GSSAPI error message improvements

Make the error messages around GSSAPI encryption a bit clearer.  Tweak
some messages to avoid plural problems.

Also make a code change for clarity.  Using "conf" for "confidential"
is quite confusing.  Using "conf_state" is perhaps not much better but
that's what the GSSAPI documentation uses, so there is at least some
hope of understanding it.

diff --git a/src/backend/libpq/be-secure-gssapi.c b/src/backend/libpq/be-secure-gssapi.c
index 92f39c113a7a3ab15d66c80a2c29b5dd789b5784..a0855a9401e0e9b314ecf31a867931a99328e557 100644 (file)
--- a/src/backend/libpq/be-secure-gssapi.c
+++ b/src/backend/libpq/be-secure-gssapi.c
@@ -99,7 +99,7 @@ be_gssapi_write(Port *port, void *ptr, size_t len)
                                        minor;
                gss_buffer_desc input,
                                        output;
-               int                     conf = 0;
+               int                     conf_state = 0;
                uint32          netlen;
                pg_gssinfo *gss = port->gss;
 
@@ -172,18 +172,19 @@ be_gssapi_write(Port *port, void *ptr, size_t len)
 
                /* Create the next encrypted packet */
                major = gss_wrap(&minor, gss->ctx, 1, GSS_C_QOP_DEFAULT,
-                                                &input, &conf, &output);
+                                                &input, &conf_state, &output);
                if (major != GSS_S_COMPLETE)
                        pg_GSS_error(FATAL, gettext_noop("GSSAPI wrap error"), major, minor);
 
-               if (conf == 0)
+               if (conf_state == 0)
                        ereport(FATAL,
-                                       (errmsg("GSSAPI did not provide confidentiality")));
+                                       (errmsg("outgoing GSSAPI message would not use confidentiality")));
 
                if (output.length > PQ_GSS_SEND_BUFFER_SIZE - sizeof(uint32))
                        ereport(FATAL,
-                                       (errmsg("server tried to send oversize GSSAPI packet: %zu bytes",
-                                                       (size_t) output.length)));
+                                       (errmsg("server tried to send oversize GSSAPI packet (%zu > %zu)",
+                                                       (size_t) output.length,
+                                                       PQ_GSS_SEND_BUFFER_SIZE - sizeof(uint32))));
 
                bytes_encrypted += input.length;
                bytes_to_encrypt -= input.length;
@@ -216,7 +217,7 @@ be_gssapi_read(Port *port, void *ptr, size_t len)
        ssize_t         ret;
        size_t          bytes_to_return = len;
        size_t          bytes_returned = 0;
-       int                     conf = 0;
+       int                     conf_state = 0;
        pg_gssinfo *gss = port->gss;
 
        /*
@@ -299,8 +300,9 @@ be_gssapi_read(Port *port, void *ptr, size_t len)
                /* Check for over-length packet */
                if (input.length > PQ_GSS_RECV_BUFFER_SIZE - sizeof(uint32))
                        ereport(FATAL,
-                                       (errmsg("oversize GSSAPI packet sent by the client: %zu bytes",
-                                                       (size_t) input.length)));
+                                       (errmsg("oversize GSSAPI packet sent by the client (%zu > %zu)",
+                                                       (size_t) input.length,
+                                                       PQ_GSS_RECV_BUFFER_SIZE - sizeof(uint32))));
 
                /*
                 * Read as much of the packet as we are able to on this call into
@@ -338,14 +340,14 @@ be_gssapi_read(Port *port, void *ptr, size_t len)
                output.length = 0;
                input.value = PqGSSRecvBuffer + sizeof(uint32);
 
-               major = gss_unwrap(&minor, gss->ctx, &input, &output, &conf, NULL);
+               major = gss_unwrap(&minor, gss->ctx, &input, &output, &conf_state, NULL);
                if (major != GSS_S_COMPLETE)
                        pg_GSS_error(FATAL, gettext_noop("GSSAPI unwrap error"),
                                                 major, minor);
 
-               if (conf == 0)
+               if (conf_state == 0)
                        ereport(FATAL,
-                                       (errmsg("GSSAPI did not provide confidentiality")));
+                                       (errmsg("incoming GSSAPI message did not use confidentiality")));
 
                memcpy(PqGSSResultBuffer, output.value, output.length);
 
@@ -497,8 +499,9 @@ secure_open_gssapi(Port *port)
                 */
                if (input.length > PQ_GSS_RECV_BUFFER_SIZE)
                        ereport(FATAL,
-                                       (errmsg("oversize GSSAPI packet sent by the client: %zu bytes",
-                                                       (size_t) input.length)));
+                                       (errmsg("oversize GSSAPI packet sent by the client (%zu > %d)",
+                                                       (size_t) input.length,
+                                                       PQ_GSS_RECV_BUFFER_SIZE)));
 
                /*
                 * Get the rest of the packet so we can pass it to GSSAPI to accept
@@ -518,7 +521,7 @@ secure_open_gssapi(Port *port)
                                                                           NULL, NULL);
                if (GSS_ERROR(major))
                {
-                       pg_GSS_error(ERROR, gettext_noop("GSSAPI context error"),
+                       pg_GSS_error(ERROR, gettext_noop("could not accept GSSAPI security context"),
                                                 major, minor);
                        gss_release_buffer(&minor, &output);
                        return -1;
@@ -545,8 +548,9 @@ secure_open_gssapi(Port *port)
 
                        if (output.length > PQ_GSS_SEND_BUFFER_SIZE - sizeof(uint32))
                                ereport(FATAL,
-                                               (errmsg("server tried to send oversize GSSAPI packet: %zu bytes",
-                                                               (size_t) output.length)));
+                                               (errmsg("server tried to send oversize GSSAPI packet (%zu > %zu)",
+                                                               (size_t) output.length,
+                                                               PQ_GSS_SEND_BUFFER_SIZE - sizeof(uint32))));
 
                        memcpy(PqGSSSendBuffer, (char *) &netlen, sizeof(uint32));
                        PqGSSSendPointer += sizeof(uint32);

diff --git a/src/interfaces/libpq/fe-secure-gssapi.c b/src/interfaces/libpq/fe-secure-gssapi.c
index 4fdd3887eddc5b2eccf8ca3233d69b7a2a049113..095750db1faaa45ff20dd0f74adf5e83e4608e1f 100644 (file)
--- a/src/interfaces/libpq/fe-secure-gssapi.c
+++ b/src/interfaces/libpq/fe-secure-gssapi.c
@@ -87,7 +87,7 @@ pg_GSS_write(PGconn *conn, const void *ptr, size_t len)
         */
        while (bytes_to_encrypt || PqGSSSendPointer)
        {
-               int                     conf = 0;
+               int                     conf_state = 0;
                uint32          netlen;
 
                /*
@@ -154,24 +154,25 @@ pg_GSS_write(PGconn *conn, const void *ptr, size_t len)
 
                /* Create the next encrypted packet */
                major = gss_wrap(&minor, conn->gctx, 1, GSS_C_QOP_DEFAULT,
-                                                &input, &conf, &output);
+                                                &input, &conf_state, &output);
                if (major != GSS_S_COMPLETE)
                {
                        pg_GSS_error(libpq_gettext("GSSAPI wrap error"), conn, major, minor);
                        goto cleanup;
                }
-               else if (conf == 0)
+               else if (conf_state == 0)
                {
                        printfPQExpBuffer(&conn->errorMessage,
-                                                         libpq_gettext("GSSAPI did not provide confidentiality\n"));
+                                                         libpq_gettext("outgoing GSSAPI message would not use confidentiality\n"));
                        goto cleanup;
                }
 
                if (output.length > PQ_GSS_SEND_BUFFER_SIZE - sizeof(uint32))
                {
                        printfPQExpBuffer(&conn->errorMessage,
-                                                         libpq_gettext("client tried to send oversize GSSAPI packet: %zu bytes\n"),
-                                                         (size_t) output.length);
+                                                         libpq_gettext("client tried to send oversize GSSAPI packet (%zu > %zu)\n"),
+                                                         (size_t) output.length,
+                                                         PQ_GSS_SEND_BUFFER_SIZE - sizeof(uint32));
                        goto cleanup;
                }
 
@@ -229,7 +230,7 @@ pg_GSS_read(PGconn *conn, void *ptr, size_t len)
         */
        while (bytes_to_return)
        {
-               int                     conf = 0;
+               int                     conf_state = 0;
 
                /* Check if we have data in our buffer that we can return immediately */
                if (PqGSSResultPointer < PqGSSResultLength)
@@ -287,7 +288,9 @@ pg_GSS_read(PGconn *conn, void *ptr, size_t len)
                if (input.length > PQ_GSS_RECV_BUFFER_SIZE - sizeof(uint32))
                {
                        printfPQExpBuffer(&conn->errorMessage,
-                                                         libpq_gettext("GSSAPI did not provide confidentiality\n"));
+                                                         libpq_gettext("oversize GSSAPI packet sent by the server (%zu > %zu)\n"),
+                                                         (size_t) input.length,
+                                                         PQ_GSS_RECV_BUFFER_SIZE - sizeof(uint32));
                        ret = -1;
                        goto cleanup;
                }
@@ -318,7 +321,7 @@ pg_GSS_read(PGconn *conn, void *ptr, size_t len)
                output.length = 0;
                input.value = PqGSSRecvBuffer + sizeof(uint32);
 
-               major = gss_unwrap(&minor, conn->gctx, &input, &output, &conf, NULL);
+               major = gss_unwrap(&minor, conn->gctx, &input, &output, &conf_state, NULL);
                if (major != GSS_S_COMPLETE)
                {
                        pg_GSS_error(libpq_gettext("GSSAPI unwrap error"), conn,
@@ -326,10 +329,10 @@ pg_GSS_read(PGconn *conn, void *ptr, size_t len)
                        ret = -1;
                        goto cleanup;
                }
-               else if (conf == 0)
+               else if (conf_state == 0)
                {
                        printfPQExpBuffer(&conn->errorMessage,
-                                                         libpq_gettext("GSSAPI did not provide confidentiality\n"));
+                                                         libpq_gettext("incoming GSSAPI message did not use confidentiality\n"));
                        ret = -1;
                        goto cleanup;
                }
@@ -491,8 +494,9 @@ pqsecure_open_gss(PGconn *conn)
                if (input.length > PQ_GSS_RECV_BUFFER_SIZE - sizeof(uint32))
                {
                        printfPQExpBuffer(&conn->errorMessage,
-                                                         libpq_gettext("oversize GSSAPI packet sent by the server: %zu bytes\n"),
-                                                         (size_t) input.length);
+                                                         libpq_gettext("oversize GSSAPI packet sent by the server (%zu > %zu)\n"),
+                                                         (size_t) input.length,
+                                                         PQ_GSS_RECV_BUFFER_SIZE - sizeof(uint32));
                        return PGRES_POLLING_FAILED;
                }
 
@@ -536,7 +540,7 @@ pqsecure_open_gss(PGconn *conn)
 
        if (GSS_ERROR(major))
        {
-               pg_GSS_error(libpq_gettext("GSSAPI context establishment error"),
+               pg_GSS_error(libpq_gettext("could not initiate GSSAPI security context"),
                                         conn, major, minor);
                return PGRES_POLLING_FAILED;
        }