mirror of
https://github.com/MariaDB/server.git
synced 2025-01-30 18:41:56 +01:00
c94ec9fc67
Revert the side effect of 7c40996cc8.
Do not convert password hash to its binary representation when a user
entry is loaded. Do it lazily on the first authenticatation attempt.
As a collateral - force all authentication plugins to follow the
protocol and read_packet at least once before accessing info->username
(username is not available before first client handshake packet is read).
Fix PAM and GSSAPI plugins to behave.
42 lines
1.2 KiB
Text
42 lines
1.2 KiB
Text
--source include/have_unix_socket.inc
|
|
|
|
#
|
|
# MDEV-3909 remote user enumeration
|
|
# unix_socket tests
|
|
#
|
|
update mysql.global_priv set priv=json_insert(priv, '$.plugin', 'unix_socket');
|
|
flush privileges;
|
|
|
|
# Make sure that the replace works, even if $USER is 'user' or something else
|
|
# that matches other parts of the error message.
|
|
let $replace=Access denied for user '$USER';
|
|
|
|
--echo connect(localhost,USER,,test,MASTER_PORT,MASTER_SOCKET);
|
|
--replace_result $replace "Access denied for user 'USER'"
|
|
--disable_query_log
|
|
--error ER_PLUGIN_IS_NOT_LOADED
|
|
connect (fail,localhost,$USER);
|
|
--enable_query_log
|
|
|
|
--replace_result $replace "Access denied for user 'USER'"
|
|
--error ER_PLUGIN_IS_NOT_LOADED
|
|
change_user $USER;
|
|
|
|
eval install plugin unix_socket soname '$AUTH_SOCKET_SO';
|
|
flush privileges;
|
|
|
|
--echo connect(localhost,USER,,test,MASTER_PORT,MASTER_SOCKET);
|
|
--replace_result $replace "Access denied for user 'USER'"
|
|
--disable_query_log
|
|
--error ER_ACCESS_DENIED_NO_PASSWORD_ERROR
|
|
connect (fail,localhost,$USER);
|
|
--enable_query_log
|
|
|
|
--replace_result $replace "Access denied for user 'USER'"
|
|
--error ER_ACCESS_DENIED_NO_PASSWORD_ERROR
|
|
change_user $USER;
|
|
|
|
update mysql.global_priv set priv=json_remove(priv, '$.plugin');
|
|
flush privileges;
|
|
uninstall plugin unix_socket;
|
|
|