Received: from malur.postgresql.org ([2a02:16a8:dc51::56])
	by arkaria.postgresql.org with esmtps
 (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.89)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1fSmHE-0001OI-HB
	for pgsql-hackers@arkaria.postgresql.org; Tue, 12 Jun 2018 16:36:12 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.89)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1fSmHD-0007Am-3r
	for pgsql-hackers@arkaria.postgresql.org; Tue, 12 Jun 2018 16:36:11 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.89)
	(envelope-from <rharwood@redhat.com>)
	id 1fSmHC-0007Ac-Sx
	for pgsql-hackers@lists.postgresql.org; Tue, 12 Jun 2018 16:36:10 +0000
Received: from mx1.redhat.com ([209.132.183.28])
	by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.89)
	(envelope-from <rharwood@redhat.com>)
	id 1fSmH9-00021H-Dj
	for pgsql-hackers@postgresql.org; Tue, 12 Jun 2018 16:36:10 +0000
Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com
 [10.5.11.23])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mx1.redhat.com (Postfix) with ESMTPS id B10713082A4F;
	Tue, 12 Jun 2018 16:36:04 +0000 (UTC)
Received: from localhost (ovpn-112-60.rdu2.redhat.com [10.10.112.60])
	by smtp.corp.redhat.com (Postfix) with ESMTP id 741D187A86;
	Tue, 12 Jun 2018 16:36:04 +0000 (UTC)
From: Robbie Harwood <rharwood@redhat.com>
To: Nico Williams <nico@cryptonector.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v18] GSSAPI encryption support
In-Reply-To: <20180611230026.GC23356@localhost>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com> <jlg1se287n3.fsf@redhat.com>
 <jlg602phyn5.fsf@redhat.com> <20180611230026.GC23356@localhost>
Date: Tue, 12 Jun 2018 12:36:01 -0400
Message-ID: <jlgr2lcgdxq.fsf@redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha512; protocol="application/pgp-signature"
X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23
X-Greylist: Sender IP whitelisted,
 not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.45]);
 Tue, 12 Jun 2018 16:36:04 +0000 (UTC)
List-Id: <pgsql-hackers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-hackers@lists.postgresql.org>
List-Owner: <mailto:pgsql-hackers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-hackers>
Precedence: bulk

--=-=-=
Content-Type: text/plain

Nico Williams <nico@cryptonector.com> writes:

> On Mon, Jun 11, 2018 at 04:11:10PM -0400, Robbie Harwood wrote:
>> Nico was kind enough to provide me with some code review.  This should
>> those concerns (clarify short-read behavior and fixing error checking on
>> GSS functions).
>
> Besides the bug you fixed and which I told you about off-list (on IRC,
> specifically), I only have some commentary that does not need any
> action:
>
>  - support for non-Kerberos/default GSS mechanisms
>
>    This might require new values for gssmode: prefer-<mechanism-name>
>    and require-<mechanism-name>.  One could always use SPNEGO if there
>    are multiple mechanisms to choose from.  And indeed, you could just
>    use SPNEGO if the user has credentials for multiple mechanism.
>
>    (Because GSS has no standard mechanism _names_, this means making
>    some up.  This is one obnoxious shortcoming of the GSS-API...)

As long as it's better than passing raw OIDs on the CLI...

>  - when the SCRAM channel binding work is done, it might be good to add
>    an option for TLS + GSS w/ channel binding to TLS and no gss wrap
>    tokens

I think both of these are neat ideas if they'll be used.  Getting GSSAPI
encryption in shouldn't preclude either in its present form (should make
it easier, I hope), but I'm glad to hear of possible future work as
well!

Thanks,
--Robbie

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAlsf9nIACgkQJTL5F2qV
pEKCQw/9EjevIhjIdW4PxOqJn7snebOS3HUAkako91gZ2IRsbJF8MzqXcuuB3/7u
7OC2Gx7+fWC4y8199KXryRxOiJpfPl6NeYrBKO4wfTouSObNsGa0AlS6LcHPv8r4
y8ngkMQMuQGfCzzuAJIpH4FcrzdArG+E4TJIZ9kpRYpR1lq19EJFAPYqexR76RA8
FvFiP7BQI11U4PZ1CAsPeNZ0b5PVR6vTXJ+iAYQq/9Qpovjbp2H7qaQdk6V5kJP6
gaFgjPehmkxx2T/v21iFEBS5l1hrjjUYwJP3Wl9TS4dpc6qaFWLxqlmcyxlzgVtt
CRz210rGs+6p4AIYEoZ5LjQIcB3rdLdRzYSoMwIA2FJjA5vIpl6PC1lpO/JV6mWa
I1z0LX0nqdoil4L7g3Ei0TeqIAuhTk9sOfG1JzNeWv1o9MMftUxMmoxrom0twRvV
FYV5u3uQEUBlXLiudLvib5kMgWPD7YHA4+kiubigJlu3UWEUADI2DoFa0KyjI/0f
Sb2E6r2AblbzPmDATIUblmoRAvh85RTmbKaSzh2dEqQrloAGC650AdjmVV+jDc9K
dhfqOwrFxWS7NMrGdd5AyPLaK0UPe8HbstzHgAq0EIYJVfhu1sn6P48vdzS9vQKO
zxkBPfy2ZaCTNsQ7thfEU38O2EN2n7GJpS56a/riGj8IaT6JgaU=
=cm4I
-----END PGP SIGNATURE-----
--=-=-=--