Bug #82784 MySQL X plugin versions - which version should we use to do checks?
Submitted: 29 Aug 2016 11:55 Modified: 6 Apr 2017 11:34
Reporter: Simon Mudd (OCA) Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: Document Store: X Plugin Severity:S3 (Non-critical)
Version:5.7.14 OS:Any
Assigned to: CPU Architecture:Any

[29 Aug 2016 11:55] Simon Mudd
Description:
I notice I can do the following:

mysql [localhost] {msandbox} ((none)) > select * from information_schema.plugins where plugin_name='mysqlx'\G
*************************** 1. row ***************************
           PLUGIN_NAME: mysqlx
        PLUGIN_VERSION: 1.0
         PLUGIN_STATUS: ACTIVE
           PLUGIN_TYPE: DAEMON
   PLUGIN_TYPE_VERSION: 50714.0
        PLUGIN_LIBRARY: mysqlx.so
PLUGIN_LIBRARY_VERSION: 1.6
         PLUGIN_AUTHOR: Oracle Corp
    PLUGIN_DESCRIPTION: X Plugin for MySQL
        PLUGIN_LICENSE: GPL
           LOAD_OPTION: ON
1 row in set (0.00 sec)

Also doing some X protocol testing/ debugging I notice after sending a CAPABILITIES message:

[ debug lines are my own code ]
DEBUG: found 6 capabilities
DEBUG: - scalar bool: name: "tls", value: false
DEBUG: - array of strings: name: "authentication.mechanisms", values: [MYSQL41]
DEBUG: - scalar string: name: "doc.formats", value: "text"
DEBUG: - scalar string: name: "node_type", value: "mysql"
DEBUG: - scalar string: name: "plugin.version", value: "1.0.2"    <=====

So the plugin identifies itself via the X protocol as 1.0.2.

This is all on a server running 5.7.14.

How to repeat:
See above.
Note: there are currently few public tools to debug the X protocol but the MySQL devs will be able to do this.

Suggested fix:
1. As commented in another bug#81925 elsewhere DO NOT expose the X plugin version as a version at least prior to the client authenticating. Only expose "capabilities" that the client needs to be aware of at this time. After authentication completes it may make sense to make more information available.

2. Please provide a clear description (in documentation) of which version should be used to identify the X plugin and please only use a single version.
[30 Aug 2016 8:46] MySQL Verification Team
Hello Simon,

Thank you for the report and feedback!

Thanks,
Umesh
[24 Jan 2017 12:26] Tony Bedford
Posted by developer:
 
An entry has been added to the 5.7.17 and 8.0.1 changelogs:

X Plugin displayed its version to any connected user, including those not authenticated.
[6 Apr 2017 11:34] Daniel Price
Posted by developer:
 
The bug report has been documented in the changelog, as noted above.