Implementation of ACRA Server in Transparent Proxy Mode

[carevalogh]

Good afternoon, I’m trying to implement ACRA Server in transparent proxy mode, since I cannot modify our application, and I haven’t had good results.

I installed ACRA Server and I’m starting it with the following command:

acra-server --client_id=testclient --mysql_enable=true --db_host=192.168.1.9 --db_port=3306 --incoming_connection_string="tcp://0.0.0.0:9393/" --keys_dir=.acrakeys -d -v --log_to_console=true --encryptor_config_file=./configs/encryptor-config.yaml

The file encryptor-config.yaml has the following content:

database_settings:
  mysql:
    case_sensitive_table_identifiers: true
  defaults:
    crypto_envelope: acrablock
schemas:
  - table: demo
    columns:
      - id
      - secret_data
    encrypted:
      - column: secret_data
        searchable: true
        data_type: str

When I connect to MySQL via ACRA Server, it works perfectly, but if I insert a record into the demo table, the column I configured for encryption (secret_data) does nothing.

This is the output from ACRA Server:

time="2025-06-16T21:42:09Z" level=debug msg="New packet" client_id=testclient deprecate_eof=true proxy=client sequence_number=0 session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg="Query command" client_id=testclient command=3 deprecate_eof=true proxy=client sequence_number=0 session_id=3 sql="\x00\x01SELECT @@session.transaction_read_only"
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg=HashQuery.OnQuery
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg="Unsupported search query"
time="2025-06-16T21:42:09Z" level=debug msg=PreparedStatementsQuery.OnQuery
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg="New packet from db to client" client_id=testclient sequence_number=1 session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Read column descriptions" client_id=testclient session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Read column description" client_id=testclient column_index=0 session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Parse field" client_id=testclient column_index=0 session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Read data rows" client_id=testclient session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Read data row" client_id=testclient data_row_index=0 session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Process data text row" client_id=testclient data_row_index=0 session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Process data rows in text protocol" client_id=testclient session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Unknown hash function"
time="2025-06-16T21:42:09Z" level=debug msg="OnColumn: Try to decrypt SerializedContainer"
time="2025-06-16T21:42:09Z" level=debug msg="OnColumn: Try to decrypt AcraBlock"
time="2025-06-16T21:42:09Z" level=debug msg="Unknown hash function"
time="2025-06-16T21:42:09Z" level=debug msg="Encode text" client_id=testclient column="" decrypted=false session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Finish processing text data row" client_id=testclient session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Update row data" client_id=testclient data_row_index=0 newLength=2 oldLength=2 session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Read data row" client_id=testclient data_row_index=1 session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Empty result set" client_id=testclient data_row_index=1 session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Proxy output" client_id=testclient session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Query handler finish" client_id=testclient session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="New packet" client_id=testclient deprecate_eof=true proxy=client sequence_number=0 session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg="Query command" client_id=testclient command=3 deprecate_eof=true proxy=client sequence_number=0 session_id=3 sql="\x00\x01/* ApplicationName=DBeaver 25.0.4 - SQLEditor <Script-47.sql> */ insert into demo (secret_data) values ('carlos')"
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg=HashQuery.OnQuery
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg="Unsupported search query"
time="2025-06-16T21:42:09Z" level=debug msg=PreparedStatementsQuery.OnQuery
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg="ignoring error of non parsed sql statement" error="syntax error: unexpected LEX_ERROR at position 2 near '\x00'"
time="2025-06-16T21:42:09Z" level=debug msg="New packet from db to client" client_id=testclient sequence_number=1 session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Proxy output" client_id=testclient session_id=3
time="2025-06-16T21:42:09Z" level=debug msg="Query handler finish" client_id=testclient session_id=3 

Please, I need help to understand what I’m doing wrong.

[Lagovas]

Hi. Please, provide the following details:

• version of mysql
• schema of db, at least a target table
• sql query you send through AcraServer

[carevalogh]

Hi, here is the information you requested.

version of mysql

8.4.5

schema of db, at least a target table

USE acra_test;
CREATE TABLE demo (
  id INT AUTO_INCREMENT PRIMARY KEY,
  secret_data TEXT
);

sql query you send through AcraServer

insert into demo (secret_data) values ('carlos');

[Zhaars]

Hello, @carevalogh!

Unfortunately, you're using MySQL 8.4.5, which relies on a protocol version that is not fully supported by Acra at the moment.

The DBeaver client uses protocol features (such as query attributes) introduced in MySQL 8.0.23 and later. These features are currently not handled by Acra and may lead to unexpected behavior when executing queries.

As a potential workaround, you can try:

Testing with MySQL 8.0.22 or earlier – this should work fine

Using a different MySQL client that does not utilize query attributes or other newer protocol extensions
(Note: this workaround is not guaranteed to solve the issue and may require additional testing)

We appreciate your understanding and are working to improve compatibility with newer MySQL protocol versions in future releases.

[carevalogh]

Hi, thanks for responding. It works with MySQL 8.00.22, which is a fairly old version (2020), and I need support for this version on AWS RDS. If I change or upgrade MySQL, will I have this protocol issue?
In what version of ACRA, or how long do you plan to release support for the new MySQL protocols?

[Zhaars]

Hi, @carevalogh!

Based on our current roadmap, we don't expect to add support for newer MySQL protocol versions in the open-source version of Acra within the next six months. However, we may be able to prioritise this feature as part of a commercial engagement.

If this is something you’d be interested in exploring, feel free to contact us at sales@cossacklabs.com, and we’d be happy to discuss potential options.