From: Robbie Harwood <rharwood@redhat.com>
To: Stephen Frost <sfrost@snowman.net>
Cc: pgsql-hackers@postgresql.org, Nico Williams <nico@cryptonector.com>,
 Michael Paquier <michael@paquier.xyz>,
 Alvaro Herrera <alvherre@2ndquadrant.com>, David Steele <david@pgmasters.net>
Subject: Re: [PATCH v20] GSSAPI encryption support
In-Reply-To: <20190212191731.GS6197@tamriel.snowman.net>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com> <jlgy38mir81.fsf@redhat.com>
 <20190211125335.GN6197@tamriel.snowman.net> <jlg7ee5zu0f.fsf@redhat.com>
 <20190212014105.GO6197@tamriel.snowman.net> <jlgwom4kerf.fsf@redhat.com>
 <20190212191731.GS6197@tamriel.snowman.net>
Date: Tue, 12 Feb 2019 14:33:34 -0500
Message-ID: <jlgtvh8kdip.fsf@redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha512; protocol="application/pgp-signature"
Precedence: bulk

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Stephen Frost <sfrost@snowman.net> writes:

> * Robbie Harwood (rharwood@redhat.com) wrote:
>> Stephen Frost <sfrost@snowman.net> writes:
>>> * Robbie Harwood (rharwood@redhat.com) wrote:
>>>> Stephen Frost <sfrost@snowman.net> writes:
>>>>> * Robbie Harwood (rharwood@redhat.com) wrote:
>>>>>
>>>>>> Attached please find version 20 of the GSSAPI encryption support.
>>>>>> This has been rebased onto master (thanks Stephen for calling out
>>>>>> ab69ea9).
>>>>>
>>>>> I've looked over this again and have been playing with it
>>>>> off-and-on for a while now.  One thing I was actually looking at
>>>>> implementing before we push to commit this was to have similar
>>>>> information to what SSL provides on connection, specifically what
>>>>> printSSLInfo() prints by way of cipher, bits, etc for the
>>>>> client-side and then something like pg_stat_ssl for the server
>>>>> side.
>>>>>
>>>>> I went ahead and added a printGSSENCInfo(), and then
>>>>> PQgetgssSASLSSF(), which calls down into
>>>>> gss_inquire_sec_context_by_oid() for GSS_C_SEC_CONTEXT_SASL_SSF to
>>>>> get the bits (which also required including gssapi_ext.h), and now
>>>>> have psql producing:
>>>>=20
>>>> While I (a krb5 developer) am fine with a hard MIT dependency, the
>>>> project doesn't currently have this.  (And if we went that road,
>>>> I'd like to use gss_acquire_cred_from() instead of the setenv() in
>>>> be-secure-gssapi.c.)
>>>
>>> We certainly don't want a hard MIT dependency, but if it's following
>>> an RFC and we can gracefully fall-back if it isn't available then I
>>> think it's acceptable.  If there's a better approach which would
>>> work with both MIT and Heimdal and ideally is defined through an
>>> RFC, that'd be better, but I'm guessing there isn't...
>>=20
>> While I think the concept of SASL SSF is standardized, I don't think
>> the semantics of this OID are - the OID itself is in the MIT gssapi
>> extension space.
>
> We can adjust for that pretty easily, presumably, if another OID ends
> up being assigned (though if one already exists, isn't it something
> that Heimdal, for example, could potentially decide to just
> support..?).

Yes, exactly - Heimdal would probably just use the MIT OID with the
existing semantics.

Thanks,
=2D-Robbie

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAlxjH44ACgkQJTL5F2qV
pEKRRhAArDXrr6JcS9OOA7zgAFWHu7LsYFkOCQEZC815h/e49wvR8LghC6vO1ByV
MhuhaBR3NY8rGbrqeg94YzP4Z3Dd08j/ELcePGJ/apWcntcnr/2fpUhbr+Mv+dF5
WosVTmmSpZYqetVQ6e9aDSwcx4naQIOrlQLQTReNMj0PAipIsWsFDIArnlutUXnL
setF9p11MyXO3vbLM+99Ft+6jLvtI1Geh8d6wE60sTVfgfvryrd6cti09akcEOhT
zAJf1+A0IReyEw14g5qtGpmizp/SB+HKTxY/LcYLyqQ8u2NIJ/ZxWIiCABsywgB/
eqSroiaUXgFgLEam7IOcZHZeZl6fHksy1jfvGGPD1PDqzHYj4+ML6m163H/V7VFb
o4woBYaMar596mBTZr11Gj9kxD3DEpe0oHlm9Y5kJ5ldHZ3/L5WdhxXoHBZas5yt
v92pO45apnF/8zSQQakTOM+BZDKikzhUYhQfb0zlC//RbKn4ZGrqqHA50auZrS6k
U+DA8BBwuo9xzM7mHkE7BeVyhGL5bm+rJktfUuji2pwQpAFwu8Xw3yGAuhVurp/J
1py6VIgYtRT/LOC3auGSyyYbegJ4cN5nZ0M6mLJFObfVLQGjNw+UXQc2/e/uk5w6
UbOx+F+yv2rQZHy+qTf4GxkkdFBwAdA008UI1Ad/jfUDpec/TpM=
=Z91z
-----END PGP SIGNATURE-----
--=-=-=--