From 6a8c835b2405b2bb5d6f0946dd5979a3fd5ee345 Mon Sep 17 00:00:00 2001 From: Pavel Karpy Date: Fri, 6 Sep 2024 05:49:27 +0300 Subject: [PATCH 1/4] go.mod: update neofs-api-go dependency It has `Replicate` with meta signatures. Signed-off-by: Pavel Karpy --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index cf90a80197..1ff2d619e9 100644 --- a/go.mod +++ b/go.mod @@ -16,7 +16,7 @@ require ( github.com/nspcc-dev/hrw/v2 v2.0.1 github.com/nspcc-dev/locode-db v0.6.0 github.com/nspcc-dev/neo-go v0.106.3 - github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240305074711-35bc78d84dc4 + github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240827150555-5ce597aa14ea github.com/nspcc-dev/neofs-contract v0.20.0 github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.12.0.20240809202351-256513c1b29b github.com/nspcc-dev/tzhash v1.8.0 diff --git a/go.sum b/go.sum index 7b438741a8..1d4b808ed4 100644 --- a/go.sum +++ b/go.sum @@ -139,8 +139,8 @@ github.com/nspcc-dev/neo-go v0.106.3 h1:HEyhgkjQY+HfBzotMJ12xx2VuOUphkngZ4kEkjvX github.com/nspcc-dev/neo-go v0.106.3/go.mod h1:3vEwJ2ld12N7HRGCaH/l/7EwopplC/+8XdIdPDNmD/M= github.com/nspcc-dev/neo-go/pkg/interop v0.0.0-20240729160116-d8e3e57f88f2 h1:tvPkeqnIeBFhM1b1Iwwi0jJiuoxkY4Xbk8mP3W1YVUY= github.com/nspcc-dev/neo-go/pkg/interop v0.0.0-20240729160116-d8e3e57f88f2/go.mod h1:/vrbWSHc7YS1KSYhVOyyeucXW/e+1DkVBOgnBEXUCeY= -github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240305074711-35bc78d84dc4 h1:arN0Ypn+jawZpu1BND7TGRn44InAVIqKygndsx0y2no= -github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240305074711-35bc78d84dc4/go.mod h1:7Tm1NKEoUVVIUlkVwFrPh7GG5+Lmta2m7EGr4oVpBd8= +github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240827150555-5ce597aa14ea h1:mK0EMGLvunXcFyq7fBURS/CsN4MH+4nlYiqn6pTwWAU= +github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240827150555-5ce597aa14ea/go.mod h1:YzhD4EZmC9Z/PNyd7ysC7WXgIgURc9uCG1UWDeV027Y= github.com/nspcc-dev/neofs-contract v0.20.0 h1:ARE/3mSN+P9qi/10NBsf7QyPiYrvnxeEgYUN13vHRlo= github.com/nspcc-dev/neofs-contract v0.20.0/go.mod h1:YxtKYE/5cMNiqwWcQWzeizbB9jizauLni+p8wXxfhsQ= github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.12.0.20240809202351-256513c1b29b h1:/7jXQP5pf+M0kRFC1gg5GEdTPkvotpMHxjSXIbMZaGQ= From b724d1474fcdec0df7ad6d449c5886ef85a64741 Mon Sep 17 00:00:00 2001 From: Pavel Karpy Date: Fri, 6 Sep 2024 06:06:26 +0300 Subject: [PATCH 2/4] node/object/put: exchange meta signatures during replication Initial replication requires nodes to sign object's main meta information and respond with it. Meta information is not sent on wire and treated as a fixed ordered NEO's map. Signatures are verified, not stored/send anywhere yet. It follows the recent API extension: https://github.com/nspcc-dev/neofs-api/issues/299. Further, this extension is planned to have a contract adoption: https://github.com/nspcc-dev/neofs-contract/issues/413 and https://github.com/nspcc-dev/neofs-contract/issues/414. Closes #2876. Signed-off-by: Pavel Karpy --- cmd/neofs-node/object.go | 3 +- cmd/neofs-node/transport.go | 36 +++++++-- pkg/core/object/replicate.go | 73 +++++++++++++++++++ pkg/core/object/replicate_test.go | 65 +++++++++++++++++ .../transport/object/grpc/replication.go | 53 +++++++++++++- .../transport/object/grpc/replication_test.go | 60 ++++++++++++--- pkg/network/transport/object/grpc/service.go | 11 ++- pkg/services/object/put/distributed.go | 46 ++++++++++-- pkg/services/object/put/local.go | 7 +- pkg/services/object/put/proto.go | 7 +- pkg/services/object/put/proto_test.go | 5 +- pkg/services/object/put/remote.go | 26 ++++--- pkg/services/object/put/service.go | 3 +- 13 files changed, 350 insertions(+), 45 deletions(-) create mode 100644 pkg/core/object/replicate.go create mode 100644 pkg/core/object/replicate_test.go diff --git a/cmd/neofs-node/object.go b/cmd/neofs-node/object.go index 701d23b77c..24addfe663 100644 --- a/cmd/neofs-node/object.go +++ b/cmd/neofs-node/object.go @@ -38,6 +38,7 @@ import ( truststorage "github.com/nspcc-dev/neofs-node/pkg/services/reputation/local/storage" "github.com/nspcc-dev/neofs-sdk-go/client" cid "github.com/nspcc-dev/neofs-sdk-go/container/id" + neofsecdsa "github.com/nspcc-dev/neofs-sdk-go/crypto/ecdsa" eaclSDK "github.com/nspcc-dev/neofs-sdk-go/eacl" netmapsdk "github.com/nspcc-dev/neofs-sdk-go/netmap" objectSDK "github.com/nspcc-dev/neofs-sdk-go/object" @@ -350,7 +351,7 @@ func initObjectService(c *cfg) { firstSvc = objectService.NewMetricCollector(signSvc, c.metricsCollector) } - server := objectTransportGRPC.New(firstSvc, objNode) + server := objectTransportGRPC.New(firstSvc, objNode, neofsecdsa.SignerRFC6979(c.shared.basics.key.PrivateKey)) for _, srv := range c.cfgGRPC.servers { objectGRPC.RegisterObjectServiceServer(srv, server) diff --git a/cmd/neofs-node/transport.go b/cmd/neofs-node/transport.go index 33a5dc56e4..156be9a54c 100644 --- a/cmd/neofs-node/transport.go +++ b/cmd/neofs-node/transport.go @@ -5,6 +5,7 @@ import ( "fmt" objectGRPC "github.com/nspcc-dev/neofs-api-go/v2/object/grpc" + "github.com/nspcc-dev/neofs-api-go/v2/refs" rawclient "github.com/nspcc-dev/neofs-api-go/v2/rpc/client" "github.com/nspcc-dev/neofs-api-go/v2/rpc/common" "github.com/nspcc-dev/neofs-api-go/v2/rpc/grpc" @@ -12,6 +13,7 @@ import ( "github.com/nspcc-dev/neofs-api-go/v2/status" coreclient "github.com/nspcc-dev/neofs-node/pkg/core/client" apistatus "github.com/nspcc-dev/neofs-sdk-go/client/status" + neofscrypto "github.com/nspcc-dev/neofs-sdk-go/crypto" ) type transport struct { @@ -20,17 +22,17 @@ type transport struct { // SendReplicationRequestToNode connects to described node and sends prepared // replication request message to it. -func (x *transport) SendReplicationRequestToNode(ctx context.Context, req []byte, node coreclient.NodeInfo) error { +func (x *transport) SendReplicationRequestToNode(ctx context.Context, req []byte, node coreclient.NodeInfo) (*neofscrypto.Signature, error) { c, err := x.clients.Get(node) if err != nil { - return fmt.Errorf("connect to remote node: %w", err) + return nil, fmt.Errorf("connect to remote node: %w", err) } - return c.ExecRaw(func(c *rawclient.Client) error { + var resp replicateResponse + err = c.ExecRaw(func(c *rawclient.Client) error { // this will be changed during NeoFS API Go deprecation. Code most likely be // placed in SDK m := common.CallMethodInfo{Service: "neo.fs.v2.object.ObjectService", Name: "Replicate"} - var resp replicateResponse err = rawclient.SendUnary(c, m, rawclient.BinaryMessage(req), &resp, rawclient.WithContext(ctx), rawclient.AllowBinarySendingOnly()) if err != nil { @@ -38,9 +40,13 @@ func (x *transport) SendReplicationRequestToNode(ctx context.Context, req []byte } return resp.err }) + return resp.sig, err } -type replicateResponse struct{ err error } +type replicateResponse struct { + sig *neofscrypto.Signature + err error +} func (x replicateResponse) ToGRPCMessage() grpc.Message { return new(objectGRPC.ReplicateResponse) } @@ -60,6 +66,26 @@ func (x *replicateResponse) FromGRPCMessage(gm grpc.Message) error { } x.err = apistatus.ErrorFromV2(st) + if x.err != nil { + return nil + } + + sig := m.GetObjectSignature() + if sig == nil { + return nil + } + + sigV2 := new(refs.Signature) + err := sigV2.Unmarshal(sig) + if err != nil { + return fmt.Errorf("decoding signature from proto message: %w", err) + } + + x.sig = new(neofscrypto.Signature) + err = x.sig.ReadFromV2(*sigV2) + if err != nil { + return fmt.Errorf("invalid signature: %w", err) + } return nil } diff --git a/pkg/core/object/replicate.go b/pkg/core/object/replicate.go new file mode 100644 index 0000000000..3a1daf23ea --- /dev/null +++ b/pkg/core/object/replicate.go @@ -0,0 +1,73 @@ +package object + +import ( + "fmt" + + "github.com/nspcc-dev/neo-go/pkg/vm/stackitem" + cid "github.com/nspcc-dev/neofs-sdk-go/container/id" + oid "github.com/nspcc-dev/neofs-sdk-go/object/id" +) + +const ( + validInterval = 10 // in epochs + currentVersion = 6 // it is also a number of fields +) + +const ( + cidKey = "cid" + oidKey = "oid" + sizeKey = "size" + deletedKey = "deleted" + lockedKey = "locked" + validUntilKey = "validuntil" +) + +// EncodeReplicationMetaInfo uses NEO's map (strict order) serialized format as a raw +// representation of object's meta information. +// +// This (ordered) format is used (keys are strings): +// +// "cid": _raw_ container ID (32 bytes) +// "oid": _raw_ object ID (32 bytes) +// "size": payload size +// "deleted": array of _raw_ object IDs +// "locked": array of _raw_ object IDs +// "validuntil": last valid epoch number for meta information +// +// Last valid epoch is object's creation epoch + 10. +func EncodeReplicationMetaInfo(cID cid.ID, oID oid.ID, pSize uint64, deleted, locked []oid.ID, createdAt uint64) []byte { + kvs := []stackitem.MapElement{ + kv(cidKey, cID[:]), + kv(oidKey, oID[:]), + kv(sizeKey, pSize), + oidsKV(deletedKey, deleted), + oidsKV(lockedKey, locked), + kv(validUntilKey, createdAt+validInterval), + } + + result, err := stackitem.Serialize(stackitem.NewMapWithValue(kvs)) + if err != nil { + // all the errors in the stackitem relate only cases when it is + // impossible to use serialized values (too many values, unsupported + // types, etc.), unexpected errors at all + panic(fmt.Errorf("unexpected stackitem map serialization failure: %v", err)) + } + + return result +} + +func kv(k string, value any) stackitem.MapElement { + return stackitem.MapElement{ + Key: stackitem.Make(k), + Value: stackitem.Make(value), + } +} + +func oidsKV(fieldKey string, oIDs []oid.ID) stackitem.MapElement { + res := make([]stackitem.Item, 0, len(oIDs)) + for _, oID := range oIDs { + res = append(res, stackitem.NewByteArray(oID[:])) + } + + return kv(fieldKey, res) +} diff --git a/pkg/core/object/replicate_test.go b/pkg/core/object/replicate_test.go new file mode 100644 index 0000000000..2503cf3e05 --- /dev/null +++ b/pkg/core/object/replicate_test.go @@ -0,0 +1,65 @@ +package object + +import ( + "math/big" + "math/rand/v2" + "testing" + + "github.com/nspcc-dev/neo-go/pkg/vm/stackitem" + cidtest "github.com/nspcc-dev/neofs-sdk-go/container/id/test" + oid "github.com/nspcc-dev/neofs-sdk-go/object/id" + oidtest "github.com/nspcc-dev/neofs-sdk-go/object/id/test" + "github.com/stretchr/testify/require" +) + +func TestMetaInfo(t *testing.T) { + oID := oidtest.ID() + cID := cidtest.ID() + size := rand.Uint64() + deleted := oidtest.IDs(10) + locked := oidtest.IDs(10) + validUntil := rand.Uint64() + + raw := EncodeReplicationMetaInfo(cID, oID, size, deleted, locked, validUntil) + item, err := stackitem.Deserialize(raw) + require.NoError(t, err) + + require.Equal(t, stackitem.MapT, item.Type()) + mm, ok := item.Value().([]stackitem.MapElement) + require.True(t, ok) + + require.Len(t, mm, currentVersion) + + require.Equal(t, cidKey, string(mm[0].Key.Value().([]byte))) + require.Equal(t, cID[:], mm[0].Value.Value().([]byte)) + + require.Equal(t, oidKey, string(mm[1].Key.Value().([]byte))) + require.Equal(t, oID[:], mm[1].Value.Value().([]byte)) + + require.Equal(t, sizeKey, string(mm[2].Key.Value().([]byte))) + require.Equal(t, size, mm[2].Value.Value().(*big.Int).Uint64()) + + require.Equal(t, deletedKey, string(mm[3].Key.Value().([]byte))) + require.Equal(t, deleted, stackItemToOIDs(t, mm[3].Value)) + + require.Equal(t, lockedKey, string(mm[4].Key.Value().([]byte))) + require.Equal(t, locked, stackItemToOIDs(t, mm[4].Value)) + + require.Equal(t, validUntilKey, string(mm[5].Key.Value().([]byte))) + require.Equal(t, validUntil+validInterval, mm[5].Value.Value().(*big.Int).Uint64()) +} + +func stackItemToOIDs(t *testing.T, value stackitem.Item) []oid.ID { + value, ok := value.(*stackitem.Array) + require.True(t, ok) + + vv := value.Value().([]stackitem.Item) + res := make([]oid.ID, 0, len(vv)) + + for _, v := range vv { + raw := v.Value().([]byte) + res = append(res, oid.ID(raw)) + } + + return res +} diff --git a/pkg/network/transport/object/grpc/replication.go b/pkg/network/transport/object/grpc/replication.go index 0945acf1e0..90f74595d0 100644 --- a/pkg/network/transport/object/grpc/replication.go +++ b/pkg/network/transport/object/grpc/replication.go @@ -11,11 +11,13 @@ import ( refsv2 "github.com/nspcc-dev/neofs-api-go/v2/refs" refs "github.com/nspcc-dev/neofs-api-go/v2/refs/grpc" status "github.com/nspcc-dev/neofs-api-go/v2/status/grpc" + objectcore "github.com/nspcc-dev/neofs-node/pkg/core/object" apistatus "github.com/nspcc-dev/neofs-sdk-go/client/status" cid "github.com/nspcc-dev/neofs-sdk-go/container/id" neofscrypto "github.com/nspcc-dev/neofs-sdk-go/crypto" neofsecdsa "github.com/nspcc-dev/neofs-sdk-go/crypto/ecdsa" "github.com/nspcc-dev/neofs-sdk-go/object" + oid "github.com/nspcc-dev/neofs-sdk-go/object/id" ) // Replicate serves neo.fs.v2.object.ObjectService/Replicate RPC. @@ -178,7 +180,18 @@ func (s *Server) Replicate(_ context.Context, req *objectGRPC.ReplicateRequest) }}, nil } - return new(objectGRPC.ReplicateResponse), nil + resp := new(objectGRPC.ReplicateResponse) + if req.GetSignObject() { + resp.ObjectSignature, err = s.metaInfoSignature(*obj) + if err != nil { + return &objectGRPC.ReplicateResponse{Status: &status.Status{ + Code: codeInternal, + Message: fmt.Sprintf("failed to sign object meta information: %v", err), + }}, nil + } + } + + return resp, nil } func objectFromMessage(gMsg *objectGRPC.Object) (*object.Object, error) { @@ -190,3 +203,41 @@ func objectFromMessage(gMsg *objectGRPC.Object) (*object.Object, error) { return object.NewFromV2(&msg), nil } + +func (s *Server) metaInfoSignature(o object.Object) ([]byte, error) { + var deleted []oid.ID + var locked []oid.ID + switch o.Type() { + case object.TypeTombstone: + var t object.Tombstone + err := t.Unmarshal(o.Payload()) + if err != nil { + return nil, fmt.Errorf("reading tombstoned objects: %w", err) + } + + deleted = t.Members() + case object.TypeLock: + var l object.Lock + err := l.Unmarshal(o.Payload()) + if err != nil { + return nil, fmt.Errorf("reading locked objects: %w", err) + } + + locked = make([]oid.ID, l.NumberOfMembers()) + l.ReadMembers(locked) + default: + } + + metaInfo := objectcore.EncodeReplicationMetaInfo(o.GetContainerID(), o.GetID(), o.PayloadSize(), deleted, locked, o.CreationEpoch()) + + var sig neofscrypto.Signature + err := sig.Calculate(s.signer, metaInfo) + if err != nil { + return nil, fmt.Errorf("signature failure: %w", err) + } + + sigV2 := new(refsv2.Signature) + sig.WriteToV2(sigV2) + + return sigV2.StableMarshal(nil), nil +} diff --git a/pkg/network/transport/object/grpc/replication_test.go b/pkg/network/transport/object/grpc/replication_test.go index e48e34b72f..4ca247a45f 100644 --- a/pkg/network/transport/object/grpc/replication_test.go +++ b/pkg/network/transport/object/grpc/replication_test.go @@ -11,7 +11,9 @@ import ( objectV2 "github.com/nspcc-dev/neofs-api-go/v2/object" objectgrpc "github.com/nspcc-dev/neofs-api-go/v2/object/grpc" + refsv2 "github.com/nspcc-dev/neofs-api-go/v2/refs" refs "github.com/nspcc-dev/neofs-api-go/v2/refs/grpc" + objectcore "github.com/nspcc-dev/neofs-node/pkg/core/object" . "github.com/nspcc-dev/neofs-node/pkg/network/transport/object/grpc" objectSvc "github.com/nspcc-dev/neofs-node/pkg/services/object" cid "github.com/nspcc-dev/neofs-sdk-go/container/id" @@ -127,8 +129,9 @@ func (x *testNode) VerifyAndStoreObject(obj object.Object) error { return x.storeErr } -func anyValidRequest(tb testing.TB, signer neofscrypto.Signer, cnr cid.ID, objID oid.ID) *objectgrpc.ReplicateRequest { +func anyValidRequest(tb testing.TB, signer neofscrypto.Signer, cnr cid.ID, objID oid.ID) (*objectgrpc.ReplicateRequest, object.Object) { obj := objecttest.Object() + obj.SetType(object.TypeRegular) obj.SetContainerID(cnr) obj.SetID(objID) @@ -141,6 +144,7 @@ func anyValidRequest(tb testing.TB, signer neofscrypto.Signer, cnr cid.ID, objID Key: neofscrypto.PublicKeyBytes(signer.Public()), Sign: sig, }, + SignObject: false, } switch signer.Scheme() { @@ -154,19 +158,19 @@ func anyValidRequest(tb testing.TB, signer neofscrypto.Signer, cnr cid.ID, objID req.Signature.Scheme = refs.SignatureScheme_ECDSA_RFC6979_SHA256_WALLET_CONNECT } - return req + return req, obj } func TestServer_Replicate(t *testing.T) { var noCallNode noCallTestNode var noCallObjSvc noCallObjectService - noCallSrv := New(noCallObjSvc, &noCallNode) + noCallSrv := New(noCallObjSvc, &noCallNode, neofscryptotest.Signer()) clientSigner := neofscryptotest.Signer() clientPubKey := neofscrypto.PublicKeyBytes(clientSigner.Public()) serverPubKey := neofscrypto.PublicKeyBytes(neofscryptotest.Signer().Public()) cnr := cidtest.ID() objID := oidtest.ID() - req := anyValidRequest(t, clientSigner, cnr, objID) + req, _ := anyValidRequest(t, clientSigner, cnr, objID) t.Run("invalid/unsupported signature format", func(t *testing.T) { // note: verification is tested separately @@ -219,7 +223,7 @@ func TestServer_Replicate(t *testing.T) { expectedMsg: "unsupported scheme in the object signature field", }, } { - req := anyValidRequest(t, neofscryptotest.Signer(), cidtest.ID(), oidtest.ID()) + req, _ := anyValidRequest(t, neofscryptotest.Signer(), cidtest.ID(), oidtest.ID()) req.Signature = tc.fSig() resp, err := noCallSrv.Replicate(context.Background(), req) require.NoError(t, err, tc.name) @@ -324,7 +328,7 @@ func TestServer_Replicate(t *testing.T) { t.Run("apply storage policy failure", func(t *testing.T) { node := newTestNode(t, serverPubKey, clientPubKey, cnr, req.Object) - srv := New(noCallObjSvc, node) + srv := New(noCallObjSvc, node, neofscryptotest.Signer()) node.cnrErr = errors.New("any error") @@ -336,7 +340,7 @@ func TestServer_Replicate(t *testing.T) { t.Run("client or server mismatches object's storage policy", func(t *testing.T) { node := newTestNode(t, serverPubKey, clientPubKey, cnr, req.Object) - srv := New(noCallObjSvc, node) + srv := New(noCallObjSvc, node, neofscryptotest.Signer()) node.serverOutsideCnr = true node.clientOutsideCnr = true @@ -356,7 +360,7 @@ func TestServer_Replicate(t *testing.T) { t.Run("local storage failure", func(t *testing.T) { node := newTestNode(t, serverPubKey, clientPubKey, cnr, req.Object) - srv := New(noCallObjSvc, node) + srv := New(noCallObjSvc, node, neofscryptotest.Signer()) node.storeErr = errors.New("any error") @@ -366,9 +370,43 @@ func TestServer_Replicate(t *testing.T) { require.Equal(t, "failed to verify and store object locally: any error", resp.GetStatus().GetMessage()) }) + t.Run("meta information signature", func(t *testing.T) { + signer := neofscryptotest.Signer() + reqForSignature, o := anyValidRequest(t, clientSigner, cnr, objID) + node := newTestNode(t, serverPubKey, clientPubKey, cnr, reqForSignature.Object) + srv := New(noCallObjSvc, node, signer) + + t.Run("signature not requested", func(t *testing.T) { + resp, err := srv.Replicate(context.Background(), reqForSignature) + require.NoError(t, err) + require.EqualValues(t, 0, resp.GetStatus().GetCode()) + require.Empty(t, resp.GetStatus().GetMessage()) + require.Empty(t, resp.GetObjectSignature()) + }) + + t.Run("signature is requested", func(t *testing.T) { + reqForSignature.SignObject = true + + resp, err := srv.Replicate(context.Background(), reqForSignature) + require.NoError(t, err) + require.EqualValues(t, 0, resp.GetStatus().GetCode()) + require.Empty(t, resp.GetStatus().GetMessage()) + require.NotNil(t, resp.GetObjectSignature()) + + var sigV2 refsv2.Signature + require.NoError(t, sigV2.Unmarshal(resp.GetObjectSignature())) + + var sig neofscrypto.Signature + require.NoError(t, sig.ReadFromV2(sigV2)) + + require.Equal(t, signer.PublicKeyBytes, sig.PublicKeyBytes()) + require.True(t, sig.Verify(objectcore.EncodeReplicationMetaInfo(o.GetContainerID(), o.GetID(), o.PayloadSize(), nil, nil, o.CreationEpoch()))) + }) + }) + t.Run("OK", func(t *testing.T) { node := newTestNode(t, serverPubKey, clientPubKey, cnr, req.Object) - srv := New(noCallObjSvc, node) + srv := New(noCallObjSvc, node, neofscryptotest.Signer()) resp, err := srv.Replicate(context.Background(), req) require.NoError(t, err) @@ -395,7 +433,7 @@ func BenchmarkServer_Replicate(b *testing.B) { ctx := context.Background() var node nopNode - srv := New(nil, node) + srv := New(nil, node, neofscryptotest.Signer()) for _, tc := range []struct { name string @@ -421,7 +459,7 @@ func BenchmarkServer_Replicate(b *testing.B) { }, } { b.Run(tc.name, func(b *testing.B) { - req := anyValidRequest(b, tc.newSigner(b), cidtest.ID(), oidtest.ID()) + req, _ := anyValidRequest(b, tc.newSigner(b), cidtest.ID(), oidtest.ID()) b.ReportAllocs() b.ResetTimer() diff --git a/pkg/network/transport/object/grpc/service.go b/pkg/network/transport/object/grpc/service.go index 511d5413fa..2b2babdaf6 100644 --- a/pkg/network/transport/object/grpc/service.go +++ b/pkg/network/transport/object/grpc/service.go @@ -11,6 +11,7 @@ import ( objectSvc "github.com/nspcc-dev/neofs-node/pkg/services/object" "github.com/nspcc-dev/neofs-node/pkg/services/util" cid "github.com/nspcc-dev/neofs-sdk-go/container/id" + neofscrypto "github.com/nspcc-dev/neofs-sdk-go/crypto" objectsdk "github.com/nspcc-dev/neofs-sdk-go/object" ) @@ -47,14 +48,16 @@ type Node interface { type Server struct { srv objectSvc.ServiceServer - node Node + node Node + signer neofscrypto.Signer } // New creates, initializes and returns Server instance. -func New(c objectSvc.ServiceServer, node Node) *Server { +func New(c objectSvc.ServiceServer, node Node, signer neofscrypto.Signer) *Server { return &Server{ - srv: c, - node: node, + srv: c, + node: node, + signer: signer, } } diff --git a/pkg/services/object/put/distributed.go b/pkg/services/object/put/distributed.go index cb0b59554f..a7a3fbf2a6 100644 --- a/pkg/services/object/put/distributed.go +++ b/pkg/services/object/put/distributed.go @@ -1,6 +1,7 @@ package putsvc import ( + "bytes" "fmt" "math" "slices" @@ -12,6 +13,7 @@ import ( "github.com/nspcc-dev/neofs-node/pkg/network" svcutil "github.com/nspcc-dev/neofs-node/pkg/services/object/util" "github.com/nspcc-dev/neofs-node/pkg/util" + apistatus "github.com/nspcc-dev/neofs-sdk-go/client/status" neofscrypto "github.com/nspcc-dev/neofs-sdk-go/crypto" "github.com/nspcc-dev/neofs-sdk-go/netmap" objectSDK "github.com/nspcc-dev/neofs-sdk-go/object" @@ -21,14 +23,15 @@ import ( type preparedObjectTarget interface { WriteObject(*objectSDK.Object, object.ContentMeta, encodedObject) error - Close() (oid.ID, error) + Close() (oid.ID, *neofscrypto.Signature, error) } type distributedTarget struct { placementIterator placementIterator - obj *objectSDK.Object - objMeta object.ContentMeta + obj *objectSDK.Object + objMeta object.ContentMeta + objSharedMeta []byte localNodeInContainer bool localNodeSigner neofscrypto.Signer @@ -76,7 +79,7 @@ func (t *distributedTarget) WriteHeader(hdr *objectSDK.Object) error { if t.placementIterator.localOnly { t.encodedObject, err = encodeObjectWithoutPayload(*hdr, int(payloadLen)) } else { - t.encodedObject, err = encodeReplicateRequestWithoutPayload(t.localNodeSigner, *hdr, int(payloadLen)) + t.encodedObject, err = encodeReplicateRequestWithoutPayload(t.localNodeSigner, *hdr, int(payloadLen), true) } if err != nil { return fmt.Errorf("encode object into binary: %w", err) @@ -127,6 +130,17 @@ func (t *distributedTarget) Close() (oid.ID, error) { } } + var deletedObjs []oid.ID + var lockedObjs []oid.ID + switch t.objMeta.Type() { + case objectSDK.TypeTombstone: + deletedObjs = t.objMeta.Objects() + case objectSDK.TypeLock: + lockedObjs = t.objMeta.Objects() + default: + } + + t.objSharedMeta = object.EncodeReplicationMetaInfo(t.obj.GetContainerID(), t.obj.GetID(), t.obj.PayloadSize(), deletedObjs, lockedObjs, t.obj.CreationEpoch()) id, _ := t.obj.ID() return