proxysql

Commit Graph

Author	SHA1	Message	Date
René Cannaò	741ce1e36f	fix(pgsql): native query error must not be misclassified as broken connection is_connection_in_reusable_state() called PQtransactionStatus(pgsql_conn) directly; in native mode pgsql_conn is NULL so libpq returns PQTRANS_UNKNOWN, making the session treat a normal backend query error (ErrorResponse + ReadyForQuery, the connection is still idle/reusable) as a broken connection and retry instead of forwarding the error (with its SQLSTATE) to the client. Derive the transaction status from the natively-tracked ReadyForQuery byte in native mode.	2 weeks ago
René Cannaò	21600ac7cf	fix(pgsql): native Query message must have exactly one NUL terminator The native simple-query path appended a NUL to query.length bytes, but the client-query callers (async_query with pgsql_real_query.QuerySize) pass a length that already includes the trailing NUL, producing a malformed double-NUL Query body. PostgreSQL rejects it with 08P01 'invalid message format', breaking the backend connection. Normalize to the SQL up to the first NUL (bounded by query.length) plus a single terminator, matching PQsendQuery semantics. The strlen()-based callers (async_send_simple_command/init_connect) are unaffected.	2 weeks ago
René Cannaò	6e344f04e5	feat(pgsql): native simple-query + simple-command execution (stream-through results) [Task 1.6c / Phase 2 core]	2 weeks ago
René Cannaò	f9ac5607bf	test(pgsql): differential native-vs-libpq auth test (compiles; run pending Docker) [Task 1.8]	2 weeks ago
René Cannaò	f953a3f137	feat(pgsql): native backend TLS (SSLRequest + client handshake + cert verification) [Task 1.6b]	2 weeks ago
René Cannaò	b027c8c21d	fix(pgsql): native connect entry guards (handler first-call flag, async_connect assert) + timeout teardown [Task 1.6a]	2 weeks ago
René Cannaò	b7bedf06f2	feat(pgsql): native PostgreSQL connect + auth (trust/md5/SCRAM, no TLS) [Task 1.6a]	2 weeks ago
René Cannaò	630c076527	docs: defer SCRAM channel binding (-PLUS) to Phase 1b (libscram lacks client cbind)	2 weeks ago
René Cannaò	4e90372ef4	feat(pgsql): native SCRAM-SHA-256 client exchange over libscram with proof-correctness test	2 weeks ago
René Cannaò	ad31ded2fb	feat(pgsql): native md5 password auth builder with known-vector unit test	2 weeks ago
René Cannaò	6ed54c51bf	feat(pgsql): native startup + SSLRequest encoders with unit tests	2 weeks ago
René Cannaò	6874b5a9a2	fix(pgsql): harden backend framer (msg-length cap, realloc/overflow checks, noncopyable)	2 weeks ago
René Cannaò	544799257c	feat(pgsql): native backend message framer with partial-message handling + unit tests Add PgSQL_Backend_Msg_Framer: a pure wire-message framer for the native PostgreSQL backend protocol. It accepts fed bytes (possibly partial) and yields complete messages (type byte + 4-byte big-endian length-prefixed body), signaling FRAME_NEED_MORE on incomplete trailing bytes and FRAME_ERROR on a malformed length. Header stays light (cstdint/cstddef only). Destructor frees the realloc'd buffer to avoid a leak on long-lived connections. Wire it into libproxysql.a via _OBJ_CXX in lib/Makefile. Also fix a pre-existing duplicate vec.o on the unit-test link line: the test/tap/tests/unit/Makefile appended SQLITE3_LDIR/vec.o to STATIC_LIBS in two separate PROXYSQL40 blocks, producing ~98 duplicate-symbol errors that broke every unit test under PROXYSQL40. Keep the single append after the autodetection block.	2 weeks ago
René Cannaò	e5e99e3898	feat(pgsql): native_mode dispatch skeleton with libpq fallback (Phase 0 inert)	2 weeks ago
René Cannaò	d539351a0f	feat(pgsql): add native_mode + backend protocol member to PgSQL_Connection	3 weeks ago
René Cannaò	eef410e5ed	feat(pgsql): add pgsql-use_native_backend_protocol runtime variable (default off)	3 weeks ago
René Cannaò	0572b0327e	docs: fix build commands in plan (plain make, never bare make -j)	3 weeks ago
René Cannaò	e2448f8078	docs: Phase 0+1 implementation plan for native PostgreSQL backend protocol	3 weeks ago
René Cannaò	abb93dce29	docs: design spec for native PostgreSQL backend protocol (replace libpq on data path)	3 weeks ago
