github
/
mysql-audit
mirror of https://github.com/mcafee-enterprise/mysql-audit
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Offsets for MySQL 5.5.49, 5.6.30, 5.7.12. Whitespace cleanups. 

Update yajl/src/Makefile.am to remove an Autoconf warning.
pull/141/head
Arnold Robbins 2016-04-19 12:09:36 +03:00
parent 80646620e9
commit 3589301cf1
11 changed files with 143 additions and 108 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
include/audit_handler.h
View File

@ -39,17 +39,17 @@ typedef struct _QueryTableInf {
int num_of_elem;
char *db[MAX_NUM_QUERY_TABLE_ELEM];
char *table_name[MAX_NUM_QUERY_TABLE_ELEM];
const char *object_type [MAX_NUM_QUERY_TABLE_ELEM];
const char *object_type[MAX_NUM_QUERY_TABLE_ELEM];
} QueryTableInf;
#define MAX_NUM_QUEUE_ELEM 1024
typedef struct _THDPRINTED {
size_t cur_index;
char is_thd_printed_queue [MAX_NUM_QUEUE_ELEM];
size_t cur_index;
char is_thd_printed_queue[MAX_NUM_QUEUE_ELEM];
} THDPRINTED;
#define MAX_COMMAND_CHAR_NUMBERS 40
const char *retrieve_command(THD *thd, bool & is_sql_cmd);
const char *retrieve_command(THD *thd, bool& is_sql_cmd);
typedef size_t OFFSET;
#define MAX_COM_STATUS_VARS_RECORDS 512
@ -112,7 +112,7 @@ public:
class ThdSesData {
public:
// enum indicating from where the object list came from
enum ObjectIterType {OBJ_NONE, OBJ_DB, OBJ_QUERY_CACHE, OBJ_TABLE_LIST};
enum ObjectIterType { OBJ_NONE, OBJ_DB, OBJ_QUERY_CACHE, OBJ_TABLE_LIST };
ThdSesData(THD *pTHD);
THD *getTHD() { return m_pThd;}
const char *getCmdName() { return m_CmdName; }
@ -122,7 +122,8 @@ public:
*/
bool startGetObjects();
/**
* Get next object. Return true if populated. False if there isn't an object available.
* Get next object. Return true if populated. False if there isn't an
* object available.
* Will point the passed pointers to point to db, name and type.
* obj_type is optional and may be null.
*/
@ -155,29 +156,32 @@ public:
virtual ~Audit_formatter() {}
/**
* static offsets to use for fetching THD data. Set by the audit plugin during startup.
* static offsets to use for fetching THD data.
* Set by the audit plugin during startup.
*/
static ThdOffsets thd_offsets;
/**
* Format an audit event from the passed THD. Will write out its output using the audit_write_func.
* Format an audit event from the passed THD.
* Will write out its output using the audit_write_func.
*
* @return -1 on a failure
*/
virtual ssize_t event_format(ThdSesData *pThdData, IWriter *writer) =0;
virtual ssize_t event_format(ThdSesData *pThdData, IWriter *writer) = 0;
/**
* format a message when handler is started
* Format a message when handler is started
* @return -1 on a failure
*/
virtual ssize_t start_msg_format(IWriter *writer) { return 0; }
/**
* format a message when handler is stopped
* Format a message when handler is stopped
* @return -1 on a failure
*/
virtual ssize_t stop_msg_format(IWriter *writer) { return 0; }
static const char *retrieve_object_type(TABLE_LIST *pObj);
static QueryTableInf *getQueryCacheTableList1(THD *thd);
// utility functions for fetching thd stuff
static inline my_thread_id thd_inst_thread_id(THD *thd)
{
@ -317,7 +321,8 @@ public:
return *(LEX **) (((unsigned char *) thd) + Audit_formatter::thd_offsets.lex);
}
// we don't use get_db_name() as when we call it view may be not null and it may return an invalid value for view_db
// we don't use get_db_name() as when we call it view may be not null
// and it may return an invalid value for view_db
static inline const char *table_get_db_name(TABLE_LIST *table)
{
return table->db;
@ -342,8 +347,12 @@ class Audit_json_formatter: public Audit_formatter {
public:
static const char *DEF_MSG_DELIMITER;
Audit_json_formatter(): m_msg_delimiter(NULL), m_write_start_msg(true), m_password_mask_regex_preg(NULL),
m_password_mask_regex_compiled(false), m_perform_password_masking(NULL)
Audit_json_formatter()
: m_msg_delimiter(NULL),
m_write_start_msg(true),
m_password_mask_regex_preg(NULL),
m_password_mask_regex_compiled(false),
m_perform_password_masking(NULL)
{
config.beautify = 0;
config.indentString = NULL;
@ -363,7 +372,8 @@ public:
virtual ssize_t start_msg_format(IWriter *writer);
/**
* Utility method used to compile a regex program. Will compile and log errors if necessary.
* Utility method used to compile a regex program.
* Will compile and log errors if necessary.
* Return null if fails
*/
static pcre *regex_compile(const char *str);
@ -387,7 +397,8 @@ public:
my_bool (*m_perform_password_masking)(const char *cmd);
/**
* Message delimiter. Should point to a valid json string (supporting the json escapping format).
* Message delimiter. Should point to a valid json string
* (supporting the json escapping format).
* Will only be checked at the start. Public so can be set by sysvar.
*
* We only support a delimiter up to 32 chars
@ -452,10 +463,12 @@ public:
}
/**
* Should be called to initialize. We don't init in constructor in order to provide indication if
* Should be called to initialize.
* We don't init in constructor in order to provide indication if
* pthread stuff failed init.
*
* @frmt the formatter to use in this handler (does not manage distruction of this object)
* @frmt the formatter to use in this handler (does not manage
* destruction of this object)
* @return 0 on success
*/
int init(Audit_formatter *frmt)
@ -465,16 +478,19 @@ public:
{
return 0;
}
int res = my_rwlock_init(&LOCK_audit, NULL);
if (res)
{
return res;
}
res = pthread_mutex_init(&LOCK_io, MY_MUTEX_INIT_SLOW);;
if (res)
{
return res;
}
m_initialized = true;
return res;
}
@ -531,7 +547,8 @@ protected:
return m_failed && (m_retry_interval < 0 ||
difftime(time(NULL), m_last_retry_sec_ts) > m_retry_interval);
}
// override default assignment and copy to protect against creating additional instances
// override default assignment and copy to protect against
// creating additional instances
Audit_handler & operator=(const Audit_handler&);
Audit_handler(const Audit_handler&);
private:
@ -604,7 +621,8 @@ public:
unsigned int m_sync_period;
/**
* The buf size used by the file stream. 0 = use default, negative or 1 = no buffering
* The buf size used by the file stream. 0 = use default,
* negative or 1 = no buffering
*/
long m_bufsize;
@ -618,7 +636,8 @@ public:
int open(const char *io_dest, bool m_log_errors);
// static void print_sleep(THD *thd, int delay_ms);
protected:
// override default assignment and copy to protect against creating additional instances
// override default assignment and copy to protect against creating
// additional instances
Audit_file_handler & operator=(const Audit_file_handler&);
Audit_file_handler(const Audit_file_handler&);

4
include/hot_patch.h Executable file → Normal file
View File

@ -16,9 +16,9 @@
unsigned int jump_size();
int hot_patch_function(void* targetFunction, void* newFunction, void * trampolineFunction, unsigned int *trampolinesize, bool log_info);
int hot_patch_function(void* targetFunction, void* newFunction, void* trampolineFunction, unsigned int *trampolinesize, bool log_info);
void remove_hot_patch_function (void* targetFunction, void * trampolineFunction, unsigned int trampolinesize, bool log_info);
void remove_hot_patch_function(void* targetFunction, void* trampolineFunction, unsigned int trampolinesize, bool log_info);
//8KB NOP + 16
//can be used to define a block of memory to use for trampolines

1
include/md5.h
View File

@ -49,7 +49,6 @@ extern void MD5_Final(unsigned char *result, MD5_CTX *ctx);
#define my_MD5Update MD5_Update
#define my_MD5Final MD5_Final
#endif // #if MYSQL_VERSION_ID >= 50600
#endif

6
include/mysql_inc.h
View File

@ -8,8 +8,10 @@
#define MYSQL_DYNAMIC_PLUGIN 1
#define MYSQL_SERVER 1
// Fix for VIO. We don't want to using method mapping as then a change in the struct will cause the offsets compiled with to
// be wrong. As is the case with ndb which uses a version of Vio with support for ipv6 similar to 5.5 but different from 5.1
// Fix for VIO. We don't want to using method mapping as then a change in
// the struct will cause the offsets compiled with to be wrong.
// As is the case with ndb which uses a version of Vio with support for
// ipv6 similar to 5.5 but different from 5.1
#define DONT_MAP_VIO
#include <my_config.h>

2
src/Makefile.am
View File

@ -16,7 +16,7 @@
$(top_srcdir)/pcre/libpcre.la:
cd $(top_srcdir)/pcre && $(MAKE) $(AM_MAKEFLAGS) libpcre.la
INCLUDES = $(MYSQL_INC) $(YAJL_INC) $(UDIS_INC) -I$(top_srcdir)/pcre
AM_CPPFLAGS = $(MYSQL_INC) $(YAJL_INC) $(UDIS_INC) -I$(top_srcdir)/pcre
pkgplugindir = $(MYSQL_PLUGIN_DIR)

12
src/audit_handler.cc
View File

@ -40,13 +40,11 @@
fprintf(f, __VA_ARGS__);\
} while (0)
// regex flags used in compilation
static const int regex_flags = PCRE_DOTALL | PCRE_UTF8 | PCRE_CASELESS | PCRE_DUPNAMES;
// initialize static stuff
ThdOffsets Audit_formatter::thd_offsets = { 0 };
Audit_handler *Audit_handler::m_audit_handler_list[Audit_handler::MAX_AUDIT_HANDLERS_NUM];
const char * Audit_json_formatter::DEF_MSG_DELIMITER = "\\n";
const char *Audit_json_formatter::DEF_MSG_DELIMITER = "\\n";
#if MYSQL_VERSION_ID < 50709
#define C_STRING_WITH_LEN(X) ((char *) (X)), ((size_t) (sizeof(X) - 1))
@ -263,7 +261,8 @@ bool Audit_io_handler::handler_start_internal()
}
ssize_t res = m_formatter->start_msg_format(this);
/*
* Sanity check of writing to the log. If we fail, we print an erorr and disable this handler.
* Sanity check of writing to the log. If we fail, we print an
* error and disable this handler.
*/
if (res < 0)
{
@ -495,7 +494,7 @@ extern "C" {
static const char *thd_query_str(THD *thd, size_t *len)
{
MYSQL_LEX_STRING * str = thd_query_string(thd);
MYSQL_LEX_STRING *str = thd_query_string(thd);
if (str)
{
*len = str->length;
@ -879,6 +878,9 @@ pcre *Audit_json_formatter::regex_compile(const char *str)
{
const char *error;
int erroffset;
static const int regex_flags =
PCRE_DOTALL | PCRE_UTF8 | PCRE_CASELESS | PCRE_DUPNAMES;
pcre *re = pcre_compile(str, regex_flags, &error, &erroffset, NULL);
if (!re)
{

12
src/audit_offsets.cc
View File

@ -22,6 +22,12 @@
const ThdOffsets thd_offsets_arr[] =
{
/* +++ MYSQL 64 OFFSETS GO HERE +++ */
//offsets for: /mysqlrpm/5.7.12/usr/sbin/mysqld (5.7.12)
{"5.7.12","f2061aef037c01412ecf9142fe627572", 7800, 7848, 3624, 4776, 456, 360, 0, 32, 64, 160, 536, 7964},
//offsets for: /mysqlrpm/5.5.49/usr/sbin/mysqld (5.5.49)
{"5.5.49","bae752665a4ebcff87a5933350cc1cbf", 6144, 6192, 3816, 4312, 88, 2592, 96, 0, 32, 104, 120, 6264},
//offsets for: /mysqlrpm/5.6.30/usr/sbin/mysqld (5.6.30)
{"5.6.30","84dd43523b638e4b2817ca9b53f204fe", 6992, 7040, 4000, 4520, 72, 2704, 96, 0, 32, 104, 136, 7128},
//offsets for: /mysqlrpm/5.5.48/usr/sbin/mysqld (5.5.48)
{"5.5.48","69b209f0c08027a501b1cb7a20e6e582", 6144, 6192, 3816, 4312, 88, 2592, 96, 0, 32, 104, 120, 6264},
//offsets for: /mysqlrpm/5.6.29/usr/sbin/mysqld (5.6.29)
@ -425,6 +431,12 @@ const ThdOffsets thd_offsets_arr[] =
const ThdOffsets thd_offsets_arr[] =
{
/* +++ MYSQL 32 OFFSETS GO HERE +++ */
//offsets for: /mysqlrpm/5.7.12/usr/sbin/mysqld (5.7.12)
{"5.7.12","c544b5ccfc52a7e4667e0766fbad0909", 5072, 5100, 2208, 3028, 296, 200, 0, 20, 40, 100, 340, 5188},
//offsets for: /mysqlrpm/5.5.49/usr/sbin/mysqld (5.5.49)
{"5.5.49","3fbac9ee400e5ca56e0b328f23c38b54", 3872, 3900, 2368, 2748, 44, 1656, 60, 0, 20, 64, 60, 3956},
//offsets for: /mysqlrpm/5.6.30/usr/sbin/mysqld (5.6.30)
{"5.6.30","bcf06179a987910bff85ee0482f8391f", 4676, 4704, 2660, 3052, 36, 1748, 60, 0, 20, 64, 72, 4776},
//offsets for: /mysqlrpm/5.5.48/usr/sbin/mysqld (5.5.48)
{"5.5.48","731f6399029830b0b9ffa151541ed474", 3872, 3900, 2368, 2748, 44, 1656, 60, 0, 20, 64, 60, 3956},
//offsets for: /mysqlrpm/5.6.29/usr/sbin/mysqld (5.6.29)

5
src/audit_plugin.cc
View File

@ -53,7 +53,7 @@ static my_bool offsets_by_version_enable = FALSE;
static my_bool validate_offsets_extended_enable = FALSE;
static char *offsets_string = NULL;
static char *checksum_string = NULL;
static int delay_ms_val =0;
static int delay_ms_val = 0;
static char *delay_cmds_string = NULL;
static char delay_cmds_buff[4096] = {0};
static char *whitelist_cmds_string = NULL;
@ -1604,7 +1604,8 @@ static int audit_plugin_init(void *p)
DBUG_RETURN(1);
}
// enable according to what we have in *file_handler_enable (this is set accordingly by sysvar functionality)
// enable according to what we have in *file_handler_enable
// (this is set accordingly by sysvar functionality)
json_file_handler.set_enable(json_file_handler_enable);
json_socket_handler.set_enable(json_socket_handler_enable);
Audit_handler::m_audit_handler_list[Audit_handler::JSON_FILE_HANDLER] = &json_file_handler;

4
src/hot_patch.cc
View File

@ -171,7 +171,7 @@ static void WriteJump(void *pAddress, ULONG_PTR JumpTo)
BYTE *pCur = (BYTE *) pAddress;
#ifndef __x86_64__
BYTE * pbJmpSrc = pCur + 5;
BYTE *pbJmpSrc = pCur + 5;
*pCur++ = 0xE9; // jmp +imm32
*((ULONG_PTR *)pCur) = JumpTo - (ULONG_PTR)pbJmpSrc;
@ -288,7 +288,7 @@ static void UnhookFunction(ULONG_PTR Function, ULONG_PTR trampolineFunction, uns
{
sql_print_error(
"%s Unhook not able to unprotect function page: %p. Aborting.",
log_prefix, (void * )FunctionPage);
log_prefix, (void *) FunctionPage);
return;
}
memcpy((void *) Function, (void*)trampolineFunction,trampolinesize);

2
yajl/src/Makefile.am
View File

@ -28,7 +28,7 @@
# POSSIBILITY OF SUCH DAMAGE.
#
INCLUDES = $(YAJL_INC)
AM_CPPFLAGS = $(YAJL_INC)
noinst_LTLIBRARIES = libyajl.la
libyajl_la_SOURCES = yajl_alloc.c yajl_buf.c yajl.c yajl_encode.c yajl_gen.c yajl_lex.c yajl_parser.c yajl_version.c