s.makhov/frostfs-node
1
0
Fork 0
forked from TrueCloudLab/frostfs-node
Code Pull requests Activity

[#1218] object: Fix bearer token validation

Browse source 
Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>
This commit is contained in:
Airat Arifullin 2024-07-02 13:08:59 +03:00 committed by Evgenii Stratonikov
parent a378ff9cf6
commit f3a861806e
1 changed files with 8 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
pkg/services/object/ape/checker.go
View file

@ -97,22 +97,23 @@ func isValidBearer(token *bearer.Token, ownerCnr user.ID, containerID cid.ID, pu
return nil return nil
} }
// 1. First check token lifetime. Simplest verification. // First check token lifetime. Simplest verification.
if token.InvalidAt(st.CurrentEpoch()) { if token.InvalidAt(st.CurrentEpoch()) {
return errBearerExpired return errBearerExpired
} }
// 2. Then check if bearer token is signed correctly. // Then check if bearer token is signed correctly.
if !token.VerifySignature() { if !token.VerifySignature() {
return errBearerInvalidSignature return errBearerInvalidSignature
} }
// 3. Then check if container is either empty or equal to the container in the request. // Check for ape overrides defined in the bearer token.
apeOverride := token.APEOverride() apeOverride := token.APEOverride()
if apeOverride.Target.TargetType != ape.TargetTypeContainer { if len(apeOverride.Chains) > 0 && apeOverride.Target.TargetType != ape.TargetTypeContainer {
return errInvalidTargetType return fmt.Errorf("%w: %s", errInvalidTargetType, apeOverride.Target.TargetType.ToV2().String())
} }
// Then check if container is either empty or equal to the container in the request.
var targetCnr cid.ID var targetCnr cid.ID
err := targetCnr.DecodeString(apeOverride.Target.Name) err := targetCnr.DecodeString(apeOverride.Target.Name)
if err != nil { if err != nil {
@ -122,12 +123,12 @@ func isValidBearer(token *bearer.Token, ownerCnr user.ID, containerID cid.ID, pu
return errBearerInvalidContainerID return errBearerInvalidContainerID
} }
// 4. Then check if container owner signed this token. // Then check if container owner signed this token.
if !bearer.ResolveIssuer(*token).Equals(ownerCnr) { if !bearer.ResolveIssuer(*token).Equals(ownerCnr) {
return errBearerNotSignedByOwner return errBearerNotSignedByOwner
} }
// 5. Then check if request sender has rights to use this token. // Then check if request sender has rights to use this token.
var usrSender user.ID var usrSender user.ID
user.IDFromKey(&usrSender, (ecdsa.PublicKey)(*publicKey)) user.IDFromKey(&usrSender, (ecdsa.PublicKey)(*publicKey))