NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit25fe5ac

committed

Fix bugs in libpq's management of GSS encryption state.

GSS-related resources should be cleaned up in pqDropConnection,not freePGconn, else the wrong things happen when resettinga connection or trying to switch to a different server.It's also critical to reset conn->gssenc there.During connection setup, initialize conn->try_gss at the correctplace, else switching to a different server won't work right.Remove now-redundant cleanup of GSS resources around one (and, forsome reason, only one) pqDropConnection call in connectDBStart.Per report from Kyotaro Horiguchi that psql would freeze up,rather than successfully resetting a GSS-encrypted connectionafter a server restart.This is YA oversight in commitb0b39f7, so back-patch to v12.Discussion:https://postgr.es/m/20200710.173803.435804731896516388.horikyota.ntt@gmail.com

1 parent8d2ed66 commit25fe5acCopy full SHA for 25fe5ac

File tree

1 file changed

-28

lines changed

src/interfaces/libpq
- fe-connect.c

1 file changed

-28

lines changed

`‎src/interfaces/libpq/fe-connect.c`

Lines changed: 9 additions & 28 deletions

Original file line number	Diff line number	Diff line change
`@@ -477,6 +477,11 @@ pqDropConnection(PGconn *conn, bool flushInput)`
`477`	`477`	`{`
`478`	`478`	`OM_uint32min_s;`
`479`	`479`
	`480`	`+if (conn->gcred!=GSS_C_NO_CREDENTIAL)`
	`481`	`+{`
	`482`	`+gss_release_cred(&min_s,&conn->gcred);`
	`483`	`+conn->gcred=GSS_C_NO_CREDENTIAL;`
	`484`	`+}`
`480`	`485`	`if (conn->gctx)`
`481`	`486`	`gss_delete_sec_context(&min_s,&conn->gctx,GSS_C_NO_BUFFER);`
`482`	`487`	`if (conn->gtarg_nam)`
`@@ -496,6 +501,7 @@ pqDropConnection(PGconn *conn, bool flushInput)`
`496`	`501`	`free(conn->gss_ResultBuffer);`
`497`	`502`	`conn->gss_ResultBuffer=NULL;`
`498`	`503`	`}`
	`504`	`+conn->gssenc= false;`
`499`	`505`	`}`
`500`	`506`	`#endif`
`501`	`507`	`#ifdefENABLE_SSPI`
`@@ -2027,11 +2033,6 @@ connectDBStart(PGconn *conn)`
`2027`	`2033`	`*/`
`2028`	`2034`	`resetPQExpBuffer(&conn->errorMessage);`
`2029`	`2035`
`2030`		`-#ifdefENABLE_GSS`
`2031`		`-if (conn->gssencmode[0]=='d')/* "disable" */`
`2032`		`-conn->try_gss= false;`
`2033`		`-#endif`
`2034`		`-`
`2035`	`2036`	`/*`
`2036`	`2037`	`* Set up to try to connect to the first host. (Setting whichhost = -1 is`
`2037`	`2038`	`* a bit of a cheat, but PQconnectPoll will advance it to 0 before`
`@@ -2468,6 +2469,9 @@ PQconnectPoll(PGconn *conn)`
`2468`	`2469`	`conn->allow_ssl_try= (conn->sslmode[0]!='d');/* "disable" */`
`2469`	`2470`	`conn->wait_ssl_try= (conn->sslmode[0]=='a');/* "allow" */`
`2470`	`2471`	`#endif`
	`2472`	`+#ifdefENABLE_GSS`
	`2473`	`+conn->try_gss= (conn->gssencmode[0]!='d');/* "disable" */`
	`2474`	`+#endif`
`2471`	`2475`
`2472`	`2476`	`reset_connection_state_machine= false;`
`2473`	`2477`	`need_new_connection= true;`
`@@ -3349,12 +3353,8 @@ PQconnectPoll(PGconn *conn)`
`3349`	`3353`	`*/`
`3350`	`3354`	`if (conn->gssenc&&conn->gssencmode[0]=='p')`
`3351`	`3355`	`{`
`3352`		`-OM_uint32minor;`
`3353`		`-`
`3354`	`3356`	`/* postmaster expects us to drop the connection */`
`3355`	`3357`	`conn->try_gss= false;`
`3356`		`-conn->gssenc= false;`
`3357`		`-gss_delete_sec_context(&minor,&conn->gctx,NULL);`
`3358`	`3358`	`pqDropConnection(conn, true);`
`3359`	`3359`	`conn->status=CONNECTION_NEEDED;`
`3360`	`3360`	`gotokeep_going;`
`@@ -3906,9 +3906,6 @@ makeEmptyPGconn(void)`
`3906`	`3906`	`conn->verbosity=PQERRORS_DEFAULT;`
`3907`	`3907`	`conn->show_context=PQSHOW_CONTEXT_ERRORS;`
`3908`	`3908`	`conn->sock=PGINVALID_SOCKET;`
`3909`		`-#ifdefENABLE_GSS`
`3910`		`-conn->try_gss= true;`
`3911`		`-#endif`
`3912`	`3909`
`3913`	`3910`	`/*`
`3914`	`3911`	`* We try to send at least 8K at a time, which is the usual size of pipe`
`@@ -4065,22 +4062,6 @@ freePGconn(PGconn *conn)`
`4065`	`4062`	`free(conn->gsslib);`
`4066`	`4063`	`if (conn->connip)`
`4067`	`4064`	`free(conn->connip);`
`4068`		`-#ifdefENABLE_GSS`
`4069`		`-if (conn->gcred!=GSS_C_NO_CREDENTIAL)`
`4070`		`-{`
`4071`		`-OM_uint32minor;`
`4072`		`-`
`4073`		`-gss_release_cred(&minor,&conn->gcred);`
`4074`		`-conn->gcred=GSS_C_NO_CREDENTIAL;`
`4075`		`-}`
`4076`		`-if (conn->gctx)`
`4077`		`-{`
`4078`		`-OM_uint32minor;`
`4079`		`-`
`4080`		`-gss_delete_sec_context(&minor,&conn->gctx,GSS_C_NO_BUFFER);`
`4081`		`-conn->gctx=NULL;`
`4082`		`-}`
`4083`		`-#endif`
`4084`	`4065`	`/* Note that conn->Pfdebug is not ours to close or free */`
`4085`	`4066`	`if (conn->last_query)`
`4086`	`4067`	`free(conn->last_query);`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit25fe5ac

File tree

1 file changed

1 file changed

`‎src/interfaces/libpq/fe-connect.c`

0 commit comments