mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 03:52:35 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-10361 Crash in pam_securid.so with auth_pam connecting from SQLyog

Browse source 
auth_pam: debug output
This commit is contained in:
Sergei Golubchik 2016-07-26 12:34:04 +02:00
parent d0d99dec91
commit ea91bb6801
4 changed files with 34 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
mysql-test/include/default_mysqld.cnf
View file

@ -45,6 +45,8 @@ loose-feedback-debug-startup-interval=20
loose-feedback-debug-first-interval=60
loose-feedback-debug-interval=60
loose-pam-debug
loose-innodb_data_file_path= ibdata1:12M:autoextend
loose-innodb_buffer_pool_size= 8M
loose-innodb_lru_scan_depth= 100

2
mysql-test/suite/plugins/r/pam_cleartext.result
View file

@ -2,7 +2,7 @@ install plugin pam soname 'auth_pam.so';
create user test_pam identified via pam using 'mariadb_mtr';
create user pam_test;
grant proxy on pam_test to test_pam;
show variables like 'pam%';
show variables like 'pam_use_%';
Variable_name Value
pam_use_cleartext_plugin ON
drop user test_pam;

2
mysql-test/suite/plugins/t/pam_cleartext.test
View file

@ -1,7 +1,7 @@
--source pam_init.inc
show variables like 'pam%';
show variables like 'pam_use_%';
--error 1
--exec echo FAIL | $MYSQL_TEST -u test_pam --plugin-dir=$plugindir

30
plugin/auth_pam/auth_pam.c
View file

@ -17,6 +17,7 @@
#define _GNU_SOURCE 1 /* for strndup */
#include <mysql/plugin_auth.h>
#include <stdio.h>
#include <string.h>
#include <security/pam_appl.h>
#include <security/pam_modules.h>
@ -44,6 +45,13 @@ char *strndup(const char *from, size_t length)
}
#endif
#ifndef DBUG_OFF
static char pam_debug = 0;
#define PAM_DEBUG(X) do { if (pam_debug) { fprintf X; } } while(0)
#else
#define PAM_DEBUG(X) /* no-op */
#endif
static int conv(int n, const struct pam_message **msg,
struct pam_response **resp, void *data)
{
@ -91,12 +99,17 @@ static int conv(int n, const struct pam_message **msg,
4 means "password-like input, echo disabled"
C'est la vie. */
param->buf[0] = msg[i]->msg_style == PAM_PROMPT_ECHO_ON ? 2 : 4;
PAM_DEBUG((stderr, "PAM: conv: send(%.*s)\n", (int)(param->ptr - param->buf - 1), param->buf));
if (param->vio->write_packet(param->vio, param->buf, param->ptr - param->buf - 1))
return PAM_CONV_ERR;
pkt_len = param->vio->read_packet(param->vio, &pkt);
if (pkt_len < 0)
{
PAM_DEBUG((stderr, "PAM: conv: recv() ERROR\n"));
return PAM_CONV_ERR;
}
PAM_DEBUG((stderr, "PAM: conv: recv(%.*s)\n", pkt_len, pkt));
/* allocate and copy the reply to the response array */
if (!((*resp)[i].resp= strndup((char*) pkt, pkt_len)))
return PAM_CONV_ERR;
@ -134,9 +147,16 @@ static int pam_auth(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *info)
param.ptr = param.buf + 1;
param.vio = vio;
PAM_DEBUG((stderr, "PAM: pam_start(%s, %s)\n", service, info->user_name));
DO( pam_start(service, info->user_name, &pam_start_arg, &pamh) );
PAM_DEBUG((stderr, "PAM: pam_authenticate(0)\n"));
DO( pam_authenticate (pamh, 0) );
PAM_DEBUG((stderr, "PAM: pam_acct_mgmt(0)\n"));
DO( pam_acct_mgmt(pamh, 0) );
PAM_DEBUG((stderr, "PAM: pam_get_item(PAM_USER)\n"));
DO( pam_get_item(pamh, PAM_USER, (pam_get_item_3_arg) &new_username) );
if (new_username && strcmp(new_username, info->user_name))
@ -145,6 +165,7 @@ static int pam_auth(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *info)
end:
pam_end(pamh, status);
PAM_DEBUG((stderr, "PAM: status = %d user = %s\n", status, new_username));
return status == PAM_SUCCESS ? CR_OK : CR_ERROR;
}
@ -163,8 +184,17 @@ static MYSQL_SYSVAR_BOOL(use_cleartext_plugin, use_cleartext_plugin,
"supports simple PAM policies that don't require anything besides "
"a password", NULL, NULL, 0);
#ifndef DBUG_OFF
static MYSQL_SYSVAR_BOOL(debug, pam_debug, PLUGIN_VAR_OPCMDARG,
"Log all PAM activity", NULL, NULL, 0);
#endif
static struct st_mysql_sys_var* vars[] = {
MYSQL_SYSVAR(use_cleartext_plugin),
#ifndef DBUG_OFF
MYSQL_SYSVAR(debug),
#endif
NULL
};