From: Robbie Harwood <rharwood@redhat.com>
To: Andres Freund <andres@anarazel.de>,
 Michael Paquier <michael.paquier@gmail.com>
Cc: Stephen Frost <sfrost@snowman.net>,
 PostgreSQL mailing lists <pgsql-hackers@postgresql.org>,
 Craig Ringer <craig@2ndquadrant.com>
Subject: Re: [PATCH v3] GSSAPI encryption support
In-Reply-To: <20151022090026.GB8952@awork2.anarazel.de>
References: <jlg1tcw6owo.fsf@thriss.redhat.com>
 <CAMsr+YH0jamGmOM=mwziYQg=J-0XVp4BosPEv1n+UMaNMj4aMA@mail.gmail.com>
 <20151016133459.GL3685@tamriel.snowman.net>
 <CAMsr+YG1+HQ-V_kdBKkFX+XRV+bND0pJOygns-nbAuHEn2pj2w@mail.gmail.com>
 <20151017021105.GP3685@tamriel.snowman.net>
 <jlgwpuin3fm.fsf@thriss.redhat.com>
 <CAB7nPqT+URED7yZUPc_Soj=vfhf_r7MJD7=VonWpOFiiJE6zgg@mail.gmail.com>
 <CAB7nPqTL1SjaYn7pwb86mW1M+469=ofyyRt1Oh9dyFC_bAf_iw@mail.gmail.com>
 <jlgbnbskwya.fsf@thriss.redhat.com>
 <CAB7nPqSRFG=U3Q_R-7FPvMjNH4TsGfTdZPa7c6x868iw_h0cvw@mail.gmail.com>
 <20151022090026.GB8952@awork2.anarazel.de>
User-Agent: Notmuch/0.18.2 (http://notmuchmail.org) Emacs/24.4.1
 (x86_64-pc-linux-gnu)
Date: Thu, 22 Oct 2015 10:36:19 -0400
Message-ID: <jlgwpufj7h8.fsf@thriss.redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha1; protocol="application/pgp-signature"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

--=-=-=
Content-Type: text/plain

Andres Freund <andres@anarazel.de> writes:

> On 2015-10-22 16:47:09 +0900, Michael Paquier wrote:
>> Hm, and that's why you chose this way of going. My main concern about
>> this patch is that it adds on top of the existing Postgres protocol a
>> layer to encrypt and decrypt the messages between server and client
>> based on GSSAPI. All messages transmitted between client and server
>> are changed to 'g' messages on the fly and switched back to their
>> original state at reception. This is symbolized by the four routines
>> you added in the patch in this purpose, two for frontend and two for
>> backend, each one for encryption and decryption. I may be wrong of
>> course, but it seems to me that this approach will not survive
>> committer-level screening because of the fact that context-level
>> things invade higher level protocol messages.
>
> Agreed. At least one committer here indeed thinks this approach is not
> acceptable (and I've said so upthread).

Okay, I'll make some changes.  Before I do, though, since this is not
the approach I came up with, can you explicitly state what you're
looking for here?  It subjectively seems that I'm getting a lot of
feedback of "this feels wrong" without suggestion for improvement.

To be clear, what I need to know is:

- What changes do you want to see in the wire protocol?  (And how will
  fallback be supported if that's affected?)

- Since this seems to be an important sticking point, what files am I
  encouraged to change (or prohibited from changing)?  (Fallback makes
  this complex.)

- I've been assuming that we care about fallback, but I'd like to be
  told that it's something postgres actually wants to see because it's
  the most intricate part of these changes.  (I'm reasonably confident
  that the code becomes simpler without it, and I myself have no use for
  it.)

If I understand what you're asking for (and the above is intended to be
sure that I will), this will not be a trivial rework, so I want to be
really sure before doing that because writing this code a third time is
something I don't relish.

Thanks,
--Robbie

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJWKPRkAAoJECUy+RdqlaRCP2gQAIVaPPDcuuECT8ICcY0rf7sm
NnsZZqT/CtFPsmtsEZi4HoichvW2JKgDWxV8QgAU5iYC9rFPXiQPoKy0sr4W20Bc
oEm7rWTPTC4j9vYeYz2VDUbXKDmIJaP2atS5yAKnUIltIEJvMAwsgrkqpRL1+j65
n4PfwQjJpGdfYqOZhzbNeo1FKewQD217jW+5eKNWAZQux7mmKHIsDdw5rTUrccTz
cN64opFytIOOw0UMO8mvsxxs+Qt5nAGKyV4VcyRUHH8KYmJM+fBVQBbS7oGqHtgu
EpnjjXNIhRbruLtv2gGMhmeu0g1BVcHMcL1dJFBVFnZJvag6e6i0MqPRvjKeVvL5
03R7LddeJCquqbNtT/P/LDy7xFuRxH18ef+8iqa1gunIkQViAR8v4j2aaL/9tiGO
LYSNc++jH2yiYl2AIvCmSB+/85q0fxlJDLpnWuTkFfgH1uuv7EhVhCDGKnIF/UMJ
iKy1BZ91UW4rXvOMNXsqzb5viZlH4YWGJL3wA/4dYizXf83+xXwl+ehtsTaYFvfO
XNexE+HrakPGBorwJ1StWXUaSk87yPBPy6n5QKHXb7setd7+S59Ou33Oyiz9uCid
OZgdP4mITPGmsiGSUWYNEX3Iz5kFwt6xT0y/pPWdjkkPltNwNHxuSAcpizeRUbhJ
wSwDabnbID99e1XnwAH8
=6R0Z
-----END PGP SIGNATURE-----
--=-=-=--