package ape import ( "crypto/ecdsa" "errors" "fmt" aperequest "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/request" "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/router" frostfsidcore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/frostfsid" "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/netmap" "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ape" "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer" apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status" cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id" "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user" apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain" policyengine "git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine" "github.com/nspcc-dev/neo-go/pkg/crypto/keys" ) var ( errInvalidTargetType = errors.New("bearer token defines non-container target override") errBearerExpired = errors.New("bearer token has expired") errBearerInvalidSignature = errors.New("bearer token has invalid signature") errBearerInvalidContainerID = errors.New("bearer token was created for another container") errBearerNotSignedByOwner = errors.New("bearer token is not signed by the container owner") errBearerInvalidOwner = errors.New("bearer token owner differs from the request sender") ) type CheckPrm struct { // Request is an APE-request that is checked by policy engine. Request aperequest.Request Namespace string Container cid.ID // An encoded container's owner user ID. ContainerOwner user.ID // PublicKey is public key of the request sender. PublicKey *keys.PublicKey // The request's bearer token. It is used in order to check APE overrides with the token. BearerToken *bearer.Token // If SoftAPECheck is set to true, then NoRuleFound is interpreted as allow. SoftAPECheck bool } // CheckCore provides methods to perform the common logic of APE check. type CheckCore interface { // CheckAPE performs the common policy-engine check logic on a prepared request. CheckAPE(prm CheckPrm) error } type checkerCoreImpl struct { LocalOverrideStorage policyengine.LocalOverrideStorage MorphChainStorage policyengine.MorphRuleChainStorageReader FrostFSSubjectProvider frostfsidcore.SubjectProvider State netmap.State } func New(localOverrideStorage policyengine.LocalOverrideStorage, morphChainStorage policyengine.MorphRuleChainStorageReader, frostFSSubjectProvider frostfsidcore.SubjectProvider, state netmap.State, ) CheckCore { return &checkerCoreImpl{ LocalOverrideStorage: localOverrideStorage, MorphChainStorage: morphChainStorage, FrostFSSubjectProvider: frostFSSubjectProvider, State: state, } } // CheckAPE performs the common policy-engine check logic on a prepared request. func (c *checkerCoreImpl) CheckAPE(prm CheckPrm) error { var cr policyengine.ChainRouter if prm.BearerToken != nil && !prm.BearerToken.Impersonate() { var err error if err = isValidBearer(prm.BearerToken, prm.ContainerOwner, prm.Container, prm.PublicKey, c.State); err != nil { return fmt.Errorf("bearer validation error: %w", err) } cr, err = router.BearerChainFeedRouter(c.LocalOverrideStorage, c.MorphChainStorage, prm.BearerToken.APEOverride()) if err != nil { return fmt.Errorf("create chain router error: %w", err) } } else { cr = policyengine.NewDefaultChainRouterWithLocalOverrides(c.MorphChainStorage, c.LocalOverrideStorage) } groups, err := aperequest.Groups(c.FrostFSSubjectProvider, prm.PublicKey) if err != nil { return fmt.Errorf("failed to get group ids: %w", err) } // Policy contract keeps group related chains as namespace-group pair. for i := range groups { groups[i] = fmt.Sprintf("%s:%s", prm.Namespace, groups[i]) } rt := policyengine.NewRequestTargetExtended(prm.Namespace, prm.Container.EncodeToString(), fmt.Sprintf("%s:%s", prm.Namespace, prm.PublicKey.Address()), groups) status, found, err := cr.IsAllowed(apechain.Ingress, rt, prm.Request) if err != nil { return err } if !found && prm.SoftAPECheck || status == apechain.Allow { return nil } err = fmt.Errorf("access to operation %s is denied by access policy engine: %s", prm.Request.Operation(), status.String()) return apeErr(err) } func apeErr(err error) error { errAccessDenied := &apistatus.ObjectAccessDenied{} errAccessDenied.WriteReason(err.Error()) return errAccessDenied } // isValidBearer checks whether bearer token was correctly signed by authorized // entity. This method might be defined on whole ACL service because it will // require fetching current epoch to check lifetime. func isValidBearer(token *bearer.Token, ownerCnr user.ID, cntID cid.ID, publicKey *keys.PublicKey, st netmap.State) error { if token == nil { return nil } // First check token lifetime. Simplest verification. if token.InvalidAt(st.CurrentEpoch()) { return errBearerExpired } // Then check if bearer token is signed correctly. if !token.VerifySignature() { return errBearerInvalidSignature } // Check for ape overrides defined in the bearer token. apeOverride := token.APEOverride() if len(apeOverride.Chains) > 0 && apeOverride.Target.TargetType != ape.TargetTypeContainer { return fmt.Errorf("%w: %s", errInvalidTargetType, apeOverride.Target.TargetType.ToV2().String()) } // Then check if container is either empty or equal to the container in the request. var targetCnr cid.ID err := targetCnr.DecodeString(apeOverride.Target.Name) if err != nil { return fmt.Errorf("invalid cid format: %s", apeOverride.Target.Name) } if !cntID.Equals(targetCnr) { return errBearerInvalidContainerID } // Then check if container owner signed this token. if !bearer.ResolveIssuer(*token).Equals(ownerCnr) { return errBearerNotSignedByOwner } // Then check if request sender has rights to use this token. var usrSender user.ID user.IDFromKey(&usrSender, (ecdsa.PublicKey)(*publicKey)) if !token.AssertUser(usrSender) { return errBearerInvalidOwner } return nil }