Uploaded image for project: 'MariaDB Connector/J'
  1. MariaDB Connector/J
  2. CONJ-394

Wrong salt used when calculating scramble after authentication switch

Details

    Description

      https://dev.mysql.com/doc/internals/en/connection-phase-packets.html#packet-Protocol::AuthSwitchRequest

      The last zero byte should not be included in the salt when re-calculating the scramble responding to auth switch request.

      Check attached before.png (current code, 0x00 included) and after.png (after fix, 0x00 excluded).

      I have created a PR to fix this, please help to verify and review.
      https://github.com/MariaDB/mariadb-connector-j/pull/93

      Attachments

        1. after.PNG
          after.PNG
          30 kB
        2. before.PNG
          before.PNG
          32 kB

        Activity

          Ascending order - Click to sort in descending order
          diego dupin Diego Dupin added a comment -

          I agree that implementation doesn't correspond to documentation.
          Each authentication data remove this additional byte afterward.
          Better to remove it when setting the data variable, like documentation https://mariadb.com/kb/en/mariadb/1-connecting-connecting/#authentication-switch-request describe it.
          (https://dev.mysql.com/doc/internals/en/connection-phase-packets.html#packet-Protocol::AuthSwitchRequest is wrong describing this as string[EOF])

          diego dupin Diego Dupin added a comment - I agree that implementation doesn't correspond to documentation. Each authentication data remove this additional byte afterward. Better to remove it when setting the data variable, like documentation https://mariadb.com/kb/en/mariadb/1-connecting-connecting/#authentication-switch-request describe it. ( https://dev.mysql.com/doc/internals/en/connection-phase-packets.html#packet-Protocol::AuthSwitchRequest is wrong describing this as string [EOF] )
          diego dupin Diego Dupin added a comment -

          After some verification, i was wrong : this data depend on plugins implementation. : auth_pam really use all data : there is no null terminated byte.
          Documentation is updated to use byte[EOF].

          Additional documentation for each plugins would be great, but that's actually not done.

          Did you face any issue or is this problem only related to documentation ?

          diego dupin Diego Dupin added a comment - After some verification, i was wrong : this data depend on plugins implementation. : auth_pam really use all data : there is no null terminated byte. Documentation is updated to use byte [EOF] . Additional documentation for each plugins would be great, but that's actually not done. Did you face any issue or is this problem only related to documentation ?
          xiangyhu xiangyhu added a comment -

          Hey Diego,

          This is an issue we faced when we asks client to switch to mysql_native_password while the client fails to absorb the correct salt. It's kind of a blocker here

          xiangyhu xiangyhu added a comment - Hey Diego, This is an issue we faced when we asks client to switch to mysql_native_password while the client fails to absorb the correct salt. It's kind of a blocker here
          diego dupin Diego Dupin added a comment -

          correction done by commit : https://github.com/MariaDB/mariadb-connector-j/commit/c29464331ec1d84fd9cb0926207373e8f42b9985
          will be in 1.5.6 (release this week)

          diego dupin Diego Dupin added a comment - correction done by commit : https://github.com/MariaDB/mariadb-connector-j/commit/c29464331ec1d84fd9cb0926207373e8f42b9985 will be in 1.5.6 (release this week)
          diego dupin Diego Dupin added a comment -

          documentation improved to describe authentication plugins format : https://mariadb.com/kb/en/mariadb/1-connecting-connecting/

          diego dupin Diego Dupin added a comment - documentation improved to describe authentication plugins format : https://mariadb.com/kb/en/mariadb/1-connecting-connecting/

          People

            diego dupin Diego Dupin
            xiangyhu xiangyhu
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.