Skip to content

M
MariaDB
Commit 5f051022 authored by Sergei Golubchik's avatar Sergei Golubchik
Browse files
Options

MDEV-16238 root/localhost authn prioritizes authentication_string over Password 

Don't let SET PASSWORD to set the password, if auth_string is set.

Now SET PASSWORD always sets the plugin/auth_string fields and clears
the password field (on pre-plugin mysql.user table it works as before).
parent b4db59ba
Show whitespace changes
Inline Side-by-side
Showing with 138 additions and 104 deletions
mysql-test/r/grant2.result
View file @ 5f051022
......@@ -372,8 +372,8 @@ mysqltest_1@127.0.0.1
set password = password('changed');
disconnect b12302;
connection default;
select host, length(password) from mysql.user where user like 'mysqltest\_1';
host length(password)
select host, length(authentication_string) from mysql.user where user like 'mysqltest\_1';
host length(authentication_string)
127.0.0.1 41
revoke all on mysqltest_1.* from mysqltest_1@'127.0.0.1';
delete from mysql.user where user like 'mysqltest\_1';
......@@ -387,8 +387,8 @@ mysqltest_1@127.0.0.0/255.0.0.0
set password = password('changed');
disconnect b12302_2;
connection default;
select host, length(password) from mysql.user where user like 'mysqltest\_1';
host length(password)
select host, length(authentication_string) from mysql.user where user like 'mysqltest\_1';
host length(authentication_string)
127.0.0.0/255.0.0.0 41
revoke all on mysqltest_1.* from mysqltest_1@'127.0.0.0/255.0.0.0';
delete from mysql.user where user like 'mysqltest\_1';
......
mysql-test/r/set_password_plugin-9835.result → mysql-test/r/set_password.result
View file @ 5f051022
......@@ -11,10 +11,10 @@ select user, host, password, plugin, authentication_string from mysql.user where
user host password plugin authentication_string
natauth localhost *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29
newpass localhost *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29
newpassnat localhost *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29
newpassnat localhost mysql_native_password *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29
oldauth localhost 378b243e220ca493
oldpass localhost 378b243e220ca493
oldpassold localhost 378b243e220ca493
oldpassold localhost mysql_old_password 378b243e220ca493
connect con,localhost,natauth,test,;
select current_user();
current_user()
......@@ -86,12 +86,12 @@ set password for oldpass@localhost = PASSWORD('test2');
set password for oldpassold@localhost = PASSWORD('test2');
select user, host, password, plugin, authentication_string from mysql.user where user != 'root';
user host password plugin authentication_string
natauth localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
newpass localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
newpassnat localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldauth localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldpass localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldpassold localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
natauth localhost mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
newpass localhost mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
newpassnat localhost mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldauth localhost mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldpass localhost mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldpassold localhost mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
connect con,localhost,natauth,test2,;
select current_user();
current_user()
......@@ -158,3 +158,20 @@ connection default;
drop user natauth@localhost, newpass@localhost, newpassnat@localhost;
drop user oldauth@localhost, oldpass@localhost, oldpassold@localhost;
set global secure_auth=default;
create user foo@localhost identified with mysql_native_password;
update mysql.user set authentication_string=password('foo'), plugin='mysql_native_password' where user='foo' and host='localhost';
set password for 'foo'@'localhost' = password('bar');
flush privileges;
connect foo, localhost, foo, bar;
select user(), current_user();
user() current_user()
foo@localhost foo@localhost
show grants;
Grants for foo@localhost
GRANT USAGE ON *.* TO 'foo'@'localhost' IDENTIFIED BY PASSWORD '*E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB'
disconnect foo;
connection default;
select user,host,password,plugin,authentication_string from mysql.user where user='foo';
user host password plugin authentication_string
foo localhost mysql_native_password *E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB
drop user foo@localhost;
mysql-test/r/show_grants_with_plugin-7985.result
View file @ 5f051022
......@@ -71,7 +71,7 @@ connection default;
set password for u1 = PASSWORD('SOMETHINGELSE');
select user, host, password, plugin, authentication_string from mysql.user where user = 'u1';
user host password plugin authentication_string
u1 % *054B7BBD2B9A553DA560520DCD3F76DA2D81B7C6
u1 % mysql_native_password *054B7BBD2B9A553DA560520DCD3F76DA2D81B7C6
#
# Here we should use the password field, as that primes over
# the authentication_string field.
......@@ -112,7 +112,7 @@ connection default;
# Now we remove the authentication plugin password, flush privileges and
# try again.
#
update mysql.user set authentication_string = '' where user='u1';
update mysql.user set password=authentication_string, plugin='', authentication_string='' where user='u1';
select user, host, password, plugin, authentication_string from mysql.user where user = 'u1';
user host password plugin authentication_string
u1 % *054B7BBD2B9A553DA560520DCD3F76DA2D81B7C6
......@@ -172,7 +172,7 @@ connection default;
set password for u1 = '';
select user, host, password, plugin, authentication_string from mysql.user where user = 'u1';
user host password plugin authentication_string
u1 %
u1 % mysql_native_password
#
# Test no password connect.
#
......
mysql-test/suite/rpl/include/rpl_mixed_check_user.inc
View file @ 5f051022
......@@ -5,9 +5,9 @@
# Requirements:
#########################################
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
sync_slave_with_master;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
connection master;
mysql-test/suite/rpl/r/rpl_do_grant.result
View file @ 5f051022
......@@ -20,21 +20,21 @@ GRANT DROP ON `test`.* TO 'rpl_do_grant'@'localhost'
connection master;
set password for rpl_do_grant@localhost=password("does it work?");
connection slave;
select password<>_binary'' from mysql.user where user=_binary'rpl_do_grant';
password<>_binary''
select authentication_string<>_binary'' from mysql.user where user=_binary'rpl_do_grant';
authentication_string<>_binary''
1
connection master;
update mysql.user set password='' where user='rpl_do_grant';
update mysql.user set authentication_string='' where user='rpl_do_grant';
flush privileges;
select password<>'' from mysql.user where user='rpl_do_grant';
password<>''
select authentication_string<>'' from mysql.user where user='rpl_do_grant';
authentication_string<>''
0
set sql_mode='ANSI_QUOTES';
set password for rpl_do_grant@localhost=password('does it work?');
set sql_mode='';
connection slave;
select password<>'' from mysql.user where user='rpl_do_grant';
password<>''
select authentication_string<>'' from mysql.user where user='rpl_do_grant';
authentication_string<>''
1
connection master;
delete from mysql.user where user=_binary'rpl_do_grant';
......
mysql-test/suite/rpl/r/rpl_innodb_mixed_dml.result
View file @ 5f051022
......@@ -480,72 +480,72 @@ SET TRANSACTION ISOLATION LEVEL SERIALIZABLE;
******************** CREATE USER ********************
CREATE USER 'user_test_rpl'@'localhost' IDENTIFIED BY PASSWORD '*1111111111111111111111111111111111111111';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 N
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 N
connection master;
******************** GRANT ********************
GRANT SELECT ON *.* TO 'user_test_rpl'@'localhost';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 Y
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 Y
connection master;
******************** REVOKE ********************
REVOKE SELECT ON *.* FROM 'user_test_rpl'@'localhost';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 N
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 N
connection master;
******************** SET PASSWORD ********************
SET PASSWORD FOR 'user_test_rpl'@'localhost' = '*0000000000000000000000000000000000000000';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
localhost user_test_rpl *0000000000000000000000000000000000000000 N
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl mysql_native_password *0000000000000000000000000000000000000000 N
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
localhost user_test_rpl *0000000000000000000000000000000000000000 N
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl mysql_native_password *0000000000000000000000000000000000000000 N
connection master;
******************** RENAME USER ********************
RENAME USER 'user_test_rpl'@'localhost' TO 'user_test_rpl_2'@'localhost';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
localhost user_test_rpl_2 *0000000000000000000000000000000000000000 N
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl_2 mysql_native_password *0000000000000000000000000000000000000000 N
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
localhost user_test_rpl_2 *0000000000000000000000000000000000000000 N
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl_2 mysql_native_password *0000000000000000000000000000000000000000 N
connection master;
******************** DROP USER ********************
DROP USER 'user_test_rpl_2'@'localhost';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
connection master;
INSERT INTO t1 VALUES(100, 'test');
......
mysql-test/suite/rpl/t/rpl_do_grant.test
View file @ 5f051022
......@@ -27,20 +27,20 @@ show grants for rpl_do_grant@localhost;
connection master;
set password for rpl_do_grant@localhost=password("does it work?");
sync_slave_with_master;
select password<>_binary'' from mysql.user where user=_binary'rpl_do_grant';
select authentication_string<>_binary'' from mysql.user where user=_binary'rpl_do_grant';
#
# Bug#24158 SET PASSWORD in binary log fails under ANSI_QUOTES
#
connection master;
update mysql.user set password='' where user='rpl_do_grant';
update mysql.user set authentication_string='' where user='rpl_do_grant';
flush privileges;
select password<>'' from mysql.user where user='rpl_do_grant';
select authentication_string<>'' from mysql.user where user='rpl_do_grant';
set sql_mode='ANSI_QUOTES';
set password for rpl_do_grant@localhost=password('does it work?');
set sql_mode='';
sync_slave_with_master;
select password<>'' from mysql.user where user='rpl_do_grant';
select authentication_string<>'' from mysql.user where user='rpl_do_grant';
# clear what we have done, to not influence other tests.
......
