OneDB v3.4.0

Release Date: July 2026
Release Type: Feature Release
Branch: 3.4.0

Overview

OneDB v3.4.0 significantly expands IBM Db2 support across the OneDB platform.

This release introduces the Db2 Listener, secure Db2 client connections, Query Audit, Query Whitelist enforcement, result-set masking, and Db2 support in the Migration module.

OneDB v3.4.0 also introduces responsive navigation for tablet and mobile displays.

What’s New

Db2 Listener

OneDB now supports IBM Db2 client connections through the OneDB Listener using the DRDA protocol.

The Db2 Listener supports:

  • IBM Data Server Driver for JDBC and SQLJ.
  • Direct, prepared, and parameterized SQL statements.
  • Database metadata requests.
  • Transaction commit and rollback.
  • Client reconnection and concurrent sessions.
  • Listener start, stop, reload, and restart recovery.
  • Isolated session management between Listeners.

Each client session maintains isolated protocol and execution state. Stopping or restarting one Listener does not affect sessions connected through another Listener.

Malformed, incomplete, or unsupported Db2 protocol messages are handled safely without logging credentials, authentication payloads, security tokens, or raw protocol content.

Db2 Listener Transport

Db2 clients can connect to OneDB using plaintext or TLS.

TLS is terminated by OneDB before Query Audit, Query Whitelist, and result-set masking are performed.

Important: Db2 Listener backend connections support plaintext transport only in this release. A Db2 Connection configured with Secure Connection cannot be assigned to a Db2 Listener.

This limitation does not affect Db2 backend TLS used by Test Connection, Database Browser, Certificate Profiles, or other JDBC-based modules.

Secure Db2 Client Connections

Db2 Listeners now support secure IBM JCC client connections using the existing OneDB Listener Secure Connection configuration and shared PKCS12 keystore.

Secure connections support:

  • TLS-protected authentication and SQL traffic.
  • Direct and prepared statements.
  • Query Audit.
  • Query Whitelist enforcement and protection bypass.
  • Result-set masking.
  • Client reconnection and concurrent sessions.
  • Listener and backend restart recovery.
  • TLS 1.3.

OneDB rejects plaintext clients connecting to secure Db2 Listeners and TLS clients connecting to plaintext Db2 Listeners.

TLS errors are sanitized, and active sessions are safely closed when a TLS handshake fails, the backend disconnects, or the Listener is stopped.

Db2 Query Audit

Query Audit now supports SQL activity passing through the Db2 Listener.

OneDB can capture:

  • SELECT, INSERT, UPDATE, and DELETE statements.
  • Direct and prepared-statement executions.
  • Repeated prepared-statement executions.
  • Commit and rollback operations.
  • Invalid SQL and nonexistent-object requests.
  • Schema-qualified statements and quoted identifiers.
  • SQL comments and supported Unicode SQL content.

Prepared-statement templates are recorded without storing or logging parameter values.

Authentication, handshake, package-binding, driver-internal, and protocol-only traffic are excluded from Query Audit.

Audit records may include the database type, Connection, database username, client address, schema, table, SQL statement, and query type.

Db2 Query Whitelist

Query Whitelist now supports Db2 Connections.

Administrators can create, edit, enable, disable, and delete Db2 whitelist entries using the existing Query Whitelist interface.

Matching supports:

  • Direct and prepared SQL.
  • Normalized capitalization and whitespace.
  • SQL comments and trailing semicolons.
  • String literals, numeric literals, and parameter markers.
  • Optional client-address and database-username restrictions.
  • Wildcard restrictions.

Enforcement Behavior

  • When no active whitelist entry exists, SQL is processed normally.
  • When one or more active whitelist entries exist, matching SQL is allowed.
  • When one or more active whitelist entries exist, unmatched SQL is blocked.
  • Commit and rollback operations are exempt.
  • Matching entries may bypass result-set protection.

Blocked executions return a sanitized policy error.

Both allowed and blocked executions remain available in Query Audit where sufficient SQL information is available.

Prepared-statement matching uses the SQL template without inspecting, storing, or logging parameter values.

Db2 Result-Set Masking

OneDB can now apply Field Settings protection to supported Db2 query results passing through the Db2 Listener.

OneDB uses Db2 result metadata to identify the database, schema, table, base column, data type, length, character encoding, and column origin before applying the configured protection.

The initial implementation supports validated Db2 VARCHAR and CHAR representations.

VARCHAR Protection

Supported VARCHAR protection includes:

  • UTF-8 values.
  • Preservation of NULL and empty-string values.
  • Multiple rows and fetch blocks.
  • Multiple active result sets.
  • Query Whitelist protection bypass.
  • Safe protocol-length recalculation.

CHAR Protection

Supported CHAR protection includes:

  • Fixed-width CHAR values.
  • Preservation of trailing spaces.
  • Preservation of NULL and all-space values.
  • Original field-width preservation.
  • Protection without truncation or silent resizing.

A protected CHAR value must fit safely within its original meaningful byte length.

If the value cannot be transformed safely, OneDB returns the original result object unchanged.

Structural Pass-Through Types

OneDB can structurally process supported mixed result sets containing:

  • INTEGER.
  • DECIMAL.
  • DATE.
  • VARCHAR.
  • CHAR.
  • Supported opaque binary fields.

Binary values, including supported RID_BIT results, are preserved unchanged and are not masking-eligible.

Result transformation is atomic. Unsupported encodings, layouts, data representations, or unsafe transformed values cause the affected result object to pass through unchanged.

Query Whitelist Protection Bypass

When a Db2 query matches a Query Whitelist entry configured to bypass protection, OneDB returns the original unprotected result.

Whitelist bypass state is maintained independently for each result set and client session.

Db2 Migration

The OneDB Migration module now supports Db2 as both a source and target database.

Supported migration directions include:

  • Supported relational database to Db2.
  • Db2 to a supported relational database.
  • Db2 to Db2.

Db2 Migration supports:

  • Schema, table, column, primary-key, nullable, precision, scale, identity, and generated-column discovery.
  • Migration preview and compatibility validation.
  • Exact, compatible, potentially lossy, and unsupported mapping classifications.
  • Quoted and mixed-case identifiers.
  • Reserved words and spaces in object names.
  • Bounded batch execution.
  • Numeric, character, Boolean, temporal, binary, and NULL values.
  • Unicode CHAR and VARCHAR values.
  • Exact DECIMAL and NUMERIC validation.
  • Identity and generated-column handling.
  • Migration cancellation.
  • Full transaction rollback.

The target transaction is committed only after the entire migration completes successfully.

Failures such as duplicate keys, invalid values, conversion errors, oversized values, later-batch failures, or cancellation trigger a complete rollback to prevent partial target data.

Migration mappings are revalidated before queuing and again before execution to prevent stale or manipulated configurations from being processed.

Migration Limitations

The initial Db2 Migration implementation does not automatically support:

  • Schema creation.
  • Table creation.
  • Target-table drop or replacement.
  • Lossy data conversions.
  • CLOB migration.
  • BLOB migration.
  • Mixed relational-to-MongoDB migration.
  • Mixed MongoDB-to-relational migration.

Required schemas and target tables must be prepared before starting the migration.

Responsive Sidebar

OneDB now provides responsive sidebar navigation for tablet and mobile layouts.

The responsive sidebar includes:

  • An off-canvas navigation drawer.
  • Hamburger-menu toggle.
  • Page backdrop.
  • Escape-key handling.
  • Automatic closing after navigation.
  • Body scroll locking.
  • Accessibility-related visibility and focus behavior.

The existing desktop sidebar behavior remains unchanged.

Security and Reliability Improvements

OneDB v3.4.0 also includes:

  • Isolated protocol and execution state for each Db2 session.
  • Isolated Query Whitelist and result-set state.
  • Cross-listener session isolation.
  • Automatic cleanup during disconnect, reload, restart, or deletion.
  • Sanitized Db2 protocol, TLS, whitelist, and migration errors.
  • Protection against logging credentials, parameter values, authentication payloads, security tokens, raw DRDA packets, or TLS ciphertext.
  • Atomic fail-open handling for unsupported result-set representations.
  • Full rollback for failed or cancelled migrations.
  • Regression protection for existing PostgreSQL, MySQL, Oracle, SQL Server, and MongoDB Listeners.

Compatibility

OneDB v3.4.0 maintains compatibility with existing OneDB Listener implementations for:

  • PostgreSQL.
  • MySQL.
  • Oracle Database.
  • Microsoft SQL Server.
  • MongoDB.

Existing Db2 functionality also remains supported, including:

  • Db2 backend Connections.
  • Db2 backend TLS.
  • Db2 Certificate Profiles.
  • Db2 Database Browser.
  • Db2 Field Settings.
  • Db2 Connection Test.
  • Db2 metadata discovery.

Validation

OneDB v3.4.0 was validated for:

  • Db2 authentication and connectivity.
  • Direct, prepared, and parameterized SQL.
  • INSERT, UPDATE, and DELETE operations.
  • Database metadata retrieval.
  • Transaction commit and rollback.
  • Invalid SQL and nonexistent-object handling.
  • Client reconnection and concurrent sessions.
  • Listener and backend restart recovery.
  • Query Audit.
  • Query Whitelist matching and blocking.
  • Client-address and database-username restrictions.
  • Query Whitelist protection bypass.
  • VARCHAR and CHAR result-set masking.
  • Binary result pass-through.
  • Multiple result types and fetch sizes.
  • Plaintext and secure Db2 client connections.
  • TLS 1.3.
  • Db2-to-Db2 migration.
  • PostgreSQL-to-Db2 migration.
  • Db2-to-PostgreSQL migration.
  • Empty, single-row, and multi-batch migrations.
  • NULL, empty-string, UTF-8, numeric, and temporal values.
  • Identity-column handling.
  • Duplicate-key and oversized-value rollback.
  • Migration cancellation without partial target rows.
  • Responsive sidebar behavior on tablet and mobile-style layouts.

Known Limitations

  • Db2 Listener backend TLS is not supported in v3.4.0.
  • Secure Db2 client traffic terminates at OneDB and is forwarded to a plaintext Db2 backend.
  • A Db2 Connection configured with Secure Connection cannot be assigned to a Db2 Listener.
  • Db2 result-set masking is limited to validated Db2 protocol representations.
  • Unsupported result layouts, encodings, or data representations are returned unchanged.
  • Binary result fields are not masking-eligible.
  • CHAR values are returned unchanged when the protected value cannot safely fit within the original field width.
  • Automatic Db2 schema creation, table creation, drop, replace, CLOB, BLOB, and lossy Migration operations are not supported.
  • Mixed relational-to-MongoDB and MongoDB-to-relational migrations are not included.

Summary

OneDB v3.4.0 introduces:

  • Db2 Listener and DRDA support.
  • Plaintext and secure Db2 client connections.
  • Db2 Query Audit.
  • Db2 Query Whitelist enforcement.
  • Db2 VARCHAR and CHAR result-set masking.
  • Query Whitelist protection bypass.
  • Db2 Migration support.
  • Responsive tablet and mobile navigation.

These enhancements allow organizations to monitor, control, protect, securely route, and migrate supported IBM Db2 workloads through OneDB.