Subject: Re: [PATCH v6] GSSAPI encryption support
To: Robbie Harwood <rharwood@redhat.com>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
 <jlgegbkmvxl.fsf@thriss.redhat.com>
From: David Steele <david@pgmasters.net>
Cc: Michael Paquier <michael.paquier@gmail.com>,
 Pg Hackers <pgsql-hackers@postgresql.org>
Message-ID: <56E81852.1060005@pgmasters.net>
Date: Tue, 15 Mar 2016 10:12:34 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0)
 Gecko/20100101 Thunderbird/38.6.0
MIME-Version: 1.0
In-Reply-To: <jlgegbkmvxl.fsf@thriss.redhat.com>
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature";
 boundary="r1RC7AWUXnoXxafFUFlnrpGtfB9JrOhEI"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--r1RC7AWUXnoXxafFUFlnrpGtfB9JrOhEI
From: David Steele <david@pgmasters.net>
To: Robbie Harwood <rharwood@redhat.com>
Cc: Michael Paquier <michael.paquier@gmail.com>,
 Pg Hackers <pgsql-hackers@postgresql.org>
Message-ID: <56E81852.1060005@pgmasters.net>
Subject: Re: [PATCH v6] GSSAPI encryption support
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
 <jlgegbkmvxl.fsf@thriss.redhat.com>
In-Reply-To: <jlgegbkmvxl.fsf@thriss.redhat.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

On 3/8/16 5:44 PM, Robbie Harwood wrote:

> Here's yet another version of GSSAPI encryption support.

OK, everything seems to be working fine with a 9.6 client and server so
next I tested older clients and I got this error:

$ /usr/lib/postgresql/9.1/bin/psql -h localhost \
  -U vagrant@PGMASTERS.NET postgres
psql: FATAL:  GSSAPI did no provide required flags

There's a small typo in the error message, BTW.

Here's the output from the server logs:

DEBUG:  forked new backend, pid=3D7746 socket=3D9
DEBUG:  postgres child[7746]: starting with (
DEBUG:  	postgres
DEBUG:  )
DEBUG:  InitPostgres
DEBUG:  my backend ID is 2
DEBUG:  StartTransaction
DEBUG:  name: unnamed; blockState:       DEFAULT; state: INPROGR,
xid/subid/cid: 0/1/0, nestlvl: 1, children:
DEBUG:  Processing received GSS token of length 667
DEBUG:  gss_accept_sec_context major: 0, minor: 0, outlen: 161,
outflags: 1b2
DEBUG:  sending GSS response token of length 161
DEBUG:  sending GSS token of length 161
FATAL:  GSSAPI did no provide required flags
DEBUG:  shmem_exit(1): 1 before_shmem_exit callbacks to make
DEBUG:  shmem_exit(1): 6 on_shmem_exit callbacks to make
DEBUG:  proc_exit(1): 3 callbacks to make
DEBUG:  exit(1)
DEBUG:  shmem_exit(-1): 0 before_shmem_exit callbacks to make
DEBUG:  shmem_exit(-1): 0 on_shmem_exit callbacks to make
DEBUG:  proc_exit(-1): 0 callbacks to make
DEBUG:  reaping dead processes
DEBUG:  server process (PID 7746) exited with exit code 1

I got the same result with a 9.4 client so didn't try any others.

--=20
-David
david@pgmasters.net


--r1RC7AWUXnoXxafFUFlnrpGtfB9JrOhEI
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJW6BhSAAoJEIA2uIJQ5SFA3yMQAKdYE+jOE48uroPWFGG4o2Yu
YVxEOuCRjHvZC/VuHo+S2hKnm7cIFA5bbrqm/+dqAmHh8i3UFj9x092fDDy9tLiR
NHkPIWyAUxG+omzZXyXTGRFqOzf9ILrvwH74H/MfYWiVHHiT+EcXyWqaKG+LASaZ
1J70189H4Hj7qq241RBAkmutE3072oUufMew8qcMnnj2ODICwZGSpeyT8xf5s0xx
55SqO0GeHvYToNqAbPSmzSoOkw1CWs67+g8Gk8l0N2jyW8Jp5Loxxml2NsHn/fCu
b40+7iBrdIHIqGmXT9dbJzdWevfJq7AE6F8a+xpL2jsudZzOYjZlJsaUv23I/iZo
c1T93raIx8R8M5jfwx753OHjpXr3JbprYmLkBSpgsQ5I0048A5AdZ/CVjMJfZPb/
lH/l7k+8CuGQFGXgLd8DrEYHi2p+b7SmVaKIgkVmXVHMP9bolj7ggjmKaA4gV5o/
oO7qz7Z+Jdh9s0RCbyzsmVtLoYz0EUA0cNJQKTTXxI9N8OxQV5pmQxQKVZxWNe8D
kiW6OBBWLTkoRrEnaAB25+LboA/6GNihWswisQQNLO/9x6Kp/Hid2tSV9wxCqjdM
oYXE+G6NfzaavDA7rwd5rEUxD14bz+70xzz0zPF+VwYI+ad9QqeQPlBjvwzdGbiq
DURE0bZRR6lQeqIDY6Lp
=V0K9
-----END PGP SIGNATURE-----

--r1RC7AWUXnoXxafFUFlnrpGtfB9JrOhEI--