spetz commented on code in PR #4615: URL: https://github.com/apache/iggy/pull/4615#discussion_r4340268040
########## core/server/src/stream_keys.rs: ########## @@ -0,0 +1,355 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +use crate::wire::rewrite_request_body; +use bytes::Bytes; +use iggy_binary_protocol::requests::streams::CreateStreamRequest; +use iggy_binary_protocol::{RoutedRequestHeader, WireEncode}; +use iggy_common::wire_conversions::resource_options_to_wire; +use iggy_common::{ + HeaderKey, HeaderValue, IggyError, OptionKey, OptionValue, OptionsProvenance, ResourceOptions, + ServerKeyContext, StreamEncryptionKey, StreamKeyOrigin, critical_keys_marker, erase_buffer, +}; +use secrecy::zeroize::Zeroize; +use server_common::Message; + +/// A request past static bounds. A `CreateStream` keeps its decoded body and +/// admitted options for [`maybe_rewrite_secret_options_request`], so a client +/// key is decoded once and never encoded into a request in the clear again. +pub enum Bounded { + Request(Message<RoutedRequestHeader>), + StreamCreate { + request: Message<RoutedRequestHeader>, + create: CreateStreamRequest, + /// The admitted canonical options, a client key among them. + options: ResourceOptions, + }, +} + +/// Wrap a `CreateStream`'s key before the request leaves this node: the +/// client's key when it sent one, or a key generated here when it did not and +/// this node encrypts new streams. The key is wrapped under every configured +/// server key, so the stream also opens on nodes a rotation has not reached. +/// Only the wrap set and the critical marker travel on, so no plaintext key Review Comment: Corrected the comment at `core/server/src/stream_keys.rs:48`: TCP carries only the wrap set onward, and an HTTP follower relays the raw body to the primary, which wraps the key there. ########## core/simulator/src/workload/ops/update_user.rs: ########## @@ -51,17 +54,22 @@ pub fn sample( Outcome::Ok => { let user = shadow.pick_user_name(prng)?; let current_password = shadow.password_for(&user)?.to_string(); + let status = if prng.random_bool(0.5) { Review Comment: Raw mode now commits a precomputed wrap set through the new `CreateKeyedStream` op (`core/simulator/src/workload/ops/create_keyed_stream.rs:63`). Rewrap is internal, so a scenario drives the in-process submit with a stale entry (`core/simulator/src/lib.rs:3764`), and self-deactivation keeps its exempt receipt (`core/simulator/src/lib.rs:3830`). ########## .github/actions/utils/server-start/action.yml: ########## @@ -53,6 +53,14 @@ inputs: description: "--replica-id <u8> value (leave empty to omit)" required: false default: "" + encryption-enabled: + description: "Give streams created without their own key a generated key, which the SDK server-generated key tests need" + required: false + default: "false" Review Comment: `encryption-key` now defaults to empty (`.github/actions/utils/server-start/action.yml:63`) and every encrypted lane passes the key. Node, Go, Swift, Python and C++ gained a lane on the shipped default without the resource options cases, and the Java and PHP TLS lanes now run keyless. C# starts its own encrypted fixture per test and is unchanged. ########## core/binary_protocol/src/consensus/operation.rs: ########## @@ -64,14 +64,26 @@ pub enum Operation { TruncatePartition = 68, FinalizeSession = 70, CompleteLifecycle = 71, + /// Prepare-resolved `UpdateResource` on a stream: column changes extracted, + /// resets resolved to their defaults. Claimed by the streams state machine. + UpdateStreamResolved = 72, + /// Prepare-resolved `UpdateResource` on a topic. + UpdateTopicResolved = 73, + /// Prepare-resolved `UpdateResource` on a user. Claimed by the users state + /// machine. + UpdateUserResolved = 74, + /// Server-originated: replace encrypted streams' wrap sets during a + /// key-encryption key rotation. Proposed by the metadata primary, no + /// client wire code. + RewrapStreamKeys = 75, Review Comment: Added `breaking:replica-to-replica-protocol`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
