contrib/mysql: add classic protocol support#4967
contrib/mysql: add classic protocol support#4967pablogonzalezpe wants to merge 2 commits intosecdev:masterfrom
Conversation
| return repr(val) | ||
|
|
||
|
|
||
| class MySQLCapabilityFlagsField(LEIntField): |
There was a problem hiding this comment.
Is this "redefinition" of a FlagsField really necessary?
| return _flag_repr(int(val), MYSQL_COLUMN_FLAGS) | ||
|
|
||
|
|
||
| class MySQLLenEncStrField(Field[Any, Any]): |
There was a problem hiding this comment.
Whats the purpose of this field?
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #4967 +/- ##
==========================================
+ Coverage 80.31% 80.33% +0.01%
==========================================
Files 381 382 +1
Lines 93630 94110 +480
==========================================
+ Hits 75202 75600 +398
- Misses 18428 18510 +82
🚀 New features to boost your workflow:
|
| """ | ||
| Authentication response encoding depends on client capabilities. | ||
|
|
||
| - CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA: string<lenenc> |
There was a problem hiding this comment.
It's not the scapy way to introduce a new Field for such a handling. More correct would be to use "ConditionalFields" or MultipleTypeFields
| return repr(val) | ||
|
|
||
|
|
||
| class MySQLTextRowValuesField(Field[Any, Any]): |
There was a problem hiding this comment.
Is this Field really necessary?
|
Please try to increase the test coverage, since this looks like AI-generated code. |
|
Thanks, that is fair feedback. I will add more tests to exercise the currently uncovered branches in \scapy.contrib.mysql. The current version already includes UTScapy regression tests and validation against real MySQL pcaps, but I agree that the patch coverage can be improved further. |
|
I added more UTScapy tests to exercise uncovered branches, including auth-response variants, helper edge cases, fallback/error paths, and incomplete stream reassembly. |
3 participants
Summary
This PR adds a new
scapy.contrib.mysqlmodule implementing support for the MySQL classic protocol over TCP.The current scope covers a first usable subset of the protocol for dissection and packet building, including:
payload_length+sequence_id)Protocol::HandshakeV10Protocol::SSLRequestProtocol::HandshakeResponse41OldAuthSwitchRequestAuthSwitchRequestAuthSwitchResponseAuthMoreDataOK_PacketERR_PacketEOF_PacketCOM_QUERYCOM_STMT_PREPARE_OKRegression tests are added in
test/contrib/mysql.uts.Scope
This PR is intentionally limited to a usable MVP for the classic protocol.
Not implemented in this first version:
SSLRequestValidation
UTScapy
Added regression tests for:
COM_QUERYNULLOKwhenCLIENT_DEPRECATE_EOFappliesCOM_STMT_PREPARE_OKmetadata flowsResult:
UTScapy:15/15passingLint / typing
Validated locally with:
tox -e flake8on Windows: OKtox -e flake8on WSL Ubuntu / Python 3.9: OKtox -e mypyon Windows: OKOn WSL Ubuntu / Python 3.9,
tox -e mypyreports existing repository-level typing issues outside this module.Real PCAP validation
The contrib was also tested against these public MySQL captures:
umitproject/packet-manipulator/audits/pcap-tests/mysql.pcapcolinnewell/pcap2mysql-log/test/captures/big-data.pcaparkime/tests/pcap/mysql-allow.pcapIn local validation, the MySQL messages in these 3 captures were successfully parsed with the current implementation.
Notes
This PR follows the earlier discussion in #4954.
I tried to keep names close to the MySQL protocol naming where possible, while avoiding collisions with Scapy internals when needed.
Feedback is welcome on:
scapy.contrib