Skip to content

Implement GSSAPI session encryption - #6131

Merged
vonzshik merged 26 commits into
mainfrom
2957-gssapi-session-ecnryption
Jun 16, 2025
Merged

vonzshik merged 26 commits into
mainfrom
2957-gssapi-session-ecnryption

Conversation

@vonzshik

@vonzshik vonzshik commented Jun 5, 2025

Copy link
Copy Markdown
Contributor

Closes #2957

@vonzshik vonzshik changed the title Implement GSSAPI session ecnryption Implement GSSAPI session encryption Jun 5, 2025
@vonzshik
vonzshik force-pushed the 2957-gssapi-session-ecnryption branch from b0edd1d to cdc45cf Compare June 5, 2025 15:51
@vonzshik
vonzshik marked this pull request as ready for review June 6, 2025 12:26
@vonzshik
vonzshik requested a review from roji as a code owner June 6, 2025 12:26
@vonzshik

vonzshik commented Jun 6, 2025

Copy link
Copy Markdown
Contributor Author

OK, it's ready. The important docs to read are: protocol flow, require_auth and gsencmode.

Current implementation should follow libpq, with a single difference: we have GssEncMode by default set to Disable, while libpq has it to Prefer. I think it's better if we leave it disabled for the next few releases, given that we do not have a good way to test this in CI since it requires kerberos. While I did test it locally, for now we should treat it as experimental, and we can change it to Prefer for npgsql 12.

@roji roji left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See initial review - mostly nits, it looks generally just fine. Main thoughts on my side:

  • Can we factor more common code between GSS auth and encrypt modes? There seems to be a bit of duplication.
  • There may also be some opportunities for doing things more similarly across SSL and GSS encryption (e.g. see comment on retry below).
  • Can we use .NET NegotiateStream rather than implementing our own GSSStream?

Comment thread src/Npgsql/PublicAPI.Unshipped.txt Outdated
Comment thread src/Npgsql/Util/GSSStream.cs
Comment thread src/Npgsql/PostgresEnvironment.cs Outdated
Comment thread src/Npgsql/NpgsqlConnectionStringBuilder.cs Outdated
Comment thread src/Npgsql/NpgsqlConnectionStringBuilder.cs Outdated
Comment thread src/Npgsql/Internal/NpgsqlConnector.cs Outdated
Comment thread src/Npgsql/Internal/NpgsqlConnector.cs
Comment thread src/Npgsql/Internal/NpgsqlConnector.cs Outdated
Comment thread src/Npgsql/Internal/NpgsqlConnector.cs Outdated
Comment thread src/Npgsql/Internal/NpgsqlConnector.cs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Implement GSSAPI session encryption

2 participants