Commit Graph

3118 Commits

Author SHA1 Message Date
ea55667096 Add back the missing netmask handling code
The netmask code was mistakenly removed when the authentication was moved
to the SQLite based system.
2017-03-13 10:45:56 +02:00
d88d02ee95 Fix namedserverfilter source parameter
The `source` parameter was broken by the IPv6 change. Now the filter no
longer uses functions from the core to resolve the network addresses.
2017-03-13 10:45:55 +02:00
894679d611 Fix hostname resolution in MySQLAuth
The hostname resolution was broken by the move to IPv6.
2017-03-13 10:45:55 +02:00
66ba7f3c80 Simplify network socket creation code
The socket creation code in mysql_backend.c wasn't MySQL specific and it
could be used for all non-blocking network connections. Thus, it makes
sense to move it to a common file where other protocol modules can use
it.

The address resolution code now uses `getaddrinfo` to resolve all
addresses instead of manually handling wildcard hosts. This allows the
same code to be used for all addresses.
2017-03-13 10:45:55 +02:00
37dd561470 Add support for IPv6
Both the listeners and servers now support IPv6 addresses.

The namedserverfilter does not yet use the new structures and needs to be
fixed in a following commit.
2017-03-13 10:45:55 +02:00
405b944abb Use on-disk database for MySQLAuth users
The SQLite database is now always created on disk. This will remove the
need to dump the database users from the in-memory database to the
persisted on-disk database.

This change will also make the authentication compatible with older SQLite
implementations which lack the URI-based database strings found in newer
versions.
2017-03-13 10:45:55 +02:00
71b3ee70a4 Fix empty password detection
If a user was defined without a password, the authentication would fail.
2017-03-13 10:45:54 +02:00
adb9b5049b Fix user cache directory permissions
The user cache directory is only used by the maxscale user so only the
maxscale user should have access to it.
2017-03-13 10:45:54 +02:00
b796967df8 Add diagnostic entry point to authenticators
The authenticators should have a similar way to print diagnostic
information as filter and routers do. This allows the authenticators to
print the users in their own format.

In the future, all the diagnostic entry points should be changed so that
they return a structure that contains the information in a standard
form. This information can then be formatted in different ways by other
modules.
2017-03-13 10:45:54 +02:00
f225b29756 Fix injection of service user
The parameters that were given to the user creation function were in the
wrong order.
2017-03-13 10:45:54 +02:00
2dd79e2e0c Make sure user cache directory exists
The cache directory needs to be created by the authenticator itself.
2017-03-13 10:45:54 +02:00
a3a2a24c97 Return correct value for failed db authentication
The unknown database error was never triggered as all authentication
errors returned MXS_AUTH_FAILED.
2017-03-13 10:45:54 +02:00
b2c018a986 Don't users with a pre-4.1 password
The old error message and behavior was lost with the new implementation.
2017-03-13 10:45:53 +02:00
5494b262d3 Reorder SQL statements when persisting users
The statements are now executed in a more controlled order and a failure
of one will skip the others. The transaction is also rolled back if it
fails.
2017-03-13 10:45:53 +02:00
0488f8a052 Fix enable_root_user
The option was inverted.
2017-03-13 10:45:53 +02:00
04899f3a3e Remove unused code from MySQLAuth
Removed the old implementation of MySQL authentication. The user printing
functionality still expects a hashtable which should be fixed.
2017-03-13 10:45:53 +02:00
b206300975 Exact hostnames grants take precedence over wildcard grants
MariaDB and others match grants first by exact hostname/IP and then by
wildcard. If there are no exact matches, the wildcard grant should be
picked. This can be tested by having different passwords for localhost and
remote address.

The SQLite based authentication should first check for an exact match and
then only after that should it try to match the hostname to a wildcard
grant.
2017-03-13 10:45:53 +02:00
ba16b8ca1c Fix memory leak in dbusers.c
The MySQL connection was created twice.
2017-03-13 10:45:52 +02:00
b376d9043a Use new authentication for reauthentication
This fixes the reauthentication of users that was missing from the new
implementation. Now COM_CHANGE_USER should work properly.
2017-03-13 10:45:52 +02:00
48d70fa4a8 Replace get_users implementation with new version
The get_users function now combines the functionality of the old get_users
and get_all_users. This removes large parts of similar code.

Removed the listener resources as MySQLAuth was the only one that used it.
2017-03-13 10:45:52 +02:00
62763e2505 Store SQLite tables on disk
The SQLite database users are cached on disk. This allows the binlogrouter
to authenticate users without a connection to the master server.
2017-03-13 10:45:52 +02:00
2f4df0c21e Store databases in the SQLite database
The databases are now also stored in the sqlite database. This allows the
`resource` member of the USERS struct to be removed in the future.
2017-03-13 10:45:51 +02:00
041c0f1f2d Use SQLite3 based authentication
The user data is now stored inside a SQLite3 database. By storing the data
inside a database, we remove the restriction that the previous hashtable
based implementation had.
2017-03-13 10:45:51 +02:00
d4a06c61de Move reauthentication to authenticators
Currently the only situation where a user needs to be authenticated after
the initial authentication is when a COM_CHANGE_USER is being
executed. This was previously handled by directly calling a function in
the MySQLAuth authenticator.

The new entry in the API of the authenticators is very specific to MySQL
and should be reviewed once other protocols are added.
2017-03-13 10:45:51 +02:00
6da8cfe97e Fix assignment of master status on failed servers
When the real root master server went down, it still received the master
status bit due to how the replication tree was built. The bit should only
be set for servers that are running.

Also fixed a false state change event when the master status bit was
manually cleared from the downed root master server.
2017-03-12 09:40:21 +02:00
cb69b3cbca Merge branch 'develop' into MXS-1075 2017-03-09 15:08:04 +01:00
415001a4cd Merge branch '2.1' into develop 2017-03-09 10:02:36 +02:00
41ff01d16d Merge branch '2.0' into 2.1 2017-03-09 10:01:38 +02:00
e1a1959bc2 Replace strerror_r with mxs_strerror
The mxs_strerror function requires no local buffer, thus making it simpler
and cleaner to use.
2017-03-09 09:36:57 +02:00
d764bb9e1f MXS-1178: Fix master_accept_reads
The order of the servers in the service definition could break the
master_accept_reads functionality.

When the first server defined in the service is a slave, it will always be
picked as the first candidate for reads. The master would only be
considered as a candidate for reads if no previous candidate was
available. For this reason, the master_accept_reads only worked when the
first server in the list was the master.
2017-03-09 07:45:29 +02:00
fd2df3a863 Always open files with configured block size
If the Avro file already exists, it should be opened with the configured
block size instead of the default block size of 16 kilobytes.
2017-03-08 20:03:45 +02:00
c1dc0e6f73 MXS-1075: simplify blr_slave_query: handle SELECT stmts
First simplification of blr_slave_query: SELECT stmts are handled by
blr_handle_select_smt()
2017-03-08 17:23:39 +01:00
d7e48f93bb NamedServerFilter PCRE2 matching and refactoring
Change to modutil_extract_SQL(), add pcre2_data to filter session.
The pattern is now jit-compiled for maximum speed. Move general
pcre2 error printing to a function and macro. Add instance-level
statistics so the filter always prints diagnostic info. Add a mention
of PCRE2 to release notes.
2017-03-08 14:01:38 +02:00
55f038bc1f RegexHintFilter (namedserverfilter) now uses PCRE2
Also, changed the Filter struct to a class and moved code to class
methods. Renamed to .cc. Modifications in progress.
2017-03-08 13:48:11 +02:00
5975422473 Change namedserverfilter to C++, reorder code, cleanup
Functionality unchanged.
2017-03-08 13:48:11 +02:00
4b472d9a13 MXS-1075: file field added to MARIADB_GTID_INFO
MXS-1075: missing field added to MARIADB_GTID_INFO
2017-03-08 09:29:21 +01:00
670150c1c9 MXS-1075: added blr_fetch_mariadb_gtid() routine
Added generic blr_fetch_mariadb_gtid() routine

inst->binlog_name is now stored into MARIADB_GTID_INFO struct. (it was
missing)
2017-03-08 09:06:10 +01:00
656a38096c Revert "MXS-1075: added blr_fetch_mariadb_gtid() routine"
This reverts commit b0afff73a1b9b1eacc617408d92d5117b7676f0e.
2017-03-08 08:57:59 +01:00
e8161bbb08 MXS-1075: MARIADB_GTID_INFO struct is fully copied
Binlog file in MARIADB_GTID_INFO is now duplicated
2017-03-08 08:57:43 +01:00
b0afff73a1 MXS-1075: added blr_fetch_mariadb_gtid() routine
Added generic blr_fetch_mariadb_gtid() routine

inst->binlog_name is now stored into MARIADB_GTID_INFO struct. (it was
missing)
2017-03-08 08:51:19 +01:00
8bacc91153 Merge branch 'develop' into MXS-1075 2017-03-07 16:11:18 +01:00
b1521e0545 Log the use of prepared statements
If cache decisions should be logged, we log the presence of
prepared statements as they currently are the primary source
for the cache not caching.
2017-03-07 15:45:29 +02:00
f18a40ce73 Remove redundant error handling code from routers
The routers no longer need to track the number of errors each DCB
receives. This is now done by the protocol modules.

The type of the DCB no longer needs to be checked in the handleError
implementation as the function is only called when a backend DCB fails.
2017-03-07 11:12:56 +02:00
29ece502f5 Minor refactoring of error handling
Refactored common code into a reusable function. Now all of the backend
error handling uses the same function.

Moved responsibility of the DCB error handling tracking to the backend
protocol. The routers no longer need to manage the
`dcb->dcb_errhandle_called` variable of the failed DCB.

Removed calls to handleError with client DCBs as parameters. All of the
routers close the DCB given to handleError if it is a client DCB. The only
time the error handler would be called is when the routeQuery function
fails. The handleError call is redundant as the router already knows that
the session should be closed when it returns from routeQuery.
2017-03-07 11:12:56 +02:00
b4d81ffe27 Use correct capability for schemarouter
The router should use RCAP_TYPE_CONTIGUOUS_INPUT as it parses the
statements.
2017-03-06 16:35:17 +02:00
5ea049cffc MXS-1075: MariaDB 10 slave connecting with GTID
A MariaDB 10 slave connects to binlog server with GTID request
2017-03-06 14:41:24 +01:00
8be44a8cda Merge branch '2.1' into develop 2017-03-06 11:25:44 +02:00
bb22b82461 Merge branch '2.0' into 2.1 2017-03-06 10:38:07 +02:00
0f9c169e7d Merge branch 'develop' into MXS-1075 2017-03-06 08:57:51 +01:00
4e8bf1106b MXS-1075: MariaDB 10 Slave registration with GTID
New SQL commands are handled for MariaDB 10 slave registration with GTID
2017-03-06 08:56:26 +01:00