From f371dd554deb8c505959b3e5e815ab32f4610943 Mon Sep 17 00:00:00 2001 From: lishuode Date: Tue, 20 Jun 2017 05:03:08 +0000 Subject: [PATCH 1/2] Fix connection procedure auth-switch password. For AuthSwitch feature, mysql_native_password and mysql_old_password should reply only 8-byte or 20-byte scrambled password without \0. So fixed it. --- pymysql/connections.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pymysql/connections.py b/pymysql/connections.py index bce92b62..da5249be 100644 --- a/pymysql/connections.py +++ b/pymysql/connections.py @@ -1183,10 +1183,10 @@ def _process_auth(self, plugin_name, auth_packet): handler = None if plugin_name == b"mysql_native_password": # https://dev.mysql.com/doc/internals/en/secure-password-authentication.html#packet-Authentication::Native41 - data = _scramble(self.password.encode('latin1'), auth_packet.read_all()) + b'\0' + data = _scramble(self.password.encode('latin1'), auth_packet.read_all()) elif plugin_name == b"mysql_old_password": # https://dev.mysql.com/doc/internals/en/old-password-authentication.html - data = _scramble_323(self.password.encode('latin1'), auth_packet.read_all()) + b'\0' + data = _scramble_323(self.password.encode('latin1'), auth_packet.read_all()) elif plugin_name == b"mysql_clear_password": # https://dev.mysql.com/doc/internals/en/clear-text-authentication.html data = self.password.encode('latin1') + b'\0' From 5f6f111928afd3ecdf526141c2045f166db9aa85 Mon Sep 17 00:00:00 2001 From: lishuode Date: Wed, 21 Jun 2017 08:58:39 +0000 Subject: [PATCH 2/2] Old password plugin can accept '\0' value --- pymysql/connections.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pymysql/connections.py b/pymysql/connections.py index da5249be..ac16c993 100644 --- a/pymysql/connections.py +++ b/pymysql/connections.py @@ -1186,7 +1186,7 @@ def _process_auth(self, plugin_name, auth_packet): data = _scramble(self.password.encode('latin1'), auth_packet.read_all()) elif plugin_name == b"mysql_old_password": # https://dev.mysql.com/doc/internals/en/old-password-authentication.html - data = _scramble_323(self.password.encode('latin1'), auth_packet.read_all()) + data = _scramble_323(self.password.encode('latin1'), auth_packet.read_all()) + b'\0' elif plugin_name == b"mysql_clear_password": # https://dev.mysql.com/doc/internals/en/clear-text-authentication.html data = self.password.encode('latin1') + b'\0'