/* Copyright (c) 2000, 2023, Oracle and/or its affiliates.

This program is free software; you can redistribute it and/or modify

it under the terms of the GNU General Public License, version 2.0,

as published by the Free Software Foundation.

This program is also distributed with certain software (including

but not limited to OpenSSL) that is licensed under separate terms,

as designated in a particular file or component or in included license

documentation. The authors of MySQL hereby grant you an additional

permission to link the program and your derivative works with the

separately licensed software that they have included with MySQL.

This program is distributed in the hope that it will be useful,

but WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

GNU General Public License, version 2.0, for more details.

You should have received a copy of the GNU General Public License

along with this program; if not, write to the Free Software

Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */

#include "sql_show.h" /* append_identifier */

#include "log.h" /* sql_print_warning */

#include "sql_base.h" /* MYSQL_LOCK_IGNORE_TIMEOUT */

#include "key.h" /* key_copy, key_cmp_if_same */

/* key_restore */

#include "auth_internal.h"

#include "sql_auth_cache.h"

#include "sql_authentication.h"

#include "sql_time.h"

#include "sql_plugin.h" // lock_plugin_data etc.

#include "debug_sync.h"

#include "sql_user_table.h"

#define INVALID_DATE "0000-00-00 00:00:00"

#include <algorithm>

#include <functional>

using std::min;

struct ACL_internal_schema_registry_entry

{

const LEX_STRING *m_name;

const ACL_internal_schema_access *m_access;

};

/**

Internal schema registered.

Currently, this is only:

- performance_schema

- information_schema,

This can be reused later for:

- mysql

*/

static ACL_internal_schema_registry_entry registry_array[2];

static uint m_registry_array_size= 0;

#ifndef NO_EMBEDDED_ACCESS_CHECKS

MEM_ROOT global_acl_memory;

MEM_ROOT memex;

Prealloced_array<ACL_USER, ACL_PREALLOC_SIZE> *acl_users= NULL;

Prealloced_array<ACL_PROXY_USER, ACL_PREALLOC_SIZE> *acl_proxy_users= NULL;

Prealloced_array<ACL_DB, ACL_PREALLOC_SIZE> *acl_dbs= NULL;

Prealloced_array<ACL_HOST_AND_IP, ACL_PREALLOC_SIZE> *acl_wild_hosts= NULL;

HASH column_priv_hash, proc_priv_hash, func_priv_hash;

hash_filo *acl_cache;

HASH acl_check_hosts;

bool initialized=0;

bool allow_all_hosts=1;

uint grant_version=0; /* Version of priv tables */

my_bool validate_user_plugins= TRUE;

/**

Flag to track if rwlocks in ACL subsystem were initialized.

Necessary because acl_free() can be called in some error scenarios

without prior call to acl_init().

*/

bool rwlocks_initialized= false;

const uint LOCK_GRANT_PARTITIONS= 32;

Partitioned_rwlock LOCK_grant;

#define FIRST_NON_YN_FIELD 26

#define IP_ADDR_STRLEN (3 + 1 + 3 + 1 + 3 + 1 + 3)

#define ACL_KEY_LENGTH (IP_ADDR_STRLEN + 1 + NAME_LEN + \

1 + USERNAME_LENGTH + 1)

#endif /* NO_EMBEDDED_ACCESS_CHECKS */

/**

Add an internal schema to the registry.

@param name the schema name

@param access the schema ACL specific rules

*/

void ACL_internal_schema_registry::register_schema

(const LEX_STRING &name, const ACL_internal_schema_access *access)

{

assert(m_registry_array_size < array_elements(registry_array));

/* Not thread safe, and does not need to be. */

registry_array[m_registry_array_size].m_name= &name;

registry_array[m_registry_array_size].m_access= access;

m_registry_array_size++;

}

/**

Search per internal schema ACL by name.

@param name a schema name

@return per schema rules, or NULL

*/

const ACL_internal_schema_access *

ACL_internal_schema_registry::lookup(const char *name)

{

assert(name != NULL);

uint i;

for (i= 0; i<m_registry_array_size; i++)

{

if (my_strcasecmp(system_charset_info, registry_array[i].m_name->str,

name) == 0)

return registry_array[i].m_access;

}

return NULL;

}

const char *

ACL_HOST_AND_IP::calc_ip(const char *ip_arg, long *val, char end)

{

long ip_val,tmp;

if (!(ip_arg=str2int(ip_arg,10,0,255,&ip_val)) || *ip_arg != '.')

return 0;

ip_val<<=24;

if (!(ip_arg=str2int(ip_arg+1,10,0,255,&tmp)) || *ip_arg != '.')

return 0;

ip_val+=tmp<<16;

if (!(ip_arg=str2int(ip_arg+1,10,0,255,&tmp)) || *ip_arg != '.')

return 0;

ip_val+=tmp<<8;

if (!(ip_arg=str2int(ip_arg+1,10,0,255,&tmp)) || *ip_arg != end)

return 0;

*val=ip_val+tmp;

return ip_arg;

}

/**

@brief Update the hostname. Updates ip and ip_mask accordingly.

@param host_arg Value to be stored

*/

void

ACL_HOST_AND_IP::update_hostname(const char *host_arg)

{

hostname=(char*) host_arg; // This will not be modified!

hostname_length= hostname ? strlen( hostname ) : 0;

if (!host_arg ||

(!(host_arg=(char*) calc_ip(host_arg,&ip,'/')) ||

!(host_arg=(char*) calc_ip(host_arg+1,&ip_mask,'\0'))))

{

ip= ip_mask=0; // Not a masked ip

}

}

/*

@brief Comparing of hostnames

@param host_arg Hostname to be compared with

@param ip_arg IP address to be compared with

@notes

A hostname may be of type:

1) hostname (May include wildcards); monty.pp.sci.fi

2) ip (May include wildcards); 192.168.0.0

3) ip/netmask 192.168.0.0/255.255.255.0

A net mask of 0.0.0.0 is not allowed.

@return

true if matched

false if not matched

*/

bool

ACL_HOST_AND_IP::compare_hostname(const char *host_arg, const char *ip_arg)

{

long tmp;

if (ip_mask && ip_arg && calc_ip(ip_arg,&tmp,'\0'))

{

return (tmp & ip_mask) == ip;

}

return (!hostname ||

(host_arg &&

!wild_case_compare(system_charset_info, host_arg, hostname)) ||

(ip_arg && !wild_compare(ip_arg, hostname, 0)));

}

ACL_USER *

ACL_USER::copy(MEM_ROOT *root)

{

ACL_USER *dst= (ACL_USER *) alloc_root(root, sizeof(ACL_USER));

if (!dst)

return 0;

*dst= *this;

dst->user= safe_strdup_root(root, user);

dst->ssl_cipher= safe_strdup_root(root, ssl_cipher);

dst->x509_issuer= safe_strdup_root(root, x509_issuer);

dst->x509_subject= safe_strdup_root(root, x509_subject);

/*

If the plugin is built in we don't need to reallocate the name of the

plugin.

*/

if (auth_plugin_is_built_in(dst->plugin.str))

dst->plugin= plugin;

else

{

dst->plugin.str= strmake_root(root, plugin.str, plugin.length);

dst->plugin.length= plugin.length;

}

dst->auth_string.str= safe_strdup_root(root, auth_string.str);

dst->host.update_hostname(host.is_null() ? NULL : strdup_root(root, host.get_host()));

return dst;

}

void

ACL_PROXY_USER::init(const char *host_arg, const char *user_arg,

const char *proxied_host_arg,

const char *proxied_user_arg, bool with_grant_arg)

{

user= (user_arg && *user_arg) ? user_arg : NULL;

host.update_hostname ((host_arg && *host_arg) ? host_arg : NULL);

proxied_user= (proxied_user_arg && *proxied_user_arg) ?

proxied_user_arg : NULL;

proxied_host.update_hostname ((proxied_host_arg && *proxied_host_arg) ?

proxied_host_arg : NULL);

with_grant= with_grant_arg;

sort= get_sort(4, host.get_host(), user,

proxied_host.get_host(), proxied_user);

}

void

ACL_PROXY_USER::init(MEM_ROOT *mem, const char *host_arg, const char *user_arg,

const char *proxied_host_arg,

const char *proxied_user_arg, bool with_grant_arg)

{

init ((host_arg && *host_arg) ? strdup_root (mem, host_arg) : NULL,

(user_arg && *user_arg) ? strdup_root (mem, user_arg) : NULL,

(proxied_host_arg && *proxied_host_arg) ?

strdup_root (mem, proxied_host_arg) : NULL,

(proxied_user_arg && *proxied_user_arg) ?

strdup_root (mem, proxied_user_arg) : NULL,

with_grant_arg);

}

void

ACL_PROXY_USER::init(TABLE *table, MEM_ROOT *mem)

{

init (get_field(mem, table->field[MYSQL_PROXIES_PRIV_HOST]),

get_field(mem, table->field[MYSQL_PROXIES_PRIV_USER]),

get_field(mem, table->field[MYSQL_PROXIES_PRIV_PROXIED_HOST]),

get_field(mem, table->field[MYSQL_PROXIES_PRIV_PROXIED_USER]),

table->field[MYSQL_PROXIES_PRIV_WITH_GRANT]->val_int() != 0);

}

void

ACL_PROXY_USER::check_validity(bool check_no_resolve)

{

if (check_no_resolve &&

(hostname_requires_resolving(host.get_host()) ||

hostname_requires_resolving(proxied_host.get_host())) &&

strcmp(host.get_host(), "localhost") != 0) {

sql_print_warning("'proxies_priv' entry '%s@%s %s@%s' "

"ignored in --skip-name-resolve mode.",

proxied_user ? proxied_user : "",

proxied_host.get_host(),

user ? user : "",

host.get_host());

}

}

bool

ACL_PROXY_USER::matches(const char *host_arg, const char *user_arg,

const char *ip_arg, const char *proxied_user_arg,

bool any_proxy_user)

{

DBUG_ENTER("ACL_PROXY_USER::matches");

DBUG_PRINT("info", ("compare_hostname(%s,%s,%s) &&"

"compare_hostname(%s,%s,%s) &&"

"wild_compare (%s,%s) &&"

"wild_compare (%s,%s)",

host.get_host(),

host_arg ? host_arg : "<NULL>",

ip_arg ? ip_arg : "<NULL>",

proxied_host.get_host(),

host_arg ? host_arg : "<NULL>",

ip_arg ? ip_arg : "<NULL>",

user_arg ? user_arg : "<NULL>",

user ? user : "<NULL>",

proxied_user_arg ? proxied_user_arg : "<NULL>",

proxied_user ? proxied_user : "<NULL>"));

DBUG_RETURN(host.compare_hostname(host_arg, ip_arg) &&

proxied_host.compare_hostname(host_arg, ip_arg) &&

(!user ||

(user_arg && !wild_compare(user_arg, user, TRUE))) &&

(any_proxy_user || !proxied_user ||

(proxied_user && !wild_compare(proxied_user_arg, proxied_user,

TRUE))));

}

bool

ACL_PROXY_USER::pk_equals(ACL_PROXY_USER *grant)

{

DBUG_ENTER("pk_equals");

DBUG_PRINT("info", ("strcmp(%s,%s) &&"

"strcmp(%s,%s) &&"

"wild_compare (%s,%s) &&"

"wild_compare (%s,%s)",

user ? user : "<NULL>",

grant->user ? grant->user : "<NULL>",

proxied_user ? proxied_user : "<NULL>",

grant->proxied_user ? grant->proxied_user : "<NULL>",

host.get_host(),

grant->host.get_host(),

proxied_host.get_host(),

grant->proxied_host.get_host()));

DBUG_RETURN(auth_element_equals(user, grant->user) &&

auth_element_equals(proxied_user, grant->proxied_user) &&

auth_element_equals(host.get_host(), grant->host.get_host()) &&

auth_element_equals(proxied_host.get_host(),

grant->proxied_host.get_host()));

}

void

ACL_PROXY_USER::print_grant(THD *thd, String *str)

{

str->append(STRING_WITH_LEN("GRANT PROXY ON "));

String proxied_user_str(proxied_user, get_proxied_user_length(),

system_charset_info);

append_query_string(thd, system_charset_info, &proxied_user_str, str);

str->append(STRING_WITH_LEN("@"));

String proxied_host_str(proxied_host.get_host(), proxied_host.get_host_len(),

system_charset_info);

append_query_string(thd, system_charset_info, &proxied_host_str, str);

str->append(STRING_WITH_LEN(" TO "));

String user_str(user, get_user_length(), system_charset_info);

append_query_string(thd, system_charset_info, &user_str, str);

str->append(STRING_WITH_LEN("@"));

String host_str(host.get_host(), host.get_host_len(), system_charset_info);

append_query_string(thd, system_charset_info, &host_str, str);

if (with_grant)

str->append(STRING_WITH_LEN(" WITH GRANT OPTION"));

}

int

ACL_PROXY_USER::store_pk(TABLE *table,

const LEX_CSTRING &host,

const LEX_CSTRING &user,

const LEX_CSTRING &proxied_host,

const LEX_CSTRING &proxied_user)

{

DBUG_ENTER("ACL_PROXY_USER::store_pk");

DBUG_PRINT("info", ("host=%s, user=%s, proxied_host=%s, proxied_user=%s",

host.str ? host.str : "<NULL>",

user.str ? user.str : "<NULL>",

proxied_host.str ? proxied_host.str : "<NULL>",

proxied_user.str ? proxied_user.str : "<NULL>"));

if (table->field[MYSQL_PROXIES_PRIV_HOST]->store(host.str,

host.length,

system_charset_info))

DBUG_RETURN(TRUE);

if (table->field[MYSQL_PROXIES_PRIV_USER]->store(user.str,

user.length,

system_charset_info))

DBUG_RETURN(TRUE);

if (table->field[MYSQL_PROXIES_PRIV_PROXIED_HOST]->store(proxied_host.str,

proxied_host.length,

system_charset_info))

DBUG_RETURN(TRUE);

if (table->field[MYSQL_PROXIES_PRIV_PROXIED_USER]->store(proxied_user.str,

proxied_user.length,

system_charset_info))

DBUG_RETURN(TRUE);

DBUG_RETURN(FALSE);

}

int

ACL_PROXY_USER::store_with_grant(TABLE * table,

bool with_grant)

{

DBUG_ENTER("ACL_PROXY_USER::store_with_grant");

DBUG_PRINT("info", ("with_grant=%s", with_grant ? "TRUE" : "FALSE"));

if (table->field[MYSQL_PROXIES_PRIV_WITH_GRANT]->store(with_grant ? 1 : 0,

TRUE))

DBUG_RETURN(TRUE);

DBUG_RETURN(FALSE);

}

int

ACL_PROXY_USER::store_data_record(TABLE *table,

const LEX_CSTRING &host,

const LEX_CSTRING &user,

const LEX_CSTRING &proxied_host,

const LEX_CSTRING &proxied_user,

bool with_grant,

const char *grantor)

{

DBUG_ENTER("ACL_PROXY_USER::store_pk");

if (store_pk(table, host, user, proxied_host, proxied_user))

DBUG_RETURN(TRUE);

if (store_with_grant(table, with_grant))

DBUG_RETURN(TRUE);

if (table->field[MYSQL_PROXIES_PRIV_GRANTOR]->store(grantor,

strlen(grantor),

system_charset_info))

DBUG_RETURN(TRUE);

DBUG_RETURN(FALSE);

}

int wild_case_compare(CHARSET_INFO *cs, const char *str,const char *wildstr)

{

int flag;

DBUG_ENTER("wild_case_compare");

DBUG_PRINT("enter",("str: '%s' wildstr: '%s'",str,wildstr));

while (*wildstr)

{

while (*wildstr && *wildstr != wild_many && *wildstr != wild_one)

{

if (*wildstr == wild_prefix && wildstr[1])

wildstr++;

if (my_toupper(cs, *wildstr++) !=

my_toupper(cs, *str++)) DBUG_RETURN(1);

}

if (! *wildstr ) DBUG_RETURN (*str != 0);

if (*wildstr++ == wild_one)

{

if (! *str++) DBUG_RETURN (1); /* One char; skip */

}

else

{ /* Found '*' */

if (!*wildstr) DBUG_RETURN(0); /* '*' as last char: OK */

flag=(*wildstr != wild_many && *wildstr != wild_one);

do

{

if (flag)

{

char cmp;

if ((cmp= *wildstr) == wild_prefix && wildstr[1])

cmp=wildstr[1];

cmp=my_toupper(cs, cmp);

while (*str && my_toupper(cs, *str) != cmp)

str++;

if (!*str) DBUG_RETURN (1);

}

if (wild_case_compare(cs, str,wildstr) == 0) DBUG_RETURN (0);

} while (*str++);

DBUG_RETURN(1);

}

}

DBUG_RETURN (*str != '\0');

}

/*

Return a number which, if sorted 'desc', puts strings in this order:

no wildcards

strings containg wildcards and non-wildcard characters

single muilt-wildcard character('%')

empty string

*/

ulong get_sort(uint count,...)

{

va_list args;

va_start(args,count);

ulong sort=0;

/* Should not use this function with more than 4 arguments for compare. */

assert(count <= 4);

while (count--)

{

char *start, *str= va_arg(args,char*);

uint chars= 0;

uint wild_pos= 0;

/*

wild_pos

0 if string is empty

1 if string is a single muilt-wildcard

character('%')

first wildcard position + 1 if string containg wildcards and

non-wildcard characters

*/

if ((start= str))

{

for (; *str ; str++)

{

if (*str == wild_prefix && str[1])

str++;

else if (*str == wild_many || *str == wild_one)

{

wild_pos= (uint) (str - start) + 1;

if (!(wild_pos == 1 && *str == wild_many && *(++str) == '\0'))

wild_pos++;

break;

}

chars= 128; // Marker that chars existed

}

}

sort= (sort << 8) + (wild_pos ? min(wild_pos, 127U) : chars);

}

va_end(args);

return sort;

}

/**

Check if the given host name needs to be resolved or not.

Host name has to be resolved if it actually contains *name*.

For example:

192.168.1.1 --> FALSE

192.168.1.0/255.255.255.0 --> FALSE

% --> FALSE

192.168.1.% --> FALSE

AB% --> FALSE

AAAAFFFF --> TRUE (Hostname)

AAAA:FFFF:1234:5678 --> FALSE

::1 --> FALSE

This function does not check if the given string is a valid host name or

not. It assumes that the argument is a valid host name.

@param hostname the string to check.

@return a flag telling if the argument needs to be resolved or not.

@retval TRUE the argument is a host name and needs to be resolved.

@retval FALSE the argument is either an IP address, or a patter and

should not be resolved.

*/

bool hostname_requires_resolving(const char *hostname)

{

/* called only for --skip-name-resolve */

assert(specialflag & SPECIAL_NO_RESOLVE);

if (!hostname)

return FALSE;

/*

If the string contains any of {':', '%', '_', '/'}, it is definitely

not a host name:

- ':' means that the string is an IPv6 address;

- '%' or '_' means that the string is a pattern;

- '/' means that the string is an IPv4 network address;

*/

for (const char *p= hostname; *p; ++p)

{

switch (*p) {

case ':':

case '%':

case '_':

case '/':

return FALSE;

}

}

/*

Now we have to tell a host name (ab.cd, 12.ab) from an IPv4 address

(12.34.56.78). The assumption is that if the string contains only

digits and dots, it is an IPv4 address. Otherwise -- a host name.

*/

for (const char *p= hostname; *p; ++p)

{

if (*p != '.' && !my_isdigit(&my_charset_latin1, *p))

return TRUE; /* a "letter" has been found. */

}

return FALSE; /* all characters are either dots or digits. */

}

#ifndef NO_EMBEDDED_ACCESS_CHECKS

static uchar* get_key_column(GRANT_COLUMN *buff, size_t *length,

my_bool not_used MY_ATTRIBUTE((unused)))

{

*length=buff->key_length;

return (uchar*) buff->column;

}

uchar* get_grant_table(GRANT_NAME *buff, size_t *length,

my_bool not_used MY_ATTRIBUTE((unused)))

{

*length=buff->key_length;

return (uchar*) buff->hash_key;

}

GRANT_COLUMN::GRANT_COLUMN(String &c, ulong y) :rights (y)

{

column= (char*) memdup_root(&memex,c.ptr(), key_length=c.length());

}

void GRANT_NAME::set_user_details(const char *h, const char *d,

const char *u, const char *t,

bool is_routine)

{

/* Host given by user */

host.update_hostname(strdup_root(&memex, h));

if (db != d)

{

db= strdup_root(&memex, d);

if (lower_case_table_names)

my_casedn_str(files_charset_info, db);

}

user = strdup_root(&memex,u);

sort= get_sort(3,host.get_host(),db,user);

if (tname != t)

{

tname= strdup_root(&memex, t);

if (lower_case_table_names || is_routine)

my_casedn_str(files_charset_info, tname);

}

key_length= strlen(d) + strlen(u)+ strlen(t)+3;

hash_key= (char*) alloc_root(&memex,key_length);

my_stpcpy(my_stpcpy(my_stpcpy(hash_key,user)+1,db)+1,tname);

}

GRANT_NAME::GRANT_NAME(const char *h, const char *d,const char *u,

const char *t, ulong p, bool is_routine)

:db(0), tname(0), privs(p)

{

set_user_details(h, d, u, t, is_routine);

}

GRANT_TABLE::GRANT_TABLE(const char *h, const char *d,const char *u,

const char *t, ulong p, ulong c)

:GRANT_NAME(h,d,u,t,p, FALSE), cols(c)

{

(void) my_hash_init2(&hash_columns,4,system_charset_info,

0,0,0, (my_hash_get_key) get_key_column,0,0,

key_memory_acl_memex);

}

GRANT_NAME::GRANT_NAME(TABLE *form, bool is_routine)

{

host.update_hostname(get_field(&memex, form->field[0]));

db= get_field(&memex,form->field[1]);

user= get_field(&memex,form->field[2]);

if (!user)

user= (char*) "";

sort= get_sort(3, host.get_host(), db, user);

tname= get_field(&memex,form->field[3]);

if (!db || !tname) {

/* Wrong table row; Ignore it */

privs= 0;

return; /* purecov: inspected */

}

if (lower_case_table_names)

{

my_casedn_str(files_charset_info, db);

}

if (lower_case_table_names || is_routine)

{

my_casedn_str(files_charset_info, tname);

}

key_length= (strlen(db) + strlen(user) + strlen(tname) + 3);

hash_key= (char*) alloc_root(&memex, key_length);

my_stpcpy(my_stpcpy(my_stpcpy(hash_key,user)+1,db)+1,tname);

if (form->field[MYSQL_TABLES_PRIV_FIELD_TABLE_PRIV])

{

privs = (ulong) form->field[MYSQL_TABLES_PRIV_FIELD_TABLE_PRIV]->val_int();

privs = fix_rights_for_table(privs);

}

}

GRANT_TABLE::GRANT_TABLE(TABLE *form)

:GRANT_NAME(form, false)

{

if (!db || !tname)

{

/* Wrong table row; Ignore it */

my_hash_clear(&hash_columns); /* allow for destruction */

cols= 0;

return;

}

if (form->field[MYSQL_TABLES_PRIV_FIELD_COLUMN_PRIV])

{

cols= (ulong) form->field[MYSQL_TABLES_PRIV_FIELD_COLUMN_PRIV]->val_int();

cols = fix_rights_for_column(cols);

}

else

cols= 0;

(void) my_hash_init2(&hash_columns,4,system_charset_info,

0,0,0, (my_hash_get_key) get_key_column,0,0,

key_memory_acl_memex);

}

GRANT_TABLE::~GRANT_TABLE()

{

my_hash_free(&hash_columns);

}

bool GRANT_TABLE::init(TABLE *col_privs)

{

int error;

if (cols)

{

uchar key[MAX_KEY_LENGTH];

uint key_prefix_len;

if (!col_privs->key_info)

{

my_error(ER_MISSING_KEY, MYF(0), col_privs->s->db.str,

col_privs->s->table_name.str);

return true;

}

KEY_PART_INFO *key_part= col_privs->key_info->key_part;

col_privs->field[0]->store(host.get_host(),

host.get_host_len(),

system_charset_info);

col_privs->field[1]->store(db, strlen(db), system_charset_info);

col_privs->field[2]->store(user, strlen(user), system_charset_info);

col_privs->field[3]->store(tname, strlen(tname), system_charset_info);

key_prefix_len= (key_part[0].store_length +

key_part[1].store_length +

key_part[2].store_length +

key_part[3].store_length);

key_copy(key, col_privs->record[0], col_privs->key_info, key_prefix_len);

col_privs->field[4]->store("", 0, &my_charset_latin1);

error= col_privs->file->ha_index_init(0, 1);

if (error)

{

acl_print_ha_error(col_privs, error);

return true;

}

error=

col_privs->file->ha_index_read_map(col_privs->record[0], (uchar*) key,

(key_part_map)15, HA_READ_KEY_EXACT);

DBUG_EXECUTE_IF("se_error_grant_table_init_read",

error= HA_ERR_LOCK_WAIT_TIMEOUT;);

if (error)

{

bool ret= false;

cols= 0;

if (error != HA_ERR_KEY_NOT_FOUND && error != HA_ERR_END_OF_FILE)

{

acl_print_ha_error(col_privs, error);

ret= true;

}

col_privs->file->ha_index_end();

return ret;

}

do

{

String *res,column_name;

GRANT_COLUMN *mem_check;

/* As column name is a string, we don't have to supply a buffer */

res= col_privs->field[4]->val_str(&column_name);

ulong priv= (ulong) col_privs->field[6]->val_int();

if (!(mem_check= new GRANT_COLUMN(*res,

fix_rights_for_column(priv))) ||

my_hash_insert(&hash_columns, (uchar *) mem_check))

{

/* Don't use this entry */

col_privs->file->ha_index_end();

return true;

}

error= col_privs->file->ha_index_next(col_privs->record[0]);

DBUG_EXECUTE_IF("se_error_grant_table_init_read_next",

error= HA_ERR_LOCK_WAIT_TIMEOUT;);

if (error && error != HA_ERR_END_OF_FILE)

{

acl_print_ha_error(col_privs, error);

col_privs->file->ha_index_end();

return true;

}

}

while (!error && !key_cmp_if_same(col_privs,key,0,key_prefix_len));

col_privs->file->ha_index_end();

}

return false;

}

/*

Find first entry that matches the current user

*/

ACL_USER *

find_acl_user(const char *host, const char *user, my_bool exact)

{

DBUG_ENTER("find_acl_user");

DBUG_PRINT("enter",("host: '%s' user: '%s'",host,user));

mysql_mutex_assert_owner(&acl_cache->lock);

if (likely(acl_users))

{

for (ACL_USER *acl_user= acl_users->begin();

acl_user != acl_users->end(); ++acl_user)

{

DBUG_PRINT("info",("strcmp('%s','%s'), compare_hostname('%s','%s'),",

user, acl_user->user ? acl_user->user : "",

host,

acl_user->host.get_host()));

if ((!acl_user->user && !user[0]) ||

(acl_user->user && !strcmp(user,acl_user->user)))

{

if (exact ? !my_strcasecmp(system_charset_info, host,

acl_user->host.get_host()) :

acl_user->host.compare_hostname(host,host))

{

DBUG_RETURN(acl_user);

}

}

}

}

DBUG_RETURN(0);

}

/*

Find user in ACL

SYNOPSIS

is_acl_user()

host host name

user user name

RETURN

FALSE user not fond

TRUE there are such user

*/

bool is_acl_user(const char *host, const char *user)

{

bool res;

/* --skip-grants */

if (!initialized)

return TRUE;

mysql_mutex_lock(&acl_cache->lock);

res= find_acl_user(host, user, TRUE) != NULL;

mysql_mutex_unlock(&acl_cache->lock);

return res;

}

/**

Validate if a user can proxy as another user

@thd current thread

@param user the logged in user (proxy user)

@param authenticated_as the effective user a plugin is trying to

impersonate as (proxied user)

@return proxy user definition

@retval NULL proxy user definition not found or not applicable

@retval non-null the proxy user data

*/

ACL_PROXY_USER *

acl_find_proxy_user(const char *user, const char *host, const char *ip,

char *authenticated_as, bool *proxy_used)

{

/* if the proxied and proxy user are the same return OK */

DBUG_ENTER("acl_find_proxy_user");

DBUG_PRINT("info", ("user=%s host=%s ip=%s authenticated_as=%s",

user, host, ip, authenticated_as));

if (!strcmp(authenticated_as, user))

{

DBUG_PRINT ("info", ("user is the same as authenticated_as"));

DBUG_RETURN (NULL);

}

bool find_any = check_proxy_users && !*authenticated_as;

if(!find_any)

*proxy_used= TRUE;

for (ACL_PROXY_USER *proxy= acl_proxy_users->begin();

proxy != acl_proxy_users->end(); ++proxy)

{

if (proxy->matches(host, user, ip, authenticated_as, find_any))

{

DBUG_PRINT("info", ("proxy matched=%s@%s",

proxy->get_proxied_user(),

proxy->get_proxied_host()));

if (!find_any)

{

DBUG_PRINT("info", ("returning specific match as authenticated_as was specified"));

*proxy_used = TRUE;

DBUG_RETURN(proxy);

}

else

{

// we never use anonymous users when mapping

// proxy users for internal plugins:

if (strcmp(proxy->get_proxied_user() ?

proxy->get_proxied_user() : "", ""))

{

if (find_acl_user(

proxy->get_proxied_host(),

proxy->get_proxied_user(),

TRUE))

{

DBUG_PRINT("info", ("setting proxy_used to true, as \

find_all search matched real user=%s host=%s",

proxy->get_proxied_user(),

proxy->get_proxied_host()));

*proxy_used = TRUE;

strcpy(authenticated_as, proxy->get_proxied_user());

}

else

{

DBUG_PRINT("info", ("skipping match because ACL user \

does not exist, looking for next match to map"));

}

if (*proxy_used)

{

DBUG_PRINT("info", ("returning matching user"));

DBUG_RETURN(proxy);

}

}

}

}

}

DBUG_PRINT("info", ("No matching users found, returning null"));

DBUG_RETURN(NULL);

}

static uchar* acl_entry_get_key(acl_entry *entry, size_t *length,

my_bool not_used MY_ATTRIBUTE((unused)))

{

*length=(uint) entry->length;

return (uchar*) entry->key;

}

static uchar* check_get_key(ACL_USER *buff, size_t *length,

my_bool not_used MY_ATTRIBUTE((unused)))

{

*length=buff->host.get_host_len();

return (uchar*) buff->host.get_host();

}

/*

Get privilege for a host, user and db combination

as db_is_pattern changes the semantics of comparison,

acl_cache is not used if db_is_pattern is set.

*/

ulong acl_get(const char *host, const char *ip,

const char *user, const char *db, my_bool db_is_pattern)

{

ulong host_access= ~(ulong)0, db_access= 0;

size_t key_length, copy_length;

char key[ACL_KEY_LENGTH],*tmp_db,*end;

acl_entry *entry;

DBUG_ENTER("acl_get");

copy_length= (strlen(ip ? ip : "") +

strlen(user ? user : "") +

strlen(db ? db : "")) + 2; /* Added 2 at the end to avoid

buffer overflow at strmov()*/