Complex object cannot be put when it should pass APE rule. #1300

New issue

Open

opened 2024-08-07 10:29:58 +00:00 by abereziny · 2 comments

abereziny commented

2024-08-07 10:29:58 +00:00

Member

Expected Behavior

Successfull object put

Current Behavior

Error with retcode 1
Output: 
rpc error: client failure: status: code = 1024 message = incomplete object PUT by placement: could not write header: (*putsvc.remoteTarget) could not put single object to [/ip4/192.168.201.173/tcp/8080 /ip4/192.168.200.173/tcp/8080]: put single object via client: status: code = 2048 message = access to object operation denied

Possible Solution

 No fix can be suggested by a QA engineer. Further solutions shall be up to developers.

Steps to Reproduce (for bugs)

Create public container with owner wallet

frostfs-cli --config owner.yml container create --rpc-endpoint '10.10.10.100' --basic-acl '0FBFBFFF' --await --policy 'REP 2 IN X CBF 1 SELECT 4 FROM * AS X'
Success with retcode 0
Output: 
CID: J93jqd38xy49pEukYx1Hxf6jLFtccTeKty156FrhNLBP

Deny placement for others with ResourceCondition "check_key"!="check_value" (StringNotEquals)

11:57:28 [INFO] Command: frostfs-cli --config owner ape-manager add --rpc-endpoint '10.10.10.100' --chain-id 'chain-id-0x61f14197cf7f8' --rule 'deny object.get object.head object.put ResourceCondition:"check_key"!="check_value" RequestCondition:"\$Actor:role"=others *' --target-name 'J93jqd38xy49pEukYx1Hxf6jLFtccTeKty156FrhNLBP' --target-type 'container'
Success with retcode 0
Output: 
Parsed chain:
Chain ID: chain-id-0x61f14197cf7f8
     HEX: 636861696e2d69642d307836316631343139376366376638
Rules:

	Status: Access denied
	Any: false
	Conditions:
		Resource check_key StringNotEquals check_value
		Request $Actor:role StringEquals others
	Actions:	Inverted:false
		GetObject
		HeadObject
		PutObject
	Resources:	Inverted:false
		native:object/*
Rule has been added.
Chain ID:  chain-id-0x61f14197cf7f8

Put COMPLEX object with attribute check_key=check_value. It should pass the rule, since check_value is equals the rule (which is StringNotEquals).

frostfs-cli --config others.yml object put --rpc-endpoint '10.10.10.100' --cid 'J93jqd38xy49pEukYx1Hxf6jLFtccTeKty156FrhNLBP' --file 'TemporaryDir/object-0x61f1411591dd4' --attributes 'check_key=check_value'

IMPORTANT NOTE:
Same issue may happen if we do ResourceCondition "check_key"="" (i.e. we want to deny objects with empty attribute) and put complex object with this attribute not empty.

Context

Migration of ACL => APE autotests

Regression

No(?)

## Expected Behavior Successfull object put ## Current Behavior ``` Error with retcode 1 Output: rpc error: client failure: status: code = 1024 message = incomplete object PUT by placement: could not write header: (*putsvc.remoteTarget) could not put single object to [/ip4/192.168.201.173/tcp/8080 /ip4/192.168.200.173/tcp/8080]: put single object via client: status: code = 2048 message = access to object operation denied ``` ## Possible Solution No fix can be suggested by a QA engineer. Further solutions shall be up to developers. ## Steps to Reproduce (for bugs) 1. Create public container with owner wallet ``` frostfs-cli --config owner.yml container create --rpc-endpoint '10.10.10.100' --basic-acl '0FBFBFFF' --await --policy 'REP 2 IN X CBF 1 SELECT 4 FROM * AS X' Success with retcode 0 Output: CID: J93jqd38xy49pEukYx1Hxf6jLFtccTeKty156FrhNLBP ``` 2. Deny placement for others with ResourceCondition "check_key"!="check_value" (StringNotEquals) ``` 11:57:28 [INFO] Command: frostfs-cli --config owner ape-manager add --rpc-endpoint '10.10.10.100' --chain-id 'chain-id-0x61f14197cf7f8' --rule 'deny object.get object.head object.put ResourceCondition:"check_key"!="check_value" RequestCondition:"\$Actor:role"=others *' --target-name 'J93jqd38xy49pEukYx1Hxf6jLFtccTeKty156FrhNLBP' --target-type 'container' Success with retcode 0 Output: Parsed chain: Chain ID: chain-id-0x61f14197cf7f8 HEX: 636861696e2d69642d307836316631343139376366376638 Rules: Status: Access denied Any: false Conditions: Resource check_key StringNotEquals check_value Request $Actor:role StringEquals others Actions: Inverted:false GetObject HeadObject PutObject Resources: Inverted:false native:object/* Rule has been added. Chain ID: chain-id-0x61f14197cf7f8 ``` 3. Put **COMPLEX** object with attribute `check_key=check_value`. It should pass the rule, since `check_value` is equals the rule (which is StringNotEquals). ``` frostfs-cli --config others.yml object put --rpc-endpoint '10.10.10.100' --cid 'J93jqd38xy49pEukYx1Hxf6jLFtccTeKty156FrhNLBP' --file 'TemporaryDir/object-0x61f1411591dd4' --attributes 'check_key=check_value' ``` IMPORTANT NOTE: Same issue may happen if we do `ResourceCondition "check_key"=""` (i.e. we want to deny objects with empty attribute) and put complex object with this attribute not empty. ## Context Migration of ACL => APE autotests ## Regression No(?)

abereziny added the

bug

triage

labels 2024-08-07 10:29:58 +00:00

aarifullin commented

2024-08-07 10:40:40 +00:00

Member

This can be checked with frostfs-dev-env but the object must be huge

dd if=/dev/urandom of=random_payload.bin bs=1M count=65

If you try to upload random_payload.bin by object put, then you'll encounter the error. This happens because the compex object parts are sent without attributes but

Resource check_key StringNotEquals check_value

works out although attribute doesn't come ("" != "check_value" == true). So, this probably requires a change within policy-engine that should read value by presented key.

The problem that @abereziny is struggling can be temporarily solved by this

--rule  'deny object.get object.head object.put ResourceCondition:"check_key"!="check_value" ResourceCondition:"check_key"!="" RequestCondition:"\$Actor:role"=others *'

This can be checked with `frostfs-dev-env` but the object must be huge ```bash dd if=/dev/urandom of=random_payload.bin bs=1M count=65 ``` If you try to upload `random_payload.bin` by `object put`, then you'll encounter the error. This happens because the compex object parts are sent without attributes but ``` Resource check_key StringNotEquals check_value ``` works out although attribute doesn't come (`"" != "check_value" == true`). So, this probably requires a change within `policy-engine` that should read value by presented key. The problem that @abereziny is struggling can be **temporarily** solved by this ``` --rule 'deny object.get object.head object.put ResourceCondition:"check_key"!="check_value" ResourceCondition:"check_key"!="" RequestCondition:"\$Actor:role"=others *' ```

aarifullin self-assigned this 2024-09-16 07:35:28 +00:00

aarifullin commented

2024-11-05 08:40:11 +00:00

Member

This can be checked with frostfs-dev-env but the object must be huge
dd if=/dev/urandom of=random_payload.bin bs=1M count=65
If you try to upload random_payload.bin by object put, then you'll encounter the error. This happens because the compex object parts are sent without attributes but
Resource check_key StringNotEquals check_value
works out although attribute doesn't come ("" != "check_value" == true). So, this probably requires a change within policy-engine that should read value by presented key.

The problem that @abereziny is struggling can be temporarily solved by this
--rule  'deny object.get object.head object.put ResourceCondition:"check_key"!="check_value" ResourceCondition:"check_key"!="" RequestCondition:"\$Actor:role"=others *'

TBH, I am barely able to recall the full context of the discussion. Looking at this comment I got an idea that this point actually exists in fact but it's irrelevant to the issue.
I tried to reproduce the issue on the latest commit and got no errors

Same issue may happen if we do ResourceCondition "check_key"="" (i.e. we want to deny objects with empty attribute) and put complex object with this attribute not empty.

This was reproduced neither.
@abereziny, Can you recheck on your own, please?

> This can be checked with `frostfs-dev-env` but the object must be huge > > ```bash > dd if=/dev/urandom of=random_payload.bin bs=1M count=65 > ``` > > If you try to upload `random_payload.bin` by `object put`, then you'll encounter the error. This happens because the compex object parts are sent without attributes but > > ``` > Resource check_key StringNotEquals check_value > ``` > > works out although attribute doesn't come (`"" != "check_value" == true`). So, this probably requires a change within `policy-engine` that should read value by presented key. > > The problem that @abereziny is struggling can be **temporarily** solved by this > > ``` > --rule 'deny object.get object.head object.put ResourceCondition:"check_key"!="check_value" ResourceCondition:"check_key"!="" RequestCondition:"\$Actor:role"=others *' > ``` TBH, I am barely able to recall the full context of the discussion. Looking at this comment I got an idea that this point actually exists in fact but it's irrelevant to the issue. I tried to reproduce the issue on the latest commit and got no errors > Same issue may happen if we do ResourceCondition "check_key"="" (i.e. we want to deny objects with empty attribute) and put complex object with this attribute not empty. This was reproduced neither. @abereziny, Can you recheck on your own, please?