Date: Thu, 4 Apr 2019 22:59:25 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Magnus Hagander <magnus@hagander.net>, Joe Conway <mail@joeconway.com>,
	Alvaro Herrera <alvherre@2ndquadrant.com>,
	David Steele <david@pgmasters.net>,
	Michael Paquier <michael@paquier.xyz>,
	Nico Williams <nico@cryptonector.com>,
	Robbie Harwood <rharwood@redhat.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
Message-ID: <20190405025925.GN6197@tamriel.snowman.net>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="mZ/tsEkYIOgOIQ+2"
Content-Disposition: inline
In-Reply-To: <6c1cd334-cf1d-58b5-ffe0-5d4688538024@2ndquadrant.com>
 <7b7035e0-3691-ca63-0957-25d17dc11514@2ndquadrant.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--mZ/tsEkYIOgOIQ+2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> Kerberos tests are now failing for me (macOS).  I'm seeing
>=20
> psql: error: could not connect to server: Over-size error packet sent by
> the server.
> not ok 3 - GSS encryption without auth
>=20
> #   Failed test 'GSS encryption without auth'
> #   at t/002_enc.pl line 170.
> #          got: '2'
> #     expected: '0'
>=20
> (and repeated for several other tests).

Alright, that over-size error was a bug in the error-handling code,
which I've just pushed a fix for.  That said...

* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 2019-04-04 17:35, Stephen Frost wrote:
> > Ok, it looks like there's a server-side error happening here, and it
> > would be good to see what that is, so can you send the server logs?
>=20
> These errors appear several times in the server logs:
>=20
> FATAL:  GSSAPI context error
> DETAIL:   Miscellaneous failure (see text): Decrypt integrity check
> failed for checksum type hmac-sha1-96-aes256, key type
> aes256-cts-hmac-sha1-96
>=20
> FATAL:  accepting GSS security context failed
> DETAIL:   Miscellaneous failure (see text): Decrypt integrity check
> failed for checksum type hmac-sha1-96-aes256, key type
> aes256-cts-hmac-sha1-96

This looks like it's a real issue and it's unclear what's going on here.
I wonder- are you certain that you're using all the same Kerberos
libraries for the KDC, the server, and psql?

If you go back to before the GSSAPI encryption patch, does it work..?

I've certainly seen interesting issues on MacOS, in particular, due to
different Kerberos libraries/tools being installed and I wonder if
that's what is going on here.  Maybe you could check klist vs. psql wrt
what libraries are linked in?

Thanks,

Stephen

--mZ/tsEkYIOgOIQ+2
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJcpsSNAAoJEO1sijiDR2RVCpsP/imkt0IvUsboGvyZyVMNbLpm
gA1NWxMrQtDrWNFhDc2kJ1tgSf02x3TtpXAM59f9T4T7P95KB43fHNTIcul3weHn
HkoED+b7uDi5TArAAv2G6Xopxd1pP5ETUIbJ8mTd5KSb3q+L2GVii9TRXXpPRtOd
NiNXs4DThhHdkRljLWjUnNUE66eiY5oznmu4CeAy1uYOH/Ro5GF/+5SklncQUqKi
MME9wCjPmwOPtQ76D9r+a2XGAPWHzTWCddqKyCUtsyQEhD363kDN7k2U1S82wk35
LGj3Ij1zJE8uUyf53pExYvjknz02gEwc2ixZtKDfiv0h8B1IzdiLgXZOVQML/CcM
USTOMKVgkzVJFBi0JEGIiucU/QJXbvQAY2KCt3Y7WbG60YAtSsxoKIaeG6DV6YQd
cooO282rv00xNuQY1Az84YaL9kVsWFfpQuw9F0retM4PprExwow+RFpFvfofgOO7
XesSgkKHFBOE0lfN2sn6xwXCmVqG0FgTSPDSFL2T/iyVraqf2qHqibdSCGxNg6t4
7+yLqpDpXPWxvm/U4CYIofA778OIegj2+dcLBIana6X9Ys8tL5H5u2KLUvwRwWbJ
2y1SF9l601LmEm4O5Gj3YgzN/LKjBEcmRbrCl+drZIJelTJIwon4hivqrVHVcGmg
DM/phefgAFygoSK+HaU9
=Mo3I
-----END PGP SIGNATURE-----

--mZ/tsEkYIOgOIQ+2--