proxysql

Commit Graph

Author	SHA1	Message	Date
René Cannaò	9f377eec4e	Merge pull request #5302 from sysown/v3.0.6-bump_version bump version to 3.0.6 at the beginning of the development cycle	3 months ago
Miro Stauder	b41a135e09	bump version to 3.0.6 at the beginning of the development cycle	3 months ago
René Cannaò	7e9e00997d	Merge pull request #5293 from sysown/v3.0.5-groups.json_add_missing_test groups.json: add missing test	3 months ago
Miro Stauder	b91dac044a	groups.json: add missing test Signed-off-by: Miro Stauder <miro@proxysql.com>	3 months ago
René Cannaò	a8e759c970	Merge pull request #5289 from sysown/v3.0_buildTap Improve build performance by preserving test dependencies during 'make clean'	3 months ago
René Cannaò	8b2b29918a	Merge pull request #5291 from sysown/v3.0-misc260111 [skip-ci] Remove deprecated read_only_action implementations from MySQL and PgSQL HostGroups managers	3 months ago
René Cannaò	0687365003	Merge pull request #5235 from sysown/v3.0.4-rpm_spec_rework rework spec files, use rpm macros to handle systemd	3 months ago
René Cannaò	876d4ad3b8	Merge pull request #5285 from sysown/v3.0_pgsql-use-ssl-issue-5284 Fix: pgsql_users.use_ssl not being enforced on frontend connections	3 months ago
René Cannaò	b1e37b3387	Merge branch 'v3.0' into v3.0_pgsql-use-ssl-issue-5284 Signed-off-by: René Cannaò <rene@proxysql.com>	3 months ago
René Cannaò	c6ed5b96cd	Merge pull request #5282 from sysown/v3.0_bind-format-issue-5273-fix Fix malformed Bind packets when client provides a single parameter format	3 months ago
Rene Cannao	4aedacd83b	[skip-ci] Remove deprecated read_only_action implementations from MySQL and PgSQL HostGroups managers The old read_only_action() implementations were marked for deletion after 2025-07-14. These were replaced with new implementation that doesn't depend on the admin table. This change removes the deprecated code paths to clean up the codebase.	3 months ago
Rene Cannao	f2ac54e677	Optimize find commands in test/tap/tap/Makefile for better performance Combine multiple find commands into a single command to reduce directory traversal from 4 passes to 1 pass, improving both performance and readability. Suggestion from gemini-code-assist review.	3 months ago
Rene Cannao	4be31efd91	Fix cpp-dotenv preservation in clean target and add proper cleanall support - Fix: Exclude cpp-dotenv directories from find commands in 'make clean' (was removing build artifacts even when preserving source directories) - Add: proper 'cleanall' target in test/tap/tap/Makefile that removes cpp-dotenv source - Update: test/tap/Makefile cleanall to call tap's cleanall instead of clean - Now cpp-dotenv directories are properly preserved during development This fixes a bug where: 1. cpp-dotenv build artifacts were still being deleted during 'make clean' 2. There was no way to properly clean cpp-dotenv except manually 3. The preservation optimization was ineffective due to the above Behavior now: - 'make clean': preserves cpp-dotenv source and build artifacts (~213MB saved) - 'make cleanall': removes everything including cpp-dotenv source	3 months ago
Rene Cannao	ca224cfbdd	Preserve cpp-dotenv source during 'make clean' to improve build performance - Remove cpp-dotenv source cleanup from 'make clean' in test/tap/tap/Makefile - This prevents accidental removal of 213MB of extracted cpp-dotenv source - Build targets force full rebuild anyway if libraries are missing - Typical 'make clean' operation is now faster and preserves compiled artifacts Similar optimization as test/deps: - Regular development workflow preserves expensive-to-rebuild dependencies - Only 'cleanall' removes everything including source directories - Reduces repeated downloads and extraction of cpp-dotenv sources This change complements the previous test/deps optimization, further improving development workflow performance.	3 months ago
Rene Cannao	2ecda902e6	Improve build performance and clean behavior - Remove test/deps from 'make clean' to prevent accidental 2.8GB cleanup - 'make clean' now preserves test dependencies, speeding up development workflow - 'make cleanall' still removes test dependencies as intended - In test/deps/Makefile, make 'clean' an alias of 'cleanall' since incremental clean was practically redundant due to build targets forcing full rebuilds This change: - Reduces typical 'make clean' time by ~30 minutes - Prevents accidental loss of compiled test dependencies (2.8GB) - Makes development workflow more efficient while preserving explicit control Resolves issue with repeated MySQL connector compilation during development.	3 months ago
Rahim Kanji	c0086a56e4	Add test to groups.json	3 months ago
Rahim Kanji	b0ce03cc0e	Add test to groups.json	3 months ago
René Cannaò	9c3f6b0aa5	Merge pull request #5286 from sysown/v3.0-poll_doc [skip-ci] Add comprehensive ProxySQL_Poll usage documentation throughout codebase	3 months ago
Rene Cannao	0699c7ba11	Add comprehensive ProxySQL_Poll usage documentation throughout codebase Enhance ProxySQL_Poll class documentation with detailed usage patterns: - lib/ProxySQL_Poll.cpp: Enhanced file-level documentation with architecture overview, template specialization, memory management, and event processing pipeline explanations - lib/MySQL_Thread.cpp: Added usage documentation for listener registration, removal patterns, client session setup, and main poll loop - lib/PgSQL_Thread.cpp: Added equivalent PostgreSQL usage documentation mirroring MySQL patterns with protocol-specific details - lib/mysql_data_stream.cpp: Documented cleanup, receive activity tracking, and send activity tracking patterns - lib/PgSQL_Data_Stream.cpp: Documented equivalent PostgreSQL data stream patterns for cleanup and activity tracking All documentation is placed directly where code is used, avoiding specific line numbers for better maintainability. Includes comprehensive explanations of when, why, and how ProxySQL_Poll methods are used throughout ProxySQL's event-driven architecture. [skip-ci]	3 months ago
René Cannaò	e6cbdcad7f	Merge pull request #5276 from sysown/v3.0_fork Fix critical bugs in close_all_non_term_fd() for fork/exec safety	3 months ago
Rahim Kanji	f5074a535f	Removed unused executeQueries function	3 months ago
Rahim Kanji	ba53c75c63	Add Regression Test	3 months ago
Rahim Kanji	860657f8fa	use_ssl value from pgsql_users is properly assigned to the session	3 months ago
Rahim Kanji	556b1023c4	Removed change_user_auth_switch flag	3 months ago
René Cannaò	ef872c7f48	Merge pull request #5280 from sysown/v3.0-timezone-parser-fix Fix timezone parsing to support 3-component IANA names and hyphens	3 months ago
René Cannaò	591e1bca6b	Merge pull request #5277 from sysown/v3.0_5272 Fix #5272: Add mysql-select_version_forwarding variable for SELECT VERSION()	3 months ago
Rahim Kanji	3f46d4a5cc	Updated pg_lite_client and Added TAP test	4 months ago
Rahim Kanji	5a7e7b30e7	Fix extended query Bind handling when a single parameter format is provided PostgreSQL allows a Bind message to specify a single parameter format (num_param_formats = 1), which applies to all parameters. libpq, however, always expects a format entry per parameter and previously sent uninitialized values for the remaining parameters when only one format was specified. This caused ProxySQL to forward malformed Bind packets to backend. ProxySQL now detects this case and propagates the single provided parameter format to all parameters, matching PostgreSQL semantics.	4 months ago
René Cannaò	4f675ed137	Merge pull request #5279 from sysown/v3.0-keylog_doc Add comprehensive documentation for SSL/TLS key logging feature	4 months ago
Rene Cannao	662d8a0c47	Address gemini-code-assist review: improve hyphen test case Replace 'Atlantic/Canary' with 'US/East-Indiana' in the hyphen test cases. The previous test case (Atlantic/Canary) did not contain a hyphen and would have been matched by the old regex, so it did not actually test the new hyphen support. The new test case (US/East-Indiana) contains a hyphen and properly validates the hyphen support feature. Thanks to @gemini-code-assist for the excellent review feedback!	4 months ago
