Malformed request: token is invalid at epoch doesn't fit to `SessionTokenExpired` #20

New issue

Closed

opened 2023-01-20 06:45:45 +00:00 by KirillovDenis · 1 comment

KirillovDenis commented

2023-01-20 06:45:45 +00:00

(Migrated from github.com)

Using expired session token for object operations leads to apistatus.ServerInternal (status: code = 1024 message = malformed request: token is invalid at 5 epoch)) rather than apistatus.SessionTokenExpired

Additionally, is it ok to have alone ) in the end of error message ?
d4d2a8c865/pkg/services/object/acl/v2/service.go (L577-L578)

Expected Behavior

Expected api status SessionTokenExpired

Current Behavior

Current status ServerInternalError

Steps to Reproduce (for bugs)

Create bucket
Create object
Run the following test:

const devEnvPrivateKey = "1dd37fba80fec4e6a6f13fd708d8dcb3b29def768017052f6c930fa1c5d90bbb"

func TestTMPDEBUG(t *testing.T) {
	ctx := context.Background()

	key, err := keys.NewPrivateKeyFromHex(devEnvPrivateKey)
	require.NoError(t, err)

	var cl sdkClient.Client
	var prmInit sdkClient.PrmInit
	prmInit.SetDefaultPrivateKey(key.PrivateKey)

	cl.Init(prmInit)

	var prmDial sdkClient.PrmDial
	prmDial.SetServerURI("s01.frostfs.devenv:8080")
	prmDial.SetContext(ctx)

	err = cl.Dial(prmDial)
	require.NoError(t, err)

	var cnrID cid.ID
	err = cnrID.DecodeString("FrjgqGnj7f6J7bmieokw3oHtLWb2ef9k7oLQKyvdaxVC")
	require.NoError(t, err)

	var objID oid.ID
	err = objID.DecodeString("BtVoDQsNLdV5hURoECdDz3MBX5pqobAw332zvEkKh62C")
	require.NoError(t, err)

	exp := uint64(1)

	var prmSess sdkClient.PrmSessionCreate
	prmSess.SetExp(exp)

	sessRes, err := cl.SessionCreate(ctx, prmSess)
	require.NoError(t, err)

	var id uuid.UUID
	err = id.UnmarshalBinary(sessRes.ID())
	require.NoError(t, err)

	var authKey frostfsecdsa.PublicKey
	err = authKey.Decode(sessRes.PublicKey())
	require.NoError(t, err)

	var prm sdkClient.PrmObjectHead
	prm.FromContainer(cnrID)
	prm.ByID(objID)

	var stoken session.Object
	stoken.SetExp(exp)
	stoken.LimitByObjects(objID)
	stoken.BindContainer(cnrID)
	stoken.ForVerb(session.VerbObjectHead)
	stoken.SetAuthKey(&authKey)
	stoken.SetID(id)
	stoken.Issuer()

	err = stoken.Sign(key.PrivateKey)
	require.NoError(t, err)

	prm.WithinSession(stoken)

	res, err := cl.ObjectHead(ctx, prm)
	require.NoError(t, err)

	fmt.Println("status: ", res.Status())
	err = apistatus.ErrFromStatus(res.Status())
	fmt.Println("isErrSessionExpired: ", sdkClient.IsErrSessionExpired(err))
}

Context

Pool from SDK expects SessionTokenExpired to invalidate cache.

It seems the same problem there is in this branch

Your Environment

Version used: v0.34.0-164-gd4d2a8c8
Server setup and configuration: dev-env

@dansingjulia It's related to AccessDenied error in s3 tests

/cc @alexvanin @fyrchik

Using expired session token for object operations leads to `apistatus.ServerInternal` (`status: code = 1024 message = malformed request: token is invalid at 5 epoch)`) rather than `apistatus.SessionTokenExpired` Additionally, is it ok to have alone `)` in the end of error message ? https://github.com/TrueCloudLab/frostfs-node/blob/d4d2a8c8651cdd4da62571bb86bcbc019e3b48ae/pkg/services/object/acl/v2/service.go#L577-L578 ## Expected Behavior Expected api status `SessionTokenExpired` ## Current Behavior Current status `ServerInternalError` ## Steps to Reproduce (for bugs) 1. Create bucket 2. Create object 3. Run the following test: ```go const devEnvPrivateKey = "1dd37fba80fec4e6a6f13fd708d8dcb3b29def768017052f6c930fa1c5d90bbb" func TestTMPDEBUG(t *testing.T) { ctx := context.Background() key, err := keys.NewPrivateKeyFromHex(devEnvPrivateKey) require.NoError(t, err) var cl sdkClient.Client var prmInit sdkClient.PrmInit prmInit.SetDefaultPrivateKey(key.PrivateKey) cl.Init(prmInit) var prmDial sdkClient.PrmDial prmDial.SetServerURI("s01.frostfs.devenv:8080") prmDial.SetContext(ctx) err = cl.Dial(prmDial) require.NoError(t, err) var cnrID cid.ID err = cnrID.DecodeString("FrjgqGnj7f6J7bmieokw3oHtLWb2ef9k7oLQKyvdaxVC") require.NoError(t, err) var objID oid.ID err = objID.DecodeString("BtVoDQsNLdV5hURoECdDz3MBX5pqobAw332zvEkKh62C") require.NoError(t, err) exp := uint64(1) var prmSess sdkClient.PrmSessionCreate prmSess.SetExp(exp) sessRes, err := cl.SessionCreate(ctx, prmSess) require.NoError(t, err) var id uuid.UUID err = id.UnmarshalBinary(sessRes.ID()) require.NoError(t, err) var authKey frostfsecdsa.PublicKey err = authKey.Decode(sessRes.PublicKey()) require.NoError(t, err) var prm sdkClient.PrmObjectHead prm.FromContainer(cnrID) prm.ByID(objID) var stoken session.Object stoken.SetExp(exp) stoken.LimitByObjects(objID) stoken.BindContainer(cnrID) stoken.ForVerb(session.VerbObjectHead) stoken.SetAuthKey(&authKey) stoken.SetID(id) stoken.Issuer() err = stoken.Sign(key.PrivateKey) require.NoError(t, err) prm.WithinSession(stoken) res, err := cl.ObjectHead(ctx, prm) require.NoError(t, err) fmt.Println("status: ", res.Status()) err = apistatus.ErrFromStatus(res.Status()) fmt.Println("isErrSessionExpired: ", sdkClient.IsErrSessionExpired(err)) } ``` ## Context Pool from SDK expects `SessionTokenExpired` to [invalidate cache](https://github.com/TrueCloudLab/frostfs-sdk-go/blob/b2a37543d34da7f96d4e3d35c4e8da4bf1f43a00/pool/pool.go#L1877). It seems the same problem there is in [this branch](https://github.com/nspcc-dev/neofs-node/tree/support/v0.35) ## Your Environment  * Version used: v0.34.0-164-gd4d2a8c8 * Server setup and configuration: dev-env @dansingjulia It's related to AccessDenied error in s3 tests /cc @alexvanin @fyrchik

fyrchik commented

2023-01-25 14:46:16 +00:00

(Migrated from github.com)

Closed via #28 .