Skip to content

Commit

Permalink
Backport 1.3.x: Fix MySQL Plugin password special character escape bug (
Browse files Browse the repository at this point in the history 
#8177)

Also factor out mysqlhelper so we can create mysql docker containers in other tests. (#8167)
  • Loading branch information
@ncabatoff
ncabatoff committed Jan 17, 2020
1 parent 467fef6 commit 1374988
Show file tree
Hide file tree
Showing 43 changed files with 357 additions and 8,911 deletions.
67 changes: 67 additions & 0 deletions helper/testhelpers/mysql/mysqlhelper.go
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
package mysqlhelper

import (
"database/sql"
"fmt"
"os"
"strings"
"testing"

"github.com/hashicorp/vault/helper/testhelpers/docker"
"github.com/ory/dockertest"
)

func PrepareMySQLTestContainer(t *testing.T, legacy bool, pw string) (cleanup func(), retURL string) {
if os.Getenv("MYSQL_URL") != "" {
return func() {}, os.Getenv("MYSQL_URL")
}

pool, err := dockertest.NewPool("")
if err != nil {
t.Fatalf("Failed to connect to docker: %s", err)
}

imageVersion := "5.7"
if legacy {
imageVersion = "5.6"
}

resource, err := pool.Run("mysql", imageVersion, []string{"MYSQL_ROOT_PASSWORD=" + pw})
if err != nil {
t.Fatalf("Could not start local MySQL docker container: %s", err)
}

cleanup = func() {
docker.CleanupResource(t, pool, resource)
}

retURL = fmt.Sprintf("root:%s@(localhost:%s)/mysql?parseTime=true", pw, resource.GetPort("3306/tcp"))

// exponential backoff-retry
if err = pool.Retry(func() error {
var err error
var db *sql.DB
db, err = sql.Open("mysql", retURL)
if err != nil {
return err
}
defer db.Close()
return db.Ping()
}); err != nil {
cleanup()
t.Fatalf("Could not connect to MySQL docker container: %s", err)
}

return
}

func TestCredsExist(t testing.TB, connURL, username, password string) error {
// Log in with the new creds
connURL = strings.Replace(connURL, "root:secret", fmt.Sprintf("%s:%s", username, password), 1)
db, err := sql.Open("mysql", connURL)
if err != nil {
return err
}
defer db.Close()
return db.Ping()
}
117 changes: 44 additions & 73 deletions plugins/database/mysql/mysql_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,69 +3,22 @@ package mysql
import (
"context"
"database/sql"
"fmt"
"os"
"strings"
"testing"
"time"

stdmysql "github.com/go-sql-driver/mysql"
"github.com/hashicorp/vault/helper/testhelpers/docker"
mysqlhelper "github.com/hashicorp/vault/helper/testhelpers/mysql"
"github.com/hashicorp/vault/sdk/database/dbplugin"
"github.com/hashicorp/vault/sdk/database/helper/credsutil"
"github.com/hashicorp/vault/sdk/database/helper/dbutil"
"github.com/hashicorp/vault/sdk/helper/strutil"
"github.com/ory/dockertest"
)

var _ dbplugin.Database = (*MySQL)(nil)

func prepareMySQLTestContainer(t *testing.T, legacy bool) (cleanup func(), retURL string) {
if os.Getenv("MYSQL_URL") != "" {
return func() {}, os.Getenv("MYSQL_URL")
}

pool, err := dockertest.NewPool("")
if err != nil {
t.Fatalf("Failed to connect to docker: %s", err)
}

imageVersion := "5.7"
if legacy {
imageVersion = "5.6"
}

resource, err := pool.Run("mysql", imageVersion, []string{"MYSQL_ROOT_PASSWORD=secret"})
if err != nil {
t.Fatalf("Could not start local MySQL docker container: %s", err)
}

cleanup = func() {
docker.CleanupResource(t, pool, resource)
}

retURL = fmt.Sprintf("root:secret@(localhost:%s)/mysql?parseTime=true", resource.GetPort("3306/tcp"))

// exponential backoff-retry
if err = pool.Retry(func() error {
var err error
var db *sql.DB
db, err = sql.Open("mysql", retURL)
if err != nil {
return err
}
defer db.Close()
return db.Ping()
}); err != nil {
cleanup()
t.Fatalf("Could not connect to MySQL docker container: %s", err)
}

return
}

func TestMySQL_Initialize(t *testing.T) {
cleanup, connURL := prepareMySQLTestContainer(t, false)
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, false, "secret")
defer cleanup()

connectionDetails := map[string]interface{}{
Expand Down Expand Up @@ -100,7 +53,7 @@ func TestMySQL_Initialize(t *testing.T) {
}

func TestMySQL_CreateUser(t *testing.T) {
cleanup, connURL := prepareMySQLTestContainer(t, false)
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, false, "secret")
defer cleanup()

connectionDetails := map[string]interface{}{
Expand Down Expand Up @@ -133,7 +86,7 @@ func TestMySQL_CreateUser(t *testing.T) {
t.Fatalf("err: %s", err)
}

if err := testCredsExist(t, connURL, username, password); err != nil {
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}

Expand All @@ -143,7 +96,7 @@ func TestMySQL_CreateUser(t *testing.T) {
t.Fatalf("err: %s", err)
}

if err := testCredsExist(t, connURL, username, password); err != nil {
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}

Expand All @@ -155,14 +108,14 @@ func TestMySQL_CreateUser(t *testing.T) {
t.Fatalf("err: %s", err)
}

if err := testCredsExist(t, connURL, username, password); err != nil {
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}

}

func TestMySQL_CreateUser_Legacy(t *testing.T) {
cleanup, connURL := prepareMySQLTestContainer(t, true)
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, true, "secret")
defer cleanup()

connectionDetails := map[string]interface{}{
Expand Down Expand Up @@ -195,7 +148,7 @@ func TestMySQL_CreateUser_Legacy(t *testing.T) {
t.Fatalf("err: %s", err)
}

if err := testCredsExist(t, connURL, username, password); err != nil {
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}

Expand All @@ -205,13 +158,13 @@ func TestMySQL_CreateUser_Legacy(t *testing.T) {
t.Fatalf("err: %s", err)
}

if err := testCredsExist(t, connURL, username, password); err != nil {
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
}

func TestMySQL_RotateRootCredentials(t *testing.T) {
cleanup, connURL := prepareMySQLTestContainer(t, false)
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, false, "secret")
defer cleanup()

connURL = strings.Replace(connURL, "root:secret", `{{username}}:{{password}}`, -1)
Expand Down Expand Up @@ -247,7 +200,7 @@ func TestMySQL_RotateRootCredentials(t *testing.T) {
}

func TestMySQL_RevokeUser(t *testing.T) {
cleanup, connURL := prepareMySQLTestContainer(t, false)
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, false, "secret")
defer cleanup()

connectionDetails := map[string]interface{}{
Expand All @@ -274,7 +227,7 @@ func TestMySQL_RevokeUser(t *testing.T) {
t.Fatalf("err: %s", err)
}

if err := testCredsExist(t, connURL, username, password); err != nil {
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}

Expand All @@ -284,7 +237,7 @@ func TestMySQL_RevokeUser(t *testing.T) {
t.Fatalf("err: %s", err)
}

if err := testCredsExist(t, connURL, username, password); err == nil {
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err == nil {
t.Fatal("Credentials were not revoked")
}

Expand All @@ -294,7 +247,7 @@ func TestMySQL_RevokeUser(t *testing.T) {
t.Fatalf("err: %s", err)
}

if err := testCredsExist(t, connURL, username, password); err != nil {
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}

Expand All @@ -305,19 +258,19 @@ func TestMySQL_RevokeUser(t *testing.T) {
t.Fatalf("err: %s", err)
}

if err := testCredsExist(t, connURL, username, password); err == nil {
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err == nil {
t.Fatal("Credentials were not revoked")
}
}

func TestMySQL_SetCredentials(t *testing.T) {
cleanup, connURL := prepareMySQLTestContainer(t, false)
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, false, "secret")
defer cleanup()

// create the database user and verify we can access
dbUser := "vaultstatictest"
createTestMySQLUser(t, connURL, dbUser, "password", testRoleStaticCreate)
if err := testCredsExist(t, connURL, dbUser, "password"); err != nil {
if err := mysqlhelper.TestCredsExist(t, connURL, dbUser, "password"); err != nil {
t.Fatalf("Could not connect with credentials: %s", err)
}

Expand Down Expand Up @@ -351,7 +304,7 @@ func TestMySQL_SetCredentials(t *testing.T) {
}

// verify new password works
if err := testCredsExist(t, connURL, dbUser, newPassword); err != nil {
if err := mysqlhelper.TestCredsExist(t, connURL, dbUser, newPassword); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}

Expand All @@ -363,20 +316,38 @@ func TestMySQL_SetCredentials(t *testing.T) {
t.Fatalf("err: %s", err)
}

if err := testCredsExist(t, connURL, dbUser, newPassword); err != nil {
if err := mysqlhelper.TestCredsExist(t, connURL, dbUser, newPassword); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
}

func testCredsExist(t testing.TB, connURL, username, password string) error {
// Log in with the new creds
connURL = strings.Replace(connURL, "root:secret", fmt.Sprintf("%s:%s", username, password), 1)
db, err := sql.Open("mysql", connURL)
func TestMySQL_Initialize_ReservedChars(t *testing.T) {
pw := "#secret!%25#{@}"
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, false, pw)
defer cleanup()

// Revert password set to test replacement by db.Init
connURL = strings.ReplaceAll(connURL, pw, "{{password}}")

connectionDetails := map[string]interface{}{
"connection_url": connURL,
"password": pw,
}

db := new(MetadataLen, MetadataLen, UsernameLen)
_, err := db.Init(context.Background(), connectionDetails, true)
if err != nil {
t.Fatalf("err: %s", err)
}

if !db.Initialized {
t.Fatal("Database should be initialized")
}

err = db.Close()
if err != nil {
return err
t.Fatalf("err: %s", err)
}
defer db.Close()
return db.Ping()
}

func createTestMySQLUser(t *testing.T, connURL, username, password, query string) {
Expand Down
8 changes: 7 additions & 1 deletion sdk/database/helper/connutil/sql.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -55,11 +55,17 @@ func (c *SQLConnectionProducer) Init(ctx context.Context, conf map[string]interf
return nil, fmt.Errorf("connection_url cannot be empty")
}

// Don't escape special characters for MySQL password
password := c.Password
if c.Type != "mysql" {
password = url.PathEscape(c.Password)
}

// QueryHelper doesn't do any SQL escaping, but if it starts to do so
// then maybe we won't be able to use it to do URL substitution any more.
c.ConnectionURL = dbutil.QueryHelper(c.ConnectionURL, map[string]string{
"username": url.PathEscape(c.Username),
"password": url.PathEscape(c.Password),
"password": password,
})

if c.MaxOpenConnections == 0 {
Expand Down
Loading

0 comments on commit 1374988

Please sign in to comment.