id, t.placementIterator.iterateNodesForObject(id, t.sendObject) } @@ -138,11 +152,31 @@ func (t *distributedTarget) sendObject(node nodeDesc) error { target := t.nodeTargetInitializer(node) - if err := target.WriteObject(t.obj, t.objMeta, t.encodedObject); err != nil { + err := target.WriteObject(t.obj, t.objMeta, t.encodedObject) + if err != nil { return fmt.Errorf("could not write header: %w", err) - } else if _, err := target.Close(); err != nil { + } + + _, sig, err := target.Close() + if err != nil { return fmt.Errorf("could not close object stream: %w", err) } + + if t.localNodeInContainer && !node.local { + if sig == nil { + return fmt.Errorf("%w: missing object meta signature", apistatus.ErrSignatureVerification) + } + + if !bytes.Equal(sig.PublicKeyBytes(), node.info.PublicKey()) { + return fmt.Errorf("%w: public key differs in object meta signature", apistatus.ErrSignatureVerification) + } + + if !sig.Verify(t.objSharedMeta) { + return fmt.Errorf("%w: %s node did not pass the meta information verification", + apistatus.ErrSignatureVerification, network.StringifyGroup(node.info.AddressGroup())) + } + } + return nil } diff --git a/pkg/services/object/put/local.go b/pkg/services/object/put/local.go index 1963983dda..755274e738 100644 --- a/pkg/services/object/put/local.go +++ b/pkg/services/object/put/local.go @@ -8,6 +8,7 @@ import ( objectCore "github.com/nspcc-dev/neofs-node/pkg/core/object" "github.com/nspcc-dev/neofs-sdk-go/checksum" + neofscrypto "github.com/nspcc-dev/neofs-sdk-go/crypto" "github.com/nspcc-dev/neofs-sdk-go/object" oid "github.com/nspcc-dev/neofs-sdk-go/object/id" "github.com/nspcc-dev/tzhash/tz" @@ -47,15 +48,15 @@ func (t *localTarget) WriteObject(obj *object.Object, meta objectCore.ContentMet return nil } -func (t *localTarget) Close() (oid.ID, error) { +func (t *localTarget) Close() (oid.ID, *neofscrypto.Signature, error) { err := putObjectLocally(t.storage, t.obj, t.meta, &t.enc) if err != nil { - return oid.ID{}, err + return oid.ID{}, nil, err } id, _ := t.obj.ID() - return id, nil + return id, nil, nil } func putObjectLocally(storage ObjectStorage, obj *object.Object, meta objectCore.ContentMeta, enc *encodedObject) error { diff --git a/pkg/services/object/put/proto.go b/pkg/services/object/put/proto.go index 75f1174e84..5cc3c4eccf 100644 --- a/pkg/services/object/put/proto.go +++ b/pkg/services/object/put/proto.go @@ -30,6 +30,7 @@ const ( _ = iota fieldNumReplicateObject fieldNumReplicateSignature + fieldSignObjectMeta ) type encodedObject struct { @@ -66,7 +67,7 @@ func encodeObjectWithoutPayload(hdr object.Object, pldLen int) (encodedObject, e return res, nil } -func encodeReplicateRequestWithoutPayload(signer neofscrypto.Signer, hdr object.Object, pldLen int) (encodedObject, error) { +func encodeReplicateRequestWithoutPayload(signer neofscrypto.Signer, hdr object.Object, pldLen int, signObjectMeta bool) (encodedObject, error) { var res encodedObject id, ok := hdr.ID() if !ok { @@ -98,6 +99,7 @@ func encodeReplicateRequestWithoutPayload(signer neofscrypto.Signer, hdr object. return res, fmt.Errorf("replicate request exceeds server limit %d", math.MaxInt) } fullLen += protowire.SizeBytes(objFldLen) + fullLen += protowire.SizeTag(fieldSignObjectMeta) + protowire.SizeVarint(protowire.EncodeBool(signObjectMeta)) res.b = getPayload() if cap(res.b) < fullLen { @@ -105,6 +107,9 @@ func encodeReplicateRequestWithoutPayload(signer neofscrypto.Signer, hdr object. res.b = make([]byte, 0, fullLen) } + // meta signature extension flag + res.b = protowire.AppendTag(res.b, fieldSignObjectMeta, protowire.VarintType) + res.b = protowire.AppendVarint(res.b, protowire.EncodeBool(signObjectMeta)) // signature res.b = protowire.AppendTag(res.b, fieldNumReplicateSignature, protowire.BytesType) res.b = protowire.AppendVarint(res.b, uint64(sigFldLen)) diff --git a/pkg/services/object/put/proto_test.go b/pkg/services/object/put/proto_test.go index b8e55d0058..fe18ea6c7a 100644 --- a/pkg/services/object/put/proto_test.go +++ b/pkg/services/object/put/proto_test.go @@ -29,7 +29,7 @@ func TestUnaryReplicateRequest(t *testing.T) { signer := neofscryptotest.Signer() // prepare request - r, err := encodeReplicateRequestWithoutPayload(signer, hdr, len(payload)) + r, err := encodeReplicateRequestWithoutPayload(signer, hdr, len(payload), true) require.NoError(t, err) require.Equal(t, len(payload), cap(r.b)-r.pldOff) require.Equal(t, len(payload), cap(r.b)-len(r.b)) @@ -55,4 +55,7 @@ func TestUnaryReplicateRequest(t *testing.T) { require.NoError(t, objv2.FromGRPCMessage(req.Object)) obj2 := *object.NewFromV2(&objv2) require.Equal(t, obj, obj2) + + // check meta signature flag + require.True(t, req.GetSignObject()) } diff --git a/pkg/services/object/put/remote.go b/pkg/services/object/put/remote.go index f0f34ab73a..a484822741 100644 --- a/pkg/services/object/put/remote.go +++ b/pkg/services/object/put/remote.go @@ -10,6 +10,7 @@ import ( objectcore "github.com/nspcc-dev/neofs-node/pkg/core/object" internalclient "github.com/nspcc-dev/neofs-node/pkg/services/object/internal/client" "github.com/nspcc-dev/neofs-node/pkg/services/object/util" + neofscrypto "github.com/nspcc-dev/neofs-sdk-go/crypto" neofsecdsa "github.com/nspcc-dev/neofs-sdk-go/crypto/ecdsa" "github.com/nspcc-dev/neofs-sdk-go/netmap" "github.com/nspcc-dev/neofs-sdk-go/object" @@ -53,14 +54,13 @@ func (t *remoteTarget) WriteObject(obj *object.Object, _ objectcore.ContentMeta, return nil } -func (t *remoteTarget) Close() (oid.ID, error) { +func (t *remoteTarget) Close() (oid.ID, *neofscrypto.Signature, error) { if t.enc.hdrOff > 0 { - err := t.transport.SendReplicationRequestToNode(t.ctx, t.enc.b, t.nodeInfo) + sig, err := t.transport.SendReplicationRequestToNode(t.ctx, t.enc.b, t.nodeInfo) if err != nil { - return oid.ID{}, fmt.Errorf("replicate object to remote node (key=%x): %w", t.nodeInfo.PublicKey(), err) + return oid.ID{}, nil, fmt.Errorf("replicate object to remote node (key=%x): %w", t.nodeInfo.PublicKey(), err) } - id, _ := t.obj.ID() - return id, nil + return t.obj.GetID(), sig, nil } var sessionInfo *util.SessionInfo @@ -74,12 +74,12 @@ func (t *remoteTarget) Close() (oid.ID, error) { key, err := t.keyStorage.GetKey(sessionInfo) if err != nil { - return oid.ID{}, fmt.Errorf("(%T) could not receive private key: %w", t, err) + return oid.ID{}, nil, fmt.Errorf("(%T) could not receive private key: %w", t, err) } c, err := t.clientConstructor.Get(t.nodeInfo) if err != nil { - return oid.ID{}, fmt.Errorf("(%T) could not create SDK client %s: %w", t, t.nodeInfo, err) + return oid.ID{}, nil, fmt.Errorf("(%T) could not create SDK client %s: %w", t, t.nodeInfo, err) } var prm internalclient.PutObjectPrm @@ -94,10 +94,10 @@ func (t *remoteTarget) Close() (oid.ID, error) { res, err := internalclient.PutObject(prm) if err != nil { - return oid.ID{}, fmt.Errorf("(%T) could not put object to %s: %w", t, t.nodeInfo.AddressGroup(), err) + return oid.ID{}, nil, fmt.Errorf("(%T) could not put object to %s: %w", t, t.nodeInfo.AddressGroup(), err) } - return res.ID(), nil + return res.ID(), nil, nil } // NewRemoteSender creates, initializes and returns new RemoteSender instance. @@ -139,9 +139,13 @@ func (s *RemoteSender) PutObject(ctx context.Context, p *RemotePutPrm) error { return fmt.Errorf("parse client node info: %w", err) } - if err := t.WriteObject(p.obj, objectcore.ContentMeta{}, encodedObject{}); err != nil { + err = t.WriteObject(p.obj, objectcore.ContentMeta{}, encodedObject{}) + if err != nil { return fmt.Errorf("(%T) could not send object header: %w", s, err) - } else if _, err := t.Close(); err != nil { + } + + _, _, err = t.Close() + if err != nil { return fmt.Errorf("(%T) could not send object: %w", s, err) } diff --git a/pkg/services/object/put/service.go b/pkg/services/object/put/service.go index 04ae1a82ec..5b14ea6377 100644 --- a/pkg/services/object/put/service.go +++ b/pkg/services/object/put/service.go @@ -10,6 +10,7 @@ import ( objutil "github.com/nspcc-dev/neofs-node/pkg/services/object/util" "github.com/nspcc-dev/neofs-node/pkg/util" cid "github.com/nspcc-dev/neofs-sdk-go/container/id" + neofscrypto "github.com/nspcc-dev/neofs-sdk-go/crypto" netmapsdk "github.com/nspcc-dev/neofs-sdk-go/netmap" oid "github.com/nspcc-dev/neofs-sdk-go/object/id" "go.uber.org/zap" @@ -35,7 +36,7 @@ type Option func(*cfg) type Transport interface { // SendReplicationRequestToNode sends a prepared replication request message to // the specified remote node. - SendReplicationRequestToNode(ctx context.Context, req []byte, node client.NodeInfo) error + SendReplicationRequestToNode(ctx context.Context, req []byte, node client.NodeInfo) (*neofscrypto.Signature, error) } type ClientConstructor interface { From 5d236f3b97daa4a1611451145917c5b070853a54 Mon Sep 17 00:00:00 2001 From: Pavel Karpy Date: Fri, 6 Sep 2024 19:11:41 +0300 Subject: [PATCH 3/4] pkg/morph: make read network's magic `uint32` When I wanted to use it, I wrote all the code based on `uint32` (because I knew it should be this way), and at the last moment I found that `client` package returns it as `uint64` for no reason. Signed-off-by: Pavel Karpy --- cmd/neofs-node/netmap.go | 4 ++-- pkg/morph/client/client.go | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/cmd/neofs-node/netmap.go b/cmd/neofs-node/netmap.go index 575b88e76f..856dc82bee 100644 --- a/cmd/neofs-node/netmap.go +++ b/cmd/neofs-node/netmap.go @@ -388,7 +388,7 @@ type netInfo struct { netState netmap.State magic interface { - MagicNumber() (uint64, error) + MagicNumber() (uint32, error) } morphClientNetMap *nmClient.Client @@ -404,7 +404,7 @@ func (n *netInfo) Dump(ver version.Version) (*netmapSDK.NetworkInfo, error) { var ni netmapSDK.NetworkInfo ni.SetCurrentEpoch(n.netState.CurrentEpoch()) - ni.SetMagicNumber(magic) + ni.SetMagicNumber(uint64(magic)) netInfoMorph, err := n.morphClientNetMap.ReadNetworkConfiguration() if err != nil { diff --git a/pkg/morph/client/client.go b/pkg/morph/client/client.go index 486b16f09e..e9c4bf8cfe 100644 --- a/pkg/morph/client/client.go +++ b/pkg/morph/client/client.go @@ -533,7 +533,7 @@ func (c *Client) roleList(r noderoles.Role) (keys.PublicKeys, error) { // MagicNumber returns the magic number of the network // to which the underlying RPC node client is connected. -func (c *Client) MagicNumber() (uint64, error) { +func (c *Client) MagicNumber() (uint32, error) { c.switchLock.RLock() defer c.switchLock.RUnlock() @@ -541,7 +541,7 @@ func (c *Client) MagicNumber() (uint64, error) { return 0, ErrConnectionLost } - return uint64(c.rpcActor.GetNetwork()), nil + return uint32(c.rpcActor.GetNetwork()), nil } // BlockCount returns block count of the network From d7b63cb3fe8b50b7d6b6f942156d14de117a258b Mon Sep 17 00:00:00 2001 From: Pavel Karpy Date: Fri, 6 Sep 2024 19:33:07 +0300 Subject: [PATCH 4/4] node/object/replicate: add network magic object's meta information It saves from replay attacks and makes replication operation (and meta information in particular) more explicit. Signed-off-by: Pavel Karpy --- cmd/neofs-node/object.go | 6 +++- pkg/core/object/replicate.go | 20 ++++++++----- pkg/core/object/replicate_test.go | 30 +++++++++++-------- .../transport/object/grpc/replication.go | 3 +- .../transport/object/grpc/replication_test.go | 17 ++++++----- pkg/network/transport/object/grpc/service.go | 14 +++++---- pkg/services/object/put/distributed.go | 10 ++++--- pkg/services/object/put/service.go | 8 +++++ pkg/services/object/put/streamer.go | 1 + 9 files changed, 68 insertions(+), 41 deletions(-) diff --git a/cmd/neofs-node/object.go b/cmd/neofs-node/object.go index 24addfe663..4fd8b12790 100644 --- a/cmd/neofs-node/object.go +++ b/cmd/neofs-node/object.go @@ -257,7 +257,11 @@ func initObjectService(c *cfg) { searchsvcV2.WithKeyStorage(keyStorage), ) + mNumber, err := c.shared.basics.cli.MagicNumber() + fatalOnErr(err) + sPut := putsvc.NewService(&transport{clients: putConstructor}, c, + putsvc.WithNetworkMagic(mNumber), putsvc.WithKeyStorage(keyStorage), putsvc.WithClientConstructor(putConstructor), putsvc.WithMaxSizeSource(newCachedMaxObjectSizeSource(c)), @@ -351,7 +355,7 @@ func initObjectService(c *cfg) { firstSvc = objectService.NewMetricCollector(signSvc, c.metricsCollector) } - server := objectTransportGRPC.New(firstSvc, objNode, neofsecdsa.SignerRFC6979(c.shared.basics.key.PrivateKey)) + server := objectTransportGRPC.New(firstSvc, mNumber, objNode, neofsecdsa.SignerRFC6979(c.shared.basics.key.PrivateKey)) for _, srv := range c.cfgGRPC.servers { objectGRPC.RegisterObjectServiceServer(srv, server) diff --git a/pkg/core/object/replicate.go b/pkg/core/object/replicate.go index 3a1daf23ea..398d8d5b54 100644 --- a/pkg/core/object/replicate.go +++ b/pkg/core/object/replicate.go @@ -10,16 +10,17 @@ import ( const ( validInterval = 10 // in epochs - currentVersion = 6 // it is also a number of fields + currentVersion = 7 // it is also a number of fields ) const ( - cidKey = "cid" - oidKey = "oid" - sizeKey = "size" - deletedKey = "deleted" - lockedKey = "locked" - validUntilKey = "validuntil" + networkMagicKey = "network" + cidKey = "cid" + oidKey = "oid" + sizeKey = "size" + deletedKey = "deleted" + lockedKey = "locked" + validUntilKey = "validuntil" ) // EncodeReplicationMetaInfo uses NEO's map (strict order) serialized format as a raw @@ -27,6 +28,7 @@ const ( // // This (ordered) format is used (keys are strings): // +// "network": network magic // "cid": _raw_ container ID (32 bytes) // "oid": _raw_ object ID (32 bytes) // "size": payload size @@ -35,8 +37,10 @@ const ( // "validuntil": last valid epoch number for meta information // // Last valid epoch is object's creation epoch + 10. -func EncodeReplicationMetaInfo(cID cid.ID, oID oid.ID, pSize uint64, deleted, locked []oid.ID, createdAt uint64) []byte { +func EncodeReplicationMetaInfo(cID cid.ID, oID oid.ID, pSize uint64, + deleted, locked []oid.ID, createdAt uint64, magicNumber uint32) []byte { kvs := []stackitem.MapElement{ + kv(networkMagicKey, magicNumber), kv(cidKey, cID[:]), kv(oidKey, oID[:]), kv(sizeKey, pSize), diff --git a/pkg/core/object/replicate_test.go b/pkg/core/object/replicate_test.go index 2503cf3e05..3f14669163 100644 --- a/pkg/core/object/replicate_test.go +++ b/pkg/core/object/replicate_test.go @@ -13,6 +13,7 @@ import ( ) func TestMetaInfo(t *testing.T) { + network := rand.Uint32() oID := oidtest.ID() cID := cidtest.ID() size := rand.Uint64() @@ -20,7 +21,7 @@ func TestMetaInfo(t *testing.T) { locked := oidtest.IDs(10) validUntil := rand.Uint64() - raw := EncodeReplicationMetaInfo(cID, oID, size, deleted, locked, validUntil) + raw := EncodeReplicationMetaInfo(cID, oID, size, deleted, locked, validUntil, network) item, err := stackitem.Deserialize(raw) require.NoError(t, err) @@ -30,23 +31,26 @@ func TestMetaInfo(t *testing.T) { require.Len(t, mm, currentVersion) - require.Equal(t, cidKey, string(mm[0].Key.Value().([]byte))) - require.Equal(t, cID[:], mm[0].Value.Value().([]byte)) + require.Equal(t, networkMagicKey, string(mm[0].Key.Value().([]byte))) + require.Equal(t, network, uint32(mm[0].Value.Value().(*big.Int).Uint64())) - require.Equal(t, oidKey, string(mm[1].Key.Value().([]byte))) - require.Equal(t, oID[:], mm[1].Value.Value().([]byte)) + require.Equal(t, cidKey, string(mm[1].Key.Value().([]byte))) + require.Equal(t, cID[:], mm[1].Value.Value().([]byte)) - require.Equal(t, sizeKey, string(mm[2].Key.Value().([]byte))) - require.Equal(t, size, mm[2].Value.Value().(*big.Int).Uint64()) + require.Equal(t, oidKey, string(mm[2].Key.Value().([]byte))) + require.Equal(t, oID[:], mm[2].Value.Value().([]byte)) - require.Equal(t, deletedKey, string(mm[3].Key.Value().([]byte))) - require.Equal(t, deleted, stackItemToOIDs(t, mm[3].Value)) + require.Equal(t, sizeKey, string(mm[3].Key.Value().([]byte))) + require.Equal(t, size, mm[3].Value.Value().(*big.Int).Uint64()) - require.Equal(t, lockedKey, string(mm[4].Key.Value().([]byte))) - require.Equal(t, locked, stackItemToOIDs(t, mm[4].Value)) + require.Equal(t, deletedKey, string(mm[4].Key.Value().([]byte))) + require.Equal(t, deleted, stackItemToOIDs(t, mm[4].Value)) - require.Equal(t, validUntilKey, string(mm[5].Key.Value().([]byte))) - require.Equal(t, validUntil+validInterval, mm[5].Value.Value().(*big.Int).Uint64()) + require.Equal(t, lockedKey, string(mm[5].Key.Value().([]byte))) + require.Equal(t, locked, stackItemToOIDs(t, mm[5].Value)) + + require.Equal(t, validUntilKey, string(mm[6].Key.Value().([]byte))) + require.Equal(t, validUntil+validInterval, mm[6].Value.Value().(*big.Int).Uint64()) } func stackItemToOIDs(t *testing.T, value stackitem.Item) []oid.ID { diff --git a/pkg/network/transport/object/grpc/replication.go b/pkg/network/transport/object/grpc/replication.go index 90f74595d0..e73f89c1ba 100644 --- a/pkg/network/transport/object/grpc/replication.go +++ b/pkg/network/transport/object/grpc/replication.go @@ -228,7 +228,8 @@ func (s *Server) metaInfoSignature(o object.Object) ([]byte, error) { default: } - metaInfo := objectcore.EncodeReplicationMetaInfo(o.GetContainerID(), o.GetID(), o.PayloadSize(), deleted, locked, o.CreationEpoch()) + metaInfo := objectcore.EncodeReplicationMetaInfo(o.GetContainerID(), o.GetID(), o.PayloadSize(), deleted, locked, + o.CreationEpoch(), s.mNumber) var sig neofscrypto.Signature err := sig.Calculate(s.signer, metaInfo) diff --git a/pkg/network/transport/object/grpc/replication_test.go b/pkg/network/transport/object/grpc/replication_test.go index 4ca247a45f..a8d4490517 100644 --- a/pkg/network/transport/object/grpc/replication_test.go +++ b/pkg/network/transport/object/grpc/replication_test.go @@ -164,7 +164,7 @@ func anyValidRequest(tb testing.TB, signer neofscrypto.Signer, cnr cid.ID, objID func TestServer_Replicate(t *testing.T) { var noCallNode noCallTestNode var noCallObjSvc noCallObjectService - noCallSrv := New(noCallObjSvc, &noCallNode, neofscryptotest.Signer()) + noCallSrv := New(noCallObjSvc, 0, &noCallNode, neofscryptotest.Signer()) clientSigner := neofscryptotest.Signer() clientPubKey := neofscrypto.PublicKeyBytes(clientSigner.Public()) serverPubKey := neofscrypto.PublicKeyBytes(neofscryptotest.Signer().Public()) @@ -328,7 +328,7 @@ func TestServer_Replicate(t *testing.T) { t.Run("apply storage policy failure", func(t *testing.T) { node := newTestNode(t, serverPubKey, clientPubKey, cnr, req.Object) - srv := New(noCallObjSvc, node, neofscryptotest.Signer()) + srv := New(noCallObjSvc, 0, node, neofscryptotest.Signer()) node.cnrErr = errors.New("any error") @@ -340,7 +340,7 @@ func TestServer_Replicate(t *testing.T) { t.Run("client or server mismatches object's storage policy", func(t *testing.T) { node := newTestNode(t, serverPubKey, clientPubKey, cnr, req.Object) - srv := New(noCallObjSvc, node, neofscryptotest.Signer()) + srv := New(noCallObjSvc, 0, node, neofscryptotest.Signer()) node.serverOutsideCnr = true node.clientOutsideCnr = true @@ -360,7 +360,7 @@ func TestServer_Replicate(t *testing.T) { t.Run("local storage failure", func(t *testing.T) { node := newTestNode(t, serverPubKey, clientPubKey, cnr, req.Object) - srv := New(noCallObjSvc, node, neofscryptotest.Signer()) + srv := New(noCallObjSvc, 0, node, neofscryptotest.Signer()) node.storeErr = errors.New("any error") @@ -371,10 +371,11 @@ func TestServer_Replicate(t *testing.T) { }) t.Run("meta information signature", func(t *testing.T) { + var mNumber uint32 = 123 signer := neofscryptotest.Signer() reqForSignature, o := anyValidRequest(t, clientSigner, cnr, objID) node := newTestNode(t, serverPubKey, clientPubKey, cnr, reqForSignature.Object) - srv := New(noCallObjSvc, node, signer) + srv := New(noCallObjSvc, mNumber, node, signer) t.Run("signature not requested", func(t *testing.T) { resp, err := srv.Replicate(context.Background(), reqForSignature) @@ -400,13 +401,13 @@ func TestServer_Replicate(t *testing.T) { require.NoError(t, sig.ReadFromV2(sigV2)) require.Equal(t, signer.PublicKeyBytes, sig.PublicKeyBytes()) - require.True(t, sig.Verify(objectcore.EncodeReplicationMetaInfo(o.GetContainerID(), o.GetID(), o.PayloadSize(), nil, nil, o.CreationEpoch()))) + require.True(t, sig.Verify(objectcore.EncodeReplicationMetaInfo(o.GetContainerID(), o.GetID(), o.PayloadSize(), nil, nil, o.CreationEpoch(), mNumber))) }) }) t.Run("OK", func(t *testing.T) { node := newTestNode(t, serverPubKey, clientPubKey, cnr, req.Object) - srv := New(noCallObjSvc, node, neofscryptotest.Signer()) + srv := New(noCallObjSvc, 0, node, neofscryptotest.Signer()) resp, err := srv.Replicate(context.Background(), req) require.NoError(t, err) @@ -433,7 +434,7 @@ func BenchmarkServer_Replicate(b *testing.B) { ctx := context.Background() var node nopNode - srv := New(nil, node, neofscryptotest.Signer()) + srv := New(nil, 0, node, neofscryptotest.Signer()) for _, tc := range []struct { name string diff --git a/pkg/network/transport/object/grpc/service.go b/pkg/network/transport/object/grpc/service.go index 2b2babdaf6..6ebe90c5c5 100644 --- a/pkg/network/transport/object/grpc/service.go +++ b/pkg/network/transport/object/grpc/service.go @@ -48,16 +48,18 @@ type Node interface { type Server struct { srv objectSvc.ServiceServer - node Node - signer neofscrypto.Signer + node Node + signer neofscrypto.Signer + mNumber uint32 } // New creates, initializes and returns Server instance. -func New(c objectSvc.ServiceServer, node Node, signer neofscrypto.Signer) *Server { +func New(c objectSvc.ServiceServer, magicNumber uint32, node Node, signer neofscrypto.Signer) *Server { return &Server{ - srv: c, - node: node, - signer: signer, + srv: c, + node: node, + signer: signer, + mNumber: magicNumber, } } diff --git a/pkg/services/object/put/distributed.go b/pkg/services/object/put/distributed.go index a7a3fbf2a6..0fe937c20a 100644 --- a/pkg/services/object/put/distributed.go +++ b/pkg/services/object/put/distributed.go @@ -29,9 +29,10 @@ type preparedObjectTarget interface { type distributedTarget struct { placementIterator placementIterator - obj *objectSDK.Object - objMeta object.ContentMeta - objSharedMeta []byte + obj *objectSDK.Object + objMeta object.ContentMeta + networkMagicNumber uint32 + objSharedMeta []byte localNodeInContainer bool localNodeSigner neofscrypto.Signer @@ -140,7 +141,8 @@ func (t *distributedTarget) Close() (oid.ID, error) { default: } - t.objSharedMeta = object.EncodeReplicationMetaInfo(t.obj.GetContainerID(), t.obj.GetID(), t.obj.PayloadSize(), deletedObjs, lockedObjs, t.obj.CreationEpoch()) + t.objSharedMeta = object.EncodeReplicationMetaInfo(t.obj.GetContainerID(), t.obj.GetID(), t.obj.PayloadSize(), deletedObjs, + lockedObjs, t.obj.CreationEpoch(), t.networkMagicNumber) id, _ := t.obj.ID() return id, t.placementIterator.iterateNodesForObject(id, t.sendObject) } diff --git a/pkg/services/object/put/service.go b/pkg/services/object/put/service.go index 5b14ea6377..e5b2414eb1 100644 --- a/pkg/services/object/put/service.go +++ b/pkg/services/object/put/service.go @@ -100,6 +100,8 @@ type cfg struct { clientConstructor ClientConstructor log *zap.Logger + + networkMagic uint32 } func defaultCfg() *cfg { @@ -203,3 +205,9 @@ func WithLogger(l *zap.Logger) Option { c.log = l } } + +func WithNetworkMagic(m uint32) Option { + return func(c *cfg) { + c.networkMagic = m + } +} diff --git a/pkg/services/object/put/streamer.go b/pkg/services/object/put/streamer.go index 7c96e27919..46517b6bf5 100644 --- a/pkg/services/object/put/streamer.go +++ b/pkg/services/object/put/streamer.go @@ -207,6 +207,7 @@ func (p *Streamer) newCommonTarget(prm *PutInitPrm) internal.Target { withBroadcast := !localOnly && (typ == object.TypeTombstone || typ == object.TypeLock) return &distributedTarget{ + networkMagicNumber: p.networkMagic, placementIterator: placementIterator{ log: p.log, neoFSNet: p.neoFSNet,