TrueCloudLab/frostfs-node
20
1
Fork 27
Code Issues 93 Pull requests 4 Projects Releases 1 Activity Actions

object: Introduce soft ape checks #986

Merged
fyrchik merged 3 commits from aarifullin/frostfs-node:fix/strict_ape_checks into master 2024-02-28 19:05:58 +00:00
Conversation 4 Commits 3 Files changed 9 +340 -112
aarifullin commented 2024-02-14 11:17:55 +00:00
Member
Copy link
  • Soft APE check means that APE should allow request even it gets status NoRuleFound for a request. Otherwise, it is interpreted as Deny
  • Soft APE check is performed if basic ACL mask is not set.
    * The PR also introduce a new action Object.* and Container.* to make possible to define a rule for all methods
  • Make default deny for NoRuleFound in container service
  • Ignore basic acl checks in tree service, if the mask in unset
* Soft APE check means that APE should allow request even it gets status NoRuleFound for a request. Otherwise, it is interpreted as Deny * Soft APE check is performed if basic ACL mask is not set. ~~* The PR also introduce a new action `Object.*` and `Container.*` to make possible to define a rule for all methods~~ * Make default deny for NoRuleFound in container service * Ignore basic acl checks in tree service, if the mask in unset
aarifullin added the
P0
 label 2024-02-14 11:17:55 +00:00
aarifullin force-pushed fix/strict_ape_checks from d1a1d98f95 to f697ca511b 2024-02-14 11:18:27 +00:00 Compare
aarifullin requested review from storage-core-committers 2024-02-14 11:18:34 +00:00
aarifullin requested review from storage-core-developers 2024-02-14 11:18:44 +00:00
fyrchik requested review from alexvanin 2024-02-14 11:20:15 +00:00
fyrchik requested review from dkirillov 2024-02-14 11:20:17 +00:00
dkirillov commented 2024-02-14 11:50:24 +00:00
Member
Copy link

We have to also add the similar check for tree service. See f697ca511b/pkg/services/tree/signature.go (L79-L87)

We have to also add the similar check for tree service. See https://git.frostfs.info/aarifullin/frostfs-node/src/commit/f697ca511b9623888f53bdd7e78eb19079979b0f/pkg/services/tree/signature.go#L79-L87
acid-ant commented 2024-02-14 13:30:55 +00:00
Member
Copy link

Looks like needs to reword commit message a bit:
enabled is basic ACL mask is not set --> enabled if basic ACL mask is not set

Looks like needs to reword commit message a bit: enabled is basic ACL mask is not set --> enabled if basic ACL mask is not set
acid-ant reviewed 2024-02-14 13:43:59 +00:00
pkg/services/object/acl/v2/request.go Outdated
@ -107,0 +108,4 @@
// Strict APE check denies a request if CheckAPE returns NoRuleFound for it,
// otherwise it allows the request. It is taken for enabled if no bits are set
// within basic ACL mask.
func (r RequestInfo) IsStrictAPECheck() bool {
acid-ant commented 2024-02-14 13:43:59 +00:00
Member
Copy link

You are always using NOT operator with result of this function and with field StrictAPECheck. How about to replace it with SoftAPECheck?

You are always using NOT operator with result of this function and with field `StrictAPECheck`. How about to replace it with `SoftAPECheck`?
aarifullin commented 2024-02-14 15:25:46 +00:00
Author
Member
Copy link

Replaced to SoftAPECheck. Could u check please if I've left mistakes. Also, I fixed commit message

Replaced to `SoftAPECheck`. Could u check please if I've left mistakes. Also, I fixed commit message
aarifullin force-pushed fix/strict_ape_checks from f697ca511b to 6af79d2d6e 2024-02-14 15:25:10 +00:00 Compare
aarifullin changed title from object: Introduce strict ape checks to object: Introduce soft ape checks 2024-02-14 15:27:30 +00:00
aarifullin force-pushed fix/strict_ape_checks from 6af79d2d6e to d4fee9d5b8 2024-02-14 16:06:20 +00:00 Compare
fyrchik commented 2024-02-15 07:35:06 +00:00
Owner
Copy link

Unit tests fail
What other testing was done?

Unit tests fail What other testing was done?
aarifullin force-pushed fix/strict_ape_checks from d4fee9d5b8 to 259208161e 2024-02-15 10:25:08 +00:00 Compare
aarifullin force-pushed fix/strict_ape_checks from 259208161e to 2943a56b76 2024-02-15 10:29:14 +00:00 Compare
dstepanov-yadro approved these changes 2024-02-15 10:49:16 +00:00
aarifullin added 1 commit 2024-02-15 11:01:39 +00:00
[#986] tree: Skip ACL checks if basicACL mask is unset
All checks were successful
DCO action / DCO (pull_request) Successful in 3m7s
Details
Vulncheck / Vulncheck (pull_request) Successful in 3m5s
Details
Build / Build Components (1.20) (pull_request) Successful in 3m55s
Details
Build / Build Components (1.21) (pull_request) Successful in 3m51s
Details
Tests and linters / Staticcheck (pull_request) Successful in 4m30s
Details
Tests and linters / Lint (pull_request) Successful in 5m19s
Details
Tests and linters / Tests (1.20) (pull_request) Successful in 5m56s
Details
Tests and linters / Tests (1.21) (pull_request) Successful in 6m6s
Details
Tests and linters / Tests with -race (pull_request) Successful in 7m25s
Details
98ce78be0a 
Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>
aarifullin reviewed 2024-02-15 11:05:14 +00:00
pkg/services/tree/signature.go Outdated
@ -79,1 +79,4 @@
basicACL := cnr.Value.BasicACL()
// Basic ACL mask can be unset, if a container operations are performed
// with strict APE checks only.
if basicACL == 0x0 {
aarifullin commented 2024-02-15 11:05:14 +00:00
Author
Member
Copy link

@dkirillov

Since, basic acl checks are skipped in tree service if the mask is unset

@dkirillov Since, basic acl checks are skipped in tree service if the mask is unset
aarifullin commented 2024-02-15 11:07:30 +00:00
Author
Member
Copy link

Unit tests fail
What other testing was done?

Fixed unit-tests. The failures occured because no allow policy was set

> Unit tests fail > What other testing was done? Fixed unit-tests. The failures occured because no allow policy was set
acid-ant approved these changes 2024-02-15 12:25:07 +00:00
aarifullin requested review from dstepanov-yadro 2024-02-16 11:34:53 +00:00
dstepanov-yadro approved these changes 2024-02-16 11:36:45 +00:00
aarifullin force-pushed fix/strict_ape_checks from 98ce78be0a to 511a8527d9 2024-02-20 08:14:39 +00:00 Compare
dkirillov approved these changes 2024-02-21 06:44:20 +00:00
alexvanin approved these changes 2024-02-22 07:08:56 +00:00
aarifullin requested review from dstepanov-yadro 2024-02-26 07:09:38 +00:00
aarifullin requested review from acid-ant 2024-02-26 07:09:41 +00:00
dstepanov-yadro approved these changes 2024-02-26 08:01:02 +00:00
acid-ant approved these changes 2024-02-26 08:03:22 +00:00
fyrchik merged commit 75a1a95c2c into master 2024-02-28 19:05:58 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
dkirillov
alexvanin
dstepanov-yadro
acid-ant
TrueCloudLab/storage-core-developers
Labels
Clear labels   
P0

Highest

  
P1

High

  
P2

Medium

  
P3

Low

  
badger

Badger DB related issues

  
frostfs-adm

   
frostfs-cli

   
frostfs-ir

   
frostfs-lens

   
frostfs-node

   
good first issue

Good for newcomers

  
triage
  
Infrastructure

Infrastructure, Automation, CI/CD or DevOps related stuff

  
blocked

The issue or PR is blocked by something

  
bug

Something is not working

  
config

Configuration format update or breaking change

  
discussion

Talking about something in order to reach a decision or to exchange ideas

  
documentation

Documentation related

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
go

Language features adoption

  
help wanted

Extra attention is needed

  
internal

   
invalid

Something is wrong

  
kludge

This is a kludge and we know it

  
observability

Related to metrics, tracing and logs

  
perfomance

Perfomance related

  
question

More information is needed

  
refactoring

Refactoring

  
wontfix

This won't be fixed

No labels
P0
P1
P2
P3
badger
frostfs-adm
frostfs-cli
frostfs-ir
frostfs-lens
frostfs-node
good first issue
triage
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
6 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/frostfs-node#986
No description provided.
Delete branch "aarifullin/frostfs-node:fix/strict_ape_checks"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?