TrueCloudLab/frostfs-node

Fork 27

APE ignores xheaders RequestConditions which were working in eACL #1243

New issue

Open

opened 2024-07-11 12:49:34 +00:00 by abereziny · 2 comments

abereziny commented

2024-07-11 12:49:34 +00:00

Member

Expected Behavior

Request should be blocked by APE rule.

Current Behavior

Success:
return code: 0 
Output: [TemporaryDir/object-0x61cf8149b5b6f] Object successfully stored
  OID: CsB6XpPtphmemBbm8NKFTha3biNgJAqFkaGKikjY8ZNY
  CID: Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj

Possible Solution

 No fix can be suggested by a QA engineer. Further solutions shall be up to developers.

Steps to Reproduce (for bugs)

Create public container

frostfs-cli container create --wallet owner.json --basic-acl '0FBFBFFF' --policy 'REP 2 IN X CBF 1 SELECT 4 FROM * AS X'
CID: Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj

Deny all operations for others via APE with request conditions

frostfs-cli ape-manager add --wallet owner.json --chain-id 'chain-id-0x61cf815c51632' --rule 'deny object.put object.get object.head object.range object.hash object.search object.delete RequestCondition:"check_key"="check_value" RequestCondition:"\$Actor:role"=others *' --target-name 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --target-type 'container'
Success:
return code: 0 
Output: Parsed chain:
Chain ID: chain-id-0x61cf815c51632
     HEX: 636861696e2d69642d307836316366383135633531363332
Rules:

	Status: Access denied
	Any: false
	Conditions:
		Request check_key StringEquals check_value
		Request $Actor:role StringEquals others
	Actions:	Inverted:false
		PutObject
		GetObject
		HeadObject
		RangeObject
		HashObject
		SearchObject
		DeleteObject
	Resources:	Inverted:false
		native:object/*
Rule has been added.
Chain ID:  chain-id-0x61cf815c51632

Send put request with xheaders from others wallet

frostfs-cli object put --wallet others.json --cid 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --file 'test.txt' --xhdr 'check_key=check_value'

Context

This was working with eACL rules. Now, with migration to APE this piece of functionality is lost.

Regression

Yes*
Technically it's a regression. However, APE is new functionality.

## Expected Behavior Request should be blocked by APE rule. ## Current Behavior ``` Success: return code: 0 Output: [TemporaryDir/object-0x61cf8149b5b6f] Object successfully stored OID: CsB6XpPtphmemBbm8NKFTha3biNgJAqFkaGKikjY8ZNY CID: Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj ``` ## Possible Solution No fix can be suggested by a QA engineer. Further solutions shall be up to developers. ## Steps to Reproduce (for bugs) 1. Create public container ``` frostfs-cli container create --wallet owner.json --basic-acl '0FBFBFFF' --policy 'REP 2 IN X CBF 1 SELECT 4 FROM * AS X' CID: Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj ``` 2. Deny all operations for others via APE with request conditions ``` frostfs-cli ape-manager add --wallet owner.json --chain-id 'chain-id-0x61cf815c51632' --rule 'deny object.put object.get object.head object.range object.hash object.search object.delete RequestCondition:"check_key"="check_value" RequestCondition:"\$Actor:role"=others *' --target-name 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --target-type 'container' Success: return code: 0 Output: Parsed chain: Chain ID: chain-id-0x61cf815c51632 HEX: 636861696e2d69642d307836316366383135633531363332 Rules: Status: Access denied Any: false Conditions: Request check_key StringEquals check_value Request $Actor:role StringEquals others Actions: Inverted:false PutObject GetObject HeadObject RangeObject HashObject SearchObject DeleteObject Resources: Inverted:false native:object/* Rule has been added. Chain ID: chain-id-0x61cf815c51632 ``` 3. Send put request with xheaders from `others` wallet ``` frostfs-cli object put --wallet others.json --cid 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --file 'test.txt' --xhdr 'check_key=check_value' ``` ## Context This was working with eACL rules. Now, with migration to APE this piece of functionality is lost. ## Regression Yes* Technically it's a regression. However, APE is new functionality.

abereziny added the

bug

triage

labels 2024-07-11 12:49:34 +00:00

abereziny changed title from ~~APE ignores xheaders RequestConditions which were worked in eACL~~ to APE ignores xheaders RequestConditions which were working in eACL

2024-07-11 12:50:27 +00:00

aarifullin self-assigned this 2024-07-11 12:55:56 +00:00

aarifullin referenced this issue from a pull request that will close it,

2024-07-12 09:05:18 +00:00

[#1243] object: Make APE checker set x-headers to request properties #1247

fyrchik closed this issue

2024-07-16 07:28:59 +00:00

fyrchik referenced this issue from a commit

2024-07-16 07:29:01 +00:00

[#1243] object: Make APE checker set x-headers to request properties

abereziny commented

2024-08-02 14:10:21 +00:00

Author

Member

Still doesn't work with GET and HEAD requests.

Steps are the same but instead of put, use get and head

Expected Behavior

Request should be blocked by APE rule.

Current Behavior

Get and Head succeeds

Possible Solution

 No fix can be suggested by a QA engineer. Further solutions shall be up to developers.

Steps to Reproduce (for bugs)

Create public container

frostfs-cli container create --wallet owner.json --basic-acl '0FBFBFFF' --policy 'REP 2 IN X CBF 1 SELECT 4 FROM * AS X'
CID: Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj

Put object using owner wallet (attributes are garbage info to test APE rule doesn't rely on them in THIS case)

frostfs-cli --config owner.json object put --cid 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --file 'file.txt' --attributes 'key_one=check_value,x_key=xvalue,check_key=check_value,key=2' --no-progress --timeout '100s'

  OID: 3R1YNuCG25K9JJcsVeiLupWcQXFZXgDxDMTZxoiLTbUL
  CID: Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj

Deny all operations for others via APE with request conditions

frostfs-cli ape-manager add --wallet owner.json --chain-id 'chain-id-0x61cf815c51632' --rule 'deny object.put object.get object.head object.range object.hash object.search object.delete RequestCondition:"frostfs:xheader/check_key"="check_value" RequestCondition:"\$Actor:role"=others *' --target-name 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --target-type 'container'
Success:
return code: 0 
Output: Parsed chain:
Chain ID: chain-id-0x61cf815c51632
     HEX: 636861696e2d69642d307836316366383135633531363332
Rules:

	Status: Access denied
	Any: false
	Conditions:
		Request check_key StringEquals check_value
		Request $Actor:role StringEquals others
	Actions:	Inverted:false
		PutObject
		GetObject
		HeadObject
		RangeObject
		HashObject
		SearchObject
		DeleteObject
	Resources:	Inverted:false
		native:object/*
Rule has been added.
Chain ID:  chain-id-0x61cf815c51632

Send get request with xheaders from others wallet

frostfs-cli object get --wallet others.json --cid 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --oid '3R1YNuCG25K9JJcsVeiLupWcQXFZXgDxDMTZxoiLTbUL' --file 'test_download.txt'  --xhdr 'check_key=check_value'

Send head request with xheaders from others wallet

frostfs-cli object head --wallet others.json --cid 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --oid '3R1YNuCG25K9JJcsVeiLupWcQXFZXgDxDMTZxoiLTbUL' --xhdr 'check_key=check_value'

Still doesn't work with GET and HEAD requests. Steps are the same but instead of `put`, use `get` and `head`  ## Expected Behavior Request should be blocked by APE rule. ## Current Behavior Get and Head succeeds ## Possible Solution No fix can be suggested by a QA engineer. Further solutions shall be up to developers. ## Steps to Reproduce (for bugs) 1. Create public container ``` frostfs-cli container create --wallet owner.json --basic-acl '0FBFBFFF' --policy 'REP 2 IN X CBF 1 SELECT 4 FROM * AS X' CID: Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj ``` 2. Put object using owner wallet (attributes are garbage info to test APE rule doesn't rely on them in THIS case) ``` frostfs-cli --config owner.json object put --cid 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --file 'file.txt' --attributes 'key_one=check_value,x_key=xvalue,check_key=check_value,key=2' --no-progress --timeout '100s' OID: 3R1YNuCG25K9JJcsVeiLupWcQXFZXgDxDMTZxoiLTbUL CID: Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj ``` 3. Deny all operations for others via APE with request conditions ``` frostfs-cli ape-manager add --wallet owner.json --chain-id 'chain-id-0x61cf815c51632' --rule 'deny object.put object.get object.head object.range object.hash object.search object.delete RequestCondition:"frostfs:xheader/check_key"="check_value" RequestCondition:"\$Actor:role"=others *' --target-name 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --target-type 'container' Success: return code: 0 Output: Parsed chain: Chain ID: chain-id-0x61cf815c51632 HEX: 636861696e2d69642d307836316366383135633531363332 Rules: Status: Access denied Any: false Conditions: Request check_key StringEquals check_value Request $Actor:role StringEquals others Actions: Inverted:false PutObject GetObject HeadObject RangeObject HashObject SearchObject DeleteObject Resources: Inverted:false native:object/* Rule has been added. Chain ID: chain-id-0x61cf815c51632 ``` 3. Send get request with xheaders from `others` wallet ``` frostfs-cli object get --wallet others.json --cid 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --oid '3R1YNuCG25K9JJcsVeiLupWcQXFZXgDxDMTZxoiLTbUL' --file 'test_download.txt' --xhdr 'check_key=check_value' ``` 4. Send head request with xheaders from `others` wallet ``` frostfs-cli object head --wallet others.json --cid 'Bf5xGjzL3K6UYsDZKDGAxuR7j8cZEtGWTTmHeYd2iaxj' --oid '3R1YNuCG25K9JJcsVeiLupWcQXFZXgDxDMTZxoiLTbUL' --xhdr 'check_key=check_value' ```

abereziny reopened this issue

2024-08-02 14:10:23 +00:00

aarifullin commented

2024-08-02 14:13:22 +00:00

Member

Put works fine, but Head, Get has got the problem.
The problem that @abereziny is struggling: xheaders are not forwarded when the request is proxied to the container node. That's why the rule doesn't work out

`Put` works fine, but `Head`, `Get` has got the problem. The problem that @abereziny is struggling: `xheaders` are not forwarded when the request is proxied to the container node. That's why the rule doesn't work out

fyrchik added this to the v0.43.0 milestone 2024-08-19 08:47:18 +00:00

fyrchik added

frostfs-node

and removed

triage

labels 2024-08-19 08:47:24 +00:00