From: Robbie Harwood <rharwood@redhat.com>
To: Craig Ringer <craig@2ndquadrant.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>,
 Andres Freund <andres@anarazel.de>,
 Michael Paquier <michael.paquier@gmail.com>
Subject: Re: [PATCH v3] GSSAPI encryption support
In-Reply-To: 
 <CAMsr+YE-WaD4kV4vYe0WxQhgD=hJ-EHd7oJ3=ZUF614t1HMPMA@mail.gmail.com>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
 <jlgvbaao0sr.fsf@thriss.redhat.com>
 <CAMsr+YE-WaD4kV4vYe0WxQhgD=hJ-EHd7oJ3=ZUF614t1HMPMA@mail.gmail.com>
User-Agent: Notmuch/0.18.2 (http://notmuchmail.org) Emacs/24.4.1
 (x86_64-pc-linux-gnu)
Date: Thu, 15 Oct 2015 13:07:51 -0400
Message-ID: <jlg1tcw6owo.fsf@thriss.redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha1; protocol="application/pgp-signature"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

--=-=-=
Content-Type: text/plain

Craig Ringer <craig@2ndquadrant.com> writes:

> On 14 October 2015 at 06:34, Robbie Harwood <rharwood@redhat.com> wrote:
>> Alright, here's v3.  As requested, it's one patch now.
>
> I hate to ask, but have you looked at how this interacts with Windows?
>
> We support Windows SSPI (on a domain-member host) authenticating to a
> PostgreSQL server using gssapi with spnego.
>
> We also support a PostgreSQL client on *nix authenticating using
> gssapi with spnego to a PostgreSQL server that's requesting sspi mode.
>
> The relevant code is all a bit tangled, since there's support in there
> for using Kerberos libraries on Windows instead of SSPI too. I doubt
> anybody uses that last one, tests it, or cares about it, though, given
> the painful hoop-jumping, registry key permission changes, etc
> required to make it work.
>
> For bonus fun, RC4, DES, AES128 or AES256 are available/used for
> Kerberos encryption on Windows. See
> http://blogs.msdn.com/b/openspecification/archive/2011/05/31/windows-configurations-for-kerberos-supported-encryption-type.aspx
> . Though given that Win7 defaults to AES256 it's probably reasonable
> to simply not care about anything else.

The short - and probably most important - answer is that no, I haven't
tested it, and it would be difficult for me to do so quickly.

In more depth:

Looking at
http://www.postgresql.org/docs/9.4/static/protocol-message-formats.html
suggests that SSPI follows a separate codepath from the GSS code;
certainly it's a different auth request, which means it shouldn't
trigger the encryption path.

There is no reason that using GSSAPI from, e.g., MIT Kerberos for
Windows, should not work here.  Even more broadly than that, GSSAPI is a
RFC-standardized protocol with rigorously tested interop etc. etc.,
though whether anyone outside of MIT cares about MIT Kerberos for
Windows I have no idea.  As for encryption types, MIT out-of-the-box
supports aes256 + aes128 (in several variants), rc4-hmac and friends,
camellia in several variants, and des3-cbc-sha1.  A much wider selection
is available on setting the appropriately named "allow_weak_crypto" in
krb5.conf, though I would hope that would not be needed.

I think the important takeaway here is that I haven't actually changed
how *authentication* works; these changes only affect GSSAPI
post-authentication add encryption functions as defined by that
specification.  So if the authentication was working before, and the
GSSAPI implementation is following RFC, I would hope that this would
work still.

Thanks,
--Robbie

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJWH91nAAoJECUy+RdqlaRCu2QP/0HZ+XSbUr7mI0Vf8NVmXwJS
MDUEpthXQVOIuAjPh1/0toDO05EwdpJRtrQNNOM76bahXlMZHDTYmrT+awmG12ZV
NXZoFguZ4iQ0QeSU0wstNDbjnH+oMOGj3raC5HCag74L8Iz7VH3oL4r9t1L86bUw
qA4+WKH0PUnwMaYrsUJGbzqRq4cXKMEjGeZbN14mOSNeB2tCxKx4wqwL+FFOQBis
ajsp5EwelkXNL1QkZayY8FlwSd/zlq/b+PsybRxKSl32aObdyIcSG9Fm3eiWm/E5
Wr37XRXX5+1a8x3YLyyQLCXv8fKuZjxGOYcO2mH1GUy7FsnpJIjkV1MLDGrT8dDE
Yv9fEcbZoYAiXlv2FN4Xvy8HPuNbIGLeFYlCKIujdXKjkP0QkAxWAHLzr8Ug4Zos
peHP/clp8tfd2iD6R9PgABaD3X1VWDl07dgBraxw9II+cuJ5MAHO3zhHmX4o3hxP
SfXIlb9LuKnAy9726Ut4tvkOHkqt4qjBcuIqx7GoX64rRcdMPKlDkgGYX3iv6Ntw
mz5iGR7wUcHa5zG1EIHHZJKoP/TBMW9z11aBpso+ZN647FkkI5C1DcZrZ741Q/MB
r6e2LbC70Heo+XqKZTAxRyTdT3rFagdDUXrCK2Ej7ZrfBNOdOnrRmBr90MKa62ML
QkNAQBsPQBz3FaxntSaW
=qXH/
-----END PGP SIGNATURE-----
--=-=-=--