From: Robbie Harwood <rharwood@redhat.com>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Andres Freund <andres@anarazel.de>
Cc: Craig Ringer <craig@2ndquadrant.com>
Subject: Re: [PATCH v3] GSSAPI encryption support
Date: Wed, 21 Oct 2015 12:39:27 -0400
Message-ID: <jlg7fmgkwg0.fsf@thriss.redhat.com> (raw)
In-Reply-To: <CAB7nPqT+URED7yZUPc_Soj=vfhf_r7MJD7=VonWpOFiiJE6zgg@mail.gmail.com>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
<jlgvbaao0sr.fsf@thriss.redhat.com>
<CAMsr+YE-WaD4kV4vYe0WxQhgD=hJ-EHd7oJ3=ZUF614t1HMPMA@mail.gmail.com>
<jlg1tcw6owo.fsf@thriss.redhat.com>
<CAMsr+YH0jamGmOM=mwziYQg=J-0XVp4BosPEv1n+UMaNMj4aMA@mail.gmail.com>
<20151016133459.GL3685@tamriel.snowman.net>
<CAMsr+YG1+HQ-V_kdBKkFX+XRV+bND0pJOygns-nbAuHEn2pj2w@mail.gmail.com>
<20151017021105.GP3685@tamriel.snowman.net>
<jlgwpuin3fm.fsf@thriss.redhat.com>
<CAB7nPqT+URED7yZUPc_Soj=vfhf_r7MJD7=VonWpOFiiJE6zgg@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Michael Paquier <michael.paquier@gmail.com> writes:
> On Tue, Oct 20, 2015 at 3:01 AM, Robbie Harwood wrote:
>> Stephen Frost <sfrost@snowman.net> writes:
>>> psql: lost synchronization with server: got message type "S", length 22
>>
>> which unfortunately could be a great many things. I've said this a
>> couple times now, but I really do need more information - a traffic
>> dump, a list of commands that were run, etc.; unfortunately, the surface
>> here is pretty large, and while I totally am willing to believe there
>> are bugs in the code I've written, I do not yet see them.
>
> --- a/src/interfaces/libpq/fe-protocol3.c
> +++ b/src/interfaces/libpq/fe-protocol3.c
> @@ -129,6 +129,58 @@ pqParseInput3(PGconn *conn)
> return;
> }
>
> +#ifdef ENABLE_GSS
> + /* We want to be ready in both IDLE and BUSY states
> for encryption */
> + if (id == 'g' && !conn->gss_disable_enc && conn->gctx)
> + {
> + ssize_t encEnd, next;
> [...]
> + }
> + else if (!conn->gss_disable_enc && conn->gss_auth_done &&
> + !conn->gss_decrypted_cur && id != 'E')
> + /* This could be a sync error, so let's handle
> it as such. */
> + handleSyncLoss(conn, id, msgLength);
> +#endif
>
> Hm. The out-of-sync error I am seeing in my environment is caused by
> this block when parsing 'g' messages coming from the backend that are
> considered as being GSSAPI-encrypted messages. I am still looking at
> that...
If you're hitting the else-block, that suggests a GSSAPI context is not
present at the time a GSSAPI message was received, I think.
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: rharwood@redhat.com, michael.paquier@gmail.com, sfrost@snowman.net, andres@anarazel.de, craig@2ndquadrant.com
Subject: Re: [PATCH v3] GSSAPI encryption support
In-Reply-To: <jlg7fmgkwg0.fsf@thriss.redhat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox