Skip to content

Commit a09ca74

Browse files
david22swandavid22swan
authored
Merge pull request #1233 from koshatul/fix-for-tls-options
change split on whitespace to split on tab in mysql_user
2 parents 351840a + 698c21c commit a09ca74

File tree

3 files changed

+94
-5
lines changed

3 files changed

+94
-5
lines changed

‎lib/puppet/provider/mysql_user/mysql.rb

+4-4
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ def self.instances
2323
end
2424
@max_user_connections, @max_connections_per_hour, @max_queries_per_hour,
2525
@max_updates_per_hour, ssl_type, ssl_cipher, x509_issuer, x509_subject,
26-
@password, @plugin, @authentication_string = mysql_caller(query, 'regular').split(%r{\s})
26+
@password, @plugin, @authentication_string = mysql_caller(query, 'regular').chomp.split(%r{\t})
2727
@tls_options = parse_tls_options(ssl_type, ssl_cipher, x509_issuer, x509_subject)
2828
if newer_than('mariadb' => '10.1.21') && @plugin == 'ed25519'
2929
# Some auth plugins (e.g. ed25519) use authentication_string
@@ -244,9 +244,9 @@ def self.parse_tls_options(ssl_type, ssl_cipher, x509_issuer, x509_subject)
244244
['X509']
245245
elsif ssl_type == 'SPECIFIED'
246246
options = []
247-
options << "CIPHER #{ssl_cipher}" if !ssl_cipher.nil? && !ssl_cipher.empty?
248-
options << "ISSUER #{x509_issuer}" if !x509_issuer.nil? && !x509_issuer.empty?
249-
options << "SUBJECT #{x509_subject}" if !x509_subject.nil? && !x509_subject.empty?
247+
options << "CIPHER '#{ssl_cipher}'" if !ssl_cipher.nil? && !ssl_cipher.empty?
248+
options << "ISSUER '#{x509_issuer}'" if !x509_issuer.nil? && !x509_issuer.empty?
249+
options << "SUBJECT '#{x509_subject}'" if !x509_subject.nil? && !x509_subject.empty?
250250
options
251251
else
252252
['NONE']

‎spec/acceptance/types/mysql_user_spec.rb

+51
Original file line numberDiff line numberDiff line change
@@ -199,4 +199,55 @@ class { 'mysql::server': * => $ed25519_opts }
199199
end
200200
end
201201
end
202+
context 'using user-w-subject@localhost with ISSUER and SUBJECT' do
203+
describe 'adding user' do
204+
it 'works without errors' do
205+
pp = <<-MANIFEST
206+
mysql_user { 'user-w-subject@localhost':
207+
tls_options => [
208+
"SUBJECT '/OU=MySQL Users/CN=username'",
209+
"ISSUER '/CN=Certificate Authority'",
210+
"CIPHER 'EDH-RSA-DES-CBC3-SHA'",
211+
],
212+
}
213+
MANIFEST
214+
idempotent_apply(pp)
215+
end
216+
217+
it 'finds the user #stdout' do
218+
run_shell("mysql -NBe \"select '1' from mysql.user where CONCAT(user, '@', host) = 'user-w-subject@localhost'\"") do |r|
219+
expect(r.stdout).to match(%r{^1$})
220+
expect(r.stderr).to be_empty
221+
end
222+
end
223+
224+
it 'shows correct ssl_type #stdout' do
225+
run_shell("mysql -NBe \"select SSL_TYPE from mysql.user where CONCAT(user, '@', host) = 'user-w-subject@localhost'\"") do |r|
226+
expect(r.stdout).to match(%r{^SPECIFIED$})
227+
expect(r.stderr).to be_empty
228+
end
229+
end
230+
231+
it 'shows correct x509_issuer #stdout' do
232+
run_shell("mysql -NBe \"select X509_ISSUER from mysql.user where CONCAT(user, '@', host) = 'user-w-subject@localhost'\"") do |r|
233+
expect(r.stdout).to match(%r{^/CN=Certificate Authority$})
234+
expect(r.stderr).to be_empty
235+
end
236+
end
237+
238+
it 'shows correct x509_subject #stdout' do
239+
run_shell("mysql -NBe \"select X509_SUBJECT from mysql.user where CONCAT(user, '@', host) = 'user-w-subject@localhost'\"") do |r|
240+
expect(r.stdout).to match(%r{^/OU=MySQL Users/CN=username$})
241+
expect(r.stderr).to be_empty
242+
end
243+
end
244+
245+
it 'shows correct ssl_cipher #stdout' do
246+
run_shell("mysql -NBe \"select SSL_CIPHER from mysql.user where CONCAT(user, '@', host) = 'user-w-subject@localhost'\"") do |r|
247+
expect(r.stdout).to match(%r{^EDH-RSA-DES-CBC3-SHA$})
248+
expect(r.stderr).to be_empty
249+
end
250+
end
251+
end
252+
end
202253
end

‎spec/unit/puppet/provider/mysql_user/mysql_spec.rb

+39-1
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@
101101
Puppet::Util.stubs(:which).with('mysqld').returns('/usr/sbin/mysqld')
102102
File.stubs(:file?).with('/root/.my.cnf').returns(true)
103103
provider.class.stubs(:mysql_caller).with("SELECT CONCAT(User, '@',Host) AS User FROM mysql.user", 'regular').returns('joe@localhost')
104-
provider.class.stubs(:mysql_caller).with("SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = 'joe@localhost'", 'regular').returns('10 10 10 10 *6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4') # rubocop:disable Metrics/LineLength
104+
provider.class.stubs(:mysql_caller).with("SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = 'joe@localhost'", 'regular').returns('10 10 10 10 *6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4') # rubocop:disable Metrics/LineLength
105105
end
106106

107107
describe 'self.instances' do
@@ -439,6 +439,44 @@
439439
end
440440
end
441441

442+
describe 'tls_options=required' do
443+
it 'adds mTLS option grant in mysql 5.5' do
444+
provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.5'][:string])
445+
provider.class.expects(:mysql_caller).with("GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE ISSUER '/CN=Certificate Authority' AND SUBJECT '/OU=MySQL Users/CN=Username'", 'system').returns('0')
446+
447+
provider.expects(:tls_options).returns(['ISSUER \'/CN=Certificate Authority\'', 'SUBJECT \'/OU=MySQL Users/CN=Username\''])
448+
provider.tls_options = ['ISSUER \'/CN=Certificate Authority\'', 'SUBJECT \'/OU=MySQL Users/CN=Username\'']
449+
end
450+
it 'adds mTLS option grant in mysql 5.6' do
451+
provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.6'][:string])
452+
provider.class.expects(:mysql_caller).with("GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE ISSUER '/CN=Certificate Authority' AND SUBJECT '/OU=MySQL Users/CN=Username'", 'system').returns('0')
453+
454+
provider.expects(:tls_options).returns(['ISSUER \'/CN=Certificate Authority\'', 'SUBJECT \'/OU=MySQL Users/CN=Username\''])
455+
provider.tls_options = ['ISSUER \'/CN=Certificate Authority\'', 'SUBJECT \'/OU=MySQL Users/CN=Username\'']
456+
end
457+
it 'adds mTLS option grant in mysql < 5.7.6' do
458+
provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.1'][:string])
459+
provider.class.expects(:mysql_caller).with("GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE ISSUER '/CN=Certificate Authority' AND SUBJECT '/OU=MySQL Users/CN=Username'", 'system').returns('0')
460+
461+
provider.expects(:tls_options).returns(['ISSUER \'/CN=Certificate Authority\'', 'SUBJECT \'/OU=MySQL Users/CN=Username\''])
462+
provider.tls_options = ['ISSUER \'/CN=Certificate Authority\'', 'SUBJECT \'/OU=MySQL Users/CN=Username\'']
463+
end
464+
it 'adds mTLS option grant in mysql >= 5.7.6' do
465+
provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.6'][:string])
466+
provider.class.expects(:mysql_caller).with("ALTER USER 'joe'@'localhost' REQUIRE ISSUER '/CN=Certificate Authority' AND SUBJECT '/OU=MySQL Users/CN=Username'", 'system').returns('0')
467+
468+
provider.expects(:tls_options).returns(['ISSUER \'/CN=Certificate Authority\'', 'SUBJECT \'/OU=MySQL Users/CN=Username\''])
469+
provider.tls_options = ['ISSUER \'/CN=Certificate Authority\'', 'SUBJECT \'/OU=MySQL Users/CN=Username\'']
470+
end
471+
it 'adds mTLS option grant in mariadb-10.0' do
472+
provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mariadb-10.0'][:string])
473+
provider.class.expects(:mysql_caller).with("GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE ISSUER '/CN=Certificate Authority' AND SUBJECT '/OU=MySQL Users/CN=Username'", 'system').returns('0')
474+
475+
provider.expects(:tls_options).returns(['ISSUER \'/CN=Certificate Authority\'', 'SUBJECT \'/OU=MySQL Users/CN=Username\''])
476+
provider.tls_options = ['ISSUER \'/CN=Certificate Authority\'', 'SUBJECT \'/OU=MySQL Users/CN=Username\'']
477+
end
478+
end
479+
442480
['max_user_connections', 'max_connections_per_hour', 'max_queries_per_hour', 'max_updates_per_hour'].each do |property|
443481
describe property do
444482
it "returns #{property}" do

0 commit comments

Comments
 (0)