Isn't this way lead to DDoS attack via log overflow?

Hi sanja,

I don't think I would consider this feature request a good candidate for DDoS attacks. Failed authentication attempts already write warnings to the error log when log_warnings=2, so this feature request isn't even very novel when compared to the current behavior.

I think this feature request's potential as a DDoS attack is especially limited, since a host would be blocked after its failed connection attempts reached max_connect_errors, which defaults to only 100.

https://mariadb.com/kb/en/library/server-system-variables/#max_connect_errors

And additionally, if someone were really worried about their log size growing enough to cause a denial of service, then they should definitely configure log rotation.

https://mariadb.com/kb/en/library/rotating-logs-on-unix-and-linux/

didn't 'unauthenticated' point that there was no authentication?

If there is concerns that somebody can create such user, I can change it to

 @@@@%%%%!!!!§§§§§ununauthenticated§§§§§!!!!!%%%%%@@@@@ 

and change the priority of the warning

I think the current "unauthenticated" user name is fine.

I think the priority should be changed to 2, and I think the message in the parenthesis should be changed from CLOSE_CONNECTION to something more descriptive.

what can be more descriptive? the code is like this:

  thd->print_aborted_warning(3, sql_errno ? ER_DEFAULT(sql_errno)

                                          : "CLOSE_CONNECTION");

i.e. if there is no error we write "CLOSE_CONNECTION" as an error, probably I can write "CLOSED_BY_USER_CONNECTION", but it would not be true, we just do not know why connection is closed, so I am open for suggestion about what to write if the connection closed with no error.

NORMALLY_CLOSED_CONNECTION ?
NO_ERROR_CLOSED_CONNECTION ?
This connection closed without an error ?

My suggestion in the issue description was "Connection closed without authenticating". This is way more descriptive because it makes it extremely clear that the connection had not performed authentication before it was closed.

I can not write this if it was authenticated, I can make 2 cases for closing without an error:
1) connection closed normally
2) connection closed normally without authentication

That sounds good to me.

Hi sanja. The patch is fine, but I'd like have a test case for connect timeout (connect with socket on the port, and do nothing for a while), if possible.
A more specific error message in case of connect timeout would be helpful (this can be made another MDEV, if you wish)