Merge lp:~sergei.glushchenko/percona-server/CVE-2012-5627-bug1172090-5.6 into lp:percona-server/5.6

[Sergei Glushchenko]

This is a manual merge fix for #1172090, #1171941 from 5.6

http://jenkins.percona.com/view/PS%205.6/job/percona-server-5.6-param/81/

[Laurynas Biveinis (laurynas-biveinis)]

Same comment as for 5.5, also the sql_acl.cc bit in rev 342 belongs to 343 instead. It is benign enough though.

review: Approve

=== modified file 'Percona-Server/client/mysqltest.cc'
--- Percona-Server/client/mysqltest.cc	2013-03-05 12:46:43 +0000
+++ Percona-Server/client/mysqltest.cc	2013-05-01 09:25:43 +0000
@@ -4165,7 +4165,10 @@
                       cur_con->name, ds_user.str, ds_passwd.str, ds_db.str));
 
   if (mysql_change_user(mysql, ds_user.str, ds_passwd.str, ds_db.str))
-    die("change user failed: %s", mysql_error(mysql));
+    handle_error(command, mysql_errno(mysql), mysql_error(mysql),
+                 mysql_sqlstate(mysql), &ds_res);
+  else
+    handle_no_error(command);
 
   dynstr_free(&ds_user);
   dynstr_free(&ds_passwd);
 
=== added file 'Percona-Server/mysql-test/r/change_user_notembedded.result'
--- Percona-Server/mysql-test/r/change_user_notembedded.result	1970-01-01 00:00:00 +0000
+++ Percona-Server/mysql-test/r/change_user_notembedded.result	2013-05-01 09:25:43 +0000
@@ -0,0 +1,5 @@
+ERROR 28000: Access denied for user 'foo'@'localhost' (using password: YES)
+ERROR 28000: Access denied for user 'foo'@'localhost' (using password: NO)
+ERROR 28000: Access denied for user 'foo'@'localhost' (using password: YES)
+ERROR 08S01: Unknown command
+ERROR 08S01: Unknown command
 
=== added file 'Percona-Server/mysql-test/r/failed_auth_3909.result'
--- Percona-Server/mysql-test/r/failed_auth_3909.result	1970-01-01 00:00:00 +0000
+++ Percona-Server/mysql-test/r/failed_auth_3909.result	2013-05-01 09:25:43 +0000
@@ -0,0 +1,20 @@
+optimize table mysql.user;
+Table	Op	Msg_type	Msg_text
+mysql.user	optimize	status	OK
+insert mysql.user (user,plugin) values ('foo','bar'),('bar','bar'),('baz','bar');
+Warnings:
+Warning	1364	Field 'ssl_cipher' doesn't have a default value
+Warning	1364	Field 'x509_issuer' doesn't have a default value
+Warning	1364	Field 'x509_subject' doesn't have a default value
+flush privileges;
+connect(localhost,u1,,test,MASTER_PORT,MASTER_SOCKET);
+ERROR HY000: Plugin 'bar' is not loaded
+connect(localhost,u2,,test,MASTER_PORT,MASTER_SOCKET);
+ERROR 28000: Access denied for user 'u2'@'localhost' (using password: NO)
+connect(localhost,u2,password,test,MASTER_PORT,MASTER_SOCKET);
+ERROR 28000: Access denied for user 'u2'@'localhost' (using password: YES)
+ERROR HY000: Plugin 'bar' is not loaded
+ERROR 28000: Access denied for user 'u2'@'localhost' (using password: NO)
+ERROR 28000: Access denied for user 'u2'@'localhost' (using password: YES)
+delete from mysql.user where plugin = 'bar';
+flush privileges;
 
=== modified file 'Percona-Server/mysql-test/r/mysqltest.result'
--- Percona-Server/mysql-test/r/mysqltest.result	2012-08-22 01:40:20 +0000
+++ Percona-Server/mysql-test/r/mysqltest.result	2013-05-01 09:25:43 +0000
@@ -929,9 +929,9 @@
 b	varchar(255)	YES		NULL	
 c	datetime	YES		NULL	
 drop table t1;
-mysqltest: At line 1: change user failed: Unknown database 'inexistent'
-mysqltest: At line 1: change user failed: Access denied for user 'inexistent'@'localhost' (using password: NO)
-mysqltest: At line 1: change user failed: Access denied for user 'root'@'localhost' (using password: YES)
+mysqltest: At line 1: query 'change_user root,,inexistent' failed: 1049: Unknown database 'inexistent'
+mysqltest: At line 1: query 'change_user inexistent,,test' failed: 1045: Access denied for user 'inexistent'@'localhost' (using password: NO)
+mysqltest: At line 1: query 'change_user root,inexistent,test' failed: 1045: Access denied for user 'root'@'localhost' (using password: YES)
 REPLACED_FILE1.txt
 file1.txt
 file2.txt
 
=== added file 'Percona-Server/mysql-test/t/change_user_notembedded.test'
--- Percona-Server/mysql-test/t/change_user_notembedded.test	1970-01-01 00:00:00 +0000
+++ Percona-Server/mysql-test/t/change_user_notembedded.test	2013-05-01 09:25:43 +0000
@@ -0,0 +1,24 @@
+source include/not_embedded.inc;
+
+#
+# MDEV-3915 COM_CHANGE_USER allows fast password brute-forcing
+#
+# only three failed change_user per connection.
+# successful change_user do NOT reset the counter
+#
+connect (test,localhost,root,,);
+connection test;
+--error 1045
+change_user foo,bar;
+--error 1045
+change_user foo;
+change_user;
+--error 1045
+change_user foo,bar;
+--error 1047
+change_user foo,bar;
+--error 1047
+change_user;
+disconnect test;
+connection default;
+
 
=== added file 'Percona-Server/mysql-test/t/failed_auth_3909.test'
--- Percona-Server/mysql-test/t/failed_auth_3909.test	1970-01-01 00:00:00 +0000
+++ Percona-Server/mysql-test/t/failed_auth_3909.test	2013-05-01 09:25:43 +0000
@@ -0,0 +1,37 @@
+source include/not_embedded.inc;
+
+#
+# MDEV-3909 remote user enumeration
+#
+# verify that for some failed login attemps (with wrong user names)
+# the server requests a plugin
+#
+optimize table mysql.user;
+insert mysql.user (user,plugin) values ('foo','bar'),('bar','bar'),('baz','bar');
+flush privileges;
+
+--replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT
+--error ER_PLUGIN_IS_NOT_LOADED
+connect (fail,localhost,u1);
+
+--replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT
+--error ER_ACCESS_DENIED_ERROR
+connect (fail,localhost,u2);
+
+--replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT
+--error ER_ACCESS_DENIED_ERROR
+connect (fail,localhost,u2,password);
+
+--error ER_PLUGIN_IS_NOT_LOADED
+change_user u1;
+
+--error ER_ACCESS_DENIED_ERROR
+change_user u2;
+
+--error ER_ACCESS_DENIED_ERROR
+change_user u2,password;
+
+delete from mysql.user where plugin = 'bar';
+flush privileges;
+
+
 
=== modified file 'Percona-Server/sql/sql_acl.cc'
--- Percona-Server/sql/sql_acl.cc	2013-03-05 12:46:43 +0000
+++ Percona-Server/sql/sql_acl.cc	2013-05-01 09:25:43 +0000
@@ -9126,6 +9126,7 @@
     uint pkt_len;
   } cached_server_packet;
   int packets_read, packets_written; ///< counters for send/received packets
+  bool make_it_fail;
   /** when plugin returns a failure this tells us what really happened */
   enum { SUCCESS, FAILURE, RESTART } status;
 
@@ -9488,14 +9489,14 @@
 /**
    Finds acl entry in user database for authentication purposes.
    
-   Finds a user and copies it into mpvio. Reports an authentication
-   failure if a user is not found.
+   Finds a user and copies it into mpvio. Creates a fake user
+   if no matching user account is found.
 
    @note find_acl_user is not the same, because it doesn't take into
    account the case when user is not empty, but acl_user->user is empty
 
    @retval 0    found
-   @retval 1    not found
+   @retval 1    error
 */
 static bool find_mpvio_user(MPVIO_EXT *mpvio)
 {
@@ -9530,8 +9531,32 @@
 
   if (!mpvio->acl_user)
   {
-    login_failed_error(mpvio, mpvio->auth_info.password_used);
-    DBUG_RETURN (1);
+    /*
+      A matching user was not found. Fake it. Take any user, make the
+      authentication fail later.
+      This way we get a realistically looking failure, with occasional
+      "change auth plugin" requests even for nonexistent users. The ratio
+      of "change auth plugin" request will be the same for real and
+      nonexistent users.
+      Note, that we cannot pick any user at random, it must always be
+      the same user account for the incoming sctx->user name.
+    */
+    ulong nr1=1, nr2=4;
+    CHARSET_INFO *cs= &my_charset_latin1;
+    cs->coll->hash_sort(cs, (uchar*) mpvio->auth_info.user_name,
+                        mpvio->auth_info.user_name_length, &nr1, &nr2);
+
+    mysql_mutex_lock(&acl_cache->lock);
+    uint i= nr1 % acl_users.elements;
+    ACL_USER *acl_user_tmp= dynamic_element(&acl_users, i, ACL_USER*);
+    mpvio->acl_user= acl_user_tmp->copy(mpvio->mem_root);
+    make_lex_string_root(mpvio->mem_root, 
+                         &mpvio->acl_user_plugin, 
+                         acl_user_tmp->plugin.str, 
+                         acl_user_tmp->plugin.length, 0);
+    mysql_mutex_unlock(&acl_cache->lock);
+
+    mpvio->make_it_fail= true;
   }
 
   if (my_strcasecmp(system_charset_info, mpvio->acl_user->plugin.str,
@@ -9638,6 +9663,9 @@
   uint passwd_len= (mpvio->client_capabilities & CLIENT_SECURE_CONNECTION ?
                     (uchar) (*passwd++) : strlen(passwd));
 
+  if (passwd_len)
+    mpvio->auth_info.password_used= PASSWORD_USED_YES;
+
   db+= passwd_len + 1;
   /*
     Database name is always NUL-terminated, so in case of empty database
@@ -10431,6 +10459,10 @@
       *buf= (uchar*) mpvio->cached_client_reply.pkt;
       mpvio->cached_client_reply.pkt= 0;
       mpvio->packets_read++;
+
+      if (mpvio->make_it_fail)
+        goto err;
+
       DBUG_RETURN ((int) mpvio->cached_client_reply.pkt_len);
     }
 
@@ -10473,12 +10505,21 @@
   else
     *buf= mpvio->net->read_pos;
 
+  if (mpvio->make_it_fail)
+    goto err;
+
   DBUG_RETURN((int)pkt_len);
 
 err:
   if (mpvio->status == MPVIO_EXT::FAILURE)
   {
-    my_error(ER_HANDSHAKE_ERROR, MYF(0));
+    if (!current_thd->is_error())
+    {
+      if (mpvio->make_it_fail)
+        login_failed_error(mpvio, mpvio->auth_info.password_used);
+      else
+        my_error(ER_HANDSHAKE_ERROR, MYF(0));
+    }
   }
   DBUG_RETURN(-1);
 }
@@ -10686,6 +10727,7 @@
 #endif /* HAVE_OPENSSL && !EMBEDDED_LIBRARY */
     mpvio->vio_is_encrypted= 0;
   mpvio->status= MPVIO_EXT::FAILURE;
+  mpvio->make_it_fail= false;
 
   mpvio->client_capabilities= thd->client_capabilities;
   mpvio->mem_root= thd->mem_root;
 
=== modified file 'Percona-Server/sql/sql_class.cc'
--- Percona-Server/sql/sql_class.cc	2013-03-05 12:46:43 +0000
+++ Percona-Server/sql/sql_class.cc	2013-05-01 09:25:43 +0000
@@ -899,6 +899,7 @@
    first_successful_insert_id_in_prev_stmt_for_binlog(0),
    first_successful_insert_id_in_cur_stmt(0),
    stmt_depends_on_first_successful_insert_id_in_prev_stmt(FALSE),
+   failed_com_change_user(0),
    m_examined_row_count(0),
    m_statement_psi(NULL),
    m_idle_psi(NULL),
 
=== modified file 'Percona-Server/sql/sql_class.h'
--- Percona-Server/sql/sql_class.h	2013-03-05 12:46:43 +0000
+++ Percona-Server/sql/sql_class.h	2013-05-01 09:25:43 +0000
@@ -2641,6 +2641,7 @@
   }
 
   ha_rows    cuted_fields;
+  uint8      failed_com_change_user;
 
 private:
   /**
 
=== modified file 'Percona-Server/sql/sql_parse.cc'
--- Percona-Server/sql/sql_parse.cc	2013-03-31 06:08:39 +0000
+++ Percona-Server/sql/sql_parse.cc	2013-05-01 09:25:43 +0000
@@ -1252,7 +1252,22 @@
     const CHARSET_INFO *save_character_set_results=
       thd->variables.character_set_results;
 
-    auth_rc= acl_authenticate(thd, packet_length);
+    /* Ensure we don't free security_ctx->user in case we have to revert */
+    thd->security_ctx->user= 0;
+    thd->set_user_connect(0);
+
+    /*
+      to limit COM_CHANGE_USER ability to brute-force passwords,
+      we only allow three unsuccessful COM_CHANGE_USER per connection.
+    */
+    if (thd->failed_com_change_user >= 3)
+    {
+      my_message(ER_UNKNOWN_COM_ERROR, ER(ER_UNKNOWN_COM_ERROR), MYF(0));
+      auth_rc= 1;
+    }
+    else
+      auth_rc= acl_authenticate(thd, packet_length);
+
     MYSQL_AUDIT_NOTIFY_CONNECTION_CHANGE_USER(thd);
     if (auth_rc)
     {
@@ -1264,6 +1279,8 @@
       thd->variables.collation_connection= save_collation_connection;
       thd->variables.character_set_results= save_character_set_results;
       thd->update_charset();
+      thd->failed_com_change_user++;
+      my_sleep(1000000);
     }
     else
     {
 
=== modified file 'Percona-Server/tests/mysql_client_test.c'
--- Percona-Server/tests/mysql_client_test.c	2013-03-05 12:46:43 +0000
+++ Percona-Server/tests/mysql_client_test.c	2013-05-01 09:25:43 +0000
@@ -16266,6 +16266,7 @@
   const char *pw= "password";
   const char *db= "mysqltest_user_test_database";
   int rc;
+  MYSQL *conn;
 
   DBUG_ENTER("test_change_user");
   myheader("test_change_user");
@@ -16309,149 +16310,173 @@
   rc= mysql_query(mysql, buff);
   myquery(rc);
 
+  conn= client_connect(0, MYSQL_PROTOCOL_TCP, 0);
 
   /* Try some combinations */
-  rc= mysql_change_user(mysql, NULL, NULL, NULL);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-
-  rc= mysql_change_user(mysql, "", NULL, NULL);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, "", "", NULL);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, "", "", "");
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, NULL, "", "");
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-
-  rc= mysql_change_user(mysql, NULL, NULL, "");
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, "", NULL, "");
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, user_pw, NULL, "");
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, user_pw, "", "");
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, user_pw, "", NULL);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, user_pw, NULL, NULL);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, user_pw, "", db);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, user_pw, NULL, db);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, user_pw, pw, db);
-  myquery(rc);
-
-  rc= mysql_change_user(mysql, user_pw, pw, NULL);
-  myquery(rc);
-
-  rc= mysql_change_user(mysql, user_pw, pw, "");
-  myquery(rc);
-
-  rc= mysql_change_user(mysql, user_no_pw, pw, db);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, user_no_pw, pw, "");
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, user_no_pw, pw, NULL);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, user_no_pw, "", NULL);
-  myquery(rc);
-
-  rc= mysql_change_user(mysql, user_no_pw, "", "");
-  myquery(rc);
-
-  rc= mysql_change_user(mysql, user_no_pw, "", db);
-  myquery(rc);
-
-  rc= mysql_change_user(mysql, user_no_pw, NULL, db);
-  myquery(rc);
-
-  rc= mysql_change_user(mysql, "", pw, db);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, "", pw, "");
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, "", pw, NULL);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, NULL, pw, NULL);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, NULL, NULL, db);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, NULL, "", db);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
-
-  rc= mysql_change_user(mysql, "", "", db);
-  DIE_UNLESS(rc);
-  if (! opt_silent)
-    printf("Got error (as expected): %s\n", mysql_error(mysql));
+  rc= mysql_change_user(conn, NULL, NULL, NULL);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+
+  rc= mysql_change_user(conn, "", NULL, NULL);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, "", "", NULL);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  mysql_close(conn);
+  conn= client_connect(0, MYSQL_PROTOCOL_TCP, 0);
+
+  rc= mysql_change_user(conn, "", "", "");
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, NULL, "", "");
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+
+  rc= mysql_change_user(conn, NULL, NULL, "");
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  mysql_close(conn);
+  conn= client_connect(0, MYSQL_PROTOCOL_TCP, 0);
+
+  rc= mysql_change_user(conn, "", NULL, "");
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, user_pw, NULL, "");
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, user_pw, "", "");
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  mysql_close(conn);
+  conn= client_connect(0, MYSQL_PROTOCOL_TCP, 0);
+
+  rc= mysql_change_user(conn, user_pw, "", NULL);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, user_pw, NULL, NULL);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, user_pw, "", db);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  mysql_close(conn);
+  conn= client_connect(0, MYSQL_PROTOCOL_TCP, 0);
+
+  rc= mysql_change_user(conn, user_pw, NULL, db);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, user_pw, pw, db);
+  myquery(rc);
+
+  rc= mysql_change_user(conn, user_pw, pw, NULL);
+  myquery(rc);
+
+  rc= mysql_change_user(conn, user_pw, pw, "");
+  myquery(rc);
+
+  rc= mysql_change_user(conn, user_no_pw, pw, db);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, user_no_pw, pw, "");
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  mysql_close(conn);
+  conn= client_connect(0, MYSQL_PROTOCOL_TCP, 0);
+
+  rc= mysql_change_user(conn, user_no_pw, pw, NULL);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, user_no_pw, "", NULL);
+  myquery(rc);
+
+  rc= mysql_change_user(conn, user_no_pw, "", "");
+  myquery(rc);
+
+  rc= mysql_change_user(conn, user_no_pw, "", db);
+  myquery(rc);
+
+  rc= mysql_change_user(conn, user_no_pw, NULL, db);
+  myquery(rc);
+
+  rc= mysql_change_user(conn, "", pw, db);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, "", pw, "");
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  mysql_close(conn);
+  conn= client_connect(0, MYSQL_PROTOCOL_TCP, 0);
+
+  rc= mysql_change_user(conn, "", pw, NULL);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, NULL, pw, NULL);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, NULL, NULL, db);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  mysql_close(conn);
+  conn= client_connect(0, MYSQL_PROTOCOL_TCP, 0);
+
+  rc= mysql_change_user(conn, NULL, "", db);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
+
+  rc= mysql_change_user(conn, "", "", db);
+  DIE_UNLESS(rc);
+  if (! opt_silent)
+    printf("Got error (as expected): %s\n", mysql_error(conn));
 
   /* Cleanup the environment */
 
-  mysql_change_user(mysql, opt_user, opt_password, current_db);
+  mysql_change_user(conn, opt_user, opt_password, current_db);
+
+  mysql_close(conn);
 
   sprintf(buff, "drop database %s", db);
   rc= mysql_query(mysql, buff);
@@ -17114,30 +17139,36 @@
   static char db[NAME_CHAR_LEN+1];
   static char query[LARGE_BUFFER_SIZE*2];
 #endif
+  MYSQL* conn;
 
   DBUG_ENTER("test_bug31669");
   myheader("test_bug31669");
 
-  rc= mysql_change_user(mysql, NULL, NULL, NULL);
+  conn= client_connect(0, MYSQL_PROTOCOL_TCP, 0);
+
+  rc= mysql_change_user(conn, NULL, NULL, NULL);
   DIE_UNLESS(rc);
 
-  rc= mysql_change_user(mysql, "", "", "");
+  rc= mysql_change_user(conn, "", "", "");
   DIE_UNLESS(rc);
 
   memset(buff, 'a', sizeof(buff));
   buff[sizeof(buff) - 1] = '\0';
 
-  rc= mysql_change_user(mysql, buff, buff, buff);
+  mysql_close(conn);
+  conn= client_connect(0, MYSQL_PROTOCOL_TCP, 0);
+
+  rc= mysql_change_user(conn, buff, buff, buff);
   DIE_UNLESS(rc);
 
-  rc = mysql_change_user(mysql, opt_user, opt_password, current_db);
+  rc = mysql_change_user(conn, opt_user, opt_password, current_db);
   DIE_UNLESS(!rc);
 
 #ifndef EMBEDDED_LIBRARY
   memset(db, 'a', sizeof(db));
   db[NAME_CHAR_LEN]= 0;
   strxmov(query, "CREATE DATABASE IF NOT EXISTS ", db, NullS);
-  rc= mysql_query(mysql, query);
+  rc= mysql_query(conn, query);
   myquery(rc);
 
   memset(user, 'b', sizeof(user));
@@ -17146,54 +17177,59 @@
   buff[LARGE_BUFFER_SIZE]= 0;
   strxmov(query, "GRANT ALL PRIVILEGES ON *.* TO '", user, "'@'%' IDENTIFIED BY "
                  "'", buff, "' WITH GRANT OPTION", NullS);
-  rc= mysql_query(mysql, query);
+  rc= mysql_query(conn, query);
   myquery(rc);
 
   strxmov(query, "GRANT ALL PRIVILEGES ON *.* TO '", user, "'@'localhost' IDENTIFIED BY "
                  "'", buff, "' WITH GRANT OPTION", NullS);
-  rc= mysql_query(mysql, query);
-  myquery(rc);
-
-  rc= mysql_query(mysql, "FLUSH PRIVILEGES");
-  myquery(rc);
-
-  rc= mysql_change_user(mysql, user, buff, db);
+  rc= mysql_query(conn, query);
+  myquery(rc);
+
+  rc= mysql_query(conn, "FLUSH PRIVILEGES");
+  myquery(rc);
+
+  rc= mysql_change_user(conn, user, buff, db);
   DIE_UNLESS(!rc);
 
   user[USERNAME_CHAR_LENGTH-1]= 'a';
-  rc= mysql_change_user(mysql, user, buff, db);
+  rc= mysql_change_user(conn, user, buff, db);
   DIE_UNLESS(rc);
 
   user[USERNAME_CHAR_LENGTH-1]= 'b';
   buff[LARGE_BUFFER_SIZE-1]= 'd';
-  rc= mysql_change_user(mysql, user, buff, db);
+  rc= mysql_change_user(conn, user, buff, db);
   DIE_UNLESS(rc);
 
   buff[LARGE_BUFFER_SIZE-1]= 'c';
   db[NAME_CHAR_LEN-1]= 'e';
-  rc= mysql_change_user(mysql, user, buff, db);
+  rc= mysql_change_user(conn, user, buff, db);
   DIE_UNLESS(rc);
 
+  mysql_close(conn);
+  conn= client_connect(0, MYSQL_PROTOCOL_TCP, 0);
+
   db[NAME_CHAR_LEN-1]= 'a';
-  rc= mysql_change_user(mysql, user, buff, db);
+  rc= mysql_change_user(conn, user, buff, db);
   DIE_UNLESS(!rc);
 
-  rc= mysql_change_user(mysql, user + 1, buff + 1, db + 1);
+  rc= mysql_change_user(conn, user + 1, buff + 1, db + 1);
   DIE_UNLESS(rc);
 
-  rc = mysql_change_user(mysql, opt_user, opt_password, current_db);
+  rc = mysql_change_user(conn, opt_user, opt_password, current_db);
   DIE_UNLESS(!rc);
 
   strxmov(query, "DROP DATABASE ", db, NullS);
-  rc= mysql_query(mysql, query);
+  rc= mysql_query(conn, query);
   myquery(rc);
 
   strxmov(query, "DELETE FROM mysql.user WHERE User='", user, "'", NullS);
-  rc= mysql_query(mysql, query);
+  rc= mysql_query(conn, query);
   myquery(rc);
-  DIE_UNLESS(mysql_affected_rows(mysql) == 2);
+  DIE_UNLESS(mysql_affected_rows(conn) == 2);
 #endif
 
+  mysql_close(conn);
+
   DBUG_VOID_RETURN;
 }