TrueCloudLab/frostfs-node
20
1
Fork 27
Code Issues 101 Pull requests 4 Projects Releases 1 Activity Actions

[#1628] tree: Pre-allocate errors in ACL checks

Browse source 
Signed-off-by: Pavel Karpy <carpawell@nspcc.ru>
This commit is contained in:
Pavel Karpy 2022-09-12 14:40:06 +03:00 committed by fyrchik
parent 5adf089c1d
commit 4083a62679
1 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
pkg/services/tree/signature.go
View file

@ -36,6 +36,10 @@ func eACLErr(op eacl.Operation, err error) error {
return fmt.Errorf("access to operation %s is denied by extended ACL check: %w", op, err) return fmt.Errorf("access to operation %s is denied by extended ACL check: %w", op, err)
} }
var errBearerWrongOwner = errors.New("bearer token must be signed by the container owner")
var errBearerWrongContainer = errors.New("bearer token is created for another container")
var errBearerSignature = errors.New("invalid bearer token signature")
// verifyClient verifies if the request for a client operation // verifyClient verifies if the request for a client operation
// was signed by a key allowed by (e)ACL rules. // was signed by a key allowed by (e)ACL rules.
// Operation must be one of: // Operation must be one of:
@ -88,13 +92,13 @@ func (s *Service) verifyClient(req message, cid cidSDK.ID, rawBearer []byte, op
return eACLErr(eaclOp, fmt.Errorf("invalid bearer token: %w", err)) return eACLErr(eaclOp, fmt.Errorf("invalid bearer token: %w", err))
} }
if !bearer.ResolveIssuer(bt).Equals(cnr.Value.Owner()) { if !bearer.ResolveIssuer(bt).Equals(cnr.Value.Owner()) {
return eACLErr(eaclOp, errors.New("bearer token must be signed by the container owner")) return eACLErr(eaclOp, errBearerWrongOwner)
} }
if !bt.AssertContainer(cid) { if !bt.AssertContainer(cid) {
return eACLErr(eaclOp, errors.New("bearer token is created for another container")) return eACLErr(eaclOp, errBearerWrongContainer)
} }
if !bt.VerifySignature() { if !bt.VerifySignature() {
return eACLErr(eaclOp, errors.New("invalid bearer token signature")) return eACLErr(eaclOp, errBearerSignature)
} }
tb = bt.EACLTable() tb = bt.EACLTable()
@ -202,6 +206,9 @@ func eACLRole(role acl.Role) eacl.Role {
} }
} }
var errDENY = errors.New("DENY eACL rule")
var errNoAllowRules = errors.New("not found allowing rules for the request")
// checkEACL searches for the eACL rules that could be applied to the request // checkEACL searches for the eACL rules that could be applied to the request
// (a tuple of a signer key, his NeoFS role and a request operation). // (a tuple of a signer key, his NeoFS role and a request operation).
// It does not filter the request by the filters of the eACL table since tree // It does not filter the request by the filters of the eACL table since tree
@ -225,13 +232,13 @@ func checkEACL(tb eacl.Table, signer []byte, role eacl.Role, op eacl.Operation)
case eacl.ActionAllow: case eacl.ActionAllow:
return nil return nil
case eacl.ActionDeny: case eacl.ActionDeny:
return eACLErr(op, errors.New("DENY eACL rule")) return eACLErr(op, errDENY)
default: default:
return eACLErr(op, fmt.Errorf("unexpected action: %s", a)) return eACLErr(op, fmt.Errorf("unexpected action: %s", a))
} }
} }
return eACLErr(op, errors.New("not found allowing rules for the request")) return eACLErr(op, errNoAllowRules)
} }
func targetMatches(rec eacl.Record, role eacl.Role, signer []byte) bool { func targetMatches(rec eacl.Record, role eacl.Role, signer []byte) bool {