Merge 5d87754 into 577cec9

VERSION

@@ -1 +1 @@
-0.7.3-dev
+0.7.3

cmd/onos-config/onos-config.go

@@ -63,6 +63,9 @@ import (
 	"github.com/onosproject/onos-lib-go/pkg/northbound"
 )
 
+// OIDCServerURL - address of an OpenID Connect server
+const OIDCServerURL = "OIDC_SERVER_URL"
+
 type arrayFlags []string
 
 func (i *arrayFlags) String() string {
@@ -185,15 +188,28 @@ func main() {
 	}
 
 	mgr.Run()
-	err = startServer(*caPath, *keyPath, *certPath)
+	authorization := false
+	if oidcURL := os.Getenv(OIDCServerURL); oidcURL != "" {
+		authorization = true
+		log.Infof("Authorization enabled. %s=%s", OIDCServerURL, oidcURL)
+		// OIDCServerURL is also referenced in jwt.go (from onos-lib-go)
+	} else {
+		log.Infof("Authorization not enabled %s", os.Getenv(OIDCServerURL))
+	}
+
+	err = startServer(*caPath, *keyPath, *certPath, authorization)
 	if err != nil {
 		log.Fatal("Unable to start onos-config ", err)
 	}
 }
 
 // Creates gRPC server and registers various services; then serves.
-func startServer(caPath string, keyPath string, certPath string) error {
-	s := northbound.NewServer(northbound.NewServerCfg(caPath, keyPath, certPath, 5150, true, northbound.SecurityConfig{}))
+func startServer(caPath string, keyPath string, certPath string, authorization bool) error {
+	s := northbound.NewServer(northbound.NewServerCfg(caPath, keyPath, certPath, 5150, true,
+		northbound.SecurityConfig{
+			AuthenticationEnabled: authorization,
+			AuthorizationEnabled:  authorization,
+		}))
 	s.AddService(admin.Service{})
 	s.AddService(diags.Service{})
 	s.AddService(gnmi.Service{})

go.mod

@@ -3,40 +3,36 @@ module github.com/onosproject/onos-config
 go 1.14
 
 require (
-	cloud.google.com/go v0.43.0 // indirect
 	github.com/Pallinder/go-randomdata v1.2.0
 	github.com/atomix/go-client v0.4.1
 	github.com/cenkalti/backoff v2.2.1+incompatible
 	github.com/docker/docker v1.13.1 // indirect
 	github.com/gogo/protobuf v1.3.1
 	github.com/golang/mock v1.4.4
 	github.com/golang/protobuf v1.4.3
-	github.com/google/pprof v0.0.0-20190723021845-34ac40c74b70 // indirect
 	github.com/google/uuid v1.1.2
 	github.com/googleapis/gnostic v0.3.0 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
-	github.com/kr/pty v1.1.8 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware v1.2.0
 	github.com/mattn/go-colorable v0.1.4 // indirect
 	github.com/mattn/go-isatty v0.0.12 // indirect
 	github.com/onosproject/config-models/modelplugin/devicesim-1.0.0 v0.0.0-20201130213019-492043aed0df
 	github.com/onosproject/config-models/modelplugin/testdevice-1.0.0 v0.0.0-20201130213019-492043aed0df
 	github.com/onosproject/config-models/modelplugin/testdevice-2.0.0 v0.0.0-20201130213019-492043aed0df
 	github.com/onosproject/helmit v0.6.8
 	github.com/onosproject/onos-api/go v0.7.2
-	github.com/onosproject/onos-lib-go v0.7.0
+	github.com/onosproject/onos-lib-go v0.7.2
 	github.com/onosproject/onos-test v0.6.4
 	github.com/openconfig/gnmi v0.0.0-20200617225440-d2b4e6a45802
 	github.com/openconfig/goyang v0.2.1
 	github.com/openconfig/ygot v0.8.12
 	github.com/pelletier/go-toml v1.4.0 // indirect
 	github.com/pkg/errors v0.9.1
 	github.com/smartystreets/assertions v1.0.0 // indirect
-	github.com/spf13/cobra v0.0.6
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/viper v1.6.2
+	github.com/spf13/viper v1.6.2 // indirect
 	github.com/stretchr/testify v1.5.1
 	go.uber.org/multierr v1.4.0 // indirect
-	golang.org/x/mobile v0.0.0-20190806162312-597adff16ade // indirect
 	golang.org/x/tools v0.0.0-20200522201501-cb1345f3a375 // indirect
 	google.golang.org/grpc v1.33.2
 	gopkg.in/yaml.v2 v2.2.8

go.sum

@@ -541,8 +541,8 @@ github.com/onosproject/helmit v0.6.8 h1:f/DjOzQp/NFzbTClM7qn4WwQ5DgR/13OD1FWJ4Vx
 github.com/onosproject/helmit v0.6.8/go.mod h1:EorNGSNGWojXGxBEuiNmPScae+R2C5WYfg/13gKEPLw=
 github.com/onosproject/onos-api/go v0.7.2 h1:MduxbuoAYFYT5BhQZ/eqpIz4ZKJRIedog1y0qbDnMgY=
 github.com/onosproject/onos-api/go v0.7.2/go.mod h1:HLfWE9aouIeOmi4soR6bxK2cZ33NbnFMvdyv9fmjaSg=
-github.com/onosproject/onos-lib-go v0.7.0 h1:+BxQc0K4nej8qsciArvk6QC3Do6VKQevbIegpR3Kil8=
-github.com/onosproject/onos-lib-go v0.7.0/go.mod h1:ttkK+fV2CULZFHiq6FBZ69i7/Nymi1Wow1DNy0Ik/2o=
+github.com/onosproject/onos-lib-go v0.7.2 h1:uqCYVfK0ZTO/CAGZ9Di1C2EMQVHvnuD8MOqSjVOQDss=
+github.com/onosproject/onos-lib-go v0.7.2/go.mod h1:ttkK+fV2CULZFHiq6FBZ69i7/Nymi1Wow1DNy0Ik/2o=
 github.com/onosproject/onos-test v0.6.4 h1:ocJhMv5mZ5RsojkhBUadE68Q6uSgBZpyDDjnwOPmu6g=
 github.com/onosproject/onos-test v0.6.4/go.mod h1:Ugb1OKR2bJhZjqpSMm9F5o6Ma2iwbtswhSlNyXXPgrg=
 github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=

pkg/northbound/admin/admin.go

@@ -18,6 +18,7 @@ package admin
 import (
 	"context"
 	"fmt"
+	"github.com/grpc-ecosystem/go-grpc-middleware/util/metautils"
 	"io"
 	"os"
 	"strings"
@@ -55,7 +56,14 @@ type Server struct {
 }
 
 // UploadRegisterModel uploads and registers a new model plugin.
+// Deprecated: models should only be loaded at startup
 func (s Server) UploadRegisterModel(stream admin.ConfigAdminService_UploadRegisterModelServer) error {
+	if stream.Context() != nil {
+		if md := metautils.ExtractIncoming(stream.Context()); md != nil {
+			log.Infof("admin UploadRegisterModel() called by '%s (%s)' with token %s",
+				md.Get("name"), md.Get("email"), md.Get("at_hash"))
+		}
+	}
 	response := admin.RegisterResponse{Name: "WidthUnknown"}
 	soFileName := ""
 
@@ -112,6 +120,12 @@ func (s Server) UploadRegisterModel(stream admin.ConfigAdminService_UploadRegist
 
 // ListRegisteredModels lists the registered models..
 func (s Server) ListRegisteredModels(req *admin.ListModelsRequest, stream admin.ConfigAdminService_ListRegisteredModelsServer) error {
+	if stream.Context() != nil {
+		if md := metautils.ExtractIncoming(stream.Context()); md != nil {
+			log.Infof("admin ListRegisteredModels() called by '%s (%s)' with token %s",
+				md.Get("name"), md.Get("email"), md.Get("at_hash"))
+		}
+	}
 	requestedModel := req.ModelName
 	requestedVersion := req.ModelVersion
 
@@ -191,6 +205,10 @@ func (s Server) ListRegisteredModels(req *admin.ListModelsRequest, stream admin.
 
 // RollbackNetworkChange rolls back a named atomix-based network change.
 func (s Server) RollbackNetworkChange(ctx context.Context, req *admin.RollbackRequest) (*admin.RollbackResponse, error) {
+	if md := metautils.ExtractIncoming(ctx); md != nil {
+		log.Infof("admin RollbackNetworkChange() called by '%s (%s)' with token %s", md.Get("name"),
+			md.Get("email"), md.Get("at_hash"))
+	}
 	errRollback := manager.GetManager().RollbackTargetConfig(networkchange.ID(req.Name))
 	if errRollback != nil {
 		return nil, errRollback
@@ -202,6 +220,12 @@ func (s Server) RollbackNetworkChange(ctx context.Context, req *admin.RollbackRe
 
 // ListSnapshots lists snapshots for all devices
 func (s Server) ListSnapshots(r *admin.ListSnapshotsRequest, stream admin.ConfigAdminService_ListSnapshotsServer) error {
+	if stream.Context() != nil {
+		if md := metautils.ExtractIncoming(stream.Context()); md != nil {
+			log.Infof("admin ListSnapshots() called by '%s (%s)' with token %s",
+				md.Get("name"), md.Get("email"), md.Get("at_hash"))
+		}
+	}
 	log.Infof("ListSnapshots called with %s. Subscribe %v", r.ID, r.Subscribe)
 
 	// There may be a wildcard given - we only want to reply with changes that match
@@ -287,6 +311,10 @@ func (s Server) ListSnapshots(r *admin.ListSnapshotsRequest, stream admin.Config
 
 // CompactChanges takes a snapshot of all devices
 func (s Server) CompactChanges(ctx context.Context, request *admin.CompactChangesRequest) (*admin.CompactChangesResponse, error) {
+	if md := metautils.ExtractIncoming(ctx); md != nil {
+		log.Infof("admin CompactChanges() called by '%s (%s)' with token %s", md.Get("name"),
+			md.Get("email"), md.Get("at_hash"))
+	}
 	snap := &networksnapshot.NetworkSnapshot{
 		Retention: snapshot.RetentionOptions{
 			RetainWindow: request.RetentionPeriod,

pkg/northbound/diags/diags.go

@@ -17,6 +17,7 @@ package diags
 
 import (
 	"fmt"
+	"github.com/grpc-ecosystem/go-grpc-middleware/util/metautils"
 
 	"github.com/onosproject/onos-api/go/onos/config/admin"
 	devicechange "github.com/onosproject/onos-api/go/onos/config/change/device"
@@ -53,6 +54,13 @@ type Server struct {
 
 // GetOpState provides a stream of Operational and State data
 func (s Server) GetOpState(r *diags.OpStateRequest, stream diags.OpStateDiags_GetOpStateServer) error {
+	if stream.Context() != nil {
+		if md := metautils.ExtractIncoming(stream.Context()); md != nil {
+			log.Infof("diags GetOpState() called by '%s (%s)' with token %s",
+				md.Get("name"), md.Get("email"), md.Get("at_hash"))
+		}
+	}
+
 	manager.GetManager().OperationalStateCacheLock.RLock()
 	deviceCache, ok := manager.GetManager().OperationalStateCache[topodevice.ID(r.DeviceId)]
 	manager.GetManager().OperationalStateCacheLock.RUnlock()
@@ -121,6 +129,12 @@ func (s Server) GetOpState(r *diags.OpStateRequest, stream diags.OpStateDiags_Ge
 // changes first, and then hold the connection open and send on
 // further updates until the client hangs up
 func (s Server) ListNetworkChanges(r *diags.ListNetworkChangeRequest, stream diags.ChangeService_ListNetworkChangesServer) error {
+	if stream.Context() != nil {
+		if md := metautils.ExtractIncoming(stream.Context()); md != nil {
+			log.Infof("diags ListNetworkChanges() called by '%s (%s)' with token %s",
+				md.Get("name"), md.Get("email"), md.Get("at_hash"))
+		}
+	}
 	log.Infof("ListNetworkChanges called with %s. Subscribe %v", r.ChangeID, r.Subscribe)
 
 	// There may be a wildcard given - we only want to reply with changes that match
@@ -215,6 +229,12 @@ func (s Server) ListNetworkChanges(r *diags.ListNetworkChangeRequest, stream dia
 
 // ListDeviceChanges provides a stream of Device Changes
 func (s Server) ListDeviceChanges(r *diags.ListDeviceChangeRequest, stream diags.ChangeService_ListDeviceChangesServer) error {
+	if stream.Context() != nil {
+		if md := metautils.ExtractIncoming(stream.Context()); md != nil {
+			log.Infof("diags ListDeviceChanges() called by '%s (%s)' with token %s",
+				md.Get("name"), md.Get("email"), md.Get("at_hash"))
+		}
+	}
 	log.Infof("ListDeviceChanges called with %s %s. Subscribe %v", r.DeviceID, r.DeviceVersion, r.Subscribe)
 
 	var watchOpts []device.WatchOption

pkg/northbound/gnmi/get.go

@@ -17,6 +17,7 @@ package gnmi
 import (
 	"context"
 	"fmt"
+	"github.com/grpc-ecosystem/go-grpc-middleware/util/metautils"
 	devicechange "github.com/onosproject/onos-api/go/onos/config/change/device"
 	devicetype "github.com/onosproject/onos-api/go/onos/config/device"
 	"github.com/onosproject/onos-config/pkg/manager"
@@ -33,6 +34,10 @@ import (
 func (s *Server) Get(ctx context.Context, req *gnmi.GetRequest) (*gnmi.GetResponse, error) {
 	notifications := make([]*gnmi.Notification, 0)
 
+	if md := metautils.ExtractIncoming(ctx); md != nil {
+		log.Infof("gNMI Get() called by '%s (%s)' with token %s", md.Get("name"),
+			md.Get("email"), md.Get("at_hash"))
+	}
 	prefix := req.GetPrefix()
 
 	version, err := extractGetVersion(req)

pkg/northbound/gnmi/set.go

@@ -17,6 +17,7 @@ package gnmi
 import (
 	"context"
 	"fmt"
+	"github.com/grpc-ecosystem/go-grpc-middleware/util/metautils"
 	"time"
 
 	devicechange "github.com/onosproject/onos-api/go/onos/config/change/device"
@@ -40,6 +41,10 @@ type mapTargetModels map[devicetype.ID]modelregistry.ReadWritePathMap
 
 // Set implements gNMI Set
 func (s *Server) Set(ctx context.Context, req *gnmi.SetRequest) (*gnmi.SetResponse, error) {
+	if md := metautils.ExtractIncoming(ctx); md != nil {
+		log.Infof("gNMI Set() called by '%s (%s)' with token %s",
+			md.Get("name"), md.Get("email"), md.Get("at_hash"))
+	}
 	// There is only one set of extensions in Set request, regardless of number of
 	// updates
 	var (

pkg/northbound/gnmi/subscribe.go

@@ -17,6 +17,7 @@ package gnmi
 import (
 	"crypto/sha1"
 	"fmt"
+	"github.com/grpc-ecosystem/go-grpc-middleware/util/metautils"
 	changetypes "github.com/onosproject/onos-api/go/onos/config/change"
 	devicechange "github.com/onosproject/onos-api/go/onos/config/change/device"
 	devicetype "github.com/onosproject/onos-api/go/onos/config/device"
@@ -44,6 +45,12 @@ type result struct {
 
 // Subscribe implements gNMI Subscribe
 func (s *Server) Subscribe(stream gnmi.GNMI_SubscribeServer) error {
+	if stream.Context() != nil {
+		if md := metautils.ExtractIncoming(stream.Context()); md != nil {
+			log.Infof("gNMI Subscribe() called by '%s (%s)' with token %s",
+				md.Get("name"), md.Get("email"), md.Get("at_hash"))
+		}
+	}
 	//updateChan := make(chan *gnmi.Update)
 	var subscribe *gnmi.SubscriptionList
 	mgr := manager.GetManager()

pkg/northbound/gnmi/subscribe_test.go

@@ -23,6 +23,7 @@ import (
 	"github.com/openconfig/gnmi/proto/gnmi"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
 	"gotest.tools/assert"
 	"strconv"
@@ -37,6 +38,7 @@ type gNMISubscribeServerFake struct {
 	Request   *gnmi.SubscribeRequest
 	Responses chan *gnmi.SubscribeResponse
 	Signal    chan struct{}
+	context   context.Context
 	grpc.ServerStream
 }
 
@@ -53,13 +55,18 @@ func (x gNMISubscribeServerFake) Recv() (*gnmi.SubscribeRequest, error) {
 	return x.Request, nil
 }
 
+func (x gNMISubscribeServerFake) Context() context.Context {
+	return x.context
+}
+
 type gNMISubscribeServerPollFake struct {
 	Request     *gnmi.SubscribeRequest
 	PollRequest *gnmi.SubscribeRequest
 	Responses   chan *gnmi.SubscribeResponse
 	Signal      chan struct{}
 	grpc.ServerStream
-	first bool
+	first   bool
+	context context.Context
 }
 
 func (x gNMISubscribeServerPollFake) Send(m *gnmi.SubscribeResponse) error {
@@ -76,6 +83,10 @@ func (x gNMISubscribeServerPollFake) Recv() (*gnmi.SubscribeRequest, error) {
 
 }
 
+func (x gNMISubscribeServerPollFake) Context() context.Context {
+	return x.context
+}
+
 // Test_SubscribeLeafOnce tests subscribing with mode ONCE and then immediately receiving the subscription for a specific leaf.
 func Test_SubscribeLeafOnce(t *testing.T) {
 	server, mgr, mocks := setUp(t)
@@ -103,10 +114,15 @@ func Test_SubscribeLeafOnce(t *testing.T) {
 	request := buildRequest(path, gnmi.SubscriptionList_ONCE)
 
 	responsesChan := make(chan *gnmi.SubscribeResponse)
+	mdMap := make(map[string]string)
+	mdMap["name"] = "test user"
+	mdMap["email"] = "test@email"
+	mdMap["other"] = "other attribute"
 	serverFake := gNMISubscribeServerFake{
 		Request:   request,
 		Responses: responsesChan,
 		Signal:    make(chan struct{}),
+		context:   metadata.NewIncomingContext(context.Background(), metadata.New(mdMap)),
 	}
 	go func() {
 		err = server.Subscribe(serverFake)
@@ -155,6 +171,7 @@ func Test_SubscribeLeafStream(t *testing.T) {
 		Request:   request,
 		Responses: responsesChan,
 		Signal:    make(chan struct{}),
+		context:   context.Background(),
 	}
 
 	go func() {
@@ -260,6 +277,7 @@ func Test_WrongPath(t *testing.T) {
 	//	Request:   request,
 	//	Responses: responsesChan,
 	//	Signal:    make(chan struct{}),
+	//  context:   context.Background(),
 	//}
 
 	targets := make(map[string]struct{})
@@ -358,6 +376,7 @@ func Test_Poll(t *testing.T) {
 		Signal:      make(chan struct{}),
 		first:       true,
 		PollRequest: pollrequest,
+		context:     context.Background(),
 	}
 
 	go func() {
@@ -422,6 +441,7 @@ func Test_SubscribeLeafStreamDelete(t *testing.T) {
 		Request:   request,
 		Responses: responsesChan,
 		Signal:    make(chan struct{}),
+		context:   context.Background(),
 	}
 
 	go func() {
@@ -502,6 +522,7 @@ func Test_SubscribeLeafStreamWithDeviceLoaded(t *testing.T) {
 		Request:   request,
 		Responses: responsesChan,
 		Signal:    make(chan struct{}),
+		context:   context.Background(),
 	}
 
 	go func() {