Skip to content

M
mariadb
Commit 97687f28 authored by Sergei Golubchik's avatar Sergei Golubchik
Browse files
Options

Fix hostcache_ipv4_blocked and hostcache_ipv6_blocked to pass. 

Don't abort plugin reads whem mpvio->make_it_fail is set - this can leak information.
parent 06bdc441
Show whitespace changes
Inline Side-by-side
Showing with 21 additions and 30 deletions
mysql-test/r/plugin_auth_qa_3.result
View file @ 97687f28
...@@ -6,6 +6,6 @@ exec MYSQL --default_auth=qa_auth_client -h localhost -P MASTER_MYPORT -u qa_tes ...@@ -6,6 +6,6 @@ exec MYSQL --default_auth=qa_auth_client -h localhost -P MASTER_MYPORT -u qa_tes
current_user() user() @@local.proxy_user @@local.external_user current_user() user() @@local.proxy_user @@local.external_user
qa_test_11_dest@% qa_test_11_user@localhost 'qa_test_11_user'@'%' NULL qa_test_11_dest@% qa_test_11_user@localhost 'qa_test_11_user'@'%' NULL
exec MYSQL --default_auth=qa_auth_client -h localhost -P MASTER_MYPORT -u qa_test_2_user --password=qa_test_11_dest test_user_db -e "SELECT current_user(),user(),@@local.proxy_user,@@local.external_user;" 2>&1 exec MYSQL --default_auth=qa_auth_client -h localhost -P MASTER_MYPORT -u qa_test_2_user --password=qa_test_11_dest test_user_db -e "SELECT current_user(),user(),@@local.proxy_user,@@local.external_user;" 2>&1
ERROR 1045 (28000): Access denied for user 'qa_test_2_user'@'localhost' (using password: NO) ERROR 1045 (28000): Access denied for user 'qa_test_2_user'@'localhost' (using password: YES)
DROP USER qa_test_11_user, qa_test_11_dest; DROP USER qa_test_11_user, qa_test_11_dest;
DROP DATABASE test_user_db; DROP DATABASE test_user_db;
mysql-test/suite/perfschema/r/hostcache_ipv4_blocked.result
View file @ 97687f28
...@@ -32,7 +32,7 @@ select current_user(); ...@@ -32,7 +32,7 @@ select current_user();
current_user() current_user()
root@localhost root@localhost
set global debug_dbug= "+d,vio_peer_addr_fake_ipv4,getnameinfo_fake_ipv4,getaddrinfo_fake_good_ipv4,native_password_bad_reply"; set global debug_dbug= "+d,vio_peer_addr_fake_ipv4,getnameinfo_fake_ipv4,getaddrinfo_fake_good_ipv4,native_password_bad_reply";
ERROR 28000: Access denied for user 'quota'@'santa.claus.ipv4.example.com' (using password: NO) ERROR 08S01: Bad handshake
"Dumping performance_schema.host_cache" "Dumping performance_schema.host_cache"
IP 192.0.2.4 IP 192.0.2.4
HOST santa.claus.ipv4.example.com HOST santa.claus.ipv4.example.com
...@@ -61,7 +61,7 @@ COUNT_LOCAL_ERRORS 0 ...@@ -61,7 +61,7 @@ COUNT_LOCAL_ERRORS 0
COUNT_UNKNOWN_ERRORS 0 COUNT_UNKNOWN_ERRORS 0
FIRST_ERROR_SEEN set FIRST_ERROR_SEEN set
LAST_ERROR_SEEN set LAST_ERROR_SEEN set
ERROR 28000: Access denied for user 'quota'@'santa.claus.ipv4.example.com' (using password: NO) ERROR 08S01: Bad handshake
"Dumping performance_schema.host_cache" "Dumping performance_schema.host_cache"
IP 192.0.2.4 IP 192.0.2.4
HOST santa.claus.ipv4.example.com HOST santa.claus.ipv4.example.com
...@@ -90,7 +90,7 @@ COUNT_LOCAL_ERRORS 0 ...@@ -90,7 +90,7 @@ COUNT_LOCAL_ERRORS 0
COUNT_UNKNOWN_ERRORS 0 COUNT_UNKNOWN_ERRORS 0
FIRST_ERROR_SEEN set FIRST_ERROR_SEEN set
LAST_ERROR_SEEN set LAST_ERROR_SEEN set
ERROR 28000: Access denied for user 'quota'@'santa.claus.ipv4.example.com' (using password: NO) ERROR 08S01: Bad handshake
"Dumping performance_schema.host_cache" "Dumping performance_schema.host_cache"
IP 192.0.2.4 IP 192.0.2.4
HOST santa.claus.ipv4.example.com HOST santa.claus.ipv4.example.com
...@@ -178,7 +178,7 @@ COUNT_UNKNOWN_ERRORS 0 ...@@ -178,7 +178,7 @@ COUNT_UNKNOWN_ERRORS 0
FIRST_ERROR_SEEN set FIRST_ERROR_SEEN set
LAST_ERROR_SEEN set LAST_ERROR_SEEN set
flush hosts; flush hosts;
ERROR 28000: Access denied for user 'quota'@'santa.claus.ipv4.example.com' (using password: NO) ERROR 08S01: Bad handshake
"Dumping performance_schema.host_cache" "Dumping performance_schema.host_cache"
IP 192.0.2.4 IP 192.0.2.4
HOST santa.claus.ipv4.example.com HOST santa.claus.ipv4.example.com
......
