From: Robbie Harwood <rharwood@redhat.com>
To: Stephen Frost <sfrost@snowman.net>,
 Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Magnus Hagander <magnus@hagander.net>, Joe Conway <mail@joeconway.com>,
 Alvaro Herrera <alvherre@2ndquadrant.com>,
 David Steele <david@pgmasters.net>, Michael Paquier <michael@paquier.xyz>,
 Nico Williams <nico@cryptonector.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
In-Reply-To: <20190405124803.GO6197@tamriel.snowman.net>
References: <20190405025925.GN6197@tamriel.snowman.net>
 <7d0584ab-26a8-6731-aeee-9c8e195533e6@2ndquadrant.com>
 <20190405124803.GO6197@tamriel.snowman.net>
Date: Fri, 05 Apr 2019 11:31:25 -0400
Message-ID: <jlga7h4sc36.fsf@redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha512; protocol="application/pgp-signature"
Precedence: bulk

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Stephen Frost <sfrost@snowman.net> writes:

> * Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
>> On 2019-04-05 04:59, Stephen Frost wrote:
>>
>>> Alright, that over-size error was a bug in the error-handling code,
>>> which I've just pushed a fix for.  That said...
>>=20
>> Yes, that looks better now.
>
> Great.
>
>>> This looks like it's a real issue and it's unclear what's going on
>>> here.  I wonder- are you certain that you're using all the same
>>> Kerberos libraries for the KDC, the server, and psql?
>>=20
>> Right, it was built against the OS-provided Kerberos installation
>> (/usr/bin etc.).  If I build against the Homebrew-provided one then
>> the tests pass.
>
> All of it was built against the OS-provided Kerberos install, and you
> got the failure..?
>
>> So maybe that means that this encryption feature is not supported on
>> that (presumably older) installation?  (krb5-config --version says
>> "Kerberos 5 release 1.7-prerelease") Is that plausible?  Is a gentler
>> failure mode possible?

Heimdal never had a 1.7 release - they went from 1.5.2 to 7.1.0.

MIT did have a 1.7 release - in 2009.

Apple doesn't open source their Kerberos implementation, so I can't
exactly point a debugger at it.  But if it's in fact somehow related to
MIT 1.7-prerelease, I imagine they inherited a bug or two that's been
fixed in the ten years since then.

As for the code: I'm not doing anything complicated.  The interface I'm
using is as specified in RFC2743 and RFC2744, which is from 2000 (though
I think technically I'm mostly backward compatible to RFC1509, from
1993), and Kerberos V5 itself is specified in RFC4120 (from 2005).

> On a failure to set up an encrypted connection, we'll actually fall
> back to a non-encrypted one, using GSSAPI *just* for authentication,
> which is why I was asking if this worked before the encryption patch
> went in.  Also, which of the tests are still failing, exactly?  The
> authentication ones or the encryption ones or both?

Good question.

> If we determine that this is some issue with the MacOS-provided
> Kerberos libraries, then we could try to detect them and disable
> GSSAPI encryption in that case explicitly, I suppose, but I've seen
> odd things with the MacOS-provided Kerberos libraries before on
> released versions of PG (without any encryption support), so I'm not
> yet convinced that this is an issue that's specific to adding support
> for encryption.

If we have to, a version check >1.7 would probably work.  That'll remove
the ability to work on RHEL/CentOS 5, but that's probably fine, and I'm
not aware of any other supported OSs that would be impacted.

Thanks,
=2D-Robbie

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAlyndM0ACgkQJTL5F2qV
pEJW9xAAmttIQy3iviXcAdaUjSJf0TUm9K22qxkgWt7IIpa7xS2KThqJrr89AgaW
wZHYhfqLz+73wZjzpAI0Op15E4t+tsv6T2ic5nmAv85gEFHeQX4BkXF8XalypT6x
G13hAbJOFbu0Kpg51aqI1gDG4abMC8YCaqE+L73Qc5RWb63vH1DkP3zGizDJ79k2
jsYhtIpYVcDY8WECV9pLz7vDtC0inZlJDt68ts+cUcibRSbpqHg3pqsVIL4n3PU1
2cKdEJhx12MUyQiOcSm5cTnQzOoFkwRk2iQAre11dLkv15asBvtySISyptl5IEJS
a2mRmHlBWFHCvq0PVvdQBERXkDfjNkd89wfVgQGlvN/JfkpeQwb51Yf8aqJJjzrZ
Jzll2J9IUpJr8+TWjFfRGrfhZKxmejn+dxrs1m78GsPEVPykYM069PK/uTU7kxUn
fhznYR+aWVP5SRZCEjKvu4fa6hO2USFmunL95HG/2WNV6DD6Z3UAeTRtvIhLLACQ
S+GwKO67Dg43RUL0hnv8B7jgEERenj0BkIIOFkQGXtQPIjWW7XgyiBVl6hs/rTJc
id8hs8NGEvF4O/hN89IL+M4J4RaK3JMH4y1l5wxivWJcucgGY85mDPbFt8QxdUq8
y/BRLsfcwRaImWftber9p9AunIn4W+MbWzklyQHh/Fb49KCm6x0=
=R8Av
-----END PGP SIGNATURE-----
--=-=-=--