hcq/oceanbase
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

[FEAT MERGE] support restore encrypted tenant

Browse Source
This commit is contained in:
yinyj17
2023-04-28 15:15:31 +00:00
committed by ob-robot
parent b41dc0ebdd
commit 34a9edf738
39 changed files with 455 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

166
unittest/share/test_master_key_getter.cpp
View File

@ -32,6 +32,7 @@ public:
void TestMasterKeyGetter::SetUp()
{
system("rm -rf wallet");
int ret = ObMasterKeyGetter::instance().init(NULL);
ASSERT_EQ(OB_SUCCESS, ret);
}
@ -128,6 +129,9 @@ TEST_F(TestMasterKeyGetter, key_getter_serialize)
char data[OB_MAX_MASTER_KEY_LENGTH] = {0};
int64_t data_len = 0;
int tenant_num = sizeof(orig_key_list) / sizeof(orig_key_list[0]);
ObString root_key("123456");
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().set_root_key(OB_SYS_TENANT_ID,
obrpc::RootKeyType::NORMAL, root_key, false));
for (int i = 0; i < tenant_num; ++i) {
for (int j = 0; j < key_num; ++j) {
cur_key = orig_key_list[i][j];
@ -169,6 +173,8 @@ TEST_F(TestMasterKeyGetter, dump2file)
int tenant_num = sizeof(orig_key_list) / sizeof(orig_key_list[0]);
uint64_t key_version = 0;
ObAesOpMode key_algorithm = ObAesOpMode::ob_invalid_mode;
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().set_root_key(OB_SYS_TENANT_ID,
obrpc::RootKeyType::DEFAULT, ObString(), false));
for (int i = 0; i < tenant_num; ++i) {
for (int j = 0; j < key_num; ++j) {
cur_key = orig_key_list[i][j];
@ -187,6 +193,7 @@ TEST_F(TestMasterKeyGetter, dump2file)
ObMasterKeyGetter::instance().id_value_map_.reuse();
ObMasterKeyGetter::instance().tenant_key_version_map_.reuse();
ObMasterKeyGetter::instance().tenant_table_key_algorithm_map_.reuse();
ObMasterKeyGetter::instance().root_key_map_.reuse();
EXPECT_EQ(0, ObMasterKeyGetter::instance().id_value_map_.size());
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().load_key(keystore_file));
EXPECT_EQ(tenant_num * key_num, ObMasterKeyGetter::instance().id_value_map_.size());
@ -197,7 +204,7 @@ TEST_F(TestMasterKeyGetter, dump2file)
EXPECT_STREQ(data, orig_key_list[i][j]);
}
}
EXPECT_EQ(tenant_num, ObMasterKeyGetter::instance().tenant_key_version_map_.size());
EXPECT_EQ(1, ObMasterKeyGetter::instance().tenant_key_version_map_.size());
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().get_max_active_version(0, key_version));
EXPECT_EQ(key_num - 2, key_version);
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().get_max_stored_version(0, key_version));
@ -221,6 +228,162 @@ TEST_F(TestMasterKeyGetter, dump2file)
// EXPECT_EQ(0, ObMasterKeyGetter::instance().tenant_table_key_algorithm_map_.size());
// }
TEST_F(TestMasterKeyGetter, dump_tenant_keys)
{
int64_t key_num = 5;
char key[OB_MAX_MASTER_KEY_LENGTH] = {0};
const int64_t key_len = OB_MAX_MASTER_KEY_LENGTH;
int64_t tmp_len = 0;
uint64_t src_tenant_id = 1;
uint64_t dst_tenant_id = 2;
ObMasterKeyBackup key_backup;
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().set_root_key(OB_SYS_TENANT_ID,
obrpc::RootKeyType::DEFAULT, ObString(), false));
for (int64_t i = 0; i < key_num; ++i) {
EXPECT_EQ(OB_SUCCESS, ObKeyGenerator::generate_encrypt_key(key, key_len));
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().set_master_key(src_tenant_id, i + 1, key, key_len));
}
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().dump_tenant_keys(src_tenant_id, key_backup.master_key_list_));
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().load_tenant_keys(dst_tenant_id, ObAesOpMode::ob_aes_128_ecb, key_backup.master_key_list_));
EXPECT_EQ(key_num * 2, ObMasterKeyGetter::instance().id_value_map_.size());
char src_key[OB_MAX_MASTER_KEY_LENGTH + 1] = {0};
char dst_key[OB_MAX_MASTER_KEY_LENGTH + 1] = {0};
for (int64_t i = 0; i < key_num; ++i) {
memset(src_key, 0, OB_MAX_MASTER_KEY_LENGTH + 1);
memset(dst_key, 0, OB_MAX_MASTER_KEY_LENGTH + 1);
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::get_master_key(src_tenant_id, i + 1, src_key, OB_MAX_MASTER_KEY_LENGTH, tmp_len));
EXPECT_EQ(tmp_len, key_len);
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::get_master_key(src_tenant_id, i + 1, dst_key, OB_MAX_MASTER_KEY_LENGTH, tmp_len));
EXPECT_EQ(tmp_len, key_len);
EXPECT_STREQ(src_key, dst_key);
}
}
TEST_F(TestMasterKeyGetter, backup_keys)
{
int64_t key_num = 5;
char key[OB_MAX_MASTER_KEY_LENGTH] = {0};
char encrypt_key[OB_MAX_MASTER_KEY_LENGTH] = {0};
const int64_t key_len = OB_MAX_MASTER_KEY_LENGTH;
int64_t tmp_len = 0;
uint64_t src_tenant_id = 1;
uint64_t dst_tenant_id = 2;
ObString backup_path("file://wallet/key.bak");
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().set_root_key(OB_SYS_TENANT_ID,
obrpc::RootKeyType::DEFAULT, ObString(), false));
EXPECT_EQ(OB_SUCCESS, ObKeyGenerator::generate_encrypt_key(encrypt_key, key_len));
for (int64_t i = 0; i < key_num; ++i) {
EXPECT_EQ(OB_SUCCESS, ObKeyGenerator::generate_encrypt_key(key, key_len));
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().set_master_key(src_tenant_id, i + 1, key, key_len));
}
ObString encrypt_key_str(key_len, encrypt_key);
EXPECT_EQ(OB_SUCCESS, ObMasterKeyUtil::backup_key(src_tenant_id, backup_path, encrypt_key_str));
EXPECT_EQ(OB_SUCCESS, ObMasterKeyUtil::restore_key(dst_tenant_id, backup_path, encrypt_key_str));
EXPECT_EQ(OB_SUCCESS, ObMasterKeyUtil::restore_key(dst_tenant_id, backup_path, encrypt_key_str));
EXPECT_EQ(key_num * 2, ObMasterKeyGetter::instance().id_value_map_.size());
char src_key[OB_MAX_MASTER_KEY_LENGTH + 1] = {0};
char dst_key[OB_MAX_MASTER_KEY_LENGTH + 1] = {0};
for (int64_t i = 0; i < key_num; ++i) {
memset(src_key, 0, OB_MAX_MASTER_KEY_LENGTH + 1);
memset(dst_key, 0, OB_MAX_MASTER_KEY_LENGTH + 1);
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::get_master_key(src_tenant_id, i + 1, src_key, OB_MAX_MASTER_KEY_LENGTH, tmp_len));
EXPECT_EQ(tmp_len, key_len);
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::get_master_key(dst_tenant_id, i + 1, dst_key, OB_MAX_MASTER_KEY_LENGTH, tmp_len));
EXPECT_EQ(tmp_len, key_len);
EXPECT_STREQ(src_key, dst_key);
}
}
TEST_F(TestMasterKeyGetter, dump_root_key)
{
const int key_num = 3;
ObRootKey key_list[key_num];
key_list[0].key_type_ = obrpc::RootKeyType::NORMAL;
key_list[0].key_ = ObString("123456");
key_list[1].key_type_ = obrpc::RootKeyType::DEFAULT;
key_list[2].key_type_ = obrpc::RootKeyType::NORMAL;
key_list[2].key_ = ObString("abcde");
for (int i = 0; i < key_num; ++i) {
ObRootKey &root_key = key_list[i];
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().set_root_key(i + 1, root_key.key_type_, root_key.key_));
}
EXPECT_EQ(key_num, ObMasterKeyGetter::instance().root_key_map_.size());
ObMasterKeyGetter::instance().root_key_map_.reuse();
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().load_root_key());
EXPECT_EQ(key_num, ObMasterKeyGetter::instance().root_key_map_.size());
for (int i = 0; i < key_num; ++i) {
ObRootKey &old_key = key_list[i];
ObRootKey cur_key;
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().get_root_key(i + 1, cur_key.key_type_, cur_key.key_));
EXPECT_EQ(old_key.key_type_, cur_key.key_type_);
EXPECT_EQ(0, old_key.key_.compare(cur_key.key_));
}
}
TEST_F(TestMasterKeyGetter, backup_root_key)
{
const int key_num = 3;
char encrypt_key_buf[OB_MAX_MASTER_KEY_LENGTH] = {0};
const int64_t key_len = OB_MAX_MASTER_KEY_LENGTH;
const char *path_format = "file://wallet/key%d.bak";
ObString path_not_exist("file://wallet/not_exist.bak");
char root_key_buf[key_num][OB_MAX_MASTER_KEY_LENGTH] = {};
ObRootKey key_list[key_num];
EXPECT_EQ(OB_SUCCESS, ObKeyGenerator::generate_encrypt_key(encrypt_key_buf, key_len));
ObString encrypt_key(key_len, encrypt_key_buf);
for (int i = 0; i < key_num; ++i) {
ObRootKey &root_key = key_list[i];
if (i == 1) {
root_key.key_type_ = obrpc::RootKeyType::DEFAULT;
root_key.key_.reset();
} else {
EXPECT_EQ(OB_SUCCESS, ObKeyGenerator::generate_encrypt_key(root_key_buf[i], key_len));
root_key.key_type_ = obrpc::RootKeyType::NORMAL;
root_key.key_.assign_ptr(root_key_buf[i], key_len);
}
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().set_root_key(i, root_key.key_type_, root_key.key_));
}
EXPECT_EQ(key_num, ObMasterKeyGetter::instance().root_key_map_.size());
for (int i = 0; i < key_num; ++i) {
ObBackupDest backup_dest;
char bak_path[MAX_PATH_SIZE] = {};
snprintf(bak_path, MAX_PATH_SIZE, path_format, i);
EXPECT_EQ(OB_SUCCESS, backup_dest.set(bak_path));
EXPECT_EQ(OB_SUCCESS, ObMasterKeyUtil::backup_root_key(i, backup_dest.get_root_path(),
backup_dest.get_storage_info(), encrypt_key));
}
ObMasterKeyGetter::instance().root_key_map_.reuse();
for (int i = 0; i < key_num; ++i) {
ObBackupDest backup_dest;
char bak_path[MAX_PATH_SIZE] = {};
snprintf(bak_path, MAX_PATH_SIZE, path_format, i);
EXPECT_EQ(OB_SUCCESS, backup_dest.set(bak_path));
EXPECT_EQ(OB_SUCCESS, ObMasterKeyUtil::restore_root_key(i + key_num, backup_dest.get_root_path(),
backup_dest.get_storage_info(), encrypt_key));
}
EXPECT_EQ(key_num, ObMasterKeyGetter::instance().root_key_map_.size());
for (int i = 0; i < key_num; ++i) {
ObRootKey &old_key = key_list[i];
ObRootKey cur_key;
EXPECT_EQ(OB_SUCCESS, ObMasterKeyGetter::instance().get_root_key(i + key_num, cur_key.key_type_, cur_key.key_));
EXPECT_EQ(old_key.key_type_, cur_key.key_type_);
EXPECT_EQ(0, old_key.key_.compare(cur_key.key_));
}
ObMasterKeyGetter::instance().root_key_map_.reuse();
ObBackupDest backup_dest;
EXPECT_EQ(OB_SUCCESS, backup_dest.set(path_not_exist));
EXPECT_EQ(OB_SUCCESS, ObMasterKeyUtil::restore_root_key(1, backup_dest.get_root_path(),
backup_dest.get_storage_info(), encrypt_key));
EXPECT_EQ(0, ObMasterKeyGetter::instance().root_key_map_.size());
}
} // end namespace share
} // end namespace oceanbase
@ -229,6 +392,7 @@ int main(int argc, char **argv)
system("rm -rf test_master_key_getter.log* wallet");
oceanbase::common::ObLogger::get_logger().set_file_name("test_master_key_getter.log", true);
oceanbase::common::ObLogger::get_logger().set_log_level("INFO");
oceanbase::common::ObClusterVersion::get_instance().update_cluster_version(CLUSTER_VERSION_4_2_0_0);
testing::InitGoogleTest(&argc, argv);
return RUN_ALL_TESTS();
}