summaryrefslogtreecommitdiff
path: root/mysql-test/suite/roles
Commit message (Collapse)AuthorAgeFilesLines
* MDEV-17964: Assertion `status == 0' failed in add_role_user_mapping_actionVicențiu Ciorbaru2021-10-152-0/+297
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This happens upon CREATE USER and DROP ROLE. The underlying problem is that our HASH implementation shuffles elements around when performing an update or delete. This means that when doing a scan through the HASH table by index, in search of elements to delete or update one must restart the scan to make sure nothing is missed if at least one delete / update happened. More specifically, what happened in this case: The hash has 131 element, DROP ROLE removes the element [119]. Its [119]->next was element [129], so [129] is moved to [119]. Now we need to compact the hash, removing the last element [130]. It gets one bit off its hash value and becomes element [2]. The existing element [2] is moved to [129], and old [130] is moved to [2]. We cannot simply move [130] to [129] and make [2]->next=130, it won't work if [2] is itself in the collision list and doesn't belong in [2]. The handle_grant_struct code assumed that it is safe to continue by only reexamining the currently modified / deleted element index, but that is not true. Missing to delete an element in the hash triggered the assertion in the test case. DROP ROLE would not clear all necessary role->role or role->user mappings. To fix the problem we ensure that the scan is restarted, only if an element was deleted / updated, similar to how bubble-sort keeps sorting until it finds no more elements to swap.
* MDEV-26080: SHOW GRANTS does not quote role names properly for DEFAULT ROLEAnel Husakovic2021-07-0933-307/+307
| | | | | | | - Used single quotes, back quotes are used with commit fafb35ee517f309d9e507f6e3908caca5d8cd257 in 10.3 and will be changed. Reviewed by: serg@mariadb.org
* MDEV-26081 set role crashes when a hostname cannot be resolvedSergei Golubchik2021-07-023-6/+6
| | | | host can be NULL
* MDEV-24289: show grants missing with grant optionAnel Husakovic2020-11-262-0/+28
| | | | Reviewed by:serg@mariadb.com
* MDEV-22313: Neither SHOW CREATE USER nor SHOW GRANTS prints a user's default ↵Anel Husakovic2020-10-244-0/+8
| | | | | | role Reviewed-by: serg@mariadb.com
* MDEV-23511 shutdown_server 10 times out, causing server kill at shutdownAndrei Elkin2020-08-211-1/+1
| | | | | | | | | | | Shutdown of mtr tests may be too impatient, esp on CI environment where 10 seconds of `arg` of `shutdown_server arg` may not be enough for the clean shutdown to complete. This is fixed to remove explicit non-zero timeout argument to `shutdown_server` from all mtr tests. mysqltest computes 60 seconds default value for the timeout for the argless `shutdown_server` command. This policy is additionally ensured with a compile time assert.
* Merge branch '10.1' into 10.2Oleksandr Byelkin2020-08-022-0/+14
|\
| * improve the error message for a dropped current roleSergei Golubchik2020-07-302-2/+2
| |
| * MDEV-22521 Server crashes in traverse_role_graph_up or Assertion `user' ↵Sergei Golubchik2020-07-302-0/+14
| | | | | | | | fails in traverse_role_graph_impl
* | Merge 10.1 into 10.2Marko Mäkelä2020-06-014-3/+197
|\ \ | |/
| * MDEV-22312: Bad error message for SET DEFAULT ROLE when user account is not ↵Anel Husakovic2020-05-284-3/+197
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | granted the role - `SET DEFAULT ROLE xxx [FOR yyy]` should say: "User yyy has not been granted a role xxx" if: - The current user (not the user `yyy` in the FOR clause) can see the role xxx. It can see the role if: * role exists in `mysql.roles_mappings` (traverse the graph), * If the current user has read access on `mysql.user` table - in that case, it can see all roles, granted or not. - Otherwise it should be "Invalid role specification". In other words, it should not be possible to use `SET DEFAULT ROLE` to discover whether a specific role exist or not.
* | Updated mtr files to support different compiled in optionsMonty2019-09-013-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows one to run the test suite even if any of the following options are changed: - character-set-server - collation-server - join-cache-level - log-basename - max-allowed-packet - optimizer-switch - query-cache-size and query-cache-type - skip-name-resolve - table-definition-cache - table-open-cache - Some innodb options etc Changes: - Don't print out the value of system variables as one can't depend on them to being constants. - Don't set global variables to 'default' as the default may not be the same as the test was started with if there was an additional option file. Instead save original value and reset it at end of test. - Test that depends on the latin1 character set should include default_charset.inc or set the character set to latin1 - Test that depends on the original optimizer switch, should include default_optimizer_switch.inc - Test that depends on the value of a specific system variable should set it in the test (like optimizer_use_condition_selectivity) - Split subselect3.test into subselect3.test and subselect3.inc to make it easier to set and reset system variables. - Added .opt files for test that required specfic options that could be changed by external configuration files. - Fixed result files in rockdsb & tokudb that had not been updated for a while.
* | Merge 10.1 into 10.2Marko Mäkelä2019-04-032-0/+52
|\ \ | |/
| * MDEV-18298 Crashes server with segfault during role grantsSergei Golubchik2019-04-022-0/+52
| | | | | | | | | | it was supposed to be `*(p-1)` not `*p-1` (the crash happens if `*p==0`)
* | After-merge fixMarko Mäkelä2018-12-072-2/+2
| |
* | Merge 10.1 into 10.2Marko Mäkelä2018-12-072-0/+24
|\ \ | |/
| * Merge branch '10.0' into 10.1Sergei Golubchik2018-12-062-0/+24
| |\
| | * MDEV-17898 FLUSH PRIVILEGES crashes server with segfaultSergei Golubchik2018-12-062-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | merge_role_db_privileges() was remembering pointers into Dynamic_array acl_dbs, and later was using them, while pushing more elements into the array. But pushing can cause realloc, and it can invalidate all pointers. Fix: remember and use indexes of elements, not pointers.
* | | fix mtr warnings after 5f0510225aaSergei Golubchik2018-06-244-0/+6
| | |
* | | Fixed failing test acl_load_mutex-5170Monty2018-06-192-0/+2
| | | | | | | | | | | | | | | Added flush tables to ensure that MyISAM tables are properly flushed before reboot
* | | Merge remote-tracking branch 'origin/10.1' into 10.2Vicențiu Ciorbaru2017-12-224-0/+1023
|\ \ \ | |/ /
| * | Merge branch '10.0' into 10.1Vicențiu Ciorbaru2017-12-204-0/+1017
| |\ \ | | |/
| | * MDEV-12366: FLUSH PRIVILEGES can break hierarchy of rolesVicențiu Ciorbaru2017-12-192-0/+918
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Whenever we call merge_role_privileges on a role, we make use of the role->counter variable to check if all it's children have had their privileges merged. Only if all children have had their privileges merged, do we update the privileges on parent. This is done to prevent extra work. The same idea is employed during flush privileges. You only begin merging from "leaf" roles. The recursive calls will merge their parents at some point. A problem arises when we try to "re-merge" a parent. Take the following graph: {noformat} A (0) ---- C (2) ---- D (2) ---- USER / / B (0) ----/ / / E (0) --------------/ {noformat} In parentheses we have the "counter" value right before we start to iterate through the roles hash and propagate values. It represents the number of roles granted to the current role. The order in which we iterate through the roles hash is alphabetical. * First merge A, which leads to decreasing the counter for C to 1. Since C is not 0, we don't proceed with merging into C. * Second we merge B, which leads to decreasing the counter for C to 0. Now we proceed with merging into C. This leads to reducing the counter for D to 1 as part of C merge process. * Third as we iterate through the hash, we see that C has counter 0, thus we start the merge process *again*. This leads to reducing the counter for D to 0! We then attempt to merge D. * Fourth we start merging E. When E sees D as it's parent (according to the code) it attempts to reduce D's counter, which leads to overflow. Now D's counter is a very large number, thus E's privileges are not forwarded to D yet. To correct this behavior we must make sure to only start merging from initial leaf nodes.
| | * MDEV-13655: Set role does not properly grant privileges.Vicențiu Ciorbaru2017-12-192-0/+99
| | | | | | | | | | | | | | | | | | | | | | | | When granting a role to another role, DB privileges get propagated. If the grantee had no previous DB privileges, an extra ACL_DB entry is created to house those "indirectly received" privileges. If, afterwards, DB privileges are granted to the grantee directly, we must make sure to not create a duplicate ACL_DB entry.
* | | Merge branch '10.1' into 10.2Sergei Golubchik2017-10-242-0/+241
|\ \ \ | |/ /
| * | Merge branch '10.0' into 10.1Sergei Golubchik2017-10-222-0/+236
| |\ \ | | |/
| | * MDEV-13676: Field "create Procedure" is NULL, even if the the user has role ↵Vicențiu Ciorbaru2017-10-112-0/+236
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | which is the definer. (SHOW CREATE PROCEDURE) During show create procedure we ommited to check the current role, if it is the actual definer of the procedure. In addition, we should support indirectly granted roles to the current role. Implemented a recursive lookup to search the tree of grants if the rolename is present. SQL Standard 2016, Part 5 Section 53 View I_S.ROUTINES selects ROUTINE_BODY and its WHERE clause says that the GRANTEE must be either PUBLIC, or CURRENT_USER or in the ENABLED_ROLES.
* | | Merge branch '10.1' into 10.2Sergei Golubchik2017-09-221-1/+1
|\ \ \ | |/ / | | | | | | | | | But without f4f48e06215..f8a800bec81 - fixes for MDEV-12672 and related issues. 10.2 specific fix follows...
| * | Merge branch '10.0' into 10.1Sergei Golubchik2017-09-211-1/+1
| |\ \ | | |/
| | * include/master-slave.inc must always be included lastSergei Golubchik2017-09-201-1/+1
| | |
* | | Merge branch '10.1' into 10.2Sergei Golubchik2017-07-054-0/+329
|\ \ \ | |/ /
| * | Merge remote-tracking branch '10.0' into 10.1Vicențiu Ciorbaru2017-06-214-0/+325
| |\ \ | | |/
| | * MDEV-12666: CURRENT_ROLE() and DATABASE() does not work in a viewVicențiu Ciorbaru2017-06-152-0/+205
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The problem lies in how CURRENT_ROLE is defined. The Item_func_current_role inherits from Item_func_sysconst, which defines a safe_charset_converter to be a const_charset_converter. During view creation, if there is no role previously set, the current_role() function returns NULL. This is captured on item instantiation and the const_charset_converter call subsequently returns an Item_null. In turn, the function is replaced with Item_null and the view is then created with an Item_null instead of Item_func_current_role. Without this patch, the first SHOW CREATE VIEW from the testcase would have a where clause of WHERE role_name = NULL, while the second SHOW CREATE VIEW would show a correctly created view. The same applies for the DATABASE function, as it can change as well. There is an additional problem with CURRENT_ROLE() when used in a prepared statement. During prepared statement creation we used to set the string_value of the function to the current role as well as the null_value flag. During execution, if CURRENT_ROLE was not null, the null_value flag was never set to not-null during fix_fields. Item_func_current_user however can never be NULL so it did not show this problem in a view before. At the same time, the CURRENT_USER() can not be changed between prepared statement execution and creation so the implementation where the value is stored during fix_fields is sufficient. Note also that DATABASE() function behaves differently during prepared statements. See bug 25843 for details or commit 7e0ad09edff587dadc3e9855fc81e1b7de8f2199
| | * MDEV-10463: Granted as a whole to roles, databases are not show in SHOW ↵Vicențiu Ciorbaru2017-06-152-0/+120
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | DATABASES The problem lies in not checking role privileges as well during SHOW DATABASES command. This problem is also apparent for SHOW CREATE DATABASE command. Other SHOW COMMANDS make use of check_access, which in turn makes use of acl_get for both priv_user and priv_role parts, which allows them to function correctly.
* | | MDEV-7635: Update tests to adapt to the new default sql_modeNirbhay Choubey2017-02-106-37/+37
| | |
* | | Merge branch '10.1' into 10.2Sergei Golubchik2016-12-294-0/+142
|\ \ \ | |/ /
| * | Merge branch '10.0' into 10.1Sergei Golubchik2016-12-114-0/+140
| |\ \ | | |/
| | * MDEV-11533: Roles with trailing white spaces are not cleared correctlyVicențiu Ciorbaru2016-12-102-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Role names with trailing whitespaces are truncated in length as of 956e92d90873532fee95581c702f7b76643969ea to fix MDEV-8609. The problem is that the code that creates role mappings expects the string to be null terminated. Add the null terminator to account for that as well. In the future the rest of the code can be cleaned up to never assume c style strings but only LEX_STRINGS.
| | * MDEV-10744: Roles are not fully case sensitiveVicențiu Ciorbaru2016-12-012-0/+112
| | | | | | | | | | | | | | | | | | | | | Due to the collation used on the roles_mapping_hash, key comparison would work in a case-insensitive manner. This is incorrect from the roles mapping perspective. Make use of a case-sensitive collation for that hash, the same one used for the acl_roles hash.
* | | Item::print(): remove redundant parenthesesSergei Golubchik2016-12-121-11/+11
| | | | | | | | | | | | | | | by introducing new Item::precedence() method and using it to decide whether parentheses are required
* | | Remove end . from error messages to get them consistentMonty2016-10-0513-39/+39
| | | | | | | | | | | | Fixed a few failing tests
* | | MDEV-6112 multiple triggers per tableMonty2016-10-052-8/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is similar to MysQL Worklog 3253, but with a different implementation. The disk format and SQL syntax is identical with MySQL 5.7. Fetures supported: - "Any" ammount of any trigger - Supports FOLLOWS and PRECEDES to be able to put triggers in a certain execution order. Implementation details: - Class Trigger added to hold information about a trigger. Before this trigger information was stored in a set of lists in Table_triggers_list and in Table_triggers_list::bodies - Each Trigger has a next field that poinst to the next Trigger with the same action and time. - When accessing a trigger, we now always access all linked triggers - The list are now only used to load and save trigger files. - MySQL trigger test case (trigger_wl3253) added and we execute these identically. - Even more gracefully handling of wrong trigger files than before. This is useful if a trigger file uses functions or syntax not provided by the server. - Each trigger now has a "Created" field that shows when the trigger was created, with 2 decimals. Other comments: - Many of the changes in test files was done because of the new "Created" field in the trigger file. This shows up in SHOW ... TRIGGER and when using information_schema.trigger. - Don't check if all memory is released if on uses --gdb; This is needed to be able to get a list from safemalloc of not freed memory while debugging. - Added option to trim_whitespace() to know how many prefix characters was skipped. - Changed a few ulonglong sql_mode to sql_mode_t, to find some wrong usage of sql_mode.
* | | fix: CURRENT_ROLE() inside SECURITY DEFINER viewsSergei Golubchik2016-08-272-11/+12
| | |
* | | Post-merge: Update test resultsNirbhay Choubey2016-06-302-13/+2
| | |
* | | Merge branch '10.1' into 10.2Sergei Golubchik2016-06-306-0/+235
|\ \ \ | |/ /
| * | Merge branch '10.0' into 10.1Sergei Golubchik2016-06-284-0/+211
| |\ \ | | |/
| | * MDEV-8638: REVOKE ALL PRIVILEGES, GRANT OPTION FROM CURRENT_ROLE breaks ↵Vicențiu Ciorbaru2016-06-222-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | replication Fix the replication failure caused by incorect initialization of THD::invoker_host && THD::invoker_user. Breakdown of the failure is this: Query_log_event::host and Query_log_event::user can have their LEX_STRING's set to length 0, but the actual str member points to garbage. Code afterwards copies Query_log_event::host and user to THD::invoker_host and THD::invoker_user. Calling code for these members expects both members to be initialized. Eg. the str member be a NULL terminated string and length have appropriate size.
| | * [MDEV-9614] Roles and Users longer than 6 charactersIgor Pashev2016-06-222-0/+178
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The bug is apparent when the username is longer than the rolename. It is caused by a simple typo that caused a memcmp call to compare a different number of bytes than necessary. The fix was proposed by Igor Pashev. I have reviewed it and it is the correct approach. Test case introduced by me, using the details provided in the MDEV. Signed-off-by: Vicențiu Ciorbaru <vicentiu@mariadb.org>
| * | MDEV-9898 SET ROLE NONE can crash mysqld.Alexey Botchkov2016-05-022-0/+24
| | | | | | | | | | | | | | | | | | | | | The check_user_can_set_role() used find_user_exact() to get the permissions for the SET ROLE NONE command. Which returned NULL too often, for instance when user authenticated as 'user'@'%'. Now we use find_user_wild() instead.
* | | MDEV-6720 - enable connection log in mysqltest by defaultSergey Vojtovich2016-03-3122-7/+130
|/ /
View Lorry Controller Status