Mosquitto dies on wrong password. about mosquitto-auth-plug

[jpmens]

Can you show me your configuration?

[satanasov]

auth_plugin /etc/mosquitto/auth-plug.so
auth_opt_backends mysql
auth_opt_host localhost
auth_opt_port 3306
auth_opt_dbname mosquittodb
auth_opt_user mosquittouser
auth_opt_pass mosquittopass
auth_opt_userquery SELECT pw FROM auth_users WHERE username = '%s'
auth_opt_superquery SELECT COUNT(*) FROM auth_users WHERE username = '%s' AND super = 1
auth_opt_aclquery SELECT topic FROM acls WHERE username = '%s'

[jpmens]

Just woke up, sorry. ;-) I now see you're using Mosquitto 1.2.2. Can you please confirm it worked for you in 1.2.1? (So that I know where to look, as I cannot reproduce with 1.2.1.)

[jpmens]

Can't reproduce with 1.2.2.
What platform are you on? OS/version?

[satanasov]

Same problem on 1.2.1 ...

OS: Slackware64-current

If I have wrong username or password Mosquitto sifaults. If I use local acl and pw files - all is ok.

[jpmens]

Cannot reproduce on Debian either ...

Please compile auth plugin with -DDEBUG=1 and launch Mosquitto on command-line (not in background). Then send me debug of connection which looks a bit like this:

...
1382430295: |-- getuser(jjolie) AUTHENTICATED=1 by mysql
1382430295: Sending CONNACK to mosqpub/62618-tiggr.ww. (0)
...

[satanasov]

Normal user with normal password:

1382430635: New connection from 212.5.158.111 on port 1883.
1382430635: |-- getuser(lucifer) AUTHENTICATED=1 by mysql
1382430635: New client connected from 212.5.158.111 as 9396e814f4ac05c4 (c1, k900).
1382430635: Sending CONNACK to 9396e814f4ac05c4 (0)
1382430635: |-- aclcheck(lucifer, mqttitude/lucifer, 2) SUPERUSER=Y by mysql
1382430635: Received PUBLISH from 9396e814f4ac05c4 (d0, q1, r0, m1, 'mqttitude/lucifer', ... (114 bytes))
1382430635: Sending PUBACK to 9396e814f4ac05c4 (Mid: 1)

With wrong user (just aded a letter to the username):

1382430798: Received DISCONNECT from 9396e814f4ac05c4
1382430798: New connection from 212.5.158.111 on port 1883.
Segmentation fault

[jpmens]

Could you please git pull, make the plugin again, restart Mosquitto, and show me the debug output again?

[satanasov]

Same result.

1382432164: New connection from 212.5.158.111 on port 1883.
Segmentation fault

[satanasov]

OK ...

Let's start from the begining:

I need ONLY MySQL support, so my make file looks like this:

# Choose one or more back-ends Allowed values are
#       BE_CDB
#       BE_MYSQL
#       BE_SQLITE
#       BE_REDIS

BACKENDS= -DBE_MYSQL

BE_CFLAGS=`mysql_config --cflags`
BE_LDFLAGS=`mysql_config --libs`
BE_DEPS=

CDBDIR=contrib/tinycdb-0.78
CDB=$(CDBDIR)/cdb
CDBINC=$(CDBDIR)/
CDBLIB=$(CDBDIR)/libcdb.a
BE_CFLAGS += -I$(CDBINC)/
BE_LDFLAGS += -L$(CDBDIR) -lcdb
BE_DEPS += $(CDBLIB)

BE_LDFLAGS += -lsqlite3

#BE_CFLAGS += -I/usr/local/include/hiredis
#BE_LDFLAGS += -L/usr/local/lib -lhiredis

OPENSSLDIR=/usr/include/openssl
OSSLINC=-I$(OPENSSLDIR)/include
OSSLIBS=-L$(OPENSSLDIR)/lib -lcrypto



CFLAGS = -I/tmp/SBo/mosquitto-1.2.2/src/
CFLAGS += -I/tmp/SBo/mosquitto-1.2.2/lib/
CFLAGS += -fPIC -Wall -Werror $(BACKENDS) $(BE_CFLAGS) -I$(MOSQ)/src -DDEBUG=1 $(OSSLINC)
LDFLAGS=$(BE_LDFLAGS) -lmosquitto $(OSSLIBS)
LDFLAGS += -L/usr/lib64
# LDFLAGS += -Wl,-rpath,$(../../../../pubgit/MQTT/mosquitto/lib) -lc
# LDFLAGS += -export-dynamic

OBJS=auth-plug.o base64.o pbkdf2-check.o log.o hash.o be-psk.o be-cdb.o be-mysql.o be-sqlite.o be-redis.o

all: auth-plug.so np

auth-plug.so : $(OBJS) $(BE_DEPS)
        $(CC) -fPIC -shared $(OBJS) -o $@  $(OSSLIBS) $(BE_DEPS) $(LDFLAGS)

be-redis.o: be-redis.c be-redis.h log.h hash.h Makefile
be-sqlite.o: be-sqlite.c be-sqlite.h Makefile
auth-plug.o: auth-plug.c be-cdb.h be-mysql.h be-sqlite.h Makefile
be-psk.o: be-psk.c be-psk.h Makefile
be-cdb.o: be-cdb.c be-cdb.h Makefile
be-mysql.o: be-mysql.c be-mysql.h Makefile
be-sqlite.o: be-sqlite.c be-sqlite.h Makefile
pbkdf2-check.o: pbkdf2-check.c base64.h Makefile
base64.o: base64.c base64.h Makefile
log.o: log.c log.h Makefile
hash.o: hash.c hash.h uthash.h Makefile

np: np.c base64.o
        $(CC) $(CFLAGS) $^ -o $@ $(OSSLIBS)

$(CDBLIB):
        (cd $(CDBDIR); make libcdb.a cdb )

pwdb.cdb: pwdb.in
        $(CDB) -c -m  pwdb.cdb pwdb.in
clean :
        rm -f *.o *.so
        (cd contrib/tinycdb-0.78; make realclean )

This compiles and works ... could there be problem here?

[jpmens]

Your Makefile looks ok to me; proof is that when you're passing good username/pw values it works ;-)

I've added a debug for checking NULL userdata upon entry into the checking function. I'd appreciate if you could pull/make and test again (both the good and the negative situations).

(I greatly appreciate your working with me on this -- really trying to find the issue!)

[satanasov]

No problem with the work ..

User and pass exists(login successful)

1382433203: New connection from 212.5.158.111 on port 1883.
1382433203: |-- mosquitto_auth_unpwd_check(lucifer)
1382433203: |-- ** checking backend mysql
1382433203: |-- getuser(lucifer) AUTHENTICATED=1 by mysql
1382433203: New client connected from 212.5.158.111 as 9396e814f4ac05c4 (c1, k900).
1382433203: Sending CONNACK to 9396e814f4ac05c4 (0)

User is not existing:

1382433280: Received DISCONNECT from 9396e814f4ac05c4
1382433280: New connection from 212.5.158.111 on port 1883.
1382433281: |-- mosquitto_auth_unpwd_check(luciferq)
1382433281: |-- ** checking backend mysql
1382433281: |-- ** checking backend
Segmentation fault

[jpmens]

Pull/make again, please? :-)

[satanasov]

You can close the ticket!

1382434030: New connection from 212.5.158.111 on port 1883.
1382434030: |-- mosquitto_auth_unpwd_check(lucifer)
1382434030: |-- ** checking backend mysql
1382434030: |-- getuser(lucifer) AUTHENTICATED=1 by mysql
1382434030: New client connected from 212.5.158.111 as 9396e814f4ac05c4 (c1, k900).
1382434030: Sending CONNACK to 9396e814f4ac05c4 (0)
1382434038: Received DISCONNECT from 9396e814f4ac05c4
1382434038: New connection from 212.5.158.111 on port 1883.
1382434038: |-- mosquitto_auth_unpwd_check(luciferq)
1382434038: |-- ** checking backend mysql
1382434038: |-- getuser(luciferq) AUTHENTICATED=0 by none
1382434038: Sending CONNACK to 212.5.158.111 (4)

Thank you a lot!

[jpmens]

Whew!

Thank you very much for your assistance, @lucifer4o ; I'm glad it works now for you.

[satanasov]

No problem.

It was a joy! If there is something else - I'll bug you about it!

[nikhilve99]

hi i am getting same error
1484724748: New connection from 10.40.145.5 on port 443.
1484724748: |-- mosquitto_auth_unpwd_check(nikhilv)
1484724748: |-- ** checking backend mysql
1484724748: |-- getuser(nikhilv) AUTHENTICATED=0 by none
1484724748: Sending CONNACK to 10.40.145.5 (0, 5)
1484724748: Socket error on client , disconnecting.

kindly help
regards
nikhil