| From: | Greg Sabino Mullane <htamfids(at)gmail(dot)com> |
|---|---|
| To: | Andres Freund <andres(at)anarazel(dot)de> |
| Cc: | Antonin Houska <ah(at)cybertec(dot)at>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org> |
| Subject: | Re: POC: Carefully exposing information without authentication |
| Date: | 2026-09-07 02:15:52 |
| Message-ID: | CAKAnmm+eGs++amVMuq-dGXzUOHRNytHgMcaX_5N+jvitmBn6MA@mail.gmail.com |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Please find attached a new version. I recently was working with a client
that had an F5 BIG-IP and needed to know how to tell which of a list of
servers was the primary (and which were replicas). If one has Patroni, then
it has an API for that. If not (as was the case here), the answer is to
write a shell script that connects to the local database, runs
pg_is_in_recovery(), and then outputs the result in a form readable by the
F5. Then make that script executable somehow on an open port, such that the
F5 can reach it. And possibly create a database user for this as well,
storing its credentials locally. Which is a whole lot of trouble just to
answer the question "is this the primary?". This reminded me once again of
this patch, so I took a new look at it and cleaned it up. Some changes I
made this round:
* Removed the "GET /info". Seems unlikely to be used: people are going to
want to know the version, or the role, but not both. So this was removed to
simplify the code
* Made the send() and recv() a lot more robust (including a timeout for
send(), and win32 socket handling [mostly based on be-secure.c: but
untested by myself on Windows]).
* Added a HEAD and GET for /primary, in addition to the existing /replica.
While this will never be a drop-in replacement for the full Patroni API,
the use of /primary and /replica should cover most cases (e.g. the F5 case)
* Changed the name of the GUC entry from "replica" to "role"
* Tightened up the checks to allow exact strings only, and added more tests
Cheers,
Greg
| Attachment | Content-Type | Size |
|---|---|---|
| 0007-Allow-specific-information-to-be-output-directly-by-Postgres.patch | application/octet-stream | 23.1 KB |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | David Rowley | 2026-09-07 03:01:50 | Re: SUM(int2)/SUM(int4) do not detect overflow of the int8 accumulator |
| Previous Message | Tom Lane | 2026-09-07 01:43:33 | Re: Remove toast_max_chunk_size from control file |