The world's most popular open source database

MySQL 5.1: mysql/src/5.1-dbg/sql/sql_acl.h Source File
mysql/src/5.1-dbg/sql/sql_acl.h

00001 /* Copyright (C) 2000 MySQL AB & MySQL Finland AB & TCX DataKonsult AB
00002 
00003    This program is free software; you can redistribute it and/or modify
00004    it under the terms of the GNU General Public License as published by
00005    the Free Software Foundation; either version 2 of the License, or
00006    (at your option) any later version.
00007 
00008    This program is distributed in the hope that it will be useful,
00009    but WITHOUT ANY WARRANTY; without even the implied warranty of
00010    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
00011    GNU General Public License for more details.
00012 
00013    You should have received a copy of the GNU General Public License
00014    along with this program; if not, write to the Free Software
00015    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA */
00016 
00017 #include "slave.h" // for tables_ok(), rpl_filter
00018 
00019 #define SELECT_ACL      (1L << 0)
00020 #define INSERT_ACL      (1L << 1)
00021 #define UPDATE_ACL      (1L << 2)
00022 #define DELETE_ACL      (1L << 3)
00023 #define CREATE_ACL      (1L << 4)
00024 #define DROP_ACL        (1L << 5)
00025 #define RELOAD_ACL      (1L << 6)
00026 #define SHUTDOWN_ACL    (1L << 7)
00027 #define PROCESS_ACL     (1L << 8)
00028 #define FILE_ACL        (1L << 9)
00029 #define GRANT_ACL       (1L << 10)
00030 #define REFERENCES_ACL  (1L << 11)
00031 #define INDEX_ACL       (1L << 12)
00032 #define ALTER_ACL       (1L << 13)
00033 #define SHOW_DB_ACL     (1L << 14)
00034 #define SUPER_ACL       (1L << 15)
00035 #define CREATE_TMP_ACL  (1L << 16)
00036 #define LOCK_TABLES_ACL (1L << 17)
00037 #define EXECUTE_ACL     (1L << 18)
00038 #define REPL_SLAVE_ACL  (1L << 19)
00039 #define REPL_CLIENT_ACL (1L << 20)
00040 #define CREATE_VIEW_ACL (1L << 21)
00041 #define SHOW_VIEW_ACL   (1L << 22)
00042 #define CREATE_PROC_ACL (1L << 23)
00043 #define ALTER_PROC_ACL  (1L << 24)
00044 #define CREATE_USER_ACL (1L << 25)
00045 #define EVENT_ACL       (1L << 26)
00046 #define TRIGGER_ACL     (1L << 27)
00047 /*
00048   don't forget to update
00049   1. static struct show_privileges_st sys_privileges[]
00050   2. static const char *command_array[] and static uint command_lengths[]
00051   3. mysql_create_system_tables.sh, mysql_fix_privilege_tables.sql
00052      and mysql-test/lib/init_db.sql
00053   4. acl_init() or whatever - to define behaviour for old privilege tables
00054   5. sql_yacc.yy - for GRANT/REVOKE to work
00055 */
00056 #define EXTRA_ACL       (1L << 29)
00057 #define NO_ACCESS       (1L << 30)
00058 #define DB_ACLS \
00059 (UPDATE_ACL | SELECT_ACL | INSERT_ACL | DELETE_ACL | CREATE_ACL | DROP_ACL | \
00060  GRANT_ACL | REFERENCES_ACL | INDEX_ACL | ALTER_ACL | CREATE_TMP_ACL | \
00061  LOCK_TABLES_ACL | EXECUTE_ACL | CREATE_VIEW_ACL | SHOW_VIEW_ACL | \
00062  CREATE_PROC_ACL | ALTER_PROC_ACL | EVENT_ACL | TRIGGER_ACL)
00063 
00064 #define TABLE_ACLS \
00065 (SELECT_ACL | INSERT_ACL | UPDATE_ACL | DELETE_ACL | CREATE_ACL | DROP_ACL | \
00066  GRANT_ACL | REFERENCES_ACL | INDEX_ACL | ALTER_ACL | CREATE_VIEW_ACL | \
00067  SHOW_VIEW_ACL | TRIGGER_ACL)
00068 
00069 #define COL_ACLS \
00070 (SELECT_ACL | INSERT_ACL | UPDATE_ACL | REFERENCES_ACL)
00071 
00072 #define PROC_ACLS \
00073 (ALTER_PROC_ACL | EXECUTE_ACL | GRANT_ACL)
00074 
00075 #define SHOW_PROC_ACLS \
00076 (ALTER_PROC_ACL | EXECUTE_ACL | CREATE_PROC_ACL)
00077 
00078 #define GLOBAL_ACLS \
00079 (SELECT_ACL | INSERT_ACL | UPDATE_ACL | DELETE_ACL | CREATE_ACL | DROP_ACL | \
00080  RELOAD_ACL | SHUTDOWN_ACL | PROCESS_ACL | FILE_ACL | GRANT_ACL | \
00081  REFERENCES_ACL | INDEX_ACL | ALTER_ACL | SHOW_DB_ACL | SUPER_ACL | \
00082  CREATE_TMP_ACL | LOCK_TABLES_ACL | REPL_SLAVE_ACL | REPL_CLIENT_ACL | \
00083  EXECUTE_ACL | CREATE_VIEW_ACL | SHOW_VIEW_ACL | CREATE_PROC_ACL | \
00084  ALTER_PROC_ACL | CREATE_USER_ACL | EVENT_ACL | TRIGGER_ACL)
00085 
00086 #define DEFAULT_CREATE_PROC_ACLS \
00087 (ALTER_PROC_ACL | EXECUTE_ACL)
00088 
00089 /*
00090   Defines to change the above bits to how things are stored in tables
00091   This is needed as the 'host' and 'db' table is missing a few privileges
00092 */
00093 
00094 /* Privileges that needs to be reallocated (in continous chunks) */
00095 #define DB_CHUNK0 (SELECT_ACL | INSERT_ACL | UPDATE_ACL | DELETE_ACL | \
00096                    CREATE_ACL | DROP_ACL)
00097 #define DB_CHUNK1 (GRANT_ACL | REFERENCES_ACL | INDEX_ACL | ALTER_ACL)
00098 #define DB_CHUNK2 (CREATE_TMP_ACL | LOCK_TABLES_ACL)
00099 #define DB_CHUNK3 (CREATE_VIEW_ACL | SHOW_VIEW_ACL | \
00100                    CREATE_PROC_ACL | ALTER_PROC_ACL )
00101 #define DB_CHUNK4 (EXECUTE_ACL)
00102 #define DB_CHUNK5 (EVENT_ACL | TRIGGER_ACL)
00103 
00104 #define fix_rights_for_db(A)  (((A)       & DB_CHUNK0) | \
00105                               (((A) << 4) & DB_CHUNK1) | \
00106                               (((A) << 6) & DB_CHUNK2) | \
00107                               (((A) << 9) & DB_CHUNK3) | \
00108                               (((A) << 2) & DB_CHUNK4))| \
00109                               (((A) << 9) & DB_CHUNK5)
00110 #define get_rights_for_db(A)  (((A) & DB_CHUNK0)       | \
00111                               (((A) & DB_CHUNK1) >> 4) | \
00112                               (((A) & DB_CHUNK2) >> 6) | \
00113                               (((A) & DB_CHUNK3) >> 9) | \
00114                               (((A) & DB_CHUNK4) >> 2))| \
00115                               (((A) & DB_CHUNK5) >> 9)
00116 #define TBL_CHUNK0 DB_CHUNK0
00117 #define TBL_CHUNK1 DB_CHUNK1
00118 #define TBL_CHUNK2 (CREATE_VIEW_ACL | SHOW_VIEW_ACL)
00119 #define TBL_CHUNK3 TRIGGER_ACL
00120 #define fix_rights_for_table(A) (((A)        & TBL_CHUNK0) | \
00121                                 (((A) <<  4) & TBL_CHUNK1) | \
00122                                 (((A) << 11) & TBL_CHUNK2) | \
00123                                 (((A) << 15) & TBL_CHUNK3))
00124 #define get_rights_for_table(A) (((A) & TBL_CHUNK0)        | \
00125                                 (((A) & TBL_CHUNK1) >>  4) | \
00126                                 (((A) & TBL_CHUNK2) >> 11) | \
00127                                 (((A) & TBL_CHUNK3) >> 15))
00128 #define fix_rights_for_column(A) (((A) & 7) | (((A) & ~7) << 8))
00129 #define get_rights_for_column(A) (((A) & 7) | ((A) >> 8))
00130 #define fix_rights_for_procedure(A) ((((A) << 18) & EXECUTE_ACL) | \
00131                                      (((A) << 23) & ALTER_PROC_ACL) | \
00132                                      (((A) << 8) & GRANT_ACL))
00133 #define get_rights_for_procedure(A) ((((A) & EXECUTE_ACL) >> 18) |  \
00134                                      (((A) & ALTER_PROC_ACL) >> 23) | \
00135                                      (((A) & GRANT_ACL) >> 8))
00136 
00137 enum mysql_db_table_field
00138 {
00139   MYSQL_DB_FIELD_HOST = 0,
00140   MYSQL_DB_FIELD_DB,
00141   MYSQL_DB_FIELD_USER,
00142   MYSQL_DB_FIELD_SELECT_PRIV,
00143   MYSQL_DB_FIELD_INSERT_PRIV,
00144   MYSQL_DB_FIELD_UPDATE_PRIV,
00145   MYSQL_DB_FIELD_DELETE_PRIV,
00146   MYSQL_DB_FIELD_CREATE_PRIV,
00147   MYSQL_DB_FIELD_DROP_PRIV,
00148   MYSQL_DB_FIELD_GRANT_PRIV,
00149   MYSQL_DB_FIELD_REFERENCES_PRIV,
00150   MYSQL_DB_FIELD_INDEX_PRIV,
00151   MYSQL_DB_FIELD_ALTER_PRIV,
00152   MYSQL_DB_FIELD_CREATE_TMP_TABLE_PRIV,
00153   MYSQL_DB_FIELD_LOCK_TABLES_PRIV,
00154   MYSQL_DB_FIELD_CREATE_VIEW_PRIV,
00155   MYSQL_DB_FIELD_SHOW_VIEW_PRIV,
00156   MYSQL_DB_FIELD_CREATE_ROUTINE_PRIV,
00157   MYSQL_DB_FIELD_ALTER_ROUTINE_PRIV,
00158   MYSQL_DB_FIELD_EXECUTE_PRIV,
00159   MYSQL_DB_FIELD_EVENT_PRIV,
00160   MYSQL_DB_FIELD_TRIGGER_PRIV,
00161   MYSQL_DB_FIELD_COUNT
00162 };
00163 
00164 extern TABLE_FIELD_W_TYPE mysql_db_table_fields[];
00165 extern time_t mysql_db_table_last_check;
00166 
00167 /* Classes */
00168 
00169 struct acl_host_and_ip
00170 {
00171   char *hostname;
00172   long ip,ip_mask;                      // Used with masked ip:s
00173 };
00174 
00175 
00176 class ACL_ACCESS {
00177 public:
00178   ulong sort;
00179   ulong access;
00180 };
00181 
00182 
00183 /* ACL_HOST is used if no host is specified */
00184 
00185 class ACL_HOST :public ACL_ACCESS
00186 {
00187 public:
00188   acl_host_and_ip host;
00189   char *db;
00190 };
00191 
00192 
00193 class ACL_USER :public ACL_ACCESS
00194 {
00195 public:
00196   acl_host_and_ip host;
00197   uint hostname_length;
00198   USER_RESOURCES user_resource;
00199   char *user;
00200   uint8 salt[SCRAMBLE_LENGTH+1];       // scrambled password in binary form
00201   uint8 salt_len;        // 0 - no password, 4 - 3.20, 8 - 3.23, 20 - 4.1.1 
00202   enum SSL_type ssl_type;
00203   const char *ssl_cipher, *x509_issuer, *x509_subject;
00204 };
00205 
00206 
00207 class ACL_DB :public ACL_ACCESS
00208 {
00209 public:
00210   acl_host_and_ip host;
00211   char *user,*db;
00212 };
00213 
00214 /* prototypes */
00215 
00216 bool hostname_requires_resolving(const char *hostname);
00217 my_bool  acl_init(bool dont_read_acl_tables);
00218 my_bool acl_reload(THD *thd);
00219 void acl_free(bool end=0);
00220 ulong acl_get(const char *host, const char *ip,
00221               const char *user, const char *db, my_bool db_is_pattern);
00222 int acl_getroot(THD *thd, USER_RESOURCES *mqh, const char *passwd,
00223                 uint passwd_len);
00224 bool acl_getroot_no_password(Security_context *sctx, char *user, char *host,
00225                              char *ip, char *db);
00226 bool acl_check_host(const char *host, const char *ip);
00227 bool check_change_password(THD *thd, const char *host, const char *user,
00228                            char *password, uint password_len);
00229 bool change_password(THD *thd, const char *host, const char *user,
00230                      char *password);
00231 bool mysql_grant(THD *thd, const char *db, List <LEX_USER> &user_list,
00232                  ulong rights, bool revoke);
00233 bool mysql_table_grant(THD *thd, TABLE_LIST *table, List <LEX_USER> &user_list,
00234                        List <LEX_COLUMN> &column_list, ulong rights,
00235                        bool revoke);
00236 bool mysql_routine_grant(THD *thd, TABLE_LIST *table, bool is_proc,
00237                          List <LEX_USER> &user_list, ulong rights,
00238                          bool revoke, bool no_error);
00239 my_bool grant_init();
00240 void grant_free(void);
00241 my_bool grant_reload(THD *thd);
00242 bool check_grant(THD *thd, ulong want_access, TABLE_LIST *tables,
00243                  uint show_command, uint number, bool dont_print_error);
00244 bool check_grant_column (THD *thd, GRANT_INFO *grant,
00245                          const char *db_name, const char *table_name,
00246                          const char *name, uint length, Security_context *sctx);
00247 bool check_column_grant_in_table_ref(THD *thd, TABLE_LIST * table_ref,
00248                                      const char *name, uint length);
00249 bool check_grant_all_columns(THD *thd, ulong want_access, GRANT_INFO *grant,
00250                              const char* db_name, const char *table_name,
00251                              Field_iterator *fields);
00252 bool check_grant_routine(THD *thd, ulong want_access,
00253                          TABLE_LIST *procs, bool is_proc, bool no_error);
00254 bool check_grant_db(THD *thd,const char *db);
00255 ulong get_table_grant(THD *thd, TABLE_LIST *table);
00256 ulong get_column_grant(THD *thd, GRANT_INFO *grant,
00257                        const char *db_name, const char *table_name,
00258                        const char *field_name);
00259 bool mysql_show_grants(THD *thd, LEX_USER *user);
00260 void get_privilege_desc(char *to, uint max_length, ulong access);
00261 void get_mqh(const char *user, const char *host, USER_CONN *uc);
00262 bool mysql_create_user(THD *thd, List <LEX_USER> &list);
00263 bool mysql_drop_user(THD *thd, List <LEX_USER> &list);
00264 bool mysql_rename_user(THD *thd, List <LEX_USER> &list);
00265 bool mysql_revoke_all(THD *thd, List <LEX_USER> &list);
00266 void fill_effective_table_privileges(THD *thd, GRANT_INFO *grant,
00267                                      const char *db, const char *table);
00268 bool sp_revoke_privileges(THD *thd, const char *sp_db, const char *sp_name,
00269                           bool is_proc);
00270 bool sp_grant_privileges(THD *thd, const char *sp_db, const char *sp_name,
00271                          bool is_proc);
00272 bool check_routine_level_acl(THD *thd, const char *db, const char *name,
00273                              bool is_proc);
00274 bool is_acl_user(const char *host, const char *user);
00275 #ifdef NO_EMBEDDED_ACCESS_CHECKS
00276 #define check_grant(A,B,C,D,E,F) 0
00277 #define check_grant_db(A,B) 0
00278 #endif
Generated on Sat Sep 9 00:50:17 2006 for MySQL 5.1 by
1.4.7