/*
|
* The contents of this file are subject to the terms of the Common Development and
|
* Distribution License (the License). You may not use this file except in compliance with the
|
* License.
|
*
|
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
* specific language governing permission and limitations under the License.
|
*
|
* When distributing Covered Software, include this CDDL Header Notice in each file and include
|
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
* Header, with the fields enclosed by brackets [] replaced by your own identifying
|
* information: "Portions Copyright [year] [name of copyright owner]".
|
*
|
* Copyright 2006-2010 Sun Microsystems, Inc.
|
* Portions Copyright 2011-2016 ForgeRock AS.
|
* Portions Copyright 2014 Manuel Gaupp
|
* Portions Copyright 2026 3A Systems, LLC.
|
*/
|
package org.opends.server.backends.pluggable;
|
|
import static org.opends.messages.BackendMessages.*;
|
import static org.opends.server.backends.pluggable.EntryIDSet.*;
|
|
import java.io.Closeable;
|
import java.util.ArrayList;
|
import java.util.Collection;
|
import java.util.Collections;
|
import java.util.HashMap;
|
import java.util.HashSet;
|
import java.util.List;
|
import java.util.Map;
|
import java.util.Set;
|
import java.util.SortedSet;
|
import java.util.TreeMap;
|
import java.util.TreeSet;
|
|
import org.forgerock.i18n.LocalizableMessage;
|
import org.forgerock.i18n.LocalizableMessageBuilder;
|
import org.forgerock.i18n.slf4j.LocalizedLogger;
|
import org.forgerock.opendj.config.server.ConfigChangeResult;
|
import org.forgerock.opendj.config.server.ConfigException;
|
import org.forgerock.opendj.config.server.ConfigurationChangeListener;
|
import org.forgerock.opendj.ldap.Assertion;
|
import org.forgerock.opendj.ldap.ByteSequence;
|
import org.forgerock.opendj.ldap.ByteString;
|
import org.forgerock.opendj.ldap.DN;
|
import org.forgerock.opendj.ldap.DecodeException;
|
import org.forgerock.opendj.ldap.schema.AttributeType;
|
import org.forgerock.opendj.ldap.schema.MatchingRule;
|
import org.forgerock.opendj.ldap.schema.Schema;
|
import org.forgerock.opendj.ldap.schema.UnknownSchemaElementException;
|
import org.forgerock.opendj.ldap.spi.IndexQueryFactory;
|
import org.forgerock.opendj.ldap.spi.Indexer;
|
import org.forgerock.opendj.ldap.spi.IndexingOptions;
|
import org.forgerock.opendj.server.config.meta.BackendIndexCfgDefn.IndexType;
|
import org.forgerock.opendj.server.config.server.BackendIndexCfg;
|
import org.opends.server.backends.pluggable.spi.StorageRuntimeException;
|
import org.opends.server.backends.pluggable.spi.TreeName;
|
import org.opends.server.backends.pluggable.spi.WriteOperation;
|
import org.opends.server.backends.pluggable.spi.WriteableTransaction;
|
import org.opends.server.core.DirectoryServer;
|
import org.opends.server.crypto.CryptoSuite;
|
import org.opends.server.types.Attribute;
|
import org.opends.server.types.DirectoryException;
|
import org.opends.server.types.Entry;
|
import org.opends.server.types.FilterType;
|
import org.opends.server.types.SearchFilter;
|
import org.opends.server.util.StaticUtils;
|
|
/**
|
* Class representing an attribute index.
|
* We have a separate tree for each type of indexing, which makes it easy
|
* to tell which attribute indexes are configured. The different types of
|
* indexing are equality, presence, substrings and ordering. The keys in the
|
* ordering index are ordered by setting the btree comparator to the ordering
|
* matching rule comparator.
|
* Note that the values in the equality index are normalized by the equality
|
* matching rule, whereas the values in the ordering index are normalized
|
* by the ordering matching rule. If these could be guaranteed to be identical
|
* then we would not need a separate ordering index.
|
*/
|
class AttributeIndex implements ConfigurationChangeListener<BackendIndexCfg>, Closeable
|
{
|
private static final LocalizedLogger logger = LocalizedLogger.getLoggerForThisClass();
|
|
/** Type of the index filter. */
|
enum IndexFilterType
|
{
|
/** Equality. */
|
EQUALITY(IndexType.EQUALITY),
|
/** Presence. */
|
PRESENCE(IndexType.PRESENCE),
|
/** Ordering. */
|
GREATER_OR_EQUAL(IndexType.ORDERING),
|
/** Ordering. */
|
LESS_OR_EQUAL(IndexType.ORDERING),
|
/** Substring. */
|
SUBSTRING(IndexType.SUBSTRING),
|
/** Approximate. */
|
APPROXIMATE(IndexType.APPROXIMATE);
|
|
private final IndexType indexType;
|
|
IndexFilterType(IndexType indexType)
|
{
|
this.indexType = indexType;
|
}
|
|
@Override
|
public String toString()
|
{
|
return indexType.toString();
|
}
|
}
|
|
static final String PROTECTED_INDEX_ID = ":hash";
|
|
/** This class implements an attribute indexer for matching rules in a Backend. */
|
static final class MatchingRuleIndex extends DefaultIndex
|
{
|
private final AttributeType attributeType;
|
private final Indexer indexer;
|
|
private MatchingRuleIndex(EntryContainer entryContainer, AttributeType attributeType, State state, Indexer indexer,
|
int indexEntryLimit, CryptoSuite cryptoSuite)
|
{
|
super(getIndexName(entryContainer, attributeType, indexer.getIndexID()),
|
state, indexEntryLimit, entryContainer, cryptoSuite);
|
this.attributeType = attributeType;
|
this.indexer = indexer;
|
}
|
|
Set<ByteString> indexEntry(Entry entry)
|
{
|
final Set<ByteString> keys = new HashSet<>();
|
indexEntry(entry, keys);
|
return keys;
|
}
|
|
private void modifyEntry(Entry oldEntry, Entry newEntry, Map<ByteString, Boolean> modifiedKeys)
|
{
|
for (ByteString key : indexEntry(oldEntry))
|
{
|
modifiedKeys.put(key, false);
|
}
|
|
for (ByteString key : indexEntry(newEntry))
|
{
|
final Boolean needsAdding = modifiedKeys.get(key);
|
if (needsAdding == null)
|
{
|
// This value has been added.
|
modifiedKeys.put(key, true);
|
}
|
else if (!needsAdding)
|
{
|
// This value has not been added or removed.
|
modifiedKeys.remove(key);
|
}
|
}
|
}
|
|
void indexEntry(Entry entry, Set<ByteString> keys)
|
{
|
for (Attribute attr : entry.getAllAttributes(attributeType))
|
{
|
if (!attr.isVirtual())
|
{
|
for (ByteString value : attr)
|
{
|
try
|
{
|
indexer.createKeys(Schema.getDefaultSchema(), value, keys);
|
|
/*
|
* Optimization for presence: return immediately after first value since all values
|
* have the same key.
|
*/
|
if (indexer == PRESENCE_INDEXER)
|
{
|
return;
|
}
|
}
|
catch (DecodeException e)
|
{
|
logger.traceException(e);
|
}
|
}
|
}
|
}
|
}
|
|
@Override
|
public String keyToString(ByteString key)
|
{
|
return indexer.keyToHumanReadableString(key);
|
}
|
|
@Override
|
public ByteString generateKey(String key)
|
{
|
try
|
{
|
SortedSet<ByteString> keys = new TreeSet<>();
|
indexer.createKeys(Schema.getDefaultSchema(), ByteString.valueOfUtf8(key), keys);
|
return keys.first();
|
}
|
catch (DecodeException e)
|
{
|
return super.generateKey(key);
|
}
|
}
|
}
|
|
/**
|
* Decorates an Indexer so that we can post process key and change index name for
|
* those attributes declared as protected in the configuration.
