# # WL#5706/Bug#58712/Bug#11746378 # Encrypt or remove passwords from slow, query, and binary logs # (see sql/sql_rewrite.cc for bulk of implementation) # --source include/not_windows.inc # make sure we start with a clean slate. log_tables.test says this is OK. TRUNCATE TABLE mysql.slow_log; SET @old_log_output= @@global.log_output; SET @old_slow_query_log= @@global.slow_query_log; SET @old_slow_query_log_file= @@global.slow_query_log_file; SET @old_long_query_time= @@global.long_query_time; --replace_result $MYSQLTEST_VARDIR ... eval SET GLOBAL slow_query_log_file= '$MYSQLTEST_VARDIR/log/rewrite_slow.log'; SET GLOBAL log_output = 'FILE,TABLE'; SET GLOBAL slow_query_log= 'ON'; # The answer is obvious: log everything! SET SESSION long_query_time= 0; # Show that obfuscation applies to the slow log at all. # If one applies, they all do, and we've already demonstrated the individual # obfuscations above for the general log. # 1.1.1.1 GRANT ALL on *.* TO test_user1 IDENTIFIED BY 'azundris1'; # 1.1.1.2 CREATE USER test_user2 IDENTIFIED BY 'azundris2'; # 1.1.1.3 --disable_warnings CHANGE MASTER TO MASTER_PASSWORD='azundris3'; CHANGE MASTER TO MASTER_CONNECT_RETRY = 1, MASTER_HEARTBEAT_PERIOD = 1.01, MASTER_LOG_FILE = 'master_log_name', MASTER_LOG_POS = 0, MASTER_SSL = 0, MASTER_SSL_CA = 'ca_file_name', MASTER_SSL_CAPATH = 'ca_directory_name', MASTER_SSL_CERT = 'cert_file_name', MASTER_SSL_KEY = 'key_file_name', MASTER_SSL_CIPHER = 'cipher_list', MASTER_SSL_VERIFY_SERVER_CERT = 0, IGNORE_SERVER_IDS = (99,100); # cleanup CHANGE MASTER TO MASTER_CONNECT_RETRY = 1, MASTER_HEARTBEAT_PERIOD = 1.01, MASTER_LOG_FILE = '', MASTER_LOG_POS = 0, MASTER_SSL = 0, MASTER_SSL_CA = '', MASTER_SSL_CAPATH = '', MASTER_SSL_CERT = '', MASTER_SSL_KEY = '', MASTER_SSL_CIPHER = '', MASTER_SSL_VERIFY_SERVER_CERT = 0, IGNORE_SERVER_IDS = ( ); --enable_warnings # 1.1.1.4 CREATE USER 'test_user4'@'localhost'; SET PASSWORD FOR 'test_user4'@'localhost' = PASSWORD('azundris4'); SET SESSION long_query_time= @old_long_query_time; # clean-up SET GLOBAL slow_query_log='OFF'; DROP USER 'test_user4'@'localhost'; DROP USER test_user2; DROP USER test_user1; # show slow-logging to file is correct CREATE TABLE test_log (sql_text TEXT); --replace_result $MYSQLTEST_VARDIR ... eval LOAD DATA LOCAL INFILE '$MYSQLTEST_VARDIR/log/rewrite_slow.log' INTO TABLE test_log FIELDS TERMINATED BY '\n' LINES TERMINATED BY '\n'; # all passwords ('azundris%') must have been obfuscated -> empty result set --echo This line should be followed by two SELECTs with empty result sets SELECT sql_text FROM test_log WHERE sql_text LIKE CONCAT('%azun','dris%'); # same for logging to table SELECT sql_text FROM mysql.slow_log WHERE sql_text LIKE CONCAT('%azun','dris%'); --echo ------ from file ------ SELECT sql_text FROM test_log WHERE sql_text like '%PASSWORD %'; --echo ------ from table ------ SELECT sql_text FROM mysql.slow_log WHERE sql_text like '%PASSWORD %'; --echo ------ done ------ DROP TABLE test_log; --remove_file $MYSQLTEST_VARDIR/log/rewrite_slow.log SET GLOBAL slow_query_log_file= @old_slow_query_log_file; SET GLOBAL slow_query_log= @old_slow_query_log; SET GLOBAL log_output= @old_log_output; --echo End of 5.6 tests!