6.4.7.4 MySQL Enterprise Firewall Reference

USERHOST

An account registered with the firewall. Each account has the format user_name@host_name and represents actual user and host names as authenticated by the server. Patterns and netmasks should not be used when registering users.

MODE

The current firewall operational mode for the account. The permitted mode values are OFF, DETECTING, PROTECTING, RECORDING, and RESET. For details about their meanings, see the description of sp_set_firewall_mode() in MySQL Enterprise Firewall Procedures and Functions.

USERHOST

An account registered with the firewall. The format is the same as for the user account tables.

RULE

A normalized statement indicating an acceptable statement pattern for the account. An account whitelist is the union of its rules.

ID

An integer column that is a primary key for the table. This column was added in MySQL 8.0.12.

sp_reload_firewall_rules(user)

This stored procedure uses firewall UDFs to reset a registered account and reload the in-memory rules for it from the rules stored in the mysql.firewall_whitelist table. This procedure provides control over firewall operation for individual accounts.

The user argument names the affected account, as a string in user_name@host_name format.

Example:

sp_set_firewall_mode(user, mode)

This stored procedure registers a MySQL account with the firewall and establishes its operational mode. The procedure also invokes firewall UDFs as necessary to transfer firewall data between the cache and the underlying system tables. This procedure may be called even if the mysql_firewall_mode system variable is OFF, although setting the mode for an account has no operational effect while the firewall is disabled.

The user argument names the affected account, as a string in user_name@host_name format.

The mode is the operational mode for the user, as a string. These mode values are permitted:

Switching the mode for an account to any mode but RECORDING synchronizes the firewall cache data to the underlying mysql system database tables for persistent storage. Switching the mode from OFF to RECORDING reloads the whitelist from the mysql.firewall_whitelist table into the cache.

If an account has an empty whitelist, setting its mode to PROTECTING produces an error message that is returned in a result set, but not an SQL error:

mysql_firewall_flush_status()

This UDF resets several firewall status variables to 0:

Firewall_access_denied
Firewall_access_granted
Firewall_access_suspicious

Example:

normalize_statement(stmt)

This UDF normalizes an SQL statement into the digest form used for whitelist rules.

Example:

read_firewall_users(user, mode)

This aggregate UDF updates the firewall user cache through a SELECT statement on the mysql.firewall_users table.

Example:

read_firewall_whitelist(user, rule)

This aggregate UDF updates the recorded statement cache through a SELECT statement on the mysql.firewall_whitelist table.

Example:

set_firewall_mode(user, mode)

This UDF manages the user cache and establishes the user operational mode.

Example:

mysql_firewall_mode

Whether MySQL Enterprise Firewall is enabled (the default) or disabled.

mysql_firewall_trace

Whether the MySQL Enterprise Firewall trace is enabled or disabled (the default). When mysql_firewall_trace is enabled, for PROTECTING mode, the firewall writes rejected statements to the error log.

Firewall_access_denied

The number of statements rejected by MySQL Enterprise Firewall.

Firewall_access_granted

The number of statements accepted by MySQL Enterprise Firewall.

Firewall_access_suspicious

The number of statements logged by MySQL Enterprise Firewall as suspicious for users who are in DETECTING mode.

Firewall_cached_entries

The number of statements recorded by MySQL Enterprise Firewall, including duplicates.