Re: BUG #15182: Canceling authentication due to timeout aka Denial of Service Attack

From: Michael Paquier <michael(at)paquier(dot)xyz>
To: "Bossart, Nathan" <bossartn(at)amazon(dot)com>
Cc: Kyotaro HORIGUCHI <horiguchi(dot)kyotaro(at)lab(dot)ntt(dot)co(dot)jp>, "andres(at)anarazel(dot)de" <andres(at)anarazel(dot)de>, "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org>, "robertmhaas(at)gmail(dot)com" <robertmhaas(at)gmail(dot)com>, "Schneider, Jeremy" <schnjere(at)amazon(dot)com>, "pgsql-hackers(at)postgresql(dot)org" <pgsql-hackers(at)postgresql(dot)org>, "lalbin(at)scharp(dot)org" <lalbin(at)scharp(dot)org>
Subject: Re: BUG #15182: Canceling authentication due to timeout aka Denial of Service Attack
Date: 2018-07-28 00:10:12
Message-ID: 20180728001012.GC1882@paquier.xyz
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs pgsql-hackers

On Fri, Jul 27, 2018 at 02:40:42PM +0000, Bossart, Nathan wrote:
> On 7/26/18, 11:16 PM, "Michael Paquier" <michael(at)paquier(dot)xyz> wrote:
> I think I'm essentially suggesting what you have in 0002 but without
> the new RangeVarGetRelidExtended() callback. I've attached a modified
> version of 0002 that seems to fix the originally reported issue. (I
> haven't looked into any extra handling needed for ANALYZE or
> partitioned tables.) Running the same checks for all VACUUMs would
> keep things simple and provide a more uniform user experience.

Okay, let me check that. Your patch has at least an error in
get_all_vacuum_rels() where toast relations cannot be skipped.

>> The docs mentioned that shared catalogs are processed, so I did not
>> bother, but visibly your comment is that we could be more precise about
>> the ownership in this case? An attempt is attached.
>
> Sorry, I should have been clearer. But yes, your update is what I was
> thinking.

No problem. If there are no objections, I am going to fix the REINDEX
issue first and back-patch. Its patch is the least invasive of the
set.
--
Michael

In response to

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Michael Paquier 2018-07-28 04:01:49 Re: BUG #15303: Postgres fail to start if pg_wal is symlink, and works when it's a junction point
Previous Message Vasilis Ventirozos 2018-07-27 21:38:06 Re: BUG #15304: Problem when replicating Floating point timestamps to int64 timestamps

Browse pgsql-hackers by date

  From Date Subject
Next Message Tatsuo Ishii 2018-07-28 01:23:12 Removing useless \. at the end of copy in pgbench
Previous Message Michael Paquier 2018-07-27 23:10:10 Re: add verbosity to pg_basebackup for sync