Repository navigation
Conversation
…ccounts using passwords longer than 19 characters https://dev.mysql.com/doc/dev/mysql-server/latest/page_caching_sha2_authentication_exchanges.html tells us that the nonce used in this authentication method is 20 bytes long. However, we might receive additional scramble data in php_mysqlnd_greet_read not used in this method. On my test setup, I received 21 bytes (20 bytes + '\0'). This resulted in the xor computation to incorrectly include the NUL byte. Every password of at least 20 characters therefore failed to authenticate using this method. Looking at mysql-server source code also seems to reveal that it always uses a fixed number of scramble bytes [1]. [1] https://github.com/mysql/mysql-server/blob/ea7087d885006918ad54458e7aad215b1650312c/sql/auth/sha2_password.cc#L1078-L1079
kamil-tekiela
left a comment
kamil-tekiela
left a comment
There was a problem hiding this comment.
This is the right solution, but please add a test for it. You can add it in mysqli or PDO_mysql. You can copy the /ext/mysqli/tests/mysqli_pam_sha256_public_key_ini.phpt test or similar, but with >20 char long password.
|
I think I got it. So sorry again, but I think I misled you and myself by pointing at a very weird test that is either completely nonsense or tests some obscure feature. Anyway, I trimmed it down to the actual bug fix and now the test works. You can verify with your fix it is green, and without is red. Hopefully CI agrees. |
|
Alright, thanks for taking care of the test. |
kamil-tekiela
left a comment
kamil-tekiela
left a comment
There was a problem hiding this comment.
Nice! You can merge it.
https://dev.mysql.com/doc/dev/mysql-server/latest/page_caching_sha2_authentication_exchanges.html tells us that the nonce used in this authentication method is 20 bytes long. However, we might receive additional scramble data in php_mysqlnd_greet_read not used in this method.
On my test setup, I received 21 bytes (20 bytes + '\0'). This resulted in the xor computation to incorrectly include the NUL byte. Every password of at least 20 characters therefore failed to authenticate using this method.
Looking at mysql-server source code also seems to reveal that it always uses a fixed number of scramble bytes [1].
[1] https://github.com/mysql/mysql-server/blob/ea7087d885006918ad54458e7aad215b1650312c/sql/auth/sha2_password.cc#L1078-L1079
I'm a mysqlnd noob, so someone should triple check this please.