rancher/steve
1
0
Fork 0
mirror of https://github.com/rancher/steve.git synced 2025-09-08 10:49:25 +00:00
Code Issues Projects Releases Wiki Activity

Respect shouldEncrypt configuration when storing events (#725)

Browse Source
This commit is contained in:
Tom Lebreux
2025-07-15 09:57:28 -04:00
committed by GitHub
parent 904e52dc11
commit 0c2c554c8c
7 changed files with 264 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
pkg/sqlcache/informer/listoption_indexer.go
View File

@@ -87,9 +87,11 @@ const (
rv TEXT NOT NULL,
type TEXT NOT NULL,
event BLOB NOT NULL,
eventnonce BLOB,
dekid BLOB,
PRIMARY KEY (type, rv)
)`
listEventsAfterFmt = `SELECT type, rv, event
listEventsAfterFmt = `SELECT type, rv, event, eventnonce, dekid
FROM "%s_events"
WHERE rowid > ?
`
@@ -243,7 +245,7 @@ func NewListOptionIndexer(ctx context.Context, s Store, opts ListOptionIndexerOp
}
l.upsertEventsQuery = fmt.Sprintf(
`REPLACE INTO "%s_events"(rv, type, event) VALUES (?, ?, ?)`,
`REPLACE INTO "%s_events"(rv, type, event, eventnonce, dekid) VALUES (?, ?, ?, ?, ?)`,
dbName,
)
l.upsertEventsStmt = l.Prepare(l.upsertEventsQuery)
@@ -321,9 +323,7 @@ func (l *ListOptionIndexer) Watch(ctx context.Context, opts WatchOptions, events
defer rows.Close()
for rows.Next() {
var typ, rv string
var buf sql.RawBytes
err := rows.Scan(&typ, &rv, &buf)
typ, buf, err := l.decryptScanEvent(rows)
if err != nil {
return fmt.Errorf("scanning event row: %w", err)
}
@@ -370,6 +370,24 @@ func (l *ListOptionIndexer) Watch(ctx context.Context, opts WatchOptions, events
return nil
}
func (l *ListOptionIndexer) decryptScanEvent(rows db.Rows) (watch.EventType, []byte, error) {
var typ, rv string
var event, eventNonce sql.RawBytes
var kid uint32
err := rows.Scan(&typ, &rv, &event, &eventNonce, &kid)
if err != nil {
return watch.Error, nil, err
}
if l.Decryptor() != nil && l.GetShouldEncrypt() {
decryptedData, err := l.Decryptor().Decrypt(event, eventNonce, kid)
if err != nil {
return watch.Error, nil, err
}
return watch.EventType(typ), decryptedData, nil
}
return watch.EventType(typ), event, nil
}
func toBytes(obj any) []byte {
var buf bytes.Buffer
enc := gob.NewEncoder(&buf)
@@ -452,9 +470,10 @@ func (l *ListOptionIndexer) notifyEvent(eventType watch.EventType, oldObj any, o
}
latestRV := acc.GetResourceVersion()
_, err = tx.Stmt(l.upsertEventsStmt).Exec(latestRV, eventType, toBytes(obj))
err = l.upsertEvent(tx, eventType, latestRV, obj)
if err != nil {
return &db.QueryError{QueryString: l.upsertEventsQuery, Err: err}
return err
}
l.watchersLock.RLock()
@@ -476,6 +495,26 @@ func (l *ListOptionIndexer) notifyEvent(eventType watch.EventType, oldObj any, o
return nil
}
func (l *ListOptionIndexer) upsertEvent(tx transaction.Client, eventType watch.EventType, latestRV string, obj any) error {
objBytes := toBytes(obj)
var dataNonce []byte
var err error
var kid uint32
if l.Encryptor() != nil && l.GetShouldEncrypt() {
objBytes, dataNonce, kid, err = l.Encryptor().Encrypt(objBytes)
if err != nil {
return err
}
}
_, err = tx.Stmt(l.upsertEventsStmt).Exec(latestRV, eventType, objBytes, dataNonce, kid)
if err != nil {
return &db.QueryError{QueryString: l.upsertEventsQuery, Err: err}
}
return err
}
// addIndexFields saves sortable/filterable fields into tables
func (l *ListOptionIndexer) addIndexFields(key string, obj any, tx transaction.Client) error {
args := []any{key}