MXS-2414: Prototype connection attempt throttling
The RateLimit class stores authentication failure data mapped by the client IP addresses. The authentication failures are limited per thread. The limits are still hard-coded and at least the number of failures should be made configurable. The simplest, most maintainable and acceptably efficient implementation for DDoS protection is a thread-local unordered_map. The unwanted side-effect of "scaling" of the number of allowed authentication failures is unlikely to be problematic in most use-cases. As the blocking of a host is only temporary, the behavior differs from the one in the MariaDB server. This allows the number of failures to be set to a much lower value negating some of the problems caused by the relatively simple implementation.
This commit is contained in:
@ -818,6 +818,8 @@ static int gw_read_do_authentication(DCB* dcb, GWBUF* read_buffer, int nbytes_re
|
||||
{
|
||||
protocol->protocol_auth_state = MXS_AUTH_STATE_FAILED;
|
||||
mysql_client_auth_error_handling(dcb, auth_val, next_sequence);
|
||||
mxb_assert(dcb->session->listener);
|
||||
dcb->session->listener->mark_auth_as_failed(dcb->remote);
|
||||
/**
|
||||
* Close DCB and which will release MYSQL_session
|
||||
*/
|
||||
|
Reference in New Issue
Block a user