USERHOST

帐户配置文件名称。每个帐户名的格式都是 . user_name@host_name

MODE

The current operational mode for the profile. Permitted mode values are OFF, DETECTING, PROTECTING, RECORDING, and RESET. For details about their meanings, see Firewall Concepts.

USERHOST

The account profile name. Each account name has the format user_name@host_name.

RULE

A normalized statement indicating an acceptable statement pattern for the profile. A profile allowlist is the union of its rules.

ID

An integer column that is a primary key for the table. This column was added in MySQL 5.7.23.

sp_reload_firewall_rules(user)

This stored procedure provides control over firewall operation for individual account profiles. The procedure uses firewall administrative functions to reload the in-memory rules for an account profile from the rules stored in the mysql.firewall_whitelist table.

Arguments:

Example:

CALL mysql.sp_reload_firewall_rules('fwuser@localhost');

sp_set_firewall_mode(user, mode)

This stored procedure establishes the operational mode for a firewall account profile, after registering the profile with the firewall if it was not already registered. The procedure also invokes firewall administrative functions as necessary to transfer firewall data between the cache and persistent storage. This procedure may be called even if the mysql_firewall_mode system variable is OFF, although setting the mode for a profile has no operational effect until the firewall is enabled.

Arguments:

Switching an account profile to any mode but RECORDING synchronizes its firewall cache data to the mysql system database tables that provide persistent underlying storage. Switching the mode from OFF to RECORDING reloads the allowlist from the mysql.firewall_whitelist table into the cache.

If an account profile has an empty allowlist, its mode cannot be set to PROTECTING because the profile would reject every statement, effectively prohibiting the account from executing statements. In response to such a mode-setting attempt, the firewall produces a diagnostic message that is returned as a result set rather than as an SQL error:

mysql> CALL mysql.sp_set_firewall_mode('a@b','PROTECTING');
+----------------------------------------------------------------------+
| set_firewall_mode(arg_userhost, arg_mode)                            |
+----------------------------------------------------------------------+
| ERROR: PROTECTING mode requested for a@b but the whitelist is empty. |
+----------------------------------------------------------------------+
1 row in set (0.02 sec)

Query OK, 0 rows affected (0.02 sec)

Firewall Account Profile Functions

Firewall Miscellaneous Functions

read_firewall_users(user, mode)

This aggregate function updates the firewall account profile cache through a SELECT statement on the mysql.firewall_users table. It requires the SUPER privilege.

Example:

SELECT read_firewall_users('fwuser@localhost', 'RECORDING')
FROM mysql.firewall_users;

read_firewall_whitelist(user, rule)

This aggregate function updates the recorded-statement cache for the named account profile through a SELECT statement on the mysql.firewall_whitelist table. It requires the SUPER privilege.

Example:

SELECT read_firewall_whitelist('fwuser@localhost', fw.rule)
FROM mysql.firewall_whitelist AS fw
WHERE USERHOST = 'fwuser@localhost';

set_firewall_mode(user, mode)

This function manages the account profile cache and establishes the profile operational mode. It requires the SUPER privilege.

Example:

SELECT set_firewall_mode('fwuser@localhost', 'RECORDING');

mysql_firewall_flush_status()

This function resets several firewall status variables to 0:

This function requires the SUPER privilege.

Example:

SELECT mysql_firewall_flush_status();

normalize_statement(stmt)

This function normalizes an SQL statement into the digest form used for allowlist rules. It requires the SUPER privilege.

Example:

SELECT normalize_statement('SELECT * FROM t1 WHERE c1 > 2');

mysql_firewall_mode

Whether MySQL Enterprise Firewall is enabled (the default) or disabled.

mysql_firewall_trace

Whether the MySQL Enterprise Firewall trace is enabled or disabled (the default). When mysql_firewall_trace is enabled, for PROTECTING mode, the firewall writes rejected statements to the error log.

Firewall_access_denied

The number of statements rejected by MySQL Enterprise Firewall.

Firewall_access_granted

The number of statements accepted by MySQL Enterprise Firewall.

Firewall_access_suspicious

MySQL Enterprise Firewall 记录的对处于DETECTING模式的用户可疑的语句数。

Firewall_cached_entries

MySQL Enterprise Firewall 记录的语句数，包括重复项。