mirror of
https://github.com/neondatabase/neon.git
synced 2026-01-08 05:52:55 +00:00
da9c101939
The compute_ctl HTTP server has the following purposes: - Allow management via the control plane - Provide an endpoint for scaping metrics - Provide APIs for compute internal clients - Neon Postgres extension for installing remote extensions - local_proxy for installing extensions and adding grants The first two purposes require the HTTP server to be available outside the compute. The Neon threat model is a bad actor within our internal network. We need to reduce the surface area of attack. By exposing unnecessary unauthenticated HTTP endpoints to the internal network, we increase the surface area of attack. For endpoints described in the third bullet point, we can just run an extra HTTP server, which is only bound to the loopback interface since all consumers of those endpoints are within the compute.
54 lines
2.1 KiB
Diff
54 lines
2.1 KiB
Diff
diff --git a/expected/ut-A.out b/expected/ut-A.out
|
|
index da723b8..5328114 100644
|
|
--- a/expected/ut-A.out
|
|
+++ b/expected/ut-A.out
|
|
@@ -9,13 +9,16 @@ SET search_path TO public;
|
|
----
|
|
-- No.A-1-1-3
|
|
CREATE EXTENSION pg_hint_plan;
|
|
+LOG: Sending request to compute_ctl: http://localhost:3081/extension_server/pg_hint_plan
|
|
-- No.A-1-2-3
|
|
DROP EXTENSION pg_hint_plan;
|
|
-- No.A-1-1-4
|
|
CREATE SCHEMA other_schema;
|
|
CREATE EXTENSION pg_hint_plan SCHEMA other_schema;
|
|
+LOG: Sending request to compute_ctl: http://localhost:3081/extension_server/pg_hint_plan
|
|
ERROR: extension "pg_hint_plan" must be installed in schema "hint_plan"
|
|
CREATE EXTENSION pg_hint_plan;
|
|
+LOG: Sending request to compute_ctl: http://localhost:3081/extension_server/pg_hint_plan
|
|
DROP SCHEMA other_schema;
|
|
----
|
|
---- No. A-5-1 comment pattern
|
|
@@ -3175,6 +3178,7 @@ SELECT s.query, s.calls
|
|
FROM public.pg_stat_statements s
|
|
JOIN pg_catalog.pg_database d
|
|
ON (s.dbid = d.oid)
|
|
+ WHERE s.query LIKE 'SELECT * FROM s1.t1%' OR s.query LIKE '%pg_stat_statements_reset%'
|
|
ORDER BY 1;
|
|
query | calls
|
|
--------------------------------------+-------
|
|
diff --git a/expected/ut-fdw.out b/expected/ut-fdw.out
|
|
index d372459..6282afe 100644
|
|
--- a/expected/ut-fdw.out
|
|
+++ b/expected/ut-fdw.out
|
|
@@ -7,6 +7,7 @@ SET pg_hint_plan.debug_print TO on;
|
|
SET client_min_messages TO LOG;
|
|
SET pg_hint_plan.enable_hint TO on;
|
|
CREATE EXTENSION file_fdw;
|
|
+LOG: Sending request to compute_ctl: http://localhost:3081/extension_server/file_fdw
|
|
CREATE SERVER file_server FOREIGN DATA WRAPPER file_fdw;
|
|
CREATE USER MAPPING FOR PUBLIC SERVER file_server;
|
|
CREATE FOREIGN TABLE ft1 (id int, val int) SERVER file_server OPTIONS (format 'csv', filename :'filename');
|
|
diff --git a/sql/ut-A.sql b/sql/ut-A.sql
|
|
index 7c7d58a..4fd1a07 100644
|
|
--- a/sql/ut-A.sql
|
|
+++ b/sql/ut-A.sql
|
|
@@ -963,6 +963,7 @@ SELECT s.query, s.calls
|
|
FROM public.pg_stat_statements s
|
|
JOIN pg_catalog.pg_database d
|
|
ON (s.dbid = d.oid)
|
|
+ WHERE s.query LIKE 'SELECT * FROM s1.t1%' OR s.query LIKE '%pg_stat_statements_reset%'
|
|
ORDER BY 1;
|
|
|
|
----
|