From: Robbie Harwood <rharwood@redhat.com>
To: Tom Lane <tgl@sss.pgh.pa.us>, Stephen Frost <sfrost@snowman.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
 Alvaro Herrera <alvherre@2ndquadrant.com>,
 David Steele <david@pgmasters.net>, Joe Conway <mail@joeconway.com>,
 Magnus Hagander <magnus@hagander.net>, Michael Paquier <michael@paquier.xyz>,
 Nico Williams <nico@cryptonector.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
In-Reply-To: <7566.1554391003@sss.pgh.pa.us>
References: <1f799b02-d766-0328-45d6-73e5674d0bc2@2ndquadrant.com>
 <CAOuzzgprZ7-gYkzwkPzMOPka62irppKpXNm219q7a_8Fu33TLw@mail.gmail.com>
 <500b1be7-d0aa-96a2-9982-d748609faff5@joeconway.com>
 <CABUevEyuNNJv=19foa=ycTfTfBUYOEwM8_Uss5OVKrwBAy+Btw@mail.gmail.com>
 <20190403144332.GD6197@tamriel.snowman.net>
 <7b7035e0-3691-ca63-0957-25d17dc11514@2ndquadrant.com>
 <CAOuzzgrztzi+g5vfd-dtNxx+MByZcy9nMVzavYZTgvZGHx98Hg@mail.gmail.com>
 <5406.1554388830@sss.pgh.pa.us> <20190404144818.GI6197@tamriel.snowman.net>
 <5945.1554389568@sss.pgh.pa.us> <20190404150054.GJ6197@tamriel.snowman.net>
 <7566.1554391003@sss.pgh.pa.us>
Date: Thu, 04 Apr 2019 13:14:32 -0400
Message-ID: <jlgv9ztr8uf.fsf@redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha512; protocol="application/pgp-signature"
Precedence: bulk

--=-=-=
Content-Type: text/plain

Tom Lane <tgl@sss.pgh.pa.us> writes:

> Stephen Frost <sfrost@snowman.net> writes:
>> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>>> Well, if the caller thinks what is being passed back is an int,
>>> it will do a 32-to-64-bit widening, which is almost certainly
>>> going to result in a corrupted pointer.
>
>> Oh, good point.  Interesting that it still works then.
>
> There must be something about the x86_64 ABI that allows this to
> accidentally work -- maybe integers are presumed to be sign-extended
> to 64 bits by callee not caller?  I added some logging and verified
> that pgstat.c is seeing the correct string value, so it's working
> somehow.
>
>> I've got a fix for the missing prototypes, I hadn't noticed the issue
>> previously due to always building with SSL enabled as well.
>
> Yeah, I'd just come to the conclusion that it's because I didn't
> include --with-openssl, and libpq-be.h's #ifdef nest doesn't expect
> that.
>
> BTW, the kerberos test suite takes nearly 4 minutes for me, is
> it supposed to be so slow?

My guess is entropy problems as well.  If available, configuring
/dev/urandom passthrough from the host is a generally helpful thing to
do.

My (Fedora, Centos/RHEL 7+) krb5 builds use getrandom() for entropy, so
they shouldn't be slow; I believe Debian also has started doing so
recently as well.  I don't know what other distros/OSs do for this.

Thanks,
--Robbie

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAlymO3gACgkQJTL5F2qV
pEJQ/A//dH9AuCWZ+q0hWF9Dh1v3pxTd+s/oPDFe4mR+IBZ2jrS9Mt1Q8o+l+UDQ
eW1PFkvlVFR9LoAeQrOZyXYVDchuUEu3jXW21Y6TsaA2Tx1ZkXrLNZucEBUMUQ0O
vW0WnZWJ4zY6mV5KmnqpjTihOSnC7QTyer5m8LtvFH08xR6/SmNyfW6wO8P/YGqO
1LMl82aM6DUcaCrsNI/tf2NvQMC3OZmVOVa9biQ1vQGG2bpX0JnE3V+0MfwD4+nZ
63qzZx5H149TY2056EBgnfybpTyECEDctWqqrs5pe1PspwegwK9dX+BjNk+yz9Rn
KZAH4b3YRaks68N3Sc5ICrVuNoToHM7g6B8VEzC02/zHbizFhEc9SxwdmwLMJ6vI
TCfrjF4u/KiCfR+0N8JnlT1qfzAowkdVQEV4WVw+He67P6c0Q0u462X91hMOdvyp
5tdcvbRZiOlpzfT+9hmnJo4/Z8LP+Xf6PduBAUt3F7ZE69He8tKv2tJFS+ewSkYb
EQRKySkfA72yaXRtbbHqZcY1hc7hcVlLhXBvMPY6CmYahj9SMzxVkWenCk2JtbBX
mwjUgBd6xFvix2kx2hSpjU+/Yovfe9i1/zuXoDoYMsCvFf/VjZKxzThvVaVXHcil
v8srxMM0GHU4h8yu9no/upTg4HS6MXjdkBdzGlkGHCwjhTsDCfQ=
=kMiL
-----END PGP SIGNATURE-----
--=-=-=--