proxysql

History

Rene Cannao 04bccec51e chore(plugin-chassis): tighten gating, drop dead paths, gate forgery setters Five clean-up items from the independent review of PR #5651. None of these change behaviour on a normal run; they each fix a concrete way the current code is misleading or unnecessarily exposed. 1) lib/ProxySQL_Admin.cpp: gate the three plugin-DB-handle getters (proxysql_plugin_get_admindb / _configdb / _statsdb) under #ifdef PROXYSQL40. Previously these were defined unconditionally and emitted symbols into v3.0/v3.1 binaries. The chassis is a v4.0 feature; the user explicitly required that v3.x builds carry no plugin-aware code. Wrap in PROXYSQL40 so they are entirely absent from v3.x linkage. ProxySQL_PluginManager.cpp's extern declarations (lines 23-25) are already inside the file-wide PROXYSQL40 gate and so resolve only when the gate is active. 2) lib/ProxySQL_PluginManager.cpp + include/ProxySQL_PluginManager.h: delete the dead `#else /* !PROXYSQL40 /` branches. Both files are wrapped in a top-level `#ifdef PROXYSQL40` covering the entire body. Inner `#ifdef PROXYSQL40 ... #else ... #endif` blocks therefore had unreachable `#else` arms — 30+ lines of "pre-chassis two-phase loader" in the .cpp, plus a redundant declaration of proxysql_load_configured_plugins in the .h. The dead arms read as load-bearing alternative implementations on review and that is exactly the wrong signal. Drop them; the single PROXYSQL40 path is the only one. 3) lib/Admin_Bootstrap.cpp + include/proxysql_admin.h + src/main.cpp: remove ProxySQL_Admin::materialize_plugin_tables(). `Admin::init()` already merges plugin-declared schemas into tables_defs_{admin,config,stats} (~line 944) and runs the DDL via check_and_build_standard_tables() (~line 994), all on the same first-boot/reload code path the core tables use. The follow-up call to GloAdmin->materialize_plugin_tables() in main.cpp ran a second name-dedup pass that found everything already present and produced an empty new-rows set — i.e. the post-init helper was a no-op disguised as load-bearing infrastructure. Delete the helper, the header declaration, and the main.cpp call site, and update the comments in main.cpp + ProxySQL_PluginManager.cpp to point at Admin::init() as the single canonical materialization site. Leave a NOTE in Admin_Bootstrap.cpp at the old call site so anyone re-adding a similar helper sees why the prior one was removed. 4) plugins/mysqlx/include/mysqlx_session.h + plugins/mysqlx/src/mysqlx_session.cpp: gate the two genuine forgery vectors behind MYSQLX_TEST_BUILD. inject_identity_for_test() bypasses the full auth flow — no credential check, no capability negotiation, just sets identity_ to a caller-supplied MysqlxResolvedIdentity. resolve_backend_target_ for_test() drives a private routing helper without an authenticated identity. Both are necessary for unit tests but should not be reachable at all in shipped binaries; an in-process exploit reaching the session can call inject_identity_for_test() to forge an authenticated identity. Wrap them in #ifdef MYSQLX_TEST_BUILD; define -DMYSQLX_TEST_BUILD in the test Makefile only. The remaining target__for_test() getters are read-only state observers and are left unconditional — they cannot mutate the session and a debugger could observe the same state regardless. 5) test/tap/tests/unit/Makefile: define -DMYSQLX_TEST_BUILD on every unit test compile line via OPT. This is the test-only knob that re-enables the gated forgery methods so unit tests still compile. plugins/mysqlx/Makefile does NOT define this macro, so the production .so does not compile in the entry points. Verified locally: - plugins/mysqlx/ProxySQL_MySQLX_Plugin.so builds clean with PROXYSQL40=1 PROXYSQL31=1 PROXYSQLFFTO=1 PROXYSQLTSDB=1 PROXYSQLGENAI=1 (no MYSQLX_TEST_BUILD). - test/tap/tests/unit/mysqlx_robustness_unit-t builds and runs: 74/74 assertions pass, including the ones that exercise inject_identity_for_test (visible only because the test Makefile defines MYSQLX_TEST_BUILD).	4 weeks ago
..
mysqlx	chore(plugin-chassis): tighten gating, drop dead paths, gate forgery setters	4 weeks ago

Rene Cannao 04bccec51e chore(plugin-chassis): tighten gating, drop dead paths, gate forgery setters

Five clean-up items from the independent review of PR #5651. None of
these change behaviour on a normal run; they each fix a concrete way
the current code is misleading or unnecessarily exposed.

