(ranger) branch master updated: RANGER-4478: Incorrect trie updates when processing deltas - Part 3

2023-11-04 Thread abhay 
This is an automated email from the ASF dual-hosted git repository.

abhay pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git


The following commit(s) were added to refs/heads/master by this push:
 new 3f78f9fae RANGER-4478: Incorrect trie updates when processing deltas - 
Part 3
3f78f9fae is described below

commit 3f78f9fae635b4dc1febdd1aad99e485cde412d6
Author: Abhay Kulkarni 
AuthorDate: Sat Nov 4 13:16:35 2023 -0700

RANGER-4478: Incorrect trie updates when processing deltas - Part 3
---
 .../plugin/policyengine/RangerResourceTrie.java| 41 +++---
 1 file changed, 37 insertions(+), 4 deletions(-)

diff --git 
a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
 
b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
index d95da7c50..773a02609 100644
--- 
a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
+++ 
b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
@@ -576,7 +576,7 @@ public class RangerResourceTrie {
 
 }
 
-private String getNonWildcardPrefix(String str) {
+private int getNonWildcardPrefixLength(String str) {
 int minIndex = str.length();
 
 for (int i = 0; i < wildcardChars.length(); i++) {
@@ -587,9 +587,17 @@ public class RangerResourceTrie {
 }
 }
 
-return str.substring(0, minIndex);
+return minIndex;
+}
+
+private String getNonWildcardPrefix(String str) {
+int prefixLen = getNonWildcardPrefixLength(str);
+
+return (prefixLen < str.length()) ? str.substring(0, prefixLen) : str;
 }
 
+
+
 private Set getEvaluatorsForResource(String resource, 
ResourceElementMatchingScope scope) {
 if(LOG.isDebugEnabled()) {
 LOG.debug("==> RangerResourceTrie.getEvaluatorsForResource(" + 
resource + ", " + scope + ")");
@@ -718,7 +726,7 @@ public class RangerResourceTrie {
 }
 
 TrieNode curr = root;
-final int   len  = resource.length();
+final int   len  = getNonWildcardPrefixLength(resource);
 int i= 0;
 
 while (i < len) {
@@ -738,6 +746,8 @@ public class RangerResourceTrie {
 i+= childStr.length();
 }
 
+curr = (i == len) ? curr : null;
+
 RangerPerfTracer.logAlways(perf);
 
 if(LOG.isDebugEnabled()) {
@@ -1128,11 +1138,21 @@ public class RangerResourceTrie {
 }
 
 void removeSelfFromTrie() {
-if (evaluators == null && wildcardEvaluators == null && 
children.size() == 0) {
+if (LOG.isDebugEnabled()) {
+LOG.debug("==> removeSelfFromTrie(" + this + ")");
+}
+if (evaluators == null && children.size() == 0) {
 TrieNode parent = getParent();
 if (parent != null) {
 parent.children.remove(str.charAt(0));
 }
+} else {
+if (LOG.isDebugEnabled()) {
+LOG.debug("removeSelfFromTrie(" + this + ") could not 
remove self from Trie");
+}
+}
+if (LOG.isDebugEnabled()) {
+LOG.debug("<== removeSelfFromTrie(" + this + ")");
 }
 }
 
@@ -1298,12 +1318,25 @@ public class RangerResourceTrie {
 }
 
 private void removeEvaluatorFromSubtree(U evaluator) {
+if (LOG.isDebugEnabled()) {
+LOG.debug("==> removeEvaluatorFromSubtree(" + 
evaluator.getId() + ")");
+}
 if (CollectionUtils.isNotEmpty(wildcardEvaluators) && 
wildcardEvaluators.contains(evaluator)) {
 removeWildcardEvaluator(evaluator);
 } else {
 removeEvaluator(evaluator);
 }
 removeSelfFromTrie();
+if (LOG.isDebugEnabled()) {
+LOG.debug("<== removeEvaluatorFromSubtree(" + 
evaluator.getId() + ")");
+}
+}
+
+@Override
+public String toString() {
+StringBuilder sb = new StringBuilder();
+toString(sb);
+return sb.toString();
 }
 
 void toString(StringBuilder sb) {

[ranger] branch master updated: RANGER-4478: Incorrect trie updates when processing deltas - Part 2

2023-10-23 Thread abhay 
This is an automated email from the ASF dual-hosted git repository.

abhay pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git


The following commit(s) were added to refs/heads/master by this push:
 new 36ce62eab RANGER-4478: Incorrect trie updates when processing deltas - 
Part 2
36ce62eab is described below

commit 36ce62eabbcc38112b15e376411fb053ef8d2ed9
Author: Abhay Kulkarni 
AuthorDate: Mon Oct 23 13:18:12 2023 -0700

RANGER-4478: Incorrect trie updates when processing deltas - Part 2
---
 .../java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java | 3 ---
 1 file changed, 3 deletions(-)

diff --git 
a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
 
b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
index 61b6a4357..d95da7c50 100644
--- 
a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
+++ 
b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
@@ -553,7 +553,6 @@ public class RangerResourceTrie {
 
 builderThreads.get(index).add(resource, isRecursive, evaluator);
 } else {
-currentRoot.undoSetup();
 currentRoot.addWildcardEvaluator(evaluator);
 }
 
@@ -570,7 +569,6 @@ public class RangerResourceTrie {
 }
 
 if(isWildcard || isRecursive) {
-curr.undoSetup();
 curr.addWildcardEvaluator(evaluator);
 } else {
 curr.addEvaluator(evaluator);
@@ -1301,7 +1299,6 @@ public class RangerResourceTrie {
 
 private void removeEvaluatorFromSubtree(U evaluator) {
 if (CollectionUtils.isNotEmpty(wildcardEvaluators) && 
wildcardEvaluators.contains(evaluator)) {
-undoSetup();
 removeWildcardEvaluator(evaluator);
 } else {
 removeEvaluator(evaluator);

[ranger] branch master updated: RANGER-4478: Incorrect trie updates when processing deltas

2023-10-17 Thread abhay 
This is an automated email from the ASF dual-hosted git repository.

abhay pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git


The following commit(s) were added to refs/heads/master by this push:
 new 0e7d63022 RANGER-4478: Incorrect trie updates when processing deltas
0e7d63022 is described below

commit 0e7d63022252dc3c74478aa32bffac3ea755fee9
Author: Abhay Kulkarni 
AuthorDate: Tue Oct 17 13:00:22 2023 -0700

RANGER-4478: Incorrect trie updates when processing deltas
---
 .../plugin/policyengine/RangerResourceTrie.java| 71 --
 .../RangerPolicyResourceMatcher.java   |  1 -
 2 files changed, 39 insertions(+), 33 deletions(-)

diff --git 
a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
 
b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
index 2f725036d..61b6a4357 100644
--- 
a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
+++ 
b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java
@@ -94,6 +94,13 @@ public class RangerResourceTrie {
 
 wrapUpUpdate();
 
+if (!isOptimizedForRetrieval) {
+if (LOG.isDebugEnabled()) {
+LOG.debug("Trie for " + this.resourceDef.getName() + " is not 
optimized for retrieval. Resetting isSetup flag by calling undoSetup() on the 
root");
+}
+root.undoSetup();
+}
+
 RangerPerfTracer.logAlways(perf);
 
 if (PERF_TRIE_INIT_LOG.isDebugEnabled()) {
@@ -109,7 +116,7 @@ public class RangerResourceTrie {
 this(resourceDef, evaluators, isOptimizedForRetrieval, false, 
pluginContext);
 }
 
-public  
RangerResourceTrie(RangerResourceDef resourceDef, List evaluators, boolean 
isOptimizedForRetrieval, boolean isOptimizedForSpace, RangerPluginContext 
pluginContext) {
+public  RangerResourceTrie(RangerResourceDef resourceDef, List 
evaluators, boolean isOptimizedForRetrieval, boolean isOptimizedForSpace, 
RangerPluginContext pluginContext) {
 if(LOG.isDebugEnabled()) {
 LOG.debug("==> RangerResourceTrie(" + resourceDef.getName() + ", 
evaluatorCount=" + evaluators.size() + ", isOptimizedForRetrieval=" + 
isOptimizedForRetrieval + ", isOptimizedForSpace=" + isOptimizedForSpace + ")");
 }
@@ -158,9 +165,9 @@ public class RangerResourceTrie {
 this.isOptimizedForRetrieval = !isOptimizedForSpace && 
isOptimizedForRetrieval;  // isOptimizedForSpace takes precedence
 this.separatorChar   = 
ServiceDefUtil.getCharOption(matcherOptions, OPTION_PATH_SEPARATOR, 
DEFAULT_PATH_SEPARATOR_CHAR);
 
-final TrieNode tmpRoot = buildTrie(resourceDef, evaluators, 
builderThreadCount);
+final TrieNode tmpRoot = buildTrie(resourceDef, evaluators, 
builderThreadCount);
 
-if (builderThreadCount > 1 && tmpRoot == null) { // if multi-threaded 
trie-creation failed, build using a single thread
+if (builderThreadCount > 1 && tmpRoot == null) { // if multithreaded 
trie-creation failed, build using a single thread
 this.root = buildTrie(resourceDef, evaluators, 1);
 } else {
 this.root = tmpRoot;
@@ -179,7 +186,7 @@ public class RangerResourceTrie {
 }
 
 if(LOG.isDebugEnabled()) {
-LOG.debug("<== RangerResourceTrie(" + resourceDef.getName() + ", 
evaluatorCount=" + evaluators.size() + ", isOptimizedForRetrieval=" + 
this.isOptimizedForRetrieval + ", isOptimizedForSpace=" + 
this.isOptimizedForSpace + "): " + toString());
+LOG.debug("<== RangerResourceTrie(" + resourceDef.getName() + ", 
evaluatorCount=" + evaluators.size() + ", isOptimizedForRetrieval=" + 
this.isOptimizedForRetrieval + ", isOptimizedForSpace=" + 
this.isOptimizedForSpace + "): " + this);
 }
 }
 
@@ -191,16 +198,16 @@ public class RangerResourceTrie {
 return getEvaluatorsForResource(resource, 
ResourceElementMatchingScope.SELF);
 }
 
+@SuppressWarnings("unchecked")
 public Set getEvaluatorsForResource(Object resource, 
ResourceElementMatchingScope scope) {
 if (resource instanceof String) {
 return getEvaluatorsForResource((String) resource, scope);
 } else if (resource instanceof Collection) {
-if (CollectionUtils.isEmpty((Collection) resource)) {  // treat 
empty collection same as empty-string
+Collection resources = (Collection) resource;
+
+if (CollectionUtils.isEmpty(resources)) {  // treat empty 
collection same as empty-string
 return getEvaluatorsForResource("", scope);
 } else {
-@SuppressWarnings("unchecked")
-Collection resources = (Collection) resource;
-
 return getEvaluatorsForResources(resources, scope);
 }
 }
@@ -457,6 +464,9 @@