From: Robbie Harwood <rharwood@redhat.com>
To: David Steele <david@pgmasters.net>
To: pgsql-hackers@postgresql.org
Cc: Michael Paquier <michael.paquier@gmail.com>
Subject: Re: [PATCH v6] GSSAPI encryption support
Date: Wed, 09 Mar 2016 15:14:20 -0500
Message-ID: <jlgvb4v76jn.fsf@thriss.redhat.com> (raw)
In-Reply-To: <56E05575.9060200@pgmasters.net>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
<jlgegbkmvxl.fsf@thriss.redhat.com>
<56E05575.9060200@pgmasters.net>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
David Steele <david@pgmasters.net> writes:
> On 3/8/16 5:44 PM, Robbie Harwood wrote:
>>
>> Here's yet another version of GSSAPI encryption support. It's also
>> available for viewing on my github:
>
> I got this warning when applying the first patch in the set:
>
> ../other/v6-0001-Move-common-GSSAPI-code-into-its-own-files.patch:245:
> new blank line at EOF.
> +
> warning: 1 line adds whitespace errors.
Hah, so it does. Thanks for catching it; will fix.
> The build went fine but when testing I was unable to logon at all. I'm
> using the same methodology as in
> http://www.postgresql.org/message-id/56BE0FF9.70302@pgmasters.net except
> that I'm running against 51c0f63 and using the v6 patch set.
>
> psql simply hangs and never returns. I have attached a pcap of the
> psql/postgres session generated with:
>
> tcpdump -i lo -nnvvXSs 1514 port 5432 -w gssapi.pcap
>
> If you would like me to capture more information please let me know
> specifically how you would like me to capture it.
Thank you for the pcap! (I'm using wireshark so formats it can open are
greatly appreciated.) This suggests that the hang is my client code's
fault, but just in case: I assume nothing unusual was logged on the
server?
v6-0002-Connection-encryption-support-for-GSSAPI.patch in fe-connect.c
at around line 2518 adds a call to appendBinaryPQExpBuffer and sets
conn->inEnd. Can you try without those lines?
Can you also (e.g., with gdb or by adding printf calls) tell me what the
values of conn->inStart, conn->inEnd, and conn->inCursor any time
(should only be once) that those lines are triggered?
> I reverted to v5 and got the same behavior I was seeing with v4 and v5,
> namely that I can only logon occasionally and usually get this error:
>
> psql: expected authentication request from server, but received
>
> Using a fresh build from 51c0f63 I can logon reliably every time so I
> don't think there's an issue in my environment.
Agreed, I'm sure I've caused it somehow, though I don't know what's
wrong yet. (And if it weren't my fault but you didn't get useful errors
out, that'd be my fault anyway for not checking enough stuff!)
I don't know if this would say anything relevant, but it might be
interesting to see what the results are of applying [1] to the v5 code.
It's the same approach to solving the problem, though it happens at a
different time due to the aforementioned protocol change between v5 and
v6.
Thanks,
--Robbie
[1] https://github.com/frozencemetery/postgres/commit/82c89227a6b499ac9273044f91cff747c154629fAttachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: rharwood@redhat.com, david@pgmasters.net, michael.paquier@gmail.com
Subject: Re: [PATCH v6] GSSAPI encryption support
In-Reply-To: <jlgvb4v76jn.fsf@thriss.redhat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox