TrueCloudLab
/
frostfs-node
17
1
Fork 22
Code Issues 90 Pull Requests 8 Actions Projects Releases Activity

Audit grpc requests #1184

Merged
fyrchik merged 4 commits from dstepanov-yadro/frostfs-node:feat/op_logging into master 2024-06-19 17:18:13 +00:00
Conversation 0 Commits 4 Files Changed 34
dstepanov-yadro commented 2024-06-18 09:47:48 +00:00
Collaborator

Added config option to enable audit event logging, SIGHUP supported.

Audit logs for all handlers have the same structure: operation (grpc handler), object (containerID, treeID, objectID, nodeID, ownerID; it depends on handler), subject (client's public key), success (true or false).

Added config option to enable audit event logging, SIGHUP supported. Audit logs for all handlers have the same structure: operation (grpc handler), object (containerID, treeID, objectID, nodeID, ownerID; it depends on handler), subject (client's public key), success (true or false).
dstepanov-yadro added 4 commits 2024-06-18 09:47:53 +00:00
1522859a2b [#9999] config: Add audit.enabled parameter for node 
Signed-off-by: Dmitrii Stepanov <d.stepanov@yadro.com>
d9ca0ed95b [#9999] node: Add audit package 
Signed-off-by: Dmitrii Stepanov <d.stepanov@yadro.com>
76b374853d [#9999] node: Add audit middleware for grpc services 
Signed-off-by: Dmitrii Stepanov <d.stepanov@yadro.com>
DCO action / DCO (pull_request) Successful in 2m10s Details
Build / Build Components (1.21) (pull_request) Successful in 4m4s Details
Vulncheck / Vulncheck (pull_request) Successful in 3m19s Details
Build / Build Components (1.22) (pull_request) Successful in 4m29s Details
Tests and linters / Lint (pull_request) Successful in 5m36s Details
Tests and linters / Staticcheck (pull_request) Successful in 5m34s Details
Tests and linters / gopls check (pull_request) Successful in 7m13s Details
Pre-commit hooks / Pre-commit (pull_request) Failing after 10m9s Details
Tests and linters / Tests (1.21) (pull_request) Successful in 11m23s Details
Tests and linters / Tests with -race (pull_request) Successful in 11m27s Details
Tests and linters / Tests (1.22) (pull_request) Successful in 12m29s Details
e7650d0be6 [#9999] ir: Add grpc middleware for control service 
Signed-off-by: Dmitrii Stepanov <d.stepanov@yadro.com>
dstepanov-yadro force-pushed feat/op_logging from e7650d0be6 to efeb766356 2024-06-18 10:56:32 +00:00 Compare
dstepanov-yadro force-pushed feat/op_logging from efeb766356 to a11b93df64 2024-06-18 11:41:26 +00:00 Compare
dstepanov-yadro changed title from WIP: Audit grpc requests to Audit grpc requests 2024-06-18 11:55:58 +00:00
dstepanov-yadro requested review from storage-core-committers 2024-06-18 11:57:05 +00:00
dstepanov-yadro requested review from storage-core-developers 2024-06-18 11:57:16 +00:00
fyrchik reviewed 2024-06-18 12:43:12 +00:00
internal/audit/request.go Outdated
@ -0,0 +24,4 @@
func LogRequestWithKey(log *logger.Logger, operation string, key []byte, target Target, status bool) {
object, subject := NotDefined, NotDefined
publicKey := crypto.UnmarshalPublicKey(key)
fyrchik commented 2024-06-18 12:38:13 +00:00
Owner

keys.NewPublicKeyFromBytes does essentially the same and returns keys.PublicKey type. Why not use it?

`keys.NewPublicKeyFromBytes` does essentially the same and returns `keys.PublicKey` type. Why not use it?
dstepanov-yadro commented 2024-06-18 12:56:18 +00:00
Poster
Collaborator

  1. This method is used for signature verification (see frostfs-api-go).

  2. frostfs-crypto looks closer to frosfst-node than neo-go.

  3. This method is simpler: it returns public key or nil.

1. This method is used for signature verification (see `frostfs-api-go`). 2. `frostfs-crypto` looks closer to `frosfst-node` than `neo-go`. 3. This method is simpler: it returns public key or nil.
fyrchik marked this conversation as resolved
internal/audit/target.go Outdated
@ -0,0 +26,4 @@
func TargetFromRefs[T any](refs []*T, model ModelType[T]) Target {
if len(refs) == 0 {
return &stringTarget{s: NotDefined}
fyrchik commented 2024-06-18 12:39:40 +00:00
Owner

Why does String method have pointer receiver? We could save an allocation here with type stringTarget string, as I understand it is only used as nice stringer.

Why does `String` method have pointer receiver? We could save an allocation here with `type stringTarget string`, as I understand it is only used as nice stringer.
dstepanov-yadro commented 2024-06-18 12:58:45 +00:00
Poster
Collaborator

Fixed

Fixed
fyrchik marked this conversation as resolved
internal/audit/target.go Outdated
@ -0,0 +73,4 @@
if len(v) == 0 {
sb.WriteString(Empty)
} else {
sb.WriteString(string(v))
fyrchik commented 2024-06-18 12:40:16 +00:00
Owner

string(v) seems unnecessary, v is already string, no?

`string(v)` seems unnecessary, `v` is already string, no?
dstepanov-yadro commented 2024-06-18 12:58:50 +00:00
Poster
Collaborator

Fixed

Fixed
fyrchik marked this conversation as resolved
dstepanov-yadro force-pushed feat/op_logging from a11b93df64 to 462539b94f 2024-06-18 12:58:51 +00:00 Compare
acid-ant reviewed 2024-06-19 10:03:34 +00:00
pkg/services/object/audit.go Outdated
@ -0,0 +145,4 @@
a.failed = true
}
a.objectID = resp.GetBody().GetObjectID()
audit.LogRequestWithKey(a.log, objectGRPC.ObjectService_Put_FullMethodName, a.key,
acid-ant commented 2024-06-19 09:58:30 +00:00
Collaborator

How about to use string constant here as it is done for tracing:
objectGRPC.ObjectService_Put_FullMethodName -> putv2.streamer.CloseAndRecv.
And do the same for auditPutStream.Send().

How about to use string constant here as it is done for `tracing`: `objectGRPC.ObjectService_Put_FullMethodName` -> `putv2.streamer.CloseAndRecv`. And do the same for `auditPutStream.Send()`.
dstepanov-yadro commented 2024-06-19 10:20:07 +00:00
Poster
Collaborator

I didn't get the idea...

I didn't get the idea...
acid-ant commented 2024-06-19 11:21:27 +00:00
Collaborator

Instead of logging with the same value for operation (CloseAndRecv and Send are using objectGRPC.ObjectService_Put_FullMethodName constant) use putv2.streamer.CloseAndRecv and putv2.streamer.Send, for example.

Instead of logging with the same value for `operation` (`CloseAndRecv` and `Send` are using `objectGRPC.ObjectService_Put_FullMethodName` constant) use `putv2.streamer.CloseAndRecv` and `putv2.streamer.Send`, for example.
dstepanov-yadro commented 2024-06-19 12:44:29 +00:00
Poster
Collaborator

Send logs only on an error, when CloseAndRecv will not call. So log will containe only one log record.

`Send` logs only on an error, when `CloseAndRecv` will not call. So log will containe only one log record.
acid-ant marked this conversation as resolved
fyrchik approved these changes 2024-06-19 11:39:48 +00:00
aarifullin approved these changes 2024-06-19 12:49:10 +00:00
acid-ant approved these changes 2024-06-19 13:04:25 +00:00
dstepanov-yadro force-pushed feat/op_logging from 462539b94f to fd28461def 2024-06-19 13:06:33 +00:00 Compare
fyrchik merged commit fd28461def into master 2024-06-19 17:18:13 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
fyrchik
aarifullin
acid-ant
Labels
Clear labels   
P0

Highest   
P1

High   
P2

Medium   
P3

Low   
badger

Badger DB related issues   
frostfs-adm
   
frostfs-cli
   
frostfs-ir
   
frostfs-lens
   
frostfs-node
   
good first issue

Good for newcomers   
triage
  
Infrastructure

Infrastructure, Automation, CI/CD or DevOps related stuff   
blocked

The issue or PR is blocked by something   
bug

Something is not working   
config

Configuration format update or breaking change   
discussion

Talking about something in order to reach a decision or to exchange ideas   
documentation

Documentation related   
duplicate

This issue or pull request already exists   
enhancement

New feature   
go

Language features adoption   
help wanted

Extra attention is needed   
internal
   
invalid

Something is wrong   
kludge

This is a kludge and we know it   
observability

Related to metrics, tracing and logs   
perfomance

Perfomance related   
question

More information is needed   
refactoring

Refactoring   
wontfix

This won't be fixed
No Label
P0
P1
P2
P3
badger
frostfs-adm
frostfs-cli
frostfs-ir
frostfs-lens
frostfs-node
good first issue
triage
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
4 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/frostfs-node#1184
There is no content yet.
Delete Branch "dstepanov-yadro/frostfs-node:feat/op_logging"

Deleting a branch is permanent. Although the deleted branch may exist for a short time before cleaning up, in most cases it CANNOT be undone. Continue?