From: Robbie Harwood <rharwood@redhat.com>
To: Stephen Frost <sfrost@snowman.net>
Cc: pgsql-hackers@postgresql.org, Nico Williams <nico@cryptonector.com>,
 Michael Paquier <michael@paquier.xyz>,
 Alvaro Herrera <alvherre@2ndquadrant.com>, David Steele <david@pgmasters.net>
Subject: Re: [PATCH v20] GSSAPI encryption support
In-Reply-To: <20190221233910.GO6197@tamriel.snowman.net>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com> <jlgy38mir81.fsf@redhat.com>
 <20190211125335.GN6197@tamriel.snowman.net> <jlg7ee5zu0f.fsf@redhat.com>
 <20190212014105.GO6197@tamriel.snowman.net> <jlgwom4kerf.fsf@redhat.com>
 <20190212191731.GS6197@tamriel.snowman.net> <jlg36og4wbb.fsf@redhat.com>
 <20190221233910.GO6197@tamriel.snowman.net>
Date: Fri, 22 Feb 2019 15:37:24 -0500
Message-ID: <jlgr2bza7az.fsf@redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha512; protocol="application/pgp-signature"
Precedence: bulk

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Stephen Frost <sfrost@snowman.net> writes:

> * Robbie Harwood (rharwood@redhat.com) wrote:
>> Stephen Frost <sfrost@snowman.net> writes:
>>> * Robbie Harwood (rharwood@redhat.com) wrote:
>>>
>>>> Sure!  I'll go ahead and hack up the checks and lucid stuff and get
>>>> back to you.
>>>
>>> Great!  I'll finish fleshing out the basics of how to have this work
>>> server-side and once the checks and lucid stuff are in on the psql
>>> side, it should be pretty straight-forward to copy that same
>>> information into beentry alongside the SSL info, and expose it
>>> through pg_stat_get_activity() into a pg_stat_gss view.
>>=20
>> When the mech is gss_mech_krb5 under MIT krb5:
>>=20
>>     psql (12devel)
>>     GSSAPI encrypted connection (krb5 using aes256-cts-hmac-sha384-192)
>>     Type "help" for help.
>>=20
>> And the same under Heimdal:
>>=20
>>     psql (12devel)
>>     GSSAPI encrypted connection (krb5 using aes256-cts-hmac-sha1-96)
>>     Type "help" for help
>>=20
>> If the mech weren't gss_krb5, or Lucid introspection failed, but we're a
>> SASL-aware mech (and using MIT):
>>=20
>>     psql (12devel)
>>     GSSAPI encrypted connection (~256 bits)
>>     Type "help" for help.
>>=20
>> The third case (no lucid, no SASL SSF):
>>=20
>>     psql (12devel)
>>     GSSAPI encrypted connection (unknown mechanism)
>>     Type "help" for help.
>>=20
>> Feel free to tweak these strings as needed.
>
> That all looks fantastic!  Do you see any reason to not say:
>
>     GSSAPI encrypted connection (SASL SSF: ~256 bits)
>
> instead, since that's what we are technically reporting there?

Nope, that'd be fine with me!  (We'd probably want to get rid of the ~
in that case; I'd included it since SASL SSF is an approximate bit
measure, but 256 is the exact SSF.)

>> Another thing I've been thinking about here is whether the SASL SSF
>> logic is useful.  It'll only get invoked when the mechanism isn't
>> gss_mech_krb5, and only under MIT.  SPNEGO (krb5), NTLM
>> (gss-ntlmssp), IAKERB (krb5), and EAP (moonshot) all don't support
>> GSS_C_SEC_CONTEXT_SASL_SSF; I actually couldn't come up with another
>> mechanism that does.  I defer to you on whether to remove that,
>> though.
>
> Oh, hmm, I see.  Yeah, since there's no case where that could actually
> end up being used today then perhaps it makes sense to remove it- it's
> not a terribly good interface anyway since it doesn't provide the
> actual encryption algorithm, I had just gone down that route because I
> saw how to.  The lucid stuff is much better. :)
>
>> I've also adjusted the layering somewhat and moved the actual
>> printf() call down into fe-secure-gssapi.c I don't know whether this
>> model makes more sense in the long run, but for PoC code it was
>> marginally easier to reason about.
>
> No, I think we need to provide a way for libpq-using applications to
> get at that information easily..

Well, it's easier if there's only one type of thing (string) that can be
returned at least.  I imagine the interface there has to be pass
buffer-and-size into the function in fe-secure-gssapi.c then?  Do you
want me to make that change, or would you prefer to do it as part of the
server logging logic?

>> Patch attached after the break; apply on top of -20.
>
> Ok.  I'm pretty amazed at how little code it was to do..

The autotools part took the longest :)

> Is there somewhere that these functions are publicly documented and
> how they can be used from a GSSAPI handle is documented?

Not in the way you're hoping for, I suspect.  This interface is only
intended for consumption by NFS - which needs to pass contexts in and
out of the kernel.  Unlike GSSAPI, Kerberos5 interfaces aren't
standardized at all - parity between MIT and Heimdal is pretty low on
the krb5_*().

I was just referencing MIT's header files:
https://github.com/krb5/krb5/blob/master/src/lib/gssapi/krb5/gssapi_krb5.h#=
L229
(with the goal in mind of hitting krb5_enctype_to_name())
https://github.com/krb5/krb5/blob/master/src/include/krb5/krb5.hin#L6284-L6=
302

(Heimdal doesn't have any documentation/example code, but it works the
same way for lucid stuff; I had to look at the source to see how its
variant of krb5_enctype_to_string() worked.)

Thanks,
=2D-Robbie

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAlxwXYQACgkQJTL5F2qV
pEIYzA//civ8JClHrqyme10290TrH4xUgU/st58EWEDgJ+cjVnl0vtDWb+ZoFKlu
rb2obmtGtxHnnkfv4oEy+0anLQocmW46IRfjOVoPzvHoanHdgRciCwyccFDDEBP9
xz0iPOnnKWU5/8tiMfZ4tkiUBlx+sa9OBLnrzXNmpl/cPsuvBCRta1QrG3IkD5d6
T4mdeC8SceB3Y9ljcGilHXwjif2L1KeYNFKy3p7R615oU0zz9h4UmciTasuV/qNs
gEQH+kD5/aws3xvrH92p0blq2AH/pw87zKXZ06635TSc99Eb9wQ09TDnNSHir+Ql
JaeonOQ5951/Nt8krjp/Fg5ydbOoFPcTKvriq3ic9FXI+ZweG7VwQdTIyjiOogcy
NLhppeCf3Tdu/UwENxslhka3zmURpUMv8BQZx9ydSI5Na9Jyvmpozk7ptAmE28Gf
Je2qDkP5GPnU6DuZSmbNwLKrLZz7a9OsdQISWphUTXju022UE3vnE4DXiFWbvZce
iAMDie/tMxWGr5PD1aHvGk8f6NcUidYrGcp5QKfgeqCZF23/Z7wEa6QMLNsqFcRN
Bw3j89bYmN4pLWHNgu6oVoRqXzqaW2749hbO1oUJauIsGTvy+1vT51wjwtpi/jtK
VBl17vtBr0xfLc+VVOKIPJ2q4FADM0cGb6fF6+wzVchlRmNHcdU=
=MxCe
-----END PGP SIGNATURE-----
--=-=-=--