Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

mysql: Implement and test COM_CHANGE_USER

Browse source 
This reworks the parser such that COM_CHANGE_USER switches the
connection back into the CONNECTION_PHASE so that we can remove the
EXPECT_AUTH_SWITCH special case in the COMMAND_PHASE. Adds two pcaps
produced with Python that actually do COM_CHANGE_USER as it seems
not possible from the MySQL CLI.
This commit is contained in:
Arne Welzel 2024-08-13 17:29:36 +02:00
parent a4c79e7304
commit 02f4665e9b
12 changed files with 275 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/base/protocols/mysql/main.zeek
View file

@ -84,6 +84,11 @@ event mysql_command_request(c: connection, command: count, arg: string) &priorit
Conn::register_removal_hook(c, finalize_mysql);
}
event mysql_change_user(c: connection, username: string) &priority=5
{
c$mysql$arg = username;
}
event mysql_command_request(c: connection, command: count, arg: string) &priority=-5
{
if ( c?$mysql && c$mysql?$cmd && c$mysql$cmd == "quit" )