|
*/
|
private static class HashedKeyEqualityIndexer implements Indexer {
|
|
private final Indexer delegate;
|
private CryptoSuite cryptoSuite;
|
|
private HashedKeyEqualityIndexer(Indexer delegate, CryptoSuite cryptoSuite)
|
{
|
this.delegate = delegate;
|
this.cryptoSuite = cryptoSuite;
|
}
|
|
@Override
|
public String getIndexID()
|
{
|
return delegate.getIndexID() + PROTECTED_INDEX_ID;
|
}
|
|
@Override
|
public void createKeys(Schema schema, ByteSequence value, Collection<ByteString> keys) throws DecodeException
|
{
|
Collection<ByteString> hashKeys = new ArrayList<>(1);
|
delegate.createKeys(schema, value, hashKeys);
|
for (ByteString key : hashKeys)
|
{
|
keys.add(cryptoSuite.hash48(key).toByteString());
|
}
|
}
|
|
@Override
|
public String keyToHumanReadableString(ByteSequence key)
|
{
|
return key.toByteString().toHexString();
|
}
|
}
|
|
/** The key bytes used for the presence index as a {@link ByteString}. */
|
static final ByteString PRESENCE_KEY = ByteString.valueOfUtf8("+");
|
|
/** A special indexer for generating presence indexes. */
|
private static final Indexer PRESENCE_INDEXER = new Indexer()
|
{
|
@Override
|
public void createKeys(Schema schema, ByteSequence value, Collection<ByteString> keys) throws DecodeException
|
{
|
keys.add(PRESENCE_KEY);
|
}
|
|
@Override
|
public String keyToHumanReadableString(ByteSequence key)
|
{
|
return "PRESENCE";
|
}
|
|
@Override
|
public String getIndexID()
|
{
|
return IndexType.PRESENCE.toString();
|
}
|
};
|
|
/*
|
* FIXME Matthew Swift: Once the matching rules have been migrated we should
|
* revisit this class. All of the evaluateXXX methods should go (the Matcher
|
* class in the SDK could implement the logic, I hope).
|
*/
|
|
/** The entryContainer in which this attribute index resides. */
|
private final EntryContainer entryContainer;
|
|
/** The attribute index configuration. */
|
private BackendIndexCfg config;
|
|
/** The mapping from names to indexes. */
|
private Map<String, MatchingRuleIndex> indexIdToIndexes;
|
private IndexingOptions indexingOptions;
|
private final State state;
|
private final CryptoSuite cryptoSuite;
|
|
AttributeIndex(BackendIndexCfg config, State state, EntryContainer entryContainer, CryptoSuite cryptoSuite)
|
throws ConfigException
|
{
|
this.entryContainer = entryContainer;
|
this.config = config;
|
this.state = state;
|
this.cryptoSuite = cryptoSuite;
|
this.indexingOptions = new IndexingOptionsImpl(config.getSubstringLength());
|
this.indexIdToIndexes = Collections.unmodifiableMap(buildIndexes(entryContainer, state, config, cryptoSuite));
|
}
|
|
private Map<String, MatchingRuleIndex> buildIndexes(EntryContainer entryContainer, State state,
|
BackendIndexCfg config, CryptoSuite cryptoSuite) throws ConfigException
|
{
|
final AttributeType attributeType = config.getAttribute();
|
final int indexEntryLimit = config.getIndexEntryLimit();
|
final IndexingOptions indexingOptions = new IndexingOptionsImpl(config.getSubstringLength());
|
|
Map<Indexer, Boolean> indexers = new HashMap<>();
|
for(IndexType indexType : config.getIndexType()) {
|
switch (indexType)
|
{
|
case PRESENCE:
|
indexers.put(PRESENCE_INDEXER, false);
|
break;
|
case EXTENSIBLE:
|
indexers.putAll(
|
getExtensibleIndexers(config.getAttribute(), config.getIndexExtensibleMatchingRule(), indexingOptions));
|
break;
|
case EQUALITY:
|
indexers.putAll(buildBaseIndexers(config.isConfidentialityEnabled(), false, indexType, attributeType,
|
indexingOptions));
|
break;
|
case SUBSTRING:
|
indexers.putAll(buildBaseIndexers(false, config.isConfidentialityEnabled(), indexType, attributeType,
|
indexingOptions));
|
break;
|
case APPROXIMATE:
|
case ORDERING:
|
indexers.putAll(buildBaseIndexers(false, false, indexType, attributeType, indexingOptions));
|
break;
|
default:
|
throw noMatchingRuleForIndexType(attributeType, indexType);
|
}
|
}
|
return buildIndexesForIndexers(entryContainer, attributeType, state, indexEntryLimit, indexers, cryptoSuite);
|
}
|
|
private Map<Indexer, Boolean> buildBaseIndexers(boolean protectIndexKeys, boolean protectIndexValues,
|
IndexType indexType, AttributeType attributeType, IndexingOptions indexingOptions) throws ConfigException
|
{
|
Map<Indexer, Boolean> indexers = new HashMap<>();
|
MatchingRule rule = getMatchingRule(indexType, attributeType);
|
if (rule == null)
|
{
|
throw noMatchingRuleForIndexType(attributeType, indexType);
|
}
|
throwIfProtectKeysAndValues(attributeType, protectIndexKeys, protectIndexValues);
|
Collection<? extends Indexer> ruleIndexers = rule.createIndexers(indexingOptions);
|
for (Indexer indexer: ruleIndexers)
|
{
|
if (protectIndexKeys)
|
{
|
indexers.put(new HashedKeyEqualityIndexer(indexer, cryptoSuite), false);
|
}
|
else
|
{
|
indexers.put(indexer, protectIndexValues);
|
}
|
}
|
return indexers;
|
}
|
|
private static ConfigException noMatchingRuleForIndexType(AttributeType attributeType, IndexType indexType)
|
{
|
return new ConfigException(ERR_CONFIG_INDEX_TYPE_NEEDS_MATCHING_RULE.get(attributeType, indexType));
|
}
|
|
private void throwIfProtectKeysAndValues(AttributeType attributeType, boolean protectKeys, boolean protectValues)
|
throws ConfigException
|
{
|
if (protectKeys && protectValues)
|
{
|
throw new ConfigException(ERR_CONFIG_INDEX_CANNOT_PROTECT_BOTH.get(attributeType));
|
}
|
}
|
|
private static Map<String, MatchingRuleIndex> buildIndexesForIndexers(EntryContainer entryContainer,
|
AttributeType attributeType, State state, int indexEntryLimit, Map<Indexer, Boolean> indexers,
|
CryptoSuite cryptoSuite)
|
{
|
final Map<String, MatchingRuleIndex> indexes = new HashMap<>();
|
for (Map.Entry<Indexer, Boolean> indexerEntry : indexers.entrySet())
|
{
|
final String indexID = indexerEntry.getKey().getIndexID();
|
if (!indexes.containsKey(indexID))
|
{
|
indexes.put(indexID,
|
new MatchingRuleIndex(entryContainer, attributeType, state, indexerEntry.getKey(),
|
indexEntryLimit, cryptoSuite));
|
}
|
}
|
return indexes;
|
}
|
|
private static Map<Indexer, Boolean> getExtensibleIndexers(AttributeType attributeType, Set<String> extensibleRules,
|
IndexingOptions options) throws ConfigException
|
{
|
IndexType indexType = IndexType.EXTENSIBLE;
|
if (extensibleRules == null || extensibleRules.isEmpty())
|
{
|
throw noMatchingRuleForIndexType(attributeType, indexType);
|
}
|
|
final Map<Indexer, Boolean> indexers = new HashMap<>();
|
for (final String ruleName : extensibleRules)
|
{
|
try
|
{
|
final MatchingRule rule = getSchema().getMatchingRule(ruleName);
|
for (Indexer indexer : rule.createIndexers(options))
|
{
|
indexers.put(indexer, false);
|
}
|
}
|
catch (UnknownSchemaElementException e)
|
{
|
throw noMatchingRuleForIndexType(attributeType, indexType);
|
}
|
}
|
|
return indexers;
|
}
|
|
private static TreeName getIndexName(EntryContainer entryContainer, AttributeType attrType, String indexID)
|
{
|
return new TreeName(entryContainer.getTreePrefix(), attrType.getNameOrOID() + "." + indexID);
|
}
|
|
/**
|
* Open the attribute index.
|
*
|
* @param txn a non null transaction
|
* @param createOnDemand true if the tree should be created if it does not exist
|
* @throws StorageRuntimeException if an error occurs while opening the index
|
*/
|
void open(WriteableTransaction txn, boolean createOnDemand) throws StorageRuntimeException
|
{
|
for (Index index : indexIdToIndexes.values())
|
{
|
index.open(txn, createOnDemand);
|
}
|
config.addChangeListener(this);
|
}
|
|
/**
|
* Drops whatever an index of the same name left behind for the trees this index, which the
|
* configuration is adding, is about to open.
|
* <p>
|
* The name of an index tree is a pure function of the base DN, the attribute and the index id, and
|
* {@link #open} creates a tree only where there is none, so an index added for an attribute
|
* another index served reopens exactly the trees that one left behind - with their content and
|
* with the TRUSTED flag their {@code state} records carry. Neither is this index's: what those
|
* trees hold is what the backend was told before the configuration stopped naming them, every
|
* entry written in between is missing from it, and TRUSTED has searches answer out of it all the
|
* same. A rebuild regenerates all of it and nothing else is lost with it, so it is dropped here
|
* rather than adopted, which leaves this index where any other index added to a backend holding
|
* entries starts: empty, untrusted and asking to be rebuilt (#990).
|
* <p>
|
* Only the trees of the index ids this configuration declares are looked at. A tree of an id it
|
* does not name is opened by nothing and answers nothing, and the first configuration which
|
* declares that id again drops it the same way.
|
* <p>
|
* This must run in a write of its own, committed before the write which opens the index. On JE
|
* deleting a tree write-locks the record of its name until the transaction commits, while opening
|
* a tree - which {@code JEStorage} does under a transaction of its own - asks for a read lock on
|
* that record and waits for it without limit: no cycle, so the deadlock detector is silent, and
|
* the configuration change never returns.
|
* <p>
|
* What this answers, the caller reports once every write of its change is over, whichever way
|
* they went - and when the write this ran in fails at its commit as well, although on JE and PDB
|
* that failure rolls the drop back. The report then overstates what happened: the trees are still
|
* there, the configuration entry is already written ({@code ConfigurationHandler} writes it before
|
* it notifies any listener), and the next open of the backend adopts them with their TRUSTED
|
* flag; the rebuild the report asks for is what puts that right. On JDBC the DROP has committed on
|
* its own before that commit failed, the record is back over a table which is gone, and the report
|
* is the only trace of it. Reported from a flag copied once the write has returned instead, the
|
* JE and PDB reports would be exact and the JDBC one silent, in the one case this method is for.
|
*
|
* @param txn a non null transaction
|
* @return true if a tree was dropped; a record deleted on its own discards nothing
|
* @throws StorageRuntimeException if an error occurs in the storage
|
*/
|
boolean dropLeftovers(WriteableTransaction txn) throws StorageRuntimeException
|
{
|
boolean dropped = false;
|
for (Index index : indexIdToIndexes.values())
|
{
|
dropped |= dropLeftoversOf(txn, index);
|
}
|
return dropped;
|
}
|
|
/**
|
* Drops the tree an index about to be opened would adopt, and the {@code state} record which goes
|
* with it.
|
* <p>
|
* The record can outlive the tree on its own: on JDBC a tree is dropped by DDL which commits of
|
* its own accord while the record is deleted by the transaction, so a rollback in between leaves
|
* the record over a tree which is gone, and the index opened next is created empty and read back
|
* as trusted. It is therefore taken out whether a tree was found for it or not - but a record
|
* deleted on its own is not reported as discarded content, since none was.
|
* <p>
|
* The tree is asked for through the transaction rather than through a list of the trees read
|
* beforehand: on JDBC that list borrows a connection of its own, which a transaction already
|
* holding one of the same pool must not ask for, while {@code treeExists} asks the transaction's
|
* own; on Cassandra the list is not implemented and answers nothing, while {@code treeExists}
|
* finds the partition; and a replayed attempt then sees what is there when it runs, not what was
|
* there before the first attempt.
|
* <p>
|
* No search can be reading what is dropped here, so this does not take the exclusive lock
|
* {@link #deleteIndex} takes: an index which is only being added is in no map a search reaches,
|
* and the trees it would have adopted are named by nothing until it opens them. The add listener
|
* refuses an index for an attribute type which is already indexed, so that no live index is
|
* reached through another of the attribute's names or its OID.
|
*
|
* @return true if a tree was dropped
|
*/
|
private boolean dropLeftoversOf(WriteableTransaction txn, Index index)
|
{
|
if (txn.treeExists(index.getName()))
|
{
|
// Deletes the state record along with the tree.
|
entryContainer.deleteTree(txn, index);
|
return true;
|
}
|
state.deleteRecord(txn, index.getName());
|
return false;
|
}
|
|
/**
|
* Tells the operator that trees left behind were discarded rather than adopted, and puts it in the
|
* error log as well: the session which submitted the change ends, and what a backend was left
|
* holding has to be findable afterwards.
|
*/
|
static void reportDiscardedLeftovers(ConfigChangeResult ccr, Object indexName, DN baseDN)
|
{
|
final LocalizableMessage message = WARN_INDEX_ADD_DISCARDED_LEFTOVER_TREES.get(indexName, baseDN);
|
ccr.addMessage(message);
|
logger.warn(message);
|
}
|
|
@Override
|
public void close()
|
{
|
config.removeChangeListener(this);
|
}
|
|
/**
|
* Get the attribute type of this attribute index.
|
* @return The attribute type of this attribute index.
|
*/
|
AttributeType getAttributeType()
|
{
|
return config.getAttribute();
|
}
|
|
/**
|
* Get the configuration of this attribute index.
|
* @return The configuration this attribute index is currently applying.
|
*/
|
BackendIndexCfg getConfiguration()
|
{
|
return config;
|
}
|
|
public CryptoSuite getCryptoSuite()
|
{
|
return cryptoSuite;
|
}
|
|
/**
|
* Return the indexing options of this AttributeIndex.
|
*
|
* @return the indexing options of this AttributeIndex.
|
*/
|
IndexingOptions getIndexingOptions()
|
{
|
return indexingOptions;
|
}
|
|
/**
|
* Returns {@code true} if this attribute index supports the provided index type.
|
*
|
* @param indexType
|
* The index type.
|
* @return {@code true} if this attribute index supports the provided index type.
|
*/
|
boolean isIndexed(org.opends.server.types.IndexType indexType)
|
{
|
switch (indexType)
|
{
|
case PRESENCE:
|
return isIndexed(IndexType.PRESENCE);
|
|
case EQUALITY:
|
return isIndexed(IndexType.EQUALITY);
|
|
case SUBSTRING:
|
case SUBINITIAL:
|
case SUBANY:
|
case SUBFINAL:
|
return isIndexed(IndexType.SUBSTRING);
|
|
case GREATER_OR_EQUAL:
|
case LESS_OR_EQUAL:
|
return isIndexed(IndexType.ORDERING);
|
|
case APPROXIMATE:
|
return isIndexed(IndexType.APPROXIMATE);
|
|
default:
|
return false;
|
}
|
}
|
|
boolean isIndexed(IndexType indexType)
|
{
|
return config.getIndexType().contains(indexType);
|
}
|
|
/**
|
* Update the attribute index for a new entry.
|
*
|
* @param buffer The index buffer to use to store the added keys
|
* @param entryID The entry ID.
|
* @param entry The contents of the new entry.
|
* @throws StorageRuntimeException If an error occurs in the storage.
|
* @throws DirectoryException If a Directory Server error occurs.
|
*/
|
void addEntry(IndexBuffer buffer, EntryID entryID, Entry entry) throws StorageRuntimeException, DirectoryException
|
{
|
for (MatchingRuleIndex index : indexIdToIndexes.values())
|
{
|
for (ByteString key : index.indexEntry(entry))
|
{
|
buffer.put(index, key, entryID);
|
}
|
}
|
}
|
|
/**
|
* Update the attribute index for a deleted entry.
|
*
|
* @param buffer The index buffer to use to store the deleted keys
|
* @param entryID The entry ID
|
* @param entry The contents of the deleted entry.
|
* @throws StorageRuntimeException If an error occurs in the storage.
|
* @throws DirectoryException If a Directory Server error occurs.
|
*/
|
void removeEntry(IndexBuffer buffer, EntryID entryID, Entry entry) throws StorageRuntimeException, DirectoryException
|
{
|
for (MatchingRuleIndex index : indexIdToIndexes.values())
|
{
|
for (ByteString key : index.indexEntry(entry))
|
{
|
buffer.remove(index, key, entryID);
|
}
|
}
|
}
|
|
/**
|
* Update the index to reflect a sequence of modifications in a Modify operation.
|
*
|
* @param buffer The index buffer used to buffer up the index changes.
|
* @param entryID The ID of the entry that was modified.
|
* @param oldEntry The entry before the modifications were applied.
|
* @param newEntry The entry after the modifications were applied.
|
* @throws StorageRuntimeException If an error occurs during an operation on a
|
* storage.
|
*/
|
void modifyEntry(IndexBuffer buffer, EntryID entryID, Entry oldEntry, Entry newEntry) throws StorageRuntimeException
|
{
|
for (MatchingRuleIndex index : indexIdToIndexes.values())
|
{
|
TreeMap<ByteString, Boolean> modifiedKeys = new TreeMap<>();
|
index.modifyEntry(oldEntry, newEntry, modifiedKeys);
|
for (Map.Entry<ByteString, Boolean> modifiedKey : modifiedKeys.entrySet())
|
{
|
if (modifiedKey.getValue())
|
{
|
buffer.put(index, modifiedKey.getKey(), entryID);
|
}
|
else
|
{
|
buffer.remove(index, modifiedKey.getKey(), entryID);
|
}
|
}
|
}
|
}
|
|
/**
|
* Retrieve the entry IDs that might match the provided assertion.
|
*
|
* @param indexQuery
|
* The query used to retrieve entries.
|
* @param indexName
|
* The name of index used to retrieve entries.
|
* @param filter
|
* The filter on entries.
|
* @param debugBuffer
|
* If not null, a diagnostic string will be written which will help
|
* determine how the indexes contributed to this search.
|
* @param monitor
|
* The backend monitor provider that will keep index
|
* filter usage statistics.
|
* @return The candidate entry IDs that might contain the filter assertion value.
|
*/
|
private static EntryIDSet evaluateIndexQuery(IndexQuery indexQuery, String indexName, SearchFilter filter,
|
StringBuilder debugBuffer, BackendMonitor monitor)
|
{
|
// FIXME equivalent code exists in evaluateExtensibleFilter()
|
LocalizableMessageBuilder debugMessage = monitor.isFilterUseEnabled() ? new LocalizableMessageBuilder() : null;
|
StringBuilder indexNameOut = debugBuffer == null ? null : new StringBuilder();
|
EntryIDSet results = indexQuery.evaluate(debugMessage, indexNameOut);
|
|
if (debugBuffer != null)
|
{
|
appendDebugIndexInformation(debugBuffer, filter.getAttributeType(), indexName);
|
appendDebugUnindexedInformation(debugBuffer, filter.getAttributeType(), indexNameOut);
|
}
|
|
updateStats(monitor, filter, results, debugMessage);
|
return results;
|
}
|
|
private static void updateStats(BackendMonitor monitor, SearchFilter filter, EntryIDSet idSet,
|
LocalizableMessageBuilder debugMessage)
|
{
|
if (monitor.isFilterUseEnabled())
|
{
|
if (idSet.isDefined())
|
{
|
monitor.updateStats(filter, idSet.size());
|
}
|
else
|
{
|
monitor.updateStats(filter, debugMessage.toMessage());
|
}
|
}
|
}
|
|
/**
|
* Appends additional traces to {@code debugsearchindex} when a filter successfully used
|
* an auxiliary index type during index query.
|
*
|
* @param debugBuffer the current debugsearchindex buffer
|
* @param indexName the name of the index type
|
*/
|
private static void appendDebugUnindexedInformation(StringBuilder debugBuffer, AttributeType attrType,
|
StringBuilder indexName)
|
{
|
if (indexName.length() > 0)
|
{
|
debugBuffer.append(newUndefinedSet());
|
appendDebugIndexInformation(debugBuffer, attrType, indexName);
|
}
|
}
|
|
private static void appendDebugIndexInformation(StringBuilder debugBuffer, AttributeType attrType,
|
CharSequence indexName)
|
{
|
String attrNameOrOID = attrType.getNameOrOID();
|
debugBuffer.append("[INDEX:").append(attrNameOrOID).append(".").append(indexName).append("]");
|
}
|
|
private static void appendDebugIndexesInformation(StringBuilder debugBuffer, AttributeType attrType,
|
Collection<? extends Indexer> indexers)
|
{
|
final String attrNameOrOID = attrType.getNameOrOID();
|
debugBuffer.append("[INDEX:");
|
boolean isFirst = true;
|
for (Indexer indexer : indexers)
|
{
|
if (isFirst)
|
{
|
isFirst = false;
|
}
|
else
|
{
|
debugBuffer.append(" ");
|
}
|
debugBuffer.append(attrNameOrOID).append(".").append(indexer.getIndexID());
|
}
|
debugBuffer.append("]");
|
}
|
|
/**
|
* Retrieve the entry IDs that might match two filters that restrict a value
|
* to both a lower bound and an upper bound.
|
*
|
* @param indexQueryFactory
|
* The index query factory to use for the evaluation
|
* @param filter1
|
* The first filter, that is either a less-or-equal filter or a
|
* greater-or-equal filter.
|
* @param filter2
|
* The second filter, that is either a less-or-equal filter or a
|
* greater-or-equal filter. It must not be of the same type than the
|
* first filter.
|
* @param debugBuffer
|
* If not null, a diagnostic string will be written which will help
|
* determine how the indexes contributed to this search.
