Skip to content

Commit 8ce105b

Browse files
author
Kristofer Pettersson
committed
WL#5602 Enable partial YaSSL support
Due to lack of functioanlity in YaSSL the RSA pub/priv key authentication can't be supported.
1 parent ef7af31 commit 8ce105b

10 files changed

+291
-28
lines changed

‎mysql-test/r/plugin_auth_sha256_server_default_tls.result

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
CREATE USER 'kristofer';
2+
SET PASSWORD FOR 'kristofer'=PASSWORD('secret');
3+
SELECT user, plugin FROM mysql.user;
4+
user plugin
5+
root
6+
root
7+
root
8+
root
9+
kristofer sha256_password
10+
SELECT USER(),CURRENT_USER();
11+
USER() CURRENT_USER()
12+
kristofer@localhost kristofer@%
13+
DROP USER 'kristofer';
14+
GRANT ALL ON *.* TO 'kristofer'@'localhost' IDENTIFIED WITH 'sha256_password';
15+
GRANT ALL ON *.* TO 'kristofer2'@'localhost' IDENTIFIED WITH 'sha256_password';
16+
SET PASSWORD FOR 'kristofer'@'localhost'=PASSWORD('secret2');
17+
SET PASSWORD FOR 'kristofer2'@'localhost'=PASSWORD('secret2');
18+
SELECT USER(),CURRENT_USER();
19+
USER() CURRENT_USER()
20+
kristofer@localhost kristofer@localhost
21+
SHOW GRANTS FOR 'kristofer'@'localhost';
22+
Grants for kristofer@localhost
23+
GRANT ALL PRIVILEGES ON *.* TO 'kristofer'@'localhost' IDENTIFIED BY PASSWORD '<non-deterministic-password-hash>'
24+
Change user (should succeed)
25+
SELECT USER(),CURRENT_USER();
26+
USER() CURRENT_USER()
27+
kristofer2@localhost kristofer2@localhost
28+
**** Client default_auth=sha_256_password and server default auth=sha256_password
29+
#### Test is disabled because it requires RSA-keys and this only works
30+
#### with OpenSSL. The reason is that the current client library
31+
#### framework can't know if SSL was attempted or not when the default
32+
#### client auth is switched and hence it will only report that the
33+
#### connection is unencrypted.
34+
**** Client default_auth=native and server default auth=sha256_password
35+
user() current_user()
36+
kristofer@localhost kristofer@localhost
37+
DROP USER 'kristofer'@'localhost';
38+
DROP USER 'kristofer2'@'localhost';
39+
GRANT ALL ON *.* TO 'kristofer'@'localhost';
40+
SET PASSWORD FOR 'kristofer'@'localhost'=PASSWORD('');
41+
SELECT USER(),CURRENT_USER();
42+
USER() CURRENT_USER()
43+
kristofer@localhost kristofer@localhost
44+
SHOW GRANTS FOR 'kristofer'@'localhost';
45+
Grants for kristofer@localhost
46+
GRANT ALL PRIVILEGES ON *.* TO 'kristofer'@'localhost' IDENTIFIED BY PASSWORD '<non-deterministic-password-hash>'
47+
DROP USER 'kristofer'@'localhost';
48+
GRANT ALL ON *.* TO 'kristofer'@'33.33.33.33';
49+
SET PASSWORD FOR 'kristofer'@'33.33.33.33'=PASSWORD('');
50+
Connection should fail for localhost
51+
ERROR 28000: Access denied for user 'kristofer'@'localhost' (using password: NO)
52+
DROP USER 'kristofer'@'33.33.33.33';
53+
GRANT ALL ON *.* TO 'kristofer'@'localhost' IDENTIFIED BY 'awesomeness';
54+
SELECT USER(),CURRENT_USER();
55+
USER() CURRENT_USER()
56+
kristofer@localhost kristofer@localhost
57+
SHOW GRANTS FOR 'kristofer'@'localhost';
58+
Grants for kristofer@localhost
59+
GRANT ALL PRIVILEGES ON *.* TO 'kristofer'@'localhost' IDENTIFIED BY PASSWORD '<non-deterministic-password-hash>'
60+
SET @@OLD_PASSWORDS= 0;
61+
SET PASSWORD FOR 'kristofer'@'localhost'= PASSWORD('error');
62+
ERROR HY000: The password hash doesn't have the expected format. Check if the correct password algorithm is being used with the PASSWORD() function.
63+
DROP USER 'kristofer'@'localhost';

‎mysql-test/r/plugin_auth_sha256_tls.result

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
SHOW STATUS LIKE 'Ssl_cipher';
2+
Variable_name Value
3+
Ssl_cipher DHE-RSA-AES256-SHA
4+
CREATE USER 'kristofer' IDENTIFIED WITH 'sha256_password';
5+
SET GLOBAL old_passwords= 2;
6+
SET SESSION old_passwords= 2;
7+
SET PASSWORD FOR 'kristofer'=PASSWORD('secret');
8+
DROP USER 'kristofer';
9+
GRANT ALL ON *.* TO 'kristofer'@'localhost' IDENTIFIED WITH 'sha256_password';
10+
SET PASSWORD FOR 'kristofer'@'localhost'=PASSWORD('secret2');
11+
SELECT USER(),CURRENT_USER();
12+
USER() CURRENT_USER()
13+
kristofer@localhost kristofer@localhost
14+
SHOW GRANTS FOR 'kristofer'@'localhost';
15+
Grants for kristofer@localhost
16+
GRANT ALL PRIVILEGES ON *.* TO 'kristofer'@'localhost' IDENTIFIED BY PASSWORD '<non-deterministic-password-hash>'
17+
DROP USER 'kristofer'@'localhost';
18+
GRANT ALL ON *.* TO 'kristofer'@'localhost' IDENTIFIED WITH 'sha256_password';
19+
SET PASSWORD FOR 'kristofer'@'localhost'=PASSWORD('');
20+
SELECT USER(),CURRENT_USER();
21+
USER() CURRENT_USER()
22+
kristofer@localhost kristofer@localhost
23+
SHOW GRANTS FOR 'kristofer'@'localhost';
24+
Grants for kristofer@localhost
25+
GRANT ALL PRIVILEGES ON *.* TO 'kristofer'@'localhost' IDENTIFIED BY PASSWORD '<non-deterministic-password-hash>'
26+
DROP USER 'kristofer'@'localhost';
27+
GRANT ALL ON *.* TO 'kristofer'@'33.33.33.33' IDENTIFIED WITH 'sha256_password';
28+
SET PASSWORD FOR 'kristofer'@'33.33.33.33'=PASSWORD('');
29+
Connection should fail for localhost
30+
ERROR 28000: Access denied for user 'kristofer'@'localhost' (using password: NO)
31+
DROP USER 'kristofer'@'33.33.33.33';
32+
SET GLOBAL old_passwords= default;

‎mysql-test/t/plugin_auth_sha256_server_default_tls-master.opt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
--default_authentication_plugin=sha256_password

‎mysql-test/t/plugin_auth_sha256_server_default_tls.test

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
--source include/not_embedded.inc
2+
--source include/have_ssl.inc
3+
4+
CREATE USER 'kristofer';
5+
SET PASSWORD FOR 'kristofer'=PASSWORD('secret');
6+
SELECT user, plugin FROM mysql.user;
7+
connect(con1,localhost,kristofer,secret,,,,SSL);
8+
connection con1;
9+
SELECT USER(),CURRENT_USER();
10+
connection default;
11+
disconnect con1;
12+
DROP USER 'kristofer';
13+
14+
GRANT ALL ON *.* TO 'kristofer'@'localhost' IDENTIFIED WITH 'sha256_password';
15+
GRANT ALL ON *.* TO 'kristofer2'@'localhost' IDENTIFIED WITH 'sha256_password';
16+
SET PASSWORD FOR 'kristofer'@'localhost'=PASSWORD('secret2');
17+
SET PASSWORD FOR 'kristofer2'@'localhost'=PASSWORD('secret2');
18+
connect(con2,localhost,kristofer,secret2,,,,SSL);
19+
connection con2;
20+
SELECT USER(),CURRENT_USER();
21+
--replace_regex /PASSWORD .*$/PASSWORD '<non-deterministic-password-hash>'/
22+
SHOW GRANTS FOR 'kristofer'@'localhost';
23+
24+
--echo Change user (should succeed)
25+
change_user kristofer2,secret2;
26+
SELECT USER(),CURRENT_USER();
27+
28+
connection default;
29+
disconnect con2;
30+
--echo **** Client default_auth=sha_256_password and server default auth=sha256_password
31+
--echo #### Test is disabled because it requires RSA-keys and this only works
32+
--echo #### with OpenSSL. The reason is that the current client library
33+
--echo #### framework can't know if SSL was attempted or not when the default
34+
--echo #### client auth is switched and hence it will only report that the
35+
--echo #### connection is unencrypted.
36+
# --exec xterm -e gdb --args $MYSQL -ukristofer -psecret2 --default_auth=sha256_password --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem -e "select user(), current_user()"
37+
--echo **** Client default_auth=native and server default auth=sha256_password
38+
--exec $MYSQL -ukristofer -psecret2 --default_auth=mysql_native_password --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem -e "select user(), current_user()"
39+
40+
DROP USER 'kristofer'@'localhost';
41+
DROP USER 'kristofer2'@'localhost';
42+
43+
GRANT ALL ON *.* TO 'kristofer'@'localhost';
44+
SET PASSWORD FOR 'kristofer'@'localhost'=PASSWORD('');
45+
connect(con3,localhost,kristofer,,,,,SSL);
46+
connection con3;
47+
SELECT USER(),CURRENT_USER();
48+
--replace_regex /PASSWORD .*$/PASSWORD '<non-deterministic-password-hash>'/
49+
SHOW GRANTS FOR 'kristofer'@'localhost';
50+
connection default;
51+
disconnect con3;
52+
DROP USER 'kristofer'@'localhost';
53+
54+
GRANT ALL ON *.* TO 'kristofer'@'33.33.33.33';
55+
SET PASSWORD FOR 'kristofer'@'33.33.33.33'=PASSWORD('');
56+
--echo Connection should fail for localhost
57+
--replace_result $MASTER_MYSOCK MASTER_MYSOCK
58+
--disable_query_log
59+
--error ER_ACCESS_DENIED_ERROR
60+
connect(con4,127.0.0.1,kristofer,,,,,SSL);
61+
--enable_query_log
62+
DROP USER 'kristofer'@'33.33.33.33';
63+
64+
GRANT ALL ON *.* TO 'kristofer'@'localhost' IDENTIFIED BY 'awesomeness';
65+
connect(con3,localhost,kristofer,awesomeness,,,,SSL);
66+
connection con3;
67+
SELECT USER(),CURRENT_USER();
68+
--replace_regex /PASSWORD .*$/PASSWORD '<non-deterministic-password-hash>'/
69+
SHOW GRANTS FOR 'kristofer'@'localhost';
70+
connection default;
71+
disconnect con3;
72+
# Setting password for kristofer@localhost using old_passwords=0 will fail.
73+
SET @@OLD_PASSWORDS= 0;
74+
--error ER_PASSWORD_FORMAT
75+
SET PASSWORD FOR 'kristofer'@'localhost'= PASSWORD('error');
76+
DROP USER 'kristofer'@'localhost';
77+
78+

‎mysql-test/t/plugin_auth_sha256_tls.test

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
--source include/not_embedded.inc
2+
--source include/have_ssl.inc
3+
4+
connect (ssl_con,localhost,root,,,,,SSL);
5+
SHOW STATUS LIKE 'Ssl_cipher';
6+
7+
CREATE USER 'kristofer' IDENTIFIED WITH 'sha256_password';
8+
SET GLOBAL old_passwords= 2;
9+
SET SESSION old_passwords= 2;
10+
SET PASSWORD FOR 'kristofer'=PASSWORD('secret');
11+
connect(con1,localhost,kristofer,secret,,,,SSL);
12+
connection con1;
13+
connection ssl_con;
14+
disconnect con1;
15+
DROP USER 'kristofer';
16+
GRANT ALL ON *.* TO 'kristofer'@'localhost' IDENTIFIED WITH 'sha256_password';
17+
SET PASSWORD FOR 'kristofer'@'localhost'=PASSWORD('secret2');
18+
connect(con2,localhost,kristofer,secret2,,,,SSL);
19+
connection con2;
20+
SELECT USER(),CURRENT_USER();
21+
--replace_regex /PASSWORD .*$/PASSWORD '<non-deterministic-password-hash>'/
22+
SHOW GRANTS FOR 'kristofer'@'localhost';
23+
connection ssl_con;
24+
disconnect con2;
25+
DROP USER 'kristofer'@'localhost';
26+
GRANT ALL ON *.* TO 'kristofer'@'localhost' IDENTIFIED WITH 'sha256_password';
27+
SET PASSWORD FOR 'kristofer'@'localhost'=PASSWORD('');
28+
connect(con3,localhost,kristofer,,,,,SSL);
29+
connection con3;
30+
SELECT USER(),CURRENT_USER();
31+
--replace_regex /PASSWORD .*$/PASSWORD '<non-deterministic-password-hash>'/
32+
SHOW GRANTS FOR 'kristofer'@'localhost';
33+
connection ssl_con;
34+
disconnect con3;
35+
DROP USER 'kristofer'@'localhost';
36+
37+
GRANT ALL ON *.* TO 'kristofer'@'33.33.33.33' IDENTIFIED WITH 'sha256_password';
38+
SET PASSWORD FOR 'kristofer'@'33.33.33.33'=PASSWORD('');
39+
--echo Connection should fail for localhost
40+
--replace_result $MASTER_MYSOCK MASTER_MYSOCK
41+
--disable_query_log
42+
--error ER_ACCESS_DENIED_ERROR
43+
connect(con4,127.0.0.1,kristofer,,,,,SSL);
44+
--enable_query_log
45+
DROP USER 'kristofer'@'33.33.33.33';
46+
# Restore default value to old_passwords
47+
SET GLOBAL old_passwords= default;
48+
connection default;
49+
disconnect ssl_con;
50+
51+

‎sql-common/client.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2242,7 +2242,7 @@ static auth_plugin_t clear_password_client_plugin=
22422242
clear_password_auth_client
22432243
};
22442244

2245-
#if defined(HAVE_OPENSSL) && !defined(HAVE_YASSL)
2245+
#if defined(HAVE_OPENSSL)
22462246
static auth_plugin_t sha256_password_client_plugin=
22472247
{
22482248
MYSQL_CLIENT_AUTHENTICATION_PLUGIN,
@@ -2268,7 +2268,7 @@ struct st_mysql_client_plugin *mysql_client_builtins[]=
22682268
(struct st_mysql_client_plugin *)&native_password_client_plugin,
22692269
(struct st_mysql_client_plugin *)&old_password_client_plugin,
22702270
(struct st_mysql_client_plugin *)&clear_password_client_plugin,
2271-
#if defined(HAVE_OPENSSL) && !defined(HAVE_YASSL)
2271+
#if defined(HAVE_OPENSSL)
22722272
(struct st_mysql_client_plugin *) &sha256_password_client_plugin,
22732273
#endif
22742274
#ifdef AUTHENTICATION_WIN

‎sql-common/client_authentication.cc

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#if defined(HAVE_OPENSSL) && !defined(HAVE_YASSL)
1+
#if defined(HAVE_OPENSSL)
22
#include "crypt_genhash_impl.h"
33
#include "mysql/client_authentication.h"
44
#include "m_ctype.h"
@@ -8,30 +8,40 @@
88

99
#include <string.h>
1010
#include <stdarg.h>
11+
#if !defined(HAVE_YASSL)
1112
#include <openssl/rsa.h>
1213
#include <openssl/pem.h>
1314
#include <openssl/err.h>
1415
#if defined(_WIN32) && !defined(_OPENSSL_Applink)
1516
#include <openssl/applink.c>
1617
#endif
18+
#endif
1719
#include "mysql/service_my_plugin_log.h"
1820

1921
#define MAX_CIPHER_LENGTH 1024
22+
23+
#if !defined(HAVE_YASSL)
2024
mysql_mutex_t g_public_key_mutex;
25+
#endif
2126

2227
int sha256_password_init(char *a, size_t b, int c, va_list d)
2328
{
29+
#if !defined(HAVE_YASSL)
2430
mysql_mutex_init(0,&g_public_key_mutex, MY_MUTEX_INIT_SLOW);
31+
#endif
2532
return 0;
2633
}
2734

2835
int sha256_password_deinit(void)
2936
{
37+
#if !defined(HAVE_YASSL)
3038
mysql_mutex_destroy(&g_public_key_mutex);
39+
#endif
3140
return 0;
3241
}
3342

3443

44+
#if !defined(HAVE_YASSL)
3545
/**
3646
Reads and parse RSA public key data from a file.
3747
@@ -90,7 +100,7 @@ RSA *rsa_init(MYSQL *mysql)
90100

91101
return key;
92102
}
93-
103+
#endif // !defined(HAVE_YASSL)
94104

95105
/**
96106
Authenticate the client using the RSA or TLS and a SHA256 salted password.
@@ -106,14 +116,17 @@ RSA *rsa_init(MYSQL *mysql)
106116
extern "C"
107117
int sha256_password_auth_client(MYSQL_PLUGIN_VIO *vio, MYSQL *mysql)
108118
{
119+
bool uses_password= mysql->passwd[0] != 0;
120+
#if !defined(HAVE_YASSL)
109121
unsigned char encrypted_password[MAX_CIPHER_LENGTH];
110122
static char request_public_key= '\1';
111-
bool uses_password= mysql->passwd[0] != 0;
112123
RSA *public_key= NULL;
124+
bool got_public_key_from_server= false;
125+
#endif
113126
bool connection_is_secure= false;
114127
unsigned char scramble_pkt[20];
115128
unsigned char *pkt;
116-
bool got_public_key_from_server= false;
129+
117130

118131
DBUG_ENTER("sha256_password_auth_client");
119132

@@ -137,7 +150,11 @@ int sha256_password_auth_client(MYSQL_PLUGIN_VIO *vio, MYSQL *mysql)
137150

138151
/* If connection isn't secure attempt to get the RSA public key file */
139152
if (!connection_is_secure)
153+
{
154+
#if !defined(HAVE_YASSL)
140155
public_key= rsa_init(mysql);
156+
#endif
157+
}
141158

142159
if (!uses_password)
143160
{
@@ -152,6 +169,7 @@ int sha256_password_auth_client(MYSQL_PLUGIN_VIO *vio, MYSQL *mysql)
152169
unsigned int passwd_len= strlen(mysql->passwd) + 1;
153170
if (!connection_is_secure)
154171
{
172+
#if !defined(HAVE_YASSL)
155173
/*
156174
If no public key; request one from the server.
157175
*/
@@ -195,6 +213,9 @@ int sha256_password_auth_client(MYSQL_PLUGIN_VIO *vio, MYSQL *mysql)
195213

196214
if (vio->write_packet(vio, (uchar*) encrypted_password, cipher_length))
197215
DBUG_RETURN(CR_ERROR);
216+
#else
217+
DBUG_RETURN(CR_ERROR); // If no yassl support
218+
#endif
198219
}
199220
else
200221
{

‎sql/item_strfunc.cc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1942,7 +1942,7 @@ static int calculate_password(String *str, char *buffer)
19421942
if (thd)
19431943
old_passwords= thd->variables.old_passwords;
19441944

1945-
#if defined(HAVE_OPENSSL) && !defined(HAVE_YASSL)
1945+
#if defined(HAVE_OPENSSL)
19461946
if (old_passwords == 2)
19471947
{
19481948
my_make_scrambled_password(buffer, str->ptr(),
@@ -2023,7 +2023,7 @@ char *Item_func_password::
20232023
buff= (char *) thd->alloc(SCRAMBLED_PASSWORD_CHAR_LENGTH + 1);
20242024
my_make_scrambled_password_sha1(buff, password, pass_len);
20252025
}
2026-
#if defined(HAVE_OPENSSL) && !defined(HAVE_YASSL)
2026+
#if defined(HAVE_OPENSSL)
20272027
else
20282028
{
20292029
/* Allocate memory for the password scramble and one extra byte for \0 */

‎sql/password.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -399,7 +399,7 @@ my_crypt(char *to, const uchar *s1, const uchar *s2, uint len)
399399
*to++= *s1++ ^ *s2++;
400400
}
401401

402-
#if defined(HAVE_OPENSSL) && !defined(HAVE_YASSL)
402+
#if defined(HAVE_OPENSSL)
403403
void my_make_scrambled_password(char *to, const char *password,
404404
size_t pass_len)
405405
{

0 commit comments

Comments
 (0)