[#505] ir/container: Verify signature of binary eACL tables

Add signature check to `checkSetEACL` method of the `setEACL` notification
handler in Container processor.

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>
This commit is contained in:
Leonard Lyubich 2021-05-19 15:26:41 +03:00 committed by Alex Vanin
parent 87d83174d9
commit b0271aa478

View file

@ -1,6 +1,12 @@
package container package container
import ( import (
"crypto/elliptic"
"crypto/sha256"
"errors"
"fmt"
"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
"github.com/nspcc-dev/neofs-node/pkg/morph/event/container" "github.com/nspcc-dev/neofs-node/pkg/morph/event/container"
"go.uber.org/zap" "go.uber.org/zap"
) )
@ -24,6 +30,21 @@ func (cp *Processor) processSetEACL(e container.SetEACL) {
} }
func (cp *Processor) checkSetEACL(e container.SetEACL) error { func (cp *Processor) checkSetEACL(e container.SetEACL) error {
// verify signature
key, err := keys.NewPublicKeyFromBytes(e.PublicKey(), elliptic.P256())
if err != nil {
return fmt.Errorf("invalid key: %w", err)
}
table := e.Table()
tableHash := sha256.Sum256(table)
if !key.Verify(e.Signature(), tableHash[:]) {
return errors.New("invalid signature")
}
// TODO: check key ownership
return nil return nil
} }