proxysql

Commit Graph

Author	SHA1	Message	Date
René Cannaò	f9ac5607bf	test(pgsql): differential native-vs-libpq auth test (compiles; run pending Docker) [Task 1.8]	3 weeks ago
Rene Cannao	9d9ede1532	fix(test): sort groups.json — pp1_unknown_spoof before proclist_use_after_free Run-with --fix from test/tap/groups/lint_groups_json.py. Unblocks the 'lint' check on PR #5819.	1 month ago
René Cannaò	46ab989adb	Merge commit from fork fix(security): reject addresses after PROXY UNKNOWN (CVE-2026-48772 / GHSA-gw94-85m2-x8v2)	1 month ago
René Cannaò	7dbe1f7029	Merge commit from fork fix(security): bound first-packet recv() in data streams (CVE-2026-48773 / GHSA-58ww-865x-grpr)	1 month ago
René Cannaò	08cc2dbaa5	Merge commit from fork fix(security): MCP run_sql_readonly multi-statement bypass (CVE-2026-48774 / GHSA-7wh6-2vcc-gcm4)	1 month ago
Rene Cannao	aac3963625	Fix groups.json: sort pgsql-reg_test_5801_options_startup_param-t alphabetically	1 month ago
Rahim Kanji	093131cf27	Merge branch 'v3.0' into v3.0_pgsql_options_5801	1 month ago
Rahim Kanji	fa0b76681d	test(pgsql): regression test for #5801 options startup parameter Adds pgsql-reg_test_5801_options_startup_param-t covering both fixes via the real backend path, reading back the options ProxySQL sent with PROXYSQL INTERNAL SESSION (backends[].conn.pgsql.options): - no trailing space in the options value (tracked-only and with an untracked tail) - multiple untracked parameters are all forwarded, not just the last (guarded by a lock-on-hostgroup check so it fails loudly if the chosen GUCs ever become tracked)	1 month ago
René Cannaò	1d52499791	Merge pull request #5808 from sysown/issue_5639 fix(session): avoid double-free of stmt_meta pkt in LargePacket (#5639)	1 month ago
René Cannaò	af4aa17346	Merge pull request #5807 from sysown/fix/5790-mariadb-collation-255 fix(core): validate_charset must replace collation 255 on MariaDB backends (#5790)	1 month ago
René Cannaò	fadffdbcbd	Merge pull request #5806 from sysown/pgsql_dns_cache Independent DNS cache for PgSQL (fixes #5768)	1 month ago
Rene Cannao	d8c32f1af6	fixup: sort reg_test_5639_... entry alphabetically in groups.json CI-lint-groups-json requires keys in groups.json to be sorted.	1 month ago
Rene Cannao	c10b30523c	Test: cover pgsql DNS cache + fix whitespace handling Adds pgsql-test_dns_cache-t mirroring the existing MySQL test_dns_cache test, exercising 16 scenarios: * pgsql-monitor_local_dns_cache_* variables propagate to runtime * IP literal does not touch the cache * Resolvable hostname populates dns_cache_record_updated * Client connect through the proxy increments dns_cache_queried and dns_cache_lookup_success on a cache hit * Hostname with leading/trailing whitespace is trimmed before resolution * Unresolvable hostname is queried but produces no record (cache miss bumps dns_cache_queried only) * Removing pgsql_servers rows drops the orphaned cache record * Cache disabled via refresh_interval=0 flatlines all counters * MySQL DNS cache counters do not move in response to pgsql-side activity (independence between the two caches) While writing the test, step 4 (whitespace trim) caught a real bug: PgSQL_Monitor::monitor_dns_cache was inserting hostnames verbatim from the SQLite3_result into the resolver queue, so ' example.org ' was handed to getaddrinfo() unchanged and failed. MySQL_Monitor sidesteps this by reading via SELECT trim(hostname) FROM monitor_internal.; the pgsql variant reads directly from pgsql_servers_to_monitor so it needs to call trim() in C++. Fix: trim before validate_ip / insert into the hostnames set. The lookup path already trimmed, so the bookkeeper key now matches. Registered the test in groups.json under legacy-g4 and the mysql- variant g4 groups, matching how the other pgsql-* tests are grouped.	1 month ago
