TrueCloudLab/frostfs-s3-gw

Fork 20

[#154] Rename access key to secret key #229

Merged

alexvanin merged 1 commit from :feature/154-rename_access_key into master

2023-10-06 09:20:40 +00:00

r.loginov commented

2023-10-02 09:58:20 +00:00

Member

closes #154

Signed-off-by: Roman Loginov r.loginov@yadro.com

closes #154 Signed-off-by: Roman Loginov <r.loginov@yadro.com>

r.loginov self-assigned this 2023-10-02 09:58:20 +00:00

r.loginov added 1 commit 2023-10-02 09:58:22 +00:00

[#154 ] Rename access key to secret key

/ DCO (pull_request) Successful in 1m19s

Details

/ Builds (1.20) (pull_request) Successful in 1m55s

Details

/ Builds (1.21) (pull_request) Successful in 1m49s

Details

/ Vulncheck (pull_request) Successful in 4m52s

Details

/ Lint (pull_request) Successful in 3m3s

Details

/ Tests (1.20) (pull_request) Successful in 7m59s

Details

/ Tests (1.21) (pull_request) Successful in 1m27s

Details

8a5295dea9

Signed-off-by: Roman Loginov <r.loginov@yadro.com>

r.loginov requested review from storage-services-committers 2023-10-02 10:07:59 +00:00

r.loginov requested review from storage-services-developers 2023-10-02 10:08:00 +00:00

mbiryukova approved these changes 2023-10-02 15:25:52 +00:00

dkirillov approved these changes 2023-10-04 07:50:16 +00:00

dkirillov left a comment

Member

LGTM

alexvanin commented

2023-10-04 11:12:04 +00:00

Owner

@r.loginov Can you check compatibility by using frostfs-aio on current master branch and gateway from this branch?

Start environment with make up s3cred and receive some access key and secret key
Start frostfs-s3 gateway on your local machine and point it to frostfs-aio
Try to use credentials from step 1 to create bucket and object.

Here is a small config to run s3 gateway with aio.

wallet:
  path: ../frostfs-aio/s3-gw/s3-gw-wallet.json
  passphrase: ""

peers:
  0:
    address: localhost:8080
    priority: 1
    weight: 1

server:
  - address: 0.0.0.0:8884

logger:
  level: debug

rpc_endpoint: http://localhost:30333
resolve_order:
  - nns

placement_policy:
  default: REP 1

@r.loginov Can you check compatibility by using frostfs-aio on current master branch and gateway from this branch? 1. Start environment with `make up s3cred` and receive some access key and secret key 2. Start frostfs-s3 gateway on your local machine and point it to frostfs-aio 3. Try to use credentials from step 1 to create bucket and object. Here is a small config to run s3 gateway with aio. ```yaml wallet: path: ../frostfs-aio/s3-gw/s3-gw-wallet.json passphrase: "" peers: 0: address: localhost:8080 priority: 1 weight: 1 server: - address: 0.0.0.0:8884 logger: level: debug rpc_endpoint: http://localhost:30333 resolve_order: - nns placement_policy: default: REP 1 ```

alexvanin commented

2023-10-04 11:22:15 +00:00

Owner

I request one more change. Rename OwnerPublicKey to SeedKey in access box message.

In fact this is a random public key which is created on every new access box object and it is used as random seed to generate shared secret data.

OwnerPublicKey may be referenced as public key of the wallet which signed tokens in the box, but it is not. @pogpp felt into this bad naming once.

// Creating
ephemeralKey, err := keys.NewPrivateKey()
...
box.OwnerPublicKey = ephemeralKey.PublicKey().Bytes()

// Encoding secret
func encrypt(owner *keys.PrivateKey, sender *keys.PublicKey, data []byte) ([]byte, error) {
    enc, err := getCipher(owner, sender) // sender is a bad naming, also rename to seedKey.

// Decoding secret
func decrypt(owner *keys.PrivateKey, sender *keys.PublicKey, data []byte) ([]byte, error) {
	dec, err := getCipher(owner, sender) // sender is a bad naming, also rename to seedKey.

I request one more change. Rename `OwnerPublicKey` to `SeedKey` in access box message. In fact this is a random public key which is created on every new access box object and it is used as random seed to generate shared secret data. `OwnerPublicKey` may be referenced as public key of the wallet which signed tokens in the box, but it is not. @pogpp felt into this bad naming once. ``` go // Creating ephemeralKey, err := keys.NewPrivateKey() ... box.OwnerPublicKey = ephemeralKey.PublicKey().Bytes() // Encoding secret func encrypt(owner *keys.PrivateKey, sender *keys.PublicKey, data []byte) ([]byte, error) { enc, err := getCipher(owner, sender) // sender is a bad naming, also rename to seedKey. // Decoding secret func decrypt(owner *keys.PrivateKey, sender *keys.PublicKey, data []byte) ([]byte, error) { dec, err := getCipher(owner, sender) // sender is a bad naming, also rename to seedKey. ```