René Cannaò	7ddb3dc015	Merge pull request #5840 from sysown/fix/clang-parsersql-cxx-and-arm64-verify-file fix(build,ci): unblock clang packages + arm64 package verification (3.0.9)	3 weeks ago
Rene Cannao	b41df66032	chore(deps): vendor ParserSQL 1.0.9 tarball from official v1.0.9 tag Regenerated via git archive of the released v1.0.9 tag (ProxySQL/ParserSQL) for provenance; tree is identical to the prior commit.	3 weeks ago
Rene Cannao	792d48d801	fix(build,ci): clang package builds + arm64 package verification Two release-blocking bugs surfaced while building 3.0.9/3.1.9 packages: 1. clang builds (16 distro variants) failed at deps build with exit 127. Root cause: vendored ParserSQL's Makefile hardcoded `CXX = g++`, which the `CC=.. CXX=.. make` env prefix does not override, so clang containers (no g++) could not compile src/sql_parser/*.o. Fixed upstream in ParserSQL 1.0.9 (CXX ?= g++); re-vendored the 1.0.9 tarball and repointed the symlink. No change needed to deps/Makefile. 2. arm64 base package builds (14 distros) failed in the new 'Verify package installs' step: verify-package-install.bash used `file` (and `which`), absent in slim base images, so verification aborted after a good build and blocked the upload. Replaced with a portable ELF-magic check (head -c4 + od) and `command -v`.	3 weeks ago
René Cannaò	cae8c76e12	Merge pull request #5828 from sysown/feature/ci-codecov-tap-all-groups-callers ci(coverage): grant write-all on TAP-group callers for Codecov OIDC	1 month ago
Rene Cannao	b25ed9f804	fix(ci): broaden CI-unit-tests-asan-coverage to write-all for OIDC + checks Follow-up to `30b255339`, which added `checks: write` to the narrow permissions block. That wasn't enough -- the next run still failed with "Resource not accessible by integration" at the LouisBrunner/checks-action step. The reason is the workflow_run trigger context. This workflow is spawned by CI-trigger's completion (workflow_run), and the GITHUB_TOKEN GitHub mints for that context is scoped to the default branch, not to the PR branch the cascade was actually testing. Trying to POST a check-run for a PR-branch SHA from that token fails even with `checks: write` granted -- the same wall the legacy-g2-genai pipeline hit during PR #5818 ratcheting (see the commit history on ci-legacy-g2-genai.yml under GH-Actions, where the author tried adding scopes one at a time before settling on write-all). Switch to `permissions: write-all` -- identical to what every TAP- group reusable workflow in this PR's fan-out already declares. The older minimal block's only motivation was a noted desire not to widen scope unnecessarily; in this case the wider scope is actually required for the workflow's last step to succeed.	1 month ago
Rene Cannao	b7b2be0cd4	fix(ci): scrub unescaped double quotes from coverage-trap comment Second self-inflicted breakage on top of `76bfaf527`. My previous comment used markdown-style double quotes around "No such file or directory" and "bash -c". The whole script body is the argument to an outer bash -c "..." block: inside the outer DOUBLE QUOTES, any bare " character closes the outer string early. The inner bash then saw a truncated script ending mid-statement and reported -c: line 96: syntax error: unexpected end of file which tripped set -e in run-tests-isolated.bash and killed every TAP-group run within seconds, just like the backtick regression did before it. This commit rewrites the explanatory comment without any literal " or ` characters: apostrophes throughout, and explicit instructions for the next editor on which characters must stay out of this block (the only legitimate use of " inside the bash -c body is the bash quoting idiom on line 524, where the outer string is intentionally closed to allow ${WORKSPACE} to expand in the OUTER shell before the string is reopened -- that pattern is preserved exactly as-is). Audit: between the opening /bin/bash -c " on line 305 and the closing " on line 525, only one unescaped " remains (the pre-existing ${WORKSPACE} idiom on line 524), and zero backticks.	1 month ago
