Skip to content

Commit 9781dce

Browse files
StekPerepolnenStekPerepolnen
authored
mask iam tokens (#10276)
1 parent cb4e8c5 commit 9781dce

File tree

5 files changed

+82
-4
lines changed

5 files changed

+82
-4
lines changed

‎ydb/mvp/core/grpc_log.h

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,11 @@
77

88
namespace NMVP {
99

10+
template<typename TProto>
11+
TString SecureShortDebugString(const TProto& request) {
12+
return request.ShortDebugString();
13+
}
14+
1015
template <typename TGRpcService>
1116
class TLoggedGrpcServiceConnection {
1217
std::unique_ptr<NYdbGrpc::TServiceConnection<TGRpcService>> Connection;
@@ -41,13 +46,13 @@ class TLoggedGrpcServiceConnection {
4146
NYdbGrpc::IQueueClientContextProvider* provider = nullptr)
4247
{
4348
const TString& requestName = request.GetDescriptor()->name();
44-
BLOG_GRPC_D(Prefix() << "Request " << requestName << " " << Trim(request.ShortDebugString()));
49+
BLOG_GRPC_D(Prefix() << "Request " << requestName << " " << Trim(SecureShortDebugString(request)));
4550
NActors::TActorSystem* actorSystem = NActors::TlsActivationContext->ActorSystem();
4651
THPTimer timer;
4752
NYdbGrpc::TResponseCallback<TResponse> cb =
4853
[actorSystem, requestName, host = host, timer = std::move(timer), prefix = Prefix(), callback = std::move(callback)](NYdbGrpc::TGrpcStatus&& status, TResponse&& response) -> void {
4954
if (status.Ok()) {
50-
BLOG_GRPC_DC(*actorSystem, prefix << "Response " << response.GetDescriptor()->name() << " " << Trim(response.ShortDebugString()));
55+
BLOG_GRPC_DC(*actorSystem, prefix << "Response " << response.GetDescriptor()->name() << " " << Trim(SecureShortDebugString(response)));
5156
} else {
5257
BLOG_GRPC_DC(*actorSystem, prefix << "Status " << status.GRpcStatusCode << " " << status.Msg);
5358
}
@@ -73,13 +78,13 @@ class TLoggedGrpcServiceConnection {
7378
NYdbGrpc::IQueueClientContextProvider* provider = nullptr)
7479
{
7580
const TString& requestName = request.GetDescriptor()->name();
76-
BLOG_GRPC_D(Prefix() << "Request " << requestName << " " << Trim(request.ShortDebugString()));
81+
BLOG_GRPC_D(Prefix() << "Request " << requestName << " " << Trim(SecureShortDebugString(request)));
7782
NActors::TActorSystem* actorSystem = NActors::TlsActivationContext->ActorSystem();
7883
THPTimer timer;
7984
NYdbGrpc::TAdvancedResponseCallback<TResponse> cb =
8085
[actorSystem, requestName, host = host, timer = std::move(timer), prefix = Prefix(), callback = std::move(callback)](const grpc::ClientContext& context, NYdbGrpc::TGrpcStatus&& status, TResponse&& response) -> void {
8186
if (status.Ok()) {
82-
BLOG_GRPC_DC(*actorSystem, prefix << "Response " << response.GetDescriptor()->name() << " " << Trim(response.ShortDebugString()));
87+
BLOG_GRPC_DC(*actorSystem, prefix << "Response " << response.GetDescriptor()->name() << " " << Trim(SecureShortDebugString(response)));
8388
} else {
8489
BLOG_GRPC_DC(*actorSystem, prefix << "Status " << status.GRpcStatusCode << " " << status.Msg);
8590
}

‎ydb/mvp/core/mvp_tokens.cpp

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
#include <contrib/libs/jwt-cpp/include/jwt-cpp/jwt.h>
22
#include <ydb/library/actors/http/http_proxy.h>
3+
#include <ydb/library/security/util.h>
34
#include <ydb/mvp/core/core_ydb.h>
45
#include <ydb/public/api/grpc/ydb_auth_v1.grpc.pb.h>
56
#include "mvp_tokens.h"
@@ -299,4 +300,43 @@ void TMvpTokenator::UpdateOAuthToken(const NMvp::TOAuthInfo* oauthInfo) {
299300
TEvPrivate::TEvUpdateIamTokenYandex>(oauthInfo->name(), oauthInfo->endpoint(), request, &yandex::cloud::priv::iam::v1::IamTokenService::Stub::AsyncCreate);
300301
}
301302

303+
template<>
304+
TString SecureShortDebugString(const yandex::cloud::priv::iam::v1::CreateIamTokenRequest& request) {
305+
yandex::cloud::priv::iam::v1::CreateIamTokenRequest copy = request;
306+
switch (copy.identity_case()) {
307+
case yandex::cloud::priv::iam::v1::CreateIamTokenRequest::kYandexPassportOauthToken:
308+
copy.set_yandex_passport_oauth_token(NKikimr::MaskTicket(copy.yandex_passport_oauth_token()));
309+
break;
310+
case yandex::cloud::priv::iam::v1::CreateIamTokenRequest::kJwt:
311+
copy.set_jwt(NKikimr::MaskTicket(copy.jwt()));
312+
break;
313+
case yandex::cloud::priv::iam::v1::CreateIamTokenRequest::kIamCookie:
314+
case yandex::cloud::priv::iam::v1::CreateIamTokenRequest::kYandexPassportCookies:
315+
case yandex::cloud::priv::iam::v1::CreateIamTokenRequest::IDENTITY_NOT_SET:
316+
break;
317+
}
318+
return copy.ShortDebugString();
319+
}
320+
321+
template<>
322+
TString SecureShortDebugString(const yandex::cloud::priv::iam::v1::CreateIamTokenResponse& request) {
323+
yandex::cloud::priv::iam::v1::CreateIamTokenResponse copy = request;
324+
copy.set_iam_token(NKikimr::MaskTicket(copy.iam_token()));
325+
return copy.ShortDebugString();
326+
}
327+
328+
template<>
329+
TString SecureShortDebugString(const nebius::iam::v1::ExchangeTokenRequest& request) {
330+
nebius::iam::v1::ExchangeTokenRequest copy = request;
331+
copy.set_subject_token(NKikimr::MaskTicket(copy.subject_token()));
332+
return copy.ShortDebugString();
333+
}
334+
335+
template<>
336+
TString SecureShortDebugString(const nebius::iam::v1::CreateTokenResponse& request) {
337+
nebius::iam::v1::CreateTokenResponse copy = request;
338+
copy.set_access_token(NKikimr::MaskTicket(copy.access_token()));
339+
return copy.ShortDebugString();
340+
}
341+
302342
}

‎ydb/mvp/core/ya.make

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ PEERDIR(
5353
ydb/library/actors/core
5454
ydb/library/actors/http
5555
ydb/library/actors/protos
56+
ydb/library/security
5657
library/cpp/lwtrace/protos
5758
library/cpp/lfalloc/alloc_profiler
5859
ydb/core/viewer/json

‎ydb/mvp/oidc_proxy/oidc_protected_page_yandex.cpp

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
#include <ydb/library/actors/http/http.h>
2+
#include <ydb/library/security/util.h>
23
#include <ydb/mvp/core/mvp_tokens.h>
34
#include <ydb/mvp/core/appdata.h>
45
#include <ydb/mvp/core/mvp_log.h>
@@ -85,4 +86,19 @@ bool THandlerSessionServiceCheckYandex::NeedSendSecureHttpRequest(const NHttp::T
8586
}
8687

8788
} // NOIDC
89+
90+
template<>
91+
TString SecureShortDebugString(const yandex::cloud::priv::oauth::v1::CheckSessionRequest& request) {
92+
yandex::cloud::priv::oauth::v1::CheckSessionRequest copy = request;
93+
copy.clear_cookie_header();
94+
return copy.ShortDebugString();
95+
}
96+
97+
template<>
98+
TString SecureShortDebugString(const yandex::cloud::priv::oauth::v1::CheckSessionResponse& request) {
99+
yandex::cloud::priv::oauth::v1::CheckSessionResponse copy = request;
100+
copy.mutable_iam_token()->set_iam_token(NKikimr::MaskTicket(copy.iam_token().iam_token()));
101+
return copy.ShortDebugString();
102+
}
103+
88104
} // NMVP

‎ydb/mvp/oidc_proxy/oidc_session_create_yandex.cpp

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
#include <ydb/library/actors/http/http.h>
22
#include <ydb/library/grpc/client/grpc_client_low.h>
3+
#include <ydb/library/security/util.h>
34
#include <ydb/mvp/core/mvp_tokens.h>
45
#include <ydb/mvp/core/appdata.h>
56
#include <ydb/mvp/core/mvp_log.h>
@@ -79,4 +80,19 @@ void THandlerSessionCreateYandex::HandleError(TEvPrivate::TEvErrorResponse::TPtr
7980
}
8081

8182
} // NOIDC
83+
84+
template<>
85+
TString SecureShortDebugString(const yandex::cloud::priv::oauth::v1::CreateSessionRequest& request) {
86+
yandex::cloud::priv::oauth::v1::CreateSessionRequest copy = request;
87+
copy.set_access_token(NKikimr::MaskTicket(copy.access_token()));
88+
return copy.ShortDebugString();
89+
}
90+
91+
template<>
92+
TString SecureShortDebugString(const yandex::cloud::priv::oauth::v1::CreateSessionResponse& request) {
93+
yandex::cloud::priv::oauth::v1::CreateSessionResponse copy = request;
94+
copy.clear_set_cookie_header();
95+
return copy.ShortDebugString();
96+
}
97+
8298
} // NMVP

0 commit comments

Comments
 (0)