Skip to content

Commit f4d5afd

Browse files
StekPerepolnenStekPerepolnen
committed
EXT-1555 Add audit log on receive for unauthorized requests (#26099)
1 parent ea66216 commit f4d5afd

File tree

4 files changed

+5
-1
lines changed

4 files changed

+5
-1
lines changed

‎ydb/core/mon/async_http_mon.cpp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -217,6 +217,7 @@ class THttpMonLegacyActorRequest : public TActorBootstrapped<THttpMonLegacyActor
217217
return;
218218
}
219219
}
220+
AuditCtx.LogOnReceived();
220221
SendRequest();
221222
}
222223
void ReplyWith(NHttp::THttpOutgoingResponsePtr response) {
@@ -350,7 +351,6 @@ class THttpMonLegacyActorRequest : public TActorBootstrapped<THttpMonLegacyActor
350351
if (result && result->UserToken) {
351352
serializedToken = result->UserToken->GetSerializedToken();
352353
}
353-
AuditCtx.LogOnReceived();
354354
Send(ActorMonPage->TargetActorId, new NMon::TEvHttpInfo(
355355
Container, serializedToken), IEventHandle::FlagTrackDelivery);
356356
}
@@ -377,6 +377,7 @@ class THttpMonLegacyActorRequest : public TActorBootstrapped<THttpMonLegacyActor
377377
void Handle(NKikimr::NGRpcService::TEvRequestAuthAndCheckResult::TPtr& ev) {
378378
const NKikimr::NGRpcService::TEvRequestAuthAndCheckResult& result(*ev->Get());
379379
AuditCtx.AddAuditLogParts(result.AuditLogParts);
380+
AuditCtx.LogOnReceived();
380381
if (result.UserToken) {
381382
AuditCtx.SetSubjectType(result.UserToken->GetSubjectType());
382383
}

‎ydb/tests/functional/audit/canondata/test_canonical_records.test_dml_through_http/audit_log.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "other-user@builtin"}
2+
{"body": "{\"action\": \"execute-query\", \"base64\": false, \"database\": \"/Root\", \"query\": \"SELECT 42\", \"stats\": \"full\", \"syntax\": \"yql_v1\", \"tracingLevel\": 9}", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "schema=multi&base64=false", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "IN-PROCESS", "subject": "other-user@builtin", "url": "/viewer/json/query"}
23
{"body": "{\"action\": \"execute-query\", \"base64\": false, \"database\": \"/Root\", \"query\": \"SELECT 42\", \"stats\": \"full\", \"syntax\": \"yql_v1\", \"tracingLevel\": 9}", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "schema=multi&base64=false", "reason": "403 Forbidden", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "ERROR", "subject": "other-user@builtin", "url": "/viewer/json/query"}
34
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "root@builtin"}
45
{"body": "{\"action\": \"execute-query\", \"base64\": false, \"database\": \"/Root\", \"query\": \"SELECT 42\", \"stats\": \"full\", \"syntax\": \"yql_v1\", \"tracingLevel\": 9}", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "schema=multi&base64=false", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "status": "IN-PROCESS", "subject": "root@builtin", "url": "/viewer/json/query"}

‎ydb/tests/functional/audit/canondata/test_canonical_records.test_kill_tablet_using_developer_ui/audit_log.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "other-user@builtin"}
2+
{"component": "monitoring", "method": "GET", "operation": "HTTP REQUEST", "params": "RestartTabletID=<canonized_tablet_id>", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "IN-PROCESS", "subject": "other-user@builtin", "url": "/tablets"}
23
{"component": "monitoring", "method": "GET", "operation": "HTTP REQUEST", "params": "RestartTabletID=<canonized_tablet_id>", "reason": "403 Forbidden", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "ERROR", "subject": "other-user@builtin", "url": "/tablets"}
34
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "root@builtin"}
45
{"component": "monitoring", "method": "GET", "operation": "HTTP REQUEST", "params": "RestartTabletID=<canonized_tablet_id>", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "status": "IN-PROCESS", "subject": "root@builtin", "url": "/tablets"}

‎ydb/tests/functional/audit/canondata/test_canonical_records.test_restart_pdisk/audit_log.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "other-user@builtin"}
2+
{"body": "restartPDisk=&ignoreChecks=true", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "/actors/pdisks/pdisk000000001", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "IN-PROCESS", "subject": "other-user@builtin", "url": "/actors/pdisks/pdisk000000001"}
23
{"body": "restartPDisk=&ignoreChecks=true", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "/actors/pdisks/pdisk000000001", "reason": "403 Forbidden", "remote_address": "<canonized_remote_address>", "sanitized_token": "othe****ltin (27F910A9)", "status": "ERROR", "subject": "other-user@builtin", "url": "/actors/pdisks/pdisk000000001"}
34
{"component": "grpc-proxy", "database": "/Root", "operation": "request auth and check internal request", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "start_time": "<canonized_start_time>", "status": "IN-PROCESS", "subject": "root@builtin"}
45
{"body": "restartPDisk=&ignoreChecks=true", "component": "monitoring", "method": "POST", "operation": "HTTP REQUEST", "params": "/actors/pdisks/pdisk000000001", "reason": "Execute", "remote_address": "<canonized_remote_address>", "sanitized_token": "**** (B6C6F477)", "status": "IN-PROCESS", "subject": "root@builtin", "url": "/actors/pdisks/pdisk000000001"}

0 commit comments

Comments
 (0)