| // Licensed to the Apache Software Foundation (ASF) under one |
| // or more contributor license agreements. See the NOTICE file |
| // distributed with this work for additional information |
| // regarding copyright ownership. The ASF licenses this file |
| // to you under the Apache License, Version 2.0 (the |
| // "License"); you may not use this file except in compliance |
| // the License. You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, |
| // software distributed under the License is distributed on an |
| // "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| // KIND, either express or implied. See the License for the |
| // specific language governing permissions and limitations |
| // under the License. |
| package com.cloud.utils.crypt; |
| |
| import java.io.BufferedWriter; |
| import java.io.File; |
| import java.io.FileInputStream; |
| import java.io.FileNotFoundException; |
| import java.io.FileWriter; |
| import java.io.IOException; |
| import java.lang.reflect.Field; |
| import java.nio.charset.StandardCharsets; |
| import java.sql.Connection; |
| import java.sql.DatabaseMetaData; |
| import java.sql.PreparedStatement; |
| import java.sql.ResultSet; |
| import java.sql.SQLException; |
| import java.util.Arrays; |
| import java.util.Date; |
| import java.util.HashMap; |
| import java.util.HashSet; |
| import java.util.Map; |
| import java.util.Properties; |
| import java.util.Set; |
| import java.util.stream.Collectors; |
| |
| import org.apache.commons.cli.CommandLine; |
| import org.apache.commons.cli.CommandLineParser; |
| import org.apache.commons.cli.DefaultParser; |
| import org.apache.commons.cli.HelpFormatter; |
| import org.apache.commons.cli.Option; |
| import org.apache.commons.cli.Options; |
| import org.apache.commons.cli.ParseException; |
| import org.apache.commons.configuration.ConfigurationException; |
| import org.apache.commons.configuration.PropertiesConfiguration; |
| import org.apache.commons.lang3.StringUtils; |
| |
| import com.cloud.utils.PropertiesUtil; |
| import com.cloud.utils.ReflectUtil; |
| import com.cloud.utils.db.Encrypt; |
| import com.cloud.utils.db.TransactionLegacy; |
| import com.cloud.utils.exception.CloudRuntimeException; |
| |
| import com.google.gson.Gson; |
| import com.google.gson.JsonSyntaxException; |
| |
| import javax.persistence.Column; |
| import javax.persistence.Table; |
| |
| /* |
| * EncryptionSecretKeyChanger updates Management Secret Key / DB Secret Key or both. |
| * DB secret key is validated against the key in db.properties |
| * db.properties is updated with values encrypted using new MS secret key |
| * server.properties is updated with values encrypted using new MS secret key |
| * DB data migrated using new DB secret key |
| */ |
| public class EncryptionSecretKeyChanger { |
| |
| private CloudStackEncryptor oldEncryptor; |
| private CloudStackEncryptor newEncryptor; |
| private static final String KEY_FILE = "/etc/cloudstack/management/key"; |
| private static final String ENV_NEW_MANAGEMENT_KEY = "CLOUD_SECRET_KEY_NEW"; |
| private final Gson gson = new Gson(); |
| private static final String PASSWORD = "password"; |
| |
| private static final Options options = initializeOptions(); |
| private static final HelpFormatter helper = initializeHelper(); |
| private static final String CMD_LINE_SYNTAX = "cloudstack-migrate-databases"; |
| private static final int WIDTH = 100; |
| private static final String HEADER = "Options:"; |
| private static final String FOOTER = " \nExamples: \n" + |
| " " + CMD_LINE_SYNTAX + " -m password -d password -n newmgmtkey -v V2 \n" + |
| " Migrate cloudstack properties (db.properties and server.properties) \n" + |
| " with new management key and encryptor V2. \n" + |
| " " + CMD_LINE_SYNTAX + " -m password -d password -n newmgmtkey -e newdbkey \n" + |
| " Migrate cloudstack properties and databases with new management key and database secret key. \n" + |
| " " + CMD_LINE_SYNTAX + " -m password -d password -n newmgmtkey -e newdbkey -s -v V2 \n" + |
| " Migrate cloudstack properties with new keys and encryptor V2, but skip database migration. \n" + |
| " " + CMD_LINE_SYNTAX + " -m password -d password -l -f \n" + |
| " Migrate cloudstack properties with new management key (load from $CLOUD_SECRET_KEY_NEW), \n" + |
| " and migrate database with old db key. \n" + |
| " \nReturn codes: \n" + |
| " 0 - Succeed to change keys and/or migrate databases \n" + |
| " 1 - Fail to parse the command line arguments \n" + |
| " 2 - Fail to validate parameters \n" + |
| " 3 - Fail to migrate database"; |
| private static final String OLD_MS_KEY_OPTION = "oldMSKey"; |
| private static final String OLD_DB_KEY_OPTION = "oldDBKey"; |
| private static final String NEW_MS_KEY_OPTION = "newMSKey"; |
| private static final String NEW_DB_KEY_OPTION = "newDBKey"; |
| private static final String ENCRYPTOR_VERSION_OPTION = "version"; |
| private static final String LOAD_NEW_MS_KEY_FROM_ENV_FLAG = "load-new-management-key-from-env"; |
| private static final String FORCE_DATABASE_MIGRATION_FLAG = "force-database-migration"; |
| private static final String SKIP_DATABASE_MIGRATION_FLAG = "skip-database-migration"; |
| private static final String HELP_FLAG = "help"; |
| |
| public static void main(String[] args) { |
| if (args.length == 0 || StringUtils.equalsAny(args[0], "-h", "--help")) { |
| helper.printHelp(WIDTH, CMD_LINE_SYNTAX, HEADER, options, FOOTER, true); |
| System.exit(0); |
| } |
| |
| CommandLine cmdLine = null; |
| CommandLineParser parser = new DefaultParser(); |
| try { |
| cmdLine = parser.parse(options, args); |
| } catch (ParseException e) { |
| System.out.println(e.getMessage()); |
| helper.printHelp(WIDTH, CMD_LINE_SYNTAX, HEADER, options, FOOTER, true); |
| System.exit(1); |
| } |
| |
| String oldMSKey = cmdLine.getOptionValue(OLD_MS_KEY_OPTION); |
| String oldDBKey = cmdLine.getOptionValue(OLD_DB_KEY_OPTION); |
| String newMSKey = cmdLine.getOptionValue(NEW_MS_KEY_OPTION); |
| String newDBKey = cmdLine.getOptionValue(NEW_DB_KEY_OPTION); |
| String newEncryptorVersion = cmdLine.getOptionValue(ENCRYPTOR_VERSION_OPTION); |
| boolean loadNewMsKeyFromEnv = cmdLine.hasOption(LOAD_NEW_MS_KEY_FROM_ENV_FLAG); |
| boolean forced = cmdLine.hasOption(FORCE_DATABASE_MIGRATION_FLAG); |
| boolean skipped = cmdLine.hasOption(SKIP_DATABASE_MIGRATION_FLAG); |
| |
| if (!validateParameters(oldMSKey, oldDBKey, newMSKey, newDBKey, newEncryptorVersion, loadNewMsKeyFromEnv)) { |
| helper.printHelp(WIDTH, CMD_LINE_SYNTAX, HEADER, options, FOOTER, true); |
| System.exit(2); |
| } |
| |
| System.out.println("Started database migration at " + new Date()); |
| if (!migratePropertiesAndDatabase(oldMSKey, oldDBKey, newMSKey, newDBKey, newEncryptorVersion, loadNewMsKeyFromEnv, forced, skipped)) { |
| System.out.println("Got error during database migration at " + new Date()); |
| System.exit(3); |
| } |
| System.out.println("Finished database migration at " + new Date()); |
| } |
| |
| private static Options initializeOptions() { |
| Options options = new Options(); |
| |
| Option oldMSKey = Option.builder("m").longOpt(OLD_MS_KEY_OPTION).argName(OLD_MS_KEY_OPTION).required(true).hasArg().desc("(required) Current Mgmt Secret Key").build(); |
| Option oldDBKey = Option.builder("d").longOpt(OLD_DB_KEY_OPTION).argName(OLD_DB_KEY_OPTION).required(true).hasArg().desc("(required) Current DB Secret Key").build(); |
| Option newMSKey = Option.builder("n").longOpt(NEW_MS_KEY_OPTION).argName(NEW_MS_KEY_OPTION).required(false).hasArg().desc("New Mgmt Secret Key").build(); |
| Option newDBKey = Option.builder("e").longOpt(NEW_DB_KEY_OPTION).argName(NEW_DB_KEY_OPTION).required(false).hasArg().desc("New DB Secret Key").build(); |
| Option encryptorVersion = Option.builder("v").longOpt(ENCRYPTOR_VERSION_OPTION).argName(ENCRYPTOR_VERSION_OPTION).required(false).hasArg().desc("New DB Encryptor Version. Options are V1, V2.").build(); |
| |
| Option loadNewMsKeyFromEnv = Option.builder("l").longOpt(LOAD_NEW_MS_KEY_FROM_ENV_FLAG).desc("Load new management key from environment variable " + ENV_NEW_MANAGEMENT_KEY).build(); |
| Option forceDatabaseMigration = Option.builder("f").longOpt(FORCE_DATABASE_MIGRATION_FLAG).desc("Force database migration even if DB Secret key is not changed").build(); |
| Option skipDatabaseMigration = Option.builder("s").longOpt(SKIP_DATABASE_MIGRATION_FLAG).desc("Skip database migration even if DB Secret key is changed").build(); |
| Option help = Option.builder("h").longOpt(HELP_FLAG).desc("Show help message").build(); |
| |
| options.addOption(oldMSKey); |
| options.addOption(oldDBKey); |
| options.addOption(newMSKey); |
| options.addOption(newDBKey); |
| options.addOption(encryptorVersion); |
