mirror of
https://github.com/MariaDB/server.git
synced 2025-07-05 12:42:17 +03:00
cc125bebfe
The 'special' cases where we disable, suppress or circumvent UBSAN are: - ref10 source (as here we intentionally do some shifts that UBSAN complains about. - x86 version of optimized int#korr() methods. UBSAN do not like unaligned memory access of integers. Fixed by using byte_order_generic.h when compiling with UBSAN - We use smaller thread stack with ASAN and UBSAN, which forced me to disable a few tests that prints the thread stack size. - Verifying class types does not work for shared libraries. I added suppression in mysql-test-run.pl for this case. - Added '#ifdef WITH_UBSAN' when using integer arithmetic where it is safe to have overflows (two cases, in item_func.cc). Things fixed: - Don't left shift signed values (byte_order_generic.h, mysqltest.c, item_sum.cc and many more) - Don't assign not non existing values to enum variables. - Ensure that bool and enum values are properly initialized in constructors. This was needed as UBSAN checks that these types has correct values when one copies an object. (gcalc_tools.h, ha_partition.cc, item_sum.cc, partition_element.h ...) - Ensure we do not called handler functions on unallocated objects or deleted objects. (events.cc, sql_acl.cc). - Fixed bugs in Item_sp::Item_sp() where we did not call constructor on Query_arena object. - Fixed several cast of objects to an incompatible class! (Item.cc, Item_buff.cc, item_timefunc.cc, opt_subselect.cc, sql_acl.cc, sql_select.cc ...) - Ensure we do not do integer arithmetic that causes over or underflows. This includes also ++ and -- of integers. (Item_func.cc, Item_strfunc.cc, item_timefunc.cc, sql_base.cc ...) - Added JSON_VALUE_UNITIALIZED to json_value_types and ensure that value_type is initialized to this instead of to -1, which is not a valid enum value for json_value_types. - Ensure we do not call memcpy() when second argument could be null. Other things: - Changed struct st_position to an OBJECT and added an initialization function to it to ensure that we do not copy or use uninitialized members. The change to a class was also motived that we used "struct st_position" and POSITION randomly trough the code which was confusing. - Notably big rewrite in sql_acl.cc to avoid using deleted objects. - Changed in sql_partition to use '^' instead of '-'. This is safe as the operator is either 0 or 0x8000000000000000ULL. - Added check for select_nr < INT_MAX in JOIN::build_explain() to avoid bug when get_select() could return NULL. - Reordered elements in POSITION for better alignment. - Changed sql_test.cc::print_plan() to use pointers instead of objects. - Fixed bug in find_set() where could could execute '1 << -1'. - Added variable have_sanitizer, used by mtr. (This variable was before only in 10.5 and up). It can now have one of two values: ASAN or UBSAN. - Moved ~Archive_share() from ha_archive.cc to ha_archive.h and marked it virtual. This was an effort to get UBSAN to work with loaded storage engines. I kept the change as the new place is better. - Added in CONNECT engine COLBLK::SetName(), to get around a wrong cast in tabutil.cpp. Changes that should not be needed but had to be done to suppress warnings from UBSAN: - Added static_cast<<uint16_t>> around shift to get rid of a LOT of compiler warnings when using UBSAN. - Had to change some '/' of 2 base integers to shift to get rid of some compile time warnings. Fixes: MDEV-25505 Assertion `old_flags == ((my_flags & 0x10000U) ? 1 : 0) fixed (was caused by an old version if this commit). Reviewed by: - Json changes: Alexey Botchkov - Charset changes in ctype-uca.c: Alexander Barkov - InnoDB changes: Marko Mäkelä - sql_acl.cc changes: Vicențiu Ciorbaru - build_explain() changes: Sergey Petrunia Temporary commit to log changes for UBSAN
214 lines
7.6 KiB
Plaintext
214 lines
7.6 KiB
Plaintext
--source include/not_ubsan.inc
|
|
|
|
let $REGEX_VERSION_ID=/$mysql_get_server_version/VERSION_ID/;
|
|
let $REGEX_PASSWORD_LAST_CHANGED=/password_last_changed": [0-9]*/password_last_changed": #/;
|
|
let $REGEX_GLOBAL_PRIV=$REGEX_PASSWORD_LAST_CHANGED $REGEX_VERSION_ID;
|
|
|
|
#
|
|
# MDEV-11340 Allow multiple alternative authentication methods for the same user
|
|
#
|
|
--source include/have_unix_socket.inc
|
|
if (`SELECT '$USER' = 'mysqltest1'`) {
|
|
skip USER is mysqltest1;
|
|
}
|
|
if (!$AUTH_ED25519_SO) {
|
|
skip No auth_ed25519 plugin;
|
|
}
|
|
|
|
--let $plugindir=`SELECT @@global.plugin_dir`
|
|
install soname 'auth_ed25519';
|
|
|
|
--let $try_auth=$MYSQL_TEST < $MYSQLTEST_VARDIR/tmp/peercred_test.txt 2>&1
|
|
|
|
--write_file $MYSQLTEST_VARDIR/tmp/peercred_test.txt
|
|
--let $replace1=$USER@localhost
|
|
--let $replace2=$USER@%
|
|
--replace_result $replace1 "USER@localhost" $replace2 "USER@%"
|
|
select user(), current_user(), database();
|
|
EOF
|
|
|
|
--let $creplace=create user $USER
|
|
--let $dreplace=drop user $USER
|
|
|
|
#
|
|
# socket,password
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via unix_socket OR mysql_native_password as password("GOOD");
|
|
create user mysqltest1 identified via unix_socket OR mysql_native_password as password("good");
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match, password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # name does not match, password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
#
|
|
# password,socket
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via mysql_native_password as password("GOOD") OR unix_socket;
|
|
create user mysqltest1 identified via mysql_native_password as password("good") OR unix_socket;
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match, password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # name does not match, password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
#
|
|
# socket,ed25519
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via unix_socket OR ed25519 as password("GOOD");
|
|
create user mysqltest1 identified via unix_socket OR ed25519 as password("good");
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match, password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # name does not match, password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
#
|
|
# ed25519,socket
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via ed25519 as password("GOOD") OR unix_socket;
|
|
create user mysqltest1 identified via ed25519 as password("good") OR unix_socket;
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match, password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # name does not match, password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
#
|
|
# ed25519,socket,password
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via ed25519 as password("GOOD") OR unix_socket OR mysql_native_password as password("works");
|
|
create user mysqltest1 identified via ed25519 as password("good") OR unix_socket OR mysql_native_password as password("works");
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match, password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # name does not match, second password works = ok
|
|
--exec $try_auth -u mysqltest1 -pworks
|
|
--echo # name does not match, password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
#
|
|
# password,password
|
|
#
|
|
create user mysqltest1 identified via mysql_native_password as password("good") OR mysql_native_password as password("works");
|
|
show create user mysqltest1;
|
|
--echo # password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # second password works = ok
|
|
--exec $try_auth -u mysqltest1 -pworks
|
|
--echo # password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
drop user mysqltest1;
|
|
|
|
#
|
|
# show grants, flush privileges, set password, alter user
|
|
#
|
|
create user mysqltest1 identified via ed25519 as password("good") OR unix_socket OR mysql_native_password as password("works");
|
|
show grants for mysqltest1;
|
|
--replace_regex $REGEX_GLOBAL_PRIV
|
|
select json_detailed(priv) from mysql.global_priv where user='mysqltest1';
|
|
select password,plugin,authentication_string from mysql.user where user='mysqltest1';
|
|
flush privileges;
|
|
show create user mysqltest1;
|
|
set password for mysqltest1 = password('foobar');
|
|
show create user mysqltest1;
|
|
alter user mysqltest1 identified via unix_socket OR mysql_native_password as password("some");
|
|
show create user mysqltest1;
|
|
set password for mysqltest1 = password('foobar');
|
|
show create user mysqltest1;
|
|
alter user mysqltest1 identified via unix_socket;
|
|
--error ER_SET_PASSWORD_AUTH_PLUGIN
|
|
set password for mysqltest1 = password('bla');
|
|
alter user mysqltest1 identified via mysql_native_password as password("some") or unix_socket;
|
|
show create user mysqltest1;
|
|
drop user mysqltest1;
|
|
|
|
--source include/switch_to_mysql_user.inc
|
|
--replace_regex /\d{6}/XX.YY.ZZ/
|
|
--error ER_COL_COUNT_DOESNT_MATCH_PLEASE_UPDATE
|
|
create user mysqltest1 identified via ed25519 as password("good") OR unix_socket OR mysql_native_password as password("works");
|
|
--source include/switch_to_mysql_global_priv.inc
|
|
|
|
#
|
|
# invalid password,socket
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via mysql_native_password as '1234567890123456789012345678901234567890a' OR unix_socket;
|
|
create user mysqltest1 identified via mysql_native_password as '1234567890123456789012345678901234567890a' OR unix_socket;
|
|
update mysql.global_priv set priv=replace(priv, '1234567890123456789012345678901234567890a', 'invalid password');
|
|
flush privileges;
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1
|
|
--echo # SET PASSWORD helps
|
|
set password for mysqltest1 = password('bla');
|
|
--exec $try_auth -u mysqltest1 -pbla
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
#
|
|
# missing client-side plugin
|
|
#
|
|
create user mysqltest1 identified via ed25519 as password("good");
|
|
show create user mysqltest1;
|
|
--echo # no plugin = failure
|
|
--replace_result $plugindir <PLUGINDIR>
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pgood --plugin-dir=$plugindir/no
|
|
alter user mysqltest1 identified via ed25519 as password("good") OR mysql_native_password as password("works");
|
|
show create user mysqltest1;
|
|
--echo # no plugin = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pgood --plugin-dir=$plugindir/no
|
|
--echo # no plugin, second password works = ok
|
|
--exec $try_auth -u mysqltest1 -pworks --plugin-dir=$plugindir/no
|
|
drop user mysqltest1;
|
|
|
|
uninstall soname 'auth_ed25519';
|
|
--remove_file $MYSQLTEST_VARDIR/tmp/peercred_test.txt
|
|
|
|
#
|
|
# MDEV-21928 ALTER USER doesn't remove excess authentication plugins from mysql.global_priv
|
|
#
|
|
create user mysqltest1 identified via mysql_native_password as password("good") OR unix_socket;
|
|
show create user mysqltest1;
|
|
alter user mysqltest1 identified via mysql_native_password as password("better");
|
|
show create user mysqltest1;
|
|
flush privileges;
|
|
show create user mysqltest1;
|
|
drop user mysqltest1;
|