ApiListener::UpdateObjectAuthority(): distribute auth. by object's host

lib/remote/apilistener-authority.cpp

@@ -25,6 +25,7 @@ void ApiListener::UpdateObjectAuthority()
 
 	std::vector<Endpoint::Ptr> endpoints;
 	Endpoint::Ptr my_endpoint;
+	int hostChildrenInheritObjectAuthority = 0;
 
 	if (my_zone) {
 		my_endpoint = Endpoint::GetLocalEndpoint();
@@ -51,6 +52,12 @@ void ApiListener::UpdateObjectAuthority()
 				return a->GetName() < b->GetName();
 			}
 		);
+
+		for (auto& endpoint : endpoints) {
+			if (endpoint == my_endpoint || endpoint->GetCapabilities() & (uint_fast64_t)ApiCapabilities::HostChildrenInheritObjectAuthority) {
+				++hostChildrenInheritObjectAuthority;
+			}
+		}
 	}
 
 	for (const Type::Ptr& type : Type::GetAllTypes()) {
@@ -65,10 +72,24 @@ void ApiListener::UpdateObjectAuthority()
 
 			bool authority;
 
-			if (!my_zone)
+			if (my_zone) {
+				auto name (object->GetName());
+
+				// If all endpoints know this algorithm, we can use it.
+				if (hostChildrenInheritObjectAuthority == endpoints.size()) {
+					auto exclamation (name.FindFirstOf('!'));
+
+					// Pin child objects of hosts (HOST!...) to the same endpoint as the host.
+					// This reduces cross-object action latency withing the same host.
+					if (exclamation != String::NPos) {
+						name = name.SubStr(0, exclamation);
+					}
+				}
+
+				authority = endpoints[Utility::SDBM(name) % endpoints.size()] == my_endpoint;
+			} else {
 				authority = true;
-			else
-				authority = endpoints[Utility::SDBM(object->GetName()) % endpoints.size()] == my_endpoint;
+			}
 
 #ifdef I2_DEBUG
 // 			//Enable on demand, causes heavy logging on each run.

lib/remote/apilistener.cpp

@@ -644,7 +644,9 @@ static const auto l_AppVersionInt (([]() -> unsigned long {
 })());
 
 static const auto l_MyCapabilities (
-	(uint_fast64_t)ApiCapabilities::ExecuteArbitraryCommand | (uint_fast64_t)ApiCapabilities::IfwApiCheckCommand
+	(uint_fast64_t)ApiCapabilities::ExecuteArbitraryCommand
+	| (uint_fast64_t)ApiCapabilities::IfwApiCheckCommand
+	| (uint_fast64_t)ApiCapabilities::HostChildrenInheritObjectAuthority
 );
 
 /**
@@ -852,11 +854,22 @@ void ApiListener::NewClientHandlerInternal(
 		JsonRpcConnection::Ptr aclient = new JsonRpcConnection(identity, verify_ok, client, role);
 
 		if (endpoint) {
-			endpoint->AddClient(aclient);
+			const auto reuniteCluster ([this, endpoint](const JsonRpcConnection::Ptr& aclient) {
+				endpoint->AddClient(aclient);
 
-			Utility::QueueAsyncCallback([this, aclient, endpoint]() {
-				SyncClient(aclient, endpoint, true);
+				Utility::QueueAsyncCallback([this, aclient, endpoint] {
+					SyncClient(aclient, endpoint, true);
+				});
 			});
+
+			if (endpoint->GetZone() == Zone::GetLocalZone()) {
+				// Nodes in the same zone, which do teamwork, must know each other's capabilities in advance.
+				// Hence, we delay everything else until they're told us via an icinga::Hello message.
+				// Even v2.12 nodes send this message at the beginning, so we're safe.
+				aclient->OnNextHello.connect(reuniteCluster);
+			} else {
+				reuniteCluster(aclient);
+			}
 		} else if (!AddAnonymousClient(aclient)) {
 			Log(LogNotice, "ApiListener")
 				<< "Ignoring anonymous JSON-RPC connection " << conninfo
@@ -1825,6 +1838,10 @@ Value ApiListener::HelloAPIHandler(const MessageOrigin::Ptr& origin, const Dicti
 					}
 				}
 			}
+
+			decltype(client->OnNextHello) listeners;
+			std::swap(client->OnNextHello, listeners);
+			listeners(client);
 		}
 	}
 

lib/remote/apilistener.hpp

@@ -69,6 +69,7 @@ enum class ApiCapabilities : uint_fast64_t
 {
 	ExecuteArbitraryCommand = 1u << 0u,
 	IfwApiCheckCommand = 1u << 1u,
+	HostChildrenInheritObjectAuthority = 1u << 2u,
 };
 
 /**

lib/remote/jsonrpcconnection.hpp

@@ -15,6 +15,7 @@
 #include <boost/asio/io_context.hpp>
 #include <boost/asio/io_context_strand.hpp>
 #include <boost/asio/spawn.hpp>
+#include <boost/signals2.hpp>
 
 namespace icinga
 {
@@ -59,6 +60,9 @@ class JsonRpcConnection final : public Object
 	void SendMessage(const Dictionary::Ptr& request);
 	void SendRawMessage(const String& request);
 
+	// On remote icinga::Hello, this signal is emitted and all handlers are removed from it, atomically.
+	boost::signals2::signal<void(const Ptr&)> OnNextHello;
+
 	static Value HeartbeatAPIHandler(const intrusive_ptr<MessageOrigin>& origin, const Dictionary::Ptr& params);
 
 	static double GetWorkQueueRate();