Update 20230707_01.md

Author: digoal

202307/20230707_01.md

@@ -238,6 +238,121 @@ anon 用法参考:
 - [《PostgreSQL 敏感信息遮掩插件 anon (Anonymizer) - security label provider - anon》](../201911/20191115_03.md)    
 - [《Anonymization & Data Masking for PostgreSQL - 自动脱敏控制 - oracle data vault - postgresql-anonymizer》](../201908/20190817_03.md)    
 
+  
+`git clone --depth 1 https://gitlab.com/dalibo/postgresql_anonymizer/ ` 
+  
+security label的实现逻辑如下:    
+  
+![pic](20230707_01_pic_001.jpg)  
+  
+security label的实现核心是通过钩子加入一些执行代码, 例如将原始值进行修改, 限制权限等.     
+  
+以anon插件为例.  
+  
+使用`_PG_init`注册了几个钩子函数, 在parser analyze产生raw query tree后植入代码逻辑. 在ProcessUtility (也就是ddl, dcl等语句)后执行代码逻辑.   
+  
+  
+```  
+/*  
+ * Register the extension and declare its GUC variables  
+ */  
+void  
+_PG_init(void)  
+{  
+  
+...  
+  
+  /* Install the hooks */  
+  prev_post_parse_analyze_hook = post_parse_analyze_hook;  
+  post_parse_analyze_hook = pa_post_parse_analyze_hook;  
+  
+  prev_ProcessUtility_hook = ProcessUtility_hook;  
+  ProcessUtility_hook = pa_ProcessUtility_hook;  
+  
+  
+  
+  
+  
+/* Hook for plugins to get control at end of parse analysis */  
+typedef void (*post_parse_analyze_hook_type) (ParseState *pstate,  
+                                                                                          Query *query,  
+                                                                                          JumbleState *jstate);  
+  
+  
+/* Hook for plugins to get control in ProcessUtility() */  
+typedef void (*ProcessUtility_hook_type) (PlannedStmt *pstmt,  
+                                                                                  const char *queryString,  
+                                                                                  bool readOnlyTree,  
+                                                                                  ProcessUtilityContext context,  
+                                                                                  ParamListInfo params,  
+                                                                                  QueryEnvironment *queryEnv,  
+                                                                                  DestReceiver *dest, QueryCompletion *qc);  
+```  
+  
+anon pa_post_parse_analyze_hook钩子的逻辑:    
+  
+```  
+/*  
+ * Post-parse-analysis hook: mask query  
+ * https://github.com/taminomara/psql-hooks/blob/master/Detailed.md#post_parse_analyze_hook  
+ */  
+static void  
+#if PG_VERSION_NUM >= 140000  
+pa_post_parse_analyze_hook(ParseState *pstate, Query *query, JumbleState *jstate)  
+#else  
+pa_post_parse_analyze_hook(ParseState *pstate, Query *query)  
+#endif  
+{  
+  char * policy = NULL;  
+  
+  if (prev_post_parse_analyze_hook)  
+    #if PG_VERSION_NUM >= 140000  
+    prev_post_parse_analyze_hook(pstate, query, jstate);  
+    #else  
+    prev_post_parse_analyze_hook(pstate, query);  
+    #endif  
+  
+  if (!IsTransactionState()) return;  
+  if (!guc_anon_transparent_dynamic_masking) return;  
+  
+  policy = pa_get_masking_policy(GetUserId());  
+  if (policy)  
+    pa_rewrite(query,policy);  
+  
+  return;  
+}  
+```  
+  
+  
+  
+PostgreSQL 中post_parse_analyze_hook 钩子的植入部位:    
+  
+```  
+/*  
+ * parse_analyze_fixedparams  
+ *              Analyze a raw parse tree and transform it to Query form.  
+ *  
+ * Optionally, information about $n parameter types can be supplied.  
+ * References to $n indexes not defined by paramTypes[] are disallowed.  
+ *  
+ * The result is a Query node.  Optimizable statements require considerable  
+ * transformation, while utility-type statements are simply hung off  
+ * a dummy CMD_UTILITY Query node.  
+ */  
+Query *  
+parse_analyze_fixedparams(RawStmt *parseTree, const char *sourceText,  
+                                                  const Oid *paramTypes, int numParams,  
+                                                  QueryEnvironment *queryEnv)  
+{  
+.......  
+  
+        if (post_parse_analyze_hook)  
+                (*post_parse_analyze_hook) (pstate, query, jstate);  
+......  
+}  
+```  
+  
+  
 ## security label provider: sepgsql  
 
 https://www.postgresql.org/docs/16/sepgsql.html