TrueCloudLab/frostfs-node
21
1
Fork 27
Code Issues 104 Pull requests 4 Projects Releases 2 Activity Actions

tree: Allow reading requests signed by keys from allow list #458

Merged
fyrchik merged 1 commit from acid-ant/frostfs-node:feature/449-tree-allowed-keys into master 2023-07-26 21:07:59 +00:00
Conversation 1 Commits 1 Files changed 1 +3 -1
acid-ant commented 2023-06-21 11:32:38 +00:00
Member
Copy link

Close #449

Signed-off-by: Anton Nikiforov an.nikiforov@yadro.com

Close #449 Signed-off-by: Anton Nikiforov <an.nikiforov@yadro.com>
acid-ant requested review from storage-core-committers 2023-06-21 11:34:11 +00:00
acid-ant requested review from storage-core-developers 2023-06-21 11:34:11 +00:00
acid-ant force-pushed feature/449-tree-allowed-keys from e7b758e90c to e26fd1f24a 2023-06-21 11:34:35 +00:00 Compare
dstepanov-yadro reviewed 2023-06-21 12:11:35 +00:00
pkg/services/tree/options.go Outdated
@ -127,0 +130,4 @@
// keys that have rights to use Tree service.
func WithAuthorizedKeys(keys [][]byte) Option {
return func(c *cfg) {
c.authorizedKeys = append(c.authorizedKeys, keys...)
dstepanov-yadro commented 2023-06-21 12:11:35 +00:00
Member
Copy link

Looks like in the most of options with slice as argeument (see metabase, blobstore) we replace slice, but not append to slice.

Looks like in the most of options with slice as argeument (see metabase, blobstore) we replace slice, but not append to slice.
acid-ant commented 2023-06-21 12:36:09 +00:00
Author
Member
Copy link

Thanks, fixed.

Thanks, fixed.
acid-ant force-pushed feature/449-tree-allowed-keys from e26fd1f24a to 1579ba24ab 2023-06-21 12:35:56 +00:00 Compare
acid-ant force-pushed feature/449-tree-allowed-keys from 1579ba24ab to a9513f78d2 2023-06-21 12:36:35 +00:00 Compare
fyrchik reviewed 2023-06-21 13:06:04 +00:00
pkg/services/tree/signature.go Outdated
@ -47,11 +47,6 @@ var errBearerSignature = errors.New("invalid bearer token signature")
// - 1. ObjectPut;
// - 2. ObjectGet.
func (s *Service) verifyClient(req message, cid cidSDK.ID, rawBearer []byte, op acl.Op) error {
err := verifyMessage(req)
fyrchik commented 2023-06-21 13:06:04 +00:00
Owner
Copy link

Why did you move it outside?
verifyClient is supposed to be a function which checks access rights.
We have op which is equal to acl.OpObjectGet for read operations.

Why did you move it outside? `verifyClient` is supposed to be a function which checks access rights. We have `op` which is equal to `acl.OpObjectGet` for read operations.
acid-ant commented 2023-06-21 13:23:22 +00:00
Author
Member
Copy link

Oops, the idea was not to do that check twice. Now I see that I can compare key with allow list and after that verify message.

Oops, the idea was not to do that check twice. Now I see that I can compare key with allow list and after that verify message.
acid-ant commented 2023-06-21 14:28:19 +00:00
Author
Member
Copy link

Updated, please review.

Updated, please review.
fyrchik marked this conversation as resolved
acid-ant force-pushed feature/449-tree-allowed-keys from a9513f78d2 to cf8a2837ef 2023-06-21 14:26:59 +00:00 Compare
dstepanov-yadro approved these changes 2023-06-21 15:05:56 +00:00
fyrchik approved these changes 2023-06-21 17:24:31 +00:00
cmd/frostfs-node/config/tree/config.go Outdated
@ -74,0 +78,4 @@
// parameter from "tree" section.
//
// Returns an empty list if not set.
func (c TreeConfig) AuthorizedKeys() [][]byte {
fyrchik commented 2023-06-21 17:24:29 +00:00
Owner
Copy link

Not important, but why not return keys.PublicKeys? This is what we do in a control service and []byte could be a purely tree service optimization.

Not important, but why not return `keys.PublicKeys`? This is what we do in a control service and `[]byte` could be a purely tree service optimization.
acid-ant commented 2023-06-22 06:40:26 +00:00
Author
Member
Copy link

Just want to hide [][]byte creation. Don't mind using PublicKeys. Updated.

Just want to hide `[][]byte` creation. Don't mind using `PublicKeys`. Updated.
fyrchik marked this conversation as resolved
fyrchik reviewed 2023-06-21 17:25:12 +00:00
pkg/services/tree/service.go Outdated
@ -327,3 +327,2 @@
err := s.verifyClient(req, cid, b.GetBearerToken(), acl.OpObjectGet)
if err != nil {
if allowed, err := s.isAuthorizedClient(req); err != nil {
fyrchik commented 2023-06-21 17:25:12 +00:00
Owner
Copy link

Again, why can't we move isAuthorizedClient inside verifyClient?
It is the same access control.

Again, why can't we move `isAuthorizedClient` inside `verifyClient`? It is the same access control.
acid-ant commented 2023-06-22 06:36:51 +00:00
Author
Member
Copy link

Gotcha, updated.

Gotcha, updated.
fyrchik marked this conversation as resolved
acid-ant force-pushed feature/449-tree-allowed-keys from cf8a2837ef to 53a2fd2cee 2023-06-22 06:36:29 +00:00 Compare
fyrchik approved these changes 2023-06-22 12:01:43 +00:00
cmd/frostfs-node/tree.go Outdated
@ -42,6 +42,12 @@ func initTreeService(c *cfg) {
return
}
pubs := treeConfig.AuthorizedKeys()
fyrchik commented 2023-06-22 12:01:40 +00:00
Owner
Copy link

What about doing it inside the service? I mean it accepts public keys, everything else (comparing byte-slices is an internal optimization detail)

What about doing it inside the service? I mean it accepts public keys, everything else (comparing byte-slices is an internal optimization detail)
acid-ant commented 2023-06-22 12:15:03 +00:00
Author
Member
Copy link

omg, where is my head?) Done.

omg, where is my head?) Done.
fyrchik marked this conversation as resolved
acid-ant force-pushed feature/449-tree-allowed-keys from 53a2fd2cee to c9da42232b 2023-06-22 12:14:23 +00:00 Compare
acid-ant commented 2023-06-22 12:16:55 +00:00
Author
Member
Copy link

@fyrchik should we reload these keys on SIGHUP?

@fyrchik should we reload these keys on SIGHUP?
fyrchik reviewed 2023-06-23 08:04:19 +00:00
pkg/services/tree/signature.go Outdated
@ -54,0 +61,4 @@
}
var key = sign.GetKey()
for i := range s.authorizedKeys {
if bytes.Equal(s.authorizedKeys[i].Bytes(), key) {
fyrchik commented 2023-06-23 08:04:19 +00:00
Owner
Copy link

This will lead to multiple allocations on each tree service operation.
Can we cache this [][]byte somehow?
I've meant that WithAuthorizedKeys should accept keys.PublicKeys, but, for example, we can also convert everything to bytes right there.

This will lead to multiple allocations on each tree service operation. Can we cache this `[][]byte` somehow? I've meant that `WithAuthorizedKeys` should accept `keys.PublicKeys`, but, for example, we can also convert everything to bytes right there.
👍 1
acid-ant commented 2023-06-23 08:13:30 +00:00
Author
Member
Copy link

You are right, done.

You are right, done.
fyrchik marked this conversation as resolved
acid-ant force-pushed feature/449-tree-allowed-keys from c9da42232b to 598a278e25 2023-06-23 08:12:48 +00:00 Compare
acid-ant force-pushed feature/449-tree-allowed-keys from 598a278e25 to a3cf8858d7 2023-06-23 08:19:23 +00:00 Compare
acid-ant force-pushed feature/449-tree-allowed-keys from a3cf8858d7 to 8e84452020 2023-06-23 08:25:46 +00:00 Compare
fyrchik approved these changes 2023-06-23 10:11:48 +00:00
acid-ant force-pushed feature/449-tree-allowed-keys from 8e84452020 to ab489265b3 2023-06-23 11:44:27 +00:00 Compare
fyrchik merged commit ab489265b3 into master 2023-06-26 07:12:27 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
dstepanov-yadro
fyrchik
Labels
Clear labels   
P0

Highest

  
P1

High

  
P2

Medium

  
P3

Low

  
badger

Badger DB related issues

  
frostfs-adm

   
frostfs-cli

   
frostfs-ir

   
frostfs-lens

   
frostfs-node

   
good first issue

Good for newcomers

  
triage
  
Infrastructure

Infrastructure, Automation, CI/CD or DevOps related stuff

  
blocked

The issue or PR is blocked by something

  
bug

Something is not working

  
config

Configuration format update or breaking change

  
discussion

Talking about something in order to reach a decision or to exchange ideas

  
documentation

Documentation related

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
go

Language features adoption

  
help wanted

Extra attention is needed

  
internal

   
invalid

Something is wrong

  
kludge

This is a kludge and we know it

  
observability

Related to metrics, tracing and logs

  
perfomance

Perfomance related

  
question

More information is needed

  
refactoring

Refactoring

  
wontfix

This won't be fixed

No labels
P0
P1
P2
P3
badger
frostfs-adm
frostfs-cli
frostfs-ir
frostfs-lens
frostfs-node
good first issue
triage
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/frostfs-node#458
No description provided.
Delete branch "acid-ant/frostfs-node:feature/449-tree-allowed-keys"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?