This is an automated email from the ASF dual-hosted git repository.
abhay pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new 30d253a RANGER-3178: Fix spurious full policy/tag downloads when
incremental policy/tag updates are enabled
30d253a is described below
commit 30d253ad777b6df9bfdeef1f61f14ecdf6977918
Author: Abhay Kulkarni <[email protected]>
AuthorDate: Fri Feb 12 19:44:22 2021 -0800
RANGER-3178: Fix spurious full policy/tag downloads when incremental
policy/tag updates are enabled
---
.../ranger/plugin/util/RangerPolicyDeltaUtil.java | 76 +++++++++++++---------
.../java/org/apache/ranger/biz/ServiceDBStore.java | 3 +
.../main/resources/META-INF/jpa_named_queries.xml | 2 +-
3 files changed, 51 insertions(+), 30 deletions(-)
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerPolicyDeltaUtil.java
b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerPolicyDeltaUtil.java
index 62b60a1..4661f79 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerPolicyDeltaUtil.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerPolicyDeltaUtil.java
@@ -51,54 +51,72 @@ public class RangerPolicyDeltaUtil {
perf = RangerPerfTracer.getPerfTracer(PERF_POLICY_DELTA_LOG,
"RangerPolicyDelta.applyDeltas()");
}
+ boolean hasExpectedServiceType = false;
+
if (CollectionUtils.isNotEmpty(deltas)) {
if (LOG.isDebugEnabled()) {
- LOG.debug("applyDeltas(deltas=" +
Arrays.toString(deltas.toArray()) + ", serviceType=" + serviceType +")");
+ LOG.debug("applyDeltas(deltas=" +
Arrays.toString(deltas.toArray()) + ", serviceType=" + serviceType + ")");
}
- ret = new ArrayList<>(policies);
for (RangerPolicyDelta delta : deltas) {
- int changeType = delta.getChangeType();
- if (!serviceType.equals(delta.getServiceType())) {
- if
(!serviceType.equals(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME) &&
!delta.getServiceType().equals(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME))
{
- LOG.error("Found unexpected serviceType in
policyDelta:[" + delta + "]. Was expecting serviceType:[" + serviceType + "].
Should NOT have come here!! Ignoring delta and continuing");
- }
- continue;
+ if (serviceType.equals(delta.getServiceType())) {
+ hasExpectedServiceType = true;
+ break;
+ } else if
(!serviceType.equals(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME) &&
!delta.getServiceType().equals(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME))
{
+ LOG.warn("Found unexpected serviceType in policyDelta:[" +
delta + "]. Was expecting serviceType:[" + serviceType + "]. Should NOT have
come here!! Ignoring delta and continuing");
}
- if (changeType == RangerPolicyDelta.CHANGE_TYPE_POLICY_CREATE
|| changeType == RangerPolicyDelta.CHANGE_TYPE_POLICY_UPDATE || changeType ==
RangerPolicyDelta.CHANGE_TYPE_POLICY_DELETE) {
- if (changeType ==
RangerPolicyDelta.CHANGE_TYPE_POLICY_CREATE) {
- if (delta.getPolicy() != null) {
- ret.add(delta.getPolicy());
- }
- } else {
- // Either UPDATE or DELETE
- Long policyId = delta.getPolicyId();
-
- Iterator<RangerPolicy> iter = ret.iterator();
- while (iter.hasNext()) {
- if (policyId.equals(iter.next().getId())) {
- iter.remove();
- break;
- }
- }
- if (changeType ==
RangerPolicyDelta.CHANGE_TYPE_POLICY_UPDATE) {
+ }
+
+ if (hasExpectedServiceType) {
+ ret = new ArrayList<>(policies);
+
+ for (RangerPolicyDelta delta : deltas) {
+ if (!serviceType.equals(delta.getServiceType())) {
+ continue;
+ }
+
+ int changeType = delta.getChangeType();
+
+ if (changeType ==
RangerPolicyDelta.CHANGE_TYPE_POLICY_CREATE || changeType ==
RangerPolicyDelta.CHANGE_TYPE_POLICY_UPDATE || changeType ==
RangerPolicyDelta.CHANGE_TYPE_POLICY_DELETE) {
+ if (changeType ==
RangerPolicyDelta.CHANGE_TYPE_POLICY_CREATE) {
if (delta.getPolicy() != null) {
ret.add(delta.getPolicy());
}
+ } else {
+ // Either UPDATE or DELETE
+ Long policyId = delta.getPolicyId();
+
+ Iterator<RangerPolicy> iter = ret.iterator();
+ while (iter.hasNext()) {
+ if (policyId.equals(iter.next().getId())) {
+ iter.remove();
+ break;
+ }
+ }
+ if (changeType ==
RangerPolicyDelta.CHANGE_TYPE_POLICY_UPDATE) {
+ if (delta.getPolicy() != null) {
+ ret.add(delta.getPolicy());
+ }
+ }
}
+ } else {
+ LOG.warn("Found unexpected changeType in
policyDelta:[" + delta + "]. Ignoring delta");
}
- } else {
- LOG.warn("Found unexpected changeType in policyDelta:[" +
delta +"]. Ignoring delta");
}
+ } else {
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("applyDeltas - none of the deltas is for " +
serviceType + ")");
+ }
+ ret = policies;
}
} else {
if (LOG.isDebugEnabled()) {
- LOG.debug("applyDeltas(deltas=null, serviceType=" +
serviceType +")");
+ LOG.debug("applyDeltas(deltas=null, serviceType=" +
serviceType + ")");
}
ret = policies;
}
- if (CollectionUtils.isNotEmpty(deltas) &&
CollectionUtils.isNotEmpty(ret)) {
+ if (CollectionUtils.isNotEmpty(deltas) && hasExpectedServiceType &&
CollectionUtils.isNotEmpty(ret)) {
ret.sort(RangerPolicy.POLICY_ID_COMPARATOR);
}
diff --git
a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
index 93ee077..41980d2 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
@@ -3124,6 +3124,9 @@ public class ServiceDBStore extends AbstractServiceStore {
if (isValid) {
if
(CollectionUtils.isNotEmpty(tagPolicyDeltas)) {
+ // To ensure that
resource-policy-deltas with service-type of 'tag' are ignored after validation
+
resourcePolicyDeltas.removeIf(rangerPolicyDelta ->
StringUtils.equals(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME,
rangerPolicyDelta.getServiceType()));
+
resourcePolicyDeltas.addAll(tagPolicyDeltas);
}
List<RangerPolicyDelta>
compressedDeltas = compressDeltas(resourcePolicyDeltas);
diff --git a/security-admin/src/main/resources/META-INF/jpa_named_queries.xml
b/security-admin/src/main/resources/META-INF/jpa_named_queries.xml
index d026dec..1381454 100755
--- a/security-admin/src/main/resources/META-INF/jpa_named_queries.xml
+++ b/security-admin/src/main/resources/META-INF/jpa_named_queries.xml
@@ -1555,7 +1555,7 @@
<named-query name="XXPolicyChangeLog.findSinceVersion">
<query>
select obj.id, obj.changeType, obj.policyVersion, obj.serviceType,
obj.policyType, obj.policyId, obj.zoneName from
- XXPolicyChangeLog obj where obj.serviceId = :serviceId and
obj.serviceType != 'tag' and obj.policyVersion >= :version order by
+ XXPolicyChangeLog obj where obj.serviceId = :serviceId and
obj.policyVersion >= :version order by
obj.policyVersion
</query>
</named-query>
