diff options
author | Jason Carey <jcarey@argv.me> | 2017-07-21 11:54:18 -0400 |
---|---|---|
committer | Jason Carey <jcarey@argv.me> | 2017-07-26 15:53:42 -0400 |
commit | edfe3f3b1276ef3598b1af673d088e6b5c4b3ad5 (patch) | |
tree | 08f0efcdb6100dc315cf5e9ac98c0c6261be928d /src/mongo/s | |
parent | cb36a96d7c96cf1b24c7ef3b8b086cfc04c77642 (diff) | |
download | mongo-edfe3f3b1276ef3598b1af673d088e6b5c4b3ad5.tar.gz |
SERVER-30298 Add UserDigest LogicalSessionID
Inclusion of a sha256 digest of the full username to the logical session
id (in addition to the current guid) is necessary to fully disambiguate
logical sessions in degraded clusters (when the authoritative record for
a session is unreachable).
Semantics for the uid are as follows:
session creation via startSession()
* Sessions can only be created with one, and only one, user authenticated
* The composite key is created from a guid created on the spot, as well
as the digest of the currently auth'd username
* Only the session guid is returned to the user
* This prevents outside users from attempting to send back a value
we'd have to check. It's preferable to decorate the guid with the
user digest per command, rather than having to check a value the user
might send.
session use for a command
* Sessions are passed via the lsid top level field in any command
* Sessions are only meaningful for commands which requireAuth. For
sessions which don't require auth, we strip session information from the
command at parse time
* Session ids are passed as an object, which can optionally include the
username digest
* It is illegal to pass the username digest unless the currently
auth'd user has the impersonate privilege (the __system user does).
This enables sessions on shard servers via mongos
Diffstat (limited to 'src/mongo/s')
-rw-r--r-- | src/mongo/s/commands/strategy.cpp | 5 | ||||
-rw-r--r-- | src/mongo/s/query/SConscript | 1 | ||||
-rw-r--r-- | src/mongo/s/query/cluster_client_cursor_impl_test.cpp | 2 | ||||
-rw-r--r-- | src/mongo/s/query/cluster_cursor_manager_test.cpp | 14 |
4 files changed, 12 insertions, 10 deletions
diff --git a/src/mongo/s/commands/strategy.cpp b/src/mongo/s/commands/strategy.cpp index 90b9748732b..b6037760773 100644 --- a/src/mongo/s/commands/strategy.cpp +++ b/src/mongo/s/commands/strategy.cpp @@ -42,6 +42,7 @@ #include "mongo/db/auth/authorization_session.h" #include "mongo/db/commands.h" #include "mongo/db/logical_clock.h" +#include "mongo/db/logical_session_id_helpers.h" #include "mongo/db/logical_time_validator.h" #include "mongo/db/matcher/extensions_callback_noop.h" #include "mongo/db/namespace_string.h" @@ -256,12 +257,12 @@ void runAgainstRegistered(OperationContext* opCtx, return; } + initializeOperationSessionInfo(opCtx, request.body, c->requiresAuth()); + execCommandClient(opCtx, c, request, anObjBuilder); } void runCommand(OperationContext* opCtx, const OpMsgRequest& request, BSONObjBuilder&& builder) { - initializeOperationSessionInfo(opCtx, request.body); - // Handle command option maxTimeMS. uassert(ErrorCodes::InvalidOptions, "no such command option $maxTimeMs; use maxTimeMS instead", diff --git a/src/mongo/s/query/SConscript b/src/mongo/s/query/SConscript index 39bc9dcf017..f2a7b25cb28 100644 --- a/src/mongo/s/query/SConscript +++ b/src/mongo/s/query/SConscript @@ -131,6 +131,7 @@ env.Library( ], LIBDEPS=[ '$BUILD_DIR/mongo/base', + '$BUILD_DIR/mongo/db/logical_session_id', ], ) diff --git a/src/mongo/s/query/cluster_client_cursor_impl_test.cpp b/src/mongo/s/query/cluster_client_cursor_impl_test.cpp index 6c10cf18530..549a692d720 100644 --- a/src/mongo/s/query/cluster_client_cursor_impl_test.cpp +++ b/src/mongo/s/query/cluster_client_cursor_impl_test.cpp @@ -164,7 +164,7 @@ TEST(ClusterClientCursorImpl, LogicalSessionIdsOnCursors) { // Make a cursor with an lsid auto mockStage2 = stdx::make_unique<RouterStageMock>(); ClusterClientCursorParams params2(NamespaceString("test"), {}); - auto lsid = LogicalSessionId::gen(); + auto lsid = makeLogicalSessionIdForTest(); ClusterClientCursorImpl cursor2{std::move(mockStage2), std::move(params2), lsid}; ASSERT(*(cursor2.getLsid()) == lsid); } diff --git a/src/mongo/s/query/cluster_cursor_manager_test.cpp b/src/mongo/s/query/cluster_cursor_manager_test.cpp index 35bbf4ad847..46377d2f483 100644 --- a/src/mongo/s/query/cluster_cursor_manager_test.cpp +++ b/src/mongo/s/query/cluster_cursor_manager_test.cpp @@ -969,7 +969,7 @@ TEST_F(ClusterCursorManagerTest, CursorsWithoutSessions) { */ TEST_F(ClusterCursorManagerTest, OneCursorWithASession) { // Add a cursor with a session to the cursor manager. - auto lsid = LogicalSessionId::gen(); + auto lsid = makeLogicalSessionIdForTest(); auto cursorId = assertGet( getManager()->registerCursor(nullptr, allocateMockCursor(lsid), @@ -1003,7 +1003,7 @@ TEST_F(ClusterCursorManagerTest, OneCursorWithASession) { */ TEST_F(ClusterCursorManagerTest, GetSessionIdsWhileCheckedOut) { // Add a cursor with a session to the cursor manager. - auto lsid = LogicalSessionId::gen(); + auto lsid = makeLogicalSessionIdForTest(); auto cursorId = assertGet( getManager()->registerCursor(nullptr, allocateMockCursor(lsid), @@ -1024,7 +1024,7 @@ TEST_F(ClusterCursorManagerTest, GetSessionIdsWhileCheckedOut) { */ TEST_F(ClusterCursorManagerTest, MultipleCursorsWithSameSession) { // Add two cursors on the same session to the cursor manager. - auto lsid = LogicalSessionId::gen(); + auto lsid = makeLogicalSessionIdForTest(); auto cursorId1 = assertGet( getManager()->registerCursor(nullptr, allocateMockCursor(lsid), @@ -1039,7 +1039,7 @@ TEST_F(ClusterCursorManagerTest, MultipleCursorsWithSameSession) { ClusterCursorManager::CursorLifetime::Mortal)); // Retrieve all sessions - set should contain just lsid. - stdx::unordered_set<LogicalSessionId, LogicalSessionId::Hash> lsids; + stdx::unordered_set<LogicalSessionId, LogicalSessionIdHash> lsids; getManager()->appendActiveSessions(&lsids); ASSERT_EQ(lsids.size(), size_t(1)); ASSERT(lsids.find(lsid) != lsids.end()); @@ -1069,8 +1069,8 @@ TEST_F(ClusterCursorManagerTest, MultipleCursorsWithSameSession) { * Test a manager with multiple cursors running inside of different sessions. */ TEST_F(ClusterCursorManagerTest, MultipleCursorsMultipleSessions) { - auto lsid1 = LogicalSessionId::gen(); - auto lsid2 = LogicalSessionId::gen(); + auto lsid1 = makeLogicalSessionIdForTest(); + auto lsid2 = makeLogicalSessionIdForTest(); // Register two cursors with different lsids, and one without. CursorId cursor1 = assertGet( @@ -1116,7 +1116,7 @@ TEST_F(ClusterCursorManagerTest, MultipleCursorsMultipleSessions) { TEST_F(ClusterCursorManagerTest, ManyCursorsManySessions) { const int count = 10000; for (int i = 0; i < count; i++) { - auto lsid = LogicalSessionId::gen(); + auto lsid = makeLogicalSessionIdForTest(); ASSERT_OK( getManager()->registerCursor(nullptr, allocateMockCursor(lsid), |