Date: Fri, 5 Apr 2019 17:37:45 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Magnus Hagander <magnus@hagander.net>, Joe Conway <mail@joeconway.com>,
	Alvaro Herrera <alvherre@2ndquadrant.com>,
	David Steele <david@pgmasters.net>,
	Michael Paquier <michael@paquier.xyz>,
	Nico Williams <nico@cryptonector.com>,
	Robbie Harwood <rharwood@redhat.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
Message-ID: <20190405213745.GR6197@tamriel.snowman.net>
References: <20190405025925.GN6197@tamriel.snowman.net>
 <7d0584ab-26a8-6731-aeee-9c8e195533e6@2ndquadrant.com>
 <20190405124803.GO6197@tamriel.snowman.net>
 <f56cacac-0693-23aa-353d-179adbe32f2e@2ndquadrant.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="XIruDbM988UppX5/"
Content-Disposition: inline
In-Reply-To: <f56cacac-0693-23aa-353d-179adbe32f2e@2ndquadrant.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--XIruDbM988UppX5/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 2019-04-05 14:48, Stephen Frost wrote:
> > On a failure to set up an encrypted connection, we'll actually fall back
> > to a non-encrypted one using GSSAPI *just* for authentication, which is=
> why I was asking if this worked before the encryption patch went in.
>=20
> The tests have always worked before.  I've run them probably hundreds of
> times.

Ok.

> > Also, which of the tests are still failing, exactly?  The authentication
> > ones or the encryption ones or both?
>=20
> Only the encryption ones:
>=20
> not ok 1 - GSS-encrypted access
>=20
> #   Failed test 'GSS-encrypted access'
> #   at t/002_enc.pl line 170.
> #          got: '2'
> #     expected: '0'
> ok 2 - GSS encryption disabled
> not ok 3 - GSS encryption without auth
>=20
> #   Failed test 'GSS encryption without auth'
> #   at t/002_enc.pl line 170.
> #          got: '2'
> #     expected: '0'
> not ok 4 - GSS unencrypted fallback
>=20
> #   Failed test 'GSS unencrypted fallback'
> #   at t/002_enc.pl line 170.
> #          got: '2'
> #     expected: '0'
> ok 5 - GSS unencrypted fallback prevention

So, looking back at the error message you got:

FATAL:  GSSAPI context error
DETAIL:   Miscellaneous failure (see text): Decrypt integrity check
failed for checksum type hmac-sha1-96-aes256, key type
aes256-cts-hmac-sha1-96

FATAL:  accepting GSS security context failed
DETAIL:   Miscellaneous failure (see text): Decrypt integrity check
failed for checksum type hmac-sha1-96-aes256, key type
aes256-cts-hmac-sha1-96

(assuming that's still what you're getting..?)

What this is saying is basically that the key that the PG server is
using from its keytab and the key used to encrypt the ticket that the
user has (from the KDC) don't match up.

I wonder if somehow the keytab file that the server is using isn't
getting destroyed between the two test runs and so you're ending up with
the server using the key from the old KDC, while the user is using the
new one..?  Or something is equally going wrong in the tests.

Could you try doing something like removing the 001_auth.pl, moving the
002_enc.pl to 001_enc.pl, double-check that everything is cleaned up and
that there aren't any old PG servers running, et al, and re-try that
way?

I've also reached out to some colleagues about having one of them test
with MacOS.  What version are you on..?=20

Thanks!

Stephen

--XIruDbM988UppX5/
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJcp8qpAAoJEO1sijiDR2RV2pMP/23L/C/tmsJe4NGsyWI/BY2S
3Mxlp9Mz7paK4gk6FOkHPAc+mpW+dASSzMjABjmoiYYcpjz5/22zmGMrJ9oc0nEa
j3Bw1+Kv59kjQutmWKTzSSjnOB1mcK8jxaMVOCddD4aL5ml/0nEyeFDF7dLKdqQr
e3TrJ2LWh4Jdwj9vgcKopJ54uPD1YYyeWehMQe7RuTW3V2XCyvDLZD3qNRXlDfHQ
cQTDMccxlcXR3TwmXR5H6aJS/kYorSZBmRq3NEZfD99eXmcfT/ayHoyxTdk1VoA9
RUR4PkFb5GqtDBNr+yRX+qglgf7RivXi8phIYvWmoA5ZbhH+KmoCyuyoflQwTikX
0y3aSZTZY4f8a5eCc55QWBd8Oz3E/Znaob+GpDZbWSXbSpfKDz6Bdq8sdeFHS+ro
l45vQDCkBBuZs/sxC9OmTvWOT3s/EorjHg29uaaQq7BPnsRFn1UKbxbSfia1f+r2
Vv7oqbG0M8XkULn5MlR3C8yyUqlqnjtPtOxU3k+PVLo7eFo2wfiJ19Y11QwEZu+f
Noq93IDrcrFnHXZinLmd940g0fagN23OMEcz3krI1fV6naEQaLBlQZA1e9SrxnY2
lY603JsWYMl8vaTqqgZS2NIgg48d+Vm4P32BmQzeIn0zrxx65IpH2gZF4S0xMP22
WlqOMqW8llW7XnyW0jLX
=1bAL
-----END PGP SIGNATURE-----

--XIruDbM988UppX5/--