Skip to content

Commit dc1f4cd

Browse files
lkotulajankowsk
lkotula
authored and
jankowsk
committed
PS-11392 [8.4] Backport PBKDF2 from 9.7
Bug#38879953 - X Plugin is missing support for PBKDF2 storage format with Caching_sha2_password Description =========== WL#17160 introduced a new storage format type (PBKDF2) for caching_sha2_password. Without implementing support for this type, the X Plugin will reject authentications targeting caching_sha2_password accounts that have their password hash stored using PBKDF2 format. Fix === X Plugin must support new type. Thus both hash types my work with X Protocol: CRYPT5, PBKDF2_SHA512. Change-Id: I8fc29705eaa1fe33f2d569253d419cf8405ce6ec
1 parent aaf995b commit dc1f4cd

36 files changed

Lines changed: 1366 additions & 297 deletions

‎mysql-test/suite/auth_sec/include/plugin_auth_caching_sha2_password_multi_format_no_dual.inc‎

Lines changed: 278 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,278 @@
1+
# This test case is a simplified version of
2+
# plugin_auth_caching_sha2_password_multi_format_support.inc test.
3+
# It duplicates the tests that are done for secondary passwords in
4+
# plugin_auth_caching_sha2_password_multi_format_support.inc.
5+
# The test was re-written to use standard accounts with a single password.
6+
# X Protocol doesn't support dual passwords, thus this file was created for it.
7+
8+
# Short summary:
9+
# 1. Check if CREATE user uses selected storage format.
10+
# 2. Check if enforce storage format is set, then accounts with other storage
11+
# format are forced to change the password (expired).
12+
# 3. Verify that fast auth doesn't work for accounts that have wrong storage
13+
# format.
14+
#
15+
# Please note that those points apply only to caching_sha2_password plugin.
16+
17+
#
18+
# $parameter_client_script -
19+
# Set the application that will execute scripts in mysql-test language
20+
#
21+
# $parameter_client -
22+
# Set the application that will execute single queries
23+
#
24+
#
25+
## Usage
26+
#
27+
# --let $parameter_client_script = $MYSQL_TEST --connect-expired-password
28+
# --let $parameter_client = $MYSQL --connect-expired-password
29+
# --source suite/auth_sec/include/plugin_auth_caching_sha2_password_multi_format_no_dual.inc
30+
31+
if (`SELECT '$parameter_client_script' = ''`)
32+
{
33+
--die "plugin_auth_caching_sha2_password_multi_format_support.inc" requires "parameter_client_script" parameter.
34+
}
35+
36+
if (`SELECT '$parameter_client' = ''`)
37+
{
38+
--die "plugin_auth_caching_sha2_password_multi_format_support.inc" requires "parameter_client" parameter.
39+
}
40+
41+
# Save initial setting
42+
SELECT @@global.caching_sha2_password_storage_format INTO @saved_storage_format;
43+
SELECT @@global.caching_sha2_password_enforce_storage_format INTO @saved_enforce_storage_format;
44+
45+
SET GLOBAL caching_sha2_password_storage_format="CRYPT5";
46+
47+
# -------------------------------------------------------------------
48+
# Prepare script files
49+
#
50+
# Please note that the language of mysqlxtest and mysqltest is similar but not
51+
# the same. To ensure compatibility, apply the following rules for those
52+
# scripts:
53+
#
54+
# * Don't use the "--" version of the commands.
55+
# * Variable substitution for queries for both tools is only done under "eval"
56+
# command.
57+
# * Use "error" command to specify expected error returned by the server.
58+
# * Use env var to pass parameters from this file to the script.
59+
60+
--let $query_account_file= $MYSQL_TMP_DIR/query_account_file.test
61+
--write_file $query_account_file
62+
SELECT CURRENT_USER();
63+
EOF
64+
65+
--let $query_simple_file= $MYSQL_TMP_DIR/query_simple_file.test
66+
--write_file $query_simple_file
67+
SELECT 1;
68+
EOF
69+
70+
71+
--let $query_account_and_change_pwd_file= $MYSQL_TMP_DIR/query_account_and_change_pwd_file.test
72+
--write_file $query_account_and_change_pwd_file
73+
SELECT CURRENT_USER();
74+
75+
eval SET PASSWORD = '$TEST_PARAM_PASS';
76+
77+
EOF
78+
79+
--let $query_simple_er_expired_file= $MYSQL_TMP_DIR/query_simple_er_expired_file.test
80+
--write_file $query_simple_er_expired_file
81+
error ER_MUST_CHANGE_PASSWORD;
82+
SELECT 1;
83+
EOF
84+
85+
--let $query_simple_er_expired_change_pwd_file= $MYSQL_TMP_DIR/query_simple_er_expired_change_pwd_file.test
86+
--write_file $query_simple_er_expired_change_pwd_file
87+
error ER_MUST_CHANGE_PASSWORD;
88+
SELECT 1;
89+
90+
eval SET PASSWORD = '$TEST_PARAM_PASS';
91+
92+
SELECT 1;
93+
EOF
94+
95+
# -------------------------------------------------------------------
96+
# The test begins here
97+
98+
SET GLOBAL caching_sha2_password_storage_format="PBKDF2_SHA512";
99+
CREATE USER arthur IDENTIFIED WITH caching_sha2_password BY 'abcd';
100+
CREATE USER marvin IDENTIFIED WITH caching_sha2_password BY 'efgh';
101+
102+
SET GLOBAL caching_sha2_password_storage_format="CRYPT5";
103+
CREATE USER zaphod IDENTIFIED WITH caching_sha2_password BY 'ijkl';
104+
CREATE USER ford IDENTIFIED WITH caching_sha2_password BY 'mnop';
105+
106+
107+
# Current state
108+
# User Algo Pass
109+
#-------------------------------
110+
# arthur PBKDF2_SHA512 abcd
111+
# marvin PBKDF2_SHA512 efgh
112+
# zaphod CRYPT5 ijkl
113+
# ford CRYPT5 mnop
114+
115+
SELECT user, SUBSTRING(authentication_string, 1, 7) as first, SUBSTRING(JSON_EXTRACT(User_attributes, "$.additional_password"), 2, 7) as second FROM mysql.user WHERE user IN ('arthur', 'marvin', 'zaphod', 'ford') ORDER BY user ASC;
116+
117+
# Try with password
118+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=REQUIRED -uarthur -pabcd -e "SELECT CURRENT_USER()" 2>&1
119+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=REQUIRED -umarvin -pefgh -e "SELECT CURRENT_USER()" 2>&1
120+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=REQUIRED -uzaphod -pijkl -e "SELECT CURRENT_USER()" 2>&1
121+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=REQUIRED -uford -pmnop -e "SELECT CURRENT_USER()" 2>&1
122+
123+
124+
FLUSH PRIVILEGES;
125+
126+
# Tests for caching_sha2_password_enforce_format
127+
128+
# Current state
129+
# User Algo Pass
130+
#-------------------------------
131+
# arthur PBKDF2_SHA512 abcd
132+
# marvin PBKDF2_SHA512 efgh
133+
# zaphod CRYPT5 ijkl
134+
# ford CRYPT5 mnop
135+
136+
SET GLOBAL caching_sha2_password_storage_format="PBKDF2_SHA512";
137+
SET GLOBAL caching_sha2_password_enforce_storage_format=1;
138+
139+
# Try connecting with password stored in non-compliant format
140+
exec $parameter_client_script
141+
--host=localhost --ssl-mode=REQUIRED
142+
-uzaphod -pijkl
143+
-x $query_simple_er_expired_file 2>&1;
144+
145+
# Try using fast auth - Must fail
146+
--error 1
147+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -uzaphod -pijkl -e "SELECT CURRENT_USER()" 2>&1
148+
149+
# Try connecing with another password stored in non-compliant format
150+
exec $parameter_client_script
151+
--host=localhost --ssl-mode=REQUIRED
152+
-uford -pmnop
153+
-x $query_simple_er_expired_file 2>&1;
154+
155+
# Try using fast auth - Must fail
156+
--error 1
157+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -uford -pmnop -e "SELECT CURRENT_USER()" 2>&1
158+
159+
# Try connecting with password stored in non-compliant format and reset password
160+
--let TEST_PARAM_PASS=ijkl
161+
exec $parameter_client_script
162+
--host=localhost --ssl-mode=REQUIRED
163+
-uzaphod -pijkl
164+
-x $query_simple_er_expired_change_pwd_file 2>&1;
165+
166+
# Try using fast auth - Must fail
167+
--error 1
168+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -uzaphod -pijkl -e "SELECT CURRENT_USER()" 2>&1
169+
170+
# Must succeed - secure channel
171+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=REQUIRED -uzaphod -pijkl -e "SELECT CURRENT_USER()" 2>&1
172+
173+
# Must succeed with fast auth now - compliant password format
174+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -uzaphod -pijkl -e "SELECT CURRENT_USER()" 2>&1
175+
176+
# Try connecing with another password stored in non-compliant format and reset password
177+
--let TEST_PARAM_PASS=mnop
178+
exec $parameter_client_script
179+
--host=localhost --ssl-mode=REQUIRED
180+
-uford -pmnop
181+
-x $query_simple_er_expired_change_pwd_file 2>&1;
182+
183+
# Try using fast auth - Must fail
184+
--error 1
185+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -uford -pmnop -e "SELECT CURRENT_USER()" 2>&1
186+
187+
# Must succeed - secure channel
188+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=REQUIRED -uford -pmnop -e "SELECT CURRENT_USER()" 2>&1
189+
190+
# Must succeed with fast auth now - compliant password format
191+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -uford -pmnop -e "SELECT CURRENT_USER()" 2>&1
192+
193+
SET GLOBAL caching_sha2_password_storage_format="CRYPT5";
194+
SET GLOBAL caching_sha2_password_enforce_storage_format=1;
195+
196+
# Current state
197+
# User Algo Pass
198+
#-------------------------------
199+
# arthur PBKDF2_SHA512 abcd
200+
# marvin PBKDF2_SHA512 efgh
201+
# zaphod CRYPT5 ijkl
202+
# ford CRYPT5 mnop
203+
204+
# Try connecting with password stored in non-compliant format
205+
exec $parameter_client_script
206+
--host=localhost --ssl-mode=REQUIRED
207+
-uarthur -pabcd
208+
-x $query_simple_er_expired_file 2>&1;
209+
210+
# Try using fast auth - Must fail
211+
--error 1
212+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -uarthur -pabcd -e "SELECT CURRENT_USER()" 2>&1
213+
214+
215+
216+
# Try connecing with another password stored in non-compliant format
217+
exec $parameter_client_script
218+
--host=localhost --ssl-mode=REQUIRED
219+
-umarvin -pefgh
220+
-x $query_simple_er_expired_file 2>&1;
221+
222+
# Try using fast auth - Must fail
223+
--error 1
224+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -umarvin -pefgh -e "SELECT CURRENT_USER()" 2>&1
225+
226+
# Try connecting with password stored in non-compliant format and reset password
227+
let TEST_PARAM_PASS=abcd;
228+
exec $parameter_client_script
229+
--host=localhost --ssl-mode=REQUIRED
230+
-uarthur -pabcd
231+
-x $query_simple_er_expired_change_pwd_file 2>&1;
232+
233+
# Try using fast auth - Must fail
234+
--error 1
235+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -uarthur -pabcd -e "SELECT CURRENT_USER()" 2>&1
236+
237+
# Must succeed with fast auth now - compliant password format
238+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=REQUIRED -uarthur -pabcd -e "SELECT CURRENT_USER()" 2>&1
239+
240+
# Must succeed with fast auth now - compliant password format
241+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -uarthur -pabcd -e "SELECT CURRENT_USER()" 2>&1
242+
243+
# Try connecing with another password stored in non-compliant format and reset password
244+
let TEST_PARAM_PASS=efgh;
245+
exec $parameter_client_script
246+
--host=localhost --ssl-mode=REQUIRED
247+
-umarvin -pefgh
248+
-x $query_simple_er_expired_change_pwd_file 2>&1;
249+
250+
251+
# Try using fast auth - Must fail
252+
--error 1
253+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -umarvin -pefgh -e "SELECT CURRENT_USER()" 2>&1
254+
255+
# Must succeed with fast auth now - compliant password format
256+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=REQUIRED -umarvin -pefgh -e "SELECT CURRENT_USER()" 2>&1
257+
258+
# Must succeed with fast auth now - compliant password format
259+
--exec $parameter_client --host=127.0.0.1 --ssl-mode=DISABLED -umarvin -pefgh -e "SELECT CURRENT_USER()" 2>&1
260+
261+
262+
# -------------------------------------------------------------------
263+
264+
# Drop users
265+
DROP USER arthur, marvin, zaphod, ford;
266+
267+
# Revert to initial setting
268+
SET GLOBAL caching_sha2_password_enforce_storage_format=@saved_enforce_storage_format;
269+
SET GLOBAL caching_sha2_password_storage_format=@saved_storage_format;
270+
271+
--remove_file $query_account_and_change_pwd_file
272+
--remove_file $query_account_file
273+
--remove_file $query_simple_file
274+
--remove_file $query_simple_er_expired_file
275+
--remove_file $query_simple_er_expired_change_pwd_file
276+
277+
--let $parameter_client_script=
278+
--let $parameter_client=

0 commit comments

Comments
 (0)