Rene Cannao	76bfaf5277	fix(ci): remove backticks from explanatory comment that itself triggered the bug Self-inflicted regression on a94ba88a2: the comment intended to warn the next contributor about the backtick-in-bash-c trap reintroduced the same trap twice, in markdown-style code references: # script is wrapped in `bash -c "..."`, and inside the # outer double quotes backticks trigger command # substitution, so `SF:proxysql/...` would make the outer ^^^^^^^^^^^^^^^^^ command substitution: bash tries to execute this token as a command, prints "No such file or directory", trips set -e on the outer docker-run line, the test step exits before any container starts. The previous cascade tally was misleading: the runs at commit `30b25533` never actually fired downstream (workflow_dispatch on a non-default branch doesn't propagate workflow_run events), so the bug hid until the natural pull_request trigger on commit `ca90fb540` fired the cascade and every TAP group exited within seconds. Rewrite the comment without any backticks, single quotes throughout, explicit "NB:" prefix.	1 month ago
Rene Cannao	ca90fb540b	fix(coverage): mount .gcno files into ProxySQL container so gcov runtime resolves daemon coverage Daemon-side coverage has been silently empty since gcov was first wired up. The TAP cascade hits the right code paths and the tester calls `PROXYSQL GCOV DUMP` after every test (proxysql-tester.py line 880), and proxysql writes 226 .gcda files into /gcov. But every single one of them lands with empty metadata: [error]: Missing 'current_working_directory' for data file: {'data_file': '/gcov/obj/MySQL_Query_Processor.gcda', 'files': []} [error]: Missing 'current_working_directory' for data file: {'data_file': '/gcov/obj/MySQL_Session.gcda', 'files': []} ... (x226) fastcov gives up on every one of them. The resulting .info file has zero `lib/.cpp` SF: entries -- only the ~200 header files indirectly pulled in by other sources. Codecov then reports `lib/MySQL_Session.cpp`, `lib/MySQL_Monitor.cpp`, `lib/MySQL_Protocol.cpp`, `lib/Admin_Handler.cpp`, `lib/MySQL_Logger.cpp`, `lib/MySQL_PreparedStatement.cpp`, `lib/ProxySQL_Cluster.cpp` and dozens more at 0% coverage* even though they're the hottest paths in the daemon. Root cause: the proxysql binary is built inside the build container with the source bind-mounted at /opt/proxysql/ (docker-compose.yml `- ./:/opt/proxysql/`). gcc embeds the .gcno paths into the binary as `/opt/proxysql/{lib,src}/obj/X.gcno`. At runtime, gcov reads those .gcno files at startup to populate per-translation-unit metadata that later goes into the .gcda files written by __gcov_dump(). The proxysql RUNTIME container has the binary but does NOT have the .gcno files at /opt/proxysql/{lib,src}/obj/ -- the entire 'current_working _directory' field of every .gcda comes out blank. Fix: mount the .gcno files from the build cache into the proxysql container at the compile-time path. The build cache restore already puts them at ${WORKSPACE}/lib/obj/.gcno and ${WORKSPACE}/src/obj/ .gcno on the runner, so this is just two extra `-v ...:ro` mounts on the docker run in start-proxysql-isolated.bash. Always-on, gated on .gcno presence: for a non-coverage build, the WORKSPACE has no .gcno files and the conditional adds nothing. This is the missing piece behind every prior coverage attempt -- PR #5817 (lib-only unit tests) bypassed it by running tests in the same container that built proxysql, PR #5818 (legacy-g2 TAP) hit exactly this bug and quietly uploaded a near-empty .info that Codecov merged with the unit-test data, masking the issue under a reasonable-looking 15% aggregate.	1 month ago
Rene Cannao	30b2553398	fix(ci): grant checks:write to CI-unit-tests-asan-coverage The workflow's permissions block declared only `contents: read` and `id-token: write`. The final step in the job is a `LouisBrunner/checks-action@v2.0.0` call that updates the check-run status. POSTing a check run requires `checks:write`, and without it the action fails with: ##[error]Resource not accessible by integration Every run since at least 2026-05-26 has failed at this step even when build + ASAN unit tests + LCOV coverage capture + Codecov upload all succeeded -- the workflow has been showing red on the dashboard for purely cosmetic reasons. Found while investigating the #5828 fan-out cascade's red lines (this workflow isn't in the fan-out, but the same cascade re-runs it, so it appeared in the same failure list).	1 month ago
