frostfs-node/pkg/innerring/processors/container/process_container.go
Pavel Karpy e03b44ffc1 [#807] morph/event/container: Add delete notary support
Includes:
- `delete` container notary notification;
- refactor in processor bindings;
- fixed conflicts in `put` notifications.

Signed-off-by: Pavel Karpy <carpawell@nspcc.ru>
2021-09-09 18:37:45 +03:00

204 lines
4.9 KiB
Go

package container
import (
"crypto/elliptic"
"crypto/sha256"
"errors"
"fmt"
"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
containerSDK "github.com/nspcc-dev/neofs-api-go/pkg/container"
cid "github.com/nspcc-dev/neofs-api-go/pkg/container/id"
"github.com/nspcc-dev/neofs-api-go/pkg/session"
"github.com/nspcc-dev/neofs-api-go/v2/refs"
"github.com/nspcc-dev/neofs-node/pkg/core/container"
containerEvent "github.com/nspcc-dev/neofs-node/pkg/morph/event/container"
"go.uber.org/zap"
)
// Process new container from the user by checking container sanity
// and sending approve tx back to morph.
func (cp *Processor) processContainerPut(put *containerEvent.Put) {
if !cp.alphabetState.IsAlphabet() {
cp.log.Info("non alphabet mode, ignore container put")
return
}
err := cp.checkPutContainer(put)
if err != nil {
cp.log.Error("put container check failed",
zap.String("error", err.Error()),
)
return
}
cp.approvePutContainer(put)
}
func (cp *Processor) checkPutContainer(e *containerEvent.Put) error {
// verify signature
key, err := keys.NewPublicKeyFromBytes(e.PublicKey(), elliptic.P256())
if err != nil {
return fmt.Errorf("invalid key: %w", err)
}
binCnr := e.Container()
tableHash := sha256.Sum256(binCnr)
if !key.Verify(e.Signature(), tableHash[:]) {
return errors.New("invalid signature")
}
// unmarshal container structure
cnr := containerSDK.New()
err = cnr.Unmarshal(binCnr)
if err != nil {
return fmt.Errorf("invalid binary container: %w", err)
}
// perform format check
err = container.CheckFormat(cnr)
if err != nil {
return fmt.Errorf("incorrect container format: %w", err)
}
// unmarshal session token if presented
tok, err := tokenFromEvent(e)
if err != nil {
return err
}
if tok != nil {
// check token context
err = checkTokenContext(tok, func(c *session.ContainerContext) bool {
return c.IsForPut()
})
if err != nil {
return err
}
}
cnr.SetSessionToken(tok)
return cp.checkKeyOwnership(cnr, key)
}
func (cp *Processor) approvePutContainer(e *containerEvent.Put) {
var err error
if nr := e.NotaryRequest(); nr != nil {
// put event was received via Notary service
err = cp.cnrClient.Morph().NotarySignAndInvokeTX(nr.MainTransaction)
} else {
// put event was received via notification service
err = cp.cnrClient.Put(e.Container(), e.PublicKey(), e.Signature(), e.SessionToken())
}
if err != nil {
cp.log.Error("could not approve put container",
zap.String("error", err.Error()),
)
}
}
// Process delete container operation from the user by checking container sanity
// and sending approve tx back to morph.
func (cp *Processor) processContainerDelete(delete *containerEvent.Delete) {
if !cp.alphabetState.IsAlphabet() {
cp.log.Info("non alphabet mode, ignore container delete")
return
}
err := cp.checkDeleteContainer(delete)
if err != nil {
cp.log.Error("delete container check failed",
zap.String("error", err.Error()),
)
return
}
cp.approveDeleteContainer(delete)
}
func (cp *Processor) checkDeleteContainer(e *containerEvent.Delete) error {
binCID := e.ContainerID()
// receive owner of the related container
cnr, err := cp.cnrClient.Get(binCID)
if err != nil {
return fmt.Errorf("could not receive the container: %w", err)
}
token, err := tokenFromEvent(e)
if err != nil {
return err
}
var checkKeys keys.PublicKeys
if token != nil {
// check token context
// TODO: think how to avoid version casts
idV2 := new(refs.ContainerID)
idV2.SetValue(binCID)
id := cid.NewFromV2(idV2)
err = checkTokenContextWithCID(token, id, func(c *session.ContainerContext) bool {
return c.IsForDelete()
})
if err != nil {
return err
}
key, err := keys.NewPublicKeyFromBytes(token.SessionKey(), elliptic.P256())
if err != nil {
return fmt.Errorf("invalid session key: %w", err)
}
// check token ownership
err = cp.checkKeyOwnershipWithToken(cnr, key, token)
if err != nil {
return err
}
checkKeys = keys.PublicKeys{key}
} else {
// receive all owner keys from NeoFS ID contract
checkKeys, err = cp.idClient.AccountKeys(cnr.OwnerID())
if err != nil {
return fmt.Errorf("could not received owner keys %s: %w", cnr.OwnerID(), err)
}
}
// verify signature
cidHash := sha256.Sum256(binCID)
sig := e.Signature()
for _, key := range checkKeys {
if key.Verify(sig, cidHash[:]) {
return nil
}
}
return errors.New("signature verification failed on all owner keys ")
}
func (cp *Processor) approveDeleteContainer(e *containerEvent.Delete) {
var err error
if nr := e.NotaryRequest(); nr != nil {
// delete event was received via Notary service
err = cp.cnrClient.Morph().NotarySignAndInvokeTX(nr.MainTransaction)
} else {
// delete event was received via notification service
err = cp.cnrClient.Delete(e.ContainerID(), e.Signature(), e.SessionToken())
}
if err != nil {
cp.log.Error("could not approve delete container",
zap.String("error", err.Error()),
)
}
}