231 lines
8.8 KiB
Plaintext
231 lines
8.8 KiB
Plaintext
#
|
|
# WL#5706/Bug#58712/Bug#11746378
|
|
# Encrypt or remove passwords from slow, query, and binary logs
|
|
# (see sql/sql_rewrite.cc for bulk of implementation)
|
|
#
|
|
|
|
# make sure we start with a clean slate. log_tables.test says this is OK.
|
|
TRUNCATE TABLE mysql.general_log;
|
|
|
|
CALL mtr.add_suppression('Following users were specified in CREATE USER IF NOT EXISTS but they already exist');
|
|
CALL mtr.add_suppression('Following users were specified in ALTER USER IF EXISTS but they do not exist');
|
|
|
|
--echo --------------- general log ---------------------------------------
|
|
|
|
LET old_log_output= `select @@global.log_output`;
|
|
LET old_general_log= `select @@global.general_log`;
|
|
LET old_general_log_file= `select @@global.general_log_file`;
|
|
|
|
--replace_result $MYSQLTEST_VARDIR ...
|
|
eval SET GLOBAL general_log_file = '$MYSQLTEST_VARDIR/log/rewrite_general.log';
|
|
SET GLOBAL log_output = 'FILE,TABLE';
|
|
SET GLOBAL general_log= 'ON';
|
|
|
|
# SET NAMES / SET CHARSET
|
|
# keep these in lower case so we can tell them from the upper case rewrites!
|
|
set character set 'hebrew';
|
|
set charset default,@dummy='A';
|
|
set names 'latin1',@dummy='B';
|
|
set names 'latin1' collate 'latin1_german2_ci';
|
|
set names default,@dummy='c';
|
|
|
|
# 1.1.1.1
|
|
|
|
CREATE TABLE t1(f1 INT, f2 INT, f3 INT, f4 INT);
|
|
CREATE PROCEDURE proc_rewrite_1() INSERT INTO test.t1 VALUES ("hocus pocus");
|
|
CREATE FUNCTION func_rewrite_1(i INT) RETURNS INT DETERMINISTIC RETURN i+1;
|
|
|
|
CREATE USER test_user1 IDENTIFIED WITH mysql_native_password BY 'azundris1';
|
|
GRANT SELECT(f2), INSERT(f3), INDEX, UPDATE(f1,f3, f2, f4), ALTER on
|
|
test.t1 TO test_user1;
|
|
GRANT ALL ON PROCEDURE test.proc_rewrite_1 TO test_user1;
|
|
GRANT EXECUTE ON FUNCTION test.func_rewrite_1 TO test_user1;
|
|
|
|
CREATE USER test_user3@localhost IDENTIFIED WITH mysql_native_password BY 'meow' REQUIRE SSL;
|
|
GRANT SELECT,USAGE ON test.* TO test_user3@localhost;
|
|
ALTER USER test_user3@localhost IDENTIFIED BY 'meow'
|
|
REQUIRE X509 WITH
|
|
MAX_QUERIES_PER_HOUR 1 MAX_UPDATES_PER_HOUR 2
|
|
MAX_CONNECTIONS_PER_HOUR 3 MAX_USER_CONNECTIONS 4;
|
|
GRANT USAGE ON test.* TO test_user3@localhost WITH GRANT OPTION;
|
|
ALTER USER test_user3@localhost REQUIRE NONE;
|
|
|
|
|
|
DROP PROCEDURE proc_rewrite_1;
|
|
DROP FUNCTION func_rewrite_1;
|
|
DROP TABLE t1;
|
|
|
|
# 1.1.1.2
|
|
CREATE USER test_user2 IDENTIFIED WITH mysql_native_password BY 'azundris2';
|
|
|
|
# 1.1.1.3
|
|
--disable_warnings
|
|
CHANGE MASTER TO MASTER_PASSWORD='azundris3';
|
|
--enable_warnings
|
|
|
|
# 1.1.1.4
|
|
CREATE USER 'test_user4'@'localhost' IDENTIFIED WITH mysql_native_password;
|
|
ALTER USER 'test_user4'@'localhost' IDENTIFIED BY 'azundris4';
|
|
# 1.1.1.5
|
|
CREATE USER test_user5 IDENTIFIED WITH mysql_native_password AS
|
|
'*67092806AE91BFB6BE72DE6C7BE2B7CCA8CFA9DF', test_user6 IDENTIFIED BY 'test';
|
|
ALTER USER IF EXISTS test_user5 IDENTIFIED BY 'test',
|
|
test_user6 IDENTIFIED WITH mysql_native_password AS
|
|
'*67092806AE91BFB6BE72DE6C7BE2B7CCA8CFA9DF', test_user7 IDENTIFIED BY 'test';
|
|
CREATE USER IF NOT EXISTS test_user6 IDENTIFIED BY 'test',
|
|
test_user7 IDENTIFIED BY 'test';
|
|
ALTER USER test_user7 IDENTIFIED WITH mysql_native_password AS
|
|
'*67092806AE91BFB6BE72DE6C7BE2B7CCA8CFA9DF';
|
|
# 1.1.1.6 : Literal <secret> must be printed in the log for empty password
|
|
CREATE USER test_user8 IDENTIFIED BY '';
|
|
ALTER USER test_user8 IDENTIFIED BY '';
|
|
CREATE USER test_user9 IDENTIFIED WITH 'caching_sha2_password' BY '';
|
|
ALTER USER test_user9 IDENTIFIED WITH 'caching_sha2_password' BY '';
|
|
SET PASSWORD FOR test_user9 = "";
|
|
#1.1.1.7 : WL#11544, verify the newly added clauses
|
|
CREATE USER u1, u2;
|
|
GRANT CREATE USER ON *.* to 'u1' WITH GRANT OPTION;
|
|
connect(con1,localhost,u1,,);
|
|
SET PASSWORD = '' REPLACE '';
|
|
ALTER USER u1 IDENTIFIED BY '123' REPLACE '', u2 IDENTIFIED BY '456'
|
|
PASSWORD REQUIRE CURRENT OPTIONAL;
|
|
ALTER USER u2 IDENTIFIED BY 'xyz', u1 IDENTIFIED BY 'abc' REPLACE '123';
|
|
|
|
connection default;
|
|
disconnect con1;
|
|
|
|
# clean-up
|
|
SET GLOBAL general_log= 'OFF';
|
|
DROP USER u1, u2;
|
|
DROP USER 'test_user4'@'localhost';
|
|
DROP USER 'test_user3'@'localhost';
|
|
DROP USER test_user9, test_user8;
|
|
DROP USER test_user7, test_user6, test_user5;
|
|
DROP USER test_user2;
|
|
DROP USER test_user1;
|
|
|
|
# show general-logging to file is correct
|
|
CREATE TABLE test_log (argument TEXT);
|
|
--replace_result $MYSQLTEST_VARDIR ...
|
|
eval LOAD DATA LOCAL INFILE '$MYSQLTEST_VARDIR/log/rewrite_general.log'
|
|
INTO TABLE test_log FIELDS TERMINATED BY '\n' LINES TERMINATED BY '\n';
|
|
|
|
# all passwords ('azundris%') must have been obfuscated -> empty result set
|
|
--echo This line should be followed by two SELECTs with empty result sets
|
|
--replace_regex /.*Query *//i
|
|
SELECT argument FROM test_log WHERE argument LIKE CONCAT('%azun','dris%');
|
|
|
|
# same for logging to table
|
|
SELECT argument FROM mysql.general_log WHERE argument LIKE CONCAT('%azun','dris%');
|
|
|
|
--echo Show that we logged stuff at all:
|
|
--echo ------ from file ------
|
|
--replace_regex /.*Execute *//i
|
|
SELECT TRIM(LEADING '\t' FROM MID(argument,LOCATE('Query',argument)+5)) FROM
|
|
test_log WHERE (argument LIKE '%BY %' OR argument LIKE '%AS %'
|
|
OR argument LIKE '%PASSWORD %')
|
|
AND argument NOT LIKE '%Prepare%';
|
|
--echo ------ from table ------
|
|
SELECT argument FROM mysql.general_log WHERE (argument LIKE '%BY %' OR
|
|
argument LIKE '%AS %' OR argument LIKE '%PASSWORD %')
|
|
AND command_type NOT LIKE 'Prepare';
|
|
--echo ------ done ------
|
|
|
|
--echo ------ rewrite ------
|
|
SELECT argument FROM mysql.general_log WHERE argument LIKE CONCAT('set ','character set %');
|
|
SELECT argument FROM mysql.general_log WHERE argument LIKE CONCAT('set ','names %');
|
|
SELECT argument FROM mysql.general_log WHERE argument LIKE 'GRANT %' AND command_type NOT LIKE 'Prepare';
|
|
--echo ------ done ------ see log_tables.test for more proof! :)
|
|
|
|
# Sanity check -- prove we log the correct hash. Must return one row. In case of ps-protocol mode the query returns 2 rows
|
|
SELECT COUNT(*)=1 OR COUNT(*)=2 FROM mysql.general_log WHERE argument LIKE 'CREATE USER%' AND argument LIKE CONCAT('%AS %');
|
|
|
|
--echo Bug#13958454 -- show we print SET @a:=5, but SELECT (@a:=5)
|
|
# We need the () in EXPLAIN, for (@e:=80)+5.
|
|
# In SET however, they'd break syntax.
|
|
# VIEWs do not accepted variables at this time.
|
|
EXPLAIN SELECT @a=5,@b:=10,@c:=20,@d:=40+5,(@e:=80)+5;
|
|
|
|
--echo
|
|
--echo End of 5.6 tests!
|
|
--echo
|
|
|
|
--echo #
|
|
--echo # Bug#16953758: PREPARED STATEMENT IS WRITTEN TO GENERAL QUERY LOG AFTER ITS EXECUTION IS FINISH
|
|
--echo #
|
|
TRUNCATE TABLE mysql.general_log;
|
|
SET GLOBAL general_log='ON';
|
|
SET @sql='SELECT command_type, argument FROM mysql.general_log WHERE argument LIKE "%Bug#16953758%"';
|
|
PREPARE stmt FROM @sql;
|
|
EXECUTE stmt;
|
|
DEALLOCATE PREPARE stmt;
|
|
|
|
|
|
--echo #
|
|
--echo # Bug#18616826: PREPARED STATEMENTS WHOSE EXECUTION FAIL ARE NOT LOGGED TO THE GENERAL LOG
|
|
--echo #
|
|
TRUNCATE TABLE mysql.general_log;
|
|
SET @sql='DROP TABLE 18616826_does_not_exist';
|
|
PREPARE stmt FROM @sql;
|
|
--error ER_BAD_TABLE_ERROR
|
|
EXECUTE stmt;
|
|
DEALLOCATE PREPARE stmt;
|
|
SELECT command_type, argument FROM mysql.general_log WHERE argument LIKE "DROP TABLE 18616826_does_not_exist";
|
|
|
|
--echo
|
|
--echo End of 5.7 tests!
|
|
--echo
|
|
|
|
# Tests related to WL#11544 : Restart the server with --log-raw
|
|
# and check if password is in plaintext
|
|
--echo # shutdown the server from mtr.
|
|
--exec echo "wait" > $MYSQLTEST_VARDIR/tmp/mysqld.1.expect
|
|
--shutdown_server
|
|
--source include/wait_until_disconnected.inc
|
|
|
|
--echo # restart the server.
|
|
--exec echo "restart: --log-raw" > $MYSQLTEST_VARDIR/tmp/mysqld.1.expect
|
|
--enable_reconnect
|
|
--source include/wait_until_connected_again.inc
|
|
|
|
--replace_result $MYSQLTEST_VARDIR ...
|
|
eval SET GLOBAL general_log_file = '$MYSQLTEST_VARDIR/log/rewrite_general.log';
|
|
SET GLOBAL log_output = 'FILE,TABLE';
|
|
SET GLOBAL general_log= 'ON';
|
|
|
|
CREATE USER 'plaintext_test' IDENTIFIED BY 'pwd';
|
|
connect(con1,localhost,plaintext_test,'pwd',);
|
|
ALTER USER plaintext_test IDENTIFIED BY '' REPLACE 'pwd';
|
|
SET PASSWORD FOR plaintext_test='456' REPLACE '';
|
|
SET PASSWORD='789' REPLACE '456';
|
|
disconnect con1;
|
|
connection default;
|
|
DROP USER plaintext_test;
|
|
|
|
# Restart the server to original state
|
|
--echo # shutdown the server from mtr.
|
|
--exec echo "wait" > $MYSQLTEST_VARDIR/tmp/mysqld.1.expect
|
|
--shutdown_server
|
|
--source include/wait_until_disconnected.inc
|
|
|
|
--echo # restart the server.
|
|
--exec echo "restart:" > $MYSQLTEST_VARDIR/tmp/mysqld.1.expect
|
|
--enable_reconnect
|
|
--source include/wait_until_connected_again.inc
|
|
|
|
# Password must be seen in cleartext with --log-raw option. In case of ps-protocol mode the query returns 9 rows
|
|
SELECT count(*)=6 or count(*)=9 FROM mysql.general_log WHERE argument LIKE '%plaintext_test%' or argument like '%789%';
|
|
|
|
# cleanup
|
|
DROP TABLE test_log;
|
|
|
|
--remove_file $MYSQLTEST_VARDIR/log/rewrite_general.log
|
|
--replace_result $MYSQLTEST_VARDIR ...
|
|
eval SET GLOBAL general_log_file = '$old_general_log_file';
|
|
eval SET GLOBAL log_output= '$old_log_output';
|
|
eval SET GLOBAL general_log= $old_general_log;
|
|
|
|
--echo
|
|
--echo End of 5.7 tests!
|
|
--echo
|