Skip to content

Commit d54e24e

Browse files
maximyurchukmaximyurchuk
authored
Merge pull request #6368 from uzhastik/merge_from_ydb_24_2
q-stable-24-2: merge from ydb-24-2
2 parents 4dcb0b7 + f9f3452 commit d54e24e

File tree

179 files changed

+4836
-1788
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

179 files changed

+4836
-1788
lines changed

‎ydb/apps/version/version_definition.cpp‎

Lines changed: 3 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,30 +9,14 @@ NKikimrConfig::TCurrentCompatibilityInfo NKikimr::TCompatibilityInfo::MakeCurren
99
.Application = "ydb",
1010
.Version = TVersionConstructor{
1111
.Year = 24,
12-
.Major = 1,
13-
},
14-
.CanLoadFrom = {
15-
TCompatibilityRuleConstructor{
16-
.LowerLimit = TVersionConstructor{ .Year = 23, .Major = 4 },
17-
.UpperLimit = TVersionConstructor{ .Year = 24, .Major = 1 },
18-
},
19-
},
20-
.StoresReadableBy = {
21-
TCompatibilityRuleConstructor{
22-
.LowerLimit = TVersionConstructor{ .Year = 23, .Major = 4 },
23-
.UpperLimit = TVersionConstructor{ .Year = 24, .Major = 1 },
24-
},
12+
.Major = 2,
2513
},
2614
.CanConnectTo = {
27-
TCompatibilityRuleConstructor{
28-
.LowerLimit = TVersionConstructor{ .Year = 23, .Major = 4 },
29-
.UpperLimit = TVersionConstructor{ .Year = 24, .Major = 1 },
30-
},
3115
TCompatibilityRuleConstructor{
3216
.Application = "nbs",
3317
.LowerLimit = TVersionConstructor{ .Year = 23, .Major = 3 },
34-
.UpperLimit = TVersionConstructor{ .Year = 24, .Major = 1 },
18+
.UpperLimit = TVersionConstructor{ .Year = 24, .Major = 2 },
3519
},
36-
}
20+
},
3721
}.ToPB();
3822
}

‎ydb/core/base/appdata_fwd.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,7 @@ struct TAppData {
239239
TVector<TString> AdministrationAllowedSIDs; // users/groups which allowed to perform administrative tasks
240240
TVector<TString> DefaultUserSIDs;
241241
TString AllAuthenticatedUsers = "all-users@well-known";
242+
TVector<TString> RegisterDynamicNodeAllowedSIDs;
242243
TString TenantName;
243244
TString NodeName;
244245

‎ydb/core/blobstorage/vdisk/huge/blobstorage_hullhugeheap.cpp‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -538,13 +538,26 @@ namespace NKikimr {
538538
}
539539
Y_ABORT_UNLESS(loadedIt == loadedEnd);
540540
} else {
541-
// entry point size rollback case
542541
Y_ABORT_UNLESS(size > ChainDelegators.size());
543-
ui32 curChainDelegatorsSize = ChainDelegators.size();
544-
Y_FAIL_S("Impossible case; MinHugeBlobInBytes# " << MinHugeBlobInBytes
545-
<< " MilestoneBlobInBytes# " << MilestoneBlobInBytes
546-
<< " loadedSize# " << size
547-
<< " curChainDelegatorsSize# " << curChainDelegatorsSize);
542+
543+
// skip first delegators, which must not be used
544+
for (size_t i = ChainDelegators.size(); i < size; ++i) {
545+
ui32 slotsInChunk;
546+
::Load(s, slotsInChunk);
547+
ui32 allocatedSlots;
548+
::Load(s, allocatedSlots);
549+
TMap<ui32, TMask> freeSpace;
550+
::Load(s, freeSpace);
551+
Y_ABORT_UNLESS(slotsInChunk > ChainDelegators.front().SlotsInChunk, "incompatible format");
552+
Y_ABORT_UNLESS(!allocatedSlots, "incompatible format");
553+
Y_ABORT_UNLESS(freeSpace.empty(), "incompatible format");
554+
}
555+
556+
// load the rest as usual
557+
StartMode = EStartMode::Loaded;
558+
for (TChainDelegator& delegator : ChainDelegators) {
559+
::Load(s, delegator);
560+
}
548561
}
549562
}
550563

‎ydb/core/client/server/grpc_server.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -478,7 +478,7 @@ void TGRpcService::SetupIncomingRequests() {
478478
// dynamic node registration
479479
ADD_REQUEST(RegisterNode, TNodeRegistrationRequest, TNodeRegistrationResponse, {
480480
NMsgBusProxy::TBusMessageContext msg(ctx->BindBusContext(NMsgBusProxy::MTYPE_CLIENT_NODE_REGISTRATION_REQUEST));
481-
RegisterRequestActor(CreateMessageBusRegisterNode(msg, DynamicNodeAuthorizationParams));
481+
RegisterRequestActor(CreateMessageBusRegisterNode(msg));
482482
})
483483

484484
// CMS request

‎ydb/core/client/server/grpc_server.h‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,4 @@
11
#pragma once
2-
#include <ydb/core/grpc_services/auth_processor/dynamic_node_auth_processor.h>
3-
42
#include <ydb/core/protos/grpc.grpc.pb.h>
53

64
#include <ydb/library/actors/core/actorsystem.h>
@@ -60,10 +58,6 @@ class TGRpcService
6058
public:
6159
TGRpcService();
6260

63-
void SetDynamicNodeAuthParams(const TDynamicNodeAuthorizationParams& dynamicNodeAuthorizationParams) {
64-
DynamicNodeAuthorizationParams = dynamicNodeAuthorizationParams;
65-
}
66-
6761
void InitService(grpc::ServerCompletionQueue* cq, NYdbGrpc::TLoggerPtr logger) override;
6862
void SetGlobalLimiterHandle(NYdbGrpc::TGlobalLimiter* limiter) override;
6963

@@ -98,8 +92,6 @@ class TGRpcService
9892
std::function<void()> InitCb_;
9993
// In flight request management.
10094
NYdbGrpc::TGlobalLimiter* Limiter_ = nullptr;
101-
102-
TDynamicNodeAuthorizationParams DynamicNodeAuthorizationParams = {};
10395
};
10496

10597
}

‎ydb/core/client/server/msgbus_server.h‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
#pragma once
2-
#include <ydb/core/grpc_services/auth_processor/dynamic_node_auth_processor.h>
32
#include <ydb/library/actors/core/actorsystem.h>
43
#include <ydb/library/actors/core/actor_bootstrapped.h>
54
#include <ydb/public/lib/base/defs.h>
@@ -298,7 +297,7 @@ IActor* CreateMessageBusBlobStorageConfig(TBusMessageContext &msg);
298297
IActor* CreateMessageBusDrainNode(TBusMessageContext &msg);
299298
IActor* CreateMessageBusFillNode(TBusMessageContext &msg);
300299
IActor* CreateMessageBusResolveNode(TBusMessageContext &msg);
301-
IActor* CreateMessageBusRegisterNode(TBusMessageContext &msg, const TDynamicNodeAuthorizationParams& dynamicNodeAuthorizationParams);
300+
IActor* CreateMessageBusRegisterNode(TBusMessageContext &msg);
302301
IActor* CreateMessageBusCmsRequest(TBusMessageContext &msg);
303302
IActor* CreateMessageBusSqsRequest(TBusMessageContext &msg);
304303
IActor* CreateMessageBusWhoAmI(TBusMessageContext &msg);

‎ydb/core/client/server/msgbus_server_console.cpp‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,20 @@ class TConsoleRequestActor : public TMessageBusSecureRequest<TMessageBusServerRe
3030
: TBase(msg)
3131
, Request(request)
3232
{
33-
TBase::SetSecurityToken(request.GetSecurityToken());
34-
TBase::SetRequireAdminAccess(true);
33+
const auto& token = request.GetSecurityToken();
34+
if (!token.empty()) {
35+
TBase::SetSecurityToken(token);
36+
} else {
37+
const auto& clientCertificates = msg.FindClientCert();
38+
if (!clientCertificates.empty()) {
39+
TBase::SetSecurityToken(TString(clientCertificates.front()));
40+
}
41+
}
42+
// Don`t require admin access for GetNodeConfigRequest
43+
if (Request.GetRequestCase() != NKikimrClient::TConsoleRequest::kGetNodeConfigRequest) {
44+
TBase::SetRequireAdminAccess(true);
45+
}
46+
3547
}
3648

3749
void Bootstrap(const TActorContext &ctx)
@@ -120,6 +132,10 @@ class TConsoleRequestActor : public TMessageBusSecureRequest<TMessageBusServerRe
120132
request->Record.CopyFrom(Request.GetGetNodeConfigItemsRequest());
121133
NTabletPipe::SendData(ctx, ConsolePipe, request.Release());
122134
} else if (Request.HasGetNodeConfigRequest()) {
135+
if (!CheckAccessGetNodeConfig()) {
136+
ReplyWithErrorAndDie(Ydb::StatusIds::UNAUTHORIZED, "Cannot get node config. Access denied. Node is not authorized", ctx);
137+
return;
138+
}
123139
auto request = MakeHolder<TEvConsole::TEvGetNodeConfigRequest>();
124140
request->Record.CopyFrom(Request.GetGetNodeConfigRequest());
125141
NTabletPipe::SendData(ctx, ConsolePipe, request.Release());
@@ -348,6 +364,21 @@ class TConsoleRequestActor : public TMessageBusSecureRequest<TMessageBusServerRe
348364
}
349365
}
350366

367+
bool CheckAccessGetNodeConfig() const {
368+
const auto serializedToken = TBase::GetSerializedToken();
369+
// Empty serializedToken means token is not required. Checked in secure_request.h
370+
if (!serializedToken.empty() && !AppData()->RegisterDynamicNodeAllowedSIDs.empty()) {
371+
NACLib::TUserToken token(serializedToken);
372+
for (const auto& sid : AppData()->RegisterDynamicNodeAllowedSIDs) {
373+
if (token.IsExist(sid)) {
374+
return true;
375+
}
376+
}
377+
return false;
378+
}
379+
return true;
380+
}
381+
351382
private:
352383
NKikimrClient::TConsoleRequest Request;
353384
NKikimrClient::TConsoleResponse Response;

‎ydb/core/client/server/msgbus_server_node_registration.cpp‎

Lines changed: 33 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
#include "msgbus_servicereq.h"
1+
#include "msgbus_server_request.h"
2+
#include "msgbus_securereq.h"
23
#include "grpc_server.h"
34

45
#include <ydb/library/actors/core/actor_bootstrapped.h>
@@ -19,36 +20,35 @@ using namespace NNodeBroker;
1920

2021
namespace {
2122

22-
class TNodeRegistrationActor : public TActorBootstrapped<TNodeRegistrationActor>, public TMessageBusSessionIdentHolder
23+
class TNodeRegistrationActor : public TMessageBusSecureRequest<TMessageBusServerRequestBase<TNodeRegistrationActor>>
2324
{
2425
using TActorBase = TActorBootstrapped<TNodeRegistrationActor>;
25-
26-
struct TNodeAuthorizationResult {
27-
bool IsAuthorized = false;
28-
bool IsCertificateUsed = false;
29-
30-
operator bool() const {
31-
return IsAuthorized;
32-
}
33-
};
26+
using TBase = TMessageBusSecureRequest<TMessageBusServerRequestBase<TNodeRegistrationActor>>;
3427

3528
public:
3629
static constexpr NKikimrServices::TActivity::EType ActorActivityType() {
3730
return NKikimrServices::TActivity::MSGBUS_COMMON;
3831
}
3932

40-
TNodeRegistrationActor(NKikimrClient::TNodeRegistrationRequest &request, NMsgBusProxy::TBusMessageContext &msg, const NKikimr::TDynamicNodeAuthorizationParams& dynamicNodeAuthorizationParams)
41-
: TMessageBusSessionIdentHolder(msg)
33+
TNodeRegistrationActor(NKikimrClient::TNodeRegistrationRequest &request, NMsgBusProxy::TBusMessageContext &msg)
34+
: TBase(msg)
4235
, Request(request)
43-
, DynamicNodeAuthorizationParams(dynamicNodeAuthorizationParams)
4436
{
37+
const auto& clientCertificates = msg.FindClientCert();
38+
if (!clientCertificates.empty()) {
39+
TBase::SetSecurityToken(TString(clientCertificates.front()));
40+
} else {
41+
TBase::SetSecurityToken(BUILTIN_ACL_ROOT); // NBS compatibility
42+
}
4543
}
4644

4745
void Bootstrap(const TActorContext &ctx)
4846
{
49-
const TNodeAuthorizationResult nodeAuthorizationResult = IsNodeAuthorized();
50-
if (!nodeAuthorizationResult.IsAuthorized) {
47+
if (!CheckAccess()) {
48+
Response.MutableStatus()->SetCode(TStatus::UNAUTHORIZED);
49+
Response.MutableStatus()->SetReason("Cannot authorize node. Access denied");
5150
SendReplyAndDie(ctx);
51+
return;
5252
}
5353

5454
auto dinfo = AppData(ctx)->DomainsInfo;
@@ -90,7 +90,7 @@ class TNodeRegistrationActor : public TActorBootstrapped<TNodeRegistrationActor>
9090
if (Request.HasPath()) {
9191
request->Record.SetPath(Request.GetPath());
9292
}
93-
request->Record.SetAuthorizedByCertificate(nodeAuthorizationResult.IsCertificateUsed);
93+
request->Record.SetAuthorizedByCertificate(IsNodeAuthorizedByCertificate);
9494

9595
NTabletPipe::SendData(ctx, NodeBrokerPipe, request.Release());
9696

@@ -157,7 +157,7 @@ class TNodeRegistrationActor : public TActorBootstrapped<TNodeRegistrationActor>
157157
void Die(const TActorContext &ctx)
158158
{
159159
NTabletPipe::CloseClient(ctx, NodeBrokerPipe);
160-
TActorBase::Die(ctx);
160+
TBase::Die(ctx);
161161
}
162162

163163
void SendReplyAndDie(const TActorContext &ctx)
@@ -186,52 +186,34 @@ class TNodeRegistrationActor : public TActorBootstrapped<TNodeRegistrationActor>
186186
}
187187

188188
private:
189-
TNodeAuthorizationResult IsNodeAuthorized() {
190-
TNodeAuthorizationResult result {.IsAuthorized = false, .IsCertificateUsed = false};
191-
auto* appdata = AppData();
192-
if (appdata && appdata->FeatureFlags.GetEnableDynamicNodeAuthorization() && DynamicNodeAuthorizationParams) {
193-
const auto& nodeAuthValues = FindClientCert();
194-
if (nodeAuthValues.empty()) {
195-
Response.MutableStatus()->SetCode(TStatus::UNAUTHORIZED);
196-
Response.MutableStatus()->SetReason("Cannot authorize node. Node has not provided certificate");
197-
return result;
198-
}
199-
const auto& pemCert = nodeAuthValues.front();
200-
TMap<TString, TString> subjectDescription;
201-
X509CertificateReader::X509Ptr x509cert = X509CertificateReader::ReadCertAsPEM(pemCert);
202-
for(const auto& term: X509CertificateReader::ReadSubjectTerms(x509cert)) {
203-
subjectDescription.insert(term);
204-
}
205-
206-
if (!DynamicNodeAuthorizationParams.IsSubjectDescriptionMatched(subjectDescription)) {
207-
Response.MutableStatus()->SetCode(TStatus::UNAUTHORIZED);
208-
Response.MutableStatus()->SetReason("Cannot authorize node by certificate");
209-
return result;
210-
}
211-
const auto& host = Request.GetHost();
212-
if (!DynamicNodeAuthorizationParams.IsHostMatchAttributeCN(host)) {
213-
Response.MutableStatus()->SetCode(TStatus::UNAUTHORIZED);
214-
Response.MutableStatus()->SetReason("Cannot authorize node with host: " + host);
215-
return result;
189+
bool CheckAccess() {
190+
const auto serializedToken = TBase::GetSerializedToken();
191+
// Empty serializedToken means token is not required. Checked in secure_request.h
192+
if (!serializedToken.empty() && !AppData()->RegisterDynamicNodeAllowedSIDs.empty()) {
193+
NACLib::TUserToken token(serializedToken);
194+
for (const auto& sid : AppData()->RegisterDynamicNodeAllowedSIDs) {
195+
if (token.IsExist(sid)) {
196+
IsNodeAuthorizedByCertificate = true;
197+
return true;
198+
}
216199
}
217-
result.IsCertificateUsed = true;
200+
return false;
218201
}
219-
result.IsAuthorized = true;
220-
return result;;
202+
return true;
221203
}
222204

223205
NKikimrClient::TNodeRegistrationRequest Request;
224206
NKikimrClient::TNodeRegistrationResponse Response;
225207
TActorId NodeBrokerPipe;
226-
const TDynamicNodeAuthorizationParams DynamicNodeAuthorizationParams;
208+
bool IsNodeAuthorizedByCertificate = false;
227209
};
228210

229211
} // namespace
230212

231-
IActor *CreateMessageBusRegisterNode(NMsgBusProxy::TBusMessageContext &msg, const NKikimr::TDynamicNodeAuthorizationParams& dynamicNodeAuthorizationParams) {
213+
IActor *CreateMessageBusRegisterNode(NMsgBusProxy::TBusMessageContext &msg) {
232214
NKikimrClient::TNodeRegistrationRequest &record
233215
= static_cast<TBusNodeRegistrationRequest*>(msg.GetMessage())->Record;
234-
return new TNodeRegistrationActor(record, msg, dynamicNodeAuthorizationParams);
216+
return new TNodeRegistrationActor(record, msg);
235217
}
236218

237219
} // namespace NMsgBusProxy

‎ydb/core/client/server/ya.make‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ PEERDIR(
7474
ydb/core/engine
7575
ydb/core/engine/minikql
7676
ydb/core/grpc_services
77-
ydb/core/grpc_services/auth_processor
77+
ydb/core/security/certificate_check
7878
ydb/core/grpc_services/base
7979
ydb/core/keyvalue
8080
ydb/core/kqp/common

‎ydb/core/cms/json_proxy_proto.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@ class TJsonProxyProto : public TActorBootstrapped<TJsonProxyProto> {
7676
return ReplyWithTypeDescription(*NKikimrConfig::TImmediateControlsConfig::TSchemeShardControls::descriptor(), ctx);
7777
else if (name == ".NKikimrConfig.TImmediateControlsConfig.TTCMallocControls")
7878
return ReplyWithTypeDescription(*NKikimrConfig::TImmediateControlsConfig::TTCMallocControls::descriptor(), ctx);
79+
else if (name == ".NKikimrConfig.TImmediateControlsConfig.TVDiskControls")
80+
return ReplyWithTypeDescription(*NKikimrConfig::TImmediateControlsConfig::TVDiskControls::descriptor(), ctx);
7981
else if (name == ".NKikimrConfig.TImmediateControlsConfig.TTabletControls")
8082
return ReplyWithTypeDescription(*NKikimrConfig::TImmediateControlsConfig::TTabletControls::descriptor(), ctx);
8183
}

0 commit comments

Comments
 (0)