Database Firewall Algorithms

Database Firewall Algorithms #

Matching Algorithms #

Risk DDL Matching Algorithm #

Type: RISK_DDL

Configurable Properties:

Property Name	Data Type	Description	Default Value
truncate-table	boolean	Match TRUNCATE TABLE statements	true
drop-table	boolean	Match DROP TABLE statements	true
alter-table	boolean	Match ALTER TABLE statements	true

Risk DML Matching Algorithm #

Type: RISK_DML

Configurable Properties:

Property Name	Data Type	Description	Default Value
full-table-update	boolean	Match full table update statements	true
full-table-delete	boolean	Match full table delete statements	true

Note: Full table update and full table delete refer to UPDATE and DELETE statements that do not include a WHERE clause.

Join Query Matching Algorithm #

Type: JOIN_QUERY

Configurable Properties:

Property Name	Data Type	Description	Default Value
max-allowed-join-table-count	int	Maximum allowed number of joined tables	3

Note: This algorithm does not differentiate between JOIN types, such as LEFT JOIN, RIGHT JOIN, etc.

Subquery Matching Algorithm #

Type: SUBQUERY

Configurable Properties:

Property Name	Data Type	Description	Default Value
max-allowed-subquery-count	int	Maximum allowed depth of nested subqueries	1

Sharding Condition Matching Algorithm #

Type: SHARDING

Configurable Properties:

Property Name	Data Type	Description	Default Value
select-without-sharding-column	boolean	Match SELECT statements without sharding columns	true
update-without-sharding-column	boolean	Match UPDATE statements without sharding columns	true
delete-without-sharding-column	boolean	Match DELETE statements without sharding columns	true

Note: INSERT statements are required to have sharding keys and are not checked by the database firewall rules.

Missing WHERE condition matching algorithm #

Type: MISSING_WHERE_CONDITION

Configurable Properties:

Property Name	Data Type	Description	Default Value
columns	string	Column to match	None
insert	boolean	Whether to match the INSERT statement	true
select	boolean	Whether to match the SELECT statement	true
update	boolean	Whether to match the UPDATE statement	true
delete	boolean	Whether to match the DELETE statement	true

Note: If the DML statement does not contain the where condition of the column corresponding to columns, the match will be successful.

Host Address Matching Algorithm #

Type: HOST

Configurable Properties:

Property Name	Data Type	Description	Default Value
blacklist	String	Blacklist specifying addresses to match	None
whitelist	String	Whitelist specifying addresses to allow	None

Explanation:

When declaring the algorithm, either the blacklist or whitelist must be defined; both cannot be empty simultaneously.
Only supports IP addresses, such as ‘127.0.0.1’; does not support hostname format.
Both blacklist and whitelist support multiple elements, separated by commas, e.g., ‘127.0.0.1, 10.9.100.5’.
Algorithm rules: The current address is considered a match if it is in the blacklist or [the whitelist is not empty and the current address is not in the whitelist].
In case of duplicate elements in the blacklist and whitelist, the blacklist takes priority.

Username Matching Algorithm #

Type: USERNAME

Configurable Properties:

Property Name	Data Type	Description	Default Value
blacklist	String	Blacklist specifying usernames to match	None
whitelist	String	Whitelist specifying usernames to allow	None

Explanation:

When declaring the algorithm, either the blacklist or whitelist must be defined; both cannot be empty simultaneously.
Matches only the username, without considering the login address.
Both blacklist and whitelist support multiple elements, separated by commas, e.g., ‘root, sharding’.
Algorithm rules: The current user is considered a match if they are in the blacklist or [the whitelist is not empty and the current username is not in the whitelist].
In case of duplicate elements in the blacklist and whitelist, the blacklist takes priority.

Role Matching Algorithm #

Type: ROLE

Configurable Properties:

Property Name	Data Type	Description	Default Value
blacklist	String	Blacklist specifying roles to match	None
whitelist	String	Whitelist specifying roles to allow	None

Explanation:

When declaring the algorithm, either the blacklist or whitelist must be defined; both cannot be empty simultaneously.
Both blacklist and whitelist support multiple elements, separated by commas, e.g., ‘role_dml, admin’.
Algorithm rules: The current user’s role is considered a match if any of their roles are in the blacklist or [the whitelist is not empty and none of the user’s roles are in the whitelist].
In case of duplicate elements in the blacklist and whitelist, the blacklist takes priority.

Disable encrypted field association query algorithm #

Type: ENCRYPT_JOIN_QUERY

Configurable Properties: None

Description：

After configuring this algorithm, it will be prohibited to perform related queries on encrypted fields.

Database Firewall Action Algorithms #

Logging #

Type: LOG

Configurable Properties:

Property Name	Data Type	Description	Default Value
log-level	String	Output log level, supports DEBUG, INFO, WARN, ERROR	WARN

Explanation: Logs database firewall events, including database, user, host, and matched policy name, e.g., [WARN] date time [THREAD] AUDIT - log by strategy: risk_dml_strategy db: sharding_db user: root host: 127.0.0.1

Blocking #

Type: BLOCK

Explanation:

Logs database firewall events and blocks them by throwing an exception. The log includes the database, user, host, and matched policy name, e.g., [WARN] date time [THREAD] AUDIT - block by strategy: risk_dml_strategy db: sharding_db user: root host: 127.0.0.1
The log level for blocked events is uniformly set to WARN and is not currently modifiable.