proxysql

Commit Graph

Author	SHA1	Message	Date
Rene Cannao	778958b03d	test(security): regression tests for PP1 UNKNOWN address spoof (GHSA-gw94-85m2-x8v2) Cover the GHSA-gw94-85m2-x8v2 fix at two layers: Unit tests (test/tap/tests/unit/proxy_protocol_unit-t.cpp): - "PROXY UNKNOWN\\r\\n" returns false and sets header_was_unknown, source_address stays empty. - The advisory PoC payload "PROXY UNKNOWN 10.0.0.5 1.2.3.4 12345 3306\\r\\n" must NOT write "10.0.0.5" into source_address. - "PROXY UNKNOWNFOO ..." is rejected outright (not treated as UNKNOWN). - "PROXY TCP4xyz ..." is rejected — the protocol token must be followed by a single space. - Sanity check: a legitimate "PROXY TCP4 192.168.1.1 ..." still parses source_address correctly. Integration test (test/tap/tests/reg_test_pp1_unknown_spoof-t.cpp): - Mirrors the reporter's PoC end-to-end with MARIADB_OPT_PROXY_HEADER. Sets mysql-proxy_protocol_networks='*' and connects with "PROXY UNKNOWN 10.0.0.5 ...". Asserts that PROXYSQL INTERNAL SESSION's client.client_addr.address and client.PROXY_V1.source_address are NOT the forged "10.0.0.5". - Asserts "PROXY TCP4xyz ..." is not recorded as PROXY_V1 and does not spoof client_addr. - Positive control: legitimate TCP4 frame is still accepted and records the expected source IP. Wired the integration test into the same TAP groups as test_PROXY_Protocol-t so it runs everywhere PP1 is exercised.	1 month ago
Rene Cannao	accc68c9dc	test: add 11 new unit test files with 520 assertions for lib/ coverage Add targeted unit tests for pure functions and isolated components across lib/, increasing test coverage for both core utilities and GenAI/MCP components. New test files (test/tap/tests/unit/): Core utilities: - pgsql_variables_validator_unit-t (75 tests): bool, float, string, memory size, search_path, and client_encoding validators - gen_utils_unit-t (28 tests): mywildcmp wildcard matching, escape_string_single_quotes, Proxy_file_regular - mysql_encode_unit-t (23 tests): mysql_encode_length, CPY3/CPY8, proxy_my_crypt XOR, write_encoded_length - proxysql_utils_unit-t (23 tests): hex/unhex, sql_escape, split_str, replace_str, generate_multi_rows_query, checksums - proxy_protocol_unit-t (22 tests): PROXY v1 header parsing, subnet validation, IPv4/IPv6 network matching - pgsql_error_helper_unit-t (139 tests): SQLSTATE code mapping, all 38 error class branches, severity classification, fill/reset - pgsql_txn_state_unit-t (54 tests): TxnCmdParser for BEGIN, COMMIT, ROLLBACK, SAVEPOINT, RELEASE, AND CHAIN variants - sqlite3db_unit-t (21 tests): execute, return_one_int, check_table_structure, build_table, row ops, locking GenAI/MCP (PROXYSQLGENAI=1): - genai_stats_parsing_unit-t (79 tests): parse_server_filter, parse_digest_filter, parse_ll_or_zero, get_interval_config, calculate_percentile - genai_fts_string_unit-t (32 tests): MySQL_FTS sanitize_name, escape_identifier, escape_sql, table name construction - genai_anomaly_unit-t (24 tests): normalize_query SQL normalization, check_sql_injection pattern detection Minimal production changes for GenAI testability: - include/Anomaly_Detector.h: add friend class for test access - include/Stats_Tool_Handler.h: declare 4 parsing helpers, move 2 pure computation methods (get_interval_config, calculate_percentile) to public - lib/Stats_Tool_Handler.cpp: remove static from 4 free helper functions (no behavioral change, only linkage visibility)	3 months ago

Author

SHA1

Message

Date

Rene Cannao

778958b03d

test(security): regression tests for PP1 UNKNOWN address spoof (GHSA-gw94-85m2-x8v2)

Cover the GHSA-gw94-85m2-x8v2 fix at two layers:

Unit tests (test/tap/tests/unit/proxy_protocol_unit-t.cpp):
- "PROXY UNKNOWN\\r\\n" returns false and sets header_was_unknown,
  source_address stays empty.
- The advisory PoC payload
  "PROXY UNKNOWN 10.0.0.5 1.2.3.4 12345 3306\\r\\n" must NOT write
  "10.0.0.5" into source_address.
- "PROXY UNKNOWNFOO ..." is rejected outright (not treated as UNKNOWN).
- "PROXY TCP4xyz ..." is rejected — the protocol token must be
  followed by a single space.
- Sanity check: a legitimate "PROXY TCP4 192.168.1.1 ..." still
  parses source_address correctly.

Integration test (test/tap/tests/reg_test_pp1_unknown_spoof-t.cpp):
- Mirrors the reporter's PoC end-to-end with MARIADB_OPT_PROXY_HEADER.
  Sets mysql-proxy_protocol_networks='*' and connects with
  "PROXY UNKNOWN 10.0.0.5 ...". Asserts that
  PROXYSQL INTERNAL SESSION's client.client_addr.address and
  client.PROXY_V1.source_address are NOT the forged "10.0.0.5".
- Asserts "PROXY TCP4xyz ..." is not recorded as PROXY_V1 and does
  not spoof client_addr.
- Positive control: legitimate TCP4 frame is still accepted and
  records the expected source IP.

Wired the integration test into the same TAP groups as
test_PROXY_Protocol-t so it runs everywhere PP1 is exercised.

Rene Cannao

accc68c9dc

test: add 11 new unit test files with 520 assertions for lib/ coverage

Add targeted unit tests for pure functions and isolated components
across lib/, increasing test coverage for both core utilities and
GenAI/MCP components.

New test files (test/tap/tests/unit/):

  Core utilities:
  - pgsql_variables_validator_unit-t (75 tests): bool, float, string,
    memory size, search_path, and client_encoding validators
  - gen_utils_unit-t (28 tests): mywildcmp wildcard matching,
    escape_string_single_quotes, Proxy_file_regular
  - mysql_encode_unit-t (23 tests): mysql_encode_length, CPY3/CPY8,
    proxy_my_crypt XOR, write_encoded_length
  - proxysql_utils_unit-t (23 tests): hex/unhex, sql_escape,
    split_str, replace_str, generate_multi_rows_query, checksums
  - proxy_protocol_unit-t (22 tests): PROXY v1 header parsing,
    subnet validation, IPv4/IPv6 network matching
  - pgsql_error_helper_unit-t (139 tests): SQLSTATE code mapping,
    all 38 error class branches, severity classification, fill/reset
  - pgsql_txn_state_unit-t (54 tests): TxnCmdParser for BEGIN,
    COMMIT, ROLLBACK, SAVEPOINT, RELEASE, AND CHAIN variants
  - sqlite3db_unit-t (21 tests): execute, return_one_int,
    check_table_structure, build_table, row ops, locking

  GenAI/MCP (PROXYSQLGENAI=1):
  - genai_stats_parsing_unit-t (79 tests): parse_server_filter,
    parse_digest_filter, parse_ll_or_zero, get_interval_config,
    calculate_percentile
  - genai_fts_string_unit-t (32 tests): MySQL_FTS sanitize_name,
    escape_identifier, escape_sql, table name construction
  - genai_anomaly_unit-t (24 tests): normalize_query SQL
    normalization, check_sql_injection pattern detection

Minimal production changes for GenAI testability:
- include/Anomaly_Detector.h: add friend class for test access
- include/Stats_Tool_Handler.h: declare 4 parsing helpers, move
  2 pure computation methods (get_interval_config,
  calculate_percentile) to public
- lib/Stats_Tool_Handler.cpp: remove static from 4 free helper
  functions (no behavioral change, only linkage visibility)

2 Commits (fix/pgsql-unix-socket)