From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robbie Harwood <rharwood@redhat.com>
cc: Alvaro Herrera <alvherre@2ndquadrant.com>,
        Michael Paquier <michael.paquier@gmail.com>,
        PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v9] GSSAPI encryption support
In-reply-to: <jlgtwjm4bby.fsf@thriss.redhat.com>
References: <20160331194556.GA134261@alvherre.pgsql>
 <jlgtwjm4bby.fsf@thriss.redhat.com>
Comments: In-reply-to Robbie Harwood <rharwood@redhat.com>
	message dated "Thu, 31 Mar 2016 16:54:57 -0400"
Date: Thu, 31 Mar 2016 17:10:39 -0400
Message-ID: <8265.1459458639@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

Robbie Harwood <rharwood@redhat.com> writes:
>>> +   {
>>> +       {"gss_encrypt", PGC_USERSET, CONN_AUTH_SECURITY,
>>> +        gettext_noop("Require encryption for all GSSAPI connections."),
>>> +        NULL,
>>> +        GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
>>> +       },
>>> +       &gss_encrypt, false, check_gss_encrypt, assign_gss_encrypt, NULL
>>> +   },

>> Why is this marked NOT_IN_SAMPLE?

> Well, because it's not something that's supposed to be set in the file
> (and indeed, you can't set it there, if I understand
> GUC_DISALLOW_IN_FILE).  It's used only as a connection parameter, and I
> use its presence / absence for the client and server to negotiate GSSAPI
> encryption support.

If that's what it is, it seems fairly broken to have it connected up to a
GUC variable.  Especially one that's USERSET; some people will wonder why
frobbing it with SET does nothing, and others will bitch that they think
it should be superuser-only or some such.  I'd keep it localized to the
connection logic, myself.  There's already logic in ProcessStartupPacket
for connection options that aren't GUC variables, so I'd suggest adding
another case there instead of pretending this is a settable GUC variable.

			regards, tom lane


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers