----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/74106/#review224656 -----------------------------------------------------------
Ship it! Ship It! - Madhan Neethiraj On Sept. 8, 2022, 10:08 a.m., Ramachandran Krishnan wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/74106/ > ----------------------------------------------------------- > > (Updated Sept. 8, 2022, 10:08 a.m.) > > > Review request for ranger, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, > Nikhil P, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, Sailaja > Polavarapu, and Velmurugan Periasamy. > > > Bugs: RANGER-3898 > https://issues.apache.org/jira/browse/RANGER-3898 > > > Repository: ranger > > > Description > ------- > > Bug in Ranger Roles Cache > > It seems Apache Ranger open source contains a bug where else block in the > below code will not be called at all > > In the below code else block is a dead code > > > > public RangerRoles getLatestRangerRoleOrCached(String serviceName, > RoleDBStore roleDBStore, Long lastKnownRoleVersion, Long > rangerRoleVersionInDB) throws Exception { > final RangerRoles ret; > > if (lastKnownRoleVersion == null || > !lastKnownRoleVersion.equals(rangerRoleVersionInDB)) { > roleCacheWrapper = new RangerRoleCacheWrapper(); > ret = roleCacheWrapper.getLatestRangerRoles(serviceName, > roleDBStore, lastKnownRoleVersion, rangerRoleVersionInDB); > } else if (lastKnownRoleVersion.equals(rangerRoleVersionInDB)) { > ret = null; > } else { > ret = roleCacheWrapper.getRoles(); > } > > return ret; > } > > > The below behaviour also broken > > when multiple threads are trying to access and one or more threads got > timeout while acquiring the lock,it will fetch the roles from cache but ,we > are not setting the roles in cache anywhere in our code > > public RangerRoles getLatestRangerRoles(String serviceName, RoleDBStore > roleDBStore, Long lastKnownRoleVersion, Long rolesVersionInDB) throws > Exception { > RangerRoles ret = null; > boolean lockResult = false; > > if (LOG.isDebugEnabled()) { > LOG.debug("==> RangerRoleCache.getLatestRangerRoles(ServiceName= " + > serviceName + " lastKnownRoleVersion= " + lastKnownRoleVersion + " > rolesVersionInDB= " + rolesVersionInDB + ")"); > } > > try { > lockResult = lock.tryLock(waitTimeInSeconds, TimeUnit.SECONDS); > > if (lockResult) { > // We are getting all the Roles to be downloaded for now. Should do > downloades for each service based on what roles are there in the policies. > SearchFilter searchFilter = null; > final Set<RangerRole> rolesInDB = new > HashSet<>(roleDBStore.getRoles(searchFilter)); > > Date updateTime = new Date(); > > if (rolesInDB != null) { > ret = new RangerRoles(); > > ret.setRangerRoles(rolesInDB); > ret.setRoleUpdateTime(updateTime); > ret.setRoleVersion(rolesVersionInDB); > > rolesVersion = rolesVersionInDB; > } else { > LOG.error("Could not get Ranger Roles from database ..."); > } > } else { > if (LOG.isDebugEnabled()) { > LOG.debug("Could not get lock in [" + waitTimeInSeconds + "] > seconds, returning cached RangerRoles"); > } > ret = getRoles(); > } > } catch (InterruptedException exception) { > LOG.error("RangerRoleCache.getLatestRangerRoles:lock got > interrupted..", exception); > } finally { > if (lockResult) { > lock.unlock(); > } > } > > if (LOG.isDebugEnabled()) { > LOG.debug("<== RangerRoleCache.getLatestRangerRoles(ServiceName= " + > serviceName + " lastKnownRoleVersion= " + lastKnownRoleVersion + " > rolesVersionInDB= " + rolesVersionInDB + " RangerRoles= " + ret + ")"); > } > > return ret; > } > > > Diffs > ----- > > security-admin/src/main/java/org/apache/ranger/common/RangerRoleCache.java > d71e97034 > > > Diff: https://reviews.apache.org/r/74106/diff/1/ > > > Testing > ------- > > Tested the below Rest API's to make sure everything works fine > 1.GET /service/roles/download/{serviceName} > > 2.GET /service/roles/secure/download/{serviceName} > > > Thanks, > > Ramachandran Krishnan > >