Rene Cannao	a94ba88a20	fix(ci): stop leaking backticks from coverage trap into outer shell The coverage-collection trap inside `run-tests-isolated.bash` is embedded in a `docker run ... /bin/bash -c "..."` block where the script body is the argument to `bash -c`, double-quoted. Inside double quotes, backticks are still command substitution. One comment line in the SF: path-normalization block had used markdown-style backticks for code formatting: # as `SF:proxysql/...` get resolved -- the other two forms The outer shell sees `SF:proxysql/...` as command substitution, tries to execute `SF:proxysql/...` as a command before passing the body to docker, and prints to the runner log on every TAP run: test/infra/control/run-tests-isolated.bash: line 275: SF:proxysql/...: No such file or directory (Line 275 is where the `docker run \` compound command begins.) The error is non-fatal: the substitution evaluates to the empty string, the inner bash receives a comment with that empty substitution still inert, and the actual `sed -i` normalization a few lines below runs correctly. Codecov uploads have been working. But: - log noise looks alarming and got asked about, - any future "comment" with backticks in this block silently executes as a real command in the outer shell -- a footgun waiting for the next contributor. Fix: swap the backticks for single quotes and add a sibling comment explaining the trap so the next author doesn't reintroduce it. No behavior change for the test infrastructure or coverage upload.	1 month ago
Rene Cannao	9b56e56621	ci: retrigger after #5827 (Codecov callees) merged	1 month ago
Rene Cannao	8878076cf8	ci(coverage): grant write-all on TAP-group callers for Codecov OIDC Fan-out companion to the reusable-side change on GH-Actions (feature/ci-codecov-tap-all-groups-callees). Every CI-<group>.yml caller now declares `permissions: write-all` on its `jobs.run` block so the `id-token:write` scope that codecov- action@v4 needs (`use_oidc: true`) actually reaches the callee. Reusable-workflow permissions are the intersection of caller + callee; without this grant on the caller side, the OIDC token mint fails even though the callee declares write-all. Mirrors what CI-legacy-g2-genai.yml already does (from PR #5818). Workflows touched (38): CI-legacy-clickhouse-g1 CI-legacy-g1, CI-legacy-g3..g9 CI-mariadb10-galera-g1..g9 CI-mysql56-single-g1 CI-mysql84-g1..g9 CI-mysql84-gr-g1..g9 CI-set_parser_algorithm_3-g1	1 month ago
René Cannaò	97eab1bbf0	Merge pull request #5825 from sysown/v3.0_partition-fairness Promote longest-waiting B session via max_connect_time fold	1 month ago
René Cannaò	aa0f1367e1	Merge branch 'v3.0' into v3.0_partition-fairness	1 month ago
René Cannaò	b5b4d8bd13	Merge pull request #5818 from sysown/feature/ci-codecov-tap-legacy-g2 ci(coverage): upload legacy-g2 TAP coverage to Codecov via OIDC	1 month ago
Rene Cannao	638d33bf96	test: fix two false-positive failures unmasked by recent CI Two distinct test bugs, same kind of mistake: assuming the absence of one specific external signal in a fixed time window. Both are purely test-side -- the proxy code under test is correct. 