Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pRi9N-0007LO-4L for pgsql-hackers@arkaria.postgresql.org; Mon, 13 Feb 2023 23:22:21 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1pRi9L-0007iV-QD for pgsql-hackers@arkaria.postgresql.org; Mon, 13 Feb 2023 23:22:19 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pRi9L-0007ho-DL for pgsql-hackers@lists.postgresql.org; Mon, 13 Feb 2023 23:22:19 +0000 Received: from mail-pf1-x436.google.com ([2607:f8b0:4864:20::436]) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1pRi9G-0008A8-RK for pgsql-hackers@lists.postgresql.org; Mon, 13 Feb 2023 23:22:18 +0000 Received: by mail-pf1-x436.google.com with SMTP id t17so9047276pfj.0 for ; Mon, 13 Feb 2023 15:22:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=timescale.com; s=google; h=cc:subject:from:to:content-language:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to; bh=0JAyhGtjyhrMUTtlGrjI85NnKO99NzA+fHTllSLq7VA=; b=T9lrE+FuC0BXSdluGZH83MqWlcWPtp5Xf2fsULk92GgN1yxWVFL9muSoRY7FbbgMh7 tL03u0AOZ/76N8gdkGSjg8VEvqUSO4UJidsXYl3GuNwYQQqGco+3Al2Yevt8Hr2RTj1i vfHB/j7aLx9dzF6nYUljSPbx1/OfdV1LsNt6/yWnblOWd1xbodcacEeB5sl4G8twtzK2 flQL6Elvp6+qPVIM+9jP6Mm+GNm8nGtIlGUXVxEnmlJWATotP2AcLvtG0DFcgfcObSTI frbPsQpOv/C1Xs6Ho4m4A6ojQj+TEfqyabowL+FdRtuad6gkx3YfWq2uaaBC3kVHc6h+ h3hA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:subject:from:to:content-language:user-agent:mime-version:date :message-id:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=0JAyhGtjyhrMUTtlGrjI85NnKO99NzA+fHTllSLq7VA=; b=PfoA0qI+LW/T27hSsP/YyPCgKoZLMlolEvorUCHQSrnbfzosQ52w9xv3IjWJauielr qeP0MWcsXKv6EmYBPNu2zkG4zKm6xhltZy1QPTvG/m2UYhPxDyRLh8inK/vApauIU6Ni d+y3dt6sDun/ToRwu3GAxyI7gOh1yPjt4yZyZSeCJfEpoLjbenpSMpsOaoSwH7vvFLE+ zWqZXwJiN84Df/mK9OyVS9bEvyNFVFHesOFw2yMV2PiaGlTcLo8KmaWZY4CQsTrlbrsa V7HcS+Ol4JMGr9cHxNMrvLozJtYP5w1eBGdjRVXXcBn0hqgC+YIAxgYsLKgWqoStRgEc hL6A== X-Gm-Message-State: AO0yUKWiHX5Ef3Vb1fjmhSx8TWxOKnDVvLc5yQqb9CmcJke53MxEtx07 T89Wrb6Sw9TB3IOumGUKecgINT/tuNHBRi0OI4M= X-Google-Smtp-Source: AK7set/XDpDNt05t7fc5FM0w++3VXZWFfRpBIhM5DTHVfjkYCkMPYnNQv2FmiGFHCLcwoc6GIWmwLw== X-Received: by 2002:a62:15d8:0:b0:5a8:b082:19dc with SMTP id 207-20020a6215d8000000b005a8b08219dcmr4662628pfv.11.1676330532396; Mon, 13 Feb 2023 15:22:12 -0800 (PST) Received: from [192.168.1.21] ([50.53.8.205]) by smtp.gmail.com with ESMTPSA id 16-20020aa79250000000b005a8851e0cddsm4604793pfp.188.2023.02.13.15.22.11 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 13 Feb 2023 15:22:11 -0800 (PST) Content-Type: multipart/mixed; boundary="------------IjHTyzeWk7KYwgyzY2wQ75TF" Message-ID: <8e729daf-7d71-6965-9687-8bc0630599b3@timescale.com> Date: Mon, 13 Feb 2023 15:22:11 -0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.7.1 Content-Language: en-US To: PostgreSQL Hackers From: Jacob Champion Subject: [PATCH] Fix unbounded authentication exchanges during PQconnectPoll() Cc: Peter Eisentraut List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk This is a multi-part message in MIME format. --------------IjHTyzeWk7KYwgyzY2wQ75TF Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Hello, This is closely related to the prior conversation at [1]. There are a couple places in CONNECTION_AWAITING_RESPONSE where libpq will read a huge number of bytes from a server that we really should have hung up on. The attached patch adds a length check for the v2 error compatibility case, and updates the v3 error handling to jump to error_return rather than asking for more data. The existing error_return paths have been updated for consistency. Thanks, --Jacob [1] https://www.postgresql.org/message-id/a5c5783d-73f3-acbc-997f-1649a7406029%40timescale.com --------------IjHTyzeWk7KYwgyzY2wQ75TF Content-Type: text/x-patch; charset=UTF-8; name="PQconnectPoll-fix-unbounded-authentication-exchanges.patch" Content-Disposition: attachment; filename*0="PQconnectPoll-fix-unbounded-authentication-exchanges.patch" Content-Transfer-Encoding: base64 RnJvbSA5NDlhNWU5OTQyMzVhNjA3MzFmZjgyN2RjZmM1MTU3MDA3ZDkzN2NhIE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBKYWNvYiBDaGFtcGlvbiA8amNoYW1waW9uQHRpbWVz Y2FsZS5jb20+CkRhdGU6IEZyaSwgMTggTm92IDIwMjIgMTM6NDU6MzQgLTA4MDAKU3ViamVj dDogW1BBVENIXSBQUWNvbm5lY3RQb2xsOiBmaXggdW5ib3VuZGVkIGF1dGhlbnRpY2F0aW9u IGV4Y2hhbmdlcwoKQSBjb3VwbGUgb2YgY29kZSBwYXRocyBpbiBDT05ORUNUSU9OX0FXQUlU