mirrors
/
postgres
mirror of https://github.com/postgres/postgres
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix inconsistent error handling for GSS encryption in PQconnectPoll() 

The error cases for TLS and GSS encryption were inconsistent.  After TLS
fails, the connection is marked as dead and follow-up calls of
PQconnectPoll() would return immediately, but GSS encryption was not
doing that, so the connection would still have been allowed to enter the
GSS handling code.  This was handled incorrectly when gssencmode was set
to "require".  "prefer" was working correctly, and this could not happen
under "disable" as GSS encryption would not be attempted.

This commit makes the error handling of GSS encryption on par with TLS
portion, fixing the case of gssencmode=require.

Reported-by: Jacob Champion
Author: Michael Paquier
Reviewed-by: Jacob Champion, Stephen Frost
Discussion: https://postgr.es/m/23787477-5fe1-a161-6d2a-e459f74c4713@timescale.com
Backpatch-through: 12
This commit is contained in:
Michael Paquier 2023-03-13 16:36:20 +09:00
parent bf32ec2256
commit e0a09d4e35
1 changed files with 14 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
src/interfaces/libpq/fe-connect.c
View File

@ -3148,17 +3148,22 @@ keep_going: /* We will come back to here until there is
conn->status = CONNECTION_MADE;
return PGRES_POLLING_WRITING;
}
else if (pollres == PGRES_POLLING_FAILED &&
conn->gssencmode[0] == 'p')
else if (pollres == PGRES_POLLING_FAILED)
{
/*
* We failed, but we can retry on "prefer". Have to drop
* the current connection to do so, though.
*/
conn->try_gss = false;
need_new_connection = true;
goto keep_going;
if (conn->gssencmode[0] == 'p')
{
/*
* We failed, but we can retry on "prefer". Have to
* drop the current connection to do so, though.
*/
conn->try_gss = false;
need_new_connection = true;
goto keep_going;
}
/* Else it's a hard failure */
goto error_return;
}
/* Else, return POLLING_READING or POLLING_WRITING status */
return pollres;
#else /* !ENABLE_GSS */
/* unreachable */