Rene Cannao	b3f7d29d51	fix(session): avoid double-free of stmt_meta pkt in LargePacket (#5639 ) When handler_WCD_SS_MCQ_qpo_LargePacket() is reached via the COM_STMT_EXECUTE path, MySQL_Protocol::get_binds_from_pkt() has already aliased stmt_meta->pkt to pkt->ptr (see the FIXME at MySQL_Protocol.cpp:2873). The subsequent RequestEnd() -> Query_Info::end() free()s stmt_meta->pkt (the fix introduced for bug #796 at MySQL_Session.cpp:455), and then LargePacket's own l_free(pkt->size, pkt->ptr) frees the same buffer a second time. With jemalloc this silently corrupts the arena and surfaces later as the SIGSEGV reported in #5639, with the crashing frame landing on the l_free call site (+0x10e into LargePacket). Under ASAN the double-free aborts deterministically with a backtrace whose two free() chains match the report exactly. Fix: capture whether CurrentQuery.stmt_meta aliases pkt before calling RequestEnd() (which clears stmt_meta), and skip the second free when the alias was present. For the COM_QUERY path through LargePacket, stmt_meta is always NULL, so the previous behaviour is preserved there. Also add reg_test_5639_stmt_execute_max_allowed_packet-t which exercises the STMT_EXECUTE > mysql-max_allowed_packet path and asserts the session and process survive.	1 month ago
Rene Cannao	d8e51349e2	fix(core): validate_charset must replace collation 255 on MariaDB backends (#5790 ) Commit `7c6f42bcd` ("fix: MySQL 9.x charset handling and log_last_insert_id test race") changed the version guard in lib/MySQL_Variables.cpp from testing the first character of server_version to using atoi(): - if (charset >= 255 && myconn->mysql->server_version[0] != '8') { + if (charset >= 255 && atoi(myconn->mysql->server_version) < 8) { The new form correctly extends the "supports collation id 255" treatment to MySQL 9.x and later, but it silently broke MariaDB: server_version old check new check ---------------------------- --------- --------- "5.7.x" replace replace "8.0.x" skip skip "9.x.y" replace[] skip "10.11.13-MariaDB" replace skip <-- BUG "11.x.x-MariaDB" replace skip <-- BUG [] wrong for MySQL 9.x; that is the case the original commit fixed. MariaDB does not implement utf8mb4_0900_ai_ci (collation id 255), regardless of its numeric major version. With the regression, ProxySQL no longer rewrites the unsupported collation before sending SET NAMES to the MariaDB backend, and the backend rejects it with: ERROR 1273 (HY000): Unknown collation: 'utf8mb4_0900_ai_ci' …breaking clients such as Dovecot that pick collation 255 from libmariadb's charset table at connect time. Fix: also treat MariaDB (detected by the "MariaDB" suffix in server_version) as a backend that cannot accept collation id >= 255, so handle_unknown_charset replacement applies there as well. The regression is present on v3.0 HEAD (and on the v3.1.8 / v4.0.8 tags), but NOT in the v3.0.7 / v3.0.8 release tags themselves; users hitting this in production are on post-v3.0.8 "v3.0-head" CI packages (`3.0.8-NN-gHASH`). Reported-by: @FoZo (sysown/proxysql#5790) Also-confirmed-by: @akrus Adds reg_test_5790-mariadb_collation_255-t, registered in mariadb10-galera-g1, which: 1. Skips when the backend is not MariaDB. 2. Sets mysql-handle_unknown_charset=1 and mysql-default_collation_connection=utf8mb4_general_ci. 3. Issues `SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci`. 4. Runs a SELECT that forces backend SET NAMES via handler_again___status_CHANGING_CHARSET. 5. Verifies the SELECT succeeds and that the backend's @@collation_connection is the configured default, not utf8mb4_0900_ai_ci. This test fails without the fix (errno 1273 from the backend) and passes with it.	1 month ago
René Cannaò	9f9a75f798	Merge branch 'v3.0' into fix/5708-followup-multiline-for	1 month ago
