materialize icon indicating copy to clipboard operation
materialize copied to clipboard

Add peer ip to session

Open jubrad opened this issue 1 year ago • 0 comments

Updates pgwire, http, and ws connections to pass through the peer ip and stuff it into the new sessions.

Motivation

Pre work for #23498

Currently we store and report sessions in mz_sessions table. This includes data about when the session was created and the session role, but we don't pass through the IPs of that session. For audit reasons it seems like it be useful to pass this through. There are a few challenges, one being that with the balacner or a proxy in front the actual peer ip may not always be valueable to know. We also need to check X_FORWARD_FOR headers for http, and similarly, we need to inject an X_FORWARD_FOR param for all connections that go through the balancers (this might not work if balancers can't inject an X_FORWARD_FOR in http traffic) .

So far I have only handled the base case that we trust the peer id, the headers/params still need taken into consideration. They will end up overriding the peer_ip.

Tips for reviewer

Checklist

  • [ ] This PR has adequate test coverage / QA involvement has been duly considered. (trigger-ci for additional test/nightly runs)
  • [ ] This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
  • [ ] If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
  • [ ] If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).
  • [ ] If this PR includes major user-facing behavior changes, I have pinged the relevant PM to schedule a changelog post.

jubrad avatar Aug 22 '24 15:08 jubrad