Date: Thu, 4 Apr 2019 12:24:52 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Alvaro Herrera <alvherre@2ndquadrant.com>,
	David Steele <david@pgmasters.net>, Joe Conway <mail@joeconway.com>,
	Magnus Hagander <magnus@hagander.net>,
	Michael Paquier <michael@paquier.xyz>,
	Nico Williams <nico@cryptonector.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>,
	Robbie Harwood <rharwood@redhat.com>
Subject: Re: [PATCH v20] GSSAPI encryption support
Message-ID: <20190404162452.GM6197@tamriel.snowman.net>
References: <7b7035e0-3691-ca63-0957-25d17dc11514@2ndquadrant.com>
 <CAOuzzgrztzi+g5vfd-dtNxx+MByZcy9nMVzavYZTgvZGHx98Hg@mail.gmail.com>
 <5406.1554388830@sss.pgh.pa.us>
 <20190404144818.GI6197@tamriel.snowman.net>
 <5945.1554389568@sss.pgh.pa.us>
 <20190404150054.GJ6197@tamriel.snowman.net>
 <7566.1554391003@sss.pgh.pa.us>
 <20190404152439.GK6197@tamriel.snowman.net>
 <8476.1554391968@sss.pgh.pa.us>
 <15827.1554394584@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="saNGPHUskr/kQ9Of"
Content-Disposition: inline
In-Reply-To: <15827.1554394584@sss.pgh.pa.us>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--saNGPHUskr/kQ9Of
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> I wrote:
> > Stephen Frost <sfrost@snowman.net> writes:
> >> So I'm a bit surprised that it's taking 4 minutes for you.  I wonder if
> >> there might be an issue related to the KDC wanting to get some amount =
of
> >> random data and the system you're on isn't producing random bytes very
> >> fast..?
>=20
> > Not sure.  This is my usual development box and it also does mail, DNS,
> > etc for my household, so I'd expect it to have plenty of entropy.
> > But it's running a pretty old kernel, and old Kerberos too, so maybe
> > the explanation is in there somewhere.
>=20
> Same test on a laptop running Fedora 28 takes a shade under 5 seconds.
> The laptop has a somewhat better geekbench rating than my workstation,
> but certainly not 50x better.  And I really doubt it's got more entropy
> sources than the workstation.  Gotta be something about the kernel.
>=20
> Watching the test logs, I see that essentially all the time on the RHEL6
> machine is consumed by the two
>=20
> # Running: /usr/sbin/kdb5_util create -s -P secret0
>=20
> steps.  Is there a case for merging the two scripts so we only have to
> do that once?  Maybe not, if nobody else sees this.

I do think that mergeing them would be a good idea and I can look into
that, though at least locally that step takes less than a second..  I
wonder if you might strace (or whatever is appropriate) that kdb5_util
and see what's taking so long.  I seriously doubt it's the actual
kdb5_util code and strongly suspect it's some kernel call.

Thanks!

Stephen

--saNGPHUskr/kQ9Of
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJcpi/TAAoJEO1sijiDR2RVvtgP/2evGfudGO/ohBZjGOulCC/f
0IfM3nbqDwUieS6JMZsPvUruAQcM/qfE631gM+h0yvNjpbetTasBXF+U4tWLAiBO
I2SqJQePU2qlHG/sR8RIzMWsaTe8lEzNX3/AQxTdmGd8WQadZemJZpsk/vccD+HV
D0KOb9GbWOzwsVSXkJRn776c4LetaJZxQ5fjUTHnV4UszAcfbbZOObX1WL6+DMaq
JptGReJpyQaQ1V6kvzb7mSpTayL1YsN0to3wTl7vRWQKgTAdzs9hOGZZQtNCn+hH
ErthEczD+lKK339676VO0D1VcAYh9CjXHt/3VioW6eOV4yKpTj8yvuXkQe6AKwPV
7rZH7fhu/62ZnNpWschb+kixqVMLpLt3wKvmETH4Wm/Je23G5s5IxRLIvs8aVgzd
ij78dHPrjGtotYShcLUYxGE9ABM5CRExp2obPDeR7c9vbSqZYHjDG6toio/Aoz91
z/pnMSjYQ8F4Udc0PzN3qlufNOfFK1rUFoYwRm7H7Szsduy0nZDWQDWH9fEmiIw1
DQMN2eFzYcs8m9ZsVPQ5iXYi0+MM6uReuxmVv/Y5uuzdTMNE9R/3I9AqQWFtxmz+
YUnkZNELcs1Gy9MNaKzLX38dcSBXIX9jguS5dSkz+63qN49G8utWT1j75Sao9CpY
7on/8hd0/f3D8nPqSoQi
=41rC
-----END PGP SIGNATURE-----

--saNGPHUskr/kQ9Of--