Comment: 20 bytes of random data

[zhenjl]

This is not a bug. Just a quick comment about a comment here: https://github.com/go-sql-driver/mysql/blob/master/packets.go#L177

The reason the python library uses 12 bytes is because in MySQL 4.1 the initial handshake packet sends back 20 bytes of random data. The first 8 are in the earlier part of the packet, then the remaining 12 bytes are in this later section.

Documentation is here: http://dev.mysql.com/doc/internals/en/secure-password-authentication.html#packet-Authentication::Native41

You may know that already but just in case...

[julienschmidt]

Thanks for your comment.

The confusion comes from http://dev.mysql.com/doc/internals/en/connection-phase-packets.html#packet-Protocol::Handshake, in detail from string[$len] auth-plugin-data-part-2 ($len=MAX(13, length of auth-plugin-data - 8)), which suggests that it would be at least 13 bytes long.

As you pointed out, length of auth-plugin-data - 8 would be 12 in this case.

[zhenjl]

From mysql-5.7/sql/auth/sql_authentication.cc line 538

the 13th byte is " \0 byte, terminating the second part of a scramble"

  Packet format:

    Bytes       Content
    -----       ----
    1           protocol version (always 10)
    n           server version string, \0-terminated
    4           thread id
    8           first 8 bytes of the plugin provided data (scramble)
    1           \0 byte, terminating the first part of a scramble
    2           server capabilities (two lower bytes)
    1           server character set
    2           server status
    2           server capabilities (two upper bytes)
    1           length of the scramble
    10          reserved, always 0
    n           rest of the plugin provided data (at least 12 bytes)
    1           \0 byte, terminating the second part of a scramble

[arnehormann]

Thank you! Are you interested in writing a pull request for an improved comment and join our ranks of contributors?
You did the research, you deserve the credit.

[zhenjl]

Sounds good. Will send in a PR later today. thx.

[julienschmidt]

Fixed by #197