Hello Christopher, - With post-80 using CLIENT_PLUGIN_AUTH, MySQL doesn't send err_packet (0xff) on plugin mismatch (reports 0xfe) and expect client to use correct plugin. Same is not the case with pre-41/post-41 (MySQL relies with error 1251) - this can happen with many reasons like version upgrades (using the prior auth account using old plugin) to continue for health checks. Idea here is to not silently ignore the mismatch (ultimately MySQL blocking haproxy host due to 1129 err) - This false positive (haproxy is reporting OK packet with 0xfe all the time) is updated in the doc but code isn't immediately reporting the error in case of mismatch, the prior fix the support of sha2 is added
Regards, *Siddharth Agravat* On Mon, Nov 9, 2026, 12:29 PM Christopher Faulet <[email protected]> wrote: > Le 06/11/2026 à 7:30 PM, Siddharth Agravat a écrit : > > Hi Christopher, Willy, and list, > > > > Please find attached a follow-up patch on top of Alex Joseph's patch > > "MINOR: tcpcheck: add post-80-sha2 mode to mysql-check for > > caching_sha2_password" > > (https://github.com/aarul/haproxy-mysql-sha2/pull/1): > > - Follow-up PR: https://github.com/aarul/haproxy-mysql-sha2/pull/2 > > When option mysql-check is used with a username, > tcpcheck_mysql_expect_ok() > > calls tcpcheck_mysql_expect_packet() with offset > 0 to validate the > server > > response to the client HandshakeResponse41 packet. Previously, > > tcpcheck_mysql_expect_packet() only checked whether the packet header > byte > > was 0xff (ERR_Packet) and treated any other packet header as a valid OK > > response. > > As a result, when a MySQL 8.0+ / 8.4+ / 9.x server replies with an > > AuthSwitchRequest (0xfe) (for example, when post-80 announces > > mysql_native_password for a caching_sha2_password check user, or > > post-80-sha2 is used against a non-caching_sha2_password check user) or > > AuthMoreData (0x01), mysql-check falsely reports the server as UP (L7OK) > > while the pipelined COM_QUIT packet causes the server to abort the > > handshake with ER_NET_PACKETS_OUT_OF_ORDER (1156) and increment the host > > cache connection error counter until ER_HOST_IS_BLOCKED (1129) blocks all > > traffic from HAProxy. > > This patch requires the post-handshake packet header byte (at offset > 0) > > to be 0x00 (OK_Packet), rejecting 0xfe (AuthSwitchRequest) and any other > > non-OK packet with HCHK_STATUS_L7RSP and a descriptive error message, and > > adds a corresponding reg-test case (s7/be7) in > reg-tests/checks/mysql-check.vtc. > > Validated against MySQL 9.7 (Cloud SQL for MySQL 9.7.2) across both > > matching and mismatched auth plugins, as well as a 30-minute continuous > > connection and health-check run (900 checks, 0 Aborted_connects, 0 > host_cache > > errors). > > Hi, > > I'm not sure to understand. Is this happen even when the username is > properly > configured, as specified in the documentation ? It is a pre-requisite to > enable > a MySQL healthcheck. Otherwise, there is no way to make it work. > > Regards, > -- > Christopher Faulet >
