sql_acl.cc 106 KB
Newer Older
1
/* Copyright (C) 2000-2003 MySQL AB
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2

bk@work.mysql.com's avatar
bk@work.mysql.com committed
3 4 5 6
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 2 of the License, or
   (at your option) any later version.
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
7

bk@work.mysql.com's avatar
bk@work.mysql.com committed
8 9 10 11
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
12

bk@work.mysql.com's avatar
bk@work.mysql.com committed
13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30
   You should have received a copy of the GNU General Public License
   along with this program; if not, write to the Free Software
   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA */


/*
  The privileges are saved in the following tables:
  mysql/user	 ; super user who are allowed to do almoust anything
  mysql/host	 ; host priviliges. This is used if host is empty in mysql/db.
  mysql/db	 ; database privileges / user

  data in tables is sorted according to how many not-wild-cards there is
  in the relevant fields. Empty strings comes last.
*/

#include "mysql_priv.h"
#include "sql_acl.h"
#include "hash_filo.h"
31 32 33
#ifdef HAVE_REPLICATION
#include "sql_repl.h" //for tables_ok()
#endif
bk@work.mysql.com's avatar
bk@work.mysql.com committed
34 35 36
#include <m_ctype.h>
#include <stdarg.h>

hf@deer.(none)'s avatar
hf@deer.(none) committed
37
#ifndef NO_EMBEDDED_ACCESS_CHECKS
38

bk@work.mysql.com's avatar
bk@work.mysql.com committed
39 40 41
class acl_entry :public hash_filo_element
{
public:
42
  ulong access;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
43 44 45 46
  uint16 length;
  char key[1];					// Key will be stored here
};

47

bk@work.mysql.com's avatar
bk@work.mysql.com committed
48 49 50 51 52 53 54
static byte* acl_entry_get_key(acl_entry *entry,uint *length,
			       my_bool not_used __attribute__((unused)))
{
  *length=(uint) entry->length;
  return (byte*) entry->key;
}

serg@serg.mylan's avatar
serg@serg.mylan committed
55
#define IP_ADDR_STRLEN (3+1+3+1+3+1+3)
56
#define ACL_KEY_LENGTH (IP_ADDR_STRLEN+1+NAME_LEN+1+USERNAME_LENGTH+1)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
57 58 59 60 61

static DYNAMIC_ARRAY acl_hosts,acl_users,acl_dbs;
static MEM_ROOT mem, memex;
static bool initialized=0;
static bool allow_all_hosts=1;
62
static HASH acl_check_hosts, column_priv_hash;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
63 64 65
static DYNAMIC_ARRAY acl_wild_hosts;
static hash_filo *acl_cache;
static uint grant_version=0;
peter@mysql.com's avatar
peter@mysql.com committed
66
static uint priv_version=0; /* Version of priv tables. incremented by acl_init */
67
static ulong get_access(TABLE *form,uint fieldnr, uint *next_field=0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
68 69 70 71 72
static int acl_compare(ACL_ACCESS *a,ACL_ACCESS *b);
static ulong get_sort(uint count,...);
static void init_check_host(void);
static ACL_USER *find_acl_user(const char *host, const char *user);
static bool update_user_table(THD *thd, const char *host, const char *user,
73
			      const char *new_password, uint new_password_len);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
74
static void update_hostname(acl_host_and_ip *host, const char *hostname);
75
static bool compare_hostname(const acl_host_and_ip *host,const char *hostname,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
76 77
			     const char *ip);

78 79 80 81 82 83 84 85 86 87 88 89 90 91
/*
  Convert scrambled password to binary form, according to scramble type, 
  Binary form is stored in user.salt.
*/

static
void
set_user_salt(ACL_USER *acl_user, const char *password, uint password_len)
{
  if (password_len == SCRAMBLED_PASSWORD_CHAR_LENGTH)
  {
    get_salt_from_password(acl_user->salt, password);
    acl_user->salt_len= SCRAMBLE_LENGTH;
  }
92
  else if (password_len == SCRAMBLED_PASSWORD_CHAR_LENGTH_323)
93 94
  {
    get_salt_from_password_323((ulong *) acl_user->salt, password);
95
    acl_user->salt_len= SCRAMBLE_LENGTH_323;
96 97 98 99 100
  }
  else
    acl_user->salt_len= 0;
}

101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118
/*
  This after_update function is used when user.password is less than
  SCRAMBLE_LENGTH bytes.
*/

static void restrict_update_of_old_passwords_var(THD *thd,
                                                 enum_var_type var_type)
{
  if (var_type == OPT_GLOBAL)
  {
    pthread_mutex_lock(&LOCK_global_system_variables);
    global_system_variables.old_passwords= 1;
    pthread_mutex_unlock(&LOCK_global_system_variables);
  }
  else
    thd->variables.old_passwords= 1;
}

119

120 121 122 123 124
/*
  Read grant privileges from the privilege tables in the 'mysql' database.

  SYNOPSIS
    acl_init()
125
    thd				Thread handler
126 127 128 129 130 131 132 133
    dont_read_acl_tables	Set to 1 if run with --skip-grant

  RETURN VALUES
    0	ok
    1	Could not initialize grant's
*/


134
my_bool acl_init(THD *org_thd, bool dont_read_acl_tables)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
135
{
136
  THD  *thd;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
137 138 139
  TABLE_LIST tables[3];
  TABLE *table;
  READ_RECORD read_record_info;
140 141
  MYSQL_LOCK *lock;
  my_bool return_val=1;
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
142 143
  bool check_no_resolve= specialflag & SPECIAL_NO_RESOLVE;

bk@work.mysql.com's avatar
bk@work.mysql.com committed
144 145 146 147 148
  DBUG_ENTER("acl_init");

  if (!acl_cache)
    acl_cache=new hash_filo(ACL_CACHE_SIZE,0,0,
			    (hash_get_key) acl_entry_get_key,
bar@bar.mysql.r18.ru's avatar
bar@bar.mysql.r18.ru committed
149
			    (hash_free_key) free, system_charset_info);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
150
  if (dont_read_acl_tables)
151
  {
bk@work.mysql.com's avatar
bk@work.mysql.com committed
152
    DBUG_RETURN(0); /* purecov: tested */
peter@mysql.com's avatar
peter@mysql.com committed
153 154
  }

155
  priv_version++; /* Privileges updated */
peter@mysql.com's avatar
peter@mysql.com committed
156

157 158 159
  /*
    To be able to run this from boot, we allocate a temporary THD
  */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
160 161
  if (!(thd=new THD))
    DBUG_RETURN(1); /* purecov: inspected */
162 163
  thd->store_globals();

bk@work.mysql.com's avatar
bk@work.mysql.com committed
164
  acl_cache->clear(1);				// Clear locked hostname cache
165 166
  thd->db= my_strdup("mysql",MYF(0));
  thd->db_length=5;				// Safety
bk@work.mysql.com's avatar
bk@work.mysql.com committed
167
  bzero((char*) &tables,sizeof(tables));
168 169 170
  tables[0].alias=tables[0].real_name=(char*) "host";
  tables[1].alias=tables[1].real_name=(char*) "user";
  tables[2].alias=tables[2].real_name=(char*) "db";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
171 172 173 174 175
  tables[0].next=tables+1;
  tables[1].next=tables+2;
  tables[0].lock_type=tables[1].lock_type=tables[2].lock_type=TL_READ;
  tables[0].db=tables[1].db=tables[2].db=thd->db;

176 177
  uint counter;
  if (open_tables(thd, tables, &counter))
178 179 180
  {
    sql_print_error("Fatal error: Can't open privilege tables: %s",
		    thd->net.last_error);
181
    goto end;
182
  }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
183 184 185 186
  TABLE *ptr[3];				// Lock tables for quick update
  ptr[0]= tables[0].table;
  ptr[1]= tables[1].table;
  ptr[2]= tables[2].table;
187
  if (!(lock=mysql_lock_tables(thd,ptr,3)))
188 189 190
  {
    sql_print_error("Fatal error: Can't lock privilege tables: %s",
		    thd->net.last_error);
191
    goto end;
192
  }
193
  init_sql_alloc(&mem, ACL_ALLOC_BLOCK_SIZE, 0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
194
  init_read_record(&read_record_info,thd,table= tables[0].table,NULL,1,0);
195
  VOID(my_init_dynamic_array(&acl_hosts,sizeof(ACL_HOST),20,50));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
196 197 198
  while (!(read_record_info.read_record(&read_record_info)))
  {
    ACL_HOST host;
199 200
    update_hostname(&host.host,get_field(&mem, table->field[0]));
    host.db=	 get_field(&mem, table->field[1]);
201 202
    host.access= get_access(table,2);
    host.access= fix_rights_for_db(host.access);
203
    host.sort=	 get_sort(2,host.host.hostname,host.db);
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
204 205
    if (check_no_resolve && hostname_requires_resolving(host.host.hostname))
    {
serg@serg.mylan's avatar
serg@serg.mylan committed
206
      sql_print_warning("'host' entry '%s|%s' "
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
207
		      "ignored in --skip-name-resolve mode.",
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
208 209 210
		      host.host.hostname, host.db, host.host.hostname);
      continue;
    }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
211 212 213 214
#ifndef TO_BE_REMOVED
    if (table->fields ==  8)
    {						// Without grant
      if (host.access & CREATE_ACL)
215
	host.access|=REFERENCES_ACL | INDEX_ACL | ALTER_ACL | CREATE_TMP_ACL;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
216 217 218 219 220 221 222 223 224 225
    }
#endif
    VOID(push_dynamic(&acl_hosts,(gptr) &host));
  }
  qsort((gptr) dynamic_element(&acl_hosts,0,ACL_HOST*),acl_hosts.elements,
	sizeof(ACL_HOST),(qsort_cmp) acl_compare);
  end_read_record(&read_record_info);
  freeze_size(&acl_hosts);

  init_read_record(&read_record_info,thd,table=tables[1].table,NULL,1,0);
226
  VOID(my_init_dynamic_array(&acl_users,sizeof(ACL_USER),50,100));
227
  if (table->field[2]->field_length < SCRAMBLED_PASSWORD_CHAR_LENGTH_323)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
228
  {
229 230 231
    sql_print_error("Fatal error: mysql.user table is damaged or in "
                    "unsupported 3.20 format.");
    goto end;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
232 233
  }

234 235
  DBUG_PRINT("info",("user table fields: %d, password length: %d",
		     table->fields, table->field[2]->field_length));
236 237 238
  
  pthread_mutex_lock(&LOCK_global_system_variables);
  if (table->field[2]->field_length < SCRAMBLED_PASSWORD_CHAR_LENGTH)
239
  {
240 241 242 243 244 245 246 247 248 249 250 251 252 253
    if (opt_secure_auth)
    {
      pthread_mutex_unlock(&LOCK_global_system_variables);
      sql_print_error("Fatal error: mysql.user table is in old format, "
                      "but server started with --secure-auth option.");
      goto end;
    }
    sys_old_passwords.after_update= restrict_update_of_old_passwords_var;
    if (global_system_variables.old_passwords)
      pthread_mutex_unlock(&LOCK_global_system_variables);
    else
    {
      global_system_variables.old_passwords= 1;
      pthread_mutex_unlock(&LOCK_global_system_variables);
254 255 256
      sql_print_warning("mysql.user table is not updated to new password format; "
                        "Disabling new password usage until "
                        "mysql_fix_privilege_tables is run");
257 258 259 260
    }
    thd->variables.old_passwords= 1;
  }
  else
261
  {
262 263
    sys_old_passwords.after_update= 0;
    pthread_mutex_unlock(&LOCK_global_system_variables);
264 265
  }

bk@work.mysql.com's avatar
bk@work.mysql.com committed
266 267 268 269
  allow_all_hosts=0;
  while (!(read_record_info.read_record(&read_record_info)))
  {
    ACL_USER user;
270 271
    update_hostname(&user.host, get_field(&mem, table->field[0]));
    user.user= get_field(&mem, table->field[1]);
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
272 273
    if (check_no_resolve && hostname_requires_resolving(user.host.hostname))
    {
serg@serg.mylan's avatar
serg@serg.mylan committed
274 275
      sql_print_warning("'user' entry '%s@%s' "
                        "ignored in --skip-name-resolve mode.",
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
276 277 278 279
		      user.user, user.host.hostname, user.host.hostname);
      continue;
    }

280 281 282 283
    const char *password= get_field(&mem, table->field[2]);
    uint password_len= password ? strlen(password) : 0;
    set_user_salt(&user, password, password_len);
    if (user.salt_len == 0 && password_len != 0)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
284
    {
285 286
      switch (password_len) {
      case 45: /* 4.1: to be removed */
serg@serg.mylan's avatar
serg@serg.mylan committed
287 288 289 290 291
        sql_print_warning("Found 4.1 style password for user '%s@%s'. "
                          "Ignoring user. "
                          "You should change password for this user.",
                          user.user ? user.user : "",
                          user.host.hostname ? user.host.hostname : "");
292 293
        break;
      default:
serg@serg.mylan's avatar
serg@serg.mylan committed
294 295 296
        sql_print_warning("Found invalid password for user: '%s@%s'; "
                          "Ignoring user", user.user ? user.user : "",
                           user.host.hostname ? user.host.hostname : "");
297 298
        break;
      }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
299
    }
300
    else                                        // password is correct
bk@work.mysql.com's avatar
bk@work.mysql.com committed
301
    {
302 303
      uint next_field;
      user.access= get_access(table,3,&next_field) & GLOBAL_ACLS;
304 305 306
      user.sort= get_sort(2,user.host.hostname,user.user);
      user.hostname_length= (user.host.hostname ?
                             (uint) strlen(user.host.hostname) : 0);
307
      if (table->fields >= 31)	 /* Starting from 4.0.2 we have more fields */
308
      {
309
        char *ssl_type=get_field(&mem, table->field[next_field++]);
310 311 312 313 314 315 316 317 318
        if (!ssl_type)
          user.ssl_type=SSL_TYPE_NONE;
        else if (!strcmp(ssl_type, "ANY"))
          user.ssl_type=SSL_TYPE_ANY;
        else if (!strcmp(ssl_type, "X509"))
          user.ssl_type=SSL_TYPE_X509;
        else  /* !strcmp(ssl_type, "SPECIFIED") */
          user.ssl_type=SSL_TYPE_SPECIFIED;

319 320 321
        user.ssl_cipher=   get_field(&mem, table->field[next_field++]);
        user.x509_issuer=  get_field(&mem, table->field[next_field++]);
        user.x509_subject= get_field(&mem, table->field[next_field++]);
322

323 324 325 326 327 328
        char *ptr = get_field(&mem, table->field[next_field++]);
        user.user_resource.questions=ptr ? atoi(ptr) : 0;
        ptr = get_field(&mem, table->field[next_field++]);
        user.user_resource.updates=ptr ? atoi(ptr) : 0;
        ptr = get_field(&mem, table->field[next_field++]);
        user.user_resource.connections=ptr ? atoi(ptr) : 0;
329 330 331
        if (user.user_resource.questions || user.user_resource.updates ||
            user.user_resource.connections)
          mqh_used=1;
332
      }
333 334 335
      else
      {
        user.ssl_type=SSL_TYPE_NONE;
336
        bzero((char *)&(user.user_resource),sizeof(user.user_resource));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
337
#ifndef TO_BE_REMOVED
338 339 340 341 342 343 344 345 346 347 348
        if (table->fields <= 13)
        {						// Without grant
          if (user.access & CREATE_ACL)
            user.access|=REFERENCES_ACL | INDEX_ACL | ALTER_ACL;
        }
        /* Convert old privileges */
        user.access|= LOCK_TABLES_ACL | CREATE_TMP_ACL | SHOW_DB_ACL;
        if (user.access & FILE_ACL)
          user.access|= REPL_CLIENT_ACL | REPL_SLAVE_ACL;
        if (user.access & PROCESS_ACL)
          user.access|= SUPER_ACL | EXECUTE_ACL;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
349
#endif
350 351 352 353 354
      }
      VOID(push_dynamic(&acl_users,(gptr) &user));
      if (!user.host.hostname || user.host.hostname[0] == wild_many &&
          !user.host.hostname[1])
        allow_all_hosts=1;			// Anyone can connect
355
    }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
356 357 358 359 360
  }
  qsort((gptr) dynamic_element(&acl_users,0,ACL_USER*),acl_users.elements,
	sizeof(ACL_USER),(qsort_cmp) acl_compare);
  end_read_record(&read_record_info);
  freeze_size(&acl_users);
peter@mysql.com's avatar
peter@mysql.com committed
361

bk@work.mysql.com's avatar
bk@work.mysql.com committed
362
  init_read_record(&read_record_info,thd,table=tables[2].table,NULL,1,0);
363
  VOID(my_init_dynamic_array(&acl_dbs,sizeof(ACL_DB),50,100));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
364 365 366
  while (!(read_record_info.read_record(&read_record_info)))
  {
    ACL_DB db;
367 368
    update_hostname(&db.host,get_field(&mem, table->field[0]));
    db.db=get_field(&mem, table->field[1]);
369 370
    if (!db.db)
    {
serg@serg.mylan's avatar
serg@serg.mylan committed
371
      sql_print_warning("Found an entry in the 'db' table with empty database name; Skipped");
372
      continue;
373
    }
374
    db.user=get_field(&mem, table->field[2]);
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
375 376
    if (check_no_resolve && hostname_requires_resolving(db.host.hostname))
    {
serg@serg.mylan's avatar
serg@serg.mylan committed
377 378 379
      sql_print_warning("'db' entry '%s %s@%s' "
		        "ignored in --skip-name-resolve mode.",
		        db.db, db.user, db.host.hostname, db.host.hostname);
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
380 381
      continue;
    }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400
    db.access=get_access(table,3);
    db.access=fix_rights_for_db(db.access);
    db.sort=get_sort(3,db.host.hostname,db.db,db.user);
#ifndef TO_BE_REMOVED
    if (table->fields <=  9)
    {						// Without grant
      if (db.access & CREATE_ACL)
	db.access|=REFERENCES_ACL | INDEX_ACL | ALTER_ACL;
    }
#endif
    VOID(push_dynamic(&acl_dbs,(gptr) &db));
  }
  qsort((gptr) dynamic_element(&acl_dbs,0,ACL_DB*),acl_dbs.elements,
	sizeof(ACL_DB),(qsort_cmp) acl_compare);
  end_read_record(&read_record_info);
  freeze_size(&acl_dbs);
  init_check_host();

  mysql_unlock_tables(thd, lock);
401
  initialized=1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
402
  thd->version--;				// Force close to free memory
403 404 405
  return_val=0;

end:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
406 407
  close_thread_tables(thd);
  delete thd;
408 409
  if (org_thd)
    org_thd->store_globals();			/* purecov: inspected */
410 411 412 413 414
  else
  {
    /* Remember that we don't have a THD */
    my_pthread_setspecific_ptr(THR_THD,  0);
  }
415
  DBUG_RETURN(return_val);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
416 417 418 419 420
}


void acl_free(bool end)
{
421
  free_root(&mem,MYF(0));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
422 423 424 425 426 427 428 429 430 431 432 433 434 435
  delete_dynamic(&acl_hosts);
  delete_dynamic(&acl_users);
  delete_dynamic(&acl_dbs);
  delete_dynamic(&acl_wild_hosts);
  hash_free(&acl_check_hosts);
  if (!end)
    acl_cache->clear(1); /* purecov: inspected */
  else
  {
    delete acl_cache;
    acl_cache=0;
  }
}

436 437 438 439 440 441 442 443

/*
  Forget current privileges and read new privileges from the privilege tables

  SYNOPSIS
    acl_reload()
    thd			Thread handle
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
444

445
void acl_reload(THD *thd)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
446 447 448 449 450 451
{
  DYNAMIC_ARRAY old_acl_hosts,old_acl_users,old_acl_dbs;
  MEM_ROOT old_mem;
  bool old_initialized;
  DBUG_ENTER("acl_reload");

452
  if (thd && thd->locked_tables)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
453
  {					// Can't have locked tables here
454 455 456
    thd->lock=thd->locked_tables;
    thd->locked_tables=0;
    close_thread_tables(thd);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
457 458 459 460 461 462 463 464 465 466 467
  }
  if ((old_initialized=initialized))
    VOID(pthread_mutex_lock(&acl_cache->lock));

  old_acl_hosts=acl_hosts;
  old_acl_users=acl_users;
  old_acl_dbs=acl_dbs;
  old_mem=mem;
  delete_dynamic(&acl_wild_hosts);
  hash_free(&acl_check_hosts);

468
  if (acl_init(thd, 0))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
469
  {					// Error. Revert to old list
470
    DBUG_PRINT("error",("Reverting to old privileges"));
471
    acl_free();				/* purecov: inspected */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
472 473 474 475 476 477 478 479
    acl_hosts=old_acl_hosts;
    acl_users=old_acl_users;
    acl_dbs=old_acl_dbs;
    mem=old_mem;
    init_check_host();
  }
  else
  {
480
    free_root(&old_mem,MYF(0));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
481 482 483 484 485 486 487 488 489 490
    delete_dynamic(&old_acl_hosts);
    delete_dynamic(&old_acl_users);
    delete_dynamic(&old_acl_dbs);
  }
  if (old_initialized)
    VOID(pthread_mutex_unlock(&acl_cache->lock));
  DBUG_VOID_RETURN;
}


491 492
/*
  Get all access bits from table after fieldnr
493 494 495 496 497 498 499 500 501 502 503 504 505 506 507

  IMPLEMENTATION
    We know that the access privileges ends when there is no more fields
    or the field is not an enum with two elements.

  SYNOPSIS
    get_access()
    form        an open table to read privileges from.
                The record should be already read in table->record[0]
    fieldnr     number of the first privilege (that is ENUM('N','Y') field
    next_field  on return - number of the field next to the last ENUM
                (unless next_field == 0)

  RETURN VALUE
    privilege mask
508
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
509

510
static ulong get_access(TABLE *form, uint fieldnr, uint *next_field)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
511
{
512
  ulong access_bits=0,bit;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
513
  char buff[2];
514
  String res(buff,sizeof(buff),&my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
515 516
  Field **pos;

517 518 519
  for (pos=form->field+fieldnr, bit=1;
       *pos && (*pos)->real_type() == FIELD_TYPE_ENUM &&
	 ((Field_enum*) (*pos))->typelib->count == 2 ;
520
       pos++, fieldnr++, bit<<=1)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
521
  {
522
    (*pos)->val_str(&res);
523
    if (my_toupper(&my_charset_latin1, res[0]) == 'Y')
524
      access_bits|= bit;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
525
  }
526 527
  if (next_field)
    *next_field=fieldnr;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
528 529 530 531 532
  return access_bits;
}


/*
533 534 535 536 537
  Return a number which, if sorted 'desc', puts strings in this order:
    no wildcards
    wildcards
    empty string
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
538 539 540 541 542 543 544

static ulong get_sort(uint count,...)
{
  va_list args;
  va_start(args,count);
  ulong sort=0;

545 546 547
  /* Should not use this function with more than 4 arguments for compare. */
  DBUG_ASSERT(count <= 4);

bk@work.mysql.com's avatar
bk@work.mysql.com committed
548 549
  while (count--)
  {
550 551 552
    char *start, *str= va_arg(args,char*);
    uint chars= 0;
    uint wild_pos= 0;           /* first wildcard position */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
553

monty@mysql.com's avatar
monty@mysql.com committed
554
    if ((start= str))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
555 556 557 558
    {
      for (; *str ; str++)
      {
	if (*str == wild_many || *str == wild_one || *str == wild_prefix)
559
        {
monty@mysql.com's avatar
monty@mysql.com committed
560
          wild_pos= (uint) (str - start) + 1;
561 562
          break;
        }
monty@mysql.com's avatar
monty@mysql.com committed
563
        chars= 128;                             // Marker that chars existed
bk@work.mysql.com's avatar
bk@work.mysql.com committed
564 565
      }
    }
monty@mysql.com's avatar
monty@mysql.com committed
566
    sort= (sort << 8) + (wild_pos ? min(wild_pos, 127) : chars);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
567 568 569 570 571 572 573 574 575 576 577 578 579 580 581
  }
  va_end(args);
  return sort;
}


static int acl_compare(ACL_ACCESS *a,ACL_ACCESS *b)
{
  if (a->sort > b->sort)
    return -1;
  if (a->sort < b->sort)
    return 1;
  return 0;
}

582

583
/*
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
584 585
  Seek ACL entry for a user, check password, SSL cypher, and if
  everything is OK, update THD user data and USER_RESOURCES struct.
586

monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
587 588 589 590
  IMPLEMENTATION
   This function does not check if the user has any sensible privileges:
   only user's existence and  validity is checked.
   Note, that entire operation is protected by acl_cache_lock.
peter@mysql.com's avatar
peter@mysql.com committed
591

592
  SYNOPSIS
593 594 595 596 597 598 599 600 601 602 603 604 605 606
    acl_getroot()
    thd         thread handle. If all checks are OK,
                thd->priv_user, thd->master_access are updated.
                thd->host, thd->ip, thd->user are used for checks.
    mqh         user resources; on success mqh is reset, else
                unchanged
    passwd      scrambled & crypted password, recieved from client
                (to check): thd->scramble or thd->scramble_323 is
                used to decrypt passwd, so they must contain
                original random string,
    passwd_len  length of passwd, must be one of 0, 8,
                SCRAMBLE_LENGTH_323, SCRAMBLE_LENGTH
    'thd' and 'mqh' are updated on success; other params are IN.
  
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
607
  RETURN VALUE
608 609
    0  success: thd->priv_user, thd->priv_host, thd->master_access, mqh are
       updated
610
    1  user not found or authentification failure
611
    2  user found, has long (4.1.1) salt, but passwd is in old (3.23) format.
612
   -1  user found, has short (3.23) salt, but passwd is in new (4.1.1) format.
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
613 614
*/

615 616
int acl_getroot(THD *thd, USER_RESOURCES  *mqh,
                const char *passwd, uint passwd_len)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
617
{
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
618 619 620
  ulong user_access= NO_ACCESS;
  int res= 1;
  ACL_USER *acl_user= 0;
621
  DBUG_ENTER("acl_getroot");
bk@work.mysql.com's avatar
bk@work.mysql.com committed
622 623

  if (!initialized)
624
  {
625 626 627 628 629 630
    /* 
      here if mysqld's been started with --skip-grant-tables option.
    */
    thd->priv_user= (char *) "";                // privileges for
    *thd->priv_host= '\0';                      // the user are unknown
    thd->master_access= ~NO_ACCESS;             // everything is allowed
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
631
    bzero((char*) mqh, sizeof(*mqh));
632
    DBUG_RETURN(0);
633
  }
634

bk@work.mysql.com's avatar
bk@work.mysql.com committed
635
  VOID(pthread_mutex_lock(&acl_cache->lock));
peter@mysql.com's avatar
peter@mysql.com committed
636

bk@work.mysql.com's avatar
bk@work.mysql.com committed
637
  /*
638 639 640
    Find acl entry in user database. Note, that find_acl_user is not the same,
    because it doesn't take into account the case when user is not empty,
    but acl_user->user is empty
bk@work.mysql.com's avatar
bk@work.mysql.com committed
641
  */
peter@mysql.com's avatar
peter@mysql.com committed
642

643
  for (uint i=0 ; i < acl_users.elements ; i++)
644
  {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
645 646
    ACL_USER *acl_user_tmp= dynamic_element(&acl_users,i,ACL_USER*);
    if (!acl_user_tmp->user || !strcmp(thd->user, acl_user_tmp->user))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
647
    {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
648
      if (compare_hostname(&acl_user_tmp->host, thd->host, thd->ip))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
649
      {
650
        /* check password: it should be empty or valid */
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
651
        if (passwd_len == acl_user_tmp->salt_len)
peter@mysql.com's avatar
peter@mysql.com committed
652
        {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
653
          if (acl_user_tmp->salt_len == 0 ||
serg@serg.mylan's avatar
serg@serg.mylan committed
654 655
              (acl_user_tmp->salt_len == SCRAMBLE_LENGTH ?
              check_scramble(passwd, thd->scramble, acl_user_tmp->salt) :
656
              check_scramble_323(passwd, thd->scramble,
serg@serg.mylan's avatar
serg@serg.mylan committed
657
                                 (ulong *) acl_user_tmp->salt)) == 0)
658
          {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
659
            acl_user= acl_user_tmp;
660 661
            res= 0;
          }
peter@mysql.com's avatar
peter@mysql.com committed
662
        }
663
        else if (passwd_len == SCRAMBLE_LENGTH &&
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
664
                 acl_user_tmp->salt_len == SCRAMBLE_LENGTH_323)
665
          res= -1;
666
        else if (passwd_len == SCRAMBLE_LENGTH_323 &&
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
667
                 acl_user_tmp->salt_len == SCRAMBLE_LENGTH)
668
          res= 2;
669 670
        /* linear search complete: */
        break;
peter@mysql.com's avatar
peter@mysql.com committed
671
      }
peter@mysql.com's avatar
peter@mysql.com committed
672
    }
673
  }
674 675 676 677
  /*
    This was moved to separate tree because of heavy HAVE_OPENSSL case.
    If acl_user is not null, res is 0.
  */
peter@mysql.com's avatar
peter@mysql.com committed
678 679 680

  if (acl_user)
  {
681
    /* OK. User found and password checked continue validation */
682
#ifdef HAVE_OPENSSL
683
    Vio *vio=thd->net.vio;
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
684
    SSL *ssl= (SSL*) vio->ssl_arg;
685
#endif
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
686

687
    /*
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
688
      At this point we know that user is allowed to connect
689 690 691 692 693 694
      from given host by given username/password pair. Now
      we check if SSL is required, if user is using SSL and
      if X509 certificate attributes are OK
    */
    switch (acl_user->ssl_type) {
    case SSL_TYPE_NOT_SPECIFIED:		// Impossible
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
695 696
    case SSL_TYPE_NONE:				// SSL is not required
      user_access= acl_user->access;
697
      break;
698
#ifdef HAVE_OPENSSL
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
699
    case SSL_TYPE_ANY:				// Any kind of SSL is ok
700
      if (vio_type(vio) == VIO_TYPE_SSL)
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
701
	user_access= acl_user->access;
702 703 704 705 706
      break;
    case SSL_TYPE_X509: /* Client should have any valid certificate. */
      /*
	Connections with non-valid certificates are dropped already
	in sslaccept() anyway, so we do not check validity here.
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
707

monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
708 709
	We need to check for absence of SSL because without SSL
	we should reject connection.
710
      */
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
711
      if (vio_type(vio) == VIO_TYPE_SSL &&
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
712 713
	  SSL_get_verify_result(ssl) == X509_V_OK &&
	  SSL_get_peer_certificate(ssl))
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
714
	user_access= acl_user->access;
715 716 717 718 719 720 721 722
      break;
    case SSL_TYPE_SPECIFIED: /* Client should have specified attrib */
      /*
	We do not check for absence of SSL because without SSL it does
	not pass all checks here anyway.
	If cipher name is specified, we compare it to actual cipher in
	use.
      */
monty@mysql.com's avatar
monty@mysql.com committed
723
      X509 *cert;
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
724
      if (vio_type(vio) != VIO_TYPE_SSL ||
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
725
	  SSL_get_verify_result(ssl) != X509_V_OK)
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
726
	break;
727
      if (acl_user->ssl_cipher)
peter@mysql.com's avatar
peter@mysql.com committed
728
      {
729
	DBUG_PRINT("info",("comparing ciphers: '%s' and '%s'",
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
730 731
			   acl_user->ssl_cipher,SSL_get_cipher(ssl)));
	if (!strcmp(acl_user->ssl_cipher,SSL_get_cipher(ssl)))
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
732
	  user_access= acl_user->access;
733 734
	else
	{
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
735
	  if (global_system_variables.log_warnings)
serg@serg.mylan's avatar
serg@serg.mylan committed
736 737 738
	    sql_print_information("X509 ciphers mismatch: should be '%s' but is '%s'",
			      acl_user->ssl_cipher,
			      SSL_get_cipher(ssl));
739 740
	  break;
	}
bk@work.mysql.com's avatar
bk@work.mysql.com committed
741
      }
742 743
      /* Prepare certificate (if exists) */
      DBUG_PRINT("info",("checkpoint 1"));
monty@mysql.com's avatar
monty@mysql.com committed
744 745 746 747 748
      if (!(cert= SSL_get_peer_certificate(ssl)))
      {
	user_access=NO_ACCESS;
	break;
      }
749 750 751
      DBUG_PRINT("info",("checkpoint 2"));
      /* If X509 issuer is speified, we check it... */
      if (acl_user->x509_issuer)
peter@mysql.com's avatar
peter@mysql.com committed
752
      {
kostja@oak.local's avatar
kostja@oak.local committed
753
        DBUG_PRINT("info",("checkpoint 3"));
754 755 756
	char *ptr = X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);
	DBUG_PRINT("info",("comparing issuers: '%s' and '%s'",
			   acl_user->x509_issuer, ptr));
kostja@oak.local's avatar
kostja@oak.local committed
757
        if (strcmp(acl_user->x509_issuer, ptr))
758
        {
kostja@oak.local's avatar
kostja@oak.local committed
759
          if (global_system_variables.log_warnings)
serg@serg.mylan's avatar
serg@serg.mylan committed
760 761
            sql_print_information("X509 issuer mismatch: should be '%s' "
			      "but is '%s'", acl_user->x509_issuer, ptr);
762
          free(ptr);
kostja@oak.local's avatar
kostja@oak.local committed
763
          break;
764
        }
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
765
        user_access= acl_user->access;
kostja@oak.local's avatar
kostja@oak.local committed
766
        free(ptr);
peter@mysql.com's avatar
peter@mysql.com committed
767
      }
768 769 770 771
      DBUG_PRINT("info",("checkpoint 4"));
      /* X509 subject is specified, we check it .. */
      if (acl_user->x509_subject)
      {
kostja@oak.local's avatar
kostja@oak.local committed
772 773 774 775
        char *ptr= X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);
        DBUG_PRINT("info",("comparing subjects: '%s' and '%s'",
                           acl_user->x509_subject, ptr));
        if (strcmp(acl_user->x509_subject,ptr))
776
        {
kostja@oak.local's avatar
kostja@oak.local committed
777
          if (global_system_variables.log_warnings)
serg@serg.mylan's avatar
serg@serg.mylan committed
778
            sql_print_information("X509 subject mismatch: '%s' vs '%s'",
kostja@oak.local's avatar
kostja@oak.local committed
779
                            acl_user->x509_subject, ptr);
780
        }
kostja@oak.local's avatar
kostja@oak.local committed
781
        else
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
782
          user_access= acl_user->access;
kostja@oak.local's avatar
kostja@oak.local committed
783
        free(ptr);
784 785
      }
      break;
peter@mysql.com's avatar
peter@mysql.com committed
786
#else  /* HAVE_OPENSSL */
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
787
    default:
788
      /*
kostja@oak.local's avatar
kostja@oak.local committed
789 790 791
        If we don't have SSL but SSL is required for this user the 
        authentication should fail.
      */
792 793
      break;
#endif /* HAVE_OPENSSL */
peter@mysql.com's avatar
peter@mysql.com committed
794
    }
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
795
    thd->master_access= user_access;
796 797
    thd->priv_user= acl_user->user ? thd->user : (char *) "";
    *mqh= acl_user->user_resource;
798

799 800 801 802 803
    if (acl_user->host.hostname)
      strmake(thd->priv_host, acl_user->host.hostname, MAX_HOSTNAME);
    else
      *thd->priv_host= 0;
  }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
804
  VOID(pthread_mutex_unlock(&acl_cache->lock));
805
  DBUG_RETURN(res);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
806 807 808 809 810 811 812 813 814 815
}


static byte* check_get_key(ACL_USER *buff,uint *length,
			   my_bool not_used __attribute__((unused)))
{
  *length=buff->hostname_length;
  return (byte*) buff->host.hostname;
}

816

bk@work.mysql.com's avatar
bk@work.mysql.com committed
817
static void acl_update_user(const char *user, const char *host,
818
			    const char *password, uint password_len,
819 820 821 822
			    enum SSL_type ssl_type,
			    const char *ssl_cipher,
			    const char *x509_issuer,
			    const char *x509_subject,
peter@mysql.com's avatar
peter@mysql.com committed
823
			    USER_RESOURCES  *mqh,
824
			    ulong privileges)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
825 826 827 828 829 830 831 832 833
{
  for (uint i=0 ; i < acl_users.elements ; i++)
  {
    ACL_USER *acl_user=dynamic_element(&acl_users,i,ACL_USER*);
    if (!acl_user->user && !user[0] ||
	acl_user->user &&
	!strcmp(user,acl_user->user))
    {
      if (!acl_user->host.hostname && !host[0] ||
834
	  acl_user->host.hostname &&
835
	  !my_strcasecmp(&my_charset_latin1, host, acl_user->host.hostname))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
836 837
      {
	acl_user->access=privileges;
838
	if (mqh->bits & 1)
839
	  acl_user->user_resource.questions=mqh->questions;
840
	if (mqh->bits & 2)
841
	  acl_user->user_resource.updates=mqh->updates;
842
	if (mqh->bits & 4)
843
	  acl_user->user_resource.connections=mqh->connections;
844 845 846 847 848 849 850 851 852 853
	if (ssl_type != SSL_TYPE_NOT_SPECIFIED)
	{
	  acl_user->ssl_type= ssl_type;
	  acl_user->ssl_cipher= (ssl_cipher ? strdup_root(&mem,ssl_cipher) :
				 0);
	  acl_user->x509_issuer= (x509_issuer ? strdup_root(&mem,x509_issuer) :
				  0);
	  acl_user->x509_subject= (x509_subject ?
				   strdup_root(&mem,x509_subject) : 0);
	}
854 855
	if (password)
	  set_user_salt(acl_user, password, password_len);
856
        /* search complete: */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
857 858 859 860 861 862 863 864
	break;
      }
    }
  }
}


static void acl_insert_user(const char *user, const char *host,
865
			    const char *password, uint password_len,
866 867 868 869
			    enum SSL_type ssl_type,
			    const char *ssl_cipher,
			    const char *x509_issuer,
			    const char *x509_subject,
870
			    USER_RESOURCES *mqh,
871
			    ulong privileges)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
872 873
{
  ACL_USER acl_user;
874
  acl_user.user=*user ? strdup_root(&mem,user) : 0;
monty@mysql.com's avatar
monty@mysql.com committed
875
  update_hostname(&acl_user.host, *host ? strdup_root(&mem, host): 0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
876
  acl_user.access=privileges;
877
  acl_user.user_resource = *mqh;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
878
  acl_user.sort=get_sort(2,acl_user.host.hostname,acl_user.user);
879
  acl_user.hostname_length=(uint) strlen(host);
880 881 882 883 884
  acl_user.ssl_type= (ssl_type != SSL_TYPE_NOT_SPECIFIED ?
		      ssl_type : SSL_TYPE_NONE);
  acl_user.ssl_cipher=	ssl_cipher   ? strdup_root(&mem,ssl_cipher) : 0;
  acl_user.x509_issuer= x509_issuer  ? strdup_root(&mem,x509_issuer) : 0;
  acl_user.x509_subject=x509_subject ? strdup_root(&mem,x509_subject) : 0;
885 886

  set_user_salt(&acl_user, password, password_len);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
887 888 889 890

  VOID(push_dynamic(&acl_users,(gptr) &acl_user));
  if (!acl_user.host.hostname || acl_user.host.hostname[0] == wild_many
      && !acl_user.host.hostname[1])
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
891
    allow_all_hosts=1;		// Anyone can connect /* purecov: tested */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
892 893 894 895 896 897 898 899 900 901 902
  qsort((gptr) dynamic_element(&acl_users,0,ACL_USER*),acl_users.elements,
	sizeof(ACL_USER),(qsort_cmp) acl_compare);

  /* We must free acl_check_hosts as its memory is mapped to acl_user */
  delete_dynamic(&acl_wild_hosts);
  hash_free(&acl_check_hosts);
  init_check_host();
}


static void acl_update_db(const char *user, const char *host, const char *db,
903
			  ulong privileges)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
904 905 906 907 908 909 910 911 912
{
  for (uint i=0 ; i < acl_dbs.elements ; i++)
  {
    ACL_DB *acl_db=dynamic_element(&acl_dbs,i,ACL_DB*);
    if (!acl_db->user && !user[0] ||
	acl_db->user &&
	!strcmp(user,acl_db->user))
    {
      if (!acl_db->host.hostname && !host[0] ||
913
	  acl_db->host.hostname &&
914
	  !my_strcasecmp(&my_charset_latin1, host, acl_db->host.hostname))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
915 916 917 918 919 920 921 922 923 924 925 926 927 928 929
      {
	if (!acl_db->db && !db[0] ||
	    acl_db->db && !strcmp(db,acl_db->db))
	{
	  if (privileges)
	    acl_db->access=privileges;
	  else
	    delete_dynamic_element(&acl_dbs,i);
	}
      }
    }
  }
}


930 931 932 933 934 935 936 937 938 939 940 941 942 943
/*
  Insert a user/db/host combination into the global acl_cache

  SYNOPSIS
    acl_insert_db()
    user		User name
    host		Host name
    db			Database name
    privileges		Bitmap of privileges

  NOTES
    acl_cache->lock must be locked when calling this
*/

bk@work.mysql.com's avatar
bk@work.mysql.com committed
944
static void acl_insert_db(const char *user, const char *host, const char *db,
945
			  ulong privileges)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
946 947
{
  ACL_DB acl_db;
948
  safe_mutex_assert_owner(&acl_cache->lock);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
949 950 951 952 953 954 955 956 957 958 959
  acl_db.user=strdup_root(&mem,user);
  update_hostname(&acl_db.host,strdup_root(&mem,host));
  acl_db.db=strdup_root(&mem,db);
  acl_db.access=privileges;
  acl_db.sort=get_sort(3,acl_db.host.hostname,acl_db.db,acl_db.user);
  VOID(push_dynamic(&acl_dbs,(gptr) &acl_db));
  qsort((gptr) dynamic_element(&acl_dbs,0,ACL_DB*),acl_dbs.elements,
	sizeof(ACL_DB),(qsort_cmp) acl_compare);
}


960 961 962 963

/*
  Get privilege for a host, user and db combination
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
964

965
ulong acl_get(const char *host, const char *ip,
966
              const char *user, const char *db, my_bool db_is_pattern)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
967
{
968 969
  ulong host_access,db_access;
  uint i,key_length;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
970
  db_access=0; host_access= ~0;
971
  char key[ACL_KEY_LENGTH],*tmp_db,*end;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
972 973 974
  acl_entry *entry;

  VOID(pthread_mutex_lock(&acl_cache->lock));
975
  end=strmov((tmp_db=strmov(strmov(key, ip ? ip : "")+1,user)+1),db);
976 977
  if (lower_case_table_names)
  {
978
    my_casedn_str(files_charset_info, tmp_db);
979 980
    db=tmp_db;
  }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998
  key_length=(uint) (end-key);
  if ((entry=(acl_entry*) acl_cache->search(key,key_length)))
  {
    db_access=entry->access;
    VOID(pthread_mutex_unlock(&acl_cache->lock));
    return db_access;
  }

  /*
    Check if there are some access rights for database and user
  */
  for (i=0 ; i < acl_dbs.elements ; i++)
  {
    ACL_DB *acl_db=dynamic_element(&acl_dbs,i,ACL_DB*);
    if (!acl_db->user || !strcmp(user,acl_db->user))
    {
      if (compare_hostname(&acl_db->host,host,ip))
      {
999
	if (!acl_db->db || !wild_compare(db,acl_db->db,db_is_pattern))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020
	{
	  db_access=acl_db->access;
	  if (acl_db->host.hostname)
	    goto exit;				// Fully specified. Take it
	  break; /* purecov: tested */
	}
      }
    }
  }
  if (!db_access)
    goto exit;					// Can't be better

  /*
    No host specified for user. Get hostdata from host table
  */
  host_access=0;				// Host must be found
  for (i=0 ; i < acl_hosts.elements ; i++)
  {
    ACL_HOST *acl_host=dynamic_element(&acl_hosts,i,ACL_HOST*);
    if (compare_hostname(&acl_host->host,host,ip))
    {
1021
      if (!acl_host->db || !wild_compare(db,acl_host->db,db_is_pattern))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040
      {
	host_access=acl_host->access;		// Fully specified. Take it
	break;
      }
    }
  }
exit:
  /* Save entry in cache for quick retrieval */
  if ((entry= (acl_entry*) malloc(sizeof(acl_entry)+key_length)))
  {
    entry->access=(db_access & host_access);
    entry->length=key_length;
    memcpy((gptr) entry->key,key,key_length);
    acl_cache->add(entry);
  }
  VOID(pthread_mutex_unlock(&acl_cache->lock));
  return (db_access & host_access);
}

1041 1042 1043 1044 1045 1046 1047
/*
  Check if there are any possible matching entries for this host

  NOTES
    All host names without wild cards are stored in a hash table,
    entries with wildcards are stored in a dynamic array
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1048 1049 1050 1051

static void init_check_host(void)
{
  DBUG_ENTER("init_check_host");
1052
  VOID(my_init_dynamic_array(&acl_wild_hosts,sizeof(struct acl_host_and_ip),
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1053
			  acl_users.elements,1));
1054
  VOID(hash_init(&acl_check_hosts,&my_charset_latin1,acl_users.elements,0,0,
1055
		 (hash_get_key) check_get_key,0,0));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069
  if (!allow_all_hosts)
  {
    for (uint i=0 ; i < acl_users.elements ; i++)
    {
      ACL_USER *acl_user=dynamic_element(&acl_users,i,ACL_USER*);
      if (strchr(acl_user->host.hostname,wild_many) ||
	  strchr(acl_user->host.hostname,wild_one) ||
	  acl_user->host.ip_mask)
      {						// Has wildcard
	uint j;
	for (j=0 ; j < acl_wild_hosts.elements ; j++)
	{					// Check if host already exists
	  acl_host_and_ip *acl=dynamic_element(&acl_wild_hosts,j,
					       acl_host_and_ip *);
1070
	  if (!my_strcasecmp(&my_charset_latin1,
1071
                             acl_user->host.hostname, acl->hostname))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1072 1073 1074 1075 1076 1077
	    break;				// already stored
	}
	if (j == acl_wild_hosts.elements)	// If new
	  (void) push_dynamic(&acl_wild_hosts,(char*) &acl_user->host);
      }
      else if (!hash_search(&acl_check_hosts,(byte*) &acl_user->host,
1078
			    (uint) strlen(acl_user->host.hostname)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1079
      {
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
1080
	if (my_hash_insert(&acl_check_hosts,(byte*) acl_user))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101
	{					// End of memory
	  allow_all_hosts=1;			// Should never happen
	  DBUG_VOID_RETURN;
	}
      }
    }
  }
  freeze_size(&acl_wild_hosts);
  freeze_size(&acl_check_hosts.array);
  DBUG_VOID_RETURN;
}


/* Return true if there is no users that can match the given host */

bool acl_check_host(const char *host, const char *ip)
{
  if (allow_all_hosts)
    return 0;
  VOID(pthread_mutex_lock(&acl_cache->lock));

1102 1103
  if (host && hash_search(&acl_check_hosts,(byte*) host,(uint) strlen(host)) ||
      ip && hash_search(&acl_check_hosts,(byte*) ip,(uint) strlen(ip)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121
  {
    VOID(pthread_mutex_unlock(&acl_cache->lock));
    return 0;					// Found host
  }
  for (uint i=0 ; i < acl_wild_hosts.elements ; i++)
  {
    acl_host_and_ip *acl=dynamic_element(&acl_wild_hosts,i,acl_host_and_ip*);
    if (compare_hostname(acl, host, ip))
    {
      VOID(pthread_mutex_unlock(&acl_cache->lock));
      return 0;					// Host ok
    }
  }
  VOID(pthread_mutex_unlock(&acl_cache->lock));
  return 1;					// Host is not allowed
}


1122 1123 1124 1125 1126 1127 1128 1129
/*
  Check if the user is allowed to change password

  SYNOPSIS:
    check_change_password()
    thd		THD
    host	hostname for the user
    user	user name
monty@hundin.mysql.fi's avatar
merge  
monty@hundin.mysql.fi committed
1130

1131
    RETURN VALUE
1132 1133
      0		OK
      1		ERROR  ; In this case the error is sent to the client.
1134 1135
*/

1136 1137
bool check_change_password(THD *thd, const char *host, const char *user,
                           char *new_password)
1138
{
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1139 1140
  if (!initialized)
  {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
1141
    net_printf(thd,ER_OPTION_PREVENTS_STATEMENT,
1142 1143
             "--skip-grant-tables");
    return(1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1144
  }
1145 1146
  if (!thd->slave_thread &&
      (strcmp(thd->user,user) ||
1147
       my_strcasecmp(&my_charset_latin1, host, thd->host_or_ip)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1148
  {
hf@deer.(none)'s avatar
hf@deer.(none) committed
1149
    if (check_access(thd, UPDATE_ACL, "mysql",0,1,0))
1150
      return(1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1151
  }
1152 1153
  if (!thd->slave_thread && !thd->user[0])
  {
1154
    send_error(thd, ER_PASSWORD_ANONYMOUS_USER);
1155
    return(1);
1156
  }
1157
  uint len=strlen(new_password);
1158
  if (len && len != SCRAMBLED_PASSWORD_CHAR_LENGTH &&
1159 1160 1161 1162 1163 1164 1165
      len != SCRAMBLED_PASSWORD_CHAR_LENGTH_323)
  {
    net_printf(thd, 0,
               "Password hash should be a %d-digit hexadecimal number",
               SCRAMBLED_PASSWORD_CHAR_LENGTH);
    return -1;
  }
1166 1167 1168 1169
  return(0);
}


1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182
/*
  Change a password for a user

  SYNOPSIS
    change_password()
    thd			Thread handle
    host		Hostname
    user		User name
    new_password	New password for host@user

  RETURN VALUES
    0	ok
    1	ERROR; In this case the error is sent to the client.
peter@mysql.com's avatar
peter@mysql.com committed
1183
*/
1184

1185 1186 1187 1188 1189 1190 1191 1192
bool change_password(THD *thd, const char *host, const char *user,
		     char *new_password)
{
  DBUG_ENTER("change_password");
  DBUG_PRINT("enter",("host: '%s'  user: '%s'  new_password: '%s'",
		      host,user,new_password));
  DBUG_ASSERT(host != 0);			// Ensured by parent

1193
  if (check_change_password(thd, host, user, new_password))
1194 1195
    DBUG_RETURN(1);

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1196 1197
  VOID(pthread_mutex_lock(&acl_cache->lock));
  ACL_USER *acl_user;
1198
  if (!(acl_user= find_acl_user(host, user)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1199 1200
  {
    VOID(pthread_mutex_unlock(&acl_cache->lock));
1201
    send_error(thd, ER_PASSWORD_NO_MATCH);
1202
    DBUG_RETURN(1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1203
  }
1204 1205 1206 1207
  /* update loaded acl entry: */
  uint new_password_len= new_password ? strlen(new_password) : 0;
  set_user_salt(acl_user, new_password, new_password_len);

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1208 1209
  if (update_user_table(thd,
			acl_user->host.hostname ? acl_user->host.hostname : "",
1210
			acl_user->user ? acl_user->user : "",
1211
			new_password, new_password_len))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1212 1213
  {
    VOID(pthread_mutex_unlock(&acl_cache->lock)); /* purecov: deadcode */
1214
    send_error(thd,0); /* purecov: deadcode */
1215
    DBUG_RETURN(1); /* purecov: deadcode */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1216
  }
peter@mysql.com's avatar
peter@mysql.com committed
1217

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1218 1219 1220
  acl_cache->clear(1);				// Clear locked hostname cache
  VOID(pthread_mutex_unlock(&acl_cache->lock));

1221
  char buff[512]; /* Extend with extended password length*/
1222
  ulong query_length=
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1223 1224
    my_sprintf(buff,
	       (buff,"SET PASSWORD FOR \"%-.120s\"@\"%-.120s\"=\"%-.120s\"",
1225
		acl_user->user ? acl_user->user : "",
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1226 1227
		acl_user->host.hostname ? acl_user->host.hostname : "",
		new_password));
guilhem@mysql.com's avatar
guilhem@mysql.com committed
1228
  thd->clear_error();
1229
  mysql_update_log.write(thd, buff, query_length);
1230
  Query_log_event qinfo(thd, buff, query_length, 0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1231
  mysql_bin_log.write(&qinfo);
1232
  DBUG_RETURN(0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1233 1234 1235 1236 1237 1238 1239 1240 1241 1242
}


/*
  Find first entry that matches the current user
*/

static ACL_USER *
find_acl_user(const char *host, const char *user)
{
1243
  DBUG_ENTER("find_acl_user");
1244
  DBUG_PRINT("enter",("host: '%s'  user: '%s'",host,user));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1245 1246 1247
  for (uint i=0 ; i < acl_users.elements ; i++)
  {
    ACL_USER *acl_user=dynamic_element(&acl_users,i,ACL_USER*);
1248
    DBUG_PRINT("info",("strcmp('%s','%s'), compare_hostname('%s','%s'),",
1249 1250 1251 1252 1253
		       user,
		       acl_user->user ? acl_user->user : "",
		       host,
		       acl_user->host.hostname ? acl_user->host.hostname :
		       ""));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1254 1255 1256
    if (!acl_user->user && !user[0] ||
	acl_user->user && !strcmp(user,acl_user->user))
    {
1257
      if (compare_hostname(&acl_user->host,host,host))
1258 1259 1260
      {
	DBUG_RETURN(acl_user);
      }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1261 1262
    }
  }
1263
  DBUG_RETURN(0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1264 1265 1266
}


1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277
/*
  Comparing of hostnames

  NOTES
  A hostname may be of type:
  hostname   (May include wildcards);   monty.pp.sci.fi
  ip	   (May include wildcards);   192.168.0.0
  ip/netmask			      192.168.0.0/255.255.255.0

  A net mask of 0.0.0.0 is not allowed.
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300

static const char *calc_ip(const char *ip, long *val, char end)
{
  long ip_val,tmp;
  if (!(ip=str2int(ip,10,0,255,&ip_val)) || *ip != '.')
    return 0;
  ip_val<<=24;
  if (!(ip=str2int(ip+1,10,0,255,&tmp)) || *ip != '.')
    return 0;
  ip_val+=tmp<<16;
  if (!(ip=str2int(ip+1,10,0,255,&tmp)) || *ip != '.')
    return 0;
  ip_val+=tmp<<8;
  if (!(ip=str2int(ip+1,10,0,255,&tmp)) || *ip != end)
    return 0;
  *val=ip_val+tmp;
  return ip;
}


static void update_hostname(acl_host_and_ip *host, const char *hostname)
{
  host->hostname=(char*) hostname;		// This will not be modified!
1301
  if (!hostname ||
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1302 1303 1304
      (!(hostname=calc_ip(hostname,&host->ip,'/')) ||
       !(hostname=calc_ip(hostname+1,&host->ip_mask,'\0'))))
  {
1305
    host->ip= host->ip_mask=0;			// Not a masked ip
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318
  }
}


static bool compare_hostname(const acl_host_and_ip *host, const char *hostname,
			     const char *ip)
{
  long tmp;
  if (host->ip_mask && ip && calc_ip(ip,&tmp,'\0'))
  {
    return (tmp & host->ip_mask) == host->ip;
  }
  return (!host->hostname ||
1319
	  (hostname && !wild_case_compare(&my_charset_latin1,
1320
                                          hostname,host->hostname)) ||
1321
	  (ip && !wild_compare(ip,host->hostname,0)));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1322 1323
}

hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
1324 1325 1326 1327
bool hostname_requires_resolving(const char *hostname)
{
  char cur;
  if (!hostname)
monty@mysql.com's avatar
monty@mysql.com committed
1328
    return FALSE;
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
1329 1330 1331 1332 1333
  int namelen= strlen(hostname);
  int lhlen= strlen(my_localhost);
  if ((namelen == lhlen) &&
      !my_strnncoll(&my_charset_latin1, (const uchar *)hostname,  namelen,
		    (const uchar *)my_localhost, strlen(my_localhost)))
monty@mysql.com's avatar
monty@mysql.com committed
1334
    return FALSE;
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
1335 1336 1337 1338
  for (; (cur=*hostname); hostname++)
  {
    if ((cur != '%') && (cur != '_') && (cur != '.') &&
	((cur < '0') || (cur > '9')))
monty@mysql.com's avatar
monty@mysql.com committed
1339
      return TRUE;
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
1340
  }
monty@mysql.com's avatar
monty@mysql.com committed
1341
  return FALSE;
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
1342
}
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1343

1344 1345 1346
/*
  Update grants in the user and database privilege tables
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1347 1348

static bool update_user_table(THD *thd, const char *host, const char *user,
1349
			      const char *new_password, uint new_password_len)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1350 1351 1352 1353 1354 1355 1356 1357
{
  TABLE_LIST tables;
  TABLE *table;
  bool error=1;
  DBUG_ENTER("update_user_table");
  DBUG_PRINT("enter",("user: %s  host: %s",user,host));

  bzero((char*) &tables,sizeof(tables));
1358
  tables.alias=tables.real_name=(char*) "user";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1359
  tables.db=(char*) "mysql";
bell@sanja.is.com.ua's avatar
bell@sanja.is.com.ua committed
1360

1361 1362 1363 1364 1365 1366 1367
#ifdef HAVE_REPLICATION
  /*
    GRANT and REVOKE are applied the slave in/exclusion rules as they are
    some kind of updates to the mysql.% tables.
  */
  if (thd->slave_thread && table_rules_on)
  {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
1368 1369 1370
    /*
      The tables must be marked "updating" so that tables_ok() takes them into
      account in tests.  It's ok to leave 'updating' set after tables_ok.
1371
    */
1372
    tables.updating= 1;
1373 1374 1375 1376 1377 1378
    /* Thanks to bzero, tables.next==0 */
    if (!tables_ok(0, &tables))
      DBUG_RETURN(0);
  }
#endif

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1379 1380
  if (!(table=open_ltable(thd,&tables,TL_WRITE)))
    DBUG_RETURN(1); /* purecov: deadcode */
1381 1382
  table->field[0]->store(host,(uint) strlen(host), &my_charset_latin1);
  table->field[1]->store(user,(uint) strlen(user), &my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1383 1384 1385 1386 1387 1388 1389 1390

  if (table->file->index_read_idx(table->record[0],0,
				  (byte*) table->field[0]->ptr,0,
				  HA_READ_KEY_EXACT))
  {
    my_error(ER_PASSWORD_NO_MATCH,MYF(0));	/* purecov: deadcode */
    DBUG_RETURN(1);				/* purecov: deadcode */
  }
1391
  store_record(table,record[1]);
1392
  table->field[2]->store(new_password, new_password_len, &my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404
  if ((error=table->file->update_row(table->record[1],table->record[0])))
  {
    table->file->print_error(error,MYF(0));	/* purecov: deadcode */
    goto end;					/* purecov: deadcode */
  }
  error=0;					// Record updated

end:
  close_thread_tables(thd);
  DBUG_RETURN(error);
}

monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1405 1406 1407 1408 1409 1410 1411 1412 1413

/* Return 1 if we are allowed to create new users */

static bool test_if_create_new_users(THD *thd)
{
  bool create_new_users=1;    // Assume that we are allowed to create new users
  if (opt_safe_user_create && !(thd->master_access & INSERT_ACL))
  {
    TABLE_LIST tl;
1414
    ulong db_access;
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1415 1416
    bzero((char*) &tl,sizeof(tl));
    tl.db=	   (char*) "mysql";
1417
    tl.real_name=  (char*) "user";
bell@sanja.is.com.ua's avatar
bell@sanja.is.com.ua committed
1418

1419
    db_access=acl_get(thd->host, thd->ip,
1420
		      thd->priv_user, tl.db, 0);
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1421 1422
    if (!(db_access & INSERT_ACL))
    {
bell@sanja.is.com.ua's avatar
bell@sanja.is.com.ua committed
1423
      if (check_grant(thd, INSERT_ACL, &tl, 0, UINT_MAX, 1))
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1424 1425 1426 1427 1428 1429 1430
	create_new_users=0;
    }
  }
  return create_new_users;
}


bk@work.mysql.com's avatar
bk@work.mysql.com committed
1431
/****************************************************************************
1432
  Handle GRANT commands
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1433 1434
****************************************************************************/

1435
static int replace_user_table(THD *thd, TABLE *table, const LEX_USER &combo,
1436 1437
			      ulong rights, bool revoke_grant,
			      bool create_user)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1438 1439
{
  int error = -1;
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1440
  bool old_row_exists=0;
1441
  const char *password= "";
1442
  uint password_len= 0;
1443
  char what= (revoke_grant) ? 'N' : 'Y';
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1444
  DBUG_ENTER("replace_user_table");
1445
  safe_mutex_assert_owner(&acl_cache->lock);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1446 1447

  if (combo.password.str && combo.password.str[0])
1448
  {
1449 1450
    if (combo.password.length != SCRAMBLED_PASSWORD_CHAR_LENGTH &&
        combo.password.length != SCRAMBLED_PASSWORD_CHAR_LENGTH_323)
1451
    {
1452
      my_printf_error(ER_UNKNOWN_ERROR,
1453 1454
                      "Password hash should be a %d-digit hexadecimal number",
                      MYF(0), SCRAMBLED_PASSWORD_CHAR_LENGTH);
1455
      DBUG_RETURN(-1);
1456
    }
1457
    password_len= combo.password.length;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1458
    password=combo.password.str;
1459
  }
peter@mysql.com's avatar
peter@mysql.com committed
1460

1461 1462
  table->field[0]->store(combo.host.str,combo.host.length, &my_charset_latin1);
  table->field[1]->store(combo.user.str,combo.user.length, &my_charset_latin1);
1463
  if (table->file->index_read_idx(table->record[0], 0,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1464 1465 1466
			      (byte*) table->field[0]->ptr,0,
			      HA_READ_KEY_EXACT))
  {
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1467
    if (!create_user)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1468
    {
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1469
      if (what == 'N')
guilhem@mysql.com's avatar
guilhem@mysql.com committed
1470
	my_error(ER_NONEXISTING_GRANT, MYF(0), combo.user.str, combo.host.str);
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1471
      else
guilhem@mysql.com's avatar
guilhem@mysql.com committed
1472 1473
	my_error(ER_NO_PERMISSION_TO_CREATE_USER, MYF(0),
                 thd->user, thd->host_or_ip);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1474 1475
      goto end;
    }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1476
    old_row_exists = 0;
1477 1478 1479 1480 1481 1482 1483
    restore_record(table,default_values);       // cp empty row from default_values
    table->field[0]->store(combo.host.str,combo.host.length,
                           &my_charset_latin1);
    table->field[1]->store(combo.user.str,combo.user.length,
                           &my_charset_latin1);
    table->field[2]->store(password, password_len,
                           &my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1484 1485 1486
  }
  else
  {
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1487
    old_row_exists = 1;
1488
    store_record(table,record[1]);			// Save copy for update
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1489
    if (combo.password.str)			// If password given
1490
      table->field[2]->store(password, password_len, &my_charset_latin1);
1491 1492 1493 1494 1495
    else if (!rights && !revoke_grant && thd->lex->ssl_type == SSL_TYPE_NOT_SPECIFIED &&
	     !thd->lex->mqh.bits)
    {
      DBUG_RETURN(0);
    }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1496 1497
  }

1498 1499 1500 1501 1502 1503 1504 1505
  /* Update table columns with new privileges */

  Field **tmp_field;
  ulong priv;
  for (tmp_field= table->field+3, priv = SELECT_ACL;
       *tmp_field && (*tmp_field)->real_type() == FIELD_TYPE_ENUM &&
	 ((Field_enum*) (*tmp_field))->typelib->count == 2 ;
       tmp_field++, priv <<= 1)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1506
  {
1507
    if (priv & rights)				 // set requested privileges
1508
      (*tmp_field)->store(&what, 1, &my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1509 1510
  }
  rights=get_access(table,3);
1511
  DBUG_PRINT("info",("table->fields: %d",table->fields));
1512
  if (table->fields >= 31)		/* From 4.0.0 we have more fields */
1513
  {
1514
    /* We write down SSL related ACL stuff */
1515
    switch (thd->lex->ssl_type) {
1516
    case SSL_TYPE_ANY:
1517 1518 1519 1520
      table->field[24]->store("ANY",3, &my_charset_latin1);
      table->field[25]->store("", 0, &my_charset_latin1);
      table->field[26]->store("", 0, &my_charset_latin1);
      table->field[27]->store("", 0, &my_charset_latin1);
1521 1522
      break;
    case SSL_TYPE_X509:
1523 1524 1525 1526
      table->field[24]->store("X509",4, &my_charset_latin1);
      table->field[25]->store("", 0, &my_charset_latin1);
      table->field[26]->store("", 0, &my_charset_latin1);
      table->field[27]->store("", 0, &my_charset_latin1);
1527 1528
      break;
    case SSL_TYPE_SPECIFIED:
1529 1530 1531 1532
      table->field[24]->store("SPECIFIED",9, &my_charset_latin1);
      table->field[25]->store("", 0, &my_charset_latin1);
      table->field[26]->store("", 0, &my_charset_latin1);
      table->field[27]->store("", 0, &my_charset_latin1);
1533 1534 1535 1536 1537 1538 1539 1540 1541
      if (thd->lex->ssl_cipher)
	table->field[25]->store(thd->lex->ssl_cipher,
				strlen(thd->lex->ssl_cipher), &my_charset_latin1);
      if (thd->lex->x509_issuer)
	table->field[26]->store(thd->lex->x509_issuer,
				strlen(thd->lex->x509_issuer), &my_charset_latin1);
      if (thd->lex->x509_subject)
	table->field[27]->store(thd->lex->x509_subject,
				strlen(thd->lex->x509_subject), &my_charset_latin1);
1542
      break;
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
1543
    case SSL_TYPE_NOT_SPECIFIED:
gluh@gluh.(none)'s avatar
gluh@gluh.(none) committed
1544 1545
      break;
    case SSL_TYPE_NONE:
1546 1547 1548 1549
      table->field[24]->store("", 0, &my_charset_latin1);
      table->field[25]->store("", 0, &my_charset_latin1);
      table->field[26]->store("", 0, &my_charset_latin1);
      table->field[27]->store("", 0, &my_charset_latin1);
gluh@gluh.(none)'s avatar
gluh@gluh.(none) committed
1550
      break;
1551
    }
1552

1553
    USER_RESOURCES mqh= thd->lex->mqh;
1554
    if (mqh.bits & 1)
1555
      table->field[28]->store((longlong) mqh.questions);
1556
    if (mqh.bits & 2)
1557
      table->field[29]->store((longlong) mqh.updates);
1558
    if (mqh.bits & 4)
1559
      table->field[30]->store((longlong) mqh.connections);
1560
    mqh_used = mqh_used || mqh.questions || mqh.updates || mqh.connections;
1561
  }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1562
  if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1563 1564 1565 1566 1567
  {
    /*
      We should NEVER delete from the user table, as a uses can still
      use mysqld even if he doesn't have any privileges in the user table!
    */
1568
    if (cmp_record(table,record[1]) &&
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587
	(error=table->file->update_row(table->record[1],table->record[0])))
    {						// This should never happen
      table->file->print_error(error,MYF(0));	/* purecov: deadcode */
      error= -1;				/* purecov: deadcode */
      goto end;					/* purecov: deadcode */
    }
  }
  else if ((error=table->file->write_row(table->record[0]))) // insert
  {						// This should never happen
    if (error && error != HA_ERR_FOUND_DUPP_KEY &&
	error != HA_ERR_FOUND_DUPP_UNIQUE)	/* purecov: inspected */
    {
      table->file->print_error(error,MYF(0));	/* purecov: deadcode */
      error= -1;				/* purecov: deadcode */
      goto end;					/* purecov: deadcode */
    }
  }
  error=0;					// Privileges granted / revoked

1588
end:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1589 1590 1591
  if (!error)
  {
    acl_cache->clear(1);			// Clear privilege cache
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1592
    if (old_row_exists)
1593 1594
      acl_update_user(combo.user.str, combo.host.str,
                      combo.password.str, password_len,
1595 1596 1597 1598 1599
		      thd->lex->ssl_type,
		      thd->lex->ssl_cipher,
		      thd->lex->x509_issuer,
		      thd->lex->x509_subject,
		      &thd->lex->mqh,
1600
		      rights);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1601
    else
1602
      acl_insert_user(combo.user.str, combo.host.str, password, password_len,
1603 1604 1605 1606 1607
		      thd->lex->ssl_type,
		      thd->lex->ssl_cipher,
		      thd->lex->x509_issuer,
		      thd->lex->x509_subject,
		      &thd->lex->mqh,
1608
		      rights);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1609 1610 1611 1612 1613 1614
  }
  DBUG_RETURN(error);
}


/*
1615
  change grants in the mysql.db table
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1616 1617 1618 1619
*/

static int replace_db_table(TABLE *table, const char *db,
			    const LEX_USER &combo,
1620
			    ulong rights, bool revoke_grant)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1621
{
1622 1623
  uint i;
  ulong priv,store_rights;
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1624
  bool old_row_exists=0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1625
  int error;
1626
  char what= (revoke_grant) ? 'N' : 'Y';
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1627 1628
  DBUG_ENTER("replace_db_table");

1629 1630
  if (!initialized)
  {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
1631
    my_error(ER_OPTION_PREVENTS_STATEMENT, MYF(0), "--skip-grant-tables");
1632 1633 1634
    DBUG_RETURN(-1);
  }

1635
  /* Check if there is such a user in user table in memory? */
1636
  if (!find_acl_user(combo.host.str,combo.user.str))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1637 1638 1639 1640 1641
  {
    my_error(ER_PASSWORD_NO_MATCH,MYF(0));
    DBUG_RETURN(-1);
  }

1642 1643 1644
  table->field[0]->store(combo.host.str,combo.host.length, &my_charset_latin1);
  table->field[1]->store(db,(uint) strlen(db), &my_charset_latin1);
  table->field[2]->store(combo.user.str,combo.user.length, &my_charset_latin1);
1645
  if (table->file->index_read_idx(table->record[0],0,(byte*) table->field[0]->ptr,0,
1646
			      HA_READ_KEY_EXACT))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1647 1648 1649
  {
    if (what == 'N')
    { // no row, no revoke
guilhem@mysql.com's avatar
guilhem@mysql.com committed
1650
      my_error(ER_NONEXISTING_GRANT, MYF(0), combo.user.str, combo.host.str);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1651 1652
      goto abort;
    }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1653
    old_row_exists = 0;
1654
    restore_record(table,default_values);			// cp empty row from default_values
1655 1656 1657
    table->field[0]->store(combo.host.str,combo.host.length, &my_charset_latin1);
    table->field[1]->store(db,(uint) strlen(db), &my_charset_latin1);
    table->field[2]->store(combo.user.str,combo.user.length, &my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1658 1659 1660
  }
  else
  {
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1661
    old_row_exists = 1;
1662
    store_record(table,record[1]);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1663 1664 1665
  }

  store_rights=get_rights_for_db(rights);
1666
  for (i= 3, priv= 1; i < table->fields; i++, priv <<= 1)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1667
  {
1668
    if (priv & store_rights)			// do it if priv is chosen
1669
      table->field [i]->store(&what,1, &my_charset_latin1);// set requested privileges
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1670 1671 1672 1673
  }
  rights=get_access(table,3);
  rights=fix_rights_for_db(rights);

monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1674
  if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1675
  {
1676
    /* update old existing row */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694
    if (rights)
    {
      if ((error=table->file->update_row(table->record[1],table->record[0])))
	goto table_error;			/* purecov: deadcode */
    }
    else	/* must have been a revoke of all privileges */
    {
      if ((error = table->file->delete_row(table->record[1])))
	goto table_error;			/* purecov: deadcode */
    }
  }
  else if ((error=table->file->write_row(table->record[0])))
  {
    if (error && error != HA_ERR_FOUND_DUPP_KEY) /* purecov: inspected */
      goto table_error; /* purecov: deadcode */
  }

  acl_cache->clear(1);				// Clear privilege cache
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1695
  if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1696 1697 1698 1699 1700 1701
    acl_update_db(combo.user.str,combo.host.str,db,rights);
  else
    acl_insert_db(combo.user.str,combo.host.str,db,rights);
  DBUG_RETURN(0);

  /* This could only happen if the grant tables got corrupted */
1702
table_error:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1703 1704
  table->file->print_error(error,MYF(0));	/* purecov: deadcode */

1705
abort:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1706 1707 1708 1709 1710 1711 1712 1713
  DBUG_RETURN(-1);
}


class GRANT_COLUMN :public Sql_alloc
{
public:
  char *column;
1714 1715 1716
  ulong rights;
  uint key_length;
  GRANT_COLUMN(String &c,  ulong y) :rights (y)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1717
  {
1718
    column= memdup_root(&memex,c.ptr(), key_length=c.length());
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1719 1720 1721
  }
};

1722

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1723 1724 1725 1726 1727 1728 1729
static byte* get_key_column(GRANT_COLUMN *buff,uint *length,
			    my_bool not_used __attribute__((unused)))
{
  *length=buff->key_length;
  return (byte*) buff->column;
}

1730

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1731 1732 1733
class GRANT_TABLE :public Sql_alloc
{
public:
monty@mysql.com's avatar
monty@mysql.com committed
1734
  char *host,*db, *user, *tname, *hash_key, *orig_host;
1735
  ulong privs, cols;
1736
  ulong sort;
1737
  uint key_length;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1738
  HASH hash_columns;
monty@mysql.com's avatar
monty@mysql.com committed
1739 1740 1741 1742

  GRANT_TABLE(const char *h, const char *d,const char *u,
              const char *t, ulong p, ulong c);
  GRANT_TABLE (TABLE *form, TABLE *col_privs);
1743 1744
  bool ok() { return privs != 0 || cols != 0; }
};
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1745

1746

monty@mysql.com's avatar
monty@mysql.com committed
1747

1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760
GRANT_TABLE::GRANT_TABLE(const char *h, const char *d,const char *u,
                         const char *t, ulong p, ulong c)
  :privs(p), cols(c)
{
  /* Host given by user */
  orig_host=  strdup_root(&memex,h);
  /* Convert empty hostname to '%' for easy comparision */
  host=  orig_host[0] ? orig_host : (char*) "%";
  db =   strdup_root(&memex,d);
  user = strdup_root(&memex,u);
  sort=  get_sort(3,host,db,user);
  tname= strdup_root(&memex,t);
  if (lower_case_table_names)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1761
  {
1762 1763
    my_casedn_str(files_charset_info, db);
    my_casedn_str(files_charset_info, tname);
1764 1765 1766 1767
  }
  key_length =(uint) strlen(d)+(uint) strlen(u)+(uint) strlen(t)+3;
  hash_key = (char*) alloc_root(&memex,key_length);
  strmov(strmov(strmov(hash_key,user)+1,db)+1,tname);
monty@mysql.com's avatar
monty@mysql.com committed
1768 1769
  (void) hash_init(&hash_columns,&my_charset_latin1,
                   0,0,0, (hash_get_key) get_key_column,0,0);
1770
}
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1771

1772 1773 1774 1775 1776

GRANT_TABLE::GRANT_TABLE(TABLE *form, TABLE *col_privs)
{
  byte key[MAX_KEY_LENGTH];

monty@mysql.com's avatar
monty@mysql.com committed
1777 1778 1779
  orig_host= host= get_field(&memex, form->field[0]);
  db=    get_field(&memex,form->field[1]);
  user=  get_field(&memex,form->field[2]);
1780 1781 1782 1783 1784 1785 1786
  if (!user)
    user= (char*) "";
  if (!orig_host)
  {
    orig_host= (char*) "";
    host= (char*) "%";
  }
monty@mysql.com's avatar
monty@mysql.com committed
1787 1788
  sort=  get_sort(3, orig_host, db, user);
  tname= get_field(&memex,form->field[3]);
1789 1790 1791 1792 1793 1794 1795 1796
  if (!db || !tname)
  {
    /* Wrong table row; Ignore it */
    privs = cols = 0;				/* purecov: inspected */
    return;					/* purecov: inspected */
  }
  if (lower_case_table_names)
  {
1797 1798
    my_casedn_str(files_charset_info, db);
    my_casedn_str(files_charset_info, tname);
1799 1800 1801 1802 1803 1804 1805 1806 1807 1808
  }
  key_length = ((uint) strlen(db) + (uint) strlen(user) +
                (uint) strlen(tname) + 3);
  hash_key = (char*) alloc_root(&memex,key_length);
  strmov(strmov(strmov(hash_key,user)+1,db)+1,tname);
  privs = (ulong) form->field[6]->val_int();
  cols  = (ulong) form->field[7]->val_int();
  privs = fix_rights_for_table(privs);
  cols =  fix_rights_for_column(cols);

monty@mysql.com's avatar
monty@mysql.com committed
1809 1810
  (void) hash_init(&hash_columns,&my_charset_latin1,
                   0,0,0, (hash_get_key) get_key_column,0,0);
1811 1812 1813
  if (cols)
  {
    int key_len;
monty@mysql.com's avatar
monty@mysql.com committed
1814 1815 1816 1817 1818
    col_privs->field[0]->store(orig_host,(uint) strlen(orig_host),
                               &my_charset_latin1);
    col_privs->field[1]->store(db,(uint) strlen(db), &my_charset_latin1);
    col_privs->field[2]->store(user,(uint) strlen(user), &my_charset_latin1);
    col_privs->field[3]->store(tname,(uint) strlen(tname), &my_charset_latin1);
1819 1820 1821 1822 1823
    key_len=(col_privs->field[0]->pack_length()+
             col_privs->field[1]->pack_length()+
             col_privs->field[2]->pack_length()+
             col_privs->field[3]->pack_length());
    key_copy(key,col_privs,0,key_len);
monty@mysql.com's avatar
monty@mysql.com committed
1824
    col_privs->field[4]->store("",0, &my_charset_latin1);
1825 1826
    col_privs->file->ha_index_init(0);
    if (col_privs->file->index_read(col_privs->record[0],
1827 1828
                                    (byte*) col_privs->field[0]->ptr,
                                    key_len, HA_READ_KEY_EXACT))
1829
    {
1830
      cols = 0; /* purecov: deadcode */
1831
      col_privs->file->ha_index_end();
1832
      return;
1833
    }
1834
    do
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1835
    {
1836 1837 1838
      String *res,column_name;
      GRANT_COLUMN *mem_check;
      /* As column name is a string, we don't have to supply a buffer */
monty@mysql.com's avatar
monty@mysql.com committed
1839
      res=col_privs->field[4]->val_str(&column_name);
1840 1841 1842
      ulong priv= (ulong) col_privs->field[6]->val_int();
      if (!(mem_check = new GRANT_COLUMN(*res,
                                         fix_rights_for_column(priv))))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1843
      {
1844 1845 1846
        /* Don't use this entry */
        privs = cols = 0;			/* purecov: deadcode */
        return;				/* purecov: deadcode */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1847
      }
monty@mysql.com's avatar
monty@mysql.com committed
1848
      my_hash_insert(&hash_columns, (byte *) mem_check);
1849
    } while (!col_privs->file->index_next(col_privs->record[0]) &&
1850
             !key_cmp_if_same(col_privs,key,0,key_len));
1851
    col_privs->file->ha_index_end();
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1852
  }
1853
}
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1854

1855

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1856 1857 1858 1859 1860 1861 1862
static byte* get_grant_table(GRANT_TABLE *buff,uint *length,
			     my_bool not_used __attribute__((unused)))
{
  *length=buff->key_length;
  return (byte*) buff->hash_key;
}

1863

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1864 1865 1866 1867 1868
void free_grant_table(GRANT_TABLE *grant_table)
{
  hash_free(&grant_table->hash_columns);
}

1869

bk@work.mysql.com's avatar
bk@work.mysql.com committed
1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881
/* Search after a matching grant. Prefer exact grants before not exact ones */

static GRANT_TABLE *table_hash_search(const char *host,const char* ip,
				      const char *db,
				      const char *user, const char *tname,
				      bool exact)
{
  char helping [NAME_LEN*2+USERNAME_LENGTH+3];
  uint len;
  GRANT_TABLE *grant_table,*found=0;

  len  = (uint) (strmov(strmov(strmov(helping,user)+1,db)+1,tname)-helping)+ 1;
1882 1883
  for (grant_table=(GRANT_TABLE*) hash_search(&column_priv_hash,
					      (byte*) helping,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1884 1885
					      len) ;
       grant_table ;
1886 1887
       grant_table= (GRANT_TABLE*) hash_next(&column_priv_hash,(byte*) helping,
					     len))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1888 1889 1890
  {
    if (exact)
    {
1891
      if ((host &&
1892
	   !my_strcasecmp(&my_charset_latin1, host, grant_table->host)) ||
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1893 1894 1895 1896 1897
	  (ip && !strcmp(ip,grant_table->host)))
	return grant_table;
    }
    else
    {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
1898 1899 1900 1901
      if (((host && !wild_case_compare(&my_charset_latin1,
				       host,grant_table->host)) ||
	   (ip && !wild_case_compare(&my_charset_latin1,
				     ip,grant_table->host))) &&
1902
          (!found || found->sort < grant_table->sort))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1903 1904 1905 1906 1907 1908 1909 1910
	found=grant_table;					// Host ok
    }
  }
  return found;
}



1911
inline GRANT_COLUMN *
1912
column_hash_search(GRANT_TABLE *t, const char *cname, uint length)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1913 1914 1915 1916 1917 1918 1919 1920 1921
{
  return (GRANT_COLUMN*) hash_search(&t->hash_columns, (byte*) cname,length);
}


static int replace_column_table(GRANT_TABLE *g_t,
				TABLE *table, const LEX_USER &combo,
				List <LEX_COLUMN> &columns,
				const char *db, const char *table_name,
1922
				ulong rights, bool revoke_grant)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1923 1924 1925 1926 1927 1928
{
  int error=0,result=0;
  uint key_length;
  byte key[MAX_KEY_LENGTH];
  DBUG_ENTER("replace_column_table");

1929 1930 1931 1932
  table->field[0]->store(combo.host.str,combo.host.length, &my_charset_latin1);
  table->field[1]->store(db,(uint) strlen(db), &my_charset_latin1);
  table->field[2]->store(combo.user.str,combo.user.length, &my_charset_latin1);
  table->field[3]->store(table_name,(uint) strlen(table_name), &my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1933 1934 1935 1936 1937 1938 1939 1940 1941 1942
  key_length=(table->field[0]->pack_length()+ table->field[1]->pack_length()+
	      table->field[2]->pack_length()+ table->field[3]->pack_length());
  key_copy(key,table,0,key_length);

  rights &= COL_ACLS;				// Only ACL for columns

  /* first fix privileges for all columns in column list */

  List_iterator <LEX_COLUMN> iter(columns);
  class LEX_COLUMN *xx;
1943
  table->file->ha_index_init(0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1944 1945
  while ((xx=iter++))
  {
1946
    ulong privileges = xx->rights;
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1947
    bool old_row_exists=0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1948
    key_restore(table,key,0,key_length);
1949 1950
    table->field[4]->store(xx->column.ptr(),xx->column.length(),
                           &my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1951 1952 1953 1954 1955 1956

    if (table->file->index_read(table->record[0],(byte*) table->field[0]->ptr,
				0, HA_READ_KEY_EXACT))
    {
      if (revoke_grant)
      {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
1957 1958
	my_error(ER_NONEXISTING_TABLE_GRANT, MYF(0),
                 combo.user.str, combo.host.str, table_name); /* purecov: inspected */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1959 1960 1961
	result= -1; /* purecov: inspected */
	continue; /* purecov: inspected */
      }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1962
      old_row_exists = 0;
1963
      restore_record(table,default_values);		// Get empty record
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1964
      key_restore(table,key,0,key_length);
1965 1966
      table->field[4]->store(xx->column.ptr(),xx->column.length(),
                             &my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1967 1968 1969
    }
    else
    {
1970
      ulong tmp= (ulong) table->field[6]->val_int();
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1971 1972 1973 1974 1975 1976
      tmp=fix_rights_for_column(tmp);

      if (revoke_grant)
	privileges = tmp & ~(privileges | rights);
      else
	privileges |= tmp;
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1977
      old_row_exists = 1;
1978
      store_record(table,record[1]);			// copy original row
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1979 1980 1981 1982
    }

    table->field[6]->store((longlong) get_rights_for_column(privileges));

monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
1983
    if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009
    {
      if (privileges)
	error=table->file->update_row(table->record[1],table->record[0]);
      else
	error=table->file->delete_row(table->record[1]);
      if (error)
      {
	table->file->print_error(error,MYF(0)); /* purecov: inspected */
	result= -1;				/* purecov: inspected */
	goto end;				/* purecov: inspected */
      }
      GRANT_COLUMN *grant_column = column_hash_search(g_t,
						      xx->column.ptr(),
						      xx->column.length());
      if (grant_column)				// Should always be true
	grant_column->rights = privileges;	// Update hash
    }
    else					// new grant
    {
      if ((error=table->file->write_row(table->record[0])))
      {
	table->file->print_error(error,MYF(0)); /* purecov: inspected */
	result= -1;				/* purecov: inspected */
	goto end;				/* purecov: inspected */
      }
      GRANT_COLUMN *grant_column = new GRANT_COLUMN(xx->column,privileges);
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
2010
      my_hash_insert(&g_t->hash_columns,(byte*) grant_column);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024
    }
  }

  /*
    If revoke of privileges on the table level, remove all such privileges
    for all columns
  */

  if (revoke_grant)
  {
    if (table->file->index_read(table->record[0], (byte*) table->field[0]->ptr,
				key_length, HA_READ_KEY_EXACT))
      goto end;

2025
    /* Scan through all rows with the same host,db,user and table */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2026 2027
    do
    {
2028
      ulong privileges = (ulong) table->field[6]->val_int();
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2029
      privileges=fix_rights_for_column(privileges);
2030
      store_record(table,record[1]);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2031 2032 2033 2034 2035

      if (privileges & rights)	// is in this record the priv to be revoked ??
      {
	GRANT_COLUMN *grant_column = NULL;
	char  colum_name_buf[HOSTNAME_LENGTH+1];
2036
	String column_name(colum_name_buf,sizeof(colum_name_buf),&my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2037 2038 2039 2040

	privileges&= ~rights;
	table->field[6]->store((longlong)
			       get_rights_for_column(privileges));
2041
	table->field[4]->val_str(&column_name);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071
	grant_column = column_hash_search(g_t,
					  column_name.ptr(),
					  column_name.length());
	if (privileges)
	{
	  int tmp_error;
	  if ((tmp_error=table->file->update_row(table->record[1],
						 table->record[0])))
	  {					/* purecov: deadcode */
	    table->file->print_error(tmp_error,MYF(0)); /* purecov: deadcode */
	    result= -1;				/* purecov: deadcode */
	    goto end;				/* purecov: deadcode */
	  }
	  if (grant_column)
	    grant_column->rights  = privileges; // Update hash
	}
	else
	{
	  int tmp_error;
	  if ((tmp_error = table->file->delete_row(table->record[1])))
	  {					/* purecov: deadcode */
	    table->file->print_error(tmp_error,MYF(0)); /* purecov: deadcode */
	    result= -1;				/* purecov: deadcode */
	    goto end;				/* purecov: deadcode */
	  }
	  if (grant_column)
	    hash_delete(&g_t->hash_columns,(byte*) grant_column);
	}
      }
    } while (!table->file->index_next(table->record[0]) &&
2072
	     !key_cmp_if_same(table,key,0,key_length));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2073 2074
  }

2075
end:
2076
  table->file->ha_index_end();
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2077 2078 2079 2080 2081 2082 2083
  DBUG_RETURN(result);
}


static int replace_table_table(THD *thd, GRANT_TABLE *grant_table,
			       TABLE *table, const LEX_USER &combo,
			       const char *db, const char *table_name,
2084 2085
			       ulong rights, ulong col_rights,
			       bool revoke_grant)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2086
{
2087
  char grantor[HOSTNAME_LENGTH+USERNAME_LENGTH+2];
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2088
  int old_row_exists = 1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2089
  int error=0;
2090
  ulong store_table_rights, store_col_rights;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2091 2092
  DBUG_ENTER("replace_table_table");

2093
  strxmov(grantor, thd->user, "@", thd->host_or_ip, NullS);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2094

2095 2096 2097 2098
  /*
    The following should always succeed as new users are created before
    this function is called!
  */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2099 2100 2101 2102 2103 2104
  if (!find_acl_user(combo.host.str,combo.user.str))
  {
    my_error(ER_PASSWORD_NO_MATCH,MYF(0));	/* purecov: deadcode */
    DBUG_RETURN(-1);				/* purecov: deadcode */
  }

2105
  restore_record(table,default_values);			// Get empty record
2106 2107 2108 2109
  table->field[0]->store(combo.host.str,combo.host.length, &my_charset_latin1);
  table->field[1]->store(db,(uint) strlen(db), &my_charset_latin1);
  table->field[2]->store(combo.user.str,combo.user.length, &my_charset_latin1);
  table->field[3]->store(table_name,(uint) strlen(table_name), &my_charset_latin1);
2110
  store_record(table,record[1]);			// store at pos 1
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122

  if (table->file->index_read_idx(table->record[0],0,
				  (byte*) table->field[0]->ptr,0,
				  HA_READ_KEY_EXACT))
  {
    /*
      The following should never happen as we first check the in memory
      grant tables for the user.  There is however always a small change that
      the user has modified the grant tables directly.
    */
    if (revoke_grant)
    { // no row, no revoke
guilhem@mysql.com's avatar
guilhem@mysql.com committed
2123 2124 2125
      my_error(ER_NONEXISTING_TABLE_GRANT, MYF(0),
               combo.user.str, combo.host.str,
               table_name);		/* purecov: deadcode */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2126 2127
      DBUG_RETURN(-1);				/* purecov: deadcode */
    }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2128
    old_row_exists = 0;
2129
    restore_record(table,record[1]);			// Get saved record
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2130 2131
  }

2132 2133
  store_table_rights= get_rights_for_table(rights);
  store_col_rights=   get_rights_for_column(col_rights);
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2134
  if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2135
  {
2136
    ulong j,k;
2137
    store_record(table,record[1]);
2138 2139
    j = (ulong) table->field[6]->val_int();
    k = (ulong) table->field[7]->val_int();
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2140 2141 2142

    if (revoke_grant)
    {
2143
      /* column rights are already fixed in mysql_table_grant */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2144 2145 2146 2147
      store_table_rights=j & ~store_table_rights;
    }
    else
    {
2148 2149
      store_table_rights|= j;
      store_col_rights|=   k;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2150 2151 2152
    }
  }

2153
  table->field[4]->store(grantor,(uint) strlen(grantor), &my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2154 2155 2156
  table->field[6]->store((longlong) store_table_rights);
  table->field[7]->store((longlong) store_col_rights);
  rights=fix_rights_for_table(store_table_rights);
2157
  col_rights=fix_rights_for_column(store_col_rights);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2158

monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2159
  if (old_row_exists)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175
  {
    if (store_table_rights || store_col_rights)
    {
      if ((error=table->file->update_row(table->record[1],table->record[0])))
	goto table_error;			/* purecov: deadcode */
    }
    else if ((error = table->file->delete_row(table->record[1])))
      goto table_error;				/* purecov: deadcode */
  }
  else
  {
    error=table->file->write_row(table->record[0]);
    if (error && error != HA_ERR_FOUND_DUPP_KEY)
      goto table_error;				/* purecov: deadcode */
  }

2176
  if (rights | col_rights)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2177
  {
2178
    grant_table->privs= rights;
2179
    grant_table->cols=	col_rights;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2180 2181 2182
  }
  else
  {
2183
    hash_delete(&column_priv_hash,(byte*) grant_table);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2184 2185 2186
  }
  DBUG_RETURN(0);

2187 2188
  /* This should never happen */
table_error:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2189 2190 2191 2192 2193
  table->file->print_error(error,MYF(0)); /* purecov: deadcode */
  DBUG_RETURN(-1); /* purecov: deadcode */
}


2194 2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 2210
/*
  Store table level and column level grants in the privilege tables

  SYNOPSIS
    mysql_table_grant()
    thd			Thread handle
    table_list		List of tables to give grant
    user_list		List of users to give grant
    columns		List of columns to give grant
    rights		Table level grant
    revoke_grant	Set to 1 if this is a REVOKE command

  RETURN
    0	ok
    1	error
*/

2211 2212 2213 2214
int mysql_table_grant(THD *thd, TABLE_LIST *table_list,
		      List <LEX_USER> &user_list,
		      List <LEX_COLUMN> &columns, ulong rights,
		      bool revoke_grant)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2215
{
2216
  ulong column_priv= 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2217 2218 2219
  List_iterator <LEX_USER> str_list (user_list);
  LEX_USER *Str;
  TABLE_LIST tables[3];
2220
  bool create_new_users=0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2221 2222 2223 2224
  DBUG_ENTER("mysql_table_grant");

  if (!initialized)
  {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
2225 2226 2227
    my_error(ER_OPTION_PREVENTS_STATEMENT, MYF(0),
             "--skip-grant-tables");	/* purecov: inspected */
    DBUG_RETURN(-1);				/* purecov: inspected */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2228 2229 2230 2231 2232 2233 2234 2235 2236 2237
  }
  if (rights & ~TABLE_ACLS)
  {
    my_error(ER_ILLEGAL_GRANT_FOR_TABLE,MYF(0));
    DBUG_RETURN(-1);
  }

  if (columns.elements && !revoke_grant)
  {
    TABLE *table;
2238 2239
    class LEX_COLUMN *column;
    List_iterator <LEX_COLUMN> column_iter(columns);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2240 2241 2242

    if (!(table=open_ltable(thd,table_list,TL_READ)))
      DBUG_RETURN(-1);
2243
    while ((column = column_iter++))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2244
    {
2245
      uint unused_field_idx= NO_CACHED_FIELD_INDEX;
2246
      if (!find_field_in_table(thd,table,column->column.ptr(),
2247 2248
                               column->column.length(),0,0,
                               &unused_field_idx))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2249
      {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
2250 2251
	my_error(ER_BAD_FIELD_ERROR, MYF(0),
                 column->column.c_ptr(), table_list->alias);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2252 2253
	DBUG_RETURN(-1);
      }
2254
      column_priv|= column->rights;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2255 2256 2257 2258 2259 2260
    }
    close_thread_tables(thd);
  }
  else if (!(rights & CREATE_ACL) && !revoke_grant)
  {
    char buf[FN_REFLEN];
2261 2262
    sprintf(buf,"%s/%s/%s.frm",mysql_data_home, table_list->db,
	    table_list->real_name);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2263 2264 2265
    fn_format(buf,buf,"","",4+16+32);
    if (access(buf,F_OK))
    {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
2266
      my_error(ER_NO_SUCH_TABLE, MYF(0), table_list->db, table_list->alias);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2267 2268 2269 2270 2271 2272 2273
      DBUG_RETURN(-1);
    }
  }

  /* open the mysql.tables_priv and mysql.columns_priv tables */

  bzero((char*) &tables,sizeof(tables));
2274 2275 2276
  tables[0].alias=tables[0].real_name= (char*) "user";
  tables[1].alias=tables[1].real_name= (char*) "tables_priv";
  tables[2].alias=tables[2].real_name= (char*) "columns_priv";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2277 2278 2279 2280 2281 2282 2283 2284
  tables[0].next=tables+1;
  /* Don't open column table if we don't need it ! */
  tables[1].next=((column_priv ||
		   (revoke_grant && ((rights & COL_ACLS) || columns.elements)))
		  ? tables+2 : 0);
  tables[0].lock_type=tables[1].lock_type=tables[2].lock_type=TL_WRITE;
  tables[0].db=tables[1].db=tables[2].db=(char*) "mysql";

2285 2286 2287 2288 2289
#ifdef HAVE_REPLICATION
  /*
    GRANT and REVOKE are applied the slave in/exclusion rules as they are
    some kind of updates to the mysql.% tables.
  */
2290 2291
  if (thd->slave_thread && table_rules_on)
  {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2292 2293 2294
    /*
      The tables must be marked "updating" so that tables_ok() takes them into
      account in tests.
2295
    */
2296
    tables[0].updating= tables[1].updating= tables[2].updating= 1;
2297 2298 2299
    if (!tables_ok(0, tables))
      DBUG_RETURN(0);
  }
2300 2301
#endif

2302
  if (simple_open_n_lock_tables(thd,tables))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2303 2304 2305 2306 2307
  {						// Should never happen
    close_thread_tables(thd);			/* purecov: deadcode */
    DBUG_RETURN(-1);				/* purecov: deadcode */
  }

2308 2309
  if (!revoke_grant)
    create_new_users= test_if_create_new_users(thd);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2310
  int result=0;
2311
  rw_wrlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2312 2313 2314 2315 2316
  MEM_ROOT *old_root=my_pthread_getspecific_ptr(MEM_ROOT*,THR_MALLOC);
  my_pthread_setspecific_ptr(THR_MALLOC,&memex);

  while ((Str = str_list++))
  {
2317
    int error;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2318 2319 2320 2321 2322 2323 2324 2325 2326
    GRANT_TABLE *grant_table;
    if (Str->host.length > HOSTNAME_LENGTH ||
	Str->user.length > USERNAME_LENGTH)
    {
      my_error(ER_GRANT_WRONG_HOST_OR_USER,MYF(0));
      result= -1;
      continue;
    }
    /* Create user if needed */
2327
    pthread_mutex_lock(&acl_cache->lock);
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2328 2329
    error=replace_user_table(thd, tables[0].table, *Str,
			     0, revoke_grant, create_new_users);
2330 2331
    pthread_mutex_unlock(&acl_cache->lock);
    if (error)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2332 2333 2334 2335 2336 2337 2338 2339
    {
      result= -1;				// Remember error
      continue;					// Add next user
    }

    /* Find/create cached table grant */
    grant_table= table_hash_search(Str->host.str,NullS,table_list->db,
				   Str->user.str,
2340
				   table_list->real_name,1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2341 2342 2343 2344
    if (!grant_table)
    {
      if (revoke_grant)
      {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
2345 2346
	my_error(ER_NONEXISTING_TABLE_GRANT, MYF(0),
                 Str->user.str, Str->host.str, table_list->real_name);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2347 2348 2349 2350 2351
	result= -1;
	continue;
      }
      grant_table = new GRANT_TABLE (Str->host.str,table_list->db,
				     Str->user.str,
2352
				     table_list->real_name,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2353 2354 2355 2356 2357 2358 2359
				     rights,
				     column_priv);
      if (!grant_table)				// end of memory
      {
	result= -1;				/* purecov: deadcode */
	continue;				/* purecov: deadcode */
      }
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
2360
      my_hash_insert(&column_priv_hash,(byte*) grant_table);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2361 2362 2363 2364 2365
    }

    /* If revoke_grant, calculate the new column privilege for tables_priv */
    if (revoke_grant)
    {
2366 2367
      class LEX_COLUMN *column;
      List_iterator <LEX_COLUMN> column_iter(columns);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2368 2369 2370
      GRANT_COLUMN *grant_column;

      /* Fix old grants */
2371
      while ((column = column_iter++))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2372 2373
      {
	grant_column = column_hash_search(grant_table,
2374 2375
					  column->column.ptr(),
					  column->column.length());
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2376
	if (grant_column)
2377
	  grant_column->rights&= ~(column->rights | rights);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2378 2379
      }
      /* scan trough all columns to get new column grant */
2380
      column_priv= 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2381 2382 2383 2384 2385 2386 2387 2388 2389 2390 2391 2392 2393 2394 2395 2396 2397 2398
      for (uint idx=0 ; idx < grant_table->hash_columns.records ; idx++)
      {
	grant_column= (GRANT_COLUMN*) hash_element(&grant_table->hash_columns,
						   idx);
	grant_column->rights&= ~rights;		// Fix other columns
	column_priv|= grant_column->rights;
      }
    }
    else
    {
      column_priv|= grant_table->cols;
    }


    /* update table and columns */

    if (replace_table_table(thd,grant_table,tables[1].table,*Str,
			    table_list->db,
2399
			    table_list->real_name,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2400 2401 2402 2403 2404 2405 2406 2407 2408
			    rights, column_priv, revoke_grant))
    {						// Crashend table ??
      result= -1;			       /* purecov: deadcode */
    }
    else if (tables[2].table)
    {
      if ((replace_column_table(grant_table,tables[2].table, *Str,
				columns,
				table_list->db,
2409
				table_list->real_name,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2410 2411 2412 2413 2414 2415 2416 2417
				rights, revoke_grant)))
      {
	result= -1;
      }
    }
  }
  grant_option=TRUE;
  my_pthread_setspecific_ptr(THR_MALLOC,old_root);
2418
  rw_unlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2419
  if (!result)
2420
    send_ok(thd);
2421
  /* Tables are automatically closed */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2422 2423 2424 2425
  DBUG_RETURN(result);
}


monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2426 2427
int mysql_grant(THD *thd, const char *db, List <LEX_USER> &list,
		ulong rights, bool revoke_grant)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2428 2429 2430
{
  List_iterator <LEX_USER> str_list (list);
  LEX_USER *Str;
2431
  char tmp_db[NAME_LEN+1];
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2432
  bool create_new_users=0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2433 2434 2435 2436
  TABLE_LIST tables[2];
  DBUG_ENTER("mysql_grant");
  if (!initialized)
  {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
2437 2438
    my_error(ER_OPTION_PREVENTS_STATEMENT, MYF(0),
             "--skip-grant-tables");	/* purecov: tested */
2439
    DBUG_RETURN(-1);				/* purecov: tested */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2440 2441
  }

2442 2443 2444
  if (lower_case_table_names && db)
  {
    strmov(tmp_db,db);
2445
    my_casedn_str(files_charset_info, tmp_db);
2446 2447
    db=tmp_db;
  }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2448 2449

  /* open the mysql.user and mysql.db tables */
2450
  bzero((char*) &tables,sizeof(tables));
2451 2452
  tables[0].alias=tables[0].real_name=(char*) "user";
  tables[1].alias=tables[1].real_name=(char*) "db";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2453 2454 2455 2456 2457
  tables[0].next=tables+1;
  tables[1].next=0;
  tables[0].lock_type=tables[1].lock_type=TL_WRITE;
  tables[0].db=tables[1].db=(char*) "mysql";
  tables[0].table=tables[1].table=0;
2458 2459 2460 2461 2462 2463

#ifdef HAVE_REPLICATION
  /*
    GRANT and REVOKE are applied the slave in/exclusion rules as they are
    some kind of updates to the mysql.% tables.
  */
2464 2465
  if (thd->slave_thread && table_rules_on)
  {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2466 2467 2468
    /*
      The tables must be marked "updating" so that tables_ok() takes them into
      account in tests.
2469
    */
2470
    tables[0].updating= tables[1].updating= 1;
2471 2472 2473
    if (!tables_ok(0, tables))
      DBUG_RETURN(0);
  }
2474 2475
#endif

2476
  if (simple_open_n_lock_tables(thd,tables))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2477 2478 2479 2480 2481
  {						// This should never happen
    close_thread_tables(thd);			/* purecov: deadcode */
    DBUG_RETURN(-1);				/* purecov: deadcode */
  }

monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2482 2483
  if (!revoke_grant)
    create_new_users= test_if_create_new_users(thd);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2484

2485
  /* go through users in user_list */
2486
  rw_wrlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499
  VOID(pthread_mutex_lock(&acl_cache->lock));
  grant_version++;

  int result=0;
  while ((Str = str_list++))
  {
    if (Str->host.length > HOSTNAME_LENGTH ||
	Str->user.length > USERNAME_LENGTH)
    {
      my_error(ER_GRANT_WRONG_HOST_OR_USER,MYF(0));
      result= -1;
      continue;
    }
2500
    if ((replace_user_table(thd,
2501
			    tables[0].table,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2502
			    *Str,
2503 2504
			    (!db ? rights : 0), revoke_grant,
			    create_new_users)))
2505
      result= -1;
2506
    else if (db)
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2507
    {
2508 2509 2510 2511 2512 2513 2514 2515 2516
      ulong db_rights= rights & DB_ACLS;
      if (db_rights  == rights)
      {
	if (replace_db_table(tables[1].table, db, *Str, db_rights,
			     revoke_grant))
	  result= -1;
      }
      else
      {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
2517
	my_error(ER_WRONG_USAGE, MYF(0), "DB GRANT", "GLOBAL PRIVILEGES");
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2518
	result= -1;
2519
      }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2520
    }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2521 2522
  }
  VOID(pthread_mutex_unlock(&acl_cache->lock));
2523
  rw_unlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2524 2525 2526
  close_thread_tables(thd);

  if (!result)
2527
    send_ok(thd);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2528 2529 2530
  DBUG_RETURN(result);
}

2531 2532

/* Free grant array if possible */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2533 2534 2535 2536 2537

void  grant_free(void)
{
  DBUG_ENTER("grant_free");
  grant_option = FALSE;
2538
  hash_free(&column_priv_hash);
2539
  free_root(&memex,MYF(0));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2540 2541 2542 2543 2544 2545
  DBUG_VOID_RETURN;
}


/* Init grant array if possible */

2546
my_bool grant_init(THD *org_thd)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2547
{
2548
  THD  *thd;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2549
  TABLE_LIST tables[2];
2550 2551
  MYSQL_LOCK *lock;
  my_bool return_val= 1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2552
  TABLE *t_table, *c_table;
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
2553
  bool check_no_resolve= specialflag & SPECIAL_NO_RESOLVE;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2554 2555 2556
  DBUG_ENTER("grant_init");

  grant_option = FALSE;
2557
  (void) hash_init(&column_priv_hash,&my_charset_latin1,
2558
		   0,0,0, (hash_get_key) get_grant_table,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2559
		   (hash_free_key) free_grant_table,0);
2560
  init_sql_alloc(&memex, ACL_ALLOC_BLOCK_SIZE, 0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2561

2562
  /* Don't do anything if running with --skip-grant */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2563 2564
  if (!initialized)
    DBUG_RETURN(0);				/* purecov: tested */
2565

bk@work.mysql.com's avatar
bk@work.mysql.com committed
2566 2567
  if (!(thd=new THD))
    DBUG_RETURN(1);				/* purecov: deadcode */
2568
  thd->store_globals();
2569 2570
  thd->db= my_strdup("mysql",MYF(0));
  thd->db_length=5;				// Safety
2571
  bzero((char*) &tables, sizeof(tables));
2572 2573
  tables[0].alias=tables[0].real_name= (char*) "tables_priv";
  tables[1].alias=tables[1].real_name= (char*) "columns_priv";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2574 2575 2576 2577
  tables[0].next=tables+1;
  tables[0].lock_type=tables[1].lock_type=TL_READ;
  tables[0].db=tables[1].db=thd->db;

2578 2579
  uint counter;
  if (open_tables(thd, tables, &counter))
2580 2581
    goto end;

bk@work.mysql.com's avatar
bk@work.mysql.com committed
2582 2583 2584
  TABLE *ptr[2];				// Lock tables for quick update
  ptr[0]= tables[0].table;
  ptr[1]= tables[1].table;
2585 2586
  if (!(lock=mysql_lock_tables(thd,ptr,2)))
    goto end;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2587 2588

  t_table = tables[0].table; c_table = tables[1].table;
2589
  t_table->file->ha_index_init(0);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2590 2591
  if (t_table->file->index_first(t_table->record[0]))
  {
2592
    return_val= 0;
2593
    goto end_unlock;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2594
  }
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2595
  grant_option= TRUE;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2596

2597
  /* Will be restored by org_thd->store_globals() */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2598
  my_pthread_setspecific_ptr(THR_MALLOC,&memex);
2599
  do
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2600 2601
  {
    GRANT_TABLE *mem_check;
Sinisa@sinisa.nasamreza.org's avatar
Sinisa@sinisa.nasamreza.org committed
2602
    if (!(mem_check=new GRANT_TABLE(t_table,c_table)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2603 2604
    {
      /* This could only happen if we are out memory */
2605
      grant_option= FALSE;			/* purecov: deadcode */
2606
      goto end_unlock;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2607
    }
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
2608 2609 2610 2611 2612

    if (check_no_resolve)
    {
      if (hostname_requires_resolving(mem_check->host))
      {
serg@serg.mylan's avatar
serg@serg.mylan committed
2613 2614 2615 2616
        sql_print_warning("'tables_priv' entry '%s %s@%s' "
                          "ignored in --skip-name-resolve mode.",
                          mem_check->tname, mem_check->user,
                          mem_check->host, mem_check->host);
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
2617 2618 2619 2620
	continue;
      }
    }

Sinisa@sinisa.nasamreza.org's avatar
Sinisa@sinisa.nasamreza.org committed
2621
    if (mem_check->ok() && my_hash_insert(&column_priv_hash,(byte*) mem_check))
hf@deer.(none)'s avatar
SCRUM  
hf@deer.(none) committed
2622 2623 2624 2625
    {
      grant_option= FALSE;
      goto end_unlock;
    }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2626
  }
2627 2628 2629 2630 2631
  while (!t_table->file->index_next(t_table->record[0]));

  return_val=0;					// Return ok

end_unlock:
2632
  t_table->file->ha_index_end();
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2633 2634
  mysql_unlock_tables(thd, lock);
  thd->version--;				// Force close to free memory
2635 2636

end:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2637 2638
  close_thread_tables(thd);
  delete thd;
2639 2640
  if (org_thd)
    org_thd->store_globals();
2641 2642 2643 2644 2645
  else
  {
    /* Remember that we don't have a THD */
    my_pthread_setspecific_ptr(THR_THD,  0);
  }
2646
  DBUG_RETURN(return_val);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2647 2648 2649
}


2650
/*
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2651
 Reload grant array (table and column privileges) if possible
2652 2653 2654 2655 2656 2657 2658 2659

  SYNOPSIS
    grant_reload()
    thd			Thread handler

  NOTES
    Locked tables are checked by acl_init and doesn't have to be checked here
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2660

2661
void grant_reload(THD *thd)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2662
{
2663 2664
  HASH old_column_priv_hash;
  bool old_grant_option;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2665 2666 2667
  MEM_ROOT old_mem;
  DBUG_ENTER("grant_reload");

2668
  rw_wrlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2669
  grant_version++;
2670
  old_column_priv_hash= column_priv_hash;
2671
  old_grant_option= grant_option;
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
2672
  old_mem= memex;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2673

2674
  if (grant_init(thd))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2675
  {						// Error. Revert to old hash
2676
    DBUG_PRINT("error",("Reverting to old privileges"));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2677
    grant_free();				/* purecov: deadcode */
2678
    column_priv_hash= old_column_priv_hash;	/* purecov: deadcode */
2679
    grant_option= old_grant_option;		/* purecov: deadcode */
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
2680
    memex= old_mem;				/* purecov: deadcode */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2681 2682 2683
  }
  else
  {
2684
    hash_free(&old_column_priv_hash);
2685
    free_root(&old_mem,MYF(0));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2686
  }
2687
  rw_unlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2688 2689 2690 2691 2692
  DBUG_VOID_RETURN;
}


/****************************************************************************
2693
  Check table level grants
2694
  All errors are written directly to the client if no_errors is given !
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2695 2696
****************************************************************************/

2697
bool check_grant(THD *thd, ulong want_access, TABLE_LIST *tables,
bell@sanja.is.com.ua's avatar
bell@sanja.is.com.ua committed
2698
		 uint show_table, uint number, bool no_errors)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2699 2700 2701 2702 2703 2704 2705 2706
{
  TABLE_LIST *table;
  char *user = thd->priv_user;

  want_access &= ~thd->master_access;
  if (!want_access)
    return 0;					// ok

2707
  rw_rdlock(&LOCK_grant);
bell@sanja.is.com.ua's avatar
bell@sanja.is.com.ua committed
2708
  for (table= tables; table && number--; table= table->next)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2709
  {
2710
    if (!(~table->grant.privilege & want_access) || table->derived)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2711 2712 2713 2714
    {
      table->grant.want_privilege=0;
      continue;					// Already checked
    }
2715 2716
    GRANT_TABLE *grant_table = table_hash_search(thd->host,thd->ip,
						 table->db,user,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2717 2718 2719 2720 2721 2722
						 table->real_name,0);
    if (!grant_table)
    {
      want_access &= ~table->grant.privilege;
      goto err;					// No grants
    }
monty@tramp.mysql.fi's avatar
monty@tramp.mysql.fi committed
2723 2724
    if (show_table)
      continue;					// We have some priv on this
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740

    table->grant.grant_table=grant_table;	// Remember for column test
    table->grant.version=grant_version;
    table->grant.privilege|= grant_table->privs;
    table->grant.want_privilege= ((want_access & COL_ACLS)
				  & ~table->grant.privilege);

    if (!(~table->grant.privilege & want_access))
      continue;

    if (want_access & ~(grant_table->cols | table->grant.privilege))
    {
      want_access &= ~(grant_table->cols | table->grant.privilege);
      goto err;					// impossible
    }
  }
2741
  rw_unlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2742 2743
  return 0;

2744
err:
2745
  rw_unlock(&LOCK_grant);
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
2746
  if (!no_errors)				// Not a silent skip of table
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2747 2748 2749
  {
    const char *command="";
    if (want_access & SELECT_ACL)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2750
      command= "select";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2751
    else if (want_access & INSERT_ACL)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2752
      command= "insert";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2753
    else if (want_access & UPDATE_ACL)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2754
      command= "update";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2755
    else if (want_access & DELETE_ACL)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2756
      command= "delete";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2757
    else if (want_access & DROP_ACL)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2758
      command= "drop";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2759
    else if (want_access & CREATE_ACL)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2760
      command= "create";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2761
    else if (want_access & ALTER_ACL)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2762
      command= "alter";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2763
    else if (want_access & INDEX_ACL)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2764
      command= "index";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2765
    else if (want_access & GRANT_ACL)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2766
      command= "grant";
2767
    net_printf(thd,ER_TABLEACCESS_DENIED_ERROR,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2768 2769
	       command,
	       thd->priv_user,
2770
	       thd->host_or_ip,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2771 2772 2773 2774 2775 2776
	       table ? table->real_name : "unknown");
  }
  return 1;
}


2777 2778
bool check_grant_column(THD *thd,TABLE *table, const char *name,
			uint length, uint show_tables)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2779 2780 2781 2782
{
  GRANT_TABLE *grant_table;
  GRANT_COLUMN *grant_column;

2783
  ulong want_access=table->grant.want_privilege;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2784 2785 2786
  if (!want_access)
    return 0;					// Already checked

2787
  rw_rdlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2788

2789
  /* reload table if someone has modified any grants */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2790 2791 2792 2793

  if (table->grant.version != grant_version)
  {
    table->grant.grant_table=
2794
      table_hash_search(thd->host, thd->ip, table->table_cache_key,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2795
			thd->priv_user,
2796
			table->real_name, 0);	/* purecov: inspected */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2797 2798 2799 2800 2801 2802 2803 2804
    table->grant.version=grant_version;		/* purecov: inspected */
  }
  if (!(grant_table=table->grant.grant_table))
    goto err;					/* purecov: deadcode */

  grant_column=column_hash_search(grant_table, name, length);
  if (grant_column && !(~grant_column->rights & want_access))
  {
2805
    rw_unlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2806 2807 2808 2809 2810
    return 0;
  }
#ifdef NOT_USED
  if (show_tables && (grant_column || table->grant.privilege & COL_ACLS))
  {
2811
    rw_unlock(&LOCK_grant);			/* purecov: deadcode */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2812 2813 2814 2815 2816
    return 0;					/* purecov: deadcode */
  }
#endif

  /* We must use my_printf_error() here! */
2817
err:
2818
  rw_unlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2819 2820
  if (!show_tables)
  {
2821 2822
    char command[128];
    get_privilege_desc(command, sizeof(command), want_access);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2823 2824 2825 2826 2827
    my_printf_error(ER_COLUMNACCESS_DENIED_ERROR,
		    ER(ER_COLUMNACCESS_DENIED_ERROR),
		    MYF(0),
		    command,
		    thd->priv_user,
2828
		    thd->host_or_ip,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2829 2830 2831 2832 2833 2834 2835
		    name,
		    table ? table->real_name : "unknown");
  }
  return 1;
}


2836
bool check_grant_all_columns(THD *thd, ulong want_access, TABLE *table)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2837 2838 2839 2840 2841 2842 2843
{
  GRANT_TABLE *grant_table;
  GRANT_COLUMN *grant_column;
  Field *field=0,**ptr;

  want_access &= ~table->grant.privilege;
  if (!want_access)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2844
    return 0;				// Already checked
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
2845
  if (!grant_option)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2846 2847
  {
    field= table->field[0];		// To give a meaningful error message
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
2848
    goto err2;
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2849
  }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2850

2851
  rw_rdlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2852

2853
  /* reload table if someone has modified any grants */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2854 2855 2856 2857

  if (table->grant.version != grant_version)
  {
    table->grant.grant_table=
2858
      table_hash_search(thd->host, thd->ip, table->table_cache_key,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2859 2860 2861 2862
			thd->priv_user,
			table->real_name,0);	/* purecov: inspected */
    table->grant.version=grant_version;		/* purecov: inspected */
  }
2863
  /* The following should always be true */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2864 2865 2866 2867 2868 2869
  if (!(grant_table=table->grant.grant_table))
    goto err;					/* purecov: inspected */

  for (ptr=table->field; (field= *ptr) ; ptr++)
  {
    grant_column=column_hash_search(grant_table, field->field_name,
2870
				    (uint) strlen(field->field_name));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2871 2872 2873
    if (!grant_column || (~grant_column->rights & want_access))
      goto err;
  }
2874
  rw_unlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2875 2876 2877
  return 0;

  /* We must use my_printf_error() here! */
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
2878
err:
2879
  rw_unlock(&LOCK_grant);
monty@narttu.mysql.fi's avatar
monty@narttu.mysql.fi committed
2880
err2:
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2881
  const char *command= "";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2882
  if (want_access & SELECT_ACL)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2883
    command= "select";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2884
  else if (want_access & INSERT_ACL)
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2885
    command= "insert";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2886 2887 2888 2889 2890
  my_printf_error(ER_COLUMNACCESS_DENIED_ERROR,
		  ER(ER_COLUMNACCESS_DENIED_ERROR),
		  MYF(0),
		  command,
		  thd->priv_user,
2891
		  thd->host_or_ip,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2892 2893 2894 2895 2896 2897
		  field ? field->field_name : "unknown",
		  table->real_name);
  return 1;
}


2898
/*
2899 2900 2901
  Check if a user has the right to access a database
  Access is accepted if he has a grant for any table in the database
  Return 1 if access is denied
2902
*/
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2903 2904 2905 2906 2907 2908 2909 2910

bool check_grant_db(THD *thd,const char *db)
{
  char helping [NAME_LEN+USERNAME_LENGTH+2];
  uint len;
  bool error=1;

  len  = (uint) (strmov(strmov(helping,thd->priv_user)+1,db)-helping)+ 1;
2911
  rw_rdlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2912

2913
  for (uint idx=0 ; idx < column_priv_hash.records ; idx++)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2914
  {
2915 2916
    GRANT_TABLE *grant_table= (GRANT_TABLE*) hash_element(&column_priv_hash,
							  idx);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2917 2918
    if (len < grant_table->key_length &&
	!memcmp(grant_table->hash_key,helping,len) &&
2919
	(thd->host && !wild_case_compare(&my_charset_latin1,
2920
                                         thd->host,grant_table->host) ||
2921
	 (thd->ip && !wild_case_compare(&my_charset_latin1,
2922
                                        thd->ip,grant_table->host))))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2923 2924 2925 2926 2927
    {
      error=0;					// Found match
      break;
    }
  }
2928
  rw_unlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2929 2930 2931 2932
  return error;
}

/*****************************************************************************
2933
  Functions to retrieve the grant for a table/column  (for SHOW functions)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2934 2935
*****************************************************************************/

2936
ulong get_table_grant(THD *thd, TABLE_LIST *table)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2937
{
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2938
  ulong privilege;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2939 2940 2941 2942
  char *user = thd->priv_user;
  const char *db = table->db ? table->db : thd->db;
  GRANT_TABLE *grant_table;

2943
  rw_rdlock(&LOCK_grant);
2944 2945 2946
#ifdef EMBEDDED_LIBRARY
  grant_table= NULL;
#else
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
2947 2948
  grant_table= table_hash_search(thd->host, thd->ip, db, user,
				 table->real_name, 0);
2949
#endif
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2950 2951 2952 2953
  table->grant.grant_table=grant_table; // Remember for column test
  table->grant.version=grant_version;
  if (grant_table)
    table->grant.privilege|= grant_table->privs;
2954
  privilege= table->grant.privilege;
2955
  rw_unlock(&LOCK_grant);
2956
  return privilege;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2957 2958 2959
}


2960
ulong get_column_grant(THD *thd, TABLE_LIST *table, Field *field)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2961 2962 2963
{
  GRANT_TABLE *grant_table;
  GRANT_COLUMN *grant_column;
2964
  ulong priv;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2965

2966
  rw_rdlock(&LOCK_grant);
2967
  /* reload table if someone has modified any grants */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2968 2969 2970
  if (table->grant.version != grant_version)
  {
    table->grant.grant_table=
2971
      table_hash_search(thd->host, thd->ip, table->db,
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2972 2973 2974 2975 2976 2977 2978 2979 2980 2981
			thd->priv_user,
			table->real_name,0);	/* purecov: inspected */
    table->grant.version=grant_version;		/* purecov: inspected */
  }

  if (!(grant_table=table->grant.grant_table))
    priv=table->grant.privilege;
  else
  {
    grant_column=column_hash_search(grant_table, field->field_name,
2982
				    (uint) strlen(field->field_name));
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2983 2984 2985 2986 2987
    if (!grant_column)
      priv=table->grant.privilege;
    else
      priv=table->grant.privilege | grant_column->rights;
  }
2988
  rw_unlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2989 2990 2991
  return priv;
}

2992
/* Help function for mysql_show_grants */
bk@work.mysql.com's avatar
bk@work.mysql.com committed
2993

2994 2995 2996 2997 2998 2999 3000 3001 3002 3003 3004 3005
static void add_user_option(String *grant, ulong value, const char *name)
{
  if (value)
  {
    char buff[22], *p; // just as in int2str
    grant->append(' ');
    grant->append(name, strlen(name));
    grant->append(' ');
    p=int10_to_str(value, buff, 10);
    grant->append(buff,p-buff);
  }
}
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3006 3007

static const char *command_array[]=
3008 3009 3010 3011 3012 3013
{
  "SELECT", "INSERT","UPDATE","DELETE","CREATE", "DROP", "RELOAD","SHUTDOWN",
  "PROCESS","FILE","GRANT","REFERENCES","INDEX", "ALTER", "SHOW DATABASES",
  "SUPER", "CREATE TEMPORARY TABLES", "LOCK TABLES", "EXECUTE",
  "REPLICATION SLAVE", "REPLICATION CLIENT",
};
3014

3015 3016 3017 3018 3019
static uint command_lengths[]=
{
  6,6,6,6,6,4,6,8,7,4,5,10,5,5,14,5,23,11,7,17,18
};

bk@work.mysql.com's avatar
bk@work.mysql.com committed
3020

3021 3022 3023 3024 3025 3026 3027
/*
  SHOW GRANTS;  Send grants for a user to the client

  IMPLEMENTATION
   Send to client grant-like strings depicting user@host privileges
*/

peter@mysql.com's avatar
peter@mysql.com committed
3028
int mysql_show_grants(THD *thd,LEX_USER *lex_user)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3029
{
3030 3031
  ulong want_access;
  uint counter,index;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3032
  int  error = 0;
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3033 3034
  ACL_USER *acl_user;
  ACL_DB *acl_db;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3035
  char buff[1024];
3036
  Protocol *protocol= thd->protocol;
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
3037
  DBUG_ENTER("mysql_show_grants");
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3038 3039 3040 3041

  LINT_INIT(acl_user);
  if (!initialized)
  {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
3042 3043
    my_error(ER_OPTION_PREVENTS_STATEMENT, MYF(0), "--skip-grant-tables");
    DBUG_RETURN(-1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3044
  }
monty@mysql.com's avatar
monty@mysql.com committed
3045 3046 3047 3048 3049 3050

  if (!lex_user->host.str)
  {
    lex_user->host.str= (char*) "%";
    lex_user->host.length=1;
  }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062
  if (lex_user->host.length > HOSTNAME_LENGTH ||
      lex_user->user.length > USERNAME_LENGTH)
  {
    my_error(ER_GRANT_WRONG_HOST_OR_USER,MYF(0));
    DBUG_RETURN(-1);
  }

  for (counter=0 ; counter < acl_users.elements ; counter++)
  {
    const char *user,*host;
    acl_user=dynamic_element(&acl_users,counter,ACL_USER*);
    if (!(user=acl_user->user))
monty@mysql.com's avatar
monty@mysql.com committed
3063
      user= "";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3064
    if (!(host=acl_user->host.hostname))
monty@mysql.com's avatar
monty@mysql.com committed
3065
      host= "";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3066
    if (!strcmp(lex_user->user.str,user) &&
3067
	!my_strcasecmp(&my_charset_latin1, lex_user->host.str, host))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3068 3069
      break;
  }
peter@mysql.com's avatar
peter@mysql.com committed
3070
  if (counter == acl_users.elements)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3071
  {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
3072 3073
    my_error(ER_NONEXISTING_GRANT, MYF(0),
             lex_user->user.str, lex_user->host.str);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3074 3075 3076
    DBUG_RETURN(-1);
  }

3077
  Item_string *field=new Item_string("",0,&my_charset_latin1);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3078 3079 3080 3081 3082 3083
  List<Item> field_list;
  field->name=buff;
  field->max_length=1024;
  strxmov(buff,"Grants for ",lex_user->user.str,"@",
	  lex_user->host.str,NullS);
  field_list.push_back(field);
3084
  if (protocol->send_fields(&field_list,1))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3085 3086
    DBUG_RETURN(-1);

monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3087
  rw_wrlock(&LOCK_grant);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3088 3089 3090 3091
  VOID(pthread_mutex_lock(&acl_cache->lock));

  /* Add first global access grants */
  {
3092
    String global(buff,sizeof(buff),system_charset_info);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3093 3094 3095
    global.length(0);
    global.append("GRANT ",6);

monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3096
    want_access= acl_user->access;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3097 3098 3099 3100
    if (test_all_bits(want_access, (GLOBAL_ACLS & ~ GRANT_ACL)))
      global.append("ALL PRIVILEGES",14);
    else if (!(want_access & ~GRANT_ACL))
      global.append("USAGE",5);
peter@mysql.com's avatar
peter@mysql.com committed
3101
    else
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3102 3103
    {
      bool found=0;
3104
      ulong j,test_access= want_access & ~GRANT_ACL;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3105 3106
      for (counter=0, j = SELECT_ACL;j <= GLOBAL_ACLS;counter++,j <<= 1)
      {
peter@mysql.com's avatar
peter@mysql.com committed
3107
	if (test_access & j)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3108 3109 3110 3111 3112 3113 3114 3115 3116
	{
	  if (found)
	    global.append(", ",2);
	  found=1;
	  global.append(command_array[counter],command_lengths[counter]);
	}
      }
    }
    global.append (" ON *.* TO '",12);
3117 3118
    global.append(lex_user->user.str, lex_user->user.length,
		  system_charset_info);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3119 3120 3121
    global.append ("'@'",3);
    global.append(lex_user->host.str,lex_user->host.length);
    global.append ('\'');
3122
    if (acl_user->salt_len)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3123
    {
3124 3125 3126 3127 3128
      char passwd_buff[SCRAMBLED_PASSWORD_CHAR_LENGTH+1];
      if (acl_user->salt_len == SCRAMBLE_LENGTH)
        make_password_from_salt(passwd_buff, acl_user->salt);
      else
        make_password_from_salt_323(passwd_buff, (ulong *) acl_user->salt);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3129
      global.append(" IDENTIFIED BY PASSWORD '",25);
3130
      global.append(passwd_buff);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3131 3132
      global.append('\'');
    }
3133 3134
    /* "show grants" SSL related stuff */
    if (acl_user->ssl_type == SSL_TYPE_ANY)
3135
      global.append(" REQUIRE SSL",12);
3136
    else if (acl_user->ssl_type == SSL_TYPE_X509)
3137
      global.append(" REQUIRE X509",13);
3138
    else if (acl_user->ssl_type == SSL_TYPE_SPECIFIED)
3139
    {
3140
      int ssl_options = 0;
3141
      global.append(" REQUIRE ",9);
3142 3143
      if (acl_user->x509_issuer)
      {
3144 3145 3146
	ssl_options++;
	global.append("ISSUER \'",8);
	global.append(acl_user->x509_issuer,strlen(acl_user->x509_issuer));
3147
	global.append('\'');
3148
      }
3149 3150
      if (acl_user->x509_subject)
      {
3151 3152 3153 3154
	if (ssl_options++)
	  global.append(' ');
	global.append("SUBJECT \'",9);
	global.append(acl_user->x509_subject,strlen(acl_user->x509_subject));
3155
	global.append('\'');
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
3156
      }
3157 3158
      if (acl_user->ssl_cipher)
      {
3159 3160 3161 3162
	if (ssl_options++)
	  global.append(' ');
	global.append("CIPHER '",8);
	global.append(acl_user->ssl_cipher,strlen(acl_user->ssl_cipher));
3163
	global.append('\'');
3164 3165
      }
    }
3166 3167 3168
    if ((want_access & GRANT_ACL) ||
	(acl_user->user_resource.questions | acl_user->user_resource.updates |
	 acl_user->user_resource.connections))
3169
    {
peter@mysql.com's avatar
peter@mysql.com committed
3170
      global.append(" WITH",5);
3171
      if (want_access & GRANT_ACL)
peter@mysql.com's avatar
peter@mysql.com committed
3172
	global.append(" GRANT OPTION",13);
3173 3174 3175 3176 3177 3178
      add_user_option(&global, acl_user->user_resource.questions,
		      "MAX_QUERIES_PER_HOUR");
      add_user_option(&global, acl_user->user_resource.updates,
		      "MAX_UPDATES_PER_HOUR");
      add_user_option(&global, acl_user->user_resource.connections,
		      "MAX_CONNECTIONS_PER_HOUR");
3179
    }
3180
    protocol->prepare_for_resend();
3181
    protocol->store(global.ptr(),global.length(),global.charset());
3182
    if (protocol->write())
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3183
    {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3184
      error= -1;
3185
      goto end;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3186 3187 3188 3189 3190 3191
    }
  }

  /* Add database access */
  for (counter=0 ; counter < acl_dbs.elements ; counter++)
  {
monty@mysql.com's avatar
monty@mysql.com committed
3192
    const char *user, *host;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3193 3194 3195

    acl_db=dynamic_element(&acl_dbs,counter,ACL_DB*);
    if (!(user=acl_db->user))
monty@mysql.com's avatar
monty@mysql.com committed
3196
      user= "";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3197
    if (!(host=acl_db->host.hostname))
monty@mysql.com's avatar
monty@mysql.com committed
3198
      host= "";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3199 3200

    if (!strcmp(lex_user->user.str,user) &&
3201
	!my_strcasecmp(&my_charset_latin1, lex_user->host.str, host))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3202 3203
    {
      want_access=acl_db->access;
peter@mysql.com's avatar
peter@mysql.com committed
3204
      if (want_access)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3205
      {
3206
	String db(buff,sizeof(buff),system_charset_info);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3207 3208 3209 3210 3211
	db.length(0);
	db.append("GRANT ",6);

	if (test_all_bits(want_access,(DB_ACLS & ~GRANT_ACL)))
	  db.append("ALL PRIVILEGES",14);
3212
	else if (!(want_access & ~GRANT_ACL))
3213
	  db.append("USAGE",5);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3214 3215 3216
	else
	{
	  int found=0, cnt;
3217
	  ulong j,test_access= want_access & ~GRANT_ACL;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3218 3219 3220 3221 3222 3223 3224 3225 3226 3227 3228
	  for (cnt=0, j = SELECT_ACL; j <= DB_ACLS; cnt++,j <<= 1)
	  {
	    if (test_access & j)
	    {
	      if (found)
		db.append(", ",2);
	      found = 1;
	      db.append(command_array[cnt],command_lengths[cnt]);
	    }
	  }
	}
3229 3230 3231
	db.append (" ON ",4);
	append_identifier(thd, &db, acl_db->db, strlen(acl_db->db));
	db.append (".* TO '",7);
3232 3233
	db.append(lex_user->user.str, lex_user->user.length,
		  system_charset_info);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3234 3235
	db.append ("'@'",3);
	db.append(lex_user->host.str, lex_user->host.length);
peter@mysql.com's avatar
peter@mysql.com committed
3236
	db.append ('\'');
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3237
	if (want_access & GRANT_ACL)
3238
	  db.append(" WITH GRANT OPTION",18);
3239
	protocol->prepare_for_resend();
3240
	protocol->store(db.ptr(),db.length(),db.charset());
3241
	if (protocol->write())
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3242
	{
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3243
	  error= -1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3244 3245 3246 3247 3248 3249
	  goto end;
	}
      }
    }
  }

3250
  /* Add table & column access */
3251
  for (index=0 ; index < column_priv_hash.records ; index++)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3252
  {
monty@mysql.com's avatar
monty@mysql.com committed
3253
    const char *user;
3254 3255
    GRANT_TABLE *grant_table= (GRANT_TABLE*) hash_element(&column_priv_hash,
							  index);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3256 3257

    if (!(user=grant_table->user))
3258
      user= "";
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3259 3260

    if (!strcmp(lex_user->user.str,user) &&
monty@mysql.com's avatar
monty@mysql.com committed
3261 3262
	!my_strcasecmp(&my_charset_latin1, lex_user->host.str,
                       grant_table->orig_host))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3263
    {
3264 3265
      ulong table_access= grant_table->privs;
      if ((table_access | grant_table->cols) != 0)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3266
      {
3267
	String global(buff, sizeof(buff), system_charset_info);
3268 3269
	ulong test_access= (table_access | grant_table->cols) & ~GRANT_ACL;

bk@work.mysql.com's avatar
bk@work.mysql.com committed
3270 3271 3272
	global.length(0);
	global.append("GRANT ",6);

3273
	if (test_all_bits(table_access, (TABLE_ACLS & ~GRANT_ACL)))
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3274
	  global.append("ALL PRIVILEGES",14);
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3275
	else if (!test_access)
3276
 	  global.append("USAGE",5);
peter@mysql.com's avatar
peter@mysql.com committed
3277
	else
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3278
	{
3279
          /* Add specific column access */
3280
	  int found= 0;
3281
	  ulong j;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3282

3283
	  for (counter= 0, j= SELECT_ACL; j <= TABLE_ACLS; counter++, j<<= 1)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3284
	  {
peter@mysql.com's avatar
peter@mysql.com committed
3285
	    if (test_access & j)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3286 3287 3288
	    {
	      if (found)
		global.append(", ",2);
3289
	      found= 1;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3290 3291
	      global.append(command_array[counter],command_lengths[counter]);

peter@mysql.com's avatar
peter@mysql.com committed
3292
	      if (grant_table->cols)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3293
	      {
3294
		uint found_col= 0;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3295 3296 3297 3298 3299 3300
		for (uint col_index=0 ;
		     col_index < grant_table->hash_columns.records ;
		     col_index++)
		{
		  GRANT_COLUMN *grant_column = (GRANT_COLUMN*)
		    hash_element(&grant_table->hash_columns,col_index);
peter@mysql.com's avatar
peter@mysql.com committed
3301
		  if (grant_column->rights & j)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3302
		  {
peter@mysql.com's avatar
peter@mysql.com committed
3303
		    if (!found_col)
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3304
		    {
3305 3306 3307 3308 3309 3310 3311 3312 3313 3314 3315
		      found_col= 1;
		      /*
			If we have a duplicated table level privilege, we
			must write the access privilege name again.
		      */
		      if (table_access & j)
		      {
			global.append(", ", 2);
			global.append(command_array[counter],
				      command_lengths[counter]);
		      }
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3316 3317 3318 3319 3320
		      global.append(" (",2);
		    }
		    else
		      global.append(", ",2);
		    global.append(grant_column->column,
3321 3322
				  grant_column->key_length,
				  system_charset_info);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3323 3324 3325 3326 3327 3328 3329 3330
		  }
		}
		if (found_col)
		  global.append(')');
	      }
	    }
	  }
	}
3331 3332 3333 3334 3335 3336 3337
	global.append(" ON ",4);
	append_identifier(thd, &global, grant_table->db,
			  strlen(grant_table->db));
	global.append('.');
	append_identifier(thd, &global, grant_table->tname,
			  strlen(grant_table->tname));
	global.append(" TO '",5);
3338 3339
	global.append(lex_user->user.str, lex_user->user.length,
		      system_charset_info);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3340
	global.append("'@'",3);
peter@mysql.com's avatar
peter@mysql.com committed
3341
	global.append(lex_user->host.str,lex_user->host.length);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3342
	global.append('\'');
3343
	if (table_access & GRANT_ACL)
peter@mysql.com's avatar
peter@mysql.com committed
3344
	  global.append(" WITH GRANT OPTION",18);
3345
	protocol->prepare_for_resend();
3346
	protocol->store(global.ptr(),global.length(),global.charset());
3347
	if (protocol->write())
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3348
	{
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3349
	  error= -1;
3350
	  break;
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3351 3352 3353 3354
	}
      }
    }
  }
3355
end:
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3356
  VOID(pthread_mutex_unlock(&acl_cache->lock));
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3357
  rw_unlock(&LOCK_grant);
3358

3359
  send_eof(thd);
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3360 3361 3362 3363
  DBUG_RETURN(error);
}


3364 3365 3366 3367 3368 3369 3370 3371 3372 3373 3374 3375 3376 3377 3378 3379 3380 3381 3382 3383 3384 3385 3386 3387 3388 3389 3390 3391
/*
  Make a clear-text version of the requested privilege.
*/

void get_privilege_desc(char *to, uint max_length, ulong access)
{
  uint pos;
  char *start=to;
  DBUG_ASSERT(max_length >= 30);		// For end ',' removal

  if (access)
  {
    max_length--;				// Reserve place for end-zero
    for (pos=0 ; access ; pos++, access>>=1)
    {
      if ((access & 1) &&
	  command_lengths[pos] + (uint) (to-start) < max_length)
      {
	to= strmov(to, command_array[pos]);
	*to++=',';
      }
    }
    to--;					// Remove end ','
  }
  *to=0;
}


3392
void get_mqh(const char *user, const char *host, USER_CONN *uc)
3393 3394
{
  ACL_USER *acl_user;
3395 3396 3397 3398
  if (initialized && (acl_user= find_acl_user(host,user)))
    uc->user_resources= acl_user->user_resource;
  else
    bzero((char*) &uc->user_resources, sizeof(uc->user_resources));
3399 3400
}

3401 3402 3403 3404 3405 3406
int open_grant_tables(THD *thd, TABLE_LIST *tables)
{
  DBUG_ENTER("open_grant_tables");

  if (!initialized)
  {
guilhem@mysql.com's avatar
guilhem@mysql.com committed
3407
    net_printf(thd,ER_OPTION_PREVENTS_STATEMENT, "--skip-grant-tables");
3408 3409 3410 3411 3412 3413 3414 3415 3416 3417 3418 3419 3420 3421 3422 3423 3424 3425 3426 3427 3428
    DBUG_RETURN(-1);
  }

  bzero((char*) tables, 4*sizeof(*tables));
  tables->alias= tables->real_name= (char*) "user";
  (tables+1)->alias= (tables+1)->real_name= (char*) "db";
  (tables+2)->alias= (tables+2)->real_name= (char*) "tables_priv";
  (tables+3)->alias= (tables+3)->real_name= (char*) "columns_priv";
  tables->next= tables+1;
  (tables+1)->next= tables+2;
  (tables+2)->next= tables+3;
  (tables+3)->next= 0;
  tables->lock_type= (tables+1)->lock_type=
    (tables+2)->lock_type= (tables+3)->lock_type= TL_WRITE;
  tables->db= (tables+1)->db= (tables+2)->db= (tables+3)->db=(char*) "mysql";

#ifdef HAVE_REPLICATION
  /*
    GRANT and REVOKE are applied the slave in/exclusion rules as they are
    some kind of updates to the mysql.% tables.
  */
3429 3430
  if (thd->slave_thread && table_rules_on)
  {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3431 3432 3433
    /*
      The tables must be marked "updating" so that tables_ok() takes them into
      account in tests.
3434 3435 3436 3437 3438 3439
    */
    tables[0].updating=tables[1].updating=tables[2].updating=tables[3].updating=1;
    if (!tables_ok(0, tables))
      DBUG_RETURN(1);
    tables[0].updating=tables[1].updating=tables[2].updating=tables[3].updating=0;
  }
3440 3441
#endif

3442
  if (simple_open_n_lock_tables(thd, tables))
3443 3444 3445 3446 3447 3448 3449 3450 3451
  {						// This should never happen
    close_thread_tables(thd);
    DBUG_RETURN(-1);
  }

  DBUG_RETURN(0);
}

ACL_USER *check_acl_user(LEX_USER *user_name,
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
3452
			 uint *acl_acl_userdx)
3453 3454 3455 3456 3457 3458 3459 3460 3461
{
  ACL_USER *acl_user= 0;
  uint counter;

  for (counter= 0 ; counter < acl_users.elements ; counter++)
  {
    const char *user,*host;
    acl_user= dynamic_element(&acl_users, counter, ACL_USER*);
    if (!(user=acl_user->user))
monty@mysql.com's avatar
monty@mysql.com committed
3462
      user= "";
3463
    if (!(host=acl_user->host.hostname))
monty@mysql.com's avatar
monty@mysql.com committed
3464
      host= "%";
3465 3466 3467 3468 3469 3470 3471
    if (!strcmp(user_name->user.str,user) &&
	!my_strcasecmp(system_charset_info, user_name->host.str, host))
      break;
  }
  if (counter == acl_users.elements)
    return 0;

monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
3472
  *acl_acl_userdx= counter;
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3473
  return acl_user;
3474 3475
}

monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3476

3477 3478
int mysql_drop_user(THD *thd, List <LEX_USER> &list)
{
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
3479
  uint counter, acl_userd;
3480 3481 3482 3483 3484 3485 3486 3487
  int result;
  ACL_USER *acl_user;
  ACL_DB *acl_db;
  TABLE_LIST tables[4];

  DBUG_ENTER("mysql_drop_user");

  if ((result= open_grant_tables(thd, tables)))
3488
    DBUG_RETURN(result == 1 ? 0 : 1);
3489 3490 3491 3492 3493 3494 3495 3496 3497 3498

  rw_wrlock(&LOCK_grant);
  VOID(pthread_mutex_lock(&acl_cache->lock));

  LEX_USER *user_name;
  List_iterator <LEX_USER> user_list(list);
  while ((user_name=user_list++))
  {
    if (!(acl_user= check_acl_user(user_name, &counter)))
    {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3499
      sql_print_error("DROP USER: Can't drop user: '%s'@'%s'; No such user",
3500 3501 3502 3503 3504 3505 3506
		      user_name->user.str,
		      user_name->host.str);
      result= -1;
      continue;
    }
    if ((acl_user->access & ~0))
    {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3507
      sql_print_error("DROP USER: Can't drop user: '%s'@'%s'; Global privileges exists",
3508 3509 3510 3511 3512
		      user_name->user.str,
		      user_name->host.str);
      result= -1;
      continue;
    }
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
3513
    acl_userd= counter;
3514 3515 3516 3517 3518 3519

    for (counter= 0 ; counter < acl_dbs.elements ; counter++)
    {
      const char *user,*host;
      acl_db=dynamic_element(&acl_dbs,counter,ACL_DB*);
      if (!(user= acl_db->user))
monty@mysql.com's avatar
monty@mysql.com committed
3520
	user= "";
3521
      if (!(host= acl_db->host.hostname))
monty@mysql.com's avatar
monty@mysql.com committed
3522
	host= "";
3523 3524 3525 3526 3527 3528 3529

      if (!strcmp(user_name->user.str,user) &&
	  !my_strcasecmp(system_charset_info, user_name->host.str, host))
	break;
    }
    if (counter != acl_dbs.elements)
    {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3530
      sql_print_error("DROP USER: Can't drop user: '%s'@'%s'; Database privileges exists",
3531 3532 3533 3534 3535 3536 3537 3538 3539 3540 3541 3542
		      user_name->user.str,
		      user_name->host.str);
      result= -1;
      continue;
    }

    for (counter= 0 ; counter < column_priv_hash.records ; counter++)
    {
      const char *user,*host;
      GRANT_TABLE *grant_table= (GRANT_TABLE*) hash_element(&column_priv_hash,
							    counter);
      if (!(user=grant_table->user))
monty@mysql.com's avatar
monty@mysql.com committed
3543
	user= "";
3544
      if (!(host=grant_table->host))
monty@mysql.com's avatar
monty@mysql.com committed
3545
	host= "";
3546 3547 3548 3549 3550 3551 3552

      if (!strcmp(user_name->user.str,user) &&
	  !my_strcasecmp(system_charset_info, user_name->host.str, host))
	break;
    }
    if (counter != column_priv_hash.records)
    {
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3553
      sql_print_error("DROP USER: Can't drop user: '%s'@'%s';  Table privileges exists",
3554 3555 3556 3557 3558 3559
		      user_name->user.str,
		      user_name->host.str);
      result= -1;
      continue;
    }

monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3560
    tables[0].table->field[0]->store(user_name->host.str,(uint)
3561 3562
				     user_name->host.length,
				     system_charset_info);
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3563
    tables[0].table->field[1]->store(user_name->user.str,(uint)
3564 3565
				     user_name->user.length,
				     system_charset_info);
3566
    if (!tables[0].table->file->index_read_idx(tables[0].table->record[0],0,
3567 3568
					       (byte*) tables[0].table->
					       field[0]->ptr,0,
3569 3570 3571
					       HA_READ_KEY_EXACT))
    {
      int error;
3572 3573
      if ((error = tables[0].table->file->delete_row(tables[0].table->
						     record[0])))
3574 3575 3576 3577
      {
	tables[0].table->file->print_error(error, MYF(0));
	DBUG_RETURN(-1);
      }
monty@narttu.mysql.fi's avatar
merge  
monty@narttu.mysql.fi committed
3578
      delete_dynamic_element(&acl_users, acl_userd);
3579 3580
    }
  }
3581

3582 3583 3584 3585 3586 3587 3588 3589 3590 3591 3592 3593
  VOID(pthread_mutex_unlock(&acl_cache->lock));
  rw_unlock(&LOCK_grant);
  close_thread_tables(thd);
  if (result)
    my_error(ER_DROP_USER, MYF(0));
  DBUG_RETURN(result);
}

int mysql_revoke_all(THD *thd,  List <LEX_USER> &list)
{
  uint counter;
  int result;
3594
  ACL_DB *acl_db;
3595 3596 3597 3598
  TABLE_LIST tables[4];
  DBUG_ENTER("mysql_revoke_all");

  if ((result= open_grant_tables(thd, tables)))
3599
    DBUG_RETURN(result == 1 ? 0 : 1);
3600 3601 3602 3603 3604 3605 3606 3607

  rw_wrlock(&LOCK_grant);
  VOID(pthread_mutex_lock(&acl_cache->lock));

  LEX_USER *lex_user;
  List_iterator <LEX_USER> user_list(list);
  while ((lex_user=user_list++))
  {
3608
    if (!check_acl_user(lex_user, &counter))
3609 3610 3611 3612 3613 3614 3615
    {
      sql_print_error("REVOKE ALL PRIVILEGES, GRANT: User '%s'@'%s' not exists",
		      lex_user->user.str,
		      lex_user->host.str);
      result= -1;
      continue;
    }
monty@mashka.mysql.fi's avatar
monty@mashka.mysql.fi committed
3616

3617 3618 3619 3620 3621 3622 3623 3624 3625 3626 3627 3628 3629 3630
    if (replace_user_table(thd, tables[0].table,
			   *lex_user, ~0, 1, 0))
    {
      result= -1;
      continue;
    }

    /* Remove db access privileges */
    for (counter= 0 ; counter < acl_dbs.elements ; counter++)
    {
      const char *user,*host;

      acl_db=dynamic_element(&acl_dbs,counter,ACL_DB*);
      if (!(user=acl_db->user))
monty@mysql.com's avatar
monty@mysql.com committed
3631
	user= "";
3632
      if (!(host=acl_db->host.hostname))
monty@mysql.com's avatar
monty@mysql.com committed
3633
	host= "";
3634 3635 3636 3637 3638 3639 3640 3641 3642 3643 3644 3645 3646 3647 3648 3649

      if (!strcmp(lex_user->user.str,user) &&
	  !my_strcasecmp(system_charset_info, lex_user->host.str, host))
      {
	if (replace_db_table(tables[1].table, acl_db->db, *lex_user, ~0, 1))
	  result= -1;
      }
    }

    /* Remove column access */
    for (counter= 0 ; counter < column_priv_hash.records ; counter++)
    {
      const char *user,*host;
      GRANT_TABLE *grant_table= (GRANT_TABLE*) hash_element(&column_priv_hash,
							    counter);
      if (!(user=grant_table->user))
monty@mysql.com's avatar
monty@mysql.com committed
3650
	user= "";
3651
      if (!(host=grant_table->host))
monty@mysql.com's avatar
monty@mysql.com committed
3652
	host= "";
3653 3654 3655 3656 3657 3658 3659 3660 3661 3662 3663 3664 3665 3666 3667 3668 3669 3670 3671 3672 3673 3674 3675 3676 3677 3678 3679 3680 3681

      if (!strcmp(lex_user->user.str,user) &&
	  !my_strcasecmp(system_charset_info, lex_user->host.str, host))
      {
	if (replace_table_table(thd,grant_table,tables[2].table,*lex_user,
				grant_table->db,
				grant_table->tname,
				~0, 0, 1))
	{
	  result= -1;
	  continue;
	}
	if (grant_table->cols)
	{
	  List<LEX_COLUMN> columns;
	  if (replace_column_table(grant_table,tables[3].table, *lex_user,
				   columns,
				   grant_table->db,
				   grant_table->tname,
				   ~0, 1))
	    result= -1;
	}
      }
    }
  }

  VOID(pthread_mutex_unlock(&acl_cache->lock));
  rw_unlock(&LOCK_grant);
  close_thread_tables(thd);
serg@serg.mylan's avatar
serg@serg.mylan committed
3682

3683 3684
  if (result)
    my_error(ER_REVOKE_GRANTS, MYF(0));
serg@serg.mylan's avatar
serg@serg.mylan committed
3685

3686 3687
  DBUG_RETURN(result);
}
3688

3689

bk@work.mysql.com's avatar
bk@work.mysql.com committed
3690
/*****************************************************************************
3691
  Instantiate used templates
bk@work.mysql.com's avatar
bk@work.mysql.com committed
3692 3693 3694 3695 3696 3697 3698 3699
*****************************************************************************/

#ifdef __GNUC__
template class List_iterator<LEX_COLUMN>;
template class List_iterator<LEX_USER>;
template class List<LEX_COLUMN>;
template class List<LEX_USER>;
#endif
hf@deer.(none)'s avatar
hf@deer.(none) committed
3700 3701 3702 3703 3704 3705 3706 3707 3708 3709 3710 3711 3712 3713 3714 3715 3716 3717 3718 3719 3720 3721 3722 3723 3724 3725 3726 3727 3728 3729 3730 3731 3732 3733 3734 3735 3736 3737 3738 3739 3740 3741 3742 3743 3744 3745 3746

#endif /*NO_EMBEDDED_ACCESS_CHECKS */


int wild_case_compare(CHARSET_INFO *cs, const char *str,const char *wildstr)
{
  reg3 int flag;
  DBUG_ENTER("wild_case_compare");
  DBUG_PRINT("enter",("str: '%s'  wildstr: '%s'",str,wildstr));
  while (*wildstr)
  {
    while (*wildstr && *wildstr != wild_many && *wildstr != wild_one)
    {
      if (*wildstr == wild_prefix && wildstr[1])
	wildstr++;
      if (my_toupper(cs, *wildstr++) !=
          my_toupper(cs, *str++)) DBUG_RETURN(1);
    }
    if (! *wildstr ) DBUG_RETURN (*str != 0);
    if (*wildstr++ == wild_one)
    {
      if (! *str++) DBUG_RETURN (1);	/* One char; skip */
    }
    else
    {						/* Found '*' */
      if (!*wildstr) DBUG_RETURN(0);		/* '*' as last char: OK */
      flag=(*wildstr != wild_many && *wildstr != wild_one);
      do
      {
	if (flag)
	{
	  char cmp;
	  if ((cmp= *wildstr) == wild_prefix && wildstr[1])
	    cmp=wildstr[1];
	  cmp=my_toupper(cs, cmp);
	  while (*str && my_toupper(cs, *str) != cmp)
	    str++;
	  if (!*str) DBUG_RETURN (1);
	}
	if (wild_case_compare(cs, str,wildstr) == 0) DBUG_RETURN (0);
      } while (*str++);
      DBUG_RETURN(1);
    }
  }
  DBUG_RETURN (*str != '\0');
}