Skip to content
Permalink
Browse files

MDEV-19879 server can send empty error message to client with pam_use…

…_cleartext_plugin

fixed in MDEV-19878, here just adding tests
  • Loading branch information...
vuvova committed Jun 30, 2019
1 parent 3914a79 commit 4f87ad1975fd02bec3a2558069127d8cd1ff1dd7
@@ -8,6 +8,14 @@ pam_use_cleartext_plugin ON
#
# same test as in pam.test now fails
#
#
# success
#
user() current_user() database()
test_pam@localhost pam_test@% NULL
#
# failure
#
drop user test_pam;
drop user pam_test;
uninstall plugin pam;
@@ -14,9 +14,22 @@ EOF
--echo #
--error 1
--exec $MYSQL_TEST -u test_pam --plugin-dir=$plugindir < $MYSQLTEST_VARDIR/tmp/pam_good.txt
--error 1
--exec $MYSQL_TEST -u test_pam --plugin-dir=$plugindir -p'something' < $MYSQLTEST_VARDIR/tmp/pam_good.txt

--remove_file $MYSQLTEST_VARDIR/tmp/pam_good.txt

--echo #
--echo # success
--echo #
--exec $MYSQL -u test_pam --plugin-dir=$plugindir -p'cleartext good' -e 'select user(), current_user(), database()'

--echo #
--echo # failure
--echo #
--error 1
--exec $MYSQL -u test_pam --plugin-dir=$plugindir -p'cleartext bad' -e 'select user(), current_user(), database()'

drop user test_pam;
drop user pam_test;
let $count_sessions= 1;
@@ -38,23 +38,29 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
if (pam_err != PAM_SUCCESS || !resp || !((r1= resp[1].resp)))
goto ret;

free(resp);

msg[0].msg_style = PAM_PROMPT_ECHO_ON;
msg[0].msg = "PIN:";
pam_err = (*conv->conv)(1, msgp, &resp, conv->appdata_ptr);

if (pam_err != PAM_SUCCESS || !resp || !((r2= resp[0].resp)))
goto ret;

/* Produce the crash for testing purposes. */
if (strcmp(r1, "crash pam module") == 0 && atoi(r2) == 616)
abort();

if (strlen(r1) == (uint)atoi(r2) % 100)
if (strcmp(r1, "cleartext good") == 0)
retval = PAM_SUCCESS;
else
else if (strcmp(r1, "cleartext bad") == 0)
retval = PAM_AUTH_ERR;
else
{
free(resp);
msg[0].msg_style = PAM_PROMPT_ECHO_ON;
msg[0].msg = "PIN:";
pam_err = (*conv->conv)(1, msgp, &resp, conv->appdata_ptr);

if (pam_err != PAM_SUCCESS || !resp || !((r2= resp[0].resp)))
goto ret;

/* Produce the crash for testing purposes. */
if (strcmp(r1, "crash pam module") == 0 && atoi(r2) == 616)
abort();

if (strlen(r1) == (uint)atoi(r2) % 100)
retval = PAM_SUCCESS;
else
retval = PAM_AUTH_ERR;
}

if (argc > 0 && argv[0])
pam_set_item(pamh, PAM_USER, argv[0]);

0 comments on commit 4f87ad1

Please sign in to comment.
You can’t perform that action at this time.