encrypt audit log

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/conf/IoTDBConfig.java

@@ -49,6 +49,7 @@
 
 import org.apache.tsfile.common.conf.TSFileDescriptor;
 import org.apache.tsfile.common.constant.TsFileConstant;
+import org.apache.tsfile.encrypt.EncryptParameter;
 import org.apache.tsfile.enums.TSDataType;
 import org.apache.tsfile.file.metadata.enums.CompressionType;
 import org.apache.tsfile.file.metadata.enums.TSEncoding;
@@ -62,9 +63,11 @@
 import java.lang.reflect.Field;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 import java.util.Properties;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.TimeUnit;
 import java.util.regex.Pattern;
 
@@ -1176,6 +1179,10 @@ public class IoTDBConfig {
 
   private boolean includeNullValueInWriteThroughputMetric = false;
 
+  private ConcurrentHashMap<String, EncryptParameter> tsFileDBToEncryptMap =
+      new ConcurrentHashMap<>(
+          Collections.singletonMap("root.__audit", new EncryptParameter("UNENCRYPTED", null)));
+
   IoTDBConfig() {}
 
   public int getMaxLogEntriesNumPerBatch() {
@@ -4225,4 +4232,8 @@ public int getPasswordLockTimeMinutes() {
   public void setPasswordLockTimeMinutes(int passwordLockTimeMinutes) {
     this.passwordLockTimeMinutes = passwordLockTimeMinutes;
   }
+
+  public ConcurrentHashMap<String, EncryptParameter> getTSFileDBToEncryptMap() {
+    return tsFileDBToEncryptMap;
+  }
 }

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/storageengine/dataregion/DataRegion.java

@@ -153,6 +153,7 @@
 import org.apache.iotdb.db.tools.settle.TsFileAndModSettleTool;
 import org.apache.iotdb.db.utils.CommonUtils;
 import org.apache.iotdb.db.utils.DateTimeUtils;
+import org.apache.iotdb.db.utils.EncryptDBUtils;
 import org.apache.iotdb.db.utils.ModificationUtils;
 import org.apache.iotdb.metrics.utils.MetricLevel;
 import org.apache.iotdb.rpc.RpcUtils;
@@ -3087,7 +3088,9 @@ public int executeCompaction() throws InterruptedException {
     if (!isCompactionSelecting.compareAndSet(false, true)) {
       return 0;
     }
-    CompactionScheduleContext context = new CompactionScheduleContext();
+    CompactionScheduleContext context =
+        new CompactionScheduleContext(
+            EncryptDBUtils.getFirstEncryptParamFromDatabase(databaseName));
     try {
       List<Long> timePartitions = new ArrayList<>(tsFileManager.getTimePartitions());
       // Sort the time partition from largest to smallest
@@ -3140,7 +3143,9 @@ public int executeTTLCheck() throws InterruptedException {
         return 0;
       }
       logger.info("[TTL] {}-{} Start ttl and modification checking.", databaseName, dataRegionId);
-      CompactionScheduleContext context = new CompactionScheduleContext();
+      CompactionScheduleContext context =
+          new CompactionScheduleContext(
+              EncryptDBUtils.getFirstEncryptParamFromDatabase(databaseName));
       List<Long> timePartitions = new ArrayList<>(tsFileManager.getTimePartitions());
       // Sort the time partition from smallest to largest
       Collections.sort(timePartitions);

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/storageengine/dataregion/compaction/execute/performer/constant/CrossCompactionPerformer.java

@@ -24,6 +24,8 @@
 import org.apache.iotdb.db.storageengine.dataregion.compaction.execute.performer.impl.FastCompactionPerformer;
 import org.apache.iotdb.db.storageengine.dataregion.compaction.execute.performer.impl.ReadPointCompactionPerformer;
 
+import org.apache.tsfile.encrypt.EncryptParameter;
+
 public enum CrossCompactionPerformer {
   READ_POINT,
   FAST;
@@ -49,4 +51,16 @@ public ICrossCompactionPerformer createInstance() {
             "Illegal compaction performer for cross compaction " + this);
     }
   }
+
+  public ICrossCompactionPerformer createInstance(EncryptParameter encryptParameter) {
+    switch (this) {
+      case READ_POINT:
+        return new ReadPointCompactionPerformer(encryptParameter);
+      case FAST:
+        return new FastCompactionPerformer(true, encryptParameter);
+      default:
+        throw new IllegalCompactionPerformerException(
+            "Illegal compaction performer for cross compaction " + this);
+    }
+  }
 }

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/storageengine/dataregion/compaction/execute/performer/constant/InnerSeqCompactionPerformer.java

@@ -24,6 +24,8 @@
 import org.apache.iotdb.db.storageengine.dataregion.compaction.execute.performer.impl.FastCompactionPerformer;
 import org.apache.iotdb.db.storageengine.dataregion.compaction.execute.performer.impl.ReadChunkCompactionPerformer;
 
+import org.apache.tsfile.encrypt.EncryptParameter;
+
 public enum InnerSeqCompactionPerformer {
   READ_CHUNK,
   FAST;
@@ -49,4 +51,16 @@ public ISeqCompactionPerformer createInstance() {
             "Illegal compaction performer for seq inner compaction " + this);
     }
   }
+
+  public ISeqCompactionPerformer createInstance(EncryptParameter encryptParameter) {
+    switch (this) {
+      case READ_CHUNK:
+        return new ReadChunkCompactionPerformer(encryptParameter);
+      case FAST:
+        return new FastCompactionPerformer(false, encryptParameter);
+      default:
+        throw new IllegalCompactionPerformerException(
+            "Illegal compaction performer for seq inner compaction " + this);
+    }
+  }
 }

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/storageengine/dataregion/compaction/execute/performer/constant/InnerUnseqCompactionPerformer.java

@@ -24,6 +24,8 @@
 import org.apache.iotdb.db.storageengine.dataregion.compaction.execute.performer.impl.FastCompactionPerformer;
 import org.apache.iotdb.db.storageengine.dataregion.compaction.execute.performer.impl.ReadPointCompactionPerformer;
 
+import org.apache.tsfile.encrypt.EncryptParameter;
+
 public enum InnerUnseqCompactionPerformer {
   READ_POINT,
   FAST;
@@ -49,4 +51,16 @@ public IUnseqCompactionPerformer createInstance() {
             "Illegal compaction performer for unseq inner compaction " + this);
     }
   }
+
+  public IUnseqCompactionPerformer createInstance(EncryptParameter encryptParameter) {
+    switch (this) {
+      case READ_POINT:
+        return new ReadPointCompactionPerformer(encryptParameter);
+      case FAST:
+        return new FastCompactionPerformer(false, encryptParameter);
+      default:
+        throw new IllegalCompactionPerformerException(
+            "Illegal compaction performer for unseq inner compaction " + this);
+    }
+  }
 }

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/storageengine/dataregion/compaction/execute/performer/impl/FastCompactionPerformer.java

@@ -47,6 +47,8 @@
 import org.apache.iotdb.db.storageengine.dataregion.tsfile.TsFileResource;
 import org.apache.iotdb.db.utils.datastructure.PatternTreeMapFactory;
 
+import org.apache.tsfile.common.conf.TSFileDescriptor;
+import org.apache.tsfile.encrypt.EncryptParameter;
 import org.apache.tsfile.exception.StopReadTsFileByInterruptException;
 import org.apache.tsfile.exception.write.PageException;
 import org.apache.tsfile.file.metadata.IDeviceID;
@@ -96,6 +98,8 @@ public class FastCompactionPerformer
 
   private final boolean isCrossCompaction;
 
+  private EncryptParameter encryptParameter;
+
   public FastCompactionPerformer(
       List<TsFileResource> seqFiles,
       List<TsFileResource> unseqFiles,
@@ -109,10 +113,40 @@ public FastCompactionPerformer(
     } else {
       isCrossCompaction = true;
     }
+    this.encryptParameter =
+        new EncryptParameter(
+            TSFileDescriptor.getInstance().getConfig().getEncryptType(),
+            TSFileDescriptor.getInstance().getConfig().getEncryptKey());
+  }
+
+  public FastCompactionPerformer(
+      List<TsFileResource> seqFiles,
+      List<TsFileResource> unseqFiles,
+      List<TsFileResource> targetFiles,
+      EncryptParameter encryptParameter) {
+    this.seqFiles = seqFiles;
+    this.unseqFiles = unseqFiles;
+    this.targetFiles = targetFiles;
+    if (seqFiles.isEmpty() || unseqFiles.isEmpty()) {
+      // inner space compaction
+      isCrossCompaction = false;
+    } else {
+      isCrossCompaction = true;
+    }
+    this.encryptParameter = encryptParameter;
   }
 
   public FastCompactionPerformer(boolean isCrossCompaction) {
     this.isCrossCompaction = isCrossCompaction;
+    this.encryptParameter =
+        new EncryptParameter(
+            TSFileDescriptor.getInstance().getConfig().getEncryptType(),
+            TSFileDescriptor.getInstance().getConfig().getEncryptKey());
+  }
+
+  public FastCompactionPerformer(boolean isCrossCompaction, EncryptParameter encryptParameter) {
+    this.isCrossCompaction = isCrossCompaction;
+    this.encryptParameter = encryptParameter;
   }
 
   @Override
@@ -122,8 +156,9 @@ public void perform() throws Exception {
             new MultiTsFileDeviceIterator(seqFiles, unseqFiles, readerCacheMap);
         AbstractCompactionWriter compactionWriter =
             isCrossCompaction
-                ? new FastCrossCompactionWriter(targetFiles, seqFiles, readerCacheMap)
-                : new FastInnerCompactionWriter(targetFiles)) {
+                ? new FastCrossCompactionWriter(
+                    targetFiles, seqFiles, readerCacheMap, encryptParameter)
+                : new FastInnerCompactionWriter(targetFiles, encryptParameter)) {
       List<Schema> schemas =
           CompactionTableSchemaCollector.collectSchema(seqFiles, unseqFiles, readerCacheMap);
       compactionWriter.setSchemaForAllTargetFile(schemas);

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/storageengine/dataregion/compaction/execute/performer/impl/ReadChunkCompactionPerformer.java

@@ -36,6 +36,8 @@
 import org.apache.iotdb.db.storageengine.dataregion.tsfile.TsFileResource;
 import org.apache.iotdb.db.storageengine.rescon.memory.SystemInfo;
 
+import org.apache.tsfile.common.conf.TSFileDescriptor;
+import org.apache.tsfile.encrypt.EncryptParameter;
 import org.apache.tsfile.enums.TSDataType;
 import org.apache.tsfile.exception.write.PageException;
 import org.apache.tsfile.file.metadata.AbstractAlignedChunkMetadata;
@@ -66,6 +68,8 @@ public class ReadChunkCompactionPerformer implements ISeqCompactionPerformer {
               * IoTDBDescriptor.getInstance().getConfig().getChunkMetadataSizeProportion());
   private Schema schema = null;
 
+  private EncryptParameter firstEncryptParameter;
+
   public ReadChunkCompactionPerformer(List<TsFileResource> sourceFiles, TsFileResource targetFile) {
     this(sourceFiles, Collections.singletonList(targetFile));
   }
@@ -74,13 +78,30 @@ public ReadChunkCompactionPerformer(
       List<TsFileResource> sourceFiles, List<TsFileResource> targetFiles) {
     setSourceFiles(sourceFiles);
     setTargetFiles(targetFiles);
+    this.firstEncryptParameter =
+        new EncryptParameter(
+            TSFileDescriptor.getInstance().getConfig().getEncryptType(),
+            TSFileDescriptor.getInstance().getConfig().getEncryptKey());
   }
 
   public ReadChunkCompactionPerformer(List<TsFileResource> sourceFiles) {
     setSourceFiles(sourceFiles);
+    this.firstEncryptParameter =
+        new EncryptParameter(
+            TSFileDescriptor.getInstance().getConfig().getEncryptType(),
+            TSFileDescriptor.getInstance().getConfig().getEncryptKey());
+  }
+
+  public ReadChunkCompactionPerformer() {
+    this.firstEncryptParameter =
+        new EncryptParameter(
+            TSFileDescriptor.getInstance().getConfig().getEncryptType(),
+            TSFileDescriptor.getInstance().getConfig().getEncryptKey());
   }
 
-  public ReadChunkCompactionPerformer() {}
+  public ReadChunkCompactionPerformer(EncryptParameter encryptParameter) {
+    this.firstEncryptParameter = encryptParameter;
+  }
 
   @Override
   public void perform()
@@ -161,7 +182,8 @@ private void useNewWriter() throws IOException {
         new CompactionTsFileWriter(
             targetResources.get(currentTargetFileIndex).getTsFile(),
             memoryBudgetForFileWriter,
-            CompactionType.INNER_SEQ_COMPACTION);
+            CompactionType.INNER_SEQ_COMPACTION,
+            firstEncryptParameter);
     currentWriter.setSchema(CompactionTableSchemaCollector.copySchema(schema));
   }
 

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/storageengine/dataregion/compaction/execute/performer/impl/ReadPointCompactionPerformer.java

@@ -44,7 +44,10 @@
 import org.apache.iotdb.db.storageengine.dataregion.read.control.QueryResourceManager;
 import org.apache.iotdb.db.storageengine.dataregion.tsfile.TsFileResource;
 
+import org.apache.tsfile.common.conf.TSFileDescriptor;
 import org.apache.tsfile.common.constant.TsFileConstant;
+import org.apache.tsfile.encrypt.EncryptParameter;
+import org.apache.tsfile.encrypt.EncryptUtils;
 import org.apache.tsfile.file.metadata.IDeviceID;
 import org.apache.tsfile.read.common.block.TsBlock;
 import org.apache.tsfile.read.reader.IPointReader;
@@ -83,22 +86,61 @@ public class ReadPointCompactionPerformer
 
   protected List<TsFileResource> targetFiles = Collections.emptyList();
 
+  private EncryptParameter encryptParameter;
+
   public ReadPointCompactionPerformer(
       List<TsFileResource> seqFiles,
       List<TsFileResource> unseqFiles,
       List<TsFileResource> targetFiles) {
     this.seqFiles = seqFiles;
     this.unseqFiles = unseqFiles;
     this.targetFiles = targetFiles;
+    this.encryptParameter =
+        new EncryptParameter(
+            TSFileDescriptor.getInstance().getConfig().getEncryptType(),
+            TSFileDescriptor.getInstance().getConfig().getEncryptKey());
+  }
+
+  public ReadPointCompactionPerformer(
+      List<TsFileResource> seqFiles,
+      List<TsFileResource> unseqFiles,
+      List<TsFileResource> targetFiles,
+      EncryptParameter encryptParameter) {
+    this.seqFiles = seqFiles;
+    this.unseqFiles = unseqFiles;
+    this.targetFiles = targetFiles;
+    this.encryptParameter = encryptParameter;
   }
 
   public ReadPointCompactionPerformer(
       List<TsFileResource> seqFiles, List<TsFileResource> unseqFiles) {
     this.seqFiles = seqFiles;
     this.unseqFiles = unseqFiles;
+    this.encryptParameter =
+        new EncryptParameter(
+            TSFileDescriptor.getInstance().getConfig().getEncryptType(),
+            TSFileDescriptor.getInstance().getConfig().getEncryptKey());
   }
 
-  public ReadPointCompactionPerformer() {}
+  public ReadPointCompactionPerformer(
+      List<TsFileResource> seqFiles,
+      List<TsFileResource> unseqFiles,
+      EncryptParameter encryptParameter) {
+    this.seqFiles = seqFiles;
+    this.unseqFiles = unseqFiles;
+    this.encryptParameter = encryptParameter;
+  }
+
+  public ReadPointCompactionPerformer() {
+    this.encryptParameter =
+        new EncryptParameter(
+            TSFileDescriptor.getInstance().getConfig().getEncryptType(),
+            TSFileDescriptor.getInstance().getConfig().getEncryptKey());
+  }
+
+  public ReadPointCompactionPerformer(EncryptParameter encryptParameter) {
+    this.encryptParameter = encryptParameter;
+  }
 
   @SuppressWarnings("squid:S2095") // Do not close device iterator
   @Override
@@ -159,6 +201,10 @@ public void setSummary(CompactionTaskSummary summary) {
     this.summary = summary;
   }
 
+  public EncryptParameter getEncryptParameter() {
+    return encryptParameter;
+  }
+
   private void compactAlignedSeries(
       IDeviceID device,
       MultiTsFileDeviceIterator deviceIterator,
@@ -194,7 +240,10 @@ private void compactAlignedSeries(
       measurementSchemas.add(0, timeSchema);
       compactionWriter.startMeasurement(
           TsFileConstant.TIME_COLUMN_ID,
-          new AlignedChunkWriterImpl(measurementSchemas.remove(0), measurementSchemas),
+          new AlignedChunkWriterImpl(
+              measurementSchemas.remove(0),
+              measurementSchemas,
+              EncryptUtils.getEncryptParameter(getEncryptParameter())),
           0);
       writeWithReader(compactionWriter, dataBlockReader, device, 0, true);
       compactionWriter.endMeasurement(0);
@@ -303,10 +352,11 @@ protected AbstractCompactionWriter getCompactionWriter(
       throws IOException {
     if (!seqFileResources.isEmpty() && !unseqFileResources.isEmpty()) {
       // cross space
-      return new ReadPointCrossCompactionWriter(targetFileResources, seqFileResources);
+      return new ReadPointCrossCompactionWriter(
+          targetFileResources, seqFileResources, encryptParameter);
     } else {
       // inner space
-      return new ReadPointInnerCompactionWriter(targetFileResources);
+      return new ReadPointInnerCompactionWriter(targetFileResources, encryptParameter);
     }
   }