Rene Cannao	778958b03d	test(security): regression tests for PP1 UNKNOWN address spoof (GHSA-gw94-85m2-x8v2) Cover the GHSA-gw94-85m2-x8v2 fix at two layers: Unit tests (test/tap/tests/unit/proxy_protocol_unit-t.cpp): - "PROXY UNKNOWN\\r\\n" returns false and sets header_was_unknown, source_address stays empty. - The advisory PoC payload "PROXY UNKNOWN 10.0.0.5 1.2.3.4 12345 3306\\r\\n" must NOT write "10.0.0.5" into source_address. - "PROXY UNKNOWNFOO ..." is rejected outright (not treated as UNKNOWN). - "PROXY TCP4xyz ..." is rejected — the protocol token must be followed by a single space. - Sanity check: a legitimate "PROXY TCP4 192.168.1.1 ..." still parses source_address correctly. Integration test (test/tap/tests/reg_test_pp1_unknown_spoof-t.cpp): - Mirrors the reporter's PoC end-to-end with MARIADB_OPT_PROXY_HEADER. Sets mysql-proxy_protocol_networks='*' and connects with "PROXY UNKNOWN 10.0.0.5 ...". Asserts that PROXYSQL INTERNAL SESSION's client.client_addr.address and client.PROXY_V1.source_address are NOT the forged "10.0.0.5". - Asserts "PROXY TCP4xyz ..." is not recorded as PROXY_V1 and does not spoof client_addr. - Positive control: legitimate TCP4 frame is still accepted and records the expected source IP. Wired the integration test into the same TAP groups as test_PROXY_Protocol-t so it runs everywhere PP1 is exercised.	1 month ago
Rene Cannao	5044d13d5e	test(framework): remove skip_all() — fail loudly on missing preconditions Stage 2 follow-up to the PR #5708 reproduction debug. The framework helper test/tap/tap/tap.{h,cpp}::skip_all() prints "1..0 # skip ..." and exit(0), which the harness reports as "ignored" — zero assertions emitted, zero failures recorded, no notice that a test never ran. While investigating the customer regression on PR #5708 we discovered that test_set_statement_for-t had been silently skipping in CI since the day it was added: it self-skipped on non-MariaDB backends, but was registered only in MySQL-family TAP groups, so every run skipped. PR #5794 fixes that one test. The principled fix is to remove the mechanism that lets a test silently disappear. This commit converts the remaining four skip_all() callers and deletes the framework function: - test_mysqlx_e2e_routing-t BAIL_OUT if MYSQLX_E2E_PROXYSQL_PORT is not set. The group env file test/tap/groups/mysqlx-e2e/env.sh sets it; missing at runtime means the harness did not source it. - test_mysqlx_e2e_handshake-t BAIL_OUT if MYSQLX_E2E_HOST is not set (same env file, same rationale). - test_mysqlx_route_drop_inflight-t BAIL_OUT if the X-Protocol listener is not reachable. The mysqlx-soak-g1 harness is supposed to start ProxySQL with the mysqlx plugin and provision the route; a missing listener is a setup bug. - test_mysqlx_sigterm_inflight-t Deleted. The binary was a stub whose body was a TODO; the real sigterm scenario is implemented in test/scripts/mysqlx/behavioral_validation.py --scenario sigterm. With skip_all gone the stub had no remaining purpose. Also dropped from groups.json and the Makefile. After this commit, the test/tap codebase has zero call sites of skip_all(). The framework declaration and definition are deleted from tap.h and tap.cpp; the doc references at the bottom of tap.cpp are updated; a comment explains the rationale and points at BAIL_OUT() as the replacement. Verified locally: full TAP debug build succeeds, no undefined-reference errors, lint_groups_json + check_groups --source both green. Depends on PR #5794 (which removed the fifth caller in test_set_statement_for-t.cpp). This PR is based on that branch; merging in order keeps each merge a clean compile.	1 month ago
Rene Cannao	960c8bcb73	fix(session): SET STATEMENT ... FOR detection tolerates any whitespace PR #5708 added detection for MariaDB's `SET STATEMENT … FOR …` syntax to keep ProxySQL from invoking `unable_to_parse_set_statement()` and locking the session to a single hostgroup. The detection at `lib/MySQL_Session.cpp` was: if (strncasecmp(nq.c_str(), "SET STATEMENT ", 14) == 0 && strcasestr(nq.c_str(), " FOR ")) { return false; } `strcasestr(nq, " FOR ")` is a literal-substring search requiring a space BOTH before and after the FOR keyword. A customer report (see PR #5708 thread) reproduced the same error 9006 as before the fix by typing the statement across multiple lines at the mysql client prompt — the character after FOR is then a newline, not a space, so the detection misses, the code falls through to the regular SET parser, the parser doesn't know SET STATEMENT, and the hostgroup is locked to the user's default. The next non-default-hostgroup query fails with 9006. Verified with a standalone strcasestr probe: q1 (customer multi-line): strcasestr(" FOR ") matches ? NO q2 (existing TAP single-line): YES The fix uses `dig` (the digest text) for the detection instead of `nq` (the raw query). `dig` is whitespace-normalised by the digest builder, so " FOR " always has a space on both sides regardless of how the client formatted the query. This is consistent with the prefix check 35 lines above, which already uses `dig` for keyword detection. == Test coverage == `test/tap/tests/test_set_statement_for-t.cpp` previously had `plan(5)` and self-skipped on non-MariaDB backends via `skip_all()`. It was also registered ONLY in MySQL-family TAP groups (`legacy-g2`, `mysql84-g2`, etc.). The net effect was that the test self-skipped on every CI run since it was added — never actually executing an assertion in CI. The customer's bug regressed entirely unnoticed. This commit: 1. Removes the runtime MariaDB-detection helper and the `skip_all` call. A misregistered test should fail loudly, not silently skip; correct registration is enforced through the groups.json layer instead. 2. Moves the groups.json registration from the MySQL-only groups to `mariadb10-galera-g2`, which actually provides a MariaDB backend. 3. Adds four new test cases (assertions 6–13) covering the customer whitespace shapes that strcasestr (" FOR ") missed: newline, tab, CRLF, and multiple spaces between FOR and the inner statement. Each case verifies (a) the SET STATEMENT succeeds, and (b) a follow-up plain SELECT succeeds (i.e. no hostgroup lock persists — the customer's actual failure mode). Verified locally on TAP group mariadb10-galera-g2 against MariaDB 10.11.9: 13/13 ok, RC=0. A separate framework-cleanup follow-up should remove `skip_all()` from `test/tap/tap/tap.{h,cpp}` entirely and convert the other four callers (`test_mysqlx_e2e_*`, `test_mysqlx_route_drop_inflight-t`, `test_mysqlx_sigterm_inflight-t`) to either fail loudly or move to appropriately-gated TAP groups.	1 month ago
Rene Cannao	8371d63372	test(security): regression test for MCP run_sql_readonly bypass (GHSA-7wh6-2vcc-gcm4) Adds a negative TAP test that drives /mcp/query run_sql_readonly with the adversarial payloads that pre-fix code would have accepted: - 10 multi-statement payloads (the demonstrated PoC plus 9 variants covering INSERT, DROP, SET sql_log_bin, RESET MASTER, LOCK TABLES, KILL, FLUSH LOGS, OPTIMIZE, and a multi-statement-after-block-comment variant) - 14 single-statement payloads exercising the keywords that the pre-fix substring blacklist missed (RENAME, SET, RESET, LOCK, UNLOCK, KILL, FLUSH, OPTIMIZE, REPAIR, HANDLER, USE, XA), plus EXPLAIN ANALYZE and a line-comment-followed-by-RENAME case After every rejection the test verifies a backend canary table is still intact (correct name, exactly one row), so a future regression where the validator says "reject" but the backend already executed the side-effecting statement would surface as a canary failure. The "still allowed" section guards against false positives in the new lexer-aware semicolon check: semicolons inside string literals, trailing semicolons, and trailing line comments must still pass. Test is registered in the ai-g1 group with the rest of the MCP tests.	2 months ago
Rene Cannao	1cb2ecc17a	fix(security): bound first-packet recv() in MySQL and PgSQL data streams (GHSA-58ww-865x-grpr) An unauthenticated client could declare an oversized first-packet length in either protocol and ProxySQL would pass that length straight to recv() while writing into the fixed 32 KB queueIN buffer, producing an out-of-bounds heap write in: - MySQL_Data_Stream::read_from_net (lib/mysql_data_stream.cpp) - PgSQL_Data_Stream::read_from_net (lib/PgSQL_Data_Stream.cpp) The pre-existing PROXY-protocol prefix check only handled the 'PROX' literal variant from sysown/proxysql#5376; the general ordinary first-packet path was still vulnerable. Bound the second recv() against the remaining queueIN capacity and shut_soft() the connection when the declared length exceeds the bound. For MySQL that bound is queue_available - 4 (header size); for PgSQL it is queue_available - 5 (type byte + 4-byte length). Add a TAP regression test that opens raw sockets to both listeners, sends oversized first-packet headers with declared lengths above the queue boundary (32765, 65535, 100000, protocol-max), and asserts: - the listener closes the connection promptly - ProxySQL admin remains responsive afterward (no daemon crash) Run under ASAN to catch any future regression of the bounds check.	2 months ago
René Cannaò	2c2cfa59bb	Merge branch 'v3.0' into genai_5534	2 months ago
René Cannaò	43d3ee7cd2	Merge branch 'v3.0' into test/cluster-simulator	2 months ago
René Cannaò	421604d553	Merge branch 'v3.0' into genai_5534	2 months ago
René Cannaò	e5a31efe61	Merge branch 'integration/v3.0-batch-2026-05-13' into fix/issue-5620-fast-routing-qr-leak Signed-off-by: René Cannaò <rene@proxysql.com>	2 months ago
Rene Cannao	587f3c9d56	fix(deps): restore libconfig 1.7.3 passthrough for \a \b \v in quoted strings (#5766 ) libconfig 1.8.1 added explicit STRING-state rules for \a (0x07), \b (0x08) and \v (0x0B) that did not exist in 1.7.3. When a proxysql.cnf string contains a literal `\v` (two characters: 0x5C 0x76), 1.8.1 silently collapses it to the single byte 0x0B. This corrupts password fields and any other config value that happens to contain those byte sequences, with no warning and no way to tell from the file on disk. Operators upgrading 2.x -> 3.x see authentication failures against the MySQL backend (monitor and mysql_users) because the value ProxySQL sends to the server no longer matches the source-of-truth in proxysql.cnf. This commit patches the bundled libconfig so the three new-in-1.8.1 escape rules emit the backslash and the letter as two literal bytes, restoring 1.7.3 wire-for-wire behaviour for affected sequences while keeping every other libconfig 1.8.1 change. \f \n \r \t \xHH still behave the same as they did in 1.7.3 (interpreted). The patch is applied at extraction time via deps/Makefile, mirroring the existing pattern used for prometheus-cpp. Includes regression test reg_test_5766_libconfig_escape_passthrough-t that loads a cnf with \a \b \v \n \xHH and asserts every value round-trips byte-for-byte through `LOAD MYSQL VARIABLES FROM CONFIG`.	2 months ago
Wazir Ahmed	b64ac92152	chore(lint): Fix lint error in groups.json	2 months ago
Wazir Ahmed	57d67a8362	Merge branch 'v3.0' into cluster-simulator	2 months ago
Wazir Ahmed	21efbdf8d6	test: Remove reg_test_5546-shun_recovery-t.cpp - Validating the fix for #5546 is orders of magnitude complex than the fix. - `reg_test_5546-shun_recovery-t.cpp` does not solve this problem. - Skipping validation for #5546. Signed-off-by: Wazir Ahmed <wazir@proxysql.com>	2 months ago
