Parsec fails in MariaDB 11.8.4

[bgrainger]

Software versions
MySqlConnector version: 2.5.0-beta.1
Server type (MySQL, MariaDB, Aurora, etc.) and version: MariaDB 11.8.4
.NET version: 10

Describe the bug

IntegrationTests.SslTests.ConnectZeroConfigurationSslParsec fails with mariadb:11.8.4 but not mariadb:11.8.3.

Exception

 Failed IntegrationTests.SslTests.ConnectZeroConfigurationSslParsec [19 ms]
  Error Message:
   MySqlConnector.MySqlException : Couldn't connect to server
---- System.ArgumentException : Invalid extended salt (Parameter 'authenticationData')
  Stack Trace:
     at MySqlConnector.Core.ServerSession.ConnectAsync(ConnectionSettings cs, MySqlConnection connection, Int64 startingTimestamp, ILoadBalancer loadBalancer, Activity activity, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/ServerSession.cs:line 650
   at MySqlConnector.Core.ServerSession.ConnectAndRedirectAsync(ILogger connectionLogger, ILogger poolLogger, IConnectionPoolMetadata pool, ConnectionSettings cs, ILoadBalancer loadBalancer, MySqlConnection connection, Action`4 logMessage, Int64 startingTimestamp, Activity activity, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/ServerSession.cs:line 720
   at MySqlConnector.Core.ServerSession.ConnectAndRedirectAsync(ILogger connectionLogger, ILogger poolLogger, IConnectionPoolMetadata pool, ConnectionSettings cs, ILoadBalancer loadBalancer, MySqlConnection connection, Action`4 logMessage, Int64 startingTimestamp, Activity activity, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/ServerSession.cs:line 725
   at MySqlConnector.Core.ConnectionPool.GetSessionAsync(MySqlConnection connection, Int64 startingTimestamp, Int32 timeoutMilliseconds, Activity activity, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/ConnectionPool.cs:line 116
   at MySqlConnector.Core.ConnectionPool.GetSessionAsync(MySqlConnection connection, Int64 startingTimestamp, Int32 timeoutMilliseconds, Activity activity, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/ConnectionPool.cs:line 35
   at MySqlConnector.MySqlConnection.CreateSessionAsync(ConnectionPool pool, Int64 startingTimestamp, Activity activity, Nullable`1 ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/MySqlConnection.cs:line 1089
   at MySqlConnector.MySqlConnection.OpenAsync(Nullable`1 ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/MySqlConnection.cs:line 562
   at IntegrationTests.SslTests.ConnectZeroConfigurationSslParsec() in /_/tests/IntegrationTests/SslTests.cs:line 264

CC @rusher

[bgrainger]

MariaDB 11.8.3 sends a 20-byte "ext-salt" that starts with P, as per this documentation: https://mariadb.com/docs/server/reference/clientserver-protocol/1-connecting/connection#parsec-plugin

MariaDB 11.8.4 sends a 21-byte "ext-salt" that has 0x01 then 'P' and the rest of the salt. On first glance, this appears to be a regression in MariaDB 11.8.4 where it's not following the documented protocol.

[bgrainger]

Copilot analysis:

Summary

I found the commit that introduced the change in the parsec plugin's ext-salt behavior between MariaDB 11.8.3 and 11.8.4:

Commit: MariaDB/server@2a722fc
Title: MDEV-37554 MariaDB auth protocol differs from MySQL
Author: Sergei Golubchik
Date: Tue Oct 14 17:14:10 2025 +0200

What Changed

The commit modified sql/sql_acl.cc in the server_mpvio_write_packet() function. Previously, the code had logic to avoid sending plugin data packets starting with certain bytes (0, 1, 254, 255) because they could be confused with OK, ERROR, or "change plugin" packets.

Before (11.8.3): Plugin data was sent directly via my_net_write() when it didn't start with problematic bytes.

After (11.8.4): ALL plugin data packets are now prefixed with a 1-byte header using net_write_command(), which adds 0x01 to the beginning of the packet.

Impact on Parsec Plugin

The parsec plugin sends the ext-salt using:

vio->write_packet(vio, (uchar*)info->auth_string, 2 + CHALLENGE_SALT_LENGTH)

• 11.8.3: Sent 20 bytes directly (algorithm 'P' + iterations + 18-byte salt)
• 11.8.4: The 0x01 prefix is now added by the protocol layer, resulting in 21 bytes total (0x01 + 'P' + iterations + 18-byte salt)

This is a protocol-level change to match MySQL's behavior and affects all authentication plugins, not just parsec.

[bgrainger]

Pushed a fix to handle an optional 0x01 leading byte, but this is an unexpected on-the-wire protocol change from a MariaDB patch release.

[vuvova]

Sorry for the trouble and thanks for fixing it quickly!