TrueCloudLab/frostfs-node
20
1
Fork 27
Code Issues 101 Pull requests 6 Projects Releases 1 Activity Actions

[#1503] container: Fix APE-request target
Some checks failed
Tests and linters / Run gofumpt (pull_request) Successful in 48s
Details
DCO action / DCO (pull_request) Successful in 1m19s
Details
Vulncheck / Vulncheck (pull_request) Successful in 2m7s
Details
Build / Build Components (pull_request) Successful in 2m42s
Details
Tests and linters / Staticcheck (pull_request) Successful in 2m38s
Details
Pre-commit hooks / Pre-commit (pull_request) Successful in 2m45s
Details
Tests and linters / gopls check (pull_request) Failing after 2m58s
Details
Tests and linters / Tests with -race (pull_request) Failing after 3m4s
Details
Tests and linters / Tests (pull_request) Failing after 3m19s
Details
Tests and linters / Lint (pull_request) Successful in 3m51s
Details

Browse source 
* Request target shouldn't contain container target as container
  operations can't be checked with container-targeted rules.

Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>
This commit is contained in:
Airat Arifullin 2024-11-18 18:57:13 +03:00
parent 46fef276b4
commit cd97b1a1ba
2 changed files with 19 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
pkg/services/container/ape.go
View file

@ -327,9 +327,15 @@ func (ac *apeChecker) validateContainerBoundedOperation(ctx context.Context, con
reqProps, reqProps,
) )
s, found, err := ac.router.IsAllowed(apechain.Ingress, rt := policyengine.NewRequestTargetWithNamespace(namespace)
policyengine.NewRequestTargetExtended(namespace, id.EncodeToString(), fmt.Sprintf("%s:%s", namespace, pk.Address()), groups), userTarget := policyengine.UserTarget(fmt.Sprintf("%s:%s", namespace, pk.Address()))
request) rt.User = &userTarget
rt.Groups = make([]policyengine.Target, len(groups))
for i := range groups {
rt.Groups[i] = policyengine.GroupTarget(groups[i])
}
s, found, err := ac.router.IsAllowed(apechain.Ingress, rt, request)
if err != nil { if err != nil {
return err return err
} }

20
pkg/services/container/ape_test.go
View file

@ -117,7 +117,7 @@ func testAllowThenDenyGetContainerRuleDefined(t *testing.T) {
_, err = apeSrv.Get(context.Background(), req) _, err = apeSrv.Get(context.Background(), req)
require.NoError(t, err) require.NoError(t, err)
_, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{
Rules: []chain.Rule{ Rules: []chain.Rule{
{ {
Status: chain.AccessDenied, Status: chain.AccessDenied,
@ -324,7 +324,7 @@ func testDenyGetContainerForOthers(t *testing.T) {
nm.netmaps[nm.currentEpoch] = &testNetmap nm.netmaps[nm.currentEpoch] = &testNetmap
nm.netmaps[nm.currentEpoch-1] = &testNetmap nm.netmaps[nm.currentEpoch-1] = &testNetmap
_, _, err := router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ _, _, err := router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{
Rules: []chain.Rule{ Rules: []chain.Rule{
{ {
Status: chain.AccessDenied, Status: chain.AccessDenied,
@ -424,7 +424,7 @@ func testDenyGetContainerByUserClaimTag(t *testing.T) {
nm.netmaps[nm.currentEpoch] = &testNetmap nm.netmaps[nm.currentEpoch] = &testNetmap
nm.netmaps[nm.currentEpoch-1] = &testNetmap nm.netmaps[nm.currentEpoch-1] = &testNetmap
_, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{
Rules: []chain.Rule{ Rules: []chain.Rule{
{ {
Status: chain.AccessDenied, Status: chain.AccessDenied,
@ -522,7 +522,7 @@ func testDenyGetContainerByIP(t *testing.T) {
nm.netmaps[nm.currentEpoch] = &testNetmap nm.netmaps[nm.currentEpoch] = &testNetmap
nm.netmaps[nm.currentEpoch-1] = &testNetmap nm.netmaps[nm.currentEpoch-1] = &testNetmap
_, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{
Rules: []chain.Rule{ Rules: []chain.Rule{
{ {
Status: chain.AccessDenied, Status: chain.AccessDenied,
@ -621,7 +621,7 @@ func testDenyGetContainerByGroupID(t *testing.T) {
nm.netmaps[nm.currentEpoch] = &testNetmap nm.netmaps[nm.currentEpoch] = &testNetmap
nm.netmaps[nm.currentEpoch-1] = &testNetmap nm.netmaps[nm.currentEpoch-1] = &testNetmap
_, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{
Rules: []chain.Rule{ Rules: []chain.Rule{
{ {
Status: chain.AccessDenied, Status: chain.AccessDenied,
@ -1213,7 +1213,7 @@ func TestValidateContainerBoundedOperation(t *testing.T) {
components.containerReader.c[contID] = &containercore.Container{Value: testContainer} components.containerReader.c[contID] = &containercore.Container{Value: testContainer}
initTestNetmap(components.netmap) initTestNetmap(components.netmap)
_, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{
Rules: []chain.Rule{ Rules: []chain.Rule{
{ {
Status: chain.AccessDenied, Status: chain.AccessDenied,
@ -1255,7 +1255,7 @@ func TestValidateContainerBoundedOperation(t *testing.T) {
components.containerReader.c[contID] = &containercore.Container{Value: testContainer} components.containerReader.c[contID] = &containercore.Container{Value: testContainer}
initTestNetmap(components.netmap) initTestNetmap(components.netmap)
_, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{
Rules: []chain.Rule{ Rules: []chain.Rule{
{ {
Status: chain.AccessDenied, Status: chain.AccessDenied,
@ -1341,7 +1341,7 @@ func TestValidateContainerBoundedOperation(t *testing.T) {
components.containerReader.c[contID] = &containercore.Container{Value: testContainer} components.containerReader.c[contID] = &containercore.Container{Value: testContainer}
initTestNetmap(components.netmap) initTestNetmap(components.netmap)
_, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{
Rules: []chain.Rule{ Rules: []chain.Rule{
{ {
Status: chain.AccessDenied, Status: chain.AccessDenied,
@ -1384,7 +1384,7 @@ func TestValidateContainerBoundedOperation(t *testing.T) {
components.containerReader.c[contID] = &containercore.Container{Value: testContainer} components.containerReader.c[contID] = &containercore.Container{Value: testContainer}
initTestNetmap(components.netmap) initTestNetmap(components.netmap)
_, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{
Rules: []chain.Rule{ Rules: []chain.Rule{
{ {
Status: chain.AccessDenied, Status: chain.AccessDenied,
@ -1566,7 +1566,7 @@ func initListRequest(t *testing.T, actorPK *keys.PrivateKey, ownerPK *keys.Priva
} }
func addDefaultAllowGetPolicy(t *testing.T, e engine.Engine, contID cid.ID) { func addDefaultAllowGetPolicy(t *testing.T, e engine.Engine, contID cid.ID) {
_, _, err := e.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ _, _, err := e.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{
Rules: []chain.Rule{ Rules: []chain.Rule{
{ {
Status: chain.Allow, Status: chain.Allow,