Skip to content

Commit d4a45cb

Browse files
CRZbulabulaCRZbulabula
committed
Fix IT
Fix IT
1 parent 5073c41 commit d4a45cb

File tree

17 files changed

+150
-52
lines changed

17 files changed

+150
-52
lines changed

‎iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/audit/CNAuditLogger.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ public CNAuditLogger(ConfigManager configManager) {
4949
}
5050

5151
public void log(AuditLogFields auditLogFields, String log) {
52+
if (!IS_AUDIT_LOG_ENABLED) {
53+
return;
54+
}
5255
if (!checkBeforeLog(auditLogFields)) {
5356
return;
5457
}

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/audit/DNAuditLogger.java‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,6 @@ public class DNAuditLogger extends AbstractAuditLogger {
9696
private static final String AUDIT_LOG_DEVICE = "root.__audit.log.node_%s.u_%s";
9797
private static final String AUDIT_LOGIN_LOG_DEVICE = "root.__audit.login.node_%s.u_%s";
9898
private static final String AUDIT_CN_LOG_DEVICE = "root.__audit.log.node_%s.u_all";
99-
private static final Coordinator COORDINATOR = Coordinator.getInstance();
10099
private static final SessionInfo sessionInfo =
101100
new SessionInfo(
102101
0,
@@ -115,6 +114,8 @@ public class DNAuditLogger extends AbstractAuditLogger {
115114
DataNodeDevicePathCache.getInstance();
116115
private static final AtomicBoolean tableViewIsInitialized = new AtomicBoolean(false);
117116

117+
private Coordinator coordinator;
118+
118119
private DNAuditLogger() {
119120
// Empty constructor
120121
}
@@ -123,6 +124,10 @@ public static DNAuditLogger getInstance() {
123124
return DNAuditLoggerHolder.INSTANCE;
124125
}
125126

127+
public void setCoordinator(Coordinator coordinator) {
128+
DNAuditLoggerHolder.INSTANCE.coordinator = coordinator;
129+
}
130+
126131
@NotNull
127132
private static InsertRowStatement generateInsertStatement(
128133
AuditLogFields auditLogFields, String log, PartialPath log_device) {
@@ -224,7 +229,7 @@ public void createViewIfNecessary() {
224229
+ " WITH SCHEMA_REGION_GROUP_NUM=1, DATA_REGION_GROUP_NUM=1",
225230
ZoneId.systemDefault());
226231
ExecutionResult result =
227-
COORDINATOR.executeForTreeModel(
232+
coordinator.executeForTreeModel(
228233
statement,
229234
SESSION_MANAGER.requestQueryId(),
230235
sessionInfo,
@@ -253,7 +258,7 @@ public void createViewIfNecessary() {
253258
ZoneId.systemDefault(),
254259
session);
255260
TSStatus status =
256-
COORDINATOR.executeForTableModel(
261+
coordinator.executeForTableModel(
257262
stmt,
258263
relationSqlParser,
259264
session,
@@ -287,7 +292,7 @@ public void createViewIfNecessary() {
287292
ZoneId.systemDefault(),
288293
session);
289294
status =
290-
COORDINATOR.executeForTableModel(
295+
coordinator.executeForTableModel(
291296
stmt,
292297
relationSqlParser,
293298
session,
@@ -314,6 +319,9 @@ public void createViewIfNecessary() {
314319
}
315320

316321
public void log(AuditLogFields auditLogFields, String log) {
322+
if (!IS_AUDIT_LOG_ENABLED) {
323+
return;
324+
}
317325
createViewIfNecessary();
318326
if (!checkBeforeLog(auditLogFields)) {
319327
return;
@@ -335,7 +343,7 @@ public void log(AuditLogFields auditLogFields, String log) {
335343
logger.error("Failed to log audit events because ", e);
336344
return;
337345
}
338-
COORDINATOR.executeForTreeModel(
346+
coordinator.executeForTreeModel(
339347
statement,
340348
SESSION_MANAGER.requestQueryId(),
341349
sessionInfo,
@@ -352,7 +360,7 @@ public void log(AuditLogFields auditLogFields, String log) {
352360
logger.error("Failed to log audit login events because ", e);
353361
return;
354362
}
355-
COORDINATOR.executeForTreeModel(
363+
coordinator.executeForTreeModel(
356364
statement,
357365
SESSION_MANAGER.requestQueryId(),
358366
sessionInfo,
@@ -373,7 +381,7 @@ public void logFromCN(AuditLogFields auditLogFields, String log, int nodeId)
373381
auditLogFields,
374382
log,
375383
DEVICE_PATH_CACHE.getPartialPath(String.format(AUDIT_CN_LOG_DEVICE, nodeId)));
376-
COORDINATOR.executeForTreeModel(
384+
coordinator.executeForTreeModel(
377385
statement,
378386
SESSION_MANAGER.requestQueryId(),
379387
sessionInfo,

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
import org.apache.iotdb.commons.auth.AuthException;
2424
import org.apache.iotdb.commons.auth.entity.PrivilegeType;
2525
import org.apache.iotdb.commons.conf.CommonDescriptor;
26+
import org.apache.iotdb.commons.conf.IoTDBConstant;
2627
import org.apache.iotdb.commons.path.PartialPath;
2728
import org.apache.iotdb.commons.path.PathPatternTree;
2829
import org.apache.iotdb.commons.schema.column.ColumnHeader;
@@ -76,8 +77,8 @@ public class AuthorityChecker {
7677

7778
public static final TSStatus SUCCEED = new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());
7879

79-
public static int INTERNAL_AUDIT_USER_ID = -1;
80-
public static String INTERNAL_AUDIT_USER = "__auditor";
80+
public static final int INTERNAL_AUDIT_USER_ID = IoTDBConstant.INTERNAL_AUDIT_USER_ID;
81+
public static final String INTERNAL_AUDIT_USER = IoTDBConstant.INTERNAL_AUDIT_USER;
8182

8283
public static String ANY_SCOPE = "any";
8384

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -649,6 +649,7 @@ private boolean checkRoleFromConfigNode(String username, String rolename) {
649649
/** Cache user. */
650650
public User cacheUser(TPermissionInfoResp tPermissionInfoResp) {
651651
User user = new User();
652+
user.setUserId(tPermissionInfoResp.getUserInfo().getUserId());
652653
List<TPathPrivilege> privilegeList =
653654
tPermissionInfoResp.getUserInfo().getPermissionInfo().getPrivilegeList();
654655
user.setName(tPermissionInfoResp.getUserInfo().getPermissionInfo().getName());

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/pipe/source/dataregion/realtime/PipeRealtimeDataRegionSource.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -281,10 +281,11 @@ public void customize(
281281
}
282282

283283
userId =
284-
Long.parseLong(
285-
parameters.getStringByKeys(
284+
parameters.getLongOrDefault(
285+
Arrays.asList(
286286
PipeSourceConstant.EXTRACTOR_IOTDB_USER_ID,
287-
PipeSourceConstant.SOURCE_IOTDB_USER_ID));
287+
PipeSourceConstant.SOURCE_IOTDB_USER_ID),
288+
-1);
288289

289290
userName =
290291
parameters.getStringByKeys(

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AccessControlImpl.java‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,11 @@ public void checkCanShowOrUseDatabase(
103103
public void checkCanCreateTable(
104104
String userName, QualifiedObjectName tableName, IAuditEntity auditEntity) {
105105
InformationSchemaUtils.checkDBNameInWrite(tableName.getDatabaseName());
106+
if (userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)
107+
&& tableName.getDatabaseName().equals(TABLE_MODEL_AUDIT_DATABASE)) {
108+
// The internal audit user can create new tables in the audit database
109+
return;
110+
}
106111
checkAuditDatabase(tableName.getDatabaseName());
107112
if (hasGlobalPrivilege(userName, PrivilegeType.SYSTEM)) {
108113
return;
@@ -136,6 +141,11 @@ public void checkCanAlterTable(
136141
public void checkCanInsertIntoTable(
137142
String userName, QualifiedObjectName tableName, IAuditEntity auditEntity) {
138143
InformationSchemaUtils.checkDBNameInWrite(tableName.getDatabaseName());
144+
if (userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)
145+
&& tableName.getDatabaseName().equals(TABLE_MODEL_AUDIT_DATABASE)) {
146+
// Only the internal audit user can insert into the audit table
147+
return;
148+
}
139149
checkAuditDatabase(tableName.getDatabaseName());
140150
authChecker.checkTablePrivilege(userName, tableName, TableModelPrivilege.INSERT, auditEntity);
141151
}
@@ -410,7 +420,7 @@ public TSStatus checkFullPathWriteDataPermission(
410420
try {
411421
PartialPath path = new MeasurementPath(device, measurementId);
412422
// audit db is read-only
413-
if (includeByAuditTreeDB(path)) {
423+
if (includeByAuditTreeDB(path) && !userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
414424
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
415425
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
416426
}

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/ITableAuthCheckerImpl.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,11 @@ public void checkDatabasePrivilege(
118118
TableModelPrivilege privilege,
119119
IAuditEntity auditEntity) {
120120
checkAuditDatabase(userName, privilege, databaseName, auditEntity);
121+
if (userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)
122+
&& databaseName.equals(TABLE_MODEL_AUDIT_DATABASE)) {
123+
// The internal auditor has any privilege to the audit database
124+
return;
125+
}
121126

122127
if (AuthorityChecker.SUPER_USER.equals(userName)) {
123128
recordAuditLog(
@@ -153,6 +158,9 @@ private static void checkAuditDatabase(
153158
TableModelPrivilege privilege,
154159
String databaseName,
155160
IAuditEntity auditEntity) {
161+
if (userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
162+
return;
163+
}
156164
if (TABLE_MODEL_AUDIT_DATABASE.equalsIgnoreCase(databaseName)) {
157165
if (privilege == TableModelPrivilege.SELECT) {
158166
checkCanSelectAuditTable(userName, auditEntity);

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckVisitor.java‎

Lines changed: 26 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,8 @@ public TSStatus visitCreateLogicalView(
307307
.concatNode(IoTDBConstant.ONE_LEVEL_PATH_WILDCARD));
308308
for (PartialPath path : paths) {
309309
// audit db is read-only
310-
if (includeByAuditTreeDB(path)) {
310+
if (includeByAuditTreeDB(path)
311+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
311312
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
312313
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
313314
}
@@ -400,7 +401,8 @@ public TSStatus visitAlterLogicalView(
400401
public TSStatus visitRenameLogicalView(
401402
RenameLogicalViewStatement statement, TreeAccessCheckContext context) {
402403
// audit db is read-only
403-
if (includeByAuditTreeDB(statement.getNewName())) {
404+
if (includeByAuditTreeDB(statement.getNewName())
405+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
404406
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
405407
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
406408
}
@@ -774,7 +776,8 @@ public TSStatus visitInsertBase(InsertBaseStatement statement, TreeAccessCheckCo
774776

775777
for (PartialPath path : statement.getDevicePaths()) {
776778
// audit db is read-only
777-
if (includeByAuditTreeDB(path)) {
779+
if (includeByAuditTreeDB(path)
780+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
778781
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
779782
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
780783
}
@@ -792,7 +795,8 @@ public TSStatus visitInsertBase(InsertBaseStatement statement, TreeAccessCheckCo
792795
@Override
793796
public TSStatus visitInsert(InsertStatement statement, TreeAccessCheckContext context) {
794797
// audit db is read-only
795-
if (includeByAuditTreeDB(statement.getDevice())) {
798+
if (includeByAuditTreeDB(statement.getDevice())
799+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
796800
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
797801
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
798802
}
@@ -810,7 +814,8 @@ public TSStatus visitLoadFile(LoadTsFileStatement statement, TreeAccessCheckCont
810814
public TSStatus visitDeleteData(DeleteDataStatement statement, TreeAccessCheckContext context) {
811815
for (PartialPath path : statement.getPaths()) {
812816
// audit db is read-only
813-
if (includeByAuditTreeDB(path)) {
817+
if (includeByAuditTreeDB(path)
818+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
814819
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
815820
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
816821
}
@@ -857,7 +862,8 @@ public static TSStatus checkTimeSeriesPermission(
857862
public TSStatus visitCreateTimeseries(
858863
CreateTimeSeriesStatement statement, TreeAccessCheckContext context) {
859864
// audit db is read-only
860-
if (includeByAuditTreeDB(statement.getPath())) {
865+
if (includeByAuditTreeDB(statement.getPath())
866+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
861867
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
862868
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
863869
}
@@ -869,7 +875,8 @@ public TSStatus visitCreateTimeseries(
869875
public TSStatus visitCreateAlignedTimeseries(
870876
CreateAlignedTimeSeriesStatement statement, TreeAccessCheckContext context) {
871877
// audit db is read-only
872-
if (includeByAuditTreeDB(statement.getDevicePath())) {
878+
if (includeByAuditTreeDB(statement.getDevicePath())
879+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
873880
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
874881
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
875882
}
@@ -882,7 +889,8 @@ public TSStatus visitCreateMultiTimeSeries(
882889
CreateMultiTimeSeriesStatement statement, TreeAccessCheckContext context) {
883890
// audit db is read-only
884891
for (PartialPath path : statement.getPaths()) {
885-
if (includeByAuditTreeDB(path)) {
892+
if (includeByAuditTreeDB(path)
893+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
886894
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
887895
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
888896
}
@@ -897,7 +905,8 @@ public TSStatus visitInternalCreateMultiTimeSeries(
897905
InternalCreateMultiTimeSeriesStatement statement, TreeAccessCheckContext context) {
898906
// audit db is read-only
899907
for (PartialPath path : statement.getDeviceMap().keySet()) {
900-
if (includeByAuditTreeDB(path)) {
908+
if (includeByAuditTreeDB(path)
909+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
901910
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
902911
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
903912
}
@@ -910,7 +919,8 @@ public TSStatus visitInternalCreateMultiTimeSeries(
910919
public TSStatus visitInternalCreateTimeseries(
911920
InternalCreateTimeSeriesStatement statement, TreeAccessCheckContext context) {
912921
// audit db is read-only
913-
if (includeByAuditTreeDB(statement.getDevicePath())) {
922+
if (includeByAuditTreeDB(statement.getDevicePath())
923+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
914924
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
915925
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
916926
}
@@ -1012,7 +1022,8 @@ public TSStatus visitShowChildPaths(
10121022
public TSStatus visitAlterTimeSeries(
10131023
AlterTimeSeriesStatement statement, TreeAccessCheckContext context) {
10141024
// audit db is read-only
1015-
if (includeByAuditTreeDB(statement.getPath())) {
1025+
if (includeByAuditTreeDB(statement.getPath())
1026+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
10161027
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
10171028
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
10181029
}
@@ -1025,7 +1036,8 @@ public TSStatus visitDeleteTimeSeries(
10251036
DeleteTimeSeriesStatement statement, TreeAccessCheckContext context) {
10261037
// audit db is read-only
10271038
for (PartialPath path : statement.getPathPatternList()) {
1028-
if (includeByAuditTreeDB(path)) {
1039+
if (includeByAuditTreeDB(path)
1040+
&& !context.userName.equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
10291041
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
10301042
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
10311043
}
@@ -1387,7 +1399,8 @@ protected boolean checkHasGlobalAuth(String userName, PrivilegeType requiredPriv
13871399
}
13881400

13891401
protected TSStatus checkWriteOnReadOnlyPath(PartialPath path) {
1390-
if (includeByAuditTreeDB(path)) {
1402+
if (includeByAuditTreeDB(path)
1403+
&& !AuthorityChecker.INTERNAL_AUDIT_USER.equals(path.getFullPath())) {
13911404
return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
13921405
.setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));
13931406
}

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/service/DataNode.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@
8686
import org.apache.iotdb.db.qp.sql.SqlLexer;
8787
import org.apache.iotdb.db.queryengine.execution.exchange.MPPDataExchangeService;
8888
import org.apache.iotdb.db.queryengine.execution.schedule.DriverScheduler;
89+
import org.apache.iotdb.db.queryengine.plan.Coordinator;
8990
import org.apache.iotdb.db.queryengine.plan.analyze.cache.schema.DataNodeTTLCache;
9091
import org.apache.iotdb.db.queryengine.plan.parser.ASTVisitor;
9192
import org.apache.iotdb.db.queryengine.plan.parser.StatementGenerator;
@@ -266,8 +267,9 @@ protected void start() {
266267
logger.info("IoTDB configuration: {}", config.getConfigMessage());
267268
logger.info("Congratulations, IoTDB DataNode is set up successfully. Now, enjoy yourself!");
268269

269-
// Start the Audit Service
270+
// Start the Audit Service when necessary
270271
if (CommonDescriptor.getInstance().getConfig().isEnableAuditLog()) {
272+
DNAuditLogger.getInstance().setCoordinator(Coordinator.getInstance());
271273
AuditLogFields fields =
272274
new AuditLogFields(
273275
null,

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/service/DataNodeShutdownHook.java‎

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -95,21 +95,19 @@ private void startWatcher() {
9595
@Override
9696
public void run() {
9797
logger.info("DataNode exiting...");
98-
if (CommonDescriptor.getInstance().getConfig().isEnableAuditLog()) {
99-
AuditLogFields fields =
100-
new AuditLogFields(
101-
null,
102-
-1,
103-
null,
104-
AuditEventType.DN_SHUTDOWN,
105-
AuditLogOperation.CONTROL,
106-
PrivilegeType.SYSTEM,
107-
true,
108-
null,
109-
null);
110-
String logMessage = String.format("DataNode %s exiting...", nodeLocation);
111-
DNAuditLogger.getInstance().log(fields, logMessage);
112-
}
98+
AuditLogFields fields =
99+
new AuditLogFields(
100+
null,
101+
-1,
102+
null,
103+
AuditEventType.DN_SHUTDOWN,
104+
AuditLogOperation.CONTROL,
105+
PrivilegeType.SYSTEM,
106+
true,
107+
null,
108+
null);
109+
String logMessage = String.format("DataNode %s exiting...", nodeLocation);
110+
DNAuditLogger.getInstance().log(fields, logMessage);
113111

114112
startWatcher();
115113
// Stop external rpc service firstly.

0 commit comments

Comments
 (0)