mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 03:52:35 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
mariadb/mysql-test/main/set_password.result
Daniel Black d4c35fb21b MDEV-24207: recognise mysql forms of invalid password for mysql_native_password 
The main goal of this patch is to prevent MariaDB's native_password_plugin
from "parsing" the hex (or non hex) authentication_string. Due to how the
current code is written, we convert any string (within native_password_get_salt)
that has the appropriate length to a "binary" representation, that can
potentially match a real password.

More specifically,
"*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" produces the same results as
"*d13c3c78dafa52d9bce09bdd1adcb7befced1ebe".

The length indicator is the main indicator of an invalid password. We use
use same trick with "invalid" to change its internal representation.

The "parsing" mentioned is by get_salt_from_password down to char_val()
and because if where it is, its effectively a static plugin API that cannot
change.

In supporting these, we support the SHOW CREATE USER from MySQL may have the
hashed password string: *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE.

Obviously this isn't a hash because it contains non-hex characters.

After this patch we do however recognise the pattern;

 [any char, notionally *]{40 chars not all are hex}

as a pattern for an invalid password. This was determined to be the general
pattern that MySQL used.

Reviewers: Sergei G, Vicentiu
2020-12-15 15:15:29 +11:00

211 lines
8.6 KiB
Text
Raw Blame History

set global secure_auth=0;
create user natauth@localhost identified via 'mysql_native_password' using '*94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29';
create user invalidauth@localhost identified via 'mysql_native_password' using 'invalid';
create user newpass@localhost identified by password '*94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29';
create user invalidpass@localhost identified by password 'invalid';
create user newpassnat@localhost identified via 'mysql_native_password';
set password for newpassnat@localhost = '*94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29';
create user invalidpassnat@localhost identified by password 'invalid';
set password for invalidpassnat@localhost = 'invalid';
create user oldauth@localhost identified with 'mysql_old_password' using '378b243e220ca493';
create user oldpass@localhost identified by password '378b243e220ca493';
create user oldpassold@localhost identified with 'mysql_old_password';
set password for oldpassold@localhost = '378b243e220ca493';
create user invalidmysql57auth@localhost identified via 'mysql_native_password' using '*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE';
select user, host, password, plugin, authentication_string from mysql.user where user != 'root';
User Host Password plugin authentication_string
invalidauth localhost invalid mysql_native_password invalid
invalidmysql57auth localhost *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE mysql_native_password *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE
invalidpass localhost invalid mysql_native_password invalid
invalidpassnat localhost invalid mysql_native_password invalid
mariadb.sys localhost mysql_native_password
natauth localhost *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29 mysql_native_password *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29
newpass localhost *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29 mysql_native_password *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29
newpassnat localhost *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29 mysql_native_password *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29
oldauth localhost 378b243e220ca493 mysql_old_password 378b243e220ca493
oldpass localhost 378b243e220ca493 mysql_old_password 378b243e220ca493
oldpassold localhost 378b243e220ca493 mysql_old_password 378b243e220ca493
connect con,localhost,natauth,test,;
select current_user();
current_user()
natauth@localhost
disconnect con;
connect con,localhost,newpass,test,;
select current_user();
current_user()
newpass@localhost
disconnect con;
connect con,localhost,newpassnat,test,;
select current_user();
current_user()
newpassnat@localhost
disconnect con;
connect con,localhost,oldauth,test,;
select current_user();
current_user()
oldauth@localhost
disconnect con;
connect con,localhost,oldpass,test,;
select current_user();
current_user()
oldpass@localhost
disconnect con;
connect con,localhost,oldpassold,test,;
select current_user();
current_user()
oldpassold@localhost
disconnect con;
connection default;
flush privileges;
connect con,localhost,natauth,test,;
select current_user();
current_user()
natauth@localhost
disconnect con;
connect con,localhost,newpass,test,;
select current_user();
current_user()
newpass@localhost
disconnect con;
connect con,localhost,newpassnat,test,;
select current_user();
current_user()
newpassnat@localhost
disconnect con;
connect con,localhost,oldauth,test,;
select current_user();
current_user()
oldauth@localhost
disconnect con;
connect con,localhost,oldpass,test,;
select current_user();
