From: Heikki Linnakangas <heikki.linnakangas@iki.fi>
Date: Wed, 14 Oct 2009 07:27:44 +0000 (+0000)
Subject: Raise the maximum authentication token (Kerberos ticket) size in GSSAPI
X-Git-Tag: REL8_3_9~24
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c6b4d4fbc8cf8558e381fcc68f101baa1e04e2a0;p=postgresql

Raise the maximum authentication token (Kerberos ticket) size in GSSAPI
and SSPI athentication methods. While the old 2000 byte limit was more than
enough for Unix Kerberos implementations, tickets issued by Windows Domain
Controllers can be much larger.

Ian Turner
---

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 0c9fc850db..9ec424fc5d 100644
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.164.2.2 2009/06/25 11:30:12 mha Exp $
+ *	  $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.164.2.3 2009/10/14 07:27:44 heikki Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -90,6 +90,20 @@ ULONG(*__ldap_start_tls_sA) (
 static int	CheckLDAPAuth(Port *port);
 #endif
 
+/*
+ * Maximum size of GSS and SSPI authentication tokens.
+ *
+ * Kerberos tickets are usually quite small, but the TGTs issued by Windows
+ * domain controllers include an authorization field known as the Privilege
+ * Attribute Certificate (PAC), which contains the user's Windows permissions
+ * (group memberships etc.). The PAC is copied into all tickets obtained on
+ * the basis of this TGT (even those issued by Unix realms which the Windows
+ * realm trusts), and can be several kB in size. The maximum token size
+ * accepted by Windows systems is determined by the MaxAuthToken Windows
+ * registry setting. Microsoft recommends that it is not set higher than
+ * 65535 bytes, so that seems like a reasonable limit for us as well.
+ */
+#define MAX_AUTH_TOKEN_LENGTH	65535
 
 #ifdef KRB5
 /*----------------------------------------------------------------
@@ -463,7 +477,7 @@ pg_GSS_recvauth(Port *port)
 
 		/* Get the actual GSS token */
 		initStringInfo(&buf);
-		if (pq_getmessage(&buf, 2000))
+		if (pq_getmessage(&buf, MAX_AUTH_TOKEN_LENGTH))
 		{
 			/* EOF - pq_getmessage already logged error */
 			pfree(buf.data);
@@ -725,7 +739,7 @@ pg_SSPI_recvauth(Port *port)
 
 		/* Get the actual SSPI token */
 		initStringInfo(&buf);
-		if (pq_getmessage(&buf, 2000))
+		if (pq_getmessage(&buf, MAX_AUTH_TOKEN_LENGTH))
 		{
 			/* EOF - pq_getmessage already logged error */
 			pfree(buf.data);