Skip to content

*: add txn protocol version declaration - #1534

Merged
ti-chi-bot[bot] merged 1 commit into
pingcap:masterfrom
zyguan:dev/txn-rpc-protection
Sep 18, 2026
Merged

ti-chi-bot[bot] merged 1 commit into
pingcap:masterfrom
zyguan:dev/txn-rpc-protection

Conversation

@zyguan

@zyguan zyguan commented Sep 15, 2026 •

Copy link
Copy Markdown
Contributor

Issue Number: close #1535

Introduce a protocol version registry and the request declaration that lets a client tell the server which transaction protocol semantics it implements, so that requests from callers which cannot handle a feature can be rejected consistently instead of being served with best effort.

  • kvrpcpb: add the TxnProtocolVersion enum and Context.txn_protocol_version (tag 39). Version numbers accumulate monotonically: 0 is legacy, 1 means the client handles the structured incompatibility error, and 2 covers the shared lock protocol. A missing field and an explicit 0 both mean legacy. Also extend RequestOrigin with TiCDC, BR and TiFlash and document that the origin is client-provided auditing metadata, not an authorization decision.
  • errorpb: add IncompatibleRequest (reason, message, provided/min/max compatible version) and Error.incompatible_request (tag 23). The bounds are inclusive and the two error fields stay independent message fields. A rejection of a request that declared no version also sets ServerIsBusy.reason to the fixed "txn_protocol_incompatible" fallback for legacy clients; a declared non-zero version gets no fallback.
  • metapb: add TxnProtocolVersionRange and Store.txn_protocol_version_range (tag 14). The message field keeps its presence so that an absent range stays distinguishable from an explicit [0, 0].

Summary by CodeRabbit

Summary by CodeRabbit

  • New Features
    • Added structured error details for requests using unsupported transaction protocol versions, including compatible version ranges and diagnostics.
    • Added transaction protocol version metadata to requests and stores for compatibility negotiation.
    • Added request-origin identifiers for TiCDC, BR, and TiFlash auditing.
    • Added transaction protocol metadata for shared-lock support.
  • Documentation
    • Clarified request-origin auditing behavior and compatibility requirements.
    • Documented legacy fallback handling when no transaction protocol version is provided.

@ti-chi-bot ti-chi-bot Bot added do-not-merge/needs-linked-issue size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Sep 15, 2026
@coderabbitai

coderabbitai Bot commented Sep 15, 2026 •

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 73332cc1-e50b-4782-9b44-ff245ea844f1

📥 Commits

Reviewing files that changed from the base of the PR and between 9865138 and a933797.

⛔ Files ignored due to path filters (3)
  • pkg/errorpb/errorpb.pb.go is excluded by !**/*.pb.go
  • pkg/kvrpcpb/kvrpcpb.pb.go is excluded by !**/*.pb.go
  • pkg/metapb/metapb.pb.go is excluded by !**/*.pb.go
📒 Files selected for processing (3)
  • proto/errorpb.proto
  • proto/kvrpcpb.proto
  • proto/metapb.proto

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The protobuf contracts add transaction protocol declarations, structured incompatibility errors, store compatibility ranges, request-origin values, and shared-lock compatibility requirements.

Changes

Transaction protocol compatibility

Layer / File(s) Summary
Protocol version and incompatibility contracts
proto/kvrpcpb.proto, proto/errorpb.proto
Defines transaction protocol versions and adds Error.incompatible_request with version, range, reason, and diagnostic fields. Documents the legacy busy fallback.
Request metadata and shared-lock declarations
proto/kvrpcpb.proto
Adds TiCDC, BR, and TiFlash origins. Documents audit handling and protocol requirements for shared-lock wrappers.
Store compatibility range contract
proto/metapb.proto
Adds an inclusive transaction protocol range to Store, including absent, empty, and malformed-range semantics.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Context
  participant Store
  participant Error
  Client->>Context: Set txn_protocol_version
  Context->>Store: Send transaction request
  Store->>Error: Return IncompatibleRequest for unsupported version
  Error-->>Client: Provide compatible version range
Loading

Suggested reviewers: disksing

Merge Risk: ⚪ Minimal · up to a9337

The transaction compatibility wire contracts and generated artifacts are consistent, with no actionable merge risk identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Linked Issues check ❓ Inconclusive The proto summaries support the core #1535 requirements: versions 0, 1, and 2; Context.txn_protocol_version = 39; TiCDC, BR, and TiFlash origins; structured IncompatibleRequest; the version-0 `Ser… Provide reviewable evidence for the proto.lock update and regenerated Go bindings, or make the affected generated files reviewable.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title identifies the main change: adding transaction protocol version declarations. It is concise and related to the protobuf changes, although the leading asterisk is unnecessary.
Out of Scope Changes check ✅ Passed The reported changes are limited to the wire-contract definitions in #1535, related documentation, and generated-binding scope. They do not claim admission enforcement, PD range management, client dec…
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Full details: Linked Issues check

