Skip to content

Commit 3527639

Browse files
ildar-khisambeevnshestakov
ildar-khisambeev
and
nshestakov
authored
Cherry pick print sensitive (#3698)
Co-authored-by: Nikolay Shestakov <tesseract@ydb.tech>
1 parent 68050f5 commit 3527639

File tree

14 files changed

+88
-78
lines changed

14 files changed

+88
-78
lines changed

‎ydb/core/client/server/grpc_server.cpp‎

Lines changed: 2 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@
1111

1212
#include <util/string/join.h>
1313

14-
#include <google/protobuf/text_format.h>
15-
1614
#include <grpc++/resource_quota.h>
1715
#include <grpc++/security/server_credentials.h>
1816
#include <grpc++/server_builder.h>
@@ -266,15 +264,8 @@ class TSimpleRequest
266264
}
267265

268266
void Finish(const TOut& resp, ui32 status) {
269-
auto makeResponseString = [&] {
270-
TString x;
271-
google::protobuf::TextFormat::Printer printer;
272-
printer.SetSingleLineMode(true);
273-
printer.PrintToString(resp, &x);
274-
return x;
275-
};
276267
LOG_DEBUG(ActorSystem, NKikimrServices::GRPC_SERVER, "[%p] issuing response Name# %s data# %s peer# %s", this,
277-
Name, makeResponseString().data(), GetPeerName().c_str());
268+
Name, NYdbGrpc::FormatMessage<TOut>(resp).data(), GetPeerName().c_str());
278269
ResponseSize = resp.ByteSize();
279270
ResponseStatus = status;
280271
StateFunc = &TSimpleRequest::FinishDone;
@@ -300,19 +291,8 @@ class TSimpleRequest
300291
bool RequestDone(bool ok) {
301292
OnAfterCall();
302293

303-
auto makeRequestString = [&] {
304-
TString resp;
305-
if (ok) {
306-
google::protobuf::TextFormat::Printer printer;
307-
printer.SetSingleLineMode(true);
308-
printer.PrintToString(Request, &resp);
309-
} else {
310-
resp = "<not ok>";
311-
}
312-
return resp;
313-
};
314294
LOG_DEBUG(ActorSystem, NKikimrServices::GRPC_SERVER, "[%p] received request Name# %s ok# %s data# %s peer# %s current inflight# %li", this,
315-
Name, ok ? "true" : "false", makeRequestString().data(), GetPeerName().c_str(), Server->GetCurrentInFlight());
295+
Name, ok ? "true" : "false", NYdbGrpc::FormatMessage<TIn>(Request, ok).data(), GetPeerName().c_str(), Server->GetCurrentInFlight());
316296

317297
if (Context.c_call() == nullptr) {
318298
Y_ABORT_UNLESS(!ok);

‎ydb/core/grpc_streaming/grpc_streaming.h‎

Lines changed: 3 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111

1212
#include <contrib/libs/grpc/include/grpcpp/support/async_stream.h>
1313
#include <contrib/libs/grpc/include/grpcpp/support/async_unary_call.h>
14-
#include <google/protobuf/text_format.h>
1514

1615
#include <atomic>
1716

@@ -347,22 +346,10 @@ class TGRpcStreamingRequest final
347346
}
348347

349348
void OnReadDone(NYdbGrpc::EQueueEventStatus status) {
350-
auto dumpResultText = [&] {
351-
TString text;
352-
if (status == NYdbGrpc::EQueueEventStatus::OK) {
353-
google::protobuf::TextFormat::Printer printer;
354-
printer.SetSingleLineMode(true);
355-
printer.PrintToString(ReadInProgress->Record, &text);
356-
} else {
357-
text = "<not ok>";
358-
}
359-
return text;
360-
};
361-
362349
LOG_DEBUG(ActorSystem, LoggerServiceId, "[%p] read finished Name# %s ok# %s data# %s peer# %s",
363350
this, Name,
364351
status == NYdbGrpc::EQueueEventStatus::OK ? "true" : "false",
365-
dumpResultText().c_str(),
352+
NYdbGrpc::FormatMessage<TIn>(ReadInProgress->Record, status == NYdbGrpc::EQueueEventStatus::OK).c_str(),
366353
this->GetPeerName().c_str());
367354

368355
// Take current in-progress read first
@@ -400,25 +387,17 @@ class TGRpcStreamingRequest final
400387
}
401388

402389
bool Write(TOut&& message, const grpc::WriteOptions& options = { }, const grpc::Status* status = nullptr) {
403-
auto dumpMessageText = [&] {
404-
TString text;
405-
google::protobuf::TextFormat::Printer printer;
406-
printer.SetSingleLineMode(true);
407-
printer.PrintToString(message, &text);
408-
return text;
409-
};
410-
411390
if (status) {
412391
LOG_DEBUG(ActorSystem, LoggerServiceId, "[%p] facade write Name# %s data# %s peer# %s grpc status# (%d) message# %s",
413392
this, Name,
414-
dumpMessageText().c_str(),
393+
NYdbGrpc::FormatMessage<TOut>(message).c_str(),
415394
this->GetPeerName().c_str(),
416395
static_cast<int>(status->error_code()),
417396
status->error_message().c_str());
418397
} else {
419398
LOG_DEBUG(ActorSystem, LoggerServiceId, "[%p] facade write Name# %s data# %s peer# %s",
420399
this, Name,
421-
dumpMessageText().c_str(),
400+
NYdbGrpc::FormatMessage<TOut>(message).c_str(),
422401
this->GetPeerName().c_str());
423402
}
424403

‎ydb/core/persqueue/partition_monitoring.cpp‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
#include <ydb/core/protos/counters_pq.pb.h>
1313
#include <ydb/core/protos/msgbus.pb.h>
1414
#include <ydb/library/persqueue/topic_parser/topic_parser.h>
15+
#include <ydb/library/protobuf_printer/security_printer.h>
1516
#include <ydb/public/lib/base/msgbus.h>
1617
#include <library/cpp/html/pcdata/pcdata.h>
1718
#include <library/cpp/monlib/service/pages/templates.h>
@@ -22,6 +23,14 @@
2223

2324
namespace NKikimr::NPQ {
2425

26+
TString PrintConfig(const NKikimrPQ::TPQTabletConfig& cfg) {
27+
TSecurityTextFormatPrinter<NKikimrPQ::TPQTabletConfig> printer;
28+
printer.SetSingleLineMode(true);
29+
TString string;
30+
printer.PrintToString(cfg, &string);
31+
return string;
32+
}
33+
2534
void HtmlOutput(IOutputStream& out, const TString& line, const std::deque<std::pair<TKey, ui32>>& keys) {
2635
HTML(out) {
2736
TABLE() {
@@ -109,7 +118,7 @@ void TPartition::HandleMonitoring(TEvPQ::TEvMonRequest::TPtr& ev, const TActorCo
109118
out << "AvgWriteSize per " << avg.GetDuration().ToString() << " is " << avg.GetValue() << " bytes";
110119
res.push_back(out.Str()); out.Clear();
111120
}
112-
out << Config.DebugString(); res.push_back(out.Str()); out.Clear();
121+
out << PrintConfig(Config); res.push_back(out.Str()); out.Clear();
113122
HTML(out) {
114123
DIV_CLASS_ID("tab-pane fade", Sprintf("partition_%u", ui32(Partition))) {
115124
TABLE_SORTABLE_CLASS("table") {

‎ydb/core/persqueue/ya.make‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ PEERDIR(
5959
ydb/library/logger
6060
ydb/library/persqueue/counter_time_keeper
6161
ydb/library/persqueue/topic_parser
62+
ydb/library/protobuf_printer
6263
ydb/public/lib/base
6364
ydb/public/sdk/cpp/client/ydb_persqueue_core
6465
)

‎ydb/core/protos/flat_tx_scheme.proto‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import "ydb/core/protos/bind_channel_storage_pool.proto";
77
import "ydb/core/protos/flat_scheme_op.proto";
88
import "ydb/public/api/protos/ydb_cms.proto";
99
import "ydb/public/api/protos/ydb_issue_message.proto";
10+
import "ydb/public/api/protos/annotations/sensitive.proto";
1011

1112
package NKikimrScheme;
1213
option java_package = "ru.yandex.kikimr.proto";
@@ -53,7 +54,7 @@ message TEvModifySchemeTransaction {
5354
optional uint64 TabletId = 3;
5455
optional string Owner = 5;
5556
optional bool FailOnExist = 6; // depricated, TModifyScheme.FailOnExist is recomended
56-
optional string UserToken = 7; // serialized NACLib::TUserToken
57+
optional string UserToken = 7 [(Ydb.sensitive) = true]; // serialized NACLib::TUserToken
5758
optional string PeerName = 8;
5859
}
5960

‎ydb/core/protos/pqconfig.proto‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
import "ydb/public/api/protos/draft/persqueue_error_codes.proto";
22
import "ydb/public/api/protos/draft/persqueue_common.proto";
33

4+
import "ydb/public/api/protos/annotations/sensitive.proto";
5+
46
import "ydb/core/protos/base.proto";
57
import "ydb/core/protos/msgbus_kv.proto";
68
import "ydb/core/protos/node_limits.proto";
@@ -208,11 +210,11 @@ message TMirrorPartitionConfig {
208210
message TCredentials {
209211
message IamCredentials {
210212
optional string Endpoint = 1;
211-
optional string ServiceAccountKey = 2;
213+
optional string ServiceAccountKey = 2 [(Ydb.sensitive) = true];
212214
}
213215
oneof Credentials {
214-
string OauthToken = 1;
215-
string JwtParams = 2;
216+
string OauthToken = 1 [(Ydb.sensitive) = true];
217+
string JwtParams = 2 [(Ydb.sensitive) = true];
216218
IamCredentials Iam = 3;
217219
}
218220
}

‎ydb/core/tx/schemeshard/schemeshard__operation.cpp‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212
#include <ydb/core/tablet_flat/flat_cxx_database.h>
1313
#include <ydb/core/tablet_flat/tablet_flat_executor.h>
1414

15+
#include <ydb/library/protobuf_printer/security_printer.h>
16+
1517
#include <util/generic/algorithm.h>
1618

1719
namespace NKikimr::NSchemeShard {
@@ -85,6 +87,14 @@ NKikimrScheme::TEvModifySchemeTransaction GetRecordForPrint(const NKikimrScheme:
8587
return recordForPrint;
8688
}
8789

90+
TString PrintSecurely(const NKikimrScheme::TEvModifySchemeTransaction& record) {
91+
TSecurityTextFormatPrinter<NKikimrScheme::TEvModifySchemeTransaction> printer;
92+
printer.SetSingleLineMode(true);
93+
TString string;
94+
printer.PrintToString(record, &string);
95+
return string;
96+
}
97+
8898
THolder<TProposeResponse> TSchemeShard::IgniteOperation(TProposeRequest& request, TOperationContext& context) {
8999
THolder<TProposeResponse> response = nullptr;
90100

@@ -183,7 +193,7 @@ THolder<TProposeResponse> TSchemeShard::IgniteOperation(TProposeRequest& request
183193
<< ", already accepted parts: " << operation->Parts.size()
184194
<< ", propose result status: " << NKikimrScheme::EStatus_Name(response->Record.GetStatus())
185195
<< ", with reason: " << response->Record.GetReason()
186-
<< ", tx message: " << GetRecordForPrint(record).ShortDebugString());
196+
<< ", tx message: " << PrintSecurely(record));
187197
}
188198

189199
Y_VERIFY_S(context.IsUndoChangesSafe(),
@@ -194,7 +204,7 @@ THolder<TProposeResponse> TSchemeShard::IgniteOperation(TProposeRequest& request
194204
<< ", already accepted parts: " << operation->Parts.size()
195205
<< ", propose result status: " << NKikimrScheme::EStatus_Name(response->Record.GetStatus())
196206
<< ", with reason: " << response->Record.GetReason()
197-
<< ", tx message: " << GetRecordForPrint(record).ShortDebugString());
207+
<< ", tx message: " << PrintSecurely(record));
198208

199209
context.OnComplete = {}; // recreate
200210
context.DbChanges = {};
@@ -237,7 +247,7 @@ struct TSchemeShard::TTxOperationPropose: public NTabletFlatExecutor::TTransacti
237247

238248
LOG_DEBUG_S(ctx, NKikimrServices::FLAT_TX_SCHEMESHARD,
239249
"TTxOperationPropose Execute"
240-
<< ", message: " << GetRecordForPrint(Request->Get()->Record).ShortDebugString()
250+
<< ", message: " << PrintSecurely(Request->Get()->Record)
241251
<< ", at schemeshard: " << selfId);
242252

243253
txc.DB.NoMoreReadsForTx();

‎ydb/core/tx/schemeshard/ya.make‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,7 @@ PEERDIR(
268268
ydb/library/aclib/protos
269269
ydb/library/login
270270
ydb/library/login/protos
271+
ydb/library/protobuf_printer
271272
ydb/library/yql/minikql
272273
ydb/services/bg_tasks
273274
)

‎ydb/library/grpc/server/actors/ya.make‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ SRCS(
66

77
PEERDIR(
88
ydb/library/actors/core
9+
ydb/library/grpc/server
910
)
1011

1112
END()

‎ydb/library/grpc/server/logger.h‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,17 @@
11
#pragma once
22

3+
#include <ydb/library/protobuf_printer/security_printer.h>
4+
35
#include <library/cpp/logger/priority.h>
46

57
#include <util/generic/ptr.h>
8+
#include <util/system/env.h>
9+
610

711
namespace NYdbGrpc {
812

13+
static bool LogBodyEnabled = "BODY" == GetEnv("YDB_GRPC_SERVER_LOGGING");
14+
915
class TLogger: public TThrRefBase {
1016
protected:
1117
TLogger() = default;
@@ -40,4 +46,21 @@ using TLoggerPtr = TIntrusivePtr<TLogger>;
4046
logger->Write(ELogPriority::TLOG_INFO, format, __VA_ARGS__); \
4147
} else { }
4248

49+
template <typename TMsg>
50+
inline TString FormatMessage(const TMsg& message, bool ok = true) {
51+
if (ok) {
52+
if (LogBodyEnabled) {
53+
TString text;
54+
NKikimr::TSecurityTextFormatPrinter<TMsg> printer;
55+
printer.SetSingleLineMode(true);
56+
printer.PrintToString(message, &text);
57+
return text;
58+
} else {
59+
return "<hidden>";
60+
}
61+
} else {
62+
return "<not ok>";
63+
}
64+
}
65+
4366
} // namespace NYdbGrpc

0 commit comments

Comments
 (0)