TrueCloudLab/frostfs-node
21
1
Fork 27
Code Issues 107 Pull requests 3 Projects Releases 2 Activity Actions

eACL -> APE converter #800

Merged
fyrchik merged 1 commit from dstepanov-yadro/frostfs-node:feat/eacl_ape_converter into master 2023-11-15 15:12:31 +00:00
Conversation 0 Commits 1 Files changed 6 +747 -28
dstepanov-yadro commented 2023-11-10 08:43:03 +00:00
Member
Copy link

Closes TrueCloudLab/policy-engine#10

Added converter and unit tests.

Closes https://git.frostfs.info/TrueCloudLab/policy-engine/issues/10 Added converter and unit tests.
dstepanov-yadro force-pushed feat/eacl_ape_converter from 58c0ae8e62 to 8043f01890 2023-11-10 13:00:24 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from 8043f01890 to 193811da22 2023-11-10 13:28:11 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from 193811da22 to 504e524371 2023-11-13 09:27:25 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from 504e524371 to abab227a9b 2023-11-13 09:39:10 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from abab227a9b to 536bdef019 2023-11-13 11:18:59 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from 536bdef019 to d65f3a46d5 2023-11-13 12:55:09 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from d65f3a46d5 to b5497e44d2 2023-11-13 13:13:46 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from b5497e44d2 to daeae06d6b 2023-11-13 13:23:23 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from daeae06d6b to 28c6578506 2023-11-13 13:51:37 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from 28c6578506 to 2bf4fbec31 2023-11-13 14:07:07 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from 2bf4fbec31 to 91eb9cb960 2023-11-13 14:08:19 +00:00 Compare
dstepanov-yadro changed title from WIP: eACL -> APE converter to eACL -> APE converter 2023-11-13 14:09:25 +00:00
dstepanov-yadro requested review from storage-core-committers 2023-11-13 14:09:37 +00:00
dstepanov-yadro requested review from storage-core-developers 2023-11-13 14:37:02 +00:00
dstepanov-yadro force-pushed feat/eacl_ape_converter from 91eb9cb960 to 6476b81a87 2023-11-13 14:44:00 +00:00 Compare
aarifullin reviewed 2023-11-13 15:05:57 +00:00
internal/ape/converter.go Outdated
@ -0,0 +150,4 @@
cond.Op = policyengine.CondStringEquals
} else if filter.Matcher() == eacl.MatchStringNotEqual {
cond.Op = policyengine.CondStringNotEquals
}
aarifullin commented 2023-11-13 15:05:57 +00:00
Member
Copy link

The converter ignores else { /**/ } for filter.From() and filter.Matcher() and it means that invalid/incorrect filter

filter.from = eacl.HeaderTypeUnknown
filter.matcher = eacl.MatchUnknown

is converted to valid:

cond.Object = policyengine.ObjectResource
cond.Op = policyengine.CondStringEquals

Either we need to reject appending the cond to the result or we need to introduce policyengine.ObjectUnknown/policyengine.CondUnknown

The converter ignores `else { /**/ }` for `filter.From()` and `filter.Matcher()` and it means that invalid/incorrect filter ```golang filter.from = eacl.HeaderTypeUnknown filter.matcher = eacl.MatchUnknown ``` is converted to valid: ```golang cond.Object = policyengine.ObjectResource cond.Op = policyengine.CondStringEquals ``` Either we need to reject appending the `cond` to the result or we need to introduce `policyengine.ObjectUnknown/policyengine.CondUnknown`
dstepanov-yadro commented 2023-11-13 15:16:33 +00:00
Author
Member
Copy link

fixed

fixed
aarifullin marked this conversation as resolved
dstepanov-yadro force-pushed feat/eacl_ape_converter from 6476b81a87 to 2fbea9fd91 2023-11-13 15:16:18 +00:00 Compare
aarifullin reviewed 2023-11-13 15:16:49 +00:00
internal/ape/consts.go Outdated
@ -0,0 +9,4 @@
NativeRangeObject = "RangeObject"
NativeHashObject = "HashObject"
NativeResourceFormatAllContainers = "native::object/%s"
aarifullin commented 2023-11-13 15:16:49 +00:00
Member
Copy link

Could you, please, add explanatory comment for this format?

I am talking about native:[optonal_something?]:

Could you, please, add explanatory comment for this format? I am talking about `native:[optonal_something?]:`
dstepanov-yadro commented 2023-11-14 12:28:00 +00:00
Author
Member
Copy link

Moved to police-engine repository

Moved to `police-engine` repository
dstepanov-yadro force-pushed feat/eacl_ape_converter from 2fbea9fd91 to 00e2a6a854 2023-11-14 10:36:34 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from 00e2a6a854 to 9f7646fcc4 2023-11-14 12:28:30 +00:00 Compare
aarifullin approved these changes 2023-11-14 17:52:01 +00:00
aarifullin left a comment
Member
Copy link

Brilliant

Brilliant
acid-ant approved these changes 2023-11-15 07:24:59 +00:00
fyrchik reviewed 2023-11-15 08:28:10 +00:00
cmd/frostfs-cli/modules/util/ape.go Outdated
@ -134,7 +138,6 @@ const (
var typeToCondObject = map[string]policyengine.ObjectType{
ObjectResource: policyengine.ObjectResource,
ObjectRequest: policyengine.ObjectRequest,
ObjectActor: policyengine.ObjectActor,
fyrchik commented 2023-11-15 08:22:08 +00:00
Owner
Copy link

Also remove the constant ObjectActor?

Also remove the constant `ObjectActor`?
dstepanov-yadro commented 2023-11-15 08:54:46 +00:00
Author
Member
Copy link

Done

Done
fyrchik marked this conversation as resolved
cmd/frostfs-cli/modules/util/ape_test.go Outdated
@ -21,3 +21,2 @@
Status: policyengine.Allow,
Action: []string{"native:PutObject"},
Resource: []string{"native:::object/*"},
Actions: policyengine.Actions{Names: []string{"PutObject"}},
fyrchik commented 2023-11-15 08:28:03 +00:00
Owner
Copy link

Why not use constants here?

Why not use constants here?
dstepanov-yadro commented 2023-11-15 08:54:53 +00:00
Author
Member
Copy link

Fixed

Fixed
fyrchik marked this conversation as resolved
internal/ape/converter.go Outdated
@ -0,0 +87,4 @@
var pubKeyCondition policyengine.Condition
pubKeyCondition.Object = policyengine.ObjectRequest
pubKeyCondition.Key = nativeschema.PropertyKeyActorPublicKey
pubKeyCondition.Value = string(binKey)
fyrchik commented 2023-11-15 08:24:20 +00:00
Owner
Copy link

Will we store binary non-UTF-8 data in Value field here?

Will we store binary non-UTF-8 data in `Value` field here?
dstepanov-yadro commented 2023-11-15 08:55:04 +00:00
Author
Member
Copy link

Replaced with hex

Replaced with hex
fyrchik commented 2023-11-15 09:48:51 +00:00
Owner
Copy link

Wanted some discussion here -- matching binary data is a valid usecase (all ids are in base58 now, public key in hex, but could be in binary).
There is another problem with public key -- it can have 2 formats in hex (short = 0x02|0x03 + 32 bytes or long = 0x04 + 64 bytes), both denote the same entity.

Looks ok now (in practice 0x04 encoding is rare), but maybe we could extend operations in policy engine, having this in mind.

Wanted some discussion here -- matching binary data is a valid usecase (all ids are in base58 now, public key in hex, but could be in binary). There is another problem with public key -- it can have 2 formats in hex (short = 0x02|0x03 + 32 bytes or long = 0x04 + 64 bytes), both denote the same entity. Looks ok now (in practice 0x04 encoding is rare), but maybe we could extend operations in policy engine, having this in mind.
fyrchik marked this conversation as resolved
dstepanov-yadro force-pushed feat/eacl_ape_converter from 9f7646fcc4 to ee0fa8d718 2023-11-15 08:53:13 +00:00 Compare
dstepanov-yadro force-pushed feat/eacl_ape_converter from ee0fa8d718 to fd9128d051 2023-11-15 08:56:13 +00:00 Compare
aarifullin approved these changes 2023-11-15 10:37:25 +00:00
fyrchik approved these changes 2023-11-15 15:12:25 +00:00
fyrchik merged commit fd9128d051 into master 2023-11-15 15:12:31 +00:00
fyrchik referenced this pull request from a commit 2023-11-15 15:12:33 +00:00
[#800] node: eACL -> APE converter
Sign in to join this conversation.
Reviewers
No reviewers
acid-ant
aarifullin
fyrchik
Labels
Clear labels   
P0

Highest

  
P1

High

  
P2

Medium

  
P3

Low

  
badger

Badger DB related issues

  
frostfs-adm

   
frostfs-cli

   
frostfs-ir

   
frostfs-lens

   
frostfs-node

   
good first issue

Good for newcomers

  
triage
  
Infrastructure

Infrastructure, Automation, CI/CD or DevOps related stuff

  
blocked

The issue or PR is blocked by something

  
bug

Something is not working

  
config

Configuration format update or breaking change

  
discussion

Talking about something in order to reach a decision or to exchange ideas

  
documentation

Documentation related

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
go

Language features adoption

  
help wanted

Extra attention is needed

  
internal

   
invalid

Something is wrong

  
kludge

This is a kludge and we know it

  
observability

Related to metrics, tracing and logs

  
perfomance

Perfomance related

  
question

More information is needed

  
refactoring

Refactoring

  
wontfix

This won't be fixed

No labels
P0
P1
P2
P3
badger
frostfs-adm
frostfs-cli
frostfs-ir
frostfs-lens
frostfs-node
good first issue
triage
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/frostfs-node#800
No description provided.
Delete branch "dstepanov-yadro/frostfs-node:feat/eacl_ape_converter"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?