mysql-test/t/grant2.test
View file @ 5f051022
......@@ -385,7 +385,7 @@ select current_user();
set password = password('changed');
disconnect b12302;
connection default;
select host, length(password) from mysql.user where user like 'mysqltest\_1';
select host, length(authentication_string) from mysql.user where user like 'mysqltest\_1';
revoke all on mysqltest_1.* from mysqltest_1@'127.0.0.1';
delete from mysql.user where user like 'mysqltest\_1';
flush privileges;
......@@ -396,7 +396,7 @@ select current_user();
set password = password('changed');
disconnect b12302_2;
connection default;
select host, length(password) from mysql.user where user like 'mysqltest\_1';
select host, length(authentication_string) from mysql.user where user like 'mysqltest\_1';
revoke all on mysqltest_1.* from mysqltest_1@'127.0.0.0/255.0.0.0';
delete from mysql.user where user like 'mysqltest\_1';
flush privileges;
......
mysql-test/t/set_password_plugin-9835.test → mysql-test/t/set_password.test
View file @ 5f051022
......@@ -129,3 +129,17 @@ drop user natauth@localhost, newpass@localhost, newpassnat@localhost;
drop user oldauth@localhost, oldpass@localhost, oldpassold@localhost;
set global secure_auth=default;
#
# MDEV-16238 root/localhost authn prioritizes authentication_string over Password
#
create user foo@localhost identified with mysql_native_password;
update mysql.user set authentication_string=password('foo'), plugin='mysql_native_password' where user='foo' and host='localhost';
set password for 'foo'@'localhost' = password('bar');
flush privileges;
--connect foo, localhost, foo, bar
select user(), current_user();
show grants;
--disconnect foo
--connection default
select user,host,password,plugin,authentication_string from mysql.user where user='foo';
drop user foo@localhost;
mysql-test/t/show_grants_with_plugin-7985.test
View file @ 5f051022
......@@ -91,7 +91,7 @@ show grants;
--echo # Now we remove the authentication plugin password, flush privileges and
--echo # try again.
--echo #
update mysql.user set authentication_string = '' where user='u1';
update mysql.user set password=authentication_string, plugin='', authentication_string='' where user='u1';
select user, host, password, plugin, authentication_string from mysql.user where user = 'u1';
flush privileges;
show grants for u1;
......
sql/sql_acl.cc
View file @ 5f051022
......@@ -3919,13 +3919,16 @@ static bool update_user_table(THD *thd, const User_table& user_table,
DBUG_RETURN(1); /* purecov: deadcode */
}
store_record(table,record[1]);
/* If the password column is missing, we use the
authentication_string column. */
if (user_table.password())
user_table.password()->store(new_password, new_password_len, system_charset_info);
else
if (user_table.plugin())
{
set_authentication_plugin_from_password(user_table, new_password,
new_password_len);
new_password_len= 0;
}
if (user_table.password())
user_table.password()->store(new_password, new_password_len, system_charset_info);
if ((error=table->file->ha_update_row(table->record[1],table->record[0])) &&
......
storage/tokudb/mysql-test/rpl/r/rpl_tokudb_mixed_dml.result
View file @ 5f051022
......@@ -483,72 +483,72 @@ SET TRANSACTION ISOLATION LEVEL SERIALIZABLE;
******************** CREATE USER ********************
CREATE USER 'user_test_rpl'@'localhost' IDENTIFIED BY PASSWORD '*1111111111111111111111111111111111111111';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 N
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 N
connection master;
******************** GRANT ********************
GRANT SELECT ON *.* TO 'user_test_rpl'@'localhost';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 Y
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 Y
connection master;
******************** REVOKE ********************
REVOKE SELECT ON *.* FROM 'user_test_rpl'@'localhost';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 N
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl *1111111111111111111111111111111111111111 N
connection master;
******************** SET PASSWORD ********************
SET PASSWORD FOR 'user_test_rpl'@'localhost' = '*0000000000000000000000000000000000000000';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
localhost user_test_rpl *0000000000000000000000000000000000000000 N
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl mysql_native_password *0000000000000000000000000000000000000000 N
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
localhost user_test_rpl *0000000000000000000000000000000000000000 N
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl mysql_native_password *0000000000000000000000000000000000000000 N
connection master;
******************** RENAME USER ********************
RENAME USER 'user_test_rpl'@'localhost' TO 'user_test_rpl_2'@'localhost';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
localhost user_test_rpl_2 *0000000000000000000000000000000000000000 N
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl_2 mysql_native_password *0000000000000000000000000000000000000000 N
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
localhost user_test_rpl_2 *0000000000000000000000000000000000000000 N
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
localhost user_test_rpl_2 mysql_native_password *0000000000000000000000000000000000000000 N
connection master;
******************** DROP USER ********************
DROP USER 'user_test_rpl_2'@'localhost';
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
connection slave;
USE test_rpl;
SELECT host, user, password, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password select_priv
SELECT host, user, password, plugin, authentication_string, select_priv FROM mysql.user WHERE user LIKE 'user_test_rpl%';
host user password plugin authentication_string select_priv
connection master;
INSERT INTO t1 VALUES(100, 'test');
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7