dkirillov/frostfs-node
1
0
Fork 0
forked from TrueCloudLab/frostfs-node
Code Issues Pull requests Projects Releases Packages Wiki Activity

[#XX] Test policy engine check

Browse source 
Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>
This commit is contained in:
Denis Kirillov 2023-12-01 12:58:45 +03:00
parent b2c63e57ba
commit 4628c9ba8e
7 changed files with 28 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
go.mod
View file

@ -8,7 +8,7 @@ require (
git.frostfs.info/TrueCloudLab/frostfs-observability v0.0.0-20231101111734-b3ad3335ff65
git.frostfs.info/TrueCloudLab/frostfs-sdk-go v0.0.0-20231122162120-56debcfa569e
git.frostfs.info/TrueCloudLab/hrw v1.2.1
git.frostfs.info/TrueCloudLab/policy-engine v0.0.0-20231115094736-5db67021e10f
git.frostfs.info/TrueCloudLab/policy-engine v0.0.0-20231128145636-a0a35bf4bf31
git.frostfs.info/TrueCloudLab/tzhash v1.8.0
github.com/cheggaaa/pb v1.0.29
github.com/chzyer/readline v1.5.1

BIN
go.sum
View file

Binary file not shown.

10
pkg/services/control/server/policy_engine.go
View file

@ -8,7 +8,7 @@ import (
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control"
cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
engine "git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
nativeschema "git.frostfs.info/TrueCloudLab/policy-engine/schema/native"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/status"
@ -37,10 +37,8 @@ func (s *Server) AddChainLocalOverride(_ context.Context, req *control.AddChainL
s.apeChainCounter.Add(1)
// TODO (aarifullin): the such chain id is not well-designed yet.
chain.ID = apechain.ID(fmt.Sprintf("%s:%d", apechain.Ingress, s.apeChainCounter.Load()))
resource := fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, cid.EncodeToString())
if _, err = src.LocalStorage().AddOverride(apechain.Ingress, resource, &chain); err != nil {
if err = src.MorphRuleChainStorage().AddMorphRuleChain(apechain.Ingress, engine.NamespaceTarget(""), &chain); err != nil {
return nil, status.Error(getCodeByLocalStorageErr(err), err.Error())
}
@ -144,8 +142,8 @@ func (s *Server) RemoveChainLocalOverride(_ context.Context, req *control.Remove
return nil, status.Error(codes.Internal, err.Error())
}
resource := fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, cid.EncodeToString())
if err = src.LocalStorage().RemoveOverride(apechain.Ingress, resource, apechain.ID(req.GetBody().GetChainId())); err != nil {
//resource := fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, cid.EncodeToString())
if err = src.MorphRuleChainStorage().RemoveMorphRuleChain(apechain.Ingress, engine.NamespaceTarget(""), apechain.ID(req.GetBody().GetChainId())); err != nil {
return nil, status.Error(getCodeByLocalStorageErr(err), err.Error())
}
resp := &control.RemoveChainLocalOverrideResponse{

4
pkg/services/object/acl/ape.go
View file

@ -8,6 +8,7 @@ import (
v2 "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/object/acl/v2"
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/util/logger"
apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
)
@ -26,7 +27,8 @@ func NewAPEChecker(log *logger.Logger, apeSrc container.AccessPolicyEngineChainS
}
func (c *apeCheckerImpl) CheckIfRequestPermitted(reqInfo v2.RequestInfo) error {
cnr := reqInfo.ContainerID()
//cnr := reqInfo.ContainerID()
var cnr cid.ID
chainCache, err := c.apeSrc.GetChainSource(cnr)
if err != nil {

13
pkg/services/object/acl/ape_request.go
View file

@ -1,6 +1,7 @@
package acl
import (
"encoding/hex"
"fmt"
v2 "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/object/acl/v2"
@ -40,15 +41,21 @@ func getResource(reqInfo v2.RequestInfo) *resource {
} else {
name = fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, cid.EncodeToString())
}
properties := make(map[string]string, len(reqInfo.ObjectAttributes()))
for _, attr := range reqInfo.ObjectAttributes() {
properties[attr.GetKey()] = attr.GetValue()
}
return &resource{
name: name,
properties: make(map[string]string),
properties: properties,
}
}
func getProperties(_ v2.RequestInfo) map[string]string {
func getProperties(reqInfo v2.RequestInfo) map[string]string {
return map[string]string{
nativeschema.PropertyKeyActorPublicKey: "",
nativeschema.PropertyKeyActorPublicKey: hex.EncodeToString(reqInfo.SenderKey()),
nativeschema.PropertyKeyActorRole: "",
}
}

8
pkg/services/object/acl/v2/request.go
View file

@ -4,6 +4,7 @@ import (
"crypto/ecdsa"
"fmt"
objectv2 "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/object"
sessionV2 "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/session"
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl"
@ -28,6 +29,8 @@ type RequestInfo struct {
// e.g. Put, Search
obj *oid.ID
objectAttributes []objectv2.Attribute
senderKey []byte
bearer *bearer.Token // bearer token of request
@ -67,6 +70,11 @@ func (r RequestInfo) ContainerID() cid.ID {
return r.idCnr
}
// ObjectAttributes return object attributes.
func (r RequestInfo) ObjectAttributes() []objectv2.Attribute {
return r.objectAttributes
}
// CleanBearer forces cleaning bearer token information.
func (r *RequestInfo) CleanBearer() {
r.bearer = nil

2
pkg/services/object/acl/v2/service.go
View file

@ -566,6 +566,8 @@ func (p putStreamBasicChecker) Send(ctx context.Context, request *objectV2.PutRe
reqInfo.obj = obj
reqInfo.objectAttributes = part.GetHeader().GetAttributes()
if err := p.source.apeChecker.CheckIfRequestPermitted(reqInfo); err != nil {
return err
}