Skip to content

Conversation

@svats0001
Copy link
Contributor

@svats0001 svats0001 commented Oct 3, 2025

#326 @jchrys

Motivation:
To use RSA encryption when using the caching_sha2_password authentication type when SSLMode is disabled instead of throwing R2dbcPermissionDeniedException.

Modification:
MySqlAuthProvider - added RSA encryption method that returns encrypted bytes.
InitFlow - added serverRSAPublicKeyFile field to HandshakeExchangeable and invoked RSA encryption method after AuthUtils.authentication if SSL not completed and SSL necessary and serverRSAPublicKeyFile not null.
MySqlConnectionConfiguration - Added nullable serverRSAPublicKeyFile field.
MySqlConnectionFactory - Added serverRSAPublicKeyFile field to relevant constructor invocations inside getMySqlConnection.
MySqlConnectionFactoryProvider - Added option for serverRSAPublicKeyFile.
MySqlConnectionFactoryProviderTest - Added unit test to check if MySqlConnectionFactory is returned from ConnectionFactoryOptions containing serverRSAPublicKeyFile.
SslTunnelIntegrationTest - Added unit test to check if correct exceptions are thrown or if MySqlConnectionFactory is returned depending on various combinations of SSL and serverRSAPublicKeyFile in MySqlConnectionConfiguration and getting MySqlConnectionFactory from it.

Result:
When a serverRSAPublicKeyFile is provided and SSL is disabled and the caching_sha2_password authentication type is used by the MySql server and you're in full authentication phase, a R2dbcPermissionDeniedException will not be thrown and instead the password will be encrypted with RSA. Drawbacks are that RSA encryption method introduces many additional possible exceptions if specified file path is invalid or public key can't be read properly etc.

EDIT: Will fix checks/test on Monday

@svats0001 svats0001 force-pushed the rsa_caching_sha2_password branch 2 times, most recently from 8be6b8e to a2dcff0 Compare October 8, 2025 06:13
@svats0001
Copy link
Contributor Author

@jchrys I tried my hand at adding an option for RSA encryption for #326. Let me know if it's appropriate.

@jchrys jchrys self-requested a review October 8, 2025 09:17
@jchrys jchrys self-assigned this Oct 8, 2025
@jchrys jchrys added the enhancement New feature or request label Oct 8, 2025
Copy link
Collaborator

@jchrys jchrys left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR. this is major feature 👍 Overall LGTM. I’ve left a few comments. If feasible, please add a minimal integration test

Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
@svats0001 svats0001 force-pushed the rsa_caching_sha2_password branch from 8d39e66 to 0ded89c Compare October 17, 2025 04:20
@svats0001
Copy link
Contributor Author

@jchrys I've made those changes you suggested. I was unable to figure out how to configure the integration tests and get them working with the test container so I've removed them. It's not ideal but if it's completely necessary then I can try to work on the tests in the future when I have time but otherwise I think it's ready.

Copy link
Collaborator

@jchrys jchrys left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did some testing and debugging—please take a look at my comments and let me know once you’ve fixed them so I can review again.

Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
@svats0001
Copy link
Contributor Author

@jchrys Ready for review again with changes.

Signed-off-by: S V <vats02581@gmail.com>
Copy link
Collaborator

@jchrys jchrys left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM overall. I’ll run comprehensive test next week and post comment then; feel free to keep refining meanwhile.

Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Signed-off-by: S V <vats02581@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants