From 76ac63096c6345b627b434b5fa31e0dc5c58ebb9 Mon Sep 17 00:00:00 2001 From: Johan Wikman Date: Wed, 20 Mar 2019 10:30:03 +0200 Subject: [PATCH] MXS-2396 Add check_user_variables configuration parameter The masking filter should check for things like set @ssn = (SELECT ssn FROM users WHERE id = 1); so that select @ssn; is not possible. --- Documentation/Filters/Masking.md | 22 +++++++++++++++++++ .../modules/filter/masking/maskingfilter.cc | 17 ++++++++------ .../filter/masking/maskingfilterconfig.cc | 15 +++++++++++++ .../filter/masking/maskingfilterconfig.hh | 21 ++++++++++++++++++ 4 files changed, 68 insertions(+), 7 deletions(-) diff --git a/Documentation/Filters/Masking.md b/Documentation/Filters/Masking.md index b3030cf57..a16146a4c 100644 --- a/Documentation/Filters/Masking.md +++ b/Documentation/Filters/Masking.md @@ -71,6 +71,14 @@ Please see the configuration parameter [prevent_function_usage](#prevent_function_usage) for how to change the default behaviour. +From MaxScale 2.3.5 onwards, the masking filter will check the +definition of user variables and reject statements that define a user +variable using a statement that refers to columns that should be masked. + +Please see the configuration parameter +[check_user_variables](#check_user_variables) +for how to change the default behaviour. + ## Limitations The masking filter can _only_ be used for masking columns of the following @@ -170,6 +178,20 @@ prevent_function_usage=false ``` The default value is `true`. +#### `check_user_variables` + +This optional parameter specifies how the masking filter should +behave with respect to user variables. If true, then a statement like +``` +set @a = (select ssn from customer where id = 1); +``` +will be rejected if `ssn` is a column that should be masked. +``` +check_user_variables=false +``` + +The default value is `true`. + ## Rules The masking rules are expressed as a JSON object. diff --git a/server/modules/filter/masking/maskingfilter.cc b/server/modules/filter/masking/maskingfilter.cc index 59b7a6dc3..827db8ae7 100644 --- a/server/modules/filter/masking/maskingfilter.cc +++ b/server/modules/filter/masking/maskingfilter.cc @@ -90,13 +90,10 @@ extern "C" MXS_MODULE* MXS_CREATE_MODULE() "V1.0.0", RCAP_TYPE_CONTIGUOUS_INPUT | RCAP_TYPE_CONTIGUOUS_OUTPUT, &MaskingFilter::s_object, - NULL, /* Process init. - * */ - NULL, /* Process finish. - * */ - NULL, /* Thread init. */ - NULL, /* Thread finish. - * */ + NULL, /* Process init. */ + NULL, /* Process finish. */ + NULL, /* Thread init. */ + NULL, /* Thread finish. */ { { Config::rules_name, @@ -124,6 +121,12 @@ extern "C" MXS_MODULE* MXS_CREATE_MODULE() Config::prevent_function_usage_default, MXS_MODULE_OPT_NONE, }, + { + Config::check_user_variables_name, + MXS_MODULE_PARAM_BOOL, + Config::check_user_variables_default, + MXS_MODULE_OPT_NONE, + }, {MXS_END_MODULE_PARAMS} } }; diff --git a/server/modules/filter/masking/maskingfilterconfig.cc b/server/modules/filter/masking/maskingfilterconfig.cc index d0fda36d3..fb44a9195 100644 --- a/server/modules/filter/masking/maskingfilterconfig.cc +++ b/server/modules/filter/masking/maskingfilterconfig.cc @@ -27,6 +27,7 @@ const char config_value_never[] = "never"; const char config_value_always[] = "always"; const char config_name_prevent_function_usage[] = "prevent_function_usage"; +const char config_check_user_variables[] = "check_user_variables"; const char config_value_true[] = "true"; } @@ -84,6 +85,14 @@ const char* MaskingFilterConfig::prevent_function_usage_name = config_name_preve // static const char* MaskingFilterConfig::prevent_function_usage_default = config_value_true; +/* + * PARAM check_user_variables + */ +const char* MaskingFilterConfig::check_user_variables_name = config_check_user_variables; + +// static +const char* MaskingFilterConfig::check_user_variables_default = config_value_true; + /* * MaskingFilterConfig */ @@ -115,3 +124,9 @@ bool MaskingFilterConfig::get_prevent_function_usage(const MXS_CONFIG_PARAMETER* { return config_get_bool(pParams, prevent_function_usage_name); } + +// static +bool MaskingFilterConfig::get_check_user_variables(const MXS_CONFIG_PARAMETER* pParams) +{ + return config_get_bool(pParams, check_user_variables_name); +} diff --git a/server/modules/filter/masking/maskingfilterconfig.hh b/server/modules/filter/masking/maskingfilterconfig.hh index c3f72862e..28f493f5d 100644 --- a/server/modules/filter/masking/maskingfilterconfig.hh +++ b/server/modules/filter/masking/maskingfilterconfig.hh @@ -45,12 +45,16 @@ public: static const char* prevent_function_usage_name; static const char* prevent_function_usage_default; + static const char* check_user_variables_name; + static const char* check_user_variables_default; + MaskingFilterConfig(const char* zName, const MXS_CONFIG_PARAMETER* pParams) : m_name(zName) , m_large_payload(get_large_payload(pParams)) , m_rules(get_rules(pParams)) , m_warn_type_mismatch(get_warn_type_mismatch(pParams)) , m_prevent_function_usage(get_prevent_function_usage(pParams)) + , m_check_user_variables(get_check_user_variables(pParams)) { } ~MaskingFilterConfig() @@ -82,6 +86,11 @@ public: return m_prevent_function_usage; } + bool check_user_variables() const + { + return m_check_user_variables; + } + void set_large_payload(large_payload_t l) { m_large_payload = l; @@ -101,10 +110,21 @@ public: m_prevent_function_usage = b; } + void set_check_user_variables(bool b) + { + m_check_user_variables = b; + } + + bool is_parsing_needed() const + { + return prevent_function_usage() || check_user_variables(); + } + static large_payload_t get_large_payload(const MXS_CONFIG_PARAMETER* pParams); static std::string get_rules(const MXS_CONFIG_PARAMETER* pParams); static warn_type_mismatch_t get_warn_type_mismatch(const MXS_CONFIG_PARAMETER* pParams); static bool get_prevent_function_usage(const MXS_CONFIG_PARAMETER* pParams); + static bool get_check_user_variables(const MXS_CONFIG_PARAMETER* pParams); private: std::string m_name; @@ -112,4 +132,5 @@ private: std::string m_rules; warn_type_mismatch_t m_warn_type_mismatch; bool m_prevent_function_usage; + bool m_check_user_variables; };