4 Commits (feature/pgsql-native-backend-protocol)

Author	SHA1	Message	Date
Rene Cannao	e9637be4f7	feat: add SCRAM cache invalidation, TAP test, and bench_connect tool ... Generation counter for SCRAM verifier cache: - Global atomic counter incremented on pgsql_users reload - Thread-local caches check generation on lookup; stale entries are cleared and rebuilt from scratch - scram_cache_invalidate() called from __refresh_pgsql_users() - extern "C" guards added to scram_hmac_cached.h for C++ callers TAP test (pgsql-scram_cache_invalidation-t): - Creates user with pass1, populates SCRAM cache via connect loop - Changes password to pass2, reloads users (invalidates cache) - Verifies pass2 works and pass1 is rejected - Assigned to legacy-g4 test groups Benchmark tool (tools/bench_connect): - Multi-threaded SCRAM+TLS connect/disconnect benchmark - Uses vendored PostgreSQL from deps/ - Added to tools/Makefile with clean target	2 months ago
Rene Cannao	0b4f6fb213	perf: optimize SCRAM-SHA-256 auth with cached EVP_MD and verifier cache ... On OpenSSL 3.x, EVP_sha256() triggers EVP_MD_fetch() on every call, involving global lock contention and provider property lookups. The vendored PostgreSQL hmac_openssl.c calls it on every HMAC_Init_ex(), which means 4096 redundant fetches per SCRAM PBKDF2 derivation alone. This was responsible for ~58% of CPU time during SCRAM-heavy workloads, making ProxySQL 1.64x slower than PgBouncer at connect/disconnect. Two optimizations: 1. Cached EVP_MD* for HMAC (scram_hmac_cached.c): New scram_fast_* API that fetches the SHA-256 EVP_MD once via pthread_once and reuses it across all HMAC operations. Replaces all pg_hmac_* calls in libscram with the cached versions. No changes to vendored PostgreSQL code. 2. SCRAM verifier cache for plaintext passwords (scram.c): When ProxySQL stores plaintext passwords, every SCRAM exchange runs the full PBKDF2 (4096 HMAC iterations). This cache stores the generated SCRAM verifier after the first successful auth, so subsequent connections skip PBKDF2 entirely -- reducing HMAC operations from ~4096 to ~4 per connection, matching PgBouncer's behavior when a SCRAM verifier is stored directly. Thread-local, no locks needed. Result: ProxySQL connect/disconnect performance goes from 1.64x slower to parity with PgBouncer. Perf profile shifts from pg_hmac_init/EVP_MD_fetch (58%) to do_ssl_handshake (22%) -- the actual TLS work.	2 months ago
Rahim Kanji	7d32668845	Resolved crash caused by function conflicts between libscram and ... libcommon (PostgreSQL library) * Removed all shared code from libscram; it now relies on the linked libcommon library. * Eliminated dependency on libusual. * Now uses PostgreSQL common crypto functions. * Improved error handling. * Added ASAN support.	2 years ago
Rahim Kanji	e029d39007	Initial PostgreSQL commit ... * Added plain text and SCRAM authentication	2 years ago