From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: Chris Gooch <cgooch@bamfunds.com>
Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: Re: [EXT] Re: GSS Auth issue when user member of lots of AD groups
Date: Tue, 27 May 2025 18:15:29 -0400
Message-ID: <1350781.1748384129@sss.pgh.pa.us> (raw)
In-Reply-To: <CAOYmi+n0RW6uDOpz8sgLHoc0gZB+uTPERoCoP1xM3Szpajsi3w@mail.gmail.com>
References: <DS0PR22MB5971A9C8A3F44BCC6293C4DABE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
<1529314.1747928806@sss.pgh.pa.us>
<CAOYmi+nZpOu_Yd_dvQQehK78B48MB-TT1Z7Myp1xSQ1uUHHZVQ@mail.gmail.com>
<1536692.1747933034@sss.pgh.pa.us>
<CAOYmi+mPdZwNe16yozk40G8hW3d1Rxnoipu0dw52AiuZRoabaA@mail.gmail.com>
<1647590.1747936713@sss.pgh.pa.us>
<DS0PR22MB597134B3D28AC101C8936007BE9BA@DS0PR22MB5971.namprd22.prod.outlook.com>
<3060113.1748096813@sss.pgh.pa.us>
<3125813.1748115425@sss.pgh.pa.us>
<CAOYmi+n0RW6uDOpz8sgLHoc0gZB+uTPERoCoP1xM3Szpajsi3w@mail.gmail.com>
Jacob Champion <jacob.champion@enterprisedb.com> writes:
> On Sat, May 24, 2025 at 12:37 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> * The backend's secure_open_gssapi allowed received initialization packets
>> to be up to buffer-size long, whereas libpq will choke sending them
>> if they're more than buffer-size minus sizeof(uint32). This isn't
>> actually a bug, since the buffer management is handled in such a way
>> that it's safe, but it seems very inconsistent. I changed the limit
>> to subtract off sizeof(uint32) in all cases, which incidentally
>> allowed removing one variant of the translatable message string.
> That discrepancy is confusing to me. Is there a way to standardize
> both sides in the other direction, so that they actually handle tokens
> up to the "max size"?
I don't think so, because that would create exactly the cross-version
discrepancy we need to avoid. (That is, if sender thinks it can do
16384 when receiver's limit is 16384-4, kaboom.) The patch proposes
to allow slop in this during the auth phase when the packet size is
really being determined by the underlying GSSAPI library anyway.
But once we're past that and our own code is slicing up the data
stream into packets, I think the max packet size is indeed an
inalterable part of the protocol.
Could we address your confusion by improving the comment about the
packet-size #define to point out that it includes the header word?
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, jacob.champion@enterprisedb.com, cgooch@bamfunds.com, pgsql-bugs@lists.postgresql.org
Subject: Re: [EXT] Re: GSS Auth issue when user member of lots of AD groups
In-Reply-To: <1350781.1748384129@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox