Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 20:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add support for parsing the "caching_sha2_password" auth plugin

Browse source
This commit is contained in:
Fupeng Zhao 2024-06-30 15:59:13 +08:00 • committed by Arne Welzel
parent 6527850487
commit 9cb618c718
6 changed files with 192 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

23
testing/btest/Baseline/scripts.base.protocols.mysql.caching_sha2_password/mysql.log Normal file
View file

@ -0,0 +1,23 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path mysql
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p cmd arg success rows response
#types time string addr port addr port string string bool count string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 56494 127.0.0.1 3306 login root F - Got an error reading communication packets
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 49352 127.0.0.1 3306 login root T 0 -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 49352 127.0.0.1 3306 query \x00\x01show databases T 0 -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 49352 127.0.0.1 3306 query \x00\x01show tables T 0 -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 49352 127.0.0.1 3306 field_list t T 0 -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 49352 127.0.0.1 3306 query \x00\x01select @@version_comment limit 1 T 0 -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 49352 127.0.0.1 3306 quit (empty) - - -
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 127.0.0.1 40950 127.0.0.1 3306 login root T 0 -
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 127.0.0.1 40950 127.0.0.1 3306 query \x00\x01show databases T 0 -
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 127.0.0.1 40950 127.0.0.1 3306 query \x00\x01show tables T 0 -
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 127.0.0.1 40950 127.0.0.1 3306 field_list t T 0 -
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 127.0.0.1 40950 127.0.0.1 3306 query \x00\x01select @@version_comment limit 1 T 0 -
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 127.0.0.1 40950 127.0.0.1 3306 quit (empty) - - -
#close XXXX-XX-XX-XX-XX-XX

39
testing/btest/Baseline/scripts.base.protocols.mysql.caching_sha2_password/out Normal file
View file

@ -0,0 +1,39 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
mysql handshake, root
mysql error, 1158, Got an error reading communication packets
mysql handshake, root
mysql ok, 0
mysql request, 3, \x00\x01show databases
mysql result row, [information_schema]
mysql result row, [mysql]
mysql result row, [performance_schema]
mysql result row, [sys]
mysql result row, [test]
mysql ok, 0
mysql request, 3, \x00\x01show tables
mysql result row, [t]
mysql ok, 0
mysql request, 4, t\x00
mysql ok, 0
mysql request, 3, \x00\x01select @@version_comment limit 1
mysql result row, [MySQL Community Server - GPL]
mysql ok, 0
mysql request, 1,
mysql handshake, root
mysql ok, 0
mysql request, 3, \x00\x01show databases
mysql result row, [information_schema]
mysql result row, [mysql]
mysql result row, [performance_schema]
mysql result row, [sys]
mysql result row, [test]
mysql ok, 0
mysql request, 3, \x00\x01show tables
mysql result row, [t]
mysql ok, 0
mysql request, 4, t\x00
mysql ok, 0
mysql request, 3, \x00\x01select @@version_comment limit 1
mysql result row, [MySQL Community Server - GPL]
mysql ok, 0
mysql request, 1,

BIN
testing/btest/Traces/mysql/caching_sha2_password.trace Normal file
View file

Binary file not shown.

35
testing/btest/scripts/base/protocols/mysql/caching_sha2_password.test Normal file
View file

@ -0,0 +1,35 @@
# @TEST-EXEC: zeek -b -C -r $TRACES/mysql/caching_sha2_password.trace %INPUT >out
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: btest-diff mysql.log
@load base/protocols/mysql
event mysql_ok(c: connection, affected_rows: count)
{
print "mysql ok", affected_rows;
}
event mysql_eof(c: connection, is_intermediate: bool)
{
print "mysql eof", is_intermediate;
}
event mysql_result_row(c: connection, row: string_vec)
{
print "mysql result row", row;
}
event mysql_error(c: connection, code: count, msg: string)
{
print "mysql error", code, msg;
}
event mysql_command_request(c: connection, command: count, arg: string)
{
print "mysql request", command, arg;
}
event mysql_handshake(c: connection, username: string)
{
print "mysql handshake", username;
}