55 "crypto/ecdsa"
66 "errors"
77 "fmt"
8+ "slices"
89
910 "github.com/nspcc-dev/neofs-node/pkg/core/netmap"
1011 "github.com/nspcc-dev/neofs-node/pkg/services/util"
@@ -15,6 +16,7 @@ import (
1516 neofsecdsa "github.com/nspcc-dev/neofs-sdk-go/crypto/ecdsa"
1617 "github.com/nspcc-dev/neofs-sdk-go/eacl"
1718 protocontainer "github.com/nspcc-dev/neofs-sdk-go/proto/container"
19+ protonetmap "github.com/nspcc-dev/neofs-sdk-go/proto/netmap"
1820 "github.com/nspcc-dev/neofs-sdk-go/proto/refs"
1921 protosession "github.com/nspcc-dev/neofs-sdk-go/proto/session"
2022 protostatus "github.com/nspcc-dev/neofs-sdk-go/proto/status"
@@ -182,6 +184,54 @@ func (s *server) makeFailedPutResponse(err error) (*protocontainer.PutResponse,
182184 return s .makePutResponse (nil , util .ToStatus (err ))
183185}
184186
187+ const (
188+ maxObjectReplicasPerSet = 8
189+ maxContainerNodesInSet = 64
190+ maxContainerNodeSets = 256
191+ maxContainerNodes = 512
192+ )
193+
194+ const defaultBackupFactor = 3
195+
196+ var errInvalidNodeSetDesc = errors .New ("invalid node set descriptor" )
197+
198+ func verifyStoragePolicy (policy * protonetmap.PlacementPolicy ) error {
199+ if len (policy .Replicas ) > maxContainerNodeSets {
200+ return fmt .Errorf ("more than %d node sets" , maxContainerNodeSets )
201+ }
202+ bf := policy .ContainerBackupFactor
203+ if bf == 0 {
204+ bf = defaultBackupFactor
205+ }
206+ var cnrNodeCount uint32
207+ for i := range policy .Replicas {
208+ if policy .Replicas [i ] == nil {
209+ return fmt .Errorf ("nil replica #%d" , i )
210+ }
211+ if policy .Replicas [i ].Count > maxObjectReplicasPerSet {
212+ return fmt .Errorf ("%w #%d: more than %d object replicas" , errInvalidNodeSetDesc , i , maxObjectReplicasPerSet )
213+ }
214+ var sNum uint32
215+ if policy .Replicas [i ].Selector != "" {
216+ si := slices .IndexFunc (policy .Selectors , func (s * protonetmap.Selector ) bool { return s != nil && s .Name == policy .Replicas [i ].Selector })
217+ if si < 0 {
218+ return fmt .Errorf ("%w #%d: missing selector %q" , errInvalidNodeSetDesc , i , policy .Replicas [i ].Selector )
219+ }
220+ sNum = policy .Selectors [si ].Count
221+ } else {
222+ sNum = policy .Replicas [i ].Count
223+ }
224+ nodesInSet := bf * sNum
225+ if nodesInSet > maxContainerNodesInSet {
226+ return fmt .Errorf ("%w #%d: more than %d nodes" , errInvalidNodeSetDesc , i , maxContainerNodesInSet )
227+ }
228+ if cnrNodeCount += nodesInSet ; cnrNodeCount > maxContainerNodes {
229+ return fmt .Errorf ("more than %d nodes in total" , maxContainerNodes )
230+ }
231+ }
232+ return nil
233+ }
234+
185235// Put forwards container creation request to the underlying [Contract] for
186236// further processing. If session token is attached, it's verified. Returns ID
187237// to check request status in the response.
@@ -200,6 +250,13 @@ func (s *server) Put(_ context.Context, req *protocontainer.PutRequest) (*protoc
200250 return s .makeFailedPutResponse (errors .New ("missing container" ))
201251 }
202252
253+ if mCnr .PlacementPolicy == nil {
254+ return s .makeFailedPutResponse (errors .New ("missing storage policy" ))
255+ }
256+ if err := verifyStoragePolicy (mCnr .PlacementPolicy ); err != nil {
257+ return s .makeFailedPutResponse (fmt .Errorf ("invalid storage policy: %w" , err ))
258+ }
259+
203260 var cnr container.Container
204261 if err := cnr .FromProtoMessage (mCnr ); err != nil {
205262 return s .makeFailedPutResponse (fmt .Errorf ("invalid container: %w" , err ))
0 commit comments