cmd/dump: add keep-secret-key option

juicedata · Sep 8, 2022 · af4f73b · af4f73b
1 parent 4963abd
commit af4f73b
Show file tree

Hide file tree

Showing 7 changed files with 17 additions and 13 deletions.
diff --git a/cmd/dump.go b/cmd/dump.go
@@ -48,6 +48,10 @@ Details: https://juicefs.com/docs/community/metadata_dump_load`,
 				Name:  "subdir",
 				Usage: "only dump a sub-directory",
 			},
+			&cli.BoolFlag{
+				Name:  "keep-secret-key",
+				Usage: "keep secret keys intact (WARNING: Be careful as they may be leaked)",
+			},
 		},
 	}
 }
@@ -70,7 +74,7 @@ func dump(ctx *cli.Context) error {
 	if _, err := m.Load(true); err != nil {
 		return err
 	}
-	if err := m.DumpMeta(fp, 1); err != nil {
+	if err := m.DumpMeta(fp, 1, ctx.Bool("keep-secret-key")); err != nil {
 		return err
 	}
 	logger.Infof("Dump metadata into %s succeed", ctx.Args().Get(1))

diff --git a/pkg/meta/interface.go b/pkg/meta/interface.go
@@ -356,7 +356,7 @@ type Meta interface {
 	OnMsg(mtype uint32, cb MsgCallback)
 
 	// Dump the tree under root, which may be modified by checkRoot
-	DumpMeta(w io.Writer, root Ino) error
+	DumpMeta(w io.Writer, root Ino, keepSecret bool) error
 	LoadMeta(r io.Reader) error
 
 	// getBase return the base engine.

diff --git a/pkg/meta/load_dump_test.go b/pkg/meta/load_dump_test.go
@@ -197,7 +197,7 @@ func testDump(t *testing.T, m Meta, root Ino, expect, result string) {
 	if _, err = m.Load(true); err != nil {
 		t.Fatalf("load setting: %s", err)
 	}
-	if err = m.DumpMeta(fp, root); err != nil {
+	if err = m.DumpMeta(fp, root, false); err != nil {
 		t.Fatalf("dump meta: %s", err)
 	}
 	cmd := exec.Command("diff", expect, result)

diff --git a/pkg/meta/redis.go b/pkg/meta/redis.go
@@ -3178,7 +3178,7 @@ func (m *redisMeta) dumpDir(inode Ino, tree *DumpedEntry, bw *bufio.Writer, dept
 	return nil
 }
 
-func (m *redisMeta) DumpMeta(w io.Writer, root Ino) (err error) {
+func (m *redisMeta) DumpMeta(w io.Writer, root Ino, keepSecret bool) (err error) {
 	defer func() {
 		if p := recover(); p != nil {
 			if e, ok := p.(error); ok {
@@ -3253,11 +3253,11 @@ func (m *redisMeta) DumpMeta(w io.Writer, root Ino) (err error) {
 		Sustained: sessions,
 		DelFiles:  dels,
 	}
-	if dm.Setting.SecretKey != "" {
+	if !keepSecret && dm.Setting.SecretKey != "" {
 		dm.Setting.SecretKey = "removed"
 		logger.Warnf("Secret key is removed for the sake of safety")
 	}
-	if dm.Setting.SessionToken != "" {
+	if !keepSecret && dm.Setting.SessionToken != "" {
 		dm.Setting.SessionToken = "removed"
 		logger.Warnf("Session token is removed for the sake of safety")
 	}

diff --git a/pkg/meta/sql.go b/pkg/meta/sql.go
@@ -2945,7 +2945,7 @@ func (m *dbMeta) makeSnap(ses *xorm.Session, bar *utils.Bar) error {
 	return nil
 }
 
-func (m *dbMeta) DumpMeta(w io.Writer, root Ino) (err error) {
+func (m *dbMeta) DumpMeta(w io.Writer, root Ino, keepSecret bool) (err error) {
 	defer func() {
 		if p := recover(); p != nil {
 			if e, ok := p.(error); ok {
@@ -3030,11 +3030,11 @@ func (m *dbMeta) DumpMeta(w io.Writer, root Ino) (err error) {
 			Sustained: sessions,
 			DelFiles:  dels,
 		}
-		if dm.Setting.SecretKey != "" {
+		if !keepSecret && dm.Setting.SecretKey != "" {
 			dm.Setting.SecretKey = "removed"
 			logger.Warnf("Secret key is removed for the sake of safety")
 		}
-		if dm.Setting.SessionToken != "" {
+		if !keepSecret && dm.Setting.SessionToken != "" {
 			dm.Setting.SessionToken = "removed"
 			logger.Warnf("Session token is removed for the sake of safety")
 		}

diff --git a/pkg/meta/tkv.go b/pkg/meta/tkv.go
@@ -2416,7 +2416,7 @@ func (m *kvMeta) dumpDir(inode Ino, tree *DumpedEntry, bw *bufio.Writer, depth i
 	return nil
 }
 
-func (m *kvMeta) DumpMeta(w io.Writer, root Ino) (err error) {
+func (m *kvMeta) DumpMeta(w io.Writer, root Ino, keepSecret bool) (err error) {
 	defer func() {
 		if p := recover(); p != nil {
 			debug.PrintStack()
@@ -2587,11 +2587,11 @@ func (m *kvMeta) DumpMeta(w io.Writer, root Ino) (err error) {
 		Sustained: sessions,
 		DelFiles:  dels,
 	}
-	if dm.Setting.SecretKey != "" {
+	if !keepSecret && dm.Setting.SecretKey != "" {
 		dm.Setting.SecretKey = "removed"
 		logger.Warnf("Secret key is removed for the sake of safety")
 	}
-	if dm.Setting.SessionToken != "" {
+	if !keepSecret && dm.Setting.SessionToken != "" {
 		dm.Setting.SessionToken = "removed"
 		logger.Warnf("Session token is removed for the sake of safety")
 	}

diff --git a/pkg/vfs/backup.go b/pkg/vfs/backup.go
@@ -84,7 +84,7 @@ func backup(m meta.Meta, blob object.ObjectStorage, now time.Time) error {
 	defer os.Remove(fpath)
 	defer fp.Close()
 	zw := gzip.NewWriter(fp)
-	err = m.DumpMeta(zw, 0) // force dump the whole tree
+	err = m.DumpMeta(zw, 0, false) // force dump the whole tree
 	_ = zw.Close()
 	if err != nil {
 		return err