Kiu/VictoriaMetrics
Kiu/VictoriaMetrics
1
0
Fork 0
mirror of https://github.com/VictoriaMetrics/VictoriaMetrics.git synced 2024-12-18 14:40:26 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
7026498359
VictoriaMetrics/lib
History
Aliaksandr Valialkin 7026498359
lib/httpserver: revert 9b7e532172 
Reason for revert: this commit doesn't resolve real security issues,
while it complicates the resulting code in subtle ways (aka security circus).

Comparison of two strings (passwords, auth keys) takes a few nanoseconds.
This comparison is performed in non-trivial http handler, which takes thousands
of nanoseconds, and the request handler timing is non-deterministic because of Go runtime,
Go GC and other concurrently executed goroutines. The request handler timing is even
more non-deterministic when the application is executed in shared environments
such as Kubernetes, where many other applications may run on the same host and use
shared resources of this host (CPU, RAM bandwidth, network bandwidth).

Additionally, it is expected that the passwords and auth keys are passed via TLS-encrypted connections.
Establishing TLS connections takes additional non-trivial time (millions of nanoseconds),
which depends on many factors such as network latency, network congestion, etc.

This makes impossible to conduct timing attack on passwords and auth keys in VictoriaMetrics components.

Updates https://github.com/VictoriaMetrics/VictoriaMetrics/pull/6423/files
Updates https://github.com/VictoriaMetrics/VictoriaMetrics/issues/6392
2024-06-25 01:51:06 +02:00
..
appmetrics all: add -metrics.exposeMetadata command-line flag, which can be used for adding TYPE and HELP metadata for metrics exposed at /metrics page 2023-12-19 03:26:02 +02:00
auth lib/auth: add NewTokenPossibleMultitenant() for parsing auth token, which can be multitenant 2023-08-30 14:13:51 +02:00
awsapi lib/awsapi: properly assume role with webIdentity token (#5495) 2023-12-20 19:07:04 +02:00
backup lib/backup/s3remote: fixed credsFilePath flag (#6488) 2024-06-14 14:14:58 +02:00
blockcache lib: consistently use atomic.* types instead of atomic.* functions 2024-02-24 02:10:04 +02:00
bloomfilter lib: consistently use atomic.* types instead of atomic.* functions 2024-02-24 02:10:04 +02:00
bufferedwriter
buildinfo
bytesutil lib/bytesutil: optimize internStringMap cleanup 2024-06-13 15:09:42 +02:00
cgroup lib/cgroup: remove SetGOGC() function 2024-02-05 12:13:08 +02:00
consts
decimal lib/slicesutil: add helper functions for setting slice length and extending its capacity 2024-05-12 11:33:49 +02:00
encoding lib/encoding: optimize UnmarshalVarUint64, UnmarshalVarInt64 and UnmarshalBytes a bit 2024-05-14 01:30:25 +02:00
envflag
envtemplate
fastnum lib/fastnum: use unsafe.Slice() instead of deprecated reflect.SliceHeader 2024-02-29 17:17:24 +02:00
fasttime lib: consistently use atomic.* types instead of atomic.* functions 2024-02-24 02:10:04 +02:00
filestream lib/filestream: do not measure read / write duration from / to in-memory buffers 2024-01-23 14:53:35 +02:00
flagutil app/vmagent: add max_scrape_size to scrape config (#6434) 2024-06-20 14:00:22 +02:00
formatutil
fs lib/fs/fscore: do not trim content from path (#6503) 2024-06-19 10:37:12 +02:00
handshake lib/handshake: substitute time.Now() with fastttime.UnixTimestamp(), since profiling shows time.Now() is slow 2024-01-23 18:39:28 +02:00
htmlcomponents lib/htmlcomponents: use relative links for the top page and for favicon.ico 2023-11-13 20:28:17 +01:00
httpserver lib/httpserver: revert 9b7e532172 2024-06-25 01:51:06 +02:00
httputils app/vmalert: support DNS SRV record in -remoteWrite.url (#6299) 2024-05-22 10:53:22 +02:00
influxutils
ingestserver lib/logstorage: work-in-progress 2024-06-17 12:13:25 +02:00
