public:

explicit Grant_validator(THD *thd, const char *db,

const List<LEX_USER> &user_list,

Access_bitmask rights, bool revoke,

const List<LEX_CSTRING> &dynamic_privilege,

bool grant_all, LEX_GRANT_AS *grant_as,

TABLE *dynamic_priv_table)

: m_thd(thd),

m_db(db),

m_user_list(user_list),

m_rights(rights),

m_revoke(revoke),

m_dynamic_privilege(dynamic_privilege),

m_grant_all(grant_all),

m_grant_as(grant_as),

m_dynamic_priv_table(dynamic_priv_table),

m_restore(false),

m_backup(nullptr) {}

~Grant_validator();

bool validate();

private:

bool mask_and_return_error();

bool validate_system_user_privileges();

bool validate_dynamic_privileges();

bool validate_and_process_grant_as();

private:

THD *m_thd;

const char *m_db;

const List<LEX_USER> &m_user_list;

Access_bitmask m_rights;

bool m_revoke;

const List<LEX_CSTRING> &m_dynamic_privilege;

bool m_grant_all;

LEX_GRANT_AS *m_grant_as;

TABLE *m_dynamic_priv_table;

bool m_restore;

Security_context *m_backup;

Security_context m_security_context;

DBUG_TRACE;

/* Restore security context */

if (m_restore)

m_thd->security_context()->restore_security_context(m_thd, m_backup);

m_restore = false;

/*

m_thd->get_stmt_da()->reset_diagnostics_area();

my_error(ER_UKNOWN_AUTH_ID_OR_ACCESS_DENIED_FOR_GRANT_AS, MYF(0));

return true;

DBUG_TRACE;

if (m_grant_as == nullptr || !m_grant_as->grant_as_used) return false;

LEX_USER *user = get_current_user(m_thd, m_grant_as->user);

if (user == nullptr) return mask_and_return_error();

/* Change security context */

if (m_security_context.change_security_context(m_thd, user->user, user->host,

nullptr, &m_backup, true))

return mask_and_return_error();

m_restore = true;

Roles::Role_activation role_activation(m_thd, m_thd->security_context(),

m_grant_as->role_type,

m_grant_as->role_list, false);

if (role_activation.activate()) return mask_and_return_error();

/* Compare restrictions */

Restrictions this_restrictions = m_thd->security_context()->restrictions();

Restrictions other_restrictions = m_backup->restrictions();

if (this_restrictions.has_more_db_restrictions(other_restrictions, m_rights))

return mask_and_return_error();

return false;

DBUG_TRACE;

if (check_system_user_privilege(m_thd, m_user_list)) return true;

return false;

DBUG_TRACE;

/* Sanity checks for dynamic privileges */

if (!m_db && (m_dynamic_privilege.elements > 0 || m_grant_all)) {

LEX_CSTRING *priv;

Update_dynamic_privilege_table update_table(m_thd, m_dynamic_priv_table);

List<LEX_CSTRING> *privileges_to_check;

if (m_grant_all) {

/*

privileges_to_check = new (m_thd->mem_root) List<LEX_CSTRING>;

iterate_all_dynamic_privileges(m_thd, [&](const char *str) {

LEX_CSTRING *new_str = (LEX_CSTRING *)m_thd->alloc(sizeof(LEX_CSTRING));

new_str->str = str;

new_str->length = strlen(str);

privileges_to_check->push_back(new_str);

return false;

});

} else

privileges_to_check =

&const_cast<List<LEX_CSTRING> &>(m_dynamic_privilege);

List_iterator<LEX_CSTRING> priv_it(*privileges_to_check);

bool error = false;

Security_context *sctx = m_thd->security_context();

while ((priv = priv_it++) && !error) {

/*

if (check_access(m_thd, UPDATE_ACL, consts::mysql.c_str(), nullptr,

nullptr, true, true) &&

!sctx->has_global_grant(priv->str, priv->length).second) {

my_error(ER_SPECIFIC_ACCESS_DENIED_ERROR, MYF(0), "GRANT OPTION");

return true;

}

if (!m_revoke) {

// Do not grant SYSTEM_USER privilege to a mandatory role

if (consts::system_user.compare(priv->str) == 0) {

std::vector<Role_id> mandatory_roles;

get_mandatory_roles(&mandatory_roles);

List_iterator<LEX_USER> str_list(

const_cast<List<LEX_USER> &>(m_user_list));

LEX_USER *user, *target_user;

while ((target_user = str_list++)) {

if (!(user = get_current_user(m_thd, target_user))) {

my_error(ER_OUTOFMEMORY, MYF(0), sizeof(LEX_USER));

return true;

}

Auth_id_ref auth_id = create_authid_from(user);

for (const auto &rid : mandatory_roles) {

if (rid == auth_id) {

my_error(ER_CANNOT_GRANT_SYSTEM_PRIV_TO_MANDATORY_ROLE, MYF(0),

auth_id.first.str, auth_id.second.str, priv->str);

return true;

}

}

}

}

}

}

}

return false;

DBUG_TRACE;

if (validate_system_user_privileges()) return true;

if (validate_dynamic_privileges()) return true;

/*

if (validate_and_process_grant_as()) return true;

return false;

if (get_dynamic_privilege_register()->find(privilege) !=

get_dynamic_privilege_register()->end()) {

return true;

}

return false;

std::string &authid_user,

Role_vertex_descriptor *user_vert,

Role_vertex_descriptor *role_vert) {

DBUG_TRACE;

assert(assert_acl_cache_write_lock(thd));

Role_index_map::iterator it = g_authid_to_vertex->find(authid_user);

if (it == g_authid_to_vertex->end()) {

// No such user

return true;

} else

*user_vert = it->second;

it = g_authid_to_vertex->find(authid_role);

if (it == g_authid_to_vertex->end()) {

// No such role

return true;

} else

*role_vert = it->second;

boost::remove_edge(*user_vert, *role_vert, *g_granted_roles);

return false;

const Role_vertex_descriptor &role_vert, ACL_USER *acl_user) {

degree_s_t count = boost::in_degree(role_vert, *g_granted_roles);

acl_user->is_role = (count > 0) ? true : false;

std::string authid_role = create_authid_str_from(role);

std::string authid_user = create_authid_str_from(user);

Role_vertex_descriptor user_vert;

Role_vertex_descriptor role_vert;

if (!revoke_role_helper(thd, authid_role, authid_user, &user_vert,

&role_vert)) {

update_role_flag_of_acl_user(role_vert, role);

}

assert(assert_acl_cache_write_lock(thd));

for (auto &acl_user : *acl_users) {

create_role_vertex(&acl_user);

}

g_authid_to_vertex->clear();

boost::graph_traits<Granted_roles_graph>::vertex_iterator vert_it, vert_end;

boost::tie(vert_it, vert_end) = boost::vertices(*g_granted_roles);

for (; vert_it != vert_end; ++vert_it) {

ACL_USER acl_user =

boost::get(boost::vertex_acl_user_t(),

*g_granted_roles)[boost::vertex(*vert_it, *g_granted_roles)];

if (acl_user.user == g_active_dummy_user) {

(*g_authid_to_vertex)["root"] = *vert_it;

} else {

std::string authid = create_authid_str_from(&acl_user);

(*g_authid_to_vertex)[authid] = *vert_it;

}

}

const Auth_id_ref &authid_user) {

DBUG_TRACE;

bool error = false;

std::vector<ACL_USER> users;

assert(assert_acl_cache_write_lock(thd));

std::string authid_user_str = create_authid_str_from(authid_user);

Role_index_map::iterator it;

if ((it = g_authid_to_vertex->find(authid_user_str)) !=

g_authid_to_vertex->end()) {

/* Fetch source vertex details */

ACL_USER source_acl_user = boost::get(

boost::vertex_acl_user_t(),

*g_granted_roles)[boost::vertex(it->second, *g_granted_roles)];

Auth_id_ref source_user = create_authid_from(&source_acl_user);

/*

auto modify_role_edges = [&thd, &edge_table, &error,

&source_user](const ACL_USER &target_acl_user) {

Auth_id_ref target_user = create_authid_from(&target_acl_user);

error = modify_role_edges_in_table(thd, edge_table, source_user,

target_user, false, true);

error |= modify_role_edges_in_table(thd, edge_table, target_user,

source_user, false, true);

};

/* Fetch the neighboring vertices from the outgoing edges */

out_edge_itr_t oute_itr, oute_end;

boost::tie(oute_itr, oute_end) =

boost::out_edges(it->second, *g_granted_roles);

for (; oute_itr != oute_end; ++oute_itr) {

ACL_USER target_acl_user = boost::get(

boost::vertex_acl_user_t(),

*g_granted_roles)[boost::target(*oute_itr, *g_granted_roles)];

modify_role_edges(target_acl_user);

users.push_back(target_acl_user);

}

/* Fetch the neighboring vertices from the incoming edges */

in_edge_itr_t ine_itr, ine_end;

boost::tie(ine_itr, ine_end) =

boost::in_edges(it->second, *g_granted_roles);

for (; ine_itr != ine_end; ++ine_itr) {

ACL_USER target_acl_user = boost::get(

boost::vertex_acl_user_t(),

*g_granted_roles)[boost::source(*ine_itr, *g_granted_roles)];

modify_role_edges(target_acl_user);

}

/* Remove this vertex from the graph (along with its edges) */

DBUG_PRINT("info", ("Removing %s from graph and rebuild the index.",

authid_user_str.c_str()));

/*

boost::clear_vertex(it->second, *g_granted_roles);

/*

for (auto &&user_itr : users) {

Role_index_map::iterator role_it =

g_authid_to_vertex->find(create_authid_str_from(&user_itr));

if (role_it != g_authid_to_vertex->end()) {

ACL_USER *acl_role =

find_acl_user(user_itr.host.get_host(), user_itr.user, true);

assert(acl_role != nullptr);

update_role_flag_of_acl_user(role_it->second, acl_role);

}

}

}

// Remove all default role policies assigned to this authid.

clear_default_roles(thd, defaults_table, authid_user, nullptr);

// Remove all default role policies in which this authid is a default role.

std::vector<Default_roles::iterator> delete_policies;

for (auto policy = g_default_roles->begin(); policy != g_default_roles->end();

++policy) {

if (policy->second == authid_user) {

delete_policies.push_back(policy);

}

}

for (auto &&policy : delete_policies) {

modify_default_roles_in_table(thd, defaults_table,

create_authid_from(policy->first),

create_authid_from(policy->second), true);

g_default_roles->erase(policy);

}

return error;

TABLE *defaults_table, LEX_USER *user_name) {

List_of_granted_roles granted_roles;

get_granted_roles(user_name, &granted_roles);

Auth_id_ref user_name_authid = create_authid_from(user_name);

bool error = drop_role(thd, edge_table, defaults_table, user_name_authid);

return error;

List_of_granted_roles *granted_roles) {

DBUG_TRACE;

std::string authid_user = create_authid_str_from(user_from);

Role_index_map::iterator it;

if ((it = g_authid_to_vertex->find(authid_user)) ==

g_authid_to_vertex->end()) {

/* The user from wasn't in the role graph index; nothing to do. */

return true;

}

get_granted_roles(it->second, granted_roles);

Role_vertex_descriptor user_vert;

Role_vertex_descriptor role_vert;

bool errors = false;

for (auto &&ref : *granted_roles) {

std::string role_id_str;

ref.first.auth_str(&role_id_str);

std::string user_from_str = create_authid_str_from(user_from);

Auth_id_ref role_id = create_authid_from(ref.first);

errors = modify_role_edges_in_table(thd, table, role_id,

{user_from->user, user_from->host},

ref.second, true);

if (errors) break;

/*

if (!revoke_role_helper(thd, role_id_str, user_from_str, &user_vert,

&role_vert)) {

ACL_USER *acl_role = find_acl_user(ref.first.host().c_str(),

ref.first.user().c_str(), ref.second);

assert(acl_role != nullptr);

update_role_flag_of_acl_user(role_vert, acl_role);

}

}

return errors;

ACL_USER *acl_user = find_acl_user(authid->host.str, authid->user.str, true);

if (acl_user == nullptr) return false;

return acl_user->is_role;

DBUG_TRACE;

bool is_added;

std::string authid_role = create_authid_str_from(role);

std::string authid_user = create_authid_str_from(user);

Role_vertex_descriptor user_vert, role_vert;

Role_index_map::iterator it;

if ((it = g_authid_to_vertex->find(authid_user)) ==

g_authid_to_vertex->end()) {

user_vert = boost::add_vertex(*g_granted_roles);

g_authid_to_vertex->insert(make_pair(authid_user, user_vert));

} else

user_vert = it->second;

if ((it = g_authid_to_vertex->find(authid_role)) ==

g_authid_to_vertex->end()) {

role_vert = boost::add_vertex(*g_granted_roles);

g_authid_to_vertex->insert(make_pair(authid_role, role_vert));

} else

role_vert = it->second;

boost::property_map<Granted_roles_graph, boost::vertex_name_t>::type

user_pname,

role_pname;

user_pname = boost::get(boost::vertex_name_t(), *g_granted_roles);

boost::put(user_pname, user_vert, authid_user);

role_pname = boost::get(boost::vertex_name_t(), *g_granted_roles);

boost::put(role_pname, role_vert, authid_role);

boost::property_map<Granted_roles_graph, boost::vertex_acl_user_t>::type

user_pacl_user,

role_pacl_user;

user_pacl_user = boost::get(boost::vertex_acl_user_t(), *g_granted_roles);

boost::put(user_pacl_user, user_vert, *user);

role_pacl_user = boost::get(boost::vertex_acl_user_t(), *g_granted_roles);

boost::put(role_pacl_user, role_vert, *role);

Role_edge_descriptor edge;

tie(edge, is_added) = add_edge(user_vert, role_vert, *g_granted_roles);

boost::property_map<Granted_roles_graph, boost::edge_capacity_t>::type

edge_colors;

edge_colors = boost::get(boost::edge_capacity_t(), *g_granted_roles);

boost::put(edge_colors, edge, (with_admin_opt ? 1 : 0));

role->is_role = true;

Role_vertex_descriptor role_vertex;

Role_index_map::iterator it;

std::string key = create_authid_str_from(role_acl_user);

if ((it = g_authid_to_vertex->find(key)) == g_authid_to_vertex->end()) {

role_vertex = boost::add_vertex(*g_granted_roles);

boost::property_map<Granted_roles_graph, boost::vertex_acl_user_t>::type

root_prop;

root_prop = boost::get(boost::vertex_acl_user_t(), *g_granted_roles);

boost::put(root_prop, role_vertex, *role_acl_user);

boost::property_map<Granted_roles_graph, boost::vertex_name_t>::type

role_pname;

role_pname = boost::get(boost::vertex_name_t(), *g_granted_roles);

boost::put(role_pname, role_vertex, key);

g_authid_to_vertex->insert(std::make_pair(key, role_vertex));

}

LEX_USER *user_from, LEX_USER *user_to) {

assert(assert_acl_cache_write_lock(thd));

ACL_USER *acl_user_to =

find_acl_user(user_to->host.str, user_to->user.str, true);

if (acl_user_to == nullptr) {

/* The target user doesn't exist yet? */

return true;

}

/* Update default roles */

std::vector<Role_id> old_roles;

Auth_id_ref authid_user_from = create_authid_from(user_from);

clear_default_roles(thd, defaults_table, authid_user_from, &old_roles);

List_of_auth_id_refs new_default_role_ref;

for (auto &&role : old_roles) {

Auth_id_ref authid = create_authid_from(role);

new_default_role_ref.push_back(authid);

}

bool ret = alter_user_set_default_roles(thd, defaults_table, user_to,

new_default_role_ref);

if (ret) {

String warning;

append_identifier(thd, &warning, user_from->user.str,

user_from->user.length);

append_identifier(thd, &warning, user_from->host.str,

user_from->host.length);

LogErr(WARNING_LEVEL, ER_SQL_AUTHOR_DEFAULT_ROLES_FAIL, warning.c_ptr());

ret = false;

}

List_of_granted_roles granted_roles;

ret = revoke_all_granted_roles(thd, edge_table, user_from, &granted_roles);

if (!ret) {

for (auto &&ref : granted_roles) {

ACL_USER *acl_role = find_acl_user(ref.first.host().c_str(),

ref.first.user().c_str(), ref.second);

if (acl_role == nullptr) {

/* An invalid reference was encountered; just ignore it. */

continue;

}

grant_role(acl_role, acl_user_to, ref.second);

Auth_id_ref authid_role = create_authid_from(acl_role);

Auth_id_ref authid_user = create_authid_from(acl_user_to);

ret = modify_role_edges_in_table(thd, edge_table, authid_role,

authid_user, ref.second, false);

if (ret) break;

}

}

return ret;

ACL_USER *acl_user, String *global) {

assert(assert_acl_cache_read_lock(thd));

global->length(0);

global->append(STRING_WITH_LEN("GRANT "));

if (!(want_access & ~GRANT_ACL))

global->append(STRING_WITH_LEN("USAGE"));

else {

bool found = false;

const Access_bitmask test_access = want_access & ~GRANT_ACL;

int counter = 0;

Access_bitmask j = SELECT_ACL;

for (; j <= GLOBAL_ACLS; counter++, j <<= 1) {

if (test_access & j) {

if (found) global->append(STRING_WITH_LEN(", "));

found = true;

global->append(global_acls_vector[counter].c_str(),

global_acls_vector[counter].length());

}

}

}

global->append(STRING_WITH_LEN(" ON *.* TO "));

append_auth_id(thd, acl_user, global);

if (want_access & GRANT_ACL)

global->append(STRING_WITH_LEN(" WITH GRANT OPTION"));

Protocol *protocol,

const Db_access_map &db_map,

const Db_access_map &db_wild_map,

const DB_restrictions &restrictions) {

assert(assert_acl_cache_read_lock(thd));

auto make_grant_stmts = [thd, role, protocol](const Db_access_map &map) {

for (const Db_access_map::value_type &it : map) {

Access_bitmask want_access = it.second;