8000 Support authentication switch request. Fixes #1396 · mysqljs/mysql@2ae97d5 · GitHub
[go: up one dir, main page]
Skip to content

Commit 2ae97d5

Browse files
bgraingerbgrainger
committed
Support authentication switch request. Fixes #1396
Rename UseOldPasswordPacket to AuthenticationMethodSwitchRequestPacket and implement its two other fields: plugin name & data. Support mysql_native_password and mysql_old_password as potential authentication methods (but still require 'insecureAuth:true' for the latter).
1 parent 5c60778 commit 2ae97d5

File tree

8 files changed

+126
-27
lines changed

8 files changed

+126
-27
lines changed

‎lib/protocol/Parser.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -217,6 +217,11 @@ Parser.prototype.parseLengthCodedBuffer = function() {
217217
return this.parseBuffer(length);
218218
};
219219

220+
Parser.prototype.parsePacketTerminatedBuffer = function() {
221+
var length = this._packetEnd - this._offset;
222+
return this.parseBuffer(length);
223+
};
224+
220225
Parser.prototype.parseLengthCodedNumber = function parseLengthCodedNumber() {
221226
if (this._offset >= this._buffer.length) {
222227
var err = new Error('Parser: read past end');

‎lib/protocol/packets/AuthenticationMethodSwitchRequestPacket.js

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
module.exports = AuthenticationMethodSwitchRequestPacket;
2+
function AuthenticationMethodSwitchRequestPacket(options) {
3+
options = options || {};
4+
5+
this.command = 0xfe;
6+
this.methodName = options.methodName || 'mysql_native_password';
7+
this.pluginData = options.pluginData;
8+
}
9+
10+
AuthenticationMethodSwitchRequestPacket.prototype.parse = function(parser) {
11+
this.command = parser.parseUnsignedNumber(1);
12+
this.methodName = parser.parseNullTerminatedString();
13+
this.pluginData = parser.parsePacketTerminatedBuffer();
14+
};
15+
16+
AuthenticationMethodSwitchRequestPacket.prototype.write = function(writer) {
17+
writer.writeUnsignedNumber(1, this.command);
18+
writer.writeNullTerminatedString(this.methodName);
19+
if (this.pluginData !== undefined) {
20+
writer.writeBuffer(this.pluginData);
21+
}
22+
};

‎lib/protocol/packets/AuthenticationSwitchResponsePacket.js

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
module.exports = AuthenticationSwitchResponsePacket;
2+
function AuthenticationSwitchResponsePacket(options) {
3+
options = options || {};
4+
5+
this.scrambleBuff = options.scrambleBuff;
6+
}
7+
8+
AuthenticationSwitchResponsePacket.prototype.parse = function(parser) {
9+
this.scrambleBuff = parser.parsePacketTerminatedBuffer();
10+
};
11+
12+
AuthenticationSwitchResponsePacket.prototype.write = function(writer) {
13+
writer.writeBuffer(this.scrambleBuff);
14+
};

‎lib/protocol/packets/UseOldPasswordPacket.js

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎lib/protocol/packets/index.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
exports.AuthenticationMethodSwitchRequestPacket = require('./AuthenticationMethodSwitchRequestPacket');
2+
exports.AuthenticationSwitchResponsePacket = require('./AuthenticationSwitchResponsePacket');
13
exports.ClientAuthenticationPacket = require('./ClientAuthenticationPacket');
24
exports.ComChangeUserPacket = require('./ComChangeUserPacket');
35
exports.ComPingPacket = require('./ComPingPacket');
@@ -17,4 +19,3 @@ exports.ResultSetHeaderPacket = require('./ResultSetHeaderPacket');
1719
exports.RowDataPacket = require('./RowDataPacket');
1820
exports.SSLRequestPacket = require('./SSLRequestPacket');
1921
exports.StatisticsPacket = require('./StatisticsPacket');
20-
exports.UseOldPasswordPacket = require('./UseOldPasswordPacket');

‎lib/protocol/sequences/Handshake.js

Lines changed: 34 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ Handshake.prototype.determinePacket = function(firstByte) {
2525
}
2626

2727
if (firstByte === 0xfe) {
28-
return Packets.UseOldPasswordPacket;
28+
return Packets.AuthenticationMethodSwitchRequestPacket;
2929
}
3030

3131
return undefined;
@@ -80,23 +80,46 @@ Handshake.prototype._sendCredentials = function() {
8080
}));
8181
};
8282

