Always use internal credetials when connecting to the config servers. SERVER-1456

15 files changed, 87 insertions, 38 deletions

diff --git a/src/mongo/client/connpool.cpp b/src/mongo/client/connpool.cpp
index d79265d070f..ebfc187346a 100644
--- a/src/mongo/client/connpool.cpp
+++ b/src/mongo/client/connpool.cpp
@@ -80,7 +80,11 @@ namespace mongo {
             _pool.pop();
             all.push_back( c );
             bool res;
+            // When a connection is in the pool it doesn't have an AuthenticationTable set.
+            c.conn->setAuthenticationTable(
+                    AuthenticationTable::getInternalSecurityAuthenticationTable() );
             c.conn->isMaster( res );
+            c.conn->clearAuthenticationTable();
         }
 
         for ( vector<StoredConnection>::iterator i=all.begin(); i != all.end(); ++i ) {
diff --git a/src/mongo/client/dbclient.cpp b/src/mongo/client/dbclient.cpp
index 56307760e91..6441105107c 100644
--- a/src/mongo/client/dbclient.cpp
+++ b/src/mongo/client/dbclient.cpp
@@ -330,6 +330,14 @@ namespace mongo {
         _hasAuthentication = false;
     }
 
+    bool DBClientWithCommands::hasAuthenticationTable() {
+        return _hasAuthentication;
+    }
+
+    AuthenticationTable& DBClientWithCommands::getAuthenticationTable() {
+        return _authTable;
+    }
+
     inline bool DBClientWithCommands::runCommand(const string &dbname,
                                                  const BSONObj& cmd,
                                                  BSONObj &info,
diff --git a/src/mongo/client/dbclientinterface.h b/src/mongo/client/dbclientinterface.h
index 475701c061d..336033299f0 100644
--- a/src/mongo/client/dbclientinterface.h
+++ b/src/mongo/client/dbclientinterface.h
@@ -819,8 +819,8 @@ namespace mongo {
 
         bool exists( const string& ns );
 
-        void setAuthenticationTable ( const AuthenticationTable& auth );
-        void clearAuthenticationTable ();
+        virtual void setAuthenticationTable( const AuthenticationTable& auth );
+        virtual void clearAuthenticationTable();
 
         /** Create an index if it does not already exist.
             ensureIndex calls are remembered so it is safe/fast to call this function many
@@ -883,6 +883,9 @@ namespace mongo {
 
         virtual QueryOptions _lookupAvailableOptions();
 
+        bool hasAuthenticationTable();
+        AuthenticationTable& getAuthenticationTable();
+
     private:
         enum QueryOptions _cachedAvailableOptions;
         bool _haveCachedAvailableOptions;
diff --git a/src/mongo/client/syncclusterconnection.cpp b/src/mongo/client/syncclusterconnection.cpp
index 158b1dab3f2..b3ccdf829cc 100644
--- a/src/mongo/client/syncclusterconnection.cpp
+++ b/src/mongo/client/syncclusterconnection.cpp
@@ -21,6 +21,7 @@
 #include "mongo/client/syncclusterconnection.h"
 
 #include "mongo/client/dbclientcursor.h"
+#include "mongo/client/dbclientinterface.h"
 #include "mongo/db/dbmessage.h"
 
 // error codes 8000-8009
@@ -210,6 +211,20 @@ namespace mongo {
         return true;
     }
 
+    void SyncClusterConnection::setAuthenticationTable( const AuthenticationTable& auth ) {
+        for( size_t i = 0; i < _conns.size(); ++i ) {
+            _conns[i]->setAuthenticationTable( auth );
+        }
+        DBClientWithCommands::setAuthenticationTable( auth );
+    }
+
+    void SyncClusterConnection::clearAuthenticationTable() {
+        for( size_t i = 0; i < _conns.size(); ++i ) {
+            _conns[i]->clearAuthenticationTable( auth );
+        }
+        DBClientWithCommands::clearAuthenticationTable();
+    }
+
     auto_ptr<DBClientCursor> SyncClusterConnection::query(const string &ns, Query query, int nToReturn, int nToSkip,
             const BSONObj *fieldsToReturn, int queryOptions, int batchSize ) {
         _lastErrors.clear();
@@ -223,7 +238,11 @@ namespace mongo {
     }
 
