daemon: record the author of each configuration transaction

The rollback log said what changed and when, but not who made the
change, so the identities the northbound authenticates were used to
admit a request and then discarded.

Record an author alongside each transaction and return it from
ListTransactions. A commit arriving over a Unix socket is attributed
to the peer's user, taken from the socket credentials rather than
from anything the client sends, while a remote one is attributed to
the user it authenticated as, qualified by the address it came from.

Signed-off-by: Renato Westphal <renatowestphal@gmail.com>

Author: rwestphal

holo-daemon/src/northbound/client/api.rs

@@ -74,6 +74,7 @@ pub mod client {
     #[derive(Debug)]
     pub struct CommitRequest {
         pub config: CommitConfiguration,
+        pub author: String,
         pub comment: String,
         pub confirmed_timeout: u32,
         pub responder: Responder<Result<CommitResponse>>,

holo-daemon/src/northbound/client/gnmi.rs

@@ -174,6 +174,7 @@ impl proto::GNmi for GNmiService {
         grpc_request: Request<proto::SetRequest>,
     ) -> Result<Response<proto::SetResponse>, Status> {
         let yang_ctx = YANG_CTX.get().unwrap();
+        let author = grpc::request_author(&grpc_request);
         let grpc_request = grpc_request.into_inner();
         trace_span!("northbound").in_scope(|| {
             trace_span!("client", name = "gnmi").in_scope(|| {
@@ -235,6 +236,7 @@ impl proto::GNmi for GNmiService {
         // Convert and relay gNMI request to the northbound.
         let nb_request = api::client::CommitRequest {
             config: api::CommitConfiguration::Replace(candidate),
+            author,
             comment: Default::default(),
             confirmed_timeout: 0,
             responder: responder_tx,

holo-daemon/src/northbound/client/grpc.rs

@@ -17,13 +17,14 @@ use holo_utils::auth::Users;
 use holo_utils::task::Task;
 use holo_yang::{YANG_CTX, YANG_FEATURES};
 use nix::sys::stat::{Mode, fchmod};
+use nix::unistd::{Uid, User};
 use tokio::net::UnixListener;
 use tokio::sync::mpsc::Sender;
 use tokio::sync::{mpsc, oneshot, watch};
 use tokio_stream::wrappers::{UnboundedReceiverStream, UnixListenerStream};
 use tonic::metadata::MetadataMap;
 use tonic::service::interceptor::InterceptedService;
-use tonic::transport::server::Router;
+use tonic::transport::server::{Router, UdsConnectInfo};
 use tonic::transport::{Identity, Server, ServerTlsConfig};
 use tonic::{Request, Response, Status};
 use tracing::{trace, trace_span};
@@ -53,6 +54,10 @@ pub(crate) struct Authenticator {
     unix: bool,
 }
 
+// User name a request was authenticated with.
+#[derive(Clone, Debug)]
+struct AuthenticatedUser(String);
+
 // Where a server accepts connections.
 #[derive(Debug)]
 pub(crate) enum Listener {
@@ -298,6 +303,7 @@ impl proto::Northbound for NorthboundService {
         &self,
         grpc_request: Request<proto::CommitRequest>,
     ) -> Result<Response<proto::CommitResponse>, Status> {
+        let author = request_author(&grpc_request);
         let grpc_request = grpc_request.into_inner();
         trace_span!("northbound").in_scope(|| {
             trace_span!("client", name = "grpc").in_scope(|| {
@@ -335,6 +341,7 @@ impl proto::Northbound for NorthboundService {
         let nb_request =
             api::client::Request::Commit(api::client::CommitRequest {
                 config,
+                author,
                 comment: grpc_request.comment,
                 confirmed_timeout: grpc_request.confirmed_timeout,
                 responder: responder_tx,
@@ -426,8 +433,9 @@ impl proto::Northbound for NorthboundService {
             nb_response.transactions.into_iter().map(|transaction| {
                 Ok(proto::ListTransactionsResponse {
                     id: transaction.id,
-                    comment: transaction.comment,
                     date: transaction.date.to_string(),
+                    author: transaction.author,
+                    comment: transaction.comment,
                 })
             });
 
@@ -534,19 +542,24 @@ impl Authenticator {
     // user.
     pub(crate) fn intercept(
         &self,
-        request: Request<()>,
+        mut request: Request<()>,
     ) -> Result<Request<()>, Status> {
-        self.authenticate(request.metadata())?;
+        if let Some(user) = self.authenticate(request.metadata())? {
+            request.extensions_mut().insert(AuthenticatedUser(user));
+        }
 
         Ok(request)
     }
 
-    fn authenticate(&self, metadata: &MetadataMap) -> Result<(), Status> {
+    fn authenticate(
+        &self,
+        metadata: &MetadataMap,
+    ) -> Result<Option<String>, Status> {
         // The socket's file permissions already decide who may connect, and
         // the peer's identity comes from the kernel, so no password is asked
         // for.
         if self.unix {
-            return Ok(());
+            return Ok(None);
         }
 
         let Some((username, password)) = credentials(metadata) else {
@@ -563,7 +576,7 @@ impl Authenticator {
             return Err(Status::unauthenticated("invalid credentials"));
         }
 
-        Ok(())
+        Ok(Some(username.to_owned()))
     }
 }
 
@@ -812,6 +825,40 @@ fn unix_listener(path: &FsPath) -> std::io::Result<UnixListenerStream> {
 
 // ===== global functions =====
 
+// Identifies who issued a request.
+//
+// A Unix socket carries the peer's credentials, so its user comes from the
+// kernel and is prefixed with "unix:". A remote request is attributed to the
+// user it authenticated as, qualified by the address it came from.
+pub(crate) fn request_author<T>(request: &Request<T>) -> String {
+    const UNKNOWN: &str = "unknown";
+
+    if let Some(info) = request.extensions().get::<UdsConnectInfo>() {
+        let user = match info.peer_cred {
+            Some(cred) => {
+                let uid = Uid::from_raw(cred.uid());
+                User::from_uid(uid)
+                    .ok()
+                    .flatten()
+                    .map(|user| user.name)
+                    .unwrap_or_else(|| format!("uid:{uid}"))
+            }
+            None => UNKNOWN.to_owned(),
+        };
+        return format!("unix:{user}");
+    }
+
+    let user = request
+        .extensions()
+        .get::<AuthenticatedUser>()
+        .map(|user| user.0.as_str())
+        .unwrap_or(UNKNOWN);
+    match request.remote_addr() {
+        Some(address) => format!("{user}@{}", address.ip()),
+        None => user.to_owned(),
+    }
+}
+
 // Sets up the listener and the server for the given address.
 //
 // An address starting with a slash is taken as the path of a Unix socket,

holo-daemon/src/northbound/core.rs

@@ -76,6 +76,9 @@ pub struct Transaction {
     #[serde(with = "chrono::serde::ts_seconds")]
     pub date: DateTime<Utc>,
 
+    // User that committed the transaction.
+    pub author: String,
+
     // Optional comment for the transaction.
     pub comment: String,
 
@@ -199,6 +202,7 @@ impl Northbound {
                 let response = self
                     .process_client_commit(
                         request.config,
+                        request.author,
                         request.comment,
                         request.confirmed_timeout,
                     )
@@ -270,6 +274,7 @@ impl Northbound {
     async fn process_client_commit(
         &mut self,
         config: capi::CommitConfiguration,
+        author: String,
         comment: String,
         confirmed_timeout: u32,
     ) -> Result<capi::client::CommitResponse> {
@@ -296,7 +301,7 @@ impl Northbound {
 
         // Create configuration transaction.
         let transaction_id = self
-            .create_transaction(candidate, comment, confirmed_timeout)
+            .create_transaction(candidate, author, comment, confirmed_timeout)
             .await?;
         Ok(capi::client::CommitResponse { transaction_id })
     }
@@ -375,7 +380,12 @@ impl Northbound {
         let comment = "Confirmed commit rollback".to_owned();
         let rollback = self.confirmed_commit.rollback.take().unwrap();
         if let Err(error) = self
-            .create_transaction(rollback.configuration, comment, 0)
+            .create_transaction(
+                rollback.configuration,
+                String::new(),
+                comment,
+                0,
+            )
             .await
         {
             error!(%error, "failed to rollback to previous configuration");
@@ -390,6 +400,7 @@ impl Northbound {
     async fn create_transaction(
         &mut self,
         candidate: DataTree<'static>,
+        author: String,
         comment: String,
         confirmed_timeout: u32,
     ) -> Result<u32> {
@@ -461,7 +472,7 @@ impl Northbound {
                 // Create transaction structure.
                 let candidate = Arc::try_unwrap(candidate).unwrap();
                 let mut transaction =
-                    Transaction::new(Utc::now(), comment, candidate);
+                    Transaction::new(Utc::now(), author, comment, candidate);
 
                 // Record transaction.
                 let mut db = self.db.lock().unwrap();

proto/holo.proto

@@ -244,8 +244,11 @@ message ListTransactionsResponse {
   // Date and time the transaction was committed.
   string date = 2;
 
+  // User that committed the transaction.
+  string author = 3;
+
   // Comment assigned to the transaction.
-  string comment = 3;
+  string comment = 4;
 }
 
 //