Commit Graph

1254 Commits

Author SHA1 Message Date
3813c728b1 Move listener parameter handling into Listener::create
The Listener::create method now takes a set of configuration parameters
from which it constructs a listener. This removes the duplicated code and
makes the behavior of listener creation similar to other objects in
MaxScale. It also allows the configuration parameters to be stored in the
listener object itself.
2019-05-10 09:21:52 +03:00
6baf970140 Fix test_dbfwfilter 2019-05-03 16:12:26 +03:00
9a10f64840 Fix test_cacheoptions 2019-05-03 16:09:14 +03:00
fb0745e3de Merge branch '2.3' into develop 2019-05-03 13:48:57 +03:00
a3cf1d22c0 MXS-2457 Streamline logging 2019-05-03 13:38:12 +03:00
279edce16e MXS-2457 Add treat_string_as_field to firewall
Necessary if the firewall should be able to block columns when
'ANSI_QUOTES' as enabled and " instead of backticks are used.

Without this, the following

    > set @@sql_mode='ANSI_QUOTES';
    > select "ssn" from person;

will not be blocked if the database firewall has been configured
to block the column ssn.
2019-05-03 13:38:12 +03:00
5833c39a8a MXS-2457 Disable query classifier cache in masking
As the canonicalization is also not aware of 'ANSI_QUOTES', the
cache must be disabled if the masking filter has
'treat_string_arg_as_field' enabled.
2019-05-03 13:38:12 +03:00
fe5160a714 MXS-2457 Add 'treat_string_arg_as_field' to DB Firewall 2019-05-03 13:38:12 +03:00
3a5a8b13b9 MXS-2457 Treat string args as fields
The masking filter will now consider all string arguments to
functions to be fields. This in order to prevent bypassing of
the masking with

    > set @@sql_mode='ANSI_QUOTES';
    > select concat("ssn") from masking;

This may lead to false positives, but no can do.
2019-05-03 13:38:12 +03:00
8a250a8b13 MXS-2329 Make duration misuse harder
Now the desired type must be specified when getting a duration.
The type also dictates how durations without suffixes should be
interpreted.

That removes the need for remembering that to convert a returned
millisecond duration to a second duration.
2019-04-30 13:02:53 +03:00
de3f4fe5a8 MXS-2346 Ttl should be stored as milliseconds
cacheconfig.hh had not been pushed earlier.
2019-04-12 15:48:28 +03:00
0c7a3240bd MXS-2346 Exclude core parameters
Core parameters are not handled by the module but by the core and
must hence be ignored when validating and configuring.
2019-04-12 15:03:02 +03:00
17aa494c87 MXS-2346 Update cache filter
As a proof of concept, the cache filter has been updated to
use the new configuration mechanism.
2019-04-12 15:03:02 +03:00
139651c092 MXS-2253 Runtime ttl changes are made in seconds
Internally durations are stored in milliseconds but runtime changes
using SQL are made in seconds. Consequently, the provided value must
be multiplied by 1000 before being stored.
2019-04-11 15:53:45 +03:00
e659c6cc73 Merge branch '2.3' into develop 2019-04-01 13:24:30 +03:00
738ae9178b Fix binlogfilter matching
The matching always checked the default database when it should only check
it if there are no tables in the statement.
2019-04-01 11:29:16 +03:00
5346b24fa4 MXS-2393 Add parameter 'require_fully_parsed'
If set to true and if any of the other blocking related parameters
is true, then a statement that cannot be fully parsed will be blocked.

Default is true.
2019-04-01 10:52:52 +03:00
6bc2c54081 Merge commit 'a78f0fbe2537542dc7f3f0dd8b19b93ac8d9d7f8' into develop 2019-03-28 13:53:40 +02:00
e88b7f56f9 Match against default database of queries
If a query doesn't define a table, the default database wouldn't get
checked. To prevent this, it must be explicitly checked.
2019-03-25 18:49:25 +02:00
3c7e64181b MXS-2403 Check only what is necessary
The amount of checking is minimized and what can be checked in one
go, is checked in one go.
2019-03-25 15:26:17 +02:00
f9f9599e74 MXS-2403 Reject if masked filed is used in subquery
There's some overlapping work being done now. To be cleanup up
in a subsequent commit.
2019-03-25 15:26:17 +02:00
8b329f7f33 MXS-2403 Add 'check_subqueries' parameter
Only documentation and parameter handling.
2019-03-25 15:26:17 +02:00
3870fac600 MXS-2402 MXS-2396 '*' should be blocked only if there are rules
If there are no rules for the current user, then '*' should be
allowed in UNIONS and when defining variables.
2019-03-25 15:24:35 +02:00
25f8931384 MXS-2402 Reject if masked field is referred to in UNION select
If the second or subsequent select of a UNION statement refers to
a field to be masked, then the statement must be rejected.
2019-03-25 15:24:35 +02:00
ca8350ae35 MXS-2402 Document and handle 'check_unions' parameter
Only parameter handling, no actual functionality.
2019-03-25 15:24:35 +02:00
203bba0e1d Add support for multiple runtime error messages
Storing all the runtime errors makes it possible to return all of them
them via the REST API. MaxAdmin will still only show the latest error but
MaxCtrl will now show all errors if more than one error occurs.
2019-03-21 18:19:10 +02:00
0f1bc60431 Fix masking and dwfwfilter compilation
The filters were broken by the merge.
2019-03-21 18:18:33 +02:00
2ba7e63e7e Merge branch '2.3' into develop 2019-03-21 09:26:06 +02:00
9b27d7f24b MXS-2396 Reject use of masked var in variable definition
E.g.

