Skip to content

Commit 466eb55

Browse files
UgnineSirdisUgnineSirdis
authored
Merge db255d7 into 7672737 
2 parents 7672737 + db255d7 commit 466eb55

File tree

16 files changed

+221
-29
lines changed

16 files changed

+221
-29
lines changed

‎ydb/apps/dstool/lib/common.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ def add_host_access_options(self, parser, with_endpoint=True):
159159
g.add_argument('--mon-port', type=int, default=8765, metavar='PORT', help='HTTP monitoring port for viewer JSON access')
160160
g.add_argument('--mon-protocol', type=str, metavar='PROTOCOL', choices=('http', 'https'), help='HTTP monitoring protocol for viewer JSON access')
161161
g.add_argument('--token-file', type=FileType(encoding='ascii'), metavar='PATH', help='Path to token file')
162-
g.add_argument('--ca-file', metavar='PATH', dest='cafile', type=str, help='Path to a file containing the PEM encoding of the server root certificates for tls connections.')
162+
g.add_argument('--ca-file', metavar='PATH', dest='cafile', type=str, help='Path to a file containing PEM encoded root certificates for TLS connections.')
163163
g.add_argument('--http', action='store_true', help='Use HTTP to connect to blob storage controller instead of GRPC')
164164
g.add_argument('--http-timeout', type=int, default=5, help='Timeout for blocking socket I/O operations during HTTP(s) queries')
165165
g.add_argument('--insecure', action='store_true', help='Allow insecure HTTPS fetching')

‎ydb/core/driver_lib/cli_base/cli_cmds_db.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -831,6 +831,8 @@ class TClientCommandSchemaTableOptions : public TClientCommand {
831831
ClientConfig.MaxInFlight = CommandConfig.ClientConfig.MaxInFlight;
832832
ClientConfig.EnableSsl = CommandConfig.ClientConfig.EnableSsl;
833833
ClientConfig.SslCredentials.pem_root_certs = CommandConfig.ClientConfig.SslCredentials.pem_root_certs;
834+
ClientConfig.SslCredentials.pem_cert_chain = CommandConfig.ClientConfig.SslCredentials.pem_cert_chain;
835+
ClientConfig.SslCredentials.pem_private_key = CommandConfig.ClientConfig.SslCredentials.pem_private_key;
834836
}
835837

836838
template<typename T>

‎ydb/core/driver_lib/cli_base/cli_cmds_root.cpp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,7 @@ class TClientCommandRootLite : public TClientCommandRootKikimrBase {
184184
throw TMisuseException() << message;
185185
}
186186
ParseCaCerts(config);
187+
ParseClientCert(config);
187188
config.Address = Address;
188189

189190
if (!hostname) {
@@ -193,6 +194,10 @@ class TClientCommandRootLite : public TClientCommandRootKikimrBase {
193194
if (config.EnableSsl) {
194195
CommandConfig.ClientConfig.EnableSsl = config.EnableSsl;
195196
CommandConfig.ClientConfig.SslCredentials.pem_root_certs = config.CaCerts;
197+
if (config.ClientCert) {
198+
CommandConfig.ClientConfig.SslCredentials.pem_cert_chain = config.ClientCert;
199+
CommandConfig.ClientConfig.SslCredentials.pem_private_key = config.ClientCertPrivateKey;
200+
}
196201
}
197202
}
198203

‎ydb/core/driver_lib/cli_base/cli_grpc.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,8 @@ class TClientGRpcCommand : public TClientCommand {
9494
ClientConfig.MaxInFlight = CommandConfig.ClientConfig.MaxInFlight;
9595
ClientConfig.EnableSsl = CommandConfig.ClientConfig.EnableSsl;
9696
ClientConfig.SslCredentials.pem_root_certs = CommandConfig.ClientConfig.SslCredentials.pem_root_certs;
97+
ClientConfig.SslCredentials.pem_cert_chain = CommandConfig.ClientConfig.SslCredentials.pem_cert_chain;
98+
ClientConfig.SslCredentials.pem_private_key = CommandConfig.ClientConfig.SslCredentials.pem_private_key;
9799
}
98100

99101
static int PrepareConfigCredentials(NGRpcProxy::TGRpcClientConfig clientConfig, TConfig& commandConfig) {
@@ -159,4 +161,3 @@ class TClientGRpcCommand : public TClientCommand {
159161

160162
}
161163
}
162-

‎ydb/core/driver_lib/cli_utils/cli_cmds_root.cpp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,16 @@ class TClientCommandRoot : public TClientCommandRootKikimrBase {
5656
config.EnableSsl = endpoint.EnableSsl.GetRef();
5757
}
5858
ParseCaCerts(config);
59+
ParseClientCert(config);
5960