     bool SyncClusterConnection::_commandOnActive(const string &dbname, const BSONObj& cmd, BSONObj &info, int options ) {
-        auto_ptr<DBClientCursor> cursor = _queryOnActive( dbname + ".$cmd" , cmd , 1 , 0 , 0 , options , 0 );
+        BSONObj actualCmd = cmd;
+        if ( hasAuthenticationTable() ) {
+            actualCmd = getAuthenticationTable().copyCommandObjAddingAuth( cmd );
+        }
+        auto_ptr<DBClientCursor> cursor = _queryOnActive( dbname + ".$cmd" , actualCmd , 1 , 0 , 0 , options , 0 );
         if ( cursor->more() )
             info = cursor->next().copy();
         else
diff --git a/src/mongo/client/syncclusterconnection.h b/src/mongo/client/syncclusterconnection.h
index 611869b437b..3907f7e50a0 100644
--- a/src/mongo/client/syncclusterconnection.h
+++ b/src/mongo/client/syncclusterconnection.h
@@ -102,6 +102,9 @@ namespace mongo {
 
         virtual bool auth(const string &dbname, const string &username, const string &password_text, string& errmsg, bool digestPassword, Auth::Level* level=NULL);
 
+        virtual void setAuthenticationTable( const AuthenticationTable& auth );
+        virtual void clearAuthenticationTable();
+
         virtual bool lazySupported() const { return false; }
     private:
         SyncClusterConnection( SyncClusterConnection& prev, double socketTimeout = 0 );
diff --git a/src/mongo/s/chunk.cpp b/src/mongo/s/chunk.cpp
index 756e6040bc9..e9dfc8183f0 100644
--- a/src/mongo/s/chunk.cpp
+++ b/src/mongo/s/chunk.cpp
@@ -1232,7 +1232,7 @@ namespace mongo {
 
         // remove chunk data
         scoped_ptr<ScopedDbConnection> conn(
-                ScopedDbConnection::getScopedDbConnection( configServer.modelServer() ) );
+                ScopedDbConnection::getInternalScopedDbConnection( configServer.modelServer() ) );
         conn->get()->remove( Chunk::chunkMetadataNS , BSON( "ns" << _ns ) );
         conn->done();
         LOG(1) << "ChunkManager::drop : " << _ns << "\t removed chunk data" << endl;
diff --git a/src/mongo/s/chunk_diff.hpp b/src/mongo/s/chunk_diff.hpp
index 59927b95ce8..47b700457db 100644
--- a/src/mongo/s/chunk_diff.hpp
+++ b/src/mongo/s/chunk_diff.hpp
@@ -81,7 +81,8 @@ namespace mongo {
         // Get the diff query required
         Query diffQuery = configDiffQuery( extraMinorVersions );
 
-        scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getScopedDbConnection( config ) );
+        scoped_ptr<ScopedDbConnection> conn(
+                ScopedDbConnection::getInternalScopedDbConnection( config ) );
 
         try {
 
diff --git a/src/mongo/s/commands_admin.cpp b/src/mongo/s/commands_admin.cpp
index e680a919e86..19c672855c7 100644
--- a/src/mongo/s/commands_admin.cpp
+++ b/src/mongo/s/commands_admin.cpp
@@ -868,8 +868,8 @@ namespace mongo {
             }
             bool run(const string& , BSONObj& cmdObj, int, string& errmsg, BSONObjBuilder& result, bool) {
                 scoped_ptr<ScopedDbConnection> conn(
-                        ScopedDbConnection::getScopedDbConnection( configServer.getPrimary()
-                                                                   .getConnString() ) );
+                        ScopedDbConnection::getInternalScopedDbConnection( configServer.getPrimary()
+                                                                           .getConnString() ) );
 
                 vector<BSONObj> all;
                 auto_ptr<DBClientCursor> cursor = conn->get()->query( "config.shards" , BSONObj() );
@@ -973,8 +973,8 @@ namespace mongo {
                 }
 
                 scoped_ptr<ScopedDbConnection> connPtr(
-                        ScopedDbConnection::getScopedDbConnection( configServer.getPrimary()
-                                                                   .getConnString() ) );
+                        ScopedDbConnection::getInternalScopedDbConnection( configServer.getPrimary()
+                                                                           .getConnString() ) );
                 ScopedDbConnection& conn = *connPtr;
 
                 if (conn->count("config.shards", BSON("_id" << NE << s.getName() << ShardFields::draining(true)))){
@@ -1296,8 +1296,8 @@ namespace mongo {
             
             if ( sizes.find( "config" ) == sizes.end() ){
                 scoped_ptr<ScopedDbConnection> conn(
-                        ScopedDbConnection::getScopedDbConnection( configServer.getPrimary()
-                                                                   .getConnString() ) );
+                        ScopedDbConnection::getInternalScopedDbConnection( configServer.getPrimary()
+                                                                           .getConnString() ) );
                 BSONObj x;
                 if ( conn->get()->simpleCommand( "config" , &x , "dbstats" ) ){
                     BSONObjBuilder b;
diff --git a/src/mongo/s/config.cpp b/src/mongo/s/config.cpp
index 0b9bde1e195..0825378ce3c 100644
--- a/src/mongo/s/config.cpp
+++ b/src/mongo/s/config.cpp
@@ -327,8 +327,8 @@ namespace mongo {
 
         BSONObj newest;
         if ( oldVersion.isSet() && ! forceReload ) {
-            scoped_ptr<ScopedDbConnection> conn(
-                    ScopedDbConnection::getScopedDbConnection( configServer.modelServer(), 30.0 ) );
+            scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getInternalScopedDbConnection(
+                    configServer.modelServer(), 30.0 ) );
             newest = conn->get()->findOne( ShardNS::chunk ,
                                            Query( BSON( "ns" << ns ) ).sort( "lastmod" , -1 ) );
             conn->done();
@@ -460,8 +460,8 @@ namespace mongo {
     }
 
     bool DBConfig::_load() {
-        scoped_ptr<ScopedDbConnection> conn(
-                ScopedDbConnection::getScopedDbConnection( configServer.modelServer(), 30.0 ) );
+        scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getInternalScopedDbConnection(
+                configServer.modelServer(), 30.0 ) );
 
         BSONObj o = conn->get()->findOne( ShardNS::database , BSON( "_id" << _name ) );
 
@@ -504,8 +504,8 @@ namespace mongo {
     }
 
     void DBConfig::_save( bool db, bool coll ) {
-        scoped_ptr<ScopedDbConnection> conn(
-                ScopedDbConnection::getScopedDbConnection( configServer.modelServer(), 30.0 ) );
+        scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getInternalScopedDbConnection(
+                configServer.modelServer(), 30.0 ) );
 
         if( db ){
 
@@ -579,8 +579,8 @@ namespace mongo {
         // 2
         grid.removeDB( _name );
         {
-            scoped_ptr<ScopedDbConnection> conn(
-                    ScopedDbConnection::getScopedDbConnection(configServer.modelServer(), 30.0 ) );
+            scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getInternalScopedDbConnection(
+                    configServer.modelServer(), 30.0 ) );
             conn->get()->remove( ShardNS::database , BSON( "_id" << _name ) );
             errmsg = conn->get()->getLastError();
             if ( ! errmsg.empty() ) {
diff --git a/src/mongo/s/config_migrate.cpp b/src/mongo/s/config_migrate.cpp
index fc88fce1538..aa15f1eda7b 100644
--- a/src/mongo/s/config_migrate.cpp
+++ b/src/mongo/s/config_migrate.cpp
@@ -37,7 +37,7 @@ namespace mongo {
 
         if ( cur == 0 ) {
             scoped_ptr<ScopedDbConnection> conn(
-                    ScopedDbConnection::getScopedDbConnection( _primary.getConnString() ) );
+                    ScopedDbConnection::getInternalScopedDbConnection( _primary.getConnString() ) );
 
             // If the cluster has not previously been initialized, we need to set the version before using so
             // subsequent mongoses use the config data the same way.  This requires all three config servers online
diff --git a/src/mongo/s/d_chunk_manager.cpp b/src/mongo/s/d_chunk_manager.cpp
index 9d162a64d04..a39fa4a684a 100644
--- a/src/mongo/s/d_chunk_manager.cpp
+++ b/src/mongo/s/d_chunk_manager.cpp
@@ -81,7 +81,7 @@ namespace mongo {
             conn = direct.get();
         }
         else {
-            scoped.reset( ScopedDbConnection::getScopedDbConnection( configServer, 30.0 ) );
+            scoped.reset( ScopedDbConnection::getInternalScopedDbConnection( configServer, 30.0 ) );
             conn = scoped->get();
         }
 
diff --git a/src/mongo/s/d_migrate.cpp b/src/mongo/s/d_migrate.cpp
index 9ada8735cb5..36b7189132c 100644
--- a/src/mongo/s/d_migrate.cpp
+++ b/src/mongo/s/d_migrate.cpp
@@ -887,8 +887,9 @@ namespace mongo {
             ShardChunkVersion maxVersion;
             string myOldShard;
             {
-                scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getScopedDbConnection(
-                        shardingState.getConfigServer() ) );
+                scoped_ptr<ScopedDbConnection> conn(
+                        ScopedDbConnection::getInternalScopedDbConnection(
+                                shardingState.getConfigServer() ) );
 
                 BSONObj x;
                 BSONObj currChunk;
@@ -1234,8 +1235,9 @@ namespace mongo {
                 bool ok = false;
                 BSONObj cmdResult;
                 try {
-                    scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getScopedDbConnection(
-                            shardingState.getConfigServer() ) );
+                    scoped_ptr<ScopedDbConnection> conn(
+                            ScopedDbConnection::getInternalScopedDbConnection(
+                                    shardingState.getConfigServer() ) );
                     ok = conn->get()->runCommand( "config" , cmd , cmdResult );
                     conn->done();
                 }
@@ -1261,8 +1263,8 @@ namespace mongo {
 
                     try {
                         scoped_ptr<ScopedDbConnection> conn(
-                                ScopedDbConnection::getScopedDbConnection( shardingState
-                                                                           .getConfigServer() ) );
+                                ScopedDbConnection::getInternalScopedDbConnection(
+                                        shardingState.getConfigServer() ) );
 
                         // look for the chunk in this shard whose version got bumped
                         // we assume that if that mod made it to the config, the applyOps was successful
diff --git a/src/mongo/s/d_split.cpp b/src/mongo/s/d_split.cpp
index f1b96416272..4309c9ee13a 100644
--- a/src/mongo/s/d_split.cpp
+++ b/src/mongo/s/d_split.cpp
@@ -559,8 +559,9 @@ namespace mongo {
             string shard;
             ChunkInfo origChunk;
             {
-                scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getScopedDbConnection(
-                        shardingState.getConfigServer() ) );
+                scoped_ptr<ScopedDbConnection> conn(
+                        ScopedDbConnection::getInternalScopedDbConnection(
+                                shardingState.getConfigServer() ) );
 
                 BSONObj x = conn->get()->findOne( ShardNS::chunk,
                                                   Query( BSON( "ns" << ns ) )
@@ -702,8 +703,9 @@ namespace mongo {
             bool ok;
             BSONObj cmdResult;
             {
-                scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getScopedDbConnection(
-                        shardingState.getConfigServer() ) );
+                scoped_ptr<ScopedDbConnection> conn(
+                        ScopedDbConnection::getInternalScopedDbConnection(
+                                shardingState.getConfigServer() ) );
                 ok = conn->get()->runCommand( "config" , cmd , cmdResult );
                 conn->done();
             }
diff --git a/src/mongo/s/grid.cpp b/src/mongo/s/grid.cpp
index 83448245e8c..638420037d9 100644
--- a/src/mongo/s/grid.cpp
+++ b/src/mongo/s/grid.cpp
@@ -77,7 +77,8 @@ namespace mongo {
                         {
                             // lets check case
                             scoped_ptr<ScopedDbConnection> conn(
-                                ScopedDbConnection::getScopedDbConnection( configServer.modelServer() ));
+                                    ScopedDbConnection::getInternalScopedDbConnection(
+                                            configServer.modelServer() ));
 
                             BSONObjBuilder b;
                             b.appendRegex( "_id" , (string)"^" +
@@ -398,7 +399,7 @@ namespace mongo {
     }
 
     bool Grid::knowAboutShard( const string& name ) const {
-        scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getScopedDbConnection(
+        scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getInternalScopedDbConnection(
                 configServer.getPrimary().getConnString() ) );
         BSONObj shard = conn->get()->findOne( ShardNS::shard , BSON( "host" << name ) );
         conn->done();
@@ -411,7 +412,7 @@ namespace mongo {
         bool ok = false;
         int count = 0;
 
-        scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getScopedDbConnection(
+        scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getInternalScopedDbConnection(
                 configServer.getPrimary().getConnString() ) );
         BSONObj o = conn->get()->findOne( ShardNS::shard ,
                                           Query( fromjson ( "{_id: /^shard/}" ) )
@@ -439,7 +440,7 @@ namespace mongo {
      */
     bool Grid::shouldBalance( const string& ns, BSONObj* balancerDocOut ) const {
 
-        scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getScopedDbConnection(
+        scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getInternalScopedDbConnection(
                 configServer.getPrimary().getConnString() ) );
         BSONObj balancerDoc;
         BSONObj collDoc;
@@ -554,7 +555,7 @@ namespace mongo {
     }
 
     BSONObj Grid::getConfigSetting( string name ) const {
-        scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getScopedDbConnection(
+        scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getInternalScopedDbConnection(
                 configServer.getPrimary().getConnString() ) );
         BSONObj result = conn->get()->findOne( ShardNS::settings, BSON( "_id" << name ) );
         conn->done();
diff --git a/src/mongo/s/shard.cpp b/src/mongo/s/shard.cpp
index 221d900dcb6..d966ee780c7 100644
--- a/src/mongo/s/shard.cpp
+++ b/src/mongo/s/shard.cpp
@@ -37,8 +37,9 @@ namespace mongo {
 
             list<BSONObj> all;
             {
-                scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getScopedDbConnection(
-                        configServer.getPrimary().getConnString() ) );
+                scoped_ptr<ScopedDbConnection> conn(
+                        ScopedDbConnection::getInternalScopedDbConnection(
+                                configServer.getPrimary().getConnString() ) );
                 auto_ptr<DBClientCursor> c = conn->get()->query( ShardNS::shard , Query() );
                 massert( 13632 , "couldn't get updated shard list from config server" , c.get() );
                 while ( c->more() ) {
@@ -391,6 +392,11 @@ namespace mongo {
             LOG(2) << "calling onCreate auth for " << conn->toString() << endl;
             uassert( 15847, "can't authenticate to shard server",
                     conn->auth("local", internalSecurity.user, internalSecurity.pwd, err, false));
+            if ( conn->type() == ConnectionString::SYNC ) {
+                // Connections to the config servers should always have full access.
+                conn->setAuthenticationTable(
+                        AuthenticationTable::getInternalSecurityAuthenticationTable() );
+            }
         }
 
         if ( _shardedConnections && versionManager.isVersionableCB( conn ) ) {