HBASE-11774 Avoid allocating unnecessary tag iterators

hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessControlLists.java

@@ -686,6 +686,10 @@ public class AccessControlLists {
 
    public static List<Permission> getCellPermissionsForUser(User user, Cell cell)
        throws IOException {
+     // Save an object allocation where we can
+     if (cell.getTagsLength() == 0) {
+       return null;
+     }
      List<Permission> results = Lists.newArrayList();
      Iterator<Tag> tagsIterator = CellUtil.tagsIterator(cell.getTagsArray(), cell.getTagsOffset(),
         cell.getTagsLength());

hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java

@@ -758,12 +758,15 @@ public class AccessController extends BaseMasterAndRegionObserver
     for (Map.Entry<byte[], List<Cell>> e: familyMap.entrySet()) {
       List<Cell> newCells = Lists.newArrayList();
       for (Cell cell: e.getValue()) {
+        // Prepend the supplied perms in a new ACL tag to an update list of tags for the cell
         List<Tag> tags = Lists.newArrayList(new Tag(AccessControlLists.ACL_TAG_TYPE, perms));
+        if (cell.getTagsLength() > 0) {
           Iterator<Tag> tagIterator = CellUtil.tagsIterator(cell.getTagsArray(),
             cell.getTagsOffset(), cell.getTagsLength());
           while (tagIterator.hasNext()) {
             tags.add(tagIterator.next());
           }
+        }
         // Ensure KeyValue so we can do a scatter gather copy. This is only a win if the
         // incoming cell type is actually KeyValue.
         KeyValue kv = KeyValueUtil.ensureKeyValue(cell);
@@ -1694,17 +1697,21 @@ public class AccessController extends BaseMasterAndRegionObserver
     List<Tag> tags = Lists.newArrayList();
     ListMultimap<String,Permission> perms = ArrayListMultimap.create();
     if (oldCell != null) {
+      // Save an object allocation where we can
+      if (oldCell.getTagsLength() > 0) {
         Iterator<Tag> tagIterator = CellUtil.tagsIterator(oldCell.getTagsArray(),
           oldCell.getTagsOffset(), oldCell.getTagsLength());
         while (tagIterator.hasNext()) {
           Tag tag = tagIterator.next();
           if (tag.getType() != AccessControlLists.ACL_TAG_TYPE) {
+            // Not an ACL tag, just carry it through
             if (LOG.isTraceEnabled()) {
               LOG.trace("Carrying forward tag from " + oldCell + ": type " + tag.getType() +
                 " length " + tag.getTagLength());
             }
             tags.add(tag);
           } else {
+            // Merge the perms from the older ACL into the current permission set
             ListMultimap<String,Permission> kvPerms = ProtobufUtil.toUsersAndPermissions(
               AccessControlProtos.UsersAndPermissions.newBuilder().mergeFrom(
                 tag.getBuffer(), tag.getTagOffset(), tag.getTagLength()).build());
@@ -1712,6 +1719,7 @@ public class AccessController extends BaseMasterAndRegionObserver
           }
         }
       }
+    }
 
     // Do we have an ACL on the operation?
     byte[] aclBytes = mutation.getACL();

hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/TableAuthManager.java

@@ -356,13 +356,16 @@ public class TableAuthManager {
     try {
       List<Permission> perms = AccessControlLists.getCellPermissionsForUser(user, cell);
       if (LOG.isTraceEnabled()) {
-        LOG.trace("Perms for user " + user.getShortName() + " in cell " + cell + ": " + perms);
+        LOG.trace("Perms for user " + user.getShortName() + " in cell " + cell + ": " +
+          (perms != null ? perms : ""));
       }
+      if (perms != null) {
         for (Permission p: perms) {
           if (p.implies(action)) {
             return true;
           }
         }
+      }
     } catch (IOException e) {
       // We failed to parse the KV tag
       LOG.error("Failed parse of ACL tag in cell " + cell);

hbase-server/src/main/java/org/apache/hadoop/hbase/security/visibility/VisibilityController.java

@@ -925,7 +925,16 @@ public class VisibilityController extends BaseMasterAndRegionObserver implements
     if (checkAuths && user != null && user.getShortName() != null) {
       auths = this.visibilityManager.getAuthsAsOrdinals(user.getShortName());
     }
-    // Adding all other tags
+    // Prepend new visibility tags to a new list of tags for the cell
+    try {
+      tags.addAll(createVisibilityTags(cellVisibility.getExpression(), true, auths,
+        user.getShortName()));
+    } catch (ParseException e) {
+      throw new IOException(e);
+    }
+    // Save an object allocation where we can
+    if (newCell.getTagsLength() > 0) {
+      // Carry forward all other tags
       Iterator<Tag> tagsItr = CellUtil.tagsIterator(newCell.getTagsArray(), newCell.getTagsOffset(),
         newCell.getTagsLength());
       while (tagsItr.hasNext()) {
@@ -935,11 +944,6 @@ public class VisibilityController extends BaseMasterAndRegionObserver implements
           tags.add(tag);
         }
       }
-    try {
-      tags.addAll(createVisibilityTags(cellVisibility.getExpression(), true, auths,
-          user.getShortName()));
-    } catch (ParseException e) {
-      throw new IOException(e);
     }
 
     // We need to create another KV, unfortunately, because the current new KV

hbase-server/src/main/java/org/apache/hadoop/hbase/security/visibility/VisibilityLabelFilter.java

@@ -80,9 +80,11 @@ class VisibilityLabelFilter extends FilterBase {
       return ReturnCode.SKIP;
     }
 
+    boolean visibilityTagPresent = false;
+    // Save an object allocation where we can
+    if (cell.getTagsLength() > 0) {
       Iterator<Tag> tagsItr = CellUtil.tagsIterator(cell.getTagsArray(), cell.getTagsOffset(),
         cell.getTagsLength());
-    boolean visibilityTagPresent = false;
       while (tagsItr.hasNext()) {
         boolean includeKV = true;
         Tag tag = tagsItr.next();
@@ -116,6 +118,7 @@ class VisibilityLabelFilter extends FilterBase {
           }
         }
       }
+    }
     return visibilityTagPresent ? ReturnCode.SKIP : ReturnCode.INCLUDE;
   }
 

hbase-server/src/main/java/org/apache/hadoop/hbase/security/visibility/VisibilityUtils.java

@@ -176,6 +176,9 @@ public class VisibilityUtils {
    */
   public static boolean getVisibilityTags(Cell cell, List<Tag> tags) {
     boolean sortedOrder = false;
+    if (cell.getTagsLength() == 0) {
+      return sortedOrder;
+    }
     Iterator<Tag> tagsIterator = CellUtil.tagsIterator(cell.getTagsArray(), cell.getTagsOffset(),
         cell.getTagsLength());
     while (tagsIterator.hasNext()) {
@@ -200,6 +203,9 @@ public class VisibilityUtils {
    * @return true if found, false if not found
    */
   public static boolean isVisibilityTagsPresent(Cell cell) {
+    if (cell.getTagsLength() == 0) {
+      return false;
+    }
     Iterator<Tag> tagsIterator = CellUtil.tagsIterator(cell.getTagsArray(), cell.getTagsOffset(),
         cell.getTagsLength());
     while (tagsIterator.hasNext()) {
@@ -270,9 +276,12 @@ public class VisibilityUtils {
   }
 
   private static List<List<Integer>> sortTagsBasedOnOrdinal(Cell cell) throws IOException {
+    List<List<Integer>> fullTagsList = new ArrayList<List<Integer>>();
+    if (cell.getTagsLength() == 0) {
+      return fullTagsList;
+    }
     Iterator<Tag> tagsItr = CellUtil.tagsIterator(cell.getTagsArray(), cell.getTagsOffset(),
         cell.getTagsLength());
-    List<List<Integer>> fullTagsList = new ArrayList<List<Integer>>();
     while (tagsItr.hasNext()) {
       Tag tag = tagsItr.next();
       if (tag.getType() == VisibilityUtils.VISIBILITY_TAG_TYPE) {