TrueCloudLab/frostfs-node
19
1
Fork 27
Code Issues 91 Pull requests 6 Projects Releases 1 Activity Actions

[#1425] services/tree: Remove eACL mentions from bearer token parsing errors
All checks were successful
DCO action / DCO (pull_request) Successful in 4m45s
Details
Tests and linters / Run gofumpt (pull_request) Successful in 4m47s
Details
Tests and linters / Staticcheck (pull_request) Successful in 6m5s
Details
Tests and linters / Lint (pull_request) Successful in 6m43s
Details
Vulncheck / Vulncheck (pull_request) Successful in 6m47s
Details
Build / Build Components (pull_request) Successful in 6m59s
Details
Tests and linters / gopls check (pull_request) Successful in 8m32s
Details
Tests and linters / Tests with -race (pull_request) Successful in 9m5s
Details
Tests and linters / Tests (pull_request) Successful in 9m24s
Details
Pre-commit hooks / Pre-commit (pull_request) Successful in 1m28s
Details

Browse source 
Signed-off-by: Evgenii Stratonikov <e.stratonikov@yadro.com>
This commit is contained in:
Evgenii Stratonikov 2024-10-09 10:55:48 +03:00
parent 02bb7159a5
commit 1134760271
Signed by: fyrchik
SSH key fingerprint: SHA256:m/TTwCzjnRkXgnzEx9X92ccxy1CcVeinOgDb3NPWWmg
1 changed files with 6 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
pkg/services/tree/signature.go
View file

@ -15,7 +15,6 @@ import (
cidSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id" cidSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
frostfscrypto "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/crypto" frostfscrypto "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/crypto"
frostfsecdsa "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/crypto/ecdsa" frostfsecdsa "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/crypto/ecdsa"
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/eacl"
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user" "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
"github.com/nspcc-dev/neo-go/pkg/crypto/keys" "github.com/nspcc-dev/neo-go/pkg/crypto/keys"
) )
@ -27,10 +26,6 @@ type message interface {
SetSignature(*Signature) SetSignature(*Signature)
} }
func eACLErr(op eacl.Operation, err error) error {
return fmt.Errorf("access to operation %s is denied by extended ACL check: %w", op, err)
}
var ( var (
errBearerWrongContainer = errors.New("bearer token is created for another container") errBearerWrongContainer = errors.New("bearer token is created for another container")
errBearerSignature = errors.New("invalid bearer token signature") errBearerSignature = errors.New("invalid bearer token signature")
@ -57,11 +52,9 @@ func (s *Service) verifyClient(ctx context.Context, req message, cid cidSDK.ID,
return fmt.Errorf("can't get container %s: %w", cid, err) return fmt.Errorf("can't get container %s: %w", cid, err)
} }
eaclOp := eACLOp(op) bt, err := parseBearer(rawBearer, cid)
bt, err := parseBearer(rawBearer, cid, eaclOp)
if err != nil { if err != nil {
return err return fmt.Errorf("access to operation %s is denied: %w", op, err)
} }
role, pubKey, err := roleAndPubKeyFromReq(cnr, req, bt) role, pubKey, err := roleAndPubKeyFromReq(cnr, req, bt)
@ -93,20 +86,20 @@ func (s *Service) isAuthorized(req message, op acl.Op) (bool, error) {
return false, nil return false, nil
} }
func parseBearer(rawBearer []byte, cid cidSDK.ID, eaclOp eacl.Operation) (*bearer.Token, error) { func parseBearer(rawBearer []byte, cid cidSDK.ID) (*bearer.Token, error) {
if len(rawBearer) == 0 { if len(rawBearer) == 0 {
return nil, nil return nil, nil
} }
bt := new(bearer.Token) bt := new(bearer.Token)
if err := bt.Unmarshal(rawBearer); err != nil { if err := bt.Unmarshal(rawBearer); err != nil {
return nil, eACLErr(eaclOp, fmt.Errorf("invalid bearer token: %w", err)) return nil, fmt.Errorf("invalid bearer token: %w", err)
} }
if !bt.AssertContainer(cid) { if !bt.AssertContainer(cid) {
return nil, eACLErr(eaclOp, errBearerWrongContainer) return nil, errBearerWrongContainer
} }
if !bt.VerifySignature() { if !bt.VerifySignature() {
return nil, eACLErr(eaclOp, errBearerSignature) return nil, errBearerSignature
} }
return bt, nil return bt, nil
} }
@ -184,14 +177,3 @@ func roleAndPubKeyFromReq(cnr *core.Container, req message, bt *bearer.Token) (a
return role, pub, nil return role, pub, nil
} }
func eACLOp(op acl.Op) eacl.Operation {
switch op {
case acl.OpObjectGet:
return eacl.OperationGet
case acl.OpObjectPut:
return eacl.OperationPut
default:
panic(fmt.Sprintf("unexpected tree service ACL operation: %s", op))
}
}