Skip to content

Commit 25427da

Browse files
CRZbulabulaCRZbulabula
authored
Insert SQL authentication audit logs for table model (#16450)
1 parent 205e373 commit 25427da

File tree

98 files changed

+1794
-452
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

98 files changed

+1794
-452
lines changed

‎iotdb-client/cli/src/main/java/org/apache/iotdb/tool/tsfile/ImportTsFile.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -402,7 +402,9 @@ private static void processSetParams() {
402402
// ImportTsFileRemotely
403403
ImportTsFileRemotely.setHost(host);
404404
ImportTsFileRemotely.setPort(port);
405+
// TODO: Figure out how to fetch userId here
405406
ImportTsFileRemotely.setUsername(username);
407+
ImportTsFileRemotely.setCliHostname(host);
406408
ImportTsFileRemotely.setPassword(password);
407409
ImportTsFileRemotely.setValidateTsFile(verify);
408410

‎iotdb-client/cli/src/main/java/org/apache/iotdb/tool/tsfile/ImportTsFileRemotely.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,9 @@ public class ImportTsFileRemotely extends ImportTsFileBase {
6868
private static String host;
6969
private static String port;
7070

71+
private static String userId = "-1";
7172
private static String username = SessionConfig.DEFAULT_USER;
73+
private static String cliHostname = "";
7274
private static String password = SessionConfig.DEFAULT_PASSWORD;
7375
private static boolean validateTsFile;
7476

@@ -184,7 +186,9 @@ private Map<String, String> constructParamsMap() {
184186
PipeTransferHandshakeConstant.HANDSHAKE_KEY_CONVERT_ON_TYPE_MISMATCH,
185187
Boolean.toString(true));
186188
params.put(PipeTransferHandshakeConstant.HANDSHAKE_KEY_LOAD_TSFILE_STRATEGY, LOAD_STRATEGY);
189+
params.put(PipeTransferHandshakeConstant.HANDSHAKE_KEY_USER_ID, userId);
187190
params.put(PipeTransferHandshakeConstant.HANDSHAKE_KEY_USERNAME, username);
191+
params.put(PipeTransferHandshakeConstant.HANDSHAKE_KEY_CLI_HOSTNAME, cliHostname);
188192
params.put(PipeTransferHandshakeConstant.HANDSHAKE_KEY_PASSWORD, password);
189193
params.put(
190194
PipeTransferHandshakeConstant.HANDSHAKE_KEY_VALIDATE_TSFILE,
@@ -339,10 +343,18 @@ public static void setPort(final String port) {
339343
ImportTsFileRemotely.port = port;
340344
}
341345

346+
public static void setUserId(String userId) {
347+
ImportTsFileRemotely.userId = userId;
348+
}
349+
342350
public static void setUsername(final String username) {
343351
ImportTsFileRemotely.username = username;
344352
}
345353

354+
public static void setCliHostname(String cliHostname) {
355+
ImportTsFileRemotely.cliHostname = cliHostname;
356+
}
357+
346358
public static void setPassword(final String password) {
347359
ImportTsFileRemotely.password = password;
348360
}

‎iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/audit/CNAuditLogger.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ public CNAuditLogger(ConfigManager configManager) {
4949
}
5050

5151
public void log(AuditLogFields auditLogFields, String log) {
52+
if (!IS_AUDIT_LOG_ENABLED) {
53+
return;
54+
}
5255
if (!checkBeforeLog(auditLogFields)) {
5356
return;
5457
}

‎iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/event/PipeConfigRegionSnapshotEvent.java‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ public PipeConfigRegionSnapshotEvent() {
110110

111111
public PipeConfigRegionSnapshotEvent(
112112
final String snapshotPath, final String templateFilePath, final CNSnapshotFileType type) {
113-
this(snapshotPath, templateFilePath, type, null, 0, null, null, null, null, true);
113+
this(snapshotPath, templateFilePath, type, null, 0, null, null, null, null, null, null, true);
114114
}
115115

116116
public PipeConfigRegionSnapshotEvent(
@@ -122,15 +122,19 @@ public PipeConfigRegionSnapshotEvent(
122122
final PipeTaskMeta pipeTaskMeta,
123123
final TreePattern treePattern,
124124
final TablePattern tablePattern,
125+
final String userId,
125126
final String userName,
127+
final String cliHostname,
126128
final boolean skipIfNoPrivileges) {
127129
super(
128130
pipeName,
129131
creationTime,
130132
pipeTaskMeta,
131133
treePattern,
132134
tablePattern,
135+
userId,
133136
userName,
137+
cliHostname,
134138
skipIfNoPrivileges,
135139
PipeConfigNodeResourceManager.snapshot());
136140
this.snapshotPath = snapshotPath;
@@ -201,7 +205,9 @@ public EnrichedEvent shallowCopySelfAndBindPipeTaskMetaForProgressReport(
201205
final PipeTaskMeta pipeTaskMeta,
202206
final TreePattern treePattern,
203207
final TablePattern tablePattern,
208+
final String userId,
204209
final String userName,
210+
final String cliHostname,
205211
final boolean skipIfNoPrivileges,
206212
final long startTime,
207213
final long endTime) {
@@ -215,7 +221,9 @@ public EnrichedEvent shallowCopySelfAndBindPipeTaskMetaForProgressReport(
215221
pipeTaskMeta,
216222
treePattern,
217223
tablePattern,
224+
userId,
218225
userName,
226+
cliHostname,
219227
skipIfNoPrivileges);
220228
pipeConfigRegionSnapshotEvent.setAuthUserName(authUserName);
221229
return pipeConfigRegionSnapshotEvent;

‎iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/event/PipeConfigRegionWritePlanEvent.java‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ public PipeConfigRegionWritePlanEvent() {
4242

4343
public PipeConfigRegionWritePlanEvent(
4444
final ConfigPhysicalPlan configPhysicalPlan, final boolean isGeneratedByPipe) {
45-
this(configPhysicalPlan, null, 0, null, null, null, null, true, isGeneratedByPipe);
45+
this(configPhysicalPlan, null, 0, null, null, null, null, null, null, true, isGeneratedByPipe);
4646
}
4747

4848
public PipeConfigRegionWritePlanEvent(
@@ -52,7 +52,9 @@ public PipeConfigRegionWritePlanEvent(
5252
final PipeTaskMeta pipeTaskMeta,
5353
final TreePattern treePattern,
5454
final TablePattern tablePattern,
55+
final String userId,
5556
final String userName,
57+
final String cliHostname,
5658
final boolean skipIfNoPrivileges,
5759
final boolean isGeneratedByPipe) {
5860
super(
@@ -61,7 +63,9 @@ public PipeConfigRegionWritePlanEvent(
6163
pipeTaskMeta,
6264
treePattern,
6365
tablePattern,
66+
userId,
6467
userName,
68+
cliHostname,
6569
skipIfNoPrivileges,
6670
isGeneratedByPipe);
6771
this.configPhysicalPlan = configPhysicalPlan;
@@ -78,7 +82,9 @@ public EnrichedEvent shallowCopySelfAndBindPipeTaskMetaForProgressReport(
7882
final PipeTaskMeta pipeTaskMeta,
7983
final TreePattern treePattern,
8084
final TablePattern tablePattern,
85+
final String userId,
8186
final String userName,
87+
final String cliHostname,
8288
final boolean skipIfNoPrivileges,
8389
final long startTime,
8490
final long endTime) {
@@ -89,7 +95,9 @@ public EnrichedEvent shallowCopySelfAndBindPipeTaskMetaForProgressReport(
8995
pipeTaskMeta,
9096
treePattern,
9197
tablePattern,
98+
userId,
9299
userName,
100+
cliHostname,
93101
skipIfNoPrivileges,
94102
false);
95103
}

‎iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/sink/client/IoTDBConfigNodeSyncClientManager.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
package org.apache.iotdb.confignode.manager.pipe.sink.client;
2121

2222
import org.apache.iotdb.common.rpc.thrift.TEndPoint;
23+
import org.apache.iotdb.commons.audit.UserEntity;
2324
import org.apache.iotdb.commons.conf.CommonDescriptor;
2425
import org.apache.iotdb.commons.pipe.sink.client.IoTDBSyncClientManager;
2526
import org.apache.iotdb.commons.pipe.sink.payload.thrift.request.PipeTransferHandshakeV2Req;
@@ -41,7 +42,7 @@ public IoTDBConfigNodeSyncClientManager(
4142
/* The following parameters are used locally. */
4243
String loadBalanceStrategy,
4344
/* The following parameters are used to handshake with the receiver. */
44-
String username,
45+
UserEntity userEntity,
4546
String password,
4647
boolean shouldReceiverConvertOnTypeMismatch,
4748
String loadTsFileStrategy,
@@ -54,7 +55,7 @@ public IoTDBConfigNodeSyncClientManager(
5455
trustStorePwd,
5556
false,
5657
loadBalanceStrategy,
57-
username,
58+
userEntity,
5859
password,
5960
shouldReceiverConvertOnTypeMismatch,
6061
loadTsFileStrategy,

‎iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/sink/protocol/IoTDBConfigRegionAirGapSink.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,9 @@ protected byte[] generateHandShakeV2Payload() throws IOException {
7676
Boolean.toString(shouldReceiverConvertOnTypeMismatch));
7777
params.put(
7878
PipeTransferHandshakeConstant.HANDSHAKE_KEY_LOAD_TSFILE_STRATEGY, loadTsFileStrategy);
79+
params.put(PipeTransferHandshakeConstant.HANDSHAKE_KEY_USER_ID, userId);
7980
params.put(PipeTransferHandshakeConstant.HANDSHAKE_KEY_USERNAME, username);
81+
params.put(PipeTransferHandshakeConstant.HANDSHAKE_KEY_CLI_HOSTNAME, cliHostname);
8082
params.put(PipeTransferHandshakeConstant.HANDSHAKE_KEY_PASSWORD, password);
8183
params.put(
8284
PipeTransferHandshakeConstant.HANDSHAKE_KEY_VALIDATE_TSFILE,

‎iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/sink/protocol/IoTDBConfigRegionSink.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121

2222
import org.apache.iotdb.common.rpc.thrift.TEndPoint;
2323
import org.apache.iotdb.common.rpc.thrift.TSStatus;
24+
import org.apache.iotdb.commons.audit.UserEntity;
2425
import org.apache.iotdb.commons.pipe.sink.client.IoTDBSyncClient;
2526
import org.apache.iotdb.commons.pipe.sink.client.IoTDBSyncClientManager;
2627
import org.apache.iotdb.commons.pipe.sink.payload.thrift.request.PipeTransferFilePieceReq;
@@ -70,7 +71,7 @@ protected IoTDBSyncClientManager constructClient(
7071
final boolean useLeaderCache,
7172
final String loadBalanceStrategy,
7273
/* The following parameters are used to handshake with the receiver. */
73-
final String username,
74+
final UserEntity userEntity,
7475
final String password,
7576
final boolean shouldReceiverConvertOnTypeMismatch,
7677
final String loadTsFileStrategy,
@@ -82,7 +83,7 @@ protected IoTDBSyncClientManager constructClient(
8283
Objects.nonNull(trustStorePath) ? ConfigNodeConfig.addHomeDir(trustStorePath) : null,
8384
trustStorePwd,
8485
loadBalanceStrategy,
85-
username,
86+
userEntity,
8687
password,
8788
shouldReceiverConvertOnTypeMismatch,
8889
loadTsFileStrategy,

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/audit/AuditLogger.java‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
package org.apache.iotdb.db.audit;
2121

2222
import org.apache.iotdb.commons.audit.AuditLogOperation;
23+
import org.apache.iotdb.commons.audit.UserEntity;
2324
import org.apache.iotdb.commons.conf.IoTDBConstant;
2425
import org.apache.iotdb.commons.exception.IllegalPathException;
2526
import org.apache.iotdb.commons.utils.CommonDateTimeUtils;
@@ -65,7 +66,13 @@ public class AuditLogger {
6566
private static final IoTDBConfig config = IoTDBDescriptor.getInstance().getConfig();
6667
private static final List<AuditLogStorage> auditLogStorageList = config.getAuditLogStorage();
6768
private static final SessionInfo sessionInfo =
68-
new SessionInfo(0, AuthorityChecker.SUPER_USER, ZoneId.systemDefault());
69+
new SessionInfo(
70+
0,
71+
new UserEntity(
72+
AuthorityChecker.SUPER_USER_ID,
73+
AuthorityChecker.SUPER_USER,
74+
IoTDBDescriptor.getInstance().getConfig().getInternalAddress()),
75+
ZoneId.systemDefault());
6976

7077
private static final List<AuditLogOperation> auditLogOperationList =
7178
config.getAuditableOperationType();

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/audit/DNAuditLogger.java‎

Lines changed: 26 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import org.apache.iotdb.commons.audit.AuditLogFields;
2626
import org.apache.iotdb.commons.audit.AuditLogOperation;
2727
import org.apache.iotdb.commons.audit.PrivilegeLevel;
28+
import org.apache.iotdb.commons.audit.UserEntity;
2829
import org.apache.iotdb.commons.auth.entity.PrivilegeType;
2930
import org.apache.iotdb.commons.client.IClientManager;
3031
import org.apache.iotdb.commons.client.exception.ClientManagerException;
@@ -95,9 +96,14 @@ public class DNAuditLogger extends AbstractAuditLogger {
9596
private static final String AUDIT_LOG_DEVICE = "root.__audit.log.node_%s.u_%s";
9697
private static final String AUDIT_LOGIN_LOG_DEVICE = "root.__audit.login.node_%s.u_%s";
9798
private static final String AUDIT_CN_LOG_DEVICE = "root.__audit.log.node_%s.u_all";
98-
private static final Coordinator COORDINATOR = Coordinator.getInstance();
9999
private static final SessionInfo sessionInfo =
100-
new SessionInfo(0, AuthorityChecker.SUPER_USER, ZoneId.systemDefault());
100+
new SessionInfo(
101+
0,
102+
new UserEntity(
103+
AuthorityChecker.INTERNAL_AUDIT_USER_ID,
104+
AuthorityChecker.INTERNAL_AUDIT_USER,
105+
IoTDBDescriptor.getInstance().getConfig().getInternalAddress()),
106+
ZoneId.systemDefault());
101107

102108
private static final SessionManager SESSION_MANAGER = SessionManager.getInstance();
103109

@@ -106,7 +112,9 @@ public class DNAuditLogger extends AbstractAuditLogger {
106112

107113
private static final DataNodeDevicePathCache DEVICE_PATH_CACHE =
108114
DataNodeDevicePathCache.getInstance();
109-
private static AtomicBoolean tableViewIsInitialized = new AtomicBoolean(false);
115+
private static final AtomicBoolean tableViewIsInitialized = new AtomicBoolean(false);
116+
117+
private Coordinator coordinator;
110118

111119
private DNAuditLogger() {
112120
// Empty constructor
@@ -116,6 +124,10 @@ public static DNAuditLogger getInstance() {
116124
return DNAuditLoggerHolder.INSTANCE;
117125
}
118126

127+
public void setCoordinator(Coordinator coordinator) {
128+
DNAuditLoggerHolder.INSTANCE.coordinator = coordinator;
129+
}
130+
119131
@NotNull
120132
private static InsertRowStatement generateInsertStatement(
121133
AuditLogFields auditLogFields, String log, PartialPath log_device) {
@@ -217,7 +229,7 @@ public void createViewIfNecessary() {
217229
+ " WITH SCHEMA_REGION_GROUP_NUM=1, DATA_REGION_GROUP_NUM=1",
218230
ZoneId.systemDefault());
219231
ExecutionResult result =
220-
COORDINATOR.executeForTreeModel(
232+
coordinator.executeForTreeModel(
221233
statement,
222234
SESSION_MANAGER.requestQueryId(),
223235
sessionInfo,
@@ -232,7 +244,7 @@ public void createViewIfNecessary() {
232244
new InternalClientSession(
233245
String.format(
234246
"%s_%s", DNAuditLogger.class.getSimpleName(), SystemConstant.AUDIT_DATABASE));
235-
session.setUsername(AuthorityChecker.SUPER_USER);
247+
session.setUsername(AuthorityChecker.INTERNAL_AUDIT_USER);
236248
session.setZoneId(ZoneId.systemDefault());
237249
session.setClientVersion(IoTDBConstant.ClientVersion.V_1_0);
238250
session.setDatabaseName(SystemConstant.AUDIT_DATABASE);
@@ -246,7 +258,7 @@ public void createViewIfNecessary() {
246258
ZoneId.systemDefault(),
247259
session);
248260
TSStatus status =
249-
COORDINATOR.executeForTableModel(
261+
coordinator.executeForTableModel(
250262
stmt,
251263
relationSqlParser,
252264
session,
@@ -280,7 +292,7 @@ public void createViewIfNecessary() {
280292
ZoneId.systemDefault(),
281293
session);
282294
status =
283-
COORDINATOR.executeForTableModel(
295+
coordinator.executeForTableModel(
284296
stmt,
285297
relationSqlParser,
286298
session,
@@ -307,11 +319,14 @@ public void createViewIfNecessary() {
307319
}
308320

309321
public void log(AuditLogFields auditLogFields, String log) {
322+
if (!IS_AUDIT_LOG_ENABLED) {
323+
return;
324+
}
310325
createViewIfNecessary();
311326
if (!checkBeforeLog(auditLogFields)) {
312327
return;
313328
}
314-
int userId = auditLogFields.getUserId();
329+
long userId = auditLogFields.getUserId();
315330
String user = String.valueOf(userId);
316331
if (userId == -1) {
317332
user = "none";
@@ -328,7 +343,7 @@ public void log(AuditLogFields auditLogFields, String log) {
328343
logger.error("Failed to log audit events because ", e);
329344
return;
330345
}
331-
COORDINATOR.executeForTreeModel(
346+
coordinator.executeForTreeModel(
332347
statement,
333348
SESSION_MANAGER.requestQueryId(),
334349
sessionInfo,
@@ -345,7 +360,7 @@ public void log(AuditLogFields auditLogFields, String log) {
345360
logger.error("Failed to log audit login events because ", e);
346361
return;
347362
}
348-
COORDINATOR.executeForTreeModel(
363+
coordinator.executeForTreeModel(
349364
statement,
350365
SESSION_MANAGER.requestQueryId(),
351366
sessionInfo,
@@ -366,7 +381,7 @@ public void logFromCN(AuditLogFields auditLogFields, String log, int nodeId)
366381
auditLogFields,
367382
log,
368383
DEVICE_PATH_CACHE.getPartialPath(String.format(AUDIT_CN_LOG_DEVICE, nodeId)));
369-
COORDINATOR.executeForTreeModel(
384+
coordinator.executeForTreeModel(
370385
statement,
371386
SESSION_MANAGER.requestQueryId(),
372387
sessionInfo,

0 commit comments

Comments
 (0)