V2.x sha2pass draft3 #4258
Merged
V2.x sha2pass draft3 #4258
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1st commit for refactoring the authentication module
Previous commit (2nd refactoring of process_pkt_handshake_response) didn't compile with clickhouse
This branch has code where SHA1_ functions were still used.
New MySQL variable default_authentication_plugin accepting two possible values: * mysql_native_password * caching_sha2_password
Using `enum proxysql_auth_plugins` to define mysql authentication plugins. Also fixed few bugs introduced in previous commits.
Implementation not completed yet, but functional. It allows connections in which the user password is saved in clear password.
Now mysql_users.password can store the authentication_string as in MySQL's mysql.user table. Note: this commit also changes SALT_LEN_MAX in SHA-crypt code from 16 to 20 because MySQL caching_sha2_password uses 20 bytes salt
Extended account_details_t to also store clear_text_password if client provides it during a full authentication in caching_sha2_password . De facto, this implements the "caching" part of caching_sha2_password .
…type Because of the implementation of caching_sha2_password, values of switching_auth_type are shifted by 1
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
retest this please |
2 similar comments
|
retest this please |
|
retest this please |
Also added few FIXME to review part of the code
…ysql into v2.x_sha2pass_draft3
|
retest this please |
Modified generate_one_byte_pkt() to prefix the data with 1 byte. This is the "equivalent" of what MySQL performs in wrap_plguin_data_into_proper_command() , prefixing the data with a command
|
Retest this please |
During first 'caching_sha2_password' login, 'clear_text_password' is unknown until authentication is completed. Info previously fetched from 'MySQL_Authentication' should be amended with the received password.
Auth 'caching_sha2_password' imposses and async flow on several previously sync functions. This new async flow needs to take into account the potential allocations for 'MySQL_Session' attributes and client connection userinfo.
Improved observability for auth switch performed during authentication. The new field 'switching_auth_sent' is only updated when an actual auth switch requested to the client.
During an full 'caching_sha2_password' auth, it's possible that the pass has been updated in 'GloMyAuth'. If this possibility is not taking into account buffer over-read could take place and valid auth attempts denied.
Added test aims to check the correctness and completion of the currently supported authentication methods. In this initial version checks: - clear_text_pass - mysql_native_password - caching_sha2_password
- Changed several hardcoded variables in favor of env vars. - Adopted 'TAP_' convention for env vars. - Added new file 'test_auth_methods-t.env'.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.