makssent opened a new issue, #40272: URL: https://github.com/apache/shardingsphere/issues/40272
### Before reporting a bug - [x] I have searched open and closed [GitHub issues](https://github.com/apache/shardingsphere/issues). - [x] I have read the [ShardingSphere documentation](https://shardingsphere.apache.org/document/current/en/overview). ### ShardingSphere version master, commit [`01446d4fad4`](https://github.com/apache/shardingsphere/commit/01446d4fad48450e7fc3eb3b3631b25d6bf411df) ### ShardingSphere project ShardingSphere-Proxy ### Expected behavior The proxy should reject a login that it cannot complete with a login error, as the Firebird server rejects the login with [`isc_login_error`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/remote/server/server.cpp#L7590-L7599) when it uses none of the client plugins ([`authPlugins`](https://github.com/FirebirdSQL/jaybird/blob/v6.0.7/src/main/org/firebirdsql/jaybird/props/PropertyNames.java#L61)). Continuing the login with the next plugin of the client in [`op_cont_auth`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/remote/server/server.cpp#L5086-L5090), as the Firebird server [does](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/remote/server/server.cpp#L2118-L2126), is tracked in #39936 and is not part of this issue. ### Actual behavior When the first plugin of the client is not the plugin of the proxy user, the proxy answers [`op_connect`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/remote/server/server.cpp#L5051-L5071) with the name of its own plugin, but then fails on [`op_attach`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/remote/server/server.cpp#L5077-L5080) with a NullPointerException, and the client gets [`isc_random`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/include/firebird/impl/msg/jrd.h#L63) "Unknown exception." instead of a login error. The same steps were executed directly on the Firebird server and through the proxy, each case on a new connection, and the rows were read directly from the Firebird server: | Steps | Firebird server | Proxy | | --- | --- | --- | | Connect with [`authPlugins`](https://github.com/FirebirdSQL/jaybird/blob/v6.0.7/src/main/org/firebirdsql/jaybird/props/PropertyNames.java#L61)`=Srp256`, insert a row with ID = 8971, commit | Success, the row is saved | Success, the row is saved | | Connect with [`authPlugins`](https://github.com/FirebirdSQL/jaybird/blob/v6.0.7/src/main/org/firebirdsql/jaybird/props/PropertyNames.java#L61)`=Srp`, insert a row with ID = 8972, commit | Error [`isc_login_error`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/remote/server/server.cpp#L7590-L7599) "Error occurred during login, please check server firebird.log for details" | Error [`isc_random`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/include/firebird/impl/msg/jrd.h#L63) "Unknown exception." | | Connect with [`authPlugins`](https://github.com/FirebirdSQL/jaybird/blob/v6.0.7/src/main/org/firebirdsql/jaybird/props/PropertyNames.java#L61)`=Srp,Srp256`, insert a row with ID = 8973, commit | Success, the login continues with Srp256 in [`op_cont_auth`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/remote/server/server.cpp#L747-L753), the row is saved | Error [`isc_random`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/include/firebird/impl/msg/jrd.h#L63) "Unknown exception.", the row is not saved | | Connect with [`authPlugins`](https://github.com/FirebirdSQL/jaybird/blob/v6.0.7/src/main/org/firebirdsql/jaybird/props/PropertyNames.java#L61)`=Srp256,Srp`, insert a row with ID = 8974, commit | Success, the row is saved | Success, the row is saved | So through the proxy a client that offers no plugin of the proxy, or offers Srp before Srp256, gets [`isc_random`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/include/firebird/impl/msg/jrd.h#L63) "Unknown exception." with a NullPointerException in the message instead of a login error, and cannot tell it from an internal error of the proxy. ### Reason analysis - [`FirebirdConnectPacket#getPlugin`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/database/protocol/dialect/firebird/src/main/java/org/apache/shardingsphere/database/protocol/firebird/packet/handshake/FirebirdConnectPacket.java#L113-L115) returns only the first plugin of the client, and [`FirebirdAuthenticationEngine#processConnect`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/proxy/frontend/dialect/firebird/src/main/java/org/apache/shardingsphere/proxy/frontend/firebird/authentication/FirebirdAuthenticationEngine.java#L135-L142) compares it with the plugin of the proxy user. When they differ, the proxy [answers](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/proxy/frontend/dialect/firebird/src/main/java/org/apache/shardingsphere/proxy/frontend/firebird/authentication/FirebirdAuthenticationEngine.java#L137-L138) with the name of its plugin and empty data, b ut does not create [`authData`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/proxy/frontend/dialect/firebird/src/main/java/org/apache/shardingsphere/proxy/frontend/firebird/authentication/FirebirdAuthenticationEngine.java#L63) (the SRP data of the login) and does not check that the client offers this plugin at all. - On [`op_attach`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/remote/server/server.cpp#L5077-L5080) [`FirebirdAuthenticationEngine#login`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/proxy/frontend/dialect/firebird/src/main/java/org/apache/shardingsphere/proxy/frontend/firebird/authentication/FirebirdAuthenticationEngine.java#L120-L121) passes the null [`authData`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/proxy/frontend/dialect/firebird/src/main/java/org/apache/shardingsphere/proxy/frontend/firebird/authentication/FirebirdAuthenticationEngine.java#L63) to [`FirebirdSRPAuthenticator#authenticate`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/proxy/frontend/dialect/firebird/src/main/java/org/apache/shardingsphere/proxy/frontend/firebird/authentication/authenticator/impl/FirebirdSRPAuthenticator.java#L35-L36), which dereferences it and throws a NullPointerException. - [`FrontendChannelInboundHandler#failAuthentication`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/proxy/frontend/core/src/main/java/org/apache/shardingsphere/proxy/frontend/netty/FrontendChannelInboundHandler.java#L105-L113) sends this exception to the client through [`FirebirdErrorPacketFactory#newInstance`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/database/protocol/dialect/firebird/src/main/java/org/apache/shardingsphere/database/protocol/firebird/err/FirebirdErrorPacketFactory.java#L44-L47), and [`SQLExceptionTransformEngine#toSQLException`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/database/exception/core/src/main/java/org/apache/shardingsphere/database/exception/core/SQLExceptionTransformEngine.java#L68) turns it into [`isc_random`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/include/firebird/impl/msg/jrd.h#L63) "Unknown exception. ". - [`FirebirdAuthenticationEngine#authenticate`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/proxy/frontend/dialect/firebird/src/main/java/org/apache/shardingsphere/proxy/frontend/firebird/authentication/FirebirdAuthenticationEngine.java#L88-L91) does not implement [`op_cont_auth`](https://github.com/FirebirdSQL/firebird/blob/v5.0.4/src/remote/server/server.cpp#L5086-L5090) (the comment [`// TODO implement CONT_AUTH`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/proxy/frontend/dialect/firebird/src/main/java/org/apache/shardingsphere/proxy/frontend/firebird/authentication/FirebirdAuthenticationEngine.java#L89)), which is tracked in #39936. Until it is implemented, nothing rejects a login that the proxy cannot complete before [`FirebirdSRPAuthenticator#authenticate`](https://github.com/apache/shardingsphere/blob/01446d4fad48450e7fc3eb3b3631b25d6bf411df/proxy/frontend/dialect/firebird/src/main/java/or g/apache/shardingsphere/proxy/frontend/firebird/authentication/authenticator/impl/FirebirdSRPAuthenticator.java#L35-L36) fails. ### Steps to reproduce #### Environment - Firebird server 5.0. - Client: Jaybird 6.0.7. #### Steps 1. Create the table on the Firebird server: ```sql CREATE TABLE T_PLAIN (ID INTEGER NOT NULL PRIMARY KEY, NAME VARCHAR(20)); ``` 2. Start ShardingSphere-Proxy with this configuration: ```yaml # global.yaml authority: users: - user: root@% password: root privilege: type: ALL_PERMITTED props: proxy-frontend-database-protocol-type: Firebird ``` ```yaml # database-firebird.yaml databaseName: firebird_db dataSources: ds_0: url: jdbc:firebirdsql://<host>/<database file> username: <user> password: <password> rules: - !SINGLE tables: - "*.*" ``` 3. Execute the steps from the table under "Actual behavior" through the proxy and directly on the Firebird server, and compare the results. "Example code" runs all of them. ### Example code All cases on Jaybird 6.0.7, one method per case. The comment above each method shows what it prints against the Firebird server and through the proxy. ```java import java.sql.Connection; import java.sql.DriverManager; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.Properties; public class AuthPluginList { // The proxy; put the URL of the Firebird server here to compare static final String URL = "jdbc:firebirdsql://<proxy host>:<proxy port>/firebird_db?encoding=UTF8&wireCrypt=DISABLED"; static final String USER = "root"; static final String PASSWORD = "root"; // The Firebird server, to read the rows directly static final String SERVER_URL = "jdbc:firebirdsql://<host>/<database file>"; static final String SERVER_USER = "<user>"; static final String SERVER_PASSWORD = "<password>"; public static void main(final String[] args) throws Exception { executeOnServer("DELETE FROM T_PLAIN WHERE ID BETWEEN 8971 AND 8974"); srp256(); srp(); srpThenSrp256(); srp256ThenSrp(); executeOnServer("DELETE FROM T_PLAIN WHERE ID BETWEEN 8971 AND 8974"); } // Firebird server: "authPlugins=Srp256: ID = 8971: the row is saved"; proxy: "authPlugins=Srp256: ID = 8971: the row is saved" static void srp256() throws SQLException { loginAndInsert("Srp256", 8971); } // Firebird server: "authPlugins=Srp: Error occurred during login, please check server firebird.log for details ..."; // proxy: "authPlugins=Srp: Unknown exception. ..." static void srp() throws SQLException { loginAndInsert("Srp", 8972); } // Firebird server: "authPlugins=Srp,Srp256: ID = 8973: the row is saved"; proxy: "authPlugins=Srp,Srp256: Unknown exception. ..." static void srpThenSrp256() throws SQLException { loginAndInsert("Srp,Srp256", 8973); } // Firebird server: "authPlugins=Srp256,Srp: ID = 8974: the row is saved"; proxy: "authPlugins=Srp256,Srp: ID = 8974: the row is saved" static void srp256ThenSrp() throws SQLException { loginAndInsert("Srp256,Srp", 8974); } // Opens a new connection with the given authentication plugins, inserts the row with the given ID and commits static void loginAndInsert(final String plugins, final int id) throws SQLException { Properties properties = new Properties(); properties.setProperty("user", USER); properties.setProperty("password", PASSWORD); // Jaybird offers these plugins in this order and sends the data of the first one in op_connect properties.setProperty("authPlugins", plugins); try (Connection connection = DriverManager.getConnection(URL, properties)) { connection.setAutoCommit(false); try (Statement statement = connection.createStatement()) { statement.executeUpdate("INSERT INTO T_PLAIN (ID, NAME) VALUES (" + id + ", '" + plugins + "')"); } connection.commit(); } catch (final SQLException ex) { System.out.println("authPlugins=" + plugins + ": " + ex.getMessage()); return; } printRow(plugins, id); } // Reads the row directly on the Firebird server static void printRow(final String plugins, final int id) throws SQLException { try (Connection connection = DriverManager.getConnection(SERVER_URL, SERVER_USER, SERVER_PASSWORD); ResultSet resultSet = connection.createStatement().executeQuery("SELECT NAME FROM T_PLAIN WHERE ID = " + id)) { System.out.println("authPlugins=" + plugins + ": ID = " + id + ": " + (resultSet.next() ? "the row is saved" : "the row is lost")); } } static void executeOnServer(final String sql) throws SQLException { try (Connection connection = DriverManager.getConnection(SERVER_URL, SERVER_USER, SERVER_PASSWORD)) { connection.createStatement().execute(sql); } } } ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
