From 126e90fedb1df39c784d6c47a801e3ed608f3156 Mon Sep 17 00:00:00 2001 From: Jiping Yin Date: Thu, 11 Jun 2026 12:48:05 +0800 Subject: [PATCH] fix(eBPF): enforce reassembly path when MySQL reassembly is enabled When MySQL reassembly is enabled, force all related traffic into the reassembly pipeline. Otherwise, single-packet protocol inference may misidentify consecutive same-direction packets as complete MySQL requests or responses. This could lead to MSG_UNKNOWN not being returned, preventing the reassembly logic from being triggered and causing incorrect parsing behavior. Ensure same-direction continuous data is not prematurely treated as independent complete MySQL messages when reassembly is enabled. --- .../ebpf/kernel/include/protocol_inference.h | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/agent/src/ebpf/kernel/include/protocol_inference.h b/agent/src/ebpf/kernel/include/protocol_inference.h index 47ef03a7e9a..b9042d6952d 100644 --- a/agent/src/ebpf/kernel/include/protocol_inference.h +++ b/agent/src/ebpf/kernel/include/protocol_inference.h @@ -782,6 +782,30 @@ static __inline enum message_type infer_mysql_message(const char *buf, bool is_mysqld = is_current_comm("mysqld"); if (is_socket_info_valid(conn_info->socket_info_ptr)) { + /* + * When MySQL reassembly is enabled, all related traffic must be forced into + * the reassembly processing pipeline. + * + * Otherwise, under a single-packet-based protocol detection model, the + * detection capability is limited, and consecutive same-direction packets may + * be incorrectly identified as complete MySQL requests or responses. + * + * In such cases, these packets will continue to be parsed as valid MySQL + * traffic, and MSG_UNKNOWN will not be returned, thus preventing entry into + * the reassembly process. + * + * This leads to behavior inconsistent with expectations, since correct + * reassembly logic relies on returning MSG_UNKNOWN for incomplete packets in + * order to trigger reassembly. + * + * The goal of this design is to ensure that, when reassembly is enabled, + * consecutive same-direction data is not reported as independent complete + * MySQL messages (requests or responses). + */ + if (conn_info->enable_reasm) { + return MSG_UNKNOWN; + } + /* * Ensure the authentication response packet is captured * and distinguish it based on the 5th byte (Payload start):