mirror of
https://github.com/MariaDB/server.git
synced 2025-01-27 17:33:44 +01:00
689a96fcce
Problem: when SHOW BINLOG EVENTS was issued, it increased the value of @@session.max_allowed_packet. This allowed a non-root user to increase the amount of memory used by her thread arbitrarily. Thus, it removes the bound on the amount of system resources used by a client, so it presents a security risk (DoS attack). Fix: it is correct to increase the value of @@session.max_allowed_packet while executing SHOW BINLOG EVENTS (see BUG 30435). However, the increase should only be temporary. Thus, the fix is to restore the value when SHOW BINLOG EVENTS ends. The value of @@session.max_allowed_packet is also increased in mysql_binlog_send (i.e., the binlog dump thread). It is not clear if this can cause any trouble, since normally the client that issues COM_BINLOG_DUMP will not issue any other commands that would be affected by the increased value of @@session.max_allowed_packet. However, we restore the value just in case. mysql-test/suite/rpl/r/rpl_packet.result: update result file mysql-test/suite/rpl/t/rpl_packet.test: Add test that verifies that @@session.max_allowed_packet does not change when issuing SHOW BINLOG EVENTS. Make previous sub-test clean up. Add comments listing the bugs in this test case. sql/sql_repl.cc: Restore the old value of thd->variables.max_allowed_packet at the end of mysql_binlog_send and mysql_show_binlog_events.
168 lines
8.5 KiB
Text
168 lines
8.5 KiB
Text
# ==== Purpose ====
|
|
#
|
|
# Check replication protocol packet size handling
|
|
#
|
|
# ==== Related bugs ====
|
|
# Bug#19402 SQL close to the size of the max_allowed_packet fails on slave
|
|
# BUG#23755: Replicated event larger that max_allowed_packet infinitely re-transmits
|
|
# BUG#42914: No LAST_IO_ERROR for max_allowed_packet errors
|
|
# BUG#55322: SHOW BINLOG EVENTS increases @@SESSION.MAX_ALLOWED_PACKET
|
|
|
|
# max-out size db name
|
|
source include/master-slave.inc;
|
|
source include/have_binlog_format_row.inc;
|
|
call mtr.add_suppression("Slave I/O: Got a packet bigger than 'max_allowed_packet' bytes, Error_code: 1153");
|
|
call mtr.add_suppression("Slave I/O: Got fatal error 1236 from master when reading data from binary log:");
|
|
|
|
let $db= DB_NAME_OF_MAX_LENGTH_AKA_NAME_LEN_64_BYTES_____________________;
|
|
disable_warnings;
|
|
eval drop database if exists $db;
|
|
enable_warnings;
|
|
eval create database $db;
|
|
|
|
connection master;
|
|
let $old_max_allowed_packet= `SELECT @@global.max_allowed_packet`;
|
|
let $old_net_buffer_length= `SELECT @@global.net_buffer_length`;
|
|
SET @@global.max_allowed_packet=1024;
|
|
SET @@global.net_buffer_length=1024;
|
|
|
|
# Restart slave for setting to take effect
|
|
connection slave;
|
|
source include/stop_slave.inc;
|
|
source include/start_slave.inc;
|
|
|
|
# Reconnect to master for new setting to take effect
|
|
disconnect master;
|
|
|
|
# alas, can't use eval here; if db name changed apply the change here
|
|
connect (master,localhost,root,,DB_NAME_OF_MAX_LENGTH_AKA_NAME_LEN_64_BYTES_____________________);
|
|
|
|
connection master;
|
|
select @@net_buffer_length, @@max_allowed_packet;
|
|
|
|
create table `t1` (`f1` LONGTEXT) ENGINE=MyISAM;
|
|
|
|
INSERT INTO `t1`(`f1`) VALUES ('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa1023');
|
|
save_master_pos;
|
|
|
|
connection slave;
|
|
sync_with_master;
|
|
eval select count(*) from `$db`.`t1` /* must be 1 */;
|
|
|
|
SHOW STATUS LIKE 'Slave_running';
|
|
select * from information_schema.session_status where variable_name= 'SLAVE_RUNNING';
|
|
connection master;
|
|
eval drop database $db;
|
|
save_master_pos;
|
|
|
|
connection slave;
|
|
sync_with_master;
|
|
|
|
#
|
|
# Bug #23755: Replicated event larger that max_allowed_packet infinitely re-transmits
|
|
#
|
|
# Check that a situation when the size of event on the master is greater than
|
|
# max_allowed_packet on the slave does not lead to infinite re-transmits.
|
|
|
|
connection master;
|
|
|
|
# Change the max packet size on master
|
|
|
|
SET @@global.max_allowed_packet=4096;
|
|
SET @@global.net_buffer_length=4096;
|
|
|
|
# Restart slave for new setting to take effect
|
|
connection slave;
|
|
source include/stop_slave.inc;
|
|
source include/start_slave.inc;
|
|
|
|
# Reconnect to master for new setting to take effect
|
|
disconnect master;
|
|
connect (master, localhost, root);
|
|
connection master;
|
|
|
|
CREATE TABLE `t1` (`f1` LONGTEXT) ENGINE=MyISAM;
|
|
|
|
sync_slave_with_master;
|
|
|
|
connection master;
|
|
|
|
INSERT INTO `t1`(`f1`) VALUES ('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa2048');
|
|
|
|
# The slave I/O thread must stop after trying to read the above event
|
|
connection slave;
|
|
--source include/wait_for_slave_io_to_stop.inc
|
|
let $slave_io_running= query_get_value(SHOW SLAVE STATUS, Slave_IO_Running, 1);
|
|
--echo Slave_IO_Running = $slave_io_running (expect No)
|
|
#
|
|
# Bug#42914: The slave I/O thread must stop after trying to read the above
|
|
# event, However there is no Last_IO_Error report.
|
|
#
|
|
let $last_io_error= query_get_value(SHOW SLAVE STATUS, Last_IO_Error, 1);
|
|
eval SELECT "$last_io_error" AS Last_IO_Error;
|
|
|
|
#
|
|
# Bug#42914: On the master, if a binary log event is larger than
|
|
# max_allowed_packet, the error message ER_MASTER_FATAL_ERROR_READING_BINLOG
|
|
# is sent to a slave when it requests a dump from the master, thus leading the
|
|
# I/O thread to stop. However, there is no Last_IO_Error reported.
|
|
#
|
|
source include/master-slave-reset.inc;
|
|
connection master;
|
|
CREATE TABLE t1 (f1 int PRIMARY KEY, f2 LONGTEXT, f3 LONGTEXT) ENGINE=MyISAM;
|
|
sync_slave_with_master;
|
|
|
|
connection master;
|
|
INSERT INTO t1(f1, f2, f3) VALUES(1, REPEAT('a', @@global.max_allowed_packet), REPEAT('b', @@global.max_allowed_packet));
|
|
|
|
connection slave;
|
|
# The slave I/O thread must stop after receiving
|
|
# ER_MASTER_FATAL_ERROR_READING_BINLOG error message from master.
|
|
--source include/wait_for_slave_io_to_stop.inc
|
|
let $slave_io_running= query_get_value(SHOW SLAVE STATUS, Slave_IO_Running, 1);
|
|
--echo Slave_IO_Running = $slave_io_running (expect No)
|
|
let $last_io_error= query_get_value(SHOW SLAVE STATUS, Last_IO_Error, 1);
|
|
eval SELECT "$last_io_error" AS Last_IO_Error;
|
|
|
|
# Remove the bad binlog and clear error status on slave.
|
|
STOP SLAVE;
|
|
RESET SLAVE;
|
|
--connection master
|
|
RESET MASTER;
|
|
|
|
|
|
#
|
|
# BUG#55322: SHOW BINLOG EVENTS increases @@SESSION.MAX_ALLOWED_PACKET
|
|
#
|
|
# In BUG#55322, @@session.max_allowed_packet increased each time SHOW
|
|
# BINLOG EVENTS was issued. To verify that this bug is fixed, we
|
|
# execute SHOW BINLOG EVENTS twice and check that max_allowed_packet
|
|
# never changes. We turn off the result log because we don't care
|
|
# about the contents of the binlog.
|
|
|
|
--disable_result_log
|
|
SET @max_allowed_packet_0= @@session.max_allowed_packet;
|
|
SHOW BINLOG EVENTS;
|
|
SET @max_allowed_packet_1= @@session.max_allowed_packet;
|
|
SHOW BINLOG EVENTS;
|
|
SET @max_allowed_packet_2= @@session.max_allowed_packet;
|
|
--enable_result_log
|
|
if (`SELECT NOT(@max_allowed_packet_0 = @max_allowed_packet_1 AND @max_allowed_packet_1 = @max_allowed_packet_2)`)
|
|
{
|
|
--echo ERROR: max_allowed_packet changed after executing SHOW BINLOG EVENTS
|
|
--source include/show_rpl_debug_info.inc
|
|
SELECT @max_allowed_packet_0, @max_allowed_packet_1, @max_allowed_packet_2;
|
|
--die @max_allowed_packet changed after executing SHOW BINLOG EVENTS
|
|
}
|
|
|
|
|
|
--echo ==== clean up ====
|
|
connection master;
|
|
DROP TABLE t1;
|
|
eval SET @@global.max_allowed_packet= $old_max_allowed_packet;
|
|
eval SET @@global.net_buffer_length= $old_net_buffer_length;
|
|
# slave is stopped
|
|
connection slave;
|
|
DROP TABLE t1;
|
|
|
|
# End of tests
|