Merge lp:~sergei.glushchenko/percona-server/5.5-ps-bug1289599 into lp:percona-server/5.5

[Sergei Glushchenko]

http://jenkins.percona.com/view/PS%205.5/job/percona-server-5.5-param/975

    Fix by testing make_it_fail flag after authentication is done.

    Add MTR variables and necessary check routines for auth_socket
    plugin.

    Add test case which is modified test case from MariaDB but
    takes into account that Unix user can present in mysql.user
    (for example root).

[Laurynas Biveinis (laurynas-biveinis)]

review: Approve

=== added file 'mysql-test/include/have_socket_auth_plugin.inc'
--- mysql-test/include/have_socket_auth_plugin.inc	1970-01-01 00:00:00 +0000
+++ mysql-test/include/have_socket_auth_plugin.inc	2014-03-13 19:33:29 +0000
@@ -0,0 +1,22 @@
+disable_query_log;
+#
+# Check if server has support for loading plugins
+#
+if (`SELECT @@have_dynamic_loading != 'YES'`) {
+  --skip Socket auth plugin requires dynamic loading
+}
+
+#
+# Check if the variable SOCKET_AUTH is set
+#
+if (!$SOCKET_AUTH) {
+  --skip SOCKET_AUTH plugin requires the environment variable \$SOCKET_AUTH to be set (normally done by mtr)
+}
+
+#
+# Check if --plugin-dir was setup for null_audit db
+#
+if (`SELECT CONCAT('--plugin-dir=', REPLACE(@@plugin_dir, '\\\\', '/')) != '$SOCKET_AUTH_OPT/'`) {
+  --skip socket_auth plugin requires that --plugin-dir is set to the socket_auth plugin dir (either the .opt file does not contain \$SOCKET_AUTH_OPT or another plugin is in use)
+}
+enable_query_log;

=== modified file 'mysql-test/include/plugin.defs'
--- mysql-test/include/plugin.defs	2012-10-31 07:10:48 +0000
+++ mysql-test/include/plugin.defs	2014-03-13 19:33:29 +0000
@@ -41,3 +41,4 @@
 mypluglib          plugin/fulltext    SIMPLE_PARSER
 libdaemon_example  plugin/daemon_example DAEMONEXAMPLE
 adt_null           plugin/audit_null  AUDIT_NULL
+auth_socket        plugin/auth        SOCKET_AUTH

=== added file 'mysql-test/r/percona_bug1289599.result'
--- mysql-test/r/percona_bug1289599.result	1970-01-01 00:00:00 +0000
+++ mysql-test/r/percona_bug1289599.result	2014-03-13 19:33:29 +0000
@@ -0,0 +1,12 @@
+update mysql.user set plugin='auth_socket';
+flush privileges;
+connect(localhost,USER,,test,MASTER_PORT,MASTER_SOCKET);
+ERROR HY000: Plugin 'auth_socket' is not loaded
+ERROR HY000: Plugin 'auth_socket' is not loaded
+install plugin auth_socket soname 'auth_socket.so';
+connect(localhost,USER,,test,MASTER_PORT,MASTER_SOCKET);
+Got one of the listed errors
+Got one of the listed errors
+update mysql.user set plugin='';
+flush privileges;
+uninstall plugin auth_socket;

=== added file 'mysql-test/t/percona_bug1289599-master.opt'
--- mysql-test/t/percona_bug1289599-master.opt	1970-01-01 00:00:00 +0000
+++ mysql-test/t/percona_bug1289599-master.opt	2014-03-13 19:33:29 +0000
@@ -0,0 +1,1 @@
+--plugin_dir=$SOCKET_AUTH_DIR
\ No newline at end of file

=== added file 'mysql-test/t/percona_bug1289599.test'
--- mysql-test/t/percona_bug1289599.test	1970-01-01 00:00:00 +0000
+++ mysql-test/t/percona_bug1289599.test	2014-03-13 19:33:29 +0000
@@ -0,0 +1,33 @@
+#
+# Bug 1289599: Authentication bypass if auth_socket installed
+#
+
+--source include/have_socket_auth_plugin.inc
+
+if (`SELECT count(*) <> 0 FROM mysql.user WHERE user = '$USER'`)
+{
+  --skip Unix user present in mysql.user
+}
+
+update mysql.user set plugin='auth_socket';
+flush privileges;
+
+--replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT $USER USER
+--error ER_PLUGIN_IS_NOT_LOADED
+connect (fail,localhost,$USER);
+
+--error ER_PLUGIN_IS_NOT_LOADED
+change_user $USER;
+
+eval install plugin auth_socket soname '$SOCKET_AUTH';
+
+--replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT $USER USER
+--error ER_ACCESS_DENIED_ERROR, ER_ACCESS_DENIED_NO_PASSWORD_ERROR
+connect (fail,localhost,$USER);
+
+--error ER_ACCESS_DENIED_ERROR, ER_ACCESS_DENIED_NO_PASSWORD_ERROR
+change_user $USER;
+
+update mysql.user set plugin='';
+flush privileges;
+uninstall plugin auth_socket;

=== modified file 'sql/sql_acl.cc'
--- sql/sql_acl.cc	2014-02-03 04:39:37 +0000
+++ sql/sql_acl.cc	2014-03-13 19:33:29 +0000
@@ -9819,6 +9819,12 @@
 
   server_mpvio_update_thd(thd, &mpvio);
 
+  if (mpvio.make_it_fail)
+  {
+    mpvio.status= MPVIO_EXT::FAILURE;
+    res= CR_ERROR;
+  }
+
   Security_context *sctx= thd->security_ctx;
   const ACL_USER *acl_user= mpvio.acl_user;