Do not allow to create container without FrostFSID record #1278

dstepanov-yadro · 2024-07-29T08:43:02Z

dstepanov-yadro commented

2024-07-29 08:43:02 +00:00

Now anonymous user can create container, we should restrict container creation to registered users only.

Before fix: container created with generated wallet.

After fix:

IR log:

июл 29 08:20:43 dstepanov-node1 frostfs-ir[91030]: 2024-07-29T08:20:43.329Z        error        container/process_container.go:51        put container check failed        {"error": "NNS: could not get subject from FrostfsID contract: could not perform test invocation (getSubject): frostfs error: chain/client: contract execution finished with state FAULT; exception: at instruction 2231 (THROW): unhandled exception: \"subject not found\""}

frostfs-cli output:

service@dstepanov-node1[alone_datacenter]:~$ frostfs-cli -r 127.0.0.1:8080 container create -w anonon1.json --name out1 --policy "REP 2 IN X CBF 2 SELECT 2 FROM * AS X" --await
Enter password > 
CID: DXa2bUxrHab1XSHYAEcen9Bfqtx8nChYw3YZjN69hyy4
awaiting...
timeout: container has not been persisted on sidechain

Now anonymous user can create container, we should restrict container creation to registered users only. Before fix: container created with generated wallet. After fix: 1. IR log: ``` июл 29 08:20:43 dstepanov-node1 frostfs-ir[91030]: 2024-07-29T08:20:43.329Z error container/process_container.go:51 put container check failed {"error": "NNS: could not get subject from FrostfsID contract: could not perform test invocation (getSubject): frostfs error: chain/client: contract execution finished with state FAULT; exception: at instruction 2231 (THROW): unhandled exception: \"subject not found\""} ``` 2. frostfs-cli output: ``` service@dstepanov-node1[alone_datacenter]:~$ frostfs-cli -r 127.0.0.1:8080 container create -w anonon1.json --name out1 --policy "REP 2 IN X CBF 2 SELECT 2 FROM * AS X" --await Enter password > CID: DXa2bUxrHab1XSHYAEcen9Bfqtx8nChYw3YZjN69hyy4 awaiting... timeout: container has not been persisted on sidechain ```

dstepanov-yadro force-pushed fix/undefined_wallet_container_creation from 40bfab2c87 to 0244292bf8

2024-07-29 08:47:39 +00:00

Compare

dstepanov-yadro force-pushed fix/undefined_wallet_container_creation from 0244292bf8 to c2ac60abf4

2024-07-29 08:50:56 +00:00

Compare

aarifullin reviewed 2024-07-29 08:58:12 +00:00

pkg/innerring/processors/container/process_container.go Outdated

					
				@ -195,6 +190,11 @@ func (cp *Processor) checkNNS(ctx *putContainerContext, cnr containerSDK.Contain

						return fmt.Errorf("could not get subject from FrostfsID contract: %w", err)

					}

					namespace, hasNamespace := strings.CutSuffix(ctx.d.Zone(), ".ns")

aarifullin commented

2024-07-29 08:58:12 +00:00

Probably, this also should be done in containersvc.Put method implementation (it also gets frostfsid entry to determine a namespace) - at least, we can return the container creation error immediatly. Otherwise, we'll wait for a while and get only error like that
timeout: container has not been persisted on sidechain
We need to be prepared that since all anonym wallets' requests to create bucket/container will be rejected - this point is not about to fix something but just a reminder

1. Probably, this also should be done in `containersvc.Put` method implementation (it also gets frostfsid entry to determine a namespace) - at least, we can return the container creation error immediatly. Otherwise, we'll wait for a while and get only error like that `timeout: container has not been persisted on sidechain` 2. We need to be prepared that since all anonym wallets' requests to create bucket/container will be rejected - this point is not about to fix something but just a *reminder*

fyrchik commented

2024-07-29 09:54:13 +00:00

Regarding (1) -- if possible, yes, humane user messages are good.
If it is not already implemented for the namespace case, don't bother.

Regarding (1) -- if possible, yes, humane user messages are good. If it is not already implemented for the namespace case, don't bother.