[m13m]

The driver connects to a real MySQL server and authenticates. First time this project has completed anything end to end.

49 tests with --include integration; 46 and 3 excluded without, so mix test still needs no database.

The exchange

seq 0  →  HandshakeV10, announcing caching_sha2_password
seq 1  ←  HandshakeResponse41, naming mysql_native_password
seq 2  →  AuthSwitchRequest: 0xFE + "mysql_native_password" + a fresh 20-byte scramble
seq 3  ←  AuthSwitchResponse: the reply to that scramble
seq 4  →  OK

What is here

• Protocol.Handshake — parses the server greeting
• Auth.NativePassword — SHA1(password) XOR SHA1(scramble <> SHA1(SHA1(password)))
• Protocol.HandshakeResponse — builds the reply, and owns which capabilities the driver claims
• Client.connect/1 and Client.handshake/3 — the conversation, including method switching
• Transport grows connect/4, send/2, close/1; the fake records what was written
• test/fixtures/handshake_v10_8.4.4.bin — 73 bytes captured from a real server

The 2018 bugs, as the fix

{server_version, rest} = Codec.decode_string_nul(rest)    # not binary-size(6)

tail_length = max(13, auth_plugin_data_len - 8)           # not a hardcoded 13

server_version is NUL-terminated. The old pattern read it as six fixed bytes, which matches MySQL 5.7.21 — exactly six characters — and crashes on anything else. Verified both ways against the captured bytes: the 2018 pattern raises MatchError on 8.4.4 and parses cleanly when the version is six characters. Eight years of breakage caused by a coincidence between a guessed width and one version string.

What the real server corrected

I had the client refuse when the greeting named a plugin it cannot speak. That was wrong. The greeting names the server's default plugin, chosen before it knows which account is connecting; the account's actual method is settled afterwards by an AuthSwitchRequest. The check now applies to the switch, where the server has said what it needs.

No scripted test would have caught this — the fake only replays what I already believed. Worth weighing when deciding how much of a protocol can be proven without a server.

What the integration test proves that no unit test could

• The scramble is right. Its outer SHA1 and XOR had only cross-implementation agreement behind them; the inner stages were checkable against mysql.user.authentication_string, the outer ones were not. A server accepting the login is the first real evidence.
• The capability flags are acceptable to a server — claimed and withheld both.
• The 23-byte filler, charset id and max packet size are correct, none of which a unit test can validate.
• auth_plugin_data is joined correctly from two fields nine bytes apart. If that join were wrong the login would fail as "access denied" and look like a password problem.

On the capability flags

Claimed: PROTOCOL_41, PLUGIN_AUTH, SECURE_CONNECTION, TRANSACTIONS, and CONNECT_WITH_DB when a database is named.

Refused, with reasons in the source: LOCAL_FILES (a hostile server can then request any file from the client), MULTI_STATEMENTS (turns one injected query into several), SESSION_TRACK and DEPRECATE_EOF (both change packet shapes this driver does not parse yet), CONNECT_ATTRS (metadata nothing here needs).

capabilities/1 is public because the value sent is the value the Ok, Err and Eof parsers must be given. A mismatch there silently misparses every response.

Running the integration tests

docker run -d --name mysqlex-dev -p 3307:3306 \
  -e MYSQL_ROOT_PASSWORD=secret -e MYSQL_DATABASE=mysqlex_test mysql:8.0

docker exec mysqlex-dev mysql -uroot -psecret -e "
  CREATE USER 'mysqlex'@'%' IDENTIFIED WITH mysql_native_password BY 'secret';
  GRANT ALL ON mysqlex_test.* TO 'mysqlex'@'%';"

mix test --include integration

Pinned to 8.0 because MySQL 8.4 ships mysql_native_password disabled. --mysql-native-password=ON is an 8.4-only option and makes an 8.0 server refuse to start.

One expectation of mine was wrong and the server was right: a database the account cannot reach reports 1044, not 1049 — granted a single schema, the server says access denied rather than unknown database.

Not here

• caching_sha2_password, so modern servers with default settings cannot be reached yet
• TLS, which is the same transport seam with :ssl behind it
• Anything in the command phase; COM_QUERY is next