3 Commits (5eefca3ebfec6dec3f4aeae47dbc2e1787455502)

Author	SHA1	Message	Date
Rene Cannao	3ad60f6881	fix(security): hygiene follow-ups for PP1 UNKNOWN handling (GHSA-gw94-85m2-x8v2) ... Four small fixes that came out of post-fix review of the original GHSA-gw94 commit: 1. lib/proxy_protocol_info.cpp — defensively clear `header_was_unknown` at the top of parseProxyProtocolHeader(). The default constructor zero-inits it, but callers may reuse a ProxyProtocolInfo across multiple parse attempts; a stale `true` from a prior UNKNOWN parse would cause the caller to take the UNKNOWN branch on a later malformed parse, suppressing the legitimate warning. 2. lib/mysql_data_stream.cpp — in the UNKNOWN branch of buffer2array, populate PROXY_info->proxy_address and proxy_port from the real TCP peer (mirroring the TCP4/TCP6 branch at lines 1290-1296). The PROXYSQL INTERNAL SESSION JSON output previously reported empty proxy_address / proxy_port=0 for UNKNOWN frames even though the real upstream LB peer was known. 3. lib/mysql_data_stream.cpp — emit header_was_unknown in the PROXY_V1 JSON block so audit/observability consumers can distinguish a spec-compliant UNKNOWN observation (with intentionally-empty source/destination address fields) from any other state where those fields happen to be empty. 4. include/proxy_protocol_info.h — document the dual-return contract above parseProxyProtocolHeader(): returning false with header_was_unknown=true means "valid UNKNOWN, caller must NOT override client_addr". This guards against a future maintainer flipping the return value to true and accidentally letting the caller's success-branch strdup an empty source_address into addr.addr. No regression-test changes were needed — the existing unit test already pins header_was_unknown=true on UNKNOWN, and the integration test pins client.client_addr.address (not proxy_address) which is the real security boundary.	1 month ago
Rene Cannao	1d2e080a66	fix(security): reject address fields in PROXY-Protocol v1 UNKNOWN frames (GHSA-gw94-85m2-x8v2) ... The PP1 parser accepted "PROXY UNKNOWN <src> <dst> <sport> <dport>\r\n" as a well-formed header and let the parsed source address overwrite addr.addr, which is what Query_Processor reads for client_addr rule matching and what event_log / stats_mysql_processlist record. A peer that can reach the MySQL frontend (default mysql-proxy_protocol_networks = '*') could forge any source IP and bypass any client_addr-pinned ACL or routing rule. The HAProxy PROXY-protocol v1 spec is explicit: when the protocol token is UNKNOWN, the receiver MUST ignore any address fields that follow. Split UNKNOWN from TCP4/TCP6 in the parser: - For UNKNOWN, validate the byte after the token is ' ' or '\r' (rejects bogus tokens like "UNKNOWNFOO"), set a new header_was_unknown flag, and return false so the caller does not override addr.addr. - For TCP4/TCP6, require a single space delimiter after the 4-byte token before running sscanf. Previously a 4-byte memcmp accepted "TCP4xyz ..." as TCP4. Update mysql_data_stream.cpp to branch on header_was_unknown so it records the frame in PROXY_info without overriding addr.addr, and logs the skip at info level (not warning). PgSQL frontend is unaffected — only MySQL calls parseProxyProtocolHeader.	1 month ago
Rene Cannao	d85430b709	Implementation of PROXY protocol V1 ... This commit introduces: - class ProxyProtocolInfo() , that: - performs parsing - validates subnet - run automated tests in DEBUG build - variable mysql-proxy_protocol_networks . Accepted values: - empty string: disables PROXY protocol - '*' : allows connections from any IP - comma separated list of subnets - automated testing in DEBUG build during start - export of PROXY protocol information in internal session, using PROXY_V1 - a TAP test to verify various connections	2 years ago