current_user()
oldpass@localhost
disconnect con;
connect con,localhost,oldpassold,test,;
select current_user();
current_user()
oldpassold@localhost
disconnect con;
connection default;
set password for natauth@localhost = PASSWORD('test2');
set password for newpass@localhost = PASSWORD('test2');
set password for newpassnat@localhost = PASSWORD('test2');
set password for oldauth@localhost = PASSWORD('test2');
set password for oldpass@localhost = PASSWORD('test2');
set password for oldpassold@localhost = PASSWORD('test2');
select user, host, password, plugin, authentication_string from mysql.user where user != 'root';
User Host Password plugin authentication_string
invalidauth localhost invalid mysql_native_password invalid
invalidmysql57auth localhost *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE mysql_native_password *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE
invalidpass localhost invalid mysql_native_password invalid
invalidpassnat localhost invalid mysql_native_password invalid
mariadb.sys localhost mysql_native_password
natauth localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
newpass localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
newpassnat localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldauth localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldpass localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldpassold localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
connect con,localhost,natauth,test2,;
select current_user();
current_user()
natauth@localhost
disconnect con;
connect con,localhost,newpass,test2,;
select current_user();
current_user()
newpass@localhost
disconnect con;
connect con,localhost,newpassnat,test2,;
select current_user();
current_user()
newpassnat@localhost
disconnect con;
connect con,localhost,oldauth,test2,;
select current_user();
current_user()
oldauth@localhost
disconnect con;
connect con,localhost,oldpass,test2,;
select current_user();
current_user()
oldpass@localhost
disconnect con;
connect con,localhost,oldpassold,test2,;
select current_user();
current_user()
oldpassold@localhost
disconnect con;
connection default;
flush privileges;
connect con,localhost,natauth,test2,;
select current_user();
current_user()
natauth@localhost
disconnect con;
connect con,localhost,newpass,test2,;
select current_user();
current_user()
newpass@localhost
disconnect con;
connect con,localhost,newpassnat,test2,;
select current_user();
current_user()
newpassnat@localhost
disconnect con;
connect(localhost,invalidauth,invalid,test,MASTER_PORT,MASTER_SOCKET);
connect con,localhost,invalidauth,invalid,;
ERROR 28000: Access denied for user 'invalidauth'@'localhost' (using password: YES)
connect(localhost,invalidpass,invalid,test,MASTER_PORT,MASTER_SOCKET);
connect con,localhost,invalidpass,invalid,;
ERROR 28000: Access denied for user 'invalidpass'@'localhost' (using password: YES)
connect(localhost,invalidpassnat,invalid,test,MASTER_PORT,MASTER_SOCKET);
connect con,localhost,invalidpassnat,invalid,;
ERROR 28000: Access denied for user 'invalidpassnat'@'localhost' (using password: YES)
connect(localhost,invalidmysql57auth,invalid,test,MASTER_PORT,MASTER_SOCKET);
connect con,localhost,invalidmysql57auth,invalid,;
ERROR 28000: Access denied for user 'invalidmysql57auth'@'localhost' (using password: YES)
connect con,localhost,oldauth,test2,;
select current_user();
current_user()
oldauth@localhost
disconnect con;
connect con,localhost,oldpass,test2,;
select current_user();
current_user()
oldpass@localhost
disconnect con;
connect con,localhost,oldpassold,test2,;
select current_user();
current_user()
oldpassold@localhost
disconnect con;
connection default;
drop user natauth@localhost, newpass@localhost, newpassnat@localhost;
drop user invalidauth@localhost, invalidpass@localhost, invalidpassnat@localhost,invalidmysql57auth@localhost;
drop user oldauth@localhost, oldpass@localhost, oldpassold@localhost;
set global secure_auth=default;
# switching from mysql.global_priv to mysql.user
create user foo@localhost identified with mysql_native_password;
update mysql.user set authentication_string=password('foo'), plugin='mysql_native_password' where user='foo' and host='localhost';
set password for 'foo'@'localhost' = password('bar');
flush privileges;
connect foo, localhost, foo, bar;
select user(), current_user();
user() current_user()
foo@localhost foo@localhost
show grants;
Grants for foo@localhost
GRANT USAGE ON *.* TO `foo`@`localhost` IDENTIFIED BY PASSWORD '*E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB'
disconnect foo;
connection default;
select user,host,password,plugin,authentication_string from mysql.user where user='foo';
user host password plugin authentication_string
foo localhost mysql_native_password *E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB
set password for 'foo'@'localhost' = '';
select user,host,password,plugin,authentication_string from mysql.user where user='foo';
user host password plugin authentication_string
foo localhost mysql_native_password
drop user foo@localhost;
# switching back from mysql.user to mysql.global_priv
Reference in a new issue View git blame Copy permalink