Explanation

The proto summaries support the core #1535 requirements: versions 0, 1, and 2; Context.txn_protocol_version = 39; TiCDC, BR, and TiFlash origins; structured IncompatibleRequest; the version-0 ServerIsBusy fallback; and TxnProtocolVersionRange with absent-versus-[0, 0] presence semantics. The summary does not establish the required proto.lock update. The generated Go bindings are excluded from review, so their regeneration cannot be verified.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the version gate,
And finds the ranges clear and straight.
New origins hop into the trail,
While structured errors tell the tale.
Shared locks wait for matching ears,
And legacy paths keep their gears.

Comment @coderabbitai help to get the list of available commands.

Introduce a protocol version registry and the request declaration that
lets a client tell the server which transaction protocol semantics it
implements, so that requests from callers which cannot handle a feature
can be rejected consistently instead of being served with best effort.

- kvrpcpb: add the TxnProtocolVersion enum and Context.txn_protocol_version
  (tag 39). Version numbers accumulate monotonically: 0 is legacy, 1 means
  the client handles the structured incompatibility error, and 2 covers the
  shared lock protocol. A missing field and an explicit 0 both mean legacy.
  Also extend RequestOrigin with TiCDC, BR and TiFlash and document that the
  origin is client-provided auditing metadata, not an authorization decision.
- errorpb: add IncompatibleRequest (reason, message, provided/min/max
  compatible version) and Error.incompatible_request (tag 23). The bounds are
  inclusive and the two error fields stay independent message fields. A
  rejection of a request that declared no version also sets
  ServerIsBusy.reason to the fixed "txn_protocol_incompatible" fallback for
  legacy clients; a declared non-zero version gets no fallback.
- metapb: add TxnProtocolVersionRange and Store.txn_protocol_version_range
  (tag 14). The message field keeps its presence so that an absent range
  stays distinguishable from an explicit [0, 0].

Signed-off-by: zyguan <zhongyangguan@gmail.com>

@cfzjywxk cfzjywxk left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ti-chi-bot ti-chi-bot Bot added the needs-1-more-lgtm Indicates a PR needs 1 more LGTM. label Sep 16, 2026
Comment thread proto/errorpb.proto
enum IncompatibleRequestReason {
IncompatibleRequestReasonUnknown = 0;
// The declared version is outside the compatible range returned in the error.
IncompatibleRequestReasonTxnProtocolVersionOutOfRange = 1;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Better to rename IncompatibleRequestReasonUnsupportedTxnProtocolVersion ?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I slightly prefer TxnProtocolVersionOutOfRange here.

UnsupportedTxnProtocolVersion sounds like the protocol version itself is statically unsupported by the server, while compatibility here is contextual. The compatible range can be derived from the store's admission range, or narrowed by a feature-specific check. As a result, requests declaring the same version may be accepted in one case but rejected with [min, max] in another.

OutOfRange describes the actual rejection condition more precisely: the provided version is outside the compatible range returned with this particular error, without implying that the version is unsupported in general.

It also seems consistent with the current wire contract, which explicitly models compatibility as an inclusive [min, max] range.

@ti-chi-bot ti-chi-bot Bot added lgtm and removed needs-1-more-lgtm Indicates a PR needs 1 more LGTM. labels Sep 17, 2026
@ti-chi-bot

ti-chi-bot Bot commented Sep 17, 2026

Copy link
Copy Markdown

[LGTM Timeline notifier]

Timeline:

  • 2026-09-16 08:12:39.061681981 +0000 UTC m=+192804.999339585: ☑️ agreed by cfzjywxk.
  • 2026-09-17 03:34:35.299127592 +0000 UTC m=+262521.236785176: ☑️ agreed by lcwangchao.

@ti-chi-bot

ti-chi-bot Bot commented Sep 18, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cfzjywxk, hbisheng, lcwangchao, overvenus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ti-chi-bot ti-chi-bot Bot added the approved label Sep 18, 2026
@ti-chi-bot
ti-chi-bot Bot merged commit d80b6c5 into pingcap:master Sep 18, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved lgtm size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

kvproto: register txn protocol version and request declaration

5 participants