Date: Sat, 28 Jul 2018 09:10:12 +0900
From: Michael Paquier <michael@paquier.xyz>
To: "Bossart, Nathan" <bossartn@amazon.com>
Cc: Kyotaro HORIGUCHI <horiguchi.kyotaro@lab.ntt.co.jp>,
	"andres@anarazel.de" <andres@anarazel.de>,
	"pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>,
	"robertmhaas@gmail.com" <robertmhaas@gmail.com>,
	"Schneider, Jeremy" <schnjere@amazon.com>,
	"pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>,
	"lalbin@scharp.org" <lalbin@scharp.org>
Subject: Re: BUG #15182: Canceling authentication due to timeout aka Denial
 of Service Attack
Message-ID: <20180728001012.GC1882@paquier.xyz>
References: <20180726204127.GA1754@paquier.xyz>
 <3D4F2733-92AE-4B74-8912-3C611B027721@amazon.com>
 <20180727023123.GE1754@paquier.xyz>
 <20180727.123702.77822416.horiguchi.kyotaro@lab.ntt.co.jp>
 <20180727041542.GH1754@paquier.xyz>
 <62728D88-85A0-4A9A-A4F8-67D96C1179E0@amazon.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="QRj9sO5tAVLaXnSD"
Content-Disposition: inline
In-Reply-To: <62728D88-85A0-4A9A-A4F8-67D96C1179E0@amazon.com>
Precedence: bulk


--QRj9sO5tAVLaXnSD
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Jul 27, 2018 at 02:40:42PM +0000, Bossart, Nathan wrote:
> On 7/26/18, 11:16 PM, "Michael Paquier" <michael@paquier.xyz> wrote:
> I think I'm essentially suggesting what you have in 0002 but without
> the new RangeVarGetRelidExtended() callback.  I've attached a modified
> version of 0002 that seems to fix the originally reported issue.  (I
> haven't looked into any extra handling needed for ANALYZE or
> partitioned tables.)  Running the same checks for all VACUUMs would
> keep things simple and provide a more uniform user experience.

Okay, let me check that.  Your patch has at least an error in
get_all_vacuum_rels() where toast relations cannot be skipped.

>> The docs mentioned that shared catalogs are processed, so I did not
>> bother, but visibly your comment is that we could be more precise about
>> the ownership in this case?  An attempt is attached.
>=20
> Sorry, I should have been clearer.  But yes, your update is what I was
> thinking.

No problem.  If there are no objections, I am going to fix the REINDEX
issue first and back-patch.  Its patch is the least invasive of the
set.
--
Michael

--QRj9sO5tAVLaXnSD
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAltbtGQACgkQnvQgOdby
QH1tzg/+Kk1paePp13JOQ9ZLWHbKYUn8OBYJpQJYdhnb00x6nSoWrRxOarRaZ3cr
IKqW2WbfUSIAUCwlh7+CYIHLqKgerQiyDZxwHbmr5hB8BN0t8bFTrbh9YfdtcR+g
Oh0mTJaQSqRoMZziqpUurQQWF+AtZ3pG/sABkkRyDTtoMFEdg90Uhljbe1uc/3bY
FCX8t7MH2gdzU2QVYWAKxvvJFu2geCRzRVXoP68wbU7I2A+x22aOYLqK2dR9XbSe
ZGvCKeQ/eVQDMDHAxwq1aKwnl1BznUPDJwqyRkUOB4GdDIPytAYApSgK6m9wZoPH
L+ff0Zeg27R95OKrWHsNxwBox45Q3HDS+9p2RyjG3lDOmwAL+ruiHRlDRdX9L1r7
WHpb9D+Xv2YVTut8Q0lgrxShdDEL/+yxLJhTxDY4dy17RATWxqGCRnJfQeJ0YZX8
xRuQM/UcCBtY6spHw5Zj+g/wY07FU6iO08qnQAQF4s928r4FC/JBhzYsRTwiWLHo
KD6N76lj75A4hai3bPzy9J8l4aTrhrSM+A7f+5HsxAUOIlYc4ewAto/Fxr8eOv2G
O6BVNj2/Vlm8nkjkQRfthvXtFTYw38n8BZCXLNvewCdQKfyGngKFG8pd2AY3y6B9
O/4NoV543ShPwEJI50R0UhKW6M9gOaMgFVZso2K1b5FkSaqav1M=
=5nQc
-----END PGP SIGNATURE-----

--QRj9sO5tAVLaXnSD--