From: Robbie Harwood <rharwood@redhat.com>
To: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v9] GSSAPI encryption support
Date: Thu, 31 Mar 2016 16:54:57 -0400
Message-ID: <jlgtwjm4bby.fsf@thriss.redhat.com> (raw)
In-Reply-To: <20160331194556.GA134261@alvherre.pgsql>
References: <20160331194556.GA134261@alvherre.pgsql>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Alvaro Herrera <alvherre@2ndquadrant.com> writes:
> Robbie Harwood wrote:
>> Michael Paquier <michael.paquier@gmail.com> writes:
>
>> > + iov[0].iov_base = lenbuf;
>> > + iov[0].iov_len = 4;
>> > + iov[1].iov_base = output.value;
>> > + iov[1].iov_len = output.length;
>> > +
>> > + ret = writev(port->sock, iov, 2);
>> >
>> > writev and iovec are not present on Windows, so this code would never
>> > compile there, and it does not sound that this patch is a reason
>> > sufficient enough to drop support of GSSAPI on Windows.
>>
>> Um. Okay. I guess on Windows I'll make two write calls then, since the
>> only other option I see is to hit alloc again here.
>
> Hmm, I wouldn't push my luck by using writev here at all. We don't use
> writev/readv anywhere, and it's quite possible that they are not present
> on older Unixen which we still support.
> http://pubs.opengroup.org/onlinepubs/009695399/functions/writev.html
> says writev was introduced in "issue 4 version 2", which AFAICT is the
> 2004 version, but our baseline is SUSv2 (1997). So it's definitely not
> workable.
Understood. What do you suggest instead? To give some context here,
writev() is being used here because I have a GSSAPI payload that is
(effectively) opaque and need to include length in it. The only
alternatives I can see are either allocating a new buffer and reading
the payload + length into it (incurs additional memory overhead), or
calling a write/send function twice (incurs syscall overhead at
minimum).
>> > + {
>> > + {"gss_encrypt", PGC_USERSET, CONN_AUTH_SECURITY,
>> > + gettext_noop("Require encryption for all GSSAPI connections."),
>> > + NULL,
>> > + GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
>> > + },
>> > + &gss_encrypt, false, check_gss_encrypt, assign_gss_encrypt, NULL
>> > + },
>
> Why is this marked NOT_IN_SAMPLE?
Well, because it's not something that's supposed to be set in the file
(and indeed, you can't set it there, if I understand
GUC_DISALLOW_IN_FILE). It's used only as a connection parameter, and I
use its presence / absence for the client and server to negotiate GSSAPI
encryption support.
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: rharwood@redhat.com, alvherre@2ndquadrant.com, michael.paquier@gmail.com
Subject: Re: [PATCH v9] GSSAPI encryption support
In-Reply-To: <jlgtwjm4bby.fsf@thriss.redhat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox