v41-0001-Move-PG_MAX_AUTH_TOKEN_LENGTH-to-libpq-auth.h.patch
application/octet-stream
Filename: v41-0001-Move-PG_MAX_AUTH_TOKEN_LENGTH-to-libpq-auth.h.patch
Type: application/octet-stream
Part: 1
Patch
Same data as JSON:
GET /api/v1/attachments/:id/patch
the parsed metadata as JSON — format, series position, per-file stats; never the diff bytes.
API reference →
Format: format-patch
Series: patch v41-0001
Subject: Move PG_MAX_AUTH_TOKEN_LENGTH to libpq/auth.h
| File | + | − |
|---|---|---|
| src/backend/libpq/auth.c | 0 | 16 |
| src/include/libpq/auth.h | 16 | 0 |
From 386e7c4df31487b28758c76de503c71a05e6ef85 Mon Sep 17 00:00:00 2001 From: Jacob Champion <jacob.champion@enterprisedb.com> Date: Wed, 8 Jan 2025 09:30:05 -0800 Subject: [PATCH v41 1/7] Move PG_MAX_AUTH_TOKEN_LENGTH to libpq/auth.h OAUTHBEARER would like to use this as a limit on Bearer token messages coming from the client, so promote it to the header file. --- src/backend/libpq/auth.c | 16 ---------------- src/include/libpq/auth.h | 16 ++++++++++++++++ 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index 46facc275ef..d6ef32cc823 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -201,22 +201,6 @@ static int CheckRADIUSAuth(Port *port); static int PerformRadiusTransaction(const char *server, const char *secret, const char *portstr, const char *identifier, const char *user_name, const char *passwd); -/* - * Maximum accepted size of GSS and SSPI authentication tokens. - * We also use this as a limit on ordinary password packet lengths. - * - * Kerberos tickets are usually quite small, but the TGTs issued by Windows - * domain controllers include an authorization field known as the Privilege - * Attribute Certificate (PAC), which contains the user's Windows permissions - * (group memberships etc.). The PAC is copied into all tickets obtained on - * the basis of this TGT (even those issued by Unix realms which the Windows - * realm trusts), and can be several kB in size. The maximum token size - * accepted by Windows systems is determined by the MaxAuthToken Windows - * registry setting. Microsoft recommends that it is not set higher than - * 65535 bytes, so that seems like a reasonable limit for us as well. - */ -#define PG_MAX_AUTH_TOKEN_LENGTH 65535 - /*---------------------------------------------------------------- * Global authentication functions *---------------------------------------------------------------- diff --git a/src/include/libpq/auth.h b/src/include/libpq/auth.h index 9157dbe6092..902c5f6de32 100644 --- a/src/include/libpq/auth.h +++ b/src/include/libpq/auth.h @@ -16,6 +16,22 @@ #include "libpq/libpq-be.h" +/* + * Maximum accepted size of GSS and SSPI authentication tokens. + * We also use this as a limit on ordinary password packet lengths. + * + * Kerberos tickets are usually quite small, but the TGTs issued by Windows + * domain controllers include an authorization field known as the Privilege + * Attribute Certificate (PAC), which contains the user's Windows permissions + * (group memberships etc.). The PAC is copied into all tickets obtained on + * the basis of this TGT (even those issued by Unix realms which the Windows + * realm trusts), and can be several kB in size. The maximum token size + * accepted by Windows systems is determined by the MaxAuthToken Windows + * registry setting. Microsoft recommends that it is not set higher than + * 65535 bytes, so that seems like a reasonable limit for us as well. + */ +#define PG_MAX_AUTH_TOKEN_LENGTH 65535 + extern PGDLLIMPORT char *pg_krb_server_keyfile; extern PGDLLIMPORT bool pg_krb_caseins_users; extern PGDLLIMPORT bool pg_gss_accept_delegation; -- 2.34.1