github
/
mysql-audit
mirror of https://github.com/mcafee-enterprise/mysql-audit
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Offsets for MySQL 5.5.49, 5.6.30, 5.7.12. Whitespace cleanups. 

Update yajl/src/Makefile.am to remove an Autoconf warning.
pull/141/head
Arnold Robbins 2016-04-19 12:09:36 +03:00
parent 80646620e9
commit 3589301cf1
11 changed files with 143 additions and 108 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
include/audit_handler.h
View File

@ -39,17 +39,17 @@ typedef struct _QueryTableInf {
int num_of_elem; int num_of_elem;
char *db[MAX_NUM_QUERY_TABLE_ELEM]; char *db[MAX_NUM_QUERY_TABLE_ELEM];
char *table_name[MAX_NUM_QUERY_TABLE_ELEM]; char *table_name[MAX_NUM_QUERY_TABLE_ELEM];
const char *object_type [MAX_NUM_QUERY_TABLE_ELEM]; const char *object_type[MAX_NUM_QUERY_TABLE_ELEM];
} QueryTableInf; } QueryTableInf;
#define MAX_NUM_QUEUE_ELEM 1024 #define MAX_NUM_QUEUE_ELEM 1024
typedef struct _THDPRINTED { typedef struct _THDPRINTED {
size_t cur_index; size_t cur_index;
char is_thd_printed_queue [MAX_NUM_QUEUE_ELEM]; char is_thd_printed_queue[MAX_NUM_QUEUE_ELEM];
} THDPRINTED; } THDPRINTED;
#define MAX_COMMAND_CHAR_NUMBERS 40 #define MAX_COMMAND_CHAR_NUMBERS 40
const char *retrieve_command(THD *thd, bool & is_sql_cmd); const char *retrieve_command(THD *thd, bool& is_sql_cmd);
typedef size_t OFFSET; typedef size_t OFFSET;
#define MAX_COM_STATUS_VARS_RECORDS 512 #define MAX_COM_STATUS_VARS_RECORDS 512
@ -112,7 +112,7 @@ public:
class ThdSesData { class ThdSesData {
public: public:
// enum indicating from where the object list came from // enum indicating from where the object list came from
enum ObjectIterType {OBJ_NONE, OBJ_DB, OBJ_QUERY_CACHE, OBJ_TABLE_LIST}; enum ObjectIterType { OBJ_NONE, OBJ_DB, OBJ_QUERY_CACHE, OBJ_TABLE_LIST };
ThdSesData(THD *pTHD); ThdSesData(THD *pTHD);
THD *getTHD() { return m_pThd;} THD *getTHD() { return m_pThd;}
const char *getCmdName() { return m_CmdName; } const char *getCmdName() { return m_CmdName; }
@ -122,7 +122,8 @@ public:
*/ */
bool startGetObjects(); bool startGetObjects();
/** /**
* Get next object. Return true if populated. False if there isn't an object available. * Get next object. Return true if populated. False if there isn't an
* object available.
* Will point the passed pointers to point to db, name and type. * Will point the passed pointers to point to db, name and type.
* obj_type is optional and may be null. * obj_type is optional and may be null.
*/ */
@ -155,29 +156,32 @@ public:
virtual ~Audit_formatter() {} virtual ~Audit_formatter() {}
/** /**
* static offsets to use for fetching THD data. Set by the audit plugin during startup. * static offsets to use for fetching THD data.
* Set by the audit plugin during startup.
*/ */
static ThdOffsets thd_offsets; static ThdOffsets thd_offsets;
/** /**
* Format an audit event from the passed THD. Will write out its output using the audit_write_func. * Format an audit event from the passed THD.
* Will write out its output using the audit_write_func.
* *
* @return -1 on a failure * @return -1 on a failure
*/ */
virtual ssize_t event_format(ThdSesData *pThdData, IWriter *writer) =0; virtual ssize_t event_format(ThdSesData *pThdData, IWriter *writer) = 0;
/** /**
* format a message when handler is started * Format a message when handler is started
* @return -1 on a failure * @return -1 on a failure
*/ */
virtual ssize_t start_msg_format(IWriter *writer) { return 0; } virtual ssize_t start_msg_format(IWriter *writer) { return 0; }
/** /**
* format a message when handler is stopped * Format a message when handler is stopped
* @return -1 on a failure * @return -1 on a failure
*/ */
virtual ssize_t stop_msg_format(IWriter *writer) { return 0; } virtual ssize_t stop_msg_format(IWriter *writer) { return 0; }
static const char *retrieve_object_type(TABLE_LIST *pObj); static const char *retrieve_object_type(TABLE_LIST *pObj);
static QueryTableInf *getQueryCacheTableList1(THD *thd); static QueryTableInf *getQueryCacheTableList1(THD *thd);
// utility functions for fetching thd stuff // utility functions for fetching thd stuff
static inline my_thread_id thd_inst_thread_id(THD *thd) static inline my_thread_id thd_inst_thread_id(THD *thd)
{ {
@ -317,7 +321,8 @@ public:
return *(LEX **) (((unsigned char *) thd) + Audit_formatter::thd_offsets.lex); return *(LEX **) (((unsigned char *) thd) + Audit_formatter::thd_offsets.lex);
} }
// we don't use get_db_name() as when we call it view may be not null and it may return an invalid value for view_db // we don't use get_db_name() as when we call it view may be not null
// and it may return an invalid value for view_db
static inline const char *table_get_db_name(TABLE_LIST *table) static inline const char *table_get_db_name(TABLE_LIST *table)
{ {
return table->db; return table->db;
@ -342,8 +347,12 @@ class Audit_json_formatter: public Audit_formatter {
public: public:
static const char *DEF_MSG_DELIMITER; static const char *DEF_MSG_DELIMITER;
Audit_json_formatter(): m_msg_delimiter(NULL), m_write_start_msg(true), m_password_mask_regex_preg(NULL), Audit_json_formatter()
m_password_mask_regex_compiled(false), m_perform_password_masking(NULL) : m_msg_delimiter(NULL),
m_write_start_msg(true),
m_password_mask_regex_preg(NULL),
m_password_mask_regex_compiled(false),
m_perform_password_masking(NULL)
{ {
config.beautify = 0; config.beautify = 0;
config.indentString = NULL; config.indentString = NULL;
@ -363,7 +372,8 @@ public:
virtual ssize_t start_msg_format(IWriter *writer); virtual ssize_t start_msg_format(IWriter *writer);
/** /**
* Utility method used to compile a regex program. Will compile and log errors if necessary. * Utility method used to compile a regex program.
* Will compile and log errors if necessary.
* Return null if fails * Return null if fails
*/ */
static pcre *regex_compile(const char *str); static pcre *regex_compile(const char *str);
@ -387,7 +397,8 @@ public:
my_bool (*m_perform_password_masking)(const char *cmd); my_bool (*m_perform_password_masking)(const char *cmd);
/** /**
* Message delimiter. Should point to a valid json string (supporting the json escapping format). * Message delimiter. Should point to a valid json string
* (supporting the json escapping format).
* Will only be checked at the start. Public so can be set by sysvar. * Will only be checked at the start. Public so can be set by sysvar.
* *
* We only support a delimiter up to 32 chars * We only support a delimiter up to 32 chars
@ -452,10 +463,12 @@ public:
} }
/** /**
* Should be called to initialize. We don't init in constructor in order to provide indication if * Should be called to initialize.
* We don't init in constructor in order to provide indication if
* pthread stuff failed init. * pthread stuff failed init.
* *
* @frmt the formatter to use in this handler (does not manage distruction of this object) * @frmt the formatter to use in this handler (does not manage
* destruction of this object)
* @return 0 on success * @return 0 on success
*/ */
int init(Audit_formatter *frmt) int init(Audit_formatter *frmt)
@ -465,16 +478,19 @@ public:
{ {
return 0; return 0;
} }
int res = my_rwlock_init(&LOCK_audit, NULL); int res = my_rwlock_init(&LOCK_audit, NULL);
if (res) if (res)
{ {
return res; return res;
} }
res = pthread_mutex_init(&LOCK_io, MY_MUTEX_INIT_SLOW);; res = pthread_mutex_init(&LOCK_io, MY_MUTEX_INIT_SLOW);;
if (res) if (res)
{ {
return res; return res;
} }
m_initialized = true; m_initialized = true;
return res; return res;
} }
@ -531,7 +547,8 @@ protected:
return m_failed && (m_retry_interval < 0 || return m_failed && (m_retry_interval < 0 ||
difftime(time(NULL), m_last_retry_sec_ts) > m_retry_interval); difftime(time(NULL), m_last_retry_sec_ts) > m_retry_interval);
} }
// override default assignment and copy to protect against creating additional instances // override default assignment and copy to protect against
// creating additional instances
Audit_handler & operator=(const Audit_handler&); Audit_handler & operator=(const Audit_handler&);
Audit_handler(const Audit_handler&); Audit_handler(const Audit_handler&);
private: private:
@ -604,7 +621,8 @@ public:
unsigned int m_sync_period; unsigned int m_sync_period;
/** /**
* The buf size used by the file stream. 0 = use default, negative or 1 = no buffering * The buf size used by the file stream. 0 = use default,
* negative or 1 = no buffering
*/ */
long m_bufsize; long m_bufsize;
@ -618,7 +636,8 @@ public:
int open(const char *io_dest, bool m_log_errors); int open(const char *io_dest, bool m_log_errors);
// static void print_sleep(THD *thd, int delay_ms); // static void print_sleep(THD *thd, int delay_ms);
protected: protected:
// override default assignment and copy to protect against creating additional instances // override default assignment and copy to protect against creating
// additional instances
Audit_file_handler & operator=(const Audit_file_handler&); Audit_file_handler & operator=(const Audit_file_handler&);
Audit_file_handler(const Audit_file_handler&); Audit_file_handler(const Audit_file_handler&);

4
include/hot_patch.h Executable file → Normal file
View File

@ -16,9 +16,9 @@
unsigned int jump_size(); unsigned int jump_size();
int hot_patch_function(void* targetFunction, void* newFunction, void * trampolineFunction, unsigned int *trampolinesize, bool log_info); int hot_patch_function(void* targetFunction, void* newFunction, void* trampolineFunction, unsigned int *trampolinesize, bool log_info);
void remove_hot_patch_function (void* targetFunction, void * trampolineFunction, unsigned int trampolinesize, bool log_info); void remove_hot_patch_function(void* targetFunction, void* trampolineFunction, unsigned int trampolinesize, bool log_info);
//8KB NOP + 16 //8KB NOP + 16
//can be used to define a block of memory to use for trampolines //can be used to define a block of memory to use for trampolines

1
include/md5.h
View File

@ -49,7 +49,6 @@ extern void MD5_Final(unsigned char *result, MD5_CTX *ctx);
#define my_MD5Update MD5_Update #define my_MD5Update MD5_Update
#define my_MD5Final MD5_Final #define my_MD5Final MD5_Final
#endif // #if MYSQL_VERSION_ID >= 50600 #endif // #if MYSQL_VERSION_ID >= 50600
#endif #endif

6
include/mysql_inc.h
View File

@ -8,8 +8,10 @@
#define MYSQL_DYNAMIC_PLUGIN 1 #define MYSQL_DYNAMIC_PLUGIN 1
#define MYSQL_SERVER 1 #define MYSQL_SERVER 1
// Fix for VIO. We don't want to using method mapping as then a change in the struct will cause the offsets compiled with to // Fix for VIO. We don't want to using method mapping as then a change in
// be wrong. As is the case with ndb which uses a version of Vio with support for ipv6 similar to 5.5 but different from 5.1 // the struct will cause the offsets compiled with to be wrong.
// As is the case with ndb which uses a version of Vio with support for
// ipv6 similar to 5.5 but different from 5.1
#define DONT_MAP_VIO #define DONT_MAP_VIO
#include <my_config.h> #include <my_config.h>

2
src/Makefile.am
View File

@ -16,7 +16,7 @@
$(top_srcdir)/pcre/libpcre.la: $(top_srcdir)/pcre/libpcre.la:
cd $(top_srcdir)/pcre && $(MAKE) $(AM_MAKEFLAGS) libpcre.la cd $(top_srcdir)/pcre && $(MAKE) $(AM_MAKEFLAGS) libpcre.la
INCLUDES = $(MYSQL_INC) $(YAJL_INC) $(UDIS_INC) -I$(top_srcdir)/pcre AM_CPPFLAGS = $(MYSQL_INC) $(YAJL_INC) $(UDIS_INC) -I$(top_srcdir)/pcre
pkgplugindir = $(MYSQL_PLUGIN_DIR) pkgplugindir = $(MYSQL_PLUGIN_DIR)

12
src/audit_handler.cc
View File

@ -40,13 +40,11 @@
fprintf(f, __VA_ARGS__);\ fprintf(f, __VA_ARGS__);\
} while (0) } while (0)
// regex flags used in compilation
static const int regex_flags = PCRE_DOTALL | PCRE_UTF8 | PCRE_CASELESS | PCRE_DUPNAMES;
// initialize static stuff // initialize static stuff
ThdOffsets Audit_formatter::thd_offsets = { 0 }; ThdOffsets Audit_formatter::thd_offsets = { 0 };
Audit_handler *Audit_handler::m_audit_handler_list[Audit_handler::MAX_AUDIT_HANDLERS_NUM]; Audit_handler *Audit_handler::m_audit_handler_list[Audit_handler::MAX_AUDIT_HANDLERS_NUM];
const char * Audit_json_formatter::DEF_MSG_DELIMITER = "\\n"; const char *Audit_json_formatter::DEF_MSG_DELIMITER = "\\n";
#if MYSQL_VERSION_ID < 50709 #if MYSQL_VERSION_ID < 50709
#define C_STRING_WITH_LEN(X) ((char *) (X)), ((size_t) (sizeof(X) - 1)) #define C_STRING_WITH_LEN(X) ((char *) (X)), ((size_t) (sizeof(X) - 1))
@ -263,7 +261,8 @@ bool Audit_io_handler::handler_start_internal()
} }
ssize_t res = m_formatter->start_msg_format(this); ssize_t res = m_formatter->start_msg_format(this);
/* /*
* Sanity check of writing to the log. If we fail, we print an erorr and disable this handler. * Sanity check of writing to the log. If we fail, we print an
* error and disable this handler.
*/ */
if (res < 0) if (res < 0)
{ {
@ -495,7 +494,7 @@ extern "C" {
static const char *thd_query_str(THD *thd, size_t *len) static const char *thd_query_str(THD *thd, size_t *len)
{ {
MYSQL_LEX_STRING * str = thd_query_string(thd); MYSQL_LEX_STRING *str = thd_query_string(thd);
if (str) if (str)
{ {
*len = str->length; *len = str->length;
@ -879,6 +878,9 @@ pcre *Audit_json_formatter::regex_compile(const char *str)
{ {
const char *error; const char *error;
int erroffset; int erroffset;
static const int regex_flags =
PCRE_DOTALL | PCRE_UTF8 | PCRE_CASELESS | PCRE_DUPNAMES;
pcre *re = pcre_compile(str, regex_flags, &error, &erroffset, NULL); pcre *re = pcre_compile(str, regex_flags, &error, &erroffset, NULL);
if (!re) if (!re)
{ {

12
src/audit_offsets.cc
View File

@ -22,6 +22,12 @@
const ThdOffsets thd_offsets_arr[] = const ThdOffsets thd_offsets_arr[] =
{ {
/* +++ MYSQL 64 OFFSETS GO HERE +++ */ /* +++ MYSQL 64 OFFSETS GO HERE +++ */
//offsets for: /mysqlrpm/5.7.12/usr/sbin/mysqld (5.7.12)
{"5.7.12","f2061aef037c01412ecf9142fe627572", 7800, 7848, 3624, 4776, 456, 360, 0, 32, 64, 160, 536, 7964},
//offsets for: /mysqlrpm/5.5.49/usr/sbin/mysqld (5.5.49)
{"5.5.49","bae752665a4ebcff87a5933350cc1cbf", 6144, 6192, 3816, 4312, 88, 2592, 96, 0, 32, 104, 120, 6264},
//offsets for: /mysqlrpm/5.6.30/usr/sbin/mysqld (5.6.30)
{"5.6.30","84dd43523b638e4b2817ca9b53f204fe", 6992, 7040, 4000, 4520, 72, 2704, 96, 0, 32, 104, 136, 7128},
//offsets for: /mysqlrpm/5.5.48/usr/sbin/mysqld (5.5.48) //offsets for: /mysqlrpm/5.5.48/usr/sbin/mysqld (5.5.48)
{"5.5.48","69b209f0c08027a501b1cb7a20e6e582", 6144, 6192, 3816, 4312, 88, 2592, 96, 0, 32, 104, 120, 6264}, {"5.5.48","69b209f0c08027a501b1cb7a20e6e582", 6144, 6192, 3816, 4312, 88, 2592, 96, 0, 32, 104, 120, 6264},
//offsets for: /mysqlrpm/5.6.29/usr/sbin/mysqld (5.6.29) //offsets for: /mysqlrpm/5.6.29/usr/sbin/mysqld (5.6.29)
@ -425,6 +431,12 @@ const ThdOffsets thd_offsets_arr[] =
const ThdOffsets thd_offsets_arr[] = const ThdOffsets thd_offsets_arr[] =
{ {
/* +++ MYSQL 32 OFFSETS GO HERE +++ */ /* +++ MYSQL 32 OFFSETS GO HERE +++ */
//offsets for: /mysqlrpm/5.7.12/usr/sbin/mysqld (5.7.12)
{"5.7.12","c544b5ccfc52a7e4667e0766fbad0909", 5072, 5100, 2208, 3028, 296, 200, 0, 20, 40, 100, 340, 5188},
//offsets for: /mysqlrpm/5.5.49/usr/sbin/mysqld (5.5.49)
{"5.5.49","3fbac9ee400e5ca56e0b328f23c38b54", 3872, 3900, 2368, 2748, 44, 1656, 60, 0, 20, 64, 60, 3956},
//offsets for: /mysqlrpm/5.6.30/usr/sbin/mysqld (5.6.30)
{"5.6.30","bcf06179a987910bff85ee0482f8391f", 4676, 4704, 2660, 3052, 36, 1748, 60, 0, 20, 64, 72, 4776},
//offsets for: /mysqlrpm/5.5.48/usr/sbin/mysqld (5.5.48) //offsets for: /mysqlrpm/5.5.48/usr/sbin/mysqld (5.5.48)
{"5.5.48","731f6399029830b0b9ffa151541ed474", 3872, 3900, 2368, 2748, 44, 1656, 60, 0, 20, 64, 60, 3956}, {"5.5.48","731f6399029830b0b9ffa151541ed474", 3872, 3900, 2368, 2748, 44, 1656, 60, 0, 20, 64, 60, 3956},
//offsets for: /mysqlrpm/5.6.29/usr/sbin/mysqld (5.6.29) //offsets for: /mysqlrpm/5.6.29/usr/sbin/mysqld (5.6.29)

5
src/audit_plugin.cc
View File

@ -53,7 +53,7 @@ static my_bool offsets_by_version_enable = FALSE;
static my_bool validate_offsets_extended_enable = FALSE; static my_bool validate_offsets_extended_enable = FALSE;
static char *offsets_string = NULL; static char *offsets_string = NULL;
static char *checksum_string = NULL; static char *checksum_string = NULL;
static int delay_ms_val =0; static int delay_ms_val = 0;
static char *delay_cmds_string = NULL; static char *delay_cmds_string = NULL;
static char delay_cmds_buff[4096] = {0}; static char delay_cmds_buff[4096] = {0};
static char *whitelist_cmds_string = NULL; static char *whitelist_cmds_string = NULL;
@ -1604,7 +1604,8 @@ static int audit_plugin_init(void *p)
DBUG_RETURN(1); DBUG_RETURN(1);
} }
// enable according to what we have in *file_handler_enable (this is set accordingly by sysvar functionality) // enable according to what we have in *file_handler_enable
// (this is set accordingly by sysvar functionality)
json_file_handler.set_enable(json_file_handler_enable); json_file_handler.set_enable(json_file_handler_enable);
json_socket_handler.set_enable(json_socket_handler_enable); json_socket_handler.set_enable(json_socket_handler_enable);
Audit_handler::m_audit_handler_list[Audit_handler::JSON_FILE_HANDLER] = &json_file_handler; Audit_handler::m_audit_handler_list[Audit_handler::JSON_FILE_HANDLER] = &json_file_handler;

4
src/hot_patch.cc
View File

@ -171,7 +171,7 @@ static void WriteJump(void *pAddress, ULONG_PTR JumpTo)
BYTE *pCur = (BYTE *) pAddress; BYTE *pCur = (BYTE *) pAddress;
#ifndef __x86_64__ #ifndef __x86_64__
BYTE * pbJmpSrc = pCur + 5; BYTE *pbJmpSrc = pCur + 5;
*pCur++ = 0xE9; // jmp +imm32 *pCur++ = 0xE9; // jmp +imm32
*((ULONG_PTR *)pCur) = JumpTo - (ULONG_PTR)pbJmpSrc; *((ULONG_PTR *)pCur) = JumpTo - (ULONG_PTR)pbJmpSrc;
@ -288,7 +288,7 @@ static void UnhookFunction(ULONG_PTR Function, ULONG_PTR trampolineFunction, uns
{ {
sql_print_error( sql_print_error(
"%s Unhook not able to unprotect function page: %p. Aborting.", "%s Unhook not able to unprotect function page: %p. Aborting.",
log_prefix, (void * )FunctionPage); log_prefix, (void *) FunctionPage);
return; return;
} }
memcpy((void *) Function, (void*)trampolineFunction,trampolinesize); memcpy((void *) Function, (void*)trampolineFunction,trampolinesize);

2
yajl/src/Makefile.am
View File

@ -28,7 +28,7 @@
# POSSIBILITY OF SUCH DAMAGE. # POSSIBILITY OF SUCH DAMAGE.
# #
INCLUDES = $(YAJL_INC) AM_CPPFLAGS = $(YAJL_INC)
noinst_LTLIBRARIES = libyajl.la noinst_LTLIBRARIES = libyajl.la
libyajl_la_SOURCES = yajl_alloc.c yajl_buf.c yajl.c yajl_encode.c yajl_gen.c yajl_lex.c yajl_parser.c yajl_version.c libyajl_la_SOURCES = yajl_alloc.c yajl_buf.c yajl.c yajl_encode.c yajl_gen.c yajl_lex.c yajl_parser.c yajl_version.c