Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

MySQL: Fix endianness, introduce mysql_eof() event

Browse source 
We were parsing MySQL using bigendian even though the protocol is
specified as with "least significant byte first" [1]. This is most
problematic when parsing length encoded strings with 2 byte length
fields...

Further, I think, the EOF_Packet parsing was borked, either due to
testing the CLIENT_DEPRECATE_EOF with the wrong endianness, or due to
the workaround in Resultset processing raising mysql_ok(). Introduce a
new mysql_eof() that triggers for EOF_Packet's and remove the fake
mysql_ok() Resultset invocation to fix. Adapt the mysql script and tests
to account for the new event.

This is a quite backwards incompatible change on the event level, but
due to being quite buggy in general, doubt this matters to many.

I think there is more buried, but this fixes the violation of the simple
"SHOW ENGINE INNODB STATUS" and the existing tests continue to
succeed...

[1] https://dev.mysql.com/doc/dev/mysql-server/latest/page_protocol_basic_dt_integers.html
This commit is contained in:
Arne Welzel 2023-01-24 09:35:27 +01:00
parent 1772a1bd6d
commit 672602dae7
10 changed files with 144 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

19
scripts/base/protocols/mysql/main.zeek
View file

@ -112,6 +112,25 @@ event mysql_error(c: connection, code: count, msg: string) &priority=-5
}
}
event mysql_eof(c: connection, is_intermediate: bool) &priority=-5
{
if ( is_intermediate )
return;
if ( c?$mysql )
{
# We don't have more information, so just
# place what mysql_ok() would've done.
if ( ! c$mysql?$success )
c$mysql$success = T;
if ( ! c$mysql?$rows )
c$mysql$rows = 0;
Log::write(mysql::LOG, c$mysql);
delete c$mysql;
}
}
event mysql_ok(c: connection, affected_rows: count) &priority=5
{
if ( c?$mysql )