1
/* Copyright (C) 2007 MySQL AB
3
This program is free software; you can redistribute it and/or modify
4
it under the terms of the GNU General Public License as published by
5
the Free Software Foundation; version 2 of the License.
7
This program is distributed in the hope that it will be useful,
8
but WITHOUT ANY WARRANTY; without even the implied warranty of
9
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
GNU General Public License for more details.
12
You should have received a copy of the GNU General Public License
13
along with this program; if not, write to the Free Software
14
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */
1
/* -*- mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; -*-
2
* vim:expandtab:shiftwidth=2:tabstop=2:smarttab:
4
* Copyright (C) 2008 Sun Microsystems
6
* This program is free software; you can redistribute it and/or modify
7
* it under the terms of the GNU General Public License as published by
8
* the Free Software Foundation; version 2 of the License.
10
* This program is distributed in the hope that it will be useful,
11
* but WITHOUT ANY WARRANTY; without even the implied warranty of
12
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
* GNU General Public License for more details.
15
* You should have received a copy of the GNU General Public License
16
* along with this program; if not, write to the Free Software
17
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
18
22
Functions to autenticate and handle reqests for a connection
20
24
#include <drizzled/server_includes.h>
21
27
#include <drizzled/authentication.h>
22
#include <drizzled/drizzled_error_messages.h>
28
#include <drizzled/db.h>
29
#include <drizzled/error.h>
30
#include <drizzled/sql_parse.h>
31
#include <drizzled/scheduler.h>
32
#include <drizzled/session.h>
34
extern scheduler_functions thread_scheduler;
24
36
#define MIN_HANDSHAKE_SIZE 6
79
check_user(THD *thd, enum enum_server_command command,
81
uint passwd_len, const char *db,
91
check_user(Session *session, const char *passwd,
92
uint32_t passwd_len, const char *db,
84
95
LEX_STRING db_str= { (char *) db, db ? strlen(db) : 0 };
85
96
bool is_authenticated;
88
Clear thd->db as it points to something, that will be freed when
99
Clear session->db as it points to something, that will be freed when
89
100
connection is closed. We don't want to accidentally free a wrong
90
101
pointer if connect failed. Also in case of 'CHANGE USER' failure,
91
102
current database will be switched to 'no database selected'.
93
thd->reset_db(NULL, 0);
104
session->reset_db(NULL, 0);
95
106
if (passwd_len != 0 && passwd_len != SCRAMBLE_LENGTH)
97
my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.ip);
108
my_error(ER_HANDSHAKE_ERROR, MYF(0), session->security_ctx.ip.c_str());
101
is_authenticated= authenticate_user(thd, passwd);
112
is_authenticated= authenticate_user(session, passwd);
103
114
if (is_authenticated != true)
105
116
my_error(ER_ACCESS_DENIED_ERROR, MYF(0),
106
thd->main_security_ctx.user,
107
thd->main_security_ctx.ip,
117
session->security_ctx.user.c_str(),
118
session->security_ctx.ip.c_str(),
108
119
passwd_len ? ER(ER_YES) : ER(ER_NO));
115
thd->security_ctx->skip_grants();
116
memset(&ur, 0, sizeof(USER_RESOURCES));
125
session->security_ctx.skip_grants();
120
129
pthread_mutex_lock(&LOCK_connection_count);
121
130
bool count_ok= connection_count <= max_connections;
122
VOID(pthread_mutex_unlock(&LOCK_connection_count));
131
pthread_mutex_unlock(&LOCK_connection_count);
125
134
{ // too many connections
132
Log the command before authentication checks, so that the user can
133
check the log for the tried login tried and also to detect
136
general_log_print(thd, command,
137
((char*) "%s@%s on %s"),
138
thd->main_security_ctx.user,
139
thd->main_security_ctx.ip,
140
db ? db : (char*) "");
142
140
/* Change database if necessary */
145
if (mysql_change_db(thd, &db_str, false))
143
if (mysql_change_db(session, &db_str, false))
147
145
/* mysql_change_db() has pushed the error message. */
152
thd->password= test(passwd_len); // remember for error messages
150
session->password= test(passwd_len); // remember for error messages
153
151
/* Ready to handle queries */
160
158
started with corresponding variable that is greater then 0.
163
extern "C" uchar *get_key_conn(user_conn *buff, size_t *length,
161
extern "C" unsigned char *get_key_conn(user_conn *buff, size_t *length,
164
162
bool not_used __attribute__((unused)))
166
164
*length= buff->len;
167
return (uchar*) buff->user;
165
return (unsigned char*) buff->user;
171
169
extern "C" void free_user(struct user_conn *uc)
173
my_free((char*) uc,MYF(0));
176
void thd_init_client_charset(THD *thd, uint cs_number)
179
Use server character set and collation if
180
- opt_character_set_client_handshake is not set
181
- client has not specified a character set
182
- client character set is the same as the servers
183
- client character set doesn't exists in server
185
if (!opt_character_set_client_handshake ||
186
!(thd->variables.character_set_client= get_charset(cs_number, MYF(0))) ||
187
!my_strcasecmp(&my_charset_latin1,
188
global_system_variables.character_set_client->name,
189
thd->variables.character_set_client->name))
191
thd->variables.character_set_client=
192
global_system_variables.character_set_client;
193
thd->variables.collation_connection=
194
global_system_variables.collation_connection;
195
thd->variables.character_set_results=
196
global_system_variables.character_set_results;
200
thd->variables.character_set_results=
201
thd->variables.collation_connection=
202
thd->variables.character_set_client;
208
175
Initialize connection threads
221
Perform handshake, authorize client and update thd ACL variables.
188
Perform handshake, authorize client and update session ACL variables.
224
191
check_connection()
192
session thread handle
228
0 success, OK is sent to user, thd is updated.
195
0 success, OK is sent to user, session is updated.
229
196
-1 error, which is sent to user
230
197
> 0 error code (not sent to user)
233
static int check_connection(THD *thd)
200
static int check_connection(Session *session)
202
NET *net= &session->net;
236
203
uint32_t pkt_len= 0;
239
#ifdef SIGNAL_WITH_VIO_CLOSE
240
thd->set_active_vio(net->vio);
243
206
// TCP/IP connection
245
208
char ip[NI_MAXHOST];
247
if (vio_peer_addr(net->vio, ip, &thd->peer_port, NI_MAXHOST))
210
if (net_peer_addr(net, ip, &session->peer_port, NI_MAXHOST))
249
my_error(ER_BAD_HOST_ERROR, MYF(0), thd->main_security_ctx.ip);
212
my_error(ER_BAD_HOST_ERROR, MYF(0), session->security_ctx.ip.c_str());
252
if (!(thd->main_security_ctx.ip= my_strdup(ip,MYF(MY_WME))))
253
return 1; /* The error is set by my_strdup(). */
216
session->security_ctx.ip.assign(ip);
255
vio_keepalive(net->vio, true);
218
net_keepalive(net, true);
257
220
uint32_t server_capabilites;
259
222
/* buff[] needs to big enough to hold the server_version variable */
266
229
server_capabilites|= CLIENT_COMPRESS;
267
230
#endif /* HAVE_COMPRESS */
269
end= stpncpy(buff, server_version, SERVER_VERSION_LENGTH) + 1;
270
int4store((uchar*) end, thd->thread_id);
232
end= buff + strlen(server_version);
233
if ((end - buff) >= SERVER_VERSION_LENGTH)
234
end= buff + (SERVER_VERSION_LENGTH - 1);
235
memcpy(buff, server_version, end - buff);
239
int4store((unsigned char*) end, session->thread_id);
273
242
So as check_connection is the only entry point to authorization
274
243
procedure, scramble is set here. This gives us new scramble for
277
create_random_string(thd->scramble, SCRAMBLE_LENGTH, &thd->rand);
246
create_random_string(session->scramble, SCRAMBLE_LENGTH, &session->rand);
279
248
Old clients does not understand long scrambles, but can ignore packet
280
249
tail: that's why first part of the scramble is placed here, and second
281
250
part at the end of packet.
283
end= strmake(end, thd->scramble, SCRAMBLE_LENGTH_323) + 1;
252
end= strncpy(end, session->scramble, SCRAMBLE_LENGTH_323);
253
end+= SCRAMBLE_LENGTH_323 + 1;
285
255
int2store(end, server_capabilites);
286
256
/* write server characteristics: up to 16 bytes allowed */
287
257
end[2]=(char) default_charset_info->number;
288
int2store(end+3, thd->server_status);
258
int2store(end+3, session->server_status);
289
259
memset(end+5, 0, 13);
291
261
/* write scramble tail */
292
end= strmake(end, thd->scramble + SCRAMBLE_LENGTH_323,
293
SCRAMBLE_LENGTH - SCRAMBLE_LENGTH_323) + 1;
262
size_t scramble_len= SCRAMBLE_LENGTH - SCRAMBLE_LENGTH_323;
263
end= strncpy(end, session->scramble + SCRAMBLE_LENGTH_323, scramble_len);
264
end+= scramble_len + 1;
295
266
/* At this point we write connection message and read reply */
296
if (net_write_command(net, (uchar) protocol_version, (uchar*) "", 0,
297
(uchar*) buff, (size_t) (end-buff)) ||
267
if (net_write_command(net, (unsigned char) protocol_version, (unsigned char*) "", 0,
268
(unsigned char*) buff, (size_t) (end-buff)) ||
298
269
(pkt_len= my_net_read(net)) == packet_error ||
299
270
pkt_len < MIN_HANDSHAKE_SIZE)
301
272
my_error(ER_HANDSHAKE_ERROR, MYF(0),
302
thd->main_security_ctx.ip);
273
session->security_ctx.ip.c_str());
306
if (thd->packet.alloc(thd->variables.net_buffer_length))
277
if (session->packet.alloc(session->variables.net_buffer_length))
307
278
return 1; /* The error is set by alloc(). */
309
thd->client_capabilities= uint2korr(net->read_pos);
312
thd->client_capabilities|= ((uint32_t) uint2korr(net->read_pos+2)) << 16;
313
thd->max_client_packet_length= uint4korr(net->read_pos+4);
314
thd_init_client_charset(thd, (uint) net->read_pos[8]);
315
thd->update_charset();
280
session->client_capabilities= uint2korr(net->read_pos);
283
session->client_capabilities|= ((uint32_t) uint2korr(net->read_pos+2)) << 16;
284
session->max_client_packet_length= uint4korr(net->read_pos+4);
285
session->update_charset();
316
286
end= (char*) net->read_pos+32;
319
289
Disable those bits which are not supported by the server.
320
290
This is a precautionary measure, if the client lies. See Bug#27944.
322
thd->client_capabilities&= server_capabilites;
324
if (thd->client_capabilities & CLIENT_IGNORE_SPACE)
325
thd->variables.sql_mode|= MODE_IGNORE_SPACE;
292
session->client_capabilities&= server_capabilites;
327
294
if (end >= (char*) net->read_pos+ pkt_len +2)
330
my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.ip);
297
my_error(ER_HANDSHAKE_ERROR, MYF(0), session->security_ctx.ip.c_str());
334
if (thd->client_capabilities & CLIENT_INTERACTIVE)
335
thd->variables.net_wait_timeout= thd->variables.net_interactive_timeout;
336
if ((thd->client_capabilities & CLIENT_TRANSACTIONS) &&
301
if (session->client_capabilities & CLIENT_INTERACTIVE)
302
session->variables.net_wait_timeout= session->variables.net_interactive_timeout;
303
if ((session->client_capabilities & CLIENT_TRANSACTIONS) &&
337
304
opt_using_transactions)
338
net->return_status= &thd->server_status;
305
net->return_status= &session->server_status;
341
char *passwd= strend(user)+1;
342
uint user_len= passwd - user - 1;
308
char *passwd= strchr(user, '\0')+1;
309
uint32_t user_len= passwd - user - 1;
343
310
char *db= passwd;
344
311
char db_buff[NAME_LEN + 1]; // buffer to store db in utf8
345
312
char user_buff[USERNAME_LENGTH + 1]; // buffer to store user in utf8
313
uint32_t dummy_errors;
349
316
Old clients send null-terminated string as password; new clients send
355
322
Cast *passwd to an unsigned char, so that it doesn't extend the sign for
356
323
*passwd > 127 and become 2**32-127+ after casting to uint.
358
uint passwd_len= thd->client_capabilities & CLIENT_SECURE_CONNECTION ?
359
(uchar)(*passwd++) : strlen(passwd);
360
db= thd->client_capabilities & CLIENT_CONNECT_WITH_DB ?
325
uint32_t passwd_len= session->client_capabilities & CLIENT_SECURE_CONNECTION ?
326
(unsigned char)(*passwd++) : strlen(passwd);
327
db= session->client_capabilities & CLIENT_CONNECT_WITH_DB ?
361
328
db + passwd_len + 1 : 0;
362
329
/* strlen() can't be easily deleted without changing protocol */
363
uint db_len= db ? strlen(db) : 0;
330
uint32_t db_len= db ? strlen(db) : 0;
365
332
if (passwd + passwd_len + db_len > (char *)net->read_pos + pkt_len)
367
my_error(ER_HANDSHAKE_ERROR, MYF(0), thd->main_security_ctx.ip);
334
my_error(ER_HANDSHAKE_ERROR, MYF(0), session->security_ctx.ip.c_str());
474
439
This mainly updates status variables
477
void end_connection(THD *thd)
442
void end_connection(Session *session)
480
plugin_thdvar_cleanup(thd);
444
NET *net= &session->net;
445
plugin_sessionvar_cleanup(session);
482
if (thd->killed || (net->error && net->vio != 0))
447
if (session->killed || (net->error && net->vio != 0))
484
449
statistic_increment(aborted_threads,&LOCK_status);
487
452
if (net->error && net->vio != 0)
489
if (!thd->killed && thd->variables.log_warnings > 1)
454
if (!session->killed && session->variables.log_warnings > 1)
491
Security_context *sctx= thd->security_ctx;
456
Security_context *sctx= &session->security_ctx;
493
sql_print_warning(ER(ER_NEW_ABORTING_CONNECTION),
494
thd->thread_id,(thd->db ? thd->db : "unconnected"),
495
sctx->user ? sctx->user : "unauthenticated",
497
(thd->main_da.is_error() ? thd->main_da.message() :
458
errmsg_printf(ERRMSG_LVL_WARN, ER(ER_NEW_ABORTING_CONNECTION),
459
session->thread_id,(session->db ? session->db : "unconnected"),
460
sctx->user.empty() == false ? sctx->user.c_str() : "unauthenticated",
462
(session->main_da.is_error() ? session->main_da.message() :
498
463
ER(ER_UNKNOWN_ERROR)));
505
Initialize THD to handle queries
470
Initialize Session to handle queries
508
void prepare_new_connection_state(THD* thd)
473
void prepare_new_connection_state(Session* session)
510
Security_context *sctx= thd->security_ctx;
475
Security_context *sctx= &session->security_ctx;
512
if (thd->variables.max_join_size == HA_POS_ERROR)
513
thd->options |= OPTION_BIG_SELECTS;
514
if (thd->client_capabilities & CLIENT_COMPRESS)
515
thd->net.compress=1; // Use compression
477
if (session->variables.max_join_size == HA_POS_ERROR)
478
session->options |= OPTION_BIG_SELECTS;
479
if (session->client_capabilities & CLIENT_COMPRESS)
480
session->net.compress=1; // Use compression
518
Much of this is duplicated in create_embedded_thd() for the
483
Much of this is duplicated in create_embedded_session() for the
519
484
embedded server library.
520
485
TODO: refactor this to avoid code duplication there
522
thd->version= refresh_version;
524
thd->command= COM_SLEEP;
526
thd->init_for_queries();
487
session->version= refresh_version;
488
session->set_proc_info(0);
489
session->command= COM_SLEEP;
491
session->init_for_queries();
528
493
/* In the past this would only run of the user did not have SUPER_ACL */
529
494
if (sys_init_connect.value_length)
531
execute_init_command(thd, &sys_init_connect, &LOCK_sys_init_connect);
496
execute_init_command(session, &sys_init_connect, &LOCK_sys_init_connect);
497
if (session->is_error())
534
thd->killed= THD::KILL_CONNECTION;
535
sql_print_warning(ER(ER_NEW_ABORTING_CONNECTION),
536
thd->thread_id,(thd->db ? thd->db : "unconnected"),
537
sctx->user ? sctx->user : "unauthenticated",
538
sctx->ip, "init_connect command failed");
539
sql_print_warning("%s", thd->main_da.message());
499
session->killed= Session::KILL_CONNECTION;
500
errmsg_printf(ERRMSG_LVL_WARN, ER(ER_NEW_ABORTING_CONNECTION),
501
session->thread_id,(session->db ? session->db : "unconnected"),
502
sctx->user.empty() == false ? sctx->user.c_str() : "unauthenticated",
503
sctx->ip.c_str(), "init_connect command failed");
504
errmsg_printf(ERRMSG_LVL_WARN, "%s", session->main_da.message());
543
thd->init_for_queries();
506
session->set_proc_info(0);
508
session->init_for_queries();
582
547
handle_one_connection() is normally the only way a thread would
583
548
start and would always be on the very high end of the stack ,
584
549
therefore, the thread stack always starts at the address of the
585
first local variable of handle_one_connection, which is thd. We
550
first local variable of handle_one_connection, which is session. We
586
551
need to know the start of the stack so that we could check for
589
thd->thread_stack= (char*) &thd;
590
if (setup_connection_thread_globals(thd))
554
session->thread_stack= (char*) &session;
555
if (setup_connection_thread_globals(session))
560
NET *net= &session->net;
597
if (login_connection(thd))
562
if (login_connection(session))
600
prepare_new_connection_state(thd);
565
prepare_new_connection_state(session);
602
567
while (!net->error && net->vio != 0 &&
603
!(thd->killed == THD::KILL_CONNECTION))
568
!(session->killed == Session::KILL_CONNECTION))
570
if (do_command(session))
573
end_connection(session);
611
close_connection(thd, 0, 1);
612
if (thread_scheduler.end_thread(thd,1))
576
session->close_connection(NULL, true);
577
if (thread_scheduler.end_thread(session, 1))
613
578
return 0; // Probably no-threads