github
/
mysql-audit
mirror of https://github.com/mcafee-enterprise/mysql-audit
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

mariadb offsets 10.0.21 and 5.5.45. Offset validation following experience with issue: #118.

pull/141/head
Guy Lichtman 2015-08-11 13:47:51 +03:00
parent ee115750e5
commit 15c77835bf
2 changed files with 41 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/audit_offsets.cc
View File

@ -781,6 +781,10 @@ const ThdOffsets thd_offsets_arr[] =
//64 bit offsets //64 bit offsets
const ThdOffsets thd_offsets_arr[] = const ThdOffsets thd_offsets_arr[] =
{ {
//offsets for: /mariadb/10.0.21/bin/mysqld (10.0.21-MariaDB)
{"10.0.21-MariaDB","e565b3971cc11516822e676465d5b4a9", 13416, 13480, 6192, 7800, 88, 2976, 8, 0, 16, 24, 152, 13572},
//offsets for: /mariadb/5.5.45/bin/mysqld (5.5.45-MariaDB)
{"5.5.45-MariaDB","70faaed59f9d41cfea9510dbdaa8cb0d", 12032, 12096, 5800, 6904, 88, 2920, 8, 0, 16, 24, 152, 12168},
//offsets for: /mariadb/10.0.20/bin/mysqld (10.0.20-MariaDB) //offsets for: /mariadb/10.0.20/bin/mysqld (10.0.20-MariaDB)
{"10.0.20-MariaDB","1fd5e15156937feb7f4c5fd1164dd029", 13408, 13472, 6192, 7792, 88, 3000, 8, 0, 16, 24, 152, 13564}, {"10.0.20-MariaDB","1fd5e15156937feb7f4c5fd1164dd029", 13408, 13472, 6192, 7792, 88, 3000, 8, 0, 16, 24, 152, 13564},
//offsets for: /mariadb/5.5.44/bin/mysqld (5.5.44-MariaDB) //offsets for: /mariadb/5.5.44/bin/mysqld (5.5.44-MariaDB)
@ -845,6 +849,10 @@ const ThdOffsets thd_offsets_arr[] =
//32 bit offsets //32 bit offsets
const ThdOffsets thd_offsets_arr[] = const ThdOffsets thd_offsets_arr[] =
{ {
//offsets for: /mariadb/10.0.21/bin/mysqld (10.0.21-MariaDB)
{"10.0.21-MariaDB","3b330c8fef5e540fea0060d8778e1e20", 8332, 8368, 3680, 5140, 44, 1892, 4, 0, 8, 12, 84, 8440},
//offsets for: /mariadb/5.5.45/bin/mysqld (5.5.45-MariaDB)
{"5.5.45-MariaDB","c1b8f68c1012af3fba72fe72066992e0", 7276, 7312, 3460, 4468, 44, 1856, 4, 0, 8, 12, 84, 7372},
//offsets for: /mariadb/10.0.20/bin/mysqld (10.0.20-MariaDB) //offsets for: /mariadb/10.0.20/bin/mysqld (10.0.20-MariaDB)
{"10.0.20-MariaDB","707e0ad28b6b6ab79dee1b7e0ce9e7e8", 8328, 8364, 3680, 5136, 44, 1904, 4, 0, 8, 12, 84, 8436}, {"10.0.20-MariaDB","707e0ad28b6b6ab79dee1b7e0ce9e7e8", 8328, 8364, 3680, 5136, 44, 1904, 4, 0, 8, 12, 84, 8436},
//offsets for: /mariadb/5.5.44/bin/mysqld (5.5.44-MariaDB) //offsets for: /mariadb/5.5.44/bin/mysqld (5.5.44-MariaDB)

54
src/audit_plugin.cc
View File

@ -676,7 +676,7 @@ static bool parse_thd_offsets_string (char *poffsets_string)
char offset_str [2048] = {0}; char offset_str [2048] = {0};
char *poffset_str = offset_str; char *poffset_str = offset_str;
strncpy (poffset_str,poffsets_string,2048); strncpy (poffset_str,poffsets_string,array_elements(offset_str));
char * comma_delimiter = strchr (poffset_str,','); char * comma_delimiter = strchr (poffset_str,',');
size_t i =0; size_t i =0;
OFFSET *pOffset; OFFSET *pOffset;
@ -687,34 +687,44 @@ static bool parse_thd_offsets_string (char *poffsets_string)
if (!((poffset_str[j] >= '0' && poffset_str[j] <='9') || poffset_str[j] == ' ' || poffset_str[j] == ',')) if (!((poffset_str[j] >= '0' && poffset_str[j] <='9') || poffset_str[j] == ' ' || poffset_str[j] == ','))
return false; return false;
} }
while (comma_delimiter !=NULL) while (poffset_str !=NULL)
{ {
*comma_delimiter = '\0'; comma_delimiter = strchr (poffset_str,',');
if(comma_delimiter)
{
*comma_delimiter = '\0';
}
pOffset = (OFFSET*)&Audit_formatter::thd_offsets.query_id + i; pOffset = (OFFSET*)&Audit_formatter::thd_offsets.query_id + i;
if ((size_t)pOffset- (size_t)&Audit_formatter::thd_offsets < sizeof (Audit_formatter::thd_offsets)) if ((size_t)pOffset- (size_t)&Audit_formatter::thd_offsets < sizeof (Audit_formatter::thd_offsets))
{ {
sscanf (poffset_str, "%zu", pOffset); if(sscanf (poffset_str, "%zu", pOffset) != 1)
{
sql_print_error("%s Failed parsing audit_offsets: scanf failed for offset string: \"%s\" (possible missing offset)", log_prefix, poffset_str);
return false;
}
} }
else else
{ {
sql_print_error("%s Failed parsing audit_offsets: too many offsets specified", log_prefix);
return false; return false;
} }
i++; i++;
poffset_str = comma_delimiter + 1; if(comma_delimiter)
comma_delimiter = strchr (poffset_str,','); {
} poffset_str = comma_delimiter + 1;
if (poffset_str !=NULL) }
{ else
pOffset = &Audit_formatter::thd_offsets.query_id + i; {
if ((size_t)pOffset- (size_t)&Audit_formatter::thd_offsets < sizeof (Audit_formatter::thd_offsets)) poffset_str = NULL;
{ }
sscanf (poffset_str, "%zu", pOffset); }
} //validate that we got all offsets. If there is still space in thd_offsets then we didn't get all offsets
else pOffset = (OFFSET*)&Audit_formatter::thd_offsets.query_id + i;
{ if ((size_t)pOffset- (size_t)&Audit_formatter::thd_offsets < sizeof (Audit_formatter::thd_offsets))
return false; {
} sql_print_error("%s Failed parsing audit_offsets: not all offsets specified. This may happen if you used an old version of offset-extract.sh script.", log_prefix);
} return false;
}
return true; return true;
} }
@ -871,7 +881,7 @@ static int setup_offsets()
} }
if (parse_thd_offsets_string (offsets_string)) if (parse_thd_offsets_string (offsets_string))
{ {
sql_print_information ("%s setup_offsets Audit_formatter::thd_offsets values: %zu %zu %zu %zu %zu %zu %zu %zu %zu %zu", log_prefix, sql_print_information ("%s setup_offsets Audit_formatter::thd_offsets values: %zu %zu %zu %zu %zu %zu %zu %zu %zu %zu %zu %zu", log_prefix,
Audit_formatter::thd_offsets.query_id, Audit_formatter::thd_offsets.query_id,
Audit_formatter::thd_offsets.thread_id, Audit_formatter::thd_offsets.thread_id,
Audit_formatter::thd_offsets.main_security_ctx, Audit_formatter::thd_offsets.main_security_ctx,
@ -881,7 +891,9 @@ static int setup_offsets()
Audit_formatter::thd_offsets.sec_ctx_user, Audit_formatter::thd_offsets.sec_ctx_user,
Audit_formatter::thd_offsets.sec_ctx_host, Audit_formatter::thd_offsets.sec_ctx_host,
Audit_formatter::thd_offsets.sec_ctx_ip, Audit_formatter::thd_offsets.sec_ctx_ip,
Audit_formatter::thd_offsets.sec_ctx_priv_user); Audit_formatter::thd_offsets.sec_ctx_priv_user,
Audit_formatter::thd_offsets.db,
Audit_formatter::thd_offsets.killed);
if (!validate_offsets(&Audit_formatter::thd_offsets)) if (!validate_offsets(&Audit_formatter::thd_offsets))
{ {