Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(v8) Do not parse MySQL server packets #9411

Merged
merged 1 commit into from
Dec 15, 2021
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Do not parse MySQL server packets
r0mant committed Dec 15, 2021

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
commit a70d016949ee62930b4c4a4d1228cd72f997178d
20 changes: 20 additions & 0 deletions lib/srv/db/access_test.go
Original file line number Diff line number Diff line change
@@ -337,6 +337,26 @@ func TestAccessMySQLChangeUser(t *testing.T) {
require.Error(t, err)
}

// TestAccessMySQLServerPacket verifies some edge-cases related to reading
// wire packets sent by the MySQL server.
func TestAccessMySQLServerPacket(t *testing.T) {
ctx := context.Background()
testCtx := setupTestContext(ctx, t, withSelfHostedMySQL("mysql"))
go testCtx.startHandlingConnections()

// Create user/role with access permissions.
testCtx.createUserAndRole(ctx, t, "alice", "admin", []string{"alice"}, []string{types.Wildcard})

// Connect to the database as this user.
mysqlConn, err := testCtx.mysqlClient("alice", "mysql", "alice")
require.NoError(t, err)

// Execute "show tables" command which will make the test server to reply
// in a way that previously would cause our packet parsing logic to fail.
_, err = mysqlConn.Execute("show tables")
require.NoError(t, err)
}

// TestAccessMongoDB verifies access scenarios to a MongoDB database based
// on the configured RBAC rules.
func TestAccessMongoDB(t *testing.T) {
4 changes: 2 additions & 2 deletions lib/srv/db/mysql/engine.go
Original file line number Diff line number Diff line change
@@ -281,7 +281,7 @@ func (e *Engine) receiveFromServer(serverConn, clientConn net.Conn, serverErrCh
close(serverErrCh)
}()
for {
packet, err := protocol.ParsePacket(serverConn)
packet, _, err := protocol.ReadPacket(serverConn)
if err != nil {
if utils.IsOKNetworkError(err) {
log.Debug("Server connection closed.")
@@ -291,7 +291,7 @@ func (e *Engine) receiveFromServer(serverConn, clientConn net.Conn, serverErrCh
serverErrCh <- err
return
}
_, err = protocol.WritePacket(packet.Bytes(), clientConn)
_, err = protocol.WritePacket(packet, clientConn)
if err != nil {
log.WithError(err).Error("Failed to write client packet.")
serverErrCh <- err
18 changes: 18 additions & 0 deletions lib/srv/db/mysql/test.go
Original file line number Diff line number Diff line change
@@ -198,6 +198,24 @@ type testHandler struct {
func (h *testHandler) HandleQuery(query string) (*mysql.Result, error) {
h.log.Debugf("Received query %q.", query)
atomic.AddUint32(&h.queryCount, 1)
// When getting a "show tables" query, construct the response in a way
// which previously caused server packets parsing logic to fail.
if query == "show tables" {
resultSet, err := mysql.BuildSimpleTextResultset(
[]string{"Tables_in_test"},
[][]interface{}{
// In raw bytes, this table name starts with 0x11 which used to
// cause server packet parsing issues since it clashed with
// COM_CHANGE_USER packet type.
{"metadata_md_table"},
})
if err != nil {
return nil, trace.Wrap(err)
}
return &mysql.Result{
Resultset: resultSet,
}, nil
}
return TestQueryResponse, nil
}