tLSBhL3Ny
Yy9pbnRlcmZhY2VzL2xpYnBxL2ZlLWNvbm5lY3QuYworKysgYi9zcmMvaW50ZXJmYWNlcy9s
aWJwcS9mZS1jb25uZWN0LmMKQEAgLTMxNDgsMTcgKzMxNDgsMjIgQEAga2VlcF9nb2luZzoJ
CQkJCQkvKiBXZSB3aWxsIGNvbWUgYmFjayB0byBoZXJlIHVudGlsIHRoZXJlIGlzCiAJCQkJ
CWNvbm4tPnN0YXR1cyA9IENPTk5FQ1RJT05fTUFERTsKIAkJCQkJcmV0dXJuIFBHUkVTX1BP
TExJTkdfV1JJVElORzsKIAkJCQl9Ci0JCQkJZWxzZSBpZiAocG9sbHJlcyA9PSBQR1JFU19Q
T0xMSU5HX0ZBSUxFRCAmJgotCQkJCQkJIGNvbm4tPmdzc2VuY21vZGVbMF0gPT0gJ3AnKQor
CQkJCWVsc2UgaWYgKHBvbGxyZXMgPT0gUEdSRVNfUE9MTElOR19GQUlMRUQpCiAJCQkJewot
CQkJCQkvKgotCQkJCQkgKiBXZSBmYWlsZWQsIGJ1dCB3ZSBjYW4gcmV0cnkgb24gInByZWZl
ciIuICBIYXZlIHRvIGRyb3AKLQkJCQkJICogdGhlIGN1cnJlbnQgY29ubmVjdGlvbiB0byBk
byBzbywgdGhvdWdoLgotCQkJCQkgKi8KLQkJCQkJY29ubi0+dHJ5X2dzcyA9IGZhbHNlOwot
CQkJCQluZWVkX25ld19jb25uZWN0aW9uID0gdHJ1ZTsKLQkJCQkJZ290byBrZWVwX2dvaW5n
OworCQkJCQlpZiAoY29ubi0+Z3NzZW5jbW9kZVswXSA9PSAncCcpCisJCQkJCXsKKwkJCQkJ
CS8qCisJCQkJCQkgKiBXZSBmYWlsZWQsIGJ1dCB3ZSBjYW4gcmV0cnkgb24gInByZWZlciIu
ICBIYXZlIHRvIGRyb3AKKwkJCQkJCSAqIHRoZSBjdXJyZW50IGNvbm5lY3Rpb24gdG8gZG8g
c28sIHRob3VnaC4KKwkJCQkJCSAqLworCQkJCQkJY29ubi0+dHJ5X2dzcyA9IGZhbHNlOwor
CQkJCQkJbmVlZF9uZXdfY29ubmVjdGlvbiA9IHRydWU7CisJCQkJCQlnb3RvIGtlZXBfZ29p
bmc7CisJCQkJCX0KKwkJCQkJLyogRWxzZSBpdCdzIGEgaGFyZCBmYWlsdXJlICovCisJCQkJ
CWdvdG8gZXJyb3JfcmV0dXJuOwogCQkJCX0KKwkJCQkvKiBFbHNlLCByZXR1cm4gUE9MTElO
R19SRUFESU5HIG9yIFBPTExJTkdfV1JJVElORyBzdGF0dXMgKi8KIAkJCQlyZXR1cm4gcG9s
bHJlczsKICNlbHNlCQkJCQkJCS8qICFFTkFCTEVfR1NTICovCiAJCQkJLyogdW5yZWFjaGFi
bGUgKi8KLS0gCjIuMjUuMQoK

--------------nveu0geLSgQOHG81vGvhOIjl--