leveledbytebufferpool lib/leveledbytebufferpool: do not pool byte slices bigger than 2^18 bytes 2024-06-13 17:02:05 +02:00
logger lib/logger: increase default -loggerMaxArgLen command-line flag value from 500 to 1000 2023-11-14 19:55:55 +01:00
logstorage lib/logstorage: work-in-progress 2024-06-25 00:44:57 +02:00
lrucache lib: consistently use atomic.* types instead of atomic.* functions 2024-02-24 02:10:04 +02:00
memory all: cleanup: remove // +build ... lines, since they are no longer needed after Go1.17, and the minimum supported Go version for VictoriaMetrics source code is Go1.20 2023-11-13 19:15:42 +01:00
mergeset lib/mergeset: adds tracking for indexdb records drop (#6297) 2024-05-24 16:08:34 +02:00
metricsql
netutil app/vmauth: fix discovering backend IPs when url_prefix contains hostname with srv+ prefix (#6401) 2024-06-12 11:47:44 +02:00
persistentqueue Fixed a typo in the FastQueue mutex comment (#6514) 2024-06-20 14:00:08 +02:00
procutil all: cleanup: remove // +build ... lines, since they are no longer needed after Go1.17, and the minimum supported Go version for VictoriaMetrics source code is Go1.20 2023-11-13 19:15:42 +01:00
promauth all: replace old https://docs.victoriametrics.com/sd_configs.html url with the new one - https://docs.victoriametrics.com/sd_configs/ 2024-04-18 02:28:26 +02:00
prompb Exemplar support (#5982) 2024-05-10 13:14:17 +02:00
prompbmarshal lib/slicesutil: add helper functions for setting slice length and extending its capacity 2024-05-12 11:33:49 +02:00
promrelabel lib/promrelabel: speedup label match by __name__ (#6432) 2024-06-07 16:35:52 +02:00
promscrape app/vmagent: add max_scrape_size to scrape config (#6434) 2024-06-20 14:00:22 +02:00
promutils lib/logstorage: work-in-progress 2024-06-04 01:50:55 +02:00
protoparser lib/protoparser/opentelemetry/firehose: escape requestID before returning it to user (#6451) 2024-06-10 18:06:24 +02:00
proxy lib/promscrape: use the standard net/http.Client instead of fasthttp.Client for scraping targets in non-streaming mode 2024-01-30 18:39:55 +02:00
pushmetrics lib/pushmetrics: wait until the background goroutines, which push metrics, are stopped at pushmetrics.Stop() 2024-01-16 21:18:22 +02:00
querytracer lib/querytracer: add missing blank comment line after 3121d76bee 2023-11-15 16:11:50 +01:00
ratelimiter app/vmagent: properly shutdown when -maxIngestionRate limit is reached 2024-04-03 02:41:11 +03:00
regexutil lib/logstorage: work-in-progress 2024-05-25 22:59:21 +02:00
slicesutil lib/slicesutil: add helper functions for setting slice length and extending its capacity 2024-05-12 11:33:49 +02:00
snapshot Revert "app/vmbackup: introduce new flag type URL (#6152)" 2024-04-24 17:08:26 +02:00
storage lib/storage: filter deleted label names and values from `/api/v1/labe… (#6342) 2024-05-29 14:37:00 +02:00
streamaggr lib/streamaggr: remove accidentally committed changes 2024-06-17 14:25:45 +02:00
stringsutil lib/logstorage: work-in-progress 2024-05-22 21:01:28 +02:00
syncwg
tenantmetrics
timerpool
timeutil all: add up to 10% random jitter to the interval between periodic tasks performed by various components 2024-01-22 18:39:16 +02:00
uint64set lib/slicesutil: add helper functions for setting slice length and extending its capacity 2024-05-12 11:33:49 +02:00
vmselectapi lib: consistently use atomic.* types instead of atomic.* functions 2024-02-24 02:10:04 +02:00
workingsetcache lib: consistently use atomic.* types instead of atomic.* functions 2024-02-24 02:10:04 +02:00
writeconcurrencylimiter app/vmagent/remotewrite: clarify the reason behind the default value for -remoteWrite.queues in the same way as the reason for -maxConcurrentInserts is defined at 73f5fb0f0c 2024-03-06 13:57:53 +02:00