From 20b3ff84b38b70871aa1c5946bffcea159a26b2d Mon Sep 17 00:00:00 2001 From: Leonard Lyubich Date: Wed, 26 Jan 2022 16:51:50 +0300 Subject: [PATCH] [#1110] ir/container: Fix check of `SetEACL` operation In previous implementation IR incorrectly verified `SetEACL` event of `Container` contract. The incorrect behavior could be reproduced in two ways: 1. Create container using session, and perform `SetEACL` operation with a key that is different from the session one. 2. Create container using session, and perform `SetEACL` w/o a session, but sign it using session key from the `Put` operation. The problem was in the `checkSetEACL` validation method of IR container processor. It always used session token used for container creation during session ownership check. Signed-off-by: Leonard Lyubich --- pkg/innerring/processors/container/process_eacl.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkg/innerring/processors/container/process_eacl.go b/pkg/innerring/processors/container/process_eacl.go index 1b3064d2..43225938 100644 --- a/pkg/innerring/processors/container/process_eacl.go +++ b/pkg/innerring/processors/container/process_eacl.go @@ -78,6 +78,12 @@ func (cp *Processor) checkSetEACL(e container.SetEACL) error { } } + // statement below is a little hack, but if we write token from event to container, + // checkKeyOwnership method will work just as it should: + // * tok == nil => we will check if key is a container owner's key + // * tok != nil => we will check if token was signed correctly (context is checked at the statement above) + cnr.SetSessionToken(tok) + // check key ownership return cp.checkKeyOwnership(cnr, key) }