cossacklabs / acra

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
https://www.cossacklabs.com/acra/
Apache License 2.0
1.32k stars 128 forks source link

Handle sequence of query packets #637

Closed Lagovas closed 1 year ago

Lagovas commented 1 year ago

Main goal of this PR to support cases with several Parse packets in the one TCP packet. Now, if Acra receive Parse_1 + Bind_1 + Parse_2 + Bind_2 + Execute_1, it will collect encryption settings from the Parse_1, then overwrite it from Parse_2. And when process data rows after the execute it will apply encryption settings for Parse_1 matched to the Parse_2. Because it stores only last one.

But there is not only that problem. DB driver can register prepared statements in the one packet and execute in the next one in the another order. And there is no way to pull correct settings for incoming DataRow. In this PR acra remember only packets that request DataRow from the db. It is SimpleQuery and Execute. Only these two type of packets request rows from the database. So now, we remember query or set of packets from the extended protocol with Parse + Bind + Execute packets.

But we should know when we should remove saved packet and stop apply these settings for the next packets. Database separates results for requests by CommandComplete (one for every Execute and set of them each query in SimpleQueryPacket that may contain several SQL splited by ';'), ErrorResponse, EmptyResultResponse (only for SimpleQuery with sql='') and PortalSuspended (only for Execute). So, there is added tracking incoming commands for data rows and parsing queries for settings only before data decryption stage. Also removed tracking redundant packets like Bind/Parse, because doesn't need anymore.

It is draft because remaining integration test with simulation custom flow with several parse/execute pairs. But main logic is ready for review

Checklist