1. reg_test_oversize_first_pkt-t (legacy-g7, mysql84-g7) ----------------------------------------------------- `peer_closed_within()` polled once, recv'd once, and concluded "peer is still talking" if any bytes came back. That works for PgSQL (server stays silent until the client sends StartupMessage) but fails for MySQL: ProxySQL emits its ~80-byte Initial Handshake Packet immediately on accept, so by the time the helper polls the client socket those bytes are already in the recv buffer. recv() returned them with n>0, the helper returned 0 (not closed), and all four MySQL probes failed with closed=0 -- even though the proxysql.log clearly shows the security-fix bound check ("Oversized first packet... Closing fd=...") firing for every probe and shut_soft() being called. Replace the single-shot poll/recv with a drain-and-re-poll loop bounded by a steady_clock deadline. The helper now returns 1 only when it observes EOF (recv == 0) or a non-EAGAIN error (RST). Bytes that arrive without an accompanying close are drained and we keep polling until either close or the deadline. This keeps the test's contract intact (3-second timeout for the peer to close after we send an oversized header) while correctly handling server-initiated greeting traffic that exists in some protocols but not others. 2. pgsql-test_dns_cache-t (legacy-g4) ---------------------------------- Step 8's assertion `MySQL_Monitor_dns_cache_queried` stays unchanged during a 4-5 s PgSQL-only window was ~40% flaky. Root cause: that counter is bumped by the MySQL Monitor's own DNS resolver loop -- mysql-monitor_local_dns_cache_refresh_interval defaults to 60 s and on each tick the loop iterates every hostname in mysql_servers UNION proxysql_servers. A 4-5 s window sometimes catches one tick (counter goes up by N hostnames) and sometimes catches zero (counter stays flat). The failing run showed 407 -> 411 (+4 = one tick covering four hostnames). The substantive isolation guarantee is "PgSQL activity does not mutate MySQL DNS cache state", which is already covered by the sibling assertion on MySQL_Monitor_dns_cache_record_updated (records are not added or refreshed by the background loop unless hostnames actually change). Drop the noisy queried-counter assertion and adjust the plan from 17 to 16. Alternatives considered: (a) disable mysql-monitor_local_dns_cache for the duration of the test -- doesn't reliably remove in-flight resolver-queue items so the race still exists, (b) widen the tolerance -- still timing-dependent. Removing the assertion is the cleanest, and the long comment in the test explains the why so the next reader does not re-add it. Neither fix touches the security fix (GHSA-58ww-865x-grpr) nor any proxy code; the bound checks in lib/mysql_data_stream.cpp:678 and lib/PgSQL_Data_Stream.cpp:547 fire correctly and identically on both protocols. Verified by reading proxysql.log from a failing run -- all 8 "Oversized first packet... Closing fd=" lines are present.	1 month ago
Rahim Kanji	eed52db897	Merge branch 'v3.0' into v3.0_partition-fairness	1 month ago
Rahim Kanji	6909011b67	perf(partition): promote longest-waiting B session via max_connect_time fold Under sustained contention ProcessAllSessions_Partition leaves the B (CONNECTING_SERVER) band unordered, so the pass can serve newer waiters ahead of older ones until they hit connect_timeout_server_max and abort. Track the oldest waiter during the classifier's is_B arm (no second pass) and swap it to running_end. Key on max_connect_time, which the is_B test already loads -- the min-compare is a register compare with no extra memory access, and the smallest value is the waiter closest to the timeout abort. Gated by \|B\| > PARTITION_FAIRNESS_MIN_B (=4) and partition_active.	1 month ago
René Cannaò	55740e9edb	Merge branch 'v3.0' into feature/ci-codecov-tap-legacy-g2	1 month ago
René Cannaò	a1ca6a0ca3	Merge pull request #5819 from sysown/v3.0_partition-gate perf: session-partition gate (supersedes #5776 and #5799)	1 month ago
Rene Cannao	0ba0ad1609	test(security): use getaddrinfo so oversize_first_pkt-t works with hostnames The GHSA-58ww-865x-grpr regression test was failing every CI run for every branch since it merged. Root cause: `tcp_connect()` resolved the target with `inet_pton(AF_INET, host, ...)