feat(canary): mysql wire protocol (handshake + auth + ERR packets)
Phase 8 first commit. Pure encoding/decoding layer for the MySQL
wire protocol — no I/O orchestration, no DB lookups, no business
logic. Three primary functions plus utility helpers, all driven by
the byte-exact spec §9.7 lines 1363-1403:
- BuildHandshakeV10(connID, authData[20]) []byte
Server's initial greeting packet (0x0a protocol version,
"5.7.40-canary" server version, random auth-plugin-data split
into 8+12 byte parts, capability flags 0xf7ff / 0x81ff,
utf8mb4_unicode_ci charset, mysql_native_password plugin name).
Wraps in 3-byte LE length + 1-byte sequence ID (0x00).
- ReadClientAuth(r io.Reader) (*ClientAuth, error)
Parses HandshakeResponse41. Returns the username (null-terminated,
extracted starting at byte offset 32 after the 4+4+1+23-byte
fixed header) plus the client's capabilities, max packet size,
and charset for forensic richness. Defensive bounds checking
against ErrInvalidPayload / ErrUsernameMissing / ErrShortPacket /
ErrPacketTooLarge sentinels. 64KB max packet size cap.
- BuildAccessDeniedErr(username, sourceHost string) []byte
Standard MySQL ERR_Packet 1045 with SQL state "28000" and the
exact "Access denied for user '%s'@'%s' (using password: YES)"
message kubectl and the mysql client both display verbatim.
Sequence ID 0x02 (after handshake=0 and client auth=1).
Plus crypto/rand-backed helpers NewRandomAuthData (20 bytes for the
challenge) and NewRandomConnectionID (uint32). Consistent with the
crypto/rand discipline from Phase 0 supplement, Phase 5 (pdf), Phase 7
(envfile).
Tests (~24 cases): byte-exact assertions on packet headers, payload
layout, sequence IDs; round-trip Build/Read for 5 username variants;
error paths (short packet, missing username terminator, empty reader,
oversize packet rejected mid-stream); randomness distinctness (50
calls → near-50 unique values).
Handler + server land in next commit; generator + registry in the
one after. Trigger interface conformance for the mysql Generator will
be a sentinel-error no-op (mysql triggers over TCP, not HTTP — Phase
9 router doesn't mount any HTTP path to mysql.Trigger).
go test -race -timeout=60s ./internal/token/generators/mysql/...
passes, golangci-lint clean.
This commit is contained in:
CarterPerez-dev
parent
3d9b97da21
commit
712202abc0
|
|
@ -0,0 +1,220 @@
|
||||||
|
// ©AngelaMos | 2026
|
||||||
|
// protocol.go
|
||||||
|
|
||||||
|
package mysql
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/binary"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
packetHeaderSize = 4
|
||||||
|
protocolVersion = 0x0a
|
||||||
|
serverVersionString = "5.7.40-canary"
|
||||||
|
|
||||||
|
capabilityFlagsLower = uint16(0xf7ff)
|
||||||
|
capabilityFlagsUpper = uint16(0x81ff)
|
||||||
|
|
||||||
|
characterSetUtf8MB4 = 0x21
|
||||||
|
statusFlags = uint16(0x0002)
|
||||||
|
authPluginDataLen = byte(0x15)
|
||||||
|
|
||||||
|
authPluginName = "mysql_native_password"
|
||||||
|
|
||||||
|
errPacketHeader = 0xff
|
||||||
|
errCodeAccessDenied = uint16(1045)
|
||||||
|
sqlStateMarker = '#'
|
||||||
|
sqlStateAccessDenied = "28000"
|
||||||
|
|
||||||
|
seqIDServerHandshake byte = 0x00
|
||||||
|
seqIDServerErr byte = 0x02
|
||||||
|
|
||||||
|
maxPacketSize = 0x00ffffff
|
||||||
|
handshakeResponseMaxBytes = 64 * 1024
|
||||||
|
|
||||||
|
handshakeResponseFillerLen = 23
|
||||||
|
handshakeResponseHeaderBytes = 4 + 4 + 1 + handshakeResponseFillerLen
|
||||||
|
|
||||||
|
authPluginDataTotalLen = 20
|
||||||
|
authPluginDataPart1Len = 8
|
||||||
|
authPluginDataPart2Len = 12
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
ErrShortPacket = errors.New("mysql: short packet header")
|
||||||
|
ErrPacketTooLarge = errors.New("mysql: packet exceeds max size")
|
||||||
|
ErrInvalidPayload = errors.New("mysql: invalid payload structure")
|
||||||
|
ErrUsernameMissing = errors.New(
|
||||||
|
"mysql: username missing or unterminated",
|
||||||
|
)
|
||||||
|
ErrHTTPTriggerNotSupported = errors.New(
|
||||||
|
"mysql: Trigger via HTTP is not applicable (use the TCP listener)",
|
||||||
|
)
|
||||||
|
)
|
||||||
|
|
||||||
|
type ClientAuth struct {
|
||||||
|
Capabilities uint32
|
||||||
|
MaxPacketSize uint32
|
||||||
|
Charset uint8
|
||||||
|
Username string
|
||||||
|
}
|
||||||
|
|
||||||
|
func BuildHandshakeV10(
|
||||||
|
connID uint32,
|
||||||
|
authData [authPluginDataTotalLen]byte,
|
||||||
|
) ([]byte, error) {
|
||||||
|
var payload bytes.Buffer
|
||||||
|
payload.WriteByte(protocolVersion)
|
||||||
|
payload.WriteString(serverVersionString)
|
||||||
|
payload.WriteByte(0x00)
|
||||||
|
|
||||||
|
var connIDBytes [4]byte
|
||||||
|
binary.LittleEndian.PutUint32(connIDBytes[:], connID)
|
||||||
|
payload.Write(connIDBytes[:])
|
||||||
|
|
||||||
|
payload.Write(authData[:authPluginDataPart1Len])
|
||||||
|
payload.WriteByte(0x00)
|
||||||
|
|
||||||
|
var capLower [2]byte
|
||||||
|
binary.LittleEndian.PutUint16(capLower[:], capabilityFlagsLower)
|
||||||
|
payload.Write(capLower[:])
|
||||||
|
|
||||||
|
payload.WriteByte(characterSetUtf8MB4)
|
||||||
|
|
||||||
|
var statusBytes [2]byte
|
||||||
|
binary.LittleEndian.PutUint16(statusBytes[:], statusFlags)
|
||||||
|
payload.Write(statusBytes[:])
|
||||||
|
|
||||||
|
var capUpper [2]byte
|
||||||
|
binary.LittleEndian.PutUint16(capUpper[:], capabilityFlagsUpper)
|
||||||
|
payload.Write(capUpper[:])
|
||||||
|
|
||||||
|
payload.WriteByte(authPluginDataLen)
|
||||||
|
|
||||||
|
var reserved [10]byte
|
||||||
|
payload.Write(reserved[:])
|
||||||
|
|
||||||
|
payload.Write(authData[authPluginDataPart1Len:])
|
||||||
|
payload.WriteByte(0x00)
|
||||||
|
|
||||||
|
payload.WriteString(authPluginName)
|
||||||
|
payload.WriteByte(0x00)
|
||||||
|
|
||||||
|
return wrapPacket(payload.Bytes(), seqIDServerHandshake)
|
||||||
|
}
|
||||||
|
|
||||||
|
func ReadClientAuth(r io.Reader) (*ClientAuth, error) {
|
||||||
|
payload, err := readPacket(r)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
if len(payload) < handshakeResponseHeaderBytes+1 {
|
||||||
|
return nil, fmt.Errorf(
|
||||||
|
"%w: have %d bytes, need at least %d",
|
||||||
|
ErrInvalidPayload,
|
||||||
|
len(payload),
|
||||||
|
handshakeResponseHeaderBytes+1,
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
auth := &ClientAuth{
|
||||||
|
Capabilities: binary.LittleEndian.Uint32(payload[0:4]),
|
||||||
|
MaxPacketSize: binary.LittleEndian.Uint32(payload[4:8]),
|
||||||
|
Charset: payload[8],
|
||||||
|
}
|
||||||
|
|
||||||
|
usernameStart := handshakeResponseHeaderBytes
|
||||||
|
rel := bytes.IndexByte(payload[usernameStart:], 0x00)
|
||||||
|
if rel < 0 {
|
||||||
|
return nil, ErrUsernameMissing
|
||||||
|
}
|
||||||
|
auth.Username = string(payload[usernameStart : usernameStart+rel])
|
||||||
|
return auth, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func BuildAccessDeniedErr(username, sourceHost string) ([]byte, error) {
|
||||||
|
msg := fmt.Sprintf(
|
||||||
|
`Access denied for user '%s'@'%s' (using password: YES)`,
|
||||||
|
username,
|
||||||
|
sourceHost,
|
||||||
|
)
|
||||||
|
|
||||||
|
var payload bytes.Buffer
|
||||||
|
payload.WriteByte(errPacketHeader)
|
||||||
|
|
||||||
|
var code [2]byte
|
||||||
|
binary.LittleEndian.PutUint16(code[:], errCodeAccessDenied)
|
||||||
|
payload.Write(code[:])
|
||||||
|
|
||||||
|
payload.WriteByte(sqlStateMarker)
|
||||||
|
payload.WriteString(sqlStateAccessDenied)
|
||||||
|
payload.WriteString(msg)
|
||||||
|
|
||||||
|
return wrapPacket(payload.Bytes(), seqIDServerErr)
|
||||||
|
}
|
||||||
|
|
||||||
|
func wrapPacket(payload []byte, seqID byte) ([]byte, error) {
|
||||||
|
if len(payload) > maxPacketSize {
|
||||||
|
return nil, fmt.Errorf(
|
||||||
|
"%w: payload %d > max %d",
|
||||||
|
ErrPacketTooLarge,
|
||||||
|
len(payload),
|
||||||
|
maxPacketSize,
|
||||||
|
)
|
||||||
|
}
|
||||||
|
out := make([]byte, packetHeaderSize+len(payload))
|
||||||
|
n := len(payload)
|
||||||
|
out[0] = byte(n & 0xff)
|
||||||
|
out[1] = byte((n >> 8) & 0xff)
|
||||||
|
out[2] = byte((n >> 16) & 0xff)
|
||||||
|
out[3] = seqID
|
||||||
|
copy(out[packetHeaderSize:], payload)
|
||||||
|
return out, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func readPacket(r io.Reader) ([]byte, error) {
|
||||||
|
var hdr [packetHeaderSize]byte
|
||||||
|
if _, err := io.ReadFull(r, hdr[:]); err != nil {
|
||||||
|
return nil, fmt.Errorf("%w: %w", ErrShortPacket, err)
|
||||||
|
}
|
||||||
|
payloadLen := uint32(hdr[0]) |
|
||||||
|
uint32(hdr[1])<<8 |
|
||||||
|
uint32(hdr[2])<<16
|
||||||
|
if payloadLen > handshakeResponseMaxBytes {
|
||||||
|
return nil, fmt.Errorf(
|
||||||
|
"%w: payload %d > limit %d",
|
||||||
|
ErrPacketTooLarge,
|
||||||
|
payloadLen,
|
||||||
|
handshakeResponseMaxBytes,
|
||||||
|
)
|
||||||
|
}
|
||||||
|
if payloadLen == 0 {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
payload := make([]byte, payloadLen)
|
||||||
|
if _, err := io.ReadFull(r, payload); err != nil {
|
||||||
|
return nil, fmt.Errorf("mysql: read payload: %w", err)
|
||||||
|
}
|
||||||
|
return payload, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewRandomAuthData() ([authPluginDataTotalLen]byte, error) {
|
||||||
|
var data [authPluginDataTotalLen]byte
|
||||||
|
if _, err := rand.Read(data[:]); err != nil {
|
||||||
|
return data, fmt.Errorf("mysql: random auth data: %w", err)
|
||||||
|
}
|
||||||
|
return data, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewRandomConnectionID() (uint32, error) {
|
||||||
|
var b [4]byte
|
||||||
|
if _, err := rand.Read(b[:]); err != nil {
|
||||||
|
return 0, fmt.Errorf("mysql: random connection id: %w", err)
|
||||||
|
}
|
||||||
|
return binary.LittleEndian.Uint32(b[:]), nil
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,329 @@
|
||||||
|
// ©AngelaMos | 2026
|
||||||
|
// protocol_test.go
|
||||||
|
|
||||||
|
package mysql_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"encoding/binary"
|
||||||
|
"io"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/stretchr/testify/require"
|
||||||
|
|
||||||
|
"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/mysql"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
packetHeaderSize = 4
|
||||||
|
expectedProtoVersion = 0x0a
|
||||||
|
expectedCharset = 0x21
|
||||||
|
)
|
||||||
|
|
||||||
|
func buildHandshakeResponse41(t *testing.T, username string) []byte {
|
||||||
|
t.Helper()
|
||||||
|
var payload bytes.Buffer
|
||||||
|
|
||||||
|
var caps [4]byte
|
||||||
|
binary.LittleEndian.PutUint32(caps[:], 0x0001a285)
|
||||||
|
payload.Write(caps[:])
|
||||||
|
|
||||||
|
var maxPkt [4]byte
|
||||||
|
binary.LittleEndian.PutUint32(maxPkt[:], 0x01000000)
|
||||||
|
payload.Write(maxPkt[:])
|
||||||
|
|
||||||
|
payload.WriteByte(expectedCharset)
|
||||||
|
|
||||||
|
var filler [23]byte
|
||||||
|
payload.Write(filler[:])
|
||||||
|
|
||||||
|
payload.WriteString(username)
|
||||||
|
payload.WriteByte(0x00)
|
||||||
|
|
||||||
|
body := payload.Bytes()
|
||||||
|
out := make([]byte, packetHeaderSize+len(body))
|
||||||
|
n := len(body)
|
||||||
|
out[0] = byte(n & 0xff)
|
||||||
|
out[1] = byte((n >> 8) & 0xff)
|
||||||
|
out[2] = byte((n >> 16) & 0xff)
|
||||||
|
out[3] = 0x01
|
||||||
|
copy(out[packetHeaderSize:], body)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestBuildHandshakeV10_HasCorrectPacketHeader(t *testing.T) {
|
||||||
|
auth := [20]byte{
|
||||||
|
1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
|
||||||
|
11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
|
||||||
|
}
|
||||||
|
pkt, err := mysql.BuildHandshakeV10(0xdeadbeef, auth)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Greater(t, len(pkt), packetHeaderSize)
|
||||||
|
|
||||||
|
payloadLen := int(pkt[0]) |
|
||||||
|
int(pkt[1])<<8 |
|
||||||
|
int(pkt[2])<<16
|
||||||
|
require.Equal(t, len(pkt)-packetHeaderSize, payloadLen)
|
||||||
|
require.Equal(t, byte(0x00), pkt[3], "server handshake sequence ID is 0")
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestBuildHandshakeV10_PayloadStartsWithProtocolVersion(t *testing.T) {
|
||||||
|
var auth [20]byte
|
||||||
|
pkt, err := mysql.BuildHandshakeV10(0x1234, auth)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Equal(t, byte(expectedProtoVersion), pkt[packetHeaderSize])
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestBuildHandshakeV10_ContainsServerVersionString(t *testing.T) {
|
||||||
|
var auth [20]byte
|
||||||
|
pkt, err := mysql.BuildHandshakeV10(0x1234, auth)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Contains(
|
||||||
|
t,
|
||||||
|
string(pkt),
|
||||||
|
"5.7.40-canary",
|
||||||
|
"handshake must advertise the canary-server version string for verisimilitude",
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestBuildHandshakeV10_AdvertisesMySQLNativePassword(t *testing.T) {
|
||||||
|
var auth [20]byte
|
||||||
|
pkt, err := mysql.BuildHandshakeV10(0x1234, auth)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Contains(t, string(pkt), "mysql_native_password")
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestBuildHandshakeV10_EmbedsConnectionIDLittleEndian(t *testing.T) {
|
||||||
|
var auth [20]byte
|
||||||
|
connID := uint32(0xdeadbeef)
|
||||||
|
pkt, err := mysql.BuildHandshakeV10(connID, auth)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
versionEnd := bytes.IndexByte(
|
||||||
|
pkt[packetHeaderSize+1:],
|
||||||
|
0x00,
|
||||||
|
) + packetHeaderSize + 1
|
||||||
|
require.Greater(t, versionEnd, packetHeaderSize+1)
|
||||||
|
connIDStart := versionEnd + 1
|
||||||
|
got := binary.LittleEndian.Uint32(pkt[connIDStart : connIDStart+4])
|
||||||
|
require.Equal(t, connID, got)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestBuildHandshakeV10_EmbedsAuthDataInTwoParts(t *testing.T) {
|
||||||
|
auth := [20]byte{
|
||||||
|
10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
|
||||||
|
20, 21, 22, 23, 24, 25, 26, 27, 28, 29,
|
||||||
|
}
|
||||||
|
pkt, err := mysql.BuildHandshakeV10(0xcafef00d, auth)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Contains(
|
||||||
|
t,
|
||||||
|
string(pkt),
|
||||||
|
string(auth[:8]),
|
||||||
|
"first 8 bytes of auth data must appear in handshake",
|
||||||
|
)
|
||||||
|
require.Contains(
|
||||||
|
t,
|
||||||
|
string(pkt),
|
||||||
|
string(auth[8:]),
|
||||||
|
"last 12 bytes of auth data must appear in handshake (after part-1 + filler + caps + ...)",
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestReadClientAuth_ExtractsUsername(t *testing.T) {
|
||||||
|
pkt := buildHandshakeResponse41(t, "canary_abc123def456")
|
||||||
|
auth, err := mysql.ReadClientAuth(bytes.NewReader(pkt))
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.NotNil(t, auth)
|
||||||
|
require.Equal(t, "canary_abc123def456", auth.Username)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestReadClientAuth_CapturesCapabilities(t *testing.T) {
|
||||||
|
pkt := buildHandshakeResponse41(t, "anyone")
|
||||||
|
auth, err := mysql.ReadClientAuth(bytes.NewReader(pkt))
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Equal(t, uint32(0x0001a285), auth.Capabilities)
|
||||||
|
require.Equal(t, uint32(0x01000000), auth.MaxPacketSize)
|
||||||
|
require.Equal(t, uint8(expectedCharset), auth.Charset)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestReadClientAuth_EmptyUsernameStillParses(t *testing.T) {
|
||||||
|
pkt := buildHandshakeResponse41(t, "")
|
||||||
|
auth, err := mysql.ReadClientAuth(bytes.NewReader(pkt))
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Empty(t, auth.Username)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestReadClientAuth_ShortPayloadReturnsError(t *testing.T) {
|
||||||
|
short := make([]byte, packetHeaderSize+5)
|
||||||
|
short[0] = 0x05
|
||||||
|
_, err := mysql.ReadClientAuth(bytes.NewReader(short))
|
||||||
|
require.Error(t, err)
|
||||||
|
require.ErrorIs(t, err, mysql.ErrInvalidPayload)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestReadClientAuth_NoUsernameTerminatorReturnsError(t *testing.T) {
|
||||||
|
var payload bytes.Buffer
|
||||||
|
var caps [4]byte
|
||||||
|
payload.Write(caps[:])
|
||||||
|
var maxPkt [4]byte
|
||||||
|
payload.Write(maxPkt[:])
|
||||||
|
payload.WriteByte(expectedCharset)
|
||||||
|
var filler [23]byte
|
||||||
|
payload.Write(filler[:])
|
||||||
|
payload.WriteString("nocan_terminator_here_no_null")
|
||||||
|
body := payload.Bytes()
|
||||||
|
|
||||||
|
out := make([]byte, packetHeaderSize+len(body))
|
||||||
|
n := len(body)
|
||||||
|
out[0] = byte(n & 0xff)
|
||||||
|
out[1] = byte((n >> 8) & 0xff)
|
||||||
|
out[2] = byte((n >> 16) & 0xff)
|
||||||
|
out[3] = 0x01
|
||||||
|
copy(out[packetHeaderSize:], body)
|
||||||
|
|
||||||
|
_, err := mysql.ReadClientAuth(bytes.NewReader(out))
|
||||||
|
require.Error(t, err)
|
||||||
|
require.ErrorIs(t, err, mysql.ErrUsernameMissing)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestReadClientAuth_EmptyReaderReturnsShortPacket(t *testing.T) {
|
||||||
|
_, err := mysql.ReadClientAuth(bytes.NewReader(nil))
|
||||||
|
require.Error(t, err)
|
||||||
|
require.ErrorIs(t, err, mysql.ErrShortPacket)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestReadClientAuth_OversizePacketRejected(t *testing.T) {
|
||||||
|
var hdr [packetHeaderSize]byte
|
||||||
|
hdr[0] = 0x01
|
||||||
|
hdr[1] = 0x00
|
||||||
|
hdr[2] = 0x10
|
||||||
|
hdr[3] = 0x01
|
||||||
|
|
||||||
|
r := io.MultiReader(
|
||||||
|
bytes.NewReader(hdr[:]),
|
||||||
|
strings.NewReader(strings.Repeat("X", 70000)),
|
||||||
|
)
|
||||||
|
_, err := mysql.ReadClientAuth(r)
|
||||||
|
require.Error(t, err)
|
||||||
|
require.ErrorIs(t, err, mysql.ErrPacketTooLarge)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestBuildAccessDeniedErr_HasCorrectMarkerAndCode(t *testing.T) {
|
||||||
|
pkt, err := mysql.BuildAccessDeniedErr("canary_xyz", "203.0.113.50")
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Greater(t, len(pkt), packetHeaderSize)
|
||||||
|
|
||||||
|
require.Equal(
|
||||||
|
t,
|
||||||
|
byte(0xff),
|
||||||
|
pkt[packetHeaderSize],
|
||||||
|
"ERR packet header byte",
|
||||||
|
)
|
||||||
|
code := binary.LittleEndian.Uint16(
|
||||||
|
pkt[packetHeaderSize+1 : packetHeaderSize+3],
|
||||||
|
)
|
||||||
|
require.Equal(
|
||||||
|
t,
|
||||||
|
uint16(1045),
|
||||||
|
code,
|
||||||
|
"MySQL error code 1045 (access denied)",
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestBuildAccessDeniedErr_HasSQLStateMarkerAnd28000(t *testing.T) {
|
||||||
|
pkt, err := mysql.BuildAccessDeniedErr("canary_xyz", "203.0.113.50")
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Equal(
|
||||||
|
t,
|
||||||
|
byte('#'),
|
||||||
|
pkt[packetHeaderSize+3],
|
||||||
|
"SQL state marker must be '#'",
|
||||||
|
)
|
||||||
|
require.Equal(
|
||||||
|
t,
|
||||||
|
"28000",
|
||||||
|
string(pkt[packetHeaderSize+4:packetHeaderSize+9]),
|
||||||
|
"SQL state 28000 (invalid authorization)",
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestBuildAccessDeniedErr_MessageContainsUserAndHost(t *testing.T) {
|
||||||
|
pkt, err := mysql.BuildAccessDeniedErr("canary_abc", "203.0.113.7")
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Contains(
|
||||||
|
t,
|
||||||
|
string(pkt),
|
||||||
|
`Access denied for user 'canary_abc'@'203.0.113.7' (using password: YES)`,
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestBuildAccessDeniedErr_SequenceIDIs2(t *testing.T) {
|
||||||
|
pkt, err := mysql.BuildAccessDeniedErr("u", "h")
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Equal(
|
||||||
|
t,
|
||||||
|
byte(0x02),
|
||||||
|
pkt[3],
|
||||||
|
"ERR packet sequence ID is 2 (after handshake=0 and client auth=1)",
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestRoundTrip_BuildAndParseUsername(t *testing.T) {
|
||||||
|
cases := []string{
|
||||||
|
"canary_abcdef0123",
|
||||||
|
"canary_xyz",
|
||||||
|
"root",
|
||||||
|
"",
|
||||||
|
"app_user",
|
||||||
|
}
|
||||||
|
for _, name := range cases {
|
||||||
|
name := name
|
||||||
|
t.Run("username="+name, func(t *testing.T) {
|
||||||
|
pkt := buildHandshakeResponse41(t, name)
|
||||||
|
auth, err := mysql.ReadClientAuth(bytes.NewReader(pkt))
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Equal(t, name, auth.Username)
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNewRandomAuthData_ReturnsTwentyBytes(t *testing.T) {
|
||||||
|
d, err := mysql.NewRandomAuthData()
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Len(t, d, 20)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNewRandomAuthData_DistinctCallsProduceDistinctOutputs(t *testing.T) {
|
||||||
|
seen := make(map[[20]byte]struct{})
|
||||||
|
for range 50 {
|
||||||
|
d, err := mysql.NewRandomAuthData()
|
||||||
|
require.NoError(t, err)
|
||||||
|
seen[d] = struct{}{}
|
||||||
|
}
|
||||||
|
require.Greater(
|
||||||
|
t,
|
||||||
|
len(seen),
|
||||||
|
45,
|
||||||
|
"50 calls to NewRandomAuthData should produce near-50 unique values",
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNewRandomConnectionID_DistinctCallsProduceDistinctOutputs(
|
||||||
|
t *testing.T,
|
||||||
|
) {
|
||||||
|
seen := make(map[uint32]struct{})
|
||||||
|
for range 50 {
|
||||||
|
id, err := mysql.NewRandomConnectionID()
|
||||||
|
require.NoError(t, err)
|
||||||
|
seen[id] = struct{}{}
|
||||||
|
}
|
||||||
|
require.Greater(t, len(seen), 45)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestErrors_AreDistinctSentinels(t *testing.T) {
|
||||||
|
require.NotErrorIs(t, mysql.ErrShortPacket, mysql.ErrPacketTooLarge)
|
||||||
|
require.NotErrorIs(t, mysql.ErrPacketTooLarge, mysql.ErrInvalidPayload)
|
||||||
|
require.NotErrorIs(t, mysql.ErrInvalidPayload, mysql.ErrUsernameMissing)
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue