Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ui: remove remote_debugging checks #28209

Closed
wants to merge 1 commit into from
Closed

ui: remove remote_debugging checks #28209

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 0 additions & 11 deletions pkg/server/admin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@ import (
"github.com/cockroachdb/cockroach/pkg/keys"
"github.com/cockroachdb/cockroach/pkg/roachpb"
"github.com/cockroachdb/cockroach/pkg/security"
"github.com/cockroachdb/cockroach/pkg/server/debug"
"github.com/cockroachdb/cockroach/pkg/server/serverpb"
"github.com/cockroachdb/cockroach/pkg/settings"
"github.com/cockroachdb/cockroach/pkg/sql"
Expand Down Expand Up @@ -825,8 +824,6 @@ func (s *adminServer) RangeLog(
limit = defaultAPIEventLimit
}

includeRawKeys := debug.GatewayRemoteAllowed(ctx, s.server.ClusterSettings())

// Execute the query.
q := makeSQLQuery()
q.Append(`SELECT timestamp, "rangeID", "storeID", "eventType", "otherRangeID", info `)
Expand Down Expand Up @@ -901,17 +898,9 @@ func (s *adminServer) RangeLog(
return nil, errors.Wrap(err, fmt.Sprintf("info didn't parse correctly: %s", info))
}
if event.Info.NewDesc != nil {
if !includeRawKeys {
event.Info.NewDesc.StartKey = nil
event.Info.NewDesc.EndKey = nil
}
prettyInfo.NewDesc = event.Info.NewDesc.String()
}
if event.Info.UpdatedDesc != nil {
if !includeRawKeys {
event.Info.UpdatedDesc.StartKey = nil
event.Info.UpdatedDesc.EndKey = nil
}
prettyInfo.UpdatedDesc = event.Info.UpdatedDesc.String()
}
if event.Info.AddedReplica != nil {
Expand Down
21 changes: 0 additions & 21 deletions pkg/server/debug/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@
package debug

import (
"context"
"expvar"
"fmt"
"net"
Expand All @@ -27,7 +26,6 @@ import (

"github.com/cockroachdb/cockroach/pkg/server/debug/pprofui"
"golang.org/x/net/trace"
"google.golang.org/grpc/metadata"

"github.com/pkg/errors"
"github.com/rcrowley/go-metrics"
Expand Down Expand Up @@ -180,25 +178,6 @@ func isLocalhost(remoteAddr string) bool {
}
}

// GatewayRemoteAllowed returns whether a request that has been passed through
// the grpc gateway should be allowed accessed to privileged debugging
// information. Because this function assumes the presence of a context field
// populated by the grpc gateway, it's not applicable for other uses.
func GatewayRemoteAllowed(ctx context.Context, st *cluster.Settings) bool {
md, ok := metadata.FromIncomingContext(ctx)
if !ok {
// This should only happen for direct grpc connections, which are allowed.
return true
}
peerAddr, ok := md["x-forwarded-for"]
if !ok || len(peerAddr) == 0 {
// This should only happen for direct grpc connections, which are allowed.
return true
}

return authRequest(peerAddr[0], st)
}

func handleLanding(w http.ResponseWriter, r *http.Request) {
if r.URL.Path != Endpoint {
http.Redirect(w, r, Endpoint, http.StatusMovedPermanently)
Expand Down
1 change: 0 additions & 1 deletion pkg/server/statements.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,6 @@ import (
func (s *statusServer) Statements(
ctx context.Context, req *serverpb.StatementsRequest,
) (*serverpb.StatementsResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)

response := &serverpb.StatementsResponse{
Expand Down
84 changes: 3 additions & 81 deletions pkg/server/status.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,6 @@ import (
"github.com/pkg/errors"
"google.golang.org/grpc"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/metadata"
grpcstatus "google.golang.org/grpc/status"

"github.com/cockroachdb/cockroach/pkg/base"
Expand All @@ -50,7 +49,6 @@ import (
"github.com/cockroachdb/cockroach/pkg/roachpb"
"github.com/cockroachdb/cockroach/pkg/rpc"
"github.com/cockroachdb/cockroach/pkg/security"
"github.com/cockroachdb/cockroach/pkg/server/debug"
"github.com/cockroachdb/cockroach/pkg/server/diagnosticspb"
"github.com/cockroachdb/cockroach/pkg/server/serverpb"
"github.com/cockroachdb/cockroach/pkg/server/status"
Expand Down Expand Up @@ -93,25 +91,13 @@ const (
var (
// Pattern for local used when determining the node ID.
localRE = regexp.MustCompile(`(?i)local`)

// Error used to convey that remote debugging is needs to be enabled for an
// endpoint to be usable.
remoteDebuggingErr = grpcstatus.Error(
codes.PermissionDenied, "not allowed (due to the 'server.remote_debugging.mode' setting)")
)

type metricMarshaler interface {
json.Marshaler
PrintAsText(io.Writer) error
}

func propagateGatewayMetadata(ctx context.Context) context.Context {
if md, ok := metadata.FromIncomingContext(ctx); ok {
return metadata.NewOutgoingContext(ctx, md)
}
return ctx
}

// A statusServer provides a RESTful status API.
type statusServer struct {
log.AmbientContext
Expand Down Expand Up @@ -209,11 +195,6 @@ func (s *statusServer) dialNode(
func (s *statusServer) Gossip(
ctx context.Context, req *serverpb.GossipRequest,
) (*gossip.InfoStatus, error) {
if !debug.GatewayRemoteAllowed(ctx, s.st) {
return nil, remoteDebuggingErr
}

ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand All @@ -235,13 +216,6 @@ func (s *statusServer) Gossip(
func (s *statusServer) Allocator(
ctx context.Context, req *serverpb.AllocatorRequest,
) (*serverpb.AllocatorResponse, error) {
// TODO(a-robinson): It'd be nice to allow this endpoint and just avoid
// logging range start/end keys in the simulated allocator runs.
if !debug.GatewayRemoteAllowed(ctx, s.st) {
return nil, remoteDebuggingErr
}

ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand Down Expand Up @@ -343,13 +317,6 @@ func recordedSpansToAllocatorEvents(
func (s *statusServer) AllocatorRange(
ctx context.Context, req *serverpb.AllocatorRangeRequest,
) (*serverpb.AllocatorRangeResponse, error) {
// TODO(a-robinson): It'd be nice to allow this endpoint and just avoid
// logging range start/end keys in the simulated allocator runs.
if !debug.GatewayRemoteAllowed(ctx, s.st) {
return nil, remoteDebuggingErr
}

ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeCtx, cancel := context.WithTimeout(ctx, base.NetworkTimeout)
defer cancel()
Expand Down Expand Up @@ -433,7 +400,6 @@ func (s *statusServer) AllocatorRange(
func (s *statusServer) Certificates(
ctx context.Context, req *serverpb.CertificatesRequest,
) (*serverpb.CertificatesResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand Down Expand Up @@ -548,7 +514,6 @@ func extractCertFields(contents []byte, details *serverpb.CertificateDetails) er
func (s *statusServer) Details(
ctx context.Context, req *serverpb.DetailsRequest,
) (*serverpb.DetailsResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand Down Expand Up @@ -596,7 +561,6 @@ func (s *statusServer) Details(
func (s *statusServer) LogFilesList(
ctx context.Context, req *serverpb.LogFilesListRequest,
) (*serverpb.LogFilesListResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand All @@ -621,11 +585,6 @@ func (s *statusServer) LogFilesList(
func (s *statusServer) LogFile(
ctx context.Context, req *serverpb.LogFileRequest,
) (*serverpb.LogEntriesResponse, error) {
if !debug.GatewayRemoteAllowed(ctx, s.st) {
return nil, remoteDebuggingErr
}

ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand Down Expand Up @@ -696,11 +655,6 @@ func parseInt64WithDefault(s string, defaultValue int64) (int64, error) {
func (s *statusServer) Logs(
ctx context.Context, req *serverpb.LogsRequest,
) (*serverpb.LogEntriesResponse, error) {
if !debug.GatewayRemoteAllowed(ctx, s.st) {
return nil, remoteDebuggingErr
}

ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand Down Expand Up @@ -762,7 +716,6 @@ func (s *statusServer) Logs(
func (s *statusServer) Stacks(
ctx context.Context, req *serverpb.StacksRequest,
) (*serverpb.JSONResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand Down Expand Up @@ -832,7 +785,6 @@ func (s *statusServer) Profile(
func (s *statusServer) Nodes(
ctx context.Context, req *serverpb.NodesRequest,
) (*serverpb.NodesResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
startKey := keys.StatusNodePrefix
endKey := startKey.PrefixEnd()
Expand Down Expand Up @@ -895,7 +847,6 @@ type NodeStatusWithLiveness struct {
func (s *statusServer) Node(
ctx context.Context, req *serverpb.NodeRequest,
) (*status.NodeStatus, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, _, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand Down Expand Up @@ -923,7 +874,6 @@ func (s *statusServer) Node(
func (s *statusServer) Metrics(
ctx context.Context, req *serverpb.MetricsRequest,
) (*serverpb.JSONResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand All @@ -944,7 +894,6 @@ func (s *statusServer) Metrics(
func (s *statusServer) RaftDebug(
ctx context.Context, req *serverpb.RaftDebugRequest,
) (*serverpb.RaftDebugResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodes, err := s.Nodes(ctx, nil)
if err != nil {
Expand Down Expand Up @@ -1051,7 +1000,6 @@ func (s *statusServer) handleVars(w http.ResponseWriter, r *http.Request) {
func (s *statusServer) Ranges(
ctx context.Context, req *serverpb.RangesRequest,
) (*serverpb.RangesResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand Down Expand Up @@ -1100,27 +1048,16 @@ func (s *statusServer) Ranges(
return state
}

includeRawKeys := debug.GatewayRemoteAllowed(ctx, s.st)

constructRangeInfo := func(
desc roachpb.RangeDescriptor, rep *storage.Replica, storeID roachpb.StoreID, metrics storage.ReplicaMetrics,
) serverpb.RangeInfo {
raftStatus := rep.RaftStatus()
raftState := convertRaftStatus(raftStatus)
leaseHistory := rep.GetLeaseHistory()
var span serverpb.PrettySpan
if includeRawKeys {
span.StartKey = desc.StartKey.String()
span.EndKey = desc.EndKey.String()
} else {
span.StartKey = omittedKeyStr
span.EndKey = omittedKeyStr
}
span.StartKey = desc.StartKey.String()
span.EndKey = desc.EndKey.String()
state := rep.State()
if !includeRawKeys {
state.ReplicaState.Desc.StartKey = nil
state.ReplicaState.Desc.EndKey = nil
}
return serverpb.RangeInfo{
Span: span,
RaftState: raftState,
Expand Down Expand Up @@ -1213,7 +1150,6 @@ func (s *statusServer) Ranges(
func (s *statusServer) Range(
ctx context.Context, req *serverpb.RangeRequest,
) (*serverpb.RangeResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)

response := &serverpb.RangeResponse{
Expand Down Expand Up @@ -1272,13 +1208,8 @@ func (s *statusServer) CommandQueue(

// ListLocalSessions returns a list of SQL sessions on this node.
func (s *statusServer) ListLocalSessions(
ctx context.Context, req *serverpb.ListSessionsRequest,
_ctx context.Context, req *serverpb.ListSessionsRequest,
) (*serverpb.ListSessionsResponse, error) {
ctx = propagateGatewayMetadata(ctx)
if !debug.GatewayRemoteAllowed(ctx, s.st) {
return nil, remoteDebuggingErr
}

registry := s.sessionRegistry

sessions := registry.SerializeAll()
Expand Down Expand Up @@ -1375,11 +1306,6 @@ func (s *statusServer) iterateNodes(
func (s *statusServer) ListSessions(
ctx context.Context, req *serverpb.ListSessionsRequest,
) (*serverpb.ListSessionsResponse, error) {
ctx = propagateGatewayMetadata(ctx)
if !debug.GatewayRemoteAllowed(ctx, s.st) {
return nil, remoteDebuggingErr
}

ctx = s.AnnotateCtx(ctx)

response := &serverpb.ListSessionsResponse{
Expand Down Expand Up @@ -1444,7 +1370,6 @@ func (s *statusServer) CancelSession(
func (s *statusServer) CancelQuery(
ctx context.Context, req *serverpb.CancelQueryRequest,
) (*serverpb.CancelQueryResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)

Expand Down Expand Up @@ -1476,7 +1401,6 @@ func (s *statusServer) CancelQuery(
func (s *statusServer) SpanStats(
ctx context.Context, req *serverpb.SpanStatsRequest,
) (*serverpb.SpanStatsResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeID)
if err != nil {
Expand Down Expand Up @@ -1513,7 +1437,6 @@ func (s *statusServer) SpanStats(
func (s *statusServer) Diagnostics(
ctx context.Context, req *serverpb.DiagnosticsRequest,
) (*diagnosticspb.DiagnosticReport, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand All @@ -1535,7 +1458,6 @@ func (s *statusServer) Diagnostics(
func (s *statusServer) Stores(
ctx context.Context, req *serverpb.StoresRequest,
) (*serverpb.StoresResponse, error) {
ctx = propagateGatewayMetadata(ctx)
ctx = s.AnnotateCtx(ctx)
nodeID, local, err := s.parseNodeID(req.NodeId)
if err != nil {
Expand Down
Loading