From: Robbie Harwood <rharwood@redhat.com>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Stephen Frost <sfrost@snowman.net>,
 PostgreSQL mailing lists <pgsql-hackers@postgresql.org>,
 Andres Freund <andres@anarazel.de>, Craig Ringer <craig@2ndquadrant.com>
Subject: Re: [PATCH v3] GSSAPI encryption support
In-Reply-To: 
 <CAB7nPqT+URED7yZUPc_Soj=vfhf_r7MJD7=VonWpOFiiJE6zgg@mail.gmail.com>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
 <jlgvbaao0sr.fsf@thriss.redhat.com>
 <CAMsr+YE-WaD4kV4vYe0WxQhgD=hJ-EHd7oJ3=ZUF614t1HMPMA@mail.gmail.com>
 <jlg1tcw6owo.fsf@thriss.redhat.com>
 <CAMsr+YH0jamGmOM=mwziYQg=J-0XVp4BosPEv1n+UMaNMj4aMA@mail.gmail.com>
 <20151016133459.GL3685@tamriel.snowman.net>
 <CAMsr+YG1+HQ-V_kdBKkFX+XRV+bND0pJOygns-nbAuHEn2pj2w@mail.gmail.com>
 <20151017021105.GP3685@tamriel.snowman.net>
 <jlgwpuin3fm.fsf@thriss.redhat.com>
 <CAB7nPqT+URED7yZUPc_Soj=vfhf_r7MJD7=VonWpOFiiJE6zgg@mail.gmail.com>
User-Agent: Notmuch/0.18.2 (http://notmuchmail.org) Emacs/24.4.1
 (x86_64-pc-linux-gnu)
Date: Wed, 21 Oct 2015 12:39:27 -0400
Message-ID: <jlg7fmgkwg0.fsf@thriss.redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha1; protocol="application/pgp-signature"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

--=-=-=
Content-Type: text/plain

Michael Paquier <michael.paquier@gmail.com> writes:

> On Tue, Oct 20, 2015 at 3:01 AM, Robbie Harwood wrote:
>> Stephen Frost <sfrost@snowman.net> writes:
>>> psql: lost synchronization with server: got message type "S", length 22
>>
>> which unfortunately could be a great many things.  I've said this a
>> couple times now, but I really do need more information - a traffic
>> dump, a list of commands that were run, etc.; unfortunately, the surface
>> here is pretty large, and while I totally am willing to believe there
>> are bugs in the code I've written, I do not yet see them.
>
> --- a/src/interfaces/libpq/fe-protocol3.c
> +++ b/src/interfaces/libpq/fe-protocol3.c
> @@ -129,6 +129,58 @@ pqParseInput3(PGconn *conn)
>                         return;
>                 }
>
> +#ifdef ENABLE_GSS
> +               /* We want to be ready in both IDLE and BUSY states
> for encryption */
> +               if (id == 'g' && !conn->gss_disable_enc && conn->gctx)
> +               {
> +                       ssize_t encEnd, next;
> [...]
> +               }
> +               else if (!conn->gss_disable_enc && conn->gss_auth_done &&
> +                                !conn->gss_decrypted_cur && id != 'E')
> +                       /* This could be a sync error, so let's handle
> it as such. */
> +                       handleSyncLoss(conn, id, msgLength);
> +#endif
>
> Hm. The out-of-sync error I am seeing in my environment is caused by
> this block when parsing 'g' messages coming from the backend that are
> considered as being GSSAPI-encrypted messages. I am still looking at
> that...

If you're hitting the else-block, that suggests a GSSAPI context is not
present at the time a GSSAPI message was received, I think.

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJWJ7+/AAoJECUy+RdqlaRCKaMQAJPlvMtMBIZQEvfXF6OFOLzF
8loBhCu+9LEmHYKo/3oucaIlyhX9ycwVrf1egrkK/LMJLtt42Ix2C2X0DRC97Pl6
HkvpXhxdc/E1qSE/0fNrF2eYy4kCEPcFgJKqztVX2H4mMd7Pfq39LfHMxY5ey8er
4nkqSRzHQ9R2DEIH5hw+ZlQqY+UlPANkmwXTdpNKUOZJSuaxAZq0vEytp97tkUgs
qoBB+PV6owX93i3z3xj3Gtc3cMQeKC1jP2NpxGG3VLVj7u1iP94RXGpqNo6zqkvm
KQRn2IeM/GwxETGaeoiAtglXAWJ17vZysBzJaEPNE2RLPoXoypYqPtyawg7Q5GE5
oMovwfvyw/6pvIFrQc25HETIW+TMrymBL/inzweotGXm8dpqA7HpkCFUD7qZjXMW
ImxVy1pKsXAVhxcOkhz0diNFB5WemHHa42QwQ9zHpa0b1q2EJa4kCdRJZeLLYOxm
oW+IhQoX+ofhtshnhd8UWCDww0YizxlJRRsDkGCVG9jp/VVr6Z0IT29L5MVx7q/Y
tyXilg5HO5zUkUsvFtiB2nuGQrYswx4RXU8YB40CFhCyfPxXpL/GLYILMRao4wWY
ew0N8dj343M1p3aQ3+FjMJed6qSzRuC86MEZzGzXlj98l91aG1WTttoXXipS6Ok0
sp72OjWGgpZc33Fe94x+
=0UTf
-----END PGP SIGNATURE-----
--=-=-=--