From: Robbie Harwood <rharwood@redhat.com>
To: David Steele <david@pgmasters.net>, pgsql-hackers@postgresql.org
Cc: Michael Paquier <michael.paquier@gmail.com>
Subject: Re: [PATCH v6] GSSAPI encryption support
In-Reply-To: <56E05575.9060200@pgmasters.net>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
 <jlgegbkmvxl.fsf@thriss.redhat.com> <56E05575.9060200@pgmasters.net>
User-Agent: Notmuch/0.21 (http://notmuchmail.org) Emacs/24.5.1
 (x86_64-pc-linux-gnu)
Date: Wed, 09 Mar 2016 15:14:20 -0500
Message-ID: <jlgvb4v76jn.fsf@thriss.redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha1; protocol="application/pgp-signature"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

David Steele <david@pgmasters.net> writes:

> On 3/8/16 5:44 PM, Robbie Harwood wrote:
>>=20
>> Here's yet another version of GSSAPI encryption support.  It's also
>> available for viewing on my github:
>
> I got this warning when applying the first patch in the set:
>
> ../other/v6-0001-Move-common-GSSAPI-code-into-its-own-files.patch:245:
> new blank line at EOF.
> +
> warning: 1 line adds whitespace errors.

Hah, so it does.  Thanks for catching it; will fix.

> The build went fine but when testing I was unable to logon at all.  I'm
> using the same methodology as in
> http://www.postgresql.org/message-id/56BE0FF9.70302@pgmasters.net except
> that I'm running against 51c0f63 and using the v6 patch set.
>
> psql simply hangs and never returns.  I have attached a pcap of the
> psql/postgres session generated with:
>
> tcpdump -i lo -nnvvXSs 1514 port 5432 -w gssapi.pcap
>
> If you would like me to capture more information please let me know
> specifically how you would like me to capture it.

Thank you for the pcap!  (I'm using wireshark so formats it can open are
greatly appreciated.)  This suggests that the hang is my client code's
fault, but just in case: I assume nothing unusual was logged on the
server?

v6-0002-Connection-encryption-support-for-GSSAPI.patch in fe-connect.c
at around line 2518 adds a call to appendBinaryPQExpBuffer and sets
conn->inEnd.  Can you try without those lines?

Can you also (e.g., with gdb or by adding printf calls) tell me what the
values of conn->inStart, conn->inEnd, and conn->inCursor any time
(should only be once) that those lines are triggered?

> I reverted to v5 and got the same behavior I was seeing with v4 and v5,
> namely that I can only logon occasionally and usually get this error:
>
> psql: expected authentication request from server, but received
>
> Using a fresh build from 51c0f63 I can logon reliably every time so I
> don't think there's an issue in my environment.

Agreed, I'm sure I've caused it somehow, though I don't know what's
wrong yet.  (And if it weren't my fault but you didn't get useful errors
out, that'd be my fault anyway for not checking enough stuff!)

I don't know if this would say anything relevant, but it might be
interesting to see what the results are of applying [1] to the v5 code.
It's the same approach to solving the problem, though it happens at a
different time due to the aforementioned protocol change between v5 and
v6.

Thanks,
=2D-Robbie

[1] https://github.com/frozencemetery/postgres/commit/82c89227a6b499ac92730=
44f91cff747c154629f

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJW4IQdAAoJECUy+RdqlaRC/N8QAIWTJKHJAv9BVCDeD54Ri4ZE
GXSVVpzzBLRJ9ePQ7g3N1q9zz+QjLq2Q9rPl17hynQtB51ACsdKTs4y5YNgihrah
8u2V4ComNjmZfR/LaONhWxJ6DqpOojblaTDoTGzP1pw+1aViV75ezLhDS4wifMdH
P1J9LQZ0c1CqZwE6TaYNhvFUIqmNm3fCI4g1puU6dsrxkPn0vTAseaQKDvFn6g9j
df3uQdHeG/X0bEt/e2F+mwF7s4JmUEQtrcNzuOBX0oYt0xQ8Tz5y9v9i7fzCRvbe
EqQvIXmHNQDZ4CuvURx/7cMYbdGrEhRJH5VH+p2PVG3V2Hsjx0Fe5cuubFk+iDhc
7ip/D0fg87oWRPug9cbQcQXYnCfWGDZPl6JLh6ebdZW5geJHG+DRMj6taghdsyWO
ym3Qz7HVs7GKltRk2DATalu6VRve5aJumw26Ng3xy3bPsxbVIIQrJpY41xFtLHve
f4CxjEN+YDubzmRCmyZ/tlEf7HoduH9v+loCFa9kPqb42/R/c9yZrWAVk71pAGi9
NZhMMXxUTfV9aMT8+BLUj29/50TD5XzCI0Z7DlX2xHd7bpTlGHe2K3ax+5SjGWGk
OAZMC9ro4ugH+ksfA90AkW8KkBpwIwRFyaDll8pfrYwygDV3tDeX9pK2CkujilSA
LtOA2NhST1pI3P0yPf4l
=yJpD
-----END PGP SIGNATURE-----
--=-=-=--