Hi Christopher, Willy, and list, Please find attached a follow-up patch on top of Alex Joseph's patch "MINOR: tcpcheck: add post-80-sha2 mode to mysql-check for caching_sha2_password" (https://github.com/aarul/haproxy-mysql-sha2/pull/1): - Follow-up PR: https://github.com/aarul/haproxy-mysql-sha2/pull/2 When option mysql-check is used with a username, tcpcheck_mysql_expect_ok() calls tcpcheck_mysql_expect_packet() with offset > 0 to validate the server response to the client HandshakeResponse41 packet. Previously, tcpcheck_mysql_expect_packet() only checked whether the packet header byte was 0xff (ERR_Packet) and treated any other packet header as a valid OK response. As a result, when a MySQL 8.0+ / 8.4+ / 9.x server replies with an AuthSwitchRequest (0xfe) (for example, when post-80 announces mysql_native_password for a caching_sha2_password check user, or post-80-sha2 is used against a non-caching_sha2_password check user) or AuthMoreData (0x01), mysql-check falsely reports the server as UP (L7OK) while the pipelined COM_QUIT packet causes the server to abort the handshake with ER_NET_PACKETS_OUT_OF_ORDER (1156) and increment the host cache connection error counter until ER_HOST_IS_BLOCKED (1129) blocks all traffic from HAProxy. This patch requires the post-handshake packet header byte (at offset > 0) to be 0x00 (OK_Packet), rejecting 0xfe (AuthSwitchRequest) and any other non-OK packet with HCHK_STATUS_L7RSP and a descriptive error message, and adds a corresponding reg-test case (s7/be7) in reg-tests/checks/mysql-check.vtc. Validated against MySQL 9.7 (Cloud SQL for MySQL 9.7.2) across both matching and mismatched auth plugins, as well as a 30-minute continuous connection and health-check run (900 checks, 0 Aborted_connects, 0 host_cache errors).
Regards, Siddharth Agravat
0001-mysql-check-post-80-sha2-hardening.patch
Description: Binary data