Rene Cannao	abc5437dc6	fix(core): reset qr=NULL on non-match so apply=1 trap doesn't bypass fast-routing `Query_Processor<QP_DERIVED>::process_query` (lib/Query_Processor.cpp) iterates the rule list and assigns `qr=it` at the top of each iteration before* the match check. When a rule does not match the loop `continue`s but `qr` is left pointing at that non-matching rule. After the loop, `__exit_process_mysql_query` reads `qr->apply` to decide whether to fall through to `mysql_query_rules_fast_routing`. If the last iterated (non-matching) rule happens to have `apply=1`, the leftover pointer makes the check skip fast-routing entirely — even though no rule actually matched the query. In production this is a silent fast-routing bypass: traffic that should follow the fast-routing destination ends up on the user's `default_hostgroup`. burnison reproduced it on 3.0.3 and 3.0.7 (issue #5620); his repro saw `ERROR 9001 Max connect timeout` because hg=0 was unroutable in that environment. Fix is a single-line reset: when the match check fails, set `qr = NULL` before `continue`. After the loop `qr` is then NULL iff no rule matched, which is exactly what the existing exit-block check `if (qr == NULL \|\| qr->apply == false)` was always assuming. The fix lives in the templated implementation shared by MySQL and PgSQL query processors, so both protocols are covered. Adds reg_test_5620_fast_routing_qr_leak-t (registered in legacy-g6) which uses ProxySQL's built-in SQLite3 server as the backend so verification can read `stats_mysql_query_digest` directly without depending on backend reachability. Phase 1 confirms baseline fast-routing. Phase 2 inserts the trap rule (non-matching, apply=1) and re-runs the query; with the bug the query lands in `default_hostgroup`, with the fix it lands in the fast-routing hostgroup. Closes #5620	2 months ago
Wazir Ahmed	6c5d0fd5db	Merge branch 'v3.0' into cluster-simulator	2 months ago
Rene Cannao	cfad7c8554	feat(ci): add mariadb10-galera TAP group with CI-mariadb10-galera-g[1-9] workflows	2 months ago
Rene Cannao	e2caef242a	fixup: sort genai_config_query_unit-t alphabetically in groups.json	2 months ago
Rene Cannao	7153a8588e	fix(ci): register new genai unit tests in groups.json Add genai_config_query_unit-t and genai_rag_fetch_from_source_unit-t to groups.json under ai-g1 (requires genai plugin) with @proxysql_min_version:4.0 constraint, matching the pattern of other genai feature unit tests (discovery_schema, fts_string, etc.).	2 months ago
René Cannaò	1dcf95faf7	Merge branch 'v3.0' into issue-5686-galera-vars	2 months ago
Rene Cannao	949e4cdc30	feat(ci): add CI-mysql84-gr-g[1-9] workflows for Group Replication test groups	2 months ago
Rene Cannao	d7d3e5c7b8	Fix groups.json: add back 14 entries dropped during merge resolution	2 months ago
Rene Cannao	c245503e50	Merge v3.0: resolve groups.json conflict with split groups and renamed set_parser_algorithm_3	2 months ago
Rene Cannao	0f8e014a33	Merge branch v3.0 into issue-5686-galera-vars Resolve groups.json conflict: keep test_set_statement_for-t from PR and set_parser_algorithm=3-g1 additions from v3.0.	2 months ago
Rene Cannao	6033c4e1ab	feat(ci): split legacy-g[1-4] and mysql84-g[1-4] into parallel groups for faster CI Split large test groups roughly in half to reduce wall-clock CI time: - legacy-g1 (88) → legacy-g1 (44) + legacy-g6 (44) - legacy-g2 (46) → legacy-g2 (23) + legacy-g7 (23) - legacy-g3 (41) → legacy-g3 (21) + legacy-g8 (20) - legacy-g4 (98) → legacy-g4 (49) + legacy-g9 (49) - mysql84-g1 (80) → mysql84-g1 (40) + mysql84-g6 (40) - mysql84-g2 (42) → mysql84-g2 (21) + mysql84-g7 (21) - mysql84-g3 (41) → mysql84-g3 (21) + mysql84-g8 (20) - mysql84-g4 (61) → mysql84-g4 (31) + mysql84-g9 (30) Adds: group directories, caller workflows, groups.json entries. Reusable workflows on GH-Actions branch in companion PR.	2 months ago
