Background — why proxies built with this SDK break

masahide/mysql8-audit-proxy#8

A common architecture for a MySQL audit / filter / router built on go-mysql looks like this:

[application] -- go-mysql/server  -->  [proxy]  -- go-mysql/client -->  [mysqld]

• Downstream side (go-mysql/server)
  Implements the old 5.7/8.0 protocol and does not recognise
  CLIENT_QUERY_ATTRIBUTES.
  When an application connects, the handshake therefore has the bit cleared.

• Upstream side (go-mysql/client ≥ v1.12.0)
  In writeAuthHandshake() the client automatically copies
  CLIENT_QUERY_ATTRIBUTES from the server greeting, claiming the proxy
  will send query attributes.

• Mismatch
  The proxy simply forwards the raw COM_QUERY it received from the
  application.
  Because the downstream never added the attributes section, the packet sent
  upstream is missing mandatory fields → MySQL returns
  ERROR 1835 (HY000) Malformed communication packet.

What the proxy author needs

A way to say “don’t advertise CLIENT_QUERY_ATTRIBUTES on the upstream
connection even if the server supports it, because my downstream side can’t
handle that mode.”

Currently that is impossible: UnsetCapability() removes the flag from
ccaps, but writeAuthHandshake() puts it back from the server’s flag set.

Patch overview

1. Add dcaps (“deny caps”) to client.Conn to track flags explicitly
   disabled by the caller.

2. Modify SetCapability / UnsetCapability:

   SetCapability(x): ccaps |= x ; dcaps &^= x
   UnsetCapability(x): ccaps &^= x ; dcaps |= x

3. In writeAuthHandshake():

   inherit := c.capability &^ c.dcaps          // server flags minus explicit denies
   // ...
   // Advertise QUERY_ATTRIBUTES only if:
   //   a) caller opted-in  OR
   //   b) server supports it AND caller did NOT opt-out

4. Store the final negotiated set back into c.capability for later use.

Resulting behaviour

Example — disabling the flag in a proxy

backend, _ := client.Connect(
    upstreamAddr, user, pass, db,
    func(c *client.Conn) error {
        c.UnsetCapability(mysql.CLIENT_QUERY_ATTRIBUTES)
        return nil
    },
)

With this one-liner the proxy once again works with both modern MySQL servers
and the existing go-mysql/server front end.

Safety & compatibility

• No API break – existing code compiles; only behaviour changes when the
  caller explicitly opts out.
• Maintains the convenient “auto-enable” path for direct clients.
• Restores plug-and-play compatibility for every proxy built on
  go-mysql/server.