6061
CommandConfig.ClientConfig = NYdbGrpc::TGRpcClientConfig(endpoint.Address);
6162
if (config.EnableSsl) {
6263
CommandConfig.ClientConfig.EnableSsl = config.EnableSsl;
6364
CommandConfig.ClientConfig.SslCredentials.pem_root_certs = config.CaCerts;
65+
if (config.ClientCert) {
66+
CommandConfig.ClientConfig.SslCredentials.pem_cert_chain = config.ClientCert;
67+
CommandConfig.ClientConfig.SslCredentials.pem_private_key = config.ClientCertPrivateKey;
68+
}
6469
}
6570
}
6671
};

‎ydb/core/driver_lib/cli_utils/cli_cmds_tenant.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,8 @@ class TTenantClientGRpcCommand : public TTenantClientCommand {
142142
ClientConfig.MaxInFlight = CommandConfig.ClientConfig.MaxInFlight;
143143
ClientConfig.EnableSsl = CommandConfig.ClientConfig.EnableSsl;
144144
ClientConfig.SslCredentials.pem_root_certs = CommandConfig.ClientConfig.SslCredentials.pem_root_certs;
145+
ClientConfig.SslCredentials.pem_cert_chain = CommandConfig.ClientConfig.SslCredentials.pem_cert_chain;
146+
ClientConfig.SslCredentials.pem_private_key = CommandConfig.ClientConfig.SslCredentials.pem_private_key;
145147
}
146148

147149
int Run(TConfig &config) override

‎ydb/core/driver_lib/run/main.cpp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,9 @@ int MainRun(const TKikimrRunConfig& runConfig, std::shared_ptr<TModuleFactories>
8989
configParser.SetupGlobalOpts(opts);
9090
NMsgBusProxy::TMsgBusClientConfig mbusConfig;
9191
mbusConfig.ConfigureLastGetopt(opts, "mb-");
92-
opts.AddLongOption("ca-file", "Path to a file containing the PEM encoding of the server root certificates for tls connections.\n").RequiredArgument("PATH");
92+
opts.AddLongOption("ca-file", "Path to a file containing PEM encoded root certificates for TLS connections.\n").RequiredArgument("PATH");
93+
opts.AddLongOption("client-cert-file", "Path to a file containing PEM encoded client certificate for TLS connections.\n").RequiredArgument("PATH");
94+
opts.AddLongOption("client-cert-key-file", "Path to a file containing PEM encoded client certificate private key for TLS connections.\n").RequiredArgument("PATH");
9395
NDriverClient::HideOptions(opts);
9496
opts.AddLongOption('s', "server", "Server address to connect (default $KIKIMR_SERVER)").RequiredArgument("ADDR[:NUM]");
9597
opts.AddLongOption('k', "token", "Security token").RequiredArgument("TOKEN");
@@ -205,4 +207,3 @@ int ParameterizedMain(int argc, char **argv, std::shared_ptr<NKikimr::TModuleFac
205207
return 1;
206208
}
207209
}
208-

‎ydb/public/lib/ydb_cli/commands/ydb_command.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ TDriverConfig TYdbCommand::CreateDriverConfig(const TConfig& config) {
1818
driverConfig.UseSecureConnection(config.CaCerts);
1919
if (config.IsNetworkIntensive)
2020
driverConfig.SetNetworkThreadsNum(16);
21+
driverConfig.UseClientCertificate(config.ClientCert, config.ClientCertPrivateKey);
2122

2223
return driverConfig;
2324
}

‎ydb/public/lib/ydb_cli/commands/ydb_profile.cpp

Lines changed: 71 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,12 @@ namespace {
244244
if (profile->Has("ca-file")) {
245245
Cout << " ca-file: " << profile->GetValue("ca-file").as<TString>() << Endl;
246246
}
247+
if (profile->Has("client-cert-file")) {
248+
Cout << " client-cert-file: " << profile->GetValue("client-cert-file").as<TString>() << Endl;
249+
}
250+
if (profile->Has("client-cert-key-file")) {
251+
Cout << " client-cert-key-file: " << profile->GetValue("client-cert-key-file").as<TString>() << Endl;
252+
}
247253
}
248254
}
249255

@@ -307,6 +313,10 @@ void TCommandConnectionInfo::PrintInfo(TConfig& config) {
307313
if (config.CaCertsFile) {
308314
Cout << "ca-file: " << config.CaCertsFile << Endl;
309315
}
316+
if (config.ClientCertFile) {
317+
Cout << "client-cert-file: " << config.ClientCertFile << Endl;
318+
Cout << "client-cert-key-file: " << config.ClientCertPrivateKeyFile << Endl;
319+
}
310320
}
311321

312322
void TCommandConnectionInfo::PrintVerboseInfo(TConfig& config) {
@@ -382,7 +392,9 @@ void TCommandProfileCommon::GetOptionsFromStdin() {
382392
{"user", User},
383393
{"password-file", PasswordFile},
384394
{"iam-endpoint", IamEndpoint},
385-
{"ca-file", CaCertsFile}
395+
{"ca-file", CaCertsFile},
396+
{"client-cert-file", ClientCertFile},
397+
{"client-cert-key-file", ClientCertPrivateKeyFile},
386398
};
387399
while (Cin.ReadLine(line)) {
388400
Strip(line, trimmedLine);
@@ -432,6 +444,12 @@ void TCommandProfileCommon::ConfigureProfile(const TString& profileName, std::sh
432444
if (cmdLine && CaCertsFile) {
433445
profile->SetValue("ca-file", CaCertsFile);
434446
}
447+
if (cmdLine && ClientCertFile) {
448+
profile->SetValue("client-cert-file", ClientCertFile);
449+
}
450+
if (cmdLine && ClientCertPrivateKeyFile) {
451+
profile->SetValue("client-cert-key-file", ClientCertPrivateKeyFile);
452+
}
435453

436454
if (interactive) {
437455
TString activeProfileName = profileManager->GetActiveProfileName();
@@ -669,11 +687,22 @@ void TCommandProfileCommon::ValidateAuth() {
669687
}
670688
}
671689

690+
void TCommandProfileCommon::ValidateClientCert() {
691+
if (ClientCertFile.empty() && ClientCertPrivateKeyFile.empty()) {
692+
return;
693+
}
694+
if (ClientCertFile.empty() || ClientCertPrivateKeyFile.empty()) { // One option is set, another is not set
695+
throw TMisuseException()
696+
<< "Both \"client-cert-file\" and \"client-cert-key-file\" options must be provided.";
697+
}
698+
}
699+
672700
bool TCommandProfileCommon::AnyProfileOptionInCommandLine() {
673701
return Endpoint || Database || TokenFile || Oauth2KeyFile ||
674702
IamTokenFile || YcTokenFile ||
675703
SaKeyFile || UseMetadataCredentials || User ||
676-
PasswordFile || IamEndpoint || AnonymousAuth || CaCertsFile;
704+
PasswordFile || IamEndpoint || AnonymousAuth || CaCertsFile ||
705+
ClientCertFile || ClientCertPrivateKeyFile;
677706
}
678707

679708
TCommandCreateProfile::TCommandCreateProfile()
@@ -711,8 +740,14 @@ void TCommandProfileCommon::Config(TConfig& config) {
711740
.RequiredArgument("STR").StoreResult(&IamEndpoint);
712741
}
713742
opts.AddLongOption("ca-file",
714-
"Path to a file containing the PEM encoding of the server root certificates for tls connections.")
743+
"Path to a file containing PEM encoded root certificates for TLS connections.")
715744
.RequiredArgument("PATH").StoreResult(&CaCertsFile);
745+
opts.AddLongOption("client-cert-file",
746+
"Path to a file containing PEM encoded client certificate for TLS connections")
747+
.RequiredArgument("PATH").StoreResult(&ClientCertFile);
748+
opts.AddLongOption("client-cert-key-file",
749+
"Path to a file containing PEM encoded client certificate private key for TLS connections")
750+
.RequiredArgument("PATH").StoreResult(&ClientCertPrivateKeyFile);
716751
if (!IsStdinInteractive()) {
717752
GetOptionsFromStdin();
718753
}
@@ -721,6 +756,7 @@ void TCommandProfileCommon::Config(TConfig& config) {
721756
void TCommandProfileCommon::Parse(TConfig& config) {
722757
TClientCommand::Parse(config);
723758
ValidateAuth();
759+
ValidateClientCert();
724760
}
725761

726762
void TCommandCreateProfile::Config(TConfig& config) {
@@ -1064,8 +1100,12 @@ void TCommandUpdateProfile::Config(TConfig& config) {
10641100
if (config.UseIamAuth) {
10651101
opts.AddLongOption("no-iam-endpoint", "Delete endpoint of IAM service from the profile").StoreTrue(&NoIamEndpoint);
10661102
}
1067-
opts.AddLongOption("no-ca-file", "Delete path to file containing the PEM encoding of the "
1068-
"server root certificates for tls connections from the profile").StoreTrue(&NoCaCertsFile);
1103+
opts.AddLongOption("no-ca-file", "Delete path to file containing PEM encoded "
1104+
"server root certificates for TLS connections from the profile").StoreTrue(&NoCaCertsFile);
1105+
opts.AddLongOption("no-client-cert-file", "Delete path to a file containing PEM encoded "
1106+
"client certificate for TLS connections").StoreTrue(&NoClientCertFile);
1107+
opts.AddLongOption("no-client-cert-key-file", "Delete path to a file containing PEM encoded "
1108+
"client certificate private key for TLS connections").StoreTrue(&NoClientCertPrivateKeyFile);
10691109
}
10701110

10711111
void TCommandUpdateProfile::ValidateNoOptions() {
@@ -1082,22 +1122,30 @@ void TCommandUpdateProfile::ValidateNoOptions() {
10821122
TStringBuilder str;
10831123
if (Endpoint && NoEndpoint) {
10841124
str << "\"--endpoint\" and \"--no-endpoint\"";
1085-
} else {
1086-
if (Database && NoDatabase) {
1087-
str << "\"--database and \"--no-database\"";
1088-
} else {
1089-
if (IamEndpoint && NoIamEndpoint) {
1090-
str << "\"--iam-endpoint\" and \"--no-iam-endpoint\"";
1091-
} else {
1092-
if (CaCertsFile && NoCaCertsFile) {
1093-
str << "\"--ca-file\" and \"--no-ca-file\"";
1094-
}
1095-
}
1096-
}
10971125
}
1126+
if (!str && Database && NoDatabase) {
1127+
str << "\"--database and \"--no-database\"";
1128+
}
1129+
if (!str && IamEndpoint && NoIamEndpoint) {
1130+
str << "\"--iam-endpoint\" and \"--no-iam-endpoint\"";
1131+
}
1132+
if (!str && CaCertsFile && NoCaCertsFile) {
1133+
str << "\"--ca-file\" and \"--no-ca-file\"";
1134+
}
1135+
if (!str && ClientCertFile && NoClientCertFile) {
1136+
str << "\"--client-cert-file\" and \"--no-client-cert-file\"";
1137+
}
1138+
if (!str && ClientCertPrivateKeyFile && NoClientCertPrivateKeyFile) {
1139+
str << "\"--client-cert-key-file\" and \"--no-client-cert-key-file\"";
1140+
}
1141+
10981142
if (!str.empty()) {
10991143
throw TMisuseException() << "Options " << str << " are mutually exclusive";
11001144
}
1145+
1146+
if (NoClientCertFile && !NoClientCertPrivateKeyFile || !NoClientCertFile && NoClientCertPrivateKeyFile) {
1147+
throw TMisuseException() << "Options \"--no-client-cert-file\" and \"--no-client-cert-key-file\" must be both set or unset";
1148+
}
11011149
}
11021150

11031151
void TCommandUpdateProfile::DropNoOptions(std::shared_ptr<IProfile> profile) {
@@ -1116,6 +1164,12 @@ void TCommandUpdateProfile::DropNoOptions(std::shared_ptr<IProfile> profile) {
11161164
if (NoCaCertsFile) {
11171165
profile->RemoveValue("ca-file");
11181166
}
1167+
if (NoClientCertFile) {
1168+
profile->RemoveValue("client-cert-file");
1169+
}
1170+
if (NoClientCertPrivateKeyFile) {
1171+
profile->RemoveValue("client-cert-key-file");
1172+
}
11191173
}
11201174

11211175
void TCommandUpdateProfile::Parse(TConfig& config) {

‎ydb/public/lib/ydb_cli/commands/ydb_profile.h

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,13 @@ class TCommandProfileCommon : public TClientCommand {
3838

3939
protected:
4040
void ValidateAuth();
41+
void ValidateClientCert();
4142
bool AnyProfileOptionInCommandLine();
4243
void ConfigureProfile(const TString& profileName, std::shared_ptr<IProfileManager> profileManager,
4344
TConfig& config, bool interactive, bool cmdLine);
4445

4546
TString ProfileName, Endpoint, Database, TokenFile, Oauth2KeyFile, YcTokenFile, SaKeyFile,
46-
IamTokenFile, IamEndpoint, User, PasswordFile, CaCertsFile;
47+
IamTokenFile, IamEndpoint, User, PasswordFile, CaCertsFile, ClientCertFile, ClientCertPrivateKeyFile;
4748

4849
bool UseMetadataCredentials = false;
4950
bool AnonymousAuth = false;
@@ -141,6 +142,8 @@ class TCommandUpdateProfile : public TCommandProfileCommon {
141142
bool NoAuth = false;
142143
bool NoIamEndpoint = false;
143144
bool NoCaCertsFile = false;
145+
bool NoClientCertFile = false;
146+
bool NoClientCertPrivateKeyFile = false;
144147
};
145148

146149
class TCommandReplaceProfile : public TCommandProfileCommon {

0 commit comments

Comments
 (0)