Skip to content

Updating auth interfaces to pass connection #443

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fulghum merged 1 commit into from
Nov 7, 2025
Merged

Updating auth interfaces to pass connection #443

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 8 additions & 9 deletions go/mysql/auth_server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,6 @@ import (
"crypto/sha1"
"crypto/sha256"
"crypto/subtle"
"crypto/x509"
"encoding/hex"
"net"
"strings"
Expand Down Expand Up @@ -132,7 +131,7 @@ const (
// such a hash based on the salt and auth response provided here after retrieving
// the hashed password from the storage.
type HashStorage interface {
UserEntryWithHash(userCerts []*x509.Certificate, salt []byte, user string, authResponse []byte, remoteAddr net.Addr) (Getter, error)
UserEntryWithHash(conn *Conn, salt []byte, user string, authResponse []byte, remoteAddr net.Addr) (Getter, error)
}

// PlainTextStorage describes an object that is suitable to retrieve user information
Expand All @@ -146,7 +145,7 @@ type HashStorage interface {
// When comparing plain text passwords directly, please ensure to use `subtle.ConstantTimeCompare`
// to prevent timing based attacks on the password.
type PlainTextStorage interface {
UserEntryWithPassword(userCerts []*x509.Certificate, user string, password string, remoteAddr net.Addr) (Getter, error)
UserEntryWithPassword(conn *Conn, user string, password string, remoteAddr net.Addr) (Getter, error)
}

// CachingStorage describes an object that is suitable to retrieve user information
Expand All @@ -159,7 +158,7 @@ type PlainTextStorage interface {
// such a hash based on the salt and auth response provided here after retrieving
// the hashed password from the cache.
type CachingStorage interface {
UserEntryWithCacheHash(userCerts []*x509.Certificate, salt []byte, user string, authResponse []byte, remoteAddr net.Addr) (Getter, CacheState, error)
UserEntryWithCacheHash(conn *Conn, salt []byte, user string, authResponse []byte, remoteAddr net.Addr) (Getter, CacheState, error)
}

// NewMysqlNativeAuthMethod will create a new AuthMethod that implements the
Expand Down Expand Up @@ -507,7 +506,7 @@ func (n *mysqlNativePasswordAuthMethod) HandleAuthPluginData(conn *Conn, user st
return nil, NewSQLError(ERAccessDeniedError, SSAccessDeniedError, "Access denied for user '%v'", user)
}
salt := serverAuthPluginData[:len(serverAuthPluginData)-1]
return n.storage.UserEntryWithHash(conn.GetTLSClientCerts(), salt, user, clientAuthPluginData, remoteAddr)
return n.storage.UserEntryWithHash(conn, salt, user, clientAuthPluginData, remoteAddr)
}

type mysqlClearAuthMethod struct {
Expand All @@ -532,7 +531,7 @@ func (n *mysqlClearAuthMethod) HandleAuthPluginData(conn *Conn, user string, ser
if len(clientAuthPluginData) > 0 {
password = string(clientAuthPluginData[:len(clientAuthPluginData)-1])
}
return n.storage.UserEntryWithPassword(conn.GetTLSClientCerts(), user, password, remoteAddr)
return n.storage.UserEntryWithPassword(conn, user, password, remoteAddr)
}

type mysqlDialogAuthMethod struct {
Expand All @@ -557,7 +556,7 @@ func (n *mysqlDialogAuthMethod) AuthPluginData() ([]byte, error) {
return result, nil
}
func (n *mysqlDialogAuthMethod) HandleAuthPluginData(conn *Conn, user string, serverAuthPluginData []byte, clientAuthPluginData []byte, remoteAddr net.Addr) (Getter, error) {
return n.storage.UserEntryWithPassword(conn.GetTLSClientCerts(), user, string(clientAuthPluginData[:len(clientAuthPluginData)-1]), remoteAddr)
return n.storage.UserEntryWithPassword(conn, user, string(clientAuthPluginData[:len(clientAuthPluginData)-1]), remoteAddr)
}

type mysqlCachingSha2AuthMethod struct {
Expand Down Expand Up @@ -594,7 +593,7 @@ func (n *mysqlCachingSha2AuthMethod) HandleAuthPluginData(c *Conn, user string,
return nil, NewSQLError(ERAccessDeniedError, SSAccessDeniedError, "Access denied for user '%v'", user)
}
salt := serverAuthPluginData[:len(serverAuthPluginData)-1]
result, cacheState, err := n.cache.UserEntryWithCacheHash(c.GetTLSClientCerts(), salt, user, clientAuthPluginData, remoteAddr)
result, cacheState, err := n.cache.UserEntryWithCacheHash(c, salt, user, clientAuthPluginData, remoteAddr)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -638,7 +637,7 @@ func (n *mysqlCachingSha2AuthMethod) HandleAuthPluginData(c *Conn, user string,
if err != nil {
return nil, err
}
return n.storage.UserEntryWithPassword(c.GetTLSClientCerts(), user, password, remoteAddr)
return n.storage.UserEntryWithPassword(c, user, password, remoteAddr)
}

// ScrambleMysqlNativePassword computes the hash of the password using 4.1+ method.
Expand Down
4 changes: 2 additions & 2 deletions go/mysql/auth_server_clientcert.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ limitations under the License.
package mysql

import (
"crypto/x509"
"flag"
"fmt"
"net"
Expand Down Expand Up @@ -83,7 +82,8 @@ func (asl *AuthServerClientCert) HandleUser(user string, remoteAddr net.Addr) bo
}

// UserEntryWithPassword is part of the PlaintextStorage interface
func (asl *AuthServerClientCert) UserEntryWithPassword(userCerts []*x509.Certificate, user string, password string, remoteAddr net.Addr) (Getter, error) {
func (asl *AuthServerClientCert) UserEntryWithPassword(conn *Conn, user string, password string, remoteAddr net.Addr) (Getter, error) {
userCerts := conn.GetTLSClientCerts()
if len(userCerts) == 0 {
return nil, fmt.Errorf("no client certs for connection")
}
Expand Down
3 changes: 1 addition & 2 deletions go/mysql/auth_server_none.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ limitations under the License.
package mysql

import (
"crypto/x509"
"net"

querypb "github.com/dolthub/vitess/go/vt/proto/query"
Expand Down Expand Up @@ -51,7 +50,7 @@ func (a *AuthServerNone) HandleUser(user string, remoteAddr net.Addr) bool {

// UserEntryWithHash validates the user if it exists and returns the information.
// Always accepts any user.
func (a *AuthServerNone) UserEntryWithHash(userCerts []*x509.Certificate, salt []byte, user string, authResponse []byte, remoteAddr net.Addr) (Getter, error) {
func (a *AuthServerNone) UserEntryWithHash(conn *Conn, salt []byte, user string, authResponse []byte, remoteAddr net.Addr) (Getter, error) {
return &NoneGetter{}, nil
}

Expand Down
7 changes: 3 additions & 4 deletions go/mysql/auth_server_static.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ package mysql
import (
"bytes"
"crypto/subtle"
"crypto/x509"
"encoding/json"
"flag"
"net"
Expand Down Expand Up @@ -165,7 +164,7 @@ func (a *AuthServerStatic) HandleUser(user string, remoteAddr net.Addr) bool {

// UserEntryWithPassword implements password lookup based on a plain
// text password that is negotiated with the client.
func (a *AuthServerStatic) UserEntryWithPassword(userCerts []*x509.Certificate, user string, password string, remoteAddr net.Addr) (Getter, error) {
func (a *AuthServerStatic) UserEntryWithPassword(conn *Conn, user string, password string, remoteAddr net.Addr) (Getter, error) {
a.mu.Lock()
entries, ok := a.entries[user]
a.mu.Unlock()
Expand All @@ -183,7 +182,7 @@ func (a *AuthServerStatic) UserEntryWithPassword(userCerts []*x509.Certificate,

// UserEntryWithHash implements password lookup based on a
// mysql_native_password hash that is negotiated with the client.
func (a *AuthServerStatic) UserEntryWithHash(userCerts []*x509.Certificate, salt []byte, user string, authResponse []byte, remoteAddr net.Addr) (Getter, error) {
func (a *AuthServerStatic) UserEntryWithHash(conn *Conn, salt []byte, user string, authResponse []byte, remoteAddr net.Addr) (Getter, error) {
a.mu.Lock()
entries, ok := a.entries[user]
a.mu.Unlock()
Expand Down Expand Up @@ -213,7 +212,7 @@ func (a *AuthServerStatic) UserEntryWithHash(userCerts []*x509.Certificate, salt

// UserEntryWithCacheHash implements password lookup based on a
// caching_sha2_password hash that is negotiated with the client.
func (a *AuthServerStatic) UserEntryWithCacheHash(userCerts []*x509.Certificate, salt []byte, user string, authResponse []byte, remoteAddr net.Addr) (Getter, CacheState, error) {
func (a *AuthServerStatic) UserEntryWithCacheHash(conn *Conn, salt []byte, user string, authResponse []byte, remoteAddr net.Addr) (Getter, CacheState, error) {
a.mu.Lock()
entries, ok := a.entries[user]
a.mu.Unlock()
Expand Down