Re: BUG #15182: Canceling authentication due to timeout aka Denialof Service Attack - Mailing list pgsql-hackers

From Michael Paquier
Subject Re: BUG #15182: Canceling authentication due to timeout aka Denialof Service Attack
Date
Msg-id 20180829013441.GO29157@paquier.xyz
Whole thread Raw
In response to Re: BUG #15182: Canceling authentication due to timeout aka Denialof Service Attack  (Michael Paquier <michael@paquier.xyz>)
List pgsql-hackers
Hi all,

Here is a summary of what has happened since this thread has been
created.  Three problems reported on this thread have been solved and
resulted in different commits for early lock lookups:
- VACUUM FULL, patched on 12~:
https://www.postgresql.org/message-id/20180812222142.GA6097@paquier.xyz
Commit a556549: Improve VACUUM and ANALYZE by avoiding early lock queue
- TRUNCATE, patched on 12~:
https://www.postgresql.org/message-id/20180806165816.GA19883@paquier.xyz
Commit f841ceb: Improve TRUNCATE by avoiding early lock queue
- REINDEX, patched on 11~:
https://www.postgresql.org/message-id/20180805211059.GA2185@paquier.xyz
Commit 661dd23: Restrict access to reindex of shared catalogs for
non-privileged users

Please note that I have been very conservative with the different fixes
as v11 is getting very close to release.  The patch for REINDEX is a
behavior change which will not get further down anyway.  It would still
be nice to get a second lookup at the code and look if there are other
suspicious calls of relation_open or such which could allow
non-privileged users to pile up locks and cause more DOS problems.

Thanks,
--
Michael

Attachment

pgsql-hackers by date:

Previous
From: Masahiko Sawada
Date:
Subject: Re: Copy function for logical replication slots
Next
From: Kyotaro HORIGUCHI
Date:
Subject: Re: Reopen logfile on SIGHUP