contrib/mysql: add classic protocol support#4967
contrib/mysql: add classic protocol support#4967pablogonzalezpe wants to merge 3 commits intosecdev:masterfrom
Conversation
| return repr(val) | ||
|
|
||
|
|
||
| class MySQLCapabilityFlagsField(LEIntField): |
There was a problem hiding this comment.
Is this "redefinition" of a FlagsField really necessary?
There was a problem hiding this comment.
The goal here was not to redefine FlagsField semantics, but to keep this serialized as a regular little-endian integer while providing a readable representation in show().
I used this small wrapper because MySQL capability flags are 32-bit little-endian values and the current code keeps the raw integer behavior unchanged. If you prefer using a native FlagsField pattern here, I can adjust it.
There was a problem hiding this comment.
A standard FlagsField can provide LE representation:
class FlagsField(_BitField[Optional[Union[int, FlagValue]]]):
""" Handle Flag type field
...
...
:param name: field's name
:param default: default value for the field
:param size: number of bits in the field (in bits). if negative, LE <-----
:param names: (list or str or dict) label for each flag
If it's a str or a list, the least Significant Bit tag's name
is written first.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #4967 +/- ##
==========================================
+ Coverage 80.31% 80.33% +0.01%
==========================================
Files 381 382 +1
Lines 93630 94110 +480
==========================================
+ Hits 75202 75600 +398
- Misses 18428 18510 +82
🚀 New features to boost your workflow:
|
| """ | ||
| Authentication response encoding depends on client capabilities. | ||
|
|
||
| - CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA: string<lenenc> |
There was a problem hiding this comment.
It's not the scapy way to introduce a new Field for such a handling. More correct would be to use "ConditionalFields" or MultipleTypeFields
There was a problem hiding this comment.
That is fair, thanks. I refactored this part to use MultipleTypeField in MySQLHandshakeResponse41 instead of a dedicated MySQLAuthResponseField.
The auth response still supports the same three encodings (lenenc, 1-byte length, and NUL-terminated), but the field selection is now expressed in a way that is closer to Scapy conventions.
I also re-ran the MySQL UTScapy tests as well as flake8 and mypy after the change.
|
Please try to increase the test coverage, since this looks like AI-generated code. |
|
Thanks, that is fair feedback. I will add more tests to exercise the currently uncovered branches in \scapy.contrib.mysql. The current version already includes UTScapy regression tests and validation against real MySQL pcaps, but I agree that the patch coverage can be improved further. |
|
I added more UTScapy tests to exercise uncovered branches, including auth-response variants, helper edge cases, fallback/error paths, and incomplete stream reassembly. |
| return _flag_repr(int(val), MYSQL_CLIENT_FLAGS) | ||
|
|
||
|
|
||
| class MySQLStatusFlagsField(LEShortField): |
There was a problem hiding this comment.
same here, please reuse existing fields.
| return bool(flags & mask) | ||
|
|
||
|
|
||
| def _flag_repr(value: int, mapping: Any) -> str: |
There was a problem hiding this comment.
This function is already part of FlagsField.
remove it
| return _flag_repr(int(val), MYSQL_STATUS_FLAGS) | ||
|
|
||
|
|
||
| class MySQLCharsetField(ByteEnumField): |
There was a problem hiding this comment.
Please use existing Field definitions, if the derived class is not providing "new" functionality.
| LEShortEnumField.__init__(self, name, default, MYSQL_CHARACTER_SETS) | ||
|
|
||
|
|
||
| class MySQLColumnFlagsField(LEShortField): |
3 participants
Summary
This PR adds a new
scapy.contrib.mysqlmodule implementing support for the MySQL classic protocol over TCP.The current scope covers a first usable subset of the protocol for dissection and packet building, including:
payload_length+sequence_id)Protocol::HandshakeV10Protocol::SSLRequestProtocol::HandshakeResponse41OldAuthSwitchRequestAuthSwitchRequestAuthSwitchResponseAuthMoreDataOK_PacketERR_PacketEOF_PacketCOM_QUERYCOM_STMT_PREPARE_OKRegression tests are added in
test/contrib/mysql.uts.Scope
This PR is intentionally limited to a usable MVP for the classic protocol.
Not implemented in this first version:
SSLRequestValidation
UTScapy
Added regression tests for:
COM_QUERYNULLOKwhenCLIENT_DEPRECATE_EOFappliesCOM_STMT_PREPARE_OKmetadata flowsResult:
UTScapy:15/15passingLint / typing
Validated locally with:
tox -e flake8on Windows: OKtox -e flake8on WSL Ubuntu / Python 3.9: OKtox -e mypyon Windows: OKOn WSL Ubuntu / Python 3.9,
tox -e mypyreports existing repository-level typing issues outside this module.Real PCAP validation
The contrib was also tested against these public MySQL captures:
umitproject/packet-manipulator/audits/pcap-tests/mysql.pcapcolinnewell/pcap2mysql-log/test/captures/big-data.pcaparkime/tests/pcap/mysql-allow.pcapIn local validation, the MySQL messages in these 3 captures were successfully parsed with the current implementation.
Notes
This PR follows the earlier discussion in #4954.
I tried to keep names close to the MySQL protocol naming where possible, while avoiding collisions with Scapy internals when needed.
Feedback is welcome on:
scapy.contrib