pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Andres Freund <andres@anarazel.de>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Robbie Harwood <rharwood@redhat.com>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Craig Ringer <craig@2ndquadrant.com>
Subject: Re: [PATCH v3] GSSAPI encryption support
Date: Thu, 22 Oct 2015 11:00:26 +0200
Message-ID: <20151022090026.GB8952@awork2.anarazel.de> (raw)
In-Reply-To: <CAB7nPqSRFG=U3Q_R-7FPvMjNH4TsGfTdZPa7c6x868iw_h0cvw@mail.gmail.com>
References: <jlg1tcw6owo.fsf@thriss.redhat.com>
	<CAMsr+YH0jamGmOM=mwziYQg=J-0XVp4BosPEv1n+UMaNMj4aMA@mail.gmail.com>
	<20151016133459.GL3685@tamriel.snowman.net>
	<CAMsr+YG1+HQ-V_kdBKkFX+XRV+bND0pJOygns-nbAuHEn2pj2w@mail.gmail.com>
	<20151017021105.GP3685@tamriel.snowman.net>
	<jlgwpuin3fm.fsf@thriss.redhat.com>
	<CAB7nPqT+URED7yZUPc_Soj=vfhf_r7MJD7=VonWpOFiiJE6zgg@mail.gmail.com>
	<CAB7nPqTL1SjaYn7pwb86mW1M+469=ofyyRt1Oh9dyFC_bAf_iw@mail.gmail.com>
	<jlgbnbskwya.fsf@thriss.redhat.com>
	<CAB7nPqSRFG=U3Q_R-7FPvMjNH4TsGfTdZPa7c6x868iw_h0cvw@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On 2015-10-22 16:47:09 +0900, Michael Paquier wrote:
> Hm, and that's why you chose this way of going. My main concern about
> this patch is that it adds on top of the existing Postgres protocol a
> layer to encrypt and decrypt the messages between server and client
> based on GSSAPI. All messages transmitted between client and server
> are changed to 'g' messages on the fly and switched back to their
> original state at reception. This is symbolized by the four routines
> you added in the patch in this purpose, two for frontend and two for
> backend, each one for encryption and decryption. I may be wrong of
> course, but it seems to me that this approach will not survive
> committer-level screening because of the fact that context-level
> things invade higher level protocol messages.

Agreed. At least one committer here indeed thinks this approach is not
acceptable (and I've said so upthread).

Greetings,

Andres Freund


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (220+ messages)  latest in thread

Message-ID: <20151022090026.GB8952@awork2.anarazel.de>
Permalink:  ../20151022090026.GB8952@awork2.anarazel.de/
Also on:    postgresql.org/message-id/20151022090026.GB8952@awork2.anarazel.de

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: andres@anarazel.de, michael.paquier@gmail.com, rharwood@redhat.com, sfrost@snowman.net, craig@2ndquadrant.com
  Subject: Re: [PATCH v3] GSSAPI encryption support
  In-Reply-To: <20151022090026.GB8952@awork2.anarazel.de>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox