package ape import ( "context" "crypto/sha256" "fmt" "net" "strconv" objectV2 "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/object" aperequest "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/request" "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/netmap" "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/object" "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl" cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id" objectSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object" oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id" "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user" commonschema "git.frostfs.info/TrueCloudLab/policy-engine/schema/common" nativeschema "git.frostfs.info/TrueCloudLab/policy-engine/schema/native" "github.com/nspcc-dev/neo-go/pkg/crypto/keys" "google.golang.org/grpc/peer" ) var defaultRequest = aperequest.Request{} func nativeSchemaRole(role acl.Role) string { switch role { case acl.RoleOwner: return nativeschema.PropertyValueContainerRoleOwner case acl.RoleContainer: return nativeschema.PropertyValueContainerRoleContainer case acl.RoleInnerRing: return nativeschema.PropertyValueContainerRoleIR case acl.RoleOthers: return nativeschema.PropertyValueContainerRoleOthers default: return "" } } func resourceName(cid cid.ID, oid *oid.ID, namespace string) string { if namespace == "root" || namespace == "" { if oid != nil { return fmt.Sprintf(nativeschema.ResourceFormatRootContainerObject, cid.EncodeToString(), oid.EncodeToString()) } return fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, cid.EncodeToString()) } if oid != nil { return fmt.Sprintf(nativeschema.ResourceFormatNamespaceContainerObject, namespace, cid.EncodeToString(), oid.EncodeToString()) } return fmt.Sprintf(nativeschema.ResourceFormatNamespaceContainerObjects, namespace, cid.EncodeToString()) } // objectProperties collects object properties from address parameters and a header if it is passed. func objectProperties(cnr cid.ID, oid *oid.ID, cnrOwner user.ID, header *objectV2.Header) map[string]string { objectProps := map[string]string{ nativeschema.PropertyKeyObjectContainerID: cnr.EncodeToString(), } objectProps[nativeschema.PropertyKeyContainerOwnerID] = cnrOwner.EncodeToString() if oid != nil { objectProps[nativeschema.PropertyKeyObjectID] = oid.String() } if header == nil { return objectProps } objV2 := new(objectV2.Object) objV2.SetHeader(header) objSDK := objectSDK.NewFromV2(objV2) objectProps[nativeschema.PropertyKeyObjectVersion] = objSDK.Version().String() objectProps[nativeschema.PropertyKeyObjectOwnerID] = objSDK.OwnerID().EncodeToString() objectProps[nativeschema.PropertyKeyObjectCreationEpoch] = strconv.Itoa(int(objSDK.CreationEpoch())) objectProps[nativeschema.PropertyKeyObjectPayloadLength] = strconv.Itoa(int(objSDK.PayloadSize())) objectProps[nativeschema.PropertyKeyObjectType] = objSDK.Type().String() pcs, isSet := objSDK.PayloadChecksum() if isSet { objectProps[nativeschema.PropertyKeyObjectPayloadHash] = pcs.String() } hcs, isSet := objSDK.PayloadHomomorphicHash() if isSet { objectProps[nativeschema.PropertyKeyObjectHomomorphicHash] = hcs.String() } for _, attr := range header.GetAttributes() { objectProps[attr.GetKey()] = attr.GetValue() } return objectProps } // newAPERequest creates an APE request to be passed to a chain router. It collects resource properties from // header provided by headerProvider. If it cannot be found in headerProvider, then properties are // initialized from header given in prm (if it is set). Otherwise, just CID and OID are set to properties. func (c *checkerImpl) newAPERequest(ctx context.Context, prm Prm) (aperequest.Request, error) { switch prm.Method { case nativeschema.MethodGetObject, nativeschema.MethodHeadObject, nativeschema.MethodRangeObject, nativeschema.MethodHashObject, nativeschema.MethodDeleteObject, nativeschema.MethodPatchObject: if prm.Object == nil { return defaultRequest, fmt.Errorf("method %s: %w", prm.Method, errMissingOID) } case nativeschema.MethodSearchObject, nativeschema.MethodPutObject: default: return defaultRequest, fmt.Errorf("unknown method: %s", prm.Method) } var header *objectV2.Header if prm.Header != nil { header = prm.Header } else if prm.Object != nil && !prm.WithoutHeaderRequest { headerObjSDK, err := c.headerProvider.GetHeader(ctx, prm.Container, *prm.Object, true) if err == nil { header = headerObjSDK.ToV2().GetHeader() } } header = c.fillHeaderWithECParent(ctx, prm, header) reqProps := map[string]string{ nativeschema.PropertyKeyActorPublicKey: prm.SenderKey, nativeschema.PropertyKeyActorRole: prm.Role, } for _, xhead := range prm.XHeaders { xheadKey := fmt.Sprintf(commonschema.PropertyKeyFrostFSXHeader, xhead.GetKey()) reqProps[xheadKey] = xhead.GetValue() } var err error reqProps, err = c.fillWithUserClaimTags(reqProps, prm) if err != nil { return defaultRequest, err } if p, ok := peer.FromContext(ctx); ok { if tcpAddr, ok := p.Addr.(*net.TCPAddr); ok { reqProps[commonschema.PropertyKeyFrostFSSourceIP] = tcpAddr.IP.String() } } return aperequest.NewRequest( prm.Method, aperequest.NewResource( resourceName(prm.Container, prm.Object, prm.Namespace), objectProperties(prm.Container, prm.Object, prm.ContainerOwner, header), ), reqProps, ), nil } func (c *checkerImpl) fillHeaderWithECParent(ctx context.Context, prm Prm, header *objectV2.Header) *objectV2.Header { if header == nil { return header } if header.GetEC() == nil { return header } if prm.Role == nativeschema.PropertyValueContainerRoleContainer || prm.Role == nativeschema.PropertyValueContainerRoleIR { return header } parentObjRefID := header.GetEC().Parent if parentObjRefID == nil { return header } var parentObjID oid.ID if err := parentObjID.ReadFromV2(*parentObjRefID); err != nil { return header } // only container node have access to collect parent object contNode, err := c.currentNodeIsContainerNode(prm.Container) if err != nil || !contNode { return header } parentObj, err := c.headerProvider.GetHeader(ctx, prm.Container, parentObjID, false) if err != nil { return header } return parentObj.ToV2().GetHeader() } func (c *checkerImpl) currentNodeIsContainerNode(cnrID cid.ID) (bool, error) { cnr, err := c.cnrSource.Get(cnrID) if err != nil { return false, err } nm, err := netmap.GetLatestNetworkMap(c.nm) if err != nil { return false, err } idCnr := make([]byte, sha256.Size) cnrID.Encode(idCnr) in, err := object.LookupKeyInContainer(nm, c.nodePK, idCnr, cnr.Value) if err != nil { return false, err } else if in { return true, nil } nm, err = netmap.GetPreviousNetworkMap(c.nm) if err != nil { return false, err } return object.LookupKeyInContainer(nm, c.nodePK, idCnr, cnr.Value) } // fillWithUserClaimTags fills ape request properties with user claim tags getting them from frostfsid contract by actor public key. func (c *checkerImpl) fillWithUserClaimTags(reqProps map[string]string, prm Prm) (map[string]string, error) { if reqProps == nil { reqProps = make(map[string]string) } pk, err := keys.NewPublicKeyFromString(prm.SenderKey) if err != nil { return nil, err } props, err := aperequest.FormFrostfsIDRequestProperties(c.frostFSIDClient, pk) if err != nil { return reqProps, err } for propertyName, properyValue := range props { reqProps[propertyName] = properyValue } return reqProps, nil }