1) lib/ProxySQL_Admin.cpp: gate the three plugin-DB-handle getters
   (proxysql_plugin_get_admindb / _configdb / _statsdb) under
   #ifdef PROXYSQL40.

   Previously these were defined unconditionally and emitted symbols
   into v3.0/v3.1 binaries. The chassis is a v4.0 feature; the user
   explicitly required that v3.x builds carry no plugin-aware code.
   Wrap in PROXYSQL40 so they are entirely absent from v3.x linkage.
   ProxySQL_PluginManager.cpp's extern declarations (lines 23-25) are
   already inside the file-wide PROXYSQL40 gate and so resolve only
   when the gate is active.

2) lib/ProxySQL_PluginManager.cpp + include/ProxySQL_PluginManager.h:
   delete the dead `#else /* !PROXYSQL40 */` branches.

   Both files are wrapped in a top-level `#ifdef PROXYSQL40` covering
   the entire body. Inner `#ifdef PROXYSQL40 ... #else ... #endif`
   blocks therefore had unreachable `#else` arms — 30+ lines of
   "pre-chassis two-phase loader" in the .cpp, plus a redundant
   declaration of proxysql_load_configured_plugins in the .h. The
   dead arms read as load-bearing alternative implementations on
   review and that is exactly the wrong signal. Drop them; the
   single PROXYSQL40 path is the only one.

3) lib/Admin_Bootstrap.cpp + include/proxysql_admin.h + src/main.cpp:
   remove ProxySQL_Admin::materialize_plugin_tables().

   `Admin::init()` already merges plugin-declared schemas into
   tables_defs_{admin,config,stats} (~line 944) and runs the DDL via
   check_and_build_standard_tables() (~line 994), all on the same
   first-boot/reload code path the core tables use. The follow-up
   call to GloAdmin->materialize_plugin_tables() in main.cpp ran a
   second name-dedup pass that found everything already present and
   produced an empty new-rows set — i.e. the post-init helper was a
   no-op disguised as load-bearing infrastructure. Delete the helper,
   the header declaration, and the main.cpp call site, and update
   the comments in main.cpp + ProxySQL_PluginManager.cpp to point at
   Admin::init() as the single canonical materialization site. Leave
   a NOTE in Admin_Bootstrap.cpp at the old call site so anyone
   re-adding a similar helper sees why the prior one was removed.

4) plugins/mysqlx/include/mysqlx_session.h +
   plugins/mysqlx/src/mysqlx_session.cpp: gate the two genuine
   forgery vectors behind MYSQLX_TEST_BUILD.

   inject_identity_for_test() bypasses the full auth flow — no
   credential check, no capability negotiation, just sets identity_
   to a caller-supplied MysqlxResolvedIdentity. resolve_backend_target_
   for_test() drives a private routing helper without an authenticated
   identity. Both are necessary for unit tests but should not be
   reachable at all in shipped binaries; an in-process exploit
   reaching the session can call inject_identity_for_test() to forge
   an authenticated identity. Wrap them in #ifdef MYSQLX_TEST_BUILD;
   define -DMYSQLX_TEST_BUILD in the test Makefile only. The remaining
   target_*_for_test() getters are read-only state observers and are
   left unconditional — they cannot mutate the session and a debugger
   could observe the same state regardless.

5) test/tap/tests/unit/Makefile: define -DMYSQLX_TEST_BUILD on every
   unit test compile line via OPT.

   This is the test-only knob that re-enables the gated forgery
   methods so unit tests still compile. plugins/mysqlx/Makefile does
   NOT define this macro, so the production .so does not compile in
   the entry points.

Verified locally:
- plugins/mysqlx/ProxySQL_MySQLX_Plugin.so builds clean with
  PROXYSQL40=1 PROXYSQL31=1 PROXYSQLFFTO=1 PROXYSQLTSDB=1
  PROXYSQLGENAI=1 (no MYSQLX_TEST_BUILD).
- test/tap/tests/unit/mysqlx_robustness_unit-t builds and runs:
  74/74 assertions pass, including the ones that exercise
  inject_identity_for_test (visible only because the test Makefile
  defines MYSQLX_TEST_BUILD).

mysqlx

chore(plugin-chassis): tighten gating, drop dead paths, gate forgery setters