From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Joe Conway <mail@joeconway.com>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: David Steele <david@pgmasters.net>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: Nico Williams <nico@cryptonector.com>
Cc: Robbie Harwood <rharwood@redhat.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
Date: Thu, 4 Apr 2019 22:59:25 -0400
Message-ID: <20190405025925.GN6197@tamriel.snowman.net> (raw)
In-Reply-To: <6c1cd334-cf1d-58b5-ffe0-5d4688538024@2ndquadrant.com> <7b7035e0-3691-ca63-0957-25d17dc11514@2ndquadrant.com>
Greetings,
* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> Kerberos tests are now failing for me (macOS). I'm seeing
>
> psql: error: could not connect to server: Over-size error packet sent by
> the server.
> not ok 3 - GSS encryption without auth
>
> # Failed test 'GSS encryption without auth'
> # at t/002_enc.pl line 170.
> # got: '2'
> # expected: '0'
>
> (and repeated for several other tests).
Alright, that over-size error was a bug in the error-handling code,
which I've just pushed a fix for. That said...
* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 2019-04-04 17:35, Stephen Frost wrote:
> > Ok, it looks like there's a server-side error happening here, and it
> > would be good to see what that is, so can you send the server logs?
>
> These errors appear several times in the server logs:
>
> FATAL: GSSAPI context error
> DETAIL: Miscellaneous failure (see text): Decrypt integrity check
> failed for checksum type hmac-sha1-96-aes256, key type
> aes256-cts-hmac-sha1-96
>
> FATAL: accepting GSS security context failed
> DETAIL: Miscellaneous failure (see text): Decrypt integrity check
> failed for checksum type hmac-sha1-96-aes256, key type
> aes256-cts-hmac-sha1-96
This looks like it's a real issue and it's unclear what's going on here.
I wonder- are you certain that you're using all the same Kerberos
libraries for the KDC, the server, and psql?
If you go back to before the GSSAPI encryption patch, does it work..?
I've certainly seen interesting issues on MacOS, in particular, due to
different Kerberos libraries/tools being installed and I wonder if
that's what is going on here. Maybe you could check klist vs. psql wrt
what libraries are linked in?
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, peter.eisentraut@2ndquadrant.com, magnus@hagander.net, mail@joeconway.com, alvherre@2ndquadrant.com, david@pgmasters.net, michael@paquier.xyz, nico@cryptonector.com, rharwood@redhat.com
Subject: Re: [PATCH v20] GSSAPI encryption support
In-Reply-To: <20190405025925.GN6197@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox