forked from TrueCloudLab/frostfs-node
512 lines
13 KiB
Go
512 lines
13 KiB
Go
package object
|
|
|
|
import (
|
|
"context"
|
|
"crypto/ecdsa"
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/nspcc-dev/neofs-api-go/acl"
|
|
"github.com/nspcc-dev/neofs-api-go/bootstrap"
|
|
"github.com/nspcc-dev/neofs-api-go/container"
|
|
"github.com/nspcc-dev/neofs-api-go/object"
|
|
"github.com/nspcc-dev/neofs-api-go/refs"
|
|
"github.com/nspcc-dev/neofs-api-go/service"
|
|
crypto "github.com/nspcc-dev/neofs-crypto"
|
|
libacl "github.com/nspcc-dev/neofs-node/lib/acl"
|
|
"github.com/nspcc-dev/neofs-node/lib/implementations"
|
|
"github.com/nspcc-dev/neofs-node/lib/ir"
|
|
"github.com/nspcc-dev/neofs-node/lib/test"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
type (
|
|
testACLEntity struct {
|
|
// Set of interfaces which testCommonEntity must implement, but some methods from those does not call.
|
|
serviceRequest
|
|
RequestTargeter
|
|
implementations.ACLHelper
|
|
implementations.ContainerNodesLister
|
|
implementations.ContainerOwnerChecker
|
|
acl.ExtendedACLTable
|
|
libacl.RequestInfo
|
|
|
|
// Argument interceptor. Used for ascertain of correct parameter passage between components.
|
|
f func(...interface{})
|
|
// Mocked result of any interface.
|
|
res interface{}
|
|
// Mocked error of any interface.
|
|
err error
|
|
}
|
|
)
|
|
|
|
type testBasicChecker struct {
|
|
libacl.BasicChecker
|
|
|
|
actionErr error
|
|
action bool
|
|
|
|
sticky bool
|
|
|
|
extended bool
|
|
|
|
bearer bool
|
|
}
|
|
|
|
func (t *testACLEntity) calculateRequestAction(context.Context, requestActionParams) acl.ExtendedACLAction {
|
|
return t.res.(acl.ExtendedACLAction)
|
|
}
|
|
|
|
func (t *testACLEntity) buildRequestInfo(req serviceRequest, target acl.Target) (libacl.RequestInfo, error) {
|
|
if t.f != nil {
|
|
t.f(req, target)
|
|
}
|
|
|
|
if t.err != nil {
|
|
return nil, t.err
|
|
}
|
|
|
|
return t.res.(libacl.RequestInfo), nil
|
|
}
|
|
|
|
func (t *testACLEntity) Action(table acl.ExtendedACLTable, req libacl.RequestInfo) acl.ExtendedACLAction {
|
|
if t.f != nil {
|
|
t.f(table, req)
|
|
}
|
|
|
|
return t.res.(acl.ExtendedACLAction)
|
|
}
|
|
|
|
func (t *testACLEntity) GetExtendedACLTable(_ context.Context, cid CID) (acl.ExtendedACLTable, error) {
|
|
if t.f != nil {
|
|
t.f(cid)
|
|
}
|
|
|
|
if t.err != nil {
|
|
return nil, t.err
|
|
}
|
|
|
|
return t.res.(acl.ExtendedACLTable), nil
|
|
}
|
|
|
|
func (s *testBasicChecker) Extended(uint32) bool {
|
|
return s.extended
|
|
}
|
|
|
|
func (s *testBasicChecker) Sticky(uint32) bool {
|
|
return s.sticky
|
|
}
|
|
|
|
func (s *testBasicChecker) Bearer(uint32, object.RequestType) (bool, error) {
|
|
return s.bearer, nil
|
|
}
|
|
|
|
func (s *testBasicChecker) Action(uint32, object.RequestType, acl.Target) (bool, error) {
|
|
return s.action, s.actionErr
|
|
}
|
|
|
|
func (t *testACLEntity) GetBasicACL(context.Context, CID) (uint32, error) {
|
|
if t.err != nil {
|
|
return 0, t.err
|
|
}
|
|
|
|
return t.res.(uint32), nil
|
|
}
|
|
|
|
func (t *testACLEntity) Target(context.Context, serviceRequest) acl.Target {
|
|
return t.res.(acl.Target)
|
|
}
|
|
|
|
func (t *testACLEntity) CID() CID { return CID{} }
|
|
|
|
func (t *testACLEntity) Type() object.RequestType { return t.res.(object.RequestType) }
|
|
|
|
func (t *testACLEntity) GetBearerToken() service.BearerToken { return nil }
|
|
|
|
func (t *testACLEntity) GetOwner() (*ecdsa.PublicKey, error) {
|
|
if t.err != nil {
|
|
return nil, t.err
|
|
}
|
|
|
|
return t.res.(*ecdsa.PublicKey), nil
|
|
}
|
|
|
|
func (t testACLEntity) GetIRInfo(ir.GetInfoParams) (*ir.GetInfoResult, error) {
|
|
if t.err != nil {
|
|
return nil, t.err
|
|
}
|
|
|
|
res := new(ir.GetInfoResult)
|
|
res.SetInfo(*t.res.(*ir.Info))
|
|
|
|
return res, nil
|
|
}
|
|
|
|
func (t *testACLEntity) ContainerNodesInfo(ctx context.Context, cid CID, prev int) ([]bootstrap.NodeInfo, error) {
|
|
if t.err != nil {
|
|
return nil, t.err
|
|
}
|
|
|
|
return t.res.([][]bootstrap.NodeInfo)[prev], nil
|
|
}
|
|
|
|
func (t *testACLEntity) IsContainerOwner(_ context.Context, cid CID, owner OwnerID) (bool, error) {
|
|
if t.f != nil {
|
|
t.f(cid, owner)
|
|
}
|
|
if t.err != nil {
|
|
return false, t.err
|
|
}
|
|
|
|
return t.res.(bool), nil
|
|
}
|
|
|
|
func (t testACLEntity) GetSignKeyPairs() []service.SignKeyPair {
|
|
if t.res == nil {
|
|
return nil
|
|
}
|
|
return t.res.([]service.SignKeyPair)
|
|
}
|
|
|
|
func TestPreprocessor(t *testing.T) {
|
|
ctx := context.TODO()
|
|
|
|
t.Run("empty request", func(t *testing.T) {
|
|
require.PanicsWithValue(t, pmEmptyServiceRequest, func() {
|
|
_ = new(aclPreProcessor).preProcess(ctx, nil)
|
|
})
|
|
})
|
|
|
|
t.Run("everything is okay", func(t *testing.T) {
|
|
rule := uint32(0x00000003)
|
|
// set F-bit
|
|
rule |= 1 << 28
|
|
|
|
checker := new(libacl.BasicACLChecker)
|
|
|
|
preprocessor := aclPreProcessor{
|
|
log: test.NewTestLogger(false),
|
|
aclInfoReceiver: aclInfoReceiver{
|
|
basicACLGetter: &testACLEntity{res: rule},
|
|
basicChecker: checker,
|
|
targetFinder: &testACLEntity{res: acl.Target_Others},
|
|
},
|
|
basicChecker: checker,
|
|
}
|
|
require.NoError(t, preprocessor.preProcess(ctx, &testACLEntity{res: object.RequestGet}))
|
|
|
|
preprocessor.aclInfoReceiver.targetFinder = &testACLEntity{res: acl.Target_System}
|
|
require.Error(t, preprocessor.preProcess(ctx, &testACLEntity{res: object.RequestGet}))
|
|
preprocessor.aclInfoReceiver.targetFinder = &testACLEntity{res: acl.Target_User}
|
|
require.Error(t, preprocessor.preProcess(ctx, &testACLEntity{res: object.RequestGet}))
|
|
})
|
|
|
|
t.Run("can't fetch container", func(t *testing.T) {
|
|
preprocessor := aclPreProcessor{
|
|
log: test.NewTestLogger(false),
|
|
aclInfoReceiver: aclInfoReceiver{
|
|
basicACLGetter: &testACLEntity{err: container.ErrNotFound},
|
|
targetFinder: &testACLEntity{res: acl.Target_Others},
|
|
},
|
|
}
|
|
require.Error(t, preprocessor.preProcess(ctx, &testACLEntity{res: object.RequestGet}))
|
|
|
|
})
|
|
|
|
t.Run("sticky bit", func(t *testing.T) {
|
|
checker := &testBasicChecker{
|
|
actionErr: nil,
|
|
action: true,
|
|
sticky: true,
|
|
}
|
|
|
|
s := &aclPreProcessor{
|
|
log: test.NewTestLogger(false),
|
|
aclInfoReceiver: aclInfoReceiver{
|
|
basicACLGetter: &testACLEntity{
|
|
res: uint32(0),
|
|
},
|
|
basicChecker: checker,
|
|
targetFinder: &testACLEntity{
|
|
res: acl.Target_User,
|
|
},
|
|
},
|
|
basicChecker: checker,
|
|
}
|
|
|
|
ownerKey := &test.DecodeKey(0).PublicKey
|
|
|
|
ownerID, err := refs.NewOwnerID(ownerKey)
|
|
require.NoError(t, err)
|
|
|
|
okItems := []func() []serviceRequest{
|
|
// Read requests
|
|
func() []serviceRequest {
|
|
return []serviceRequest{
|
|
new(object.GetRequest),
|
|
new(object.HeadRequest),
|
|
new(object.SearchRequest),
|
|
new(GetRangeRequest),
|
|
new(object.GetRangeHashRequest),
|
|
}
|
|
},
|
|
// PutRequest / DeleteRequest (w/o token)
|
|
func() []serviceRequest {
|
|
req := object.MakePutRequestHeader(&Object{
|
|
SystemHeader: SystemHeader{
|
|
OwnerID: ownerID,
|
|
},
|
|
})
|
|
req.AddSignKey(nil, ownerKey)
|
|
putReq := &putRequest{
|
|
PutRequest: req,
|
|
}
|
|
|
|
delReq := new(object.DeleteRequest)
|
|
delReq.OwnerID = ownerID
|
|
delReq.AddSignKey(nil, ownerKey)
|
|
|
|
return []serviceRequest{putReq, delReq}
|
|
},
|
|
// PutRequest / DeleteRequest (w/ token)
|
|
func() []serviceRequest {
|
|
token := new(service.Token)
|
|
token.SetOwnerID(ownerID)
|
|
token.SetOwnerKey(crypto.MarshalPublicKey(ownerKey))
|
|
|
|
req := object.MakePutRequestHeader(&Object{
|
|
SystemHeader: SystemHeader{
|
|
OwnerID: ownerID,
|
|
},
|
|
})
|
|
req.SetToken(token)
|
|
putReq := &putRequest{
|
|
PutRequest: req,
|
|
}
|
|
|
|
delReq := new(object.DeleteRequest)
|
|
delReq.OwnerID = ownerID
|
|
delReq.SetToken(token)
|
|
|
|
return []serviceRequest{putReq, delReq}
|
|
},
|
|
}
|
|
|
|
failItems := []func() []serviceRequest{
|
|
// PutRequest / DeleteRequest (w/o token and wrong owner)
|
|
func() []serviceRequest {
|
|
otherOwner := ownerID
|
|
otherOwner[0]++
|
|
|
|
req := object.MakePutRequestHeader(&Object{
|
|
SystemHeader: SystemHeader{
|
|
OwnerID: otherOwner,
|
|
},
|
|
})
|
|
req.AddSignKey(nil, ownerKey)
|
|
putReq := &putRequest{
|
|
PutRequest: req,
|
|
}
|
|
|
|
delReq := new(object.DeleteRequest)
|
|
delReq.OwnerID = otherOwner
|
|
delReq.AddSignKey(nil, ownerKey)
|
|
|
|
return []serviceRequest{putReq, delReq}
|
|
},
|
|
// PutRequest / DeleteRequest (w/ token w/ wrong owner)
|
|
func() []serviceRequest {
|
|
otherOwner := ownerID
|
|
otherOwner[0]++
|
|
|
|
token := new(service.Token)
|
|
token.SetOwnerID(ownerID)
|
|
token.SetOwnerKey(crypto.MarshalPublicKey(ownerKey))
|
|
|
|
req := object.MakePutRequestHeader(&Object{
|
|
SystemHeader: SystemHeader{
|
|
OwnerID: otherOwner,
|
|
},
|
|
})
|
|
req.SetToken(token)
|
|
putReq := &putRequest{
|
|
PutRequest: req,
|
|
}
|
|
|
|
delReq := new(object.DeleteRequest)
|
|
delReq.OwnerID = otherOwner
|
|
delReq.SetToken(token)
|
|
|
|
return []serviceRequest{putReq, delReq}
|
|
},
|
|
}
|
|
|
|
for _, ok := range okItems {
|
|
for _, req := range ok() {
|
|
require.NoError(t, s.preProcess(ctx, req))
|
|
}
|
|
}
|
|
|
|
for _, fail := range failItems {
|
|
for _, req := range fail() {
|
|
require.Error(t, s.preProcess(ctx, req))
|
|
}
|
|
}
|
|
})
|
|
|
|
t.Run("extended ACL", func(t *testing.T) {
|
|
target := acl.Target_Others
|
|
|
|
req := &testACLEntity{
|
|
res: object.RequestGet,
|
|
}
|
|
|
|
actCalc := new(testACLEntity)
|
|
|
|
checker := &testBasicChecker{
|
|
action: true,
|
|
extended: true,
|
|
}
|
|
|
|
s := &aclPreProcessor{
|
|
log: test.NewTestLogger(false),
|
|
aclInfoReceiver: aclInfoReceiver{
|
|
basicACLGetter: &testACLEntity{
|
|
res: uint32(1),
|
|
},
|
|
basicChecker: checker,
|
|
targetFinder: &testACLEntity{
|
|
res: target,
|
|
},
|
|
},
|
|
basicChecker: checker,
|
|
|
|
reqActionCalc: actCalc,
|
|
}
|
|
|
|
// force to return non-ActionAllow
|
|
actCalc.res = acl.ActionAllow + 1
|
|
require.EqualError(t, s.preProcess(ctx, req), errAccessDenied.Error())
|
|
|
|
// force to return ActionAllow
|
|
actCalc.res = acl.ActionAllow
|
|
require.NoError(t, s.preProcess(ctx, req))
|
|
})
|
|
}
|
|
|
|
func TestTargetFinder(t *testing.T) {
|
|
ctx := context.TODO()
|
|
irKey := test.DecodeKey(2)
|
|
containerKey := test.DecodeKey(3)
|
|
prevContainerKey := test.DecodeKey(4)
|
|
|
|
irInfo := new(ir.Info)
|
|
irNode := ir.Node{}
|
|
irNode.SetKey(crypto.MarshalPublicKey(&irKey.PublicKey))
|
|
irInfo.SetNodes([]ir.Node{irNode})
|
|
|
|
finder := &targetFinder{
|
|
log: test.NewTestLogger(false),
|
|
irStorage: &testACLEntity{
|
|
res: irInfo,
|
|
},
|
|
cnrLister: &testACLEntity{res: [][]bootstrap.NodeInfo{
|
|
{{PubKey: crypto.MarshalPublicKey(&containerKey.PublicKey)}},
|
|
{{PubKey: crypto.MarshalPublicKey(&prevContainerKey.PublicKey)}},
|
|
}},
|
|
}
|
|
|
|
t.Run("trusted node", func(t *testing.T) {
|
|
|
|
pk := &test.DecodeKey(0).PublicKey
|
|
|
|
ownerKey := &test.DecodeKey(1).PublicKey
|
|
owner, err := refs.NewOwnerID(ownerKey)
|
|
require.NoError(t, err)
|
|
|
|
token := new(service.Token)
|
|
token.SetSessionKey(crypto.MarshalPublicKey(pk))
|
|
token.SetOwnerKey(crypto.MarshalPublicKey(ownerKey))
|
|
token.SetOwnerID(owner)
|
|
|
|
req := new(object.SearchRequest)
|
|
req.ContainerID = CID{1, 2, 3}
|
|
req.SetToken(token)
|
|
req.AddSignKey(nil, pk)
|
|
|
|
finder.cnrOwnerChecker = &testACLEntity{
|
|
f: func(items ...interface{}) {
|
|
require.Equal(t, req.CID(), items[0])
|
|
require.Equal(t, owner, items[1])
|
|
},
|
|
res: true,
|
|
}
|
|
|
|
require.Equal(t, acl.Target_User, finder.Target(ctx, req))
|
|
})
|
|
|
|
t.Run("container owner", func(t *testing.T) {
|
|
finder.cnrOwnerChecker = &testACLEntity{res: true}
|
|
|
|
req := new(object.SearchRequest)
|
|
req.AddSignKey(nil, &test.DecodeKey(0).PublicKey)
|
|
|
|
require.Equal(t, acl.Target_User, finder.Target(ctx, req))
|
|
})
|
|
|
|
t.Run("system owner", func(t *testing.T) {
|
|
finder.cnrOwnerChecker = &testACLEntity{res: false}
|
|
|
|
req := new(object.SearchRequest)
|
|
req.AddSignKey(nil, &irKey.PublicKey)
|
|
require.Equal(t, acl.Target_System, finder.Target(ctx, req))
|
|
|
|
req = new(object.SearchRequest)
|
|
req.AddSignKey(nil, &containerKey.PublicKey)
|
|
require.Equal(t, acl.Target_System, finder.Target(ctx, req))
|
|
|
|
req = new(object.SearchRequest)
|
|
req.AddSignKey(nil, &prevContainerKey.PublicKey)
|
|
require.Equal(t, acl.Target_System, finder.Target(ctx, req))
|
|
})
|
|
|
|
t.Run("other owner", func(t *testing.T) {
|
|
finder.cnrOwnerChecker = &testACLEntity{res: false}
|
|
|
|
req := new(object.SearchRequest)
|
|
req.AddSignKey(nil, &test.DecodeKey(0).PublicKey)
|
|
require.Equal(t, acl.Target_Others, finder.Target(ctx, req))
|
|
})
|
|
|
|
t.Run("can't fetch request owner", func(t *testing.T) {
|
|
req := new(object.SearchRequest)
|
|
|
|
require.Equal(t, acl.Target_Unknown, finder.Target(ctx, req))
|
|
})
|
|
|
|
t.Run("can't fetch container", func(t *testing.T) {
|
|
finder.cnrOwnerChecker = &testACLEntity{err: container.ErrNotFound}
|
|
|
|
req := new(object.SearchRequest)
|
|
req.AddSignKey(nil, &test.DecodeKey(0).PublicKey)
|
|
require.Equal(t, acl.Target_Unknown, finder.Target(ctx, req))
|
|
})
|
|
|
|
t.Run("can't fetch ir list", func(t *testing.T) {
|
|
finder.cnrOwnerChecker = &testACLEntity{res: false}
|
|
finder.irStorage = &testACLEntity{err: errors.New("blockchain is busy")}
|
|
|
|
req := new(object.SearchRequest)
|
|
req.AddSignKey(nil, &test.DecodeKey(0).PublicKey)
|
|
require.Equal(t, acl.Target_Unknown, finder.Target(ctx, req))
|
|
})
|
|
|
|
t.Run("can't fetch container list", func(t *testing.T) {
|
|
finder.cnrOwnerChecker = &testACLEntity{res: false}
|
|
finder.cnrLister = &testACLEntity{err: container.ErrNotFound}
|
|
|
|
req := new(object.SearchRequest)
|
|
req.AddSignKey(nil, &test.DecodeKey(0).PublicKey)
|
|
require.Equal(t, acl.Target_Unknown, finder.Target(ctx, req))
|
|
})
|
|
}
|