frostfs-node/pkg/innerring/processors/container/process_container.go

package container

import (
	"context"
	"errors"
	"fmt"
	"strings"

	"git.frostfs.info/TrueCloudLab/frostfs-node/internal/logs"
	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/morph/event"
	containerEvent "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/morph/event/container"
	containerSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/session"
	"github.com/nspcc-dev/neo-go/pkg/network/payload"
	"github.com/nspcc-dev/neo-go/pkg/util"
	"go.uber.org/zap"
)

// putEvent is a common interface of Put and PutNamed event.
type putEvent interface {
	event.Event
	Container() []byte
	PublicKey() []byte
	Signature() []byte
	SessionToken() []byte
	NotaryRequest() *payload.P2PNotaryRequest
}

type putContainerContext struct {
	e putEvent

	d containerSDK.Domain
}

var errContainerAndOwnerNamespaceDontMatch = errors.New("container and owner namespaces do not match")

// Process a new container from the user by checking the container sanity
// and sending approve tx back to the morph.
func (cp *Processor) processContainerPut(put putEvent) bool {
	if !cp.alphabetState.IsAlphabet() {
		cp.log.Info(context.Background(), logs.ContainerNonAlphabetModeIgnoreContainerPut)
		return true
	}

	ctx := &putContainerContext{
		e: put,
	}

	err := cp.checkPutContainer(ctx)
	if err != nil {
		cp.log.Error(context.Background(), logs.ContainerPutContainerCheckFailed,
			zap.String("error", err.Error()),
		)

		return false
	}

	if err := cp.morphClient.NotarySignAndInvokeTX(ctx.e.NotaryRequest().MainTransaction); err != nil {
		cp.log.Error(context.Background(), logs.ContainerCouldNotApprovePutContainer,
			zap.String("error", err.Error()),
		)
		return false
	}

	return true
}

func (cp *Processor) checkPutContainer(ctx *putContainerContext) error {
	binCnr := ctx.e.Container()
	var cnr containerSDK.Container

	err := cnr.Unmarshal(binCnr)
	if err != nil {
		return fmt.Errorf("invalid binary container: %w", err)
	}

	err = cp.verifySignature(signatureVerificationData{
		ownerContainer:  cnr.Owner(),
		verb:            session.VerbContainerPut,
		binTokenSession: ctx.e.SessionToken(),
		binPublicKey:    ctx.e.PublicKey(),
		signature:       ctx.e.Signature(),
		signedData:      binCnr,
	})
	if err != nil {
		return fmt.Errorf("auth container creation: %w", err)
	}

	// check homomorphic hashing setting
	err = checkHomomorphicHashing(cp.netState, cnr)
	if err != nil {
		return fmt.Errorf("incorrect homomorphic hashing setting: %w", err)
	}

	// check native name and zone
	err = cp.checkNNS(ctx, cnr)
	if err != nil {
		return fmt.Errorf("NNS: %w", err)
	}

	return nil
}

// Process delete container operation from the user by checking container sanity
// and sending approve tx back to morph.
func (cp *Processor) processContainerDelete(e containerEvent.Delete) bool {
	if !cp.alphabetState.IsAlphabet() {
		cp.log.Info(context.Background(), logs.ContainerNonAlphabetModeIgnoreContainerDelete)
		return true
	}

	err := cp.checkDeleteContainer(e)
	if err != nil {
		cp.log.Error(context.Background(), logs.ContainerDeleteContainerCheckFailed,
			zap.String("error", err.Error()),
		)

		return false
	}

	if err := cp.morphClient.NotarySignAndInvokeTX(e.NotaryRequest().MainTransaction); err != nil {
		cp.log.Error(context.Background(), logs.ContainerCouldNotApproveDeleteContainer,
			zap.String("error", err.Error()),
		)

		return false
	}

	return true
}

func (cp *Processor) checkDeleteContainer(e containerEvent.Delete) error {
	binCnr := e.ContainerID()

	var idCnr cid.ID

	err := idCnr.Decode(binCnr)
	if err != nil {
		return fmt.Errorf("invalid container ID: %w", err)
	}

	// receive owner of the related container
	cnr, err := cp.cnrClient.Get(binCnr)
	if err != nil {
		return fmt.Errorf("could not receive the container: %w", err)
	}

	err = cp.verifySignature(signatureVerificationData{
		ownerContainer:  cnr.Value.Owner(),
		verb:            session.VerbContainerDelete,
		idContainerSet:  true,
		idContainer:     idCnr,
		binTokenSession: e.SessionToken(),
		signature:       e.Signature(),
		signedData:      binCnr,
		binPublicKey:    e.PublicKeyValue,
	})
	if err != nil {
		return fmt.Errorf("auth container removal: %w", err)
	}

	return nil
}

func (cp *Processor) checkNNS(ctx *putContainerContext, cnr containerSDK.Container) error {
	// fetch domain info
	ctx.d = containerSDK.ReadDomain(cnr)

	// if PutNamed event => check if values in container correspond to args
	if named, ok := ctx.e.(interface {
		Name() string
		Zone() string
	}); ok {
		if name := named.Name(); name != ctx.d.Name() {
			return fmt.Errorf("names differ %s/%s", name, ctx.d.Name())
		}

		if zone := named.Zone(); zone != ctx.d.Zone() {
			return fmt.Errorf("zones differ %s/%s", zone, ctx.d.Zone())
		}
	}

	addr, err := util.Uint160DecodeBytesBE(cnr.Owner().WalletBytes()[1 : 1+util.Uint160Size])
	if err != nil {
		return fmt.Errorf("could not get container owner address: %w", err)
	}

	subject, err := cp.frostFSIDClient.GetSubject(addr)
	if err != nil {
		return fmt.Errorf("could not get subject from FrostfsID contract: %w", err)
	}

	namespace, hasNamespace := strings.CutSuffix(ctx.d.Zone(), ".ns")
	if !hasNamespace {
		return nil
	}

	if subject.Namespace != namespace {
		return errContainerAndOwnerNamespaceDontMatch
	}

	return nil
}

func checkHomomorphicHashing(ns NetworkState, cnr containerSDK.Container) error {
	netSetting, err := ns.HomomorphicHashDisabled()
	if err != nil {
		return fmt.Errorf("could not get setting in contract: %w", err)
	}

	if cnrSetting := containerSDK.IsHomomorphicHashingDisabled(cnr); netSetting != cnrSetting {
		return fmt.Errorf("network setting: %t, container setting: %t", netSetting, cnrSetting)
	}

	return nil
}