From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: Robbie Harwood <rharwood@redhat.com>
To: pgsql-hackers@postgresql.org
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Nico Williams <nico@cryptonector.com>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: David Steele <david@pgmasters.net>
Subject: Re: [PATCH v20] GSSAPI encryption support
Date: Sat, 23 Feb 2019 10:19:53 +0100
Message-ID: <5ec3f734-810e-36e0-030f-af92efe135da@2ndquadrant.com> (raw)
In-Reply-To: <jlgy38mir81.fsf@redhat.com>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
<jlgy38mir81.fsf@redhat.com>
I don't know much about GSSAPI, but from what I can tell, this seems an
attractive feature, and the implementation is compact enough. I have
done a bit of work on the internal SSL API refactoring, so I have some
thoughts on this patch.
Looking at the file structure, we would have
be-secure.c
be-secure-openssl.c
be-secure-[othersslimpl].c
be-secure-gssapi.c
be-secure-common.c
This implies a code structure that isn't really there.
be-secure-common.c is used by SSL implementations but not by the GSSAPI
implementation.
Perhaps we should rename be-secure-openssl.c to be-ssl-openssl.c and
be-secure-common.c to be-ssl-common.c.
Or maybe we avoid that, and you rename be-secure-gssapi.c to just
be-gssapi.c and also combine that with the contents of be-gssapi-common.c.
(Or maybe both.)
(And similarly in libpq.)
About pg_hba.conf: The "hostgss" keyword seems a bit confusing. It only
applies to encrypted gss-using connections, not all of them. Maybe
"hostgssenc" or "hostgsswrap"?
I don't see any tests in the patch. We have a Kerberos test suite at
src/test/kerberos/ and an SSL test suite at src/test/ssl/. You can get
some ideas there.
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: peter.eisentraut@2ndquadrant.com, rharwood@redhat.com, sfrost@snowman.net, nico@cryptonector.com, michael@paquier.xyz, alvherre@2ndquadrant.com, david@pgmasters.net
Subject: Re: [PATCH v20] GSSAPI encryption support
In-Reply-To: <5ec3f734-810e-36e0-030f-af92efe135da@2ndquadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox