hcq/MaxScale
hcq/MaxScale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MXS-2396 Add check_user_variables configuration parameter

Browse Source 
The masking filter should check for things like

    set @ssn = (SELECT ssn FROM users WHERE id = 1);

so that

    select @ssn;

is not possible.
This commit is contained in:
Johan Wikman 2019-03-20 10:30:03 +02:00
parent 0b77c3f05f
commit 76ac63096c
4 changed files with 68 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
Documentation/Filters/Masking.md
View File

@ -71,6 +71,14 @@ Please see the configuration parameter
[prevent_function_usage](#prevent_function_usage)
for how to change the default behaviour.
From MaxScale 2.3.5 onwards, the masking filter will check the
definition of user variables and reject statements that define a user
variable using a statement that refers to columns that should be masked.
Please see the configuration parameter
[check_user_variables](#check_user_variables)
for how to change the default behaviour.
## Limitations
The masking filter can _only_ be used for masking columns of the following
@ -170,6 +178,20 @@ prevent_function_usage=false
```
The default value is `true`.
#### `check_user_variables`
This optional parameter specifies how the masking filter should
behave with respect to user variables. If true, then a statement like
```
set @a = (select ssn from customer where id = 1);
```
will be rejected if `ssn` is a column that should be masked.
```
check_user_variables=false
```
The default value is `true`.
## Rules
The masking rules are expressed as a JSON object.

17
server/modules/filter/masking/maskingfilter.cc
View File

@ -90,13 +90,10 @@ extern "C" MXS_MODULE* MXS_CREATE_MODULE()
"V1.0.0",
RCAP_TYPE_CONTIGUOUS_INPUT | RCAP_TYPE_CONTIGUOUS_OUTPUT,
&MaskingFilter::s_object,
NULL, /* Process init.
* */
NULL, /* Process finish.
* */
NULL, /* Thread init. */
NULL, /* Thread finish.
* */
NULL, /* Process init. */
NULL, /* Process finish. */
NULL, /* Thread init. */
NULL, /* Thread finish. */
{
{
Config::rules_name,
@ -124,6 +121,12 @@ extern "C" MXS_MODULE* MXS_CREATE_MODULE()
Config::prevent_function_usage_default,
MXS_MODULE_OPT_NONE,
},
{
Config::check_user_variables_name,
MXS_MODULE_PARAM_BOOL,
Config::check_user_variables_default,
MXS_MODULE_OPT_NONE,
},
{MXS_END_MODULE_PARAMS}
}
};

15
server/modules/filter/masking/maskingfilterconfig.cc
View File

@ -27,6 +27,7 @@ const char config_value_never[] = "never";
const char config_value_always[] = "always";
const char config_name_prevent_function_usage[] = "prevent_function_usage";
const char config_check_user_variables[] = "check_user_variables";
const char config_value_true[] = "true";
}
@ -84,6 +85,14 @@ const char* MaskingFilterConfig::prevent_function_usage_name = config_name_preve
// static
const char* MaskingFilterConfig::prevent_function_usage_default = config_value_true;
/*
* PARAM check_user_variables
*/
const char* MaskingFilterConfig::check_user_variables_name = config_check_user_variables;
// static
const char* MaskingFilterConfig::check_user_variables_default = config_value_true;
/*
* MaskingFilterConfig
*/
@ -115,3 +124,9 @@ bool MaskingFilterConfig::get_prevent_function_usage(const MXS_CONFIG_PARAMETER*
{
return config_get_bool(pParams, prevent_function_usage_name);
}
// static
bool MaskingFilterConfig::get_check_user_variables(const MXS_CONFIG_PARAMETER* pParams)
{
return config_get_bool(pParams, check_user_variables_name);
}

21
server/modules/filter/masking/maskingfilterconfig.hh
View File

@ -45,12 +45,16 @@ public:
static const char* prevent_function_usage_name;
static const char* prevent_function_usage_default;
static const char* check_user_variables_name;
static const char* check_user_variables_default;
MaskingFilterConfig(const char* zName, const MXS_CONFIG_PARAMETER* pParams)
: m_name(zName)
, m_large_payload(get_large_payload(pParams))
, m_rules(get_rules(pParams))
, m_warn_type_mismatch(get_warn_type_mismatch(pParams))
, m_prevent_function_usage(get_prevent_function_usage(pParams))
, m_check_user_variables(get_check_user_variables(pParams))
{
}
~MaskingFilterConfig()
@ -82,6 +86,11 @@ public:
return m_prevent_function_usage;
}
bool check_user_variables() const
{
return m_check_user_variables;
}
void set_large_payload(large_payload_t l)
{
m_large_payload = l;
@ -101,10 +110,21 @@ public:
m_prevent_function_usage = b;
}
void set_check_user_variables(bool b)
{
m_check_user_variables = b;
}
bool is_parsing_needed() const
{
return prevent_function_usage() || check_user_variables();
}
static large_payload_t get_large_payload(const MXS_CONFIG_PARAMETER* pParams);
static std::string get_rules(const MXS_CONFIG_PARAMETER* pParams);
static warn_type_mismatch_t get_warn_type_mismatch(const MXS_CONFIG_PARAMETER* pParams);
static bool get_prevent_function_usage(const MXS_CONFIG_PARAMETER* pParams);
static bool get_check_user_variables(const MXS_CONFIG_PARAMETER* pParams);
private:
std::string m_name;
@ -112,4 +132,5 @@ private:
std::string m_rules;
warn_type_mismatch_t m_warn_type_mismatch;
bool m_prevent_function_usage;
bool m_check_user_variables;
};