Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1uKhh2-009c2Q-ML for pgsql-bugs@arkaria.postgresql.org; Thu, 29 May 2025 18:09:28 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1uKhh1-00B7Tf-D9 for pgsql-bugs@arkaria.postgresql.org; Thu, 29 May 2025 18:09:27 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1uKhh1-00B7TW-4N for pgsql-bugs@lists.postgresql.org; Thu, 29 May 2025 18:09:27 +0000 Received: from sss.pgh.pa.us ([68.162.161.243]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1uKhgy-000l8x-0q for pgsql-bugs@lists.postgresql.org; Thu, 29 May 2025 18:09:26 +0000 Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1]) by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 54TI9IeL2089826; Thu, 29 May 2025 14:09:18 -0400 From: Tom Lane To: Jacob Champion cc: Chris Gooch , "pgsql-bugs@lists.postgresql.org" Subject: Re: [EXT] Re: GSS Auth issue when user member of lots of AD groups In-reply-to: References: <1529314.1747928806@sss.pgh.pa.us> <1536692.1747933034@sss.pgh.pa.us> <1647590.1747936713@sss.pgh.pa.us> <3060113.1748096813@sss.pgh.pa.us> <3125813.1748115425@sss.pgh.pa.us> <1350781.1748384129@sss.pgh.pa.us> Comments: In-reply-to Jacob Champion message dated "Tue, 27 May 2025 15:24:37 -0700" MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----- =_aaaaaaaaaa0" Content-ID: <2089746.1748542104.0@sss.pgh.pa.us> Content-Transfer-Encoding: 8bit Date: Thu, 29 May 2025 14:09:18 -0400 Message-ID: <2089825.1748542158@sss.pgh.pa.us> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk ------- =_aaaaaaaaaa0 Content-Type: text/plain; charset="UTF-8" Content-ID: <2089746.1748542104.1@sss.pgh.pa.us> Content-Transfer-Encoding: 8bit Jacob Champion writes: > On Tue, May 27, 2025 at 3:15 PM Tom Lane wrote: >> Could we address your confusion by improving the comment about the >> packet-size #define to point out that it includes the header word? > Yes, I think so. Here's a delta patch responding to your review comments so far: knock the max auth-packet size down to 64k, and annotate the size macros as including the header word. If you're planning to spend more time looking at this, please let me know, otherwise I'll go ahead and push the fixes. regards, tom lane ------- =_aaaaaaaaaa0 Content-Type: text/x-diff; name="gssapi.delta.patch"; charset="us-ascii" Content-ID: <2089746.1748542104.2@sss.pgh.pa.us> Content-Description: gssapi.delta.patch diff -pud be-secure-gssapi.c~ be-secure-gssapi.c --- be-secure-gssapi.c~ 2025-05-29 13:56:23.359900699 -0400 +++ be-secure-gssapi.c 2025-05-29 13:59:54.931254443 -0400 @@ -49,16 +49,15 @@ * Therefore, this #define is effectively part of the protocol * spec and can't ever be changed. */ -#define PQ_GSS_MAX_PACKET_SIZE 16384 +#define PQ_GSS_MAX_PACKET_SIZE 16384 /* includes uint32 header word */ /* * However, during the authentication exchange we must cope with whatever * message size the GSSAPI library wants to send (because our protocol * doesn't support splitting those messages). Depending on configuration - * those messages might be as much as 64kB. To provide some safety margin - * we use 128kB buffers during transport negotiation. + * those messages might be as much as 64kB. */ -#define PQ_GSS_AUTH_BUFFER_SIZE 131072 +#define PQ_GSS_AUTH_BUFFER_SIZE 65536 /* includes uint32 header word */ /* * Since we manage at most one GSS-encrypted connection per backend, diff -pud fe-secure-gssapi.c~ fe-secure-gssapi.c --- fe-secure-gssapi.c~ 2025-05-29 13:56:23.359900699 -0400 +++ fe-secure-gssapi.c 2025-05-29 13:59:59.988262778 -0400 @@ -50,16 +50,15 @@ * Therefore, this #define is effectively part of the protocol * spec and can't ever be changed. */ -#define PQ_GSS_MAX_PACKET_SIZE 16384 +#define PQ_GSS_MAX_PACKET_SIZE 16384 /* includes uint32 header word */ /* * However, during the authentication exchange we must cope with whatever * message size the GSSAPI library wants to send (because our protocol * doesn't support splitting those messages). Depending on configuration - * those messages might be as much as 64kB. To provide some safety margin - * we use 128kB buffers during transport negotiation. + * those messages might be as much as 64kB. */ -#define PQ_GSS_AUTH_BUFFER_SIZE 131072 +#define PQ_GSS_AUTH_BUFFER_SIZE 65536 /* includes uint32 header word */ /* * We need these state variables per-connection. To allow the functions ------- =_aaaaaaaaaa0--