-
Harin Vadodaria authored
WITH AUTH_SOCK PLUGIN USER Description: On client side, if server's default plugin is different than that of client, client discards packet containing scramble information. This means that if server has default plugin caching_sha2_password and client has default plugin mysql_native_password, and if client is trying to connect to server using a user with plugin C (in this case auth_socket), following will happen: 1. Client will discard scramble data 2. Client will call native_password's client side authentication plugin 3. In client_mpvio_read_packet, client will send user details to server and wait for scramble 4. Server, having received user details, goes on to process client reply and finds that there are 3 plugins involved. It then triggers a RESTART of authentication on server side without sending anything to client. As a part of restart, server uses user's actual plugin (auth_socket) and calls authenticate API for the same. 5. auth_socket plugin, having received user details and connection info, performs verification and sends OK/ERROR. 6. On client side, since client expects random data of length 20 from server, native plugin's authentication API will report error upon receing OK/ERROR. 7. run_plugin_auth() won't find expected reply (because OK/ERROR was already read) and exit with error. Solution: In run_plugin_auth(), there is a check for auth-switch packet. Fix is to extend it to cover OK packet too. (cherry picked from commit b5840b451966469f4b527ba062147897750258cf)
Harin Vadodaria authoredWITH AUTH_SOCK PLUGIN USER Description: On client side, if server's default plugin is different than that of client, client discards packet containing scramble information. This means that if server has default plugin caching_sha2_password and client has default plugin mysql_native_password, and if client is trying to connect to server using a user with plugin C (in this case auth_socket), following will happen: 1. Client will discard scramble data 2. Client will call native_password's client side authentication plugin 3. In client_mpvio_read_packet, client will send user details to server and wait for scramble 4. Server, having received user details, goes on to process client reply and finds that there are 3 plugins involved. It then triggers a RESTART of authentication on server side without sending anything to client. As a part of restart, server uses user's actual plugin (auth_socket) and calls authenticate API for the same. 5. auth_socket plugin, having received user details and connection info, performs verification and sends OK/ERROR. 6. On client side, since client expects random data of length 20 from server, native plugin's authentication API will report error upon receing OK/ERROR. 7. run_plugin_auth() won't find expected reply (because OK/ERROR was already read) and exit with error. Solution: In run_plugin_auth(), there is a check for auth-switch packet. Fix is to extend it to cover OK packet too. (cherry picked from commit b5840b451966469f4b527ba062147897750258cf)
Loading