Feedback-ID: i131946ab:Fastmail
Message-ID: <914a0125-3dfb-920f-51b6-8d44a8edbdd2@enterprisedb.com>
Date: Wed, 21 Sep 2022 18:36:41 -0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.2.2
Subject: Re: [PoC] Let libpq reject unexpected authentication requests
Content-Language: en-US
To: Jacob Champion <jchampion@timescale.com>
Cc: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>,
 Michael Paquier <michael@paquier.xyz>,
 "David G. Johnston" <david.g.johnston@gmail.com>
References: <9e5a8ccddb8355ea9fa4b75a1e3a9edc88a70cd3.camel@vmware.com>
 <YqF92PYPhsjXNYWG@paquier.xyz>
 <CAAWbhmgL1M_yNUeS+Ear=UZoZ6G=tCX5rMx2rETNbjVJJtK40A@mail.gmail.com>
 <CAKFQuwabmJHf+68wo0=dd9EE=9H0RbO=S0SJ23Kpnn8peANZoA@mail.gmail.com>
 <CAAWbhmjOVfRr=Pjp3ZjcVLnHoXBXvn=hcjC2JV02cXB71uWjWg@mail.gmail.com>
 <CAAWbhmitLHUBkUUJmsG2CuVfH=OXTzj6pU1C8XYerYBM2TBfbQ@mail.gmail.com>
 <CAAWbhmi4V9zEAvfUSCDFx1pOr3ZWrV9fuxkv_2maRqvyc-m9PQ@mail.gmail.com>
 <CAAWbhmhjuHUfCs4NbB6p_MeuAgqq+et17SN=QR52HRH8zcMfFQ@mail.gmail.com>
 <77358b4c-6497-e5d3-c13c-57522654af25@enterprisedb.com>
 <CAAWbhmiKUFtkzF5_UFrJNssyTh2QEB7qF70K8zC9KWG0jMxmGw@mail.gmail.com>
 <adfab57e-bcc6-836b-0406-83bfe7f82061@enterprisedb.com>
 <CAAWbhmjMRCFjvjWu-=rmYCW4eRo8b1OjwyREm5QS-YFGGvex-w@mail.gmail.com>
 <ebf31cf7-b0af-7407-ada2-dda6d2767ba0@enterprisedb.com>
 <CAAWbhmg5ddYa=5niqvb4vY7-tpWc2Dj7e=-cNT+WZ64s8V_hVQ@mail.gmail.com>
 <CAAWbhmgOuheFzozhej0HHXJ6wi3Vu73kLrtvD6p9=mJOGOMEfw@mail.gmail.com>
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
In-Reply-To: 
 <CAAWbhmgOuheFzozhej0HHXJ6wi3Vu73kLrtvD6p9=mJOGOMEfw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/914a0125-3dfb-920f-51b6-8d44a8edbdd2%40enterprisedb.com>
Precedence: bulk

On 21.09.22 17:33, Jacob Champion wrote:
> On Fri, Sep 16, 2022 at 1:29 PM Jacob Champion <jchampion@timescale.com> wrote:
>> I'm happy to implement proofs of concept for that, or any other ideas,
>> given the importance of getting this "right enough" the first time.
>> Just let me know.
> 
> v8 rebases over the postgres_fdw HINT changes; there are no functional
> differences.

So let's look at the two TODO comments you have:

          * TODO: how should !auth_required interact with an incomplete
          * SCRAM exchange?

What specific combination of events are you thinking of here?


             /*
              * If implicit GSS auth has already been performed via GSS
              * encryption, we don't need to have performed an
              * AUTH_REQ_GSS exchange.
              *
              * TODO: check this assumption. What mutual auth guarantees
              * are made in this case?
              */

I don't understand the details involved here, but I would be surprised 
if this assumption is true.  For example, does GSS encryption deal with 
user names and a user name map?  I don't see how these can be 
equivalent.  In any case, it seems to me that it would be safer to *not* 
make this assumption at first and then have someone more knowledgeable 
make the argument that it would be safe.