SU5HX1JFU1BPTlNFIHdpbGwgZWFnZXJseSByZWFkCmJ5dGVzIG9mZiBhIGNvbm5lY3Rpb24g dGhhdCBzaG91bGQgYmUgY2xvc2VkLiBEb24ndCBsZXQgYSBtaXNiZWhhdmluZwpzZXJ2ZXIg Y2hldyB1cCBjbGllbnQgcmVzb3VyY2VzIGhlcmU7IGEgdjIgZXJyb3IgY2FuJ3QgYmUgaW5m aW5pdGVseQpsb25nLCBhbmQgYSB2MyBlcnJvciBzaG91bGQgYmUgYm91bmRlZCBieSBpdHMg b3JpZ2luYWwgbWVzc2FnZSBsZW5ndGguCgpGb3IgdGhlIGV4aXN0aW5nIGVycm9yX3JldHVy biBjYXNlcywgSSBhZGRlZCBzb21lIGFkZGl0aW9uYWwgZXJyb3IKbWVzc2FnZXMgZm9yIHN5 bW1ldHJ5IHdpdGggdGhlIG5ldyBvbmVzLgotLS0KIHNyYy9pbnRlcmZhY2VzL2xpYnBxL2Zl LWNvbm5lY3QuYyB8IDI2ICsrKysrKysrKysrKysrKysrKysrKysrLS0tCiAxIGZpbGUgY2hh bmdlZCwgMjMgaW5zZXJ0aW9ucygrKSwgMyBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9z cmMvaW50ZXJmYWNlcy9saWJwcS9mZS1jb25uZWN0LmMgYi9zcmMvaW50ZXJmYWNlcy9saWJw cS9mZS1jb25uZWN0LmMKaW5kZXggNTBiNWRmMzQ5MC4uNTIxMmFlMWE1MiAxMDA2NDQKLS0t IGEvc3JjL2ludGVyZmFjZXMvbGlicHEvZmUtY29ubmVjdC5jCisrKyBiL3NyYy9pbnRlcmZh Y2VzL2xpYnBxL2ZlLWNvbm5lY3QuYwpAQCAtMzIzMCwxMiArMzIzMCwyNCBAQCBrZWVwX2dv aW5nOgkJCQkJCS8qIFdlIHdpbGwgY29tZSBiYWNrIHRvIGhlcmUgdW50aWwgdGhlcmUgaXMK IAkJCQkJZ290byBlcnJvcl9yZXR1cm47CiAJCQkJfQogCi0JCQkJaWYgKGJlcmVzcCA9PSAn RScgJiYgKG1zZ0xlbmd0aCA8IDggfHwgbXNnTGVuZ3RoID4gMzAwMDApKQorI2RlZmluZSBN QVhfRVJSTEVOIDMwMDAwCisJCQkJaWYgKGJlcmVzcCA9PSAnRScgJiYgKG1zZ0xlbmd0aCA8 IDggfHwgbXNnTGVuZ3RoID4gTUFYX0VSUkxFTikpCiAJCQkJewogCQkJCQkvKiBIYW5kbGUg ZXJyb3IgZnJvbSBhIHByZS0zLjAgc2VydmVyICovCiAJCQkJCWNvbm4tPmluQ3Vyc29yID0g Y29ubi0+aW5TdGFydCArIDE7IC8qIHJlcmVhZCBkYXRhICovCiAJCQkJCWlmIChwcUdldHNf YXBwZW5kKCZjb25uLT5lcnJvck1lc3NhZ2UsIGNvbm4pKQogCQkJCQl7CisJCQkJCQkvKgor CQkJCQkJICogV2UgbWF5IG5vdCBoYXZlIGF1dGhlbnRpY2F0ZWQgdGhlIHNlcnZlciB5ZXQs IHNvCisJCQkJCQkgKiBkb24ndCBsZXQgdGhlIGJ1ZmZlciBncm93IGZvcmV2ZXIuCisJCQkJ CQkgKi8KKwkJCQkJCWF2YWlsID0gY29ubi0+aW5FbmQgLSBjb25uLT5pbkN1cnNvcjsKKwkJ CQkJCWlmIChhdmFpbCA+IE1BWF9FUlJMRU4pCisJCQkJCQl7CisJCQkJCQkJbGlicHFfYXBw ZW5kX2Nvbm5fZXJyb3IoY29ubiwgInNlcnZlciBzZW50IG92ZXJsb25nIHYyIGVycm9yIG1l c3NhZ2UiKTsKKwkJCQkJCQlnb3RvIGVycm9yX3JldHVybjsKKwkJCQkJCX0KKwogCQkJCQkJ LyogV2UnbGwgY29tZSBiYWNrIHdoZW4gdGhlcmUgaXMgbW9yZSBkYXRhICovCiAJCQkJCQly ZXR1cm4gUEdSRVNfUE9MTElOR19SRUFESU5HOwogCQkJCQl9CkBAIC0zMjU1LDkgKzMyNjcs