`, which only accepts numeric IPv4 strings. In CI, `cl.host` / `cl.pgsql_host` are set to the Docker DNS hostname `proxysql` (the proxy container's service name), so inet_pton returned 0 and every probe failed with `-1` before the function ever sent a byte. Test output: # MySQL probe: connect to proxysql:6033 failed: No such file or directory not ok 1 - MySQL listener closed connection on oversize first-packet pkt_length=32765 (closed=-1) not ok 2 ... pkt_length=65535 (closed=-1) not ok 3 ... pkt_length=100000 (closed=-1) not ok 4 ... pkt_length=16777215 (closed=-1) # PgSQL listener not reachable at proxysql:6133; skipping PgSQL probes ok 5 - ProxySQL admin still accepting connections after oversize attacks # Failed 4 tests! (The misleading "No such file or directory" was just whatever errno happened to hold at the time `strerror(errno)` was called -- inet_pton doesn't set errno.) Switch to getaddrinfo, which transparently handles both hostnames and numeric IPs, and gai_strerror for a meaningful failure message. The probe semantics (4 KB header + poll for FIN/RST) are unchanged. Without this the test cannot exercise the actual security fix it was written to regression-guard; on an ASAN build the pre-fix code would NOT crash here because the probe never gets a chance to land any bytes, leaving the heap-buffer-overflow open with green CI.	1 month ago
Rene Cannao	2e1d89260e	test(groups): swap pp1_unknown_spoof / proclist_use_after_free to fix sort order The v3.0 merge into this branch (`efa852351`) brought in two entries out of alphabetical order: reg_test_proclist_use_after_free-t appeared before reg_test_pp1_unknown_spoof-t, and CI-lint-groups-json flags it with: Keys not sorted: 'reg_test_pp1_unknown_spoof-t' should come before 'reg_test_proclist_use_after_free-t' Swap the two lines.	1 month ago
Rene Cannao	9d9ede1532	fix(test): sort groups.json — pp1_unknown_spoof before proclist_use_after_free Run-with --fix from test/tap/groups/lint_groups_json.py. Unblocks the 'lint' check on PR #5819.	1 month ago
René Cannaò	a5bb7f640f	Merge branch 'v3.0' into v3.0_partition-gate	1 month ago
René Cannaò	efa8523510	Merge branch 'v3.0' into feature/ci-codecov-tap-legacy-g2	1 month ago
René Cannaò	46ab989adb	Merge commit from fork fix(security): reject addresses after PROXY UNKNOWN (CVE-2026-48772 / GHSA-gw94-85m2-x8v2)	1 month ago
René Cannaò	7dbe1f7029	Merge commit from fork fix(security): bound first-packet recv() in data streams (CVE-2026-48773 / GHSA-58ww-865x-grpr)	1 month ago
René Cannaò	08cc2dbaa5	Merge commit from fork fix(security): MCP run_sql_readonly multi-statement bypass (CVE-2026-48774 / GHSA-7wh6-2vcc-gcm4)	1 month ago
Rene Cannao	12b84f98bd	fix(coverage): normalize SF: paths in LCOV report so Codecov stores all files The previous green run (`4823a407`) successfully uploaded 1.18 MB of LCOV data to Codecov, but querying the Codecov API showed only 27 files / 5694 lines stored -- a fraction of the 84621 lines fastcov actually measured. Cause: fastcov runs inside the test container at cwd=/opt/proxysql and writes SF: lines in three flavors depending on whether the .gcno embedded absolute or relative source paths: SF:/opt/proxysql/include/Admin_ifaces.h (absolute container path) SF:lib/MySQL_Session.cpp (relative to fastcov cwd) SF:proxysql/src/SQLite3_Server.cpp (already correct -- the 27 files that survived) codecov-cli runs on the host with network_root_folder pointing at the runner's /home/runner/work/proxysql/proxysql, and the repo content lives one level deeper at <network_root>/proxysql/. So only the third shape resolves to an actual file; the other two are silently dropped server-side, with no warning in either the upload log or the Codecov UI. Fix: sed-rewrite all SF: lines so they all begin with `SF:proxysql/`. The transform is idempotent for already-correct paths via the `!s` negation guard, and is applied immediately after fastcov writes the .info (before genhtml runs, so the HTML report also benefits). After this, Codecov should store the full ~84621-line measurement and the per-file coverage explorer will show all of lib/, src/, include/, and test/tap/ instead of just src/SQLite3_Server.cpp + 26 friends.	1 month ago
René Cannaò	896bdde93a	Merge branch 'v3.0' into feature/ci-codecov-tap-legacy-g2	1 month ago
René Cannaò	3e7b77456e	Merge branch 'v3.0' into v3.0_partition-gate	1 month ago

1 2 3 4 5 ...

10376 Commits (feature/pgsql-native-backend-protocol) All Branches Search

10376 Commits (feature/pgsql-native-backend-protocol)

All Branches