Skip to content

Commit 8137e7d

Browse files
StekPerepolnenStekPerepolnen
authored
EXT-1555 Add audit log on receive for unauthorized requests (#26099)
1 parent ec08f6e commit 8137e7d

File tree

4 files changed

+8
-3
lines changed

4 files changed

+8
-3
lines changed

‎ydb/core/mon/mon.cpp‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -354,6 +354,7 @@ class THttpMonLegacyActorRequest : public TActorBootstrapped<THttpMonLegacyActor
354354
return;
355355
}
356356
}
357+
AuditCtx.LogOnReceived();
357358
SendRequest();
358359
}
359360

@@ -487,7 +488,6 @@ class THttpMonLegacyActorRequest : public TActorBootstrapped<THttpMonLegacyActor
487488
<< " " << request->URL);
488489
}
489490
TString serializedToken = result && result->UserToken ? result->UserToken->GetSerializedToken() : TString();
490-
AuditCtx.LogOnReceived();
491491
Send(ActorMonPage->TargetActorId, new NMon::TEvHttpInfo(
492492
Container, serializedToken), IEventHandle::FlagTrackDelivery);
493493
}
@@ -514,6 +514,7 @@ class THttpMonLegacyActorRequest : public TActorBootstrapped<THttpMonLegacyActor
514514
void Handle(NKikimr::NGRpcService::TEvRequestAuthAndCheckResult::TPtr& ev) {
515515
const NKikimr::NGRpcService::TEvRequestAuthAndCheckResult& result(*ev->Get());
516516
AuditCtx.AddAuditLogParts(result.AuditLogParts);
517+
AuditCtx.LogOnReceived();
517518
if (result.UserToken) {
518519
AuditCtx.SetSubjectType(result.UserToken->GetSubjectType());
519520
Event->Get()->UserToken = result.UserToken->GetSerializedToken();
@@ -557,11 +558,11 @@ class THttpMonLegacyIndexRequest : public TActorBootstrapped<THttpMonLegacyIndex
557558

558559
void Bootstrap() {
559560
AuditCtx.InitAudit(Event, NeedAudit);
561+
AuditCtx.LogOnReceived();
560562
ProcessRequest();
561563
}
562564

563565
void ProcessRequest() {
564-
AuditCtx.LogOnReceived();
565566
Container.Page->Output(Container);
566567
NHttp::THttpOutgoingResponsePtr response = Event->Get()->Request->CreateResponseString(Container.Str());
567568
AuditCtx.LogOnCompleted(response);
@@ -1027,6 +1028,7 @@ class THttpMonAuthorizedActorRequest : public TActorBootstrapped<THttpMonAuthori
10271028
return;
10281029
}
10291030
}
1031+
AuditCtx.LogOnReceived();
10301032
SendRequest();
10311033
Become(&THttpMonAuthorizedActorRequest::StateWork);
10321034
}
@@ -1137,7 +1139,6 @@ class THttpMonAuthorizedActorRequest : public TActorBootstrapped<THttpMonAuthori
11371139
<< " " << request->Method
11381140
<< " " << request->URL);
11391141
}
1140-
AuditCtx.LogOnReceived();
11411142
Send(new IEventHandle(Fields.Handler, SelfId(), Event->ReleaseBase().Release(), IEventHandle::FlagTrackDelivery, Event->Cookie));
11421143
}
11431144

@@ -1161,6 +1162,7 @@ class THttpMonAuthorizedActorRequest : public TActorBootstrapped<THttpMonAuthori
11611162
void Handle(NKikimr::NGRpcService::TEvRequestAuthAndCheckResult::TPtr& ev) {
11621163
const NKikimr::NGRpcService::TEvRequestAuthAndCheckResult& result(*ev->Get());
11631164
AuditCtx.AddAuditLogParts(result.AuditLogParts);
1165+
AuditCtx.LogOnReceived();
11641166
if (result.UserToken) {
11651167
AuditCtx.SetSubjectType(result.UserToken->GetSubjectType());
11661168
Event->Get()->UserToken = result.UserToken->GetSerializedToken();

‎ydb/tests/functional/audit/canondata/test_canonical_records.test_dml_through_http/audit_log.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "other-user@builtin"}
2+
{"body": "{\"action\": \"execute-query\", \"base64\": false, \"database\": \"/Root\", \"query\": \"SELECT 42\", \"stats\": \"full\", \"syntax\": \"yql_v1\", \"tracingLevel\": 9}", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "schema=multi&base64=false", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "IN-PROCESS", "subject": "other-user@builtin", "url": "/viewer/json/query"}
23
{"body": "{\"action\": \"execute-query\", \"base64\": false, \"database\": \"/Root\", \"query\": \"SELECT 42\", \"stats\": \"full\", \"syntax\": \"yql_v1\", \"tracingLevel\": 9}", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "schema=multi&base64=false", "reason": "403 Forbidden", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "ERROR", "subject": "other-user@builtin", "url": "/viewer/json/query"}
34
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "root@builtin"}
45
{"body": "{\"action\": \"execute-query\", \"base64\": false, \"database\": \"/Root\", \"query\": \"SELECT 42\", \"stats\": \"full\", \"syntax\": \"yql_v1\", \"tracingLevel\": 9}", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "schema=multi&base64=false", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "status": "IN-PROCESS", "subject": "root@builtin", "url": "/viewer/json/query"}

‎ydb/tests/functional/audit/canondata/test_canonical_records.test_kill_tablet_using_developer_ui/audit_log.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "other-user@builtin"}
2+
{"component": "monitoring", "method": "GET", "operation": "HTTP REQUEST", "params": "RestartTabletID=<canonized_tablet_id>", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "IN-PROCESS", "subject": "other-user@builtin", "url": "/tablets"}
23
{"component": "monitoring", "method": "GET", "operation": "HTTP REQUEST", "params": "RestartTabletID=<canonized_tablet_id>", "reason": "403 Forbidden", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "ERROR", "subject": "other-user@builtin", "url": "/tablets"}
34
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "root@builtin"}
45
{"component": "monitoring", "method": "GET", "operation": "HTTP REQUEST", "params": "RestartTabletID=<canonized_tablet_id>", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "status": "IN-PROCESS", "subject": "root@builtin", "url": "/tablets"}

‎ydb/tests/functional/audit/canondata/test_canonical_records.test_restart_pdisk/audit_log.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "other-user@builtin"}
2+
{"body": "restartPDisk=&ignoreChecks=true", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "/actors/pdisks/pdisk000000001", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "IN-PROCESS", "subject": "other-user@builtin", "url": "/actors/pdisks/pdisk000000001"}
23
{"body": "restartPDisk=&ignoreChecks=true", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "/actors/pdisks/pdisk000000001", "reason": "403 Forbidden", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "ERROR", "subject": "other-user@builtin", "url": "/actors/pdisks/pdisk000000001"}
34
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "root@builtin"}
45
{"body": "restartPDisk=&ignoreChecks=true", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "/actors/pdisks/pdisk000000001", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "status": "IN-PROCESS", "subject": "root@builtin", "url": "/actors/pdisks/pdisk000000001"}

0 commit comments

Comments
 (0)