From c20f2aab6ad4b41770fc8a066446c703bdf5d012 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Wed, 3 Jan 2024 17:40:38 -0500 Subject: [PATCH] Avoid masking EOF (no-password-supplied) conditions in auth.c. CheckPWChallengeAuth() would return STATUS_ERROR if the user does not exist or has no password assigned, even if the client disconnected without responding to the password challenge (as libpq often will, for example). We should return STATUS_EOF in that case, and the lower-level functions do, but this code level got it wrong since the refactoring done in 7ac955b34. This breaks the intent of not logging anything for EOF cases (cf. comments in auth_failed()) and might also confuse users of ClientAuthentication_hook. Per report from Liu Lang. Back-patch to all supported versions. Discussion: https://postgr.es/m/b725238c-539d-cb09-2bff-b5e6cb2c069c@esgyn.cn --- src/backend/libpq/auth.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index 4cb106cbe2..98b4225b60 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -818,16 +818,15 @@ CheckPWChallengeAuth(Port *port, char **logdetail) if (shadow_pass) pfree(shadow_pass); - - /* - * If get_role_password() returned error, return error, even if the - * authentication succeeded. - */ - if (!shadow_pass) + else { + /* + * If get_role_password() returned error, authentication better not + * have succeeded. + */ Assert(auth_result != STATUS_OK); - return STATUS_ERROR; } + return auth_result; }