#include <string.h>
#include "lex_string.h"
#include "m_string.h"
#include "my_command.h"
#include "mysql/plugin_audit.h"

Macros
#define	AUDIT_EVENT(x) x, #x
	Audit API event to string expanding macro. More...

Functions
bool	is_audit_plugin_class_active (THD *thd, unsigned long event_class)
	There's at least one active audit plugin tracking a specified class. More...

bool	is_global_audit_mask_set ()
	Checks presence of active audit plugin. More...

size_t	make_user_name (Security_context sctx, char buf)

int	initialize_audit_plugin (st_plugin_int *plugin)
	Initialize an Audit plug-in. More...

int	finalize_audit_plugin (st_plugin_int *plugin)
	Finalize an Audit plug-in. More...

void	mysql_audit_initialize ()
	Initialize Audit global variables. More...

void	mysql_audit_finalize ()
	Finalize Audit global variables. More...

void	mysql_audit_init_thd (THD *thd)
	Initialize thd variables used by Audit. More...

void	mysql_audit_free_thd (THD *thd)
	Free thd variables used by Audit. More...

int	mysql_audit_acquire_plugins (THD *thd, mysql_event_class_t event_class, unsigned long event_subclass, bool check_audited=true)
	Acquire audit plugins. More...

void	mysql_audit_release (THD *thd)
	Release any resources associated with the current thd. More...

void	mysql_audit_enable_auditing (THD *thd)
	Enable auditing of the specified THD. More...

int	mysql_audit_notify (THD thd, mysql_event_general_subclass_t subclass, const char subclass_name, int error_code, const char *msg, size_t msg_len)
	Call audit plugins of GENERAL audit class. More...

static int	mysql_audit_general_log (THD thd, const char cmd, size_t cmdlen)
	Call audit plugins of GENERAL LOG audit class. More...

int	mysql_audit_notify (THD thd, mysql_event_connection_subclass_t subclass, const char subclass_name, int errcode)
	Call audit plugins of CONNECTION audit class. More...

int	mysql_audit_notify (THD thd, mysql_event_parse_subclass_t subclass, const char subclass_name, mysql_event_parse_rewrite_plugin_flag flags, LEX_CSTRING rewritten_query)
	Call audit plugins of PARSE audit class. More...

int	mysql_audit_notify (THD thd, mysql_event_authorization_subclass_t subclass, const char subclass_name, const char database, unsigned int database_length, const char name, unsigned int name_length)
	Call audit plugins of AUTHORIZATION audit class. More...

int	mysql_audit_table_access_notify (THD thd, Table_ref table)
	Call audit plugins of TABLE ACCESS audit class events for all tables available in the list. More...

int	mysql_audit_notify (THD thd, mysql_event_global_variable_subclass_t subclass, const char subclass_name, const char name, const char value, const unsigned int value_length)
	Call audit plugins of GLOBAL VARIABLE audit class. More...

int	mysql_audit_notify (mysql_event_server_startup_subclass_t subclass, const char subclass_name, const char *argv, unsigned int argc)
	Call audit plugins of SERVER STARTUP audit class. More...

int	mysql_audit_notify (mysql_event_server_shutdown_subclass_t subclass, mysql_server_shutdown_reason_t reason, int exit_code)
	Call audit plugins of SERVER SHUTDOWN audit class. More...

int	mysql_audit_notify (THD thd, mysql_event_connection_subclass_t subclass, const char subclass_name)
	Call audit plugins of CONNECTION audit class. More...

int	mysql_audit_notify (THD thd, mysql_event_command_subclass_t subclass, const char subclass_name, enum_server_command command, const char *command_text)
	Call audit plugins of COMMAND audit class. More...

int	mysql_audit_notify (THD thd, mysql_event_query_subclass_t subclass, const char subclass_name)
	Call audit plugins of QUERY audit class. More...

int	mysql_audit_notify (THD thd, mysql_event_stored_program_subclass_t subclass, const char subclass_name, const char database, const char name, void *parameters)
	Call audit plugins of STORED PROGRAM audit class. More...

int	mysql_audit_notify (THD thd, mysql_event_authentication_subclass_t subclass, const char subclass_name, int status, const char user, const char host, const char authentication_plugin, bool is_role, const char new_user, const char *new_host)
	Call audit plugins of AUTHENTICATION audit class. More...

int	mysql_audit_notify (THD thd, mysql_event_message_subclass_t subclass, const char subclass_name, const char component, size_t component_length, const char producer, size_t producer_length, const char message, size_t message_length, mysql_event_message_key_value_t key_value_map, size_t key_value_map_length)
	Call audit plugins of MESSAGE audit class. More...

Variables
static const size_t	MAX_USER_HOST_SIZE = 512

Macro Definition Documentation

◆ AUDIT_EVENT

#define AUDIT_EVENT ( x ) x, #x

Audit API event to string expanding macro.

Function Documentation

◆ finalize_audit_plugin()

int finalize_audit_plugin ( st_plugin_int * plugin )

Finalize an Audit plug-in.

Parameters

[in] plugin Plugin data pointer to be deinitialized.

Return values

false	OK
true	There was an error.

◆ initialize_audit_plugin()

int initialize_audit_plugin ( st_plugin_int * plugin )

Initialize an Audit plug-in.

Parameters

[in] plugin Plugin structure pointer to be initialized.

Return values

false	OK
true	There was an error.

◆ is_audit_plugin_class_active()

bool is_audit_plugin_class_active	(	THD *	thd,
		unsigned long	event_class
	)

There's at least one active audit plugin tracking a specified class.

◆ is_global_audit_mask_set()

bool is_global_audit_mask_set ( )

Checks presence of active audit plugin.

Return values

TRUE	At least one audit plugin is present
FALSE	No audit plugin is present

◆ make_user_name()

size_t make_user_name	(	Security_context *	sctx,
		char *	buf
	)

◆ mysql_audit_acquire_plugins()

int mysql_audit_acquire_plugins	(	THD *	thd,
		mysql_event_class_t	event_class,
		unsigned long	event_subclass,
		bool	check_audited
	)

Acquire audit plugins.

Ensure that audit plugins interested in given event class are locked by current thread.

Parameters

thd	MySQL thread handle.
event_class	Audit event class.
event_subclass	Audit event subclass.
check_audited	Take into account m_auditing_activated flag of the THD.

Returns: Zero, when there is a plugins interested in the event specified by event_class and event_subclass. Otherwise non zero value is returned.

◆ mysql_audit_enable_auditing()

void mysql_audit_enable_auditing ( THD * thd )

Enable auditing of the specified THD.

Parameters

[in] thd THD whose auditing capability is turned on.

◆ mysql_audit_finalize()

void mysql_audit_finalize ( )

Finalize Audit global variables.

◆ mysql_audit_free_thd()

void mysql_audit_free_thd ( THD * thd )

Free thd variables used by Audit.

Parameters

thd	Current thread

◆ mysql_audit_general_log()

static int mysql_audit_general_log	(	THD *	thd,
		const char *	cmd,
		size_t	cmdlen
	)

inlinestatic

Call audit plugins of GENERAL LOG audit class.

Parameters

[in]	thd	Current thread data.
[in]	cmd	Command text.
[in]	cmdlen	Command text length.

Returns: Value returned is not taken into consideration by the server.

◆ mysql_audit_init_thd()

void mysql_audit_init_thd ( THD * thd )

Initialize thd variables used by Audit.

Parameters

[in] thd Current thread

◆ mysql_audit_initialize()

void mysql_audit_initialize ( )

Initialize Audit global variables.

◆ mysql_audit_notify() [1/13]

int mysql_audit_notify	(	mysql_event_server_shutdown_subclass_t	subclass,
		mysql_server_shutdown_reason_t	reason,
		int	exit_code
	)

Call audit plugins of SERVER SHUTDOWN audit class.

Parameters

[in]	subclass	Type of the server abort audit event.
[in]	reason	Reason code of the shutdown.
[in]	exit_code	Abort exit code.

Returns: Value returned is not taken into consideration by the server.

◆ mysql_audit_notify() [2/13]

int mysql_audit_notify	(	mysql_event_server_startup_subclass_t	subclass,
		const char *	subclass_name,
		const char **	argv,
		unsigned int	argc
	)

Call audit plugins of SERVER STARTUP audit class.

Parameters

[in]	subclass	Type of the server startup audit event.
[in]	subclass_name	Name of the subclass.
[in]	argv	Array of program arguments.
[in]	argc	Program arguments array length.

Returns: 0 continue server start, otherwise abort.

◆ mysql_audit_notify() [3/13]

int mysql_audit_notify	(	THD *	thd,
		mysql_event_authentication_subclass_t	subclass,
		const char *	subclass_name,
		int	status,
		const char *	user,
		const char *	host,
		const char *	authentication_plugin,
		bool	is_role,
		const char *	new_user,
		const char *	new_host
	)

Call audit plugins of AUTHENTICATION audit class.

Parameters

[in]	thd	Current thread data.
[in]	subclass	Type of the authentication audit event.
[in]	subclass_name	Name of the subclass.
[in]	status	Status of the event.
[in]	user	Name of the user.
[in]	host	Name of the host.
[in]	authentication_plugin	Current authentication plugin for user.
[in]	is_role	Whether given AuthID is a role or not
[in]	new_user	Name of the new user - In case of rename
[in]	new_host	Name of the new host - In case of rename

Returns: 0 continue server flow, otherwise abort.

◆ mysql_audit_notify() [4/13]

int mysql_audit_notify	(	THD *	thd,
		mysql_event_authorization_subclass_t	subclass,
		const char *	subclass_name,
		const char *	database,
		unsigned int	database_length,
		const char *	name,
		unsigned int	name_length
	)

Call audit plugins of AUTHORIZATION audit class.

Parameters

[in]	thd	Thread data.
[in]	subclass	Type of the connection audit event.
[in]	subclass_name	Name of the subclass.
[in]	database	object database
[in]	database_length	object database length
[in]	name	object name
[in]	name_length	object name length

Returns: 0 continue server flow, otherwise abort.

◆ mysql_audit_notify() [5/13]

int mysql_audit_notify	(	THD *	thd,
		mysql_event_command_subclass_t	subclass,
		const char *	subclass_name,
		enum_server_command	command,
		const char *	command_text
	)

Call audit plugins of COMMAND audit class.

Internal connection info is extracted from the thd object.

Parameters

[in]	thd	Current thread data.
[in]	subclass	Type of the command audit event.
[in]	subclass_name	Name of the subclass.
[in]	command	Command id value.
[in]	command_text	Command string value.

Returns: 0 continue server flow, otherwise abort.

◆ mysql_audit_notify() [6/13]

int mysql_audit_notify	(	THD *	thd,
		mysql_event_connection_subclass_t	subclass,
		const char *	subclass_name
	)

Call audit plugins of CONNECTION audit class.

Internal connection info is extracted from the thd object.

Parameters

[in]	thd	Current thread data.
[in]	subclass	Type of the connection audit event.
[in]	subclass_name	Name of the subclass.

Returns: 0 continue server flow, otherwise abort.

◆ mysql_audit_notify() [7/13]

int mysql_audit_notify	(	THD *	thd,
		mysql_event_connection_subclass_t	subclass,
		const char *	subclass_name,
		int	errcode
	)

Call audit plugins of CONNECTION audit class.

Parameters

[in]	thd	Current thread context.
[in]	subclass	Type of the connection audit event.
[in]	subclass_name	Name of the subclass.
[in]	errcode	Error code.

Returns: 0 continue server flow, otherwise abort.

◆ mysql_audit_notify() [8/13]

int mysql_audit_notify	(	THD *	thd,
		mysql_event_general_subclass_t	subclass,
		const char *	subclass_name,
		int	error_code,
		const char *	msg,
		size_t	msg_len
	)

Call audit plugins of GENERAL audit class.

Parameters

[in]	thd	Current thread data.
[in]	subclass	Type of general audit event.
[in]	subclass_name	Subclass name.
[in]	error_code	Error code
[in]	msg	Message
[in]	msg_len	Message length.

Returns: Value returned is not taken into consideration by the server.

◆ mysql_audit_notify() [9/13]

int mysql_audit_notify	(	THD *	thd,
		mysql_event_global_variable_subclass_t	subclass,
		const char *	subclass_name,
		const char *	name,
		const char *	value,
		const unsigned int	value_length
	)

Call audit plugins of GLOBAL VARIABLE audit class.

Parameters

[in]	thd	Current thread data.
[in]	subclass	Type of the global variable audit event.
[in]	subclass_name	Name of the subclass.
[in]	name	Name of the variable.
[in]	value	Textual value of the variable.
[in]	value_length	Textual value length.

Returns: 0 continue server flow, otherwise abort.

◆ mysql_audit_notify() [10/13]

int mysql_audit_notify	(	THD *	thd,
		mysql_event_message_subclass_t	subclass,
		const char *	subclass_name,
		const char *	component,
		size_t	component_length,
		const char *	producer,
		size_t	producer_length,
		const char *	message,
		size_t	message_length,
		mysql_event_message_key_value_t *	key_value_map,
		size_t	key_value_map_length
	)

Call audit plugins of MESSAGE audit class.

Parameters

[in]	thd	Current thread data.
[in]	subclass	Message class subclass name.
[in]	subclass_name	Subclass name length.
[in]	component	Component name.
[in]	component_length	Component name length.
[in]	producer	Producer name.
[in]	producer_length	Producer name length.
[in]	message	Message text.
[in]	message_length	Message text length.
[in]	key_value_map	Key value map pointer.
[in]	key_value_map_length	Key value map length.

Returns: 0 continue server flow.

◆ mysql_audit_notify() [11/13]

int mysql_audit_notify	(	THD *	thd,
		mysql_event_parse_subclass_t	subclass,
		const char *	subclass_name,
		mysql_event_parse_rewrite_plugin_flag *	flags,
		LEX_CSTRING *	rewritten_query
	)

Call audit plugins of PARSE audit class.

Parameters

[in]	thd	Current thread context.
[in]	subclass	Type of the parse audit event.
[in]	subclass_name	Name of the subclass.
[out]	flags	Rewritten query flags.
[out]	rewritten_query	Rewritten query

Returns: 0 continue server flow, otherwise abort.

◆ mysql_audit_notify() [12/13]

int mysql_audit_notify	(	THD *	thd,
		mysql_event_query_subclass_t	subclass,
		const char *	subclass_name
	)

Call audit plugins of QUERY audit class.

Internal query info is extracted from the thd object.

Parameters

[in]	thd	Current thread data.
[in]	subclass	Type of the query audit event.
[in]	subclass_name	Name of the subclass.

Returns: 0 continue server flow, otherwise abort.

◆ mysql_audit_notify() [13/13]

int mysql_audit_notify	(	THD *	thd,
		mysql_event_stored_program_subclass_t	subclass,
		const char *	subclass_name,
		const char *	database,
		const char *	name,
		void *	parameters
	)

Call audit plugins of STORED PROGRAM audit class.

Parameters

[in]	thd	Current thread data.
[in]	subclass	Type of the stored program audit event.
[in]	subclass_name	Name of the subclass.
[in]	database	Stored program database name.
[in]	name	Name of the stored program.
[in]	parameters	Parameters of the stored program execution.

Returns: 0 continue server flow, otherwise abort.

◆ mysql_audit_release()

void mysql_audit_release ( THD * thd )

Release any resources associated with the current thd.

Parameters

[in] thd Current thread

◆ mysql_audit_table_access_notify()

int mysql_audit_table_access_notify	(	THD *	thd,
		Table_ref *	table
	)

Call audit plugins of TABLE ACCESS audit class events for all tables available in the list.

Event subclass value depends on the thd->lex->sql_command value.

The event is generated for 'USER' and 'SYS' tables only.

Parameters

[in]	thd	Current thread data.
[in]	table	Connected list of tables, for which event is generated.

Returns: 0 - continue server flow, otherwise abort.

Variable Documentation

◆ MAX_USER_HOST_SIZE

const size_t MAX_USER_HOST_SIZE = 512

static

Macros

Functions

Variables

Macro Definition Documentation

◆ AUDIT_EVENT

Function Documentation

◆ finalize_audit_plugin()

◆ initialize_audit_plugin()

◆ is_audit_plugin_class_active()

◆ is_global_audit_mask_set()

◆ make_user_name()

◆ mysql_audit_acquire_plugins()

◆ mysql_audit_enable_auditing()

◆ mysql_audit_finalize()

◆ mysql_audit_free_thd()

◆ mysql_audit_general_log()

◆ mysql_audit_init_thd()

◆ mysql_audit_initialize()

◆ mysql_audit_notify() [1/13]

◆ mysql_audit_notify() [2/13]

◆ mysql_audit_notify() [3/13]

◆ mysql_audit_notify() [4/13]

◆ mysql_audit_notify() [5/13]

◆ mysql_audit_notify() [6/13]

◆ mysql_audit_notify() [7/13]

◆ mysql_audit_notify() [8/13]

◆ mysql_audit_notify() [9/13]

◆ mysql_audit_notify() [10/13]

◆ mysql_audit_notify() [11/13]

◆ mysql_audit_notify() [12/13]

◆ mysql_audit_notify() [13/13]

◆ mysql_audit_release()

◆ mysql_audit_table_access_notify()

Variable Documentation

◆ MAX_USER_HOST_SIZE