Skip to content

fix auth_switch_request handling #1200

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
methane merged 3 commits into from
Jan 29, 2025
+38 −3
Merged

fix auth_switch_request handling #1200

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
95ebbb3
fix auth_switch_request handling
methane Jan 29, 2025
b1aa823
update test
methane Jan 29, 2025
427ee2e
test
methane Jan 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .coveragerc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
branch = True
source =
pymysql
tests
omit = pymysql/tests/*
pymysql/tests/thirdparty/test_MySQLdb/*

Expand Down
8 changes: 6 additions & 2 deletions pymysql/_auth.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,8 @@ def sha256_password_auth(conn, pkt):

if pkt.is_auth_switch_request():
conn.salt = pkt.read_all()
if conn.salt.endswith(b"\0"):
conn.salt = conn.salt[:-1]
if not conn.server_public_key and conn.password:
# Request server public key
if DEBUG:
Expand Down Expand Up @@ -215,9 +217,11 @@ def caching_sha2_password_auth(conn, pkt):

if pkt.is_auth_switch_request():
# Try from fast auth
if DEBUG:
print("caching sha2: Trying fast path")
conn.salt = pkt.read_all()
if conn.salt.endswith(b"\0"): # str.removesuffix is available in 3.9
conn.salt = conn.salt[:-1]
if DEBUG:
print(f"caching sha2: Trying fast path. salt={conn.salt.hex()!r}")
scrambled = scramble_caching_sha2(conn.password, conn.salt)
pkt = _roundtrip(conn, scrambled)
# else: fast auth is tried in initial handshake
Expand Down
4 changes: 4 additions & 0 deletions pymysql/connections.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@
DEFAULT_USER = None

DEBUG = False
_DEFAULT_AUTH_PLUGIN = None # if this is not None, use it instead of server's default.

TEXT_TYPES = {
FIELD_TYPE.BIT,
Expand Down Expand Up @@ -1158,6 +1159,9 @@ def _get_server_information(self):
else:
self._auth_plugin_name = data[i:server_end].decode("utf-8")

if _DEFAULT_AUTH_PLUGIN is not None: # for tests
self._auth_plugin_name = _DEFAULT_AUTH_PLUGIN

def get_server_info(self):
return self.server_version

Expand Down
28 changes: 27 additions & 1 deletion tests/test_auth.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,19 @@ def test_caching_sha2_password():
con.query("FLUSH PRIVILEGES")
con.close()

# Fast path after auth_switch_request
pymysql.connections._DEFAULT_AUTH_PLUGIN = "mysql_native_password"
con = pymysql.connect(
user="user_caching_sha2",
password=pass_caching_sha2,
host=host,
port=port,
ssl=ssl,
)
con.query("FLUSH PRIVILEGES")
con.close()
pymysql.connections._DEFAULT_AUTH_PLUGIN = None


def test_caching_sha2_password_ssl():
con = pymysql.connect(
Expand All @@ -88,7 +101,20 @@ def test_caching_sha2_password_ssl():
password=pass_caching_sha2,
host=host,
port=port,
ssl=None,
ssl=ssl,
)
con.query("FLUSH PRIVILEGES")
con.close()

# Fast path after auth_switch_request
pymysql.connections._DEFAULT_AUTH_PLUGIN = "mysql_native_password"
con = pymysql.connect(
user="user_caching_sha2",
password=pass_caching_sha2,
host=host,
port=port,
ssl=ssl,
)
con.query("FLUSH PRIVILEGES")
con.close()
pymysql.connections._DEFAULT_AUTH_PLUGIN = None