Date: Fri, 5 Apr 2019 08:48:03 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Magnus Hagander <magnus@hagander.net>, Joe Conway <mail@joeconway.com>,
	Alvaro Herrera <alvherre@2ndquadrant.com>,
	David Steele <david@pgmasters.net>,
	Michael Paquier <michael@paquier.xyz>,
	Nico Williams <nico@cryptonector.com>,
	Robbie Harwood <rharwood@redhat.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
Message-ID: <20190405124803.GO6197@tamriel.snowman.net>
References: <20190405025925.GN6197@tamriel.snowman.net>
 <7d0584ab-26a8-6731-aeee-9c8e195533e6@2ndquadrant.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="LVtjOVcmXdu94Kaq"
Content-Disposition: inline
In-Reply-To: <7d0584ab-26a8-6731-aeee-9c8e195533e6@2ndquadrant.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--LVtjOVcmXdu94Kaq
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 2019-04-05 04:59, Stephen Frost wrote:
> > Alright, that over-size error was a bug in the error-handling code,
> > which I've just pushed a fix for.  That said...
>=20
> Yes, that looks better now.

Great.

> > This looks like it's a real issue and it's unclear what's going on here.
> > I wonder- are you certain that you're using all the same Kerberos
> > libraries for the KDC, the server, and psql?
>=20
> Right, it was built against the OS-provided Kerberos installation
> (/usr/bin etc.).  If I build against the Homebrew-provided one then the
> tests pass.

All of it was built against the OS-provided Kerberos install, and you
got the failure..?

> So maybe that means that this encryption feature is not supported on
> that (presumably older) installation?  (krb5-config --version says
> "Kerberos 5 release 1.7-prerelease")  Is that plausible?  Is a gentler
> failure mode possible?

On a failure to set up an encrypted connection, we'll actually fall back
to a non-encrypted one, using GSSAPI *just* for authentication, which is
why I was asking if this worked before the encryption patch went in.
Also, which of the tests are still failing, exactly?  The authentication
ones or the encryption ones or both?

If we determine that this is some issue with the MacOS-provided Kerberos
libraries, then we could try to detect them and disable GSSAPI
encryption in that case explicitly, I suppose, but I've seen odd things
with the MacOS-provided Kerberos libraries before on released versions
of PG (without any encryption support), so I'm not yet convinced that
this is an issue that's specific to adding support for encryption.

Thanks!

Stephen

--LVtjOVcmXdu94Kaq
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJcp06DAAoJEO1sijiDR2RVb2wP/i/aYE6Jon/J/Ca8YgjeCcVn
VhGZqLltXmqsG6EAEiPjBlxoDFBRtvqStZki8HKXtcUODyhJ95o0MCkjY6fGe13R
gycEhTGZQpCeCO4SQ9koO3yL0KZVY20C5H3dHaRKnMG8Khk81xgKcgptw+NisrmU
aFZWshaVrqgP9gRs+R5tbJZ2elzQkx1La8Zl4T+iFPL1INHggwP0nH6OgCf8U5zQ
Tv5rfXUvTAu4fyleF/vMi5PQPuWSdrEvUWihO9V2RRUZQndZe8prD+AXMyZA0v5z
ltn0S3HEVt2GmaMjV5k3HhDUxtienYihk+lXTQ0aYudVp95Z4B4qrZhIrGwbFNhT
6VQqbp2edWXw1GnFlmsW3iJz7bRXm2upwEgYbVi82CA/dflDrOdIs3lrvp96pgn9
DpjfKdGPcOZ3pGPUrprsND4JqwGfha0pCJ5DVNjNFiIVU0/ECANDfTn2I0L6ARKe
4LopR9AqYOe/H4CipvgIW5Bb8/hCJZUH2ZNGfKfwF/7Tx0XxDzultu59yyrLTboS
4suWkKaWS6QGXn6KOFXJClcUFNi5hhYOYFUdd4+vhPxwUy3gwdS472zhQLfH76AE
e1DhL6IBNqQrQs3RFBJ39Wvfiy9mWCSNzds9EXGT/j0subxlOjtD6WtksH0TJbk/
rqILLKJ1aafLr9GJU49y
=gwHg
-----END PGP SIGNATURE-----

--LVtjOVcmXdu94Kaq--