Skip to content

Commit 9012ea9

Browse files
gkodinovgkodinov
committed
WL#12803: SHOW CREATE USER AND CREATE USER TO WORK WITH HEX STRINGS FOR
AUTH DATA RB#21210
1 parent 0e4519e commit 9012ea9

14 files changed

+198
-16
lines changed

‎mysql-test/r/all_persisted_variables.result

+4-4
Original file line numberDiff line numberDiff line change
@@ -37,17 +37,17 @@ include/assert.inc [Expect 500+ variables in the table. Due to open Bugs, we are
3737

3838
# Test SET PERSIST
3939

40-
include/assert.inc [Expect 377 persisted variables in the table.]
40+
include/assert.inc [Expect 378 persisted variables in the table.]
4141

4242
************************************************************
4343
* 3. Restart server, it must preserve the persisted variable
4444
* settings. Verify persisted configuration.
4545
************************************************************
4646
# restart
4747

48-
include/assert.inc [Expect 377 persisted variables in persisted_variables table.]
49-
include/assert.inc [Expect 377 persisted variables shown as PERSISTED in variables_info table.]
50-
include/assert.inc [Expect 377 persisted variables with matching peristed and global values.]
48+
include/assert.inc [Expect 378 persisted variables in persisted_variables table.]
49+
include/assert.inc [Expect 378 persisted variables shown as PERSISTED in variables_info table.]
50+
include/assert.inc [Expect 378 persisted variables with matching peristed and global values.]
5151

5252
************************************************************
5353
* 4. Test RESET PERSIST IF EXISTS. Verify persisted variable

‎mysql-test/r/mysqld--help-notwin.result

+4
Original file line numberDiff line numberDiff line change
@@ -971,6 +971,9 @@ The following options may be given as the first argument:
971971
--preload-buffer-size=#
972972
The size of the buffer that is allocated when preloading
973973
indexes
974+
--print-identified-with-as-hex
975+
SHOW CREATE USER will print the AS clause as HEX if it
976+
contains non-prinable characters
974977
--profiling-history-size=#
975978
Limit of query profiling memory
976979
--query-alloc-block-size=#
@@ -1650,6 +1653,7 @@ persisted-globals-load TRUE
16501653
port ####
16511654
port-open-timeout 0
16521655
preload-buffer-size 32768
1656+
print-identified-with-as-hex FALSE
16531657
profiling-history-size 15
16541658
query-alloc-block-size 8192
16551659
query-prealloc-size 8192

‎mysql-test/r/mysqld--help-win.result

+4
Original file line numberDiff line numberDiff line change
@@ -974,6 +974,9 @@ The following options may be given as the first argument:
974974
--preload-buffer-size=#
975975
The size of the buffer that is allocated when preloading
976976
indexes
977+
--print-identified-with-as-hex
978+
SHOW CREATE USER will print the AS clause as HEX if it
979+
contains non-prinable characters
977980
--profiling-history-size=#
978981
Limit of query profiling memory
979982
--query-alloc-block-size=#
@@ -1662,6 +1665,7 @@ persisted-globals-load TRUE
16621665
port ####
16631666
port-open-timeout 0
16641667
preload-buffer-size 32768
1668+
print-identified-with-as-hex FALSE
16651669
profiling-history-size 15
16661670
query-alloc-block-size 8192
16671671
query-prealloc-size 8192

‎mysql-test/suite/binlog/r/print_identified_with_as_hex.result

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
include/master-slave.inc
2+
Warnings:
3+
Note #### Sending passwords in plain text without SSL/TLS is extremely insecure.
4+
Note #### Storing MySQL user name or password information in the master info repository is not secure and is therefore not recommended. Please consider using the USER and PASSWORD connection options for START SLAVE; see the 'START SLAVE Syntax' in the MySQL Manual for more information.
5+
[connection master]
6+
# This corresponds to CREATE USER foo@localhost IDENTIFIED BY 'bar'
7+
# But because of the salt we peg the whole hash instead.
8+
CREATE USER foo@localhost IDENTIFIED WITH 'caching_sha2_password' AS 0x244124303035240C4D7A6D25436F2C0A08515310644615383E2A123961484C6276734178425A446172436B58446A582F6178544A692E6F644E4F2F4E596E666276454B563336 PASSWORD HISTORY DEFAULT;
9+
include/sync_slave_sql_with_master.inc
10+
[On Slave]
11+
# The statement should be printed without the hex, according to the default value for the option
12+
include/show_binlog_events.inc
13+
Log_name Pos Event_type Server_id End_log_pos Info
14+
slave-bin.000001 # Query # # use `test`; CREATE USER 'foo'@'localhost' IDENTIFIED WITH 'caching_sha2_password' AS '$A$005$ Mzm%Co,\nQSdF8>*9aHLbvsAxBZDarCkXDjX/axTJi.odNO/NYnfbvEKV36' PASSWORD HISTORY DEFAULT
15+
# cleanup
16+
DROP USER foo@localhost;
17+
include/rpl_end.inc

‎mysql-test/suite/binlog/t/print_identified_with_as_hex.test

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Save the initial number of concurrent sessions
2+
--source include/count_sessions.inc
3+
--source include/master-slave.inc
4+
--connection master
5+
6+
--echo # This corresponds to CREATE USER foo@localhost IDENTIFIED BY 'bar'
7+
--echo # But because of the salt we peg the whole hash instead.
8+
CREATE USER foo@localhost IDENTIFIED WITH 'caching_sha2_password' AS 0x244124303035240C4D7A6D25436F2C0A08515310644615383E2A123961484C6276734178425A446172436B58446A582F6178544A692E6F644E4F2F4E596E666276454B563336 PASSWORD HISTORY DEFAULT;
9+
10+
--source include/sync_slave_sql_with_master.inc
11+
--echo [On Slave]
12+
--echo # The statement should be printed without the hex, according to the default value for the option
13+
--source include/show_binlog_events.inc
14+
15+
--echo # cleanup
16+
--connection master
17+
DROP USER foo@localhost;
18+
--source include/rpl_end.inc

‎mysql-test/suite/sys_vars/r/print_identified_with_as_hex_basic.result

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Should be off by default
2+
SELECT @@GLOBAL.print_identified_with_as_hex, @@SESSION.print_identified_with_as_hex;
3+
@@GLOBAL.print_identified_with_as_hex @@SESSION.print_identified_with_as_hex
4+
0 0
5+
SET GLOBAL print_identified_with_as_hex=1;
6+
SELECT @@GLOBAL.print_identified_with_as_hex, @@SESSION.print_identified_with_as_hex;
7+
@@GLOBAL.print_identified_with_as_hex @@SESSION.print_identified_with_as_hex
8+
1 0
9+
SET SESSION print_identified_with_as_hex=1;
10+
SELECT @GLOBAL.print_identified_with_as_hex, @@SESSION.print_identified_with_as_hex;
11+
@GLOBAL.print_identified_with_as_hex @@SESSION.print_identified_with_as_hex
12+
NULL 1
13+
# This corresponds to CREATE USER foo@localhost IDENTIFIED BY 'bar'
14+
# But because of the salt we peg the whole hash instead.
15+
CREATE USER 'foo'@'localhost' IDENTIFIED WITH 'caching_sha2_password' AS 0x244124303035240C4D7A6D25436F2C0A08515310644615383E2A123961484C6276734178425A446172436B58446A582F6178544A692E6F644E4F2F4E596E666276454B563336 REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT;
16+
CREATE USER oldfoo@localhost IDENTIFIED WITH 'mysql_native_password' BY 'bar';
17+
# Should display hex: unprintable symbols
18+
SHOW CREATE USER foo@localhost;
19+
CREATE USER for foo@localhost
20+
CREATE USER 'foo'@'localhost' IDENTIFIED WITH 'caching_sha2_password' AS 0x244124303035240C4D7A6D25436F2C0A08515310644615383E2A123961484C6276734178425A446172436B58446A582F6178544A692E6F644E4F2F4E596E666276454B563336 REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT
21+
# Should not display hex: native passwords not having non-printable bytes
22+
SHOW CREATE USER oldfoo@localhost;
23+
CREATE USER for oldfoo@localhost
24+
CREATE USER 'oldfoo'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT
25+
SET SESSION print_identified_with_as_hex=0;
26+
# Should not display hex: turned off
27+
SHOW CREATE USER foo@localhost;
28+
CREATE USER for foo@localhost
29+
CREATE USER 'foo'@'localhost' IDENTIFIED WITH 'caching_sha2_password' AS '$A$005$ Mzm%Co,\nQSdF8>*9aHLbvsAxBZDarCkXDjX/axTJi.odNO/NYnfbvEKV36' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT
30+
# Should not display hex: turned off
31+
SHOW CREATE USER oldfoo@localhost;
32+
CREATE USER for oldfoo@localhost
33+
CREATE USER 'oldfoo'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT
34+
# Now try to reply the statement produced by SHOW CREATE
35+
DROP USER foo@localhost;
36+
# Replaying the collected statement
37+
# Connecting as foo: should work
38+
SELECT 1;
39+
1
40+
1
41+
# back to default connection
42+
# Cleanup
43+
DROP USER foo@localhost,oldfoo@localhost;
44+
SET GLOBAL print_identified_with_as_hex=default;

‎mysql-test/suite/sys_vars/t/print_identified_with_as_hex_basic.test

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Save the initial number of concurrent sessions
2+
--source include/count_sessions.inc
3+
4+
--echo # Should be off by default
5+
SELECT @@GLOBAL.print_identified_with_as_hex, @@SESSION.print_identified_with_as_hex;
6+
SET GLOBAL print_identified_with_as_hex=1;
7+
SELECT @@GLOBAL.print_identified_with_as_hex, @@SESSION.print_identified_with_as_hex;
8+
SET SESSION print_identified_with_as_hex=1;
9+
SELECT @GLOBAL.print_identified_with_as_hex, @@SESSION.print_identified_with_as_hex;
10+
11+
--echo # This corresponds to CREATE USER foo@localhost IDENTIFIED BY 'bar'
12+
--echo # But because of the salt we peg the whole hash instead.
13+
CREATE USER 'foo'@'localhost' IDENTIFIED WITH 'caching_sha2_password' AS 0x244124303035240C4D7A6D25436F2C0A08515310644615383E2A123961484C6276734178425A446172436B58446A582F6178544A692E6F644E4F2F4E596E666276454B563336 REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT;
14+
CREATE USER oldfoo@localhost IDENTIFIED WITH 'mysql_native_password' BY 'bar';
15+
--echo # Should display hex: unprintable symbols
16+
SHOW CREATE USER foo@localhost;
17+
--echo # Should not display hex: native passwords not having non-printable bytes
18+
SHOW CREATE USER oldfoo@localhost;
19+
SET SESSION print_identified_with_as_hex=0;
20+
--echo # Should not display hex: turned off
21+
SHOW CREATE USER foo@localhost;
22+
--echo # Should not display hex: turned off
23+
SHOW CREATE USER oldfoo@localhost;
24+
25+
--echo # Now try to reply the statement produced by SHOW CREATE
26+
--exec $MYSQL -e "SHOW CREATE USER foo@localhost" -s -s -s > $MYSQLTEST_VARDIR/tmp/hex_user.sql
27+
DROP USER foo@localhost;
28+
--echo # Replaying the collected statement
29+
--exec $MYSQL < $MYSQLTEST_VARDIR/tmp/hex_user.sql
30+
--echo # Connecting as foo: should work
31+
connect(con1,localhost,foo,bar,test);
32+
SELECT 1;
33+
--echo # back to default connection
34+
connection default;
35+
disconnect con1;
36+
37+
--echo # Cleanup
38+
--remove_file $MYSQLTEST_VARDIR/tmp/hex_user.sql
39+
DROP USER foo@localhost,oldfoo@localhost;
40+
SET GLOBAL print_identified_with_as_hex=default;
41+
42+
# Wait till all disconnects are completed
43+
--source include/wait_until_count_sessions.inc

‎mysql-test/t/all_persisted_variables.test

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
call mtr.add_suppression("Failed to set up SSL because of the following SSL library error");
4040

4141
let $total_global_vars=`SELECT COUNT(*) FROM performance_schema.global_variables where variable_name NOT LIKE 'ndb_%'`;
42-
let $total_persistent_vars=377;
42+
let $total_persistent_vars=378;
4343

4444
--echo ***************************************************************
4545
--echo * 0. Verify that variables present in performance_schema.global

‎sql/auth/sql_user.cc

+2-1
Original file line numberDiff line numberDiff line change
@@ -330,7 +330,8 @@ bool mysql_show_create_user(THD *thd, LEX_USER *user_name,
330330
}
331331
lex->users_list.push_back(user_name);
332332
{
333-
Show_user_params show_user_params(hide_password_hash);
333+
Show_user_params show_user_params(
334+
hide_password_hash, thd->variables.print_identified_with_as_hex);
334335
mysql_rewrite_acl_query(thd, Consumer_type::STDOUT, &show_user_params,
335336
false);
336337
sql_text.takeover(thd->rewritten_query);

‎sql/sql_rewrite.cc

+33-5
Original file line numberDiff line numberDiff line change
@@ -784,10 +784,8 @@ void Rewriter_alter_user::rewrite_password_reuse(const LEX *lex,
784784
Rewriter_show_create_user::Rewriter_show_create_user(THD *thd,
785785
Consumer_type type,
786786
Rewrite_params *params)
787-
: Rewriter_user(thd, type) {
788-
Show_user_params *show_params = dynamic_cast<Show_user_params *>(params);
789-
if (show_params) m_hide_password_hash = show_params->hide_password_hash;
790-
}
787+
: Rewriter_user(thd, type),
788+
show_params_(dynamic_cast<Show_user_params *>(params)) {}
791789

792790
/**
793791
Rewrite the query for the SHOW CREATE USER statement.
@@ -804,6 +802,36 @@ bool Rewriter_show_create_user::rewrite() const {
804802
parent::rewrite();
805803
return true;
806804
}
805+
806+
/**
807+
A special rewriter override to make SHOW CREATE USER convert the string
808+
to hex if print_identified_with_as hex is on
809+
810+
@param [in] user LEX_USER to fetch the auth string of it.
811+
@param [in, out] str The string in which hash value is suffixed
812+
813+
@sa Rewriter_user::append_auth_str
814+
*/
815+
void Rewriter_show_create_user::append_auth_str(LEX_USER *user,
816+
String *str) const {
817+
String from_auth(user->auth.str, user->auth.length, system_charset_info);
818+
819+
if (show_params_ && show_params_->print_identified_with_as_hex_ &&
820+
user->auth.length) {
821+
for (const char *c = user->auth.str;
822+
static_cast<size_t>(c - user->auth.str) < user->auth.length; c++) {
823+
if (!my_isgraph(system_charset_info, *c)) {
824+
from_auth.alloc(user->auth.length * 2 + 3);
825+
str_to_hex(from_auth.c_ptr_quick(), user->auth.str, user->auth.length);
826+
from_auth.length(user->auth.length * 2 + 2);
827+
str->append(from_auth);
828+
829+
return;
830+
}
831+
}
832+
}
833+
append_query_string(m_thd, system_charset_info, &from_auth, str);
834+
}
807835
/**
808836
Append the PASSWORD HISTORY clause for users
809837
@@ -840,7 +868,7 @@ void Rewriter_show_create_user::append_user_auth_info(LEX_USER *user,
840868
append_plugin_name(user, str);
841869
if (user->auth.length > 0) {
842870
str->append(STRING_WITH_LEN(" AS "));
843-
if (m_hide_password_hash) {
871+
if (show_params_ && show_params_->hide_password_hash) {
844872
append_literal_secret(str);
845873
} else {
846874
append_auth_str(user, str);

‎sql/sql_rewrite.h

+11-4
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,12 @@ class User_params : public Rewrite_params {
6767
*/
6868
class Show_user_params : public Rewrite_params {
6969
public:
70-
Show_user_params(bool hide_password_hash)
71-
: Rewrite_params(), hide_password_hash(hide_password_hash) {}
70+
Show_user_params(bool hide_password_hash, bool print_identified_with_as_hex)
71+
: Rewrite_params(),
72+
hide_password_hash(hide_password_hash),
73+
print_identified_with_as_hex_(print_identified_with_as_hex) {}
7274
bool hide_password_hash;
75+
bool print_identified_with_as_hex_;
7376
};
7477

7578
/**
@@ -147,7 +150,7 @@ class Rewriter_user : public I_rewriter {
147150
/* Append the literal value <secret> to the str */
148151
void append_literal_secret(String *str) const;
149152
/* Append the password hash to the output string */
150-
void append_auth_str(LEX_USER *lex, String *str) const;
153+
virtual void append_auth_str(LEX_USER *lex, String *str) const;
151154
/* Append the authentication plugin name for the user */
152155
void append_plugin_name(const LEX_USER *user, String *str) const;
153156
/*
@@ -216,14 +219,18 @@ class Rewriter_show_create_user final : public Rewriter_user {
216219
Rewrite_params *params);
217220
bool rewrite() const override;
218221

222+
protected:
223+
/* Append the password hash to the output string */
224+
virtual void append_auth_str(LEX_USER *lex, String *str) const override;
225+
219226
private:
220227
void append_user_auth_info(LEX_USER *user, bool comma,
221228
String *str) const override;
222229
void rewrite_password_history(const LEX *lex, String *str) const override;
223230
void rewrite_password_reuse(const LEX *lex, String *str) const override;
224231
/* Append the DEFAULT ROLE OPTIONS clause */
225232
void rewrite_default_roles(const LEX *lex, String *str) const;
226-
bool m_hide_password_hash = false;
233+
Show_user_params *show_params_;
227234
};
228235
/** Rewrites the SET statement. */
229236
class Rewriter_set : public I_rewriter {

‎sql/sql_yacc.yy

+4
Original file line numberDiff line numberDiff line change
@@ -13886,6 +13886,10 @@ TEXT_STRING_password:
1388613886

1388713887
TEXT_STRING_hash:
1388813888
TEXT_STRING_sys
13889+
| HEX_NUM
13890+
{
13891+
$$= Item_hex_string::make_hex_str($1.str, $1.length);
13892+
}
1388913893
;
1389013894

1389113895
TEXT_STRING_validated:

‎sql/sys_vars.cc

+7
Original file line numberDiff line numberDiff line change
@@ -6560,3 +6560,10 @@ static Sys_var_bool Sys_table_encryption_privilege_check(
65606560
GLOBAL_VAR(opt_table_encryption_privilege_check), CMD_LINE(OPT_ARG),
65616561
DEFAULT(false), NO_MUTEX_GUARD, NOT_IN_BINLOG,
65626562
ON_CHECK(check_set_table_encryption_privilege_access), ON_UPDATE(0));
6563+
6564+
static Sys_var_bool Sys_var_print_identified_with_as_hex(
6565+
"print_identified_with_as_hex",
6566+
"SHOW CREATE USER will print the AS clause as HEX if it contains "
6567+
"non-prinable characters",
6568+
SESSION_VAR(print_identified_with_as_hex), CMD_LINE(OPT_ARG),
6569+
DEFAULT(false));

‎sql/system_variables.h

+6-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License, version 2.0,
@@ -383,6 +383,11 @@ struct System_variables {
383383
default.
384384
*/
385385
bool default_table_encryption;
386+
387+
/**
388+
@sa Sys_var_print_identified_with_as_hex
389+
*/
390+
bool print_identified_with_as_hex;
386391
};
387392

388393
/**

0 commit comments

Comments
 (0)