enh: add token transport #34012
enh: add token transport #34012
Conversation
yihaoDeng
requested review from
dapan1121,
guanshengliang and
hzcheng
as code owners
Summary of ChangesHello @yihaoDeng, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the system's transport layer by integrating support for token-based identification. It introduces new data fields and modifies existing functions and message handling logic to allow connections to be established and identified using either traditional user credentials or a new token-based mechanism. This change provides greater flexibility in how clients authenticate and interact with the system, laying the groundwork for more diverse security and access control strategies. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](/s/com/githubusercontent/avatars/G.https/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces support for token-based authentication in the transport layer. The changes include updating data structures to carry token information and modifying client and server logic to handle this new authentication method. While the overall direction is good, I've identified a critical memory corruption vulnerability on the server-side due to incorrect memory allocation. Additionally, the client-side implementation for token authentication appears to be incomplete, using hardcoded placeholder values. I've also noted a minor maintainability issue with a confusing field name. These issues should be addressed to ensure the feature is robust and secure.
source/libs/transport/src/transSvr.c
Outdated
| } | ||
|
|
||
| if (pHead->withUserInfo) { | ||
| STransMsgHead* tHead = taosMemoryCalloc(1, len - sizeof(pInst->user)); |
There was a problem hiding this comment.
There's a potential memory corruption bug here. The memory for tHead is allocated using sizeof(pInst->user), but it should use the offset variable, which correctly reflects the size of either the user or the identifier. If isToken is true, offset will be sizeof(pConn->identifier), which might be different from sizeof(pInst->user), leading to an incorrect allocation size. This could cause a buffer overflow in the subsequent memcpy.
STransMsgHead* tHead = taosMemoryCalloc(1, len - offset);
source/client/src/clientImpl.c
Outdated
| TSC_ERR_JRET(code); | ||
| } | ||
| code = openTransporter(user, secretEncrypt, tsNumOfCores / 2, &p->pTransporter); | ||
| code = openTransporter(user ? user : "<token>", 0, tsNumOfCores / 2, &p->pTransporter); |
There was a problem hiding this comment.
The call to openTransporter appears to have incorrect or incomplete logic for token-based authentication. The isToken parameter is hardcoded to 0, and a magic string "<token>" is used as the identifier when user is null. This will not work for actual token authentication and seems to be a placeholder. This should be updated to correctly handle tokens, likely by passing a real token and setting isToken to 1 when appropriate.
source/client/src/clientEnv.c
Outdated
| rpcInit.sessions = 1024; | ||
| rpcInit.connType = TAOS_CONN_CLIENT; | ||
| rpcInit.user = (char *)user; | ||
| rpcInit.user = (char *)identifier; |
There was a problem hiding this comment.
The rpcInit.user field is now being used to store an identifier which can be either a username or a token. This can be confusing given its name and the original comment in its definition. To improve clarity and maintainability, consider renaming the user field in the SRpcInit struct (defined in include/libs/transport/trpc.h) to something more generic like identifier.
Description
Issue(s)
Checklist
Please check the items in the checklist if applicable.