*: support proxy-protocol

[xhebox]

Signed-off-by: xhe xw897002528@gmail.com

What problem does this PR solve?

Issue Number: ref #14, proxy section

Problem Summary: As title, it is coded as minimal as possible. One thing, it is closed by default: because tidb can not automatically check if incoming connections are proxy or not. (start tidb using tiup with proxy-protocol will fail the health check). That said we can only enable it if the upstream server supports.

What is changed and how it works:

1. misc changes in conf/namespace/example.yaml, pkg/manager/router/router.go, Makefile, pkg/proxy/proxy.go
2. handshakeFirstTime is rewritten such that handshakes between client and proxy is finished first. Another difference is that the new logic is more strict compare to the old logic, e.g. accurate SSLRequest are sent instead of handshakeResp.
3. pkg/proxy/backend/util.go a salt generator
4. fix a length bug in ToBytes(), also avoid panic if callers passed different address family.
5. set deadline for pkg/proxy/net/packetio_test.go
6. remove weir in github template

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)

1. uncomment proxy-protocol in ./conf/proxy.yaml

2. set config for tidb(tiup ... --db.config ... or ./tidb-server -config ...)
[proxy-protocol]
networks = "*"
timeout = 10

3.  connect without failure

• No code

Notable changes

• Has configuration change
• Has HTTP API interfaces change (Don't forget to add the declarative for API)
• Has tiproxyctl change
• Other user behavior changes

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

None

[djshow832]

You should use the capability in the second response from the client (if SSL is enabled). Some clients, such as sysbench, send 2 different capabilities. Only the last one is correct.

[xhebox]

This should be investigated, I rememered mysql-server sometimes will only use the first capabilities.

[xhebox]

Confirmed, It is same in my several tests. The behavior should be determined by libmysql linked to sysbench. Sysbench it self does not control this.

[djshow832]

HandshakeSecondTime also needs proxy protocol. This requires the authenticator to keep the real client address. You can do it in another PR.

[xhebox]

HandshakeSecondTime also needs proxy protocol. This requires the authenticator to keep the real client address. You can do it in another PR.

I agree. We have discussed too much on this PR.

[xhebox]

Looks like some tests failed, let me handle it.

[xhebox]

PSMultiresult tests are removed. Since proxy can not handle this and won't send this, it does not matter backend/frontend has this capability flag or not.