PBS-33: support caching_sha2_password RSA full auth in minimysql - #160
Open
kamil-holubicki wants to merge 2 commits into
Open
PBS-33: support caching_sha2_password RSA full auth in minimysql#160kamil-holubicki wants to merge 2 commits into
kamil-holubicki wants to merge 2 commits into
Conversation
https://perconadev.atlassian.net/browse/PBS-32 Implement AuthSwitchRequest handling when the client replies with an authentication plugin that differs from the server account plugin. The server now sends the switch request, reads the client auth switch response, updates the connection context, and continues normal authentication. Format the auth switch plugin data through a helper so caching_sha2_password keeps the historical trailing NULL filler expected by MySQL clients, while leaving future plugins free to define their own payload shape.
https://perconadev.atlassian.net/browse/PBS-33 Added: Encapsulate caching_sha2_password in caching_sha2_password_authenticator (scramble verify, AuthSwitch data, 0x03/0x04, PEM, RSA decrypt, cleartext stub for future TLS). Auth loop in network_service stays auth-method agnostic: optional AuthSwitch on plugin mismatch, then begin_authentication / outbound frames / client frames until done. Fast auth when the handshake scramble matches the configured password; otherwise full auth (0x04) with RSA on plain TCP (0x02 + PEM or ciphertext via --server-public-key-path). Wire AuthMoreData (0x01 || plugin data) for 0x03, 0x04, and PEM, matching Percona Server/MySql mpvio wrapping. Thread server_rsa_public/private_key_path from minimysql_app through network_service -> connection_context -> authenticator (empty = embedded defaults; one-sided config fails hard). Random 20-byte greeting salt; unit tests for fast path, RSA path, and key path validation. How this differs from Percona Server/MySql: No SHA2 digest cache: every successful scramble is treated as a cache hit, including the first connection. PS does full auth (RSA on plain TCP / cleartext on SSL) on cache miss, then caches for later fast auth. No TLS yet: connection_is_secure() is always false; cleartext-after-0x04 is stubbed only. PS accepts cleartext password over SSL/socket after 0x04. Single configured user/password and optional key paths (or embedded MTR keys), not ACL / auto-generated server RSA keys from config.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://perconadev.atlassian.net/browse/PBS-33
Added:
Encapsulate caching_sha2_password in caching_sha2_password_authenticator
(scramble verify, AuthSwitch data, 0x03/0x04, PEM, RSA decrypt,
cleartext stub for future TLS).
Auth loop in network_service stays auth-method agnostic: optional
AuthSwitch on plugin mismatch, then
begin_authentication / outbound frames / client frames until done.
Fast auth when the handshake scramble matches the configured password;
otherwise full auth (0x04) with RSA on plain TCP (0x02 + PEM or
ciphertext via --server-public-key-path).
Wire AuthMoreData (0x01 || plugin data) for 0x03, 0x04, and PEM,
matching Percona Server/MySql mpvio wrapping.
Thread server_rsa_public/private_key_path from minimysql_app through
network_service -> connection_context -> authenticator (empty = embedded
defaults; one-sided config fails hard).
Random 20-byte greeting salt; unit tests for fast path, RSA path, and
key path validation.
How this differs from Percona Server/MySql:
No SHA2 digest cache: every successful scramble is treated as a cache
hit, including the first connection. PS does full auth
(RSA on plain TCP / cleartext on SSL) on cache miss, then caches for
later fast auth.
No TLS yet: connection_is_secure() is always false; cleartext-after-0x04
is stubbed only. PS accepts cleartext password over SSL/socket after
0x04.
Single configured user/password and optional key paths (or embedded MTR
keys), not ACL / auto-generated server RSA keys from config.