You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As per MySQL 8.0 docscaching_sha2_password requires a "secure" connection:
To connect to the server using an account that authenticates with the caching_sha2_password plugin, you must use either a secure connection or an unencrypted connection that supports password exchange using an RSA key pair, as described later in this section.
If the connection is secure, an RSA key pair is unnecessary and is not used. This applies to TCP connections encrypted using TLS, as well as Unix socket-file and shared-memory connections. The password is sent as cleartext but cannot be snooped because the connection is secure.
If we can authenticate by fast path authentication works fine:
logger.debug("caching sha2: succeeded by fast path.")
pkt=awaitself._read_packet()
pkt.check_error() # pkt must be OK packet
returnpkt
However, if we fall back to full auth, we only send the password when the connection has an SSL context.
On unix sockets we don't have an SSL context, but the connection is still secure.
$ python unix-test-password.py
2022-01-17T09:04:37.071060+01:00 - DEBUG - asyncio:__init__ - Using selector: KqueueSelector
2022-01-17T09:04:37.072641+01:00 - DEBUG - aiomysql:caching_sha2_password_auth - caching sha2: Trying full auth...
Traceback (most recent call last):
File "/Users/user/dev/aiomysql/aiomysql/connection.py", line 501, in _connectawaitself._request_authentication()
File "/Users/user/dev/aiomysql/aiomysql/connection.py", line 804, in _request_authenticationawaitself.caching_sha2_password_auth(auth_packet)
File "/Users/user/dev/aiomysql/aiomysql/connection.py", line 911, in caching_sha2_password_auth
pkt =awaitself._read_packet() # Request public key
File "/Users/user/dev/aiomysql/aiomysql/connection.py", line 591, in _read_packet
packet.check_error()
File "/Users/user/dev/aiomysql/__pypackages__/3.7/lib/pymysql/protocol.py", line 220, in check_error
err.raise_mysql_exception(self._data)
File "/Users/user/dev/aiomysql/__pypackages__/3.7/lib/pymysql/err.py", line 109, in raise_mysql_exceptionraise errorclass(errno, errval)
pymysql.err.OperationalError: (1045, "Access denied for user 'root'@'localhost' (using password: YES)")
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "unix-test-password.py", line 55, in <module>
asyncio.run(main())
File "/Users/user/.asdf/installs/python/3.7.12/lib/python3.7/asyncio/runners.py", line 43, in runreturn loop.run_until_complete(main)
File "/Users/user/.asdf/installs/python/3.7.12/lib/python3.7/asyncio/base_events.py", line 587, in run_until_completereturn future.result()
File "unix-test-password.py", line 32, in main
db='test_pymysql')
File "/Users/user/dev/aiomysql/aiomysql/connection.py", line 75, in _connectawait conn._connect()
File "/Users/user/dev/aiomysql/aiomysql/connection.py", line 521, in _connectself._host) from e
pymysql.err.OperationalError: (2003, "Can't connect to MySQL server on 'localhost'")
Describe the bug
As per MySQL 8.0 docs
caching_sha2_password
requires a "secure" connection:If we can authenticate by fast path authentication works fine:
aiomysql/aiomysql/connection.py
Lines 889 to 893 in ecbd675
However, if we fall back to full auth, we only send the password when the connection has an SSL context.
On unix sockets we don't have an SSL context, but the connection is still secure.
aiomysql/aiomysql/connection.py
Lines 899 to 901 in ecbd675
To Reproduce
Expected behavior
Authentication succeeds even when not cached.
Logs/tracebacks
Python Version
Python 3.7.12
aiomysql Version
master branch, currently on ecbd675
PyMySQL Version
Installed version: 0.9.3
SQLAlchemy Version
-
OS
macOS
Database type and version
MySQL 8.0.27
Additional context
No response
Code of Conduct
The text was updated successfully, but these errors were encountered: