From c96a4fd419dcbda06dc55301f8cb8e13f2b2e707 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20Lindstr=C3=B6m?= <jan.lindstrom@mariadb.com>
Date: Thu, 4 Sep 2025 09:24:34 +0300
Subject: [PATCH] MDEV-37548 : wsrep_allowlist allows all connections during
 SST

MDEV-37136 allowed connections by default if wsrep_schema is
not initialized, but this allows and process to connect to a
node which is joining to the cluster and receiving SST (i.e.
all incoming connections are allowed until the storage engines
get initialized). We need to allow all connections by default
to maintain upgradability if nothing else is configured.

However, if user has given wsrep_allowlist string or stored
allowed connections to mysql.wsrep_allowlist table used
address should be checked.

When node is joining to the cluster and receiving SST InnoDB
storage engine is not initialized, thus mysq.wsrep_allowlist
table is not available and wsrep_schema is not intialized.
In this case we still should check has user configured
allowed connections using wsrep_allowlist configuration
variable. If wsrep_allowlist configuration variable contains
list of allowed addressed, we check is address used in
new connection in this list. If it is not connection is not
allowed.
---
 sql/wsrep_allowlist_service.cc | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/sql/wsrep_allowlist_service.cc b/sql/wsrep_allowlist_service.cc
index 866d24e2177..ce8d72ba819 100644
--- a/sql/wsrep_allowlist_service.cc
+++ b/sql/wsrep_allowlist_service.cc
@@ -36,12 +36,31 @@ bool Wsrep_allowlist_service::allowlist_cb (
   const wsrep::const_buffer& value)
   WSREP_NOEXCEPT
 {
-  bool res=true; // allow all connections
+  // Allow all connections if user has not given list of
+  // allowed addresses or stored them on mysql.wsrep_allowlist
+  // table. Note that table is available after SEs are initialized.
+  bool res=true; 
+  std::string string_value(value.data());
   if (wsrep_schema)
   {
-    std::string string_value(value.data());
     res= wsrep_schema->allowlist_check(key, string_value);
   }
+  // If wsrep_schema is not initialized check if user has given
+  // list of addresses where connections are allowed
+  else if (wsrep_allowlist && wsrep_allowlist[0] != '\0')
+  {
+    res= false; // Allow only given addresses
+    std::vector<std::string> allowlist;
+    wsrep_split_allowlist(allowlist);
+    for(auto allowed : allowlist)
+    {
+      if (!string_value.compare(allowed))
+      {
+        res= true; // Address found allow connection
+        break;
+      }
+    }
+  }
   return res;
 }