MTUgQEAga2VlcF9nb2luZzoJCQkJCQkvKiBXZSB3aWxsIGNvbWUgYmFjayB0byBoZXJlIHVu dGlsIHRoZXJlIGlzCiAKIAkJCQkJZ290byBlcnJvcl9yZXR1cm47CiAJCQkJfQorI3VuZGVm IE1BWF9FUlJMRU4KIAogCQkJCS8qCiAJCQkJICogQ2FuJ3QgcHJvY2VzcyBpZiBtZXNzYWdl IGJvZHkgaXNuJ3QgYWxsIGhlcmUgeWV0LgorCQkJCSAqCisJCQkJICogQWZ0ZXIgdGhpcyBj aGVjayBwYXNzZXMsIGFueSBmdXJ0aGVyIEVPRiBkdXJpbmcgcGFyc2luZworCQkJCSAqIGlt cGxpZXMgdGhhdCB0aGUgc2VydmVyIHNlbnQgYSBiYWQvdHJ1bmNhdGVkIG1lc3NhZ2UuIFJl YWRpbmcKKwkJCQkgKiBtb3JlIGJ5dGVzIHdvbid0IGhlbHAgaW4gdGhhdCBjYXNlLCBzbyBk b24ndCByZXR1cm4KKwkJCQkgKiBQR1JFU19QT0xMSU5HX1JFQURJTkcgYWZ0ZXIgdGhpcyBw b2ludC4KIAkJCQkgKi8KIAkJCQltc2dMZW5ndGggLT0gNDsKIAkJCQlhdmFpbCA9IGNvbm4t PmluRW5kIC0gY29ubi0+aW5DdXJzb3I7CkBAIC0zMjgwLDggKzMyOTgsOCBAQCBrZWVwX2dv aW5nOgkJCQkJCS8qIFdlIHdpbGwgY29tZSBiYWNrIHRvIGhlcmUgdW50aWwgdGhlcmUgaXMK IAkJCQl7CiAJCQkJCWlmIChwcUdldEVycm9yTm90aWNlMyhjb25uLCB0cnVlKSkKIAkJCQkJ ewotCQkJCQkJLyogV2UnbGwgY29tZSBiYWNrIHdoZW4gdGhlcmUgaXMgbW9yZSBkYXRhICov Ci0JCQkJCQlyZXR1cm4gUEdSRVNfUE9MTElOR19SRUFESU5HOworCQkJCQkJbGlicHFfYXBw ZW5kX2Nvbm5fZXJyb3IoY29ubiwgInNlcnZlciBzZW50IHRydW5jYXRlZCBlcnJvciBtZXNz YWdlIik7CisJCQkJCQlnb3RvIGVycm9yX3JldHVybjsKIAkJCQkJfQogCQkJCQkvKiBPSywg d2UgcmVhZCB0aGUgbWVzc2FnZTsgbWFyayBkYXRhIGNvbnN1bWVkICovCiAJCQkJCWNvbm4t PmluU3RhcnQgPSBjb25uLT5pbkN1cnNvcjsKQEAgLTMzNTcsNiArMzM3NSw3IEBAIGtlZXBf Z29pbmc6CQkJCQkJLyogV2Ugd2lsbCBjb21lIGJhY2sgdG8gaGVyZSB1bnRpbCB0aGVyZSBp cwogCQkJCXsKIAkJCQkJaWYgKHBxR2V0TmVnb3RpYXRlUHJvdG9jb2xWZXJzaW9uMyhjb25u KSkKIAkJCQkJeworCQkJCQkJbGlicHFfYXBwZW5kX2Nvbm5fZXJyb3IoY29ubiwgInNlcnZl ciBzZW50IHRydW5jYXRlZCBwcm90b2NvbCBuZWdvdGlhdGlvbiBtZXNzYWdlIik7CiAJCQkJ CQlnb3RvIGVycm9yX3JldHVybjsKIAkJCQkJfQogCQkJCQkvKiBPSywgd2UgcmVhZCB0aGUg bWVzc2FnZTsgbWFyayBkYXRhIGNvbnN1bWVkICovCkBAIC0zMzcwLDYgKzMzODksNyBAQCBr ZWVwX2dvaW5nOgkJCQkJCS8qIFdlIHdpbGwgY29tZSBiYWNrIHRvIGhlcmUgdW50aWwgdGhl cmUgaXMKIAkJCQkvKiBHZXQgdGhlIHR5cGUgb2YgcmVxdWVzdC4gKi8KIAkJCQlpZiAocHFH ZXRJbnQoKGludCAqKSAmYXJlcSwgNCwgY29ubikpCiAJCQkJeworCQkJCQlsaWJwcV9hcHBl bmRfY29ubl9lcnJvcihjb25uLCAic2VydmVyIHNlbnQgdHJ1bmNhdGVkIGF1dGhlbnRpY2F0 aW9uIHJlcXVlc3QiKTsKIAkJCQkJZ290byBlcnJvcl9yZXR1cm47CiAJCQkJfQogCQkJCW1z Z0xlbmd0aCAtPSA0OwotLSAKMi4yNS4xCgo= --------------IjHTyzeWk7KYwgyzY2wQ75TF--