New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Test container removal/setEACL with session issued by a NON-owner of the container #579

Closed

cthulhu-rider opened this issue Jul 4, 2023 · 1 comment

Assignees

Contributor

cthulhu-rider commented Jul 4, 2023 •

edited

Loading

container MUST NOT be removed/setEACLed by anyone except:

owner (creator)
trusted party proved by the container owner via session token

AFAIK we have a test that asserts true-positive case (session signed by owner => removal/setEACL OK)

we must additionally test true-negative case:

issue session on behalf of any party other than container owner (i.e. sign via non-owner key)
sent removal/setEACL request with token of this session
expect operation failure

cthulhu-rider changed the title ~~Test container removal with session issued by a NON-owner of the container~~ Test container removal/setEACL with session issued by a NON-owner of the container

vvarg229 self-assigned this

vvarg229 mentioned this issue

neofs-cli container set-eacl should check that the wallet is the wallet of the container owner nspcc-dev/neofs-node#2436

Closed

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          acl, container: Add negative tests nspcc-dev#579

3c481ac

Added two negative tests that verify that the container cannot be removed or
set container EACL by anyone other than the owner (creator) or trusted trusted
party proved by the container owner via session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

roman-khimov mentioned this issue

acl, container: Add negative tests #582

Merged

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          acl, container: Add negative tests nspcc-dev#579

278d8a1

Added two negative tests that verify that the container cannot be removed or
set container EACL by anyone other than the owner (creator) or trusted trusted
party proved by the container owner via session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          acl, container: Add negative tests nspcc-dev#579

19cb691

Added two negative tests that verify that the container cannot be removed or
set container EACL by anyone other than the owner (creator) or trusted trusted
party proved by the container owner via session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          acl, container: Add negative tests nspcc-dev#579

ca3c9d7

Added two negative tests that verify that the container cannot be removed or
set container EACL by anyone other than the owner (creator).

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

e7e86ce

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          acl, container: Add negative tests nspcc-dev#579

9d6b791

Added two negative tests that verify that the container cannot be removed or
set container EACL by anyone other than the owner (creator).

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

7c9e126

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          acl, container: Add negative tests nspcc-dev#579

9ef2370

Added two negative tests that verify that the container cannot be removed or
set container EACL by anyone other than the owner (creator).

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

d0f4433

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

3d1b0cd

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

0b9638f

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 mentioned this issue

Possible incorrect error when a container is deleted by a static session token without the right permissions nspcc-dev/neofs-node#2466

Closed

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

9b40c79

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

Contributor Author

cthulhu-rider commented Aug 2, 2023 •

edited

Loading

recent NeoFS CLI revisions check session ownership, so attempting to use another wallet may fail with session issuer differs with the container owner w/o request to NeoFS. To skip this check and make behavior similar to owner's sessions, use --force flag.

with --force:

success leads to command exit with code=0.
any failure leads to command exit with code=1 and timed out after 90 seconds output message

currently, NeoFS CLI will exit with code=0 in case 2, so right now test may rely on code=1 and/or mentioned text output. This may be changed in the future nspcc-dev/neofs-node#2380

P.S. there is no ability to get exact reason of some failures right now. For example, async Inner Ring checks (session ownership is one of them).

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          acl, container: Add negative tests nspcc-dev#579

d0f966d

Added two negative tests that verify that the container cannot be removed or
set container EACL by anyone other than the owner (creator).

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

5ccf17f

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          acl, container: Add negative tests nspcc-dev#579

5c27fcb

Added two negative tests that verify that the container cannot be removed or
set container EACL by anyone other than the owner (creator).

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

50c2d0c

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          acl, container: Add negative tests nspcc-dev#579

a14657e

Added two negative tests that verify that the container cannot be removed or
set container EACL by anyone other than the owner (creator).

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

ac678c8

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          acl, container: Add negative tests nspcc-dev#579

64ea807

Added two negative tests that verify that the container cannot be removed or
set container EACL by anyone other than the owner (creator).

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

42d47d1

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

413cbaf

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

31a3cf3

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

c1fcd15

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

e215021

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          acl, container: Add negative tests nspcc-dev#579

42a519e

Added two negative tests that verify that the container cannot be removed or
set container EACL by anyone other than the owner (creator).

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests nspcc-dev#579

3b903af

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 added a commit to vvarg229/neofs-testcases that referenced this issue


          session_token: Add negative tests

0086ed9

Added negative tests that verify that the container can be removed or set
container EACL only by trusted party proved by the container owner via
session token.

Closes nspcc-dev#579

Signed-off-by: Oleg Kulachenko <oleg@nspcc.ru>

vvarg229 closed this as completed in

7ecae02

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment