sql_acl.cc 90 KB
Newer Older
1
/* Copyright (C) 2000-2003 MySQL AB
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2

bk@work.mysql.com's avatar
bk@work.mysql.com committed
3 4 5 6
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 2 of the License, or
   (at your option) any later version.
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
7

bk@work.mysql.com's avatar
bk@work.mysql.com committed
8 9 10 11
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
12

bk@work.mysql.com's avatar
bk@work.mysql.com committed
13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30
   You should have received a copy of the GNU General Public License
   along with this program; if not, write to the Free Software
   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA */


/*
  The privileges are saved in the following tables:
  mysql/user	 ; super user who are allowed to do almoust anything
  mysql/host	 ; host priviliges. This is used if host is empty in mysql/db.
  mysql/db	 ; database privileges / user

  data in tables is sorted according to how many not-wild-cards there is
  in the relevant fields. Empty strings comes last.
*/

#include "mysql_priv.h"
#include "sql_acl.h"
#include "hash_filo.h"
31 32 33
#ifdef HAVE_REPLICATION
#include "sql_repl.h" //for tables_ok()
#endif
bk@work.mysql.com's avatar
bk@work.mysql.com committed
34
#include <m_ctype.h>
35
#include <assert.h>
bk@work.mysql.com's avatar
bk@work.mysql.com committed
36 37 38 39 40 41 42 43
#include <stdarg.h>

struct acl_host_and_ip
{
  char *hostname;
  long ip,ip_mask;			// Used with masked ip:s
};

44

bk@work.mysql.com's avatar
bk@work.mysql.com committed
45 46 47
class ACL_ACCESS {
public:
  ulong sort;
48
  ulong access;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
49 50
};

51 52 53

/* ACL_HOST is used if no host is specified */

bk@work.mysql.com's avatar
bk@work.mysql.com committed
54 55 56 57 58 59 60
class ACL_HOST :public ACL_ACCESS
{
public:
  acl_host_and_ip host;
  char *db;
};

61

bk@work.mysql.com's avatar
bk@work.mysql.com committed
62 63 64 65
class ACL_USER :public ACL_ACCESS
{
public:
  acl_host_and_ip host;
66 67
  uint hostname_length;
  USER_RESOURCES user_resource;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
68 69
  char *user,*password;
  ulong salt[2];
70 71
  enum SSL_type ssl_type;
  const char *ssl_cipher, *x509_issuer, *x509_subject;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
72 73
};

74

bk@work.mysql.com's avatar
bk@work.mysql.com committed
75 76 77 78 79 80 81
class ACL_DB :public ACL_ACCESS
{
public:
  acl_host_and_ip host;
  char *user,*db;
};

82

bk@work.mysql.com's avatar
bk@work.mysql.com committed
83 84 85
class acl_entry :public hash_filo_element
{
public:
86
  ulong access;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
87 88 89 90
  uint16 length;
  char key[1];					// Key will be stored here
};

91

bk@work.mysql.com's avatar
bk@work.mysql.com committed
92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108
static byte* acl_entry_get_key(acl_entry *entry,uint *length,
			       my_bool not_used __attribute__((unused)))
{
  *length=(uint) entry->length;
  return (byte*) entry->key;
}

#define ACL_KEY_LENGTH (sizeof(long)+NAME_LEN+17)

static DYNAMIC_ARRAY acl_hosts,acl_users,acl_dbs;
static MEM_ROOT mem, memex;
static bool initialized=0;
static bool allow_all_hosts=1;
static HASH acl_check_hosts, hash_tables;
static DYNAMIC_ARRAY acl_wild_hosts;
static hash_filo *acl_cache;
static uint grant_version=0;
109
static ulong get_access(TABLE *form, uint fieldnr, uint *next_field);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
110 111 112 113 114 115 116
static int acl_compare(ACL_ACCESS *a,ACL_ACCESS *b);
static ulong get_sort(uint count,...);
static void init_check_host(void);
static ACL_USER *find_acl_user(const char *host, const char *user);
static bool update_user_table(THD *thd, const char *host, const char *user,
			      const char *new_password);
static void update_hostname(acl_host_and_ip *host, const char *hostname);
117
static bool compare_hostname(const acl_host_and_ip *host,const char *hostname,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
118 119
			     const char *ip);

120 121 122 123 124
/*
  Read grant privileges from the privilege tables in the 'mysql' database.

  SYNOPSIS
    acl_init()
125
    thd				Thread handler
126 127 128 129 130 131 132 133
    dont_read_acl_tables	Set to 1 if run with --skip-grant

  RETURN VALUES
    0	ok
    1	Could not initialize grant's
*/


134
my_bool acl_init(THD *org_thd, bool dont_read_acl_tables)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
135
{
136
  THD  *thd;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
137 138 139
  TABLE_LIST tables[3];
  TABLE *table;
  READ_RECORD read_record_info;
140 141
  MYSQL_LOCK *lock;
  my_bool return_val=1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
142 143 144 145 146
  DBUG_ENTER("acl_init");

  if (!acl_cache)
    acl_cache=new hash_filo(ACL_CACHE_SIZE,0,0,
			    (hash_get_key) acl_entry_get_key,
147
			    (hash_free_key) free);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
148 149 150
  if (dont_read_acl_tables)
    DBUG_RETURN(0); /* purecov: tested */

151 152 153
  /*
    To be able to run this from boot, we allocate a temporary THD
  */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
154 155
  if (!(thd=new THD))
    DBUG_RETURN(1); /* purecov: inspected */
156 157
  thd->store_globals();

bk@work.mysql.com's avatar
bk@work.mysql.com committed
158
  acl_cache->clear(1);				// Clear locked hostname cache
159 160
  thd->db= my_strdup("mysql",MYF(0));
  thd->db_length=5;				// Safety
bk@work.mysql.com's avatar
bk@work.mysql.com committed
161
  bzero((char*) &tables,sizeof(tables));
162 163 164
  tables[0].alias=tables[0].real_name=(char*) "host";
  tables[1].alias=tables[1].real_name=(char*) "user";
  tables[2].alias=tables[2].real_name=(char*) "db";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
165 166 167 168 169 170
  tables[0].next=tables+1;
  tables[1].next=tables+2;
  tables[0].lock_type=tables[1].lock_type=tables[2].lock_type=TL_READ;
  tables[0].db=tables[1].db=tables[2].db=thd->db;

  if (open_tables(thd,tables))
171 172 173
  {
    sql_print_error("Fatal error: Can't open privilege tables: %s",
		    thd->net.last_error);
174
    goto end;
175
  }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
176 177 178 179
  TABLE *ptr[3];				// Lock tables for quick update
  ptr[0]= tables[0].table;
  ptr[1]= tables[1].table;
  ptr[2]= tables[2].table;
180
  if (!(lock=mysql_lock_tables(thd,ptr,3)))
181 182 183
  {
    sql_print_error("Fatal error: Can't lock privilege tables: %s",
		    thd->net.last_error);
184
    goto end;
185
  }
186
  init_sql_alloc(&mem, ACL_ALLOC_BLOCK_SIZE, 0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
187
  init_read_record(&read_record_info,thd,table= tables[0].table,NULL,1,0);
188
  VOID(my_init_dynamic_array(&acl_hosts,sizeof(ACL_HOST),20,50));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
189 190 191 192
  while (!(read_record_info.read_record(&read_record_info)))
  {
    ACL_HOST host;
    update_hostname(&host.host,get_field(&mem, table,0));
193
    host.db=	 get_field(&mem, table,1);
194
    host.access= get_access(table,2,0);
195
    host.access= fix_rights_for_db(host.access);
196
    host.sort=	 get_sort(2,host.host.hostname,host.db);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
197 198 199 200
#ifndef TO_BE_REMOVED
    if (table->fields ==  8)
    {						// Without grant
      if (host.access & CREATE_ACL)
201
	host.access|=REFERENCES_ACL | INDEX_ACL | ALTER_ACL | CREATE_TMP_ACL;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
202 203 204 205 206 207 208 209 210 211
    }
#endif
    VOID(push_dynamic(&acl_hosts,(gptr) &host));
  }
  qsort((gptr) dynamic_element(&acl_hosts,0,ACL_HOST*),acl_hosts.elements,
	sizeof(ACL_HOST),(qsort_cmp) acl_compare);
  end_read_record(&read_record_info);
  freeze_size(&acl_hosts);

  init_read_record(&read_record_info,thd,table=tables[1].table,NULL,1,0);
212
  VOID(my_init_dynamic_array(&acl_users,sizeof(ACL_USER),50,100));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
213 214 215
  if (table->field[2]->field_length == 8 &&
      protocol_version == PROTOCOL_VERSION)
  {
216
    sql_print_error("Old 'user' table. (Check README or the Reference manual). Continuing --old-protocol"); /* purecov: tested */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
217 218 219
    protocol_version=9; /* purecov: tested */
  }

220
  DBUG_PRINT("info",("user table fields: %d",table->fields));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
221 222 223 224 225 226 227 228
  allow_all_hosts=0;
  while (!(read_record_info.read_record(&read_record_info)))
  {
    ACL_USER user;
    uint length=0;
    update_hostname(&user.host,get_field(&mem, table,0));
    user.user=get_field(&mem, table,1);
    user.password=get_field(&mem, table,2);
229
    if (user.password && (length=(uint) strlen(user.password)) == 8 &&
bk@work.mysql.com's avatar
bk@work.mysql.com committed
230 231 232
	protocol_version == PROTOCOL_VERSION)
    {
      sql_print_error(
233
		      "Found old style password for user '%s'. Ignoring user. (You may want to restart mysqld using --old-protocol)",
bk@work.mysql.com's avatar
bk@work.mysql.com committed
234 235
		      user.user ? user.user : ""); /* purecov: tested */
    }
236
    else if (length % 8 || length > 16)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
237 238
    {
      sql_print_error(
239
		      "Found invalid password for user: '%s'@'%s'; Ignoring user",
bk@work.mysql.com's avatar
bk@work.mysql.com committed
240 241
		      user.user ? user.user : "",
		      user.host.hostname ? user.host.hostname : ""); /* purecov: tested */
242
      continue;					/* purecov: tested */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
243
    }
244
    uint next_field;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
245
    get_salt_from_password(user.salt,user.password);
246
    user.access=get_access(table,3,&next_field) & GLOBAL_ACLS;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
247
    user.sort=get_sort(2,user.host.hostname,user.user);
248 249
    user.hostname_length= (user.host.hostname ?
			   (uint) strlen(user.host.hostname) : 0);
250
    if (table->fields >= 31)	 /* Starting from 4.0.2 we have more fields */
251
    {
252
      char *ssl_type=get_field(&mem, table, next_field++);
253 254 255 256 257 258 259 260 261
      if (!ssl_type)
	user.ssl_type=SSL_TYPE_NONE;
      else if (!strcmp(ssl_type, "ANY"))
	user.ssl_type=SSL_TYPE_ANY;
      else if (!strcmp(ssl_type, "X509"))
	user.ssl_type=SSL_TYPE_X509;
      else  /* !strcmp(ssl_type, "SPECIFIED") */
	user.ssl_type=SSL_TYPE_SPECIFIED;

262 263 264
      user.ssl_cipher=   get_field(&mem, table, next_field++);
      user.x509_issuer=  get_field(&mem, table, next_field++);
      user.x509_subject= get_field(&mem, table, next_field++);
265

266 267 268 269 270 271
      char *ptr = get_field(&mem, table, next_field++);
      user.user_resource.questions= ptr ? atoi(ptr) : 0;
      ptr = get_field(&mem, table, next_field++);
      user.user_resource.updates= ptr ? atoi(ptr): 0;
      ptr = get_field(&mem, table, next_field++);
      user.user_resource.connections=ptr ? atoi(ptr) : 0;
272 273
      if (user.user_resource.questions || user.user_resource.updates ||
	  user.user_resource.connections)
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
274
	mqh_used=1;
275
    }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
276
    else
277 278
    {
      user.ssl_type=SSL_TYPE_NONE;
279
      bzero((char *)&(user.user_resource),sizeof(user.user_resource));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
280
#ifndef TO_BE_REMOVED
281 282 283 284 285 286
      if (table->fields <= 13)
      {						// Without grant
	if (user.access & CREATE_ACL)
	  user.access|=REFERENCES_ACL | INDEX_ACL | ALTER_ACL;
      }
      /* Convert old privileges */
287
      user.access|= LOCK_TABLES_ACL | CREATE_TMP_ACL | SHOW_DB_ACL;
288 289 290 291
      if (user.access & FILE_ACL)
	user.access|= REPL_CLIENT_ACL | REPL_SLAVE_ACL;
      if (user.access & PROCESS_ACL)
	user.access|= SUPER_ACL | EXECUTE_ACL;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
292
#endif
293
    }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
294 295 296 297 298 299 300 301 302 303 304
    VOID(push_dynamic(&acl_users,(gptr) &user));
    if (!user.host.hostname || user.host.hostname[0] == wild_many &&
	!user.host.hostname[1])
      allow_all_hosts=1;			// Anyone can connect
  }
  qsort((gptr) dynamic_element(&acl_users,0,ACL_USER*),acl_users.elements,
	sizeof(ACL_USER),(qsort_cmp) acl_compare);
  end_read_record(&read_record_info);
  freeze_size(&acl_users);

  init_read_record(&read_record_info,thd,table=tables[2].table,NULL,1,0);
305
  VOID(my_init_dynamic_array(&acl_dbs,sizeof(ACL_DB),50,100));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
306 307 308 309 310
  while (!(read_record_info.read_record(&read_record_info)))
  {
    ACL_DB db;
    update_hostname(&db.host,get_field(&mem, table,0));
    db.db=get_field(&mem, table,1);
311 312 313
    if (!db.db)
    {
      sql_print_error("Found an entry in the 'db' table with empty database name; Skipped");
314
      continue;
315
    }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
316
    db.user=get_field(&mem, table,2);
317
    db.access=get_access(table,3,0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335
    db.access=fix_rights_for_db(db.access);
    db.sort=get_sort(3,db.host.hostname,db.db,db.user);
#ifndef TO_BE_REMOVED
    if (table->fields <=  9)
    {						// Without grant
      if (db.access & CREATE_ACL)
	db.access|=REFERENCES_ACL | INDEX_ACL | ALTER_ACL;
    }
#endif
    VOID(push_dynamic(&acl_dbs,(gptr) &db));
  }
  qsort((gptr) dynamic_element(&acl_dbs,0,ACL_DB*),acl_dbs.elements,
	sizeof(ACL_DB),(qsort_cmp) acl_compare);
  end_read_record(&read_record_info);
  freeze_size(&acl_dbs);
  init_check_host();

  mysql_unlock_tables(thd, lock);
336
  initialized=1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
337
  thd->version--;				// Force close to free memory
338 339 340
  return_val=0;

end:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
341 342
  close_thread_tables(thd);
  delete thd;
343 344
  if (org_thd)
    org_thd->store_globals();			/* purecov: inspected */
345 346 347 348 349
  else
  {
    /* Remember that we don't have a THD */
    my_pthread_setspecific_ptr(THR_THD,  0);
  }
350
  DBUG_RETURN(return_val);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
351 352 353 354 355
}


void acl_free(bool end)
{
356
  free_root(&mem,MYF(0));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
357 358 359 360 361 362 363 364 365 366 367 368 369 370
  delete_dynamic(&acl_hosts);
  delete_dynamic(&acl_users);
  delete_dynamic(&acl_dbs);
  delete_dynamic(&acl_wild_hosts);
  hash_free(&acl_check_hosts);
  if (!end)
    acl_cache->clear(1); /* purecov: inspected */
  else
  {
    delete acl_cache;
    acl_cache=0;
  }
}

371 372 373 374 375 376 377 378

/*
  Forget current privileges and read new privileges from the privilege tables

  SYNOPSIS
    acl_reload()
    thd			Thread handle
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
379

380
void acl_reload(THD *thd)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
381 382 383 384 385 386
{
  DYNAMIC_ARRAY old_acl_hosts,old_acl_users,old_acl_dbs;
  MEM_ROOT old_mem;
  bool old_initialized;
  DBUG_ENTER("acl_reload");

387
  if (thd && thd->locked_tables)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
388
  {					// Can't have locked tables here
389 390 391
    thd->lock=thd->locked_tables;
    thd->locked_tables=0;
    close_thread_tables(thd);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
392 393 394 395 396 397 398 399 400 401 402
  }
  if ((old_initialized=initialized))
    VOID(pthread_mutex_lock(&acl_cache->lock));

  old_acl_hosts=acl_hosts;
  old_acl_users=acl_users;
  old_acl_dbs=acl_dbs;
  old_mem=mem;
  delete_dynamic(&acl_wild_hosts);
  hash_free(&acl_check_hosts);

403
  if (acl_init(thd, 0))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
404
  {					// Error. Revert to old list
405
    acl_free();				/* purecov: inspected */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
406 407 408 409 410 411 412 413
    acl_hosts=old_acl_hosts;
    acl_users=old_acl_users;
    acl_dbs=old_acl_dbs;
    mem=old_mem;
    init_check_host();
  }
  else
  {
414
    free_root(&old_mem,MYF(0));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
415 416 417 418 419 420 421 422 423 424
    delete_dynamic(&old_acl_hosts);
    delete_dynamic(&old_acl_users);
    delete_dynamic(&old_acl_dbs);
  }
  if (old_initialized)
    VOID(pthread_mutex_unlock(&acl_cache->lock));
  DBUG_VOID_RETURN;
}


425 426
/*
  Get all access bits from table after fieldnr
427 428 429 430 431 432 433 434 435 436 437 438 439 440 441

  IMPLEMENTATION
    We know that the access privileges ends when there is no more fields
    or the field is not an enum with two elements.

  SYNOPSIS
    get_access()
    form        an open table to read privileges from.
                The record should be already read in table->record[0]
    fieldnr     number of the first privilege (that is ENUM('N','Y') field
    next_field  on return - number of the field next to the last ENUM
                (unless next_field == 0)

  RETURN VALUE
    privilege mask
442
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
443

444
static ulong get_access(TABLE *form, uint fieldnr, uint *next_field)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
445
{
446
  ulong access_bits=0,bit;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
447 448 449 450
  char buff[2];
  String res(buff,sizeof(buff));
  Field **pos;

451 452 453
  for (pos=form->field+fieldnr, bit=1;
       *pos && (*pos)->real_type() == FIELD_TYPE_ENUM &&
	 ((Field_enum*) (*pos))->typelib->count == 2 ;
454
       pos++, fieldnr++, bit<<=1)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
455 456 457
  {
    (*pos)->val_str(&res,&res);
    if (toupper(res[0]) == 'Y')
458
      access_bits|= bit;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
459
  }
460 461
  if (next_field)
    *next_field=fieldnr;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
462 463 464 465 466
  return access_bits;
}


/*
467 468 469 470 471
  Return a number which, if sorted 'desc', puts strings in this order:
    no wildcards
    wildcards
    empty string
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
472 473 474 475 476 477 478

static ulong get_sort(uint count,...)
{
  va_list args;
  va_start(args,count);
  ulong sort=0;

479 480 481
  /* Should not use this function with more than 4 arguments for compare. */
  DBUG_ASSERT(count <= 4);

bk@work.mysql.com's avatar
bk@work.mysql.com committed
482 483
  while (count--)
  {
484 485 486
    char *start, *str= va_arg(args,char*);
    uint chars= 0;
    uint wild_pos= 0;           /* first wildcard position */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
487

488
    if ((start= str))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
489 490 491 492
    {
      for (; *str ; str++)
      {
	if (*str == wild_many || *str == wild_one || *str == wild_prefix)
493 494 495 496
        {
          wild_pos= str - start + 1;
          break;
        }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
497 498 499 500
	else
	  chars++;
      }
    }
501 502
    sort= (sort << 8) + (wild_pos ? (wild_pos > 127 ? 127 : wild_pos) : 
                                    (chars ? 128 : 0));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518
  }
  va_end(args);
  return sort;
}


static int acl_compare(ACL_ACCESS *a,ACL_ACCESS *b)
{
  if (a->sort > b->sort)
    return -1;
  if (a->sort < b->sort)
    return 1;
  return 0;
}


monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
519 520 521 522 523
/*
  Get master privilges for user (priviliges for all tables).
  Required before connecting to MySQL
*/

524
ulong acl_getroot(THD *thd, const char *host, const char *ip, const char *user,
525
		  const char *password,const char *message,
526 527
		  char **priv_user, char *priv_host,
		  bool old_ver, USER_RESOURCES	*mqh)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
528
{
529
  ulong user_access=NO_ACCESS;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
530
  *priv_user=(char*) user;
531
  DBUG_ENTER("acl_getroot");
bk@work.mysql.com's avatar
bk@work.mysql.com committed
532

533
  bzero((char *)mqh,sizeof(USER_RESOURCES));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
534
  if (!initialized)
535 536 537 538
  {
    // If no data allow anything
    DBUG_RETURN((ulong) ~NO_ACCESS);		/* purecov: tested */
  }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556
  VOID(pthread_mutex_lock(&acl_cache->lock));

  /*
    Get possible access from user_list. This is or'ed to others not
    fully specified
  */
  for (uint i=0 ; i < acl_users.elements ; i++)
  {
    ACL_USER *acl_user=dynamic_element(&acl_users,i,ACL_USER*);
    if (!acl_user->user || !strcmp(user,acl_user->user))
    {
      if (compare_hostname(&acl_user->host,host,ip))
      {
	if (!acl_user->password && !*password ||
	    (acl_user->password && *password &&
	     !check_scramble(password,message,acl_user->salt,
			     (my_bool) old_ver)))
	{
557
	  Vio *vio=thd->net.vio;
558 559 560
#ifdef HAVE_OPENSSL
	  SSL *ssl= (SSL*) vio->ssl_arg;
#endif
561
	  /*
562 563 564 565
	    In this point we know that user is allowed to connect
	    from given host by given username/password pair. Now
	    we check if SSL is required, if user is using SSL and
	    if X509 certificate attributes are OK
566
	  */
567
	  switch (acl_user->ssl_type) {
568
	  case SSL_TYPE_NOT_SPECIFIED:		// Impossible
569
	  case SSL_TYPE_NONE: /* SSL is not required to connect */
570 571
	    user_access=acl_user->access;
	    break;
572
#ifdef HAVE_OPENSSL
573
	  case SSL_TYPE_ANY: /* Any kind of SSL is good enough */
574 575 576
	    if (vio_type(vio) == VIO_TYPE_SSL)
	      user_access=acl_user->access;
	    break;
577
	  case SSL_TYPE_X509: /* Client should have any valid certificate. */
578
	    /*
579
	      We need to check for absence of SSL because without SSL
580
	      we should reject connection.
581
	    */
582
	    if (vio_type(vio) == VIO_TYPE_SSL && 
583 584
	        SSL_get_verify_result(ssl) == X509_V_OK &&
	        SSL_get_peer_certificate(ssl))
585 586 587 588
	      user_access=acl_user->access;
	    break;
	  case SSL_TYPE_SPECIFIED: /* Client should have specified attrib */
	    /*
589 590
	      We need to check for absence of SSL because without SSL
	      we should reject connection.
591
	    */
592
	    if (vio_type(vio) == VIO_TYPE_SSL && 
593
	        SSL_get_verify_result(ssl) == X509_V_OK)
594
	    {
595
	      if (acl_user->ssl_cipher)
596
	      {
597 598
		DBUG_PRINT("info",("comparing ciphers: '%s' and '%s'",
				   acl_user->ssl_cipher,
599 600
				   SSL_get_cipher(ssl)));
		if (!strcmp(acl_user->ssl_cipher,SSL_get_cipher(ssl)))
601 602 603 604 605 606
		  user_access=acl_user->access;
		else
		{
		  if (global_system_variables.log_warnings)
		    sql_print_error("X509 ciphers mismatch: should be '%s' but is '%s'",
				    acl_user->ssl_cipher,
607
				    SSL_get_cipher(ssl));
608 609 610
		  user_access=NO_ACCESS;
		  break;
		}
611
	      }
612 613
	      /* Prepare certificate (if exists) */
	      DBUG_PRINT("info",("checkpoint 1"));
614
	      X509* cert=SSL_get_peer_certificate(ssl);
615 616 617 618 619
	      if (!cert)
	      {
		user_access=NO_ACCESS;
		break;
	      }
620 621
	      DBUG_PRINT("info",("checkpoint 2"));
	      /* If X509 issuer is speified, we check it... */
622
	      if (acl_user->x509_issuer)
623
	      {
624 625 626 627 628 629 630 631 632 633 634 635 636 637
		DBUG_PRINT("info",("checkpoint 3"));
		char *ptr = X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);
		DBUG_PRINT("info",("comparing issuers: '%s' and '%s'",
				   acl_user->x509_issuer, ptr));
		if (strcmp(acl_user->x509_issuer, ptr))
		{
		  if (global_system_variables.log_warnings)
		    sql_print_error("X509 issuer mismatch: should be '%s' but is '%s'",
				    acl_user->x509_issuer, ptr);
		  user_access=NO_ACCESS;
		  free(ptr);
		  break;
		}
		user_access=acl_user->access;
638 639
		free(ptr);
	      }
640 641 642
	      DBUG_PRINT("info",("checkpoint 4"));
	      /* X509 subject is specified, we check it .. */
	      if (acl_user->x509_subject)
643
	      {
644 645 646 647 648 649
		char *ptr= X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);
		DBUG_PRINT("info",("comparing subjects: '%s' and '%s'",
				   acl_user->x509_subject, ptr));
		if (strcmp(acl_user->x509_subject,ptr))
		{
		  if (global_system_variables.log_warnings)
650
		    sql_print_error("X509 subject mismatch: '%s' vs '%s'",
651 652 653 654 655 656
				    acl_user->x509_subject, ptr);
		  user_access=NO_ACCESS;
		}
		else
		  user_access=acl_user->access;
		free(ptr);
657
	      }
658
	      break;
659
	    }
660
#else  /* HAVE_OPENSSL */
661 662 663 664 665 666
          default:
            /*
                If we don't have SSL but SSL is required for this user the 
                authentication should fail.
            */
            break;
667
#endif /* HAVE_OPENSSL */
668 669
	  }
          
670
	  *mqh=acl_user->user_resource;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
671 672
	  if (!acl_user->user)
	    *priv_user=(char*) "";	// Change to anonymous user /* purecov: inspected */
673 674 675 676
	  if (acl_user->host.hostname)
	    strmake(priv_host, acl_user->host.hostname, MAX_HOSTNAME);
	  else
	    *priv_host= 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
677 678 679 680 681 682 683 684 685
	  break;
	}
#ifndef ALLOW_DOWNGRADE_OF_USERS
	break;				// Wrong password breaks loop /* purecov: inspected */
#endif
      }
    }
  }
  VOID(pthread_mutex_unlock(&acl_cache->lock));
686
  DBUG_RETURN(user_access);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702
}


/*
** Functions to add and change user and database privileges when one
** changes things with GRANT
*/

static byte* check_get_key(ACL_USER *buff,uint *length,
			   my_bool not_used __attribute__((unused)))
{
  *length=buff->hostname_length;
  return (byte*) buff->host.hostname;
}

static void acl_update_user(const char *user, const char *host,
703
			    const char *password,
704 705 706 707
			    enum SSL_type ssl_type,
			    const char *ssl_cipher,
			    const char *x509_issuer,
			    const char *x509_subject,
708
			    USER_RESOURCES  *mqh,
709
			    ulong privileges)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
710 711 712 713 714 715 716 717 718
{
  for (uint i=0 ; i < acl_users.elements ; i++)
  {
    ACL_USER *acl_user=dynamic_element(&acl_users,i,ACL_USER*);
    if (!acl_user->user && !user[0] ||
	acl_user->user &&
	!strcmp(user,acl_user->user))
    {
      if (!acl_user->host.hostname && !host[0] ||
719 720
	  acl_user->host.hostname &&
	  !my_strcasecmp(host,acl_user->host.hostname))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
721 722
      {
	acl_user->access=privileges;
723
	if (mqh->bits & 1)
724
	  acl_user->user_resource.questions=mqh->questions;
725
	if (mqh->bits & 2)
726
	  acl_user->user_resource.updates=mqh->updates;
727
	if (mqh->bits & 4)
728
	  acl_user->user_resource.connections=mqh->connections;
729 730 731 732 733 734 735 736 737 738
	if (ssl_type != SSL_TYPE_NOT_SPECIFIED)
	{
	  acl_user->ssl_type= ssl_type;
	  acl_user->ssl_cipher= (ssl_cipher ? strdup_root(&mem,ssl_cipher) :
				 0);
	  acl_user->x509_issuer= (x509_issuer ? strdup_root(&mem,x509_issuer) :
				  0);
	  acl_user->x509_subject= (x509_subject ?
				   strdup_root(&mem,x509_subject) : 0);
	}
bk@work.mysql.com's avatar
bk@work.mysql.com committed
739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756
	if (password)
	{
	  if (!password[0])
	    acl_user->password=0;
	  else
	  {
	    acl_user->password=(char*) "";	// Just point at something
	    get_salt_from_password(acl_user->salt,password);
	  }
	}
	break;
      }
    }
  }
}


static void acl_insert_user(const char *user, const char *host,
757
			    const char *password,
758 759 760 761
			    enum SSL_type ssl_type,
			    const char *ssl_cipher,
			    const char *x509_issuer,
			    const char *x509_subject,
762
			    USER_RESOURCES *mqh,
763
			    ulong privileges)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
764 765
{
  ACL_USER acl_user;
766
  acl_user.user=*user ? strdup_root(&mem,user) : 0;
767
  update_hostname(&acl_user.host, *host ? strdup_root(&mem,host): 0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
768 769
  acl_user.password=0;
  acl_user.access=privileges;
770
  acl_user.user_resource = *mqh;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
771
  acl_user.sort=get_sort(2,acl_user.host.hostname,acl_user.user);
772
  acl_user.hostname_length=(uint) strlen(host);
773 774 775 776 777
  acl_user.ssl_type= (ssl_type != SSL_TYPE_NOT_SPECIFIED ?
		      ssl_type : SSL_TYPE_NONE);
  acl_user.ssl_cipher=	ssl_cipher   ? strdup_root(&mem,ssl_cipher) : 0;
  acl_user.x509_issuer= x509_issuer  ? strdup_root(&mem,x509_issuer) : 0;
  acl_user.x509_subject=x509_subject ? strdup_root(&mem,x509_subject) : 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798
  if (password)
  {
    acl_user.password=(char*) "";		// Just point at something
    get_salt_from_password(acl_user.salt,password);
  }

  VOID(push_dynamic(&acl_users,(gptr) &acl_user));
  if (!acl_user.host.hostname || acl_user.host.hostname[0] == wild_many
      && !acl_user.host.hostname[1])
    allow_all_hosts=1;			// Anyone can connect /* purecov: tested */
  qsort((gptr) dynamic_element(&acl_users,0,ACL_USER*),acl_users.elements,
	sizeof(ACL_USER),(qsort_cmp) acl_compare);

  /* We must free acl_check_hosts as its memory is mapped to acl_user */
  delete_dynamic(&acl_wild_hosts);
  hash_free(&acl_check_hosts);
  init_check_host();
}


static void acl_update_db(const char *user, const char *host, const char *db,
799
			  ulong privileges)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
800 801 802 803 804 805 806 807 808
{
  for (uint i=0 ; i < acl_dbs.elements ; i++)
  {
    ACL_DB *acl_db=dynamic_element(&acl_dbs,i,ACL_DB*);
    if (!acl_db->user && !user[0] ||
	acl_db->user &&
	!strcmp(user,acl_db->user))
    {
      if (!acl_db->host.hostname && !host[0] ||
809
	  acl_db->host.hostname && !my_strcasecmp(host,acl_db->host.hostname))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
810 811 812 813 814 815 816 817 818 819 820 821 822 823 824
      {
	if (!acl_db->db && !db[0] ||
	    acl_db->db && !strcmp(db,acl_db->db))
	{
	  if (privileges)
	    acl_db->access=privileges;
	  else
	    delete_dynamic_element(&acl_dbs,i);
	}
      }
    }
  }
}


825 826 827 828 829 830 831 832 833 834 835 836 837 838
/*
  Insert a user/db/host combination into the global acl_cache

  SYNOPSIS
    acl_insert_db()
    user		User name
    host		Host name
    db			Database name
    privileges		Bitmap of privileges

  NOTES
    acl_cache->lock must be locked when calling this
*/

bk@work.mysql.com's avatar
bk@work.mysql.com committed
839
static void acl_insert_db(const char *user, const char *host, const char *db,
840
			  ulong privileges)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
841 842
{
  ACL_DB acl_db;
843
  safe_mutex_assert_owner(&acl_cache->lock);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
844 845 846 847 848 849 850 851 852 853 854
  acl_db.user=strdup_root(&mem,user);
  update_hostname(&acl_db.host,strdup_root(&mem,host));
  acl_db.db=strdup_root(&mem,db);
  acl_db.access=privileges;
  acl_db.sort=get_sort(3,acl_db.host.hostname,acl_db.db,acl_db.user);
  VOID(push_dynamic(&acl_dbs,(gptr) &acl_db));
  qsort((gptr) dynamic_element(&acl_dbs,0,ACL_DB*),acl_dbs.elements,
	sizeof(ACL_DB),(qsort_cmp) acl_compare);
}


855 856 857 858

/*
  Get privilege for a host, user and db combination
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
859

860
ulong acl_get(const char *host, const char *ip, const char *bin_ip,
861
	     const char *user, const char *db, my_bool db_is_pattern)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
862
{
863 864
  ulong host_access,db_access;
  uint i,key_length;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
865
  db_access=0; host_access= ~0;
866
  char key[ACL_KEY_LENGTH],*tmp_db,*end;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
867 868 869 870
  acl_entry *entry;

  VOID(pthread_mutex_lock(&acl_cache->lock));
  memcpy_fixed(&key,bin_ip,sizeof(struct in_addr));
871 872 873 874 875 876
  end=strmov((tmp_db=strmov(key+sizeof(struct in_addr),user)+1),db);
  if (lower_case_table_names)
  {
    casedn_str(tmp_db);
    db=tmp_db;
  }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894
  key_length=(uint) (end-key);
  if ((entry=(acl_entry*) acl_cache->search(key,key_length)))
  {
    db_access=entry->access;
    VOID(pthread_mutex_unlock(&acl_cache->lock));
    return db_access;
  }

  /*
    Check if there are some access rights for database and user
  */
  for (i=0 ; i < acl_dbs.elements ; i++)
  {
    ACL_DB *acl_db=dynamic_element(&acl_dbs,i,ACL_DB*);
    if (!acl_db->user || !strcmp(user,acl_db->user))
    {
      if (compare_hostname(&acl_db->host,host,ip))
      {
895
	if (!acl_db->db || !wild_compare(db,acl_db->db,db_is_pattern))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916
	{
	  db_access=acl_db->access;
	  if (acl_db->host.hostname)
	    goto exit;				// Fully specified. Take it
	  break; /* purecov: tested */
	}
      }
    }
  }
  if (!db_access)
    goto exit;					// Can't be better

  /*
    No host specified for user. Get hostdata from host table
  */
  host_access=0;				// Host must be found
  for (i=0 ; i < acl_hosts.elements ; i++)
  {
    ACL_HOST *acl_host=dynamic_element(&acl_hosts,i,ACL_HOST*);
    if (compare_hostname(&acl_host->host,host,ip))
    {
917
      if (!acl_host->db || !wild_compare(db,acl_host->db,0))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941
      {
	host_access=acl_host->access;		// Fully specified. Take it
	break;
      }
    }
  }
exit:
  /* Save entry in cache for quick retrieval */
  if ((entry= (acl_entry*) malloc(sizeof(acl_entry)+key_length)))
  {
    entry->access=(db_access & host_access);
    entry->length=key_length;
    memcpy((gptr) entry->key,key,key_length);
    acl_cache->add(entry);
  }
  VOID(pthread_mutex_unlock(&acl_cache->lock));
  return (db_access & host_access);
}


int wild_case_compare(const char *str,const char *wildstr)
{
  reg3 int flag;
  DBUG_ENTER("wild_case_compare");
942
  DBUG_PRINT("enter",("str: '%s'  wildstr: '%s'",str,wildstr));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
943 944 945 946 947 948 949 950 951 952 953
  while (*wildstr)
  {
    while (*wildstr && *wildstr != wild_many && *wildstr != wild_one)
    {
      if (*wildstr == wild_prefix && wildstr[1])
	wildstr++;
      if (toupper(*wildstr++) != toupper(*str++)) DBUG_RETURN(1);
    }
    if (! *wildstr ) DBUG_RETURN (*str != 0);
    if (*wildstr++ == wild_one)
    {
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
954
      if (! *str++) DBUG_RETURN (1);	/* One char; skip */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979
    }
    else
    {						/* Found '*' */
      if (!*wildstr) DBUG_RETURN(0);		/* '*' as last char: OK */
      flag=(*wildstr != wild_many && *wildstr != wild_one);
      do
      {
	if (flag)
	{
	  char cmp;
	  if ((cmp= *wildstr) == wild_prefix && wildstr[1])
	    cmp=wildstr[1];
	  cmp=toupper(cmp);
	  while (*str && toupper(*str) != cmp)
	    str++;
	  if (!*str) DBUG_RETURN (1);
	}
	if (wild_case_compare(str,wildstr) == 0) DBUG_RETURN (0);
      } while (*str++);
      DBUG_RETURN(1);
    }
  }
  DBUG_RETURN (*str != '\0');
}

980 981 982 983 984 985 986 987

/*
  Check if there are any possible matching entries for this host

  NOTES
    All host names without wild cards are stored in a hash table,
    entries with wildcards are stored in a dynamic array
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
988 989 990 991

static void init_check_host(void)
{
  DBUG_ENTER("init_check_host");
992
  VOID(my_init_dynamic_array(&acl_wild_hosts,sizeof(struct acl_host_and_ip),
bk@work.mysql.com's avatar
bk@work.mysql.com committed
993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016
			  acl_users.elements,1));
  VOID(hash_init(&acl_check_hosts,acl_users.elements,0,0,
		 (hash_get_key) check_get_key,0,HASH_CASE_INSENSITIVE));
  if (!allow_all_hosts)
  {
    for (uint i=0 ; i < acl_users.elements ; i++)
    {
      ACL_USER *acl_user=dynamic_element(&acl_users,i,ACL_USER*);
      if (strchr(acl_user->host.hostname,wild_many) ||
	  strchr(acl_user->host.hostname,wild_one) ||
	  acl_user->host.ip_mask)
      {						// Has wildcard
	uint j;
	for (j=0 ; j < acl_wild_hosts.elements ; j++)
	{					// Check if host already exists
	  acl_host_and_ip *acl=dynamic_element(&acl_wild_hosts,j,
					       acl_host_and_ip *);
	  if (!my_strcasecmp(acl_user->host.hostname,acl->hostname))
	    break;				// already stored
	}
	if (j == acl_wild_hosts.elements)	// If new
	  (void) push_dynamic(&acl_wild_hosts,(char*) &acl_user->host);
      }
      else if (!hash_search(&acl_check_hosts,(byte*) &acl_user->host,
1017
			    (uint) strlen(acl_user->host.hostname)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040
      {
	if (hash_insert(&acl_check_hosts,(byte*) acl_user))
	{					// End of memory
	  allow_all_hosts=1;			// Should never happen
	  DBUG_VOID_RETURN;
	}
      }
    }
  }
  freeze_size(&acl_wild_hosts);
  freeze_size(&acl_check_hosts.array);
  DBUG_VOID_RETURN;
}


/* Return true if there is no users that can match the given host */

bool acl_check_host(const char *host, const char *ip)
{
  if (allow_all_hosts)
    return 0;
  VOID(pthread_mutex_lock(&acl_cache->lock));

1041 1042
  if (host && hash_search(&acl_check_hosts,(byte*) host,(uint) strlen(host)) ||
      ip && hash_search(&acl_check_hosts,(byte*) ip,(uint) strlen(ip)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060
  {
    VOID(pthread_mutex_unlock(&acl_cache->lock));
    return 0;					// Found host
  }
  for (uint i=0 ; i < acl_wild_hosts.elements ; i++)
  {
    acl_host_and_ip *acl=dynamic_element(&acl_wild_hosts,i,acl_host_and_ip*);
    if (compare_hostname(acl, host, ip))
    {
      VOID(pthread_mutex_unlock(&acl_cache->lock));
      return 0;					// Host ok
    }
  }
  VOID(pthread_mutex_unlock(&acl_cache->lock));
  return 1;					// Host is not allowed
}


1061 1062 1063 1064 1065 1066 1067 1068
/*
  Check if the user is allowed to change password

  SYNOPSIS:
    check_change_password()
    thd		THD
    host	hostname for the user
    user	user name
monty@hundin.mysql.fi's avatar
merge  
monty@hundin.mysql.fi committed
1069

1070
    RETURN VALUE
1071 1072
      0		OK
      1		ERROR  ; In this case the error is sent to the client.
1073 1074 1075 1076
*/

bool check_change_password(THD *thd, const char *host, const char *user)
{
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1077 1078 1079
  if (!initialized)
  {
    send_error(&thd->net, ER_PASSWORD_NOT_ALLOWED); /* purecov: inspected */
1080
    return(1); /* purecov: inspected */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1081
  }
1082 1083
  if (!thd->slave_thread &&
      (strcmp(thd->user,user) ||
1084
       my_strcasecmp(host,thd->host_or_ip)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1085 1086
  {
    if (check_access(thd, UPDATE_ACL, "mysql",0,1))
1087
      return(1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1088
  }
1089 1090 1091
  if (!thd->slave_thread && !thd->user[0])
  {
    send_error(&thd->net, ER_PASSWORD_ANONYMOUS_USER);
1092
    return(1);
1093
  }
1094 1095 1096 1097
  return(0);
}


1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110
/*
  Change a password for a user

  SYNOPSIS
    change_password()
    thd			Thread handle
    host		Hostname
    user		User name
    new_password	New password for host@user

  RETURN VALUES
    0	ok
    1	ERROR; In this case the error is sent to the client.
1111
*/
1112

1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124
bool change_password(THD *thd, const char *host, const char *user,
		     char *new_password)
{
  uint length=0;
  DBUG_ENTER("change_password");
  DBUG_PRINT("enter",("host: '%s'  user: '%s'  new_password: '%s'",
		      host,user,new_password));
  DBUG_ASSERT(host != 0);			// Ensured by parent

  length=(uint) strlen(new_password);
  new_password[length & 16]=0;

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1125 1126
  VOID(pthread_mutex_lock(&acl_cache->lock));
  ACL_USER *acl_user;
1127
  if (!(acl_user= find_acl_user(host,user)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1128 1129 1130
  {
    send_error(&thd->net, ER_PASSWORD_NO_MATCH);
    VOID(pthread_mutex_unlock(&acl_cache->lock));
1131
    DBUG_RETURN(1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1132 1133 1134
  }
  if (update_user_table(thd,
			acl_user->host.hostname ? acl_user->host.hostname : "",
1135 1136
			acl_user->user ? acl_user->user : "",
			new_password))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1137 1138 1139
  {
    VOID(pthread_mutex_unlock(&acl_cache->lock)); /* purecov: deadcode */
    send_error(&thd->net,0); /* purecov: deadcode */
1140
    DBUG_RETURN(1); /* purecov: deadcode */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1141 1142 1143 1144 1145 1146 1147 1148 1149 1150
  }
  get_salt_from_password(acl_user->salt,new_password);
  if (!new_password[0])
    acl_user->password=0;
  else
    acl_user->password=(char*) "";		// Point at something
  acl_cache->clear(1);				// Clear locked hostname cache
  VOID(pthread_mutex_unlock(&acl_cache->lock));

  char buff[460];
1151
  ulong query_length=
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1152 1153
    my_sprintf(buff,
	       (buff,"SET PASSWORD FOR \"%-.120s\"@\"%-.120s\"=\"%-.120s\"",
1154
		acl_user->user ? acl_user->user : "",
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1155 1156
		acl_user->host.hostname ? acl_user->host.hostname : "",
		new_password));
guilhem@mysql.com's avatar
guilhem@mysql.com committed
1157
  thd->clear_error();
1158
  mysql_update_log.write(thd, buff, query_length);
1159
  Query_log_event qinfo(thd, buff, query_length, 0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1160
  mysql_bin_log.write(&qinfo);
1161
  DBUG_RETURN(0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1162 1163 1164 1165 1166 1167 1168 1169 1170 1171
}


/*
  Find first entry that matches the current user
*/

static ACL_USER *
find_acl_user(const char *host, const char *user)
{
1172
  DBUG_ENTER("find_acl_user");
1173
  DBUG_PRINT("enter",("host: '%s'  user: '%s'",host,user));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1174 1175 1176
  for (uint i=0 ; i < acl_users.elements ; i++)
  {
    ACL_USER *acl_user=dynamic_element(&acl_users,i,ACL_USER*);
1177
    DBUG_PRINT("info",("strcmp('%s','%s'), compare_hostname('%s','%s'),",
1178 1179 1180 1181 1182
		       user,
		       acl_user->user ? acl_user->user : "",
		       host,
		       acl_user->host.hostname ? acl_user->host.hostname :
		       ""));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1183 1184 1185
    if (!acl_user->user && !user[0] ||
	acl_user->user && !strcmp(user,acl_user->user))
    {
1186 1187 1188 1189
      if (compare_hostname(&(acl_user->host),host,host))
      {
	DBUG_RETURN(acl_user);
      }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1190 1191
    }
  }
1192
  DBUG_RETURN(0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1193 1194 1195
}


1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206
/*
  Comparing of hostnames

  NOTES
  A hostname may be of type:
  hostname   (May include wildcards);   monty.pp.sci.fi
  ip	   (May include wildcards);   192.168.0.0
  ip/netmask			      192.168.0.0/255.255.255.0

  A net mask of 0.0.0.0 is not allowed.
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229

static const char *calc_ip(const char *ip, long *val, char end)
{
  long ip_val,tmp;
  if (!(ip=str2int(ip,10,0,255,&ip_val)) || *ip != '.')
    return 0;
  ip_val<<=24;
  if (!(ip=str2int(ip+1,10,0,255,&tmp)) || *ip != '.')
    return 0;
  ip_val+=tmp<<16;
  if (!(ip=str2int(ip+1,10,0,255,&tmp)) || *ip != '.')
    return 0;
  ip_val+=tmp<<8;
  if (!(ip=str2int(ip+1,10,0,255,&tmp)) || *ip != end)
    return 0;
  *val=ip_val+tmp;
  return ip;
}


static void update_hostname(acl_host_and_ip *host, const char *hostname)
{
  host->hostname=(char*) hostname;		// This will not be modified!
1230
  if (!hostname ||
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1231 1232 1233
      (!(hostname=calc_ip(hostname,&host->ip,'/')) ||
       !(hostname=calc_ip(hostname+1,&host->ip_mask,'\0'))))
  {
1234
    host->ip= host->ip_mask=0;			// Not a masked ip
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248
  }
}


static bool compare_hostname(const acl_host_and_ip *host, const char *hostname,
			     const char *ip)
{
  long tmp;
  if (host->ip_mask && ip && calc_ip(ip,&tmp,'\0'))
  {
    return (tmp & host->ip_mask) == host->ip;
  }
  return (!host->hostname ||
	  (hostname && !wild_case_compare(hostname,host->hostname)) ||
1249
	  (ip && !wild_compare(ip,host->hostname,0)));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1250 1251 1252
}


1253 1254 1255
/*
  Update grants in the user and database privilege tables
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266

static bool update_user_table(THD *thd, const char *host, const char *user,
			      const char *new_password)
{
  TABLE_LIST tables;
  TABLE *table;
  bool error=1;
  DBUG_ENTER("update_user_table");
  DBUG_PRINT("enter",("user: %s  host: %s",user,host));

  bzero((char*) &tables,sizeof(tables));
1267
  tables.alias=tables.real_name=(char*) "user";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1268
  tables.db=(char*) "mysql";
1269 1270 1271 1272 1273 1274 1275 1276 1277
#ifdef HAVE_REPLICATION
  /*
    GRANT and REVOKE are applied the slave in/exclusion rules as they are
    some kind of updates to the mysql.% tables.
  */
  if (thd->slave_thread && table_rules_on)
  {
    /* 
       The tables must be marked "updating" so that tables_ok() takes them into
1278
       account in tests.  It's ok to leave 'updating' set after tables_ok.
1279
    */
1280
    tables.updating= 1;
1281 1282 1283 1284 1285 1286
    /* Thanks to bzero, tables.next==0 */
    if (!tables_ok(0, &tables))
      DBUG_RETURN(0);
  }
#endif

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1287 1288
  if (!(table=open_ltable(thd,&tables,TL_WRITE)))
    DBUG_RETURN(1); /* purecov: deadcode */
1289 1290
  table->field[0]->store(host,(uint) strlen(host));
  table->field[1]->store(user,(uint) strlen(user));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1291 1292 1293 1294 1295

  if (table->file->index_read_idx(table->record[0],0,
				  (byte*) table->field[0]->ptr,0,
				  HA_READ_KEY_EXACT))
  {
1296
    my_error(ER_PASSWORD_NO_MATCH,MYF(0));	/* purecov: deadcode */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1297 1298 1299
    DBUG_RETURN(1);				/* purecov: deadcode */
  }
  store_record(table,1);
1300
  table->field[2]->store(new_password,(uint) strlen(new_password));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312
  if ((error=table->file->update_row(table->record[1],table->record[0])))
  {
    table->file->print_error(error,MYF(0));	/* purecov: deadcode */
    goto end;					/* purecov: deadcode */
  }
  error=0;					// Record updated

end:
  close_thread_tables(thd);
  DBUG_RETURN(error);
}

monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1313 1314 1315 1316 1317 1318 1319 1320 1321

/* Return 1 if we are allowed to create new users */

static bool test_if_create_new_users(THD *thd)
{
  bool create_new_users=1;    // Assume that we are allowed to create new users
  if (opt_safe_user_create && !(thd->master_access & INSERT_ACL))
  {
    TABLE_LIST tl;
1322
    ulong db_access;
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1323 1324
    bzero((char*) &tl,sizeof(tl));
    tl.db=	   (char*) "mysql";
1325
    tl.real_name=  (char*) "user";
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1326
    db_access=acl_get(thd->host, thd->ip, (char*) &thd->remote.sin_addr,
1327
		      thd->priv_user, tl.db, 0);
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1328 1329 1330 1331 1332 1333 1334 1335 1336 1337
    if (!(db_access & INSERT_ACL))
    {
      if (check_grant(thd,INSERT_ACL,&tl,0,1))
	create_new_users=0;
    }
  }
  return create_new_users;
}


bk@work.mysql.com's avatar
bk@work.mysql.com committed
1338
/****************************************************************************
1339
  Handle GRANT commands
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1340 1341
****************************************************************************/

1342
static int replace_user_table(THD *thd, TABLE *table, const LEX_USER &combo,
1343 1344
			      ulong rights, bool revoke_grant,
			      bool create_user)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1345 1346
{
  int error = -1;
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1347
  bool old_row_exists=0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1348
  char *password,empty_string[1];
1349
  char what= (revoke_grant) ? 'N' : 'Y';
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1350
  DBUG_ENTER("replace_user_table");
1351
  safe_mutex_assert_owner(&acl_cache->lock);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1352

1353 1354
  password=empty_string;
  empty_string[0]=0;
1355

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1356
  if (combo.password.str && combo.password.str[0])
1357
  {
1358
    if (combo.password.length != HASH_PASSWORD_LENGTH)
1359
    {
1360
      my_printf_error(ER_PASSWORD_NO_MATCH,
1361 1362
		      "Password hash should be a %d-digit hexadecimal number",
		      MYF(0),HASH_PASSWORD_LENGTH);
1363
      DBUG_RETURN(-1);
1364
    }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1365
    password=combo.password.str;
1366
  }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1367 1368 1369 1370 1371 1372 1373 1374

  table->field[0]->store(combo.host.str,combo.host.length);
  table->field[1]->store(combo.user.str,combo.user.length);
  table->file->index_init(0);
  if (table->file->index_read(table->record[0],
			      (byte*) table->field[0]->ptr,0,
			      HA_READ_KEY_EXACT))
  {
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1375
    if (!create_user)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1376
    {
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1377 1378 1379 1380
      if (what == 'N')
	my_printf_error(ER_NONEXISTING_GRANT,ER(ER_NONEXISTING_GRANT),
			MYF(0),combo.user.str,combo.host.str);
      else
1381 1382
	my_printf_error(ER_NO_PERMISSION_TO_CREATE_USER,
			ER(ER_NO_PERMISSION_TO_CREATE_USER),
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1383
			MYF(0),thd->user,
1384
			thd->host_or_ip);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1385 1386 1387
      error= -1;
      goto end;
    }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1388
    old_row_exists = 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1389 1390 1391
    restore_record(table,2);			// cp empty row from record[2]
    table->field[0]->store(combo.host.str,combo.host.length);
    table->field[1]->store(combo.user.str,combo.user.length);
1392
    table->field[2]->store(password,(uint) strlen(password));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1393 1394 1395
  }
  else
  {
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1396
    old_row_exists = 1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1397 1398
    store_record(table,1);			// Save copy for update
    if (combo.password.str)			// If password given
1399
      table->field[2]->store(password,(uint) strlen(password));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1400 1401
  }

1402 1403 1404 1405
  /* Update table columns with new privileges */

  Field **tmp_field;
  ulong priv;
1406
  uint next_field;
1407 1408 1409 1410
  for (tmp_field= table->field+3, priv = SELECT_ACL;
       *tmp_field && (*tmp_field)->real_type() == FIELD_TYPE_ENUM &&
	 ((Field_enum*) (*tmp_field))->typelib->count == 2 ;
       tmp_field++, priv <<= 1)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1411
  {
1412 1413
    if (priv & rights)				 // set requested privileges
      (*tmp_field)->store(&what,1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1414
  }
1415
  rights= get_access(table, 3, &next_field);
1416
  DBUG_PRINT("info",("table->fields: %d",table->fields));
1417
  if (table->fields >= 31)		/* From 4.0.0 we have more fields */
1418
  {
1419
    /* We write down SSL related ACL stuff */
1420 1421
    switch (thd->lex.ssl_type) {
    case SSL_TYPE_ANY:
1422 1423 1424 1425
      table->field[next_field]->store("ANY", 3);
      table->field[next_field+1]->store("", 0);
      table->field[next_field+2]->store("", 0);
      table->field[next_field+3]->store("", 0);
1426 1427
      break;
    case SSL_TYPE_X509:
1428 1429 1430 1431
      table->field[next_field]->store("X509", 4);
      table->field[next_field+1]->store("", 0);
      table->field[next_field+2]->store("", 0);
      table->field[next_field+3]->store("", 0);
1432 1433
      break;
    case SSL_TYPE_SPECIFIED:
1434 1435 1436 1437
      table->field[next_field]->store("SPECIFIED", 9);
      table->field[next_field+1]->store("", 0);
      table->field[next_field+2]->store("", 0);
      table->field[next_field+3]->store("", 0);
1438
      if (thd->lex.ssl_cipher)
1439 1440
        table->field[next_field+1]->store(thd->lex.ssl_cipher,
                                          strlen(thd->lex.ssl_cipher));
1441
      if (thd->lex.x509_issuer)
1442 1443
        table->field[next_field+2]->store(thd->lex.x509_issuer,
                                          strlen(thd->lex.x509_issuer));
1444
      if (thd->lex.x509_subject)
1445 1446
        table->field[next_field+3]->store(thd->lex.x509_subject,
                                          strlen(thd->lex.x509_subject));
1447
      break;
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
1448
    case SSL_TYPE_NOT_SPECIFIED:
gluh@gluh.(none)'s avatar
gluh@gluh.(none) committed
1449 1450
      break;
    case SSL_TYPE_NONE:
1451 1452 1453 1454
      table->field[next_field]->store("", 0);
      table->field[next_field+1]->store("", 0);
      table->field[next_field+2]->store("", 0);
      table->field[next_field+3]->store("", 0);
gluh@gluh.(none)'s avatar
gluh@gluh.(none) committed
1455
      break;
1456
    }
1457

1458 1459 1460
    /* Skip over SSL related fields to first user limits related field */
    next_field+= 4;

1461
    USER_RESOURCES mqh = thd->lex.mqh;
1462
    if (mqh.bits & 1)
1463
      table->field[next_field]->store((longlong) mqh.questions);
1464
    if (mqh.bits & 2)
1465
      table->field[next_field+1]->store((longlong) mqh.updates);
1466
    if (mqh.bits & 4)
1467
      table->field[next_field+2]->store((longlong) mqh.connections);
1468
    mqh_used = mqh_used || mqh.questions || mqh.updates || mqh.connections;
1469
  }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1470
  if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495
  {
    /*
      We should NEVER delete from the user table, as a uses can still
      use mysqld even if he doesn't have any privileges in the user table!
    */
    if (cmp_record(table,1) &&
	(error=table->file->update_row(table->record[1],table->record[0])))
    {						// This should never happen
      table->file->print_error(error,MYF(0));	/* purecov: deadcode */
      error= -1;				/* purecov: deadcode */
      goto end;					/* purecov: deadcode */
    }
  }
  else if ((error=table->file->write_row(table->record[0]))) // insert
  {						// This should never happen
    if (error && error != HA_ERR_FOUND_DUPP_KEY &&
	error != HA_ERR_FOUND_DUPP_UNIQUE)	/* purecov: inspected */
    {
      table->file->print_error(error,MYF(0));	/* purecov: deadcode */
      error= -1;				/* purecov: deadcode */
      goto end;					/* purecov: deadcode */
    }
  }
  error=0;					// Privileges granted / revoked

1496
end:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1497 1498 1499 1500 1501
  if (!error)
  {
    acl_cache->clear(1);			// Clear privilege cache
    if (!combo.password.str)
      password=0;				// No password given on command
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1502
    if (old_row_exists)
1503
      acl_update_user(combo.user.str,combo.host.str,password,
1504 1505 1506 1507
		      thd->lex.ssl_type,
		      thd->lex.ssl_cipher,
		      thd->lex.x509_issuer,
		      thd->lex.x509_subject,
1508
		      &thd->lex.mqh,
1509
		      rights);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1510
    else
1511
      acl_insert_user(combo.user.str,combo.host.str,password,
1512 1513 1514 1515
		      thd->lex.ssl_type,
		      thd->lex.ssl_cipher,
		      thd->lex.x509_issuer,
		      thd->lex.x509_subject,
1516
		      &thd->lex.mqh,
1517
		      rights);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1518 1519 1520 1521 1522 1523 1524
  }
  table->file->index_end();
  DBUG_RETURN(error);
}


/*
1525
  change grants in the mysql.db table
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1526 1527 1528 1529
*/

static int replace_db_table(TABLE *table, const char *db,
			    const LEX_USER &combo,
1530
			    ulong rights, bool revoke_grant)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1531
{
1532 1533
  uint i;
  ulong priv,store_rights;
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1534
  bool old_row_exists=0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1535
  int error;
1536
  char what= (revoke_grant) ? 'N' : 'Y';
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1537 1538
  DBUG_ENTER("replace_db_table");

1539
  /* Check if there is such a user in user table in memory? */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1540 1541
  if (!initialized || !find_acl_user(combo.host.str,combo.user.str))
  {
1542
    my_error(ER_PASSWORD_NO_MATCH,MYF(0));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1543 1544 1545 1546
    DBUG_RETURN(-1);
  }

  table->field[0]->store(combo.host.str,combo.host.length);
1547
  table->field[1]->store(db,(uint) strlen(db));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1548 1549 1550
  table->field[2]->store(combo.user.str,combo.user.length);
  table->file->index_init(0);
  if (table->file->index_read(table->record[0],(byte*) table->field[0]->ptr,0,
1551
			      HA_READ_KEY_EXACT))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1552 1553 1554 1555 1556 1557 1558
  {
    if (what == 'N')
    { // no row, no revoke
      my_printf_error(ER_NONEXISTING_GRANT,ER(ER_NONEXISTING_GRANT),MYF(0),
		      combo.user.str,combo.host.str);
      goto abort;
    }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1559
    old_row_exists = 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1560 1561
    restore_record(table,2);			// cp empty row from record[2]
    table->field[0]->store(combo.host.str,combo.host.length);
1562
    table->field[1]->store(db,(uint) strlen(db));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1563 1564 1565 1566
    table->field[2]->store(combo.user.str,combo.user.length);
  }
  else
  {
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1567
    old_row_exists = 1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1568 1569 1570 1571
    store_record(table,1);
  }

  store_rights=get_rights_for_db(rights);
1572
  for (i= 3, priv= 1; i < table->fields; i++, priv <<= 1)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1573
  {
1574
    if (priv & store_rights)			// do it if priv is chosen
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1575 1576
      table->field [i]->store(&what,1);		// set requested privileges
  }
1577
  rights=get_access(table,3,0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1578 1579
  rights=fix_rights_for_db(rights);

monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1580
  if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1581
  {
1582
    /* update old existing row */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593
    if (rights)
    {
      if ((error=table->file->update_row(table->record[1],table->record[0])))
	goto table_error;			/* purecov: deadcode */
    }
    else	/* must have been a revoke of all privileges */
    {
      if ((error = table->file->delete_row(table->record[1])))
	goto table_error;			/* purecov: deadcode */
    }
  }
1594
  else if (rights && (error=table->file->write_row(table->record[0])))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1595 1596 1597 1598 1599 1600
  {
    if (error && error != HA_ERR_FOUND_DUPP_KEY) /* purecov: inspected */
      goto table_error; /* purecov: deadcode */
  }

  acl_cache->clear(1);				// Clear privilege cache
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1601
  if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1602 1603
    acl_update_db(combo.user.str,combo.host.str,db,rights);
  else
1604
  if (rights)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1605 1606 1607 1608 1609
    acl_insert_db(combo.user.str,combo.host.str,db,rights);
  table->file->index_end();
  DBUG_RETURN(0);

  /* This could only happen if the grant tables got corrupted */
1610
table_error:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1611 1612 1613
  table->file->print_error(error,MYF(0));	/* purecov: deadcode */
  table->file->index_end();

1614
abort:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1615 1616 1617 1618 1619 1620 1621 1622
  DBUG_RETURN(-1);
}


class GRANT_COLUMN :public Sql_alloc
{
public:
  char *column;
1623 1624 1625
  ulong rights;
  uint key_length;
  GRANT_COLUMN(String &c,  ulong y) :rights (y)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1626
  {
1627
    column= memdup_root(&memex,c.ptr(), key_length=c.length());
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1628 1629 1630
  }
};

1631

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1632 1633 1634 1635 1636 1637 1638
static byte* get_key_column(GRANT_COLUMN *buff,uint *length,
			    my_bool not_used __attribute__((unused)))
{
  *length=buff->key_length;
  return (byte*) buff->column;
}

1639

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1640 1641 1642
class GRANT_TABLE :public Sql_alloc
{
public:
1643
  char *host,*db,*user,*tname, *hash_key, *orig_host;
1644
  ulong privs, cols;
1645
  ulong sort;
1646
  uint key_length;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1647
  HASH hash_columns;
1648 1649 1650 1651 1652
  GRANT_TABLE(const char *h, const char *d,const char *u, const char *t,
              ulong p, ulong c);
  GRANT_TABLE(TABLE *form, TABLE *col_privs);
  bool ok() { return privs != 0 || cols != 0; }
};
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1653

1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667

GRANT_TABLE::GRANT_TABLE(const char *h, const char *d,const char *u,
                         const char *t, ulong p, ulong c)
  :privs(p), cols(c)
{
  /* Host given by user */
  orig_host=  strdup_root(&memex,h);
  /* Convert empty hostname to '%' for easy comparision */
  host=  orig_host[0] ? orig_host : (char*) "%";
  db =   strdup_root(&memex,d);
  user = strdup_root(&memex,u);
  sort=  get_sort(3,host,db,user);
  tname= strdup_root(&memex,t);
  if (lower_case_table_names)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1668
  {
1669 1670 1671 1672 1673 1674 1675 1676 1677
    casedn_str(db);
    casedn_str(tname);
  }
  key_length =(uint) strlen(d)+(uint) strlen(u)+(uint) strlen(t)+3;
  hash_key = (char*) alloc_root(&memex,key_length);
  strmov(strmov(strmov(hash_key,user)+1,db)+1,tname);
  (void) hash_init(&hash_columns,0,0,0, (hash_get_key) get_key_column,0,
                   HASH_CASE_INSENSITIVE);
}
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1678

1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734

GRANT_TABLE::GRANT_TABLE(TABLE *form, TABLE *col_privs)
{
  byte key[MAX_KEY_LENGTH];

  orig_host= host= get_field(&memex,form,0);
  db =    get_field(&memex,form,1);
  user =  get_field(&memex,form,2);
  if (!user)
    user= (char*) "";
  if (!orig_host)
  {
    orig_host= (char*) "";
    host= (char*) "%";
  }
  sort=   get_sort(3,orig_host,db,user);
  tname = get_field(&memex,form,3);
  if (!db || !tname)
  {
    /* Wrong table row; Ignore it */
    privs = cols = 0;				/* purecov: inspected */
    return;					/* purecov: inspected */
  }
  if (lower_case_table_names)
  {
    casedn_str(db);
    casedn_str(tname);
  }
  key_length = ((uint) strlen(db) + (uint) strlen(user) +
                (uint) strlen(tname) + 3);
  hash_key = (char*) alloc_root(&memex,key_length);
  strmov(strmov(strmov(hash_key,user)+1,db)+1,tname);
  privs = (ulong) form->field[6]->val_int();
  cols  = (ulong) form->field[7]->val_int();
  privs = fix_rights_for_table(privs);
  cols =  fix_rights_for_column(cols);

  (void) hash_init(&hash_columns,0,0,0, (hash_get_key) get_key_column,0,
                   HASH_CASE_INSENSITIVE);
  if (cols)
  {
    int key_len;
    col_privs->field[0]->store(orig_host,(uint) strlen(orig_host));
    col_privs->field[1]->store(db,(uint) strlen(db));
    col_privs->field[2]->store(user,(uint) strlen(user));
    col_privs->field[3]->store(tname,(uint) strlen(tname));
    key_len=(col_privs->field[0]->pack_length()+
             col_privs->field[1]->pack_length()+
             col_privs->field[2]->pack_length()+
             col_privs->field[3]->pack_length());
    key_copy(key,col_privs,0,key_len);
    col_privs->field[4]->store("",0);
    col_privs->file->index_init(0);
    if (col_privs->file->index_read(col_privs->record[0],
                                    (byte*) col_privs->field[0]->ptr,
                                    key_len, HA_READ_KEY_EXACT))
1735
    {
1736 1737
      cols = 0; /* purecov: deadcode */
      return;
1738
    }
1739
    do
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1740
    {
1741 1742 1743 1744 1745 1746 1747
      String *res,column_name;
      GRANT_COLUMN *mem_check;
      /* As column name is a string, we don't have to supply a buffer */
      res=col_privs->field[4]->val_str(&column_name,&column_name);
      ulong priv= (ulong) col_privs->field[6]->val_int();
      if (!(mem_check = new GRANT_COLUMN(*res,
                                         fix_rights_for_column(priv))))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1748
      {
1749 1750 1751
        /* Don't use this entry */
        privs = cols = 0;			/* purecov: deadcode */
        return;				/* purecov: deadcode */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1752
      }
1753 1754 1755
      hash_insert(&hash_columns, (byte *) mem_check);
    } while (!col_privs->file->index_next(col_privs->record[0]) &&
             !key_cmp(col_privs,key,0,key_len));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1756
  }
1757
}
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1758

1759

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1760 1761 1762 1763 1764 1765 1766
static byte* get_grant_table(GRANT_TABLE *buff,uint *length,
			     my_bool not_used __attribute__((unused)))
{
  *length=buff->key_length;
  return (byte*) buff->hash_key;
}

1767

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1768 1769 1770 1771 1772
void free_grant_table(GRANT_TABLE *grant_table)
{
  hash_free(&grant_table->hash_columns);
}

1773

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1774 1775 1776 1777 1778 1779 1780 1781 1782 1783
/* Search after a matching grant. Prefer exact grants before not exact ones */

static GRANT_TABLE *table_hash_search(const char *host,const char* ip,
				      const char *db,
				      const char *user, const char *tname,
				      bool exact)
{
  char helping [NAME_LEN*2+USERNAME_LENGTH+3];
  uint len;
  GRANT_TABLE *grant_table,*found=0;
1784
  safe_mutex_assert_owner(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1785 1786 1787 1788 1789 1790 1791 1792 1793

  len  = (uint) (strmov(strmov(strmov(helping,user)+1,db)+1,tname)-helping)+ 1;
  for (grant_table=(GRANT_TABLE*) hash_search(&hash_tables,(byte*) helping,
					      len) ;
       grant_table ;
       grant_table= (GRANT_TABLE*) hash_next(&hash_tables,(byte*) helping,len))
  {
    if (exact)
    {
1794
      if ((host && !my_strcasecmp(host,grant_table->host)) ||
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1795 1796 1797 1798 1799
	  (ip && !strcmp(ip,grant_table->host)))
	return grant_table;
    }
    else
    {
1800 1801 1802 1803
      if (((host && !wild_case_compare(host,grant_table->host)) ||
	  (ip && !wild_case_compare(ip,grant_table->host))) &&
          (!found || found->sort < grant_table->sort))
	found=grant_table;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1804 1805 1806 1807 1808 1809 1810
    }
  }
  return found;
}



1811
inline GRANT_COLUMN *
1812
column_hash_search(GRANT_TABLE *t, const char *cname, uint length)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1813 1814 1815 1816 1817 1818 1819 1820 1821
{
  return (GRANT_COLUMN*) hash_search(&t->hash_columns, (byte*) cname,length);
}


static int replace_column_table(GRANT_TABLE *g_t,
				TABLE *table, const LEX_USER &combo,
				List <LEX_COLUMN> &columns,
				const char *db, const char *table_name,
1822
				ulong rights, bool revoke_grant)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1823 1824 1825 1826 1827 1828 1829
{
  int error=0,result=0;
  uint key_length;
  byte key[MAX_KEY_LENGTH];
  DBUG_ENTER("replace_column_table");

  table->field[0]->store(combo.host.str,combo.host.length);
1830
  table->field[1]->store(db,(uint) strlen(db));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1831
  table->field[2]->store(combo.user.str,combo.user.length);
1832
  table->field[3]->store(table_name,(uint) strlen(table_name));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845
  key_length=(table->field[0]->pack_length()+ table->field[1]->pack_length()+
	      table->field[2]->pack_length()+ table->field[3]->pack_length());
  key_copy(key,table,0,key_length);

  rights &= COL_ACLS;				// Only ACL for columns

  /* first fix privileges for all columns in column list */

  List_iterator <LEX_COLUMN> iter(columns);
  class LEX_COLUMN *xx;
  table->file->index_init(0);
  while ((xx=iter++))
  {
1846
    ulong privileges = xx->rights;
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1847
    bool old_row_exists=0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861
    key_restore(table,key,0,key_length);
    table->field[4]->store(xx->column.ptr(),xx->column.length());

    if (table->file->index_read(table->record[0],(byte*) table->field[0]->ptr,
				0, HA_READ_KEY_EXACT))
    {
      if (revoke_grant)
      {
	my_printf_error(ER_NONEXISTING_TABLE_GRANT,
			ER(ER_NONEXISTING_TABLE_GRANT),MYF(0),
			combo.user.str, combo.host.str,table_name); /* purecov: inspected */
	result= -1; /* purecov: inspected */
	continue; /* purecov: inspected */
      }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1862
      old_row_exists = 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1863 1864 1865 1866 1867 1868
      restore_record(table,2);			// Get empty record
      key_restore(table,key,0,key_length);
      table->field[4]->store(xx->column.ptr(),xx->column.length());
    }
    else
    {
1869
      ulong tmp= (ulong) table->field[6]->val_int();
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1870 1871 1872 1873 1874 1875
      tmp=fix_rights_for_column(tmp);

      if (revoke_grant)
	privileges = tmp & ~(privileges | rights);
      else
	privileges |= tmp;
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1876
      old_row_exists = 1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1877 1878 1879 1880 1881
      store_record(table,1);			// copy original row
    }

    table->field[6]->store((longlong) get_rights_for_column(privileges));

monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1882
    if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925
    {
      if (privileges)
	error=table->file->update_row(table->record[1],table->record[0]);
      else
	error=table->file->delete_row(table->record[1]);
      if (error)
      {
	table->file->print_error(error,MYF(0)); /* purecov: inspected */
	result= -1;				/* purecov: inspected */
	goto end;				/* purecov: inspected */
      }
      GRANT_COLUMN *grant_column = column_hash_search(g_t,
						      xx->column.ptr(),
						      xx->column.length());
      if (grant_column)				// Should always be true
	grant_column->rights = privileges;	// Update hash
    }
    else					// new grant
    {
      if ((error=table->file->write_row(table->record[0])))
      {
	table->file->print_error(error,MYF(0)); /* purecov: inspected */
	result= -1;				/* purecov: inspected */
	goto end;				/* purecov: inspected */
      }
      GRANT_COLUMN *grant_column = new GRANT_COLUMN(xx->column,privileges);
      hash_insert(&g_t->hash_columns,(byte*) grant_column);
    }
  }
  table->file->index_end();

  /*
    If revoke of privileges on the table level, remove all such privileges
    for all columns
  */

  if (revoke_grant)
  {
    table->file->index_init(0);
    if (table->file->index_read(table->record[0], (byte*) table->field[0]->ptr,
				key_length, HA_READ_KEY_EXACT))
      goto end;

1926
    /* Scan through all rows with the same host,db,user and table */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1927 1928
    do
    {
1929
      ulong privileges = (ulong) table->field[6]->val_int();
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975
      privileges=fix_rights_for_column(privileges);
      store_record(table,1);

      if (privileges & rights)	// is in this record the priv to be revoked ??
      {
	GRANT_COLUMN *grant_column = NULL;
	char  colum_name_buf[HOSTNAME_LENGTH+1];
	String column_name(colum_name_buf,sizeof(colum_name_buf));

	privileges&= ~rights;
	table->field[6]->store((longlong)
			       get_rights_for_column(privileges));
	table->field[4]->val_str(&column_name,&column_name);
	grant_column = column_hash_search(g_t,
					  column_name.ptr(),
					  column_name.length());
	if (privileges)
	{
	  int tmp_error;
	  if ((tmp_error=table->file->update_row(table->record[1],
						 table->record[0])))
	  {					/* purecov: deadcode */
	    table->file->print_error(tmp_error,MYF(0)); /* purecov: deadcode */
	    result= -1;				/* purecov: deadcode */
	    goto end;				/* purecov: deadcode */
	  }
	  if (grant_column)
	    grant_column->rights  = privileges; // Update hash
	}
	else
	{
	  int tmp_error;
	  if ((tmp_error = table->file->delete_row(table->record[1])))
	  {					/* purecov: deadcode */
	    table->file->print_error(tmp_error,MYF(0)); /* purecov: deadcode */
	    result= -1;				/* purecov: deadcode */
	    goto end;				/* purecov: deadcode */
	  }
	  if (grant_column)
	    hash_delete(&g_t->hash_columns,(byte*) grant_column);
	}
      }
    } while (!table->file->index_next(table->record[0]) &&
	     !key_cmp(table,key,0,key_length));
  }

1976
end:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1977 1978 1979 1980 1981 1982 1983 1984
  table->file->index_end();
  DBUG_RETURN(result);
}


static int replace_table_table(THD *thd, GRANT_TABLE *grant_table,
			       TABLE *table, const LEX_USER &combo,
			       const char *db, const char *table_name,
1985 1986
			       ulong rights, ulong col_rights,
			       bool revoke_grant)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1987
{
1988
  char grantor[HOSTNAME_LENGTH+USERNAME_LENGTH+2];
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1989
  int old_row_exists = 1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1990
  int error=0;
1991
  ulong store_table_rights, store_col_rights;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1992
  DBUG_ENTER("replace_table_table");
1993
  safe_mutex_assert_owner(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1994

1995
  strxmov(grantor, thd->user, "@", thd->host_or_ip, NullS);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1996

1997 1998 1999 2000
  /*
    The following should always succeed as new users are created before
    this function is called!
  */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2001 2002 2003 2004 2005 2006 2007 2008
  if (!find_acl_user(combo.host.str,combo.user.str))
  {
    my_error(ER_PASSWORD_NO_MATCH,MYF(0));	/* purecov: deadcode */
    DBUG_RETURN(-1);				/* purecov: deadcode */
  }

  restore_record(table,2);			// Get empty record
  table->field[0]->store(combo.host.str,combo.host.length);
2009
  table->field[1]->store(db,(uint) strlen(db));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2010
  table->field[2]->store(combo.user.str,combo.user.length);
2011
  table->field[3]->store(table_name,(uint) strlen(table_name));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030
  store_record(table,1);			// store at pos 1

  if (table->file->index_read_idx(table->record[0],0,
				  (byte*) table->field[0]->ptr,0,
				  HA_READ_KEY_EXACT))
  {
    /*
      The following should never happen as we first check the in memory
      grant tables for the user.  There is however always a small change that
      the user has modified the grant tables directly.
    */
    if (revoke_grant)
    { // no row, no revoke
      my_printf_error(ER_NONEXISTING_TABLE_GRANT,
		      ER(ER_NONEXISTING_TABLE_GRANT),MYF(0),
		      combo.user.str,combo.host.str,
		      table_name);		/* purecov: deadcode */
      DBUG_RETURN(-1);				/* purecov: deadcode */
    }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2031
    old_row_exists = 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2032 2033 2034
    restore_record(table,1);			// Get saved record
  }

2035 2036
  store_table_rights= get_rights_for_table(rights);
  store_col_rights=   get_rights_for_column(col_rights);
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2037
  if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2038
  {
2039
    ulong j,k;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2040
    store_record(table,1);
2041 2042
    j = (ulong) table->field[6]->val_int();
    k = (ulong) table->field[7]->val_int();
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2043 2044 2045

    if (revoke_grant)
    {
2046
      /* column rights are already fixed in mysql_table_grant */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2047 2048 2049 2050
      store_table_rights=j & ~store_table_rights;
    }
    else
    {
2051 2052
      store_table_rights|= j;
      store_col_rights|=   k;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2053 2054 2055
    }
  }

2056
  table->field[4]->store(grantor,(uint) strlen(grantor));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2057 2058 2059
  table->field[6]->store((longlong) store_table_rights);
  table->field[7]->store((longlong) store_col_rights);
  rights=fix_rights_for_table(store_table_rights);
2060
  col_rights=fix_rights_for_column(store_col_rights);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2061

monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2062
  if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078
  {
    if (store_table_rights || store_col_rights)
    {
      if ((error=table->file->update_row(table->record[1],table->record[0])))
	goto table_error;			/* purecov: deadcode */
    }
    else if ((error = table->file->delete_row(table->record[1])))
      goto table_error;				/* purecov: deadcode */
  }
  else
  {
    error=table->file->write_row(table->record[0]);
    if (error && error != HA_ERR_FOUND_DUPP_KEY)
      goto table_error;				/* purecov: deadcode */
  }

2079
  if (rights | col_rights)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2080
  {
2081
    grant_table->privs= rights;
2082
    grant_table->cols=	col_rights;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2083 2084 2085 2086 2087 2088 2089
  }
  else
  {
    hash_delete(&hash_tables,(byte*) grant_table);
  }
  DBUG_RETURN(0);

2090 2091
  /* This should never happen */
table_error:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2092 2093 2094 2095 2096
  table->file->print_error(error,MYF(0)); /* purecov: deadcode */
  DBUG_RETURN(-1); /* purecov: deadcode */
}


2097 2098 2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110 2111 2112 2113
/*
  Store table level and column level grants in the privilege tables

  SYNOPSIS
    mysql_table_grant()
    thd			Thread handle
    table_list		List of tables to give grant
    user_list		List of users to give grant
    columns		List of columns to give grant
    rights		Table level grant
    revoke_grant	Set to 1 if this is a REVOKE command

  RETURN
    0	ok
    1	error
*/

2114 2115 2116 2117
int mysql_table_grant(THD *thd, TABLE_LIST *table_list,
		      List <LEX_USER> &user_list,
		      List <LEX_COLUMN> &columns, ulong rights,
		      bool revoke_grant)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2118
{
2119
  ulong column_priv= 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2120 2121 2122
  List_iterator <LEX_USER> str_list (user_list);
  LEX_USER *Str;
  TABLE_LIST tables[3];
2123
  bool create_new_users=0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2124 2125 2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138 2139
  DBUG_ENTER("mysql_table_grant");

  if (!initialized)
  {
    send_error(&(thd->net), ER_UNKNOWN_COM_ERROR); /* purecov: inspected */
    return 1;					/* purecov: inspected */
  }
  if (rights & ~TABLE_ACLS)
  {
    my_error(ER_ILLEGAL_GRANT_FOR_TABLE,MYF(0));
    DBUG_RETURN(-1);
  }

  if (columns.elements && !revoke_grant)
  {
    TABLE *table;
2140 2141
    class LEX_COLUMN *column;
    List_iterator <LEX_COLUMN> column_iter(columns);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2142 2143 2144

    if (!(table=open_ltable(thd,table_list,TL_READ)))
      DBUG_RETURN(-1);
2145
    while ((column = column_iter++))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2146
    {
2147 2148
      if (!find_field_in_table(thd,table,column->column.ptr(),
			       column->column.length(),0,0))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2149 2150
      {
	my_printf_error(ER_BAD_FIELD_ERROR,ER(ER_BAD_FIELD_ERROR),MYF(0),
2151
			column->column.c_ptr(), table_list->alias);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2152 2153
	DBUG_RETURN(-1);
      }
2154
      column_priv|= column->rights;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2155 2156 2157 2158 2159 2160
    }
    close_thread_tables(thd);
  }
  else if (!(rights & CREATE_ACL) && !revoke_grant)
  {
    char buf[FN_REFLEN];
2161 2162
    sprintf(buf,"%s/%s/%s.frm",mysql_data_home, table_list->db,
	    table_list->real_name);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2163 2164 2165
    fn_format(buf,buf,"","",4+16+32);
    if (access(buf,F_OK))
    {
2166
      my_error(ER_NO_SUCH_TABLE,MYF(0),table_list->db, table_list->alias);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2167 2168 2169 2170 2171 2172 2173
      DBUG_RETURN(-1);
    }
  }

  /* open the mysql.tables_priv and mysql.columns_priv tables */

  bzero((char*) &tables,sizeof(tables));
2174 2175 2176
  tables[0].alias=tables[0].real_name= (char*) "user";
  tables[1].alias=tables[1].real_name= (char*) "tables_priv";
  tables[2].alias=tables[2].real_name= (char*) "columns_priv";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2177 2178 2179 2180 2181 2182 2183 2184
  tables[0].next=tables+1;
  /* Don't open column table if we don't need it ! */
  tables[1].next=((column_priv ||
		   (revoke_grant && ((rights & COL_ACLS) || columns.elements)))
		  ? tables+2 : 0);
  tables[0].lock_type=tables[1].lock_type=tables[2].lock_type=TL_WRITE;
  tables[0].db=tables[1].db=tables[2].db=(char*) "mysql";

2185 2186 2187 2188 2189
#ifdef HAVE_REPLICATION
  /*
    GRANT and REVOKE are applied the slave in/exclusion rules as they are
    some kind of updates to the mysql.% tables.
  */
2190 2191 2192 2193 2194 2195
  if (thd->slave_thread && table_rules_on)
  {
    /* 
       The tables must be marked "updating" so that tables_ok() takes them into
       account in tests.
    */
2196
    tables[0].updating= tables[1].updating= tables[2].updating= 1;
2197 2198 2199
    if (!tables_ok(0, tables))
      DBUG_RETURN(0);
  }
2200 2201
#endif

bk@work.mysql.com's avatar
bk@work.mysql.com committed
2202 2203 2204 2205 2206 2207
  if (open_and_lock_tables(thd,tables))
  {						// Should never happen
    close_thread_tables(thd);			/* purecov: deadcode */
    DBUG_RETURN(-1);				/* purecov: deadcode */
  }

2208 2209
  if (!revoke_grant)
    create_new_users= test_if_create_new_users(thd);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2210 2211 2212 2213 2214 2215 2216
  int result=0;
  pthread_mutex_lock(&LOCK_grant);
  MEM_ROOT *old_root=my_pthread_getspecific_ptr(MEM_ROOT*,THR_MALLOC);
  my_pthread_setspecific_ptr(THR_MALLOC,&memex);

  while ((Str = str_list++))
  {
2217
    int error;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2218 2219 2220 2221 2222 2223 2224 2225 2226 2227 2228 2229 2230 2231
    GRANT_TABLE *grant_table;
    if (!Str->host.str)
    {
      Str->host.str=(char*) "%";
      Str->host.length=1;
    }
    if (Str->host.length > HOSTNAME_LENGTH ||
	Str->user.length > USERNAME_LENGTH)
    {
      my_error(ER_GRANT_WRONG_HOST_OR_USER,MYF(0));
      result= -1;
      continue;
    }
    /* Create user if needed */
2232
    pthread_mutex_lock(&acl_cache->lock);
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2233 2234
    error=replace_user_table(thd, tables[0].table, *Str,
			     0, revoke_grant, create_new_users);
2235 2236
    pthread_mutex_unlock(&acl_cache->lock);
    if (error)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2237 2238 2239 2240 2241 2242 2243 2244
    {
      result= -1;				// Remember error
      continue;					// Add next user
    }

    /* Find/create cached table grant */
    grant_table= table_hash_search(Str->host.str,NullS,table_list->db,
				   Str->user.str,
2245
				   table_list->real_name,1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2246 2247 2248 2249 2250 2251
    if (!grant_table)
    {
      if (revoke_grant)
      {
	my_printf_error(ER_NONEXISTING_TABLE_GRANT,
			ER(ER_NONEXISTING_TABLE_GRANT),MYF(0),
2252
			Str->user.str, Str->host.str, table_list->real_name);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2253 2254 2255 2256 2257
	result= -1;
	continue;
      }
      grant_table = new GRANT_TABLE (Str->host.str,table_list->db,
				     Str->user.str,
2258
				     table_list->real_name,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271
				     rights,
				     column_priv);
      if (!grant_table)				// end of memory
      {
	result= -1;				/* purecov: deadcode */
	continue;				/* purecov: deadcode */
      }
      hash_insert(&hash_tables,(byte*) grant_table);
    }

    /* If revoke_grant, calculate the new column privilege for tables_priv */
    if (revoke_grant)
    {
2272 2273
      class LEX_COLUMN *column;
      List_iterator <LEX_COLUMN> column_iter(columns);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2274 2275 2276
      GRANT_COLUMN *grant_column;

      /* Fix old grants */
2277
      while ((column = column_iter++))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2278 2279
      {
	grant_column = column_hash_search(grant_table,
2280 2281
					  column->column.ptr(),
					  column->column.length());
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2282
	if (grant_column)
2283
	  grant_column->rights&= ~(column->rights | rights);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2284 2285
      }
      /* scan trough all columns to get new column grant */
2286
      column_priv= 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2287 2288 2289 2290 2291 2292 2293 2294 2295 2296
      for (uint idx=0 ; idx < grant_table->hash_columns.records ; idx++)
      {
	grant_column= (GRANT_COLUMN*) hash_element(&grant_table->hash_columns,
						   idx);
	grant_column->rights&= ~rights;		// Fix other columns
	column_priv|= grant_column->rights;
      }
    }
    else
    {
2297
      column_priv|= grant_table->cols;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2298 2299 2300 2301 2302 2303 2304
    }


    /* update table and columns */

    if (replace_table_table(thd,grant_table,tables[1].table,*Str,
			    table_list->db,
2305
			    table_list->real_name,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2306 2307 2308 2309
			    rights, column_priv, revoke_grant))
    {						// Crashend table ??
      result= -1;			       /* purecov: deadcode */
    }
2310
    else if (tables[2].table)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2311 2312 2313 2314
    {
      if ((replace_column_table(grant_table,tables[2].table, *Str,
				columns,
				table_list->db,
2315
				table_list->real_name,
2316
				rights, revoke_grant)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2317 2318 2319 2320 2321 2322 2323 2324 2325 2326
      {
	result= -1;
      }
    }
  }
  grant_option=TRUE;
  my_pthread_setspecific_ptr(THR_MALLOC,old_root);
  pthread_mutex_unlock(&LOCK_grant);
  if (!result)
    send_ok(&thd->net);
2327
  /* Tables are automatically closed */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2328 2329 2330 2331
  DBUG_RETURN(result);
}


2332 2333
int mysql_grant(THD *thd, const char *db, List <LEX_USER> &list,
                ulong rights, bool revoke_grant)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2334 2335 2336
{
  List_iterator <LEX_USER> str_list (list);
  LEX_USER *Str;
2337
  char tmp_db[NAME_LEN+1];
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2338
  bool create_new_users=0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2339 2340 2341 2342 2343 2344
  TABLE_LIST tables[2];
  DBUG_ENTER("mysql_grant");

  if (!initialized)
  {
    send_error(&(thd->net), ER_UNKNOWN_COM_ERROR); /* purecov: tested */
2345
    DBUG_RETURN(1); /* purecov: tested */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2346 2347
  }

2348 2349 2350 2351 2352 2353
  if (lower_case_table_names && db)
  {
    strmov(tmp_db,db);
    casedn_str(tmp_db);
    db=tmp_db;
  }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2354 2355 2356

  /* open the mysql.user and mysql.db tables */

2357 2358
  tables[0].alias=tables[0].real_name=(char*) "user";
  tables[1].alias=tables[1].real_name=(char*) "db";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2359 2360 2361 2362 2363
  tables[0].next=tables+1;
  tables[1].next=0;
  tables[0].lock_type=tables[1].lock_type=TL_WRITE;
  tables[0].db=tables[1].db=(char*) "mysql";
  tables[0].table=tables[1].table=0;
2364 2365 2366 2367 2368 2369

#ifdef HAVE_REPLICATION
  /*
    GRANT and REVOKE are applied the slave in/exclusion rules as they are
    some kind of updates to the mysql.% tables.
  */
2370 2371 2372 2373 2374 2375
  if (thd->slave_thread && table_rules_on)
  {
    /* 
       The tables must be marked "updating" so that tables_ok() takes them into
       account in tests.
    */
2376
    tables[0].updating= tables[1].updating= 1;
2377 2378 2379
    if (!tables_ok(0, tables))
      DBUG_RETURN(0);
  }
2380 2381
#endif

bk@work.mysql.com's avatar
bk@work.mysql.com committed
2382 2383 2384 2385 2386 2387
  if (open_and_lock_tables(thd,tables))
  {						// This should never happen
    close_thread_tables(thd);			/* purecov: deadcode */
    DBUG_RETURN(-1);				/* purecov: deadcode */
  }

monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2388 2389
  if (!revoke_grant)
    create_new_users= test_if_create_new_users(thd);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2390

2391
  /* go through users in user_list */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2392 2393 2394 2395 2396 2397 2398 2399 2400 2401 2402 2403 2404 2405 2406 2407 2408 2409 2410
  pthread_mutex_lock(&LOCK_grant);
  VOID(pthread_mutex_lock(&acl_cache->lock));
  grant_version++;

  int result=0;
  while ((Str = str_list++))
  {
    if (!Str->host.str)
    {
      Str->host.str=(char*) "%";
      Str->host.length=1;
    }
    if (Str->host.length > HOSTNAME_LENGTH ||
	Str->user.length > USERNAME_LENGTH)
    {
      my_error(ER_GRANT_WRONG_HOST_OR_USER,MYF(0));
      result= -1;
      continue;
    }
2411
    if ((replace_user_table(thd,
2412
			    tables[0].table,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2413
			    *Str,
2414 2415
			    (!db ? rights : 0), revoke_grant,
			    create_new_users)))
2416
      result= -1;
2417
    else if (db)
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2418
    {
2419 2420 2421 2422 2423 2424 2425 2426 2427
      ulong db_rights= rights & DB_ACLS;
      if (db_rights  == rights)
      {
	if (replace_db_table(tables[1].table, db, *Str, db_rights,
			     revoke_grant))
	  result= -1;
      }
      else
      {
2428
	net_printf(&thd->net,ER_WRONG_USAGE,"DB GRANT","GLOBAL PRIVILEGES");
2429
	result= 1;
2430
      }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2431
    }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2432 2433 2434 2435 2436 2437 2438 2439 2440 2441
  }
  VOID(pthread_mutex_unlock(&acl_cache->lock));
  pthread_mutex_unlock(&LOCK_grant);
  close_thread_tables(thd);

  if (!result)
    send_ok(&thd->net);
  DBUG_RETURN(result);
}

2442 2443

/* Free grant array if possible */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2444 2445 2446 2447 2448 2449

void  grant_free(void)
{
  DBUG_ENTER("grant_free");
  grant_option = FALSE;
  hash_free(&hash_tables);
2450
  free_root(&memex,MYF(0));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2451 2452 2453 2454 2455 2456
  DBUG_VOID_RETURN;
}


/* Init grant array if possible */

2457
my_bool grant_init(THD *org_thd)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2458
{
2459
  THD  *thd;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2460
  TABLE_LIST tables[2];
2461 2462
  MYSQL_LOCK *lock;
  my_bool return_val= 1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2463 2464 2465 2466 2467 2468
  TABLE *t_table, *c_table;
  DBUG_ENTER("grant_init");

  grant_option = FALSE;
  (void) hash_init(&hash_tables,0,0,0, (hash_get_key) get_grant_table,
		   (hash_free_key) free_grant_table,0);
2469
  init_sql_alloc(&memex, ACL_ALLOC_BLOCK_SIZE, 0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2470

2471
  /* Don't do anything if running with --skip-grant */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2472 2473
  if (!initialized)
    DBUG_RETURN(0);				/* purecov: tested */
2474

bk@work.mysql.com's avatar
bk@work.mysql.com committed
2475 2476
  if (!(thd=new THD))
    DBUG_RETURN(1);				/* purecov: deadcode */
2477
  thd->store_globals();
2478 2479
  thd->db= my_strdup("mysql",MYF(0));
  thd->db_length=5;				// Safety
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2480
  bzero((char*) &tables,sizeof(tables));
2481 2482
  tables[0].alias=tables[0].real_name= (char*) "tables_priv";
  tables[1].alias=tables[1].real_name= (char*) "columns_priv";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2483 2484 2485 2486 2487
  tables[0].next=tables+1;
  tables[0].lock_type=tables[1].lock_type=TL_READ;
  tables[0].db=tables[1].db=thd->db;

  if (open_tables(thd,tables))
2488 2489
    goto end;

bk@work.mysql.com's avatar
bk@work.mysql.com committed
2490 2491 2492
  TABLE *ptr[2];				// Lock tables for quick update
  ptr[0]= tables[0].table;
  ptr[1]= tables[1].table;
2493 2494
  if (!(lock=mysql_lock_tables(thd,ptr,2)))
    goto end;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2495 2496 2497 2498 2499 2500

  t_table = tables[0].table; c_table = tables[1].table;
  t_table->file->index_init(0);
  if (t_table->file->index_first(t_table->record[0]))
  {
    t_table->file->index_end();
2501
    return_val= 0;
2502
    goto end_unlock;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2503
  }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2504
  grant_option= TRUE;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2505 2506
  t_table->file->index_end();

2507
  /* Will be restored by org_thd->store_globals() */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2508
  my_pthread_setspecific_ptr(THR_MALLOC,&memex);
2509
  do
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2510 2511 2512 2513 2514 2515
  {
    GRANT_TABLE *mem_check;
    if (!(mem_check=new GRANT_TABLE(t_table,c_table)) ||
	mem_check->ok() && hash_insert(&hash_tables,(byte*) mem_check))
    {
      /* This could only happen if we are out memory */
2516
      grant_option= FALSE;			/* purecov: deadcode */
2517
      goto end_unlock;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2518 2519
    }
  }
2520 2521 2522 2523 2524
  while (!t_table->file->index_next(t_table->record[0]));

  return_val=0;					// Return ok

end_unlock:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2525 2526
  mysql_unlock_tables(thd, lock);
  thd->version--;				// Force close to free memory
2527 2528

end:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2529 2530
  close_thread_tables(thd);
  delete thd;
2531 2532
  if (org_thd)
    org_thd->store_globals();
2533 2534 2535 2536 2537
  else
  {
    /* Remember that we don't have a THD */
    my_pthread_setspecific_ptr(THR_THD,  0);
  }
2538
  DBUG_RETURN(return_val);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2539 2540 2541
}


2542 2543 2544 2545 2546 2547 2548 2549 2550 2551
/*
  Reload grant array if possible

  SYNOPSIS
    grant_reload()
    thd			Thread handler

  NOTES
    Locked tables are checked by acl_init and doesn't have to be checked here
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2552

2553
void grant_reload(THD *thd)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2554
{
2555 2556
  HASH old_hash_tables;
  bool old_grant_option;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2557 2558 2559 2560 2561 2562
  MEM_ROOT old_mem;
  DBUG_ENTER("grant_reload");

  pthread_mutex_lock(&LOCK_grant);
  grant_version++;
  old_hash_tables=hash_tables;
2563
  old_grant_option= grant_option;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2564 2565
  old_mem = memex;

2566
  if (grant_init(thd))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2567 2568 2569
  {						// Error. Revert to old hash
    grant_free();				/* purecov: deadcode */
    hash_tables=old_hash_tables;		/* purecov: deadcode */
2570
    grant_option= old_grant_option;		/* purecov: deadcode */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2571 2572 2573 2574 2575
    memex = old_mem;				/* purecov: deadcode */
  }
  else
  {
    hash_free(&old_hash_tables);
2576
    free_root(&old_mem,MYF(0));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2577 2578 2579 2580 2581 2582 2583
  }
  pthread_mutex_unlock(&LOCK_grant);
  DBUG_VOID_RETURN;
}


/****************************************************************************
2584
  Check table level grants
2585
  All errors are written directly to the client if no_errors is given !
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2586 2587
****************************************************************************/

2588
bool check_grant(THD *thd, ulong want_access, TABLE_LIST *tables,
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2589
		 uint show_table, bool no_errors)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2590 2591 2592 2593 2594 2595 2596 2597 2598 2599 2600 2601 2602 2603 2604 2605
{
  TABLE_LIST *table;
  char *user = thd->priv_user;

  want_access &= ~thd->master_access;
  if (!want_access)
    return 0;					// ok

  pthread_mutex_lock(&LOCK_grant);
  for (table=tables; table ;table=table->next)
  {
    if (!(~table->grant.privilege & want_access))
    {
      table->grant.want_privilege=0;
      continue;					// Already checked
    }
2606 2607
    GRANT_TABLE *grant_table = table_hash_search(thd->host,thd->ip,
						 table->db,user,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2608 2609 2610 2611 2612 2613
						 table->real_name,0);
    if (!grant_table)
    {
      want_access &= ~table->grant.privilege;
      goto err;					// No grants
    }
monty@tramp.mysql.fi's avatar
monty@tramp.mysql.fi committed
2614 2615
    if (show_table)
      continue;					// We have some priv on this
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630 2631 2632 2633 2634

    table->grant.grant_table=grant_table;	// Remember for column test
    table->grant.version=grant_version;
    table->grant.privilege|= grant_table->privs;
    table->grant.want_privilege= ((want_access & COL_ACLS)
				  & ~table->grant.privilege);

    if (!(~table->grant.privilege & want_access))
      continue;

    if (want_access & ~(grant_table->cols | table->grant.privilege))
    {
      want_access &= ~(grant_table->cols | table->grant.privilege);
      goto err;					// impossible
    }
  }
  pthread_mutex_unlock(&LOCK_grant);
  return 0;

2635
err:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2636
  pthread_mutex_unlock(&LOCK_grant);
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2637
  if (!no_errors)				// Not a silent skip of table
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2638 2639 2640
  {
    const char *command="";
    if (want_access & SELECT_ACL)
2641
      command ="select";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656 2657 2658 2659 2660
    else if (want_access & INSERT_ACL)
      command = "insert";
    else if (want_access & UPDATE_ACL)
      command = "update";
    else if (want_access & DELETE_ACL)
      command = "delete";
    else if (want_access & DROP_ACL)
      command = "drop";
    else if (want_access & CREATE_ACL)
      command = "create";
    else if (want_access & ALTER_ACL)
      command = "alter";
    else if (want_access & INDEX_ACL)
      command = "index";
    else if (want_access & GRANT_ACL)
      command = "grant";
    net_printf(&thd->net,ER_TABLEACCESS_DENIED_ERROR,
	       command,
	       thd->priv_user,
2661
	       thd->host_or_ip,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2662 2663 2664 2665 2666 2667
	       table ? table->real_name : "unknown");
  }
  return 1;
}


2668 2669
bool check_grant_column(THD *thd,TABLE *table, const char *name,
			uint length, uint show_tables)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2670 2671 2672 2673
{
  GRANT_TABLE *grant_table;
  GRANT_COLUMN *grant_column;

2674
  ulong want_access=table->grant.want_privilege;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2675 2676
  if (!want_access)
    return 0;					// Already checked
2677 2678
  if (!grant_option)
    goto err2;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2679 2680 2681

  pthread_mutex_lock(&LOCK_grant);

2682
  /* reload table if someone has modified any grants */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2683 2684 2685 2686

  if (table->grant.version != grant_version)
  {
    table->grant.grant_table=
2687
      table_hash_search(thd->host, thd->ip, table->table_cache_key,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2688
			thd->priv_user,
2689
			table->real_name, 0);	/* purecov: inspected */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709
    table->grant.version=grant_version;		/* purecov: inspected */
  }
  if (!(grant_table=table->grant.grant_table))
    goto err;					/* purecov: deadcode */

  grant_column=column_hash_search(grant_table, name, length);
  if (grant_column && !(~grant_column->rights & want_access))
  {
    pthread_mutex_unlock(&LOCK_grant);
    return 0;
  }
#ifdef NOT_USED
  if (show_tables && (grant_column || table->grant.privilege & COL_ACLS))
  {
    pthread_mutex_unlock(&LOCK_grant);		/* purecov: deadcode */
    return 0;					/* purecov: deadcode */
  }
#endif

  /* We must use my_printf_error() here! */
2710
err:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2711
  pthread_mutex_unlock(&LOCK_grant);
2712
err2:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2713 2714
  if (!show_tables)
  {
2715 2716
    char command[128];
    get_privilege_desc(command, sizeof(command), want_access);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2717 2718 2719 2720 2721
    my_printf_error(ER_COLUMNACCESS_DENIED_ERROR,
		    ER(ER_COLUMNACCESS_DENIED_ERROR),
		    MYF(0),
		    command,
		    thd->priv_user,
2722
		    thd->host_or_ip,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2723 2724 2725 2726 2727 2728 2729
		    name,
		    table ? table->real_name : "unknown");
  }
  return 1;
}


2730
bool check_grant_all_columns(THD *thd, ulong want_access, TABLE *table)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741
{
  GRANT_TABLE *grant_table;
  GRANT_COLUMN *grant_column;
  Field *field=0,**ptr;

  want_access &= ~table->grant.privilege;
  if (!want_access)
    return 0;					// Already checked

  pthread_mutex_lock(&LOCK_grant);

2742
  /* reload table if someone has modified any grants */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2743 2744 2745 2746

  if (table->grant.version != grant_version)
  {
    table->grant.grant_table=
2747
      table_hash_search(thd->host, thd->ip, table->table_cache_key,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2748 2749 2750 2751
			thd->priv_user,
			table->real_name,0);	/* purecov: inspected */
    table->grant.version=grant_version;		/* purecov: inspected */
  }
2752
  /* The following should always be true */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2753 2754 2755 2756 2757 2758
  if (!(grant_table=table->grant.grant_table))
    goto err;					/* purecov: inspected */

  for (ptr=table->field; (field= *ptr) ; ptr++)
  {
    grant_column=column_hash_search(grant_table, field->field_name,
2759
				    (uint) strlen(field->field_name));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2760 2761 2762 2763 2764 2765 2766
    if (!grant_column || (~grant_column->rights & want_access))
      goto err;
  }
  pthread_mutex_unlock(&LOCK_grant);
  return 0;

  /* We must use my_printf_error() here! */
2767
err:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2768 2769 2770 2771 2772 2773 2774 2775 2776 2777 2778 2779
  pthread_mutex_unlock(&LOCK_grant);

  const char *command="";
  if (want_access & SELECT_ACL)
    command ="select";
  else if (want_access & INSERT_ACL)
    command = "insert";
  my_printf_error(ER_COLUMNACCESS_DENIED_ERROR,
		  ER(ER_COLUMNACCESS_DENIED_ERROR),
		  MYF(0),
		  command,
		  thd->priv_user,
2780
		  thd->host_or_ip,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2781 2782 2783 2784 2785 2786
		  field ? field->field_name : "unknown",
		  table->real_name);
  return 1;
}


2787
/*
2788 2789 2790
  Check if a user has the right to access a database
  Access is accepted if he has a grant for any table in the database
  Return 1 if access is denied
2791
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2792 2793 2794 2795 2796 2797 2798 2799 2800 2801 2802 2803 2804 2805 2806 2807 2808 2809 2810 2811 2812 2813 2814 2815 2816 2817 2818

bool check_grant_db(THD *thd,const char *db)
{
  char helping [NAME_LEN+USERNAME_LENGTH+2];
  uint len;
  bool error=1;

  len  = (uint) (strmov(strmov(helping,thd->priv_user)+1,db)-helping)+ 1;
  pthread_mutex_lock(&LOCK_grant);

  for (uint idx=0 ; idx < hash_tables.records ; idx++)
  {
    GRANT_TABLE *grant_table = (GRANT_TABLE*) hash_element(&hash_tables,idx);
    if (len < grant_table->key_length &&
	!memcmp(grant_table->hash_key,helping,len) &&
	(thd->host && !wild_case_compare(thd->host,grant_table->host) ||
	 (thd->ip && !wild_case_compare(thd->ip,grant_table->host))))
    {
      error=0;					// Found match
      break;
    }
  }
  pthread_mutex_unlock(&LOCK_grant);
  return error;
}

/*****************************************************************************
2819
  Functions to retrieve the grant for a table/column  (for SHOW functions)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2820 2821
*****************************************************************************/

2822
ulong get_table_grant(THD *thd, TABLE_LIST *table)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2823
{
2824
  uint privilege;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2825 2826 2827 2828 2829 2830
  char *user = thd->priv_user;
  const char *db = table->db ? table->db : thd->db;
  GRANT_TABLE *grant_table;

  pthread_mutex_lock(&LOCK_grant);
  grant_table = table_hash_search(thd->host,thd->ip,db,user,
2831
				  table->real_name, 0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2832 2833 2834 2835
  table->grant.grant_table=grant_table; // Remember for column test
  table->grant.version=grant_version;
  if (grant_table)
    table->grant.privilege|= grant_table->privs;
2836
  privilege= table->grant.privilege;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2837
  pthread_mutex_unlock(&LOCK_grant);
2838
  return privilege;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2839 2840 2841
}


2842
ulong get_column_grant(THD *thd, TABLE_LIST *table, Field *field)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2843 2844 2845
{
  GRANT_TABLE *grant_table;
  GRANT_COLUMN *grant_column;
2846
  ulong priv;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2847 2848

  pthread_mutex_lock(&LOCK_grant);
2849
  /* reload table if someone has modified any grants */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2850 2851 2852
  if (table->grant.version != grant_version)
  {
    table->grant.grant_table=
2853
      table_hash_search(thd->host, thd->ip, table->db,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2854 2855 2856 2857 2858 2859 2860 2861 2862 2863
			thd->priv_user,
			table->real_name,0);	/* purecov: inspected */
    table->grant.version=grant_version;		/* purecov: inspected */
  }

  if (!(grant_table=table->grant.grant_table))
    priv=table->grant.privilege;
  else
  {
    grant_column=column_hash_search(grant_table, field->field_name,
2864
				    (uint) strlen(field->field_name));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2865 2866 2867 2868 2869 2870 2871 2872 2873
    if (!grant_column)
      priv=table->grant.privilege;
    else
      priv=table->grant.privilege | grant_column->rights;
  }
  pthread_mutex_unlock(&LOCK_grant);
  return priv;
}

2874
/* Help function for mysql_show_grants */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2875

2876 2877 2878 2879 2880 2881 2882 2883 2884 2885 2886 2887
static void add_user_option(String *grant, ulong value, const char *name)
{
  if (value)
  {
    char buff[22], *p; // just as in int2str
    grant->append(' ');
    grant->append(name, strlen(name));
    grant->append(' ');
    p=int10_to_str(value, buff, 10);
    grant->append(buff,p-buff);
  }
}
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2888 2889

static const char *command_array[]=
2890 2891 2892 2893 2894 2895
{
  "SELECT", "INSERT","UPDATE","DELETE","CREATE", "DROP", "RELOAD","SHUTDOWN",
  "PROCESS","FILE","GRANT","REFERENCES","INDEX", "ALTER", "SHOW DATABASES",
  "SUPER", "CREATE TEMPORARY TABLES", "LOCK TABLES", "EXECUTE",
  "REPLICATION SLAVE", "REPLICATION CLIENT",
};
2896

2897 2898 2899 2900 2901
static uint command_lengths[]=
{
  6,6,6,6,6,4,6,8,7,4,5,10,5,5,14,5,23,11,7,17,18
};

bk@work.mysql.com's avatar
bk@work.mysql.com committed
2902

2903 2904 2905 2906 2907 2908 2909 2910
/*
  SHOW GRANTS;  Send grants for a user to the client

  IMPLEMENTATION
   Send to client grant-like strings depicting user@host privileges
*/

int mysql_show_grants(THD *thd,LEX_USER *lex_user)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2911
{
2912 2913
  ulong want_access;
  uint counter,index;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2914 2915 2916
  int  error = 0;
  ACL_USER *acl_user; ACL_DB *acl_db;
  char buff[1024];
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
2917
  DBUG_ENTER("mysql_show_grants");
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2918 2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943

  LINT_INIT(acl_user);
  if (!initialized)
  {
    send_error(&(thd->net), ER_UNKNOWN_COM_ERROR);
    DBUG_RETURN(-1);
  }
  if (!lex_user->host.str)
  {
    lex_user->host.str=(char*) "%";
    lex_user->host.length=1;
  }
  if (lex_user->host.length > HOSTNAME_LENGTH ||
      lex_user->user.length > USERNAME_LENGTH)
  {
    my_error(ER_GRANT_WRONG_HOST_OR_USER,MYF(0));
    DBUG_RETURN(-1);
  }

  for (counter=0 ; counter < acl_users.elements ; counter++)
  {
    const char *user,*host;
    acl_user=dynamic_element(&acl_users,counter,ACL_USER*);
    if (!(user=acl_user->user))
      user="";
    if (!(host=acl_user->host.hostname))
2944
      host="";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2945
    if (!strcmp(lex_user->user.str,user) &&
2946
	!my_strcasecmp(lex_user->host.str,host))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2947 2948
      break;
  }
2949
  if (counter == acl_users.elements)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965
  {
    my_printf_error(ER_NONEXISTING_GRANT,ER(ER_NONEXISTING_GRANT),
		    MYF(0),lex_user->user.str,lex_user->host.str);
    DBUG_RETURN(-1);
  }

  Item_string *field=new Item_string("",0);
  List<Item> field_list;
  field->name=buff;
  field->max_length=1024;
  strxmov(buff,"Grants for ",lex_user->user.str,"@",
	  lex_user->host.str,NullS);
  field_list.push_back(field);
  if (send_fields(thd,field_list,1))
    DBUG_RETURN(-1);

2966
  pthread_mutex_lock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2967 2968 2969 2970 2971 2972 2973 2974 2975 2976 2977 2978 2979
  VOID(pthread_mutex_lock(&acl_cache->lock));

  /* Add first global access grants */
  {
    want_access=acl_user->access;
    String global(buff,sizeof(buff));
    global.length(0);
    global.append("GRANT ",6);

    if (test_all_bits(want_access, (GLOBAL_ACLS & ~ GRANT_ACL)))
      global.append("ALL PRIVILEGES",14);
    else if (!(want_access & ~GRANT_ACL))
      global.append("USAGE",5);
2980
    else
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2981 2982
    {
      bool found=0;
2983
      ulong j,test_access= want_access & ~GRANT_ACL;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2984 2985
      for (counter=0, j = SELECT_ACL;j <= GLOBAL_ACLS;counter++,j <<= 1)
      {
2986
	if (test_access & j)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2987 2988 2989 2990 2991 2992 2993 2994 2995
	{
	  if (found)
	    global.append(", ",2);
	  found=1;
	  global.append(command_array[counter],command_lengths[counter]);
	}
      }
    }
    global.append (" ON *.* TO '",12);
2996
    global.append(lex_user->user.str,lex_user->user.length);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2997 2998 2999 3000 3001 3002 3003 3004 3005 3006 3007
    global.append ("'@'",3);
    global.append(lex_user->host.str,lex_user->host.length);
    global.append ('\'');
    if (acl_user->password)
    {
      char passd_buff[HASH_PASSWORD_LENGTH+1];
      make_password_from_salt(passd_buff,acl_user->salt);
      global.append(" IDENTIFIED BY PASSWORD '",25);
      global.append(passd_buff);
      global.append('\'');
    }
3008 3009
    /* "show grants" SSL related stuff */
    if (acl_user->ssl_type == SSL_TYPE_ANY)
3010
      global.append(" REQUIRE SSL",12);
3011
    else if (acl_user->ssl_type == SSL_TYPE_X509)
3012
      global.append(" REQUIRE X509",13);
3013
    else if (acl_user->ssl_type == SSL_TYPE_SPECIFIED)
3014
    {
3015
      int ssl_options = 0;
3016
      global.append(" REQUIRE ",9);
3017 3018
      if (acl_user->x509_issuer)
      {
3019 3020 3021
	ssl_options++;
	global.append("ISSUER \'",8);
	global.append(acl_user->x509_issuer,strlen(acl_user->x509_issuer));
3022
	global.append('\'');
3023
      }
3024 3025
      if (acl_user->x509_subject)
      {
3026 3027 3028 3029
	if (ssl_options++)
	  global.append(' ');
	global.append("SUBJECT \'",9);
	global.append(acl_user->x509_subject,strlen(acl_user->x509_subject));
3030
	global.append('\'');
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
3031
      }
3032 3033
      if (acl_user->ssl_cipher)
      {
3034 3035 3036 3037
	if (ssl_options++)
	  global.append(' ');
	global.append("CIPHER '",8);
	global.append(acl_user->ssl_cipher,strlen(acl_user->ssl_cipher));
3038
	global.append('\'');
3039 3040
      }
    }
3041 3042 3043
    if ((want_access & GRANT_ACL) ||
	(acl_user->user_resource.questions | acl_user->user_resource.updates |
	 acl_user->user_resource.connections))
3044
    {
3045
      global.append(" WITH",5);
3046
      if (want_access & GRANT_ACL)
3047 3048 3049 3050 3051 3052 3053
	global.append(" GRANT OPTION",13);
      add_user_option(&global, acl_user->user_resource.questions,
		      "MAX_QUERIES_PER_HOUR");
      add_user_option(&global, acl_user->user_resource.updates,
		      "MAX_UPDATES_PER_HOUR");
      add_user_option(&global, acl_user->user_resource.connections,
		      "MAX_CONNECTIONS_PER_HOUR");
3054
    }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066
    thd->packet.length(0);
    net_store_data(&thd->packet,global.ptr(),global.length());
    if (my_net_write(&thd->net,(char*) thd->packet.ptr(),
		     thd->packet.length()))
    {
      error=-1; goto end;
    }
  }

  /* Add database access */
  for (counter=0 ; counter < acl_dbs.elements ; counter++)
  {
monty@mysql.com's avatar
monty@mysql.com committed
3067
    const char *user, *host;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3068 3069 3070 3071 3072 3073 3074 3075

    acl_db=dynamic_element(&acl_dbs,counter,ACL_DB*);
    if (!(user=acl_db->user))
      user="";
    if (!(host=acl_db->host.hostname))
      host="";

    if (!strcmp(lex_user->user.str,user) &&
3076
	!my_strcasecmp(lex_user->host.str,host))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3077 3078
    {
      want_access=acl_db->access;
3079
      if (want_access)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3080 3081 3082 3083 3084 3085 3086
      {
	String db(buff,sizeof(buff));
	db.length(0);
	db.append("GRANT ",6);

	if (test_all_bits(want_access,(DB_ACLS & ~GRANT_ACL)))
	  db.append("ALL PRIVILEGES",14);
3087
	else if (!(want_access & ~GRANT_ACL))
3088
	  db.append("USAGE",5);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3089 3090 3091
	else
	{
	  int found=0, cnt;
3092
	  ulong j,test_access= want_access & ~GRANT_ACL;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3093 3094 3095 3096 3097 3098 3099 3100 3101 3102 3103
	  for (cnt=0, j = SELECT_ACL; j <= DB_ACLS; cnt++,j <<= 1)
	  {
	    if (test_access & j)
	    {
	      if (found)
		db.append(", ",2);
	      found = 1;
	      db.append(command_array[cnt],command_lengths[cnt]);
	    }
	  }
	}
3104
	db.append(" ON `",5);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3105
	db.append(acl_db->db);
3106 3107 3108
	db.append("`.* TO '",8);
	db.append(lex_user->user.str,lex_user->user.length);
	db.append("'@'",3);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3109
	db.append(lex_user->host.str, lex_user->host.length);
3110
	db.append('\'');
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3111
	if (want_access & GRANT_ACL)
3112
	  db.append(" WITH GRANT OPTION",18);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3113 3114 3115 3116 3117 3118 3119 3120 3121 3122 3123 3124
	thd->packet.length(0);
	net_store_data(&thd->packet,db.ptr(),db.length());
	if (my_net_write(&thd->net,(char*) thd->packet.ptr(),
			 thd->packet.length()))
	{
	  error=-1;
	  goto end;
	}
      }
    }
  }

3125
  /* Add table & column access */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3126 3127
  for (index=0 ; index < hash_tables.records ; index++)
  {
monty@mysql.com's avatar
monty@mysql.com committed
3128
    const char *user;
3129
    GRANT_TABLE *grant_table= (GRANT_TABLE*) hash_element(&hash_tables,index);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3130 3131

    if (!(user=grant_table->user))
3132
      user= "";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3133 3134

    if (!strcmp(lex_user->user.str,user) &&
3135
	!my_strcasecmp(lex_user->host.str, grant_table->orig_host))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3136
    {
3137 3138
      ulong table_access= grant_table->privs;
      if ((table_access | grant_table->cols) != 0)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3139 3140
      {
	String global(buff,sizeof(buff));
3141 3142
	ulong test_access= (table_access | grant_table->cols) & ~GRANT_ACL;

bk@work.mysql.com's avatar
bk@work.mysql.com committed
3143 3144 3145
	global.length(0);
	global.append("GRANT ",6);

3146
	if (test_all_bits(table_access, (TABLE_ACLS & ~GRANT_ACL)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3147
	  global.append("ALL PRIVILEGES",14);
3148
 	else if (!test_access)
3149
 	  global.append("USAGE",5);
3150
	else
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3151
	{
3152
          /* Add specific column access */
3153
	  int found= 0;
3154
	  ulong j;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3155

3156
	  for (counter= 0, j= SELECT_ACL; j <= TABLE_ACLS; counter++, j<<= 1)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3157
	  {
3158
	    if (test_access & j)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3159 3160 3161
	    {
	      if (found)
		global.append(", ",2);
3162
	      found= 1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3163 3164
	      global.append(command_array[counter],command_lengths[counter]);

3165
	      if (grant_table->cols)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3166
	      {
3167
		uint found_col= 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3168 3169 3170 3171 3172 3173
		for (uint col_index=0 ;
		     col_index < grant_table->hash_columns.records ;
		     col_index++)
		{
		  GRANT_COLUMN *grant_column = (GRANT_COLUMN*)
		    hash_element(&grant_table->hash_columns,col_index);
3174
		  if (grant_column->rights & j)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3175
		  {
3176
		    if (!found_col)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3177
		    {
3178 3179 3180 3181 3182 3183 3184 3185 3186 3187 3188
		      found_col= 1;
		      /*
			If we have a duplicated table level privilege, we
			must write the access privilege name again.
		      */
		      if (table_access & j)
		      {
			global.append(", ", 2);
			global.append(command_array[counter],
				      command_lengths[counter]);
		      }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3189 3190 3191 3192 3193 3194 3195 3196 3197 3198 3199 3200 3201 3202
		      global.append(" (",2);
		    }
		    else
		      global.append(", ",2);
		    global.append(grant_column->column,
				  grant_column->key_length);
		  }
		}
		if (found_col)
		  global.append(')');
	      }
	    }
	  }
	}
3203
	global.append(" ON `",5);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3204
	global.append(grant_table->db);
3205
	global.append("`.`",3);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3206
	global.append(grant_table->tname);
3207
	global.append("` TO '",6);
3208
	global.append(lex_user->user.str,lex_user->user.length);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3209
	global.append("'@'",3);
3210
	global.append(lex_user->host.str,lex_user->host.length);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3211
	global.append('\'');
3212 3213
	if (table_access & GRANT_ACL)
	  global.append(" WITH GRANT OPTION",18);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3214 3215 3216 3217 3218 3219
	thd->packet.length(0);
	net_store_data(&thd->packet,global.ptr(),global.length());
	if (my_net_write(&thd->net,(char*) thd->packet.ptr(),
			 thd->packet.length()))
	{
	  error=-1;
3220
	  break;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3221 3222 3223 3224
	}
      }
    }
  }
3225

3226
end:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3227
  VOID(pthread_mutex_unlock(&acl_cache->lock));
3228 3229
  pthread_mutex_unlock(&LOCK_grant);

bk@work.mysql.com's avatar
bk@work.mysql.com committed
3230 3231 3232 3233 3234
  send_eof(&thd->net);
  DBUG_RETURN(error);
}


3235 3236 3237 3238 3239 3240 3241 3242 3243 3244 3245 3246 3247 3248 3249 3250 3251 3252 3253 3254 3255 3256 3257 3258 3259 3260 3261 3262
/*
  Make a clear-text version of the requested privilege.
*/

void get_privilege_desc(char *to, uint max_length, ulong access)
{
  uint pos;
  char *start=to;
  DBUG_ASSERT(max_length >= 30);		// For end ',' removal

  if (access)
  {
    max_length--;				// Reserve place for end-zero
    for (pos=0 ; access ; pos++, access>>=1)
    {
      if ((access & 1) &&
	  command_lengths[pos] + (uint) (to-start) < max_length)
      {
	to= strmov(to, command_array[pos]);
	*to++=',';
      }
    }
    to--;					// Remove end ','
  }
  *to=0;
}


3263
void get_mqh(const char *user, const char *host, USER_CONN *uc)
3264 3265
{
  ACL_USER *acl_user;
3266 3267 3268 3269
  if (initialized && (acl_user= find_acl_user(host,user)))
    uc->user_resources= acl_user->user_resource;
  else
    bzero((char*) &uc->user_resources, sizeof(uc->user_resources));
3270 3271 3272
}


3273

bk@work.mysql.com's avatar
bk@work.mysql.com committed
3274
/*****************************************************************************
3275
  Instantiate used templates
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3276 3277 3278 3279 3280 3281 3282 3283
*****************************************************************************/

#ifdef __GNUC__
template class List_iterator<LEX_COLUMN>;
template class List_iterator<LEX_USER>;
template class List<LEX_COLUMN>;
template class List<LEX_USER>;
#endif