Re: POC: Carefully exposing information without authentication - Mailing list pgsql-hackers

From Antonin Houska
Subject Re: POC: Carefully exposing information without authentication
Date
Msg-id 11894.1767966998@localhost
Whole thread Raw
In response to Re: POC: Carefully exposing information without authentication  (Greg Sabino Mullane <htamfids@gmail.com>)
Responses Re: POC: Carefully exposing information without authentication
List pgsql-hackers
Greg Sabino Mullane <htamfids@gmail.com> wrote:

> Version 4 attached, rebased to account for new tests, plus a new instra-test
> check to make sure LWP::UserAgent is available before running.

I'm still not sure it's necessary to handle the problem at socket level. I
imagine it can be implemented this way:

1. Add a new field to the PGconn structure, indicating that the client is only
requesting the server status information, and adjust pg_isready so it sets
this option.

2. Adjust libpq frontend (pqBuildStartupPacket3) so it adds the corresponding
option to the startup packet.

3. On server, if ProcessStartupPacket() sees that option, call ereport(FATAL)
with a specific error code, and let the appropriate GUCs control the contents
of the error message. pg_isready would then just print out the message.

I haven't tried to write any code, so it's possible that I'm missing
something.

Regarding configuration, I'd prefer a single GUC. The value can be a
comma-separated list of keywords, each representing particular piece of
information to be exposed.

-- 
Antonin Houska
Web: https://www.cybertec-postgresql.com



pgsql-hackers by date:

Previous
From: Jakub Wartak
Date:
Subject: Re: pg_plan_advice
Next
From: Greg Sabino Mullane
Date:
Subject: Re: POC: Carefully exposing information without authentication