Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

mysql: Add mysql_auth_plugin, mysql_auth_more_data and mysql_auth_switch_request events

Browse source 
Remove caching_sha2_password parsing/state from the analyzer and implement
the generic events. If we actually want to peak into the authentication
mechanism, we could write a separate analyzer for it. For now, treat it
as opaque values that are exposed to script land.

The added tests show the --get-server-public-key in use where
mysql_auth_more_data contains an RSA public key.
This commit is contained in:
Arne Welzel 2024-07-05 10:24:40 +02:00
parent 8a92945b06
commit 40f1c2cb6d
7 changed files with 151 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

5
testing/btest/Baseline/scripts.base.protocols.mysql.caching_sha2_password-after-auth-switch/out
View file

@ -1,5 +1,10 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
mysql auth plugin, F, caching_sha2_password, Vz\x08w+^\x04p\x02Tv\x01"~\x114\x14RP6\x00, 21
mysql handshake, root
mysql auth plugin, T, mysql_native_password, , 0
mysql auth switch request, caching_sha2_password, Vz\x08w+^\x04p\x02Tv\x01"~\x114\x14RP6\x00, 21
mysql auth more data, T, \xf7dS\x9eXe\xc4\xd6\xa9\xa7 \xfbC\xa6p\xaf\xdf\x9dB[B\x80\xa7\x80\xef\x0c\x95BC9#\x82, 32
mysql auth more data, F, \x03, 1
mysql ok, 0
mysql request, 3, select @@version_comment limit 1
mysql result row, [MySQL Community Server - GPL]