| options.addOption(loadNewMsKeyFromEnv); |
| options.addOption(forceDatabaseMigration); |
| options.addOption(skipDatabaseMigration); |
| options.addOption(help); |
| |
| return options; |
| } |
| |
| private static HelpFormatter initializeHelper() { |
| HelpFormatter helper = new HelpFormatter(); |
| |
| helper.setOptionComparator((o1, o2) -> { |
| if (o1.isRequired() && !o2.isRequired()) { |
| return -1; |
| } |
| if (!o1.isRequired() && o2.isRequired()) { |
| return 1; |
| } |
| if (o1.hasArg() && !o2.hasArg()) { |
| return -1; |
| } |
| if (!o1.hasArg() && o2.hasArg()) { |
| return 1; |
| } |
| return o1.getOpt().compareTo(o2.getOpt()); |
| }); |
| |
| return helper; |
| } |
| |
| private static boolean validateParameters(String oldMSKey, String oldDBKey, String newMSKey, String newDBKey, |
| String newEncryptorVersion, boolean loadNewMsKeyFromEnv) { |
| |
| if (oldMSKey == null || oldDBKey == null) { |
| System.out.println("Existing Management secret key or DB secret key is not provided"); |
| return false; |
| } |
| |
| if (loadNewMsKeyFromEnv) { |
| if (StringUtils.isNotEmpty(newMSKey)) { |
| System.out.println("The new management key has already been set. Please check if it is set twice."); |
| return false; |
| } |
| newMSKey = System.getenv(ENV_NEW_MANAGEMENT_KEY); |
| if (StringUtils.isEmpty(newMSKey)) { |
| System.out.println("Environment variable " + ENV_NEW_MANAGEMENT_KEY + " is not set or empty"); |
| return false; |
| } |
| } |
| |
| if (newMSKey == null && newDBKey == null) { |
| System.out.println("New Management secret key and DB secret are both not provided"); |
| return false; |
| } |
| |
| if (newEncryptorVersion != null) { |
| try { |
| CloudStackEncryptor.EncryptorVersion.fromString(newEncryptorVersion); |
| } catch (CloudRuntimeException ex) { |
| System.out.println(ex.getMessage()); |
| return false; |
| } |
| } |
| |
| return true; |
| } |
| |
| private static boolean migratePropertiesAndDatabase(String oldMSKey, String oldDBKey, String newMSKey, String newDBKey, |
| String newEncryptorVersion, boolean loadNewMsKeyFromEnv, |
| boolean forced, boolean skipped) { |
| |
| final File dbPropsFile = PropertiesUtil.findConfigFile("db.properties"); |
| final Properties dbProps = new Properties(); |
| EncryptionSecretKeyChanger keyChanger = new EncryptionSecretKeyChanger(); |
| PropertiesConfiguration backupDBProps = null; |
| |
| System.out.println("Parsing db.properties file"); |
| try(FileInputStream dbPropFstream = new FileInputStream(dbPropsFile)) { |
| dbProps.load(dbPropFstream); |
| backupDBProps = new PropertiesConfiguration(dbPropsFile); |
| } catch (FileNotFoundException e) { |
| System.out.println("db.properties file not found while reading DB secret key: " + e.getMessage()); |
| return false; |
| } catch (IOException e) { |
| System.out.println("Error while reading DB secret key from db.properties: " + e.getMessage()); |
| return false; |
| } catch (ConfigurationException e) { |
| System.out.println("Error while getting configurations from db.properties: " + e.getMessage()); |
| return false; |
| } |
| |
| try { |
| EncryptionSecretKeyChecker.initEncryptor(oldMSKey); |
| EncryptionSecretKeyChecker.decryptAnyProperties(dbProps); |
| } catch (CloudRuntimeException e) { |
| System.out.println("Error: Incorrect Management Secret Key"); |
| return false; |
| } |
| String dbSecretKey = dbProps.getProperty("db.cloud.encrypt.secret"); |
| |
| if (!oldDBKey.equals(dbSecretKey)) { |
| System.out.println("Error: Incorrect DB Secret Key"); |
| return false; |
| } |
| |
| System.out.println("DB Secret key provided matched the key in db.properties"); |
| final String encryptionType = dbProps.getProperty("db.cloud.encryption.type"); |
| final String oldEncryptorVersion = dbProps.getProperty("db.cloud.encryptor.version"); |
| |
| // validate old and new encryptor versions |
| try { |
| CloudStackEncryptor.EncryptorVersion.fromString(oldEncryptorVersion); |
| CloudStackEncryptor.EncryptorVersion.fromString(newEncryptorVersion); |
| } catch (CloudRuntimeException ex) { |
| System.out.println(ex.getMessage()); |
| return false; |
| } |
| |
| if (loadNewMsKeyFromEnv) { |
| newMSKey = System.getenv(ENV_NEW_MANAGEMENT_KEY); |
| } |
| if (newMSKey == null) { |
| newMSKey = oldMSKey; |
| } |
| if (newDBKey == null) { |
| newDBKey = oldDBKey; |
| } |
| boolean isMSKeyChanged = !newMSKey.equals(oldMSKey); |
| boolean isDBKeyChanged = !newDBKey.equals(oldDBKey); |
| if (newEncryptorVersion == null && (isDBKeyChanged || forced) && !skipped) { |
| if (StringUtils.isNotEmpty(oldEncryptorVersion)) { |
| newEncryptorVersion = oldEncryptorVersion; |
| } else { |
| newEncryptorVersion = CloudStackEncryptor.EncryptorVersion.defaultVersion().name(); |
| } |
| } |
| boolean isEncryptorVersionChanged = false; |
| if (newEncryptorVersion != null) { |
| isEncryptorVersionChanged = !newEncryptorVersion.equalsIgnoreCase(oldEncryptorVersion); |
| } |
| |
| if (isMSKeyChanged || isDBKeyChanged || isEncryptorVersionChanged) { |
| System.out.println("INFO: Migrate properties with DB encryptor version: " + newEncryptorVersion); |
| if (!keyChanger.migrateProperties(dbPropsFile, dbProps, newMSKey, newDBKey, newEncryptorVersion)) { |
| System.out.println("Failed to update db.properties"); |
| return false; |
| } |
| if (!keyChanger.migrateServerProperties(newMSKey)) { |
| System.out.println("Failed to update server.properties"); |
| return false; |
| } |
| //db.properties updated successfully |
| if (encryptionType.equals("file")) { |
| //update key file with new MS key |
| try (FileWriter fwriter = new FileWriter(KEY_FILE); |
| BufferedWriter bwriter = new BufferedWriter(fwriter)) |
| { |
| bwriter.write(newMSKey); |
| } catch (IOException e) { |
| System.out.printf("Please update the file %s manually. Failed to write new secret to file with error %s %n", KEY_FILE, e.getMessage()); |
| return false; |
| } |
| } |
| } else { |
| System.out.println("No changes with Management Secret Key, DB Secret Key and DB encryptor version. Skipping migrating db.properties"); |
| } |
| |
| boolean success = false; |
| if (isDBKeyChanged || isEncryptorVersionChanged || forced) { |
| if (skipped) { |
| System.out.println("Skipping Data Migration as '-s' or '--skip-database-migration' is passed"); |
| return true; |
| } |
| EncryptionSecretKeyChecker.initEncryptor(newMSKey); |
| try { |
| success = keyChanger.migrateData(oldDBKey, newDBKey, oldEncryptorVersion, newEncryptorVersion); |
| } catch (Exception e) { |
| System.out.println("Error during data migration"); |
| e.printStackTrace(); |
| } |
| } else { |
| System.out.println("No changes with DB Secret Key and DB encryptor version. Skipping Data Migration"); |
| return true; |
| } |
| |
| if (success) { |
| System.out.println("Successfully updated secret key(s)"); |
| } else { |
| System.out.println("Data Migration failed. Reverting db.properties"); |
| //revert db.properties |
| try { |
| backupDBProps.save(); |
| } catch (ConfigurationException e) { |
| e.printStackTrace(); |
| } |
| if (encryptionType.equals("file")) { |
| //revert secret key in file |
| try (FileWriter fwriter = new FileWriter(KEY_FILE); |
| BufferedWriter bwriter = new BufferedWriter(fwriter)) |
| { |
| bwriter.write(oldMSKey); |
| } catch (IOException e) { |
| System.out.println("Failed to revert to old secret to file. Please update the file manually"); |
| } |
| } |
| return false; |
| } |
| |
| return true; |
| } |
| |
| private boolean migrateServerProperties(String newMSKey) { |
| System.out.println("Migrating server.properties.."); |
| final File serverPropsFile = PropertiesUtil.findConfigFile("server.properties"); |
| final Properties serverProps = new Properties(); |
| PropertiesConfiguration newServerProps; |
| |
| try(FileInputStream serverPropFstream = new FileInputStream(serverPropsFile)) { |
| serverProps.load(serverPropFstream); |
| newServerProps = new PropertiesConfiguration(serverPropsFile); |
| } catch (FileNotFoundException e) { |
| System.out.println("server.properties file not found: " + e.getMessage()); |
| return false; |
| } catch (IOException e) { |
| System.out.println("Error while reading server.properties: " + e.getMessage()); |
| return false; |
| } catch (ConfigurationException e) { |
| System.out.println("Error while getting configurations from server.properties: " + e.getMessage()); |
| return false; |
| } |
| |
| try { |
| EncryptionSecretKeyChecker.decryptAnyProperties(serverProps); |
| } catch (CloudRuntimeException e) { |
| System.out.println(e.getMessage()); |
| return false; |
| } |
| |
| CloudStackEncryptor msEncryptor = new CloudStackEncryptor(newMSKey, null, getClass()); |
| |
| try { |
| String encryptionType = serverProps.getProperty("password.encryption.type"); |
| if (StringUtils.isEmpty(encryptionType) || encryptionType.equalsIgnoreCase("none")) { |
| System.out.println("Skipping server.properties as password.encryption.type is " + encryptionType); |
| return true; |
| } |
| String keystorePassword = serverProps.getProperty("https.keystore.password"); |
| if (StringUtils.isNotEmpty(keystorePassword)) { |
| newServerProps.setProperty("https.keystore.password", "ENC(" + msEncryptor.encrypt(keystorePassword) + ")"); |
| } |
| newServerProps.save(serverPropsFile.getAbsolutePath()); |
| } catch (Exception e) { |
| System.out.println(e.getMessage()); |
| return false; |
| } |
| System.out.println("Migrating server.properties Done."); |
| return true; |
| } |
| |
| private boolean migrateProperties(File dbPropsFile, Properties dbProps, String newMSKey, String newDBKey, String newEncryptorVersion) { |
| System.out.println("Migrating db.properties.."); |
| CloudStackEncryptor msEncryptor = new CloudStackEncryptor(newMSKey, null, getClass()); |
| |
| try { |
| PropertiesConfiguration newDBProps = new PropertiesConfiguration(dbPropsFile); |
| if (StringUtils.isNotEmpty(newDBKey)) { |
| newDBProps.setProperty("db.cloud.encrypt.secret", "ENC(" + msEncryptor.encrypt(newDBKey) + ")"); |
| } |
| String prop = dbProps.getProperty("db.cloud.password"); |
| if (StringUtils.isNotEmpty(prop)) { |
| newDBProps.setProperty("db.cloud.password", "ENC(" + msEncryptor.encrypt(prop) + ")"); |
| } |
| prop = dbProps.getProperty("db.usage.password"); |
| if (StringUtils.isNotEmpty(prop)) { |
| newDBProps.setProperty("db.usage.password", "ENC(" + msEncryptor.encrypt(prop) + ")"); |
| } |
| if (newEncryptorVersion != null) { |
| newDBProps.setProperty("db.cloud.encryptor.version", newEncryptorVersion); |
| } |
| newDBProps.save(dbPropsFile.getAbsolutePath()); |
| } catch (Exception e) { |
| e.printStackTrace(); |
| return false; |
| } |
| System.out.println("Migrating db.properties Done."); |
| return true; |
| } |
| |
| private boolean migrateData(String oldDBKey, String newDBKey, String oldEncryptorVersion, String newEncryptorVersion) throws SQLException { |
| System.out.println("Begin Data migration"); |
| oldEncryptor = new CloudStackEncryptor(oldDBKey, oldEncryptorVersion, getClass()); |
| newEncryptor = new CloudStackEncryptor(newDBKey, newEncryptorVersion, getClass()); |
| System.out.println("Initialised Encryptors"); |
| |
| TransactionLegacy txn = TransactionLegacy.open("Migrate"); |
| txn.start(); |
| try { |
| Connection conn; |
| try { |
| conn = txn.getConnection(); |
| } catch (SQLException e) { |
| System.out.println("Unable to migrate encrypted data in the database due to: " + e.getMessage()); |
| throw new CloudRuntimeException("Unable to migrate encrypted data in the database", e); |
| } |
| |
| // migrate values in configuration |
| migrateConfigValues(conn); |
| |
| // migrate resource details values |
| migrateHostDetails(conn); |
| migrateEncryptedAccountDetails(conn); |
| migrateEncryptedDomainDetails(conn); |
| migrateClusterDetails(conn); |
| migrateImageStoreDetails(conn); |
| migrateStoragePoolDetails(conn); |
| migrateScaleIOStoragePoolDetails(conn); |
| migrateUserVmDetails(conn); |
| |
| // migrate other encrypted fields |
| migrateTemplateDeployAsIsDetails(conn); |
| migrateImageStoreUrlForCifs(conn); |
| migrateStoragePoolPathForSMB(conn); |
| |
| // migrate columns with annotation @Encrypt |
| migrateEncryptedTableColumns(conn); |
| |
| txn.commit(); |
| } finally { |
| txn.close(); |
| } |
| System.out.println("End Data migration"); |
| return true; |
| } |
| |
| private void migrateEncryptedAccountDetails(Connection conn) { |
| System.out.println("Beginning migration of account_details encrypted values"); |
| |
| String tableName = "account_details"; |
| String selectSql = "SELECT details.id, details.value from account_details details, cloud.configuration c " + |
| "WHERE details.name = c.name AND c.category IN ('Hidden', 'Secure') AND details.value <> \"\" ORDER BY details.id;"; |
| String updateSql = "UPDATE cloud.account_details SET value = ? WHERE id = ?;"; |
| migrateValueAndUpdateDatabaseById(conn, tableName, selectSql, updateSql, false); |
| |
| System.out.println("End migration of account details values"); |
| } |
| |
| private void migrateEncryptedDomainDetails(Connection conn) { |
| System.out.println("Beginning migration of domain_details encrypted values"); |
| |
| String tableName = "domain_details"; |
| String selectSql = "SELECT details.id, details.value from domain_details details, cloud.configuration c " + |
| "WHERE details.name = c.name AND c.category IN ('Hidden', 'Secure') AND details.value <> \"\" ORDER BY details.id;"; |
| String updateSql = "UPDATE cloud.domain_details SET value = ? WHERE id = ?;"; |
| migrateValueAndUpdateDatabaseById(conn, tableName, selectSql, updateSql, false); |
| |
| System.out.println("End migration of domain details values"); |
| } |
| |
| protected String migrateValue(String value) { |
| if (StringUtils.isEmpty(value)) { |
| return value; |
| } |
| String decryptVal = oldEncryptor.decrypt(value); |
| return newEncryptor.encrypt(decryptVal); |
| } |
| |
| protected String migrateUrlOrPath(String urlOrPath) { |
| if (StringUtils.isEmpty(urlOrPath)) { |
| return urlOrPath; |
| } |
| String[] properties = urlOrPath.split("&"); |
| for (String property : properties) { |
| if (property.startsWith("password=")) { |
| String password = property.substring(property.indexOf("=") + 1); |
| password = migrateValue(password); |
| return urlOrPath.replaceAll(property, "password=" + password); |
| } |
| } |
| return urlOrPath; |
| } |
| |
| private void migrateConfigValues(Connection conn) { |
| System.out.println("Begin migrate config values"); |
| |
| String tableName = "configuration"; |
| String selectSql = "SELECT name, value FROM configuration WHERE category IN ('Hidden', 'Secure')"; |
| String updateSql = "UPDATE configuration SET value=? WHERE name=?"; |
| migrateValueAndUpdateDatabaseByName(conn, tableName, selectSql, updateSql); |
| |
| System.out.println("End migrate config values"); |
| } |
| |
| |
| private void migrateValueAndUpdateDatabaseById(Connection conn, String tableName, String selectSql, String updateSql, boolean isUrlOrPath) { |
| try( PreparedStatement selectPstmt = conn.prepareStatement(selectSql); |
| ResultSet rs = selectPstmt.executeQuery(); |
| PreparedStatement updatePstmt = conn.prepareStatement(updateSql) |
| ) { |
| while (rs.next()) { |
| long id = rs.getLong(1); |
| String value = rs.getString(2); |
| if (StringUtils.isEmpty(value)) { |
| continue; |
| } |
| String encryptedValue = isUrlOrPath ? migrateUrlOrPath(value) : migrateValue(value); |
| updatePstmt.setBytes(1, encryptedValue.getBytes(StandardCharsets.UTF_8)); |
| updatePstmt.setLong(2, id); |
| updatePstmt.executeUpdate(); |
| } |
| } catch (SQLException e) { |
| throwCloudRuntimeException(String.format("Unable to update %s values", tableName), e); |
| } |
| } |
| |
| private void migrateValueAndUpdateDatabaseByName(Connection conn, String tableName, String selectSql, String updateSql) { |
| try(PreparedStatement selectPstmt = conn.prepareStatement(selectSql); |
| ResultSet rs = selectPstmt.executeQuery(); |
| PreparedStatement updatePstmt = conn.prepareStatement(updateSql) |
| ) { |
| while (rs.next()) { |
| String name = rs.getString(1); |
| String value = rs.getString(2); |
| if (StringUtils.isEmpty(value)) { |
| continue; |
| } |
| String encryptedValue = migrateValue(value); |
| updatePstmt.setBytes(1, encryptedValue.getBytes(StandardCharsets.UTF_8)); |
| updatePstmt.setString(2, name); |
| updatePstmt.executeUpdate(); |
| } |
| } catch (SQLException e) { |
| throwCloudRuntimeException(String.format("Unable to update %s values", tableName), e); |
| } |
| } |
| |
| private void migrateHostDetails(Connection conn) { |
| System.out.println("Begin migrate host details"); |
| migrateDetails(conn, "host_details", PASSWORD); |
| System.out.println("End migrate host details"); |
| } |
| |
| private void migrateClusterDetails(Connection conn) { |
| System.out.println("Begin migrate cluster details"); |
| migrateDetails(conn, "cluster_details", PASSWORD); |
| System.out.println("End migrate cluster details"); |
| } |
| |
| private void migrateImageStoreDetails(Connection conn) { |
| System.out.println("Begin migrate image store details"); |
| migrateDetails(conn, "image_store_details", "key", "secretkey"); |
| System.out.println("End migrate image store details"); |
| } |
| |
| private void migrateStoragePoolDetails(Connection conn) { |
| System.out.println("Begin migrate storage pool details"); |
| migrateDetails(conn, "storage_pool_details", PASSWORD); |
| System.out.println("End migrate storage pool details"); |
| } |
| |
| private void migrateScaleIOStoragePoolDetails(Connection conn) { |
| System.out.println("Begin migrate storage pool details for ScaleIO"); |
| migrateDetails(conn, "storage_pool_details", "powerflex.gw.username", "powerflex.gw.password"); |
| System.out.println("End migrate storage pool details for ScaleIO"); |
| } |
| |
| private void migrateUserVmDetails(Connection conn) { |
| System.out.println("Begin migrate user vm details"); |
| migrateDetails(conn, "user_vm_details", PASSWORD); |
| System.out.println("End migrate user vm details"); |
| } |
| |
| private void migrateDetails(Connection conn, String tableName, String... detailNames) { |
| String convertedDetails = Arrays.stream(detailNames).map(detail -> "'" + detail + "'").collect(Collectors.joining(", ")); |
| String selectSql = String.format("SELECT id, value FROM %s WHERE name IN (%s)", tableName, convertedDetails); |
| String updateSql = String.format("UPDATE %s SET value=? WHERE id=?", tableName); |
| migrateValueAndUpdateDatabaseById(conn, tableName, selectSql, updateSql, false); |
| } |
| |
| private void migrateTemplateDeployAsIsDetails(Connection conn) throws SQLException { |
| System.out.println("Begin migrate user vm deploy_as_is details"); |
| if (!ifTableExists(conn.getMetaData(), "user_vm_deploy_as_is_details")) { |
| System.out.printf("Skipped as table %s does not exist %n", "user_vm_deploy_as_is_details"); |
| return; |
| } |
| if (!ifTableExists(conn.getMetaData(), "template_deploy_as_is_details")) { |
| System.out.printf("Skipped as table %s does not exist %n", "template_deploy_as_is_details"); |
| return; |
| } |
| String sqlTemplateDeployAsIsDetails = "SELECT template_deploy_as_is_details.value " + |
| "FROM template_deploy_as_is_details JOIN vm_instance " + |
| "WHERE template_deploy_as_is_details.template_id = vm_instance.vm_template_id " + |
| "vm_instance.id = %s AND template_deploy_as_is_details.name = '%s' LIMIT 1"; |
| try (PreparedStatement selectPstmt = conn.prepareStatement("SELECT id, vm_id, name, value FROM user_vm_deploy_as_is_details"); |
| ResultSet rs = selectPstmt.executeQuery(); |
| PreparedStatement updatePstmt = conn.prepareStatement("UPDATE user_vm_deploy_as_is_details SET value=? WHERE id=?") |
| ) { |
| while (rs.next()) { |
| long id = rs.getLong(1); |
| long vmId = rs.getLong(2); |
| String name = rs.getString(3); |
| String value = rs.getString(4); |
| if (StringUtils.isEmpty(value)) { |
| continue; |
| } |
| String key = name.startsWith("property-") ? name : "property-" + name; |
| |
| try (PreparedStatement pstmtTemplateDeployAsIs = conn.prepareStatement(String.format(sqlTemplateDeployAsIsDetails, vmId, key)); |
| ResultSet rsTemplateDeployAsIs = pstmtTemplateDeployAsIs.executeQuery()) { |
| if (rsTemplateDeployAsIs.next()) { |
| String templateDeployAsIsDetailValue = rsTemplateDeployAsIs.getString(1); |
| OVFPropertyTO property = gson.fromJson(templateDeployAsIsDetailValue, OVFPropertyTO.class); |
| if (property != null && property.isPassword()) { |
| String encryptedValue = migrateValue(value); |
| updatePstmt.setBytes(1, encryptedValue.getBytes(StandardCharsets.UTF_8)); |
| updatePstmt.setLong(2, id); |
| updatePstmt.executeUpdate(); |
| } |
| } |
| } |
| } |
| } catch (SQLException | JsonSyntaxException e) { |
| throwCloudRuntimeException("Unable to update user_vm_deploy_as_is_details values", e); |
| } |
| System.out.println("End migrate user vm deploy_as_is details"); |
| } |
| |
| private void migrateImageStoreUrlForCifs(Connection conn) { |
| System.out.println("Begin migrate image store url if protocol is cifs"); |
| |
| String tableName = "image_store"; |
| String fieldName = "url"; |
| if (getCountOfTable(conn, tableName) == 0) { |
| System.out.printf("Skipped table %s as there is no image store with protocol is cifs in the table %n", tableName); |
| return; |
| } |
| String selectSql = String.format("SELECT id, `%s` FROM %s WHERE protocol = 'cifs'", fieldName, tableName); |
| String updateSql = String.format("UPDATE %s SET `%s`=? WHERE id=?", tableName, fieldName); |
| migrateValueAndUpdateDatabaseById(conn, tableName, selectSql, updateSql, true); |
| |
| System.out.println("End migrate image store url if protocol is cifs"); |
| } |
| |
| private void migrateStoragePoolPathForSMB(Connection conn) { |
| System.out.println("Begin migrate storage pool path if pool type is SMB"); |
| |
| String tableName = "storage_pool"; |
| String fieldName = "path"; |
| if (getCountOfTable(conn, tableName) == 0) { |
| System.out.printf("Skipped table %s as there is no storage pool with pool type is SMB in the table %n", tableName); |
| return; |
| } |
| String selectSql = String.format("SELECT id, `%s` FROM %s WHERE pool_type = 'SMB'", fieldName, tableName); |
| String updateSql = String.format("UPDATE %s SET `%s`=? WHERE id=?", tableName, fieldName); |
| migrateValueAndUpdateDatabaseById(conn, tableName, selectSql, updateSql, true); |
| |
| System.out.println("End migrate storage pool path if pool type is SMB"); |
| } |
| |
| private void migrateDatabaseField(Connection conn, String tableName, String fieldName) { |
| System.out.printf("Begin migrate table %s field %s %n", tableName, fieldName); |
| |
| String selectSql = String.format("SELECT id, `%s` FROM %s", fieldName, tableName); |
| String updateSql = String.format("UPDATE %s SET `%s`=? WHERE id=?", tableName, fieldName); |
| migrateValueAndUpdateDatabaseById(conn, tableName, selectSql, updateSql, false); |
| |
| System.out.printf("Done migrating database field %s.%s %n", tableName, fieldName); |
| } |
| |
| protected static Map<String, Set<String>> findEncryptedTableColumns() { |
| Map<String, Set<String>> tableCols = new HashMap<>(); |
| Set<Class<?>> vos = ReflectUtil.getClassesWithAnnotation(Table.class, new String[]{"com", "org"}); |
| vos.forEach( vo -> { |
| Table tableAnnotation = vo.getAnnotation(Table.class); |
| if (tableAnnotation == null || (tableAnnotation.name() != null && tableAnnotation.name().endsWith("_view"))) { |
| return; |
| } |
| for (Field field : vo.getDeclaredFields()) { |
| if (field.isAnnotationPresent(Encrypt.class)) { |
| Set<String> encryptedColumns = tableCols.getOrDefault(tableAnnotation.name(), new HashSet<>()); |
| String columnName = field.getName(); |
| if (field.isAnnotationPresent(Column.class)) { |
| Column columnAnnotation = field.getAnnotation(Column.class); |
| columnName = columnAnnotation.name(); |
| } |
| encryptedColumns.add(columnName); |
| tableCols.put(tableAnnotation.name(), encryptedColumns); |
| } |
| } |
| }); |
| return tableCols; |
| } |
| |
| private void migrateEncryptedTableColumns(Connection conn) throws SQLException { |
| Map<String, Set<String>> encryptedTableCols = findEncryptedTableColumns(); |
| DatabaseMetaData metadata = conn.getMetaData(); |
| encryptedTableCols.forEach((table, columns) -> { |
| if (!ifTableExists(metadata, table)) { |
| System.out.printf("Skipped table %s as it does not exist %n", table); |
| return; |
| } |
| if (getCountOfTable(conn, table) == 0) { |
| System.out.printf("Skipped table %s as there is no data in the table %n", table); |
| return; |
| } |
| columns.forEach(column -> { |
| if (!ifTableColumnExists(metadata, table, column)) { |
| System.out.printf("Skipped column %s in table %s as it does not exist %n", column, table); |
| return; |
| } |
| migrateDatabaseField(conn, table, column); |
| }); |
| }); |
| } |
| |
| private boolean ifTableExists(DatabaseMetaData metadata, String table) { |
| try { |
| ResultSet rs = metadata.getTables(null, null, table, null); |
| if (rs.next()) { |
| return true; |
| } |
| } catch (SQLException e) { |
| throwCloudRuntimeException(String.format("Unable to get table %s", table), e); |
| } |
| return false; |
| } |
| |
| private boolean ifTableColumnExists(DatabaseMetaData metadata, String table, String column) { |
| try { |
| ResultSet rs = metadata.getColumns(null, null, table, column); |
| if (rs.next()) { |
| return true; |
| } |
| } catch (SQLException e) { |
| throwCloudRuntimeException(String.format("Unable to get column %s in table %s", column, table), e); |
| } |
| return false; |
| } |
| |
| private int getCountOfTable(Connection conn, String table) { |
| try (PreparedStatement pstmt = conn.prepareStatement(String.format("SELECT count(*) FROM %s", table)); |
| ResultSet rs = pstmt.executeQuery()) { |
| if (rs.next()) { |
| return rs.getInt(1); |
| } |
| } catch (SQLException e) { |
| throwCloudRuntimeException(String.format("Unable to get count of records in table %s", table), e); |
| } |
| return 0; |
| } |
| |
| private static void throwCloudRuntimeException(String msg, Exception e) { |
| System.out.println(msg + " due to: " + e.getMessage()); |
| throw new CloudRuntimeException(msg, e); |
| } |
| } |
