Skip to content

Commit da76d25

Browse files
vuvovavuvova
committed
MDEV-26339 Account specifics to be handled before proxying
1 parent 5e04c08 commit da76d25

File tree

3 files changed

+118
-55
lines changed

3 files changed

+118
-55
lines changed

‎mysql-test/suite/plugins/r/pam.result

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,35 @@ test_pam@localhost pam_test@% test
4040
#
4141
Now, the magic number!
4242
PIN: 9212
43+
#
44+
# MDEV-26339 Account specifics to be handled before proxying
45+
#
46+
alter user pam_test account lock;
47+
alter user pam_test require subject 'foobar';
48+
alter user pam_test password expire;
49+
Now, the magic number!
50+
PIN: 9212
51+
select user(), current_user(), database();
52+
user() current_user() database()
53+
test_pam@localhost pam_test@% test
54+
alter user pam_test account unlock;
55+
alter user pam_test require none;
56+
alter user pam_test identified by '';
57+
show create user pam_test;
58+
CREATE USER for pam_test@%
59+
CREATE USER `pam_test`@`%`
60+
alter user test_pam account lock;
61+
Now, the magic number!
62+
PIN: 9212
63+
alter user test_pam account unlock;
64+
alter user test_pam require subject 'foobar';
65+
Now, the magic number!
66+
PIN: 9212
67+
alter user test_pam require none;
68+
alter user test_pam password expire;
69+
Now, the magic number!
70+
PIN: 9212
71+
select user(), current_user(), database();
4372
drop user test_pam;
4473
drop user pam_test;
4574
create user PAM_TEST identified via pam using 'mariadb_mtr';

‎mysql-test/suite/plugins/t/pam.test

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,36 @@ EOF
5454
--error 1
5555
--exec $MYSQL_TEST -u test_pam -pbadpassword --plugin-dir=$plugindir < $MYSQLTEST_VARDIR/tmp/pam_good2.txt
5656

57+
--echo #
58+
--echo # MDEV-26339 Account specifics to be handled before proxying
59+
--echo #
60+
61+
# one can connect if the proxy account is locked
62+
alter user pam_test account lock;
63+
alter user pam_test require subject 'foobar';
64+
alter user pam_test password expire;
65+
--error 0
66+
--exec $MYSQL_TEST -u test_pam -pgoodpassword --plugin-dir=$plugindir < $MYSQLTEST_VARDIR/tmp/pam_good2.txt
67+
alter user pam_test account unlock;
68+
alter user pam_test require none;
69+
alter user pam_test identified by '';
70+
show create user pam_test;
71+
72+
#one cannot connect if the proxied account is locked
73+
alter user test_pam account lock;
74+
--error 1
75+
--exec $MYSQL_TEST -u test_pam -pgoodpassword --plugin-dir=$plugindir < $MYSQLTEST_VARDIR/tmp/pam_good2.txt
76+
alter user test_pam account unlock;
77+
78+
alter user test_pam require subject 'foobar';
79+
--error 1
80+
--exec $MYSQL_TEST -u test_pam -pgoodpassword --plugin-dir=$plugindir < $MYSQLTEST_VARDIR/tmp/pam_good2.txt
81+
alter user test_pam require none;
82+
83+
alter user test_pam password expire;
84+
--error 1
85+
--exec $MYSQL_TEST -u test_pam -pgoodpassword --plugin-dir=$plugindir < $MYSQLTEST_VARDIR/tmp/pam_good2.txt
86+
5787
drop user test_pam;
5888
drop user pam_test;
5989
create user PAM_TEST identified via pam using 'mariadb_mtr';

‎sql/sql_acl.cc

Lines changed: 59 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -13932,61 +13932,6 @@ bool acl_authenticate(THD *thd, uint com_change_user_pkt_len)
1393213932

1393313933
if (initialized) // if not --skip-grant-tables
1393413934
{
13935-
#ifndef NO_EMBEDDED_ACCESS_CHECKS
13936-
bool is_proxy_user= FALSE;
13937-
const char *auth_user = acl_user->user.str;
13938-
ACL_PROXY_USER *proxy_user;
13939-
/* check if the user is allowed to proxy as another user */
13940-
proxy_user= acl_find_proxy_user(auth_user, sctx->host, sctx->ip,
13941-
mpvio.auth_info.authenticated_as,
13942-
&is_proxy_user);
13943-
if (is_proxy_user)
13944-
{
13945-
ACL_USER *acl_proxy_user;
13946-
13947-
/* we need to find the proxy user, but there was none */
13948-
if (!proxy_user)
13949-
{
13950-
Host_errors errors;
13951-
errors.m_proxy_user= 1;
13952-
inc_host_errors(mpvio.auth_info.thd->security_ctx->ip, &errors);
13953-
if (!thd->is_error())
13954-
login_failed_error(thd);
13955-
DBUG_RETURN(1);
13956-
}
13957-
13958-
my_snprintf(sctx->proxy_user, sizeof(sctx->proxy_user) - 1,
13959-
"'%s'@'%s'", auth_user,
13960-
safe_str(acl_user->host.hostname));
13961-
13962-
/* we're proxying : find the proxy user definition */
13963-
mysql_mutex_lock(&acl_cache->lock);
13964-
acl_proxy_user= find_user_exact(safe_str(proxy_user->get_proxied_host()),
13965-
mpvio.auth_info.authenticated_as);
13966-
if (!acl_proxy_user)
13967-
{
13968-
mysql_mutex_unlock(&acl_cache->lock);
13969-
13970-
Host_errors errors;
13971-
errors.m_proxy_user_acl= 1;
13972-
inc_host_errors(mpvio.auth_info.thd->security_ctx->ip, &errors);
13973-
if (!thd->is_error())
13974-
login_failed_error(thd);
13975-
DBUG_RETURN(1);
13976-
}
13977-
acl_user= acl_proxy_user->copy(thd->mem_root);
13978-
mysql_mutex_unlock(&acl_cache->lock);
13979-
}
13980-
#endif
13981-
13982-
sctx->master_access= acl_user->access;
13983-
strmake_buf(sctx->priv_user, acl_user->user.str);
13984-
13985-
if (acl_user->host.hostname)
13986-
strmake_buf(sctx->priv_host, acl_user->host.hostname);
13987-
else
13988-
*sctx->priv_host= 0;
13989-
1399013935
/*
1399113936
OK. Let's check the SSL. Historically it was checked after the password,
1399213937
as an additional layer, not instead of the password
@@ -14023,6 +13968,65 @@ bool acl_authenticate(THD *thd, uint com_change_user_pkt_len)
1402313968

1402413969
sctx->password_expired= password_expired;
1402513970

13971+
#ifndef NO_EMBEDDED_ACCESS_CHECKS
13972+
if (!password_expired)
13973+
{
13974+
bool is_proxy_user= FALSE;
13975+
const char *auth_user = acl_user->user.str;
13976+
ACL_PROXY_USER *proxy_user;
13977+
/* check if the user is allowed to proxy as another user */
13978+
proxy_user= acl_find_proxy_user(auth_user, sctx->host, sctx->ip,
13979+
mpvio.auth_info.authenticated_as,
13980+
&is_proxy_user);
13981+
if (is_proxy_user)
13982+
{
13983+
ACL_USER *acl_proxy_user;
13984+
13985+
/* we need to find the proxy user, but there was none */
13986+
if (!proxy_user)
13987+
{
13988+
Host_errors errors;
13989+
errors.m_proxy_user= 1;
13990+
inc_host_errors(mpvio.auth_info.thd->security_ctx->ip, &errors);
13991+
if (!thd->is_error())
13992+
login_failed_error(thd);
13993+
DBUG_RETURN(1);
13994+
}
13995+
13996+
my_snprintf(sctx->proxy_user, sizeof(sctx->proxy_user) - 1,
13997+
"'%s'@'%s'", auth_user,
13998+
safe_str(acl_user->host.hostname));
13999+
14000+
/* we're proxying : find the proxy user definition */
14001+
mysql_mutex_lock(&acl_cache->lock);
14002+
acl_proxy_user= find_user_exact(safe_str(proxy_user->get_proxied_host()),
14003+
mpvio.auth_info.authenticated_as);
14004+
if (!acl_proxy_user)
14005+
{
14006+
mysql_mutex_unlock(&acl_cache->lock);
14007+
14008+
Host_errors errors;
14009+
errors.m_proxy_user_acl= 1;
14010+
inc_host_errors(mpvio.auth_info.thd->security_ctx->ip, &errors);
14011+
if (!thd->is_error())
14012+
login_failed_error(thd);
14013+
DBUG_RETURN(1);
14014+
}
14015+
acl_user= acl_proxy_user->copy(thd->mem_root);
14016+
mysql_mutex_unlock(&acl_cache->lock);
14017+
}
14018+
}
14019+
#endif
14020+
14021+
sctx->master_access= acl_user->access;
14022+
strmake_buf(sctx->priv_user, acl_user->user.str);
14023+
14024+
if (acl_user->host.hostname)
14025+
strmake_buf(sctx->priv_host, acl_user->host.hostname);
14026+
else
14027+
*sctx->priv_host= 0;
14028+
14029+
1402614030
/*
1402714031
Don't allow the user to connect if he has done too many queries.
1402814032
As we are testing max_user_connections == 0 here, it means that we

0 commit comments

Comments
 (0)