TrueCloudLab/frostfs-node
20
1
Fork 27
Code Issues 101 Pull requests 5 Projects Releases 1 Activity Actions

Audit grpc requests #1184

Merged
fyrchik merged 1 commit from dstepanov-yadro/frostfs-node:feat/op_logging into master 2024-09-04 19:51:09 +00:00
Conversation 0 Commits 1 Files changed 6 +121 -6
6 changed files with 121 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit fd28461def - Show all commits

1
cmd/frostfs-ir/config.go
View file

@ -35,6 +35,7 @@ func reloadConfig() error {
return err
}
cmode.Store(cfg.GetBool("node.kludge_compatibility_mode"))
audit.Store(cfg.GetBool("audit.enabled"))
err = logPrm.SetLevelString(cfg.GetString("logger.level"))
if err != nil {
return err

2
cmd/frostfs-ir/defaults.go
View file

@ -45,6 +45,8 @@ func defaultConfiguration(cfg *viper.Viper) {
cfg.SetDefault("governance.disable", false)
cfg.SetDefault("node.kludge_compatibility_mode", false)
cfg.SetDefault("audit.enabled", false)
}
func setControlDefaults(cfg *viper.Viper) {

4
cmd/frostfs-ir/main.go
View file

@ -39,6 +39,7 @@ var (
configFile *string
configDir *string
cmode = &atomic.Bool{}
audit = &atomic.Bool{}
)
func exitErr(err error) {
@ -87,8 +88,9 @@ func main() {
metricsCmp = newMetricsComponent()
metricsCmp.init()
audit.Store(cfg.GetBool("audit.enabled"))
innerRing, err = innerring.New(ctx, log, cfg, intErr, metrics, cmode)
innerRing, err = innerring.New(ctx, log, cfg, intErr, metrics, cmode, audit)
exitErr(err)
pprofCmp.start()

8
pkg/innerring/initialization.go
View file

@ -5,6 +5,7 @@ import (
"encoding/hex"
"fmt"
"net"
"sync/atomic"
"git.frostfs.info/TrueCloudLab/frostfs-node/internal/logs"
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/innerring/processors/alphabet"
@ -26,6 +27,7 @@ import (
control "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir"
controlsrv "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir/server"
utilConfig "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/util/config"
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/util/logger"
"github.com/nspcc-dev/neo-go/pkg/core/transaction"
"github.com/nspcc-dev/neo-go/pkg/encoding/fixedn"
"github.com/spf13/viper"
@ -310,7 +312,7 @@ func (s *Server) initFrostFSMainnetProcessor(cfg *viper.Viper) error {
return bindMainnetProcessor(frostfsProcessor, s)
}
func (s *Server) initGRPCServer(cfg *viper.Viper) error {
func (s *Server) initGRPCServer(cfg *viper.Viper, log *logger.Logger, audit *atomic.Bool) error {
controlSvcEndpoint := cfg.GetString("control.grpc.endpoint")
if controlSvcEndpoint == "" {
s.log.Info(logs.InnerringNoControlServerEndpointSpecified)
@ -337,9 +339,9 @@ func (s *Server) initGRPCServer(cfg *viper.Viper) error {
p.SetPrivateKey(*s.key)
p.SetHealthChecker(s)
controlSvc := controlsrv.New(p, s.netmapClient, s.containerClient,
controlSvc := controlsrv.NewAuditService(controlsrv.New(p, s.netmapClient, s.containerClient,
controlsrv.WithAllowedKeys(authKeys),
)
), log, audit)
grpcControlSrv := grpc.NewServer()
control.RegisterControlServiceServer(grpcControlSrv, controlSvc)

4
pkg/innerring/innerring.go
View file

@ -331,7 +331,7 @@ func (s *Server) registerStarter(f func() error) {
// New creates instance of inner ring sever structure.
func New(ctx context.Context, log *logger.Logger, cfg *viper.Viper, errChan chan<- error,
metrics *metrics.InnerRingServiceMetrics, cmode *atomic.Bool,
metrics *metrics.InnerRingServiceMetrics, cmode *atomic.Bool, audit *atomic.Bool,
) (*Server, error) {
var err error
server := &Server{
@ -403,7 +403,7 @@ func New(ctx context.Context, log *logger.Logger, cfg *viper.Viper, errChan chan
server.initTimers(cfg, morphClients)
err = server.initGRPCServer(cfg)
err = server.initGRPCServer(cfg, log, audit)
if err != nil {
return nil, err
}

108
pkg/services/control/ir/server/audit.go Normal file
View file

@ -0,0 +1,108 @@
package control
import (
"context"
"encoding/hex"
"strings"
"sync/atomic"
"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/refs"
"git.frostfs.info/TrueCloudLab/frostfs-node/internal/audit"
control "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir"
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/util/logger"
cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
)
var _ control.ControlServiceServer = (*auditService)(nil)
type auditService struct {
next *Server
log *logger.Logger
enabled *atomic.Bool
}
func NewAuditService(next *Server, log *logger.Logger, enabled *atomic.Bool) control.ControlServiceServer {
return &auditService{
next: next,
log: log,
enabled: enabled,
}
}
// HealthCheck implements control.ControlServiceServer.
func (a *auditService) HealthCheck(ctx context.Context, req *control.HealthCheckRequest) (*control.HealthCheckResponse, error) {
res, err := a.next.HealthCheck(ctx, req)
if !a.enabled.Load() {
return res, err
}
audit.LogRequestWithKey(a.log, control.ControlService_HealthCheck_FullMethodName, req.GetSignature().GetKey(), nil, err == nil)
return res, err
}
// RemoveContainer implements control.ControlServiceServer.
func (a *auditService) RemoveContainer(ctx context.Context, req *control.RemoveContainerRequest) (*control.RemoveContainerResponse, error) {
res, err := a.next.RemoveContainer(ctx, req)
if !a.enabled.Load() {
return res, err
}
sb := &strings.Builder{}
var withConatiner bool
if len(req.GetBody().GetContainerId()) > 0 {
withConatiner = true
sb.WriteString("containerID:")
var containerID cid.ID
if err := containerID.Decode(req.GetBody().GetContainerId()); err != nil {
sb.WriteString(audit.InvalidValue)
} else {
sb.WriteString(containerID.EncodeToString())
}
}
if len(req.GetBody().GetOwner()) > 0 {
if withConatiner {
sb.WriteString(";")
}
sb.WriteString("owner:")
var ownerID refs.OwnerID
if err := ownerID.Unmarshal(req.GetBody().GetOwner()); err != nil {
sb.WriteString(audit.InvalidValue)
} else {
var owner user.ID
if err := owner.ReadFromV2(ownerID); err != nil {
sb.WriteString(audit.InvalidValue)
} else {
sb.WriteString(owner.EncodeToString())
}
}
}
audit.LogRequestWithKey(a.log, control.ControlService_RemoveContainer_FullMethodName, req.GetSignature().GetKey(), sb, err == nil)
return res, err
}
// RemoveNode implements control.ControlServiceServer.
func (a *auditService) RemoveNode(ctx context.Context, req *control.RemoveNodeRequest) (*control.RemoveNodeResponse, error) {
res, err := a.next.RemoveNode(ctx, req)
if !a.enabled.Load() {
return res, err
}
audit.LogRequestWithKey(a.log, control.ControlService_RemoveNode_FullMethodName, req.GetSignature().GetKey(),
audit.TargetFromString(hex.EncodeToString(req.GetBody().GetKey())), err == nil)
return res, err
}
// TickEpoch implements control.ControlServiceServer.
func (a *auditService) TickEpoch(ctx context.Context, req *control.TickEpochRequest) (*control.TickEpochResponse, error) {
res, err := a.next.TickEpoch(ctx, req)
if !a.enabled.Load() {
return res, err
}
audit.LogRequestWithKey(a.log, control.ControlService_TickEpoch_FullMethodName, req.GetSignature().GetKey(),
nil, err == nil)
return res, err
}