Ericsson / ecaudit

Ericsson Audit plug-in for Apache Cassandra
Apache License 2.0
43 stars 36 forks source link

Is it possible to cache whitelist ? #210

Closed WentingWu666666 closed 1 year ago

WentingWu666666 commented 1 year ago

We got read timeout exception as follows. May I know if it's possible to implement a cache for whitelist so that ecaudit doesn't need to query whitelist for each operation ?

'org.apache.cassandra.exceptions.ReadTimeoutException: Operation timed out - received only 0 responses.at org.apache.cassandra.service.ReadCallback.awaitResults(ReadCallback.java:139)at org.apache.cassandra.service.ReadCallback.get(ReadCallback.java:145)at org.apache.cassandra.service.AbstractReadExecutor.get(AbstractReadExecutor.java:145)at org.apache.cassandra.service.StorageProxy$SinglePartitionReadLifecycle.awaitResultsAndRetryOnDigestMismatch(StorageProxy.java:1921)at org.apache.cassandra.service.StorageProxy.fetchRows(StorageProxy.java:1868)at org.apache.cassandra.service.StorageProxy.readRegular(StorageProxy.java:1802)at org.apache.cassandra.service.StorageProxy.read(StorageProxy.java:1707)at org.apache.cassandra.db.SinglePartitionReadCommand$Group.execute(SinglePartitionReadCommand.java:1220)at org.apache.cassandra.cql3.statements.SelectStatement.execute(SelectStatement.java:315)at org.apache.cassandra.cql3.statements.SelectStatement.execute(SelectStatement.java:285)at com.ericsson.bss.cassandra.ecaudit.auth.WhitelistDataAccess.getWhitelist(WhitelistDataAccess.java:161)at com.ericsson.bss.cassandra.ecaudit.filter.role.RoleAuditFilter.isOperationWhitelistedOnResourceByRole(RoleAuditFilter.java:142)at com.ericsson.bss.cassandra.ecaudit.filter.role.RoleAuditFilter.lambda$isOperationWhitelistedOnResourceByRoles$1(RoleAuditFilter.java:137)at java.util.stream.MatchOps$1MatchSink.accept(MatchOps.java:90)at java.util.HashMap$KeySpliterator.tryAdvance(HashMap.java:1601)at java.util.stream.ReferencePipeline.forEachWithCancel(ReferencePipeline.java:126)at java.util.stream.AbstractPipeline.copyIntoWithCancel(AbstractPipeline.java:499)at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:486)at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:472)at java.util.stream.MatchOps$MatchOp.evaluateSequential(MatchOps.java:230)at java.util.stream.MatchOps$MatchOp.evaluateSequential(MatchOps.java:196)at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)at java.util.stream.ReferencePipeline.anyMatch(ReferencePipeline.java:516)at com.ericsson.bss.cassandra.ecaudit.filter.role.RoleAuditFilter.isOperationWhitelistedOnResourceByRoles(RoleAuditFilter.java:137)at com.ericsson.bss.cassandra.ecaudit.filter.role.RoleAuditFilter.lambda$isWhitelistedUnchecked$0(RoleAuditFilter.java:125)at java.util.stream.MatchOps$1MatchSink.accept(MatchOps.java:90)at java.util.Spliterators$IteratorSpliterator.tryAdvance(Spliterators.java:1812)at java.util.stream.ReferencePipeline.forEachWithCancel(ReferencePipeline.java:126)at java.util.stream.AbstractPipeline.copyIntoWithCancel(AbstractPipeline.java:499)at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:486)at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:472)at java.util.stream.MatchOps$MatchOp.evaluateSequential(MatchOps.java:230)at java.util.stream.MatchOps$MatchOp.evaluateSequential(MatchOps.java:196)at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)at java.util.stream.ReferencePipeline.allMatch(ReferencePipeline.java:521)at com.ericsson.bss.cassandra.ecaudit.filter.role.RoleAuditFilter.isWhitelistedUnchecked(RoleAuditFilter.java:125)at org.apache.cassandra.auth.AuthCache$2.load(AuthCache.java:188)at com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)at com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2197)at com.google.common.cache.LocalCache.get(LocalCache.java:3937)at com.google.common.cache.LocalCache.getOrLoad(LocalCache.java:3941)at com.google.common.cache.LocalCache$LocalLoadingCache.get(LocalCache.java:4824)at org.apache.cassandra.auth.AuthCache.get(AuthCache.java:107)at com.ericsson.bss.cassandra.ecaudit.filter.role.RoleAuditFilterCache.isWhitelisted(RoleAuditFilterCache.java:54)at com.ericsson.bss.cassandra.ecaudit.filter.role.RoleAuditFilter.isWhitelistedMaybeUnavailable(RoleAuditFilter.java:112)at com.ericsson.bss.cassandra.ecaudit.filter.role.RoleAuditFilter.isWhitelisted(RoleAuditFilter.java:98)at com.ericsson.bss.cassandra.ecaudit.facade.DefaultAuditor.shouldAudit(DefaultAuditor.java:85)at com.ericsson.bss.cassandra.ecaudit.facade.DefaultAuditor.audit(DefaultAuditor.java:73)at com.ericsson.bss.cassandra.ecaudit.AuditAdapter.auditRegular(AuditAdapter.java:107)at com.ericsson.bss.cassandra.ecaudit.handler.AuditQueryHandler.process$original$2CGAZzNX(AuditQueryHandler.java:108)at com.ericsson.bss.cassandra.ecaudit.handler.AuditQueryHandler.process$original$2CGAZzNX$accessor$P8AxMp4U(AuditQueryHandler.java)at com.ericsson.bss.cassandra.ecaudit.handler.AuditQueryHandler$auxiliary$dFNxmgaf.call(Unknown Source)at com.datastax.mgmtapi.interceptors.QueryHandlerInterceptor.intercept(QueryHandlerInterceptor.java:98)at com.ericsson.bss.cassandra.ecaudit.handler.AuditQueryHandler.process(AuditQueryHandler.java)at org.apache.cassandra.transport.messages.QueryMessage.execute(QueryMessage.java:116)at org.apache.cassandra.transport.Message$Dispatcher.processRequest(Message.java:688)at org.apache.cassandra.transport.Message$Dispatcher.lambda$channelRead0$0(Message.java:594)at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)at org.apache.cassandra.concurrent.AbstractLocalAwareExecutorService$FutureTask.run(AbstractLocalAwareExecutorService.java:162)at org.apache.cassandra.concurrent.SEPWorker.run(SEPWorker.java:113)at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)at java.lang.Thre

tommystendahl commented 1 year ago

Sorry for the late replay.

The whitelist is already cached in ecAudit, this exception was thrown then the cache was updated.

WentingWu666666 commented 1 year ago

Thanks for letting me know !