Skip to content

pgsql: add initial support to CopyIn mode/ subprotocol - v5 #13326

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 13 commits into
base: master
Choose a base branch
from

Conversation

jufajardini
Copy link
Contributor

Changes (if applicable):

  • I have updated the User Guide (in doc/userguide/) to reflect the changes made
  • I have updated the JSON schema (in etc/schema.json) to reflect all logging changes (including schema descriptions)

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/7645

Previous PR: #13298

Describe changes:

Provide values to any of the below to override the defaults.

SV_BRANCH=OISF/suricata-verify#2520

We have a data structure that can be used both for backend and frontend
messages, but was named as backend only.

Related to
Task OISF#7645
Important for CopyIn mode/ subprotocol, where the frontend is the one
sending 0 or more messages to the backend as part of a transaction.

Related to
Task OISF#7645
This sub-protocol inspects messages sent mainly from the frontend to
the backend after a statement like 'COPY FROM STDIN' has been processed
by the backend.

Parses new messages:
- CopyInResponse -- initiates copy-in mode/sub-protocol
- CopyData (In) -- data transfer message, from frontend to backend
- CopyDone -- signals that no more CopyData messages will be seen from
  the frontend, for the current transaction
- CopyFail -- used by the frontend to signal some failure to proceed
  with sending CopyData messages

Task OISF#7645
While this could be considered minor, they were not just bad, but
misleading names, as the variables weren't really `dummy` responses,
but consolidating several messages.
We used `copy_column_count`, while just `columns` is more accurate with
what PostgreSQL describes, and what Wireshark shows.

Related to
Task OISF#7644
Task OISF#7645
To set apart states that are both for frontend and backend.
Review pub visibility to:
Make it pub crate-only wherever possible.
Remove pub altogether where not-needed.
Since some of state types could indicate a request completion, don't
process them in if/else statements.

Related to
Task OISF#7645
There shouldn't be duplicated messages in the requests Vec. And thus
the parser shouldn't log duplicated keys nor messages. Add debug
validations to ensure this.

With PGSQL's current state machine, most frontend/ client messages will
lead to the creation of a new transaction - which would prevent
duplicated messages being pushed to the requests array and reaching the
logger.

The current exceptions for that are:

- CopyDataIn
- CopyDone
- CopyFail

Thus, debug statements were added for those cases.

CopyDone and CopyFail, per the documentation, shouldn't be seen
duplicated on the wire for the same transaction. CopyDataIn -- yes, but
we consolidate those, so the expectation is that they won't be
duplicated in the requests array or when reaching the logger either.

Related to
Task OISF#7645
@suricata-qa
Copy link

WARNING:

field baseline test %
SURI_TLPW1_stats_chk
.uptime 180 186 103.33%
SURI_TLPR1_stats_chk
.uptime 627 652 103.99%

Pipeline 26245

@victorjulien victorjulien added this to the 8.0 milestone Jun 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants