forked from TrueCloudLab/frostfs-testcases
223 lines
16 KiB
Text
223 lines
16 KiB
Text
*** Settings ***
|
|
Variables ../../../variables/common.py
|
|
|
|
*** Variables ***
|
|
${FILE_USR_HEADER} = key1=1,key2=abc
|
|
${FILE_USR_HEADER_DEL} = key1=del,key2=del
|
|
${FILE_OTH_HEADER} = key1=oth,key2=oth
|
|
${RULE_FOR_ALL} = REP 2 IN X CBF 1 SELECT 4 FROM * AS X
|
|
|
|
|
|
*** Keywords ***
|
|
|
|
Generate eACL Keys
|
|
${EACL_KEY_GEN} = Form WIF from String 782676b81a35c5f07325ec523e8521ee4946b6e5d4c6cd652dd0c3ba51ce03de
|
|
Set Global Variable ${EACL_KEY} ${EACL_KEY_GEN}
|
|
Set Global Variable ${SYSTEM_KEY} ${NEOFS_IR_WIF}
|
|
|
|
Create Container Public
|
|
Log Create Public Container
|
|
${PUBLIC_CID_GEN} = Create container ${USER_KEY} 0x4FFFFFFF ${RULE_FOR_ALL}
|
|
[Return] ${PUBLIC_CID_GEN}
|
|
|
|
|
|
Generate files
|
|
[Arguments] ${SIZE}
|
|
${FILE_S_GEN_1} = Generate file of bytes ${SIZE}
|
|
${FILE_S_GEN_2} = Generate file of bytes ${SIZE}
|
|
Set Global Variable ${FILE_S} ${FILE_S_GEN_1}
|
|
Set Global Variable ${FILE_S_2} ${FILE_S_GEN_2}
|
|
|
|
|
|
Prepare eACL Role rules
|
|
Log Set eACL for different Role cases
|
|
|
|
# eACL rules for all operations and similar permissions
|
|
@{Roles} = Create List OTHERS USER SYSTEM
|
|
FOR ${role} IN @{Roles}
|
|
${rule1}= Create Dictionary Operation=GET Access=DENY Role=${role}
|
|
${rule2}= Create Dictionary Operation=HEAD Access=DENY Role=${role}
|
|
${rule3}= Create Dictionary Operation=PUT Access=DENY Role=${role}
|
|
${rule4}= Create Dictionary Operation=DELETE Access=DENY Role=${role}
|
|
${rule5}= Create Dictionary Operation=SEARCH Access=DENY Role=${role}
|
|
${rule6}= Create Dictionary Operation=GETRANGE Access=DENY Role=${role}
|
|
${rule7}= Create Dictionary Operation=GETRANGEHASH Access=DENY Role=${role}
|
|
|
|
${eACL_gen}= Create List ${rule1} ${rule2} ${rule3} ${rule4} ${rule5} ${rule6} ${rule7}
|
|
Form eACL json common file gen_eacl_deny_all_${role} ${eACL_gen}
|
|
END
|
|
|
|
|
|
FOR ${role} IN @{Roles}
|
|
${rule1}= Create Dictionary Operation=GET Access=ALLOW Role=${role}
|
|
${rule2}= Create Dictionary Operation=HEAD Access=ALLOW Role=${role}
|
|
${rule3}= Create Dictionary Operation=PUT Access=ALLOW Role=${role}
|
|
${rule4}= Create Dictionary Operation=DELETE Access=ALLOW Role=${role}
|
|
${rule5}= Create Dictionary Operation=SEARCH Access=ALLOW Role=${role}
|
|
${rule6}= Create Dictionary Operation=GETRANGE Access=ALLOW Role=${role}
|
|
${rule7}= Create Dictionary Operation=GETRANGEHASH Access=ALLOW Role=${role}
|
|
|
|
${eACL_gen}= Create List ${rule1} ${rule2} ${rule3} ${rule4} ${rule5} ${rule6} ${rule7}
|
|
Form eACL json common file gen_eacl_allow_all_${role} ${eACL_gen}
|
|
END
|
|
|
|
|
|
${rule1}= Create Dictionary Operation=GET Access=ALLOW Role=A9tDy6Ye+UimXCCzJrlAmRE0FDZHjf3XRyya9rELtgAA
|
|
${rule2}= Create Dictionary Operation=HEAD Access=ALLOW Role=A9tDy6Ye+UimXCCzJrlAmRE0FDZHjf3XRyya9rELtgAA
|
|
${rule3}= Create Dictionary Operation=PUT Access=ALLOW Role=A9tDy6Ye+UimXCCzJrlAmRE0FDZHjf3XRyya9rELtgAA
|
|
${rule4}= Create Dictionary Operation=DELETE Access=ALLOW Role=A9tDy6Ye+UimXCCzJrlAmRE0FDZHjf3XRyya9rELtgAA
|
|
${rule5}= Create Dictionary Operation=SEARCH Access=ALLOW Role=A9tDy6Ye+UimXCCzJrlAmRE0FDZHjf3XRyya9rELtgAA
|
|
${rule6}= Create Dictionary Operation=GETRANGE Access=ALLOW Role=A9tDy6Ye+UimXCCzJrlAmRE0FDZHjf3XRyya9rELtgAA
|
|
${rule7}= Create Dictionary Operation=GETRANGEHASH Access=ALLOW Role=A9tDy6Ye+UimXCCzJrlAmRE0FDZHjf3XRyya9rELtgAA
|
|
${rule8}= Create Dictionary Operation=GET Access=DENY Role=OTHERS
|
|
${rule9}= Create Dictionary Operation=HEAD Access=DENY Role=OTHERS
|
|
${rule10}= Create Dictionary Operation=PUT Access=DENY Role=OTHERS
|
|
${rule11}= Create Dictionary Operation=DELETE Access=DENY Role=OTHERS
|
|
${rule12}= Create Dictionary Operation=SEARCH Access=DENY Role=OTHERS
|
|
${rule13}= Create Dictionary Operation=GETRANGE Access=DENY Role=OTHERS
|
|
${rule14}= Create Dictionary Operation=GETRANGEHASH Access=DENY Role=OTHERS
|
|
|
|
|
|
${eACL_gen}= Create List ${rule1} ${rule2} ${rule3} ${rule4} ${rule5} ${rule6} ${rule7}
|
|
... ${rule8} ${rule9} ${rule10} ${rule11} ${rule12} ${rule13} ${rule14}
|
|
Form eACL json common file gen_eacl_allow_pubkey_deny_OTHERS ${eACL_gen}
|
|
|
|
Set Global Variable ${EACL_DENY_ALL_OTHER} gen_eacl_deny_all_OTHERS
|
|
Set Global Variable ${EACL_ALLOW_ALL_OTHER} gen_eacl_allow_all_OTHERS
|
|
|
|
Set Global Variable ${EACL_DENY_ALL_USER} gen_eacl_deny_all_USER
|
|
Set Global Variable ${EACL_ALLOW_ALL_USER} gen_eacl_allow_all_USER
|
|
|
|
Set Global Variable ${EACL_DENY_ALL_SYSTEM} gen_eacl_deny_all_SYSTEM
|
|
Set Global Variable ${EACL_ALLOW_ALL_SYSTEM} gen_eacl_allow_all_SYSTEM
|
|
|
|
Set Global Variable ${EACL_ALLOW_ALL_Pubkey} gen_eacl_allow_pubkey_deny_OTHERS
|
|
|
|
|
|
# eACL rules for Compound operations: GET/GetRange/GetRangeHash
|
|
@{Roles} = Create List OTHERS USER SYSTEM
|
|
FOR ${role} IN @{Roles}
|
|
${rule1}= Create Dictionary Operation=GET Access=ALLOW Role=${role}
|
|
${rule2}= Create Dictionary Operation=GETRANGE Access=ALLOW Role=${role}
|
|
${rule3}= Create Dictionary Operation=GETRANGEHASH Access=ALLOW Role=${role}
|
|
${rule4}= Create Dictionary Operation=HEAD Access=DENY Role=${role}
|
|
${eACL_gen}= Create List ${rule1} ${rule2} ${rule3} ${rule4}
|
|
Form eACL json common file gen_eacl_compound_get_${role} ${eACL_gen}
|
|
Set Global Variable ${EACL_COMPOUND_GET_${role}} gen_eacl_compound_get_${role}
|
|
END
|
|
|
|
# eACL rules for Compound operations: DELETE
|
|
@{Roles} = Create List OTHERS USER SYSTEM
|
|
FOR ${role} IN @{Roles}
|
|
${rule1}= Create Dictionary Operation=DELETE Access=ALLOW Role=${role}
|
|
${rule2}= Create Dictionary Operation=PUT Access=DENY Role=${role}
|
|
${rule3}= Create Dictionary Operation=HEAD Access=DENY Role=${role}
|
|
${eACL_gen}= Create List ${rule1} ${rule2} ${rule3}
|
|
Form eACL json common file gen_eacl_compound_del_${role} ${eACL_gen}
|
|
Set Global Variable ${EACL_COMPOUND_DELETE_${role}} gen_eacl_compound_del_${role}
|
|
END
|
|
|
|
# eACL rules for Compound operations: GETRANGEHASH
|
|
@{Roles} = Create List OTHERS USER SYSTEM
|
|
FOR ${role} IN @{Roles}
|
|
${rule1}= Create Dictionary Operation=GETRANGEHASH Access=ALLOW Role=${role}
|
|
${rule2}= Create Dictionary Operation=GETRANGE Access=DENY Role=${role}
|
|
${rule3}= Create Dictionary Operation=GET Access=DENY Role=${role}
|
|
${eACL_gen}= Create List ${rule1} ${rule2} ${rule3}
|
|
Form eACL json common file gen_eacl_compound_get_hash_${role} ${eACL_gen}
|
|
Set Global Variable ${EACL_COMPOUND_GET_HASH_${role}} gen_eacl_compound_get_hash_${role}
|
|
END
|
|
|
|
|
|
|
|
# eACL for X-Header Other DENY and ALLOW for all
|
|
${filters}= Create Dictionary headerType=REQUEST matchType=STRING_EQUAL key=a value=2
|
|
|
|
${rule1}= Create Dictionary Operation=GET Access=DENY Role=OTHERS Filters=${filters}
|
|
${rule2}= Create Dictionary Operation=HEAD Access=DENY Role=OTHERS Filters=${filters}
|
|
${rule3}= Create Dictionary Operation=PUT Access=DENY Role=OTHERS Filters=${filters}
|
|
${rule4}= Create Dictionary Operation=DELETE Access=DENY Role=OTHERS Filters=${filters}
|
|
${rule5}= Create Dictionary Operation=SEARCH Access=DENY Role=OTHERS Filters=${filters}
|
|
${rule6}= Create Dictionary Operation=GETRANGE Access=DENY Role=OTHERS Filters=${filters}
|
|
${rule7}= Create Dictionary Operation=GETRANGEHASH Access=DENY Role=OTHERS Filters=${filters}
|
|
${eACL_gen}= Create List ${rule1} ${rule2} ${rule3} ${rule4} ${rule5} ${rule6} ${rule7}
|
|
Form eACL json common file gen_eacl_xheader_deny_all ${eACL_gen}
|
|
Set Global Variable ${EACL_XHEADER_DENY_ALL} gen_eacl_xheader_deny_all
|
|
|
|
|
|
|
|
# eACL for X-Header Other ALLOW and DENY for all
|
|
${filters}= Create Dictionary headerType=REQUEST matchType=STRING_EQUAL key=a value=2
|
|
|
|
${rule1}= Create Dictionary Operation=GET Access=ALLOW Role=OTHERS Filters=${filters}
|
|
${rule2}= Create Dictionary Operation=HEAD Access=ALLOW Role=OTHERS Filters=${filters}
|
|
${rule3}= Create Dictionary Operation=PUT Access=ALLOW Role=OTHERS Filters=${filters}
|
|
${rule4}= Create Dictionary Operation=DELETE Access=ALLOW Role=OTHERS Filters=${filters}
|
|
${rule5}= Create Dictionary Operation=SEARCH Access=ALLOW Role=OTHERS Filters=${filters}
|
|
${rule6}= Create Dictionary Operation=GETRANGE Access=ALLOW Role=OTHERS Filters=${filters}
|
|
${rule7}= Create Dictionary Operation=GETRANGEHASH Access=ALLOW Role=OTHERS Filters=${filters}
|
|
${rule8}= Create Dictionary Operation=GET Access=DENY Role=OTHERS
|
|
${rule9}= Create Dictionary Operation=HEAD Access=DENY Role=OTHERS
|
|
${rule10}= Create Dictionary Operation=PUT Access=DENY Role=OTHERS
|
|
${rule11}= Create Dictionary Operation=DELETE Access=DENY Role=OTHERS
|
|
${rule12}= Create Dictionary Operation=SEARCH Access=DENY Role=OTHERS
|
|
${rule13}= Create Dictionary Operation=GETRANGE Access=DENY Role=OTHERS
|
|
${rule14}= Create Dictionary Operation=GETRANGEHASH Access=DENY Role=OTHERS
|
|
${eACL_gen}= Create List ${rule1} ${rule2} ${rule3} ${rule4} ${rule5} ${rule6} ${rule7}
|
|
... ${rule8} ${rule9} ${rule10} ${rule11} ${rule12} ${rule13} ${rule14}
|
|
Form eACL json common file gen_eacl_xheader_allow_all ${eACL_gen}
|
|
Set Global Variable ${EACL_XHEADER_ALLOW_ALL} gen_eacl_xheader_allow_all
|
|
|
|
|
|
|
|
Check eACL Deny and Allow All
|
|
[Arguments] ${KEY} ${DENY_EACL} ${ALLOW_EACL}
|
|
|
|
${CID} = Create Container Public
|
|
${S_OID_USER} = Put object ${USER_KEY} ${FILE_S} ${CID} ${EMPTY} ${FILE_USR_HEADER}
|
|
${D_OID_USER} = Put object ${USER_KEY} ${FILE_S} ${CID} ${EMPTY} ${FILE_USR_HEADER_DEL}
|
|
@{S_OBJ_H} = Create List ${S_OID_USER}
|
|
|
|
Put object ${KEY} ${FILE_S} ${CID} ${EMPTY} ${FILE_OTH_HEADER}
|
|
|
|
Get object ${KEY} ${CID} ${S_OID_USER} ${EMPTY} local_file_eacl
|
|
Search object ${KEY} ${CID} ${EMPTY} ${EMPTY} ${FILE_USR_HEADER} ${S_OBJ_H}
|
|
Head object ${KEY} ${CID} ${S_OID_USER} ${EMPTY}
|
|
|
|
Get Range ${KEY} ${CID} ${S_OID_USER} s_get_range ${EMPTY} 0:256
|
|
Get Range Hash ${KEY} ${CID} ${S_OID_USER} ${EMPTY} 0:256
|
|
Delete object ${KEY} ${CID} ${D_OID_USER} ${EMPTY}
|
|
|
|
Set eACL ${USER_KEY} ${CID} ${DENY_EACL} --await
|
|
|
|
# The current ACL cache lifetime is 30 sec
|
|
Sleep ${NEOFS_CONTRACT_CACHE_TIMEOUT}
|
|
|
|
Run Keyword And Expect Error *
|
|
... Put object ${KEY} ${FILE_S} ${CID} ${EMPTY} ${FILE_USR_HEADER}
|
|
Run Keyword And Expect Error *
|
|
... Get object ${KEY} ${CID} ${S_OID_USER} ${EMPTY} local_file_eacl
|
|
Run Keyword And Expect Error *
|
|
... Search object ${KEY} ${CID} ${EMPTY} ${EMPTY} ${FILE_USR_HEADER} ${S_OBJ_H}
|
|
Run Keyword And Expect Error *
|
|
... Head object ${KEY} ${CID} ${S_OID_USER} ${EMPTY}
|
|
Run Keyword And Expect Error *
|
|
... Get Range ${KEY} ${CID} ${S_OID_USER} s_get_range ${EMPTY} 0:256
|
|
Run Keyword And Expect Error *
|
|
... Get Range Hash ${KEY} ${CID} ${S_OID_USER} ${EMPTY} 0:256
|
|
Run Keyword And Expect Error *
|
|
... Delete object ${KEY} ${CID} ${S_OID_USER} ${EMPTY}
|
|
|
|
Set eACL ${USER_KEY} ${CID} ${ALLOW_EACL} --await
|
|
|
|
# The current ACL cache lifetime is 30 sec
|
|
Sleep ${NEOFS_CONTRACT_CACHE_TIMEOUT}
|
|
|
|
Put object ${KEY} ${FILE_S} ${CID} ${EMPTY} ${FILE_OTH_HEADER}
|
|
Get object ${KEY} ${CID} ${S_OID_USER} ${EMPTY} local_file_eacl
|
|
Search object ${KEY} ${CID} ${EMPTY} ${EMPTY} ${FILE_USR_HEADER} ${S_OBJ_H}
|
|
Head object ${KEY} ${CID} ${S_OID_USER} ${EMPTY}
|
|
Get Range ${KEY} ${CID} ${S_OID_USER} s_get_range ${EMPTY} 0:256
|
|
Get Range Hash ${KEY} ${CID} ${S_OID_USER} ${EMPTY} 0:256
|
|
Delete object ${KEY} ${CID} ${S_OID_USER} ${EMPTY}
|
|
|