openGauss数据库源码解析系列文章—安全管理源码解析三（下篇）

typedef struct CreateMaskingPolicyStmt
{
NodeTag     type;
char        *policy_name;    /*  脱敏策略名称  */
List        *policy_data;    /*  脱敏策略行为  */
List        *policy_filters; /*  用户过滤条件  */
bool        policy_enabled;  /*  策略开关  */
} CreateMaskingPolicyStmt;

typedef struct PolicyFilterNode
{
NodeTag     type;
char        *node_type;  /*  逻辑操作类型，取值为“op”或“filter”  */
char        *op_value;   /*  逻辑操作符，仅当node_type为op时取值为“and”或“or”，否则为NULL  */
char        *filter_type;/*  过滤数据类型，仅当node_type为filter时取值为“APP”、“ROLES”、“IP”  */
List        *values;     /*  过滤数据值List，指出具体的过滤条件值，若node_type为op时置NULL  */
Node        *left;       /*  左子树  */
Node        *right;      /*  右子树  */
} PolicyFilterNode;

策略A：CREATE MASKING POLICY mask_A MASKALL ON LABEL(creditcard_label) FILTER ON IP(’10.123.123.123’), APP(jdbc), ROLES(user1);
策略B：CREATE MASKING POLICY mask_B CREDITCARDMASKING ON LABEL(creditcard_label) FILTER ON IP(’10.123.123.123’,’10.90.132.132’), APP(jdbc, gsql), ROLES(user1);
策略C：CREATE MASKING POLICY mask_C CREDITCARDMASKING ON LABEL(creditcard_label) FILTER ON IP(’10.123.123.123’ ,’10.90.132.132’), APP(jdbc), ROLES(user2);

class PolicyLogicalTree {
public:
    …
    bool parse_logical_expression(const gs_stl::gs_string logical_expr_str);   /*  逻辑表达式构造逻辑树入口函数  */
    bool match(const FilterData *filter_item);
    bool has_intersect(PolicyLogicalTree *arg);
private:
    gs_stl::gs_vector<PolicyLogicalNode> m_nodes;  /*  逻辑节点集合，包含了逻辑树中所有的节点  */
    gs_stl::gs_vector<int> m_flat_tree;   /*  利用数组将逻辑节点索引构造逻辑二叉树  */
    /*  逻辑表达式转换为逻辑树的递归函数  */
bool parse_logical_expression_impl(const gs_stl::gs_string logical_expr_str, int *offset, int *idx, Edirection direction); 
    inline void create_node(int *idx, EnodeType type, bool has_operator_not); /*  创建单个逻辑树节点  */
    void flatten_tree();  /*  将逻辑树刷新到m_nodes集合与m_flat_tree索引中  */
    bool check_apps_intersect(string_sort_vector*, string_sort_vector*);
    bool check_roles_intersect(oid_sort_vector*, oid_sort_vector*);
    bool m_has_ip;    /*  标识整个逻辑树是否涉及ip校验  */
    bool m_has_role;  /*  标识整个逻辑树是否涉及用户名校验  */
    bool m_has_app;   /*  标识整个逻辑树是否涉及客户端校验  */
};

struct PolicyLogicalNode {
    ...
EnodeType m_type;
int m_left;                /*  左子节点索引  */
int m_right;               /*  右子节点索引  */
void make_eval(const FilterData *filter_item); /* 判断用户信息是否满足本节点子树表示的逻辑。  */
bool m_eval_res;
oid_sort_vector m_roles;   /*  本节点包含的用户名集合  */
string_sort_vector m_apps; /*  本节点包含的客户端名称集合  */
IPRange m_ip_range;        /* 本节点包含的IP  */
};

static bool mask_expr_node(ParseState *pstate, Expr*& expr,
    const policy_set *policy_ids, masking_result *result, List* rtable, bool can_mask)
{
    if (expr == NULL) {
        return false;
    }
    switch (nodeTag(expr)) {
        case T_SubLink:
            ... /*  解析SubLink节点  */
        case T_FuncExpr:
            ... /*  解析FuncExpr节点  */
        case T_Var:
            return handle_masking_node(pstate, expr, policy_ids, result, rtable, can_mask); /*  进入最后脱敏处理过程  */
        break;
        case T_RelabelType:
            ... /*  解析RelabelType节点  */
        case T_CoerceViaIO:
            ... /*  解析CoerceViaIO节点  */
        case T_Aggref:
            ... /*  解析Aggref节点  */
        case T_OpExpr:
            ... /*  解析OpExpr节点  */
        default:
            break;
    }
    return false;
}

struct PolicyLabelItem {
    ...
    void get_fqdn_value(gs_stl::gs_string *value) const;

    bool operator < (const PolicyLabelItem& arg) const;
    bool operator == (const PolicyLabelItem& arg) const;
    bool empty() const {return strlen(m_column) == 0;}
    void set_object(const char *obj, int obj_type = 0);
    void set_object(Oid objid, int obj_type = 0);
    Oid            m_schema;     /*  数据库资源所属的namespace OID  */
    Oid            m_object;     /*  数据库资源所属的table OID  */
    char           m_column[256];/*  列名
    int            m_obj_type;   /*  资源类型，数据动态脱敏仅支持对column生效  */
};

CREATE CLIENT MASTER KEY cmk_1 WITH (KEY_STORE = LOCALKMS , KEY_PATH = "kms_1" , ALGORITHM = RSA_2048);

CREATE COLUMN ENCRYPTION KEY cek_1 WITH VALUES (CLIENT_MASTER_KEY = cmk_1, ALGORITHM = AEAD_AES_256_CBC_HMAC_SHA256);

CREATE TABLE creditcard_info (id_number int, name text encrypted with (column_encryption_key = cek_1, encryption_type = DETERMINISTIC), gender varchar(10) encrypted with (column_encryption_key = cek_1, encryption_type = DETERMINISTIC), salary float4 encrypted with (column_encryption_key = cek_1, encryption_type = DETERMINISTIC),credit_card varchar(19) encrypted with (column_encryption_key = cek_1, encryption_type = DETERMINISTIC));

/*  保存创建客户端主密钥的语法信息  */
typedef struct CreateClientLogicGlobal {
    NodeTag type;
    List *global_key_name;         /*  全密态数据库主密钥名称  */
    List *global_setting_params;  /*  全密态数据库主密钥参数，每一个元素是一个ClientLogicGlobalparam  */
} CreateClientLogicGlobal;

/*  保存客户端主密钥参数信息  */
typedef struct ClientLogicGlobalParam {
    NodeTag type;
    ClientLogicGlobalProperty key;  /*  键  */
    char *value;                       /*  值  */
    unsigned int len;                 /*  值长度  */
    int location;                     /*  位置标记  */
} ClientLogicGlobalParam;

/*  保存客户端主密钥参数的key的枚举类型 */
typedef enum class ClientLogicGlobalProperty {
    CLIENT_GLOBAL_FUNCTION,  /*  默认为encryption  */
    CMK_KEY_STORE,             /*  目前仅支持localkms  */
    CMK_KEY_PATH,              /*  密钥存储路径  */
    CMK_ALGORITHM              /*  指定加密CEK的算法  */
} ClientLogicGlobalProperty;

CREATE CLIENT MASTER KEY cmk_1 WITH (KEY_STORE = LOCALKMS , KEY_PATH = "kms_1" , ALGORITHM = RSA_2048);

/*  保存创建列加密密钥的语法信息  */
typedef struct CreateClientLogicColumn {
    NodeTag type;
    List *column_key_name;        /*  列加密密钥名称  */
    List *column_setting_params; /*  列加密密钥参数  */
} CreateClientLogicColumn;

/*  保存列加密密钥参数，保存在CreateClientLogicColumn的column_setting_params中  */
typedef struct ClientLogicColumnParam {
    NodeTag type;
    ClientLogicColumnProperty key;
    char *value;
    unsigned int len;
    List *qualname;
    int location;
} ClientLogicColumnParam;

/*  保存列加密密钥参数的key的枚举类型  */
typedef enum class ClientLogicColumnProperty {
    CLIENT_GLOBAL_SETTING,    /*  加密CEK的CMK  */
    CEK_ALGORITHM,             /*  加密用户数据的算法  */
    CEK_EXPECTED_VALUE,       /*  CEK密钥明文，可选参数  */
    COLUMN_COLUMN_FUNCTION,  /*  默认为encryption  */
} ClientLogicColumnProperty;

CREATE COLUMN ENCRYPTION KEY cek_1 WITH VALUES (CLIENT_MASTER_KEY = cmk_1, ALGORITHM = AEAD_AES_256_CBC_HMAC_SHA256);

void EncryptionPreProcess::set_new_query(char **query, size_t query_size, StringArgs string_args, int location,
    int encrypted_value_location, size_t encrypted_value_size, size_t quote_num)
{
for (size_t i = 0; i < string_args.Size(); i++) {
    /*  从string_args中读取键值存到变量中  */
        char string_to_add[MAX_KEY_ADD_LEN];
        errno_t rc = memset_s(string_to_add, MAX_KEY_ADD_LEN, 0, MAX_KEY_ADD_LEN);
        securec_check_c(rc, "\0", "\0");
        size_t total_in = 0;
        if (string_args.at(i) == NULL) {
            continue;
        }
        const char *key = string_args.at(i)->key;
        const char *value = string_args.at(i)->value;
        const size_t vallen = string_args.at(i)->valsize;
        if (!key || !value) {
            Assert(false);
            continue;
        }
        Assert(vallen < MAX_KEY_ADD_LEN);
        /*  将key和value构造成encrypted_value = '密文值'的形式  */
        check_strncat_s(strncat_s(string_to_add, MAX_KEY_ADD_LEN, key, strlen(key)));
        total_in += strlen(key);
        check_strncat_s(strncat_s(string_to_add, MAX_KEY_ADD_LEN, "=\'", strlen("=\'")));
        total_in += strlen("=\'");
        check_strncat_s(strncat_s(string_to_add, MAX_KEY_ADD_LEN, value, vallen));
        total_in += vallen;
        check_strncat_s(strncat_s(string_to_add, MAX_KEY_ADD_LEN, "\'", strlen("\'")));
        total_in += strlen("\'");
        Assert(total_in < MAX_KEY_ADD_LEN);
        /*  encrypted_value_location不为空，则说明用户提供EXPECTED_VALUE，将明文值替换成密文值   */
        if (encrypted_value_location && encrypted_value_size) {
            *query = (char *)libpq_realloc(*query, query_size, query_size + vallen + 1);
            if (*query == NULL) {
                return;
            }
            check_memset_s(memset_s(*query + query_size, vallen + 1, 0, vallen + 1));
            char *replace_dest = *query + encrypted_value_location + strlen("\'");
            char *move_src =
                *query + encrypted_value_location + encrypted_value_size + quote_num + strlen("\'");
            char *move_dest = *query + encrypted_value_location + vallen + strlen("\'");
            check_memmove_s(memmove_s(move_dest,
                query_size - encrypted_value_location - encrypted_value_size - strlen("\'") + 1,
                move_src,
                query_size - encrypted_value_location - encrypted_value_size - strlen("\'")));
            query_size = query_size + vallen - encrypted_value_size;
            check_memcpy_s(memcpy_s(replace_dest, query_size - encrypted_value_location, value, vallen));
        } else { 
/*  EXPECTED_VALUE是随机生成的，则直接插入原先的语句中  */
            check_strcat_s(strcat_s(string_to_add, MAX_KEY_ADD_LEN, ","));
            size_t string_to_add_size = strlen(string_to_add);
            *query = (char *)libpq_realloc(*query, query_size, query_size + string_to_add_size + 1);
            if (*query == NULL) {
                return;
            }
            check_memmove_s(memmove_s(*query + location + string_to_add_size, query_size - location, *query + location,
                query_size - location));
            query_size += string_to_add_size;
            check_memcpy_s(memcpy_s(*query + location, query_size - location, string_to_add, string_to_add_size));
        }
        query[0][query_size] = '\0';
    }
    return;
}

CREATE TABLE creditcard_info (id_number int, name text encrypted with (column_encryption_key = cek_1, encryption_type = DETERMINISTIC), gender varchar(10) encrypted with (column_encryption_key = cek_1, encryption_type = DETERMINISTIC), salary float4 encrypted with (column_encryption_key = cek_1, encryption_type = DETERMINISTIC),credit_card varchar(19) encrypted with (column_encryption_key = cek_1, encryption_type = DETERMINISTIC));

bool createStmtProcessor::run_pre_create_statement(const CreateStmt * const stmt, StatementData *statement_data)
{
    …
  /*  加密表列定义及约束处理  */
    foreach (elements, stmt->tableElts) {
        Node *element = (Node *)lfirst(elements);
        switch (nodeTag(element)) {
            case T_ColumnDef: {
                …
               /*  校验distribute by是否符合规格  */
                if (column->colname != NULL &&
                    !check_distributeby(stmt->distributeby, column->colname)) {
                    return false;
                }
               /*  列定义处理，存储加密类型，加密密钥等信息  */
                if (!process_column_defintion(column, element, &expr_vec, &cached_columns, 
                    &cached_columns_for_defaults, statement_data)) {
                    return false;
                }
                break;
            }
            /*  处理check, unique 或其他约束  */
            case T_Constraint: {
                Constraint *constraint = (Constraint*)element;
                if (constraint->keys != NULL) {
                    ListCell *ixcell = NULL;
                    foreach (ixcell, constraint->keys) {
                        char *ikname = strVal(lfirst(ixcell));
                        for (size_t i = 0; i < cached_columns.size(); i++) {
                            if (strcmp((cached_columns.at(i))->get_col_name(), ikname) == 0 && !check_constraint(
                                constraint, cached_columns.at(i)->get_data_type(), ikname, &cached_columns)) {
                                return false;
                            }
                        }
                    }
                } else if (constraint->raw_expr != NULL) {
                    if (!transform_expr(constraint->raw_expr, "", &cached_columns)) {
                        return false;
                    }
                }
                break;
            }
            default:
                break;
        }
    }
     …
    /*  加密约束中需要加密的明文数据  */
    if (!RawValues::get_raw_values_from_consts_vec(&expr_vec, statement_data, 0, &raw_values_list)) {
        return false;
    }
    return ValuesProcessor::process_values(statement_data, &cached_columns_for_defaults, 1,
        &raw_values_list);
}

int encrypt_data(const unsigned char *plain_text, int plain_text_length, const AeadAesHamcEncKey &column_encryption_key,
    EncryptionType encryption_type, unsigned char *result, ColumnEncryptionAlgorithm column_encryption_algorithm)
{
    ……
    /*  得到16位的iv值  */
    unsigned char _iv [g_key_size + 1] = {0};
unsigned char iv_truncated[g_iv_size + 1] = {0};
/*  确定性加密，则通过hmac_sha256生成iv  */
    if (encryption_type == EncryptionType::DETERMINISTIC_TYPE) {
           hmac_sha256(column_encryption_key.get_iv_key(), g_auth_tag_size, plain_text, plain_text_length, _iv);
       ……
} else {
/*  随机加密，则随机生成iv  */
        if (encryption_type != EncryptionType::RANDOMIZED_TYPE) {
            return 0; 
        }
        int res = RAND_priv_bytes(iv_truncated, g_block_size);
        if (res != 1) {
            return 0;
        }
    }
    int cipherStart = g_algo_version_size + g_auth_tag_size + g_iv_size;
    /*  调用encrypt计算密文  */
int cipherTextSize = encrypt(plain_text, plain_text_length, column_encryption_key.get_encyption_key(), iv_truncated,
        result + cipherStart, column_encryption_algorithm);
   ……
    int ivStartIndex = g_auth_tag_size + g_algo_version_size;
    res = memcpy_s(result + ivStartIndex, g_iv_size, iv_truncated, g_iv_size);
    securec_check_c(res, "\0", "\0");
    /*  计算 HMAC  */
    int hmacDataSize = g_algo_version_size + g_iv_size + cipherTextSize;
    hmac_sha256(column_encryption_key.get_mac_key(), g_auth_tag_size,
                result + g_auth_tag_size, hmacDataSize, result); 
    return (g_auth_tag_size + hmacDataSize);
}

bool Processor::run_pre_select_statement(const SelectStmt * const select_stmt, const SetOperation &parent_set_operation,
    const bool &parent_all, StatementData *statement_data, ICachedColumns *cached_columns, ICachedColumns *cached_columns_parents)
{
bool select_res = false;
/*  处理SELECT语句中的集合操作  */
    if (select_stmt->op != SETOP_NONE) {
        select_res = process_select_set_operation(select_stmt, statement_data, cached_columns);
        RETURN_IF(!select_res);
    }
    /*  处理WHERE子句  */
    ExprPartsList where_expr_parts_list;
    select_res = exprProcessor::expand_expr(select_stmt->whereClause, statement_data, &where_expr_parts_list);
    RETURN_IF(!select_res);
……
    /*  从FROM子句中获取缓存加密列  */
CachedColumns cached_columns_from(false, true);
    select_res = run_pre_from_list_statement(select_stmt->fromClause, statement_data, &cached_columns_from,
        cached_columns_parents);
……
/*  将查询的加密列放在cached_columns结构中  */
    for (size_t i = 0; i < cached_columns_from.size(); i++) {
        if (find_in_name_map(target_list, cached_columns_from.at(i)->get_col_name())) {
            CachedColumn *target = new (std::nothrow) CachedColumn(cached_columns_from.at(i));
            if (target == NULL) {
                fprintf(stderr, "failed to new CachedColumn object\n");
                return false;
            }
            cached_columns->push(target);
        }
    }
    if (cached_columns_from.is_empty()) {
        return true; 
    }
    /*  加密列不支持ORDER BY（排序）操作  */
    if (!deal_order_by_statement(select_stmt, cached_columns)) {
        return false;
    }
   
/*  将WHERE子句中加密的值进行加密处理  */
    if (!WhereClauseProcessor::process(&cached_columns_from, &where_expr_parts_list, statement_data)) {
        return false;
}
……
    return true;
}

int decrypt_data(const unsigned char *cipher_text, int cipher_text_length,
    const AeadAesHamcEncKey &column_encryption_key, unsigned char *decryptedtext,
    ColumnEncryptionAlgorithm column_encryption_algorithm)
{
    if (cipher_text == NULL || cipher_text_length <= 0 || decryptedtext == NULL) {
        return 0;
    }
    /*  校验密文长度  */
    if (cipher_text_length < min_ciph_len_in_bytes_with_authen_tag) {
        printf("ERROR(CLIENT): The length of cipher_text is invalid, cannot decrypt.\n");
        return 0;
    }
    /*  校验密文中的版本号  */
    if (cipher_text[g_auth_tag_size] != '1') {
        printf("ERROR(CLIENT): Version byte of cipher_text is invalid, cannot decrypt.\n");
        return 0;
    }
    ……
    /*  计算MAC标签  */
    unsigned char authenticationTag [g_auth_tag_size] = {0};
    int HMAC_length = cipher_text_length - g_auth_tag_size;
    int res = hmac_sha256(column_encryption_key.get_mac_key(), g_auth_tag_size,
        cipher_text + g_auth_tag_size, HMAC_length, authenticationTag);
    if (res != 1) {
        printf("ERROR(CLIENT): Fail to compute a keyed hash of a given text.\n");
        return 0;
    }
    /*  校验密文是否被篡改  */
    int cmp_result = my_memcmp(authenticationTag, cipher_text, g_auth_tag_size);
    /*  解密数据  */
    int decryptedtext_len = decrypt(cipher_text + cipher_start_index, cipher_value_length,
        column_encryption_key.get_encyption_key(), iv, decryptedtext, column_encryption_algorithm);
    if (decryptedtext_len < 0) {
        return 0;
    }
    decryptedtext[decryptedtext_len] = '\0';
    return decryptedtext_len;
}