b261110352
We want to stop using the serial_numbers table in satelliteDB. One of the last places using the serial_numbers table is when storagenodes settle orders, we look up the bucket name and project ID from the serial number from the serial_numbers table. Now that we have support to add encrypted metadata into the OrderLimit, this PR makes use of that and now attempts to read the project ID and bucket name from the encrypted orderLimit metadata instead of from the serial_numbers table. For backwards compatibility and to ensure no errors, we will still fallback to the old way of getting that info from the serial_numbers table, but this will be removed in the next release as long as there are no errors. All processes that create orderLimits must have an orders.encryption-keys set. The services that create orderLimits (and thus need to encrypt the order metadata) are the satellite apiProcess, the repair process, audit service (core process), and graceful exit (core process). Only the satellite api process decrypts the order metadata when storagenodes settle orders. This means that the same encryption key needs to be provided in the config for the satellite api process, repair process, and the core process like so: orders.include-encrypted-metadata=true orders.encryption-keys="<"encryptionKeyID>=<encryptionKey>" Change-Id: Ie2c037971713d6fbf69d697bfad7f8b672eedd66
111 lines
3.4 KiB
Go
111 lines
3.4 KiB
Go
// Copyright (C) 2020 Storj Labs, Inc.
|
|
// See LICENSE for copying information.
|
|
|
|
package orders_test
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
"go.uber.org/zap"
|
|
|
|
"storj.io/common/memory"
|
|
"storj.io/common/storj"
|
|
"storj.io/common/testcontext"
|
|
"storj.io/common/testrand"
|
|
"storj.io/storj/private/testplanet"
|
|
"storj.io/storj/satellite"
|
|
"storj.io/storj/satellite/metainfo/metabase"
|
|
"storj.io/storj/satellite/orders"
|
|
)
|
|
|
|
func TestSigner_EncryptedMetadata(t *testing.T) {
|
|
ekeys, err := orders.NewEncryptionKeys(orders.EncryptionKey{
|
|
ID: orders.EncryptionKeyID{1},
|
|
Key: storj.Key{1},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
testplanet.Run(t, testplanet.Config{
|
|
SatelliteCount: 1, StorageNodeCount: 1, UplinkCount: 1,
|
|
Reconfigure: testplanet.Reconfigure{
|
|
Satellite: func(log *zap.Logger, index int, config *satellite.Config) {
|
|
testplanet.ReconfigureRS(1, 1, 1, 1)(log, index, config)
|
|
|
|
config.Orders.IncludeEncryptedMetadata = true
|
|
config.Orders.EncryptionKeys = *ekeys
|
|
},
|
|
},
|
|
}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
|
|
satellite, uplink, storagenode := planet.Satellites[0], planet.Uplinks[0], planet.StorageNodes[0]
|
|
|
|
project, err := uplink.GetProject(ctx, satellite)
|
|
require.NoError(t, err)
|
|
bucketName := "testbucket"
|
|
bucketLocation := metabase.BucketLocation{
|
|
ProjectID: uplink.Projects[0].ID,
|
|
BucketName: bucketName,
|
|
}
|
|
|
|
_, err = project.EnsureBucket(ctx, bucketLocation.BucketName)
|
|
require.NoError(t, err)
|
|
|
|
root := testrand.PieceID()
|
|
orderCreation := time.Now()
|
|
|
|
signer, err := orders.NewSignerGet(satellite.Orders.Service, root, orderCreation, 1e6, bucketLocation)
|
|
require.NoError(t, err)
|
|
|
|
addressedLimit, err := signer.Sign(ctx, storj.NodeURL{
|
|
ID: storagenode.ID(),
|
|
Address: storagenode.Addr(),
|
|
}, 1)
|
|
require.NoError(t, err)
|
|
|
|
require.NotEmpty(t, addressedLimit.Limit.EncryptedMetadata)
|
|
require.NotEmpty(t, addressedLimit.Limit.EncryptedMetadataKeyId)
|
|
|
|
require.Equal(t, ekeys.Default.ID[:], addressedLimit.Limit.EncryptedMetadataKeyId)
|
|
|
|
metadata, err := ekeys.Default.DecryptMetadata(addressedLimit.Limit.SerialNumber, addressedLimit.Limit.EncryptedMetadata)
|
|
require.NoError(t, err)
|
|
|
|
bucketInfo, err := metabase.ParseBucketPrefix(metabase.BucketPrefix(metadata.ProjectBucketPrefix))
|
|
require.NoError(t, err)
|
|
require.Equal(t, bucketInfo.BucketName, bucketName)
|
|
require.Equal(t, bucketInfo.ProjectID, uplink.Projects[0].ID)
|
|
})
|
|
}
|
|
|
|
func TestSigner_EncryptedMetadata_UploadDownload(t *testing.T) {
|
|
ekeys, err := orders.NewEncryptionKeys(orders.EncryptionKey{
|
|
ID: orders.EncryptionKeyID{1},
|
|
Key: storj.Key{1},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
testplanet.Run(t, testplanet.Config{
|
|
SatelliteCount: 1, StorageNodeCount: 1, UplinkCount: 1,
|
|
Reconfigure: testplanet.Reconfigure{
|
|
Satellite: func(log *zap.Logger, index int, config *satellite.Config) {
|
|
testplanet.ReconfigureRS(1, 1, 1, 1)(log, index, config)
|
|
|
|
config.Orders.IncludeEncryptedMetadata = true
|
|
config.Orders.EncryptionKeys = *ekeys
|
|
},
|
|
},
|
|
}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
|
|
satellite, uplink := planet.Satellites[0], planet.Uplinks[0]
|
|
|
|
testdata := testrand.Bytes(8 * memory.KiB)
|
|
err := uplink.Upload(ctx, satellite, "testbucket", "data", testdata)
|
|
require.NoError(t, err)
|
|
|
|
downdata, err := uplink.Download(ctx, satellite, "testbucket", "data")
|
|
require.NoError(t, err)
|
|
|
|
require.Equal(t, testdata, downdata)
|
|
})
|
|
}
|