The server_audit_timestamp_format %f specifier always rendered zero
microseconds. The server downcast the precise time to seconds before
passing it to audit plugins, and the plugin then re-fetched the time
itself at write time.
Pass the server's high-resolution time through the audit API instead:
- extend mysql_event_general with general_time_microseconds (added in
MYSQL_AUDIT_INTERFACE_VERSION 0x0304), keeping general_time in
seconds for backward compatibility
- the server_audit plugin uses event->general_time_microseconds for
query log entries instead of re-fetching the time at write time
Connection and table events carry no timestamp in the audit API, so the
plugin keeps taking the time at event time for those entries.
THDVAR(thd, loc_info) can return NULL if the plugin was previously
uninstalled. get_loc_info() and its callers dereferenced it.
Guard against a NULL loc_info in get_loc_info(), auditing() and
log_current_query(). Such a session is not audited.
Replace if-else chain with a single bitwise AND check when filtering query
events by type (DDL, DML, DCL, etc.).
The removes the need for the goto statements.
Additionally, we remove the orig_query variable as it served no purpose.
All new code of the whole pull request, including one or several files
that are either new files or modified ones, are contributed under the
BSD-new license
Replace the contention prone mysql_prlock_t with a simpler
rw-lock wrapper from InnoDB, and fix several potential
race conditions by making consistent use of lock_operations.
This will also omit any PERFORMANCE_SCHEMA instrumentation.
The release of MySQL 5.7.44 (the last one in the 5.7 series) took place in
August 2023.
Also, the release of MariaDB 5.5.68 (the last one in the 5.5 series)
took place in May 2020.
Let us remove some dead code that is related to these, as well as
attempts to detect the server version by symbol lookup.
The audit plugin will typically be built and distributed together
with the current MariaDB server version.
Commit 1d80e8e updated lock_operations to a rwlock from a mutex but didn't
update the PS instrumentation setup accordingly.
We update the PS setup accordingly so the lock is correctly instrumented in
performance_schema.rwlock_instances.
All new code of the whole pull request, including one or several files
that are either new files or modified ones, are contributed under the
BSD-new license. I am contributing on behalf of my employer Amazon Web
Services, Inc.
* clarify the help text for --server-audit-file-rotate-size
* initialize cn->sync_statement, otherwise new connection randomly syncs
* and DON'T SPAM syslog
In environments with load balancers or proxies, the audit plugin logs
only the IP address, making it difficult to differentiate individual client
connections from the same IP.
Add a new 'port' field to the appropriate event objects to capture the
client's TCP port number. Populate the port field with thd->port in the
appropriate functions. The audit plugin receives and logs this port field
along with other connection information, enabling better identification
of individual client connections.
All new code of the whole pull request, including one or several files that
are either new files or modified ones, are contributed under the BSD-new license.
I am contributing on behalf of my employer Amazon Web Services, Inc.
Add tls_version and tls_version_length variables to the audit plugin so
they can be logged. This is useful to help identify suspicious or
malformed connections attempting to use unsupported TLS versions. A log
with this information will allow to detect and block more malicious
connection attempts.
Users with 'server_audit_events' empty will have these two new variables
automatically visible in their logs, but if users don't want them, they
can always configure what fields to include by listing the fields in
'server_audit_events'.
In connection event, The TLS version will be populated in `object` field
in key=value format, and the key-value pair will be omitted when the
value is empty.
To ensure the MTR test result matches in all environments, the TLS
version string is replaced with a general `TLS_VERSION` to avoid the MTR
test failing unexpectedly. It stores the version with query `SHOW STATUS
LIKE 'Ssl_version'` and replace the output with `replace_result` command.
All new code of the whole pull request, including one or several files
that are either new files or modified ones, are contributed under the
BSD-new license. I am contributing on behalf of my employer Amazon Web
Services, Inc.
[1]: https://docs.openssl.org/3.2/man3/SSL_get_version/
Limit size of server_audit_file_path value
Currently, the length of this value is not checked and can cause a buffer
overflow if given a long file path specifying a directory.
In file_logger:logger_open(), there is a check:
```
if (new_log.path_len+n_dig(rotations)+1 > FN_REFLEN)
// handle error
```
As n_dig(rotations) may return up to 3, this inherently limits the file path to
FN_REFLEN - 4 characters.
All new code of the whole pull request, including one or several files that are
either new files or modified ones, are contributed under the BSD-new license. I
am contributing on behalf of my employer Amazon Web Services, Inc.
[Breaking]
The `my_print_error` service passes formats and args directly
to `my_vsnprintf`. Just like the `my_snprintf` service,
I increased this service’s major version because:
* Custom suffixes are now a thing
(and custom specifiers will soon no longer be).
* GCC `-Wformat` now checks formats sent to them.
