Since I migrated from Mariadb 10.3.22 to 10.4.13, I get some regression with the use of proxy-protocol-networks.
Haproxy doesn't see any mysql backend alive anymore and my "clienthost" cannot authenticate themselves in Mariadb based on their IP.
On mariadb's side I tried the following things
server myglra1 172.16.42.21:3306 check weight 1 send-proxy-v2
server myglra2 172.16.42.22:3306 check weight 1 send-proxy-v2
server myglra3 172.16.42.23:3306 check weight 1 send-proxy-v2
I also tried with "send-proxy"
On haproxy I get the following logs
May 27 10:10:21 haproxy001 haproxy[2958]: Health check for server mygalera/myglra1 failed, reason: Layer7 wrong status, code: 0, info: "#HY000Proxy header is not accepted from 172.16.42.9", check duration: 2ms, status: 0/2 DOWN.
May 27 10:10:21 haproxy001 haproxy[2958]: Health check for server mygalera/myglra1 failed, reason: Layer7 wrong status, code: 0, info: "#HY000Proxy header is not accepted from 172.16.42.9", check duration: 2ms, status: 0/2 DOWN.
May 27 10:31:53 haproxy001 haproxy[3056]: Health check for server mygalera/myglra1 failed, reason: Layer7 wrong status, code: 0, info: "#HY000Proxy header is not accepted from 172.16.42.9", check duration: 1ms, status: 0/2 DOWN.
May 27 10:31:53 haproxy001 haproxy[3056]: Health check for server mygalera/myglra1 failed, reason: Layer7 wrong status, code: 0, info: "#HY000Proxy header is not accepted from 172.16.42.9", check duration: 1ms, status: 0/2 DOWN.
May 27 10:31:54 haproxy001 haproxy[3056]: Health check for server mygalera/myglra2 failed, reason: Layer7 wrong status, code: 0, info: "#HY000Proxy header is not accepted from 172.16.42.9", check duration: 2ms, status: 0/2 DOWN.
May 27 10:31:54 haproxy001 haproxy[3056]: Health check for server mygalera/myglra2 failed, reason: Layer7 wrong status, code: 0, info: "#HY000Proxy header is not accepted from 172.16.42.9", check duration: 2ms, status: 0/2 DOWN.
May 27 10:31:54 haproxy001 haproxy[3056]: Health check for server mygalera/myglra3 failed, reason: Layer7 wrong status, code: 0, info: "#HY000Proxy header is not accepted from 172.16.42.9", check duration: 2ms, status: 0/2 DOWN.
May 27 10:31:54 haproxy001 haproxy[3056]: Health check for server mygalera/myglra3 failed, reason: Layer7 wrong status, code: 0, info: "#HY000Proxy header is not accepted from 172.16.42.9", check duration: 2
and after a while I get the followinf error for each of my galera's nodes
May 28 10:07:22 haproxy001 haproxy[4028]: Health check for server mygalera/myglra1 failed, reason: Layer7 wrong status, code: 0, info: "Host '172.16.42.9' is blocked because of many connection errors; unbloc
k with 'mysqladmin flush-hosts'", check duration: 3ms, status: 0/2 DOWN.
On my galera's nodes I get following errors repeating till the source ip is blocked
May 28 10:51:01 myglra001 mysqld[19634]: 2020-05-28 10:51:01 2144 [Warning] Aborted connection 2144 to db: 'unconnected' user: 'unauthenticated' host: '172.16.42.9' (This connection closed normally without authentication)
All of this leads to all backend seen as down.
I had a some test being done on a maxscale node and the behaviour/results are the same as haproxy (no live backend seen)
I was using proxy_protocol=true in my servers' definition in maxscale.cnf
If I skip all these proxy configuration things and create users in mariadb on haproxy's ips everything is working fine, but i lose the client IP.
jplindst, I'm positive that this work in normal standalone server, which is not Galera.
We do have a test for this inside mysql_client_test, this is in test suite (https://github.com/MariaDB/server/blob/10.5/tests/mysql_client_test.c, look for test_proxy_header()) , and it always succeeds. Besides , there is not difference between 10.3 and 10.4 proxy protocol handling. But there is a difference in Galera, so I'm assigning you to check what's wrong.
You'd need to implement test like this , also for Galera.
Vladislav Vaintroub
added a comment - - edited jplindst , I'm positive that this work in normal standalone server, which is not Galera.
We do have a test for this inside mysql_client_test, this is in test suite ( https://github.com/MariaDB/server/blob/10.5/tests/mysql_client_test.c , look for test_proxy_header()) , and it always succeeds. Besides , there is not difference between 10.3 and 10.4 proxy protocol handling. But there is a difference in Galera, so I'm assigning you to check what's wrong.
You'd need to implement test like this , also for Galera.
Have the same issue after upgrading to 10.5 from 10.3 (debian buster to bullseye). I am also behind haproxy and running mariadb in a container. Using `send-proxy` on the haproxy backend configuration now fails and mariadb logs:
Yannis Fragkoulis
added a comment - Have the same issue after upgrading to 10.5 from 10.3 (debian buster to bullseye). I am also behind haproxy and running mariadb in a container. Using `send-proxy` on the haproxy backend configuration now fails and mariadb logs:
```
2021-09-03 17:03:01 505 [Warning] Aborted connection 505 to db: 'unconnected' user: 'unauthenticated' host: 'connecting host' (This connection closed normally without authentication)
```
Could not reproduce the issue on 10.4.24. Tried to configure galera hosts in HAproxy listen section to check the connection status. HAProxy could not be started while using the backend section mentioned in the bug description. Please share the haproxy.cfg file and try to check the connection status using the {{listen} section as mentioned in the test case below.
I tried to upgrade to 10.5.3 ... but it doesn't change anything concerning this problem.