From: Michael Paquier <michael@paquier.xyz>
To: Bossart, Nathan <bossartn@amazon.com>
Cc: Kyotaro HORIGUCHI <horiguchi.kyotaro@lab.ntt.co.jp>
Cc: andres@anarazel.de <andres@anarazel.de>
Cc: pgsql-hackers@lists.postgresql.org <pgsql-hackers@lists.postgresql.org>
Cc: robertmhaas@gmail.com <robertmhaas@gmail.com>
Cc: Schneider, Jeremy <schnjere@amazon.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Cc: lalbin@scharp.org <lalbin@scharp.org>
Subject: Re: BUG #15182: Canceling authentication due to timeout aka Denial of Service Attack
Date: Tue, 28 Aug 2018 18:34:41 -0700
Message-ID: <20180829013441.GO29157@paquier.xyz> (raw)
In-Reply-To: <20180811095003.GA2900@paquier.xyz>
References: <20180726204127.GA1754@paquier.xyz>
<3D4F2733-92AE-4B74-8912-3C611B027721@amazon.com>
<20180727023123.GE1754@paquier.xyz>
<20180727.123702.77822416.horiguchi.kyotaro@lab.ntt.co.jp>
<20180727041542.GH1754@paquier.xyz>
<62728D88-85A0-4A9A-A4F8-67D96C1179E0@amazon.com>
<20180811095003.GA2900@paquier.xyz>
Hi all,
Here is a summary of what has happened since this thread has been
created. Three problems reported on this thread have been solved and
resulted in different commits for early lock lookups:
- VACUUM FULL, patched on 12~:
https://www.postgresql.org/message-id/20180812222142.GA6097@paquier.xyz
Commit a556549: Improve VACUUM and ANALYZE by avoiding early lock queue
- TRUNCATE, patched on 12~:
https://www.postgresql.org/message-id/20180806165816.GA19883@paquier.xyz
Commit f841ceb: Improve TRUNCATE by avoiding early lock queue
- REINDEX, patched on 11~:
https://www.postgresql.org/message-id/20180805211059.GA2185@paquier.xyz
Commit 661dd23: Restrict access to reindex of shared catalogs for
non-privileged users
Please note that I have been very conservative with the different fixes
as v11 is getting very close to release. The patch for REINDEX is a
behavior change which will not get further down anyway. It would still
be nice to get a second lookup at the code and look if there are other
suspicious calls of relation_open or such which could allow
non-privileged users to pile up locks and cause more DOS problems.
Thanks,
--
Michael
Attachments:
[application/pgp-signature] signature.asc (832B, ../20180829013441.GO29157@paquier.xyz/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: michael@paquier.xyz, bossartn@amazon.com, horiguchi.kyotaro@lab.ntt.co.jp, andres@anarazel.de, pgsql-hackers@lists.postgresql.org, robertmhaas@gmail.com, schnjere@amazon.com, pgsql-hackers@postgresql.org, lalbin@scharp.org
Subject: Re: BUG #15182: Canceling authentication due to timeout aka Denial of Service Attack
In-Reply-To: <20180829013441.GO29157@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox