From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robbie Harwood <rharwood@redhat.com>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v9] GSSAPI encryption support
Date: Thu, 31 Mar 2016 17:10:39 -0400
Message-ID: <8265.1459458639@sss.pgh.pa.us> (raw)
In-Reply-To: <jlgtwjm4bby.fsf@thriss.redhat.com>
References: <20160331194556.GA134261@alvherre.pgsql>
<jlgtwjm4bby.fsf@thriss.redhat.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Robbie Harwood <rharwood@redhat.com> writes:
>>> + {
>>> + {"gss_encrypt", PGC_USERSET, CONN_AUTH_SECURITY,
>>> + gettext_noop("Require encryption for all GSSAPI connections."),
>>> + NULL,
>>> + GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
>>> + },
>>> + &gss_encrypt, false, check_gss_encrypt, assign_gss_encrypt, NULL
>>> + },
>> Why is this marked NOT_IN_SAMPLE?
> Well, because it's not something that's supposed to be set in the file
> (and indeed, you can't set it there, if I understand
> GUC_DISALLOW_IN_FILE). It's used only as a connection parameter, and I
> use its presence / absence for the client and server to negotiate GSSAPI
> encryption support.
If that's what it is, it seems fairly broken to have it connected up to a
GUC variable. Especially one that's USERSET; some people will wonder why
frobbing it with SET does nothing, and others will bitch that they think
it should be superuser-only or some such. I'd keep it localized to the
connection logic, myself. There's already logic in ProcessStartupPacket
for connection options that aren't GUC variables, so I'd suggest adding
another case there instead of pretending this is a settable GUC variable.
regards, tom lane
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, rharwood@redhat.com, alvherre@2ndquadrant.com, michael.paquier@gmail.com
Subject: Re: [PATCH v9] GSSAPI encryption support
In-Reply-To: <8265.1459458639@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox