pingcap / pingcap/tiproxy

Access denied when TiProxy and TiDB are in localhost

Open
#324 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
73
Forks
41
Avg merge
21h 3m
Merged PRs (30d)
21

Description

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)
  1. Start a TiDB cluster and TiProxy in localhost.
  2. Create user u1@localhost.
  3. Connect to TiProxy with u1.
2. What did you expect to see? (Required)

Connect succeeds.

3. What did you see instead (Required)

Connect failed: Access denied for user.

4. What is your version? (Required)

master.

The reason:
The Config.Host of TiDB is by default 0.0.0.0. TiDB registers to PD with address 192.168.0.101 instead of 127.0.0.1 and so TiProxy connects to 192.168.0.101. In this case, the TiDB sees that the TiProxy address is also 192.168.0.101 and so doesn't match the address DNS response contained records which contain invalid names in net.LookupAddr(host).

When TiDB starts with --host=127.0.0.1, TiDB registers to PD with address 127.0.0.1 and so TiProxy connects to 127.0.0.1. The TiDB sees that the TiProxy address is 127.0.0.1 and it matches localhost and succeeds.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the localhost setup with a TiDB cluster, TiProxy, and user u1@localhost, comparing the default host configuration with --host=127.0.0.1. Trace how TiDB registers its address through PD and how TiProxy connects and handles the address during authentication. Done means the documented localhost setup allows u1 to connect successfully without relying on the alternate host configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, databases, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.