Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot create container using session token #1464

Closed
KirillovDenis opened this issue Jun 1, 2022 · 4 comments
Closed

Cannot create container using session token #1464

KirillovDenis opened this issue Jun 1, 2022 · 4 comments
Assignees
Labels
bug Something isn't working neofs-ir Inner Ring node application issues
Milestone

Comments

@KirillovDenis
Copy link
Contributor

I try to create bucket/container using s3 (it uses a session token to do this). On latest release v0.28.1 I can do this, but on current master I can't.

Expected Behavior

Container is created with session token

Current Behavior

Container isn't created.
neofs-ir error:

2022-06-01T13:32:25.832Z	info	container/handlers.go:16	notification	{"type": "container put", "id": "8dwjFow4AExfXkfMXuFfXJE7MJbaFMNsUdVoW1juRyNx"}
2022-06-01T13:32:25.834Z	error	container/process_container.go:50	put container check failed	{"error": "auth container creation: key is not a container owner's key"}

Steps to Reproduce (for bugs)

I use latest master of neofs-node and latest master of neofs-s3-gw

  1. Issue secret using s3 authmate
  2. Try to create bucket

Possible solution

It seems that session token is missed somewhere because the binTokenSession is nil here

Your Environment

  • Version used: 0.28.1-66-gcc6209e8
  • Operating System and version (uname -a): Linux denis-nspcc 5.13.0-41-generic # 46~20.04.1-Ubuntu SMP Wed Apr 20 13:16:21 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
@cthulhu-rider
Copy link
Contributor

Should be fixed after #1454 by 2d586a8.

@alexvanin
Copy link
Contributor

Can be closed, I think?

@KirillovDenis
Copy link
Contributor Author

It seems there is another related problem with object removal:
ir error:

2022-06-07T09:27:57.272Z	error	container/process_container.go:152	delete container check failed	{"error": "auth container removal: invalid signature"}

@KirillovDenis
Copy link
Contributor Author

KirillovDenis commented Jun 7, 2022

As I can see during debug verificationsKeys contains only container owner so signature is invalid.

for i := range verificationKeys {

Though session token (for DELETE operation) is provided and valid

cthulhu-rider pushed a commit to cthulhu-rider/neofs-node that referenced this issue Jun 7, 2022
…ssions

In previous implementation `verifySignature` method of container
processor worked incorrectly for operations without a key and with
session: processor tried to verify signature with one of the bound owner
keys instead of session one.

Use `VerifySessionDataSignature` method to check the signature if
session is used. Refactor `verifySignature` a bit with session check
highlighting for readability.

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>
cthulhu-rider pushed a commit to cthulhu-rider/neofs-node that referenced this issue Jun 7, 2022
…ssions

In previous implementation `verifySignature` method of container
processor worked incorrectly for operations without a key and with
session: processor tried to verify signature with one of the bound owner
keys instead of session one.

Use `VerifySessionDataSignature` method to check the signature if
session is used. Refactor `verifySignature` a bit with session check
highlighting for readability.

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>
cthulhu-rider pushed a commit to cthulhu-rider/neofs-node that referenced this issue Jun 7, 2022
…ssions

In previous implementation `verifySignature` method of container
processor worked incorrectly for operations without a key and with
session: processor tried to verify signature with one of the bound owner
keys instead of session one.

Use `VerifySessionDataSignature` method to check the signature if
session is used. Refactor `verifySignature` a bit with session check
highlighting for readability.

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>
cthulhu-rider pushed a commit that referenced this issue Jun 7, 2022
In previous implementation `verifySignature` method of container
processor worked incorrectly for operations without a key and with
session: processor tried to verify signature with one of the bound owner
keys instead of session one.

Use `VerifySessionDataSignature` method to check the signature if
session is used. Refactor `verifySignature` a bit with session check
highlighting for readability.

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>
cthulhu-rider pushed a commit that referenced this issue Jun 7, 2022
In previous implementation `verifySignature` method of container
processor worked incorrectly for operations without a key and with
session: processor tried to verify signature with one of the bound owner
keys instead of session one.

Use `VerifySessionDataSignature` method to check the signature if
session is used. Refactor `verifySignature` a bit with session check
highlighting for readability.

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>
@cthulhu-rider cthulhu-rider added bug Something isn't working neofs-ir Inner Ring node application issues and removed triage labels Jun 8, 2022
aprasolova pushed a commit to aprasolova/neofs-node that referenced this issue Oct 19, 2022
…ssions

In previous implementation `verifySignature` method of container
processor worked incorrectly for operations without a key and with
session: processor tried to verify signature with one of the bound owner
keys instead of session one.

Use `VerifySessionDataSignature` method to check the signature if
session is used. Refactor `verifySignature` a bit with session check
highlighting for readability.

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working neofs-ir Inner Ring node application issues
Projects
None yet
Development

No branches or pull requests

4 participants