mysql-test/suite/perfschema/r/hostcache_ipv6_blocked.result
View file @ 97687f28
...@@ -32,7 +32,7 @@ select current_user(); ...@@ -32,7 +32,7 @@ select current_user();
current_user() current_user()
root@localhost root@localhost
set global debug_dbug= "+d,vio_peer_addr_fake_ipv6,getnameinfo_fake_ipv6,getaddrinfo_fake_good_ipv6,native_password_bad_reply"; set global debug_dbug= "+d,vio_peer_addr_fake_ipv6,getnameinfo_fake_ipv6,getaddrinfo_fake_good_ipv6,native_password_bad_reply";
ERROR 28000: Access denied for user 'quota'@'santa.claus.ipv6.example.com' (using password: NO) ERROR 08S01: Bad handshake
"Dumping performance_schema.host_cache" "Dumping performance_schema.host_cache"
IP 2001:db8::6:6 IP 2001:db8::6:6
HOST santa.claus.ipv6.example.com HOST santa.claus.ipv6.example.com
...@@ -61,7 +61,7 @@ COUNT_LOCAL_ERRORS 0 ...@@ -61,7 +61,7 @@ COUNT_LOCAL_ERRORS 0
COUNT_UNKNOWN_ERRORS 0 COUNT_UNKNOWN_ERRORS 0
FIRST_ERROR_SEEN set FIRST_ERROR_SEEN set
LAST_ERROR_SEEN set LAST_ERROR_SEEN set
ERROR 28000: Access denied for user 'quota'@'santa.claus.ipv6.example.com' (using password: NO) ERROR 08S01: Bad handshake
"Dumping performance_schema.host_cache" "Dumping performance_schema.host_cache"
IP 2001:db8::6:6 IP 2001:db8::6:6
HOST santa.claus.ipv6.example.com HOST santa.claus.ipv6.example.com
...@@ -90,7 +90,7 @@ COUNT_LOCAL_ERRORS 0 ...@@ -90,7 +90,7 @@ COUNT_LOCAL_ERRORS 0
COUNT_UNKNOWN_ERRORS 0 COUNT_UNKNOWN_ERRORS 0
FIRST_ERROR_SEEN set FIRST_ERROR_SEEN set
LAST_ERROR_SEEN set LAST_ERROR_SEEN set
ERROR 28000: Access denied for user 'quota'@'santa.claus.ipv6.example.com' (using password: NO) ERROR 08S01: Bad handshake
"Dumping performance_schema.host_cache" "Dumping performance_schema.host_cache"
IP 2001:db8::6:6 IP 2001:db8::6:6
HOST santa.claus.ipv6.example.com HOST santa.claus.ipv6.example.com
...@@ -178,7 +178,7 @@ COUNT_UNKNOWN_ERRORS 0 ...@@ -178,7 +178,7 @@ COUNT_UNKNOWN_ERRORS 0
FIRST_ERROR_SEEN set FIRST_ERROR_SEEN set
LAST_ERROR_SEEN set LAST_ERROR_SEEN set
flush hosts; flush hosts;
ERROR 28000: Access denied for user 'quota'@'santa.claus.ipv6.example.com' (using password: NO) ERROR 08S01: Bad handshake
"Dumping performance_schema.host_cache" "Dumping performance_schema.host_cache"
IP 2001:db8::6:6 IP 2001:db8::6:6
HOST santa.claus.ipv6.example.com HOST santa.claus.ipv6.example.com
......
mysql-test/suite/perfschema/t/hostcache_ipv4_blocked.test
View file @ 97687f28
...@@ -31,7 +31,7 @@ disconnect con1; ...@@ -31,7 +31,7 @@ disconnect con1;
set global debug_dbug= "+d,vio_peer_addr_fake_ipv4,getnameinfo_fake_ipv4,getaddrinfo_fake_good_ipv4,native_password_bad_reply"; set global debug_dbug= "+d,vio_peer_addr_fake_ipv4,getnameinfo_fake_ipv4,getaddrinfo_fake_good_ipv4,native_password_bad_reply";
--disable_query_log --disable_query_log
--error ER_ACCESS_DENIED_ERROR --error ER_HANDSHAKE_ERROR
connect (con2a,"127.0.0.1",quota,,test,$MASTER_MYPORT,); connect (con2a,"127.0.0.1",quota,,test,$MASTER_MYPORT,);
--enable_query_log --enable_query_log
...@@ -39,7 +39,7 @@ connect (con2a,"127.0.0.1",quota,,test,$MASTER_MYPORT,); ...@@ -39,7 +39,7 @@ connect (con2a,"127.0.0.1",quota,,test,$MASTER_MYPORT,);
--source ../include/hostcache_dump.inc --source ../include/hostcache_dump.inc
--disable_query_log --disable_query_log
--error ER_ACCESS_DENIED_ERROR --error ER_HANDSHAKE_ERROR
connect (con2b,"127.0.0.1",quota,,test,$MASTER_MYPORT,); connect (con2b,"127.0.0.1",quota,,test,$MASTER_MYPORT,);
--enable_query_log --enable_query_log
...@@ -47,7 +47,7 @@ connect (con2b,"127.0.0.1",quota,,test,$MASTER_MYPORT,); ...@@ -47,7 +47,7 @@ connect (con2b,"127.0.0.1",quota,,test,$MASTER_MYPORT,);
--source ../include/hostcache_dump.inc --source ../include/hostcache_dump.inc
--disable_query_log --disable_query_log
--error ER_ACCESS_DENIED_ERROR --error ER_HANDSHAKE_ERROR
connect (con2c,"127.0.0.1",quota,,test,$MASTER_MYPORT,); connect (con2c,"127.0.0.1",quota,,test,$MASTER_MYPORT,);
--enable_query_log --enable_query_log
...@@ -74,7 +74,7 @@ connect (con2e,"127.0.0.1",quota,,test,$MASTER_MYPORT,); ...@@ -74,7 +74,7 @@ connect (con2e,"127.0.0.1",quota,,test,$MASTER_MYPORT,);
flush hosts; flush hosts;
--disable_query_log --disable_query_log
--error ER_ACCESS_DENIED_ERROR --error ER_HANDSHAKE_ERROR
connect (con2c,"127.0.0.1",quota,,test,$MASTER_MYPORT,); connect (con2c,"127.0.0.1",quota,,test,$MASTER_MYPORT,);
--enable_query_log --enable_query_log
......
mysql-test/suite/perfschema/t/hostcache_ipv6_blocked.test
View file @ 97687f28
...@@ -32,7 +32,7 @@ disconnect con1; ...@@ -32,7 +32,7 @@ disconnect con1;
set global debug_dbug= "+d,vio_peer_addr_fake_ipv6,getnameinfo_fake_ipv6,getaddrinfo_fake_good_ipv6,native_password_bad_reply"; set global debug_dbug= "+d,vio_peer_addr_fake_ipv6,getnameinfo_fake_ipv6,getaddrinfo_fake_good_ipv6,native_password_bad_reply";
--disable_query_log --disable_query_log
--error ER_ACCESS_DENIED_ERROR --error ER_HANDSHAKE_ERROR
connect (con2a,"::1",quota,,test,$MASTER_MYPORT,); connect (con2a,"::1",quota,,test,$MASTER_MYPORT,);
--enable_query_log --enable_query_log
...@@ -40,7 +40,7 @@ connect (con2a,"::1",quota,,test,$MASTER_MYPORT,); ...@@ -40,7 +40,7 @@ connect (con2a,"::1",quota,,test,$MASTER_MYPORT,);
--source ../include/hostcache_dump.inc --source ../include/hostcache_dump.inc
--disable_query_log --disable_query_log
--error ER_ACCESS_DENIED_ERROR --error ER_HANDSHAKE_ERROR
connect (con2b,"::1",quota,,test,$MASTER_MYPORT,); connect (con2b,"::1",quota,,test,$MASTER_MYPORT,);
--enable_query_log --enable_query_log
...@@ -48,7 +48,7 @@ connect (con2b,"::1",quota,,test,$MASTER_MYPORT,); ...@@ -48,7 +48,7 @@ connect (con2b,"::1",quota,,test,$MASTER_MYPORT,);
--source ../include/hostcache_dump.inc --source ../include/hostcache_dump.inc
--disable_query_log --disable_query_log
--error ER_ACCESS_DENIED_ERROR --error ER_HANDSHAKE_ERROR
connect (con2c,"::1",quota,,test,$MASTER_MYPORT,); connect (con2c,"::1",quota,,test,$MASTER_MYPORT,);
--enable_query_log --enable_query_log
...@@ -75,7 +75,7 @@ connect (con2e,"::1",quota,,test,$MASTER_MYPORT,); ...@@ -75,7 +75,7 @@ connect (con2e,"::1",quota,,test,$MASTER_MYPORT,);
flush hosts; flush hosts;
--disable_query_log --disable_query_log
--error ER_ACCESS_DENIED_ERROR --error ER_HANDSHAKE_ERROR
connect (con2c,"::1",quota,,test,$MASTER_MYPORT,); connect (con2c,"::1",quota,,test,$MASTER_MYPORT,);
--enable_query_log --enable_query_log
......
sql/sql_acl.cc
View file @ 97687f28
...@@ -11728,9 +11728,6 @@ static int server_mpvio_read_packet(MYSQL_PLUGIN_VIO *param, uchar **buf) ...@@ -11728,9 +11728,6 @@ static int server_mpvio_read_packet(MYSQL_PLUGIN_VIO *param, uchar **buf)
mpvio->cached_client_reply.pkt= 0; mpvio->cached_client_reply.pkt= 0;
mpvio->packets_read++; mpvio->packets_read++;
if (mpvio->make_it_fail)
goto err;
DBUG_RETURN ((int) mpvio->cached_client_reply.pkt_len); DBUG_RETURN ((int) mpvio->cached_client_reply.pkt_len);
} }
...@@ -11765,22 +11762,14 @@ static int server_mpvio_read_packet(MYSQL_PLUGIN_VIO *param, uchar **buf) ...@@ -11765,22 +11762,14 @@ static int server_mpvio_read_packet(MYSQL_PLUGIN_VIO *param, uchar **buf)
else else
*buf= mpvio->thd->net.read_pos; *buf= mpvio->thd->net.read_pos;
if (mpvio->make_it_fail)
goto err;
DBUG_RETURN((int)pkt_len); DBUG_RETURN((int)pkt_len);
err: err:
if (mpvio->status == MPVIO_EXT::FAILURE) if (mpvio->status == MPVIO_EXT::FAILURE)
{ {
if (!mpvio->thd->is_error()) if (!mpvio->thd->is_error())
{
if (mpvio->make_it_fail)
login_failed_error(mpvio->thd);
else
my_error(ER_HANDSHAKE_ERROR, MYF(0)); my_error(ER_HANDSHAKE_ERROR, MYF(0));
} }
}
DBUG_RETURN(-1); DBUG_RETURN(-1);
} }
...@@ -12044,7 +12033,7 @@ bool acl_authenticate(THD *thd, uint connect_errors, ...@@ -12044,7 +12033,7 @@ bool acl_authenticate(THD *thd, uint connect_errors,
auth_plugin_name= &mpvio.acl_user->plugin; auth_plugin_name= &mpvio.acl_user->plugin;
res= do_auth_once(thd, auth_plugin_name, &mpvio); res= do_auth_once(thd, auth_plugin_name, &mpvio);
} }
if (mpvio.make_it_fail) if (mpvio.make_it_fail && res == CR_OK)
{ {
mpvio.status= MPVIO_EXT::FAILURE; mpvio.status= MPVIO_EXT::FAILURE;
res= CR_ERROR; res= CR_ERROR;
...@@ -12342,6 +12331,8 @@ static int native_password_authenticate(MYSQL_PLUGIN_VIO *vio, ...@@ -12342,6 +12331,8 @@ static int native_password_authenticate(MYSQL_PLUGIN_VIO *vio,
DBUG_RETURN(CR_OK); DBUG_RETURN(CR_OK);
#endif #endif
DBUG_EXECUTE_IF("native_password_bad_reply", { pkt_len= 12; });
if (pkt_len == 0) /* no password */ if (pkt_len == 0) /* no password */
DBUG_RETURN(mpvio->acl_user->salt_len != 0 ? CR_AUTH_USER_CREDENTIALS : CR_OK); DBUG_RETURN(mpvio->acl_user->salt_len != 0 ? CR_AUTH_USER_CREDENTIALS : CR_OK);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7