Commit 3914a792 authored by Sergei Golubchik's avatar Sergei Golubchik

MDEV-19880 pam v1: pam password authentication doesn't work at all in MariaDB 10.4

* fix incorrect parentheses
* if there was no password on the command line or in .cnf file,
  pkt will be "", and we need to request the user to enter the password
parent dd93028d
...@@ -7,9 +7,9 @@ grant proxy on pam_test to test_pam; ...@@ -7,9 +7,9 @@ grant proxy on pam_test to test_pam;
# note that current_user() differs from user() # note that current_user() differs from user()
# #
Challenge input first. Challenge input first.
Enter: not very secret challenge Enter: *************************
Now, the magic number! Now, the magic number!
PIN: **** PIN: 9225
select user(), current_user(), database(); select user(), current_user(), database();
user() current_user() database() user() current_user() database()
test_pam@localhost pam_test@% test test_pam@localhost pam_test@% test
...@@ -17,9 +17,22 @@ test_pam@localhost pam_test@% test ...@@ -17,9 +17,22 @@ test_pam@localhost pam_test@% test
# athentication is unsuccessful # athentication is unsuccessful
# #
Challenge input first. Challenge input first.
Enter: not very secret challenge Enter: *************************
Now, the magic number! Now, the magic number!
PIN: **** PIN: 9224
#
# athentication is successful
#
Now, the magic number!
PIN: 9212
select user(), current_user(), database();
user() current_user() database()
test_pam@localhost pam_test@% test
#
# athentication is unsuccessful
#
Now, the magic number!
PIN: 9212
drop user test_pam; drop user test_pam;
drop user pam_test; drop user pam_test;
uninstall plugin pam; uninstall plugin pam;
...@@ -13,6 +13,11 @@ not very secret challenge ...@@ -13,6 +13,11 @@ not very secret challenge
select user(), current_user(), database(); select user(), current_user(), database();
EOF EOF
--write_file $MYSQLTEST_VARDIR/tmp/pam_good2.txt
9212
select user(), current_user(), database();
EOF
--echo # --echo #
--echo # athentication is successful, challenge/pin are ok --echo # athentication is successful, challenge/pin are ok
--echo # note that current_user() differs from user() --echo # note that current_user() differs from user()
...@@ -25,7 +30,20 @@ EOF ...@@ -25,7 +30,20 @@ EOF
--error 1 --error 1
--exec $MYSQL_TEST -u test_pam --plugin-dir=$plugindir < $MYSQLTEST_VARDIR/tmp/pam_bad.txt --exec $MYSQL_TEST -u test_pam --plugin-dir=$plugindir < $MYSQLTEST_VARDIR/tmp/pam_bad.txt
--echo #
--echo # athentication is successful
--echo #
--error 0
--exec $MYSQL_TEST -u test_pam -pgoodpassword --plugin-dir=$plugindir < $MYSQLTEST_VARDIR/tmp/pam_good2.txt
--echo #
--echo # athentication is unsuccessful
--echo #
--error 1
--exec $MYSQL_TEST -u test_pam -pbadpassword --plugin-dir=$plugindir < $MYSQLTEST_VARDIR/tmp/pam_good2.txt
--remove_file $MYSQLTEST_VARDIR/tmp/pam_good.txt --remove_file $MYSQLTEST_VARDIR/tmp/pam_good.txt
--remove_file $MYSQLTEST_VARDIR/tmp/pam_good2.txt
--remove_file $MYSQLTEST_VARDIR/tmp/pam_bad.txt --remove_file $MYSQLTEST_VARDIR/tmp/pam_bad.txt
drop user test_pam; drop user test_pam;
drop user pam_test; drop user pam_test;
......
...@@ -25,7 +25,7 @@ struct param { ...@@ -25,7 +25,7 @@ struct param {
static int roundtrip(struct param *param, const unsigned char *buf, static int roundtrip(struct param *param, const unsigned char *buf,
int buf_len, unsigned char **pkt) int buf_len, unsigned char **pkt)
{ {
if (param->cached && (buf[0] >> 1) == 2) if (param->cached && *param->cached && (buf[0] >> 1) == 2)
{ {
*pkt= param->cached; *pkt= param->cached;
param->cached= NULL; param->cached= NULL;
...@@ -47,7 +47,7 @@ static int pam_auth(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *info) ...@@ -47,7 +47,7 @@ static int pam_auth(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *info)
/* no user name yet ? read the client handshake packet with the user name */ /* no user name yet ? read the client handshake packet with the user name */
if (info->user_name == 0) if (info->user_name == 0)
{ {
if ((param.cached_len= vio->read_packet(vio, &param.cached) < 0)) if ((param.cached_len= vio->read_packet(vio, &param.cached)) < 0)
return CR_ERROR; return CR_ERROR;
} }
else else
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment