WL#15655 Firewall: Make database the plugin is using configurable

Firewall will be able to fetch the data it needs to function from
the database specified by this new read-only system variable named
mysql_firewall_database.

Change-Id: I1a809fc95926134b3af28364d733633e8c8b54fc

Author: shussinh

packaging/rpm-docker/mysql.spec.in

@@ -552,6 +552,7 @@ rm -r $(readlink var) var
 %attr(755, root, root) %{_libdir}/mysql/plugin/keyring_aws.so
 %endif # aws_sdk
 %attr(644, root, root) %{_datadir}/mysql-*/linux_install_firewall.sql
+%attr(644, root, root) %{_datadir}/mysql-*/uninstall_firewall.sql
 %attr(644, root, root) %{_datadir}/mysql-*/firewall_profile_migration.sql
 %attr(644, root, root) %{_datadir}/mysql-*/masking_functions_install.sql
 %attr(644, root, root) %{_datadir}/mysql-*/masking_functions_uninstall.sql

packaging/rpm-oel/mysql.spec.in

@@ -1270,6 +1270,7 @@ fi
 %attr(755, root, root) %{_libdir}/mysql/plugin/component_masking_functions.so
 %attr(755, root, root) %{_libdir}/mysql/plugin/component_scheduler.so
 %attr(644, root, root) %{_datadir}/mysql-*/linux_install_firewall.sql
+%attr(644, root, root) %{_datadir}/mysql-*/uninstall_firewall.sql
 %attr(644, root, root) %{_datadir}/mysql-*/firewall_profile_migration.sql
 %attr(644, root, root) %{_datadir}/mysql-*/masking_functions_install.sql
 %attr(644, root, root) %{_datadir}/mysql-*/masking_functions_uninstall.sql

packaging/rpm-sles/mysql.spec.in

@@ -883,6 +883,7 @@ rm -r $(readlink var) var
 %attr(644, root, root) %{_datadir}/mysql-*/audit_log_filter_uninstall.sql
 %attr(644, root, root) %{_datadir}/mysql-*/firewall_profile_migration.sql
 %attr(644, root, root) %{_datadir}/mysql-*/linux_install_firewall.sql
+%attr(644, root, root) %{_datadir}/mysql-*/uninstall_firewall.sql
 %attr(644, root, root) %{_datadir}/mysql-*/masking_functions_install.sql
 %attr(644, root, root) %{_datadir}/mysql-*/masking_functions_uninstall.sql
 %attr(755, root, root) %{_libdir}/mysql/plugin/authentication_fido.so

scripts/firewall_stored_procedures.sql

@@ -46,21 +46,21 @@ CREATE DEFINER='mysql.sys'@'localhost'
 BEGIN
   DECLARE result VARCHAR(160);
   IF arg_mode = "RECORDING" THEN
-    SELECT read_firewall_whitelist(arg_userhost,FW.rule) FROM mysql.firewall_whitelist FW WHERE userhost = arg_userhost;
+    SELECT read_firewall_whitelist(arg_userhost,FW.rule) FROM firewall_whitelist FW WHERE userhost = arg_userhost;
   END IF;
   SELECT set_firewall_mode(arg_userhost, arg_mode) INTO result;
   IF arg_mode = "RESET" THEN
     SET arg_mode = "OFF";
   END IF;
   IF result = "OK" THEN
-    INSERT IGNORE INTO mysql.firewall_users VALUES (arg_userhost, arg_mode);
-    UPDATE mysql.firewall_users SET mode=arg_mode WHERE userhost = arg_userhost;
+    INSERT IGNORE INTO firewall_users VALUES (arg_userhost, arg_mode);
+    UPDATE firewall_users SET mode=arg_mode WHERE userhost = arg_userhost;
   ELSE
     SELECT result;
   END IF;
   IF arg_mode = "PROTECTING" OR arg_mode = "OFF" OR arg_mode = "DETECTING" THEN
-    DELETE FROM mysql.firewall_whitelist WHERE USERHOST = arg_userhost;
-    INSERT INTO mysql.firewall_whitelist(USERHOST, RULE) SELECT USERHOST,RULE FROM INFORMATION_SCHEMA.mysql_firewall_whitelist WHERE USERHOST=arg_userhost;
+    DELETE FROM firewall_whitelist WHERE USERHOST = arg_userhost;
+    INSERT INTO firewall_whitelist(USERHOST, RULE) SELECT USERHOST,RULE FROM INFORMATION_SCHEMA.mysql_firewall_whitelist WHERE USERHOST=arg_userhost;
   END IF;
 END$$
 
@@ -72,9 +72,9 @@ BEGIN
   DECLARE result VARCHAR(160);
   SELECT set_firewall_mode(arg_userhost, "RESET") INTO result;
   IF result = "OK" THEN
-    INSERT IGNORE INTO mysql.firewall_users VALUES (arg_userhost, "OFF");
-    UPDATE mysql.firewall_users SET mode="OFF" WHERE userhost = arg_userhost;
-    SELECT read_firewall_whitelist(arg_userhost,FW.rule) FROM mysql.firewall_whitelist FW WHERE FW.userhost=arg_userhost;
+    INSERT IGNORE INTO firewall_users VALUES (arg_userhost, "OFF");
+    UPDATE firewall_users SET mode="OFF" WHERE userhost = arg_userhost;
+    SELECT read_firewall_whitelist(arg_userhost,FW.rule) FROM firewall_whitelist FW WHERE FW.userhost=arg_userhost;
   ELSE
     SELECT result;
   END IF;
@@ -88,21 +88,21 @@ CREATE DEFINER='mysql.sys'@'localhost'
 BEGIN
   DECLARE result VARCHAR(160);
   IF arg_mode = "RECORDING" THEN
-    SELECT read_firewall_group_allowlist(arg_group_name,FW.rule) FROM mysql.firewall_group_allowlist FW WHERE name = arg_group_name;
+    SELECT read_firewall_group_allowlist(arg_group_name,FW.rule) FROM firewall_group_allowlist FW WHERE name = arg_group_name;
   END IF;
   SELECT set_firewall_group_mode(arg_group_name, arg_mode) INTO result;
   IF arg_mode = "RESET" THEN
     SET arg_mode = "OFF";
   END IF;
   IF result = "OK" THEN
-    INSERT IGNORE INTO mysql.firewall_groups VALUES (arg_group_name, arg_mode, NULL);
-    UPDATE mysql.firewall_groups SET mode=arg_mode WHERE name = arg_group_name;
+    INSERT IGNORE INTO firewall_groups VALUES (arg_group_name, arg_mode, NULL);
+    UPDATE firewall_groups SET mode=arg_mode WHERE name = arg_group_name;
   ELSE
     SELECT result;
   END IF;
   IF arg_mode = "PROTECTING" OR arg_mode = "OFF" OR arg_mode = "DETECTING" THEN
-    DELETE FROM mysql.firewall_group_allowlist WHERE name = arg_group_name;
-    INSERT INTO mysql.firewall_group_allowlist(name, rule)
+    DELETE FROM firewall_group_allowlist WHERE name = arg_group_name;
+    INSERT INTO firewall_group_allowlist(name, rule)
       SELECT name, rule FROM performance_schema.firewall_group_allowlist
       WHERE name=arg_group_name;
   END IF;
@@ -117,21 +117,21 @@ CREATE DEFINER='mysql.sys'@'localhost'
 BEGIN
   DECLARE result VARCHAR(160);
   IF arg_mode = "RECORDING" THEN
-    SELECT read_firewall_group_allowlist(arg_group_name,FW.rule) FROM mysql.firewall_group_allowlist FW WHERE name = arg_group_name;
+    SELECT read_firewall_group_allowlist(arg_group_name,FW.rule) FROM firewall_group_allowlist FW WHERE name = arg_group_name;
   END IF;
   SELECT set_firewall_group_mode(arg_group_name, arg_mode, arg_userhost) INTO result;
   IF arg_mode = "RESET" THEN
     SET arg_mode = "OFF";
   END IF;
   IF result = "OK" THEN
-    INSERT IGNORE INTO mysql.firewall_groups VALUES (arg_group_name, arg_mode, arg_userhost);
-    UPDATE mysql.firewall_groups SET mode=arg_mode, userhost=arg_userhost WHERE name = arg_group_name;
+    INSERT IGNORE INTO firewall_groups VALUES (arg_group_name, arg_mode, arg_userhost);
+    UPDATE firewall_groups SET mode=arg_mode, userhost=arg_userhost WHERE name = arg_group_name;
   ELSE
     SELECT result;
   END IF;
   IF arg_mode = "PROTECTING" OR arg_mode = "OFF" OR arg_mode = "DETECTING" THEN
-    DELETE FROM mysql.firewall_group_allowlist WHERE name = arg_group_name;
-    INSERT INTO mysql.firewall_group_allowlist(name, rule)
+    DELETE FROM firewall_group_allowlist WHERE name = arg_group_name;
+    INSERT INTO firewall_group_allowlist(name, rule)
       SELECT name, rule FROM performance_schema.firewall_group_allowlist
       WHERE name=arg_group_name;
   END IF;
@@ -145,9 +145,9 @@ BEGIN
   DECLARE result VARCHAR(160);
   SELECT set_firewall_group_mode(arg_group_name, "RESET") INTO result;
   IF result = "OK" THEN
-    INSERT IGNORE INTO mysql.firewall_groups VALUES (arg_group_name, "OFF", NULL);
-    UPDATE mysql.firewall_groups SET mode="OFF" WHERE name = arg_group_name;
-    SELECT read_firewall_group_allowlist(arg_group_name,FW.rule) FROM mysql.firewall_group_allowlist FW WHERE FW.name=arg_group_name;
+    INSERT IGNORE INTO firewall_groups VALUES (arg_group_name, "OFF", NULL);
+    UPDATE firewall_groups SET mode="OFF" WHERE name = arg_group_name;
+    SELECT read_firewall_group_allowlist(arg_group_name,FW.rule) FROM firewall_group_allowlist FW WHERE FW.name=arg_group_name;
   ELSE
     SELECT result;
   END IF;
@@ -162,7 +162,7 @@ BEGIN
   DECLARE result VARCHAR(160);
   SELECT firewall_group_enlist(arg_group_name, arg_userhost) INTO result;
   IF result = "OK" THEN
-    INSERT IGNORE INTO mysql.firewall_membership VALUES (arg_group_name, arg_userhost);
+    INSERT IGNORE INTO firewall_membership VALUES (arg_group_name, arg_userhost);
   ELSE
     SELECT result;
   END IF;
@@ -177,7 +177,7 @@ BEGIN
   DECLARE result VARCHAR(160);
   SELECT firewall_group_delist(arg_group_name, arg_userhost) INTO result;
   IF result = "OK" THEN
-    DELETE IGNORE FROM mysql.firewall_membership WHERE group_id = arg_group_name AND member_id = arg_userhost;
+    DELETE IGNORE FROM firewall_membership WHERE group_id = arg_group_name AND member_id = arg_userhost;
   ELSE
     SELECT result;
   END IF;

sql/mysqld.h

@@ -379,7 +379,7 @@ extern uint opt_server_id_bits;
 extern ulong opt_server_id_mask;
 extern const char *load_default_groups[];
 extern struct my_option my_long_early_options[];
-extern bool mysqld_server_started;
+extern "C" MYSQL_PLUGIN_IMPORT bool mysqld_server_started;
 extern "C" MYSQL_PLUGIN_IMPORT int orig_argc;
 extern "C" MYSQL_PLUGIN_IMPORT char **orig_argv;
 extern my_thread_attr_t connection_attrib;