From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Joe Conway <mail@joeconway.com>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: David Steele <david@pgmasters.net>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: Nico Williams <nico@cryptonector.com>
Cc: Robbie Harwood <rharwood@redhat.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
Date: Fri, 5 Apr 2019 08:48:03 -0400
Message-ID: <20190405124803.GO6197@tamriel.snowman.net> (raw)
In-Reply-To: <7d0584ab-26a8-6731-aeee-9c8e195533e6@2ndquadrant.com>
References: <20190405025925.GN6197@tamriel.snowman.net>
<7d0584ab-26a8-6731-aeee-9c8e195533e6@2ndquadrant.com>
Greetings,
* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 2019-04-05 04:59, Stephen Frost wrote:
> > Alright, that over-size error was a bug in the error-handling code,
> > which I've just pushed a fix for. That said...
>
> Yes, that looks better now.
Great.
> > This looks like it's a real issue and it's unclear what's going on here.
> > I wonder- are you certain that you're using all the same Kerberos
> > libraries for the KDC, the server, and psql?
>
> Right, it was built against the OS-provided Kerberos installation
> (/usr/bin etc.). If I build against the Homebrew-provided one then the
> tests pass.
All of it was built against the OS-provided Kerberos install, and you
got the failure..?
> So maybe that means that this encryption feature is not supported on
> that (presumably older) installation? (krb5-config --version says
> "Kerberos 5 release 1.7-prerelease") Is that plausible? Is a gentler
> failure mode possible?
On a failure to set up an encrypted connection, we'll actually fall back
to a non-encrypted one, using GSSAPI *just* for authentication, which is
why I was asking if this worked before the encryption patch went in.
Also, which of the tests are still failing, exactly? The authentication
ones or the encryption ones or both?
If we determine that this is some issue with the MacOS-provided Kerberos
libraries, then we could try to detect them and disable GSSAPI
encryption in that case explicitly, I suppose, but I've seen odd things
with the MacOS-provided Kerberos libraries before on released versions
of PG (without any encryption support), so I'm not yet convinced that
this is an issue that's specific to adding support for encryption.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, peter.eisentraut@2ndquadrant.com, magnus@hagander.net, mail@joeconway.com, alvherre@2ndquadrant.com, david@pgmasters.net, michael@paquier.xyz, nico@cryptonector.com, rharwood@redhat.com
Subject: Re: [PATCH v20] GSSAPI encryption support
In-Reply-To: <20190405124803.GO6197@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox