List:Internals« Previous MessageNext Message »
From:sca Date:February 19 2010 1:21pm
Subject:contribution: pluggable authentication
View as plain text  
Hi

This is a patch for WL#1054.
Done by RJ Silk and me.

Includes server side, client side, examples.

In a separate patch I've attached a small bugfix for mysqltest, without
it change_user.test will fail

Regards,
Sergei

------------------------------------------------------------
revno: 2745
committer: Sergei Golubchik <sergii@stripped>
branch nick: maria-5.2-pa
timestamp: Fri 2010-02-19 09:18:09 +0100
message:
  pluggable auth with plugin examples
added:
  include/mysql/client_plugin.h
  include/mysql/plugin_auth.h
  include/mysql/plugin_auth_common.h
  plugin/auth/
  plugin/auth/Makefile.am
  plugin/auth/auth_socket.c
  plugin/auth/dialog.c
  plugin/auth/plug.in
  sql-common/client_plugin.c
modified:
  .bzrignore
  client/CMakeLists.txt
  client/client_priv.h
  client/mysql.cc
  configure.in
  include/Makefile.am
  include/errmsg.h
  include/my_global.h
  include/my_no_pthread.h
  include/my_sys.h
  include/mysql.h
  include/mysql.h.pp
  include/mysql/plugin.h
  include/mysql_com.h
  include/sql_common.h
  libmysql/CMakeLists.txt
  libmysql/Makefile.shared
  libmysql/client_settings.h
  libmysql/errmsg.c
  libmysql/libmysql.c
  libmysqld/Makefile.am
  libmysqld/embedded_priv.h
  libmysqld/lib_sql.cc
  libmysqld/libmysqld.c
  mysql-test/r/change_user.result
  mysql-test/r/grant.result
  mysql-test/r/grant2.result
  mysql-test/r/ps.result
  mysql-test/r/sp_notembedded.result
  mysql-test/r/system_mysql_db.result
  mysql-test/suite/rpl/r/rpl_ignore_table.result
  mysql-test/suite/rpl/r/rpl_stm_000001.result
  mysql-test/t/change_user.test
  scripts/mysql_system_tables.sql
  scripts/mysql_system_tables_data.sql
  scripts/mysql_system_tables_fix.sql
  server-tools/instance-manager/Makefile.am
  server-tools/instance-manager/user_map.cc
  sql-common/client.c
  sql/CMakeLists.txt
  sql/Makefile.am
  sql/client_settings.h
  sql/ha_ndbcluster.cc
  sql/ha_ndbcluster_binlog.cc
  sql/lex.h
  sql/mysql_priv.h
  sql/mysqld.cc
  sql/password.c
  sql/protocol.cc
  sql/protocol.h
  sql/sql_acl.cc
  sql/sql_acl.h
  sql/sql_builtin.cc.in
  sql/sql_class.cc
  sql/sql_class.h
  sql/sql_connect.cc
  sql/sql_insert.cc
  sql/sql_lex.h
  sql/sql_parse.cc
  sql/sql_plugin.cc
  sql/sql_yacc.yy
  sql/structs.h
  sql/table.cc
  tests/mysql_client_test.c
diff:
=3D=3D=3D modified file '.bzrignore'
--- .bzrignore	2010-02-01 06:14:12 +0000
+++ .bzrignore	2010-02-19 08:18:09 +0000
@@ -1931,3 +1931,5 @@
 client/rpl_filter.h
 client/sql_list.cc
 client/sql_list.h
+libmysqld/client_plugin.c
+sql/client_plugin.c

=3D=3D=3D modified file 'client/CMakeLists.txt'
--- client/CMakeLists.txt	2009-09-04 05:54:16 +0000
+++ client/CMakeLists.txt	2010-02-19 08:18:09 +0000
@@ -83,3 +83,5 @@
   MYSQL_EMBED_MANIFEST("echo" "asInvoker")
 ENDIF(EMBED_MANIFESTS)
=20
+ADD_DEFINITIONS(-DHAVE_DLOPEN)
+

=3D=3D=3D modified file 'client/client_priv.h'
--- client/client_priv.h	2009-10-16 14:04:12 +0000
+++ client/client_priv.h	2010-02-19 08:18:09 +0000
@@ -82,5 +82,7 @@
   OPT_WRITE_BINLOG, OPT_DUMP_DATE,
   OPT_ABORT_SOURCE_ON_ERROR,
   OPT_REWRITE_DB,
-  OPT_MAX_CLIENT_OPTION
+  OPT_PLUGIN_DIR,
+  OPT_DEFAULT_PLUGIN,
+  OPT_MAX_CLIENT_OPTION /* should be always the last */
 };

=3D=3D=3D modified file 'client/mysql.cc'
--- client/mysql.cc	2010-01-15 15:27:55 +0000
+++ client/mysql.cc	2010-02-19 08:18:09 +0000
@@ -164,6 +164,7 @@
 static STATUS status;
 static ulong select_limit,max_join_size,opt_connect_timeout=3D0;
 static char mysql_charsets_dir[FN_REFLEN+1];
+static char *opt_plugin_dir=3D 0, *opt_default_auth;
 static const char *xmlmeta[] =3D {
   "&", "&amp;",
   "<", "&lt;",
@@ -1539,6 +1540,13 @@
   {"show-warnings", OPT_SHOW_WARNINGS, "Show warnings after every statemen=
t.",
     (uchar**) &show_warnings, (uchar**) &show_warnings, 0, GET_BOOL, NO_AR=
G,=20
     0, 0, 0, 0, 0, 0},
+  {"plugin_dir", OPT_PLUGIN_DIR, "Directory for client-side plugins.",
+   (uchar**) &opt_plugin_dir, (uchar**) &opt_plugin_dir, 0,
+   GET_STR, REQUIRED_ARG, 0, 0, 0, 0, 0, 0},
+  {"default_auth", OPT_PLUGIN_DIR,
+    "Default authentication client-side plugin to use.",
+   (uchar**) &opt_default_auth, (uchar**) &opt_default_auth, 0,
+   GET_STR, REQUIRED_ARG, 0, 0, 0, 0, 0, 0},
   { 0, 0, 0, 0, 0, 0, GET_NO_ARG, NO_ARG, 0, 0, 0, 0, 0, 0}
 };
=20
@@ -4227,6 +4235,54 @@
   return valid_arg ? start : NullS;
 }
=20
+/**
+  An example of mysql_authentication_dialog_ask callback.
+
+  The C function with the name "mysql_authentication_dialog_ask", if exist=
s,
+  will be used by the "dialog" client authentication plugin when user
+  input is needed. This function should be of mysql_authentication_dialog_=
ask_t
+  type. If the function does not exists, a built-in implementation will be
+  used.
+
+  @param mysql          mysql
+  @param type           type of the input
+                        1 - normal string input
+                        2 - password string
+  @param prompt         prompt
+  @param buf            a buffer to store the use input
+  @param buf_len        the length of the buffer
+
+  @retval               a pointer to the user input string.
+                        It may be equal to 'buf' or to 'mysql->password'.
+                        In all other cases it is assumed to be an allocated
+                        string, and the "dialog" plugin will free() it.
+*/
+extern "C" char *mysql_authentication_dialog_ask(MYSQL *mysql, int type,
+                                                 const char *prompt,
+                                                 char *buf, int buf_len)
+{
+  int ch;
+  char *s=3Dbuf, *end=3Dbuf+buf_len-1;
+
+  fputs("[mysql] ", stdout);
+  fputs(prompt, stdout);
+  fputs(" ", stdout);
+
+  if (type =3D=3D 2) /* password */
+  {
+    s=3D get_tty_password("");
+    strncpy(buf, s, buf_len);
+    my_free(s, MYF(0));
+  }
+  else
+  {
+    for (ch=3D fgetc(stdin); s < end && ch !=3D '\n' && ch !=3D EOF;
ch=3D=
 fgetc(stdin))
+      *s++=3D ch;
+    *s=3D0;
+  }
+
+  return buf;
+}
=20
 static int
 sql_real_connect(char *host,char *database,char *user,char *password,
@@ -4273,6 +4329,13 @@
   }
   if (default_charset_used)
     mysql_options(&mysql, MYSQL_SET_CHARSET_NAME, default_charset);
+
+  if (opt_plugin_dir && *opt_plugin_dir)
+    mysql_options(&mysql, MYSQL_PLUGIN_DIR, opt_plugin_dir);
+
+  if (opt_default_auth && *opt_default_auth)
+    mysql_options(&mysql, MYSQL_DEFAULT_AUTH, opt_default_auth);
+
   if (!mysql_real_connect(&mysql, host, user, password,
 			  database, opt_mysql_port, opt_mysql_unix_port,
 			  connect_flag | CLIENT_MULTI_STATEMENTS))

=3D=3D=3D modified file 'configure.in'
--- configure.in	2010-02-12 08:47:31 +0000
+++ configure.in	2010-02-19 08:18:09 +0000
@@ -1597,9 +1597,8 @@
     ;;
=20
   *)
-    # Check for dlopen, needed for user definable functions
+    # Check for dlopen, needed for user definable functions and plugins
     # This must be checked after threads on AIX
-    # We only need this for mysqld, not for the clients.
=20
     my_save_LIBS=3D"$LIBS"
     LIBS=3D""

=3D=3D=3D modified file 'include/Makefile.am'
--- include/Makefile.am	2009-04-25 10:05:32 +0000
+++ include/Makefile.am	2010-02-19 08:18:09 +0000
@@ -21,8 +21,9 @@
 HEADERS_ABI =3D		mysql.h mysql_com.h mysql_time.h \
 			my_list.h my_alloc.h typelib.h mysql/plugin.h
 pkginclude_HEADERS =3D	$(HEADERS_ABI) my_dbug.h m_string.h my_sys.h \
-			my_xml.h mysql_embed.h \
-		  	my_pthread.h my_no_pthread.h \
+			my_xml.h mysql_embed.h mysql/plugin_auth.h \
+		  	my_pthread.h my_no_pthread.h mysql/client_plugin.h \
+			mysql/plugin_auth_common.h \
 			decimal.h errmsg.h my_global.h my_net.h \
 			my_getopt.h sslopt-longopts.h my_dir.h \
 			sslopt-vars.h sslopt-case.h sql_common.h keycache.h \

=3D=3D=3D modified file 'include/errmsg.h'
--- include/errmsg.h	2008-05-20 16:36:26 +0000
+++ include/errmsg.h	2010-02-19 08:18:09 +0000
@@ -97,6 +97,7 @@
 #define CR_SERVER_LOST_EXTENDED			2055
 #define CR_STMT_CLOSED				2056
 #define CR_NEW_STMT_METADATA                    2057
-#define CR_ERROR_LAST  /*Copy last error nr:*/  2057
+#define CR_AUTH_PLUGIN_CANNOT_LOAD              2058
+#define CR_ERROR_LAST  /*Copy last error nr:*/  2058
 /* Add error numbers before CR_ERROR_LAST and change it accordingly. */
=20

=3D=3D=3D modified file 'include/my_global.h'
--- include/my_global.h	2009-12-03 11:19:05 +0000
+++ include/my_global.h	2010-02-19 08:18:09 +0000
@@ -578,6 +578,14 @@
 #define IF_VALGRIND(A,B) (B)
 #endif
=20
+#ifdef _WIN32
+#define SO_EXT ".dll"
+#elif defined(__APPLE__)
+#define SO_EXT ".dylib"
+#else
+#define SO_EXT ".so"
+#endif
+
 /*=20
    Suppress uninitialized variable warning without generating code.
=20

=3D=3D=3D modified file 'include/my_no_pthread.h'
--- include/my_no_pthread.h	2006-12-23 19:20:40 +0000
+++ include/my_no_pthread.h	2010-02-19 08:18:09 +0000
@@ -46,5 +46,6 @@
 #define rw_wrlock(A)
 #define rw_unlock(A)
 #define rwlock_destroy(A)
+#define safe_mutex_assert_owner(mp)
=20
 #endif

=3D=3D=3D modified file 'include/my_sys.h'
--- include/my_sys.h	2010-01-06 19:20:16 +0000
+++ include/my_sys.h	2010-02-19 08:18:09 +0000
@@ -210,7 +210,7 @@
 #define my_alloca(SZ) alloca((size_t) (SZ))
 #define my_afree(PTR) {}
 #else
-#define my_alloca(SZ) my_malloc(SZ,MYF(0))
+#define my_alloca(SZ) my_malloc(SZ,MYF(MY_FAE))
 #define my_afree(PTR) my_free(PTR,MYF(MY_WME))
 #endif /* HAVE_ALLOCA */
=20
@@ -869,6 +869,10 @@
 extern void reset_root_defaults(MEM_ROOT *mem_root, size_t block_size,
                                 size_t prealloc_size);
 extern char *strdup_root(MEM_ROOT *root,const char *str);
+static inline char *safe_strdup_root(MEM_ROOT *root, const char *str)
+{
+  return str ? strdup_root(root, str) : 0;
+}
 extern char *strmake_root(MEM_ROOT *root,const char *str,size_t len);
 extern void *memdup_root(MEM_ROOT *root,const void *str, size_t len);
 extern int get_defaults_options(int argc, char **argv,

=3D=3D=3D modified file 'include/mysql.h'
--- include/mysql.h	2010-02-01 06:14:12 +0000
+++ include/mysql.h	2010-02-19 08:18:09 +0000
@@ -167,9 +167,15 @@
   MYSQL_OPT_USE_REMOTE_CONNECTION, MYSQL_OPT_USE_EMBEDDED_CONNECTION,
   MYSQL_OPT_GUESS_CONNECTION, MYSQL_SET_CLIENT_IP, MYSQL_SECURE_AUTH,
   MYSQL_REPORT_DATA_TRUNCATION, MYSQL_OPT_RECONNECT,
-  MYSQL_OPT_SSL_VERIFY_SERVER_CERT
+  MYSQL_OPT_SSL_VERIFY_SERVER_CERT, MYSQL_PLUGIN_DIR, MYSQL_DEFAULT_AUTH
 };
=20
+/**
+  @todo remove the "extension", move st_mysql_options completely
+  out of mysql.h
+*/
+struct st_mysql_options_extention;=20
+
 struct st_mysql_options {
   unsigned int connect_timeout, read_timeout, write_timeout;
   unsigned int port, protocol;
@@ -217,7 +223,7 @@
   void (*local_infile_end)(void *);
   int (*local_infile_error)(void *, char *, unsigned int);
   void *local_infile_userdata;
-  void *extension;
+  struct st_mysql_options_extention *extension;
 };
=20
 enum mysql_status=20
@@ -752,38 +758,6 @@
 };
=20
=20
-typedef struct st_mysql_methods
-{
-  my_bool (*read_query_result)(MYSQL *mysql);
-  my_bool (*advanced_command)(MYSQL *mysql,
-			      enum enum_server_command command,
-			      const unsigned char *header,
-			      unsigned long header_length,
-			      const unsigned char *arg,
-			      unsigned long arg_length,
-			      my_bool skip_check,
-                              MYSQL_STMT *stmt);
-  MYSQL_DATA *(*read_rows)(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
-			   unsigned int fields);
-  MYSQL_RES * (*use_result)(MYSQL *mysql);
-  void (*fetch_lengths)(unsigned long *to,=20
-			MYSQL_ROW column, unsigned int field_count);
-  void (*flush_use_result)(MYSQL *mysql);
-#if !defined(MYSQL_SERVER) || defined(EMBEDDED_LIBRARY)
-  MYSQL_FIELD * (*list_fields)(MYSQL *mysql);
-  my_bool (*read_prepare_result)(MYSQL *mysql, MYSQL_STMT *stmt);
-  int (*stmt_execute)(MYSQL_STMT *stmt);
-  int (*read_binary_rows)(MYSQL_STMT *stmt);
-  int (*unbuffered_fetch)(MYSQL *mysql, char **row);
-  void (*free_embedded_thd)(MYSQL *mysql);
-  const char *(*read_statistics)(MYSQL *mysql);
-  my_bool (*next_result)(MYSQL *mysql);
-  int (*read_change_user_result)(MYSQL *mysql, char *buff, const char *pas=
swd);
-  int (*read_rows_from_cursor)(MYSQL_STMT *stmt);
-#endif
-} MYSQL_METHODS;
-
-
 MYSQL_STMT * STDCALL mysql_stmt_init(MYSQL *mysql);
 int STDCALL mysql_stmt_prepare(MYSQL_STMT *stmt, const char *query,
                                unsigned long length);
@@ -846,18 +820,6 @@
 #endif
 #define HAVE_MYSQL_REAL_CONNECT
=20
-/*
-  The following functions are mainly exported because of mysqlbinlog;
-  They are not for general usage
-*/
-
-#define simple_command(mysql, command, arg, length, skip_check) \
-  (*(mysql)->methods->advanced_command)(mysql, command, 0,  \
-                                        0, arg, length, skip_check, NULL)
-#define stmt_command(mysql, command, arg, length, stmt) \
-  (*(mysql)->methods->advanced_command)(mysql, command, 0,  \
-                                        0, arg, length, 1, stmt)
-
 #ifdef __NETWARE__
 #pragma pack(pop)		/* restore alignment */
 #endif

=3D=3D=3D modified file 'include/mysql.h.pp'
--- include/mysql.h.pp	2010-02-01 06:14:12 +0000
+++ include/mysql.h.pp	2010-02-19 08:18:09 +0000
@@ -128,13 +128,13 @@
 void hash_password(unsigned long *to, const char *password, unsigned int p=
assword_len);
 void make_scrambled_password_323(char *to, const char *password);
 void scramble_323(char *to, const char *message, const char *password);
-my_bool check_scramble_323(const char *, const char *message,
+my_bool check_scramble_323(const unsigned char *reply, const char *message,
                            unsigned long *salt);
 void get_salt_from_password_323(unsigned long *res, const char *password);
 void make_password_from_salt_323(char *to, const unsigned long *salt);
 void make_scrambled_password(char *to, const char *password);
 void scramble(char *to, const char *message, const char *password);
-my_bool check_scramble(const char *reply, const char *message,
+my_bool check_scramble(const unsigned char *reply, const char *message,
                        const unsigned char *hash_stage2);
 void get_salt_from_password(unsigned char *res, const char *password);
 void make_password_from_salt(char *to, const unsigned char *hash_stage2);
@@ -258,8 +258,9 @@
   MYSQL_OPT_USE_REMOTE_CONNECTION, MYSQL_OPT_USE_EMBEDDED_CONNECTION,
   MYSQL_OPT_GUESS_CONNECTION, MYSQL_SET_CLIENT_IP, MYSQL_SECURE_AUTH,
   MYSQL_REPORT_DATA_TRUNCATION, MYSQL_OPT_RECONNECT,
-  MYSQL_OPT_SSL_VERIFY_SERVER_CERT
+  MYSQL_OPT_SSL_VERIFY_SERVER_CERT, MYSQL_PLUGIN_DIR, MYSQL_DEFAULT_AUTH
 };
+struct st_mysql_options_extention;
 struct st_mysql_options {
   unsigned int connect_timeout, read_timeout, write_timeout;
   unsigned int port, protocol;
@@ -289,7 +290,7 @@
   void (*local_infile_end)(void *);
   int (*local_infile_error)(void *, char *, unsigned int);
   void *local_infile_userdata;
-  void *extension;
+  struct st_mysql_options_extention *extension;
 };
 enum mysql_status
 {
@@ -601,34 +602,6 @@
   STMT_ATTR_CURSOR_TYPE,
   STMT_ATTR_PREFETCH_ROWS
 };
-typedef struct st_mysql_methods
-{
-  my_bool (*read_query_result)(MYSQL *mysql);
-  my_bool (*advanced_command)(MYSQL *mysql,
-         enum enum_server_command command,
-         const unsigned char *header,
-         unsigned long header_length,
-         const unsigned char *arg,
-         unsigned long arg_length,
-         my_bool skip_check,
-                              MYSQL_STMT *stmt);
-  MYSQL_DATA *(*read_rows)(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
-      unsigned int fields);
-  MYSQL_RES * (*use_result)(MYSQL *mysql);
-  void (*fetch_lengths)(unsigned long *to,
-   MYSQL_ROW column, unsigned int field_count);
-  void (*flush_use_result)(MYSQL *mysql);
-  MYSQL_FIELD * (*list_fields)(MYSQL *mysql);
-  my_bool (*read_prepare_result)(MYSQL *mysql, MYSQL_STMT *stmt);
-  int (*stmt_execute)(MYSQL_STMT *stmt);
-  int (*read_binary_rows)(MYSQL_STMT *stmt);
-  int (*unbuffered_fetch)(MYSQL *mysql, char **row);
-  void (*free_embedded_thd)(MYSQL *mysql);
-  const char *(*read_statistics)(MYSQL *mysql);
-  my_bool (*next_result)(MYSQL *mysql);
-  int (*read_change_user_result)(MYSQL *mysql, char *buff, const char *pas=
swd);
-  int (*read_rows_from_cursor)(MYSQL_STMT *stmt);
-} MYSQL_METHODS;
 MYSQL_STMT * mysql_stmt_init(MYSQL *mysql);
 int mysql_stmt_prepare(MYSQL_STMT *stmt, const char *query,
                                unsigned long length);

=3D=3D=3D added file 'include/mysql/client_plugin.h'
--- include/mysql/client_plugin.h	1970-01-01 00:00:00 +0000
+++ include/mysql/client_plugin.h	2010-02-19 08:18:09 +0000
@@ -0,0 +1,164 @@
+#ifndef MYSQL_CLIENT_PLUGIN_INCLUDED
+/* Copyright (C) 2010 Monty Program Ab
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  U=
SA */
+
+/**
+  @file
+
+  MySQL Client Plugin API
+
+  This file defines the API for plugins that work on the client side
+*/
+#define MYSQL_CLIENT_PLUGIN_INCLUDED
+
+#include <stdarg.h>
+#include <stdlib.h>
+
+/* known plugin types */
+#define MYSQL_CLIENT_reserved1               0
+#define MYSQL_CLIENT_reserved2               1
+#define MYSQL_CLIENT_AUTHENTICATION_PLUGIN   2
+
+#define MYSQL_CLIENT_AUTHENTICATION_PLUGIN_INTERFACE_VERSION  0x0100
+
+#define MYSQL_CLIENT_MAX_PLUGINS             3
+
+#define mysql_declare_client_plugin(X)          \
+     struct st_mysql_client_plugin_ ## X        \
+        _mysql_client_plugin_declaration_ =3D {   \
+          MYSQL_CLIENT_ ## X ## _PLUGIN,        \
+          MYSQL_CLIENT_ ## X ## _PLUGIN_INTERFACE_VERSION,
+#define mysql_end_client_plugin             }
+
+/* generic plugin header structure */
+#define MYSQL_CLIENT_PLUGIN_HEADER                      \
+  int type;                                             \
+  unsigned int interface_version;                       \
+  const char *name;                                     \
+  const char *author;                                   \
+  const char *desc;                                     \
+  unsigned int version[3];                              \
+  int (*init)(char *, size_t, int, va_list);            \
+  int (*deinit)();
+
+struct st_mysql_client_plugin
+{
+  MYSQL_CLIENT_PLUGIN_HEADER
+};
+
+struct st_mysql;
+
+/******** authentication plugin specific declarations *********/
+#include <mysql/plugin_auth_common.h>
+
+struct st_mysql_client_plugin_AUTHENTICATION
+{
+  MYSQL_CLIENT_PLUGIN_HEADER
+  int (*authenticate_user)(MYSQL_PLUGIN_VIO *vio, struct st_mysql *mysql);
+};
+
+/**
+  type of the mysql_authentication_dialog_ask function
+
+  @param mysql          mysql
+  @param type           type of the input
+                        1 - ordinary string input
+                        2 - password string
+  @param prompt         prompt
+  @param buf            a buffer to store the use input
+  @param buf_len        the length of the buffer
+
+  @retval               a pointer to the user input string.
+                        It may be equal to 'buf' or to 'mysql->password'.
+                        In all other cases it is assumed to be an allocated
+                        string, and the "dialog" plugin will free() it.
+*/
+typedef char *(*mysql_authentication_dialog_ask_t)(struct st_mysql *mysql,
+                      int type, const char *prompt, char *buf, int buf_len=
);
+/******** using plugins ************/
+
+/**
+  loads a plugin and initializes it
+
+  @param mysql  MYSQL structure. only MYSQL_PLUGIN_DIR option value is use=
d,
+                and last_errno/last_error, for error reporting
+  @param name   a name of the plugin to load
+  @param type   type of plugin that should be loaded, -1 to disable type c=
heck
+  @param argc   number of arguments to pass to the plugin initialization
+                function
+  @param ...    arguments for the plugin initialization function
+
+  @retval
+  a pointer to the loaded plugin, or NULL in case of a failure
+*/
+struct st_mysql_client_plugin *
+mysql_load_plugin(struct st_mysql *mysql, const char *name, int type,
+                  int argc, ...);
+
+/**
+  loads a plugin and initializes it, taking va_list as an argument
+
+  This is the same as mysql_load_plugin, but take va_list instead of
+  a list of arguments.
+
+  @param mysql  MYSQL structure. only MYSQL_PLUGIN_DIR option value is use=
d,
+                and last_errno/last_error, for error reporting
+  @param name   a name of the plugin to load
+  @param type   type of plugin that should be loaded, -1 to disable type c=
heck
+  @param argc   number of arguments to pass to the plugin initialization
+                function
+  @param args   arguments for the plugin initialization function
+
+  @retval
+  a pointer to the loaded plugin, or NULL in case of a failure
+*/
+struct st_mysql_client_plugin *
+mysql_load_plugin_v(struct st_mysql *mysql, const char *name, int type,
+                    int argc, va_list args);
+
+/**
+  finds an already loaded plugin by name, or loads it, if necessary
+
+  @param mysql  MYSQL structure. only MYSQL_PLUGIN_DIR option value is use=
d,
+                and last_errno/last_error, for error reporting
+  @param name   a name of the plugin to load
+  @param type   type of plugin that should be loaded
+
+  @retval
+  a pointer to the plugin, or NULL in case of a failure
+*/
+struct st_mysql_client_plugin *
+mysql_client_find_plugin(struct st_mysql *mysql, const char *name, int typ=
e);
+
+/**
+  adds a plugin structure to the list of loaded plugins
+
+  This is useful if an application has the necessary functionality
+  (for example, a special load data handler) statically linked into
+  the application binary. It can use this function to register the plugin
+  directly, avoiding the need to factor it out into a shared object.
+
+  @param mysql  MYSQL structure. It is only used for error reporting
+  @param plugin an st_mysql_client_plugin structure to register
+
+  @retval
+  a pointer to the plugin, or NULL in case of a failure
+*/
+struct st_mysql_client_plugin *
+mysql_client_register_plugin(struct st_mysql *mysql,
+                             struct st_mysql_client_plugin *plugin);
+
+#endif
+

=3D=3D=3D modified file 'include/mysql/plugin.h'
--- include/mysql/plugin.h	2010-01-06 19:20:16 +0000
+++ include/mysql/plugin.h	2010-02-19 08:18:09 +0000
@@ -75,7 +75,10 @@
 #define MYSQL_FTPARSER_PLUGIN        2  /* Full-text parser plugin      */
 #define MYSQL_DAEMON_PLUGIN          3  /* The daemon/raw plugin type */
 #define MYSQL_INFORMATION_SCHEMA_PLUGIN  4  /* The I_S plugin type */
-#define MYSQL_MAX_PLUGIN_TYPE_NUM    5  /* The number of plugin types   */
+#define MYSQL_AUDIT_PLUGIN           5  /* The Audit plugin type        */
+#define MYSQL_REPLICATION_PLUGIN     6	/* The replication plugin type */
+#define MYSQL_AUTHENTICATION_PLUGIN  7  /* The authentication plugin type =
*/
+#define MYSQL_MAX_PLUGIN_TYPE_NUM    8  /* The number of plugin types   */
=20
 /* We use the following strings to define licenses for plugins */
 #define PLUGIN_LICENSE_PROPRIETARY 0

=3D=3D=3D added file 'include/mysql/plugin_auth.h'
--- include/mysql/plugin_auth.h	1970-01-01 00:00:00 +0000
+++ include/mysql/plugin_auth.h	2010-02-19 08:18:09 +0000
@@ -0,0 +1,83 @@
+#ifndef MYSQL_PLUGIN_AUTH_INCLUDED
+/* Copyright (C) 2010 Monty Program Ab
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  U=
SA */
+
+/**
+  @file
+
+  Authentication Plugin API.
+
+  This file defines the API for server authentication plugins.
+*/
+
+#define MYSQL_PLUGIN_AUTH_INCLUDED
+
+#include <mysql/plugin.h>
+
+#define MYSQL_AUTHENTICATION_INTERFACE_VERSION 0x0100
+
+#include <mysql/plugin_auth_common.h>
+
+/**
+  Provides server plugin access to authentication information
+*/
+typedef struct st_mysql_server_auth_info
+{
+  /**
+    User name as sent by the client and shown in USER().
+    NULL if the client packet with the user name was not received yet.
+  */
+  const char *user_name;
+  /**
+    A corresponding column value from the mysql.user table for the
+    matching account name
+  */
+  const char *auth_string;
+
+  /**
+    Matching account name as found in the mysql.user table.
+    A plugin can override it with another name that will be
+    used by MySQL for authorization, and shown in CURRENT_USER()
+  */
+  char authenticated_as[MYSQL_USERNAME_LENGTH+1];=20
+  /**
+    This only affects the "Authentication failed. Password used: %s"
+    error message. If set, %s will be YES, otherwise - NO.
+    Set it as appropriate or ignore at will.
+  */
+  int  password_used;
+} MYSQL_SERVER_AUTH_INFO;
+
+/**
+  Server authentication plugin descriptor
+*/
+struct st_mysql_auth
+{
+  int interface_version;                        /**< version plugin uses */
+  /**
+    A plugin that a client must use for authentication with this server
+    plugin. Can be NULL to mean "any plugin".
+  */
+  const char *client_auth_plugin;
+  /**
+    Function provided by the plugin which should perform authentication (u=
sing
+    the vio functions if necessary) and return 0 if successful. The plugin=
 can
+    also fill the info.authenticated_as field if a different username shou=
ld be
+    used for authorization.
+  */
+  int (*authenticate_user)(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *=
info);
+};
+#endif
+

=3D=3D=3D added file 'include/mysql/plugin_auth_common.h'
--- include/mysql/plugin_auth_common.h	1970-01-01 00:00:00 +0000
+++ include/mysql/plugin_auth_common.h	2010-02-19 08:18:09 +0000
@@ -0,0 +1,105 @@
+#ifndef MYSQL_PLUGIN_AUTH_COMMON_INCLUDED
+/* Copyright (C) 2010 Monty Program Ab
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  U=
SA */
+
+/**
+  @file
+
+  This file defines constants and data structures that are the same for
+  both client- and server-side authentication plugins.
+*/
+#define MYSQL_PLUGIN_AUTH_COMMON_INCLUDED
+
+/** the max allowed length for a user name */
+#define MYSQL_USERNAME_LENGTH 48
+
+/**
+  return values of the plugin authenticate_user() method.
+*/
+
+/**
+  Authentication failed. Additionally, all other CR_xxx values
+  (libmysql error code) can be used too.
+
+  The client plugin may set the error code and the error message directly
+  in the MYSQL structure and return CR_ERROR. If a CR_xxx specific error
+  code was returned, an error message in the MYSQL structure will be
+  overwritten. If CR_ERROR is returned without setting the error in MYSQL,
+  CR_UNKNOWN_ERROR will be user.
+*/
+#define CR_ERROR 0
+/**
+  Authentication (client part) was successful. It does not mean that the
+  authentication as a whole was successful, usually it only means
+  that the client was able to send the user name and the password to the
+  server. If CR_OK is returned, the libmysql reads the next packet expecti=
ng
+  it to be one of OK, ERROR, or CHANGE_PLUGIN packets.
+*/
+#define CR_OK -1
+/**
+  Authentication was successful.
+  It means that the client has done its part successfully and also that
+  a plugin has read the last packet (one of OK, ERROR, CHANGE_PLUGIN).
+  In this case, libmysql will not read a packet from the server,
+  but it will use the data at mysql->net.read_pos.
+
+  A plugin may return this value if the number of roundtrips in the
+  authentication protocol is not known in advance, and the client plugin
+  needs to read one packet more to determine if the authentication is fini=
shed
+  or not.
+*/
+#define CR_OK_HANDSHAKE_COMPLETE -2
+
+typedef struct st_plugin_vio_info
+{
+  enum { MYSQL_VIO_INVALID, MYSQL_VIO_TCP, MYSQL_VIO_SOCKET,
+         MYSQL_VIO_PIPE, MYSQL_VIO_MEMORY } protocol;
+  int socket;     /**< it's set, if the protocol is SOCKET or TCP */
+#ifdef _WIN32
+  HANDLE handle;  /**< it's set, if the protocol is PIPE or MEMORY */
+#endif
+} MYSQL_PLUGIN_VIO_INFO;
+
+/**
+  Provides plugin access to communication channel
+*/
+typedef struct st_plugin_vio
+{
+  /**
+    Plugin provides a pointer reference and this function sets it to the
+    contents of any incoming packet. Returns the packet length, or -1 if
+    the plugin should terminate.
+  */
+  int (*read_packet)(struct st_plugin_vio *vio,=20
+                     unsigned char **buf);
+ =20
+  /**
+    Plugin provides a buffer with data and the length and this
+    function sends it as a packet. Returns 0 on success, 1 on failure.
+  */
+  int (*write_packet)(struct st_plugin_vio *vio,=20
+                      const unsigned char *packet,=20
+                      int packet_len);
+
+  /**
+    Fills in a st_plugin_vio_info structure, providing the information
+    about the connection.
+  */
+  void (*info)(struct st_plugin_vio *vio, struct st_plugin_vio_info *info);
+
+} MYSQL_PLUGIN_VIO;
+
+#endif
+

=3D=3D=3D modified file 'include/mysql_com.h'
--- include/mysql_com.h	2009-11-12 04:31:28 +0000
+++ include/mysql_com.h	2010-02-19 08:18:09 +0000
@@ -152,9 +152,17 @@
 #define CLIENT_MULTI_STATEMENTS (1UL << 16) /* Enable/disable multi-stmt s=
upport */
 #define CLIENT_MULTI_RESULTS    (1UL << 17) /* Enable/disable multi-result=
s */
=20
+#define CLIENT_PLUGIN_AUTH  (1UL << 19) /* Client supports plugin authenti=
cation */
+
 #define CLIENT_SSL_VERIFY_SERVER_CERT (1UL << 30)
 #define CLIENT_REMEMBER_OPTIONS (1UL << 31)
=20
+#ifdef HAVE_COMPRESS
+#define CAN_CLIENT_COMPRESS CLIENT_COMPRESS
+#else
+#define CAN_CLIENT_COMPRESS 0
+#endif
+
 /* Gather all possible capabilites (flags) supported by the server */
 #define CLIENT_ALL_FLAGS  (CLIENT_LONG_PASSWORD | \
                            CLIENT_FOUND_ROWS | \
@@ -175,7 +183,8 @@
                            CLIENT_MULTI_STATEMENTS | \
                            CLIENT_MULTI_RESULTS | \
                            CLIENT_SSL_VERIFY_SERVER_CERT | \
-                           CLIENT_REMEMBER_OPTIONS)
+                           CLIENT_REMEMBER_OPTIONS | \
+                           CLIENT_PLUGIN_AUTH)
=20
 /*
   Switch off the flags that are optional and depending on build flags
@@ -488,14 +497,14 @@
 void hash_password(unsigned long *to, const char *password, unsigned int p=
assword_len);
 void make_scrambled_password_323(char *to, const char *password);
 void scramble_323(char *to, const char *message, const char *password);
-my_bool check_scramble_323(const char *, const char *message,
+my_bool check_scramble_323(const unsigned char *reply, const char *message,
                            unsigned long *salt);
 void get_salt_from_password_323(unsigned long *res, const char *password);
 void make_password_from_salt_323(char *to, const unsigned long *salt);
=20
 void make_scrambled_password(char *to, const char *password);
 void scramble(char *to, const char *message, const char *password);
-my_bool check_scramble(const char *reply, const char *message,
+my_bool check_scramble(const unsigned char *reply, const char *message,
                        const unsigned char *hash_stage2);
 void get_salt_from_password(unsigned char *res, const char *password);
 void make_password_from_salt(char *to, const unsigned char *hash_stage2);

=3D=3D=3D modified file 'include/sql_common.h'
--- include/sql_common.h	2008-02-27 09:00:59 +0000
+++ include/sql_common.h	2010-02-19 08:18:09 +0000
@@ -1,3 +1,4 @@
+#ifndef SQL_COMMON_INCLUDED
 /* Copyright (C) 2003-2004, 2006 MySQL AB
   =20
    This program is free software; you can redistribute it and/or modify
@@ -13,14 +14,60 @@
    along with this program; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  U=
SA */
=20
+#define SQL_COMMON_INCLUDED
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#include <mysql.h>
=20
 extern const char	*unknown_sqlstate;
 extern const char	*cant_connect_sqlstate;
 extern const char	*not_error_sqlstate;
=20
-#ifdef	__cplusplus
-extern "C" {
+struct st_mysql_options_extention {
+  char *plugin_dir;
+  char *default_auth;
+};
+
+typedef struct st_mysql_methods
+{
+  my_bool (*read_query_result)(MYSQL *mysql);
+  my_bool (*advanced_command)(MYSQL *mysql,
+			      enum enum_server_command command,
+			      const unsigned char *header,
+			      unsigned long header_length,
+			      const unsigned char *arg,
+			      unsigned long arg_length,
+			      my_bool skip_check,
+                              MYSQL_STMT *stmt);
+  MYSQL_DATA *(*read_rows)(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
+			   unsigned int fields);
+  MYSQL_RES * (*use_result)(MYSQL *mysql);
+  void (*fetch_lengths)(unsigned long *to,=20
+			MYSQL_ROW column, unsigned int field_count);
+  void (*flush_use_result)(MYSQL *mysql);
+  int (*read_change_user_result)(MYSQL *mysql);
+#if !defined(MYSQL_SERVER) || defined(EMBEDDED_LIBRARY)
+  MYSQL_FIELD * (*list_fields)(MYSQL *mysql);
+  my_bool (*read_prepare_result)(MYSQL *mysql, MYSQL_STMT *stmt);
+  int (*stmt_execute)(MYSQL_STMT *stmt);
+  int (*read_binary_rows)(MYSQL_STMT *stmt);
+  int (*unbuffered_fetch)(MYSQL *mysql, char **row);
+  void (*free_embedded_thd)(MYSQL *mysql);
+  const char *(*read_statistics)(MYSQL *mysql);
+  my_bool (*next_result)(MYSQL *mysql);
+  int (*read_rows_from_cursor)(MYSQL_STMT *stmt);
 #endif
+} MYSQL_METHODS;
+
+#define simple_command(mysql, command, arg, length, skip_check) \
+  (*(mysql)->methods->advanced_command)(mysql, command, 0,  \
+                                        0, arg, length, skip_check, NULL)
+#define stmt_command(mysql, command, arg, length, stmt) \
+  (*(mysql)->methods->advanced_command)(mysql, command, 0,  \
+                                        0, arg, length, 1, stmt)
=20
 extern CHARSET_INFO *default_client_charset_info;
 MYSQL_FIELD *unpack_fields(MYSQL_DATA *data,MEM_ROOT *alloc,uint fields,
@@ -42,9 +89,22 @@
 void set_stmt_error(MYSQL_STMT *stmt, int errcode, const char *sqlstate,
                     const char *err);
 void set_mysql_error(MYSQL *mysql, int errcode, const char *sqlstate);
+void set_mysql_extended_error(MYSQL *mysql, int errcode, const char *sqlst=
ate,
+                              const char *format, ...);
+
+/* client side of the pluggable authentication */
+struct st_plugin_vio_info;
+void mpvio_info(Vio *vio, struct st_plugin_vio_info *info);
+int run_plugin_auth(MYSQL *mysql, char *data, uint data_len, const char *d=
b);
+int mysql_client_plugin_init();
+void mysql_client_plugin_deinit();
+struct st_mysql_client_plugin;
+extern struct st_mysql_client_plugin *mysql_client_builtins[];
+
 #ifdef	__cplusplus
 }
 #endif
=20
 #define protocol_41(A) ((A)->server_capabilities & CLIENT_PROTOCOL_41)
=20
+#endif

=3D=3D=3D modified file 'libmysql/CMakeLists.txt'
--- libmysql/CMakeLists.txt	2009-09-15 10:46:35 +0000
+++ libmysql/CMakeLists.txt	2010-02-19 08:18:09 +0000
@@ -98,7 +98,7 @@
                      ../strings/strtoll.c ../strings/strtoull.c ../strings=
/strxmov.c ../strings/strxnmov.c=20
                      ../mysys/thr_mutex.c ../mysys/typelib.c ../vio/vio.c =
=2E./vio/viosocket.c=20
                      ../vio/viossl.c ../vio/viosslfactories.c ../strings/x=
ml.c ../mysys/mf_qsort.c
-		     ../mysys/my_getsystime.c ../mysys/my_sync.c ${LIB_SOURCES})
+                     ../mysys/my_getsystime.c ../mysys/my_sync.c ../sql-co=
mmon/client_plugin.c ${LIB_SOURCES})
=20
 # Need to set USE_TLS for building the DLL, since __declspec(thread)
 # approach to thread local storage does not work properly in DLLs.
@@ -125,6 +125,7 @@
 ENDIF(WIN32)
 ADD_DEPENDENCIES(libmysql GenError)
 TARGET_LINK_LIBRARIES(libmysql wsock32)
+ADD_DEFINITIONS(-DHAVE_DLOPEN)
=20
 IF(EMBED_MANIFESTS)
   MYSQL_EMBED_MANIFEST("myTest" "asInvoker")

=3D=3D=3D modified file 'libmysql/Makefile.shared'
--- libmysql/Makefile.shared	2009-09-15 10:46:35 +0000
+++ libmysql/Makefile.shared	2010-02-19 08:18:09 +0000
@@ -23,6 +23,7 @@
 MYSQLDATAdir =3D			$(localstatedir)
 MYSQLSHAREdir =3D			$(pkgdatadir)
 MYSQLBASEdir=3D			$(prefix)
+pkgplugindir =3D			$(pkglibdir)/plugin
 ## We'll use CLIENT_EXTRA_LDFLAGS for threaded and non-threaded
 ## until someone complains that they need separate options.
 LDADD =3D				@CLIENT_EXTRA_LDFLAGS@ $(target)
@@ -71,26 +72,27 @@
 			my_getopt.lo my_gethostbyname.lo my_port.lo \
                         my_rename.lo my_chsize.lo my_sync.lo my_getsystime=
=2Elo
 sqlobjects =3D		net.lo
-sql_cmn_objects =3D	pack.lo client.lo my_time.lo
+sql_cmn_objects =3D	pack.lo client.lo my_time.lo client_plugin.lo
=20
 # Not needed in the minimum library
 mysysobjects2 =3D		my_lib.lo mf_qsort.lo
 mysysobjects =3D		$(mysysobjects1) $(mysysobjects2)
 target_libadd =3D		$(mysysobjects) $(mystringsobjects) $(dbugobjects) \
  $(sql_cmn_objects) $(vio_objects) $(sqlobjects)
-target_ldflags =3D -version-info @SHARED_LIB_VERSION@ @LD_VERSION_SCRIPT@=
=20
+target_ldflags =3D -version-info @SHARED_LIB_VERSION@ @LD_VERSION_SCRIPT@ =
@LIBDL@
 vio_objects=3D vio.lo viosocket.lo viossl.lo viosslfactories.lo
=20
 BUILT_SOURCES		=3D link_sources
=20
 CLEANFILES =3D		$(target_libadd) $(SHLIBOBJS) \
 			$(target) $(BUILT_SOURCES)
-DEFS =3D			-DDEFAULT_CHARSET_HOME=3D"\"$(MYSQLBASEdir)\"" \
-			-DMYSQL_DATADIR=3D"\"$(MYSQLDATAdir)\"" \
+DEFS =3D			-DDEFAULT_CHARSET_HOME=3D'"$(MYSQLBASEdir)"' \
+			-DMYSQL_DATADIR=3D'"$(MYSQLDATAdir)"' \
 			-DDEFAULT_HOME_ENV=3DMYSQL_HOME \
+ 			-DPLUGINDIR=3D'"$(pkgplugindir)"' \
 			-DDEFAULT_GROUP_SUFFIX_ENV=3DMYSQL_GROUP_SUFFIX \
-			-DDEFAULT_SYSCONFDIR=3D"\"$(sysconfdir)\"" \
-			-DSHAREDIR=3D"\"$(MYSQLSHAREdir)\"" $(target_defs)
+			-DDEFAULT_SYSCONFDIR=3D'"$(sysconfdir)"' \
+			-DSHAREDIR=3D'"$(MYSQLSHAREdir)"' $(target_defs)
=20
 if HAVE_YASSL
 yassl_las =3D $(top_builddir)/extra/yassl/src/libyassl.la \

=3D=3D=3D modified file 'libmysql/client_settings.h'
--- libmysql/client_settings.h	2007-09-29 19:31:08 +0000
+++ libmysql/client_settings.h	2010-02-19 08:18:09 +0000
@@ -18,7 +18,8 @@
=20
 #define CLIENT_CAPABILITIES (CLIENT_LONG_PASSWORD | CLIENT_LONG_FLAG |	  \
                              CLIENT_TRANSACTIONS | \
-			     CLIENT_PROTOCOL_41 | CLIENT_SECURE_CONNECTION)
+			     CLIENT_PROTOCOL_41 | CLIENT_SECURE_CONNECTION | \
+                             CLIENT_PLUGIN_AUTH)
=20
 sig_handler my_pipe_sig_handler(int sig);
 void read_user_name(char *name);
@@ -57,7 +58,7 @@
 int cli_read_binary_rows(MYSQL_STMT *stmt);
 int cli_unbuffered_fetch(MYSQL *mysql, char **row);
 const char * cli_read_statistics(MYSQL *mysql);
-int cli_read_change_user_result(MYSQL *mysql, char *buff, const char *pass=
wd);
+int cli_read_change_user_result(MYSQL *mysql);
=20
 #ifdef EMBEDDED_LIBRARY
 int init_embedded_server(int argc, char **argv, char **groups);

=3D=3D=3D modified file 'libmysql/errmsg.c'
--- libmysql/errmsg.c	2008-05-20 16:36:26 +0000
+++ libmysql/errmsg.c	2010-02-19 08:18:09 +0000
@@ -85,6 +85,7 @@
   "Lost connection to MySQL server at '%s', system error: %d",
   "Statement closed indirectly because of a preceeding %s() call",
   "The number of columns in the result set differs from the number of boun=
d buffers. You must reset the statement, rebind the result set columns, and=
 execute the statement again",
+  "Authentication plugin '%s' cannot be loaded: %s",
   ""
 };
=20
@@ -151,6 +152,7 @@
   "Lost connection to MySQL server at '%s', system error: %d",
   "Statement closed indirectly because of a preceeding %s() call",
   "The number of columns in the result set differs from the number of boun=
d buffers. You must reset the statement, rebind the result set columns, and=
 execute the statement again",
+  "Authentication plugin '%s' cannot be loaded: %s",
   ""
 };
=20
@@ -215,6 +217,7 @@
   "Lost connection to MySQL server at '%s', system error: %d",
   "Statement closed indirectly because of a preceeding %s() call",
   "The number of columns in the result set differs from the number of boun=
d buffers. You must reset the statement, rebind the result set columns, and=
 execute the statement again",
+  "Authentication plugin '%s' cannot be loaded: %s",
   ""
 };
 #endif

=3D=3D=3D modified file 'libmysql/libmysql.c'
--- libmysql/libmysql.c	2010-01-15 15:27:55 +0000
+++ libmysql/libmysql.c	2010-02-19 08:18:09 +0000
@@ -126,12 +126,13 @@
     if (my_init())				/* Will init threads */
       return 1;
     init_client_errs();
+    if (mysql_client_plugin_init())
+      return 1;
     if (!mysql_port)
     {
       mysql_port =3D MYSQL_PORT;
 #ifndef MSDOS
       {
-	struct servent *serv_ptr;
 	char	*env;
=20
         /*
@@ -145,6 +146,7 @@
         */
=20
 #if MYSQL_PORT_DEFAULT =3D=3D 0
+	struct servent *serv_ptr;
         if ((serv_ptr =3D getservbyname("mysql", "tcp")))
           mysql_port =3D (uint) ntohs((ushort) serv_ptr->s_port);
 #endif
@@ -198,6 +200,8 @@
   if (!mysql_client_init)
     return;
=20
+  mysql_client_plugin_deinit();
+
 #ifdef EMBEDDED_LIBRARY
   end_embedded_server();
 #endif
@@ -663,44 +667,14 @@
   Change user and database
 **************************************************************************/
=20
-int cli_read_change_user_result(MYSQL *mysql, char *buff, const char *pass=
wd)
-{
-  NET *net=3D &mysql->net;
-  ulong pkt_length;
-
-  pkt_length=3D cli_safe_read(mysql);
- =20
-  if (pkt_length =3D=3D packet_error)
-    return 1;
-
-  if (pkt_length =3D=3D 1 && net->read_pos[0] =3D=3D 254 &&
-      mysql->server_capabilities & CLIENT_SECURE_CONNECTION)
-  {
-    /*
-      By sending this very specific reply server asks us to send scrambled
-      password in old format. The reply contains scramble_323.
-    */
-    scramble_323(buff, mysql->scramble, passwd);
-    if (my_net_write(net, (uchar*) buff, SCRAMBLE_LENGTH_323 + 1) ||
-        net_flush(net))
-    {
-      set_mysql_error(mysql, CR_SERVER_LOST, unknown_sqlstate);
-      return 1;
-    }
-    /* Read what server thinks about out new auth message report */
-    if (cli_safe_read(mysql) =3D=3D packet_error)
-      return 1;
-  }
-  return 0;
-}
-
 my_bool	STDCALL mysql_change_user(MYSQL *mysql, const char *user,
 				  const char *passwd, const char *db)
 {
-  char buff[USERNAME_LENGTH+SCRAMBLED_PASSWORD_CHAR_LENGTH+NAME_LEN+2];
-  char *end=3D buff;
   int rc;
   CHARSET_INFO *saved_cs=3D mysql->charset;
+  char *saved_user=3D mysql->user;
+  char *saved_passwd=3D mysql->passwd;
+  char *saved_db=3D mysql->db;
=20
   DBUG_ENTER("mysql_change_user");
=20
@@ -714,46 +688,11 @@
=20
   /* Use an empty string instead of NULL. */
=20
-  if (!user)
-    user=3D"";
-  if (!passwd)
-    passwd=3D"";
-
-  /* Store user into the buffer */
-  end=3D strmake(end, user, USERNAME_LENGTH) + 1;
-
-  /* write scrambled password according to server capabilities */
-  if (passwd[0])
-  {
-    if (mysql->server_capabilities & CLIENT_SECURE_CONNECTION)
-    {
-      *end++=3D SCRAMBLE_LENGTH;
-      scramble(end, mysql->scramble, passwd);
-      end+=3D SCRAMBLE_LENGTH;
-    }
-    else
-    {
-      scramble_323(end, mysql->scramble, passwd);
-      end+=3D SCRAMBLE_LENGTH_323 + 1;
-    }
-  }
-  else
-    *end++=3D '\0';                               /* empty password */
-  /* Add database if needed */
-  end=3D strmake(end, db ? db : "", NAME_LEN) + 1;
-
-  /* Add character set number. */
-
-  if (mysql->server_capabilities & CLIENT_SECURE_CONNECTION)
-  {
-    int2store(end, (ushort) mysql->charset->number);
-    end+=3D 2;
-  }
-
-  /* Write authentication package */
-  simple_command(mysql,COM_CHANGE_USER, (uchar*) buff, (ulong) (end-buff),=
 1);
-
-  rc=3D (*mysql->methods->read_change_user_result)(mysql, buff, passwd);
+  mysql->user=3D (char*)(user ? user : "");
+  mysql->passwd=3D (char*)(passwd ? passwd : "");
+  mysql->db=3D 0;
+
+  rc=3D run_plugin_auth(mysql, 0, 0, db);
=20
   /*
     The server will close all statements no matter was the attempt
@@ -763,18 +702,21 @@
   if (rc =3D=3D 0)
   {
     /* Free old connect information */
-    my_free(mysql->user,MYF(MY_ALLOW_ZERO_PTR));
-    my_free(mysql->passwd,MYF(MY_ALLOW_ZERO_PTR));
-    my_free(mysql->db,MYF(MY_ALLOW_ZERO_PTR));
+    my_free(saved_user, MYF(MY_ALLOW_ZERO_PTR));
+    my_free(saved_passwd, MYF(MY_ALLOW_ZERO_PTR));
+    my_free(saved_db, MYF(MY_ALLOW_ZERO_PTR));
=20
     /* alloc new connect information */
-    mysql->user=3D  my_strdup(user,MYF(MY_WME));
-    mysql->passwd=3Dmy_strdup(passwd,MYF(MY_WME));
-    mysql->db=3D    db ? my_strdup(db,MYF(MY_WME)) : 0;
+    mysql->user=3D my_strdup(mysql->user, MYF(MY_WME));
+    mysql->passwd=3D my_strdup(mysql->passwd, MYF(MY_WME));
+    mysql->db=3D db ? my_strdup(db, MYF(MY_WME)) : 0;
   }
   else
   {
     mysql->charset=3D saved_cs;
+    mysql->user=3D saved_user;
+    mysql->passwd=3D saved_passwd;
+    mysql->db=3D saved_db;
   }
=20
   DBUG_RETURN(rc);

=3D=3D=3D modified file 'libmysqld/Makefile.am'
--- libmysqld/Makefile.am	2009-12-03 11:19:05 +0000
+++ libmysqld/Makefile.am	2010-02-19 08:18:09 +0000
@@ -41,7 +41,7 @@
 SUBDIRS =3D		. examples
 libmysqld_sources=3D	libmysqld.c lib_sql.cc emb_qcache.cc
 libmysqlsources =3D	errmsg.c get_password.c libmysql.c client.c pack.c \
-                        my_time.c
+                        my_time.c client_plugin.c
=20
 noinst_HEADERS =3D	embedded_priv.h emb_qcache.h
=20

=3D=3D=3D modified file 'libmysqld/embedded_priv.h'
--- libmysqld/embedded_priv.h	2006-12-31 00:32:21 +0000
+++ libmysqld/embedded_priv.h	2010-02-19 08:18:09 +0000
@@ -15,6 +15,8 @@
=20
 /* Prototypes for the embedded version of MySQL */
=20
+#include <sql_common.h>
+
 C_MODE_START
 void lib_connection_phase(NET *net, int phase);
 void init_embedded_mysql(MYSQL *mysql, int client_flag);

=3D=3D=3D modified file 'libmysqld/lib_sql.cc'
--- libmysqld/lib_sql.cc	2009-12-03 11:19:05 +0000
+++ libmysqld/lib_sql.cc	2010-02-19 08:18:09 +0000
@@ -35,7 +35,6 @@
 #include <mysql.h>
 #undef ER
 #include "errmsg.h"
-#include <sql_common.h>
 #include "embedded_priv.h"
=20
 extern unsigned int mysql_server_last_errno;
@@ -413,11 +412,10 @@
   return mysql_store_result(mysql);
 }
=20
-int emb_read_change_user_result(MYSQL *mysql,=20
-				char *buff __attribute__((unused)),
-				const char *passwd __attribute__((unused)))
+int emb_read_change_user_result(MYSQL *mysql)
 {
-  return mysql_errno(mysql);
+  mysql->net.read_pos=3D (uchar*)""; // fake an OK packet
+  return mysql_errno(mysql) ? packet_error : 1;
 }
=20
 MYSQL_METHODS embedded_methods=3D=20
@@ -428,6 +426,7 @@
   emb_store_result,
   emb_fetch_lengths,=20
   emb_flush_use_result,
+  emb_read_change_user_result,
   emb_list_fields,
   emb_read_prepare_result,
   emb_stmt_execute,
@@ -436,7 +435,6 @@
   emb_free_embedded_thd,
   emb_read_statistics,
   emb_read_query_result,
-  emb_read_change_user_result,
   emb_read_rows_from_cursor
 };
=20
@@ -648,14 +646,19 @@
 int check_embedded_connection(MYSQL *mysql, const char *db)
 {
   int result;
+  LEX_STRING db_str =3D { (char*)db, db ? strlen(db) : 0 };
   THD *thd=3D (THD*)mysql->thd;
   thd_init_client_charset(thd, mysql->charset->number);
   thd->update_charset();
   Security_context *sctx=3D thd->security_ctx;
   sctx->host_or_ip=3D sctx->host=3D (char*) my_localhost;
   strmake(sctx->priv_host, (char*) my_localhost,  MAX_HOSTNAME-1);
-  sctx->priv_user=3D sctx->user=3D my_strdup(mysql->user, MYF(0));
-  result=3D check_user(thd, COM_CONNECT, NULL, 0, db, true);
+  strmake(sctx->priv_user, mysql->user,  USERNAME_LENGTH-1);
+  sctx->user=3D my_strdup(mysql->user, MYF(0));
+  sctx->master_access=3D GLOBAL_ACLS;       // Full rights
+  /* Change database if necessary */
+  if (!(result=3D (db && db[0] && mysql_change_db(thd, &db_str,
FALSE))))
+    my_ok(thd);
   net_end_statement(thd);
   emb_read_query_result(mysql);
   return result;
@@ -664,14 +667,15 @@
 #else
 int check_embedded_connection(MYSQL *mysql, const char *db)
 {
+  /*
+    we emulate a COM_CHANGE_USER user here,
+    it's easier than to emulate the complete 3-way handshake
+  */
+  char buf[USERNAME_LENGTH + SCRAMBLE_LENGTH + 1 + 2*NAME_LEN + 2], *end;
+  NET *net=3D &mysql->net;
   THD *thd=3D (THD*)mysql->thd;
   Security_context *sctx=3D thd->security_ctx;
-  int result;
-  char scramble_buff[SCRAMBLE_LENGTH];
-  int passwd_len;
=20
-  thd_init_client_charset(thd, mysql->charset->number);
-  thd->update_charset();
   if (mysql->options.client_ip)
   {
     sctx->host=3D my_strdup(mysql->options.client_ip, MYF(0));
@@ -682,36 +686,44 @@
   sctx->host_or_ip=3D sctx->host;
=20
   if (acl_check_host(sctx->host, sctx->ip))
-  {
-    result=3D ER_HOST_NOT_PRIVILEGED;
     goto err;
-  }
-
-  sctx->user=3D my_strdup(mysql->user, MYF(0));
+
+  /* construct a COM_CHANGE_USER packet */
+  end=3D strmake(buf, mysql->user, USERNAME_LENGTH) + 1;
+
+  memset(thd->scramble, 55, SCRAMBLE_LENGTH); // dummy scramble
+  thd->scramble[SCRAMBLE_LENGTH]=3D 0;
+
   if (mysql->passwd && mysql->passwd[0])
   {
-    memset(thd->scramble, 55, SCRAMBLE_LENGTH); // dummy scramble
-    thd->scramble[SCRAMBLE_LENGTH]=3D 0;
-    scramble(scramble_buff, thd->scramble, mysql->passwd);
-    passwd_len=3D SCRAMBLE_LENGTH;
+    *end++=3D SCRAMBLE_LENGTH;
+    scramble(end, thd->scramble, mysql->passwd);
+    end+=3D SCRAMBLE_LENGTH;
   }
   else
-    passwd_len=3D 0;
-
-  if((result=3D check_user(thd, COM_CONNECT,=20
-			 scramble_buff, passwd_len, db, true)))
-     goto err;
-
+    *end++=3D 0;
+
+  end=3D strmake(end, db ? db : "", NAME_LEN) + 1;
+
+  int2store(end, (ushort) mysql->charset->number);
+  end+=3D 2;
+
+  /* acl_authenticate() takes the data from thd->net->read_pos */
+  thd->net.read_pos=3D (uchar*)buf;
+
+  if (acl_authenticate(thd, 0, end - buf))
+  {
+    x_free(thd->security_ctx->user);
+    goto err;
+  }
   return 0;
+
 err:
-  {
-    NET *net=3D &mysql->net;
-    strmake(net->last_error, thd->main_da.message(), sizeof(net->last_erro=
r)-1);
-    memcpy(net->sqlstate,
-           mysql_errno_to_sqlstate(thd->main_da.sql_errno()),
-           sizeof(net->sqlstate)-1);
-  }
-  return result;
+  strmake(net->last_error, thd->main_da.message(), sizeof(net->last_error)=
-1);
+  memcpy(net->sqlstate,
+         mysql_errno_to_sqlstate(thd->main_da.sql_errno()),
+         sizeof(net->sqlstate)-1);
+  return 1;
 }
 #endif
=20

=3D=3D=3D modified file 'libmysqld/libmysqld.c'
--- libmysqld/libmysqld.c	2009-09-25 11:39:05 +0000
+++ libmysqld/libmysqld.c	2010-02-19 08:18:09 +0000
@@ -18,7 +18,6 @@
 #include <mysql_embed.h>
 #include <mysqld_error.h>
 #include <my_pthread.h>
-#include "embedded_priv.h"
 #include <my_sys.h>
 #include <mysys_err.h>
 #include <m_string.h>
@@ -28,6 +27,7 @@
 #include <sys/stat.h>
 #include <signal.h>
 #include <time.h>
+#include "embedded_priv.h"
 #include "client_settings.h"
 #ifdef	 HAVE_PWD_H
 #include <pwd.h>
@@ -81,9 +81,9 @@
 ** Shut down connection
 **************************************************************************/
=20
-static void end_server(MYSQL *mysql)
+void embedded_end_server(MYSQL *mysql)
 {
-  DBUG_ENTER("end_server");
+  DBUG_ENTER("embedded_end_server");
   free_old_query(mysql);
   DBUG_VOID_RETURN;
 }
@@ -169,7 +169,11 @@
   client_flag|=3DCLIENT_CAPABILITIES;
   if (client_flag & CLIENT_MULTI_STATEMENTS)
     client_flag|=3D CLIENT_MULTI_RESULTS;
-  client_flag&=3D ~CLIENT_COMPRESS;
+  /*
+    no compression in embedded as we don't send any data,
+    and no pluggable auth, as we cannot do a client-server dialog
+  */
+  client_flag&=3D ~(CLIENT_COMPRESS | CLIENT_PLUGIN_AUTH);
   if (db)
     client_flag|=3DCLIENT_CONNECT_WITH_DB;
=20
@@ -216,7 +220,7 @@
   {
     /* Free alloced memory */
     my_bool free_me=3Dmysql->free_me;
-    end_server(mysql);
+    embedded_end_server(mysql);
     mysql->free_me=3D0;
     mysql_close(mysql);
     mysql->free_me=3Dfree_me;

=3D=3D=3D modified file 'mysql-test/r/change_user.result'
--- mysql-test/r/change_user.result	2009-02-12 14:08:56 +0000
+++ mysql-test/r/change_user.result	2010-02-19 08:18:09 +0000
@@ -1,3 +1,36 @@
+grant select on test.* to test_nopw;
+grant select on test.* to test_oldpw identified by password "09301740536db=
389";
+grant select on test.* to test_newpw identified by "newpw";
+select user(), current_user(), database();
+user()	current_user()	database()
+root@localhost	root@localhost	test
+select user(), current_user(), database();
+user()	current_user()	database()
+test_nopw@localhost	test_nopw@%	NULL
+select user(), current_user(), database();
+user()	current_user()	database()
+test_oldpw@localhost	test_oldpw@%	NULL
+select user(), current_user(), database();
+user()	current_user()	database()
+test_newpw@localhost	test_newpw@%	NULL
+select user(), current_user(), database();
+user()	current_user()	database()
+root@localhost	root@localhost	NULL
+select user(), current_user(), database();
+user()	current_user()	database()
+test_nopw@localhost	test_nopw@%	test
+select user(), current_user(), database();
+user()	current_user()	database()
+test_oldpw@localhost	test_oldpw@%	test
+select user(), current_user(), database();
+user()	current_user()	database()
+test_newpw@localhost	test_newpw@%	test
+select user(), current_user(), database();
+user()	current_user()	database()
+root@localhost	root@localhost	test
+drop user test_nopw;
+drop user test_oldpw;
+drop user test_newpw;
 Bug#20023
 SELECT @@session.sql_big_selects;
 @@session.sql_big_selects

=3D=3D=3D modified file 'mysql-test/r/grant.result'
--- mysql-test/r/grant.result	2010-01-29 10:42:31 +0000
+++ mysql-test/r/grant.result	2010-02-19 08:18:09 +0000
@@ -13,8 +13,8 @@
 GRANT SELECT ON `mysqltest`.* TO 'mysqltest_1'@'localhost'
 grant delete on mysqltest.* to mysqltest_1@localhost;
 select * from mysql.user where user=3D"mysqltest_1";
-Host	User	Password	Select_priv	Insert_priv	Update_priv	Delete_priv	Create_=
priv	Drop_priv	Reload_priv	Shutdown_priv	Process_priv	File_priv	Grant_priv	=
References_priv	Index_priv	Alter_priv	Show_db_priv	Super_priv	Create_tmp_ta=
ble_priv	Lock_tables_priv	Execute_priv	Repl_slave_priv	Repl_client_priv	Cre=
ate_view_priv	Show_view_priv	Create_routine_priv	Alter_routine_priv	Create_=
user_priv	Event_priv	Trigger_priv	ssl_type	ssl_cipher	x509_issuer	x509_subj=
ect	max_questions	max_updates	max_connections	max_user_connections
-localhost	mysqltest_1		N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N=
	N	N	SPECIFIED	EDH-RSA-DES-CBC3-SHA			0	0	0	0
+Host	User	Password	Select_priv	Insert_priv	Update_priv	Delete_priv	Create_=
priv	Drop_priv	Reload_priv	Shutdown_priv	Process_priv	File_priv	Grant_priv	=
References_priv	Index_priv	Alter_priv	Show_db_priv	Super_priv	Create_tmp_ta=
ble_priv	Lock_tables_priv	Execute_priv	Repl_slave_priv	Repl_client_priv	Cre=
ate_view_priv	Show_view_priv	Create_routine_priv	Alter_routine_priv	Create_=
user_priv	Event_priv	Trigger_priv	ssl_type	ssl_cipher	x509_issuer	x509_subj=
ect	max_questions	max_updates	max_connections	max_user_connections	plugin	a=
uth_string
+localhost	mysqltest_1		N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N=
	N	N	SPECIFIED	EDH-RSA-DES-CBC3-SHA			0	0	0	0	=09
 show grants for mysqltest_1@localhost;
 Grants for mysqltest_1@localhost
 GRANT USAGE ON *.* TO 'mysqltest_1'@'localhost' REQUIRE CIPHER 'EDH-RSA-DE=
S-CBC3-SHA'
@@ -44,15 +44,15 @@
 flush privileges;
 grant usage on *.* to mysqltest_1@localhost with max_queries_per_hour 10;
 select * from mysql.user where user=3D"mysqltest_1";
-Host	User	Password	Select_priv	Insert_priv	Update_priv	Delete_priv	Create_=
priv	Drop_priv	Reload_priv	Shutdown_priv	Process_priv	File_priv	Grant_priv	=
References_priv	Index_priv	Alter_priv	Show_db_priv	Super_priv	Create_tmp_ta=
ble_priv	Lock_tables_priv	Execute_priv	Repl_slave_priv	Repl_client_priv	Cre=
ate_view_priv	Show_view_priv	Create_routine_priv	Alter_routine_priv	Create_=
user_priv	Event_priv	Trigger_priv	ssl_type	ssl_cipher	x509_issuer	x509_subj=
ect	max_questions	max_updates	max_connections	max_user_connections
-localhost	mysqltest_1		N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N=
	N	N					10	0	0	0
+Host	User	Password	Select_priv	Insert_priv	Update_priv	Delete_priv	Create_=
priv	Drop_priv	Reload_priv	Shutdown_priv	Process_priv	File_priv	Grant_priv	=
References_priv	Index_priv	Alter_priv	Show_db_priv	Super_priv	Create_tmp_ta=
ble_priv	Lock_tables_priv	Execute_priv	Repl_slave_priv	Repl_client_priv	Cre=
ate_view_priv	Show_view_priv	Create_routine_priv	Alter_routine_priv	Create_=
user_priv	Event_priv	Trigger_priv	ssl_type	ssl_cipher	x509_issuer	x509_subj=
ect	max_questions	max_updates	max_connections	max_user_connections	plugin	a=
uth_string
+localhost	mysqltest_1		N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N=
	N	N					10	0	0	0	=09
 show grants for mysqltest_1@localhost;
 Grants for mysqltest_1@localhost
 GRANT USAGE ON *.* TO 'mysqltest_1'@'localhost' WITH MAX_QUERIES_PER_HOUR =
10
 grant usage on *.* to mysqltest_1@localhost with max_updates_per_hour 20 m=
ax_connections_per_hour 30;
 select * from mysql.user where user=3D"mysqltest_1";
-Host	User	Password	Select_priv	Insert_priv	Update_priv	Delete_priv	Create_=
priv	Drop_priv	Reload_priv	Shutdown_priv	Process_priv	File_priv	Grant_priv	=
References_priv	Index_priv	Alter_priv	Show_db_priv	Super_priv	Create_tmp_ta=
ble_priv	Lock_tables_priv	Execute_priv	Repl_slave_priv	Repl_client_priv	Cre=
ate_view_priv	Show_view_priv	Create_routine_priv	Alter_routine_priv	Create_=
user_priv	Event_priv	Trigger_priv	ssl_type	ssl_cipher	x509_issuer	x509_subj=
ect	max_questions	max_updates	max_connections	max_user_connections
-localhost	mysqltest_1		N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N=
	N	N					10	20	30	0
+Host	User	Password	Select_priv	Insert_priv	Update_priv	Delete_priv	Create_=
priv	Drop_priv	Reload_priv	Shutdown_priv	Process_priv	File_priv	Grant_priv	=
References_priv	Index_priv	Alter_priv	Show_db_priv	Super_priv	Create_tmp_ta=
ble_priv	Lock_tables_priv	Execute_priv	Repl_slave_priv	Repl_client_priv	Cre=
ate_view_priv	Show_view_priv	Create_routine_priv	Alter_routine_priv	Create_=
user_priv	Event_priv	Trigger_priv	ssl_type	ssl_cipher	x509_issuer	x509_subj=
ect	max_questions	max_updates	max_connections	max_user_connections	plugin	a=
uth_string
+localhost	mysqltest_1		N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N=
	N	N					10	20	30	0	=09
 show grants for mysqltest_1@localhost;
 Grants for mysqltest_1@localhost
 GRANT USAGE ON *.* TO 'mysqltest_1'@'localhost' WITH MAX_QUERIES_PER_HOUR =
10 MAX_UPDATES_PER_HOUR 20 MAX_CONNECTIONS_PER_HOUR 30
@@ -164,6 +164,7 @@
 Warning	1364	Field 'ssl_cipher' doesn't have a default value
 Warning	1364	Field 'x509_issuer' doesn't have a default value
 Warning	1364	Field 'x509_subject' doesn't have a default value
+Warning	1364	Field 'auth_string' doesn't have a default value
 insert into mysql.db (host, db, user, select_priv) values
 ('localhost', 'a%', 'test11', 'Y'), ('localhost', 'ab%', 'test11', 'Y');
 alter table mysql.db order by db asc;

=3D=3D=3D modified file 'mysql-test/r/grant2.result'
--- mysql-test/r/grant2.result	2009-10-30 05:06:10 +0000
+++ mysql-test/r/grant2.result	2010-02-19 08:18:09 +0000
@@ -287,6 +287,7 @@
 Warning	1364	Field 'ssl_cipher' doesn't have a default value
 Warning	1364	Field 'x509_issuer' doesn't have a default value
 Warning	1364	Field 'x509_subject' doesn't have a default value
+Warning	1364	Field 'auth_string' doesn't have a default value
 create user mysqltest_A@'%';
 rename user mysqltest_B@'%' to mysqltest_C@'%';
 drop user mysqltest_C@'%';
@@ -354,6 +355,7 @@
 Warning	1364	Field 'ssl_cipher' doesn't have a default value
 Warning	1364	Field 'x509_issuer' doesn't have a default value
 Warning	1364	Field 'x509_subject' doesn't have a default value
+Warning	1364	Field 'auth_string' doesn't have a default value
 INSERT INTO mysql.db (host, db, user, select_priv) VALUES
 ('%','TESTDB','mysqltest_1','Y');
 FLUSH PRIVILEGES;

=3D=3D=3D modified file 'mysql-test/r/ps.result'
--- mysql-test/r/ps.result	2009-05-27 15:19:44 +0000
+++ mysql-test/r/ps.result	2010-02-19 08:18:09 +0000
@@ -1194,13 +1194,13 @@
 prepare my_stmt from @aux;
 execute my_stmt;
 COUNT(*)
-39
-execute my_stmt;
-COUNT(*)
-39
-execute my_stmt;
-COUNT(*)
-39
+41
+execute my_stmt;
+COUNT(*)
+41
+execute my_stmt;
+COUNT(*)
+41
 deallocate prepare my_stmt;
 drop procedure if exists p1|
 drop table if exists t1|

=3D=3D=3D modified file 'mysql-test/r/sp_notembedded.result'
--- mysql-test/r/sp_notembedded.result	2010-01-11 13:15:28 +0000
+++ mysql-test/r/sp_notembedded.result	2010-02-19 08:18:09 +0000
@@ -191,6 +191,8 @@
 VALUES('%', 'mysqltest_1', password(''), 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'N'=
, 'N', 'N',
 'N', 'N', 'N', 'Y', 'Y', 'N', 'N', 'Y', 'Y', 'N', 'N', 'N', 'N', 'N', 'Y',=
 'Y', 'N', '',
 '', '', '', '0', '0', '0', '0');
+Warnings:
+Warning	1364	Field 'auth_string' doesn't have a default value
 FLUSH PRIVILEGES;
 CREATE PROCEDURE p1(i INT) BEGIN END;
 DROP PROCEDURE p1;

=3D=3D=3D modified file 'mysql-test/r/system_mysql_db.result'
--- mysql-test/r/system_mysql_db.result	2009-10-27 10:09:36 +0000
+++ mysql-test/r/system_mysql_db.result	2010-02-19 08:18:09 +0000
@@ -118,6 +118,8 @@
   `max_updates` int(11) unsigned NOT NULL DEFAULT '0',
   `max_connections` int(11) unsigned NOT NULL DEFAULT '0',
   `max_user_connections` int(11) unsigned NOT NULL DEFAULT '0',
+  `plugin` char(60) CHARACTER SET latin1 NOT NULL DEFAULT '',
+  `auth_string` text COLLATE utf8_bin NOT NULL,
   PRIMARY KEY (`Host`,`User`)
 ) ENGINE=3DMyISAM DEFAULT CHARSET=3Dutf8 COLLATE=3Dutf8_bin COMMENT=3D'Use=
rs and global privileges'
 show create table func;

=3D=3D=3D modified file 'mysql-test/suite/rpl/r/rpl_ignore_table.result'
--- mysql-test/suite/rpl/r/rpl_ignore_table.result	2008-11-13 19:19:00 +0000
+++ mysql-test/suite/rpl/r/rpl_ignore_table.result	2010-02-19 08:18:09 +0000
@@ -34,6 +34,7 @@
 Warning	1364	Field 'ssl_cipher' doesn't have a default value
 Warning	1364	Field 'x509_issuer' doesn't have a default value
 Warning	1364	Field 'x509_subject' doesn't have a default value
+Warning	1364	Field 'auth_string' doesn't have a default value
 GRANT SELECT ON *.* TO mysqltest6@localhost;
 GRANT INSERT ON *.* TO mysqltest6@localhost;
 GRANT INSERT ON test.* TO mysqltest6@localhost;

=3D=3D=3D modified file 'mysql-test/suite/rpl/r/rpl_stm_000001.result'
--- mysql-test/suite/rpl/r/rpl_stm_000001.result	2009-11-18 14:50:31 +0000
+++ mysql-test/suite/rpl/r/rpl_stm_000001.result	2010-02-19 08:18:09 +0000
@@ -66,6 +66,7 @@
 Warning	1364	Field 'ssl_cipher' doesn't have a default value
 Warning	1364	Field 'x509_issuer' doesn't have a default value
 Warning	1364	Field 'x509_subject' doesn't have a default value
+Warning	1364	Field 'auth_string' doesn't have a default value
 select select_priv,user from mysql.user where user =3D _binary'blafasel2';
 select_priv	user
 N	blafasel2

=3D=3D=3D modified file 'mysql-test/t/change_user.test'
--- mysql-test/t/change_user.test	2009-10-28 07:52:34 +0000
+++ mysql-test/t/change_user.test	2010-02-19 08:18:09 +0000
@@ -1,4 +1,36 @@
 #
+# functional change user tests
+#
+
+grant select on test.* to test_nopw;
+grant select on test.* to test_oldpw identified by password "09301740536db=
389";
+grant select on test.* to test_newpw identified by "newpw";
+
+select user(), current_user(), database();
+
+change_user test_nopw;
+select user(), current_user(), database();
+change_user test_oldpw, oldpw;
+select user(), current_user(), database();
+change_user test_newpw, newpw;
+select user(), current_user(), database();
+change_user root;
+select user(), current_user(), database();
+
+change_user test_nopw,,test;
+select user(), current_user(), database();
+change_user test_oldpw,oldpw,test;
+select user(), current_user(), database();
+change_user test_newpw,newpw,test;
+select user(), current_user(), database();
+change_user root,,test;
+select user(), current_user(), database();
+
+drop user test_nopw;
+drop user test_oldpw;
+drop user test_newpw;
+
+#
 # Bug#20023 mysql_change_user() resets the value of SQL_BIG_SELECTS
 # The replace's are here to fix things for 32 bit systems
 #

=3D=3D=3D added directory 'plugin/auth'
=3D=3D=3D added file 'plugin/auth/Makefile.am'
--- plugin/auth/Makefile.am	1970-01-01 00:00:00 +0000
+++ plugin/auth/Makefile.am	2010-02-19 08:18:09 +0000
@@ -0,0 +1,15 @@
+pkgplugindir=3D$(pkglibdir)/plugin
+
+AM_LDFLAGS=3D-module -rpath $(pkgplugindir)
+AM_CPPFLAGS=3D-DMYSQL_DYNAMIC_PLUGIN -Wno-pointer-sign -I$(top_srcdir)/inc=
lude
+
+pkgplugin_LTLIBRARIES=3D  dialog.la
+dialog_la_SOURCES=3D dialog.c
+
+if HAVE_PEERCRED
+pkgplugin_LTLIBRARIES+=3D auth_socket.la
+auth_socket_la_SOURCES=3D auth_socket.c
+endif
+
+EXTRA_DIST=3D plug.in
+

=3D=3D=3D added file 'plugin/auth/auth_socket.c'
--- plugin/auth/auth_socket.c	1970-01-01 00:00:00 +0000
+++ plugin/auth/auth_socket.c	2010-02-19 08:18:09 +0000
@@ -0,0 +1,93 @@
+/* Copyright (C) 2010 Monty Program Ab
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  U=
SA */
+
+/**
+  @file
+
+  socket_peercred authentication plugin.
+
+  Authentication is successful if the connection is done via a unix socket=
 and
+  the owner of the client process matches the user name that was used when
+  connecting to mysqld.
+*/
+#define _GNU_SOURCE /* for struct ucred */
+
+#include <mysql/plugin_auth.h>
+#include <sys/socket.h>
+#include <pwd.h>
+#include <string.h>
+
+static int socket_auth(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *info)
+{
+  unsigned char *pkt;
+  MYSQL_PLUGIN_VIO_INFO vio_info;
+  struct ucred cred;
+  socklen_t cred_len=3D sizeof(cred);
+  struct passwd pwd_buf, *pwd;
+  char buf[1024];
+
+  /* no user name yet ? read the client handshake packet with the user nam=
e */
+  if (info->user_name =3D=3D 0)
+  {
+    if (vio->read_packet(vio, &pkt) < 0)
+      return CR_ERROR;
+  }
+
+  info->password_used =3D 0;
+
+  vio->info(vio, &vio_info);
+  if (vio_info.protocol !=3D MYSQL_VIO_SOCKET)
+    return CR_ERROR;
+
+  /* get the UID of the client process */
+  if (getsockopt(vio_info.socket, SOL_SOCKET, SO_PEERCRED, &cred, &cred_le=
n))
+    return CR_ERROR;
+
+  if (cred_len !=3D sizeof(cred))
+    return CR_ERROR;
+
+  /* and find the username for this uid */
+  getpwuid_r(cred.uid, &pwd_buf, buf, sizeof(buf), &pwd);
+  if (pwd =3D=3D NULL)
+    return CR_ERROR;
+
+  /* now it's simple as that */
+  return strcmp(pwd->pw_name, info->user_name) ? CR_ERROR : CR_OK;
+}
+
+static struct st_mysql_auth socket_auth_handler=3D
+{
+  MYSQL_AUTHENTICATION_INTERFACE_VERSION,
+  0,
+  socket_auth
+};
+
+mysql_declare_plugin(socket_auth)
+{
+  MYSQL_AUTHENTICATION_PLUGIN,
+  &socket_auth_handler,
+  "socket_peercred",
+  "Sergei Golubchik",
+  "Unix Socket based authentication",
+  PLUGIN_LICENSE_GPL,
+  NULL,
+  NULL,
+  0x0100,
+  NULL,
+  NULL,
+  NULL
+}
+mysql_declare_plugin_end;
+

=3D=3D=3D added file 'plugin/auth/dialog.c'
--- plugin/auth/dialog.c	1970-01-01 00:00:00 +0000
+++ plugin/auth/dialog.c	2010-02-19 08:18:09 +0000
@@ -0,0 +1,293 @@
+/* Copyright (C) 2010 Monty Program Ab
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  U=
SA */
+
+/**
+  @file
+
+  dialog client authentication plugin with examples
+
+  dialog is a general purpose client authentication plugin, it simply
+  asks the user the question, as provided by the server and reports
+  the answer back to the server. No encryption is involved,
+  the answers are sent in clear text.
+
+  Two examples are provided: two_questions server plugin, that asks
+  the password and an "Are you sure?" question with a reply "yes, of cours=
e".
+  It demonstrates the usage of "password" (input is hidden) and "ordinary"
+  (input can be echoed) questions, and how to mark the last question,
+  to avoid an extra roundtrip.
+
+  And three_attempts plugin that gives the user three attempts to enter
+  a correct password. It shows the situation when a number of questions
+  is not known in advance.
+*/
+#define _GNU_SOURCE /* for RTLD_DEFAULT */
+
+#include <mysql/plugin_auth.h>
+#include <mysql/client_plugin.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+/**
+  first byte of the question string is the question "type".
+  It can be a "ordinary" or a "password" question.
+  The last bit set marks a last question in the authentication exchange.
+*/
+#define ORDINARY_QUESTION       "\2"
+#define LAST_QUESTION           "\3"
+#define LAST_PASSWORD           "\4"
+#define PASSWORD_QUESTION       "\5"
+
+/********************* SERVER SIDE ***************************************=
*/
+
+/**
+  dialog demo with two questions, one password and one, the last, ordinary.
+*/
+static int two_questions(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *in=
fo)
+{
+  unsigned char *pkt;
+  int pkt_len;
+
+  /* send a password question */
+  if (vio->write_packet(vio, PASSWORD_QUESTION "Password, please:", 18))
+    return CR_ERROR;
+
+  /* read the answer */
+  if ((pkt_len=3D vio->read_packet(vio, &pkt)) < 0)
+    return CR_ERROR;
+
+  info->password_used =3D 1;
+
+  /* fail if the password is wrong */
+  if (strcmp(pkt, info->auth_string))
+    return CR_ERROR;
+
+  /* send the last, ordinary, question */
+  if (vio->write_packet(vio, LAST_QUESTION "Are you sure ?", 15))
+    return CR_ERROR;
+
+  /* read the answer */
+  if ((pkt_len=3D vio->read_packet(vio, &pkt)) < 0)
+    return CR_ERROR;
+
+  /* check the reply */
+  return strcmp(pkt, "yes, of course") ? CR_ERROR : CR_OK;
+}
+
+static struct st_mysql_auth two_handler=3D
+{
+  MYSQL_AUTHENTICATION_INTERFACE_VERSION,
+  "dialog", /* requires dialog client plugin */
+  two_questions
+};
+
+/* dialog demo where the number of questions is not known in advance */
+static int three_attempts(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *i=
nfo)
+{
+  unsigned char *pkt;
+  int pkt_len, i;
+
+  for (i=3D 0; i < 3; i++)
+  {
+    /* send the prompt */
+    if (vio->write_packet(vio, PASSWORD_QUESTION "Password, please:", 18))
+      return CR_ERROR;
+
+    /* read the password */
+    if ((pkt_len=3D vio->read_packet(vio, &pkt)) < 0)
+      return CR_ERROR;
+
+    info->password_used =3D 1;
+
+    /*
+      finish, if the password is correct.
+      note, that we did not mark the prompt packet as "last"
+    */
+    if (strcmp(pkt, info->auth_string) =3D=3D 0)
+      return CR_OK;
+  }
+
+  return CR_ERROR;
+}
+
+static struct st_mysql_auth three_handler=3D
+{
+  MYSQL_AUTHENTICATION_INTERFACE_VERSION,
+  "dialog", /* requires dialog client plugin */
+  three_attempts=20
+};
+
+mysql_declare_plugin(dialog)
+{
+  MYSQL_AUTHENTICATION_PLUGIN,
+  &two_handler,
+  "two_questions",
+  "Sergei Golubchik",
+  "Dialog plugin demo 1",
+  PLUGIN_LICENSE_GPL,
+  NULL,
+  NULL,
+  0x0100,
+  NULL,
+  NULL,
+  NULL
+},
+{
+  MYSQL_AUTHENTICATION_PLUGIN,
+  &three_handler,
+  "three_attempts",
+  "Sergei Golubchik",
+  "Dialog plugin demo 2",
+  PLUGIN_LICENSE_GPL,
+  NULL,
+  NULL,
+  0x0100,
+  NULL,
+  NULL,
+  NULL
+}
+mysql_declare_plugin_end;
+
+/********************* CLIENT SIDE ***************************************/
+/*
+  This plugin performs a dialog with the user, asking questions and
+  reading answers. Depending on the client it may be desirable to do it
+  using GUI, or console, with or without curses, or read answers
+  from a smardcard, for example.
+
+  To support all this variety, the dialog plugin has a callback function
+  "authentication_dialog_ask". If the client has a function of this name
+  dialog plugin will use it for communication with the user. Otherwise
+  a default gets() based implementation will be used.
+*/
+#include <mysql.h>
+#include <dlfcn.h>
+
+static mysql_authentication_dialog_ask_t ask;
+
+static char *builtin_ask(MYSQL *mysql __attribute__((unused)),
+                         int type __attribute__((unused)),
+                         const char *prompt,
+                         char *buf, int buf_len __attribute__((unused)))
+{
+  fputs(prompt, stdout);
+  fputc(' ', stdout);
+  if (gets(buf) =3D=3D 0)
+    return 0;
+
+  return buf;
+}
+
+/**
+  The main function of the dialog plugin.
+
+  Read the prompt, ask the question, send the reply, repeat until
+  the server is satisfied.
+
+  @note
+   1. this plugin shows how a client authentication plugin
+      may read a MySQL protocol OK packet internally - which is important
+      where a number of packets is not known in advance.
+   2. the first byte of the prompt is special. it is not
+      shown to the user, but signals whether it is the last question
+      (prompt[0] & 1 =3D=3D 1) or not last (prompt[0] & 1 =3D=3D 0),
+      and whether the input is a password (not echoed).
+   3. the prompt is expected to be sent zero-terminated
+*/
+static int perform_dialog(MYSQL_PLUGIN_VIO *vio, MYSQL *mysql)
+{
+  unsigned char *pkt, cmd=3D 0;
+  int pkt_len, res;
+  char reply_buf[1024], *reply;
+
+  do
+  {
+    /* read the prompt */
+    pkt_len=3D vio->read_packet(vio, &pkt);
+    if (pkt_len < 0)
+      return CR_ERROR;
+
+    if (pkt =3D=3D 0)
+    {
+      /*
+        in mysql_change_user() the client sends the first packet, so
+        the first vio->read_packet() does nothing (pkt =3D=3D 0).
+
+        We send the "password", assuming the client knows what its doing.
+        (in other words, the dialog plugin should be only set as a default
+        authentication plugin on the client if the first question
+        asks for a password - which will be sent in cleat text, by the way)
+      */
+      reply=3D mysql->passwd;
+    }
+    else
+    {
+      cmd=3D *pkt++;
+
+      /* is it MySQL protocol packet ? */
+      if (cmd =3D=3D 0 || cmd =3D=3D 254)
+        return CR_OK_HANDSHAKE_COMPLETE; /* yes. we're done */
+
+      /*
+        asking for a password with an empty prompt means mysql->password
+        otherwise we ask the user and read the reply
+      */
+      if ((cmd >> 1) =3D=3D 2 && *pkt =3D=3D 0)
+        reply=3D mysql->passwd;
+      else
+        reply=3D ask(mysql, cmd >> 1, pkt, reply_buf, sizeof(reply_buf));
+      if (!reply)
+        return CR_ERROR;
+    }
+    /* send the reply to the server */
+    res=3D vio->write_packet(vio, reply, strlen(reply)+1);
+
+    if (reply !=3D mysql->passwd && reply !=3D reply_buf)
+      free(reply);
+
+    if (res)
+      return CR_ERROR;
+
+    /* repeat unless it was the last question */
+  } while ((cmd & 1) !=3D 1);
+
+  /* the job of reading the ok/error packet is left to the server */
+  return CR_OK;
+}
+
+/**
+  initialization function of the dialog plugin
+
+  Pick up the client's authentication_dialog_ask() function, if exists,
+  or fall back to the default implementation.
+*/
+static int init_dialog()
+{
+  void *sym=3D dlsym(RTLD_DEFAULT, "mysql_authentication_dialog_ask");
+  ask=3D sym ? (mysql_authentication_dialog_ask_t)sym : builtin_ask;
+  return 0;
+}
+
+mysql_declare_client_plugin(AUTHENTICATION)
+  "dialog",
+  "Sergei Golubchik",
+  "Dialog Client Authentication Plugin",
+  {0,1,0},
+  init_dialog,
+  NULL,
+  perform_dialog
+mysql_end_client_plugin;
+

=3D=3D=3D added file 'plugin/auth/plug.in'
--- plugin/auth/plug.in	1970-01-01 00:00:00 +0000
+++ plugin/auth/plug.in	2010-02-19 08:18:09 +0000
@@ -0,0 +1,14 @@
+MYSQL_PLUGIN(auth, [Collection of Authentication Plugins],
+                   [Collection of Authentication Plugins])
+MYSQL_PLUGIN_DYNAMIC(auth, [dialog.la])
+MYSQL_PLUGIN_ACTIONS(auth,[
+AC_COMPILE_IFELSE([
+  AC_LANG_PROGRAM([[
+#define _GNU_SOURCE
+#include <sys/socket.h>
+]],[[
+  struct ucred cred;
+  getsockopt(0, SOL_SOCKET, SO_PEERCRED, &cred, 0);
+]])],have_peercred=3Dyes)
+AM_CONDITIONAL(HAVE_PEERCRED, test x$have_peercred =3D xyes)
+])

=3D=3D=3D modified file 'scripts/mysql_system_tables.sql'
--- scripts/mysql_system_tables.sql	2009-10-27 10:09:36 +0000
+++ scripts/mysql_system_tables.sql	2010-02-19 08:18:09 +0000
@@ -13,7 +13,7 @@
 CREATE TABLE IF NOT EXISTS host (  Host char(60) binary DEFAULT '' NOT NUL=
L, Db char(64) binary DEFAULT '' NOT NULL, Select_priv enum('N','Y') COLLAT=
E utf8_general_ci DEFAULT 'N' NOT NULL, Insert_priv enum('N','Y') COLLATE u=
tf8_general_ci DEFAULT 'N' NOT NULL, Update_priv enum('N','Y') COLLATE utf8=
_general_ci DEFAULT 'N' NOT NULL, Delete_priv enum('N','Y') COLLATE utf8_ge=
neral_ci DEFAULT 'N' NOT NULL, Create_priv enum('N','Y') COLLATE utf8_gener=
al_ci DEFAULT 'N' NOT NULL, Drop_priv enum('N','Y') COLLATE utf8_general_ci=
 DEFAULT 'N' NOT NULL, Grant_priv enum('N','Y') COLLATE utf8_general_ci DEF=
AULT 'N' NOT NULL, References_priv enum('N','Y') COLLATE utf8_general_ci DE=
FAULT 'N' NOT NULL, Index_priv enum('N','Y') COLLATE utf8_general_ci DEFAUL=
T 'N' NOT NULL, Alter_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N=
' NOT NULL, Create_tmp_table_priv enum('N','Y') COLLATE utf8_general_ci DEF=
AULT 'N' NOT NULL, Lock_tables_priv enum('N','Y') COLLATE utf8_general_ci D=
EFAULT 'N' NOT NULL, Create_view_priv enum('N','Y') COLLATE utf8_general_ci=
 DEFAULT 'N' NOT NULL, Show_view_priv enum('N','Y') COLLATE utf8_general_ci=
 DEFAULT 'N' NOT NULL, Create_routine_priv enum('N','Y') COLLATE utf8_gener=
al_ci DEFAULT 'N' NOT NULL, Alter_routine_priv enum('N','Y') COLLATE utf8_g=
eneral_ci DEFAULT 'N' NOT NULL, Execute_priv enum('N','Y') COLLATE utf8_gen=
eral_ci DEFAULT 'N' NOT NULL, Trigger_priv enum('N','Y') COLLATE utf8_gener=
al_ci DEFAULT 'N' NOT NULL, PRIMARY KEY Host (Host,Db) ) engine=3DMyISAM CH=
ARACTER SET utf8 COLLATE utf8_bin comment=3D'Host privileges;  Merged with =
database privileges';
=20
=20
-CREATE TABLE IF NOT EXISTS user (   Host char(60) binary DEFAULT '' NOT NU=
LL, User char(16) binary DEFAULT '' NOT NULL, Password char(41) character s=
et latin1 collate latin1_bin DEFAULT '' NOT NULL, Select_priv enum('N','Y')=
 COLLATE utf8_general_ci DEFAULT 'N' NOT NULL, Insert_priv enum('N','Y') CO=
LLATE utf8_general_ci DEFAULT 'N' NOT NULL, Update_priv enum('N','Y') COLLA=
TE utf8_general_ci DEFAULT 'N' NOT NULL, Delete_priv enum('N','Y') COLLATE =
utf8_general_ci DEFAULT 'N' NOT NULL, Create_priv enum('N','Y') COLLATE utf=
8_general_ci DEFAULT 'N' NOT NULL, Drop_priv enum('N','Y') COLLATE utf8_gen=
eral_ci DEFAULT 'N' NOT NULL, Reload_priv enum('N','Y') COLLATE utf8_genera=
l_ci DEFAULT 'N' NOT NULL, Shutdown_priv enum('N','Y') COLLATE utf8_general=
_ci DEFAULT 'N' NOT NULL, Process_priv enum('N','Y') COLLATE utf8_general_c=
i DEFAULT 'N' NOT NULL, File_priv enum('N','Y') COLLATE utf8_general_ci DEF=
AULT 'N' NOT NULL, Grant_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT=
 'N' NOT NULL, References_priv enum('N','Y') COLLATE utf8_general_ci DEFAUL=
T 'N' NOT NULL, Index_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N=
' NOT NULL, Alter_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' NO=
T NULL, Show_db_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' NOT =
NULL, Super_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' NOT NULL=
, Create_tmp_table_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' N=
OT NULL, Lock_tables_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N'=
 NOT NULL, Execute_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' N=
OT NULL, Repl_slave_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' =
NOT NULL, Repl_client_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N=
' NOT NULL, Create_view_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT =
'N' NOT NULL, Show_view_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT =
'N' NOT NULL, Create_routine_priv enum('N','Y') COLLATE utf8_general_ci DEF=
AULT 'N' NOT NULL, Alter_routine_priv enum('N','Y') COLLATE utf8_general_ci=
 DEFAULT 'N' NOT NULL, Create_user_priv enum('N','Y') COLLATE utf8_general_=
ci DEFAULT 'N' NOT NULL, Event_priv enum('N','Y') COLLATE utf8_general_ci D=
EFAULT 'N' NOT NULL, Trigger_priv enum('N','Y') COLLATE utf8_general_ci DEF=
AULT 'N' NOT NULL, ssl_type enum('','ANY','X509', 'SPECIFIED') COLLATE utf8=
_general_ci DEFAULT '' NOT NULL, ssl_cipher BLOB NOT NULL, x509_issuer BLOB=
 NOT NULL, x509_subject BLOB NOT NULL, max_questions int(11) unsigned DEFAU=
LT 0  NOT NULL, max_updates int(11) unsigned DEFAULT 0  NOT NULL, max_conne=
ctions int(11) unsigned DEFAULT 0  NOT NULL, max_user_connections int(11) u=
nsigned DEFAULT 0  NOT NULL, PRIMARY KEY Host (Host,User) ) engine=3DMyISAM=
 CHARACTER SET utf8 COLLATE utf8_bin comment=3D'Users and global privileges=
';
+CREATE TABLE IF NOT EXISTS user (   Host char(60) binary DEFAULT '' NOT NU=
LL, User char(16) binary DEFAULT '' NOT NULL, Password char(41) character s=
et latin1 collate latin1_bin DEFAULT '' NOT NULL, Select_priv enum('N','Y')=
 COLLATE utf8_general_ci DEFAULT 'N' NOT NULL, Insert_priv enum('N','Y') CO=
LLATE utf8_general_ci DEFAULT 'N' NOT NULL, Update_priv enum('N','Y') COLLA=
TE utf8_general_ci DEFAULT 'N' NOT NULL, Delete_priv enum('N','Y') COLLATE =
utf8_general_ci DEFAULT 'N' NOT NULL, Create_priv enum('N','Y') COLLATE utf=
8_general_ci DEFAULT 'N' NOT NULL, Drop_priv enum('N','Y') COLLATE utf8_gen=
eral_ci DEFAULT 'N' NOT NULL, Reload_priv enum('N','Y') COLLATE utf8_genera=
l_ci DEFAULT 'N' NOT NULL, Shutdown_priv enum('N','Y') COLLATE utf8_general=
_ci DEFAULT 'N' NOT NULL, Process_priv enum('N','Y') COLLATE utf8_general_c=
i DEFAULT 'N' NOT NULL, File_priv enum('N','Y') COLLATE utf8_general_ci DEF=
AULT 'N' NOT NULL, Grant_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT=
 'N' NOT NULL, References_priv enum('N','Y') COLLATE utf8_general_ci DEFAUL=
T 'N' NOT NULL, Index_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N=
' NOT NULL, Alter_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' NO=
T NULL, Show_db_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' NOT =
NULL, Super_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' NOT NULL=
, Create_tmp_table_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' N=
OT NULL, Lock_tables_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N'=
 NOT NULL, Execute_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' N=
OT NULL, Repl_slave_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N' =
NOT NULL, Repl_client_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT 'N=
' NOT NULL, Create_view_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT =
'N' NOT NULL, Show_view_priv enum('N','Y') COLLATE utf8_general_ci DEFAULT =
'N' NOT NULL, Create_routine_priv enum('N','Y') COLLATE utf8_general_ci DEF=
AULT 'N' NOT NULL, Alter_routine_priv enum('N','Y') COLLATE utf8_general_ci=
 DEFAULT 'N' NOT NULL, Create_user_priv enum('N','Y') COLLATE utf8_general_=
ci DEFAULT 'N' NOT NULL, Event_priv enum('N','Y') COLLATE utf8_general_ci D=
EFAULT 'N' NOT NULL, Trigger_priv enum('N','Y') COLLATE utf8_general_ci DEF=
AULT 'N' NOT NULL, ssl_type enum('','ANY','X509', 'SPECIFIED') COLLATE utf8=
_general_ci DEFAULT '' NOT NULL, ssl_cipher BLOB NOT NULL, x509_issuer BLOB=
 NOT NULL, x509_subject BLOB NOT NULL, max_questions int(11) unsigned DEFAU=
LT 0  NOT NULL, max_updates int(11) unsigned DEFAULT 0  NOT NULL, max_conne=
ctions int(11) unsigned DEFAULT 0  NOT NULL, max_user_connections int(11) u=
nsigned DEFAULT 0  NOT NULL, plugin char(60) CHARACTER SET latin1 DEFAULT '=
' NOT NULL, auth_string TEXT NOT NULL, PRIMARY KEY Host (Host,User) ) engin=
e=3DMyISAM CHARACTER SET utf8 COLLATE utf8_bin comment=3D'Users and global =
privileges';
=20
 -- Remember for later if user table already existed
 set @had_user_table=3D @@warning_count !=3D 0;

=3D=3D=3D modified file 'scripts/mysql_system_tables_data.sql'
--- scripts/mysql_system_tables_data.sql	2008-10-03 15:54:22 +0000
+++ scripts/mysql_system_tables_data.sql	2010-02-19 08:18:09 +0000
@@ -21,9 +21,9 @@
 -- from local machine if "users" table didn't exist before
 CREATE TEMPORARY TABLE tmp_user LIKE user;
 set @current_hostname=3D @@hostname;
-INSERT INTO tmp_user VALUES ('localhost','root','','Y','Y','Y','Y','Y','Y'=
,'Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y=
','Y','Y','Y','','','','',0,0,0,0);
-REPLACE INTO tmp_user SELECT @current_hostname,'root','','Y','Y','Y','Y','=
Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y',=
'Y','Y','Y','Y','Y','','','','',0,0,0,0 FROM dual WHERE LOWER( @current_hos=
tname) !=3D 'localhost';
-REPLACE INTO tmp_user VALUES ('127.0.0.1','root','','Y','Y','Y','Y','Y','Y=
','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','=
Y','Y','Y','Y','','','','',0,0,0,0);
+INSERT INTO tmp_user VALUES ('localhost','root','','Y','Y','Y','Y','Y','Y'=
,'Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y=
','Y','Y','Y','','','','',0,0,0,0,'','');
+REPLACE INTO tmp_user SELECT @current_hostname,'root','','Y','Y','Y','Y','=
Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y',=
'Y','Y','Y','Y','Y','','','','',0,0,0,0,'','' FROM dual WHERE LOWER( @curre=
nt_hostname) !=3D 'localhost';
+REPLACE INTO tmp_user VALUES ('127.0.0.1','root','','Y','Y','Y','Y','Y','Y=
','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','=
Y','Y','Y','Y','','','','',0,0,0,0,'','');
 INSERT INTO tmp_user (host,user) VALUES ('localhost','');
 INSERT INTO tmp_user (host,user) SELECT @current_hostname,'' FROM dual WHE=
RE LOWER(@current_hostname ) !=3D 'localhost';
 INSERT INTO user SELECT * FROM tmp_user WHERE @had_user_table=3D0;

=3D=3D=3D modified file 'scripts/mysql_system_tables_fix.sql'
--- scripts/mysql_system_tables_fix.sql	2009-10-27 10:09:36 +0000
+++ scripts/mysql_system_tables_fix.sql	2010-02-19 08:18:09 +0000
@@ -541,6 +541,9 @@
=20
 UPDATE user SET Trigger_priv=3DSuper_priv WHERE @hadTriggerPriv =3D 0;
=20
+ALTER TABLE user ADD plugin char(60) CHARACTER SET latin1 DEFAULT '' NOT N=
ULL,  ADD auth_string TEXT NOT NULL;
+ALTER TABLE user MODIFY plugin char(60) CHARACTER SET latin1 DEFAULT '' NO=
T NULL;
+
 # Activate the new, possible modified privilege tables
 # This should not be needed, but gives us some extra testing that the above
 # changes was correct

=3D=3D=3D modified file 'server-tools/instance-manager/Makefile.am'
--- server-tools/instance-manager/Makefile.am	2007-02-18 12:45:28 +0000
+++ server-tools/instance-manager/Makefile.am	2010-02-19 08:18:09 +0000
@@ -46,7 +46,8 @@
 	$(top_builddir)/sql/pack.$(OBJEXT) \
 	$(top_builddir)/sql/sql_state.$(OBJEXT) \
 	$(top_builddir)/sql/mini_client_errors.$(OBJEXT)\
-	$(top_builddir)/sql/client.$(OBJEXT)
+	$(top_builddir)/sql/client.$(OBJEXT) \
+	$(top_builddir)/sql/client_plugin.$(OBJEXT)
=20
 CLEANFILES=3D net_serv.cc client_settings.h
=20
@@ -91,7 +92,7 @@
 			$(top_builddir)/mysys/libmysys.a \
 			$(top_builddir)/strings/libmystrings.a \
 			$(top_builddir)/dbug/libdbug.a \
-			@openssl_libs@ @yassl_libs@ @ZLIB_LIBS@
+			@openssl_libs@ @yassl_libs@ @ZLIB_LIBS@ @LIBDL@
=20
 EXTRA_DIST =3D		WindowsService.cpp WindowsService.h IMService.cpp \
 			IMService.h CMakeLists.txt

=3D=3D=3D modified file 'server-tools/instance-manager/user_map.cc'
--- server-tools/instance-manager/user_map.cc	2009-06-29 14:00:47 +0000
+++ server-tools/instance-manager/user_map.cc	2010-02-19 08:18:09 +0000
@@ -368,7 +368,7 @@
                            const char *scramble) const
 {
   const User *user=3D find_user(user_name);
-  return user ? check_scramble(scrambled_password, scramble, user->salt) :=
 2;
+  return user ? check_scramble((uchar*)scrambled_password, scramble, user-=
>salt) : 2;
 }
=20
=20

=3D=3D=3D modified file 'sql-common/client.c'
--- sql-common/client.c	2010-02-01 06:14:12 +0000
+++ sql-common/client.c	2010-02-19 08:18:09 +0000
@@ -107,6 +107,7 @@
=20
 #include "client_settings.h"
 #include <sql_common.h>
+#include <mysql/client_plugin.h>
=20
 uint		mysql_port=3D0;
 char		*mysql_unix_port=3D 0;
@@ -332,7 +333,7 @@
   @param ...       variable number of arguments
 */
=20
-static void set_mysql_extended_error(MYSQL *mysql, int errcode,
+void set_mysql_extended_error(MYSQL *mysql, int errcode,
                                      const char *sqlstate,
                                      const char *format, ...)
 {
@@ -1002,9 +1003,20 @@
   "replication-probe", "enable-reads-from-master", "repl-parse-query",
   "ssl-cipher", "max-allowed-packet", "protocol", "shared-memory-base-name=
",
   "multi-results", "multi-statements", "multi-queries", "secure-auth",
-  "report-data-truncation",
+  "report-data-truncation", "plugin-dir", "default-auth",
   NullS
 };
+enum option_id {
+  OPT_port=3D1, OPT_socket, OPT_compress, OPT_password, OPT_pipe, OPT_time=
out, OPT_user,=20
+  OPT_init_command, OPT_host, OPT_database, OPT_debug, OPT_return_found_ro=
ws,=20
+  OPT_ssl_key, OPT_ssl_cert, OPT_ssl_ca, OPT_ssl_capath,=20
+  OPT_character_sets_dir, OPT_default_character_set, OPT_interactive_timeo=
ut,=20
+  OPT_connect_timeout, OPT_local_infile, OPT_disable_local_infile,=20
+  OPT_replication_probe, OPT_enable_reads_from_master, OPT_repl_parse_quer=
y,
+  OPT_ssl_cipher, OPT_max_allowed_packet, OPT_protocol, OPT_shared_memory_=
base_name,=20
+  OPT_multi_results, OPT_multi_statements, OPT_multi_queries, OPT_secure_a=
uth,=20
+  OPT_report_data_truncation, OPT_plugin_dir, OPT_default_auth,=20
+};
=20
 static TYPELIB option_types=3D{array_elements(default_options)-1,
 			     "options",default_options, NULL};
@@ -1035,6 +1047,14 @@
   return 0;
 }
=20
+#define extension_free(OPTS, X)                                  \
+    if ((OPTS)->extension)                                       \
+      my_free((OPTS)->extension->X, MYF(MY_ALLOW_ZERO_PTR));     \
+    else                                                         \
+      (OPTS)->extension=3D (struct st_mysql_options_extention *)   \
+        my_malloc(sizeof(struct st_mysql_options_extention),     \
+                  MYF(MY_WME | MY_ZEROFILL));
+
 void mysql_read_default_options(struct st_mysql_options *options,
 				const char *filename,const char *group)
 {
@@ -1067,134 +1087,134 @@
 	for (end=3D *option ; *(end=3D strcend(end,'_')) ; )
 	  *end=3D '-';
 	switch (find_type(*option+2,&option_types,2)) {
-	case 1:				/* port */
+	case OPT_port:
 	  if (opt_arg)
 	    options->port=3Datoi(opt_arg);
 	  break;
-	case 2:				/* socket */
+	case OPT_socket:
 	  if (opt_arg)
 	  {
 	    my_free(options->unix_socket,MYF(MY_ALLOW_ZERO_PTR));
 	    options->unix_socket=3Dmy_strdup(opt_arg,MYF(MY_WME));
 	  }
 	  break;
-	case 3:				/* compress */
+	case OPT_compress:
 	  options->compress=3D1;
 	  options->client_flag|=3D CLIENT_COMPRESS;
 	  break;
-	case 4:				/* password */
+	case OPT_password:
 	  if (opt_arg)
 	  {
 	    my_free(options->password,MYF(MY_ALLOW_ZERO_PTR));
 	    options->password=3Dmy_strdup(opt_arg,MYF(MY_WME));
 	  }
 	  break;
-        case 5:
+        case OPT_pipe:
           options->protocol =3D MYSQL_PROTOCOL_PIPE;
-	case 20:			/* connect_timeout */
-	case 6:				/* timeout */
+        case OPT_connect_timeout:=20
+	case OPT_timeout:
 	  if (opt_arg)
 	    options->connect_timeout=3Datoi(opt_arg);
 	  break;
-	case 7:				/* user */
+	case OPT_user:
 	  if (opt_arg)
 	  {
 	    my_free(options->user,MYF(MY_ALLOW_ZERO_PTR));
 	    options->user=3Dmy_strdup(opt_arg,MYF(MY_WME));
 	  }
 	  break;
-	case 8:				/* init-command */
+	case OPT_init_command:
 	  add_init_command(options,opt_arg);
 	  break;
-	case 9:				/* host */
+	case OPT_host:
 	  if (opt_arg)
 	  {
 	    my_free(options->host,MYF(MY_ALLOW_ZERO_PTR));
 	    options->host=3Dmy_strdup(opt_arg,MYF(MY_WME));
 	  }
 	  break;
-	case 10:			/* database */
+        case OPT_database:
 	  if (opt_arg)
 	  {
 	    my_free(options->db,MYF(MY_ALLOW_ZERO_PTR));
 	    options->db=3Dmy_strdup(opt_arg,MYF(MY_WME));
 	  }
 	  break;
-	case 11:			/* debug */
+	case OPT_debug:
 #ifdef MYSQL_CLIENT
 	  mysql_debug(opt_arg ? opt_arg : "d:t:o,/tmp/client.trace");
 	  break;
 #endif
-	case 12:			/* return-found-rows */
+	case OPT_return_found_rows:
 	  options->client_flag|=3DCLIENT_FOUND_ROWS;
 	  break;
 #ifdef HAVE_OPENSSL
-	case 13:			/* ssl_key */
+	case OPT_ssl_key:
 	  my_free(options->ssl_key, MYF(MY_ALLOW_ZERO_PTR));
           options->ssl_key =3D my_strdup(opt_arg, MYF(MY_WME));
           break;
-	case 14:			/* ssl_cert */
+	case OPT_ssl_cert:
 	  my_free(options->ssl_cert, MYF(MY_ALLOW_ZERO_PTR));
           options->ssl_cert =3D my_strdup(opt_arg, MYF(MY_WME));
           break;
-	case 15:			/* ssl_ca */
+	case OPT_ssl_ca:
 	  my_free(options->ssl_ca, MYF(MY_ALLOW_ZERO_PTR));
           options->ssl_ca =3D my_strdup(opt_arg, MYF(MY_WME));
           break;
-	case 16:			/* ssl_capath */
+	case OPT_ssl_capath:
 	  my_free(options->ssl_capath, MYF(MY_ALLOW_ZERO_PTR));
           options->ssl_capath =3D my_strdup(opt_arg, MYF(MY_WME));
           break;
-        case 26:			/* ssl_cipher */
+        case OPT_ssl_cipher:
           my_free(options->ssl_cipher, MYF(MY_ALLOW_ZERO_PTR));
           options->ssl_cipher=3D my_strdup(opt_arg, MYF(MY_WME));
           break;
 #else
-	case 13:				/* Ignore SSL options */
-	case 14:
-	case 15:
-	case 16:
-        case 26:
+	case OPT_ssl_key:
+	case OPT_ssl_cert:
+	case OPT_ssl_ca:
+	case OPT_ssl_capath:
+        case OPT_ssl_cipher:
 	  break;
 #endif /* HAVE_OPENSSL */
-	case 17:			/* charset-lib */
+        case OPT_character_sets_dir:
 	  my_free(options->charset_dir,MYF(MY_ALLOW_ZERO_PTR));
           options->charset_dir =3D my_strdup(opt_arg, MYF(MY_WME));
 	  break;
-	case 18:
+	case OPT_default_character_set:
 	  my_free(options->charset_name,MYF(MY_ALLOW_ZERO_PTR));
           options->charset_name =3D my_strdup(opt_arg, MYF(MY_WME));
 	  break;
-	case 19:				/* Interactive-timeout */
+        case OPT_interactive_timeout:
 	  options->client_flag|=3D CLIENT_INTERACTIVE;
 	  break;
-	case 21:
+        case OPT_local_infile:
 	  if (!opt_arg || atoi(opt_arg) !=3D 0)
 	    options->client_flag|=3D CLIENT_LOCAL_FILES;
 	  else
 	    options->client_flag&=3D ~CLIENT_LOCAL_FILES;
 	  break;
-	case 22:
+        case OPT_disable_local_infile:
 	  options->client_flag&=3D ~CLIENT_LOCAL_FILES;
           break;
-	case 23:  /* replication probe */
+        case OPT_replication_probe:
 #ifndef TO_BE_DELETED
 	  options->rpl_probe=3D 1;
 #endif
 	  break;
-	case 24: /* enable-reads-from-master */
+        case OPT_enable_reads_from_master:
 	  options->no_master_reads=3D 0;
 	  break;
-	case 25: /* repl-parse-query */
+        case OPT_repl_parse_query:
 #ifndef TO_BE_DELETED
 	  options->rpl_parse=3D 1;
 #endif
 	  break;
-	case 27:
+	case OPT_max_allowed_packet:
           if (opt_arg)
 	    options->max_allowed_packet=3D atoi(opt_arg);
 	  break;
-        case 28:		/* protocol */
+        case OPT_protocol:
           if ((options->protocol=3D find_type(opt_arg,
 					    &sql_protocol_typelib,0)) <=3D 0)
           {
@@ -1202,26 +1222,34 @@
             exit(1);
           }
           break;
-        case 29:		/* shared_memory_base_name */
+        case OPT_shared_memory_base_name:
 #ifdef HAVE_SMEM
           if (options->shared_memory_base_name !=3D def_shared_memory_base=
_name)
             my_free(options->shared_memory_base_name,MYF(MY_ALLOW_ZERO_PTR=
));
           options->shared_memory_base_name=3Dmy_strdup(opt_arg,MYF(MY_WME)=
);
 #endif
           break;
-	case 30:
+        case OPT_multi_results:
 	  options->client_flag|=3D CLIENT_MULTI_RESULTS;
 	  break;
-	case 31:
-	case 32:
+        case OPT_multi_statements:
+        case OPT_multi_queries:
 	  options->client_flag|=3D CLIENT_MULTI_STATEMENTS | CLIENT_MULTI_RESULTS;
 	  break;
-        case 33: /* secure-auth */
+        case OPT_secure_auth:
           options->secure_auth=3D TRUE;
           break;
-        case 34: /* report-data-truncation */
+        case OPT_report_data_truncation:
           options->report_data_truncation=3D opt_arg ? test(atoi(opt_arg))=
 : 1;
           break;
+        case OPT_plugin_dir:
+          extension_free(options, plugin_dir);
+          options->extension->plugin_dir=3D my_strdup(opt_arg, MYF(MY_WME)=
);
+          break;
+        case OPT_default_auth:
+          extension_free(options, default_auth);
+          options->extension->default_auth=3D my_strdup(opt_arg, MYF(MY_WM=
E));
+          break;
 	default:
 	  DBUG_PRINT("warning",("unknown option: %s",option[0]));
 	}
@@ -1765,6 +1793,11 @@
 static my_bool cli_read_query_result(MYSQL *mysql);
 static MYSQL_RES *cli_use_result(MYSQL *mysql);
=20
+int cli_read_change_user_result(MYSQL *mysql)
+{
+  return cli_safe_read(mysql);
+}
+
 static MYSQL_METHODS client_methods=3D
 {
   cli_read_query_result,                       /* read_query_result */
@@ -1772,7 +1805,8 @@
   cli_read_rows,                               /* read_rows */
   cli_use_result,                              /* use_result */
   cli_fetch_lengths,                           /* fetch_lengths */
-  cli_flush_use_result                         /* flush_use_result */
+  cli_flush_use_result,                        /* flush_use_result */
+  cli_read_change_user_result                  /* read_change_user_result =
*/
 #ifndef MYSQL_SERVER
   ,cli_list_fields,                            /* list_fields */
   cli_read_prepare_result,                     /* read_prepare_result */
@@ -1782,7 +1816,6 @@
   NULL,                                        /* free_embedded_thd */
   cli_read_statistics,                         /* read_statistics */
   cli_read_query_result,                       /* next_result */
-  cli_read_change_user_result,                 /* read_change_user_result =
*/
   cli_read_binary_rows                         /* read_rows_from_cursor */
 #endif
 };
@@ -1856,6 +1889,562 @@
 }
 C_MODE_END
=20
+/*********** client side authentication support **************************/
+
+typedef struct st_mysql_client_plugin_AUTHENTICATION auth_plugin_t;
+
+/* this is a "superset" of MYSQL_PLUGIN_VIO, in C++ I use inheritance */
+typedef struct {
+  int (*read_packet)(struct st_plugin_vio *vio, uchar **buf);
+  int (*write_packet)(struct st_plugin_vio *vio, const uchar *pkt, int pkt=
_len);
+  void (*info)(struct st_plugin_vio *vio, struct st_plugin_vio_info *info);
+  /* -=3D end of MYSQL_PLUGIN_VIO =3D- */
+  MYSQL *mysql;
+  auth_plugin_t *plugin;            /**< what plugin we're under */
+  const char *db;
+  struct {
+    uchar *pkt;                     /**< pointer into NET::buff */
+    uint pkt_len;
+  } cached_server_reply;
+  int packets_read, packets_written; /**< counters for send/received packe=
ts */
+  int mysql_change_user;            /**< if it's mysql_change_user() */
+  int last_read_packet_len;         /**< the length of the last *read* pac=
ket */
+} MCPVIO_EXT;
+
+#define native_password_plugin_name "mysql_native_password"
+#define old_password_plugin_name    "mysql_old_password"
+
+/**
+  sends a COM_CHANGE_USER command with a caller provided payload
+
+  Packet format:
+  =20
+    Bytes       Content
+    -----       ----
+    n           user name - \0-terminated string
+    n           password
+                  3.23 scramble - \0-terminated string (9 bytes)
+                  otherwise - length (1 byte) coded
+    n           database name - \0-terminated string
+    2           character set number (if the server >=3D 4.1.x)
+    n           client auth plugin name - \0-terminated string,
+                  (if the server supports plugin auth)
+
+  @retval 0 ok
+  @retval 1 error
+*/
+static int send_change_user_packet(MCPVIO_EXT *mpvio,
+                                   const uchar *data, int data_len)
+{
+  MYSQL *mysql=3D mpvio->mysql;
+  char *buff, *end;
+  int res=3D 1;
+
+  buff=3D my_alloca(USERNAME_LENGTH + data_len + 1 + NAME_LEN + 2 + NAME_L=
EN);
+
+  end=3D strmake(buff, mysql->user, USERNAME_LENGTH) + 1;
+
+  if (!data_len)
+    *end++=3D 0;
+  else
+  {
+    if (mysql->client_flag & CLIENT_SECURE_CONNECTION)
+    {
+      DBUG_ASSERT(data_len <=3D 255);
+      if (data_len > 255)
+      {
+        set_mysql_error(mysql, CR_MALFORMED_PACKET, unknown_sqlstate);
+        goto error;
+      }
+      *end++=3D data_len;
+    }
+    else
+    {
+      DBUG_ASSERT(data_len =3D=3D SCRAMBLE_LENGTH_323 + 1);
+      DBUG_ASSERT(data[data_len] =3D=3D 0);
+    }
+    memcpy(end, data, data_len);
+    end+=3D data_len;
+  }
+  end=3D strmake(end, mpvio->db ? mpvio->db : "", NAME_LEN) + 1;
+
+  if (mysql->server_capabilities & CLIENT_PROTOCOL_41)
+  {
+    int2store(end, (ushort) mysql->charset->number);
+    end+=3D 2;
+  }
+
+  if (mysql->server_capabilities & CLIENT_PLUGIN_AUTH)
+    end=3D strmake(end, mpvio->plugin->name, NAME_LEN) + 1;
+
+  res=3D simple_command(mysql, COM_CHANGE_USER,
+                      (uchar*)buff, (ulong)(end-buff), 1);
+
+error:
+  my_afree(buff);
+  return res;
+}
+
+/**
+  sends a client authentication packet (second packet in the 3-way handsha=
ke)
+
+  Packet format (when the server is 4.0 or earlier):
+  =20
+    Bytes       Content
+    -----       ----
+    2           client capabilities
+    3           max packet size
+    n           user name, \0-terminated
+    9           scramble_323, \0-terminated
+
+  Packet format (when the server is 4.1 or newer):
+  =20
+    Bytes       Content
+    -----       ----
+    4           client capabilities
+    4           max packet size
+    1           charset number
+    23          reserved (always 0)
+    n           user name, \0-terminated
+    n           plugin auth data (e.g. scramble), length (1 byte) coded
+    n           database name, \0-terminated
+                (if CLIENT_CONNECT_WITH_DB is set in the capabilities)
+    n           client auth plugin name - \0-terminated string,
+                (if CLIENT_PLUGIN_AUTH is set in the capabilities)
+
+  @retval 0 ok
+  @retval 1 error
+*/
+static int send_client_reply_packet(MCPVIO_EXT *mpvio,
+                                    const uchar *data, int data_len)
+{
+  MYSQL *mysql=3D mpvio->mysql;
+  NET *net=3D &mysql->net;
+  char *buff, *end;
+
+  /* see end=3D buff+32 below, fixed size of the packet is 32 bytes */
+  buff=3D my_alloca(33 + USERNAME_LENGTH + data_len + NAME_LEN + NAME_LEN);
+ =20
+  mysql->client_flag|=3D mysql->options.client_flag;
+  mysql->client_flag|=3D CLIENT_CAPABILITIES;
+
+  if (mysql->client_flag & CLIENT_MULTI_STATEMENTS)
+    mysql->client_flag|=3D CLIENT_MULTI_RESULTS;
+
+#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
+  if (mysql->options.ssl_key || mysql->options.ssl_cert ||
+      mysql->options.ssl_ca || mysql->options.ssl_capath ||
+      mysql->options.ssl_cipher)
+    mysql->options.use_ssl=3D 1;
+  if (mysql->options.use_ssl)
+    mysql->client_flag|=3D CLIENT_SSL;
+#endif /* HAVE_OPENSSL && !EMBEDDED_LIBRARY*/
+  if (mpvio->db)
+    mysql->client_flag|=3D CLIENT_CONNECT_WITH_DB;
+
+  /* Remove options that server doesn't support */
+  mysql->client_flag=3D mysql->client_flag &
+                       (~(CLIENT_COMPRESS | CLIENT_SSL | CLIENT_PROTOCOL_4=
1)=20
+                       | mysql->server_capabilities);
+
+#ifndef HAVE_COMPRESS
+  mysql->client_flag&=3D ~CLIENT_COMPRESS;
+#endif
+
+  if (mysql->client_flag & CLIENT_PROTOCOL_41)
+  {
+    /* 4.1 server and 4.1 client has a 32 byte option flag */
+    int4store(buff,mysql->client_flag);
+    int4store(buff+4, net->max_packet_size);
+    buff[8]=3D (char) mysql->charset->number;
+    bzero(buff+9, 32-9);
+    end=3D buff+32;
+  }
+  else
+  {
+    int2store(buff, mysql->client_flag);
+    int3store(buff+2, net->max_packet_size);
+    end=3D buff+5;
+  }
+#ifdef HAVE_OPENSSL
+  if (mysql->client_flag & CLIENT_SSL)
+  {
+    /* Do the SSL layering. */
+    struct st_mysql_options *options=3D &mysql->options;
+    struct st_VioSSLFd *ssl_fd;
+    char error_string[1024];
+
+    /*
+      Send mysql->client_flag, max_packet_size - unencrypted otherwise
+      the server does not know we want to do SSL
+    */
+    if (my_net_write(net, (uchar*)buff, (size_t) (end-buff)) || net_flush(=
net))
+    {
+      set_mysql_extended_error(mysql, CR_SERVER_LOST, unknown_sqlstate,
+                               ER(CR_SERVER_LOST_EXTENDED),
+                               "sending connection information to server",
+                               errno);
+      goto error;
+    }
+
+    /* Create the VioSSLConnectorFd - init SSL and load certs */
+    if (!(ssl_fd=3D new_VioSSLConnectorFd(options->ssl_key,
+                                        options->ssl_cert,
+                                        options->ssl_ca,
+                                        options->ssl_capath,
+                                        options->ssl_cipher)))
+    {
+      set_mysql_error(mysql, CR_SSL_CONNECTION_ERROR, unknown_sqlstate);
+      goto error;
+    }
+    mysql->connector_fd=3D (void*)ssl_fd;
+
+    /* Connect to the server */
+    DBUG_PRINT("info", ("IO layer change in progress..."));
+    if (sslconnect(ssl_fd, net->vio,
+                   (long) (mysql->options.connect_timeout),
+                   error_string))
+    {
+      set_mysql_extended_error(mysql, CR_SSL_CONNECTION_ERROR,
+                               unknown_sqlstate, "SSL error: %s",
+                               error_string[0] ? error_string :
+                               ER(CR_SSL_CONNECTION_ERROR));
+      goto error;
+    }
+    DBUG_PRINT("info", ("IO layer change done!"));
+
+    /* Verify server cert */
+    if ((mysql->client_flag & CLIENT_SSL_VERIFY_SERVER_CERT) &&
+        ssl_verify_server_cert(net->vio, mysql->host))
+    {
+      set_mysql_error(mysql, CR_SSL_CONNECTION_ERROR, unknown_sqlstate);
+      goto error;
+    }
+  }
+#endif /* HAVE_OPENSSL && !EMBEDDED_LIBRARY */
+
+  DBUG_PRINT("info",("Server version =3D '%s'  capabilites: %lu  status: %=
u  client_flag: %lu",
+		     mysql->server_version, mysql->server_capabilities,
+		     mysql->server_status, mysql->client_flag));
+
+  compile_time_assert(MYSQL_USERNAME_LENGTH =3D=3D USERNAME_LENGTH);
+
+  /* This needs to be changed as it's not useful with big packets */
+  if (mysql->user[0])
+    strmake(end, mysql->user, USERNAME_LENGTH);
+  else
+    read_user_name(end);
+
+  /* We have to handle different version of handshake here */
+  DBUG_PRINT("info",("user: %s",end));
+  end=3D strend(end) + 1;
+  if (data_len)
+  {
+    if (mysql->server_capabilities & CLIENT_SECURE_CONNECTION)
+    {
+      *end++=3D data_len;
+      memcpy(end, data, data_len);
+      end+=3D data_len;
+    }
+    else
+    {
+      DBUG_ASSERT(data_len =3D=3D SCRAMBLE_LENGTH_323 + 1); /* incl. \0 at=
 the end */
+      memcpy(end, data, data_len);
+      end+=3D data_len;
+    }
+  }
+  else
+    *end++=3D 0;
+
+  /* Add database if needed */
+  if (mpvio->db && (mysql->server_capabilities &
CLIENT_CONNECT_WITH_DB))
+  {
+    end=3D strmake(end, mpvio->db, NAME_LEN) + 1;
+    mysql->db=3D my_strdup(mpvio->db, MYF(MY_WME));
+  }
+
+  if (mysql->server_capabilities & CLIENT_PLUGIN_AUTH)
+    end=3D strmake(end, mpvio->plugin->name, NAME_LEN) + 1;
+
+  /* Write authentication package */
+  if (my_net_write(net, (uchar*) buff, (size_t) (end-buff)) || net_flush(n=
et))
+  {
+    set_mysql_extended_error(mysql, CR_SERVER_LOST, unknown_sqlstate,
+                             ER(CR_SERVER_LOST_EXTENDED),
+                             "sending authentication information",
+                             errno);
+    goto error;
+  }
+  my_afree(buff);
+  return 0;
+ =20
+error:
+  my_afree(buff);
+  return 1;
+}
+
+/**
+  vio->read_packet() callback method for client authentication plugins
+
+  This function is called by a client authentication plugin, when it wants
+  to read data from the server.
+*/
+static int client_mpvio_read_packet(struct st_plugin_vio *mpv, uchar **buf)
+{
+  MCPVIO_EXT *mpvio=3D (MCPVIO_EXT*)mpv;
+  MYSQL *mysql=3D mpvio->mysql;
+  ulong  pkt_len;
+
+  /* there are cached data left, feed it to a plugin */
+  if (mpvio->packets_read =3D=3D 0 || mpvio->cached_server_reply.pkt)
+  {
+    *buf=3D mpvio->cached_server_reply.pkt;
+    mpvio->cached_server_reply.pkt=3D 0;
+    mpvio->packets_read++;
+    return mpvio->cached_server_reply.pkt_len;
+  }
+
+  /* otherwise read the data */
+  pkt_len=3D (*mysql->methods->read_change_user_result)(mysql);
+  *buf=3D mysql->net.read_pos;
+  /*
+    the server sends \1\255 instead of just \255 - otherwise
+    cli_safe_read would took it as an error packet.
+    We remove this escaping \1 here.
+  */
+  if (pkt_len && **buf =3D=3D 1)
+  {
+    (*buf)++;
+    pkt_len--;
+  }
+  mpvio->packets_read++;
+  return mpvio->last_read_packet_len=3D pkt_len;
+}
+
+/**
+  vio->write_packet() callback method for client authentication plugins
+
+  This function is called by a client authentication plugin, when it wants
+  to send data to the server.
+
+  It transparently wraps the data into a change user or authentication
+  handshake packet, if neccessary.
+*/
+static int client_mpvio_write_packet(struct st_plugin_vio *mpv,
+                                     const uchar *pkt, int pkt_len)
+{
+  int res;
+  MCPVIO_EXT *mpvio=3D (MCPVIO_EXT*)mpv;
+
+  if (mpvio->packets_written =3D=3D 0)
+  {
+    DBUG_ASSERT(mpvio->packets_read =3D=3D 1);
+    if (mpvio->mysql_change_user)
+      res=3D send_change_user_packet(mpvio, pkt, pkt_len);
+    else
+      res=3D send_client_reply_packet(mpvio, pkt, pkt_len);
+  }
+  else
+  {
+    NET *net=3D &mpvio->mysql->net;
+    if (mpvio->mysql->thd)
+      res=3D 1; /* no chit-chat in embedded */
+    else
+      res=3D my_net_write(net, pkt, pkt_len) || net_flush(net);
+    if (res)
+      set_mysql_extended_error(mpvio->mysql, CR_SERVER_LOST, unknown_sqlst=
ate,
+                               ER(CR_SERVER_LOST_EXTENDED),
+                               "sending authentication information",
+                               errno);
+  }
+  mpvio->packets_written++;
+  return res;
+}
+
+/**
+  fills MYSQL_PLUGIN_VIO_INFO structure with the information about the
+  connection
+*/
+void mpvio_info(Vio *vio, MYSQL_PLUGIN_VIO_INFO *info)
+{
+  bzero(info, sizeof(*info));
+  switch (vio->type) {
+  case VIO_TYPE_TCPIP:
+    info->protocol=3D MYSQL_VIO_TCP;
+    info->socket=3D vio->sd;
+    return;
+  case VIO_TYPE_SOCKET:
+    info->protocol=3D MYSQL_VIO_SOCKET;
+    info->socket=3D vio->sd;
+    return;
+  case VIO_TYPE_SSL:
+    {
+      struct sockaddr addr;
+      socklen_t addrlen=3D sizeof(addr);
+      if (getsockname(vio->sd, &addr, &addrlen))
+        return;
+      info->protocol=3D addr.sa_family =3D=3D AF_UNIX ?
+        MYSQL_VIO_SOCKET : MYSQL_VIO_TCP;
+      info->socket=3D vio->sd;
+      return;
+    }
+#ifdef _WIN32
+  case VIO_TYPE_NAMEDPIPE:
+    info->protocol=3D MYSQL_VIO_PIPE;
+    info->handle=3D vio->hPipe;
+    return;
+  case VIO_TYPE_SHARED_MEMORY:
+    info->protocol=3D MYSQL_VIO_MEMORY;
+    info->handle=3D vio->handle_client_file_map; /* or what ? */
+    return;
+#endif
+  default: DBUG_ASSERT(0);
+  }
+}
+
+static void client_mpvio_info(MYSQL_PLUGIN_VIO *vio,
+                              MYSQL_PLUGIN_VIO_INFO *info)
+{
+  MCPVIO_EXT *mpvio=3D (MCPVIO_EXT*)vio;
+  mpvio_info(mpvio->mysql->net.vio, info);
+}
+
+/**
+  Client side of the plugin driver authentication.
+
+  @note this is used by both the mysql_real_connect and mysql_change_user
+
+  @param mysql    mysql
+  @param data     pointer to the plugin auth data (scramble) in the handsh=
ake
+                  packet or 0 if it's mysql_change_user()
+  @param data_len the length of the data
+  @param db       initial db to use, can be 0
+
+  @retval 0 ok
+  @retval 1 error
+*/
+int run_plugin_auth(MYSQL *mysql, char *data, uint data_len, const char *d=
b)
+{
+  const char    *auth_plugin_name;
+  auth_plugin_t *auth_plugin;
+  MCPVIO_EXT    mpvio;
+  ulong		pkt_length;
+  int           res;
+
+  /* determine the default/initial plugin to use */
+  if (mysql->options.extension &&
mysql->options.extension->default_auth)
+    auth_plugin_name=3D mysql->options.extension->default_auth;
+  else
+    auth_plugin_name=3D mysql->server_capabilities & CLIENT_PROTOCOL_41 ?
+      native_password_plugin_name : old_password_plugin_name;
+
+  if (!(auth_plugin=3D (auth_plugin_t*) mysql_client_find_plugin(mysql,
+                         auth_plugin_name, MYSQL_CLIENT_AUTHENTICATION_PLU=
GIN)))
+    return 1; /* oops, not found */
+
+  mysql->net.last_errno=3D 0; /* just in case */
+
+  mpvio.cached_server_reply.pkt=3D (uchar*)data;
+  mpvio.cached_server_reply.pkt_len=3D data_len;
+  mpvio.mysql_change_user=3D data =3D=3D 0;
+  mpvio.read_packet=3D client_mpvio_read_packet;
+  mpvio.write_packet=3D client_mpvio_write_packet;
+  mpvio.info=3D client_mpvio_info;
+  mpvio.mysql=3D mysql;
+  mpvio.packets_read=3D mpvio.packets_written=3D 0;
+  mpvio.db=3D db;
+  mpvio.plugin=3D auth_plugin;
+
+  res=3D auth_plugin->authenticate_user((struct st_plugin_vio *)&mpvio, my=
sql);
+
+  compile_time_assert(CR_OK =3D=3D -1);
+  compile_time_assert(CR_ERROR =3D=3D 0);
+  if (res > CR_OK)
+  {
+    /*
+      the plugin returned an error. write it down in mysql,
+      unless the error code is CR_ERROR and mysql->net.last_errno
+      is already set (the plugin has done it)
+    */
+    if (res > CR_ERROR)
+      set_mysql_error(mysql, res, unknown_sqlstate);
+    else
+      if (!mysql->net.last_errno)
+        set_mysql_error(mysql, CR_UNKNOWN_ERROR, unknown_sqlstate);
+    return 1;
+  }
+
+  /* read the OK packet (or use the cached value in mysql->net.read_pos */
+  if (res =3D=3D CR_OK)
+    pkt_length=3D (*mysql->methods->read_change_user_result)(mysql);
+  else /* res =3D=3D CR_OK_HANDSHAKE_COMPLETE */
+    pkt_length=3D mpvio.last_read_packet_len;
+
+  if (pkt_length =3D=3D packet_error)
+  {
+    if (mysql->net.last_errno =3D=3D CR_SERVER_LOST)
+      set_mysql_extended_error(mysql, CR_SERVER_LOST, unknown_sqlstate,
+                               ER(CR_SERVER_LOST_EXTENDED),
+                               "reading authorization packet",
+                               errno);
+    return 1;
+  }
+
+  if (mysql->net.read_pos[0] =3D=3D 254)
+  {
+    /* The server asked to use a different authentication plugin */
+    if (pkt_length =3D=3D 1)
+    { /* old "use short scramble" packet */
+      auth_plugin_name=3D old_password_plugin_name;
+      mpvio.cached_server_reply.pkt=3D (uchar*)mysql->scramble;
+      mpvio.cached_server_reply.pkt_len=3D SCRAMBLE_LENGTH + 1;
+    }
+    else
+    { /* new "use different plugin" packet */
+      uint len;
+      auth_plugin_name=3D (char*)mysql->net.read_pos + 1;
+      len=3D strlen(auth_plugin_name);
+      mpvio.cached_server_reply.pkt_len=3D pkt_length - len - 2;
+      mpvio.cached_server_reply.pkt=3D mysql->net.read_pos + len + 2;
+    }
+
+    if (!(auth_plugin=3D (auth_plugin_t *) mysql_client_find_plugin(mysql,
+                         auth_plugin_name, MYSQL_CLIENT_AUTHENTICATION_PLU=
GIN)))
+      return 1;
+
+    mpvio.plugin=3D auth_plugin;
+    res=3D auth_plugin->authenticate_user((struct st_plugin_vio *)&mpvio, =
mysql);
+
+    if (res > CR_OK)
+    {
+      if (res > CR_ERROR)
+        set_mysql_error(mysql, res, unknown_sqlstate);
+      else
+        if (!mysql->net.last_errno)
+          set_mysql_error(mysql, CR_UNKNOWN_ERROR, unknown_sqlstate);
+      return 1;
+    }
+
+    if (res !=3D CR_OK_HANDSHAKE_COMPLETE)
+    {
+      /* Read what server thinks about out new auth message report */
+      if (cli_safe_read(mysql) =3D=3D packet_error)
+      {
+        if (mysql->net.last_errno =3D=3D CR_SERVER_LOST)
+          set_mysql_extended_error(mysql, CR_SERVER_LOST, unknown_sqlstate,
+                                   ER(CR_SERVER_LOST_EXTENDED),
+                                   "reading final connect information",
+                                   errno);
+        return 1;
+      }
+    }
+  }
+  /*
+    net->read_pos[0] should always be 0 here if the server implements
+    the protocol correctly
+  */
+  return mysql->net.read_pos[0] !=3D 0;
+}
=20
 MYSQL * STDCALL=20
 CLI_MYSQL_REAL_CONNECT(MYSQL *mysql,const char *host, const char *user,
@@ -1863,8 +2452,8 @@
 		       uint port, const char *unix_socket,ulong client_flag)
 {
   char		buff[NAME_LEN+USERNAME_LENGTH+100];
-  char		error_string[1024];
-  char		*end,*host_info=3D NULL;
+  int           scramble_data_len;
+  char          *end,*host_info, *server_version_end, *pkt_end, *scramble_=
data;
   my_socket	sock;
   in_addr_t	ip_addr;
   struct	sockaddr_in sock_addr;
@@ -2180,8 +2769,8 @@
                                errno);
     goto error;
   }
+  pkt_end=3D (char*)net->read_pos + pkt_length;
   /* Check if version of protocol matches current one */
-
   mysql->protocol_version=3D net->read_pos[0];
   DBUG_DUMP("packet",(uchar*) net->read_pos,10);
   DBUG_PRINT("info",("mysql protocol version %d, server=3D%d",
@@ -2193,31 +2782,27 @@
                              PROTOCOL_VERSION);
     goto error;
   }
-  end=3Dstrend((char*) net->read_pos+1);
+  server_version_end=3D end=3D strend((char*) net->read_pos+1);
   mysql->thread_id=3Duint4korr(end+1);
   end+=3D5;
   /*=20
-    Scramble is split into two parts because old clients does not understa=
nd
+    Scramble is split into two parts because old clients do not understand
     long scrambles; here goes the first part.
   */
-  strmake(mysql->scramble, end, SCRAMBLE_LENGTH_323);
-  end+=3D SCRAMBLE_LENGTH_323+1;
+  scramble_data=3D end;
+  scramble_data_len=3D SCRAMBLE_LENGTH_323 + 1;
+  end+=3D scramble_data_len;
=20
-  if (pkt_length >=3D (uint) (end+1 - (char*) net->read_pos))
+  if (pkt_end >=3D end + 1)
     mysql->server_capabilities=3Duint2korr(end);
-  if (pkt_length >=3D (uint) (end+18 - (char*) net->read_pos))
+  if (pkt_end >=3D end + 18)
   {
     /* New protocol with 16 bytes to describe server characteristics */
     mysql->server_language=3Dend[2];
     mysql->server_status=3Duint2korr(end+3);
+    mysql->server_capabilities|=3D uint2korr(end+5) << 16;
   }
   end+=3D 18;
-  if (pkt_length >=3D (uint) (end + SCRAMBLE_LENGTH - SCRAMBLE_LENGTH_323 =
+ 1 -=20
-                           (char *) net->read_pos))
-    strmake(mysql->scramble+SCRAMBLE_LENGTH_323, end,
-            SCRAMBLE_LENGTH-SCRAMBLE_LENGTH_323);
-  else
-    mysql->server_capabilities&=3D ~CLIENT_SECURE_CONNECTION;
=20
   if (mysql->options.secure_auth && passwd[0] &&
       !(mysql->server_capabilities & CLIENT_SECURE_CONNECTION))
@@ -2236,7 +2821,7 @@
 		       &mysql->unix_socket,unix_socket ?
 		       (uint) strlen(unix_socket)+1 : (uint) 1,
 		       &mysql->server_version,
-		       (uint) (end - (char*) net->read_pos),
+		       (uint) (server_version_end - (char*) net->read_pos + 1),
 		       NullS) ||
       !(mysql->user=3Dmy_strdup(user,MYF(0))) ||
       !(mysql->passwd=3Dmy_strdup(passwd,MYF(0))))
@@ -2253,203 +2838,35 @@
   strmov(mysql->server_version,(char*) net->read_pos+1);
   mysql->port=3Dport;
=20
-  /*
-    Part 2: format and send client info to the server for access check
-  */
- =20
-  client_flag|=3Dmysql->options.client_flag;
-  client_flag|=3DCLIENT_CAPABILITIES;
-  if (client_flag & CLIENT_MULTI_STATEMENTS)
-    client_flag|=3D CLIENT_MULTI_RESULTS;
-
-#ifdef HAVE_OPENSSL
-  if (mysql->options.ssl_key || mysql->options.ssl_cert ||
-      mysql->options.ssl_ca || mysql->options.ssl_capath ||
-      mysql->options.ssl_cipher)
-    mysql->options.use_ssl=3D 1;
-  if (mysql->options.use_ssl)
-    client_flag|=3DCLIENT_SSL;
-#endif /* HAVE_OPENSSL */
-  if (db)
-    client_flag|=3DCLIENT_CONNECT_WITH_DB;
-
-  /* Remove options that server doesn't support */
-  client_flag=3D ((client_flag &
-		 ~(CLIENT_COMPRESS | CLIENT_SSL | CLIENT_PROTOCOL_41)) |
-		(client_flag & mysql->server_capabilities));
-#ifndef HAVE_COMPRESS
-  client_flag&=3D ~CLIENT_COMPRESS;
-#endif
-
-  if (client_flag & CLIENT_PROTOCOL_41)
-  {
-    /* 4.1 server and 4.1 client has a 32 byte option flag */
-    int4store(buff,client_flag);
-    int4store(buff+4, net->max_packet_size);
-    buff[8]=3D (char) mysql->charset->number;
-    bzero(buff+9, 32-9);
-    end=3D buff+32;
-  }
-  else
-  {
-    int2store(buff,client_flag);
-    int3store(buff+2,net->max_packet_size);
-    end=3D buff+5;
-  }
-  mysql->client_flag=3Dclient_flag;
-
-#ifdef HAVE_OPENSSL
-  if (client_flag & CLIENT_SSL)
-  {
-    /* Do the SSL layering. */
-    struct st_mysql_options *options=3D &mysql->options;
-    struct st_VioSSLFd *ssl_fd;
-
-    /*
-      Send client_flag, max_packet_size - unencrypted otherwise
-      the server does not know we want to do SSL
-    */
-    if (my_net_write(net, (uchar*) buff, (uint) (end-buff)) || net_flush(n=
et))
-    {
-      set_mysql_extended_error(mysql, CR_SERVER_LOST, unknown_sqlstate,
-                               ER(CR_SERVER_LOST_EXTENDED),
-                               "sending connection information to server",
-                               errno);
-      goto error;
-    }
-
-    /* Create the VioSSLConnectorFd - init SSL and load certs */
-    if (!(ssl_fd=3D new_VioSSLConnectorFd(options->ssl_key,
-                                        options->ssl_cert,
-                                        options->ssl_ca,
-                                        options->ssl_capath,
-                                        options->ssl_cipher)))
-    {
-      set_mysql_error(mysql, CR_SSL_CONNECTION_ERROR, unknown_sqlstate);
-      goto error;
-    }
-    mysql->connector_fd=3D (void*)ssl_fd;
-
-    /* Connect to the server */
-    DBUG_PRINT("info", ("IO layer change in progress..."));
-    if (sslconnect(ssl_fd, mysql->net.vio,
-                   (long) (mysql->options.connect_timeout),
-                   error_string))
-    {
-      set_mysql_extended_error(mysql, CR_SSL_CONNECTION_ERROR,
-                               unknown_sqlstate,
-                               "SSL error: %s",
-                               error_string[0] ? error_string :
-                               ER(CR_SSL_CONNECTION_ERROR));
-      goto error;
-    }
-    DBUG_PRINT("info", ("IO layer change done!"));
-
-    /* Verify server cert */
-    if ((client_flag & CLIENT_SSL_VERIFY_SERVER_CERT) &&
-        ssl_verify_server_cert(mysql->net.vio, mysql->host))
-    {
-      set_mysql_error(mysql, CR_SSL_CONNECTION_ERROR, unknown_sqlstate);
-      goto error;
-    }
-
-  }
-#endif /* HAVE_OPENSSL */
-
-  DBUG_PRINT("info",("Server version =3D '%s'  capabilites: %lu  status: %=
u  client_flag: %lu",
-		     mysql->server_version,mysql->server_capabilities,
-		     mysql->server_status, client_flag));
-  /* This needs to be changed as it's not useful with big packets */
-  if (user && user[0])
-    strmake(end,user,USERNAME_LENGTH);          /* Max user name */
-  else
-    read_user_name((char*) end);
-
-  /* We have to handle different version of handshake here */
-#ifdef _CUSTOMCONFIG_
-#include "_cust_libmysql.h"
-#endif
-  DBUG_PRINT("info",("user: %s",end));
-  end=3D strend(end) + 1;
-  if (passwd[0])
-  {
-    if (mysql->server_capabilities & CLIENT_SECURE_CONNECTION)
-    {
-      *end++=3D SCRAMBLE_LENGTH;
-      scramble(end, mysql->scramble, passwd);
-      end+=3D SCRAMBLE_LENGTH;
-    }
-    else
-    {
-      scramble_323(end, mysql->scramble, passwd);
-      end+=3D SCRAMBLE_LENGTH_323 + 1;
-    }
-  }
-  else
-    *end++=3D '\0';                               /* empty password */
-
-  /* Add database if needed */
-  if (db && (mysql->server_capabilities & CLIENT_CONNECT_WITH_DB))
-  {
-    end=3D strmake(end, db, NAME_LEN) + 1;
-    mysql->db=3D my_strdup(db,MYF(MY_WME));
-    db=3D 0;
-  }
-  /* Write authentication package */
-  if (my_net_write(net, (uchar*) buff, (size_t) (end-buff)) || net_flush(n=
et))
-  {
-    set_mysql_extended_error(mysql, CR_SERVER_LOST, unknown_sqlstate,
-                             ER(CR_SERVER_LOST_EXTENDED),
-                             "sending authentication information",
-                             errno);
-    goto error;
-  }
- =20
-  /*
-    Part 3: Authorization data's been sent. Now server can reply with
-    OK-packet, or re-request scrambled password.
-  */
-
-  if ((pkt_length=3Dcli_safe_read(mysql)) =3D=3D packet_error)
-  {
-    if (mysql->net.last_errno =3D=3D CR_SERVER_LOST)
-      set_mysql_extended_error(mysql, CR_SERVER_LOST, unknown_sqlstate,
-                               ER(CR_SERVER_LOST_EXTENDED),
-                               "reading authorization packet",
-                               errno);
-    goto error;
-  }
-
-  if (pkt_length =3D=3D 1 && net->read_pos[0] =3D=3D 254 &&=20
-      mysql->server_capabilities & CLIENT_SECURE_CONNECTION)
-  {
-    /*
-      By sending this very specific reply server asks us to send scrambled
-      password in old format.
-    */
-    scramble_323(buff, mysql->scramble, passwd);
-    if (my_net_write(net, (uchar*) buff, SCRAMBLE_LENGTH_323 + 1) ||
-        net_flush(net))
-    {
-      set_mysql_extended_error(mysql, CR_SERVER_LOST, unknown_sqlstate,
-                               ER(CR_SERVER_LOST_EXTENDED),
-                               "sending password information",
-                               errno);
-      goto error;
-    }
-    /* Read what server thinks about out new auth message report */
-    if (cli_safe_read(mysql) =3D=3D packet_error)
-    {
-      if (mysql->net.last_errno =3D=3D CR_SERVER_LOST)
-        set_mysql_extended_error(mysql, CR_SERVER_LOST, unknown_sqlstate,
-                                 ER(CR_SERVER_LOST_EXTENDED),
-                                 "reading final connect information",
-                                 errno);
-      goto error;
-    }
-  }
-
-  if (client_flag & CLIENT_COMPRESS)		/* We will use compression */
+  if (pkt_end >=3D end + SCRAMBLE_LENGTH - SCRAMBLE_LENGTH_323 + 1)
+  {
+    /*
+     move the first scramble part - directly in the NET buffer -
+     to get a full continuous scramble. We've read all the header,
+     and can overwrite it now.
+    */
+    memmove(end - SCRAMBLE_LENGTH_323, scramble_data,
+            SCRAMBLE_LENGTH_323);
+    scramble_data=3D end - SCRAMBLE_LENGTH_323;
+    scramble_data_len=3D pkt_end - scramble_data;
+  }
+  else
+    mysql->server_capabilities&=3D ~CLIENT_SECURE_CONNECTION;
+
+  mysql->client_flag=3D client_flag;
+
+  /*
+    Part 2: invoke the plugin to send the authentication data to the server
+  */
+
+  if (run_plugin_auth(mysql, scramble_data, scramble_data_len, db))
+    goto error;
+
+  /*
+    Part 3: authenticated, finish the initialization of the connection
+  */
+
+  if (mysql->client_flag & CLIENT_COMPRESS)      /* We will use compressio=
n */
     net->compress=3D1;
=20
 #ifdef CHECK_LICENSE=20
@@ -2457,7 +2874,7 @@
     goto error;
 #endif
=20
-  if (db && mysql_select_db(mysql, db))
+  if (db && !mysql->db && mysql_select_db(mysql, db))
   {
     if (mysql->net.last_errno =3D=3D CR_SERVER_LOST)
         set_mysql_extended_error(mysql, CR_SERVER_LOST, unknown_sqlstate,
@@ -2510,7 +2927,7 @@
     /* Free alloced memory */
     end_server(mysql);
     mysql_close_free(mysql);
-    if (!(((ulong) client_flag) & CLIENT_REMEMBER_OPTIONS))
+    if (!(client_flag & CLIENT_REMEMBER_OPTIONS))
       mysql_close_free_options(mysql);
   }
   DBUG_RETURN(0);
@@ -2655,6 +3072,12 @@
   if (mysql->options.shared_memory_base_name !=3D def_shared_memory_base_n=
ame)
     my_free(mysql->options.shared_memory_base_name,MYF(MY_ALLOW_ZERO_PTR));
 #endif /* HAVE_SMEM */
+  if (mysql->options.extension)
+  {
+    my_free(mysql->options.extension->plugin_dir,MYF(MY_ALLOW_ZERO_PTR));
+    my_free(mysql->options.extension->default_auth,MYF(MY_ALLOW_ZERO_PTR));
+    my_free(mysql->options.extension,MYF(0));
+  }
   bzero((char*) &mysql->options,sizeof(mysql->options));
   DBUG_VOID_RETURN;
 }
@@ -3185,6 +3608,14 @@
     else
       mysql->options.client_flag&=3D ~CLIENT_SSL_VERIFY_SERVER_CERT;
     break;
+  case MYSQL_PLUGIN_DIR:
+    extension_free(&mysql->options, plugin_dir);
+    mysql->options.extension->plugin_dir=3D my_strdup(arg, MYF(MY_WME));
+    break;
+  case MYSQL_DEFAULT_AUTH:
+    extension_free(&mysql->options, default_auth);
+    mysql->options.extension->default_auth=3D my_strdup(arg, MYF(MY_WME));
+    break;
   default:
     DBUG_RETURN(1);
   }
@@ -3292,4 +3723,130 @@
   return mysql->net.last_errno;
 }
=20
+/**
+  client authentication plugin that does native MySQL authentication
+  using a 20-byte (4.1+) scramble
+*/
+static int native_password_auth_client(MYSQL_PLUGIN_VIO *vio, MYSQL *mysql)
+{
+  /* read the scramble */
+  uchar *pkt;
+  int pkt_len=3D vio->read_packet(vio, &pkt);
+
+  if (pkt_len < 0)
+    return CR_ERROR;
+
+  if (pkt =3D=3D 0)
+  {
+    /*
+      in mysql_change_user() the client sends the first packet, so
+      the first vio->read_packet() does nothing (pkt =3D=3D 0).
+      we use the old scramble.
+    */
+    pkt=3D mysql->scramble;
+    pkt_len=3D SCRAMBLE_LENGTH + 1;
+  }
+  else
+  {
+    if (pkt_len !=3D SCRAMBLE_LENGTH + 1)
+      return CR_SERVER_HANDSHAKE_ERR;
+    /* save it in MYSQL */
+    memcpy(mysql->scramble, pkt, SCRAMBLE_LENGTH);
+    mysql->scramble[SCRAMBLE_LENGTH] =3D 0;
+  }
+
+  if (mysql->passwd[0])
+  {
+    char scrambled[SCRAMBLE_LENGTH + 1];
+    scramble(scrambled, (char*)pkt, mysql->passwd);
+    if (vio->write_packet(vio, (uchar*)scrambled, SCRAMBLE_LENGTH))
+      return CR_ERROR;
+  }
+  else
+    if (vio->write_packet(vio, 0, 0)) /* no password */
+      return CR_ERROR;
+
+  return CR_OK;
+}
+
+/**
+  client authentication plugin that does old MySQL authentication
+  using an 8-byte (4.0-) scramble
+*/
+static int old_password_auth_client(MYSQL_PLUGIN_VIO *vio, MYSQL *mysql)
+{
+  /* read the scramble */
+  uchar *pkt;
+  int pkt_len=3D vio->read_packet(vio, &pkt);
+
+  if (pkt_len < 0)
+    return CR_ERROR;
+
+  if (pkt =3D=3D 0)
+  {
+    /*
+      in mysql_change_user() the client sends the first packet, so
+      the first vio->read_packet() does nothing (pkt =3D=3D 0).
+      we use the old scramble.
+    */
+    pkt=3D mysql->scramble;
+    pkt_len=3D SCRAMBLE_LENGTH_323 + 1;
+  }
+  else
+  {
+    if (pkt_len !=3D SCRAMBLE_LENGTH_323 + 1 &&
+        pkt_len !=3D SCRAMBLE_LENGTH + 1)
+        return CR_SERVER_HANDSHAKE_ERR;
+
+    /* save it in MYSQL */
+    memcpy(mysql->scramble, pkt, pkt_len);
+    mysql->scramble[pkt_len] =3D 0;
+  }
+
+  if (mysql->passwd[0])
+  {
+    char scrambled[SCRAMBLE_LENGTH_323 + 1];
+    scramble_323(scrambled, (char*)pkt, mysql->passwd);
+    if (vio->write_packet(vio, (uchar*)scrambled, SCRAMBLE_LENGTH_323 + 1))
+      return CR_ERROR;
+  }
+  else
+    if (vio->write_packet(vio, 0, 0)) /* no password */
+      return CR_ERROR;
+
+  return CR_OK;
+}
+
+static auth_plugin_t native_password_client_plugin=3D
+{
+  MYSQL_CLIENT_AUTHENTICATION_PLUGIN,
+  MYSQL_CLIENT_AUTHENTICATION_PLUGIN_INTERFACE_VERSION,
+  native_password_plugin_name,
+  "R.J.Silk, Sergei Golubchik",
+  "Native MySQL authentication",
+  {1, 0, 0},
+  NULL,
+  NULL,
+  native_password_auth_client
+};
+
+static auth_plugin_t old_password_client_plugin=3D
+{
+  MYSQL_CLIENT_AUTHENTICATION_PLUGIN,
+  MYSQL_CLIENT_AUTHENTICATION_PLUGIN_INTERFACE_VERSION,
+  old_password_plugin_name,
+  "R.J.Silk, Sergei Golubchik",
+  "Old MySQL-3.23 authentication",
+  {1, 0, 0},
+  NULL,
+  NULL,
+  old_password_auth_client
+};
+
+struct st_mysql_client_plugin *mysql_client_builtins[]=3D
+{
+  (struct st_mysql_client_plugin *)&native_password_client_plugin,
+  (struct st_mysql_client_plugin *)&old_password_client_plugin,
+  0
+};
=20

=3D=3D=3D added file 'sql-common/client_plugin.c'
--- sql-common/client_plugin.c	1970-01-01 00:00:00 +0000
+++ sql-common/client_plugin.c	2010-02-19 08:18:09 +0000
@@ -0,0 +1,427 @@
+/* Copyright (C) 2010 Monty Program Ab
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  U=
SA */
+
+/**
+  @file
+ =20
+  Support code for the client side (libmysql) plugins
+
+  Client plugins are somewhat different from server plugins, they are simp=
ler.
+
+  They do not need to be installed or in any way explicitly loaded on the
+  client, they are loaded automatically on demand.
+  One client plugin per shared object, soname *must* match the plugin name.
+
+  There is no reference counting and no unloading either.
+*/
+
+#include <my_global.h>
+#include "mysql.h"
+#include <my_sys.h>
+#include <m_string.h>
+#ifdef THREAD
+#include <my_pthread.h>
+#else
+#include <my_no_pthread.h>
+#endif
+
+#include <sql_common.h>
+#include "errmsg.h"
+#include <mysql/client_plugin.h>
+
+struct st_client_plugin_int {
+  struct st_client_plugin_int *next;
+  void   *dlhandle;
+  struct st_mysql_client_plugin *plugin;
+};
+
+static my_bool initialized=3D 0;
+static MEM_ROOT mem_root;
+
+static const char *plugin_declarations_sym=3D "_mysql_client_plugin_declar=
ation_";
+static uint plugin_version[MYSQL_CLIENT_MAX_PLUGINS]=3D
+{
+  0, /* these two are taken by Connector/C */
+  0, /* these two are taken by Connector/C */
+  MYSQL_CLIENT_AUTHENTICATION_PLUGIN_INTERFACE_VERSION
+};
+
+/*
+  Loaded plugins are stored in a linked list.
+  The list is append-only, the elements are added to the head (like in a s=
tack).
+  The elements are added under a mutex, but the list can be read and trave=
rsed
+  without any mutex because once an element is added to the list, it stays
+  there. The main purpose of a mutex is to prevent two threads from
+  loading the same plugin twice in parallel.
+*/
+struct st_client_plugin_int *plugin_list[MYSQL_CLIENT_MAX_PLUGINS];
+#ifdef THREAD
+static pthread_mutex_t LOCK_load_client_plugin;
+#endif
+
+static int is_not_initialized(MYSQL *mysql, const char *name)
+{
+  if (initialized)
+    return 0;
+
+  set_mysql_extended_error(mysql, CR_AUTH_PLUGIN_CANNOT_LOAD,
+                           unknown_sqlstate, ER(CR_AUTH_PLUGIN_CANNOT_LOAD=
),
+                           name, "not initialized");
+  return 1;
+}
+
+/**
+  finds a plugin in the list
+
+  @param name   plugin name to search for
+  @param type   plugin type
+
+  @note this does NOT necessarily need a mutex, take care!
+ =20
+  @retval a pointer to a found plugin or 0
+*/
+static struct st_mysql_client_plugin *
+find_plugin(const char *name, int type)
+{
+  struct st_client_plugin_int *p;
+
+  DBUG_ASSERT(initialized);
+  DBUG_ASSERT(type >=3D 0 && type < MYSQL_CLIENT_MAX_PLUGINS);
+  if (type < 0 || type >=3D MYSQL_CLIENT_MAX_PLUGINS)
+    return 0;
+
+  for (p=3D plugin_list[type]; p; p=3D p->next)
+  {
+    if (strcmp(p->plugin->name, name) =3D=3D 0)
+      return p->plugin;
+  }
+  return NULL;
+}
+
+/**
+  verifies the plugin and adds it to the list
+
+  @param mysql          MYSQL structure (for error reporting)
+  @param plugin         plugin to install
+  @param dlhandle       a handle to the shared object (returned by dlopen)
+                        or 0 if the plugin was not dynamically loaded
+  @param argc           number of arguments in the 'va_list args'
+  @param args           arguments passed to the plugin initialization func=
tion
+
+  @retval a pointer to an installed plugin or 0
+*/
+static struct st_mysql_client_plugin *
+add_plugin(MYSQL *mysql, struct st_mysql_client_plugin *plugin, void *dlha=
ndle,
+           int argc, va_list args)
+{
+  const char *errmsg;
+  struct st_client_plugin_int plugin_int, *p;
+  char errbuf[1024];
+
+  DBUG_ASSERT(initialized);
+
+  plugin_int.plugin=3D plugin;
+  plugin_int.dlhandle=3D dlhandle;
+
+  if (plugin->type >=3D MYSQL_CLIENT_MAX_PLUGINS)
+  {
+    errmsg=3D "Unknown client plugin type";
+    goto err1;
+  }
+
+  if (plugin->interface_version < plugin_version[plugin->type] ||
+      (plugin->interface_version >> 8) >
+       (plugin_version[plugin->type] >> 8))
+  {
+    errmsg=3D "Incompatible client plugin interface";
+    goto err1;
+  }
+
+  /* Call the plugin initialization function, if any */
+  if (plugin->init && plugin->init(errbuf, sizeof(errbuf), argc, args))
+  {
+    errmsg=3D errbuf;
+    goto err1;
+  }
+
+  p=3D (struct st_client_plugin_int *)
+    memdup_root(&mem_root, &plugin_int, sizeof(plugin_int));
+
+  if (!p)
+  {
+    errmsg=3D "Out of memory";
+    goto err2;
+  }
+
+  safe_mutex_assert_owner(&LOCK_load_client_plugin);
+
+  p->next=3D plugin_list[plugin->type];
+  plugin_list[plugin->type]=3D p;
+
+  return plugin;
+
+err2:
+  if (plugin->deinit)
+    plugin->deinit();
+err1:
+  if (dlhandle)
+    dlclose(dlhandle);
+  set_mysql_extended_error(mysql, CR_AUTH_PLUGIN_CANNOT_LOAD, unknown_sqls=
tate,
+                           ER(CR_AUTH_PLUGIN_CANNOT_LOAD), plugin->name,
+                           errmsg);
+  return NULL;
+}
+
+/**
+  Loads plugins which are specified in the environment variable
+  LIBMYSQL_PLUGINS.
+ =20
+  Multiple plugins must be separated by semicolon. This function doesn't
+  return or log an error.
+
+  The function is be called by mysql_client_plugin_init
+
+  @todo
+  Support extended syntax, passing parameters to plugins, for example
+  LIBMYSQL_PLUGINS=3D"plugin1(param1,param2);plugin2;..."
+  or
+  LIBMYSQL_PLUGINS=3D"plugin1=3Dint:param1,str:param2;plugin2;..."
+*/
+static void load_env_plugins(MYSQL *mysql)
+{
+  char *plugs, *free_env, *s=3D getenv("LIBMYSQL_PLUGINS");
+
+  /* no plugins to load */
+  if(!s)
+    return;
+
+  free_env=3D plugs=3D my_strdup(s, MYF(MY_WME));
+  s=3D NULL;
+
+  do {
+    if ((s=3D strchr(plugs, ';')))
+      *s=3D '\0';
+    mysql_load_plugin(mysql, plugs, -1, 0);
+    if(s)
+      plugs=3D ++s;
+  } while (s);
+
+  my_free(free_env, MYF(0));
+}
+
+/********** extern functions to be used by libmysql *********************/
+
+/**
+  Initializes the client plugin layer.
+
+  This function must be called before any other client plugin function.
+
+  @retval 0    successful
+  @retval !=3D 0 error occured
+*/
+int mysql_client_plugin_init()
+{
+  MYSQL mysql;
+  struct st_mysql_client_plugin **builtin;
+
+  if (initialized)
+    return 0;
+
+  bzero(&mysql, sizeof(mysql)); /* dummy mysql for set_mysql_extended_erro=
r */
+
+  pthread_mutex_init(&LOCK_load_client_plugin, MY_MUTEX_INIT_SLOW);
+  init_alloc_root(&mem_root, 128, 128);
+
+  bzero(&plugin_list, sizeof(plugin_list));
+
+  initialized=3D 1;
+
+  pthread_mutex_lock(&LOCK_load_client_plugin);
+
+  for (builtin=3D mysql_client_builtins; *builtin; builtin++)
+    add_plugin(&mysql, *builtin, 0, 0, 0);
+
+  pthread_mutex_unlock(&LOCK_load_client_plugin);
+
+  load_env_plugins(&mysql);
+
+  return 0;
+}
+
+/**
+  Deinitializes the client plugin layer.
+
+  Unloades all client plugins and frees any associated resources.
+*/
+void mysql_client_plugin_deinit()
+{
+  int i;
+  struct st_client_plugin_int *p;
+
+  if (!initialized)
+    return;
+
+  for (i=3D0; i < MYSQL_CLIENT_MAX_PLUGINS; i++)
+    for (p=3D plugin_list[i]; p; p=3D p->next)
+    {
+      if (p->plugin->deinit)
+        p->plugin->deinit();
+      if (p->dlhandle)
+        dlclose(p->dlhandle);
+    }
+
+  bzero(&plugin_list, sizeof(plugin_list));
+  initialized=3D 0;
+  free_root(&mem_root, MYF(0));
+  pthread_mutex_destroy(&LOCK_load_client_plugin);
+}
+
+/************* public facing functions, for client consumption *********/
+
+/* see <mysql/client_plugin.h> for a full description */
+struct st_mysql_client_plugin *
+mysql_client_register_plugin(MYSQL *mysql,
+                             struct st_mysql_client_plugin *plugin)
+{
+  if (is_not_initialized(mysql, plugin->name))
+    return NULL;
+
+  pthread_mutex_lock(&LOCK_load_client_plugin);
+
+  /* make sure the plugin wasn't loaded meanwhile */
+  if (find_plugin(plugin->name, plugin->type))
+  {
+    set_mysql_extended_error(mysql, CR_AUTH_PLUGIN_CANNOT_LOAD,
+                             unknown_sqlstate, ER(CR_AUTH_PLUGIN_CANNOT_LO=
AD),
+                             plugin->name, "it is already loaded");
+    plugin=3D NULL;
+  }
+  else
+    plugin=3D add_plugin(mysql, plugin, 0, 0, 0);
+
+  pthread_mutex_unlock(&LOCK_load_client_plugin);
+  return plugin;
+}
+
+/* see <mysql/client_plugin.h> for a full description */
+struct st_mysql_client_plugin *
+mysql_load_plugin_v(MYSQL *mysql, const char *name, int type,
+                    int argc, va_list args)
+{
+  const char *errmsg;
+  char dlpath[FN_REFLEN+1];
+  void *sym, *dlhandle;
+  struct st_mysql_client_plugin *plugin;
+
+  if (is_not_initialized(mysql, name))
+    return NULL;
+
+  pthread_mutex_lock(&LOCK_load_client_plugin);
+
+  /* make sure the plugin wasn't loaded meanwhile */
+  if (type >=3D 0 && find_plugin(name, type))
+  {
+    errmsg=3D "it is already loaded";
+    goto err;
+  }
+
+  /* Compile dll path */
+  strxnmov(dlpath, sizeof(dlpath) - 1,
+           mysql->options.extension &&
mysql->options.extension->plugin_di=
r ?
+           mysql->options.extension->plugin_dir : PLUGINDIR, "/",
+           name, SO_EXT, NullS);
+  =20
+  /* Open new dll handle */
+  if (!(dlhandle=3D dlopen(dlpath, RTLD_NOW)))
+  {
+    errmsg=3D dlerror();
+    goto err;
+  }
+
+  if (!(sym=3D dlsym(dlhandle, plugin_declarations_sym)))
+  {
+    errmsg=3D "not a plugin";
+    dlclose(dlhandle);
+    goto err;
+  }
+
+  plugin=3D (struct st_mysql_client_plugin*)sym;
+
+  if (type >=3D0 && type !=3D plugin->type)
+  {
+    errmsg=3D "type mismatch";
+    goto err;
+  }
+
+  if (strcmp(name, plugin->name))
+  {
+    errmsg=3D "name mismatch";
+    goto err;
+  }
+
+  if (type < 0 && find_plugin(name, plugin->type))
+  {
+    errmsg=3D "it is already loaded";
+    goto err;
+  }
+
+  plugin=3D add_plugin(mysql, plugin, dlhandle, argc, args);
+
+  pthread_mutex_unlock(&LOCK_load_client_plugin);
+
+  return plugin;
+
+err:
+  pthread_mutex_unlock(&LOCK_load_client_plugin);
+  set_mysql_extended_error(mysql, CR_AUTH_PLUGIN_CANNOT_LOAD, unknown_sqls=
tate,
+                           ER(CR_AUTH_PLUGIN_CANNOT_LOAD), name, errmsg);
+  return NULL;
+}
+
+/* see <mysql/client_plugin.h> for a full description */
+struct st_mysql_client_plugin *
+mysql_load_plugin(MYSQL *mysql, const char *name, int type, int argc, ...)
+{
+  struct st_mysql_client_plugin *p;
+  va_list args;
+  va_start(args, argc);
+  p=3D mysql_load_plugin_v(mysql, name, type, argc, args);
+  va_end(args);
+  return p;
+}
+
+/* see <mysql/client_plugin.h> for a full description */
+struct st_mysql_client_plugin *
+mysql_client_find_plugin(MYSQL *mysql, const char *name, int type)
+{
+  struct st_mysql_client_plugin *p;
+
+  if (is_not_initialized(mysql, name))
+    return NULL;
+
+  if (type < 0 || type >=3D MYSQL_CLIENT_MAX_PLUGINS)
+  {
+    set_mysql_extended_error(mysql, CR_AUTH_PLUGIN_CANNOT_LOAD, unknown_sq=
lstate,
+                             ER(CR_AUTH_PLUGIN_CANNOT_LOAD), name,
+                             "invalid type");
+  }
+
+  if ((p=3D find_plugin(name, type)))
+    return p;
+
+  /* not found, load it */
+  return mysql_load_plugin(mysql, name, type, 0);
+}
+

=3D=3D=3D modified file 'sql/CMakeLists.txt'
--- sql/CMakeLists.txt	2010-01-29 18:42:22 +0000
+++ sql/CMakeLists.txt	2010-02-19 08:18:09 +0000
@@ -54,7 +54,7 @@
                log_event.cc rpl_record.cc rpl_reporting.cc
                log_event_old.cc rpl_record_old.cc
                message.h mf_iocache.cc my_decimal.cc ../sql-common/my_time=
=2Ec
-               mysqld.cc net_serv.cc=20
+               mysqld.cc net_serv.cc ../sql-common/client_plugin.c=20
                nt_servc.cc nt_servc.h opt_range.cc opt_range.h opt_sum.cc=
=20
                ../sql-common/pack.c parse_file.cc password.c procedure.cc=
=20
                protocol.cc records.cc repl_failsafe.cc rpl_filter.cc set_v=
ar.cc=20

=3D=3D=3D modified file 'sql/Makefile.am'
--- sql/Makefile.am	2009-12-03 11:19:05 +0000
+++ sql/Makefile.am	2010-02-19 08:18:09 +0000
@@ -126,7 +126,7 @@
 			sql_servers.cc event_parse_data.cc \
                         opt_table_elimination.cc
=20
-nodist_mysqld_SOURCES =3D	mini_client_errors.c pack.c client.c my_time.c m=
y_user.c=20
+nodist_mysqld_SOURCES =3D	mini_client_errors.c pack.c client.c my_time.c m=
y_user.c client_plugin.c
=20
 libndb_la_CPPFLAGS=3D	@ndbcluster_includes@
 libndb_la_SOURCES=3D	ha_ndbcluster.cc \
@@ -140,10 +140,10 @@
 mysql_tzinfo_to_sql_CXXFLAGS=3D -DTZINFO2SQL
=20
 DEFS =3D			-DMYSQL_SERVER \
-			-DDEFAULT_MYSQL_HOME=3D"\"$(MYSQLBASEdir)\"" \
-			-DMYSQL_DATADIR=3D"\"$(MYSQLDATAdir)\"" \
-			-DSHAREDIR=3D"\"$(MYSQLSHAREdir)\"" \
-			-DPLUGINDIR=3D"\"$(pkgplugindir)\"" \
+			-DDEFAULT_MYSQL_HOME=3D'"$(MYSQLBASEdir)"' \
+			-DMYSQL_DATADIR=3D'"$(MYSQLDATAdir)"' \
+			-DSHAREDIR=3D'"$(MYSQLSHAREdir)"' \
+			-DPLUGINDIR=3D'"$(pkgplugindir)"' \
 			-DHAVE_EVENT_SCHEDULER \
 			@DEFS@
=20
@@ -167,6 +167,8 @@
 	@LN_CP_F@ $(top_srcdir)/sql-common/pack.c pack.c
 	rm -f client.c
 	@LN_CP_F@ $(top_srcdir)/sql-common/client.c client.c
+	rm -f client_plugin.c
+	@LN_CP_F@ $(top_srcdir)/sql-common/client_plugin.c client_plugin.c
 	rm -f my_time.c
 	@LN_CP_F@ $(top_srcdir)/sql-common/my_time.c my_time.c
 	rm -f my_user.c

=3D=3D=3D modified file 'sql/client_settings.h'
--- sql/client_settings.h	2009-08-13 20:07:20 +0000
+++ sql/client_settings.h	2010-02-19 08:18:09 +0000
@@ -15,6 +15,7 @@
=20
=20
 #include <thr_alarm.h>
+#include <sql_common.h>
=20
 #define CLIENT_CAPABILITIES (CLIENT_LONG_PASSWORD | CLIENT_LONG_FLAG |	  \
                              CLIENT_SECURE_CONNECTION | CLIENT_TRANSACTION=
S | \
@@ -31,7 +32,8 @@
 #undef HAVE_SMEM
 #undef _CUSTOMCONFIG_
=20
-#define mysql_server_init(a,b,c) 0
+#define mysql_server_init(a,b,c) mysql_client_plugin_init()
+#define mysql_server_end()       mysql_client_plugin_deinit()
=20
 #ifdef HAVE_REPLICATION
 C_MODE_START

=3D=3D=3D modified file 'sql/ha_ndbcluster.cc'
--- sql/ha_ndbcluster.cc	2010-01-06 21:27:53 +0000
+++ sql/ha_ndbcluster.cc	2010-02-19 08:18:09 +0000
@@ -9185,7 +9185,7 @@
   thd->client_capabilities =3D 0;
   my_net_init(&thd->net, 0);
   thd->main_security_ctx.master_access=3D ~0;
-  thd->main_security_ctx.priv_user =3D 0;
+  thd->main_security_ctx.priv_user[0] =3D 0;
=20
   CHARSET_INFO *charset_connection;
   charset_connection=3D get_charset_by_csname("utf8",

=3D=3D=3D modified file 'sql/ha_ndbcluster_binlog.cc'
--- sql/ha_ndbcluster_binlog.cc	2009-12-03 11:19:05 +0000
+++ sql/ha_ndbcluster_binlog.cc	2010-02-19 08:18:09 +0000
@@ -3681,7 +3681,7 @@
   thd->client_capabilities=3D 0;
   my_net_init(&thd->net, 0);
   thd->main_security_ctx.master_access=3D ~0;
-  thd->main_security_ctx.priv_user=3D 0;
+  thd->main_security_ctx.priv_user[0]=3D 0;
=20
   /*
     Set up ndb binlog

=3D=3D=3D modified file 'sql/lex.h'
--- sql/lex.h	2009-11-12 04:31:28 +0000
+++ sql/lex.h	2010-02-19 08:18:09 +0000
@@ -590,6 +590,7 @@
   { "VARCHARACTER",	SYM(VARCHAR)},
   { "VARIABLES",	SYM(VARIABLES)},
   { "VARYING",		SYM(VARYING)},
+  { "VIA",              SYM(VIA_SYM)},
   { "VIEW",		SYM(VIEW_SYM)},
   { "VIRTUAL",          SYM(VIRTUAL_SYM)},
   { "WAIT",		SYM(WAIT_SYM)},

=3D=3D=3D modified file 'sql/mysql_priv.h'
--- sql/mysql_priv.h	2010-02-12 08:47:31 +0000
+++ sql/mysql_priv.h	2010-02-19 08:18:09 +0000
@@ -1053,9 +1053,6 @@
                    char const *query, ulong query_length);
=20
 /* sql_connect.cc */
-int check_user(THD *thd, enum enum_server_command command,=20
-	       const char *passwd, uint passwd_len, const char *db,
-	       bool check_count);
 pthread_handler_t handle_one_connection(void *arg);
 bool init_new_connection_handler_thread();
 void reset_mqh(LEX_USER *lu, bool get_them);
@@ -1068,6 +1065,9 @@
 void end_connection(THD *thd);
 void prepare_new_connection_state(THD* thd);
 void update_global_user_stats(THD* thd, bool create_user, time_t now);
+int get_or_create_user_conn(THD *thd, const char *user,
+                            const char *host, USER_RESOURCES *mqh);
+int check_for_max_user_connections(THD *thd, USER_CONN *uc);
=20
 int mysql_create_db(THD *thd, char *db, HA_CREATE_INFO *create, bool silen=
t);
 bool mysql_alter_db(THD *thd, const char *db, HA_CREATE_INFO *create);

=3D=3D=3D modified file 'sql/mysqld.cc'
--- sql/mysqld.cc	2010-02-12 08:47:31 +0000
+++ sql/mysqld.cc	2010-02-19 08:18:09 +0000
@@ -22,6 +22,7 @@
 #include "rpl_mi.h"
 #include "sql_repl.h"
 #include "rpl_filter.h"
+#include "client_settings.h"
 #include "repl_failsafe.h"
 #include <my_stacktrace.h>
 #include "mysqld_suffix.h"
@@ -1395,6 +1396,7 @@
   if (print_message && errmesg && server_start_time)
     sql_print_information(ER(ER_SHUTDOWN_COMPLETE),my_progname);
   thread_scheduler.end();
+  mysql_library_end();
   finish_client_errs();
   my_free((uchar*) my_error_unregister(ER_ERROR_FIRST, ER_ERROR_LAST),
           MYF(MY_WME | MY_FAE | MY_ALLOW_ZERO_PTR));
@@ -3487,6 +3489,7 @@
   if (init_errmessage())	/* Read error messages from file */
     return 1;
   init_client_errs();
+  mysql_library_init(un,us,ed); /* for replication */
   lex_init();
   if (item_create_init())
     return 1;

=3D=3D=3D modified file 'sql/password.c'
--- sql/password.c	2009-09-07 20:50:10 +0000
+++ sql/password.c	2010-02-19 08:18:09 +0000
@@ -193,13 +193,13 @@
 */
=20
 my_bool
-check_scramble_323(const char *scrambled, const char *message,
+check_scramble_323(const unsigned char *scrambled, const char *message,
                    ulong *hash_pass)
 {
   struct my_rnd_struct rand_st;
   ulong hash_message[2];
-  char buff[16],*to,extra;                      /* Big enough for check */
-  const char *pos;
+  uchar buff[16],*to,extra;                      /* Big enough for check */
+  const uchar *pos;
=20
   hash_password(hash_message, message, SCRAMBLE_LENGTH_323);
   my_rnd_init(&rand_st,hash_pass[0] ^ hash_message[0],
@@ -214,7 +214,7 @@
   to=3Dbuff;
   while (*scrambled)
   {
-    if (*scrambled++ !=3D (char) (*to++ ^ extra))
+    if (*scrambled++ !=3D (uchar) (*to++ ^ extra))
       return 1;                                 /* Wrong password */
   }
   return 0;
@@ -481,7 +481,7 @@
 */
=20
 my_bool
-check_scramble(const char *scramble_arg, const char *message,
+check_scramble(const uchar *scramble_arg, const char *message,
                const uint8 *hash_stage2)
 {
   SHA1_CONTEXT sha1_context;
@@ -494,7 +494,7 @@
   mysql_sha1_input(&sha1_context, hash_stage2, SHA1_HASH_SIZE);
   mysql_sha1_result(&sha1_context, buf);
   /* encrypt scramble */
-    my_crypt((char *) buf, buf, (const uchar *) scramble_arg, SCRAMBLE_LEN=
GTH);
+    my_crypt((char *) buf, buf, scramble_arg, SCRAMBLE_LENGTH);
   /* now buf supposedly contains hash_stage1: so we can get hash_stage2 */
   mysql_sha1_reset(&sha1_context);
   mysql_sha1_input(&sha1_context, buf, SHA1_HASH_SIZE);

=3D=3D=3D modified file 'sql/protocol.cc'
--- sql/protocol.cc	2009-12-03 11:19:05 +0000
+++ sql/protocol.cc	2010-02-19 08:18:09 +0000
@@ -341,24 +341,6 @@
 }
=20
 /**
-  Please client to send scrambled_password in old format.
-    =20
-  @param thd thread handle
-
-  @retval
-    0  ok
-  @retval
-   !0  error
-*/
-
-bool send_old_password_request(THD *thd)
-{
-  NET *net=3D &thd->net;
-  return my_net_write(net, eof_buff, 1) || net_flush(net);
-}
-
-
-/**
   @param thd Thread handler
   @param sql_errno The error code to send
   @param err A pointer to the error message

=3D=3D=3D modified file 'sql/protocol.h'
--- sql/protocol.h	2009-12-03 11:19:05 +0000
+++ sql/protocol.h	2010-02-19 08:18:09 +0000
@@ -177,7 +177,6 @@
 void send_warning(THD *thd, uint sql_errno, const char *err=3D0);
 bool net_send_error(THD *thd, uint sql_errno=3D0, const char *err=3D0);
 void net_end_statement(THD *thd);
-bool send_old_password_request(THD *thd);
 uchar *net_store_data(uchar *to,const uchar *from, size_t length);
 uchar *net_store_data(uchar *to,int32 from);
 uchar *net_store_data(uchar *to,longlong from);

=3D=3D=3D modified file 'sql/sql_acl.cc'
--- sql/sql_acl.cc	2010-02-01 06:14:12 +0000
+++ sql/sql_acl.cc	2010-02-19 08:18:09 +0000
@@ -30,6 +30,8 @@
 #include <stdarg.h>
 #include "sp_head.h"
 #include "sp.h"
+#include <sql_common.h>
+#include <mysql/plugin_auth.h>
=20
 static const
 TABLE_FIELD_TYPE mysql_db_table_fields[MYSQL_DB_FIELD_COUNT] =3D {
@@ -148,6 +150,84 @@
 const TABLE_FIELD_DEF
   mysql_db_table_def=3D {MYSQL_DB_FIELD_COUNT, mysql_db_table_fields};
=20
+static LEX_STRING native_password_plugin_name=3D {
+  C_STRING_WITH_LEN("mysql_native_password")
+};
+ =20
+static LEX_STRING old_password_plugin_name=3D {
+  C_STRING_WITH_LEN("mysql_old_password")
+};
+ =20
+/// @todo make it configurable
+LEX_STRING *default_auth_plugin_name=3D &native_password_plugin_name;
+
+static plugin_ref native_password_plugin, old_password_plugin;
+
+/* Classes */
+
+struct acl_host_and_ip
+{
+  char *hostname;
+  long ip,ip_mask;                      // Used with masked ip:s
+};
+
+class ACL_ACCESS {
+public:
+  ulong sort;
+  ulong access;
+};
+
+/* ACL_HOST is used if no host is specified */
+
+class ACL_HOST :public ACL_ACCESS
+{
+public:
+  acl_host_and_ip host;
+  char *db;
+};
+
+class ACL_USER :public ACL_ACCESS
+{
+public:
+  acl_host_and_ip host;
+  uint hostname_length;
+  USER_RESOURCES user_resource;
+  char *user;
+  uint8 salt[SCRAMBLE_LENGTH+1];       // scrambled password in binary form
+  uint8 salt_len;        // 0 - no password, 4 - 3.20, 8 - 4.0,  20 - 4.1.=
1=20
+  enum SSL_type ssl_type;
+  const char *ssl_cipher, *x509_issuer, *x509_subject;
+  LEX_STRING plugin;
+  LEX_STRING auth_string;
+
+  ACL_USER *copy(MEM_ROOT *root)
+  {
+    ACL_USER *dst=3D (ACL_USER *)alloc_root(root, sizeof(ACL_USER));
+    if (!dst)
+      return 0;
+    *dst=3D *this;
+    dst->user=3D safe_strdup_root(root, user);
+    dst->ssl_cipher=3D safe_strdup_root(root, ssl_cipher);
+    dst->x509_issuer=3D safe_strdup_root(root, x509_issuer);
+    dst->x509_subject=3D safe_strdup_root(root, x509_subject);
+    if (plugin.str =3D=3D native_password_plugin_name.str ||
+        plugin.str =3D=3D old_password_plugin_name.str)
+      dst->plugin=3D plugin;
+    else
+      dst->plugin.str=3D strmake_root(root, plugin.str, plugin.length);
+    dst->auth_string.str =3D safe_strdup_root(root, auth_string.str);
+    dst->host.hostname=3D safe_strdup_root(root, host.hostname);
+    return dst;
+  }
+};
+
+class ACL_DB :public ACL_ACCESS
+{
+public:
+  acl_host_and_ip host;
+  char *user,*db;
+};
+
 #ifndef NO_EMBEDDED_ACCESS_CHECKS
=20
 #define FIRST_NON_YN_FIELD 26
@@ -171,6 +251,24 @@
 #define IP_ADDR_STRLEN (3+1+3+1+3+1+3)
 #define ACL_KEY_LENGTH (IP_ADDR_STRLEN+1+NAME_LEN+1+USERNAME_LENGTH+1)
=20
+#if defined(HAVE_OPENSSL)
+/*
+  Without SSL the handshake consists of one packet. This packet
+  has both client capabilites and scrambled password.
+  With SSL the handshake might consist of two packets. If the first
+  packet (client capabilities) has CLIENT_SSL flag set, we have to
+  switch to SSL and read the second packet. The scrambled password
+  is in the second packet and client_capabilites field will be ignored.
+  Maybe it is better to accept flags other than CLIENT_SSL from the
+  second packet?
+*/
+#define SSL_HANDSHAKE_SIZE      2
+#define NORMAL_HANDSHAKE_SIZE   6
+#define MIN_HANDSHAKE_SIZE      2
+#else
+#define MIN_HANDSHAKE_SIZE      6
+#endif /* HAVE_OPENSSL && !EMBEDDED_LIBRARY */
+
 static DYNAMIC_ARRAY acl_hosts,acl_users,acl_dbs;
 static MEM_ROOT mem, memex;
 static bool initialized=3D0;
@@ -265,6 +363,19 @@
                            (hash_get_key) acl_entry_get_key,
                            (hash_free_key) free,
                            &my_charset_utf8_bin);
+
+  /*
+    cache built-in native authentication plugins,
+    to avoid hash searches and a global mutex lock on every connect
+  */
+  native_password_plugin=3D my_plugin_lock_by_name(0,
+           &native_password_plugin_name, MYSQL_AUTHENTICATION_PLUGIN);
+  old_password_plugin=3D my_plugin_lock_by_name(0,
+           &old_password_plugin_name, MYSQL_AUTHENTICATION_PLUGIN);
+
+  if (!native_password_plugin || !old_password_plugin)
+    DBUG_RETURN(1);
+
   if (dont_read_acl_tables)
   {
     DBUG_RETURN(0); /* purecov: tested */
@@ -422,6 +533,7 @@
   while (!(read_record_info.read_record(&read_record_info)))
   {
     ACL_USER user;
+    bzero(&user, sizeof(user));
     update_hostname(&user.host, get_field(&mem, table->field[0]));
     user.user=3D get_field(&mem, table->field[1]);
     if (check_no_resolve && hostname_requires_resolving(user.host.hostname=
))
@@ -433,27 +545,34 @@
       continue;
     }
=20
-    const char *password=3D get_field(thd->mem_root, table->field[2]);
+    char *password=3D get_field(thd->mem_root, table->field[2]);
     uint password_len=3D password ? strlen(password) : 0;
+    user.auth_string.str=3D password ? password : const_cast<char*>("");
+    user.auth_string.length=3D password_len;
     set_user_salt(&user, password, password_len);
-    if (user.salt_len =3D=3D 0 && password_len !=3D 0)
-    {
-      switch (password_len) {
-      case 45: /* 4.1: to be removed */
-        sql_print_warning("Found 4.1 style password for user '%s@%s'. "
-                          "Ignoring user. "
-                          "You should change password for this user.",
-                          user.user ? user.user : "",
-                          user.host.hostname ? user.host.hostname : "");
-        break;
-      default:
-        sql_print_warning("Found invalid password for user: '%s@%s'; "
-                          "Ignoring user", user.user ? user.user : "",
-                           user.host.hostname ? user.host.hostname : "");
-        break;
-      }
+
+    switch (password_len) {
+    case 0: /* no password */
+    case SCRAMBLED_PASSWORD_CHAR_LENGTH:
+      user.plugin=3D native_password_plugin_name;
+      break;
+    case SCRAMBLED_PASSWORD_CHAR_LENGTH_323:
+      user.plugin=3D old_password_plugin_name;
+      break;
+    case 45: /* 4.1: to be removed */
+      sql_print_warning("Found 4.1.0 style password for user '%s@%s'. "
+                        "Ignoring user. "
+                        "You should change password for this user.",
+                        user.user ? user.user : "",
+                        user.host.hostname ? user.host.hostname : "");
+      continue;
+    default:
+      sql_print_warning("Found invalid password for user: '%s@%s'; "
+                        "Ignoring user", user.user ? user.user : "",
+                         user.host.hostname ? user.host.hostname : "");
+      continue;
     }
-    else                                        // password is correct
+   =20
     {
       uint next_field;
       user.access=3D get_access(table,3,&next_field) & GLOBAL_ACLS;
@@ -530,13 +649,33 @@
           ptr=3D get_field(thd->mem_root, table->field[next_field++]);
           user.user_resource.user_conn=3D ptr ? atoi(ptr) : 0;
         }
-        else
-          user.user_resource.user_conn=3D 0;
+
+        if (table->s->fields >=3D 41)
+        {
+          /* We may have plugin & auth_String fields */
+          char *tmpstr=3D get_field(&mem, table->field[next_field++]);
+          if (tmpstr)
+          {
+            if (user.auth_string.length)
+            {
+              sql_print_warning("'user' entry '%s@%s' has both a password "
+                                "and an authentication plugin specified. T=
he "
+                                "password will be ignored.",
+                                user.user ? user.user : "",
+                                user.host.hostname ? user.host.hostname : =
"");
+            }
+            user.plugin.str=3D tmpstr;
+            user.plugin.length=3D strlen(tmpstr);
+            user.auth_string.str=3D get_field(&mem, table->field[next_fiel=
d++]);
+            if (!user.auth_string.str)
+              user.auth_string.str=3D const_cast<char*>("");
+            user.auth_string.length=3D strlen(user.auth_string.str);
+          }
+        }
       }
       else
       {
         user.ssl_type=3DSSL_TYPE_NONE;
-        bzero((char *)&(user.user_resource),sizeof(user.user_resource));
 #ifndef TO_BE_REMOVED
         if (table->s->fields <=3D 13)
         {						// Without grant
@@ -639,6 +778,8 @@
   delete_dynamic(&acl_dbs);
   delete_dynamic(&acl_wild_hosts);
   hash_free(&acl_check_hosts);
+  plugin_unlock(0, native_password_plugin);
+  plugin_unlock(0, old_password_plugin);
   if (!end)
     acl_cache->clear(1); /* purecov: inspected */
   else
@@ -836,246 +977,10 @@
=20
=20
 /*
-  Seek ACL entry for a user, check password, SSL cypher, and if
-  everything is OK, update THD user data and USER_RESOURCES struct.
-
-  IMPLEMENTATION
-   This function does not check if the user has any sensible privileges:
-   only user's existence and  validity is checked.
-   Note, that entire operation is protected by acl_cache_lock.
+  Gets user credentials without authentication and resource limit checks.
=20
   SYNOPSIS
     acl_getroot()
-    thd         thread handle. If all checks are OK,
-                thd->security_ctx->priv_user/master_access are updated.
-                thd->security_ctx->host/ip/user are used for checks.
-    mqh         user resources; on success mqh is reset, else
-                unchanged
-    passwd      scrambled & crypted password, received from client
-                (to check): thd->scramble or thd->scramble_323 is
-                used to decrypt passwd, so they must contain
-                original random string,
-    passwd_len  length of passwd, must be one of 0, 8,
-                SCRAMBLE_LENGTH_323, SCRAMBLE_LENGTH
-    'thd' and 'mqh' are updated on success; other params are IN.
- =20
-  RETURN VALUE
-    0  success: thd->priv_user, thd->priv_host, thd->master_access, mqh are
-       updated
-    1  user not found or authentication failure
-    2  user found, has long (4.1.1) salt, but passwd is in old (3.23) form=
at.
-   -1  user found, has short (3.23) salt, but passwd is in new (4.1.1) for=
mat.
-*/
-
-int acl_getroot(THD *thd, USER_RESOURCES  *mqh,
-                const char *passwd, uint passwd_len)
-{
-  ulong user_access=3D NO_ACCESS;
-  int res=3D 1;
-  ACL_USER *acl_user=3D 0;
-  Security_context *sctx=3D thd->security_ctx;
-  DBUG_ENTER("acl_getroot");
-
-  if (!initialized)
-  {
-    /*=20
-      here if mysqld's been started with --skip-grant-tables option.
-    */
-    sctx->skip_grants();
-    bzero((char*) mqh, sizeof(*mqh));
-    DBUG_RETURN(0);
-  }
-
-  VOID(pthread_mutex_lock(&acl_cache->lock));
-
-  /*
-    Find acl entry in user database. Note, that find_acl_user is not the s=
ame,
-    because it doesn't take into account the case when user is not empty,
-    but acl_user->user is empty
-  */
-
-  for (uint i=3D0 ; i < acl_users.elements ; i++)
-  {
-    ACL_USER *acl_user_tmp=3D dynamic_element(&acl_users,i,ACL_USER*);
-    if (!acl_user_tmp->user || !strcmp(sctx->user, acl_user_tmp->user))
-    {
-      if (compare_hostname(&acl_user_tmp->host, sctx->host, sctx->ip))
-      {
-        /* check password: it should be empty or valid */
-        if (passwd_len =3D=3D acl_user_tmp->salt_len)
-        {
-          if (acl_user_tmp->salt_len =3D=3D 0 ||
-              (acl_user_tmp->salt_len =3D=3D SCRAMBLE_LENGTH ?
-              check_scramble(passwd, thd->scramble, acl_user_tmp->salt) :
-              check_scramble_323(passwd, thd->scramble,
-                                 (ulong *) acl_user_tmp->salt)) =3D=3D 0)
-          {
-            acl_user=3D acl_user_tmp;
-            res=3D 0;
-          }
-        }
-        else if (passwd_len =3D=3D SCRAMBLE_LENGTH &&
-                 acl_user_tmp->salt_len =3D=3D SCRAMBLE_LENGTH_323)
-          res=3D -1;
-        else if (passwd_len =3D=3D SCRAMBLE_LENGTH_323 &&
-                 acl_user_tmp->salt_len =3D=3D SCRAMBLE_LENGTH)
-          res=3D 2;
-        /* linear search complete: */
-        break;
-      }
-    }
-  }
-  /*
-    This was moved to separate tree because of heavy HAVE_OPENSSL case.
-    If acl_user is not null, res is 0.
-  */
-
-  if (acl_user)
-  {
-    /* OK. User found and password checked continue validation */
-#ifdef HAVE_OPENSSL
-    Vio *vio=3Dthd->net.vio;
-    SSL *ssl=3D (SSL*) vio->ssl_arg;
-    X509 *cert;
-#endif
-
-    /*
-      At this point we know that user is allowed to connect
-      from given host by given username/password pair. Now
-      we check if SSL is required, if user is using SSL and
-      if X509 certificate attributes are OK
-    */
-    switch (acl_user->ssl_type) {
-    case SSL_TYPE_NOT_SPECIFIED:		// Impossible
-    case SSL_TYPE_NONE:				// SSL is not required
-      user_access=3D acl_user->access;
-      break;
-#ifdef HAVE_OPENSSL
-    case SSL_TYPE_ANY:				// Any kind of SSL is ok
-      if (vio_type(vio) =3D=3D VIO_TYPE_SSL)
-	user_access=3D acl_user->access;
-      break;
-    case SSL_TYPE_X509: /* Client should have any valid certificate. */
-      /*
-	Connections with non-valid certificates are dropped already
-	in sslaccept() anyway, so we do not check validity here.
-
-	We need to check for absence of SSL because without SSL
-	we should reject connection.
-      */
-      if (vio_type(vio) =3D=3D VIO_TYPE_SSL &&
-	  SSL_get_verify_result(ssl) =3D=3D X509_V_OK &&
-	  (cert=3D SSL_get_peer_certificate(ssl)))
-      {
-	user_access=3D acl_user->access;
-        X509_free(cert);
-      }
-      break;
-    case SSL_TYPE_SPECIFIED: /* Client should have specified attrib */
-      /*
-	We do not check for absence of SSL because without SSL it does
-	not pass all checks here anyway.
-	If cipher name is specified, we compare it to actual cipher in
-	use.
-      */
-      if (vio_type(vio) !=3D VIO_TYPE_SSL ||
-	  SSL_get_verify_result(ssl) !=3D X509_V_OK)
-	break;
-      if (acl_user->ssl_cipher)
-      {
-	DBUG_PRINT("info",("comparing ciphers: '%s' and '%s'",
-			   acl_user->ssl_cipher,SSL_get_cipher(ssl)));
-	if (!strcmp(acl_user->ssl_cipher,SSL_get_cipher(ssl)))
-	  user_access=3D acl_user->access;
-	else
-	{
-	  if (global_system_variables.log_warnings)
-	    sql_print_information("X509 ciphers mismatch: should be '%s' but is '=
%s'",
-			      acl_user->ssl_cipher,
-			      SSL_get_cipher(ssl));
-	  break;
-	}
-      }
-      /* Prepare certificate (if exists) */
-      DBUG_PRINT("info",("checkpoint 1"));
-      if (!(cert=3D SSL_get_peer_certificate(ssl)))
-      {
-	user_access=3DNO_ACCESS;
-	break;
-      }
-      DBUG_PRINT("info",("checkpoint 2"));
-      /* If X509 issuer is specified, we check it... */
-      if (acl_user->x509_issuer)
-      {
-        DBUG_PRINT("info",("checkpoint 3"));
-        char *ptr =3D X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);
-        DBUG_PRINT("info",("comparing issuers: '%s' and '%s'",
-			   acl_user->x509_issuer, ptr));
-        if (strcmp(acl_user->x509_issuer, ptr))
-        {
-          if (global_system_variables.log_warnings)
-            sql_print_information("X509 issuer mismatch: should be '%s' "
-			      "but is '%s'", acl_user->x509_issuer, ptr);
-          free(ptr);
-          X509_free(cert);
-          user_access=3DNO_ACCESS;
-          break;
-        }
-        user_access=3D acl_user->access;
-        free(ptr);
-      }
-      DBUG_PRINT("info",("checkpoint 4"));
-      /* X509 subject is specified, we check it .. */
-      if (acl_user->x509_subject)
-      {
-        char *ptr=3D X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);
-        DBUG_PRINT("info",("comparing subjects: '%s' and '%s'",
-                           acl_user->x509_subject, ptr));
-        if (strcmp(acl_user->x509_subject,ptr))
-        {
-          if (global_system_variables.log_warnings)
-            sql_print_information("X509 subject mismatch: should be '%s' b=
ut is '%s'",
-                            acl_user->x509_subject, ptr);
-          free(ptr);
-          X509_free(cert);
-          user_access=3DNO_ACCESS;
-          break;
-        }
-        user_access=3D acl_user->access;
-        free(ptr);
-      }
-      /* Deallocate the X509 certificate. */
-      X509_free(cert);
-      break;
-#else  /* HAVE_OPENSSL */
-    default:
-      /*
-        If we don't have SSL but SSL is required for this user the=20
-        authentication should fail.
-      */
-      break;
-#endif /* HAVE_OPENSSL */
-    }
-    sctx->master_access=3D user_access;
-    sctx->priv_user=3D acl_user->user ? sctx->user : (char *) "";
-    *mqh=3D acl_user->user_resource;
-
-    if (acl_user->host.hostname)
-      strmake(sctx->priv_host, acl_user->host.hostname, MAX_HOSTNAME);
-    else
-      *sctx->priv_host=3D 0;
-  }
-  VOID(pthread_mutex_unlock(&acl_cache->lock));
-  DBUG_RETURN(res);
-}
-
-
-/*
-  This is like acl_getroot() above, but it doesn't check password,
-  and we don't care about the user resources.
-
-  SYNOPSIS
-    acl_getroot_no_password()
       sctx               Context which should be initialized
       user               user name
       host               host name
@@ -1087,13 +992,13 @@
     TRUE   Error
 */
=20
-bool acl_getroot_no_password(Security_context *sctx, char *user, char *hos=
t,
-                             char *ip, char *db)
+bool acl_getroot(Security_context *sctx, char *user, char *host,
+                 char *ip, char *db)
 {
   int res=3D 1;
   uint i;
   ACL_USER *acl_user=3D 0;
-  DBUG_ENTER("acl_getroot_no_password");
+  DBUG_ENTER("acl_getroot");
=20
   DBUG_PRINT("enter", ("Host: '%s', Ip: '%s', User: '%s', db: '%s'",
                        (host ? host : "(NULL)"), (ip ? ip : "(NULL)"),
@@ -1116,8 +1021,7 @@
=20
   sctx->master_access=3D 0;
   sctx->db_access=3D 0;
-  sctx->priv_user=3D (char *) "";
-  *sctx->priv_host=3D 0;
+  *sctx->priv_user=3D *sctx->priv_host=3D 0;
=20
   /*
      Find acl entry in user database.
@@ -1159,7 +1063,11 @@
       }
     }
     sctx->master_access=3D acl_user->access;
-    sctx->priv_user=3D acl_user->user ? user : (char *) "";
+
+    if (acl_user->user)
+      strmake(sctx->priv_user, user, USERNAME_LENGTH);
+    else
+      *sctx->priv_user=3D 0;
=20
     if (acl_user->host.hostname)
       strmake(sctx->priv_host, acl_user->host.hostname, MAX_HOSTNAME);
@@ -1185,7 +1093,9 @@
 			    const char *x509_issuer,
 			    const char *x509_subject,
 			    USER_RESOURCES  *mqh,
-			    ulong privileges)
+			    ulong privileges,
+			    const LEX_STRING *plugin,
+			    const LEX_STRING *auth)
 {
   safe_mutex_assert_owner(&acl_cache->lock);
=20
@@ -1199,6 +1109,14 @@
 	  (acl_user->host.hostname &&
            !my_strcasecmp(system_charset_info, host, acl_user->host.hostna=
me)))
       {
+        if (plugin->str[0])
+        {
+          acl_user->plugin.str=3D strmake_root(&mem, plugin->str, plugin->=
length);
+          acl_user->plugin.length=3D plugin->length;
+          acl_user->auth_string.str=3D auth->str ?
+            strmake_root(&mem, auth->str, auth->length) : const_cast<char*=
>("");
+          acl_user->auth_string.length=3D auth->length;
+        }
 	acl_user->access=3Dprivileges;
 	if (mqh->specified_limits & USER_RESOURCES::QUERIES_PER_HOUR)
 	  acl_user->user_resource.questions=3Dmqh->questions;
@@ -1235,7 +1153,9 @@
 			    const char *x509_issuer,
 			    const char *x509_subject,
 			    USER_RESOURCES *mqh,
-			    ulong privileges)
+			    ulong privileges,
+			    const LEX_STRING *plugin,
+			    const LEX_STRING *auth)
 {
   ACL_USER acl_user;
=20
@@ -1243,6 +1163,22 @@
=20
   acl_user.user=3D*user ? strdup_root(&mem,user) : 0;
   update_hostname(&acl_user.host, *host ? strdup_root(&mem, host): 0);
+  if (plugin->str[0])
+  {
+    acl_user.plugin.str=3D strmake_root(&mem, plugin->str, plugin->length);
+    acl_user.plugin.length=3D plugin->length;
+    acl_user.auth_string.str=3D auth->str ?
+      strmake_root(&mem, auth->str, auth->length) :
const_cast<char*>("");
+    acl_user.auth_string.length=3D auth->length;
+  }
+  else
+  {
+    acl_user.plugin=3D password_len =3D=3D SCRAMBLED_PASSWORD_CHAR_LENGTH_=
323 ?
+      old_password_plugin_name : native_password_plugin_name;
+    acl_user.auth_string.str=3D strmake_root(&mem, password, password_len);
+    acl_user.auth_string.length=3D password_len;
+  }
+
   acl_user.access=3Dprivileges;
   acl_user.user_resource =3D *mqh;
   acl_user.sort=3Dget_sort(2,acl_user.host.hostname,acl_user.user);
@@ -1961,6 +1897,15 @@
                thd->security_ctx->user, thd->security_ctx->host_or_ip);
       goto end;
     }
+    else if (combo.plugin.str[0])
+    {
+      if (!plugin_is_ready(&combo.plugin, MYSQL_AUTHENTICATION_PLUGIN))
+      {
+        my_error(ER_PLUGIN_IS_NOT_LOADED, MYF(0), combo.plugin.str);
+        goto end;
+      }
+    }
+
     old_row_exists =3D 0;
     restore_record(table,s->default_values);
     table->field[0]->store(combo.host.str,combo.host.length,
@@ -1974,7 +1919,7 @@
   {
     old_row_exists =3D 1;
     store_record(table,record[1]);			// Save copy for update
-    if (combo.password.str)			// If password given
+    if (combo.password.str)                             // If password giv=
en
       table->field[2]->store(password, password_len, system_charset_info);
     else if (!rights && !revoke_grant &&
              lex->ssl_type =3D=3D SSL_TYPE_NOT_SPECIFIED &&
@@ -2055,7 +2000,17 @@
         (mqh.specified_limits & USER_RESOURCES::USER_CONNECTIONS))
       table->field[next_field+3]->store((longlong) mqh.user_conn, TRUE);
     mqh_used=3D mqh_used || mqh.questions || mqh.updates || mqh.conn_per_h=
our;
+
+    next_field+=3D4;
+    if (table->s->fields >=3D 41 && combo.plugin.str[0])
+    {
+      table->field[next_field]->store(combo.plugin.str, combo.plugin.lengt=
h,
+                  system_charset_info);
+      table->field[next_field+1]->store(combo.auth.str, combo.auth.length,
+                  system_charset_info);
+    }
   }
+
   if (old_row_exists)
   {
     /*
@@ -2099,7 +2054,9 @@
 		      lex->x509_issuer,
 		      lex->x509_subject,
 		      &lex->mqh,
-		      rights);
+		      rights,
+		      &combo.plugin,
+		      &combo.auth);
     else
       acl_insert_user(combo.user.str, combo.host.str, password, password_l=
en,
 		      lex->ssl_type,
@@ -2107,7 +2064,9 @@
 		      lex->x509_issuer,
 		      lex->x509_subject,
 		      &lex->mqh,
-		      rights);
+		      rights,
+		      &combo.plugin,
+		      &combo.auth);
   }
   DBUG_RETURN(error);
 }
@@ -4409,14 +4368,14 @@
 ulong get_table_grant(THD *thd, TABLE_LIST *table)
 {
   ulong privilege;
+  GRANT_TABLE *grant_table;
+
+  rw_rdlock(&LOCK_grant);
+#ifdef EMBEDDED_LIBRARY
+  grant_table=3D NULL;
+#else
   Security_context *sctx=3D thd->security_ctx;
   const char *db =3D table->db ? table->db : thd->db;
-  GRANT_TABLE *grant_table;
-
-  rw_rdlock(&LOCK_grant);
-#ifdef EMBEDDED_LIBRARY
-  grant_table=3D NULL;
-#else
   grant_table=3D table_hash_search(sctx->host, sctx->ip, db, sctx->priv_us=
er,
 				 table->table_name, 0);
 #endif
@@ -6254,38 +6213,44 @@
   tables->db=3D (char*)sp_db;
   tables->table_name=3D tables->alias=3D (char*)sp_name;
=20
-  combo->host.length=3D strlen(combo->host.str);
-  combo->user.length=3D strlen(combo->user.str);
-  combo->host.str=3D thd->strmake(combo->host.str,combo->host.length);
-  combo->user.str=3D thd->strmake(combo->user.str,combo->user.length);
-
-
-  if(au && au->salt_len)
-  {
-    if (au->salt_len =3D=3D SCRAMBLE_LENGTH)
-    {
-      make_password_from_salt(passwd_buff, au->salt);
-      combo->password.length=3D SCRAMBLED_PASSWORD_CHAR_LENGTH;
-    }
-    else if (au->salt_len =3D=3D SCRAMBLE_LENGTH_323)
-    {
-      make_password_from_salt_323(passwd_buff, (ulong *) au->salt);
-      combo->password.length=3D SCRAMBLED_PASSWORD_CHAR_LENGTH_323;
-    }
-    else
-    {
-      push_warning_printf(thd, MYSQL_ERROR::WARN_LEVEL_WARN,
-                          ER_PASSWD_LENGTH,
-                          ER(ER_PASSWD_LENGTH),
-                          SCRAMBLED_PASSWORD_CHAR_LENGTH);
-      return TRUE;
-    }
-    combo->password.str=3D passwd_buff;
-  }
-  else
-  {
-    combo->password.str=3D (char*)"";
-    combo->password.length=3D 0;
+  thd->make_lex_string(&combo->user,
+                       combo->user.str, strlen(combo->user.str), 0);
+  thd->make_lex_string(&combo->host,
+                       combo->host.str, strlen(combo->host.str), 0);
+
+  combo->password=3D empty_lex_str;
+  combo->plugin=3D empty_lex_str;
+  combo->auth=3D empty_lex_str;
+
+  if(au)
+  {
+    if (au->salt_len)
+    {
+      if (au->salt_len =3D=3D SCRAMBLE_LENGTH)
+      {
+        make_password_from_salt(passwd_buff, au->salt);
+        combo->password.length=3D SCRAMBLED_PASSWORD_CHAR_LENGTH;
+      }
+      else if (au->salt_len =3D=3D SCRAMBLE_LENGTH_323)
+      {
+        make_password_from_salt_323(passwd_buff, (ulong *) au->salt);
+        combo->password.length=3D SCRAMBLED_PASSWORD_CHAR_LENGTH_323;
+      }
+      else
+      {
+        push_warning_printf(thd, MYSQL_ERROR::WARN_LEVEL_WARN, ER_PASSWD_L=
ENGTH,
+                            ER(ER_PASSWD_LENGTH), SCRAMBLED_PASSWORD_CHAR_=
LENGTH);
+        return TRUE;
+      }
+      combo->password.str=3D passwd_buff;
+    }
+
+    if (au->plugin.str !=3D native_password_plugin_name.str &&
+        au->plugin.str !=3D old_password_plugin_name.str)
+    {
+      combo->plugin=3D au->plugin;
+      combo->auth=3D au->auth_string;
+    }
   }
=20
   if (user_list.push_back(combo))
@@ -6779,3 +6744,1375 @@
 }
=20
 #endif
+
+/*************************************************************************=
***
+   AUTHENTICATION CODE
+   including initial connect handshake, invoking appropriate plugins,
+   client-server plugin negotiation, COM_CHANGE_USER, and native
+   MySQL authentication plugins.
+**************************************************************************=
**/
+
+/* few defines to have less ifdef's in the code below */
+#ifdef EMBEDDED_LIBRARY
+#ifdef NO_EMBEDDED_ACCESS_CHECKS
+#define initialized 0
+#define decrease_user_connections(X)        /* nothing */
+#define check_for_max_user_connections(X,Y)   0
+#endif
+#undef HAVE_OPENSSL
+#endif
+#ifndef HAVE_OPENSSL
+#define ssl_acceptor_fd 0
+#define sslaccept(A,B,C,D) 1
+#endif
+
+/**
+  The internal version of what plugins know as MYSQL_PLUGIN_VIO,
+  basically the context of the authentication session
+*/
+struct MPVIO_EXT : public MYSQL_PLUGIN_VIO
+{
+  MYSQL_SERVER_AUTH_INFO auth_info;
+  THD *thd;
+  ACL_USER *acl_user;       ///< a copy, independent from acl_users array
+  plugin_ref plugin;        ///< what plugin we're under
+  LEX_STRING db;            ///< db name from the handshake packet
+  /** when restarting a plugin this caches the last client reply */
+  struct {
+    char *plugin, *pkt;     ///< pointers into NET::buff
+    uint pkt_len;
+  } cached_client_reply;
+  /** this caches the first plugin packet for restart request on the clien=
t */
+  struct {
+    char *pkt;
+    uint pkt_len;
+  } cached_server_packet;
+  int packets_read, packets_written; ///< counters for send/received packe=
ts
+  uint connect_errors;      ///< if there were connect errors for this host
+  /** when plugin returns a failure this tells us what really happened */
+  enum { SUCCESS, FAILURE, RESTART } status;
+};
+
+/**
+  a helper function to report an access denied error in all the proper pla=
ces
+*/
+static void login_failed_error(THD *thd, bool passwd_used)
+{
+  my_error(ER_ACCESS_DENIED_ERROR, MYF(0),
+           thd->main_security_ctx.user,
+           thd->main_security_ctx.host_or_ip,
+           passwd_used ? ER(ER_YES) : ER(ER_NO));
+  general_log_print(thd, COM_CONNECT, ER(ER_ACCESS_DENIED_ERROR),
+                    thd->main_security_ctx.user,
+                    thd->main_security_ctx.host_or_ip,
+                    passwd_used ? ER(ER_YES) : ER(ER_NO));
+  status_var_increment(thd->status_var.access_denied_errors);
+  /*=20
+    Log access denied messages to the error log when log-warnings =3D 2
+    so that the overhead of the general query log is not required to track=
=20
+    failed connections.
+  */
+  if (global_system_variables.log_warnings > 1)
+  {
+    sql_print_warning(ER(ER_ACCESS_DENIED_ERROR),
+                      thd->main_security_ctx.user,
+                      thd->main_security_ctx.host_or_ip,
+                      passwd_used ? ER(ER_YES) : ER(ER_NO));     =20
+  }
+}
+
+/**
+  sends a server handshake initialization packet, the very first packet
+  after the connection was established
+
+  Packet format:
+  =20
+    Bytes       Content
+    -----       ----
+    1           protocol version (always 10)
+    n           server version string, \0-terminated
+    4           thread id
+    8           first 8 bytes of the plugin provided data (scramble)
+    1           \0 byte, terminating the first part of a scramble
+    2           server capabilities (two lower bytes)
+    1           server character set
+    2           server status
+    2           server capabilities (two upper bytes)
+    11          reserved, always 0
+    n           rest of the plugin provided data (at least 12 bytes)
+    1           \0 byte, terminating the second part of a scramble
+
+  @retval 0 ok
+  @retval 1 error
+*/
+static bool send_server_handshake_packet(MPVIO_EXT *mpvio,
+                                         const char *data, uint data_len)
+{
+  DBUG_ASSERT(mpvio->status =3D=3D MPVIO_EXT::FAILURE);
+
+  THD *thd=3D mpvio->thd;
+  char *buff=3D (char *)my_alloca(1 + SERVER_VERSION_LENGTH + data_len + 6=
4);
+  char scramble_buf[SCRAMBLE_LENGTH];
+  char *end=3D buff;
+
+  *end++=3D protocol_version;
+
+  thd->client_capabilities=3D CLIENT_BASIC_FLAGS;
+
+  if (data_len)
+  {
+    mpvio->cached_server_packet.pkt=3D (char*)thd->memdup(data, data_len);
+    mpvio->cached_server_packet.pkt_len=3D data_len;
+  }
+
+  if (data_len < SCRAMBLE_LENGTH)
+  {
+    if (data_len)
+    { /*
+        the first packet *must* have at least 20 bytes of a scramble.
+        if a plugin provided less, we pad it to 20 with zeros
+      */
+      memcpy(scramble_buf, data, data_len);
+      bzero(scramble_buf+data_len, SCRAMBLE_LENGTH-data_len);
+      data=3D scramble_buf;
+    }
+    else
+    {
+      /*
+        if the default plugin does not provide the data for the scramble at
+        all, we generate a scramble internally anyway, just in case the
+        user account (that will be known only later) uses a
+        native_password_plugin (which needs a scramble). If we don't send a
+        scramble now - wasting 20 bytes in the packet -
+        native_password_plugin will have to send it in a separate packet,
+        adding one more round trip.
+      */
+      create_random_string(thd->scramble, SCRAMBLE_LENGTH, &thd->rand);
+      data=3D thd->scramble;
+    }
+    data_len=3D SCRAMBLE_LENGTH;
+  }
+
+  if (opt_using_transactions)
+    thd->client_capabilities|=3D CLIENT_TRANSACTIONS;
+
+  thd->client_capabilities|=3D CAN_CLIENT_COMPRESS;
+
+  if (ssl_acceptor_fd)
+  {
+    thd->client_capabilities |=3D CLIENT_SSL;
+    thd->client_capabilities |=3D CLIENT_SSL_VERIFY_SERVER_CERT;
+  }
+
+  end=3D strnmov(end, server_version, SERVER_VERSION_LENGTH) + 1;
+  int4store((uchar*) end, mpvio->thd->thread_id);
+  end+=3D 4;
+
+  /*
+    Old clients does not understand long scrambles, but can ignore packet
+    tail: that's why first part of the scramble is placed here, and second
+    part at the end of packet.
+  */
+  end=3D strmake(end, data, SCRAMBLE_LENGTH_323) + 1;
+=20
+  int2store(end, thd->client_capabilities);
+  /* write server characteristics: up to 16 bytes allowed */
+  end[2]=3D(char) default_charset_info->number;
+  int2store(end+3, mpvio->thd->server_status);
+  int2store(end+5, thd->client_capabilities >> 16);
+  bzero(end+7, 11);
+  end+=3D 18;
+  /* write scramble tail */
+  end=3D strmake(end, data + SCRAMBLE_LENGTH_323,=20
+                data_len - SCRAMBLE_LENGTH_323) + 1;
+  int res=3D my_net_write(&mpvio->thd->net, (uchar*) buff, (size_t) (end-b=
uff)) ||
+           net_flush(&mpvio->thd->net);
+  my_afree(buff);
+  return res;
+}
+
+static uchar switch_plugin_request_buf[]=3D { 254 };
+
+/**
+  sends a "change plugin" packet, requesting a client to restart authentic=
ation
+  using a different authentication plugin
+
+  Packet format:
+  =20
+    Bytes       Content
+    -----       ----
+    1           byte with the value 254
+    n           client plugin to use, \0-terminated
+    n           plugin provided data
+
+  In a special case of switching from native_password_plugin to
+  old_password_plugin, the packet contains only one - the first - byte,
+  plugin name is omitted, plugin data aren't needed as the scramble was
+  already sent. This one-byte packet is identical to the "use the short
+  scramble" packet in the protocol before plugins were introduced.
+
+  @retval 0 ok
+  @retval 1 error
+*/
+static bool send_plugin_request_packet(MPVIO_EXT *mpvio,
+                                       const uchar *data, uint data_len)
+{
+  DBUG_ASSERT(mpvio->packets_written =3D=3D 1);
+  DBUG_ASSERT(mpvio->packets_read =3D=3D 1);
+  NET *net=3D &mpvio->thd->net;
+
+  mpvio->status=3D MPVIO_EXT::FAILURE; // the status is no longer RESTART
+
+  const char *client_auth_plugin=3D
+    ((st_mysql_auth *)(plugin_decl(mpvio->plugin)->info))->client_auth_plu=
gin;
+
+  DBUG_ASSERT(client_auth_plugin);
+
+  /*
+    we send an old "short 4.0 scramble request", if we need to request a
+    client to use 4.0 auth plugin (short scramble) and the scramble was
+    already sent to the client
+  */
+  bool switch_from_long_to_short_scramble=3D
+    my_strcasecmp(system_charset_info, native_password_plugin_name.str,
+                  mpvio->cached_client_reply.plugin) =3D=3D 0 &&
+    client_auth_plugin =3D=3D old_password_plugin_name.str;
+
+  if (switch_from_long_to_short_scramble)
+    return my_net_write(net, switch_plugin_request_buf, 1) ||
+           net_flush(net);
+
+  /*
+    We never request a client to switch from a short to long scramble.
+    Plugin-aware clients can do that, but traditionally it meant to
+    ask an old 4.0 client to use the new 4.1 authentication protocol.
+  */
+  bool switch_from_short_to_long_scramble=3D
+    my_strcasecmp(system_charset_info, old_password_plugin_name.str,
+                  mpvio->cached_client_reply.plugin) =3D=3D 0 &&
+    client_auth_plugin =3D=3D native_password_plugin_name.str;
+
+  if (switch_from_short_to_long_scramble)
+  {
+    my_error(ER_NOT_SUPPORTED_AUTH_MODE, MYF(0));
+    general_log_print(mpvio->thd, COM_CONNECT, ER(ER_NOT_SUPPORTED_AUTH_MO=
DE));
+    return 1;
+  }
+
+  return net_write_command(net, switch_plugin_request_buf[0],
+                           (uchar*)client_auth_plugin,
+                           strlen(client_auth_plugin)+1,
+                           (uchar*)data, data_len);
+}
+
+#ifndef NO_EMBEDDED_ACCESS_CHECKS
+/**
+   Finds acl entry in user database for authentication purposes.
+  =20
+   Finds a user and copies it into mpvio. Reports an authentication
+   failure if a user is not found.
+
+   @note find_acl_user is not the same, because it doesn't take into
+   account the case when user is not empty, but acl_user->user is empty
+
+   @retval 0    found
+   @retval 1    not found
+*/
+static bool find_mpvio_user(MPVIO_EXT *mpvio, Security_context *sctx)
+{
+  pthread_mutex_lock(&acl_cache->lock);
+  for (uint i=3D0 ; i < acl_users.elements ; i++)
+  {
+    ACL_USER *acl_user_tmp=3D dynamic_element(&acl_users,i,ACL_USER*);
+    if (!acl_user_tmp->user || (!strcmp(sctx->user, acl_user_tmp->user)
&&
+        compare_hostname(&acl_user_tmp->host, sctx->host, sctx->ip)))
+    {
+      mpvio->acl_user=3D acl_user_tmp->copy(mpvio->thd->mem_root);
+      break;
+    }
+  }
+  pthread_mutex_unlock(&acl_cache->lock);
+
+  if (!mpvio->acl_user)
+  {
+    login_failed_error(mpvio->thd, 0);
+    return 1;
+  }
+
+  /* user account requires non-default plugin and the client is too old */
+  if (my_strcasecmp(system_charset_info, mpvio->acl_user->plugin.str,
+                                         native_password_plugin_name.str) =
&&
+      my_strcasecmp(system_charset_info, mpvio->acl_user->plugin.str,
+                                         old_password_plugin_name.str) &&
+      !(mpvio->thd->client_capabilities & CLIENT_PLUGIN_AUTH))
+  {
+    my_error(ER_NOT_SUPPORTED_AUTH_MODE, MYF(0));
+    general_log_print(mpvio->thd, COM_CONNECT, ER(ER_NOT_SUPPORTED_AUTH_MO=
DE));
+    return 1;
+  }
+
+  mpvio->auth_info.user_name=3D sctx->user;
+  mpvio->auth_info.auth_string=3D mpvio->acl_user->auth_string.str;
+  strmake(mpvio->auth_info.authenticated_as, mpvio->acl_user->user ?
+          mpvio->acl_user->user : "", USERNAME_LENGTH);
+
+  return 0;
+}
+#endif
+
+/* the packet format is described in send_change_user_packet() */
+static bool parse_com_change_user_packet(MPVIO_EXT *mpvio, uint packet_len=
gth)
+{
+  THD *thd=3D mpvio->thd;
+  NET *net=3D &thd->net;
+  Security_context *sctx=3D thd->security_ctx;
+
+  char *user=3D (char*) net->read_pos;
+  char *end=3D user + packet_length;
+  /* Safe because there is always a trailing \0 at the end of the packet */
+  char *passwd=3D strend(user)+1;
+  uint user_len=3D passwd - user - 1;
+  char *db=3D passwd;
+  char db_buff[NAME_LEN + 1];                 // buffer to store db in utf8
+  char user_buff[USERNAME_LENGTH + 1];	      // buffer to store user in ut=
f8
+  uint dummy_errors;
+
+  if (passwd >=3D end)
+  {
+    my_message(ER_UNKNOWN_COM_ERROR, ER(ER_UNKNOWN_COM_ERROR), MYF(0));
+    return 1;
+  }
+
+  /*
+    Old clients send null-terminated string as password; new clients send
+    the size (1 byte) + string (not null-terminated). Hence in case of emp=
ty
+    password both send '\0'.
+
+    This strlen() can't be easily deleted without changing protocol.
+
+    Cast *passwd to an unsigned char, so that it doesn't extend the sign f=
or
+    *passwd > 127 and become 2**32-127+ after casting to uint.
+  */
+  uint passwd_len=3D (thd->client_capabilities & CLIENT_SECURE_CONNECTION ?
+                    (uchar)(*passwd++) : strlen(passwd));
+
+  db+=3D passwd_len + 1;
+  /*
+    Database name is always NUL-terminated, so in case of empty database
+    the packet must contain at least the trailing '\0'.
+  */
+  if (db >=3D end)
+    {
+      my_message(ER_UNKNOWN_COM_ERROR, ER(ER_UNKNOWN_COM_ERROR), MYF(0));
+      return 1;
+    }
+
+  uint db_len=3D strlen(db);
+
+  char *ptr=3D db + db_len + 1;
+
+  /* Convert database and user names to utf8 */
+  db_buff[db_len=3D copy_and_convert(db_buff, sizeof(db_buff)-1,
+                                   system_charset_info, db, db_len,
+                                   thd->charset(), &dummy_errors)]=3D 0;
+  db=3D db_buff;
+
+  user_buff[user_len=3D copy_and_convert(user_buff, sizeof(user_buff)-1,
+                                       system_charset_info, user, user_len,
+                                       thd->charset(), &dummy_errors)]=3D =
'\0';
+  user=3D user_buff;
+
+  if (ptr+1 < end)
+  {
+    uint cs_number=3D uint2korr(ptr);
+    thd_init_client_charset(thd, cs_number);
+    thd->update_charset();
+  }
+
+  if (!(sctx->user=3D my_strdup(user, MYF(MY_WME))))
+    return 1;
+
+  /* Clear variables that are allocated */
+  thd->user_connect=3D 0;
+  strmake(sctx->priv_user, sctx->user, USERNAME_LENGTH);
+
+  if (thd->make_lex_string(&mpvio->db, db, db_len, 0) =3D=3D 0)
+    return 1; /* The error is set by make_lex_string(). */
+
+  /*
+    Clear thd->db as it points to something, that will be freed when
+    connection is closed. We don't want to accidentally free a wrong
+    pointer if connect failed.
+  */
+  thd->reset_db(NULL, 0);
+
+  if (!initialized)
+  {
+    // if mysqld's been started with --skip-grant-tables option
+    mpvio->status=3D MPVIO_EXT::SUCCESS;
+    return 0;
+  }
+
+#ifndef NO_EMBEDDED_ACCESS_CHECKS
+  if (find_mpvio_user(mpvio, sctx))
+    return 1;
+
+  char *client_plugin;
+  if (thd->client_capabilities & CLIENT_PLUGIN_AUTH)
+  {
+    client_plugin=3D ptr + 2;
+    if (client_plugin >=3D end)
+    {
+      my_message(ER_UNKNOWN_COM_ERROR, ER(ER_UNKNOWN_COM_ERROR), MYF(0));
+      return 1;
+    }
+  }
+  else
+    if (thd->client_capabilities & CLIENT_SECURE_CONNECTION)
+      client_plugin=3D native_password_plugin_name.str;
+    else
+    {
+      client_plugin=3D  old_password_plugin_name.str;
+      /*
+        For a passwordless accounts we use native_password_plugin.
+        But when an old 4.0 client connects to it, we change it to
+        old_password_plugin, otherwise MySQL will think that server=20
+        and client plugins don't match.
+      */
+      if (mpvio->acl_user->auth_string.length =3D=3D 0)
+        mpvio->acl_user->plugin=3D old_password_plugin_name;
+    }
+ =20
+  /* remember the data part of the packet, to present it to plugin in read=
_packet() */
+  mpvio->cached_client_reply.pkt=3D passwd;
+  mpvio->cached_client_reply.pkt_len=3D passwd_len;
+  mpvio->cached_client_reply.plugin=3D client_plugin;
+  mpvio->status=3D MPVIO_EXT::RESTART;
+#endif
+
+  return 0;
+}
+
+/* the packet format is described in send_client_reply_packet() */
+static ulong parse_client_handshake_packet(MPVIO_EXT *mpvio,
+                                           uchar **buff, ulong pkt_len)
+{
+#ifndef EMBEDDED_LIBRARY
+  THD *thd=3D mpvio->thd;
+  NET *net=3D &thd->net;
+  char *end;
+
+  DBUG_ASSERT(mpvio->status =3D=3D MPVIO_EXT::FAILURE);
+
+  if (pkt_len < MIN_HANDSHAKE_SIZE)
+    return packet_error;
+
+  if (mpvio->connect_errors)
+    reset_host_errors(&net->vio->remote.sin_addr);
+
+  ulong client_capabilities=3D uint2korr(net->read_pos);
+  if (client_capabilities & CLIENT_PROTOCOL_41)
+  {
+    client_capabilities|=3D ((ulong) uint2korr(net->read_pos+2)) << 16;
+    thd->max_client_packet_length=3D uint4korr(net->read_pos+4);
+    DBUG_PRINT("info", ("client_character_set: %d", (uint) net->read_pos[8=
]));
+    thd_init_client_charset(thd, (uint) net->read_pos[8]);
+    thd->update_charset();
+    end=3D (char*) net->read_pos+32;
+  }
+  else
+  {
+    thd->max_client_packet_length=3D uint3korr(net->read_pos+2);
+    end=3D (char*) net->read_pos+5;
+  }
+
+  /* Disable those bits which are not supported by the client. */
+  thd->client_capabilities&=3D client_capabilities;
+
+  if (thd->client_capabilities & CLIENT_IGNORE_SPACE)
+    thd->variables.sql_mode|=3D MODE_IGNORE_SPACE;
+
+  DBUG_PRINT("info", ("client capabilities: %lu", thd->client_capabilities=
));
+  if (thd->client_capabilities & CLIENT_SSL)
+  {
+    char error_string[1024] __attribute__((unused));
+
+    /* Do the SSL layering. */
+    if (!ssl_acceptor_fd)
+      return packet_error;
+
+    DBUG_PRINT("info", ("IO layer change in progress..."));
+    if (sslaccept(ssl_acceptor_fd, net->vio, net->read_timeout, error_stri=
ng))
+    {
+      DBUG_PRINT("error", ("Failed to accept new SSL connection"));
+      return packet_error;
+    }
+
+    DBUG_PRINT("info", ("Reading user information over SSL layer"));
+    pkt_len=3D my_net_read(net);
+    if (pkt_len =3D=3D packet_error || pkt_len < NORMAL_HANDSHAKE_SIZE)
+    {
+      DBUG_PRINT("error", ("Failed to read user information (pkt_len=3D %l=
u)",
+			   pkt_len));
+      return packet_error;
+    }
+  }
+
+  if (end >=3D (char*) net->read_pos+ pkt_len +2)
+    return packet_error;
+
+  if (thd->client_capabilities & CLIENT_INTERACTIVE)
+    thd->variables.net_wait_timeout=3D thd->variables.net_interactive_time=
out;
+  if ((thd->client_capabilities & CLIENT_TRANSACTIONS) &&
+      opt_using_transactions)
+    net->return_status=3D &thd->server_status;
+
+  char *user=3D end;
+  char *passwd=3D strend(user)+1;
+  uint user_len=3D passwd - user - 1;
+  char *db=3D passwd;
+  char db_buff[NAME_LEN + 1];           // buffer to store db in utf8
+  char user_buff[USERNAME_LENGTH + 1];	// buffer to store user in utf8
+  uint dummy_errors;
+
+  /*
+    Old clients send null-terminated string as password; new clients send
+    the size (1 byte) + string (not null-terminated). Hence in case of emp=
ty
+    password both send '\0'.
+
+    This strlen() can't be easily deleted without changing protocol.
+
+    Cast *passwd to an unsigned char, so that it doesn't extend the sign f=
or
+    *passwd > 127 and become 2**32-127+ after casting to uint.
+  */
+  uint passwd_len=3D thd->client_capabilities & CLIENT_SECURE_CONNECTION ?
+                   (uchar)(*passwd++) : strlen(passwd);
+  db=3D thd->client_capabilities & CLIENT_CONNECT_WITH_DB ?
+        db + passwd_len + 1 : 0;
+  /* strlen() can't be easily deleted without changing protocol */
+  uint db_len=3D db ? strlen(db) : 0;
+
+  if (passwd + passwd_len + db_len > (char *)net->read_pos + pkt_len)
+    return packet_error;
+
+  char *client_plugin=3D passwd + passwd_len + (db ? db_len + 1 : 0);
+
+  /* Since 4.1 all database names are stored in utf8 */
+  if (db)
+  {
+    db_buff[db_len=3D copy_and_convert(db_buff, sizeof(db_buff)-1,
+                                     system_charset_info,
+                                     db, db_len,
+                                     thd->charset(), &dummy_errors)]=3D 0;
+    db=3D db_buff;
+  }
+
+  user_buff[user_len=3D copy_and_convert(user_buff, sizeof(user_buff)-1,
+                                       system_charset_info, user, user_len,
+                                       thd->charset(), &dummy_errors)]=3D =
'\0';
+  user=3D user_buff;
+
+  /* If username starts and ends in "'", chop them off */
+  if (user_len > 1 && user[0] =3D=3D '\'' && user[user_len - 1] =3D=3D
'\'=
')
+  {
+    user[user_len-1]=3D 0;
+    user++;
+    user_len-=3D 2;
+  }
+
+  Security_context *sctx=3D thd->security_ctx;
+
+  if (thd->make_lex_string(&mpvio->db, db, db_len, 0) =3D=3D 0)
+    return packet_error; /* The error is set by make_lex_string(). */
+  if (sctx->user)
+    x_free(sctx->user);
+  if (!(sctx->user=3D my_strdup(user, MYF(MY_WME))))
+    return packet_error; /* The error is set by my_strdup(). */
+
+  /*
+    Clear thd->db as it points to something, that will be freed when
+    connection is closed. We don't want to accidentally free a wrong
+    pointer if connect failed.
+  */
+  thd->reset_db(NULL, 0);
+
+  if (!initialized)
+  {
+    // if mysqld's been started with --skip-grant-tables option
+    mpvio->status=3D MPVIO_EXT::SUCCESS;
+    return packet_error;
+  }
+
+  if (find_mpvio_user(mpvio, sctx))
+    return packet_error;
+
+  if (thd->client_capabilities & CLIENT_PLUGIN_AUTH)
+  {
+    if ((client_plugin + strlen(client_plugin)) >=20
+          (char *)net->read_pos + pkt_len)
+      return packet_error;
+  }
+  else
+    if (thd->client_capabilities & CLIENT_SECURE_CONNECTION)
+      client_plugin=3D native_password_plugin_name.str;
+    else
+    {
+      client_plugin=3D  old_password_plugin_name.str;
+      /*
+        For a passwordless accounts we use native_password_plugin.
+        But when an old 4.0 client connects to it, we change it to
+        old_password_plugin, otherwise MySQL will think that server=20
+        and client plugins don't match.
+      */
+      if (mpvio->acl_user->auth_string.length =3D=3D 0)
+        mpvio->acl_user->plugin=3D old_password_plugin_name;
+    }
+ =20
+  /*
+    if the acl_user needs a different plugin to authenticate
+    (specified in GRANT ... AUTHENTICATED VIA plugin_name ..)
+    we need to restart the authentication in the server.
+    But perhaps the client has already used the correct plugin -
+    in that case the authentication on the client may not need to be
+    restarted and a server auth plugin will read the data that the client
+    has just send. Cache them to return in the next server_mpvio_read_pack=
et().
+  */
+  if (my_strcasecmp(system_charset_info, mpvio->acl_user->plugin.str,
+                    plugin_name(mpvio->plugin)->str) !=3D 0)
+  {
+    mpvio->cached_client_reply.pkt=3D passwd;
+    mpvio->cached_client_reply.pkt_len=3D passwd_len;
+    mpvio->cached_client_reply.plugin=3D client_plugin;
+    mpvio->status=3D MPVIO_EXT::RESTART;
+    return packet_error;
+  }
+
+  /*
+    ok, we don't need to restart the authentication on the server.
+    but if the client used the wrong plugin, we need to restart
+    the authentication on the client. Do it here, the server plugin
+    doesn't need to know.
+  */
+  const char *client_auth_plugin=3D
+    ((st_mysql_auth *)(plugin_decl(mpvio->plugin)->info))->client_auth_plu=
gin;
+
+  if (client_auth_plugin &&
+      my_strcasecmp(system_charset_info, client_plugin, client_auth_plugin=
))
+  {
+    mpvio->cached_client_reply.plugin=3D client_plugin;
+    if (send_plugin_request_packet(mpvio,
+                                   (uchar*)mpvio->cached_server_packet.pkt,
+                                   mpvio->cached_server_packet.pkt_len))
+      return packet_error;
+
+    passwd_len=3D my_net_read(&mpvio->thd->net);
+    passwd =3D (char*)mpvio->thd->net.read_pos;
+  }
+
+  *buff=3D (uchar*)passwd;
+  return passwd_len;
+#else
+  return 0;
+#endif
+}
+
+/**
+  vio->write_packet() callback method for server authentication plugins
+
+  This function is called by a server authentication plugin, when it wants
+  to send data to the client.
+
+  It transparently wraps the data into a handshake packet,
+  and handles plugin negotiation with the client. If necessary,
+  it escapes the plugin data, if it starts with a mysql protocol packet by=
te.
+*/
+static int server_mpvio_write_packet(MYSQL_PLUGIN_VIO *param,
+                                   const uchar *packet, int packet_len)
+{
+  MPVIO_EXT *mpvio=3D (MPVIO_EXT*)param;
+  int res;
+  /* reset cached_client_reply */
+  mpvio->cached_client_reply.pkt=3D 0;
+  /* for the 1st packet we wrap plugin data into the handshake packet */
+  if (mpvio->packets_written =3D=3D 0)
+    res=3D send_server_handshake_packet(mpvio, (char*)packet, packet_len);
+  else if (mpvio->status =3D=3D MPVIO_EXT::RESTART)
+    res=3D send_plugin_request_packet(mpvio, packet, packet_len);
+  else if (packet_len > 0 && (*packet =3D=3D 1 || *packet =3D=3D 255))
+  {
+    /*
+      we cannot allow plugin data packet to start from 255 -
+      as the client will treat it as an error packet and abort.
+      We'll escape \255 byte with \1 byte. Consequently, we
+      have to escape \1 byte too.
+    */
+    res=3D net_write_command(&mpvio->thd->net, 1, (uchar*)"", 0,
+                           packet, packet_len);
+  }
+  else
+  {
+    res=3D my_net_write(&mpvio->thd->net, packet, packet_len) ||
+         net_flush(&mpvio->thd->net);
+  }
+  mpvio->packets_written++;
+  return res;
+}
+
+/**
+  vio->read_packet() callback method for server authentication plugins
+
+  This function is called by a server authentication plugin, when it wants
+  to read data from the client.
+
+  It transparently extracts the client plugin data, if embedded into
+  a client authentication handshake packet, and handles plugin negotiation
+  with the client, if necessary.
+*/
+static int server_mpvio_read_packet(MYSQL_PLUGIN_VIO *param, uchar **buf)
+{
+  MPVIO_EXT *mpvio=3D (MPVIO_EXT*)param;
+  ulong pkt_len;
+
+  if (mpvio->packets_written =3D=3D 0)
+  {
+    /*
+      plugin wants to read the data without sending anything first.
+      send an empty packet, to start a handshake
+    */
+    if (server_mpvio_write_packet(mpvio, 0, 0))
+      pkt_len=3D packet_error;
+    else
+      pkt_len=3D my_net_read(&mpvio->thd->net);
+  }
+  else=20
+  if (mpvio->cached_client_reply.pkt)
+  {
+    DBUG_ASSERT(mpvio->status =3D=3D MPVIO_EXT::RESTART);
+    DBUG_ASSERT(mpvio->packets_read > 0);
+    /*
+      if the have the data cached from the last server_mpvio_read_packet
+      (which can be the case if it's a restarted authentication)
+      and a client has used the correct plugin, then we can return the
+      cached data straight away and avoid one round trip.
+    */
+    const char *client_auth_plugin=3D
+      ((st_mysql_auth *)(plugin_decl(mpvio->plugin)->info))->client_auth_p=
lugin;
+    if (client_auth_plugin =3D=3D 0 ||
+        my_strcasecmp(system_charset_info, mpvio->cached_client_reply.plug=
in,
+                      client_auth_plugin) =3D=3D 0)
+    {
+      mpvio->status=3D MPVIO_EXT::FAILURE;
+      *buf=3D (uchar*)mpvio->cached_client_reply.pkt;
+      mpvio->cached_client_reply.pkt=3D 0;
+      mpvio->packets_read++;
+      return (int)mpvio->cached_client_reply.pkt_len;
+    }
+    /*
+      But if the client has used the wrong plugin, the cached data are
+      useless. Furthermore, we have to send a "change plugin" request
+      to the client.
+    */
+    if (server_mpvio_write_packet(mpvio, 0, 0))
+      pkt_len=3D packet_error;
+    else
+      pkt_len=3D my_net_read(&mpvio->thd->net);
+  }
+  else
+    pkt_len=3D my_net_read(&mpvio->thd->net);
+
+  if (pkt_len =3D=3D packet_error)
+    goto err;
+
+  mpvio->packets_read++;
+
+  /*
+    the 1st packet has the plugin data wrapped into the client authenticat=
ion
+    handshake packet
+  */
+  if (mpvio->packets_read =3D=3D 1)
+  {
+    pkt_len=3D parse_client_handshake_packet(mpvio, buf, pkt_len);
+    if (pkt_len =3D=3D packet_error)
+      goto err;
+  }
+  else
+    *buf =3D mpvio->thd->net.read_pos;
+
+  return (int)pkt_len;
+
+err:
+  if (mpvio->status =3D=3D MPVIO_EXT::FAILURE &&
!mpvio->thd->is_error())
+  {
+    inc_host_errors(&mpvio->thd->net.vio->remote.sin_addr);
+    my_error(ER_HANDSHAKE_ERROR, MYF(0),
+             mpvio->thd->security_ctx->host_or_ip);
+  }
+  return -1;
+}
+
+/**
+  fills MYSQL_PLUGIN_VIO_INFO structure with the information about the
+  connection
+*/
+static void server_mpvio_info(MYSQL_PLUGIN_VIO *vio,
+                              MYSQL_PLUGIN_VIO_INFO *info)
+{
+  MPVIO_EXT *mpvio=3D (MPVIO_EXT*)vio;
+  mpvio_info(mpvio->thd->net.vio, info);
+}
+
+static int acl_check_ssl(THD *thd, ACL_USER *acl_user)
+{
+#if defined(HAVE_OPENSSL)
+  Vio *vio=3Dthd->net.vio;
+  SSL *ssl=3D (SSL*) vio->ssl_arg;
+  X509 *cert;
+#endif
+
+  /*
+    At this point we know that user is allowed to connect
+    from given host by given username/password pair. Now
+    we check if SSL is required, if user is using SSL and
+    if X509 certificate attributes are OK
+  */
+  switch (acl_user->ssl_type) {
+  case SSL_TYPE_NOT_SPECIFIED:                  // Impossible
+  case SSL_TYPE_NONE:                           // SSL is not required
+    return 0;
+#if defined(HAVE_OPENSSL)
+  case SSL_TYPE_ANY:                            // Any kind of SSL is ok
+    return vio_type(vio) !=3D VIO_TYPE_SSL;
+  case SSL_TYPE_X509: /* Client should have any valid certificate. */
+    /*
+      Connections with non-valid certificates are dropped already
+      in sslaccept() anyway, so we do not check validity here.
+
+      We need to check for absence of SSL because without SSL
+      we should reject connection.
+    */
+    if (vio_type(vio) =3D=3D VIO_TYPE_SSL &&
+        SSL_get_verify_result(ssl) =3D=3D X509_V_OK &&
+        (cert=3D SSL_get_peer_certificate(ssl)))
+    {
+      X509_free(cert);
+      return 0;
+    }
+    return 1;
+  case SSL_TYPE_SPECIFIED: /* Client should have specified attrib */
+    /* If a cipher name is specified, we compare it to actual cipher in us=
e. */
+    if (vio_type(vio) !=3D VIO_TYPE_SSL ||
+        SSL_get_verify_result(ssl) !=3D X509_V_OK)
+      return 1;
+    if (acl_user->ssl_cipher)
+    {
+      DBUG_PRINT("info",("comparing ciphers: '%s' and '%s'",
+                         acl_user->ssl_cipher,SSL_get_cipher(ssl)));
+      if (strcmp(acl_user->ssl_cipher,SSL_get_cipher(ssl)))
+      {
+        if (global_system_variables.log_warnings)
+          sql_print_information("X509 ciphers mismatch: should be '%s' but=
 is '%s'",
+                            acl_user->ssl_cipher, SSL_get_cipher(ssl));
+        return 1;
+      }
+    }
+    /* Prepare certificate (if exists) */
+    if (!(cert=3D SSL_get_peer_certificate(ssl)))
+      return 1;
+    /* If X509 issuer is specified, we check it... */
+    if (acl_user->x509_issuer)
+    {
+      char *ptr =3D X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);
+      DBUG_PRINT("info",("comparing issuers: '%s' and '%s'",
+                         acl_user->x509_issuer, ptr));
+      if (strcmp(acl_user->x509_issuer, ptr))
+      {
+        if (global_system_variables.log_warnings)
+          sql_print_information("X509 issuer mismatch: should be '%s' "
+                            "but is '%s'", acl_user->x509_issuer, ptr);
+        free(ptr);
+        X509_free(cert);
+        return 1;
+      }
+      free(ptr);
+    }
+    /* X509 subject is specified, we check it .. */
+    if (acl_user->x509_subject)
+    {
+      char *ptr=3D X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);
+      DBUG_PRINT("info",("comparing subjects: '%s' and '%s'",
+                         acl_user->x509_subject, ptr));
+      if (strcmp(acl_user->x509_subject,ptr))
+      {
+        if (global_system_variables.log_warnings)
+          sql_print_information("X509 subject mismatch: should be '%s' but=
 is '%s'",
+                          acl_user->x509_subject, ptr);
+        free(ptr);
+        X509_free(cert);
+        return 1;
+      }
+      free(ptr);
+    }
+    X509_free(cert);
+    return 0;
+#else  /* HAVE_OPENSSL */
+  default:
+    /*
+      If we don't have SSL but SSL is required for this user the=20
+      authentication should fail.
+    */
+    return 1;
+#endif /* HAVE_OPENSSL */
+  }
+  return 1;
+}
+
+/**
+  Perform the handshake, authorize the client and update thd sctx variable=
s.
+
+  @param thd                     thread handle
+  @param connect_errors          number of previous failed connect attemps
+                                 from this host
+  @param com_change_user_pkt_len size of the COM_CHANGE_USER packet
+                                 (without the first, command, byte) or 0
+                                 if it's not a COM_CHANGE_USER (that is, if
+                                 it's a new connection)
+
+  @retval 0  success, thd is updated.
+  @retval 1  error
+*/
+int acl_authenticate(THD *thd, uint connect_errors, uint com_change_user_p=
kt_len)
+{
+  int res, old_status;
+  plugin_ref plugin;
+  MPVIO_EXT mpvio;
+  st_mysql_auth *auth;
+  LEX_STRING *auth_plugin_name=3D default_auth_plugin_name;
+  bool unlock_plugin;
+  enum  enum_server_command command=3D com_change_user_pkt_len ? COM_CHANG=
E_USER
+                                                             : COM_CONNECT;
+
+  compile_time_assert(MYSQL_USERNAME_LENGTH =3D=3D USERNAME_LENGTH);
+
+  bzero(&mpvio, sizeof(mpvio));
+  mpvio.read_packet=3D server_mpvio_read_packet;
+  mpvio.write_packet=3D server_mpvio_write_packet;
+  mpvio.info=3D server_mpvio_info;
+  mpvio.thd=3D thd;
+  mpvio.connect_errors=3D connect_errors;
+  mpvio.status=3D MPVIO_EXT::FAILURE;
+
+  if (com_change_user_pkt_len =3D=3D 0)
+    thd->scramble[SCRAMBLE_LENGTH]=3D 1; // it means - there is no scrambl=
e yet
+  else
+  {
+    mpvio.packets_written++; // pretend that a server handshake packet was=
 sent
+    mpvio.packets_read++;    // take COM_CHANGE_USER packet into account
+
+    if (parse_com_change_user_packet(&mpvio, com_change_user_pkt_len))
+      return 1;
+
+    DBUG_ASSERT(mpvio.status =3D=3D MPVIO_EXT::RESTART ||
+                mpvio.status =3D=3D MPVIO_EXT::SUCCESS);
+    /*
+      we skip the first step of the authentication -
+      the one that starts a default plugin, sends the handshake packet wit=
h the
+      scramble and reads the packet with the user name.
+      in COM_CHANGE_USER the client already has the scramble and we already
+      know the user name
+    */
+    goto skip_first;
+  }
+
+retry:
+  unlock_plugin=3D false;
+  if (auth_plugin_name->str =3D=3D native_password_plugin_name.str)
+    plugin=3D native_password_plugin;
+  else
+#ifndef EMBEDDED_LIBRARY
+  if (auth_plugin_name->str =3D=3D old_password_plugin_name.str)
+    plugin=3D old_password_plugin;
+  else
+  if ((plugin=3D my_plugin_lock_by_name(thd, auth_plugin_name,
+                                       MYSQL_AUTHENTICATION_PLUGIN)))
+    unlock_plugin=3D true;
+  else
+#endif
+  {
+    /* Server cannot load required plugin. */
+    my_error(ER_PLUGIN_IS_NOT_LOADED, MYF(0), auth_plugin_name->str);
+    return 1;
+  }
+
+  mpvio.plugin=3D plugin;
+  auth=3D (st_mysql_auth*)plugin_decl(plugin)->info;
+
+  old_status=3D mpvio.status;
+  res=3D auth->authenticate_user(&mpvio, &mpvio.auth_info);
+
+  if (unlock_plugin)
+    plugin_unlock(thd, plugin);
+
+skip_first:
+  /*
+    restart the authentication, if needed.
+
+    Note, that we only trust RESTART status if it wasn't set before
+    the authentication. If it was - it can never be set after the call, as
+    any read_packet() or write_packet() would've reset it. So, if it's
+    was set before authenticate_user() and we see it here, it simply means
+    that there was a restart, but a plugin never called read_packet() or
+    write_packet() and what we see is the old status from before the
+    authenticate_user() call.
+  */
+  if (mpvio.status =3D=3D MPVIO_EXT::RESTART)
+  {
+    if (old_status =3D=3D MPVIO_EXT::RESTART)
+      mpvio.status=3D MPVIO_EXT::FAILURE; // reset to the default
+    else
+    {
+      DBUG_ASSERT(mpvio.acl_user);
+      auth_plugin_name=3D &mpvio.acl_user->plugin;
+      goto retry;
+    }
+  }
+
+  Security_context *sctx=3D thd->security_ctx;
+  ACL_USER *acl_user=3D mpvio.acl_user;
+
+  thd->password=3D mpvio.auth_info.password_used;  // remember for error m=
essages=20
+
+  /*
+    Log the command here so that the user can check the log
+    for the tried logins and also to detect break-in attempts.
+
+    if sctx->user is unset it's protocol failure, bad packet.
+  */
+  if (sctx->user)
+  {
+    if (strcmp(sctx->priv_user, sctx->user))
+    {
+      general_log_print(thd, command, "%s@%s as %s on %s",
+                        sctx->user, sctx->host_or_ip,
+                        sctx->priv_user[0] ? sctx->priv_user : "anonymous",
+                        mpvio.db.str ? mpvio.db.str : (char*) "");
+    }
+    else
+      general_log_print(thd, command, (char*) "%s@%s on %s",
+                        sctx->user, sctx->host_or_ip,
+                        mpvio.db.str ? mpvio.db.str : (char*) "");
+  }
+
+  if (res > CR_OK && mpvio.status !=3D MPVIO_EXT::SUCCESS)
+  {
+    DBUG_ASSERT(mpvio.status =3D=3D MPVIO_EXT::FAILURE);
+
+    if (!thd->is_error())
+      login_failed_error(thd, thd->password);
+    return 1;
+  }
+
+  if (initialized) // if not --skip-grant-tables
+  {
+    sctx->master_access=3D acl_user->access;
+    strmake(sctx->priv_user, mpvio.auth_info.authenticated_as, USERNAME_LE=
NGTH);
+    if (acl_user->host.hostname)
+      strmake(sctx->priv_host, acl_user->host.hostname, MAX_HOSTNAME);
+    else
+      *sctx->priv_host=3D 0;
+
+    /*
+      OK. Let's check the SSL. Historically it was checked after the passw=
ord,
+      as an additional layer, not instead of the password
+      (in which case it would've been a plugin too).
+    */
+    if (acl_check_ssl(thd, acl_user))
+    {
+      login_failed_error(thd, thd->password);
+      return 1;
+    }
+
+    /* Don't allow the user to connect if he has done too many queries */
+    if ((acl_user->user_resource.questions || acl_user->user_resource.upda=
tes ||
+         acl_user->user_resource.conn_per_hour ||
+         acl_user->user_resource.user_conn || max_user_connections) &&
+        get_or_create_user_conn(thd,
+          (opt_old_style_user_limits ? sctx->user : sctx->priv_user),
+          (opt_old_style_user_limits ? sctx->host_or_ip : sctx->priv_host),
+          &acl_user->user_resource))
+      return 1; // The error is set by get_or_create_user_conn()
+  }
+  else
+    sctx->skip_grants();
+
+  if (thd->user_connect &&
+      (thd->user_connect->user_resources.conn_per_hour ||
+       thd->user_connect->user_resources.user_conn ||
+       max_user_connections) &&
+      check_for_max_user_connections(thd, thd->user_connect))
+  {
+    status_var_increment(denied_connections);
+    return 1; // The error is set in check_for_max_user_connections()
+  }
+
+  DBUG_PRINT("info",
+             ("Capabilities: %lu  packet_length: %ld  Host: '%s'  "
+              "Login user: '%s' Priv_user: '%s'  Using password: %s "
+              "Access: %lu  db: '%s'",
+              thd->client_capabilities, thd->max_client_packet_length,
+              sctx->host_or_ip, sctx->user, sctx->priv_user,
+              thd->password ? "yes": "no",
+              sctx->master_access, mpvio.db.str));
+
+  if (command =3D=3D COM_CONNECT &&
+      !(thd->main_security_ctx.master_access & SUPER_ACL))
+  {
+    pthread_mutex_lock(&LOCK_connection_count);
+    bool count_ok=3D (*thd->scheduler->connection_count <=3D
+               *thd->scheduler->max_connections);
+    VOID(pthread_mutex_unlock(&LOCK_connection_count));
+    if (!count_ok)
+    {                                         // too many connections
+      my_error(ER_CON_COUNT_ERROR, MYF(0));
+      return 1;
+    }
+  }
+
+  /*
+    This is the default access rights for the current database.  It's
+    set to 0 here because we don't have an active database yet (and we
+    may not have an active database to set.
+  */
+  sctx->db_access=3D0;
+
+  /* Change a database if necessary */
+  if (mpvio.db.length)
+  {
+    if (mysql_change_db(thd, &mpvio.db, FALSE))
+    {
+      /* mysql_change_db() has pushed the error message. */
+      if (thd->user_connect)
+      {
+        decrease_user_connections(thd->user_connect);
+        status_var_increment(thd->status_var.access_denied_errors);
+        thd->user_connect=3D 0;
+      }
+      return 1;
+    }
+  }
+
+  if (res =3D=3D CR_OK_HANDSHAKE_COMPLETE)
+    thd->main_da.disable_status();
+  else
+    my_ok(thd);
+
+  /* Ready to handle queries */
+  return 0;
+}
+
+/**
+  MySQL Server Password Authentication Plugin
+
+  In the MySQL authentication protocol:
+  1. the server sends the random scramble to the client
+  2. client sends the encrypted password back to the server
+  3. the server checks the password.
+*/
+static int native_password_authenticate(MYSQL_PLUGIN_VIO *vio,=20
+                                              MYSQL_SERVER_AUTH_INFO *info)
+{
+  uchar *pkt;
+  int pkt_len;
+  MPVIO_EXT *mpvio=3D(MPVIO_EXT*)vio;
+  THD *thd=3Dmpvio->thd;
+
+  /*
+    let's check if the client has got the scramble already.
+    That could've happened if another plugin has started the authenticatio=
n,
+    has sent the scramble, but after reading the user name the server has =
found
+    that this particular user should be handled by this particular plugin.
+  */
+
+  if (thd->scramble[SCRAMBLE_LENGTH])
+  {
+    /* no scramble was sent to the client yet, do it now */
+    create_random_string(thd->scramble,
+                         pkt_len=3D SCRAMBLE_LENGTH, &thd->rand);
+    pkt=3D (uchar*)thd->scramble;
+    if (mpvio->write_packet(mpvio, pkt, pkt_len + 1))
+      return CR_ERROR;
+  }
+
+  /* ok, the client has got the scramble. read the reply and authenticate =
*/
+
+  /*
+    <digression>
+      This is more complex than it looks.
+
+      The plugin (we) may be called right after the client was connected -
+      and will need to send a scramble, read reply, authenticate.
+
+      Or the plugin may be called after another plugin has sent a scramble,
+      and read the reply. If the client has used the correct client-plugin,
+      we won't need to read anything here from the client, the client
+      has already sent a reply with everything we need for authentication.
+
+      Or the plugin may be called after another plugin has sent a scramble,
+      and read the reply, but the client has used the wrong client-plugin.
+      We'll need to sent a "switch to another plugin" packet to the
+      client and read the reply. "Use the short scramble" packet is a spec=
ial
+      case of "switch to another plugin" packet.
+
+      Or, perhaps, the plugin may be called after another plugin has
+      done the handshake but did not send a useful scramble. We'll need
+      to send a scramble (and perhaps a "switch to another plugin" packet)
+      and read the reply.
+
+      Besides, a client may be an old one, that doesn't understand plugins.
+      Or doesn't even understand 4.0 scramble.
+
+      And we want to keep the same protocol on the wire  unless non-native
+      plugins are involved.
+
+      Anyway, it still looks simple from a plugin point of view:
+      "the client has got the scramble, read the reply and authenticate".
+      All the magic is transparently handled by the server.
+    </digression>
+  */
+
+  /* read the reply with the encrypted password */
+  if ((pkt_len=3D mpvio->read_packet(mpvio, &pkt)) < 0)
+    return CR_ERROR;
+
+#ifdef NO_EMBEDDED_ACCESS_CHECKS
+  return CR_OK;
+#endif
+
+  if (pkt_len =3D=3D 0) /* no password */
+    return info->auth_string[0] ? CR_ERROR : CR_OK;
+
+  info->password_used =3D 1;
+  if (pkt_len =3D=3D SCRAMBLE_LENGTH)
+    return check_scramble(pkt, thd->scramble, mpvio->acl_user->salt) ?
+             CR_ERROR : CR_OK;
+
+  inc_host_errors(&mpvio->thd->net.vio->remote.sin_addr);
+  my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.host_or_ip);
+  return CR_ERROR;
+}
+
+static int old_password_authenticate(MYSQL_PLUGIN_VIO *vio,=20
+                                           MYSQL_SERVER_AUTH_INFO *info)
+{
+  uchar *pkt;
+  int pkt_len;
+  MPVIO_EXT *mpvio=3D(MPVIO_EXT*)vio;
+  THD *thd=3Dmpvio->thd;
+
+  if (thd->scramble[SCRAMBLE_LENGTH])
+  {
+    /* no scramble was sent to the client yet, do it now */
+    create_random_string(thd->scramble,
+                         pkt_len=3D SCRAMBLE_LENGTH, &thd->rand);
+    pkt=3D (uchar*)thd->scramble;
+    if (mpvio->write_packet(mpvio, pkt, pkt_len))
+      return CR_ERROR;
+  }
+
+  /* ok, the client has got the scramble. read the reply and authenticate =
*/
+  if ((pkt_len=3D mpvio->read_packet(mpvio, &pkt)) < 0)
+    return CR_ERROR;
+
+#ifdef NO_EMBEDDED_ACCESS_CHECKS
+  return CR_OK;
+#endif
+
+  /*
+    legacy: if switch_from_long_to_short_scramble,
+    the password is sent \0-terminated, the pkt_len is always 9 bytes.
+    We need to figure out the correct scramble length here.
+  */
+  if (pkt_len =3D=3D SCRAMBLE_LENGTH_323+1)
+    pkt_len=3D strnlen((char*)pkt, pkt_len);
+
+  if (pkt_len =3D=3D 0) /* no password */
+    return info->auth_string[0] ? CR_ERROR : CR_OK;
+
+  /*
+    If the server is running in secure auth mode, short scrambles are=20
+    forbidden. Extra juggling to report the same error as the old code.
+  */
+  if (opt_secure_auth)
+  {
+    if (thd->client_capabilities & CLIENT_PROTOCOL_41)
+    {
+      my_error(ER_SERVER_IS_IN_SECURE_AUTH_MODE, MYF(0),
+               thd->security_ctx->user,
+               thd->security_ctx->host_or_ip);
+      general_log_print(thd, COM_CONNECT, ER(ER_SERVER_IS_IN_SECURE_AUTH_M=
ODE),
+                        thd->security_ctx->user,
+                        thd->security_ctx->host_or_ip);
+    }
+    else
+    {
+      my_error(ER_NOT_SUPPORTED_AUTH_MODE, MYF(0));
+      general_log_print(thd, COM_CONNECT, ER(ER_NOT_SUPPORTED_AUTH_MODE));
+    }
+    return CR_ERROR;
+  }
+
+  info->password_used =3D 1;
+
+  if (pkt_len =3D=3D SCRAMBLE_LENGTH_323)
+    return check_scramble_323(pkt, thd->scramble,
+                             (ulong *)mpvio->acl_user->salt) ? CR_ERROR : =
CR_OK;
+
+  inc_host_errors(&mpvio->thd->net.vio->remote.sin_addr);
+  my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.host_or_ip);
+  return CR_ERROR;
+}
+
+static struct st_mysql_auth native_password_handler=3D
+{
+  MYSQL_AUTHENTICATION_INTERFACE_VERSION,
+  native_password_plugin_name.str,
+  native_password_authenticate
+};
+
+static struct st_mysql_auth old_password_handler=3D
+{
+  MYSQL_AUTHENTICATION_INTERFACE_VERSION,
+  old_password_plugin_name.str,
+  old_password_authenticate
+};
+
+mysql_declare_plugin(mysql_password)
+{
+  MYSQL_AUTHENTICATION_PLUGIN,                  /* type constant    */
+  &native_password_handler,                     /* type descriptor  */
+  native_password_plugin_name.str,              /* Name             */
+  "R.J.Silk, Sergei Golubchik",                 /* Author           */
+  "Native MySQL authentication",                /* Description      */
+  PLUGIN_LICENSE_GPL,                           /* License          */
+  NULL,                                         /* Init function    */
+  NULL,                                         /* Deinit function  */
+  0x0100,                                       /* Version (1.0)    */
+  NULL,                                         /* status variables */
+  NULL,                                         /* system variables */
+  NULL                                          /* config options   */
+},
+{
+  MYSQL_AUTHENTICATION_PLUGIN,                  /* type constant    */
+  &old_password_handler,                        /* type descriptor  */
+  old_password_plugin_name.str,                 /* Name             */
+  "R.J.Silk, Sergei Golubchik",                 /* Author           */
+  "Old MySQL-4.0 authentication",               /* Description      */
+  PLUGIN_LICENSE_GPL,                           /* License          */
+  NULL,                                         /* Init function    */
+  NULL,                                         /* Deinit function  */
+  0x0100,                                       /* Version (1.0)    */
+  NULL,                                         /* status variables */
+  NULL,                                         /* system variables */
+  NULL                                          /* config options   */
+}
+mysql_declare_plugin_end;
+

=3D=3D=3D modified file 'sql/sql_acl.h'
--- sql/sql_acl.h	2009-11-21 11:18:21 +0000
+++ sql/sql_acl.h	2010-02-19 08:18:09 +0000
@@ -161,53 +161,6 @@
=20
 extern const TABLE_FIELD_DEF mysql_db_table_def;
=20
-/* Classes */
-
-struct acl_host_and_ip
-{
-  char *hostname;
-  long ip,ip_mask;                      // Used with masked ip:s
-};
-
-
-class ACL_ACCESS {
-public:
-  ulong sort;
-  ulong access;
-};
-
-
-/* ACL_HOST is used if no host is specified */
-
-class ACL_HOST :public ACL_ACCESS
-{
-public:
-  acl_host_and_ip host;
-  char *db;
-};
-
-
-class ACL_USER :public ACL_ACCESS
-{
-public:
-  acl_host_and_ip host;
-  uint hostname_length;
-  USER_RESOURCES user_resource;
-  char *user;
-  uint8 salt[SCRAMBLE_LENGTH+1];       // scrambled password in binary form
-  uint8 salt_len;        // 0 - no password, 4 - 3.20, 8 - 3.23, 20 - 4.1.=
1=20
-  enum SSL_type ssl_type;
-  const char *ssl_cipher, *x509_issuer, *x509_subject;
-};
-
-
-class ACL_DB :public ACL_ACCESS
-{
-public:
-  acl_host_and_ip host;
-  char *user,*db;
-};
-
 /* prototypes */
=20
 bool hostname_requires_resolving(const char *hostname);
@@ -216,10 +169,9 @@
 void acl_free(bool end=3D0);
 ulong acl_get(const char *host, const char *ip,
 	      const char *user, const char *db, my_bool db_is_pattern);
-int acl_getroot(THD *thd, USER_RESOURCES *mqh, const char *passwd,
-                uint passwd_len);
-bool acl_getroot_no_password(Security_context *sctx, char *user, char *hos=
t,
-                             char *ip, char *db);
+int acl_authenticate(THD *thd, uint connect_errors, uint com_change_user_p=
kt_len);
+bool acl_getroot(Security_context *sctx, char *user, char *host,
+                 char *ip, char *db);
 bool acl_check_host(const char *host, const char *ip);
 int check_change_password(THD *thd, const char *host, const char *user,
                            char *password, uint password_len);

=3D=3D=3D modified file 'sql/sql_builtin.cc.in'
--- sql/sql_builtin.cc.in	2009-11-29 23:08:56 +0000
+++ sql/sql_builtin.cc.in	2010-02-19 08:18:09 +0000
@@ -19,10 +19,10 @@
 typedef struct st_mysql_plugin builtin_plugin[];
=20
 extern builtin_plugin=20
-  builtin_binlog_plugin@mysql_plugin_defs@;
+  builtin_binlog_plugin, builtin_mysql_password_plugin@mysql_plugin_defs@;
=20
 struct st_mysql_plugin *mysqld_builtins[]=3D
 {
-  builtin_binlog_plugin@mysql_plugin_defs@,(struct st_mysql_plugin *)0
+  builtin_binlog_plugin, builtin_mysql_password_plugin@mysql_plugin_defs@,=
(struct st_mysql_plugin *)0
 };
=20

=3D=3D=3D modified file 'sql/sql_class.cc'
--- sql/sql_class.cc	2010-02-01 06:14:12 +0000
+++ sql/sql_class.cc	2010-02-19 08:18:09 +0000
@@ -2988,9 +2988,9 @@
=20
 void Security_context::init()
 {
-  host=3D user=3D priv_user=3D ip=3D 0;
+  host=3D user=3D ip=3D 0;
   host_or_ip=3D "connecting host";
-  priv_host[0]=3D '\0';
+  priv_user[0]=3D priv_host[0]=3D '\0';
   master_access=3D 0;
 #ifndef NO_EMBEDDED_ACCESS_CHECKS
   db_access=3D NO_ACCESS;
@@ -3014,8 +3014,7 @@
   /* privileges for the user are unknown everything is allowed */
   host_or_ip=3D (char *)"";
   master_access=3D ~NO_ACCESS;
-  priv_user=3D (char *)"";
-  *priv_host=3D '\0';
+  *priv_user=3D *priv_host=3D '\0';
 }
=20
=20
@@ -3057,7 +3056,7 @@
   of a statement under credentials of a different user, e.g.
   definer of a procedure, we authenticate this user in a local
   instance of Security_context by means of this method (and
-  ultimately by means of acl_getroot_no_password), and make the
+  ultimately by means of acl_getroot), and make the
   local instance active in the thread by re-setting
   thd->security_ctx pointer.
=20
@@ -3091,19 +3090,12 @@
   DBUG_ASSERT(definer_user->str && definer_host->str);
=20
   *backup=3D NULL;
-  /*
-    The current security context may have NULL members
-    if we have just started the thread and not authenticated
-    any user. This use case is currently in events worker thread.
-  */
-  needs_change=3D (thd->security_ctx->priv_user =3D=3D NULL ||
-                 strcmp(definer_user->str, thd->security_ctx->priv_user) ||
-                 thd->security_ctx->priv_host =3D=3D NULL ||
+  needs_change=3D (strcmp(definer_user->str, thd->security_ctx->priv_user)=
 ||
                  my_strcasecmp(system_charset_info, definer_host->str,
                                thd->security_ctx->priv_host));
   if (needs_change)
   {
-    if (acl_getroot_no_password(this, definer_user->str, definer_host->str,
+    if (acl_getroot(this, definer_user->str, definer_host->str,
                                 definer_host->str, db->str))
     {
       my_error(ER_NO_SUCH_USER, MYF(0), definer_user->str,