Rene Cannao	1946b1f728	fix(ci): rename set_parser_algorithm=3 group to avoid Docker network name issue The "=" character in the TAP group name "set_parser_algorithm=3-g1" is incompatible with Docker network names -- Docker interprets "=" as a key=value separator in the --network flag, causing the CI job to fail with "invalid field key ci-set_parser_algorithm". Rename the group to "set_parser_algorithm_3" everywhere: - Group directory: set_parser_algorithm=3/ → set_parser_algorithm_3/ - groups.json entries - Caller workflow file and name - Reusable workflow file, name, and INFRA_ID references Also fix SonarCloud cognitive-complexity Quality Gate failure in tools/bench_connect.c by extracting parse_args() and print_json() helpers from main(), reducing complexity from 31 to below 25.	2 months ago
René Cannaò	4b9fb50224	Merge branch 'v3.0' into perf/scram-cached-hmac	2 months ago
René Cannaò	0fa428b0f5	fix: sort groups.json keys to pass lint	2 months ago
Rene Cannao	e9637be4f7	feat: add SCRAM cache invalidation, TAP test, and bench_connect tool Generation counter for SCRAM verifier cache: - Global atomic counter incremented on pgsql_users reload - Thread-local caches check generation on lookup; stale entries are cleared and rebuilt from scratch - scram_cache_invalidate() called from __refresh_pgsql_users() - extern "C" guards added to scram_hmac_cached.h for C++ callers TAP test (pgsql-scram_cache_invalidation-t): - Creates user with pass1, populates SCRAM cache via connect loop - Changes password to pass2, reloads users (invalidates cache) - Verifies pass2 works and pass1 is rejected - Assigned to legacy-g4 test groups Benchmark tool (tools/bench_connect): - Multi-threaded SCRAM+TLS connect/disconnect benchmark - Uses vendored PostgreSQL from deps/ - Added to tools/Makefile with clean target	2 months ago
Wazir Ahmed	eaa57d0f58	Merge branch 'v3.0' into cluster-simulator	2 months ago
René Cannaò	dbe67dc9a9	Merge branch 'v3.0' into feature/parsersql-integration	2 months ago
René Cannaò	44c33cd2d3	Merge branch 'v3.0' into feature/parsersql-integration	2 months ago
Rene Cannao	325b3e4b2f	test(mysql): add end-to-end test for CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA New TAP test test_plugin_auth_lenenc_client_data-t that: - Connects via mariadb client library (which auto-negotiates lenenc auth when the server advertises it, same as Boost MySQL does) - Verifies server greeting contains CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA - Verifies client actually negotiated the flag (lenenc path exercised) - Executes a query to confirm the session is fully functional - Tests with deprecate_eof=ON and OFF Registered in groups.json alongside test_greeting_capabilities-t.	2 months ago
Rene Cannao	88db9fd10f	fix: resolve PR #5741 review findings (issue #5729 ) - Fix groups.json sort order (CI lint failure) - Add sqlite3_mprintf null check in Anomaly_Detector (Gemini high) - Add ROLLBACK on DELETE/COMMIT error in 5 plugin_tables.cpp callbacks - Fix TAP plan count in test_stats_mcp_tables-t (12→11) - Fix TAP plan count in genai_plugin_anomaly_unit-t (24→25) - Fix ABI.md: register_runtime_view is ABI 3+, not ABI 4 - Update plan/spec docs: db_kind at struct tail (ABI backward compat) - Add Darwin -force_load fallback in src/Makefile - Add mkdir() error handling in AI_Features_Manager Verified: build clean, 30/30 unit tests pass, lint passes.	2 months ago
Rene Cannao	18a2b11132	test: add E2E integration test for stats_mcp_* tables (issue #5729 ) Validates: - stats_mcp_query_digest captures query digest stats - stats_mcp_query_tools_counters tracks tool invocations - stats_mcp_query_rules is accessible - _reset variants clear counters correctly Registered in ai-g1 test group.	2 months ago

1 2 3 4 5 ...

280 Commits (feature/pgsql-native-backend-protocol)