   set @a = (SELECT fld FROM table);

will be rejected if 'fld' is a field that should be masked.
2019-03-20 15:11:58 +02:00
eb0f3ebe81 MXS-2396 Cleanup conceptually 2019-03-20 15:11:58 +02:00
7bb3cc6535 MXS-2396 Make preparations for adding additional checks 2019-03-20 15:11:58 +02:00
76ac63096c MXS-2396 Add check_user_variables configuration parameter
The masking filter should check for things like

    set @ssn = (SELECT ssn FROM users WHERE id = 1);

so that

    select @ssn;

is not possible.
2019-03-20 15:11:58 +02:00
a6f52b008f MXS-2390 Firewall should reject statements prepared from var
Currently no practical way for checking what the statement
actually does and thus blanket rejection is the only alternative.
2019-03-19 15:53:46 +02:00
8e0ee34a94 MXS-2392 MXS-2390 Handle prepared statements in masking filter
- Check textual prepared statements for use of columns to be masked
  in conjunction with functions.
- Check binary prepared statements for use of columns to be masked
  in conjunction with functions.
- Prevent creation of textual prepared statement from variable.
2019-03-19 12:31:08 +02:00
7f1c44cf62 MXS-2393 Reject statement that cannot be parsed completely
As the masking filter must reject statements that use columns to be
masked as arguments to functions, a statement that cannot be fully
parsed must be rejected. Unless a statement can be fully parsed we
cannot know whether such usage occurs.
2019-03-19 10:47:37 +02:00
85c2d3c9ee MXS-2374: Set next_pos for skipped events
By always setting the position of the next event, the replication cannot
break if the slave server has to reconnect after receiving an event that
was generated by the binlogfilter.
2019-03-18 13:58:04 +02:00
900cbb4cff MXS-2304 Move last config_get_x() functions inside class 2019-03-04 12:27:36 +02:00
6c05fa7d54 MXS-2302: Use unique_ptr for hint storage
This removes the need to explicitly free them.
2019-03-04 08:48:32 +02:00
d52f685ee2 MXS-2302: Rename hintfilter objects
Renamed the objects to camelcase variants.
2019-03-04 08:48:32 +02:00
e5299e1eab MXS-2302: Move hint parser into its own class
Keeping the parser state internal to a subclass makes the code more
readable and allows the removal of most parameters. It also removes the
need to return iterator ranges from the tokenization function thus making
the Token class obsolete.

Unit testing benefits from this as well as it more closely resembles usage
in the wild as more of the code can be run without a live system.
2019-03-04 08:48:32 +02:00
3fef15e892 MXS-2302: Remove templates from parsing code
The templates were only used to make testing easier and upon review the
gain in testing convenience wasn't large enough to warrant its use.
2019-03-04 08:48:32 +02:00
684ddfd12d MXS-2302: Use filter template in hintfilter 2019-03-04 08:48:32 +02:00
1d49e45036 MXS-2302: Do hint processing in a member function
Also fixed a unit test failure.
2019-03-04 08:48:32 +02:00
f106864659 MXS-2302: Use STL containers for hint storage
The named hints and the hint stack are now stored in STL containers.
2019-03-04 08:48:32 +02:00
2045ac656b MXS-2302: Remove unused hintfilter code
Also moved the token types into the correct file.
2019-03-04 08:48:32 +02:00
ec234124b1 MXS-2302: Remove unused parsing code
Removed all code that is no longer used. The hint stack mechanism is still
in use but can, and should, be replaced with std::vector.
2019-03-04 08:48:32 +02:00
c5a8b693c3 MXS-2302: Take new hint parsing code into use 2019-03-04 08:48:32 +02:00
ca9224bf88 MXS-2302: Rewrite hint tokenization and parsing
The tokenization is somewhat crude but given the small amount of token
types it is acceptably efficient while still maintaining readability. The
parsing is quite simple to implement as a sort of a recursive descent
parser and is a lot more readable that the old state machine
implementation.

Extended the unit test to check that all supported hint types are parsed
correctly. The stack mechanism isn't fully covered by the unit test and it
needs to be added once the stack mechanism uses STL containers.
2019-03-04 08:48:32 +02:00
897fee715d MXS-2302: Use const char* in hintfilter functions 2019-03-04 08:48:32 +02:00
11be8ed0f0 MXS-2302: Add comment extraction code
The code extracts comments from a query. All three comment types are
supported and the double dash comments properly handle invalid input
(fixes MXS-2289).

The code uses iterators to access to the query and returns a list of
iterator pairs as start and end markers to comments. This makes testing
easier as the input and output can be passed as an std::string.
2019-03-04 08:48:32 +02:00