PowerPoint Presentation

: : , 236349-

1 , . - , , " .

() , ? , . ip . " -PL\SQL, , , .

() connection policy, . , . ' . .

() ( ) VPD- -application context . "", piggyback ( ) / .

(), " , .

Proxy . , , , . session , " . , , . -proxy . , . ( ) 5555 , 1521.Application Context application context , , .Application context , . - Application context " session , -ID , , . : SESSION_USER -ID .

Application Context:CLIENTCONTEXT namespace :exec dbms_session.set_context('CLIENTCONTEXT','aaa','bbb'); aaa bbb :Select sys_context('CLIENTCONTEXT','aaa') from dual; bbb

Oracle . NS ( TNS) . TTI . NS packets, , packets data packet TTI. , " -TTI. .

DataOffsetSizeDescription08TNS Header82Flags10Data Data TTI, -TTI 3 (function calls) , (Fetch) " .

PiggyBack 11, Connection Function Calls , " " . , statment piggyback , , , , "" . .

SizeDescriptionValue1Message Type17 (0x11)1Function Code105 (0x69)1Sequence NumberPTRArray PTRSWORDNumber of cursorsFor each cursor:SB4Cursor IDPiggyBack - KeyVal KEYVAL, 11, application context. piggyback , , , KeyValSizeDescriptionValue1Message Type17 (0x11)1Function Code154 (0x9A)1Sequence NumberPTRFWORDNamespace lengthPTRUB4Number of valuesUB2 / UB4Flags.1 Values exists2 ClearPTRCharactersNamespaceFor each valueUB4Name lengthStringName UB4Value lengthStringValue UB4FlagOracle Virtual Private Database (VPD)

VPD . , VPD WHERE SQL policy. policy? , synonym Policy , VPD, - SQL . " WHERE - policy . -VPD . VPD SELECT,INSERT,UPDATE,INDEX,DELETE.

Oracle Virtual Private Database (VPD)

BEGIN DBMS_RLS.ADD_POLICY) object_schema => 'SYSTEM', object_name => 'OE.ORDERS, // "" policy_name => 'toDenyAccessCalendar, // policy_function => 'security ;( END; security OE.ORDERS WHERE .: :SELECT * FROM OE.ORDERS; - VPD " WHERE :SELECT * FROM OE.ORDERS WHERE SALES_REP_ID = 159; security SALES_REP_ID = 159, , ...

-PL\SQL -Policy . . :application context 'toDenyAccess' . 1 0 .'numRows' . ( 'toDenyAccess' - 'numRows') WHERE ( WHERE, ) .

PL\SQL () security1:CREATE OR REPLACE FUNCTION security1( object_schema IN VARCHAR2, object_name IN VARCHAR2)RETURN VARCHAR2 ASbeginreturn '('|| sys_context('CLIENTCONTEXT','toDenyAccess') ||'= 0)';end; sys_context('CLIENTCONTEXT','toDenyAccess') = 1)) -'toDenyAccess' 1.

PL\SQL () security2:CREATE OR REPLACE FUNCTION security2 ( object_schema IN VARCHAR2, object_name IN VARCHAR2)RETURN VARCHAR2 ASbeginreturn '('|| sys_context('CLIENTCONTEXT','toDenyAccess') ||'= 1 and ' || 'rownum object_name => policy_name=> policy_function => 'security1', statement_types => 'INSERT,UPDATE'); END; -Policy security1 .

Policy () action SELECT Policy security2. , :BEGIN DBMS_RLS.ADD_POLICY( object_schema => object_name => policy_name=> policy_function => 'security2', statement_types => SELECT'); END; -Policy security2 " .

, . , . " . , . "" , . , . , KEYVAL. KEYVAL -application context . - toDenyAccess ( ) - numRows ( , ). ( ) " , -Policy . -Policy , -Policy (security1 security2 -Policy). - application context , -toDenyAccess -numRows. WHERE . , " . PiggyBack - proxy, , , , piggyback KEYVAL, (application context) . ? :

rule12 RULES_TABLE11SELECT118:0021:00

18:00-21:00 .RULES_TABLE11 20:00 .select * from RULES_TABLE11 num_rows 1, . , piggyback .* -hexadecimal :00 68(size) 00 00 06 00 00 00 00 00 11 69 00 01 01 01 01 02 03 5e(fetch) 00 02 80 21 00 01 01 1b 01 01 0d 00 00 04 ff ff ff ff 01 32 04 7f ff ff ff 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 52 55 4c 45 53 5f 54 41 42 4c 45 31 31 01 01 00 00 00 00 00 00 01 01 00 00 00 00 00

-Piggyback:00 bf 00 00 06 00 00 00 00 00 11 9a 00 01 01 0d 01 01 01 01 01 01 43 4c 49 45 4e 54 43 4f 4e 54 45 58 54 01 07 07 6e 75 6d 52 6f 77 73 01 01 01 31 01 01 11 9a 00 01 01 0d 01 01 01 01 01 01 43 4c 49 45 4e 54 43 4f 4e 54 45 58 54 01 0c 0c 74 6f 44 65 6e 79 41 63 63 65 73 73 01 01 01 31 01 01 11 69 00 01 01 01 01 02 03 5e 00 02 80 21 00 01 01 1b 01 01 0d 00 00 04 ff ff ff ff 01 32 04 7f ff ff ff 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 52 55 4c 45 53 5f 54 41 42 4c 45 31 31(RULES_TABLE11) 01 01 00 00 00 00 00 00 01 01 00 00 00 00 00

680x 104 . piggyback 87 , 0xbf 191 .

11 9a- KEYVAL00 - sequence number01 - ptr01 - length of namespace length0d - length of namespace ("CLIENTCONTEXT".len()=13=0x0d)01 - ptr01 - length of Number of values01 - Number of values01 - length of Flags 01 - Flags01- PTR43 C 4c L 49 I 45 E 4e N 54 T 43 C 4f O 4e N 54 T 45 E 58 X 54 T 01 - length of Name length07 - Name length07 - Name length for the string

11 9a 00 01 01 0d 01 01 01 01 01 01 43 4c 49 45 4e 54 43 4f 4e 54 45 58 54 01 07 07 6e 75 6d 52 6f 77 73 01 01 01 31 01 01 11 9a 00 01 01 0d 01 01 01 01 01 01 43 4c 49 45 4e 54 43 4f 4e 54 45 58 54 01 0c 0c 74 6f 44 65 6e 79 41 63 63 65 73 73 01 01 01 31 01 016e 75 6d 52 6f 77 73 (variable name = numRows)

01 - length of Value length

01 - Value length

01 - Value length for the string

31 = "1" // one row is allowd to be seen

01 flag

Another piggyBack:

01 11 9a 00 01 01 0d 01 01 01 01 01 01 43 4c 49 45 4e 54 43 4f 4e 54 45 58 54 01 0c 0c(12) 74 6f 44 65 6e 79 41 63 63 65 73 73(variable name= "toDenyAccess") 01 01 01 31 01 01 toDenyAccess -numRows . , -Piggyback . , . 1, - , 0, ( ).

Oracle Server . .

SQL Developer . .

XML , .

Java Eclipse . -jar sqljdbc4 ,ojdbc6.

Oracle network protocol documentation (Amichai Shulman)Oracle Database Concepts 11g Release 2 (11.2):chapter 8:8 Server-Side Programming: PL/SQL and Java(excluding Java( chapter 4: 4 Partitions, Views and other Schema objects 1.Overview of Views2.Overview of SynonymsOracle Database Security Guide 11g Release 2 (11.2):chapter 6: Using Application Contexts to Retrieve User Informationchapter 7:Using Oracle Virtual Private Database to Control Data Accesschapter 8: Developing Applications Using the Data Encryption API