server: fix authentication with MySQL 5.1 and older clients (#29732) (#…

…29808)

server/conn.go

@@ -729,6 +729,20 @@ func (cc *clientConn) handleAuthPlugin(ctx context.Context, resp *handshakeRespo
 		}
 	} else {
 		logutil.Logger(ctx).Warn("Client without Auth Plugin support; Please upgrade client")
+		if cc.ctx == nil {
+			err := cc.openSession()
+			if err != nil {
+				return err
+			}
+		}
+		userplugin, err := cc.ctx.AuthPluginForUser(&auth.UserIdentity{Username: cc.user, Hostname: cc.peerHost})
+		if err != nil {
+			return err
+		}
+		if userplugin != mysql.AuthNativePassword && userplugin != "" {
+			return errNotSupportedAuthMode
+		}
+		resp.AuthPlugin = mysql.AuthNativePassword
 	}
 	return nil
 }

server/conn_test.go

@@ -912,7 +912,9 @@ func TestHandleAuthPlugin(t *testing.T) {
 		pkt: &packetIO{
 			bufWriter: bufio.NewWriter(bytes.NewBuffer(nil)),
 		},
-		server: srv,
+		collation: mysql.DefaultCollationID,
+		server:    srv,
+		user:      "root",
 	}
 	ctx := context.Background()
 	resp := handshakeResponse41{

server/server.go

@@ -102,6 +102,7 @@ var (
 	errSecureTransportRequired = dbterror.ClassServer.NewStd(errno.ErrSecureTransportRequired)
 	errMultiStatementDisabled  = dbterror.ClassServer.NewStd(errno.ErrMultiStatementDisabled)
 	errNewAbortingConnection   = dbterror.ClassServer.NewStd(errno.ErrNewAbortingConnection)
+	errNotSupportedAuthMode    = dbterror.ClassServer.NewStd(errno.ErrNotSupportedAuthMode)
 )
 
 // DefaultCapability is the capability of the server when it is created using the default configuration.