Rene Cannao	6e9abed581	Fix timezone parsing to support 3-component IANA names and hyphens This commit fixes a parsing error in the MySQL SET statement parser that occurred when processing `SET time_zone` statements with: 1. Three-component IANA timezone names (e.g., America/Argentina/Buenos_Aires) 2. Timezone names containing hyphens (e.g., America/Port-au-Prince) Previously, the regex pattern `(?:\w+/\w+)` only matched 2-component timezone names and did not support hyphens. This caused parsing errors logged as: "[ERROR] Unable to parse query. If correct, report it as a bug: SET time_zone=\"America/Argentina/Buenos_Aires\";" When multiplexing is enabled, this bug causes timestamps to be incorrectly written to the database. Changes: - Updated timezone regex from `(?:\w+/\w+)` to `(?:[\w-]+(?:/[\w-]+){1,2})` - Supports 2-3 components: Area/Location or Area/Country/Location - Supports hyphens in component names (e.g., Port-au-Prince) - Added comprehensive Doxygen documentation for timezone parsing - Extended TAP test cases with new timezone formats Note: Bare words like 'SYSTEM' and 'UTC' were already supported via other patterns in the parser (vp2 pattern for word matching). Fixes: #4993 Related: gemini-code-assist review comments	4 months ago
Rene Cannao	8c90bda52a	Address gemini-code-assist review comments for SSL keylog documentation This commit addresses all review comments from gemini-code-assist on PR #5279: 1. Fixed FLUSH LOGS documentation - clarified that file is reopened for appending, not truncating, and updated the note about preserving contents 2. Fixed callback documentation - clarified that the callback attaches to all frontend connections, not just admin connections 3. Updated security warning - focused on passive eavesdropping and offline decryption as the primary threats 4. Fixed typo: proxyql_ip -> proxysql_ip in tcpdump example 5. Removed misleading @see HPKP link - HPKP is unrelated to NSS Key Log Format and is a deprecated feature 6. Updated NSS Key Log Format URL to use official MDN link instead of unofficial mirror 7. Fixed buffer size comment to accurately reflect 256-byte buffer and 254-byte line length validation 8. Clarified fputs comment to emphasize the read lock's role in allowing concurrent writes from multiple threads	4 months ago
Rene Cannao	acf2e28905	Fix TAP test for mysql-select_version_forwarding with default mode 3 The test was failing because the default mode 3 (smart with fallback to proxying) tries to proxy the query when no backends exist, causing the query to fail. Changes: - Split test into two scenarios: 1. Mode 3 (explicitly set): Expected to FAIL with no backends 2. Mode 2: Expected to SUCCEED with no backends (fallback to internal) - Added extensive documentation explaining: * All 4 modes of mysql-select_version_forwarding * Why mode 3 fails with no backends (correct behavior) * Why mode 2 succeeds with no backends (fallback to internal version) * Test execution flow and why both scenarios matter - Refactored test into test_mode() helper function for clarity	4 months ago
Rene Cannao	b39e193f4f	Fix critical issues in close_all_non_term_fd() per code review This commit addresses critical issues identified in PR #5276 by gemini-code-assist's code review, which could undermine the goal of being allocation-free and cause hangs or silent failures. Bug 1: Vector Passed by Value (Critical) ------------------------------------------ The function took std::vector<int> excludeFDs by value, causing heap allocation during the copy operation. This undermines the PR's goal of avoiding heap allocations after fork() to prevent deadlocks in multi-threaded programs. Fix: Change to pass by const reference to avoid heap allocation. void close_all_non_term_fd(const std::vector<int>& excludeFDs) Bug 2: Infinite Loop Risk (Critical) ------------------------------------ The loop used unsigned int for the variable while comparing against rlim_t (unsigned long long). If rlim_cur exceeded UINT_MAX, this would create an infinite loop. Fix: Use rlim_t type for the loop variable and cap at INT_MAX. for (rlim_t fd_rlim = 3; fd_rlim < nlimit.rlim_cur && fd_rlim <= INT_MAX; fd_rlim++) Bug 3: close_range() Detection Logic (High) ------------------------------------------ The original detection logic had two problems: 1. Executed close_range syscall twice on first successful call 2. Incorrectly cached availability on transient failures (EINTR), leaving file descriptors open without fallback Fix: Reordered logic to only cache on success, allow retry on transient failures. Only cache as "not available" on ENOSYS. For other errors (EBADF, EINVAL, etc.), don't cache - might be transient. Files Modified -------------- - include/proxysql_utils.h - lib/proxysql_utils.cpp	4 months ago
Rene Cannao	fc73ec1c50	Code review improvements: Add enum and refactor SELECT VERSION() handling - Add SelectVersionForwardingMode enum to replace magic numbers (0,1,2,3) - Refactor modes 2 and 3 to eliminate code duplication - Improve code readability and maintainability Addresses feedback from gemini-code-assist on PR #5277	4 months ago
Rene Cannao	442635b721	Add comprehensive documentation for SSL/TLS key logging feature This commit adds extensive documentation for the ssl_keylog_file feature (introduced in PR #4236), which enables TLS key logging for debugging encrypted traffic. ## Background The ssl_keylog_file variable (exposed as admin-ssl_keylog_file in SQL interface) allows ProxySQL to write TLS secrets to a file in NSS Key Log Format. These secrets can be used by tools like Wireshark and tshark to decrypt and analyze TLS traffic for debugging purposes. ## Changes ### Inline Documentation (Code) 1. include/proxysql_sslkeylog.h (+96 lines) - File-level documentation explaining the module purpose and security - Doxygen comments for all 5 public APIs - Thread-safety annotations - Parameter descriptions and return values 2. lib/proxysql_sslkeylog.cpp (+136 lines) - Implementation-level documentation - Algorithm explanations (double-checked locking, thread safety) - Reference to NSS Key Log Format specification 3. include/proxysql_admin.h (+19 lines) - Variable documentation for ssl_keylog_file - Path handling rules (absolute vs relative) - Security implications ### Developer Documentation (doc/ssl_keylog/ssl_keylog_developer_guide.md) Target audience: Developers working on ProxySQL codebase Contents: - Variable naming convention (SQL vs config file vs internal) - Architecture diagrams - Thread safety model (pthread rwlock) - NSS Key Log Format specification - Complete API reference for all public functions - Integration points in the codebase - Security considerations and code review checklist - Testing procedures ### User Documentation (doc/ssl_keylog/ssl_keylog_user_guide.md) Target audience: End users and system administrators Contents: - What is SSL key logging and when to use it - Variable naming: admin-ssl_keylog_file (SQL) vs ssl_keylog_file (config) - Step-by-step enable/disable instructions - Path resolution (absolute vs relative) - Log rotation procedures - Production workflow: tcpdump capture → offline analysis - Wireshark (GUI) integration tutorial - tshark (command-line) usage examples - Troubleshooting common issues - Security best practices - Quick reference card ## Key Features Documented 1. Variable Naming Convention - SQL interface: SET admin-ssl_keylog_file = '/path'; - Config file: ssl_keylog_file='/path' (in admin_variables section) - Internal code: ssl_keylog_file 2. Production Workflow - Capture traffic with tcpdump (no GUI on production server) - Transfer pcap + keylog to analysis system - Analyze offline with Wireshark (GUI) or tshark (CLI) 3. tshark Examples - Command-line analysis of encrypted traffic - Filter examples for debugging TLS issues - JSON export for automated analysis ## Security Notes The documentation emphasizes that: - Key log files contain cryptographic secrets that decrypt ALL TLS traffic - Access must be restricted (permissions 0600) - Only enable for debugging, never in production - Securely delete old key log files ## Files Modified - include/proxysql_admin.h - include/proxysql_sslkeylog.h - lib/proxysql_sslkeylog.cpp ## Files Added - doc/ssl_keylog/ssl_keylog_developer_guide.md - doc/ssl_keylog/ssl_keylog_user_guide.md	4 months ago
Rene Cannao	366164ab26	Fix #5272 : Add mysql-select_version_forwarding variable for SELECT VERSION() Since ProxySQL 3.0.4, SELECT VERSION() queries were intercepted and returned ProxySQL's mysql-server_version variable instead of proxying to backends. This broke SQLAlchemy for MariaDB which expects "MariaDB" in the version string. This commit adds a new variable `mysql-select_version_forwarding` with 4 modes: - 0 = never: Always return ProxySQL's version (3.0.4+ behavior) - 1 = always: Always proxy to backend (3.0.3 behavior) - 2 = smart (fallback to 0): Try backend connection, else ProxySQL version - 3 = smart (fallback to 1): Try backend connection, else proxy (default) The implementation includes: - New global variable mysql_thread___select_version_forwarding - New function get_backend_version_for_hostgroup() to peek at backend connection versions without removing them from the pool - Modified SELECT VERSION() handler to support all 4 modes - ProxySQL backend detection to avoid recursion Mode 3 (default) ensures SQLAlchemy always gets the real MariaDB version string while maintaining fast response when connections are available.	4 months ago