|
* @param monitor
|
* The backend monitor provider that will keep index
|
* filter usage statistics.
|
* @return The candidate entry IDs that might contain match both filters.
|
*/
|
static EntryIDSet evaluateBoundedRange(IndexQueryFactory<IndexQuery> indexQueryFactory,
|
SearchFilter filter1, SearchFilter filter2, StringBuilder debugBuffer, BackendMonitor monitor)
|
{
|
// TODO : this implementation is not optimal
|
// as it implies two separate evaluations instead of a single one, thus defeating the purpose of
|
// the optimization done in IndexFilter#evaluateLogicalAndFilter method.
|
// One solution could be to implement a boundedRangeAssertion that combine the two operations in one.
|
// Such an optimization can only work for attributes declared as SINGLE-VALUE, though, since multiple
|
// values may match both filters with values outside the range. See OPENDJ-2194.
|
StringBuilder tmpBuff1 = debugBuffer != null ? new StringBuilder() : null;
|
StringBuilder tmpBuff2 = debugBuffer != null ? new StringBuilder() : null;
|
EntryIDSet results1 = evaluate(indexQueryFactory, filter1, tmpBuff1, monitor);
|
EntryIDSet results2 = evaluate(indexQueryFactory, filter2, tmpBuff2, monitor);
|
if (debugBuffer != null)
|
{
|
debugBuffer
|
.append(filter1).append(tmpBuff1).append(results1)
|
.append(filter2).append(tmpBuff2).append(results2);
|
}
|
results1.retainAll(results2);
|
return results1;
|
}
|
|
private static EntryIDSet evaluate(IndexQueryFactory<IndexQuery> indexQueryFactory, SearchFilter filter,
|
StringBuilder debugBuffer, BackendMonitor monitor)
|
{
|
boolean isLessOrEqual = filter.getFilterType() == FilterType.LESS_OR_EQUAL;
|
IndexFilterType indexFilterType = isLessOrEqual ? IndexFilterType.LESS_OR_EQUAL : IndexFilterType.GREATER_OR_EQUAL;
|
return evaluateFilter(indexQueryFactory, indexFilterType, filter, debugBuffer, monitor);
|
}
|
|
/**
|
* Retrieve the entry IDs that might match a filter.
|
*
|
* @param indexQueryFactory the index query factory to use for the evaluation
|
* @param indexFilterType the index type filter
|
* @param filter The filter.
|
* @param debugBuffer If not null, a diagnostic string will be written
|
* which will help determine how the indexes contributed
|
* to this search.
|
* @param monitor The backend monitor provider that will keep
|
* index filter usage statistics.
|
* @return The candidate entry IDs that might contain a value
|
* that matches the filter type.
|
*/
|
static EntryIDSet evaluateFilter(IndexQueryFactory<IndexQuery> indexQueryFactory, IndexFilterType indexFilterType,
|
SearchFilter filter, StringBuilder debugBuffer, BackendMonitor monitor)
|
{
|
try
|
{
|
final IndexQuery indexQuery = getIndexQuery(indexQueryFactory, indexFilterType, filter);
|
return evaluateIndexQuery(indexQuery, indexFilterType.toString(), filter, debugBuffer, monitor);
|
}
|
catch (DecodeException e)
|
{
|
// See OPENDJ-3034 for further information on why an empty set is returned here
|
logger.traceException(e);
|
return newDefinedSet();
|
}
|
}
|
|
private static IndexQuery getIndexQuery(IndexQueryFactory<IndexQuery> indexQueryFactory,
|
IndexFilterType indexFilterType, SearchFilter filter) throws DecodeException
|
{
|
MatchingRule rule;
|
switch (indexFilterType)
|
{
|
case EQUALITY:
|
rule = filter.getAttributeType().getEqualityMatchingRule();
|
if (rule != null) {
|
Assertion assertion = rule.getAssertion(filter.getAssertionValue());
|
return assertion.createIndexQuery(indexQueryFactory);
|
}
|
break;
|
|
case PRESENCE:
|
return indexQueryFactory.createMatchAllQuery();
|
|
case GREATER_OR_EQUAL:
|
rule = filter.getAttributeType().getOrderingMatchingRule();
|
if (rule != null) {
|
Assertion assertion = rule.getGreaterOrEqualAssertion(filter.getAssertionValue());
|
return assertion.createIndexQuery(indexQueryFactory);
|
}
|
break;
|
|
case LESS_OR_EQUAL:
|
rule = filter.getAttributeType().getOrderingMatchingRule();
|
if (rule != null) {
|
Assertion assertion = rule.getLessOrEqualAssertion(filter.getAssertionValue());
|
return assertion.createIndexQuery(indexQueryFactory);
|
}
|
break;
|
|
case SUBSTRING:
|
rule = filter.getAttributeType().getSubstringMatchingRule();
|
if (rule != null) {
|
Assertion assertion = rule.getSubstringAssertion(filter.getSubInitialElement(),
|
filter.getSubAnyElements(),
|
filter.getSubFinalElement());
|
return assertion.createIndexQuery(indexQueryFactory);
|
}
|
break;
|
|
case APPROXIMATE:
|
rule = filter.getAttributeType().getApproximateMatchingRule();
|
if (rule != null) {
|
Assertion assertion = rule.getAssertion(filter.getAssertionValue());
|
return assertion.createIndexQuery(indexQueryFactory);
|
}
|
break;
|
|
default:
|
break;
|
}
|
|
// The filter is undefined.
|
return indexQueryFactory.createMatchAllQuery();
|
}
|
|
/**
|
* Get a string representation of this object.
|
* @return return A string representation of this object.
|
*/
|
@Override
|
public String toString()
|
{
|
return getName();
|
}
|
|
@Override
|
public synchronized boolean isConfigurationChangeAcceptable(
|
BackendIndexCfg cfg, List<LocalizableMessage> unacceptableReasons)
|
{
|
return isIndexConfidentialityAcceptable(cfg, unacceptableReasons)
|
&& isIndexAcceptable(cfg, IndexType.EQUALITY, unacceptableReasons)
|
&& isIndexAcceptable(cfg, IndexType.SUBSTRING, unacceptableReasons)
|
&& isIndexAcceptable(cfg, IndexType.ORDERING, unacceptableReasons)
|
&& isIndexAcceptable(cfg, IndexType.APPROXIMATE, unacceptableReasons)
|
&& isExtensibleIndexAcceptable(cfg, unacceptableReasons);
|
}
|
|
private boolean isIndexConfidentialityAcceptable(BackendIndexCfg cfg, List<LocalizableMessage> unacceptableReasons)
|
{
|
if (!entryContainer.isConfidentialityEnabled() && cfg.isConfidentialityEnabled())
|
{
|
unacceptableReasons.add(ERR_CLEARTEXT_BACKEND_FOR_INDEX_CONFIDENTIALITY.get(cfg.getAttribute().getNameOrOID()));
|
return false;
|
}
|
return true;
|
}
|
|
private boolean isExtensibleIndexAcceptable(BackendIndexCfg cfg, List<LocalizableMessage> unacceptableReasons)
|
{
|
IndexType indexType = IndexType.EXTENSIBLE;
|
AttributeType attrType = cfg.getAttribute();
|
if (cfg.getIndexType().contains(indexType))
|
{
|
Set<String> newRules = cfg.getIndexExtensibleMatchingRule();
|
if (newRules == null || newRules.isEmpty())
|
{
|
unacceptableReasons.add(ERR_CONFIG_INDEX_TYPE_NEEDS_MATCHING_RULE.get(attrType, indexType));
|
return false;
|
}
|
}
|
return true;
|
}
|
|
private static boolean isIndexAcceptable(BackendIndexCfg cfg, IndexType indexType,
|
List<LocalizableMessage> unacceptableReasons)
|
{
|
final AttributeType attrType = cfg.getAttribute();
|
if (cfg.getIndexType().contains(indexType) && getMatchingRule(indexType, attrType) == null)
|
{
|
unacceptableReasons.add(ERR_CONFIG_INDEX_TYPE_NEEDS_MATCHING_RULE.get(attrType, indexType));
|
return false;
|
}
|
return true;
|
}
|
|
static MatchingRule getMatchingRule(IndexType indexType, AttributeType attrType)
|
{
|
switch (indexType)
|
{
|
case APPROXIMATE:
|
return attrType.getApproximateMatchingRule();
|
case EQUALITY:
|
return attrType.getEqualityMatchingRule();
|
case ORDERING:
|
return attrType.getOrderingMatchingRule();
|
case SUBSTRING:
|
return attrType.getSubstringMatchingRule();
|
default:
|
throw new IllegalArgumentException("Not implemented for index type " + indexType);
|
}
|
}
|
|
@Override
|
public synchronized ConfigChangeResult applyConfigurationChange(final BackendIndexCfg newConfiguration)
|
{
|
final ConfigChangeResult ccr = new ConfigChangeResult();
|
final IndexingOptions newIndexingOptions = new IndexingOptionsImpl(newConfiguration.getSubstringLength());
|
// Drop what an earlier index left behind for the added ids, in a write of its own: the drop and the open
|
// must not share a transaction, see dropLeftovers(). discarded is filled by that write and reported from
|
// the finally below: every attempt fills it afresh, so a replayed attempt repeats nothing, and the report
|
// is not skipped when the write which opens the added indexes - or a later write of this change - throws
|
// after it, nor when the drop write fails at its own commit, for the reason dropLeftovers() gives.
|
final List<MatchingRuleIndex> discarded = new ArrayList<>();
|
try
|
{
|
final Map<String, MatchingRuleIndex> newIndexIdToIndexes = buildIndexes(entryContainer, state, newConfiguration,
|
cryptoSuite);
|
|
final Map<String, MatchingRuleIndex> removedIndexes = new HashMap<>(indexIdToIndexes);
|
removedIndexes.keySet().removeAll(newIndexIdToIndexes.keySet());
|
|
final Map<String, MatchingRuleIndex> addedIndexes = new HashMap<>(newIndexIdToIndexes);
|
addedIndexes.keySet().removeAll(indexIdToIndexes.keySet());
|
|
final Map<String, MatchingRuleIndex> updatedIndexes = new HashMap<>(indexIdToIndexes);
|
updatedIndexes.keySet().retainAll(newIndexIdToIndexes.keySet());
|
|
// Replace instances of Index created by buildIndexes() with the one already opened and present in the actual
|
// indexIdToIndexes
|
newIndexIdToIndexes.putAll(updatedIndexes);
|
|
// What the new configuration asks of the indexes which stay is decided here, before any of
|
// the writes below, and reported here as well. Decided before the write which applies
|
// it: neither the entry limit an index holds nor its in-memory trusted flag is rolled back
|
// with the transaction, while the removal of the persisted TRUSTED flag is, so an attempt
|
// which rolls back would leave the raised limit in place, and a replay of it would compare
|
// that limit against itself, find nothing to rebuild, and commit an index whose entry limit
|
// was raised and which the storage still records as trusted. Reported before the writes
|
// rather than once they have committed, because the instruction holds whichever way they go:
|
// the configuration entry already holds the raised limit when this listener runs, and the
|
// next open of the index applies it to a tree whose keys were given up under the lower one.
|
// Only the limit itself waits for the write which untrusts the index to commit. The
|
// confidentiality is asked of the indexes rather than of the configuration this attribute
|
// index holds, or of the suite they share: the suite is switched outside the writes below and
|
// is not rolled back with them, so from the moment the change is asked for it reads as
|
// applied, while a tree stays in the encoding it was opened under until those writes have
|
// given it up and opened it again. What an index was opened under is what the index alone
|
// carries - and what a give-up of the reopen puts back - so it is the index which answers
|
// whether the change asked for is still to be made.
|
final List<Index> indexesToUntrust = new ArrayList<>();
|
final List<MatchingRuleIndex> treesToGiveUp = new ArrayList<>();
|
final List<LocalizableMessage> rebuildMessages = new ArrayList<>();
|
planIndexUpdates(updatedIndexes.values(), newConfiguration, indexesToUntrust, treesToGiveUp, rebuildMessages);
|
for (LocalizableMessage rebuildMessage : rebuildMessages)
|
{
|
ccr.setAdminActionRequired(true);
|
ccr.addMessage(rebuildMessage);
|
}
|
|
// A change which adds no index has nothing to drop, and opens no transaction for it - as the
|
// write which untrusts an index below opens none when there is nothing to untrust.
|
if (!addedIndexes.isEmpty())
|
{
|
entryContainer.getRootContainer().getStorage().write(new WriteOperation()
|
{
|
@Override
|
public void run(WriteableTransaction txn) throws Exception
|
{
|
discarded.clear();
|
for (MatchingRuleIndex addedIndex : addedIndexes.values())
|
{
|
if (dropLeftoversOf(txn, addedIndex))
|
{
|
discarded.add(addedIndex);
|
}
|
}
|
}
|
});
|
}
|
|
// The confidentiality of an index is carried by the CryptoSuite the indexes of its attribute
|
// share, and read from that suite by every index which opens a tree, so the new setting has to
|
// be in force before the indexes added below bind their codecs to it. Applied outside the
|
// writes, which the storage may replay: it changes a live object rather than the storage, and
|
// is idempotent - so it is compared with what the suite carries, not with the configuration.
|
if (cryptoSuite.isEncrypted() != newConfiguration.isConfidentialityEnabled())
|
{
|
entryContainer.setIndexConfidentiality(cryptoSuite, newConfiguration.isConfidentialityEnabled());
|
}
|
|
// Open added indexes *before* adding them to indexIdToIndexes
|
final List<TreeName> addedIndexesToRebuild = new ArrayList<>();
|
entryContainer.getRootContainer().getStorage().write(new WriteOperation()
|
{
|
@Override
|
public void run(WriteableTransaction txn) throws Exception
|
{
|
// Emptied at the start of every attempt: the storage may replay this operation, and what
|
// has to be reported is what the attempt which commits found, not what every attempt did.
|
addedIndexesToRebuild.clear();
|
for (MatchingRuleIndex addedIndex : addedIndexes.values())
|
{
|
if (createIndex(txn, addedIndex))
|
{
|
addedIndexesToRebuild.add(addedIndex.getName());
|
}
|
}
|
}
|
});
|
// Reported once that write has committed, since a message an attempt which rolls back added
|
// to the result stays there, and the operator would be told once per attempt.
|
// EntryContainer.applyConfigurationAdd reports the index it adds the same way.
|
for (TreeName addedIndex : addedIndexesToRebuild)
|
{
|
ccr.setAdminActionRequired(true);
|
ccr.addMessage(NOTE_INDEX_ADD_REQUIRES_REBUILD.get(addedIndex));
|
}
|
|
// We get exclusive lock to ensure that no query is actually using the indexes that will be deleted.
|
entryContainer.lock();
|
try
|
{
|
entryContainer.getRootContainer().getStorage().write(new WriteOperation()
|
{
|
@Override
|
public void run(WriteableTransaction txn) throws Exception
|
{
|
for (MatchingRuleIndex removedIndex : removedIndexes.values())
|
{
|
deleteIndex(txn, entryContainer, removedIndex);
|
}
|
}
|
});
|
// Published once the deletion has committed, not before it: a write the storage gives up on
|
// leaves the trees of the removed indexes behind, and a map which no longer names them is a
|
// map through which nothing maintains them and nothing deletes them. The lock has drained
|
// every operation which enters through shared access, so the window in which the map names
|
// trees the write has just deleted lies inside it and no search sees it; published after the
|
// write rather than from within it, so that an operation the storage replays publishes once,
|
// from the attempt which committed. The added indexes are named only at the end of that
|
// window rather than before the deletion, which costs nothing: the write above has just
|
// asked for them to be rebuilt, so nothing may read them until it has been.
|
indexingOptions = newIndexingOptions;
|
indexIdToIndexes = Collections.unmodifiableMap(newIndexIdToIndexes);
|
}
|
finally
|
{
|
entryContainer.unlock();
|
}
|
|
if (!treesToGiveUp.isEmpty())
|
{
|
// No query may be reading a tree which is being given up and opened again below - the same
|
// exclusive access the removal of an index takes.
|
entryContainer.lock();
|
try
|
{
|
writeUntrust(indexesToUntrust, treesToGiveUp);
|
// Held so that a give-up of the reopen below can be put back to what it answered before:
|
// what afterOpen binds is memory, and outlives a write the storage rolled back, while the
|
// tree it opened is not - so a re-apply which trusted that binding would agree with the
|
// new setting and never open the tree the write above just deleted.
|
final List<IndexBinding> bindings = new ArrayList<>(treesToGiveUp.size());
|
for (final MatchingRuleIndex givenUp : treesToGiveUp)
|
{
|
bindings.add(new IndexBinding(givenUp));
|
}
|
try
|
{
|
// In a write of its own, since the storage engines delete and create the tree of an index
|
// as operations of their own - as removing and adding an index does - rather than as a
|
// deletion and a creation one transaction carries together. The write above is the one
|
// which untrusts and deletes, so a change interrupted in between leaves an index the next
|
// open of this container creates empty and keeps degraded, rather than a trusted one
|
// holding nothing.
|
entryContainer.getRootContainer().getStorage().write(new WriteOperation()
|
{
|
@Override
|
public void run(WriteableTransaction txn) throws Exception
|
{
|
for (final MatchingRuleIndex givenUp : treesToGiveUp)
|
{
|
// Which is what binds the codec of the index to the confidentiality now in force.
|
givenUp.open(txn, true);
|
}
|
}
|
});
|
}
|
catch (Exception e)
|
{
|
for (IndexBinding binding : bindings)
|
{
|
binding.revert();
|
}
|
throw e;
|
}
|
}
|
finally
|
{
|
entryContainer.unlock();
|
}
|
}
|
else if (!indexesToUntrust.isEmpty())
|
{
|
// The only part of what the indexes which stay are asked for that is written down. A change
|
// which untrusts none of them - a lowered limit - opens no transaction, rather than one a
|
// bounded storage could give up on with nothing to give up; VLVIndex guards its write the
|
// same way. A change of the entry limit alone leaves the trees where they are, and needs no
|
// exclusive access of its own.
|
writeUntrust(indexesToUntrust, treesToGiveUp);
|
}
|
for (final Index updatedIndex : updatedIndexes.values())
|
{
|
updatedIndex.setIndexEntryLimit(newConfiguration.getIndexEntryLimit());
|
}
|
// Published last: the entry limit this configuration declares reaches the indexes which stay
|
// only once the write which untrusts them has committed, so a configuration published before
|
// that would declare a limit those indexes do not hold yet.
|
config = newConfiguration;
|
}
|
catch (Exception e)
|
{
|
// Logged as well as reported, for the reason given in the index delete listener of
|
// EntryContainer: what this index holds and what its configuration declares may no longer
|
// agree long after the session which asked for the change has ended.
|
final LocalizableMessage message = ERR_CONFIG_INDEX_CHANGE_FAILED.get(getAttributeType().getNameOrOID(),
|
entryContainer.getBaseDN(), StaticUtils.stackTraceToSingleLineString(e));
|
logger.error(message);
|
ccr.setResultCode(DirectoryServer.getCoreConfigManager().getServerErrorResultCode());
|
ccr.setAdminActionRequired(true);
|
ccr.addMessage(message);
|
}
|
finally
|
{
|
for (MatchingRuleIndex index : discarded)
|
{
|
reportDiscardedLeftovers(ccr, index.getName(), entryContainer.getBaseDN());
|
}
|
}
|
|
return ccr;
|
}
|
|
/**
|
* Untrusts the indexes which are kept and may no longer be trusted, in a write of its own, and
|
* gives up the trees of those whose confidentiality changes in that same write.
|
*/
|
private void writeUntrust(final List<Index> indexesToUntrust, final List<MatchingRuleIndex> treesToGiveUp)
|
throws Exception
|
{
|
entryContainer.getRootContainer().getStorage().write(new WriteOperation()
|
{
|
@Override
|
public void run(WriteableTransaction txn) throws Exception
|
{
|
for (final Index updatedIndex : indexesToUntrust)
|
{
|
updatedIndex.setTrusted(txn, false);
|
}
|
for (final MatchingRuleIndex givenUp : treesToGiveUp)
|
{
|
/*
|
* What this tree holds was written in the encoding of the setting which has just been given
|
* up, and the codec of the new one does not read it back as what it is: an encrypted record
|
* read as clear text decodes to an empty set of entry IDs rather than failing, which is a
|
* search answered with no entries at all. So the tree is given up here rather than left to
|
* the rebuild this change asks for, leaving an index which answers "undefined" - and is
|
* therefore not used - until that rebuild has run.
|
*
|
* Deleted rather than emptied record by record, which for an index of any size would be a
|
* transaction of its own making. The state record of the index is kept, so the tree the
|
* caller opens again is written back in the serialization this one was created with.
|
*
|
* Guarded by whether the tree is still there: a change asked for again after a give-up of
|
* the write which reopens it finds this index still to give up, since the setting it was
|
* opened under was put back, but the write which deleted it already committed the first
|
* time - deleting an already given-up tree a second time is what the storage answers this
|
* with otherwise.
|
*/
|
if (txn.treeExists(givenUp.getName()))
|
{
|
givenUp.delete(txn);
|
}
|
}
|
}
|
});
|
}
|
|
/**
|
* What an index answered before its tree was given up, kept so it can be put back if the reopen
|
* which follows gives its commit up. Taken after the write which untrusts, so the trust it holds
|
* is the one that write committed.
|
*/
|
private static final class IndexBinding
|
{
|
private final MatchingRuleIndex index;
|
private final boolean encrypted;
|
private final EntryIDSetCodec codec;
|
private final boolean trusted;
|
|
IndexBinding(MatchingRuleIndex index)
|
{
|
this.index = index;
|
this.encrypted = index.isEncrypted();
|
this.codec = index.codec();
|
this.trusted = index.isTrusted();
|
}
|
|
void revert()
|
{
|
index.revertFailedReopen(encrypted, codec, trusted);
|
}
|
}
|
|
/**
|
* Opens an index this change adds, and answers whether it has to be rebuilt before it is used.
|
* Answered to the caller rather than reported from here: this runs inside a {@link WriteOperation}
|
* the storage may replay, and the report belongs to the attempt which commits.
|
*/
|
private static boolean createIndex(WriteableTransaction txn, MatchingRuleIndex index)
|
{
|
index.open(txn, true);
|
return !index.isTrusted();
|
}
|
|
/**
|
* Works out what the new configuration asks of the indexes which stay: which of them may no longer
|
* be trusted, and what the operator has to be told about each of them. Decided from the state the
|
* indexes are in before anything is applied to them, so that a write the storage replays reaches
|
* the same answer on every attempt.
|
*/
|
private static void planIndexUpdates(Collection<MatchingRuleIndex> updatedIndexes, BackendIndexCfg newConfig,
|
List<Index> indexesToUntrust, List<MatchingRuleIndex> treesToGiveUp, List<LocalizableMessage> rebuildMessages)
|
{
|
for (MatchingRuleIndex updatedIndex : updatedIndexes)
|
{
|
// This index could still be used since a new smaller index size limit doesn't impact validity of the results.
|
boolean newLimitRequiresRebuild = updatedIndex.getIndexEntryLimit() < newConfig.getIndexEntryLimit();
|
if (newLimitRequiresRebuild)
|
{
|
rebuildMessages.add(NOTE_CONFIG_INDEX_ENTRY_LIMIT_REQUIRES_REBUILD.get(updatedIndex.getName()));
|
}
|
// A change of the confidentiality gives up the tree of this index, whichever way it goes. The
|
// index answers whether it writes under the setting asked for: the tree it holds is in the
|
// encoding it was opened under, until the change gives it up and opens it again. An index whose
|
// every tree is replaced, as enabling the confidentiality of an equality index does, is not
|
// among those asked, and so has nothing to give up or to open again.
|
boolean newConfidentialityRequiresRebuild = updatedIndex.isEncrypted() != newConfig.isConfidentialityEnabled();
|
if (newConfidentialityRequiresRebuild)
|
{
|
rebuildMessages.add(NOTE_CONFIG_INDEX_CONFIDENTIALITY_REQUIRES_REBUILD.get(updatedIndex.getName()));
|
treesToGiveUp.add(updatedIndex);
|
}
|
if (newLimitRequiresRebuild || newConfidentialityRequiresRebuild)
|
{
|
indexesToUntrust.add(updatedIndex);
|
}
|
}
|
}
|
|
private static void deleteIndex(WriteableTransaction txn, EntryContainer entryContainer, Index index)
|
{
|
entryContainer.exclusiveLock.lock();
|
try
|
{
|
entryContainer.deleteTree(txn, index);
|
}
|
finally
|
{
|
entryContainer.exclusiveLock.unlock();
|
}
|
}
|
|
/**
|
* Return true iff this index is trusted.
|
* @return the trusted state of this index
|
*/
|
boolean isTrusted()
|
{
|
for (Index index : indexIdToIndexes.values())
|
{
|
if (!index.isTrusted())
|
{
|
return false;
|
}
|
}
|
return true;
|
}
|
|
boolean isConfidentialityEnabled()
|
{
|
return config.isConfidentialityEnabled();
|
}
|
|
/**
|
* Get the tree name prefix for indexes in this attribute index.
|
*
|
* @return tree name for this container.
|
*/
|
String getName()
|
{
|
return entryContainer.getTreePrefix()
|
+ "_"
|
+ config.getAttribute().getNameOrOID();
|
}
|
|
Map<String, MatchingRuleIndex> getNameToIndexes()
|
{
|
return indexIdToIndexes;
|
}
|
|
/**
|
* Retrieve the entry IDs that might match an extensible filter.
|
*
|
* @param indexQueryFactory the index query factory to use for the evaluation
|
* @param filter The extensible filter.
|
* @param debugBuffer If not null, a diagnostic string will be written
|
* which will help determine how the indexes contributed
|
* to this search.
|
* @param monitor The backend monitor provider that will keep
|
* index filter usage statistics.
|
* @return The candidate entry IDs that might contain the filter assertion value.
|
*/
|
EntryIDSet evaluateExtensibleFilter(IndexQueryFactory<IndexQuery> indexQueryFactory,
|
SearchFilter filter, StringBuilder debugBuffer, BackendMonitor monitor)
|
{
|
//Get the Matching Rule OID of the filter.
|
String matchRuleOID = filter.getMatchingRuleID();
|
/*
|
* Use the default equality index in two conditions:
|
* 1. There is no matching rule provided
|
* 2. The matching rule specified is actually the default equality.
|
*/
|
MatchingRule eqRule = config.getAttribute().getEqualityMatchingRule();
|
if (matchRuleOID == null
|
|| matchRuleOID.equals(eqRule.getOID())
|
|| matchRuleOID.equalsIgnoreCase(eqRule.getNameOrOID()))
|
{
|
//No matching rule is defined; use the default equality matching rule.
|
return evaluateFilter(indexQueryFactory, IndexFilterType.EQUALITY, filter, debugBuffer, monitor);
|
}
|
|
MatchingRule rule = getSchema().getMatchingRule(matchRuleOID);
|
if (!ruleHasAtLeastOneIndex(rule))
|
{
|
if (monitor.isFilterUseEnabled())
|
{
|
monitor.updateStats(filter,
|
INFO_INDEX_FILTER_MATCHING_RULE_NOT_INDEXED.get(matchRuleOID, config.getAttribute().getNameOrOID()));
|
}
|
return IndexQueryFactoryImpl.createNullIndexQuery().evaluate(null, null);
|
}
|
|
try
|
{
|
// FIXME equivalent code exists in evaluateIndexQuery()
|
final IndexQuery indexQuery = rule.getAssertion(filter.getAssertionValue()).createIndexQuery(indexQueryFactory);
|
LocalizableMessageBuilder debugMessage = monitor.isFilterUseEnabled() ? new LocalizableMessageBuilder() : null;
|
StringBuilder indexNameOut = debugBuffer == null ? null : new StringBuilder();
|
EntryIDSet results = indexQuery.evaluate(debugMessage, indexNameOut);
|
|
if (debugBuffer != null)
|
{
|
appendDebugIndexesInformation(debugBuffer, filter.getAttributeType(), rule.createIndexers(indexingOptions));
|
appendDebugUnindexedInformation(debugBuffer, filter.getAttributeType(), indexNameOut);
|
}
|
|
updateStats(monitor, filter, results, debugMessage);
|
return results;
|
}
|
catch (DecodeException e)
|
{
|
logger.traceException(e);
|
return IndexQueryFactoryImpl.createNullIndexQuery().evaluate(null, null);
|
}
|
}
|
|
private static Schema getSchema()
|
{
|
return DirectoryServer.getInstance().getServerContext().getSchema();
|
}
|
|
private boolean ruleHasAtLeastOneIndex(MatchingRule rule)
|
{
|
for (Indexer indexer : rule.createIndexers(indexingOptions))
|
{
|
if (indexIdToIndexes.containsKey(indexer.getIndexID()))
|
{
|
return true;
|
}
|
}
|
return false;
|
}
|
|
/** Indexing options implementation. */
|
private static final class IndexingOptionsImpl implements IndexingOptions
|
{
|
/** The length of substring keys used in substring indexes. */
|
private int substringKeySize;
|
|
private IndexingOptionsImpl(int substringKeySize)
|
{
|
this.substringKeySize = substringKeySize;
|
}
|
|
@Override
|
public int substringKeySize()
|
{
|
return substringKeySize;
|
}
|
}
|
|
void closeAndDelete(WriteableTransaction txn)
|
{
|
close();
|
for (Index index : indexIdToIndexes.values())
|
{
|
index.delete(txn);
|
state.deleteRecord(txn, index.getName());
|
}
|
}
|
}
|
