Eric Day wrote:
Hi Andrey,
On Fri, Jan 09, 2009 at 08:52:15PM +0100, Andrey Hristov wrote:
It is there, in mysqld, to protect the server from being DoS-ed. Because
the queries are being re-assembled in the server and the passed for
parsing, a user with low privs can send a 2GB query to the server and
DoS it. The admin can define how big that max query can be by adjusting
max_allowed_packet. Although the name references the protocol it has
security implications on the server.
I won't kill that one.
Thanks for the insight! As Kristian noted in another reply, part of
this decision is from the Drizzle direction of putting more trust in
the client than MySQL does (like auth being off by default). The other
reason is that, in my opinion, this type of DoS protection belongs
only in the server, and should not be part of the protocol. I think
having a pre-parse memory limit is valuable, but this should not be
exposed to the client. Perhaps we can rename max_allowed_packet to
something more server-internal specific, and just take it out of the
protocol negotiation.
Well, this saves a round-trip to the server to set a packet size. Lower
packet size -> lower memory utilisation on the server.
Best regards,
-Eric
Andrey
_______________________________________________
Mailing list: https://launchpad.net/~drizzle-discuss
Post to : [email protected]
Unsubscribe : https://launchpad.net/~drizzle-discuss
More help : https://help.launchpad.net/ListHelp
