server, privilege: Socket authentication

[dveeden]

What problem does this PR solve?

Support MySQL compatible Socket Authentication (auth_socket).

This could be used to provide a more secure alternative to the default account.

See also:

• https://dev.mysql.com/doc/refman/8.0/en/socket-pluggable-authentication.html

What is changed and how it works?

Check List

Tests

• Unit test

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

Support for socket authentication was added

Notes for reviews

• Run tidb-server with socket = "/tmp/tidb.sock" in your config.
• CREATE USER 'myuser'@'%' IDENTIFIED WITH 'auth_socket' (replace myuser with your UNIX username)
• Try to connect with mysqlsh --sql mysql://myuser@(/tmp/tidb.sock)/ (shoul work)
• Try to connect with a different UNIX user (e.g. use sudo to use root) (should fail)
• Try to connect over TCP mysqlsh --sql mysql://myuser@127.0.0.1:4000/
• You might hit tidb using unix socket cannot restart if after SIGKILL #26058 when testing this.
• CREATE USER 'my_other_user'@'%' IDENTIFIED WITH 'auth_socket' AS 'myuser' (replace myuser with your UNIX username)
• Try to connect with mysqlsh --sql mysql://my_other_user@(/tmp/tidb.sock)/ as UNIX user myuser. This tests the mapping between UNIX and TiDB users.

[ti-chi-bot]

[REVIEW NOTIFICATION]

This pull request has been approved by:

• mjonss
• morgo

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

[dveeden]

/cc @crazycs520 @XuHuaiyu @morgo

[morgo]

Looking good, minor nits.

[dveeden]

/run-check_dev_2

[mjonss]

Tested on macOS 11.6 on Apple M1 (arm cpu):

Release Version: v5.3.0-alpha-1086-gfae002894
Edition: Community
Git Commit Hash: fae0028948ac951e638620c7a89a78e1ad4decdd
Git Branch: auth_socket
UTC Build Time: 2021-10-18 11:41:15
GoVersion: go1.17.1
Race Enabled: false
TiKV Min Version: v3.0.0-60965b006877ca7234adaced7890d7b029ed1306
Check Table Before Drop: false

with mysql -S /tmp/tidb.sock without issues
and mysqlsh -S /tmp/tidb.sock --sql --password= with this in the tidb-server error log:

[2021/10/18 14:00:59.019 +02:00] [WARN] [builtin_string.go:291] ["unexpected `Flen` value(-1) in CONCAT's args"] ["arg's index"=0]
[2021/10/18 14:00:59.019 +02:00] [WARN] [builtin_string.go:291] ["unexpected `Flen` value(-1) in CONCAT's args"] ["arg's index"=2]

Which is the same when mysqlsh root@localhost -P 4000 --sql --password= was used.

[mjonss]

Same test environment but with create user root@localhost identified with 'auth_socket' as 'my_user'; and

> mysql -S /tmp/tidb.sock -u root
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)

I assume that authentication variable is not properly set to my_user since it fails in privilege/privileges/privileges.go:366

(dlv) p user
"root"
(dlv) p pwd
"my_user"
(dlv) p authentication
[]uint8 len: 0, cap: 144, []

[mjonss]

Same result on Ubuntu 21.04 x64 on create user root@localhost identified with 'auth_socket' as 'my_user'; (that authentication fails, since authentication variable is empty:

Release Version: v5.3.0-alpha-1086-gfae0028948
Edition: Community
Git Commit Hash: fae0028948ac951e638620c7a89a78e1ad4decdd
Git Branch: HEAD
UTC Build Time: 2021-10-18 12:34:35
GoVersion: go1.16.2
Race Enabled: false
TiKV Min Version: v3.0.0-60965b006877ca7234adaced7890d7b029ed1306
Check Table Before Drop: false

[mjonss]

Looks like PeerHost is called too late, so cc.peerHost is not yet set which makes the userplugin lookup through userplugin, err := cc.ctx.AuthPluginForUser(&auth.UserIdentity{Username: cc.user, Hostname: cc.peerHost}) not working in server/conn.go:843 since cc.peerHost is not yet set to "localhost".

[dveeden]

@mjonss does the mysql.user.authentication_string have the right value?

[mjonss]

@mjonss does the mysql.user.authentication_string have the right value?

@dveeden, I think so:

                  Host: localhost
                  User: root
 authentication_string: <my_user> -- really my unix username
                plugin: auth_socket

[mjonss]

There is a constant you can use for "localhost": variable.DefHostname

[dveeden]

Not changing that as the "Default Hostname" is not guaranteed to remain "localhost" in the future.

[mjonss]

LGTM
Tested on macOS 11.6 on Apple M1 cpu and ubuntu 21.04 x64, and it now works also for 'proxy' user.

[morgo]

/merge

[ti-chi-bot]

This pull request has been accepted and is ready to merge.

Commit hash: d50ac88

[xiongjiwei]

can not build on windows after this pr

[dveeden]

@xiongjiwei

While Windows now seems to have AF_UNIX support ( https://devblogs.microsoft.com/commandline/af_unix-comes-to-windows/ ) this doesn't seem to be supported by Go.

Can you try dveeden@3d40baf and see if that fixes the build for the windows target for you?

[xiongjiwei]

@dveeden it works! thank you.