=3D=3D=3D modified file 'sql/sql_class.h'
--- sql/sql_class.h	2010-01-04 17:54:42 +0000
+++ sql/sql_class.h	2010-02-19 08:18:09 +0000
@@ -802,7 +802,8 @@
     priv_user - The user privilege we are using. May be "" for anonymous u=
ser.
     ip - client IP
   */
-  char   *host, *user, *priv_user, *ip;
+  char   *host, *user, *ip;
+  char   priv_user[USERNAME_LENGTH];
   /* The host privilege we are using */
   char   priv_host[MAX_HOSTNAME];
   /* points to host if host is available, otherwise points to ip */

=3D=3D=3D modified file 'sql/sql_connect.cc'
--- sql/sql_connect.cc	2010-02-01 06:14:12 +0000
+++ sql/sql_connect.cc	2010-02-19 08:18:09 +0000
@@ -27,24 +27,6 @@
 extern pthread_mutex_t LOCK_global_table_stats;
 extern pthread_mutex_t LOCK_global_index_stats;
=20
-#ifdef HAVE_OPENSSL
-/*
-  Without SSL the handshake consists of one packet. This packet
-  has both client capabilites and scrambled password.
-  With SSL the handshake might consist of two packets. If the first
-  packet (client capabilities) has CLIENT_SSL flag set, we have to
-  switch to SSL and read the second packet. The scrambled password
-  is in the second packet and client_capabilites field will be ignored.
-  Maybe it is better to accept flags other than CLIENT_SSL from the
-  second packet?
-*/
-#define SSL_HANDSHAKE_SIZE      2
-#define NORMAL_HANDSHAKE_SIZE   6
-#define MIN_HANDSHAKE_SIZE      2
-#else
-#define MIN_HANDSHAKE_SIZE      6
-#endif /* HAVE_OPENSSL */
-
 #ifdef __WIN__
 extern void win_install_sigabrt_handler();
 #endif
@@ -56,9 +38,9 @@
 #ifndef NO_EMBEDDED_ACCESS_CHECKS
 static HASH hash_user_connections;
=20
-static int get_or_create_user_conn(THD *thd, const char *user,
-				   const char *host,
-				   USER_RESOURCES *mqh)
+int get_or_create_user_conn(THD *thd, const char *user,
+                            const char *host,
+                            USER_RESOURCES *mqh)
 {
   int return_val=3D 0;
   size_t temp_len, user_len;
@@ -124,7 +106,6 @@
     1	error
 */
=20
-static
 int check_for_max_user_connections(THD *thd, USER_CONN *uc)
 {
   int error=3D0;
@@ -276,239 +257,6 @@
=20
 #endif /* NO_EMBEDDED_ACCESS_CHECKS */
=20
-
-/**
-  Check if user exist and password supplied is correct.
-
-  @param  thd         thread handle, thd->security_ctx->{host,user,ip} are=
 used
-  @param  command     originator of the check: now check_user is called
-                      during connect and change user procedures; used for
-                      logging.
-  @param  passwd      scrambled password received from client
-  @param  passwd_len  length of scrambled password
-  @param  db          database name to connect to, may be NULL
-  @param  check_count TRUE if establishing a new connection. In this case
-                      check that we have not exceeded the global
-                      max_connections limist
-
-  @note Host, user and passwd may point to communication buffer.
-  Current implementation does not depend on that, but future changes
-  should be done with this in mind; 'thd' is INOUT, all other params
-  are 'IN'.
-
-  @retval  0  OK; thd->security_ctx->user/master_access/priv_user/db_acces=
s and
-              thd->db are updated; OK is sent to the client.
-  @retval  1  error, e.g. access denied or handshake error, not sent to
-              the client. A message is pushed into the error stack.
-*/
-
-int
-check_user(THD *thd, enum enum_server_command command,
-	       const char *passwd, uint passwd_len, const char *db,
-	       bool check_count)
-{
-  DBUG_ENTER("check_user");
-  LEX_STRING db_str=3D { (char *) db, db ? strlen(db) : 0 };
-
-  /*
-    Clear thd->db as it points to something, that will be freed when
-    connection is closed. We don't want to accidentally free a wrong
-    pointer if connect failed. Also in case of 'CHANGE USER' failure,
-    current database will be switched to 'no database selected'.
-  */
-  thd->reset_db(NULL, 0);
-
-#ifdef NO_EMBEDDED_ACCESS_CHECKS
-  thd->main_security_ctx.master_access=3D GLOBAL_ACLS;       // Full rights
-  /* Change database if necessary */
-  if (db && db[0])
-  {
-    if (mysql_change_db(thd, &db_str, FALSE))
-      DBUG_RETURN(1);
-  }
-  my_ok(thd);
-  DBUG_RETURN(0);
-#else
-
-  my_bool opt_secure_auth_local;
-  pthread_mutex_lock(&LOCK_global_system_variables);
-  opt_secure_auth_local=3D opt_secure_auth;
-  pthread_mutex_unlock(&LOCK_global_system_variables);
- =20
-  /*
-    If the server is running in secure auth mode, short scrambles are=20
-    forbidden.
-  */
-  if (opt_secure_auth_local && passwd_len =3D=3D SCRAMBLE_LENGTH_323)
-  {
-    my_error(ER_NOT_SUPPORTED_AUTH_MODE, MYF(0));
-    general_log_print(thd, COM_CONNECT, ER(ER_NOT_SUPPORTED_AUTH_MODE));
-    DBUG_RETURN(1);
-  }
-  if (passwd_len !=3D 0 &&
-      passwd_len !=3D SCRAMBLE_LENGTH &&
-      passwd_len !=3D SCRAMBLE_LENGTH_323)
-  {
-    my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.host_or_ip=
);
-    DBUG_RETURN(1);
-  }
-
-  USER_RESOURCES ur;
-  int res=3D acl_getroot(thd, &ur, passwd, passwd_len);
-#ifndef EMBEDDED_LIBRARY
-  if (res =3D=3D -1)
-  {
-    /*
-      This happens when client (new) sends password scrambled with
-      scramble(), but database holds old value (scrambled with
-      scramble_323()). Here we please client to send scrambled_password
-      in old format.
-    */
-    NET *net=3D &thd->net;
-    if (opt_secure_auth_local)
-    {
-      my_error(ER_SERVER_IS_IN_SECURE_AUTH_MODE, MYF(0),
-               thd->main_security_ctx.user,
-               thd->main_security_ctx.host_or_ip);
-      general_log_print(thd, COM_CONNECT, ER(ER_SERVER_IS_IN_SECURE_AUTH_M=
ODE),
-                        thd->main_security_ctx.user,
-                        thd->main_security_ctx.host_or_ip);
-      DBUG_RETURN(1);
-    }
-    /* We have to read very specific packet size */
-    if (send_old_password_request(thd) ||
-        my_net_read(net) !=3D SCRAMBLE_LENGTH_323 + 1)
-    {
-      inc_host_errors(&thd->remote.sin_addr);
-      my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.host_or_=
ip);
-      DBUG_RETURN(1);
-    }
-    /* Final attempt to check the user based on reply */
-    /* So as passwd is short, errcode is always >=3D 0 */
-    res=3D acl_getroot(thd, &ur, (char *) net->read_pos, SCRAMBLE_LENGTH_3=
23);
-  }
-#endif /*EMBEDDED_LIBRARY*/
-  /* here res is always >=3D 0 */
-  if (res =3D=3D 0)
-  {
-    if (!(thd->main_security_ctx.master_access &
-          NO_ACCESS)) // authentication is OK
-    {
-      DBUG_PRINT("info",
-                 ("Capabilities: %lu  packet_length: %ld  Host: '%s'  "
-                  "Login user: '%s' Priv_user: '%s'  Using password: %s "
-                  "Access: %lu  db: '%s'",
-                  thd->client_capabilities,
-                  thd->max_client_packet_length,
-                  thd->main_security_ctx.host_or_ip,
-                  thd->main_security_ctx.user,
-                  thd->main_security_ctx.priv_user,
-                  passwd_len ? "yes": "no",
-                  thd->main_security_ctx.master_access,
-                  (thd->db ? thd->db : "*none*")));
-
-      if (check_count)
-      {
-        bool count_ok=3D 1;
-       =20
-        if (!(thd->main_security_ctx.master_access & SUPER_ACL))
-        {
-          pthread_mutex_lock(&LOCK_connection_count);
-          count_ok=3D (*thd->scheduler->connection_count <=3D
-                     *thd->scheduler->max_connections);
-          VOID(pthread_mutex_unlock(&LOCK_connection_count));
-        }
-        if (!count_ok)
-        {                                         // too many connections
-          my_error(ER_CON_COUNT_ERROR, MYF(0));
-          DBUG_RETURN(1);
-        }
-      }
-
-      /*
-        Log the command before authentication checks, so that the user can
-        check the log for the tried login tried and also to detect
-        break-in attempts.
-      */
-      general_log_print(thd, command,
-                        (thd->main_security_ctx.priv_user =3D=3D
-                         thd->main_security_ctx.user ?
-                         (char*) "%s@%s on %s" :
-                         (char*) "%s@%s as anonymous on %s"),
-                        thd->main_security_ctx.user,
-                        thd->main_security_ctx.host_or_ip,
-                        db ? db : (char*) "");
-
-      /*
-        This is the default access rights for the current database.  It's
-        set to 0 here because we don't have an active database yet (and we
-        may not have an active database to set.
-      */
-      thd->main_security_ctx.db_access=3D0;
-
-      /* Don't allow user to connect if he has done too many queries */
-      if ((ur.questions || ur.updates || ur.conn_per_hour || ur.user_conn =
||
-	   max_user_connections) &&
-	  get_or_create_user_conn(thd,
-            (opt_old_style_user_limits ? thd->main_security_ctx.user :
-             thd->main_security_ctx.priv_user),
-            (opt_old_style_user_limits ? thd->main_security_ctx.host_or_ip=
 :
-             thd->main_security_ctx.priv_host),
-            &ur))
-      {
-        /* The error is set by get_or_create_user_conn(). */
-	DBUG_RETURN(1);
-      }
-      if (thd->user_connect &&
-	  (thd->user_connect->user_resources.conn_per_hour ||
-	   thd->user_connect->user_resources.user_conn ||
-	   max_user_connections) &&
-	  check_for_max_user_connections(thd, thd->user_connect))
-      {
-        /* The error is set in check_for_max_user_connections(). */
-        status_var_increment(denied_connections);
-        DBUG_RETURN(1);
-      }
-
-      /* Change database if necessary */
-      if (db && db[0])
-      {
-        if (mysql_change_db(thd, &db_str, FALSE))
-        {
-          /* mysql_change_db() has pushed the error message. */
-          if (thd->user_connect)
-            decrease_user_connections(thd->user_connect);
-          status_var_increment(thd->status_var.access_denied_errors);
-          DBUG_RETURN(1);
-        }
-      }
-      my_ok(thd);
-      thd->password=3D test(passwd_len);          // remember for error me=
ssages=20
-      /* Ready to handle queries */
-      DBUG_RETURN(0);
-    }
-  }
-  else if (res =3D=3D 2) // client gave short hash, server has long hash
-  {
-    my_error(ER_NOT_SUPPORTED_AUTH_MODE, MYF(0));
-    general_log_print(thd, COM_CONNECT, ER(ER_NOT_SUPPORTED_AUTH_MODE));
-    DBUG_RETURN(1);
-  }
-  my_error(ER_ACCESS_DENIED_ERROR, MYF(0),
-           thd->main_security_ctx.user,
-           thd->main_security_ctx.host_or_ip,
-           passwd_len ? ER(ER_YES) : ER(ER_NO));
-  general_log_print(thd, COM_CONNECT, ER(ER_ACCESS_DENIED_ERROR),
-                    thd->main_security_ctx.user,
-                    thd->main_security_ctx.host_or_ip,
-                    passwd_len ? ER(ER_YES) : ER(ER_NO));
-  status_var_increment(thd->status_var.access_denied_errors);
-
-  DBUG_RETURN(1);
-#endif /* NO_EMBEDDED_ACCESS_CHECKS */
-}
-
-
 /*
   Check for maximum allowable user connections, if the mysqld server is
   started with corresponding variable that is greater then 0.
@@ -1087,9 +835,8 @@
     thd  thread handle
=20
   RETURN
-     0  success, OK is sent to user, thd is updated.
-    -1  error, which is sent to user
-   > 0  error code (not sent to user)
+     0  success, thd is updated.
+     1  error
 */
=20
 #ifndef EMBEDDED_LIBRARY
@@ -1097,8 +844,6 @@
 {
   uint connect_errors=3D 0;
   NET *net=3D &thd->net;
-  ulong pkt_len=3D 0;
-  char *end;
=20
   DBUG_PRINT("info",
              ("New connection received on %s", vio_description(net->vio)));
@@ -1160,200 +905,10 @@
   }
   vio_keepalive(net->vio, TRUE);
  =20
-  ulong server_capabilites;
-  {
-    /* buff[] needs to big enough to hold the server_version variable */
-    char buff[SERVER_VERSION_LENGTH + SCRAMBLE_LENGTH + 64];
-    server_capabilites=3D CLIENT_BASIC_FLAGS;
-
-    if (opt_using_transactions)
-      server_capabilites|=3D CLIENT_TRANSACTIONS;
-#ifdef HAVE_COMPRESS
-    server_capabilites|=3D CLIENT_COMPRESS;
-#endif /* HAVE_COMPRESS */
-#ifdef HAVE_OPENSSL
-    if (ssl_acceptor_fd)
-    {
-      server_capabilites |=3D CLIENT_SSL;       /* Wow, SSL is available! =
*/
-      server_capabilites |=3D CLIENT_SSL_VERIFY_SERVER_CERT;
-    }
-#endif /* HAVE_OPENSSL */
-
-    end=3D strnmov(buff, server_version, SERVER_VERSION_LENGTH) + 1;
-    int4store((uchar*) end, thd->thread_id);
-    end+=3D 4;
-    /*
-      So as check_connection is the only entry point to authorization
-      procedure, scramble is set here. This gives us new scramble for
-      each handshake.
-    */
-    create_random_string(thd->scramble, SCRAMBLE_LENGTH, &thd->rand);
-    /*
-      Old clients does not understand long scrambles, but can ignore packet
-      tail: that's why first part of the scramble is placed here, and seco=
nd
-      part at the end of packet.
-    */
-    end=3D strmake(end, thd->scramble, SCRAMBLE_LENGTH_323) + 1;
-  =20
-    int2store(end, server_capabilites);
-    /* write server characteristics: up to 16 bytes allowed */
-    end[2]=3D(char) default_charset_info->number;
-    int2store(end+3, thd->server_status);
-    bzero(end+5, 13);
-    end+=3D 18;
-    /* write scramble tail */
-    end=3D strmake(end, thd->scramble + SCRAMBLE_LENGTH_323,=20
-                 SCRAMBLE_LENGTH - SCRAMBLE_LENGTH_323) + 1;
-
-    /* At this point we write connection message and read reply */
-    if (net_write_command(net, (uchar) protocol_version, (uchar*) "", 0,
-                          (uchar*) buff, (size_t) (end-buff)) ||
-	(pkt_len=3D my_net_read(net)) =3D=3D packet_error ||
-	pkt_len < MIN_HANDSHAKE_SIZE)
-    {
-      inc_host_errors(&thd->remote.sin_addr);
-      my_error(ER_HANDSHAKE_ERROR, MYF(0),
-               thd->main_security_ctx.host_or_ip);
-      return 1;
-    }
-  }
-#ifdef _CUSTOMCONFIG_
-#include "_cust_sql_parse.h"
-#endif
-  if (connect_errors)
-    reset_host_errors(&thd->remote.sin_addr);
   if (thd->packet.alloc(thd->variables.net_buffer_length))
     return 1; /* The error is set by alloc(). */
=20
-  thd->client_capabilities=3D uint2korr(net->read_pos);
-  if (thd->client_capabilities & CLIENT_PROTOCOL_41)
-  {
-    thd->client_capabilities|=3D ((ulong) uint2korr(net->read_pos+2)) << 1=
6;
-    thd->max_client_packet_length=3D uint4korr(net->read_pos+4);
-    DBUG_PRINT("info", ("client_character_set: %d", (uint) net->read_pos[8=
]));
-    thd_init_client_charset(thd, (uint) net->read_pos[8]);
-    thd->update_charset();
-    end=3D (char*) net->read_pos+32;
-  }
-  else
-  {
-    thd->max_client_packet_length=3D uint3korr(net->read_pos+2);
-    end=3D (char*) net->read_pos+5;
-  }
-  /*
-    Disable those bits which are not supported by the server.
-    This is a precautionary measure, if the client lies. See Bug#27944.
-  */
-  thd->client_capabilities&=3D server_capabilites;
-
-  if (thd->client_capabilities & CLIENT_IGNORE_SPACE)
-    thd->variables.sql_mode|=3D MODE_IGNORE_SPACE;
-#ifdef HAVE_OPENSSL
-  DBUG_PRINT("info", ("client capabilities: %lu", thd->client_capabilities=
));
-  if (thd->client_capabilities & CLIENT_SSL)
-  {
-    char error_string[1024];
-    /* Do the SSL layering. */
-    if (!ssl_acceptor_fd)
-    {
-      inc_host_errors(&thd->remote.sin_addr);
-      my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.host_or_=
ip);
-      return 1;
-    }
-    DBUG_PRINT("info", ("IO layer change in progress..."));
-    if (sslaccept(ssl_acceptor_fd, net->vio, net->read_timeout, error_stri=
ng))
-    {
-      DBUG_PRINT("error", ("Failed to accept new SSL connection"));
-      inc_host_errors(&thd->remote.sin_addr);
-      my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.host_or_=
ip);
-      return 1;
-    }
-    DBUG_PRINT("info", ("Reading user information over SSL layer"));
-    if ((pkt_len=3D my_net_read(net)) =3D=3D packet_error ||
-	pkt_len < NORMAL_HANDSHAKE_SIZE)
-    {
-      DBUG_PRINT("error", ("Failed to read user information (pkt_len=3D %l=
u)",
-			   pkt_len));
-      inc_host_errors(&thd->remote.sin_addr);
-      my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.host_or_=
ip);
-      return 1;
-    }
-  }
-#endif /* HAVE_OPENSSL */
-
-  if (end >=3D (char*) net->read_pos+ pkt_len +2)
-  {
-    inc_host_errors(&thd->remote.sin_addr);
-    my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.host_or_ip=
);
-    return 1;
-  }
-
-  if (thd->client_capabilities & CLIENT_INTERACTIVE)
-    thd->variables.net_wait_timeout=3D thd->variables.net_interactive_time=
out;
-  if ((thd->client_capabilities & CLIENT_TRANSACTIONS) &&
-      opt_using_transactions)
-    net->return_status=3D &thd->server_status;
-
-  char *user=3D end;
-  char *passwd=3D strend(user)+1;
-  uint user_len=3D passwd - user - 1;
-  char *db=3D passwd;
-  char db_buff[NAME_LEN + 1];           // buffer to store db in utf8
-  char user_buff[USERNAME_LENGTH + 1];	// buffer to store user in utf8
-  uint dummy_errors;
-
-  /*
-    Old clients send null-terminated string as password; new clients send
-    the size (1 byte) + string (not null-terminated). Hence in case of emp=
ty
-    password both send '\0'.
-
-    This strlen() can't be easily deleted without changing protocol.
-
-    Cast *passwd to an unsigned char, so that it doesn't extend the sign f=
or
-    *passwd > 127 and become 2**32-127+ after casting to uint.
-  */
-  uint passwd_len=3D thd->client_capabilities & CLIENT_SECURE_CONNECTION ?
-    (uchar)(*passwd++) : strlen(passwd);
-  db=3D thd->client_capabilities & CLIENT_CONNECT_WITH_DB ?
-    db + passwd_len + 1 : 0;
-  /* strlen() can't be easily deleted without changing protocol */
-  uint db_len=3D db ? strlen(db) : 0;
-
-  if (passwd + passwd_len + db_len > (char *)net->read_pos + pkt_len)
-  {
-    inc_host_errors(&thd->remote.sin_addr);
-    my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.host_or_ip=
);
-    return 1;
-  }
-
-  /* Since 4.1 all database names are stored in utf8 */
-  if (db)
-  {
-    db_buff[copy_and_convert(db_buff, sizeof(db_buff)-1,
-                             system_charset_info,
-                             db, db_len,
-                             thd->charset(), &dummy_errors)]=3D 0;
-    db=3D db_buff;
-  }
-
-  user_buff[user_len=3D copy_and_convert(user_buff, sizeof(user_buff)-1,
-                                       system_charset_info, user, user_len,
-                                       thd->charset(), &dummy_errors)]=3D =
'\0';
-  user=3D user_buff;
-
-  /* If username starts and ends in "'", chop them off */
-  if (user_len > 1 && user[0] =3D=3D '\'' && user[user_len - 1] =3D=3D
'\'=
')
-  {
-    user[user_len-1]=3D 0;
-    user++;
-    user_len-=3D 2;
-  }
-
-  if (thd->main_security_ctx.user)
-    x_free(thd->main_security_ctx.user);
-  if (!(thd->main_security_ctx.user=3D my_strdup(user, MYF(MY_WME))))
-    return 1; /* The error is set by my_strdup(). */
-  return check_user(thd, COM_CONNECT, passwd, passwd_len, db, TRUE);
+  return acl_authenticate(thd, connect_errors, 0);
 }
=20
=20

=3D=3D=3D modified file 'sql/sql_insert.cc'
--- sql/sql_insert.cc	2010-02-01 06:14:12 +0000
+++ sql/sql_insert.cc	2010-02-19 08:18:09 +0000
@@ -1769,8 +1769,10 @@
      table(0),tables_in_use(0),stacked_inserts(0), status(0), dead(0),
      group_count(0)
   {
-    thd.security_ctx->user=3Dthd.security_ctx->priv_user=3D(char*) delayed=
_user;
+    thd.security_ctx->user=3D(char*) delayed_user;
     thd.security_ctx->host=3D(char*) my_localhost;
+    strmake(thd.security_ctx->priv_user, thd.security_ctx->user,
+            USERNAME_LENGTH);
     thd.current_tablenr=3D0;
     thd.version=3Drefresh_version;
     thd.command=3DCOM_DELAYED_INSERT;

=3D=3D=3D modified file 'sql/sql_lex.h'
--- sql/sql_lex.h	2010-01-04 17:54:42 +0000
+++ sql/sql_lex.h	2010-02-19 08:18:09 +0000
@@ -952,6 +952,8 @@
 enum xa_option_words {XA_NONE, XA_JOIN, XA_RESUME, XA_ONE_PHASE,
                       XA_SUSPEND, XA_FOR_MIGRATE};
=20
+extern const LEX_STRING null_lex_str;
+extern const LEX_STRING empty_lex_str;
=20
 /*
   Class representing list of all tables used by statement.

=3D=3D=3D modified file 'sql/sql_parse.cc'
--- sql/sql_parse.cc	2010-02-01 06:14:12 +0000
+++ sql/sql_parse.cc	2010-02-19 08:18:09 +0000
@@ -444,9 +444,8 @@
=20
   thd_proc_info(thd, 0);
   thd->version=3Drefresh_version;
-  thd->security_ctx->priv_user=3D
-    thd->security_ctx->user=3D (char*) my_strdup("boot", MYF(MY_WME));
-  thd->security_ctx->priv_host[0]=3D0;
+  thd->security_ctx->user=3D (char*) my_strdup("boot", MYF(MY_WME));
+  thd->security_ctx->priv_user[0]=3D thd->security_ctx->priv_host[0]=3D0;
   /*
     Make the "client" handle multiple results. This is necessary
     to enable stored procedures with SELECTs and Dynamic SQL
@@ -1091,96 +1090,35 @@
   case COM_CHANGE_USER:
   {
     status_var_increment(thd->status_var.com_other);
-    char *user=3D (char*) packet, *packet_end=3D packet + packet_length;
-    /* Safe because there is always a trailing \0 at the end of the packet=
 */
-    char *passwd=3D strend(user)+1;
=20
     thd->change_user();
     thd->clear_error();                         // if errors from rollback
=20
-    /*
-      Old clients send null-terminated string ('\0' for empty string) for
-      password.  New clients send the size (1 byte) + string (not null
-      terminated, so also '\0' for empty string).
+    /* acl_authenticate() takes the data from net->read_pos */
+    net->read_pos=3D (uchar*)packet;
=20
-      Cast *passwd to an unsigned char, so that it doesn't extend the sign
-      for *passwd > 127 and become 2**32-127 after casting to uint.
-    */
-    char db_buff[NAME_LEN+1];                 // buffer to store db in utf8
-    char *db=3D passwd;
-    char *save_db;
-    /*
-      If there is no password supplied, the packet must contain '\0',
-      in any type of handshake (4.1 or pre-4.1).
-     */
-    if (passwd >=3D packet_end)
-    {
-      my_message(ER_UNKNOWN_COM_ERROR, ER(ER_UNKNOWN_COM_ERROR), MYF(0));
-      break;
-    }
-    uint passwd_len=3D (thd->client_capabilities & CLIENT_SECURE_CONNECTIO=
N ?
-                      (uchar)(*passwd++) : strlen(passwd));
-    uint dummy_errors, save_db_length, db_length;
-    int res;
+    uint save_db_length=3D thd->db_length;
+    char *save_db=3D thd->db;
+    USER_CONN *save_user_connect=3D thd->user_connect;
     Security_context save_security_ctx=3D *thd->security_ctx;
-    USER_CONN *save_user_connect;
-
-    db+=3D passwd_len + 1;
-    /*
-      Database name is always NUL-terminated, so in case of empty database
-      the packet must contain at least the trailing '\0'.
-    */
-    if (db >=3D packet_end)
-    {
-      my_message(ER_UNKNOWN_COM_ERROR, ER(ER_UNKNOWN_COM_ERROR), MYF(0));
-      break;
-    }
-    db_length=3D strlen(db);
-
-    char *ptr=3D db + db_length + 1;
-    uint cs_number=3D 0;
-
-    if (ptr < packet_end)
-    {
-      if (ptr + 2 > packet_end)
-      {
-        my_message(ER_UNKNOWN_COM_ERROR, ER(ER_UNKNOWN_COM_ERROR), MYF(0));
-        break;
-      }
-
-      cs_number=3D uint2korr(ptr);
-    }
-
-    /* Convert database name to utf8 */
-    db_buff[copy_and_convert(db_buff, sizeof(db_buff)-1,
-                             system_charset_info, db, db_length,
-                             thd->charset(), &dummy_errors)]=3D 0;
-    db=3D db_buff;
-
-    /* Save user and privileges */
-    save_db_length=3D thd->db_length;
-    save_db=3D thd->db;
-    save_user_connect=3D thd->user_connect;
-
-    if (!(thd->security_ctx->user=3D my_strdup(user, MYF(0))))
-    {
-      thd->security_ctx->user=3D save_security_ctx.user;
-      my_message(ER_OUT_OF_RESOURCES, ER(ER_OUT_OF_RESOURCES), MYF(0));
-      break;
-    }
-
-    /* Clear variables that are allocated */
-    thd->user_connect=3D 0;
-    thd->security_ctx->priv_user=3D thd->security_ctx->user;
-    res=3D check_user(thd, COM_CHANGE_USER, passwd, passwd_len, db, FALSE);
-
-    if (res)
+    CHARSET_INFO *save_character_set_client=3D
+      thd->variables.character_set_client;
+    CHARSET_INFO *save_collation_connection=3D
+      thd->variables.collation_connection;
+    CHARSET_INFO *save_character_set_results=3D
+      thd->variables.character_set_results;
+
+    if (acl_authenticate(thd, 0, packet_length))
     {
       x_free(thd->security_ctx->user);
       *thd->security_ctx=3D save_security_ctx;
       thd->user_connect=3D save_user_connect;
       thd->db=3D save_db;
       thd->db_length=3D save_db_length;
+      thd->variables.character_set_client=3D save_character_set_client;
+      thd->variables.collation_connection=3D save_collation_connection;
+      thd->variables.character_set_results=3D save_character_set_results;
+      thd->update_charset();
     }
     else
     {
@@ -1191,12 +1129,6 @@
 #endif /* NO_EMBEDDED_ACCESS_CHECKS */
       x_free(save_db);
       x_free(save_security_ctx.user);
-
-      if (cs_number)
-      {
-        thd_init_client_charset(thd, cs_number);
-        thd->update_charset();
-      }
     }
     break;
   }
@@ -4348,8 +4280,8 @@
         if (sp_grant_privileges(thd, lex->sphead->m_db.str, name,
                                 lex->sql_command =3D=3D SQLCOM_CREATE_PROC=
EDURE))
           push_warning(thd, MYSQL_ERROR::WARN_LEVEL_WARN,
-                       ER_PROC_AUTO_GRANT_FAIL,
-                       ER(ER_PROC_AUTO_GRANT_FAIL));
+                       ER_PROC_AUTO_GRANT_FAIL, ER(ER_PROC_AUTO_GRANT_FAIL=
));
+        thd->clear_error();
       }
=20
       /*
@@ -7723,8 +7655,9 @@
   definer->host.str=3D (char *) sctx->priv_host;
   definer->host.length=3D strlen(definer->host.str);
=20
-  definer->password.str=3D NULL;
-  definer->password.length=3D 0;
+  definer->password=3D null_lex_str;
+  definer->plugin=3D empty_lex_str;
+  definer->auth=3D empty_lex_str;
 }
=20
=20

=3D=3D=3D modified file 'sql/sql_plugin.cc'
--- sql/sql_plugin.cc	2010-02-01 06:14:12 +0000
+++ sql/sql_plugin.cc	2010-02-19 08:18:09 +0000
@@ -16,6 +16,7 @@
 #include "mysql_priv.h"
 #include <my_pthread.h>
 #include <my_getopt.h>
+#include <mysql/plugin_auth.h>
 #define REPORT_TO_LOG  1
 #define REPORT_TO_USER 2
=20
@@ -54,7 +55,10 @@
   { C_STRING_WITH_LEN("STORAGE ENGINE") },
   { C_STRING_WITH_LEN("FTPARSER") },
   { C_STRING_WITH_LEN("DAEMON") },
-  { C_STRING_WITH_LEN("INFORMATION SCHEMA") }
+  { C_STRING_WITH_LEN("INFORMATION SCHEMA") },
+  { C_STRING_WITH_LEN("AUDIT") },
+  { C_STRING_WITH_LEN("REPLICATION") },
+  { C_STRING_WITH_LEN("AUTHENTICATION") }
 };
=20
 extern int initialize_schema_table(st_plugin_int *plugin);
@@ -67,12 +71,12 @@
 */
 plugin_type_init plugin_type_initialize[MYSQL_MAX_PLUGIN_TYPE_NUM]=3D
 {
-  0,ha_initialize_handlerton,0,0,initialize_schema_table
+  0,ha_initialize_handlerton,0,0,initialize_schema_table, 0, 0, 0
 };
=20
 plugin_type_init plugin_type_deinitialize[MYSQL_MAX_PLUGIN_TYPE_NUM]=3D
 {
-  0,ha_finalize_handlerton,0,0,finalize_schema_table
+  0,ha_finalize_handlerton,0,0,finalize_schema_table, 0, 0, 0
 };
=20
 #ifdef HAVE_DLOPEN
@@ -93,7 +97,10 @@
   MYSQL_HANDLERTON_INTERFACE_VERSION,
   MYSQL_FTPARSER_INTERFACE_VERSION,
   MYSQL_DAEMON_INTERFACE_VERSION,
-  MYSQL_INFORMATION_SCHEMA_INTERFACE_VERSION
+  MYSQL_INFORMATION_SCHEMA_INTERFACE_VERSION,
+  0xff00, /* audit plugins are supported in a later versions */
+  0xff00, /* replication plugins are supported in a later versions */
+  MYSQL_AUTHENTICATION_INTERFACE_VERSION
 };
 static int cur_plugin_info_interface_version[MYSQL_MAX_PLUGIN_TYPE_NUM]=3D
 {
@@ -101,7 +108,10 @@
   MYSQL_HANDLERTON_INTERFACE_VERSION,
   MYSQL_FTPARSER_INTERFACE_VERSION,
   MYSQL_DAEMON_INTERFACE_VERSION,
-  MYSQL_INFORMATION_SCHEMA_INTERFACE_VERSION
+  MYSQL_INFORMATION_SCHEMA_INTERFACE_VERSION,
+  0x0000, /* audit plugins are supported in a later versions */
+  0x0000, /* replication plugins are supported in a later versions */
+  MYSQL_AUTHENTICATION_INTERFACE_VERSION
 };
=20
 static bool initialized=3D 0;

=3D=3D=3D modified file 'sql/sql_yacc.yy'
--- sql/sql_yacc.yy	2010-02-01 06:14:12 +0000
+++ sql/sql_yacc.yy	2010-02-19 08:18:09 +0000
@@ -56,6 +56,7 @@
 int yylex(void *yylval, void *yythd);
=20
 const LEX_STRING null_lex_str=3D {0,0};
+const LEX_STRING empty_lex_str=3D { (char*) "", 0 };
=20
 #define yyoverflow(A,B,C,D,E,F)               \
   {                                           \
@@ -1231,8 +1232,9 @@
 %token  VARIANCE_SYM
 %token  VARYING                       /* SQL-2003-R */
 %token  VAR_SAMP_SYM
+%token  VIA_SYM
+%token  VIEW_SYM                      /* SQL-2003-N */
 %token  VIRTUAL_SYM
-%token  VIEW_SYM                      /* SQL-2003-N */
 %token  WAIT_SYM
 %token  WARNINGS
 %token  WEEK_SYM
@@ -11620,6 +11622,9 @@
             $$->user =3D $1;
             $$->host.str=3D (char *) "%";
             $$->host.length=3D 1;
+            $$->password=3D null_lex_str;=20
+            $$->plugin=3D empty_lex_str;
+            $$->auth=3D empty_lex_str;
=20
             if (check_string_char_length(&$$->user, ER(ER_USERNAME),
                                          USERNAME_CHAR_LENGTH,
@@ -11632,6 +11637,9 @@
             if (!($$=3D(LEX_USER*) thd->alloc(sizeof(st_lex_user))))
               MYSQL_YYABORT;
             $$->user =3D $1; $$->host=3D$3;
+            $$->password=3D null_lex_str;=20
+            $$->plugin=3D empty_lex_str;
+            $$->auth=3D empty_lex_str;
=20
             if (check_string_char_length(&$$->user, ER(ER_USERNAME),
                                          USERNAME_CHAR_LENGTH,
@@ -12888,6 +12896,18 @@
           }
         | user IDENTIFIED_SYM BY PASSWORD TEXT_STRING
           { $$=3D $1; $1->password=3D $5; }
+        | user IDENTIFIED_SYM VIA_SYM ident_or_text
+          {
+            $$=3D $1;
+            $1->plugin=3D $4;
+            $1->auth=3D empty_lex_str;
+          }
+        | user IDENTIFIED_SYM VIA_SYM ident_or_text USING TEXT_STRING_sys
+          {
+            $$=3D $1;
+            $1->plugin=3D $4;
+            $1->auth=3D $6;
+          }
         | user
           { $$=3D $1; $1->password=3D null_lex_str; }
         ;

=3D=3D=3D modified file 'sql/structs.h'
--- sql/structs.h	2010-02-01 06:14:12 +0000
+++ sql/structs.h	2010-02-19 08:18:09 +0000
@@ -178,7 +178,7 @@
 typedef int *(*update_var)(THD *, struct st_mysql_show_var *);
=20
 typedef struct	st_lex_user {
-  LEX_STRING user, host, password;
+  LEX_STRING user, host, password, plugin, auth;
 } LEX_USER;
=20
 /*

=3D=3D=3D modified file 'sql/table.cc'
--- sql/table.cc	2010-02-12 08:47:31 +0000
+++ sql/table.cc	2010-02-19 08:18:09 +0000
@@ -4164,11 +4164,8 @@
   {
     DBUG_PRINT("info", ("This table is suid view =3D> load contest"));
     DBUG_ASSERT(view && view_sctx);
-    if (acl_getroot_no_password(view_sctx,
-                                definer.user.str,
-                                definer.host.str,
-                                definer.host.str,
-                                thd->db))
+    if (acl_getroot(view_sctx, definer.user.str, definer.host.str,
+                                definer.host.str, thd->db))
     {
       if ((thd->lex->sql_command =3D=3D SQLCOM_SHOW_CREATE) ||
           (thd->lex->sql_command =3D=3D SQLCOM_SHOW_FIELDS))

=3D=3D=3D modified file 'tests/mysql_client_test.c'
--- tests/mysql_client_test.c	2010-01-11 13:15:28 +0000
+++ tests/mysql_client_test.c	2010-02-19 08:18:09 +0000
@@ -34,6 +34,7 @@
 #include <m_string.h>
 #include <mysqld_error.h>
 #include <my_handler.h>
+#include <sql_common.h>
=20
 #define VER "2.1"
 #define MAX_TEST_QUERY_LENGTH 300 /* MAX QUERY BUFFER LENGTH */

------------------------------------------------------------
revno: 2742
committer: Sergei Golubchik <sergii@stripped>
branch nick: maria-5.2-pa
timestamp: Fri 2010-02-19 09:08:05 +0100
message:
  bugfix: change_user should only take the password
  of the previous user if it takes the username too.
  otherwise it can never change to a passwordless account
modified:
  client/mysqltest.cc
diff:
=3D=3D=3D modified file 'client/mysqltest.cc'
--- client/mysqltest.cc	2010-01-28 14:49:14 +0000
+++ client/mysqltest.cc	2010-02-19 08:08:05 +0000
@@ -36,6 +36,7 @@
 #include "client_priv.h"
 #include <mysql_version.h>
 #include <mysqld_error.h>
+#include <sql_common.h>
 #include <m_ctype.h>
 #include <my_dir.h>
 #include <hash.h>
@@ -3610,13 +3611,15 @@
   }
=20
   if (!ds_user.length)
+  {
     dynstr_set(&ds_user, mysql->user);
=20
-  if (!ds_passwd.length)
-    dynstr_set(&ds_passwd, mysql->passwd);
+    if (!ds_passwd.length)
+      dynstr_set(&ds_passwd, mysql->passwd);
=20
-  if (!ds_db.length)
-    dynstr_set(&ds_db, mysql->db);
+    if (!ds_db.length)
+      dynstr_set(&ds_db, mysql->db);
+  }
=20
   DBUG_PRINT("info",("connection: '%s' user: '%s' password: '%s' database:=
 '%s'",
                       cur_con->name, ds_user.str, ds_passwd.str, ds_db.str=
));

Thread
contribution: pluggable authenticationsca19 Feb
  • Re: contribution: pluggable authenticationLenz Grimmer9 Mar