From: Tom Lane <tgl@sss.pgh.pa.us>
To: Chris Gooch <cgooch@bamfunds.com>
cc: Jacob Champion <jacob.champion@enterprisedb.com>,
        "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
Subject: Re: [EXT] Re: GSS Auth issue when user member of lots of AD groups
In-reply-to: <3060113.1748096813@sss.pgh.pa.us>
References: 
 <DS0PR22MB5971A9C8A3F44BCC6293C4DABE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
 <1529314.1747928806@sss.pgh.pa.us>
 <CAOYmi+nZpOu_Yd_dvQQehK78B48MB-TT1Z7Myp1xSQ1uUHHZVQ@mail.gmail.com>
 <1536692.1747933034@sss.pgh.pa.us>
 <CAOYmi+mPdZwNe16yozk40G8hW3d1Rxnoipu0dw52AiuZRoabaA@mail.gmail.com>
 <1647590.1747936713@sss.pgh.pa.us>
 <DS0PR22MB597134B3D28AC101C8936007BE9BA@DS0PR22MB5971.namprd22.prod.outlook.com>
 <3060113.1748096813@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Sat, 24 May 2025 10:26:53 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3125812.1748115425.1@sss.pgh.pa.us>
Date: Sat, 24 May 2025 15:37:05 -0400
Message-ID: <3125813.1748115425@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3125813.1748115425%40sss.pgh.pa.us>
Precedence: bulk

I wrote:
> I believe we've agreed that it'd be sufficient if we allow the
> packets exchanged during the auth phase to be up to 64K or so,
> but once we reach the point where we're able to split the
> data on arbitrary boundaries, keep the packet size at 16K
> for cross-version compatibility.

OK, here's a set of draft patches for that.  (The HEAD one works
on v16 and v17 too, the v15 one works on v14 too.  They are all
basically the same, but we kept revising libpq's internal convention
for error reports ...)

I am not in a great position to test these with a setup that actually
needs larger auth messages; I wonder if Chris can test?

Some notes:

* Is 128kB unreasonably large?  I think we may want some daylight
above 64kB, but I'm not sure how much.

* I concluded that the error report that's being given for the case
is just flat-out bogus.  The GSSAPI library has not given us an
error report so asking it for info is useless, which leads to the
very unhelpful error message Chris showed.  We should just report
"client tried to send oversize GSSAPI packet" as we do elsewhere.

* It seems pretty silly to have separate symbols for
PQ_GSS_SEND_BUFFER_SIZE and PQ_GSS_RECV_BUFFER_SIZE
when we're requiring those to be the same, so I merged
them into one symbol PQ_GSS_MAX_PACKET_SIZE.

* The backend's secure_open_gssapi allowed received initialization packets
to be up to buffer-size long, whereas libpq will choke sending them
if they're more than buffer-size minus sizeof(uint32).  This isn't
actually a bug, since the buffer management is handled in such a way
that it's safe, but it seems very inconsistent.  I changed the limit
to subtract off sizeof(uint32) in all cases, which incidentally
allowed removing one variant of the translatable message string.

			regards, tom lane