Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

enh(s3/grant): disable s3 with expired grant #25705

Merged
merged 4 commits into from
May 15, 2024
Merged

enh(s3/grant): disable s3 with expired grant #25705

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
912d33a
enh: grant support s3/active-active/dual-replica/db_encryption
kailixu May 9, 2024
fa6ff93
enh: grant check for dual-replica-ha
LiShunGang May 9, 2024
2f4d98a
enh(s3/grant): disable s3 with expired grant
stephenkgu May 9, 2024
818d96b
test: test case for show grants full
kailixu May 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 4 additions & 0 deletions include/common/tgrant.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,10 @@ typedef enum {
TSDB_GRANT_VIEW,
TSDB_GRANT_MULTI_TIER,
TSDB_GRANT_BACKUP_RESTORE,
TSDB_GRANT_OBJECT_STORAGE,
TSDB_GRANT_ACTIVE_ACTIVE,
TSDB_GRANT_DUAL_REPLICA_HA,
TSDB_GRANT_DB_ENCRYPTION,
} EGrantType;

int32_t checkAndGetCryptKey(const char *encryptCode, const char *machineId, char **key);
Expand Down
7 changes: 4 additions & 3 deletions source/dnode/mgmt/node_mgmt/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,10 @@ IF (DEFINED GRANT_CFG_INCLUDE_DIR)
add_definitions(-DGRANTS_CFG)
ENDIF()

IF (DEFINED GRANT_CFG_INCLUDE_DIR)
add_definitions(-DGRANTS_CFG)
ENDIF()
IF (TD_GRANT)
ADD_DEFINITIONS(-D_GRANT)
TARGET_LINK_LIBRARIES(dnode grant)
ENDIF ()

target_include_directories(
dnode
Expand Down
8 changes: 8 additions & 0 deletions source/dnode/mgmt/node_mgmt/src/dmEnv.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
#include "dmMgmt.h"
#include "audit.h"
#include "libs/function/tudf.h"
#include "tgrant.h"

#define DM_INIT_AUDIT() \
do { \
Expand Down Expand Up @@ -150,6 +151,7 @@ static bool dmCheckDataDirVersion() {

extern int32_t s3Begin();
extern void s3End();
extern int8_t tsS3Enabled;

#endif

Expand All @@ -164,6 +166,12 @@ int32_t dmInit() {
if (dmInitAudit() != 0) return -1;
if (dmInitDnode(dmInstance()) != 0) return -1;
#if defined(USE_S3)
int32_t expired = grantCheck(TSDB_GRANT_OBJECT_STORAGE);
if (expired && tsS3Enabled) {
dWarn("s3 grant expired: %d", expired);
tsS3Enabled = false;
}

if (s3Begin() != 0) return -1;
#endif

Expand Down
13 changes: 13 additions & 0 deletions source/dnode/mnode/impl/src/mndDb.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -903,6 +903,13 @@ static int32_t mndProcessCreateDbReq(SRpcMsg *pReq) {
goto _OVER;
}

if (createReq.replications == 2) {
if ((terrno = grantCheck(TSDB_GRANT_DUAL_REPLICA_HA)) != 0) {
code = terrno;
goto _OVER;
}
}

if ((code = mndCheckDbEncryptKey(pMnode, &createReq)) != 0) {
terrno = code;
goto _OVER;
Expand Down Expand Up @@ -1163,6 +1170,12 @@ static int32_t mndProcessAlterDbReq(SRpcMsg *pReq) {
goto _OVER;
}

if (alterReq.replications == 2) {
if ((code = grantCheck(TSDB_GRANT_DUAL_REPLICA_HA)) != 0) {
goto _OVER;
}
}

int32_t numOfTopics = 0;
if (mndGetNumOfTopics(pMnode, pDb->name, &numOfTopics) != 0) {
goto _OVER;
Expand Down
25 changes: 16 additions & 9 deletions tests/system-test/0-others/information_schema.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -269,13 +269,17 @@ def ins_dnodes_check(self):

def ins_grants_check(self):
grant_name_dict = {
'stream':'stream',
'subscription':'subscription',
'view':'view',
'audit':'audit',
'csv':'csv',
'storage':'multi_tier_storage',
'backup_restore':'backup_restore',
'stream':'Stream',
'subscription':'Subscription',
'view':'View',
'audit':'Audit',
'csv':'CSV',
'storage':'Multi-Tier Storage',
'backup_restore':'Data Backup & Restore',
'object_storage':'Object Storage',
'active_active':'Active-Active',
'dual_replica':'Dual-Replica HA',
'db_encryption':'Database Encryption',
'opc_da':'OPC_DA',
'opc_ua':'OPC_UA',
'pi':'Pi',
Expand All @@ -285,7 +289,10 @@ def ins_grants_check(self):
'avevahistorian':'avevaHistorian',
'opentsdb':'OpenTSDB',
'td2.6':'TDengine2.6',
'td3.0':'TDengine3.0'
'td3.0':'TDengine3.0',
'mysql':'MySQL',
'postgres':'PostgreSQL',
'oracle':'Oracle',
}

tdSql.execute('drop database if exists db2')
Expand All @@ -297,7 +304,7 @@ def ins_grants_check(self):
if result[i][0] in grant_name_dict:
tdSql.checkEqual(result[i][1], grant_name_dict[result[i][0]])
index += 1
tdSql.checkEqual(index, 17)
tdSql.checkEqual(index, 24)
tdSql.query(f'select * from information_schema.ins_grants_logs')
result = tdSql.queryResult
tdSql.checkEqual(True, len(result) >= 0)
Expand Down