Rene Cannao	2448b12a56	Fix critical bugs in close_all_non_term_fd() for fork/exec safety This commit fixes two critical bugs in close_all_non_term_fd() that caused undefined behavior and potential deadlocks when called after fork() before execve() in multi-threaded programs. Bug 1: Self-Referential Directory FD Closure ---------------------------------------------- When iterating through /proc/self/fd, opendir() creates a file descriptor for the directory stream. This fd appears in the enumeration while we're iterating, and if we close it, readdir() operates on a corrupted DIR* stream, causing undefined behavior, crashes, or missed file descriptors. Fix: Use dirfd() to obtain the directory's fd and explicitly skip closing it. Bug 2: Heap Allocation After fork() in Multi-Threaded Programs ---------------------------------------------------------------- In multi-threaded programs, when fork() is called while other threads hold malloc locks, the child process inherits a "frozen" state where those locks remain locked (the owning threads don't exist in the child). Any heap allocation (malloc/free/new/delete) in the child before execve() can deadlock. The original code used: - std::stol(std::string(dir->d_name)) - creates a temporary std::string - std::find() - may allocate internally Fix: Replace with heap-allocation-free alternatives: - atoi(dir->d_name) instead of std::stol(std::string(...)) - Simple C loops instead of std::find() Additional Improvements ----------------------- 1. Added close_range() syscall support (Linux 5.9+) with runtime detection - O(1) atomic operation, most efficient method - Only used when excludeFDs is empty (closes all fds >= 3) - Falls back to /proc/self/fd iteration when excludeFDs is non-empty 2. Added extensive doxygen documentation covering: - Security implications (preventing fd leaks to child processes) - Resource management (preventing fd exhaustion) - Deadlock prevention in multi-threaded fork() contexts - Implementation details (three strategies: close_range, /proc/self/fd, rlimit) - fork() safety design considerations - Example usage and portability notes 3. Added required includes: dirent.h, sys/syscall.h, linux/close_range.h Workflow Safety --------------- The function is now safe to use in the common fork() -> close_all_non_term_fd() -> execve() workflow, even in multi-threaded programs. Files Modified -------------- - lib/proxysql_utils.cpp	4 months ago
René Cannaò	a83bba1cd0	Merge pull request #5271 from sysown/v3.0_readme_update_postgres [skip-ci] docs: update README to reflect PostgreSQL support	4 months ago
Rahim Kanji	5a101d2de2	Add Table of Contents	4 months ago
René Cannaò	af23187865	Merge pull request #5270 from sysown/v3.0_restapi_improvement Use parameterized prepared statements in REST API for safer SQL execution	4 months ago
René Cannaò	461f5d52f2	Merge pull request #5266 from sysown/v3.0_mysql_monitor_crash_5256 MySQL Monitor: Improve debug handling	4 months ago
Rahim Kanji	f567bd98bb	Fixed typo	4 months ago
Rahim Kanji	11d6d5e81e	docs: update README to reflect PostgreSQL support Add PostgreSQL to the list of supported databases alongside MySQL (and forks).	4 months ago
René Cannaò	2d1140581d	Merge pull request #5269 from wazir-ahmed/unit-test-doc doc: Update TAP documentation with unit test instructions	4 months ago
Wazir Ahmed	40a1c787f7	TAP: Add proper comments in unit_test.h Signed-off-by: Wazir Ahmed <wazir@proxysql.com>	4 months ago
Wazir Ahmed	facba20055	doc: Add information about groups in TAP test guide Signed-off-by: Wazir Ahmed <wazir@proxysql.com>	4 months ago
Wazir Ahmed	0e537ddb3b	Fix typo in 'EXCLUDE_TRACKING_VARIABLES' macro Signed-off-by: Wazir Ahmed <wazir@proxysql.com>	4 months ago
Rahim Kanji	79df69332d	Refactor find_script() to use parameterized prepared statements (via execute_prepared()) for safer SQL execution.	4 months ago
Rahim Kanji	14aef13827	Add method to execute already prepared SQLite3 statements, supporting both non-SELECT and SELECT queries.	4 months ago

1 2 3 4 5 ...

7962 Commits (9f377eec4ed13325143d1dd9751f670ccd9e0bd7) All Branches Search

7962 Commits (9f377eec4ed13325143d1dd9751f670ccd9e0bd7)

All Branches