Dr.-Ing. Mario Heiderich, Cure53 Bielefelder Str. 14 D 10709 Berlin cure53.de · mario@cure53.de Pentest-Report Vitess 02.2019 Cure53, Dr.-Ing. M. Heiderich, M. Wege, MSc project was carried out by Cure53 in February 2019 and revealed only three miscellaneous findings. In terms of resources, the test was completed by six members of the Cure53 team who worked within a time setup was requested by the testers and provided by the development team. Besides furnishing Cure53 with a Kubernetes-based cluster, locally installed systems were also used for testing. Access to all

. . . . . . . . . . . . . . . . . 53 Character Set and Collation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 SQL Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Auto Increment . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Extensions to MySQL Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 MySQL Replication . . . . . . . . .

. . . . . . . . . . . . . . . . . 53 Requirements and usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Global data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Local data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . -0000000101... Starting vttablet for zone1 -0000000101... HTTP/1.1 200 OK Date: Wed, 25 Mar 2020 17:32:53 GMT Content -Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000102... Starting

. . . . . . . . . . . . . . . . . 53 ApplyRoutingRules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Sharding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . -0000000101... Starting vttablet for zone1 -0000000101... HTTP/1.1 200 OK Date: Wed, 25 Mar 2020 17:32:53 GMT Content -Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000102... Starting

. . . . . . . . . . . . . . . . . 53 New vindexes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Corner cases to keep in mind . . . . . . . . . . . . . . . . . . . 53 What won’t work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Locking functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Locking Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . 53 VStream Copy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 VStream Copy . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Architecture/Design . . . . . . . lag is small) binlog events will again be directly streamed similar to the current implementation. 53 Current API Clients create vstreams by grpc-ing to VTGate using the Vstream API call. In golang:

. . . . . . . . . . . . . . . 53 History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Vitess becomes a CNCF project -0000000101... Starting vttablet for zone1 -0000000101... HTTP/1.1 200 OK Date: Wed, 25 Mar 2020 17:32:53 GMT Content -Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000102... Starting become necessary if the overall size of the database became too large for a single MySQL instance. 53 4. YouTube’s application layer was modified so that before executing any database operation, the code

skipping of states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Asking for a safe DROP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . drop: -table_gc_lifecycle="hold,purge,drop" This is both user-customizable and simple to implement. 53 Asking for a safe DROP Safe DROP TABLEs participate in the Online DDL flow. When a user chooses an -0000000101... Starting vttablet for zone1 -0000000101... HTTP/1.1 200 OK Date: Wed, 25 Mar 2020 17:32:53 GMT Content -Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000102... Starting

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 VStream API and Resharding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . API This is how you would turn on the skew detection and alignment feature in a VStream client: 53 import vtgatepb "vitess.io/vitess/go/vt/proto/vtgate" ... ... flags := &vtgatepb.VStreamFlags{}; flags -0000000101... Starting vttablet for zone1 -0000000101... HTTP/1.1 200 OK Date: Wed, 25 Mar 2020 17:32:53 GMT Content -Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000102... Starting