From: Robbie Harwood <rharwood@redhat.com>
To: David Steele <david@pgmasters.net>, pgsql-hackers@postgresql.org
Subject: Re: [PATCH v5] GSSAPI encryption support
In-Reply-To: <56C72591.6000805@pgmasters.net>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
 <jlg4mdg8ebw.fsf@thriss.redhat.com> <56BE0FF9.70302@pgmasters.net>
 <jlgtwl9g95m.fsf@thriss.redhat.com> <56C72591.6000805@pgmasters.net>
User-Agent: Notmuch/0.21 (http://notmuchmail.org) Emacs/24.5.1
 (x86_64-pc-linux-gnu)
Date: Wed, 24 Feb 2016 14:12:38 -0500
Message-ID: <jlg1t81excp.fsf@thriss.redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha1; protocol="application/pgp-signature"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

David Steele <david@pgmasters.net> writes:

> On 2/15/16 12:45 PM, Robbie Harwood wrote:
>> David Steele <david@pgmasters.net> writes:
>>
>>> 1) It didn't apply cleanly to HEAD.  It did apply cleanly on a455878
>>> which I figured was recent enough for testing.  I didn't bisect to find
>>> the exact commit that broke it.
>>=20
>> It applied to head of master (57c932475504d63d8f8a68fc6925d7decabc378a)
>> for me (`patch -p1 < v4-GSSAPI-encryption-support.patch`).  I rebased it
>> anyway and cut a v5 anyway, just to be sure.  It's attached, and
>> available on github as well:
>> https://github.com/frozencemetery/postgres/commit/dc10e3519f0f6c67f79abd=
157dc8ff1a1c293f53
>
> It could have been my mistake.  I'll give it another try when you have a
> new patch.

Please do let me know how v5 goes.  If you run into trouble, in addition
to the logs you helpfully provided before, I'd like a traffic dump (pcap
preferable; I need tcp/udp port 88 for Kerberos and tcp port 5432 or
whatever you're running postgres on) if possible.  Thanks!

>>> 2) While I was able to apply the patch and get it compiled it seemed
>>> pretty flaky - I was only able to logon about 1 in 10 times on average.
>>>  Here was my testing methodology:
>>=20
>> What I can't tell from looking at your methodology is whether both the
>> client and server were running my patches or no.  There's no fallback
>> here (I'd like to talk about how that should work, with example from
>> v1-v3, if people have ideas).  This means that both the client and the
>> server need to be running my patches for the moment.  Is this your
>> setup?
>
> I was testing on a system with no version of PostgreSQL installed.  I
> applied your patch to master and then ran both server and client from
> that patched version.  Is there something I'm missing?

Not that I can immediately see.  As long as the client and server are
both patched, everything should work.  My process is the same as with
previous versions of this patchset [0], and though I'm using FreeIPA
there is no reason it shouldn't work with any other KDC (MIT, for
instance[1]) provided the IPA calls are converted.

I am curious, though - I haven't changed any of the authentication code
in v4/v5 from what's in ~master, so how often can you log in using
GSSAPI using master?

[0]: https://mivehind.net/2015/06/11/kerberized-postgresql/
[1]: http://web.mit.edu/kerberos/krb5-devel/doc/admin/install_kdc.html

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJWzgCnAAoJECUy+RdqlaRCZE4QAIoLfiKWBiGHi3XldTP3dYkD
Um6hr1AaT0tDGByRwc8e2vqFC/0f6SNvcAx5+yWHdGWZrI3kSwbdfG8rS12MoG6j
fGOiBR0FSOGkCAMwcGR8VMBaOVU3CjQSDnbbvVp7ty/FJ9VWBmk/viyA2wOjteTN
6u5x+9R76s52BGGL9U/93Gfk8XJcbBbUo8vpalCEQLkt/Xqmy4rLPZjRMhBGURLP
fV3ZLkjHnPnyJ4TksvoVzC4gg/7DFSVaQf7rXpacE8+eo4UE+pD3FwslHwMYjwEY
Fs0cfq6KhNApDPK3koNf6yW7Zn+vBxB1UdNcVVsOgGIEtuIiOZv9NWej+7tXt9xZ
BcC0IJmFmZagR2OO7r85uapt0osY87HmjMW3DzbAD7ChPtoi0Djny4G1zEX2Pb6Z
5ECcsyc3JJ4WlumZpaDswFQeiqXfulDrbF22Qbu5JgQ4aiDczy5kB3QGao5+y3Fr
DlGLIZVnW0JPIkGXFavqxq61b/jK+e5WVJg7WJByo2PjFWpFNAiBfbNhdQwP+V7x
S7vFS5CE6mByKJBTtHstKfUHeYvdnJcpoN7ZYZHgVUDB46HOw9h588FKBPFPeGws
BpVR8p19ER/SiJDLktX9U5Pv19R6K2610HVmU/Isz7nKzA08DjdOes7FuAECvLlG
dChhwlu4ouiUsxZWTJy/
=7Oka
-----END PGP SIGNATURE-----
--=-=-=--