Be more wary about OpenSSL not setting errno on error.

OpenSSL will sometimes return SSL_ERROR_SYSCALL without having set
errno; this is apparently a reflection of recv(2)'s habit of not
setting errno when reporting EOF.  Ensure that we treat such cases
the same as read EOF.  Previously, we'd frequently report them like
"could not accept SSL connection: Success" which is confusing, or
worse report them with an unrelated errno left over from some
previous syscall.

To fix, ensure that errno is zeroed immediately before the call,
and report its value only when it's not zero afterwards; otherwise
report EOF.

For consistency, I've applied the same coding pattern in libpq's
pqsecure_raw_read().  Bare recv(2) shouldn't really return -1 without
setting errno, but in case it does we might as well cope.

Per report from Andres Freund.  Back-patch to all supported versions.

Discussion: https://postgr.es/m/20231208181451.deqnflwxqoehhxpe@awork3.anarazel.de

diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index aed8a75345aaf4059cd5a1f516d36016b3e05f12..ed13e8b06dfd401cb95b67d688fff708ed6a5e6f 100644 (file)
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -457,6 +457,7 @@ aloop:
         * per-thread error queue following another call to an OpenSSL I/O
         * routine.
         */
+       errno = 0;
        ERR_clear_error();
        r = SSL_accept(port->ssl);
        if (r <= 0)
@@ -493,7 +494,7 @@ aloop:
                                                                                 WAIT_EVENT_SSL_OPEN_SERVER);
                                goto aloop;
                        case SSL_ERROR_SYSCALL:
-                               if (r < 0)
+                               if (r < 0 && errno != 0)
                                        ereport(COMMERROR,
                                                        (errcode_for_socket_access(),
                                                         errmsg("could not accept SSL connection: %m")));
@@ -727,7 +728,7 @@ be_tls_read(Port *port, void *ptr, size_t len, int *waitfor)
                        break;
                case SSL_ERROR_SYSCALL:
                        /* leave it to caller to ereport the value of errno */
-                       if (n != -1)
+                       if (n != -1 || errno == 0)
                        {
                                errno = ECONNRESET;
                                n = -1;
@@ -785,8 +786,14 @@ be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
                        n = -1;
                        break;
                case SSL_ERROR_SYSCALL:
-                       /* leave it to caller to ereport the value of errno */
-                       if (n != -1)
+
+                       /*
+                        * Leave it to caller to ereport the value of errno.  However, if
+                        * errno is still zero then assume it's a read EOF situation, and
+                        * report ECONNRESET.  (This seems possible because SSL_write can
+                        * also do reads.)
+                        */
+                       if (n != -1 || errno == 0)
                        {
                                errno = ECONNRESET;
                                n = -1;

diff --git a/src/backend/libpq/pqcomm.c b/src/backend/libpq/pqcomm.c
index 75392a8bb7c61419b7879e5f224447807a9649b7..bb9fa77cd4fe7d0fd310c790e01f5fc3df169002 100644 (file)
--- a/src/backend/libpq/pqcomm.c
+++ b/src/backend/libpq/pqcomm.c
@@ -954,6 +954,8 @@ pq_recvbuf(void)
        {
                int                     r;
 
+               errno = 0;
+
                r = secure_read(MyProcPort, PqRecvBuffer + PqRecvLength,
                                                PQ_RECV_BUFFER_SIZE - PqRecvLength);
 
@@ -966,10 +968,13 @@ pq_recvbuf(void)
                         * Careful: an ereport() that tries to write to the client would
                         * cause recursion to here, leading to stack overflow and core
                         * dump!  This message must go *only* to the postmaster log.
+                        *
+                        * If errno is zero, assume it's EOF and let the caller complain.
                         */
-                       ereport(COMMERROR,
-                                       (errcode_for_socket_access(),
-                                        errmsg("could not receive data from client: %m")));
+                       if (errno != 0)
+                               ereport(COMMERROR,
+                                               (errcode_for_socket_access(),
+                                                errmsg("could not receive data from client: %m")));
                        return EOF;
                }
                if (r == 0)
@@ -1046,6 +1051,8 @@ pq_getbyte_if_available(unsigned char *c)
        /* Put the socket into non-blocking mode */
        socket_set_nonblocking(true);
 
+       errno = 0;
+
        r = secure_read(MyProcPort, c, 1);
        if (r < 0)
        {
@@ -1062,10 +1069,13 @@ pq_getbyte_if_available(unsigned char *c)
                         * Careful: an ereport() that tries to write to the client would
                         * cause recursion to here, leading to stack overflow and core
                         * dump!  This message must go *only* to the postmaster log.
+                        *
+                        * If errno is zero, assume it's EOF and let the caller complain.
                         */
-                       ereport(COMMERROR,
-                                       (errcode_for_socket_access(),
-                                        errmsg("could not receive data from client: %m")));
+                       if (errno != 0)
+                               ereport(COMMERROR,
+                                               (errcode_for_socket_access(),
+                                                errmsg("could not receive data from client: %m")));
                        r = EOF;
                }
        }

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index d863d279a07bdc1698e6fb30becec7446fb4499a..61f37678a6b9a8a87f6cf7fb047c7c2a4c69f046 100644 (file)
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -209,7 +209,7 @@ rloop:
                         */
                        goto rloop;
                case SSL_ERROR_SYSCALL:
-                       if (n < 0)
+                       if (n < 0 && SOCK_ERRNO != 0)
                        {
                                result_errno = SOCK_ERRNO;
                                if (result_errno == EPIPE ||
@@ -317,7 +317,13 @@ pgtls_write(PGconn *conn, const void *ptr, size_t len)
                        n = 0;
                        break;
                case SSL_ERROR_SYSCALL:
-                       if (n < 0)
+
+                       /*
+                        * If errno is still zero then assume it's a read EOF situation,
+                        * and report EOF.  (This seems possible because SSL_write can
+                        * also do reads.)
+                        */
+                       if (n < 0 && SOCK_ERRNO != 0)
                        {
                                result_errno = SOCK_ERRNO;
                                if (result_errno == EPIPE || result_errno == ECONNRESET)
@@ -1479,10 +1485,12 @@ open_client_SSL(PGconn *conn)
 {
        int                     r;
 
+       SOCK_ERRNO_SET(0);
        ERR_clear_error();
        r = SSL_connect(conn->ssl);
        if (r <= 0)
        {
+               int                     save_errno = SOCK_ERRNO;
                int                     err = SSL_get_error(conn->ssl, r);
                unsigned long ecode;
 
@@ -1499,10 +1507,10 @@ open_client_SSL(PGconn *conn)
                                {
                                        char            sebuf[PG_STRERROR_R_BUFLEN];
 
-                                       if (r == -1)
+                                       if (r == -1 && save_errno != 0)
                                                appendPQExpBuffer(&conn->errorMessage,
                                                                                  libpq_gettext("SSL SYSCALL error: %s\n"),
-                                                                                 SOCK_STRERROR(SOCK_ERRNO, sebuf, sizeof(sebuf)));
+                                                                                 SOCK_STRERROR(save_errno, sebuf, sizeof(sebuf)));
                                        else
                                                appendPQExpBufferStr(&conn->errorMessage,
                                                                                         libpq_gettext("SSL SYSCALL error: EOF detected\n"));

diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c
index a1dc7b796d16943d1515257c9f780204784ae893..4c85b7299cc9fd2ea3b61a3e22b4c4692fa5244c 100644 (file)
--- a/src/interfaces/libpq/fe-secure.c
+++ b/src/interfaces/libpq/fe-secure.c
@@ -235,6 +235,8 @@ pqsecure_raw_read(PGconn *conn, void *ptr, size_t len)
        int                     result_errno = 0;
        char            sebuf[PG_STRERROR_R_BUFLEN];
 
+       SOCK_ERRNO_SET(0);
+
        n = recv(conn->sock, ptr, len, 0);
 
        if (n < 0)
@@ -262,6 +264,11 @@ pqsecure_raw_read(PGconn *conn, void *ptr, size_t len)
                                                                                                   "\tbefore or while processing the request.\n"));
                                break;
 
+                       case 0:
+                               /* If errno didn't get set, treat it as regular EOF */
+                               n = 0;
+                               break;
+
                        default:
                                appendPQExpBuffer(&conn->errorMessage,
                                                                  libpq_gettext("could not receive data from server: %s\n"),