Date: Mon, 25 Jan 2021 13:36:46 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Jacob Champion <pchampion@vmware.com>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: Fixing cache pollution in the Kerberos test suite
Message-ID: <20210125183645.GF27507@tamriel.snowman.net>
References: <1fcb175bafef6560f47a8c31229fa7c938486b8d.camel@vmware.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="HzyAJQdflceDj3hg"
Content-Disposition: inline
In-Reply-To: <1fcb175bafef6560f47a8c31229fa7c938486b8d.camel@vmware.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--HzyAJQdflceDj3hg
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Greetings,

* Jacob Champion (pchampion@vmware.com) wrote:
> I was running tests with a GSS-enabled stack, and ran into some very
> long psql timeouts after running the Kerberos test suite. It turns out
> the suite pushes test credentials into the user's global cache, and
> these no-longer-useful credentials persist after the suite has
> finished. (You can see this in action by running the test/kerberos
> suite and then running `klist`.) This leads to long hangs, I assume
> while the GSS implementation tries to contact a KDC that no longer
> exists.
> Attached is a patch that initializes a local credentials cache inside
> tmp_check/krb5cc, and tells psql to use it via the KRB5CCNAME envvar.
> This prevents the global cache pollution. WDYT?

Ah, yeah, that generally seems like a good idea.

Thanks,

Stephen

--HzyAJQdflceDj3hg
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJgDw+9AAoJEO1sijiDR2RV47UQAKKGQ/JbVnWEbsIc6kRDVioR
udisNQ+Pt+d88rtoMILWmy2pxmWkCIK8y59wvITCxl50F0RnqKdJoEs3YOn0Wp9Q
HRm+As0JXH+I2tT0RsVtTyNHaIH2i+Os3cOuvlP6yeur2/MfeLjS514pfr6Eirkd
rSdk4CD7gM9KJfZHXLYtKHMW2niFkXGMmPNVc2/8l71JZAbXvVkpGTeiBG2bUddj
Ex39iki4itwzSo1cbzgyrMpwXI6c1QnFScFH8hiqrAH4/725FQT1cks+BnI+/Nix
jWuDFzJljBYXN7vqrXo1oljKcA9oYhmYpc/VpzN+vA9TN/EQ4sM/Nq+pbtPQqrfV
IfEWAyWwHlHllm52EzE4xQfhpBTNPJTzKjBToiKBqpKAGogHZKqo3cczQhtc7u91
ujnFmQl3T+8SFujsp/3nqumLWdHO1ZPTzXEVCRdrSNXHWdQZcP+TPV+ksxYIe8Ux
637DTC4PmoHCtL+9lYs1jaONaOZm+qIo3xrUj//X+67URHlfI2hBTkX+JlfbWAeZ
6pADKGEtdhOyWxspg5kjv5o1UHJiB2uoeJlFFAg48EBKdL569pc0W4zPNjABvNJQ
cZmjhmraPz3qTgavOMRv39FQQ/vok/8GeyoHIxW3Rf4Dtfpx4ui1D8IdxuP9i8oN
Kilo4XrYg8M0w4WVExsp
=hLaa
-----END PGP SIGNATURE-----

--HzyAJQdflceDj3hg--