#2979, #2437, #2247, #1836: Enable mysql cleartext auth without access to keychain and with a warning to the user

4 files changed, 166 insertions, 18 deletions

diff --git a/Source/SPConnectionController.h b/Source/SPConnectionController.h
index 9da0d996..44b0a89f 100644
--- a/Source/SPConnectionController.h
+++ b/Source/SPConnectionController.h
@@ -69,6 +69,8 @@
 	BOOL isConnecting;
 	BOOL isEditingConnection;
 	BOOL isTestingConnection;
+	NSString *agreedInsecurePlugin;
+	NSString *insecureOverridePassword;
 	
 	// Standard details
 	NSInteger previousType;
@@ -164,6 +166,10 @@
     IBOutlet NSMenuItem *favoritesSortByMenuItem;
 	IBOutlet NSView *exportPanelAccessoryView;
 	IBOutlet NSView *editButtonsView;
+
+	IBOutlet NSView *requestPasswordAccessoryView;
+	IBOutlet NSTextField *requestPasswordPluginNameField;
+	IBOutlet NSSecureTextField *requestPasswordPasswordField;
 	
 	BOOL isEditingItemName;
     BOOL reverseFavoritesSort;
@@ -214,6 +220,18 @@
 @property (readwrite, retain) NSString *connectionSSHKeychainItemName;
 @property (readwrite, retain) NSString *connectionSSHKeychainItemAccount;
 @property (readwrite, assign) BOOL useCompression;
+/**
+ * If the user was prompted to allow a connection with an insecure auth plugin,
+ * the name of that plugin will be stored here (not persisted) so that we
+ * don't have to ask again when duplicating a connection/reconnecting.
+ */
+@property (readwrite, copy, nonatomic) NSString *agreedInsecurePlugin;
+/**
+ * If the user has given a password that is not the keychain password in
+ * the insecure auth plugin request, we will store it in memory and keep the
+ * other properties unchanged, since they are connected to GUI and/or backing stores
+ */
+@property (readwrite, copy, nonatomic) NSString *insecureOverridePassword;
 
 #ifdef SP_CODA
 @property (readwrite, assign) SPDatabaseDocument *dbDocument;
@@ -224,6 +242,7 @@
 
 - (NSString *)keychainPassword;
 - (NSString *)keychainPasswordForSSH;
+- (NSString *)actualPasswordForAuthPlugin:(NSString *)pluginName;
 
 // Connection processes
 - (IBAction)initiateConnection:(id)sender;
diff --git a/Source/SPConnectionController.m b/Source/SPConnectionController.m
index 467aa303..8df37973 100644
--- a/Source/SPConnectionController.m
+++ b/Source/SPConnectionController.m
@@ -114,6 +114,9 @@ static BOOL FindLinesInFile(NSData *fileData,const void *first,size_t first_len,
 
 - (void)_documentWillClose:(NSNotification *)notification;
 
+- (void)_beginRequestPasswordForInsecurePlugin:(NSString *)pluginName;
+- (void)_insecurePasswordAlertDidEnd:(NSAlert *)alert returnCode:(NSInteger)returnCode contextInfo:(void *)contextInfo;
+
 static NSComparisonResult _compareFavoritesUsingKey(id favorite1, id favorite2, void *key);
 #endif
 
@@ -163,6 +166,8 @@ static NSComparisonResult _compareFavoritesUsingKey(id favorite1, id favorite2,
 @synthesize sshKeyLocation;
 @synthesize sshPort;
 @synthesize useCompression;
+@synthesize agreedInsecurePlugin = agreedInsecurePlugin;
+@synthesize insecureOverridePassword = insecureOverridePassword;
 
 #ifdef SP_CODA
 @synthesize dbDocument;
@@ -199,6 +204,133 @@ static NSComparisonResult _compareFavoritesUsingKey(id favorite1, id favorite2,
 	return kcSSHPassword;
 }
 
+/**
+ * This method is responsible for handing the user password to SPMySQL when it needs it.
+ * It will receive the name of the auth plugin mysql plans to use and with
+ * that it has to decide whether to fetch the password from keychain, or present
+ * additional prompts to the user (e.g. in case the auth plugin is insecure).
+ *
+ * Note: The 5.5 libmysqlclient on the first attempt ignores the requested plugin
+ *       and tries to guess one instead. Only if that fails it will try to use
+ *       the server's suggested one. Thus this method may be invoked multiple times
+ *       during a single connection attempt.
+ *
+ * @return The actual user password to give to the mysql auth plugin.
+ *         This may be empty (no password).
+ *         This may be nil, which will be interpreted as "cancelled by user"
+ *
+ * This MUST be called on the UI thread!
+ */
+- (NSString *)actualPasswordForAuthPlugin:(NSString *)pluginName
+{
+	NSArray *securePluginNames = @[
+		@"mysql_native_password", //default on 4.1+
+		//@"sha256_password", // not supported by the 5.5 client, only secure when used with TLS server cert checks!
+		                      //   over SSL: password is transmitted in plaintext
+		                      //   over plaintext: the mysql client uses assymetric crypto to encrypt the password and
+		                      //                   send the encrypted plaintext to the server (this requires the OpenSSL
+		                      //                   libs, so doesn't work with our client builds)
+	];
+	//INSECURE:
+	//  mysql_clear_password; Plaintext password
+	//  mysql_old_password;   Deprecated, used with pre-4.1 servers. No longer supported in 5.7.5+ clients
+	//UNSUPPORTED:
+	//  authentication_windows_client;   Kerberos/NTLM auth. Not supported on UNIX by libmysqlclient
+	//  authentication_ldap_sasl_client; MySQL Enterprise
+	//  auth_test_plugin;                Developer example only
+
+	// TODO incorporate SSL/TLS state in decision (cleartext over trusted SSL should be fine)
+	// This is not possible right now, because someone with access to the Mac could just swap the SSL CA cert
+	// and server ip to something he controls. So if Sequel Pro would just check that SSL was in use, it could
+	// still be attacked to easily give the password away.
+	// Instead we have to link all critical connection parameters (host+port+ssh-tunnel+ssl server or ca cert hash)
+	// to the password in keychain and make sure none of them changed before giving the password to libmysqlclient.
+
+	if(![securePluginNames containsObject:pluginName]) {
+		if(![pluginName isEqualToString:agreedInsecurePlugin]) {
+			// since the user will probably take longer to answer the dialog than the connection timeout is
+			// (and because the UI sheet is async anyway),
+			// we will do a little trick and disconnect mysql right now and retry, once we actually have the password
+			[self performSelector:@selector(_beginRequestPasswordForInsecurePlugin:) withObject:pluginName afterDelay:0.0];
+			cancellingConnection = YES;
+			return nil;
+		}
+	}
+
+	NSString *pass;
+	// override password always wins
+	if ((pass = [self insecureOverridePassword])) {
+		;
+	}
+	// Only set the password if there is no Keychain item set and the connection is not being tested.
+	// The connection will otherwise ask the delegate for passwords in the Keychain.
+	else if ((!connectionKeychainItemName || isTestingConnection) && (pass = [self password])) {
+		;
+	}
+	else {
+		pass = [self keychainPassword];
+	}
+
+	return (pass ? pass : @""); //returning nil would mean cancelled
+}
+
+- (void)_beginRequestPasswordForInsecurePlugin:(NSString *)pluginName
+{
+	// if the user presses "Disconnect" in the dialog OR
+	// if this was only a test connection OR
+	// if the connection failed anyway
+	// -> agreedInsecurePlugin will be cleared again via -_restoreConnectionInterface
+	[self setAgreedInsecurePlugin:pluginName];
+
+	//show modal warning dialog
+	NSAlert *alert = [[NSAlert alloc] init]; //released in alert callback
+	[alert setAlertStyle:NSAlertStyleCritical];
+	[alert setMessageText:NSLocalizedString(@"Transmit password insecurely?",@"Connection dialog : password security error alert : title")];
+	[alert setInformativeText:NSLocalizedString(@"The MySQL server has requested the password to be transmitted in an insecure manner. This could be indicative of an attack on the server or your network connection!\n\nIf you still want to continue anyway, manually reenter your connection password.",@"Connection dialog : password security error alert : detail message")];
+	[alert setAccessoryView:requestPasswordAccessoryView];
+
+	[requestPasswordPluginNameField setStringValue:pluginName];
+
+	NSButton *connectAnywayButton = [alert addButtonWithTitle:NSLocalizedString(@"Connect Anyway",@"Connection dialog : password security error alert : confirm button")];
+	[connectAnywayButton setTag:NSAlertDefaultReturn];
+
+	NSButton *disconnectButton = [alert addButtonWithTitle:NSLocalizedString(@"Disconnect",@"Connection dialog : password security error alert : cancel button")];
+	[disconnectButton setTag:NSAlertAlternateReturn];
+
+	[alert beginSheetModalForWindow:[dbDocument parentWindow]
+	                  modalDelegate:self
+	                 didEndSelector:@selector(_insecurePasswordAlertDidEnd:returnCode:contextInfo:)
+	                    contextInfo:NULL];
+}
+
+- (void)_insecurePasswordAlertDidEnd:(NSAlert *)alert returnCode:(NSInteger)returnCode contextInfo:(void *)contextInfo
+{
+	NSString *pass = nil;
+	if(returnCode == NSAlertDefaultReturn) {
+		pass = [NSString stringWithString:[requestPasswordPasswordField stringValue]];
+	}
+	[requestPasswordPasswordField setStringValue:@""];
+
+	[alert autorelease];
+
+	cancellingConnection = NO;
+
+	//cancelled by user?
+	if(!pass) {
+		[self _restoreConnectionInterface];
+		return;
+	}
+
+	// if the manually given password matches the keychain password there is no need to keep it in memory,
+	// otherwise we use the override password ivar in order to not affect the normal logic
+	if (!connectionKeychainItemName || ![pass isEqualToString:[self keychainPassword]]) {
+		[self setInsecureOverridePassword:pass];
+	}
+
+	[[pass retain] release]; //free it asap
+	[self initiateMySQLConnection]; //reconnect
+}
+
 #pragma mark -
 #pragma mark Connection processes
 
@@ -765,6 +897,8 @@ static NSComparisonResult _compareFavoritesUsingKey(id favorite1, id favorite2,
 	if (connectionKeychainItemAccount) SPClear(connectionKeychainItemAccount);
 	if (connectionSSHKeychainItemName) SPClear(connectionSSHKeychainItemName);
 	if (connectionSSHKeychainItemAccount) SPClear(connectionSSHKeychainItemAccount);
+	[self setAgreedInsecurePlugin:nil];
+	[self setInsecureOverridePassword:nil];
 
 	SPTreeNode *node = [self selectedFavoriteNode];
 	if ([node isGroup]) node = nil;
@@ -1764,7 +1898,11 @@ static NSComparisonResult _compareFavoritesUsingKey(id favorite1, id favorite2,
 	// Reset the window title
 	[dbDocument updateWindowTitle:self];
 	[[dbDocument parentTabViewItem] setLabel:[dbDocument displayName]];
-	
+
+	//only store that if the connection attempt was successful
+	[self setAgreedInsecurePlugin:nil];
+	[self setInsecureOverridePassword:nil];
+
 	// Stop the current tab's progress indicator
 	[dbDocument setIsProcessing:NO];
 
@@ -2083,12 +2221,6 @@ static NSComparisonResult _compareFavoritesUsingKey(id favorite1, id favorite2,
 		}
 	}
 
-	// Only set the password if there is no Keychain item set and the connection is not being tested.
-	// The connection will otherwise ask the delegate for passwords in the Keychain.
-	if ((!connectionKeychainItemName || isTestingConnection) && [self password]) {
-		[mySQLConnection setPassword:[self password]];
-	}
-
 	// Enable SSL if set
 	if ([self useSSL]) {
 		[mySQLConnection setUseSSL:YES];
@@ -2130,6 +2262,11 @@ static NSComparisonResult _compareFavoritesUsingKey(id favorite1, id favorite2,
 	[mySQLConnection setUseKeepAlive:[[prefs objectForKey:SPUseKeepAlive] boolValue]];
 	[mySQLConnection setKeepAliveInterval:[[prefs objectForKey:SPKeepAliveInterval] floatValue]];
 
+	// We can always enable the cleartext plugin (this does not yet mean it will actually be used),
+	// since mysql will ask us for the password in -actualPasswordForAuthPlugin: at which point
+	// we get to decide what to do with the actual plugin.
+	[mySQLConnection setAllowCleartextPlugin:YES];
+
 	// Connect
 	[mySQLConnection connect];
 
@@ -3646,6 +3783,8 @@ static NSComparisonResult _compareFavoritesUsingKey(id favorite1, id favorite2,
 	if (connectionKeychainItemAccount)    SPClear(connectionKeychainItemAccount);
 	if (connectionSSHKeychainItemName)    SPClear(connectionSSHKeychainItemName);
 	if (connectionSSHKeychainItemAccount) SPClear(connectionSSHKeychainItemAccount);
+	[self setAgreedInsecurePlugin:nil];
+	[self setInsecureOverridePassword:nil];
 
 #ifndef SP_CODA
 	if (currentFavorite) SPClear(currentFavorite);
diff --git a/Source/SPDatabaseDocument.m b/Source/SPDatabaseDocument.m
index d907efb3..fe555241 100644
--- a/Source/SPDatabaseDocument.m
+++ b/Source/SPDatabaseDocument.m
@@ -7137,8 +7137,7 @@ static int64_t SPDatabaseDocumentInstanceCounter = 0;
  */
 - (NSString *)passwordForConnection:(SPMySQLConnection *)connection authPlugin:(NSString *)pluginName
 {
-	//TODO check plugin name to see whether we want to fetch it from keychain
-	return [connectionController keychainPassword];
+	return [[connectionController onMainThread] actualPasswordForAuthPlugin:pluginName];
 }
 
 /**
diff --git a/Source/SPKeychain.m b/Source/SPKeychain.m
index 94b561c5..61b1f5a8 100644
--- a/Source/SPKeychain.m
+++ b/Source/SPKeychain.m
@@ -43,15 +43,6 @@
 	if (!(self = [super init])) {
 		return nil;
 	}
-	
-	NSString *cleartext = [NSProcessInfo processInfo].environment[@"LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN"];
-	if (cleartext != nil) {
-		NSLog(@"LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN is set. Disabling keychain access. See Issue #2437");
-		
-		[self release];
-		return nil;
-	}
-	
 	return self;
 }