This is an automated email from the ASF dual-hosted git repository.
jiangtian pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/iotdb.git
The following commit(s) were added to refs/heads/master by this push:
new fa888b2a3e4 forbid changing encrypt key again (#15509)
fa888b2a3e4 is described below
commit fa888b2a3e4b69173203f02d395b13db19ca78bc
Author: jintao zhu <[email protected]>
AuthorDate: Tue May 20 09:38:06 2025 +0800
forbid changing encrypt key again (#15509)
* forbid changing encrypt key again
* code review and forbid changing encrypt key totally
---
.../org/apache/iotdb/db/conf/IoTDBStartCheck.java | 34 ++++++++++++++++++++++
.../java/org/apache/iotdb/db/service/DataNode.java | 8 +++++
2 files changed, 42 insertions(+)
diff --git
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/conf/IoTDBStartCheck.java
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/conf/IoTDBStartCheck.java
index c0ba3fca366..4775c4a9402 100644
---
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/conf/IoTDBStartCheck.java
+++
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/conf/IoTDBStartCheck.java
@@ -29,7 +29,10 @@ import org.apache.iotdb.consensus.ConsensusFactory;
import org.apache.iotdb.db.storageengine.dataregion.wal.utils.WALMode;
import org.apache.iotdb.db.storageengine.rescon.disk.DirectoryChecker;
+import com.google.common.base.Objects;
import org.apache.commons.io.FileUtils;
+import org.apache.tsfile.common.conf.TSFileConfig;
+import org.apache.tsfile.encrypt.EncryptUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -73,6 +76,10 @@ public class IoTDBStartCheck {
private static final String MPP_DATA_EXCHANGE_PORT =
"dn_mpp_data_exchange_port";
private static final String SCHEMA_REGION_CONSENSUS_PORT =
"dn_schema_region_consensus_port";
private static final String DATA_REGION_CONSENSUS_PORT =
"dn_data_region_consensus_port";
+ private static final String ENCRYPT_MAGIC_STRING = "encrypt_magic_string";
+
+ private static final String magicString = "thisisusedfortsfileencrypt";
+
// Mutable system parameters
private static final Map<String, Supplier<String>> variableParamValueTable =
new HashMap<>();
@@ -300,6 +307,16 @@ public class IoTDBStartCheck {
systemPropertiesHandler.put(CLUSTER_ID, clusterId);
}
+ public void serializeEncryptMagicString() throws IOException {
+ String encryptMagicString =
+ EncryptUtils.byteArrayToHexString(
+ EncryptUtils.getEncrypt()
+ .getEncryptor()
+ .encrypt(magicString.getBytes(TSFileConfig.STRING_CHARSET)));
+ systemProperties.put(ENCRYPT_MAGIC_STRING, () -> encryptMagicString);
+ generateOrOverwriteSystemPropertiesFile();
+ }
+
public boolean checkConsensusProtocolExists(TConsensusGroupType type) {
if (type == TConsensusGroupType.DataRegion) {
return properties.containsKey(DATA_REGION_CONSENSUS_PROTOCOL);
@@ -333,4 +350,21 @@ public class IoTDBStartCheck {
systemProperties.forEach((k, v) -> properties.setProperty(k, v.get()));
systemPropertiesHandler.overwrite(properties);
}
+
+ public void checkEncryptMagicString() throws IOException,
ConfigurationException {
+ properties = systemPropertiesHandler.read();
+ String encryptMagicString = properties.getProperty("encrypt_magic_string");
+ if (encryptMagicString != null) {
+ byte[] magicBytes =
EncryptUtils.hexStringToByteArray(encryptMagicString);
+ String newMagicString =
+ new String(
+ EncryptUtils.getEncrypt().getDecryptor().decrypt(magicBytes),
+ TSFileConfig.STRING_CHARSET);
+ if (!Objects.equal(magicString, newMagicString)) {
+ logger.error("encrypt_magic_string is not matched");
+ throw new ConfigurationException(
+ "Changing encrypt key for tsfile encryption after first start is
not permitted");
+ }
+ }
+ }
}
diff --git
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/service/DataNode.java
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/service/DataNode.java
index 80a1a305ec3..b15c3590beb 100644
---
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/service/DataNode.java
+++
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/service/DataNode.java
@@ -220,13 +220,21 @@ public class DataNode extends ServerCommandLine
implements DataNodeMBean {
// Pull and check system configurations from ConfigNode-leader
pullAndCheckSystemConfigurations();
+
if (isFirstStart) {
sendRegisterRequestToConfigNode(true);
IoTDBStartCheck.getInstance().generateOrOverwriteSystemPropertiesFile();
+ IoTDBStartCheck.getInstance().serializeEncryptMagicString();
ConfigNodeInfo.getInstance().storeConfigNodeList();
// Register this DataNode to the cluster when first start
sendRegisterRequestToConfigNode(false);
} else {
+ /* Check encrypt magic string */
+ try {
+ IoTDBStartCheck.getInstance().checkEncryptMagicString();
+ } catch (Exception e) {
+ throw new StartupException(e.getMessage());
+ }
// Send restart request of this DataNode
sendRestartRequestToConfigNode();
}
