"""
mysql_handshake_capture.py
连接 MySQL 服务器并捕获握手阶段的原始数据包
"""
import socket
import struct

def capture_handshake(host='127.0.0.1', port=3306):
    """建立 TCP 连接并捕获服务器发送的握手数据包"""
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(5)

    try:
        sock.connect((host, port))
        print(f"[+] 已连接到 {host}:{port}")

        # 接收服务器的握手数据包
        # MySQL 数据包格式：3 字节长度 + 1 字节序列号 + 有效载荷
        header = sock.recv(4)
        if len(header) < 4:
            print("[-] 无法读取完整的数据包头")
            return

        # 解析包头：前 3 字节是小端序的长度，第 4 字节是序列号
        payload_length = struct.unpack('<I', header[0:3] + b'\x00')[0]
        sequence_number = header[3]

        print(f"[+] 包长度: {payload_length} 字节")
        print(f"[+] 序列号: {sequence_number}")

        # 读取有效载荷
        payload = b''
        while len(payload) < payload_length:
            chunk = sock.recv(payload_length - len(payload))
            if not chunk:
                break
            payload += chunk

        print(f"[+] 有效载荷大小: {len(payload)} 字节")
        print(f"[+] 原始数据 (前 100 字节): {payload[:100].hex()}")
        print()

        # 解析握手数据包
        parse_handshake_v10(payload)

    except socket.timeout:
        print("[-] 连接超时")
    except ConnectionRefusedError:
        print("[-] 连接被拒绝，请确认 MySQL 服务是否运行")
    finally:
        sock.close()


def parse_handshake_v10(payload):
    """解析 HandshakeV10 数据包"""
    offset = 0

    # 协议版本号 (1 字节)
    protocol_version = payload[offset]
    offset += 1
    print(f"  协议版本: {protocol_version}")

    # 服务器版本字符串 (以 null 结尾)
    null_pos = payload.index(b'\x00', offset)
    server_version = payload[offset:null_pos].decode('ascii')
    offset = null_pos + 1
    print(f"  服务器版本: {server_version}")

    # 连接 ID (4 字节, 小端序)
    connection_id = struct.unpack('<I', payload[offset:offset+4])[0]
    offset += 4
    print(f"  连接 ID: {connection_id}")

    # 认证数据第一部分 (8 字节)
    auth_data_part1 = payload[offset:offset+8]
    offset += 8
    print(f"  认证数据 Part1: {auth_data_part1.hex()}")

    # 填充字节 (1 字节, 0x00)
    offset += 1

    # 能力标志低位 (2 字节)
    capability_flags_low = struct.unpack('<H', payload[offset:offset+2])[0]
    offset += 2

    # 字符集 (1 字节)
    character_set = payload[offset]
    offset += 1
    print(f"  字符集 ID: {character_set}")

    # 服务器状态 (2 字节)
    status_flags = struct.unpack('<H', payload[offset:offset+2])[0]
    offset += 2
    print(f"  状态标志: 0x{status_flags:04X}")

    # 能力标志高位 (2 字节)
    capability_flags_high = struct.unpack('<H', payload[offset:offset+2])[0]
    offset += 2

    # 合并能力标志
    capability_flags = (capability_flags_high << 16) | capability_flags_low
    print(f"  能力标志: 0x{capability_flags:08X}")

    # 解析部分关键能力标志
    parse_capability_flags(capability_flags)

    # 认证数据长度 (1 字节) 或保留字节
    auth_data_length = payload[offset]
    offset += 1
    print(f"  认证数据长度: {auth_data_length}")

    # 保留字节 (10 字节)
    offset += 10

    # 认证数据第二部分 (至少 13 字节, 以 null 结尾)
    if auth_data_length > 8:
        auth_data_part2_length = auth_data_length - 8
    else:
        # 尽可能读取到 null 结尾
        try:
            null_pos = payload.index(b'\x00', offset)
            auth_data_part2_length = null_pos - offset
        except ValueError:
            auth_data_part2_length = len(payload) - offset

    auth_data_part2 = payload[offset:offset+auth_data_part2_length]
    offset += auth_data_part2_length + 1  # +1 跳过 null 终止符

    # 合并完整认证数据
    full_auth_data = auth_data_part1 + auth_data_part2
    print(f"  完整认证数据 ({len(full_auth_data)} 字节): {full_auth_data.hex()}")

    # 认证插件名称 (以 null 结尾)
    if offset < len(payload):
        auth_plugin = payload[offset:-1].decode('ascii', errors='replace')
        print(f"  认证插件: {auth_plugin}")


def parse_capability_flags(flags):
    """解析并打印关键能力标志"""
    key_flags = {
        (1 << 0):  "CLIENT_LONG_PASSWORD",
        (1 << 1):  "CLIENT_FOUND_ROWS",
        (1 << 2):  "CLIENT_LONG_FLAG",
        (1 << 3):  "CLIENT_CONNECT_WITH_DB",
        (1 << 4):  "CLIENT_NO_SCHEMA",
        (1 << 5):  "CLIENT_COMPRESS",
        (1 << 6):  "CLIENT_ODBC",
        (1 << 7):  "CLIENT_LOCAL_FILES",
        (1 << 8):  "CLIENT_IGNORE_SPACE",
        (1 << 9):  "CLIENT_PROTOCOL_41",
        (1 << 10): "CLIENT_INTERACTIVE",
        (1 << 11): "CLIENT_SSL",
        (1 << 13): "CLIENT_TRANSACTIONS",
        (1 << 14): "CLIENT_RESERVED",
        (1 << 15): "CLIENT_SECURE_CONNECTION",
        (1 << 16): "CLIENT_MULTI_STATEMENTS",
        (1 << 17): "CLIENT_MULTI_RESULTS",
        (1 << 18): "CLIENT_PS_MULTI_RESULTS",
        (1 << 19): "CLIENT_PLUGIN_AUTH",
        (1 << 20): "CLIENT_CONNECT_ATTRS",
        (1 << 21): "CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA",
        (1 << 22): "CLIENT_CAN_HANDLE_EXPIRED_PASSWORDS",
        (1 << 23): "CLIENT_SESSION_TRACK",
        (1 << 25): "CLIENT_DEPRECATE_EOF",
        (1 << 27): "CLIENT_OPTIONAL_RESULTSET_METADATA",
        (1 << 29): "CLIENT_ZSTD_COMPRESSION_ALGORITHM",
        (1 << 30): "CLIENT_QUERY_ATTRIBUTES",
        (1 << 31): "MULTI_FACTOR_AUTHENTICATION",
    }

    print("\n  已启用的能力标志:")
    for bit, name in sorted(key_flags.items()):
        if flags & bit:
            print(f"    ✓ {name} (0x{bit:08X})")


if __name__ == '__main__':
    capture_handshake(host='127.0.0.1', port=3306)

# 启动 MySQL 服务（如果未运行）
sudo systemctl start mysql

# 运行捕获脚本
python3 mysql_handshake_capture.py

# 方法一：使用 tshark 命令行
sudo tshark -i lo -f "tcp port 3306" -Y "mysql" -V

# 方法二：先抓包保存，再分析
sudo tshark -i lo -f "tcp port 3306" -w mysql_capture.pcap
# 然后在 Wireshark 中打开 mysql_capture.pcap

# 方法三：使用 tcpdump
sudo tcpdump -i lo port 3306 -w mysql_capture.pcap

# 查看 MySQL 监听端口
ss -tlnp | grep mysql
# 输出: LISTEN  0  128  *:3306  *:*  users:(("mysqld",pid=1234,fd=34))

-- 查看当前超时设置
SHOW VARIABLES LIKE '%timeout%';

-- 查看当前连接数
SHOW STATUS LIKE 'Threads_connected';

# 克隆 PyMySQL（纯 Python，易于阅读）
git clone https://github.com/PyMySQL/PyMySQL.git
# 核心协议代码在 pymysql/protocol.py 和 pymysql/connections.py

# 克隆 Go 驱动
git clone https://github.com/go-sql-driver/mysql.git
# 核心协议代码在 packets.go