[#1002] ir: Add subnet check to the container Put process

Signed-off-by: Pavel Karpy <carpawell@nspcc.ru>
This commit is contained in:
Pavel Karpy 2021-12-01 15:45:35 +03:00 committed by LeL
parent 2245bf85d8
commit 1cee1b8f93
3 changed files with 48 additions and 0 deletions

View file

@ -714,6 +714,7 @@ func New(ctx context.Context, log *zap.Logger, cfg *viper.Viper) (*Server, error
NeoFSIDClient: neofsIDClient, NeoFSIDClient: neofsIDClient,
NetworkState: server.netmapClient, NetworkState: server.netmapClient,
NotaryDisabled: server.sideNotaryConfig.disabled, NotaryDisabled: server.sideNotaryConfig.disabled,
SubnetClient: subnetClient,
}) })
if err != nil { if err != nil {
return nil, err return nil, err

View file

@ -12,11 +12,13 @@ import (
"github.com/nspcc-dev/neofs-node/pkg/core/container" "github.com/nspcc-dev/neofs-node/pkg/core/container"
"github.com/nspcc-dev/neofs-node/pkg/morph/client/container/wrapper" "github.com/nspcc-dev/neofs-node/pkg/morph/client/container/wrapper"
neofsid "github.com/nspcc-dev/neofs-node/pkg/morph/client/neofsid/wrapper" neofsid "github.com/nspcc-dev/neofs-node/pkg/morph/client/neofsid/wrapper"
morphsubnet "github.com/nspcc-dev/neofs-node/pkg/morph/client/subnet"
"github.com/nspcc-dev/neofs-node/pkg/morph/event" "github.com/nspcc-dev/neofs-node/pkg/morph/event"
containerEvent "github.com/nspcc-dev/neofs-node/pkg/morph/event/container" containerEvent "github.com/nspcc-dev/neofs-node/pkg/morph/event/container"
containerSDK "github.com/nspcc-dev/neofs-sdk-go/container" containerSDK "github.com/nspcc-dev/neofs-sdk-go/container"
cid "github.com/nspcc-dev/neofs-sdk-go/container/id" cid "github.com/nspcc-dev/neofs-sdk-go/container/id"
"github.com/nspcc-dev/neofs-sdk-go/session" "github.com/nspcc-dev/neofs-sdk-go/session"
subnetid "github.com/nspcc-dev/neofs-sdk-go/subnet/id"
"go.uber.org/zap" "go.uber.org/zap"
) )
@ -84,6 +86,12 @@ func (cp *Processor) checkPutContainer(ctx *putContainerContext) error {
return fmt.Errorf("invalid binary container: %w", err) return fmt.Errorf("invalid binary container: %w", err)
} }
// check owner allowance in the subnetwork
err = checkSubnet(cp.subnetClient, cnr)
if err != nil {
return fmt.Errorf("incorrect subnetwork: %w", err)
}
// check native name and zone // check native name and zone
err = checkNNS(ctx, cnr) err = checkNNS(ctx, cnr)
if err != nil { if err != nil {
@ -275,3 +283,36 @@ func checkNNS(ctx *putContainerContext, cnr *containerSDK.Container) error {
return nil return nil
} }
func checkSubnet(subCli *morphsubnet.Client, cnr *containerSDK.Container) error {
prm := morphsubnet.UserAllowedPrm{}
subID := cnr.PlacementPolicy().SubnetID()
if subID == nil || subnetid.IsZero(*subID) {
return nil
}
rawSubID, err := subID.Marshal()
if err != nil {
return fmt.Errorf("could not marshal container subnetwork: %w", err)
}
ownerID, err := cnr.OwnerID().Marshal()
if err != nil {
return fmt.Errorf("could not marshal container ownerID: %w", err)
}
prm.SetID(rawSubID)
prm.SetClient(ownerID)
res, err := subCli.UserAllowed(prm)
if err != nil {
return fmt.Errorf("could not check user in contract: %w", err)
}
if !res.Allowed() {
return fmt.Errorf("user is not allowed to create containers in %s subnetwork", subID)
}
return nil
}

View file

@ -7,6 +7,7 @@ import (
"github.com/nspcc-dev/neo-go/pkg/core/mempoolevent" "github.com/nspcc-dev/neo-go/pkg/core/mempoolevent"
"github.com/nspcc-dev/neofs-node/pkg/morph/client/container/wrapper" "github.com/nspcc-dev/neofs-node/pkg/morph/client/container/wrapper"
neofsid "github.com/nspcc-dev/neofs-node/pkg/morph/client/neofsid/wrapper" neofsid "github.com/nspcc-dev/neofs-node/pkg/morph/client/neofsid/wrapper"
morphsubnet "github.com/nspcc-dev/neofs-node/pkg/morph/client/subnet"
"github.com/nspcc-dev/neofs-node/pkg/morph/event" "github.com/nspcc-dev/neofs-node/pkg/morph/event"
containerEvent "github.com/nspcc-dev/neofs-node/pkg/morph/event/container" containerEvent "github.com/nspcc-dev/neofs-node/pkg/morph/event/container"
"github.com/panjf2000/ants/v2" "github.com/panjf2000/ants/v2"
@ -26,6 +27,7 @@ type (
alphabetState AlphabetState alphabetState AlphabetState
cnrClient *wrapper.Wrapper // notary must be enabled cnrClient *wrapper.Wrapper // notary must be enabled
idClient *neofsid.ClientWrapper idClient *neofsid.ClientWrapper
subnetClient *morphsubnet.Client
netState NetworkState netState NetworkState
notaryDisabled bool notaryDisabled bool
} }
@ -37,6 +39,7 @@ type (
AlphabetState AlphabetState AlphabetState AlphabetState
ContainerClient *wrapper.Wrapper ContainerClient *wrapper.Wrapper
NeoFSIDClient *neofsid.ClientWrapper NeoFSIDClient *neofsid.ClientWrapper
SubnetClient *morphsubnet.Client
NetworkState NetworkState NetworkState NetworkState
NotaryDisabled bool NotaryDisabled bool
} }
@ -72,6 +75,8 @@ func New(p *Params) (*Processor, error) {
return nil, errors.New("ir/container: NeoFS ID client is not set") return nil, errors.New("ir/container: NeoFS ID client is not set")
case p.NetworkState == nil: case p.NetworkState == nil:
return nil, errors.New("ir/container: network state is not set") return nil, errors.New("ir/container: network state is not set")
case p.SubnetClient == nil:
return nil, errors.New("ir/container: subnet client is not set")
} }
p.Log.Debug("container worker pool", zap.Int("size", p.PoolSize)) p.Log.Debug("container worker pool", zap.Int("size", p.PoolSize))
@ -89,6 +94,7 @@ func New(p *Params) (*Processor, error) {
idClient: p.NeoFSIDClient, idClient: p.NeoFSIDClient,
netState: p.NetworkState, netState: p.NetworkState,
notaryDisabled: p.NotaryDisabled, notaryDisabled: p.NotaryDisabled,
subnetClient: p.SubnetClient,
}, nil }, nil
} }