Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new SQLite3 functions for password hash generation #4479

Merged
merged 6 commits into from
Mar 28, 2024

Conversation

JavierJF
Copy link
Collaborator

This PR introduces two new SQLite3 functions:

  • 'MYSQL_NATIVE_PASSWORD'
  • 'CACHING_SHA2_PASSWORD'

These functions are accessible from the Admin interface, and allow generating MySQL compatible passwords:

  • 'MYSQL_NATIVE_PASSWORD': Expects one argument, the desired user password and returns it's hashed version, using the SHA1 of the SHA1 as MySQL.
admin> SELECT MYSQL_NATIVE_PASSWORD('example_pass');
+-------------------------------------------+
| MYSQL_NATIVE_PASSWORD('example_pass')     |
+-------------------------------------------+
| *520BA5BE3924F1A0DB9941C4EA0911B19CBDE1A3 |
+-------------------------------------------+
1 row in set (0.00 sec)
  • CACHING_SHA2_PASSWORD: Expects either one, or two arguments. The first argument is the password to hash and the second, and optional one, is the salt use for the hash generation. If no second argument is provided, the password will be generated using a randomly generated salt. Use with one argument:
admin> SELECT CACHING_SHA2_PASSWORD('example_pass');
+------------------------------------------------------------------------+
| CACHING_SHA2_PASSWORD('example_pass')                                  |
+------------------------------------------------------------------------+
| $A$005$Lpnj_Ps)C4q2hg;%       EISfOW43XEg7z7e3VScxZg6Qn1/WGKo8sT.k4Tb9mB1 |
+------------------------------------------------------------------------+
1 row in set (0.02 sec)

admin> SELECT HEX(CACHING_SHA2_PASSWORD('example_pass'));
+----------------------------------------------------------------------------------------------------------------------------------------------+
| HEX(CACHING_SHA2_PASSWORD('example_pass'))                                                                                                   |
+----------------------------------------------------------------------------------------------------------------------------------------------+
| 244124303035244B337D2B184A464C50195B2377463F790A193B4D4B307566385637646A5457692E646B6C765768734A5145765863555939684732566A624E6D464E4C317838 |
+----------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.02 sec)

The password should always be copied using the HEX format, otherwise characters could be escaped, because the has can contain characters may not be representable, see ProxySQL doc. With two parameters, a salt can be provided, this can be used to replicate MySQL passwords, without having the complete hash for them, only the used salt:

mysql> CREATE USER 'example_user'@'%' IDENTIFIED WITH 'caching_sha2_password' BY 'example_pass';
Query OK, 0 rows affected (0.00 sec)

mysql> SELECT user, HEX(authentication_string), HEX(SUBSTR(authentication_string, 8, 20)) AS salt FROM mysql.user WHERE user='example_user';
+--------------+----------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------------+
| user         | HEX(authentication_string)                                                                                                                   | salt                                     |
+--------------+----------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------------+
| example_user | 24412430303524156B250133593C08146133655714470A700D203D7A646833593169655241513430396C3833464B7764377661755138586563446F4A63466454676367747737 | 156B250133593C08146133655714470A700D203D |
+--------------+----------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------------+
1 row in set (0.00 sec)

Now in ProxySQL Admin:

admin> SELECT HEX(CACHING_SHA2_PASSWORD('example_pass', UNHEX('156B250133593C08146133655714470A700D203D')));
+----------------------------------------------------------------------------------------------------------------------------------------------+
| HEX(CACHING_SHA2_PASSWORD('example_pass', UNHEX('156B250133593C08146133655714470A700D203D')))                                                |
+----------------------------------------------------------------------------------------------------------------------------------------------+
| 24412430303524156B250133593C08146133655714470A700D203D7A646833593169655241513430396C3833464B7764377661755138586563446F4A63466454676367747737 |
+----------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.02 sec)

Added new functions 'MYSQL_NATIVE_PASSWORD' and 'CACHING_SHA2_PASSWORD'
for generating MySQL compatible hashed passwords.
@JavierJF JavierJF mentioned this pull request Mar 22, 2024
With the addition of 'sha256_crypt_r' to 'libtap.a' it's required to
advice the linker to link against 'gcov' when building the shared
library.
@JavierJF JavierJF force-pushed the v2.x-sqlite3_pass_exts-2 branch from bb7d305 to 80b4c59 Compare March 27, 2024 15:54
- Delete utility functions 'wait_for_backend_conns', replaced with
  generic condition waiting function 'wait_for_cond'.
- Introduced function 'mysql_query_ext_val' for single value extraction.
@JavierJF JavierJF force-pushed the v2.x-sqlite3_pass_exts-2 branch from 80b4c59 to b656987 Compare March 27, 2024 19:17
@renecannao renecannao merged commit 2df30b6 into v2.x Mar 28, 2024
45 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants