If the filter is configured with action=allow and a function type rule is defined, queries which do not use functions match the function rule.

markus makela Can you please give example configuration of dbfirewall filter(full) that blocks all functions on a column

I did a quick test to figure out how the function whitelisting happens and I happened to spot a minor bug in the function type rule. Currently the syntax does not allow an empty set of function names to be given as a value for a function type rule. I've reported this in MXS-1345.

Meanwhile, the following rule file only allows the name_const function to be used with the name and address columns.

rule wl_columns deny columns name address

rule wl_function deny function name_const

users %@% match all rules wl_columns wl_function

Here's the configuration file for the rule file.

[fw]

type=filter

module=dbfwfilter

rules=/home/markusjm/build/rules

action=allow

A problematic fact about these types of rules is that the list of allowed columns is applied to all columns instead of a set of specified columns. This is partly due to the lack of expressiveness of the rule language of the dbfwfilter.

markus makela If the rule applies to function on call columns, that is a defect. A function should be specified on per column basis as well. I have created MXS-1346 to report it.