hcq/oceanbase
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
e537a0c479efd35e940aedbe7db52e6965600ff2
oceanbase/src/sql/engine/cmd/ob_dcl_executor.cpp
jingtaoye35 e537a0c479 [FEAT MERGE] 424 SQL compatibility patch 433 
Co-authored-by: wjhh2008 <wjh2006-1@163.com>
Co-authored-by: GongYusen <986957406@qq.com>
Co-authored-by: hy-guo <fqboyg@gmail.com>
2024-08-23 03:32:02 +00:00

476 lines
19 KiB
C++
Raw Blame History

/**
* Copyright (c) 2021 OceanBase
* OceanBase CE is licensed under Mulan PubL v2.
* You can use this software according to the terms and conditions of the Mulan PubL v2.
* You may obtain a copy of Mulan PubL v2 at:
* http://license.coscl.org.cn/MulanPubL-2.0
* THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
* EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
* MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
* See the Mulan PubL v2 for more details.
*/
#define USING_LOG_PREFIX SQL_ENG
#include "sql/engine/cmd/ob_dcl_executor.h"
#include "lib/encrypt/ob_encrypted_helper.h"
#include "share/ob_rpc_struct.h"
#include "share/schema/ob_schema_struct.h"
#include "share/ob_common_rpc_proxy.h"
#include "sql/engine/ob_exec_context.h"
#include "sql/resolver/dcl/ob_grant_stmt.h"
#include "sql/resolver/dcl/ob_revoke_stmt.h"
#include "sql/session/ob_sql_session_info.h"
#include "sql/engine/cmd/ob_user_cmd_executor.h"
namespace oceanbase
{
using namespace common;
using namespace share::schema;
namespace sql
{
int ObGrantExecutor::execute(ObExecContext &ctx, ObGrantStmt &stmt)
{
int ret = OB_SUCCESS;
ObTaskExecutorCtx *task_exec_ctx = NULL;
obrpc::ObCommonRpcProxy *common_rpc_proxy = NULL;
ObSQLSessionInfo *session_info = NULL;
const uint64_t tenant_id = stmt.get_tenant_id();
const ObStrings &users = stmt.get_users();
ObIAllocator &allocator = ctx.get_allocator();
obrpc::ObGrantArg &arg = static_cast<obrpc::ObGrantArg &>(stmt.get_ddl_arg());
const bool is_role = arg.roles_.count() > 0;
ObSchemaGetterGuard schema_guard;
const ObUserInfo *user_info = NULL;
if (OB_ISNULL(task_exec_ctx = GET_TASK_EXECUTOR_CTX(ctx))) {
ret = OB_NOT_INIT;
LOG_WARN("get task executor context failed");
} else if (OB_ISNULL(session_info = ctx.get_my_session())) {
ret = OB_NOT_INIT;
LOG_WARN("Get my session error");
} else if (OB_ISNULL(common_rpc_proxy = task_exec_ctx->get_common_rpc())) {
ret = OB_NOT_INIT;
LOG_WARN("get common rpc proxy failed", K(ret));
} else if (OB_ISNULL(GCTX.schema_service_)) {
ret = OB_NOT_INIT;
LOG_WARN("get schema service failed", K(ret));
} else if (!is_role) {
ObString user_name;
ObString host_name;
ObString pwd;
ObString need_enc;
//i += 4, each with user_name, pwd, need_enc
if (OB_UNLIKELY(users.count() <= 0) || OB_UNLIKELY(0 != users.count() % 4)) {
ret = OB_ERR_UNEXPECTED;
LOG_WARN("Resolve users error. Users should have user and pwd",
"ObStrings count", users.count(), K(ret));
}
for (int64_t i = 0; OB_SUCC(ret) && i < users.count(); i += 4) {
if (OB_FAIL(users.get_string(i, user_name))) {
LOG_WARN("Get string from ObStrings error", "count",
users.count(), K(i), K(ret));
} else if (OB_FAIL(users.get_string(i + 1, host_name))) {
LOG_WARN("Get string from ObStrings error", "count",
users.count(), K(i), K(ret));
} else if (OB_FAIL(users.get_string(i + 2, pwd))) {
LOG_WARN("Get string from ObStrings error", "count",
users.count(), K(i), K(ret));
} else if (OB_FAIL(users.get_string(i + 3, need_enc))) {
LOG_WARN("Get string from ObStrings error", "count",
users.count(), K(i), K(ret));
} else {
if (OB_FAIL(arg.users_passwd_.push_back(user_name))) {
LOG_WARN("failed to add user", K(ret));
} else if (OB_FAIL(arg.hosts_.push_back(host_name))) {
LOG_WARN("failed to add user", K(ret));
} else if (ObString::make_string("YES") == need_enc) {
ObString pwd_enc;
if (pwd.length() > 0) {
char *enc_buf = NULL;
if (NULL == (enc_buf = static_cast<char *>(allocator.alloc(ENC_BUF_LEN)))) {
ret = OB_ALLOCATE_MEMORY_FAILED;
LOG_ERROR("Failed to allocate memory", K(ret), K(ENC_BUF_LEN));
} else if (OB_FAIL(ObCreateUserExecutor::encrypt_passwd(pwd,
pwd_enc,
enc_buf,
ENC_BUF_LEN))) {
LOG_WARN("Encrypt password failed", K(ret));
} else { }//do nothing
}
if (OB_FAIL(ret)) {
} else if (OB_FAIL(arg.users_passwd_.push_back(pwd_enc))) {
LOG_WARN("failed to add password", K(ret));
} else { }//do nothing
} else {
if (OB_FAIL(arg.users_passwd_.push_back(pwd))) {
LOG_WARN("failed to add password", K(ret));
}
}
}
}
}
if (OB_FAIL(ret)) {
// do nothing.
} else if (OB_ISNULL(stmt.get_query_ctx())) {
ret = OB_ERR_UNEXPECTED;
LOG_WARN("query ctx is null", K(ret));
} else {
arg.tenant_id_ = tenant_id;
arg.db_ = stmt.get_database_name();
arg.table_ = stmt.get_table_name();
arg.priv_set_ = stmt.get_priv_set();
arg.priv_level_ = stmt.get_grant_level();
arg.need_create_user_ = stmt.get_need_create_user();
arg.has_create_user_priv_ = session_info->get_user_priv_set() & OB_PRIV_CREATE_USER;
arg.ddl_stmt_str_ = stmt.get_query_ctx()->get_sql_stmt();
arg.option_ = stmt.get_option();
arg.object_type_ = stmt.get_object_type();
arg.object_id_ = stmt.get_object_id();
arg.grantor_id_ = stmt.get_grantor_id();
arg.is_inner_ = session_info->is_inner();
arg.based_schema_object_infos_.reset();
if (OB_FAIL(append(arg.column_names_priv_, stmt.get_column_privs()))
|| OB_FAIL(append(arg.ins_col_ids_, stmt.get_ins_col_ids()))
|| OB_FAIL(append(arg.upd_col_ids_, stmt.get_upd_col_ids()))
|| OB_FAIL(append(arg.ref_col_ids_, stmt.get_ref_col_ids()))) {
LOG_WARN("append failed", K(ret));
} else if (lib::is_mysql_mode() && arg.object_type_ == ObObjectType::TABLE
&& arg.column_names_priv_.count() > 0) {
if (arg.object_id_ == OB_INVALID) {
//do nothing
//todo: oracle every object will use id, and should also record the schema version in future.
} else if (stmt.get_table_schema_version() != 0
&& OB_FAIL(arg.based_schema_object_infos_.push_back(ObBasedSchemaObjectInfo(arg.object_id_,
TABLE_SCHEMA,
stmt.get_table_schema_version())))) {
LOG_WARN("push back failed", K(ret));
}
}
if (OB_FAIL(ret)) {
} else if (OB_FAIL(GCTX.schema_service_->get_tenant_schema_guard(tenant_id, schema_guard))) {
LOG_WARN("failed to get tenant schema guard", K(ret));
} else if (OB_FAIL(schema_guard.get_user_info(tenant_id,
session_info->get_priv_user_id(),
user_info))) {
LOG_WARN("failed to get user info", K(ret));
} else if (OB_ISNULL(user_info)) {
// ignore ret
LOG_WARN("user info is unexpected null", K(ret));
} else if (OB_FAIL(ob_write_string(allocator, user_info->get_user_name_str(), arg.grantor_))) {
LOG_WARN("failed to write string", K(ret));
} else if (OB_FAIL(ob_write_string(allocator, user_info->get_host_name_str(), arg.grantor_host_))) {
LOG_WARN("failed to write string", K(ret));
}
int tmp_ret = OB_SUCCESS;
if (OB_TMP_FAIL(schema_guard.reset())) {
LOG_WARN("failed to reset schema guard", K(tmp_ret));
if (OB_SUCC(ret)) {
ret = tmp_ret;
}
}
if (OB_FAIL(ret)) {
} else if (OB_FAIL(common_rpc_proxy->grant(arg))) {
LOG_WARN("Grant privileges to user error", K(ret), K(arg));
}
}
return ret;
}
int ObRevokeExecutor::execute(ObExecContext &ctx, ObRevokeStmt &stmt)
{
int ret = OB_SUCCESS;
ObTaskExecutorCtx *task_exec_ctx = NULL;
obrpc::ObCommonRpcProxy *common_rpc_proxy = NULL;
if (OB_ISNULL(task_exec_ctx = GET_TASK_EXECUTOR_CTX(ctx))) {
ret = OB_NOT_INIT;
LOG_WARN("get task executor context failed");
} else if (OB_ISNULL(common_rpc_proxy = task_exec_ctx->get_common_rpc())) {
ret = OB_NOT_INIT;
LOG_WARN("get common rpc proxy failed");
} else if (stmt.get_has_warning()) {
//do nothing
} else {
switch (stmt.get_grant_level()) {
case OB_PRIV_USER_LEVEL: {
if (OB_FAIL(revoke_user(common_rpc_proxy, stmt))) {
LOG_WARN("grant_revoke_user error", K(ret));
}
break;
}
case OB_PRIV_DB_LEVEL: {
if (OB_FAIL(revoke_db(common_rpc_proxy, stmt))) {
LOG_WARN("grant_revoke_user error", K(ret));
}
break;
}
case OB_PRIV_TABLE_LEVEL: {
if (OB_FAIL(revoke_table(common_rpc_proxy, stmt, ctx))) {
LOG_WARN("grant_revoke_user error", K(ret));
}
break;
}
case OB_PRIV_ROUTINE_LEVEL: {
if (OB_FAIL(revoke_routine(common_rpc_proxy, stmt, ctx))) {
LOG_WARN("grant_revoke_user error", K(ret));
}
break;
}
case OB_PRIV_SYS_ORACLE_LEVEL: { // Oracle revoke role and sys_priv
if (OB_FAIL(revoke_sys_priv(common_rpc_proxy, stmt))) {
LOG_WARN("grant_revoke_user error", K(ret));
}
break;
}
default: {
ret = OB_ERR_UNEXPECTED;
LOG_WARN("Resolver may be error, invalid grant_level",
"grant_level", ob_priv_level_str(stmt.get_grant_level()), K(ret));
break;
}
}
}
return ret;
}
int ObRevokeExecutor::revoke_user(obrpc::ObCommonRpcProxy *rpc_proxy, ObRevokeStmt &stmt)
{
int ret = OB_SUCCESS;
if (OB_ISNULL(rpc_proxy)) {
ret = OB_INVALID_ARGUMENT;
LOG_WARN("Input argument error", K(rpc_proxy), K(ret));
} else {
obrpc::ObRevokeUserArg &arg = static_cast<obrpc::ObRevokeUserArg &>(stmt.get_ddl_arg());
arg.tenant_id_ = stmt.get_tenant_id();
const ObIArray<uint64_t> &user_ids = stmt.get_users();
const bool is_role = arg.role_ids_.count() > 0;
if (is_role) {
for (int i = 0; OB_SUCC(ret) && i < user_ids.count(); ++i) {
arg.user_id_ = user_ids.at(i);
if (OB_FAIL(rpc_proxy->revoke_user(arg))) {
LOG_WARN("revoke user error", K(arg), K(ret));
}
}
} else if (0 == user_ids.count()) {
ret = OB_ERR_UNEXPECTED;
LOG_WARN("User ids is empty, resolver may be error", K(ret));
} else {
arg.revoke_all_ = stmt.get_revoke_all();
arg.priv_set_ = stmt.get_priv_set();
for (int i = 0; OB_SUCC(ret) && i < user_ids.count(); i++) {
arg.user_id_ = user_ids.at(i);
if (OB_FAIL(rpc_proxy->revoke_user(arg))) {
LOG_WARN("revoke user error", K(arg), K(ret));
}
}
}
}
return ret;
}
int ObRevokeExecutor::revoke_db(obrpc::ObCommonRpcProxy *rpc_proxy, ObRevokeStmt &stmt)
{
int ret = OB_SUCCESS;
if (OB_ISNULL(rpc_proxy)) {
ret = OB_INVALID_ARGUMENT;
LOG_WARN("Input argument error", K(rpc_proxy), K(ret));
} else {
obrpc::ObRevokeDBArg &arg = static_cast<obrpc::ObRevokeDBArg &>(stmt.get_ddl_arg());
arg.tenant_id_ = stmt.get_tenant_id();
arg.priv_set_ = stmt.get_priv_set();
arg.db_ = stmt.get_database_name();
const ObIArray<uint64_t> &user_ids = stmt.get_users();
if (0 == user_ids.count()) {
ret = OB_ERR_UNEXPECTED;
LOG_WARN("User ids is empty, resolver may be error", K(ret));
} else {
for (int i = 0; OB_SUCC(ret) && i < user_ids.count(); i++) {
arg.user_id_ = user_ids.at(i);
if (OB_FAIL(rpc_proxy->revoke_database(arg))) {
LOG_WARN("revoke user error", K(arg), K(ret));
}
}
}
}
return ret;
}
int ObRevokeExecutor::revoke_table(obrpc::ObCommonRpcProxy *rpc_proxy,
ObRevokeStmt &stmt,
ObExecContext &ctx)
{
int ret = OB_SUCCESS;
ObSQLSessionInfo *session_info = NULL;
ObSchemaGetterGuard schema_guard;
const ObUserInfo *user_info = NULL;
if (OB_ISNULL(rpc_proxy) || OB_ISNULL(GCTX.schema_service_)) {
ret = OB_INVALID_ARGUMENT;
LOG_WARN("Input argument error", K(rpc_proxy), K(ret));
} else if (OB_ISNULL(session_info = ctx.get_my_session())) {
ret = OB_NOT_INIT;
LOG_WARN("Get my session error");
} else {
obrpc::ObRevokeTableArg &arg = static_cast<obrpc::ObRevokeTableArg &>(stmt.get_ddl_arg());
arg.tenant_id_ = stmt.get_tenant_id();
arg.priv_set_ = stmt.get_priv_set();
arg.db_ = stmt.get_database_name();
arg.table_ = stmt.get_table_name();
arg.obj_id_ = stmt.get_object_id();
arg.obj_type_ = static_cast<uint64_t>(stmt.get_object_type());
arg.grantor_id_ = stmt.get_grantor_id();
arg.revoke_all_ora_ = stmt.get_revoke_all_ora();
arg.based_schema_object_infos_.reset();
if (OB_FAIL(append(arg.column_names_priv_, stmt.get_column_privs()))) {
LOG_WARN("append failed", K(ret));
} else if (stmt.get_object_type() == ObObjectType::TABLE
&& (arg.column_names_priv_.count() > 0)) {
if (arg.obj_id_ == OB_INVALID) {
//do nothing
//todo: oracle every object will use id, and should also record the schema version in future.
} else if (lib::is_mysql_mode() && stmt.get_table_schema_version()!= 0 &&
OB_FAIL(arg.based_schema_object_infos_.push_back(ObBasedSchemaObjectInfo(arg.obj_id_,
TABLE_SCHEMA,
stmt.get_table_schema_version())))) {
LOG_WARN("push back failed", K(ret));
}
} else {
//todo: pl routine and others
}
if (OB_FAIL(ret)) {
} else if (OB_FAIL(GCTX.schema_service_->get_tenant_schema_guard(arg.tenant_id_, schema_guard))) {
LOG_WARN("failed to get tenant schema guard", K(ret));
} else if (OB_FAIL(schema_guard.get_user_info(arg.tenant_id_,
session_info->get_priv_user_id(),
user_info))) {
LOG_WARN("failed to get user info", K(ret));
} else if (OB_ISNULL(user_info)) {
// ignore ret
LOG_WARN("user info is unexpected null", K(ret));
} else if (OB_FAIL(ob_write_string(ctx.get_allocator(), user_info->get_user_name_str(), arg.grantor_))) {
LOG_WARN("failed to write string", K(ret));
} else if (OB_FAIL(ob_write_string(ctx.get_allocator(), user_info->get_host_name_str(), arg.grantor_host_))) {
LOG_WARN("failed to write string", K(ret));
}
int tmp_ret = OB_SUCCESS;
if (OB_TMP_FAIL(schema_guard.reset())) {
LOG_WARN("failed to reset schema guard", K(tmp_ret));
if (OB_SUCC(ret)) {
ret = tmp_ret;
}
}
const ObIArray<uint64_t> &user_ids = stmt.get_users();
if (OB_FAIL(ret)) {
} else if (0 == user_ids.count()) {
ret = OB_ERR_UNEXPECTED;
LOG_WARN("User ids is empty, resolver may be error", K(ret));
} else {
for (int i = 0; OB_SUCC(ret) && i < user_ids.count(); i++) {
arg.user_id_ = user_ids.at(i);
if (OB_FAIL(rpc_proxy->revoke_table(arg))) {
LOG_WARN("revoke user error", K(arg), K(ret));
}
}
}
}
return ret;
}
int ObRevokeExecutor::revoke_routine(obrpc::ObCommonRpcProxy *rpc_proxy,
ObRevokeStmt &stmt,
ObExecContext &ctx)
{
int ret = OB_SUCCESS;
ObSQLSessionInfo *session_info = NULL;
ObSchemaGetterGuard schema_guard;
const ObUserInfo *user_info = NULL;
if (OB_ISNULL(rpc_proxy)) {
ret = OB_INVALID_ARGUMENT;
LOG_WARN("Input argument error", K(rpc_proxy), K(ret));
} else if (OB_ISNULL(session_info = ctx.get_my_session())) {
ret = OB_NOT_INIT;
LOG_WARN("Get my session error");
} else {
obrpc::ObRevokeRoutineArg &arg = static_cast<obrpc::ObRevokeRoutineArg &>(stmt.get_ddl_arg());
arg.tenant_id_ = stmt.get_tenant_id();
arg.priv_set_ = stmt.get_priv_set();
arg.db_ = stmt.get_database_name();
arg.routine_ = stmt.get_table_name();
arg.obj_id_ = stmt.get_object_id();
arg.obj_type_ = static_cast<uint64_t>(stmt.get_object_type());
arg.grantor_id_ = stmt.get_grantor_id();
arg.revoke_all_ora_ = stmt.get_revoke_all_ora();
if (OB_FAIL(ret)) {
} else if (OB_FAIL(GCTX.schema_service_->get_tenant_schema_guard(arg.tenant_id_, schema_guard))) {
LOG_WARN("failed to get tenant schema guard", K(ret));
} else if (OB_FAIL(schema_guard.get_user_info(arg.tenant_id_,
session_info->get_priv_user_id(),
user_info))) {
LOG_WARN("failed to get user info", K(ret));
} else if (OB_ISNULL(user_info)) {
// ignore ret
LOG_WARN("user info is unexpected null", K(ret));
} else if (OB_FAIL(ob_write_string(ctx.get_allocator(), user_info->get_user_name_str(), arg.grantor_))) {
LOG_WARN("failed to write string", K(ret));
} else if (OB_FAIL(ob_write_string(ctx.get_allocator(), user_info->get_host_name_str(), arg.grantor_host_))) {
LOG_WARN("failed to write string", K(ret));
}
int tmp_ret = OB_SUCCESS;
if (OB_TMP_FAIL(schema_guard.reset())) {
LOG_WARN("failed to reset schema guard", K(tmp_ret));
if (OB_SUCC(ret)) {
ret = tmp_ret;
}
}
const ObIArray<uint64_t> &user_ids = stmt.get_users();
if (OB_FAIL(ret)) {
} else if (0 == user_ids.count()) {
ret = OB_ERR_UNEXPECTED;
LOG_WARN("User ids is empty, resolver may be error", K(ret));
} else {
for (int i = 0; OB_SUCC(ret) && i < user_ids.count(); i++) {
arg.user_id_ = user_ids.at(i);
if (OB_FAIL(rpc_proxy->revoke_routine(arg))) {
LOG_WARN("revoke user error", K(arg), K(ret));
}
}
}
}
return ret;
}
int ObRevokeExecutor::revoke_sys_priv(obrpc::ObCommonRpcProxy *rpc_proxy, ObRevokeStmt &stmt)
{
int ret = OB_SUCCESS;
if (OB_ISNULL(rpc_proxy)) {
ret = OB_INVALID_ARGUMENT;
LOG_WARN("Input argument error", K(rpc_proxy), K(ret));
} else {
obrpc::ObRevokeSysPrivArg &arg = static_cast<obrpc::ObRevokeSysPrivArg &>(stmt.get_ddl_arg());
arg.tenant_id_ = stmt.get_tenant_id();
// 在resolve阶段，已经设置了arg的priv_array
// 在resolve阶段，也已经设置了arg的role_ids_
const ObIArray<uint64_t> &user_ids = stmt.get_users();
if (0 == user_ids.count()) {
ret = OB_ERR_UNEXPECTED;
LOG_WARN("User ids is empty, resolver may be error", K(ret));
} else if (OB_ISNULL(stmt.get_query_ctx())) {
ret = OB_ERR_UNEXPECTED;
LOG_WARN("query ctx is null", K(ret));
} else {
arg.ddl_stmt_str_ = stmt.get_query_ctx()->get_sql_stmt();
for (int i = 0; OB_SUCC(ret) && i < user_ids.count(); i++) {
arg.grantee_id_ = user_ids.at(i);
if (OB_FAIL(rpc_proxy->revoke_sys_priv(arg))) {
LOG_WARN("revoke user error", K(arg), K(ret));
}
}
}
}
return ret;
}
}// ns sql
}// ns oceanbase
Reference in New Issue View Git Blame Copy Permalink