aarifullin/frostfs-node
1
0
Fork 0
forked from TrueCloudLab/frostfs-node
Code Issues Pull requests Projects Releases Packages Wiki Activity

Disable container owner check in tree service

Browse source 
Signed-off-by: Alex Vanin <a.vanin@yadro.com>
This commit is contained in:
Alexey Vanin 2022-10-25 12:52:41 +03:00 committed by Denis Kirillov
parent 56f12c77b9
commit fe56f11edc
1 changed files with 40 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

58
pkg/services/tree/signature.go
View file

@ -56,7 +56,23 @@ func (s *Service) verifyClient(req message, cid cidSDK.ID, rawBearer []byte, op
return fmt.Errorf("can't get container %s: %w", cid, err) return fmt.Errorf("can't get container %s: %w", cid, err)
} }
role, err := roleFromReq(cnr, req) eaclOp := eACLOp(op)
var bt *bearer.Token
if len(rawBearer) > 0 {
bt = new(bearer.Token)
if err = bt.Unmarshal(rawBearer); err != nil {
return eACLErr(eaclOp, fmt.Errorf("invalid bearer token: %w", err))
}
if !bt.VerifySignature() {
return eACLErr(eaclOp, errBearerSignature)
}
if !bt.AssertContainer(cid) {
return eACLErr(eaclOp, errBearerWrongContainer)
}
}
role, err := roleFromReq(cnr, req, bt)
if err != nil { if err != nil {
return fmt.Errorf("can't get request role: %w", err) return fmt.Errorf("can't get request role: %w", err)
} }
@ -71,8 +87,6 @@ func (s *Service) verifyClient(req message, cid cidSDK.ID, rawBearer []byte, op
return nil return nil
} }
eaclOp := eACLOp(op)
var tableFromBearer bool var tableFromBearer bool
if len(rawBearer) != 0 { if len(rawBearer) != 0 {
if !basicACL.AllowedBearerRules(op) { if !basicACL.AllowedBearerRules(op) {
@ -87,21 +101,22 @@ func (s *Service) verifyClient(req message, cid cidSDK.ID, rawBearer []byte, op
var tb eacl.Table var tb eacl.Table
if tableFromBearer { if tableFromBearer {
var bt bearer.Token if bt.Impersonate() {
if err = bt.Unmarshal(rawBearer); err != nil { tbCore, err := s.eaclSource.GetEACL(cid)
return eACLErr(eaclOp, fmt.Errorf("invalid bearer token: %w", err)) if err != nil {
} if client.IsErrEACLNotFound(err) {
if !bearer.ResolveIssuer(bt).Equals(cnr.Value.Owner()) { return nil
return eACLErr(eaclOp, errBearerWrongOwner) }
}
if !bt.AssertContainer(cid) {
return eACLErr(eaclOp, errBearerWrongContainer)
}
if !bt.VerifySignature() {
return eACLErr(eaclOp, errBearerSignature)
}
tb = bt.EACLTable() return fmt.Errorf("get eACL table: %w", err)
}
tb = *tbCore.Value
} else {
if !bearer.ResolveIssuer(*bt).Equals(cnr.Value.Owner()) {
return eACLErr(eaclOp, errBearerWrongOwner)
}
tb = bt.EACLTable()
}
} else { } else {
tbCore, err := s.eaclSource.GetEACL(cid) tbCore, err := s.eaclSource.GetEACL(cid)
if err != nil { if err != nil {
@ -168,7 +183,7 @@ func SignMessage(m message, key *ecdsa.PrivateKey) error {
return nil return nil
} }
func roleFromReq(cnr *core.Container, req message) (acl.Role, error) { func roleFromReq(cnr *core.Container, req message, bt *bearer.Token) (acl.Role, error) {
role := acl.RoleOthers role := acl.RoleOthers
owner := cnr.Value.Owner() owner := cnr.Value.Owner()
@ -177,6 +192,13 @@ func roleFromReq(cnr *core.Container, req message) (acl.Role, error) {
return role, fmt.Errorf("invalid public key: %w", err) return role, fmt.Errorf("invalid public key: %w", err)
} }
if bt != nil && bt.Impersonate() {
pub, err = keys.NewPublicKeyFromBytes(bt.SigningKeyBytes(), elliptic.P256())
if err != nil {
return role, fmt.Errorf("invalid public key: %w", err)
}
}
var reqSigner user.ID var reqSigner user.ID
user.IDFromKey(&reqSigner, (ecdsa.PublicKey)(*pub)) user.IDFromKey(&reqSigner, (ecdsa.PublicKey)(*pub))