Skip to content

P
Postgres FD Implementation
Commit fee476da authored by Tom Lane's avatar Tom Lane
Browse files
Options

Improve libpq's error reporting for SSL failures. 

In many cases, pqsecure_read/pqsecure_write set up useful error messages,
which were then overwritten with useless ones by their callers.  Fix this
by defining the responsibility to set an error message to be entirely that
of the lower-level function when using SSL.

Back-patch to 8.3; the code is too different in 8.2 to be worth the
trouble.
parent d0c23026
Show whitespace changes
Inline Side-by-side
Showing with 67 additions and 18 deletions
src/interfaces/libpq/fe-misc.c
View file @ fee476da
...@@ -647,6 +647,8 @@ retry3: ...@@ -647,6 +647,8 @@ retry3:
if (SOCK_ERRNO == ECONNRESET) if (SOCK_ERRNO == ECONNRESET)
goto definitelyFailed; goto definitelyFailed;
#endif #endif
/* in SSL mode, pqsecure_read set the error message */
if (conn->ssl == NULL)
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("could not receive data from server: %s\n"), libpq_gettext("could not receive data from server: %s\n"),
SOCK_STRERROR(SOCK_ERRNO, sebuf, sizeof(sebuf))); SOCK_STRERROR(SOCK_ERRNO, sebuf, sizeof(sebuf)));
...@@ -737,6 +739,8 @@ retry4: ...@@ -737,6 +739,8 @@ retry4:
if (SOCK_ERRNO == ECONNRESET) if (SOCK_ERRNO == ECONNRESET)
goto definitelyFailed; goto definitelyFailed;
#endif #endif
/* in SSL mode, pqsecure_read set the error message */
if (conn->ssl == NULL)
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("could not receive data from server: %s\n"), libpq_gettext("could not receive data from server: %s\n"),
SOCK_STRERROR(SOCK_ERRNO, sebuf, sizeof(sebuf))); SOCK_STRERROR(SOCK_ERRNO, sebuf, sizeof(sebuf)));
...@@ -753,6 +757,8 @@ retry4: ...@@ -753,6 +757,8 @@ retry4:
* means the connection has been closed. Cope. * means the connection has been closed. Cope.
*/ */
definitelyFailed: definitelyFailed:
/* in SSL mode, pqsecure_read set the error message */
if (conn->ssl == NULL)
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext( libpq_gettext(
"server closed the connection unexpectedly\n" "server closed the connection unexpectedly\n"
...@@ -831,6 +837,8 @@ pqSendSome(PGconn *conn, int len) ...@@ -831,6 +837,8 @@ pqSendSome(PGconn *conn, int len)
#ifdef ECONNRESET #ifdef ECONNRESET
case ECONNRESET: case ECONNRESET:
#endif #endif
/* in SSL mode, pqsecure_write set the error message */
if (conn->ssl == NULL)
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext( libpq_gettext(
"server closed the connection unexpectedly\n" "server closed the connection unexpectedly\n"
...@@ -849,6 +857,8 @@ pqSendSome(PGconn *conn, int len) ...@@ -849,6 +857,8 @@ pqSendSome(PGconn *conn, int len)
return -1; return -1;
default: default:
/* in SSL mode, pqsecure_write set the error message */
if (conn->ssl == NULL)
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("could not send data to server: %s\n"), libpq_gettext("could not send data to server: %s\n"),
SOCK_STRERROR(SOCK_ERRNO, sebuf, sizeof(sebuf))); SOCK_STRERROR(SOCK_ERRNO, sebuf, sizeof(sebuf)));
......
src/interfaces/libpq/fe-secure.c
View file @ fee476da
...@@ -302,6 +302,11 @@ pqsecure_close(PGconn *conn) ...@@ -302,6 +302,11 @@ pqsecure_close(PGconn *conn)
/* /*
* Read data from a secure connection. * Read data from a secure connection.
*
* If SSL is in use, this function is responsible for putting a suitable
* message into conn->errorMessage upon error; but the caller does that
* when not using SSL. In either case, caller uses the returned errno
* to decide whether to continue/retry after error.
*/ */
ssize_t ssize_t
pqsecure_read(PGconn *conn, void *ptr, size_t len) pqsecure_read(PGconn *conn, void *ptr, size_t len)
...@@ -325,6 +330,13 @@ rloop: ...@@ -325,6 +330,13 @@ rloop:
switch (err) switch (err)
{ {
case SSL_ERROR_NONE: case SSL_ERROR_NONE:
if (n < 0)
{
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("SSL_read failed but did not provide error information\n"));
/* assume the connection is broken */
SOCK_ERRNO_SET(ECONNRESET);
}
break; break;
case SSL_ERROR_WANT_READ: case SSL_ERROR_WANT_READ:
n = 0; n = 0;
...@@ -342,7 +354,7 @@ rloop: ...@@ -342,7 +354,7 @@ rloop:
{ {
char sebuf[256]; char sebuf[256];
if (n == -1) if (n < 0)
{ {
REMEMBER_EPIPE(spinfo, SOCK_ERRNO == EPIPE); REMEMBER_EPIPE(spinfo, SOCK_ERRNO == EPIPE);
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
...@@ -353,7 +365,7 @@ rloop: ...@@ -353,7 +365,7 @@ rloop:
{ {
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("SSL SYSCALL error: EOF detected\n")); libpq_gettext("SSL SYSCALL error: EOF detected\n"));
/* assume the connection is broken */
SOCK_ERRNO_SET(ECONNRESET); SOCK_ERRNO_SET(ECONNRESET);
n = -1; n = -1;
} }
...@@ -361,14 +373,19 @@ rloop: ...@@ -361,14 +373,19 @@ rloop:
} }
case SSL_ERROR_SSL: case SSL_ERROR_SSL:
{ {
char *err = SSLerrmessage(); char *errm = SSLerrmessage();
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("SSL error: %s\n"), err); libpq_gettext("SSL error: %s\n"), errm);
SSLerrfree(err); SSLerrfree(errm);
/* assume the connection is broken */
SOCK_ERRNO_SET(ECONNRESET);
n = -1;
break;
} }
/* fall through */
case SSL_ERROR_ZERO_RETURN: case SSL_ERROR_ZERO_RETURN:
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("SSL connection has been closed unexpectedly\n"));
SOCK_ERRNO_SET(ECONNRESET); SOCK_ERRNO_SET(ECONNRESET);
n = -1; n = -1;
break; break;
...@@ -376,6 +393,8 @@ rloop: ...@@ -376,6 +393,8 @@ rloop:
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("unrecognized SSL error code: %d\n"), libpq_gettext("unrecognized SSL error code: %d\n"),
err); err);
/* assume the connection is broken */
SOCK_ERRNO_SET(ECONNRESET);
n = -1; n = -1;
break; break;
} }
...@@ -391,6 +410,11 @@ rloop: ...@@ -391,6 +410,11 @@ rloop:
/* /*
* Write data to a secure connection. * Write data to a secure connection.
*
* If SSL is in use, this function is responsible for putting a suitable
* message into conn->errorMessage upon error; but the caller does that
* when not using SSL. In either case, caller uses the returned errno
* to decide whether to continue/retry after error.
*/ */
ssize_t ssize_t
pqsecure_write(PGconn *conn, const void *ptr, size_t len) pqsecure_write(PGconn *conn, const void *ptr, size_t len)
...@@ -412,6 +436,13 @@ pqsecure_write(PGconn *conn, const void *ptr, size_t len) ...@@ -412,6 +436,13 @@ pqsecure_write(PGconn *conn, const void *ptr, size_t len)
switch (err) switch (err)
{ {
case SSL_ERROR_NONE: case SSL_ERROR_NONE:
if (n < 0)
{
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("SSL_write failed but did not provide error information\n"));
/* assume the connection is broken */
SOCK_ERRNO_SET(ECONNRESET);
}
break; break;
case SSL_ERROR_WANT_READ: case SSL_ERROR_WANT_READ:
...@@ -429,7 +460,7 @@ pqsecure_write(PGconn *conn, const void *ptr, size_t len) ...@@ -429,7 +460,7 @@ pqsecure_write(PGconn *conn, const void *ptr, size_t len)
{ {
char sebuf[256]; char sebuf[256];
if (n == -1) if (n < 0)
{ {
REMEMBER_EPIPE(spinfo, SOCK_ERRNO == EPIPE); REMEMBER_EPIPE(spinfo, SOCK_ERRNO == EPIPE);
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
...@@ -440,6 +471,7 @@ pqsecure_write(PGconn *conn, const void *ptr, size_t len) ...@@ -440,6 +471,7 @@ pqsecure_write(PGconn *conn, const void *ptr, size_t len)
{ {
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("SSL SYSCALL error: EOF detected\n")); libpq_gettext("SSL SYSCALL error: EOF detected\n"));
/* assume the connection is broken */
SOCK_ERRNO_SET(ECONNRESET); SOCK_ERRNO_SET(ECONNRESET);
n = -1; n = -1;
} }
...@@ -447,14 +479,19 @@ pqsecure_write(PGconn *conn, const void *ptr, size_t len) ...@@ -447,14 +479,19 @@ pqsecure_write(PGconn *conn, const void *ptr, size_t len)
} }
case SSL_ERROR_SSL: case SSL_ERROR_SSL:
{ {
char *err = SSLerrmessage(); char *errm = SSLerrmessage();
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("SSL error: %s\n"), err); libpq_gettext("SSL error: %s\n"), errm);
SSLerrfree(err); SSLerrfree(errm);
/* assume the connection is broken */
SOCK_ERRNO_SET(ECONNRESET);
n = -1;
break;
} }
/* fall through */
case SSL_ERROR_ZERO_RETURN: case SSL_ERROR_ZERO_RETURN:
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("SSL connection has been closed unexpectedly\n"));
SOCK_ERRNO_SET(ECONNRESET); SOCK_ERRNO_SET(ECONNRESET);
n = -1; n = -1;
break; break;
...@@ -462,6 +499,8 @@ pqsecure_write(PGconn *conn, const void *ptr, size_t len) ...@@ -462,6 +499,8 @@ pqsecure_write(PGconn *conn, const void *ptr, size_t len)
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("unrecognized SSL error code: %d\n"), libpq_gettext("unrecognized SSL error code: %d\n"),
err); err);
/* assume the connection is broken */
SOCK_ERRNO_SET(ECONNRESET);
n = -1; n = -1;
break; break;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment