Skip to content

Commit 018e55b

Browse files
harinvadodariaharinvadodaria
committed
Bug#14850601: VALIDATE_PASSWORD_LENGTH SHOULD NOT ACCEPT
 BELOW 4 AS ANY WAY NOT ABLE TO SET IT Description: validate_password_length system variable is affected by three other system variables 1. validate_password_number_count 2. validate_password_mixed_case_count 3. validate_password_special_char_count This patch introduces update function for above mentioned system variables to make sure that requried updates to validate_password_length happens.
1 parent af43f87 commit 018e55b

3 files changed

Lines changed: 75 additions & 4 deletions

File tree

‎mysql-test/r/validate_password_plugin.result‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ UPDATE mysql.user SET PASSWORD= PASSWORD('afrgtyhlp98') WHERE user='base_user';
2020
ERROR HY000: Your password does not satisfy the current policy requirements
2121
UPDATE mysql.user SET PASSWORD= PASSWORD('iuyt567nbvfA') WHERE user='base_user';
2222
GRANT USAGE ON *.* TO 'base_user'@'localhost' IDENTIFIED BY 'password1234';
23+
SET @@global.validate_password_mixed_case_count= 0;
24+
SET @@global.validate_password_number_count= 0;
25+
SET @@global.validate_password_special_char_count= 0;
2326
SET @@global.validate_password_length= 0;
2427
UPDATE mysql.user SET PASSWORD= PASSWORD('') WHERE user='base_user';
2528
UPDATE mysql.user SET PASSWORD= PASSWORD('p') WHERE user='base_user';
@@ -51,6 +54,9 @@ EXECUTE stmt1 USING @a,@b;
5154
DEALLOCATE PREPARE stmt1;
5255
# password policy MEDIUM (check for mixed_case, digits, special_chars)
5356
# default case : atleast 1 mixed_case, 1 digit, 1 special_char
57+
SET @@global.validate_password_mixed_case_count= 1;
58+
SET @@global.validate_password_number_count= 1;
59+
SET @@global.validate_password_special_char_count= 1;
5460
SET @@global.validate_password_policy=MEDIUM;
5561
SET @@global.validate_password_number_count= 0;
5662
CREATE USER 'user'@'localhost' IDENTIFIED BY 'aedfoiASE$%';

‎mysql-test/t/validate_password_plugin.test‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,9 @@ UPDATE mysql.user SET PASSWORD= PASSWORD('password') WHERE user='base_user';
3434
UPDATE mysql.user SET PASSWORD= PASSWORD('afrgtyhlp98') WHERE user='base_user';
3535
UPDATE mysql.user SET PASSWORD= PASSWORD('iuyt567nbvfA') WHERE user='base_user';
3636
GRANT USAGE ON *.* TO 'base_user'@'localhost' IDENTIFIED BY 'password1234';
37+
SET @@global.validate_password_mixed_case_count= 0;
38+
SET @@global.validate_password_number_count= 0;
39+
SET @@global.validate_password_special_char_count= 0;
3740
SET @@global.validate_password_length= 0;
3841
UPDATE mysql.user SET PASSWORD= PASSWORD('') WHERE user='base_user';
3942
UPDATE mysql.user SET PASSWORD= PASSWORD('p') WHERE user='base_user';
@@ -62,6 +65,9 @@ DEALLOCATE PREPARE stmt1;
6265
--echo # password policy MEDIUM (check for mixed_case, digits, special_chars)
6366
--echo # default case : atleast 1 mixed_case, 1 digit, 1 special_char
6467

68+
SET @@global.validate_password_mixed_case_count= 1;
69+
SET @@global.validate_password_number_count= 1;
70+
SET @@global.validate_password_special_char_count= 1;
6571
SET @@global.validate_password_policy=MEDIUM;
6672
SET @@global.validate_password_number_count= 0;
6773
CREATE USER 'user'@'localhost' IDENTIFIED BY 'aedfoiASE$%';

‎plugin/password_validation/validate_password.cc‎

Lines changed: 63 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -275,27 +275,86 @@ static int validate_password_deinit(void *arg __attribute__((unused)))
275275
return (0);
276276
}
277277

278+
279+
/*
280+
update function for:
281+
1. validate_password_length
282+
2. validate_password_number_count
283+
3. validate_password_mixed_case_count
284+
4. validate_password_special_char_count
285+
*/
286+
static void
287+
length_update(MYSQL_THD thd __attribute__((unused)),
288+
struct st_mysql_sys_var *var __attribute__((unused)),
289+
void *var_ptr, const void *save)
290+
{
291+
int new_validate_password_length;
292+
293+
/* check if there is an actual change */
294+
if (*((int *)var_ptr) == *((int *)save))
295+
return;
296+
297+
/*
298+
set new value for system variable.
299+
Note that we need not know for which of the above mentioned
300+
variables, length_update() is called because var_ptr points
301+
to the location at which corresponding static variable is
302+
declared in this file.
303+
*/
304+
*((int *)var_ptr)= *((int *)save);
305+
306+
/*
307+
Any change in above mentioned system variables can trigger a change in
308+
actual password length restriction applied by validate password plugin.
309+
actual restriction on password length can be described as:
310+
311+
MAX(validate_password_length,
312+
(validate_password_number_count +
313+
2*validate_password_mixed_case_count +
314+
validate_password_special_char_count))
315+
*/
316+
317+
new_validate_password_length= (validate_password_number_count +
318+
(2 * validate_password_mixed_case_count) +
319+
validate_password_special_char_count);
320+
321+
if (validate_password_length < new_validate_password_length)
322+
{
323+
/*
324+
Raise a warning that effective restriction on password
325+
length is changed.
326+
*/
327+
my_plugin_log_message(&plugin_info_ptr, MY_WARNING_LEVEL,
328+
"Effective value of validate_password_length is changed. New value is %d",
329+
new_validate_password_length);
330+
331+
validate_password_length= new_validate_password_length;
332+
}
333+
}
334+
335+
336+
278337
/* Plugin system variables */
279338

280339
static MYSQL_SYSVAR_INT(length, validate_password_length,
281340
PLUGIN_VAR_RQCMDARG,
282341
"Password validate length to check for minimum password_length",
283-
NULL, NULL, 8, 0, 0, 0);
342+
NULL, length_update, 8, 0, 0, 0);
284343

285344
static MYSQL_SYSVAR_INT(number_count, validate_password_number_count,
286345
PLUGIN_VAR_RQCMDARG,
287346
"password validate digit to ensure minimum numeric character in password",
288-
NULL, NULL, 1, 0, 0, 0);
347+
NULL, length_update, 1, 0, 0, 0);
289348

290349
static MYSQL_SYSVAR_INT(mixed_case_count, validate_password_mixed_case_count,
291350
PLUGIN_VAR_RQCMDARG,
292351
"Password validate mixed case to ensure minimum upper/lower case in password",
293-
NULL, NULL, 1, 0, 0, 0);
352+
NULL, length_update, 1, 0, 0, 0);
294353

295354
static MYSQL_SYSVAR_INT(special_char_count,
296355
validate_password_special_char_count, PLUGIN_VAR_RQCMDARG,
297356
"password validate special to ensure minimum special character in password",
298-
NULL, NULL, 1, 0, 0, 0);
357+
NULL, length_update, 1, 0, 0, 0);
299358

300359
static MYSQL_SYSVAR_ENUM(policy, validate_password_policy,
301360
PLUGIN_VAR_RQCMDARG,

0 commit comments

Comments
 (0)