Allow APE rule with ResourceCondition is not found during requests #1249

New issue

Closed

opened 2024-07-15 11:43:14 +00:00 by abereziny · 2 comments

abereziny commented

2024-07-15 11:43:14 +00:00

Member

Expected Behavior

Object get passes the rule

Current Behavior

Error:
return code: 2 
Output: rpc error: read object header: status: code = 2048 message = access to object operation denied: ape denied request: method GetObject: NoRuleFound

Steps to Reproduce (for bugs)

Create container with owner wallet and basic_acl = '0'

frostfs-cli --config user_0x61d4686e73a49-config.yml container create --rpc-endpoint '10.10.100.100' --basic-acl '0' --await --policy 'REP 2 IN X CBF 1 SELECT 4 FROM * AS X'
Success:
return code: 0 
Output: CID: 5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf
awaiting...
container has been persisted on sidechain

Apply APE rule for owner wallet on this container

frostfs-cli --config user_0x61d4686e73a49-config.yml ape-manager add --rpc-endpoint '10.10.100.100' --chain-id 'chain-id-0x61d4688391be1' --rule 'allow object.* RequestCondition:"\$Actor:role"=owner *' --target-name '5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf' --target-type 'container'
Success:
return code: 0 
Output: Parsed chain:
Chain ID: chain-id-0x61d4688391be1
     HEX: 636861696e2d69642d307836316434363838333931626531
Rules:

	Status: Allowed
	Any: false
	Conditions:
		Request $Actor:role StringEquals owner
	Actions:	Inverted:false
		PutObject
		GetObject
		HeadObject
		DeleteObject
		SearchObject
		HashObject
	Resources:	Inverted:false
		native:object/*
Rule has been added.
Chain ID:  chain-id-0x61d4688391be1

Apply APE rule for others with ResourceCondition

frostfs-cli --config user_0x61d4686e73a49-config.yml ape-manager add --rpc-endpoint '10.10.100.100' --chain-id 'chain-id-0x61d46897e4eb0' --rule 'allow object.get object.head object.put ResourceCondition:"check_key"="check_value" RequestCondition:"\$Actor:role"=others *' --target-name '5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf' --target-type 'container'
Success:
return code: 0 
Output: Parsed chain:
Chain ID: chain-id-0x61d46897e4eb0
     HEX: 636861696e2d69642d307836316434363839376534656230
Rules:

	Status: Allowed
	Any: false
	Conditions:
		Resource check_key StringEquals check_value
		Request $Actor:role StringEquals others
	Actions:	Inverted:false
		GetObject
		HeadObject
		PutObject
	Resources:	Inverted:false
		native:object/*
Rule has been added.
Chain ID:  chain-id-0x61d46897e4eb0

Put object using owner wallet

frostfs-cli --config user_0x61d4686e73a49-config.yml object put --rpc-endpoint '10.10.100.100' --cid '5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf' --file 'object-0x61d468806e82c' --attributes 'key_one=check_value,x_key=xvalue,check_key=check_value,key=4'
Success:
return code: 0 
Output: [object-0x61d468806e82c] Object successfully stored
  OID: 7Cn43X7YzSerSmwpR4N8EXDoqjpaXqsjKgzyaoQCXTrg
  CID: 5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf

Get object using second wallet

frostfs-cli --config user-0x61d4685d657e7-config.yml object get --rpc-endpoint '10.10.100.100' --cid '5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf' --oid '7Cn43X7YzSerSmwpR4N8EXDoqjpaXqsjKgzyaoQCXTrg' --file '21d190e9-980a-441d-afb1-e2fc99fdeda6'

Context

This was found during eACL to APE transition for autotests

Regression

Yes* (formally)

## Expected Behavior Object get passes the rule ## Current Behavior ``` Error: return code: 2 Output: rpc error: read object header: status: code = 2048 message = access to object operation denied: ape denied request: method GetObject: NoRuleFound ``` ## Steps to Reproduce (for bugs) 1. Create container with owner wallet and basic_acl = '0' ``` frostfs-cli --config user_0x61d4686e73a49-config.yml container create --rpc-endpoint '10.10.100.100' --basic-acl '0' --await --policy 'REP 2 IN X CBF 1 SELECT 4 FROM * AS X' Success: return code: 0 Output: CID: 5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf awaiting... container has been persisted on sidechain ``` 2. Apply APE rule for owner wallet on this container ``` frostfs-cli --config user_0x61d4686e73a49-config.yml ape-manager add --rpc-endpoint '10.10.100.100' --chain-id 'chain-id-0x61d4688391be1' --rule 'allow object.* RequestCondition:"\$Actor:role"=owner *' --target-name '5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf' --target-type 'container' Success: return code: 0 Output: Parsed chain: Chain ID: chain-id-0x61d4688391be1 HEX: 636861696e2d69642d307836316434363838333931626531 Rules: Status: Allowed Any: false Conditions: Request $Actor:role StringEquals owner Actions: Inverted:false PutObject GetObject HeadObject DeleteObject SearchObject HashObject Resources: Inverted:false native:object/* Rule has been added. Chain ID: chain-id-0x61d4688391be1 ``` 3. Apply APE rule for others with ResourceCondition ``` frostfs-cli --config user_0x61d4686e73a49-config.yml ape-manager add --rpc-endpoint '10.10.100.100' --chain-id 'chain-id-0x61d46897e4eb0' --rule 'allow object.get object.head object.put ResourceCondition:"check_key"="check_value" RequestCondition:"\$Actor:role"=others *' --target-name '5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf' --target-type 'container' Success: return code: 0 Output: Parsed chain: Chain ID: chain-id-0x61d46897e4eb0 HEX: 636861696e2d69642d307836316434363839376534656230 Rules: Status: Allowed Any: false Conditions: Resource check_key StringEquals check_value Request $Actor:role StringEquals others Actions: Inverted:false GetObject HeadObject PutObject Resources: Inverted:false native:object/* Rule has been added. Chain ID: chain-id-0x61d46897e4eb0 ``` 4. Put object using owner wallet ``` frostfs-cli --config user_0x61d4686e73a49-config.yml object put --rpc-endpoint '10.10.100.100' --cid '5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf' --file 'object-0x61d468806e82c' --attributes 'key_one=check_value,x_key=xvalue,check_key=check_value,key=4' Success: return code: 0 Output: [object-0x61d468806e82c] Object successfully stored OID: 7Cn43X7YzSerSmwpR4N8EXDoqjpaXqsjKgzyaoQCXTrg CID: 5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf ``` 5. Get object using second wallet ``` frostfs-cli --config user-0x61d4685d657e7-config.yml object get --rpc-endpoint '10.10.100.100' --cid '5iHHfLo65wGUoh2syF3W776av7WEbq74jeZmVD3fjeCf' --oid '7Cn43X7YzSerSmwpR4N8EXDoqjpaXqsjKgzyaoQCXTrg' --file '21d190e9-980a-441d-afb1-e2fc99fdeda6' ``` ## Context This was found during eACL to APE transition for autotests ## Regression Yes* (formally)

abereziny added the

bug

triage

labels 2024-07-15 11:43:14 +00:00

aarifullin commented

2024-07-15 12:18:25 +00:00

Member

Briefly, the object (4) is stored with the attributes 'key_one=check_value,x_key=xvalue,check_key=check_value,key=4' although cannot be loaded with get (5).

The reason why NoRuleFound is returned: set WithoutHeaderRequest flag in Get.
So, we can't fill ape-request with the attributes here - it just skips this step.

@dstepanov-yadro, as far as I remember, you had introduced the flag to avoid double-checks within APE middleware. What do you think - could we use WithoutHeaderRequest flag only for specific cases?

Briefly, the object (4) is stored with the attributes `'key_one=check_value,x_key=xvalue,check_key=check_value,key=4'` although cannot be loaded with `get` (5). The reason why `NoRuleFound` is returned: set [WithoutHeaderRequest](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/08953a2f94ecb50ff8b006d25ac34b4b2c623418/pkg/services/object/ape/service.go#L155) flag in [Get](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/08953a2f94ecb50ff8b006d25ac34b4b2c623418/pkg/services/object/ape/service.go#L135). So, we can't fill ape-request with the attributes [here](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/08953a2f94ecb50ff8b006d25ac34b4b2c623418/pkg/services/object/ape/request.go#L118) - it just skips this step. @dstepanov-yadro, as far as I remember, you had introduced the flag to avoid double-checks within APE middleware. What do you think - could we use `WithoutHeaderRequest` flag only for specific cases?

aarifullin was assigned by fyrchik

2024-07-15 12:43:23 +00:00

dstepanov-yadro commented

2024-07-15 13:24:57 +00:00

Member

Of course, this will lead to some overhead.
Alternatively: for requests where headers are not requested, ignore NoRuleFound for verification before the request done, but take it into account in the verification after the request done and object is ready.

Of course, this will lead to some overhead. Alternatively: for requests where headers are not requested, ignore NoRuleFound for verification before the request done, but take it into account in the verification after the request done and object is ready.

👍 1

aarifullin referenced this issue from a pull request that will close it,

2024-07-16 17:48:26 +00:00

[#1249] object: Remove all APE pre-checks in handlers #1252