If there are several 'users' lines in a rule file, for a particular
user, the rules each matching line will be checked independently
until a rule match is found.
That is, the rules of each 'users' line are treated in an OR-fashion
with respect to each other.
If a user has an empty service name, use "mysql" as default.
Authentication data was only updated inside get_pam_user_services() if no service
was found. It was possible that the PAM service changed but the old service
would be used for authenticating, causing a false negative.
Now, the auth data is updated outside the function if authentication fails for
any reason. The new service data is compared to the old and if equal, password
check is not attempted again. This gives a false negative only if user password
has changed after the previous attempt.
Also, fixed some comments.
As the function documentation states, the expected value must be read
again after a call to atomic_cas_ptr. This is due to the fact that if the
values are not the same, the __atomic builtin version will store the
current value into the expected value.
The new value given to the atomic_cas_ptr function was the address of the
new value, not the new value itself. The behavior of the atomic_cas_ptr is
what caused the test to pass on systeems that implement the __atomic
builtins. On older systems that do not implement it, the expected value
was never modified which caused the test to hang.
The monitor will now also create the database if it is missing. Since it
already creates the table, also creating the database is not a large
addition.
Cleaned up some of the related checking code and combined them into a
simple utility function.
As you can create regular expressions that have a fixed length,
e.g. "....$", it makes perfect sense to replace using 'value' if
the length of the string matches exactly.
The sprintf calls failed due to a warning about possible buffer
overflow. Curiously enough, the same warnings do appear on Fedora 26 but
only when the calls are changed to snprintf.
The config parameter 'newline_replacement' (defaults to 1 space " ") now defines
what to write to the log file when the sql-query has a newline sequence (\n, \r or
\r\n). If 'newline_replacement' is the empty string "", no replacing is done and
newlines are printed to file.
Also, adds the config parameter 'separator', which defines the string
printed between elements. Default value is ",".
DECIMAL types that were larger than 8 bytes were not handled
correctly. The current implementation only prints the lowest 8 bytes of
the integer part of the decimal.
The warning that a schema already exists is obsolete as mapped tables are
now always opened instead of being reused. This causes the schema checks
to be done for each mapped table.
Updated links and module names in the configuration. Also changed object
names so that they don't produce warnings. Removed redundant parameters
and tuned default monitor_interval to a slightly more reasonable 2000
milliseconds. Enabled automatic thread number configuration.
The output generated by a failed call to a module command was previously
overwritten with the error messages stored in the module command
subsystem.
In the case of a failure, the proper procedure is to check if the output
generated by the module command conforms to the JSON API error
specification and if it does, combine it with any system generated error
messages. If the output does not conform, it is stored in the "meta" field
of the returned object. This allows all of the generated output to be
saved.
Only asynchronous authenticators require the thread-specific loading of
users as the synchronous ones all share the same data. If the service does
not declare asynchronous capabilities at startup, the users are not
seeded. This prevents unnecessary loading of users at startup.
Time elapsed is now properly tracked during a switchover. After slave
redirection, an event is added to the master. Then, the slaves are queried
repeatedly until they advance to the newest event. I/O and SQL errors are
also detected.
Setting the query classifier with an absolute path makes it easier to
manage test setup without having to manually resolve the relative path to
the query classifier from the test source directory.
When an assertion fails due to an overflow of the event buffer, all
processed values for that event are dumped.
This commit also enables the assertions even for non-debug builds which
should speed up the elimination process for bugs in the avrorouter. The
overhead of doing this is minimal as the output is already gathered for
the INFO level logging.