83-
Handshake.prototype['UseOldPasswordPacket'] = function() {
84-
if (!this._config.insecureAuth) {
83+
Handshake.prototype['AuthenticationMethodSwitchRequestPacket'] = function(packet) {
84+
if (packet.methodName === 'mysql_native_password') {
85+
// "auth plugin data" is documented as "string[EOF]", but MySQL Server will send a
86+
// null-terminated byte array for mysql_native_password; we only need to hash with
87+
// the first 20 bytes
88+
var challenge = packet.pluginData;
89+
if (challenge.length === 21) {
90+
challenge = challenge.slice(0, 20);
91+
}
92+
93+
this.emit('packet', new Packets.AuthenticationSwitchResponsePacket({
94+
scrambleBuff: Auth.token(this._config.password, challenge)
95+
}));
96+
} else if (packet.methodName === 'mysql_old_password') {
97+
if (!this._config.insecureAuth) {
98+
var err = new Error(
99+
'MySQL server is requesting the old and insecure pre-4.1 auth mechanism.' +
100+
'Upgrade the user password or use the {insecureAuth: true} option.'
101+
);
102+
103+
err.code = 'HANDSHAKE_INSECURE_AUTH';
104+
err.fatal = true;
105+
106+
this.end(err);
107+
return;
108+
}
109+
110+
this.emit('packet', new Packets.OldPasswordPacket({
111+
scrambleBuff: Auth.scramble323(this._handshakeInitializationPacket.scrambleBuff(), this._config.password)
112+
}));
113+
} else {
85114
var err = new Error(
86-
'MySQL server is requesting the old and insecure pre-4.1 auth mechanism.' +
87-
'Upgrade the user password or use the {insecureAuth: true} option.'
115+
'MySQL is requesting the ' + packet.methodName + ' authentication method, which is not supported.'
88116
);
89117

90-
err.code = 'HANDSHAKE_INSECURE_AUTH';
118+
err.code = 'UNSUPPORTED_AUTH_METHOD';
91119
err.fatal = true;
92120

93121
this.end(err);
94-
return;
95122
}
96-
97-
this.emit('packet', new Packets.OldPasswordPacket({
98-
scrambleBuff: Auth.scramble323(this._handshakeInitializationPacket.scrambleBuff(), this._config.password)
99-
}));
100123
};
101124

102125
Handshake.prototype['ErrorPacket'] = function(packet) {

‎test/FakeServer.js

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ function FakeConnection(socket) {
6464
this._handshakeInitializationPacket = null;
6565
this._clientAuthenticationPacket = null;
6666
this._oldPasswordPacket = null;
67+
this._authSwitchResponse = null;
6768
this._handshakeOptions = {};
6869

6970
socket.on('data', this._handleData.bind(this));
@@ -268,7 +269,9 @@ FakeConnection.prototype._parsePacket = function(header) {
268269
case Packets.ClientAuthenticationPacket:
269270
this._clientAuthenticationPacket = packet;
270271
if (this._handshakeOptions.oldPassword) {
271-
this._sendPacket(new Packets.UseOldPasswordPacket());
272+
this._sendPacket(new Packets.AuthenticationMethodSwitchRequestPacket({ methodName: 'mysql_old_password' }));
273+
} else if (this._handshakeOptions.forceAuthSwitch) {
274+
this._sendPacket(new Packets.AuthenticationMethodSwitchRequestPacket({ pluginData: Buffer.from('00112233445566778899AABBCCDDEEFF0102030400', 'hex') }));
272275
} else if (this._handshakeOptions.password === 'passwd') {
273276
var expected = Buffer.from('3DA0ADA7C9E1BB3A110575DF53306F9D2DE7FD09', 'hex');
274277
this._sendAuthResponse(packet, expected);
@@ -287,6 +290,13 @@ FakeConnection.prototype._parsePacket = function(header) {
287290

288291
var expected = Auth.scramble323(this._handshakeInitializationPacket.scrambleBuff(), this._handshakeOptions.password);
289292

293+
this._sendAuthResponse(packet, expected);
294+
break;
295+
case Packets.AuthenticationSwitchResponsePacket:
296+
this._authSwitchResponse = packet;
297+
298+
var expected = Auth.token(this._handshakeOptions.password, Buffer.from('00112233445566778899AABBCCDDEEFF01020304', 'hex'));
299+
290300
this._sendAuthResponse(packet, expected);
291301
break;
292302
case Packets.ComQueryPacket:
@@ -355,6 +365,10 @@ FakeConnection.prototype._determinePacket = function(header) {
355365
return Packets.OldPasswordPacket;
356366
}
357367

368+
if (this._handshakeOptions.forceAuthSwitch && !this._authSwitchResponse) {
369+
return Packets.AuthenticationSwitchResponsePacket;
370+
}
371+
358372
var firstByte = this._parser.peak();
359373
switch (firstByte) {
360374
case 0x01: return Packets.ComQuitPacket;

‎test/unit/connection/test-force-auth-switch.js

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
var common = require('../../common');
2+
var connection = common.createConnection({
3+
port : common.fakeServerPort,
4+
password : 'authswitch'
5+
});
6+
var assert = require('assert');
7+
8+
var server = common.createFakeServer();
9+
10+
var connected;
11+
server.listen(common.fakeServerPort, function(err) {
12+
if (err) throw err;
13+
14+
connection.connect(function(err, result) {
15+
if (err) throw err;
16+
17+
connected = result;
18+
19+
connection.destroy();
20+
server.destroy();
21+
});
22+
});
23+
24+
server.on('connection', function(incomingConnection) {
25+
incomingConnection.handshake({
26+
user : connection.config.user,
27+
password : connection.config.password,
28+
forceAuthSwitch : true
29+
});
30+
});
31+
32+
process.on('exit', function() {
33+
assert.equal(connected.fieldCount, 0);
34+
});

0 commit comments

Comments
 (0)
0