Commit Graph

1269 Commits

Author SHA1 Message Date
ee8042c40b MXS-2613 Access correct argument
The cache show-command accessed the wrong argument. That is why

    [maxadmin|maxctrl] call command cache show TheCache

did not work.
2019-07-30 13:00:37 +03:00
59e7b2b09d Deprecate mqfilter 2019-06-26 10:08:15 +03:00
2ab9aa9a94 Update 2.4.0 Change Date 2019-06-25 09:19:55 +03:00
9f771ffc2b Revert "MXS-2513 Deprecate firewall and masking filters"
This reverts commit de3c5721e95d5d5be909a56faeb121ad09a2f6fe.
2019-06-24 10:21:01 +03:00
470968a296 Fix unit test failures
The new net_write_timeout value needed to be explicitly defined for the
tests.
2019-06-11 21:38:47 +03:00
04fdaf1fdb MXS-2556 Make config::Configuration aware of its object
The name of the object (i.e. the section name from the configuration
file), is now stored in the configuration object for that object.

That way, more contextual and hence morfe user friendly errors and
warnings can be generated.
2019-06-11 11:05:15 +03:00
68af4cb62e MXS-2556 Rename configure -> post_configure
Rename config::Configuration::configure() to
config::Configuration::post_configure(). Latter name makes it
unambiguously clear at what point the function is called.
2019-06-11 09:46:04 +03:00
4efa9dbeea Remove maxscale/alloc.h
The remaining contents were moved to maxbase/alloc.h.
2019-06-10 14:11:25 +03:00
655e5fab5b Move length-encoded integer/string functions to maxsql 2019-06-07 11:32:46 +03:00
44d1b821c3 Merge branch '2.3' into develop 2019-06-03 13:54:55 +03:00
9481992bb9 Fix dbfwfilter release mode build failure
GCC 9 complained about null format strings even though the argument given
was never null.
2019-05-31 14:01:15 +03:00
de3c5721e9 MXS-2513 Deprecate firewall and masking filters 2019-05-31 11:53:36 +03:00
5b3dbdbf16 Fix test_cacheoptions and test_dbfwfilter
Due to listener changes we cannot just keep on creating new
listeners with the same port over and over again.

Easiest to simply use a different port each time.
2019-05-14 15:01:15 +03:00
17d3beba3b MXS-2385 Fix the problem with the USE command and tpmfilter
Trying to get the type mask of the QWBUF caused debug assertion in the query
classifier when using some commands. Now type mask is checked only when the
buffer contains MXS_COM_QUERY command.
2019-05-14 13:40:37 +03:00
fbd61967a7 Format filters 2019-05-10 10:31:12 +03:00
3813c728b1 Move listener parameter handling into Listener::create
The Listener::create method now takes a set of configuration parameters
from which it constructs a listener. This removes the duplicated code and
makes the behavior of listener creation similar to other objects in
MaxScale. It also allows the configuration parameters to be stored in the
listener object itself.
2019-05-10 09:21:52 +03:00
6baf970140 Fix test_dbfwfilter 2019-05-03 16:12:26 +03:00
9a10f64840 Fix test_cacheoptions 2019-05-03 16:09:14 +03:00
fb0745e3de Merge branch '2.3' into develop 2019-05-03 13:48:57 +03:00
a3cf1d22c0 MXS-2457 Streamline logging 2019-05-03 13:38:12 +03:00
279edce16e MXS-2457 Add treat_string_as_field to firewall
Necessary if the firewall should be able to block columns when
'ANSI_QUOTES' as enabled and " instead of backticks are used.

Without this, the following

    > set @@sql_mode='ANSI_QUOTES';
    > select "ssn" from person;

will not be blocked if the database firewall has been configured
to block the column ssn.
2019-05-03 13:38:12 +03:00
5833c39a8a MXS-2457 Disable query classifier cache in masking
As the canonicalization is also not aware of 'ANSI_QUOTES', the
cache must be disabled if the masking filter has
'treat_string_arg_as_field' enabled.
2019-05-03 13:38:12 +03:00
fe5160a714 MXS-2457 Add 'treat_string_arg_as_field' to DB Firewall 2019-05-03 13:38:12 +03:00
3a5a8b13b9 MXS-2457 Treat string args as fields
The masking filter will now consider all string arguments to
functions to be fields. This in order to prevent bypassing of
the masking with

    > set @@sql_mode='ANSI_QUOTES';
    > select concat("ssn") from masking;

This may lead to false positives, but no can do.
2019-05-03 13:38:12 +03:00
8a250a8b13 MXS-2329 Make duration misuse harder
Now the desired type must be specified when getting a duration.
The type also dictates how durations without suffixes should be
interpreted.

That removes the need for remembering that to convert a returned
millisecond duration to a second duration.
2019-04-30 13:02:53 +03:00
de3f4fe5a8 MXS-2346 Ttl should be stored as milliseconds
cacheconfig.hh had not been pushed earlier.
2019-04-12 15:48:28 +03:00
0c7a3240bd MXS-2346 Exclude core parameters
Core parameters are not handled by the module but by the core and
must hence be ignored when validating and configuring.
2019-04-12 15:03:02 +03:00
17aa494c87 MXS-2346 Update cache filter
As a proof of concept, the cache filter has been updated to
use the new configuration mechanism.
2019-04-12 15:03:02 +03:00
139651c092 MXS-2253 Runtime ttl changes are made in seconds
Internally durations are stored in milliseconds but runtime changes
using SQL are made in seconds. Consequently, the provided value must
be multiplied by 1000 before being stored.
2019-04-11 15:53:45 +03:00
e659c6cc73 Merge branch '2.3' into develop 2019-04-01 13:24:30 +03:00
738ae9178b Fix binlogfilter matching
The matching always checked the default database when it should only check
it if there are no tables in the statement.
2019-04-01 11:29:16 +03:00
5346b24fa4 MXS-2393 Add parameter 'require_fully_parsed'
If set to true and if any of the other blocking related parameters
is true, then a statement that cannot be fully parsed will be blocked.

Default is true.
2019-04-01 10:52:52 +03:00
6bc2c54081 Merge commit 'a78f0fbe2537542dc7f3f0dd8b19b93ac8d9d7f8' into develop 2019-03-28 13:53:40 +02:00
e88b7f56f9 Match against default database of queries
If a query doesn't define a table, the default database wouldn't get
checked. To prevent this, it must be explicitly checked.
2019-03-25 18:49:25 +02:00
3c7e64181b MXS-2403 Check only what is necessary
The amount of checking is minimized and what can be checked in one
go, is checked in one go.
2019-03-25 15:26:17 +02:00
f9f9599e74 MXS-2403 Reject if masked filed is used in subquery
There's some overlapping work being done now. To be cleanup up
in a subsequent commit.
2019-03-25 15:26:17 +02:00
8b329f7f33 MXS-2403 Add 'check_subqueries' parameter
Only documentation and parameter handling.
2019-03-25 15:26:17 +02:00
3870fac600 MXS-2402 MXS-2396 '*' should be blocked only if there are rules
If there are no rules for the current user, then '*' should be
allowed in UNIONS and when defining variables.
2019-03-25 15:24:35 +02:00
25f8931384 MXS-2402 Reject if masked field is referred to in UNION select
If the second or subsequent select of a UNION statement refers to
a field to be masked, then the statement must be rejected.
2019-03-25 15:24:35 +02:00
ca8350ae35 MXS-2402 Document and handle 'check_unions' parameter
Only parameter handling, no actual functionality.
2019-03-25 15:24:35 +02:00
203bba0e1d Add support for multiple runtime error messages
Storing all the runtime errors makes it possible to return all of them
them via the REST API. MaxAdmin will still only show the latest error but
MaxCtrl will now show all errors if more than one error occurs.
2019-03-21 18:19:10 +02:00
0f1bc60431 Fix masking and dwfwfilter compilation
The filters were broken by the merge.
2019-03-21 18:18:33 +02:00
2ba7e63e7e Merge branch '2.3' into develop 2019-03-21 09:26:06 +02:00
9b27d7f24b MXS-2396 Reject use of masked var in variable definition
E.g.

   set @a = (SELECT fld FROM table);

will be rejected if 'fld' is a field that should be masked.
2019-03-20 15:11:58 +02:00
eb0f3ebe81 MXS-2396 Cleanup conceptually 2019-03-20 15:11:58 +02:00
7bb3cc6535 MXS-2396 Make preparations for adding additional checks 2019-03-20 15:11:58 +02:00
76ac63096c MXS-2396 Add check_user_variables configuration parameter
The masking filter should check for things like

    set @ssn = (SELECT ssn FROM users WHERE id = 1);

so that

    select @ssn;

is not possible.
2019-03-20 15:11:58 +02:00
a6f52b008f MXS-2390 Firewall should reject statements prepared from var
Currently no practical way for checking what the statement
actually does and thus blanket rejection is the only alternative.
2019-03-19 15:53:46 +02:00
8e0ee34a94 MXS-2392 MXS-2390 Handle prepared statements in masking filter
- Check textual prepared statements for use of columns to be masked
  in conjunction with functions.
- Check binary prepared statements for use of columns to be masked
  in conjunction with functions.
- Prevent creation of textual prepared statement from variable.
2019-03-19 12:31:08 +02:00
7f1c44cf62 MXS-2393 Reject statement that cannot be parsed completely
As the masking filter must reject statements that use columns to be
masked as arguments to functions, a statement that cannot be fully
parsed must be rejected. Unless a statement can be fully parsed we
cannot know whether such usage occurs.
2019-03-19 10:47:37 +02:00