Skip to content

Commit 6bf866c

Browse files
vuvovavuvova
committed
MDEV-25641 max_password_errors not working with ed25519 auth plugin
report correct error codes in ed25519. Invalid value stored in the user table or an OpenSSL error is CR_ERROR. When a user provided incorrect password when logging in - it's CR_AUTH_USER_CREDENTIALS.
1 parent 681918a commit 6bf866c

File tree

3 files changed

+176
-4
lines changed

3 files changed

+176
-4
lines changed

‎mysql-test/suite/perfschema/r/hostcache_ipv4_auth_ed25519.result

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
install soname 'auth_ed25519';
2+
flush status;
3+
flush hosts;
4+
flush user_resources;
5+
flush privileges;
6+
select `User`, `Host` from mysql.`user` where `host` like '%\\%%';
7+
User Host
8+
select `User`, `Host` from mysql.`user` where `user` like '192.%';
9+
User Host
10+
select `User`, `Host` from mysql.`user` where `user` like '2001:%';
11+
User Host
12+
select `User`, `Host` from mysql.`user` where `user` like 'santa.claus.%';
13+
User Host
14+
create user plug1@'santa.claus.ipv4.example.com'
15+
identified with ed25519 as 'foo';
16+
create user plug2@'santa.claus.ipv4.example.com'
17+
identified with ED25519 as 'vubFBzIrapbfHct1/J72dnUryz5VS7lA6XHH8sIx4TI';
18+
set @saved_dbug = @@global.debug_dbug;
19+
set global debug_dbug= "+d,vio_peer_addr_fake_ipv4,getnameinfo_fake_ipv4,getaddrinfo_fake_good_ipv4";
20+
connect(127.0.0.1,plug1,foo,test,PORT,SOCKET);
21+
connect con1, 127.0.0.1, plug1,foo,,$MASTER_MYPORT;
22+
ERROR 28000: Access denied for user 'plug1'@'santa.claus.ipv4.example.com' (using password: NO)
23+
"Dumping performance_schema.host_cache"
24+
IP 192.0.2.4
25+
HOST santa.claus.ipv4.example.com
26+
HOST_VALIDATED YES
27+
SUM_CONNECT_ERRORS 0
28+
COUNT_HOST_BLOCKED_ERRORS 0
29+
COUNT_NAMEINFO_TRANSIENT_ERRORS 0
30+
COUNT_NAMEINFO_PERMANENT_ERRORS 0
31+
COUNT_FORMAT_ERRORS 0
32+
COUNT_ADDRINFO_TRANSIENT_ERRORS 0
33+
COUNT_ADDRINFO_PERMANENT_ERRORS 0
34+
COUNT_FCRDNS_ERRORS 0
35+
COUNT_HOST_ACL_ERRORS 0
36+
COUNT_NO_AUTH_PLUGIN_ERRORS 0
37+
COUNT_AUTH_PLUGIN_ERRORS 1
38+
COUNT_HANDSHAKE_ERRORS 0
39+
COUNT_PROXY_USER_ERRORS 0
40+
COUNT_PROXY_USER_ACL_ERRORS 0
41+
COUNT_AUTHENTICATION_ERRORS 0
42+
COUNT_SSL_ERRORS 0
43+
COUNT_MAX_USER_CONNECTIONS_ERRORS 0
44+
COUNT_MAX_USER_CONNECTIONS_PER_HOUR_ERRORS 0
45+
COUNT_DEFAULT_DATABASE_ERRORS 0
46+
COUNT_INIT_CONNECT_ERRORS 0
47+
COUNT_LOCAL_ERRORS 0
48+
COUNT_UNKNOWN_ERRORS 0
49+
FIRST_ERROR_SEEN set
50+
LAST_ERROR_SEEN set
51+
connect(127.0.0.1,plug2,bar,test,PORT,SOCKET);
52+
connect con1, 127.0.0.1, plug2,bar,,$MASTER_MYPORT;
53+
ERROR 28000: Access denied for user 'plug2'@'santa.claus.ipv4.example.com' (using password: YES)
54+
"Dumping performance_schema.host_cache"
55+
IP 192.0.2.4
56+
HOST santa.claus.ipv4.example.com
57+
HOST_VALIDATED YES
58+
SUM_CONNECT_ERRORS 0
59+
COUNT_HOST_BLOCKED_ERRORS 0
60+
COUNT_NAMEINFO_TRANSIENT_ERRORS 0
61+
COUNT_NAMEINFO_PERMANENT_ERRORS 0
62+
COUNT_FORMAT_ERRORS 0
63+
COUNT_ADDRINFO_TRANSIENT_ERRORS 0
64+
COUNT_ADDRINFO_PERMANENT_ERRORS 0
65+
COUNT_FCRDNS_ERRORS 0
66+
COUNT_HOST_ACL_ERRORS 0
67+
COUNT_NO_AUTH_PLUGIN_ERRORS 0
68+
COUNT_AUTH_PLUGIN_ERRORS 1
69+
COUNT_HANDSHAKE_ERRORS 0
70+
COUNT_PROXY_USER_ERRORS 0
71+
COUNT_PROXY_USER_ACL_ERRORS 0
72+
COUNT_AUTHENTICATION_ERRORS 1
73+
COUNT_SSL_ERRORS 0
74+
COUNT_MAX_USER_CONNECTIONS_ERRORS 0
75+
COUNT_MAX_USER_CONNECTIONS_PER_HOUR_ERRORS 0
76+
COUNT_DEFAULT_DATABASE_ERRORS 0
77+
COUNT_INIT_CONNECT_ERRORS 0
78+
COUNT_LOCAL_ERRORS 0
79+
COUNT_UNKNOWN_ERRORS 0
80+
FIRST_ERROR_SEEN set
81+
LAST_ERROR_SEEN set
82+
connect con1, 127.0.0.1, plug2,foo,,$MASTER_MYPORT;
83+
select current_user();
84+
current_user()
85+
plug2@santa.claus.ipv4.example.com
86+
disconnect con1;
87+
connection default;
88+
"Dumping performance_schema.host_cache"
89+
IP 192.0.2.4
90+
HOST santa.claus.ipv4.example.com
91+
HOST_VALIDATED YES
92+
SUM_CONNECT_ERRORS 0
93+
COUNT_HOST_BLOCKED_ERRORS 0
94+
COUNT_NAMEINFO_TRANSIENT_ERRORS 0
95+
COUNT_NAMEINFO_PERMANENT_ERRORS 0
96+
COUNT_FORMAT_ERRORS 0
97+
COUNT_ADDRINFO_TRANSIENT_ERRORS 0
98+
COUNT_ADDRINFO_PERMANENT_ERRORS 0
99+
COUNT_FCRDNS_ERRORS 0
100+
COUNT_HOST_ACL_ERRORS 0
101+
COUNT_NO_AUTH_PLUGIN_ERRORS 0
102+
COUNT_AUTH_PLUGIN_ERRORS 1
103+
COUNT_HANDSHAKE_ERRORS 0
104+
COUNT_PROXY_USER_ERRORS 0
105+
COUNT_PROXY_USER_ACL_ERRORS 0
106+
COUNT_AUTHENTICATION_ERRORS 1
107+
COUNT_SSL_ERRORS 0
108+
COUNT_MAX_USER_CONNECTIONS_ERRORS 0
109+
COUNT_MAX_USER_CONNECTIONS_PER_HOUR_ERRORS 0
110+
COUNT_DEFAULT_DATABASE_ERRORS 0
111+
COUNT_INIT_CONNECT_ERRORS 0
112+
COUNT_LOCAL_ERRORS 0
113+
COUNT_UNKNOWN_ERRORS 0
114+
FIRST_ERROR_SEEN set
115+
LAST_ERROR_SEEN set
116+
drop user plug1@'santa.claus.ipv4.example.com';
117+
drop user plug2@'santa.claus.ipv4.example.com';
118+
set @@global.debug_dbug = @saved_dbug;
119+
uninstall plugin ed25519;

‎mysql-test/suite/perfschema/t/hostcache_ipv4_auth_ed25519.test

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#
2+
# Tests for the performance_schema host_cache.
3+
#
4+
# Test authorization with auth plugins.
5+
# error reporting in:
6+
# - column COUNT_AUTH_PLUGIN_ERRORS
7+
# - column COUNT_PROXY_USER_ERRORS
8+
# - column COUNT_PROXY_USER_ACL_ERRORS
9+
10+
source include/not_embedded.inc;
11+
source include/have_debug.inc;
12+
source include/have_perfschema.inc;
13+
source include/have_plugin_auth.inc;
14+
source include/have_hostname_cache.inc;
15+
16+
if (!$AUTH_ED25519_SO) {
17+
skip No auth_ed25519 plugin;
18+
}
19+
install soname 'auth_ed25519';
20+
21+
# Enforce a clean state
22+
source ../include/wait_for_pfs_thread_count.inc;
23+
source ../include/hostcache_set_state.inc;
24+
25+
create user plug1@'santa.claus.ipv4.example.com'
26+
identified with ed25519 as 'foo';
27+
create user plug2@'santa.claus.ipv4.example.com'
28+
identified with ED25519 as 'vubFBzIrapbfHct1/J72dnUryz5VS7lA6XHH8sIx4TI';
29+
30+
set @saved_dbug = @@global.debug_dbug;
31+
set global debug_dbug= "+d,vio_peer_addr_fake_ipv4,getnameinfo_fake_ipv4,getaddrinfo_fake_good_ipv4";
32+
33+
replace_result $MASTER_MYPORT PORT $MASTER_MYSOCK SOCKET;
34+
error ER_ACCESS_DENIED_ERROR;
35+
connect con1, 127.0.0.1, plug1,foo,,$MASTER_MYPORT;
36+
source ../include/hostcache_dump.inc;
37+
38+
replace_result $MASTER_MYPORT PORT $MASTER_MYSOCK SOCKET;
39+
error ER_ACCESS_DENIED_ERROR;
40+
connect con1, 127.0.0.1, plug2,bar,,$MASTER_MYPORT;
41+
source ../include/hostcache_dump.inc;
42+
43+
connect con1, 127.0.0.1, plug2,foo,,$MASTER_MYPORT;
44+
select current_user();
45+
disconnect con1;
46+
connection default;
47+
source ../include/hostcache_dump.inc;
48+
49+
drop user plug1@'santa.claus.ipv4.example.com';
50+
drop user plug2@'santa.claus.ipv4.example.com';
51+
52+
set @@global.debug_dbug = @saved_dbug;
53+
uninstall plugin ed25519;

‎plugin/auth_ed25519/server_ed25519.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,17 +41,17 @@ static int auth(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *info)
4141

4242
/* prepare the pk */
4343
if (info->auth_string_length != PASSWORD_LEN)
44-
return CR_AUTH_USER_CREDENTIALS;
44+
return CR_ERROR; // bad password in the user table
4545
memcpy(pw, info->auth_string, PASSWORD_LEN);
4646
pw[PASSWORD_LEN]= '=';
4747
if (my_base64_decode(pw, PASSWORD_LEN_BUF, pk, NULL, 0) != CRYPTO_PUBLICKEYBYTES)
48-
return CR_AUTH_USER_CREDENTIALS;
48+
return CR_ERROR; // bad password in the user table
4949

5050
info->password_used= PASSWORD_USED_YES;
5151

5252
/* prepare random nonce */
5353
if (my_random_bytes((unsigned char *)nonce, (int)sizeof(nonce)))
54-
return CR_AUTH_USER_CREDENTIALS;
54+
return CR_ERROR; // eh? OpenSSL error
5555

5656
/* send it */
5757
if (vio->write_packet(vio, reply + CRYPTO_BYTES, NONCE_BYTES))
@@ -63,7 +63,7 @@ static int auth(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *info)
6363
memcpy(reply, pkt, CRYPTO_BYTES);
6464

6565
if (crypto_sign_open(reply, CRYPTO_BYTES + NONCE_BYTES, pk))
66-
return CR_ERROR;
66+
return CR_AUTH_USER_CREDENTIALS; // wrong password provided by the user
6767

6868
return CR_OK;
6969
}

0 commit comments

Comments
 (0)