Unsigned responses

CHANGELOG.md

@@ -17,10 +17,11 @@ Changelog for NeoFS Node
 - `session create-v2` cli command to create new session token v2 (#3750)
 - SN now support raw GET/HEAD/RANGE requests in EC containers (#3756)
 - IR now serves `setAttribute` and `removeAttribute` methods of Container contract (#3733)
-- SN now serves `ContainerService`'s `SetAttribute` and `RemoveAttribute` RPC (#3733)
-- CLI `set-attribute` and `remove-attribute commands to `container` section (#3733)
+- SN now serves `ContainerService`'s `SetAttribute` and `RemoveAttribute` RPC (#3733, #3784)
+- CLI `set-attribute` and `remove-attribute commands to `container` section (#3733, #3784)
 - Size-split object is now available even when LINK is unavailable in EC container (#3754)
 - `neofs-adm balance container-status` command (#3693)
+- SN returns unsigned responses to requests with API >= `v2.22` (#3785)
 
 ### Fixed
 - IR panics at graceful shutdown (#3706)
@@ -56,7 +57,7 @@ Changelog for NeoFS Node
 
 ### Updated
 - `github.com/nspcc-dev/neofs-contract` module to `v0.26.0` (#3670, #3746, #3733, #3780, #3782)
-- `github.com/nspcc-dev/neofs-sdk-go` module to `v1.0.0-rc.16.0.20260119140653-e47bb5276235` (#3711, #3750, #3733, #3775, #3772, #3787)
+- `github.com/nspcc-dev/neofs-sdk-go` module to `v1.0.0-rc.16.0.20260126121331-02dc50e477f2` (#3711, #3750, #3733, #3775, #3772, #3787, #3784, #3785)
 - `github.com/nspcc-dev/locode-db` module to `v0.8.2` (#3729)
 - `github.com/nspcc-dev/neo-go` module to `v0.116.0` (#3733, #3769, #3779)
 

cmd/neofs-cli/modules/request/container.go

@@ -161,13 +161,7 @@ func createContainer(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("transport failure: %w", err)
 	}
 
-	cmd.Println("Response received. Checking signatures...")
-
-	if err := neofscrypto.VerifyResponseWithBuffer(resp, nil); err != nil {
-		return fmt.Errorf("failed to verify response signatures: %w", err)
-	}
-
-	cmd.Println("Signatures are valid. Checking status...")
+	cmd.Println("Response received. Checking status...")
 
 	if err := apistatus.ToError(resp.GetMetaHeader().GetStatus()); err != nil {
 		return fmt.Errorf("status failure: %w", err)
@@ -210,13 +204,7 @@ func createContainer(cmd *cobra.Command, args []string) error {
 			return fmt.Errorf("transport failure: %w", err)
 		}
 
-		cmd.Println("Response received. Checking signatures...")
-
-		if err := neofscrypto.VerifyResponseWithBuffer(resp, nil); err != nil {
-			return fmt.Errorf("failed to verify response signatures: %w", err)
-		}
-
-		cmd.Println("Signatures are valid. Checking status...")
+		cmd.Println("Response received. Checking status...")
 
 		if err := apistatus.ToError(resp.GetMetaHeader().GetStatus()); err == nil {
 			cmd.Println("Status OK. Operation succeeded.")

cmd/neofs-node/reputation.go

@@ -263,17 +263,17 @@ func (s *reputationServer) makeResponseMetaHeader(st *protostatus.Status) *proto
 	}
 }
 
-func (s *reputationServer) makeLocalResponse(err error) (*protoreputation.AnnounceLocalTrustResponse, error) {
+func (s *reputationServer) makeLocalResponse(err error, req *protoreputation.AnnounceLocalTrustRequest) (*protoreputation.AnnounceLocalTrustResponse, error) {
 	resp := &protoreputation.AnnounceLocalTrustResponse{
 		MetaHeader: s.makeResponseMetaHeader(util.ToStatus(err)),
 	}
-	resp.VerifyHeader = util.SignResponse(&s.key.PrivateKey, resp)
+	resp.VerifyHeader = util.SignResponseIfNeeded(&s.key.PrivateKey, resp, req)
 	return resp, nil
 }
 
 func (s *reputationServer) AnnounceLocalTrust(ctx context.Context, req *protoreputation.AnnounceLocalTrustRequest) (*protoreputation.AnnounceLocalTrustResponse, error) {
 	if err := icrypto.VerifyRequestSignatures(req); err != nil {
-		return s.makeLocalResponse(err)
+		return s.makeLocalResponse(err, req)
 	}
 
 	passedRoute := reverseRoute(req.GetVerifyHeader())
@@ -288,30 +288,30 @@ func (s *reputationServer) AnnounceLocalTrust(ctx context.Context, req *protorep
 
 	w, err := s.localRouter.InitWriter(reputationrouter.NewRouteContext(eCtx, passedRoute))
 	if err != nil {
-		return s.makeLocalResponse(fmt.Errorf("could not initialize local trust writer: %w", err))
+		return s.makeLocalResponse(fmt.Errorf("could not initialize local trust writer: %w", err), req)
 	}
 
 	for _, trust := range body.GetTrusts() {
 		err = s.processLocalTrust(body.GetEpoch(), apiToLocalTrust(trust, passedRoute[0].PublicKey()), passedRoute, w)
 		if err != nil {
-			return s.makeLocalResponse(fmt.Errorf("could not write one of local trusts: %w", err))
+			return s.makeLocalResponse(fmt.Errorf("could not write one of local trusts: %w", err), req)
 		}
 	}
 
-	return s.makeLocalResponse(util.StatusOKErr)
+	return s.makeLocalResponse(util.StatusOKErr, req)
 }
 
-func (s *reputationServer) makeIntermediateResponse(err error) (*protoreputation.AnnounceIntermediateResultResponse, error) {
+func (s *reputationServer) makeIntermediateResponse(err error, req *protoreputation.AnnounceIntermediateResultRequest) (*protoreputation.AnnounceIntermediateResultResponse, error) {
 	resp := &protoreputation.AnnounceIntermediateResultResponse{
 		MetaHeader: s.makeResponseMetaHeader(util.ToStatus(err)),
 	}
-	resp.VerifyHeader = util.SignResponse(&s.key.PrivateKey, resp)
+	resp.VerifyHeader = util.SignResponseIfNeeded(&s.key.PrivateKey, resp, req)
 	return resp, nil
 }
 
 func (s *reputationServer) AnnounceIntermediateResult(ctx context.Context, req *protoreputation.AnnounceIntermediateResultRequest) (*protoreputation.AnnounceIntermediateResultResponse, error) {
 	if err := icrypto.VerifyRequestSignatures(req); err != nil {
-		return s.makeIntermediateResponse(err)
+		return s.makeIntermediateResponse(err, req)
 	}
 
 	passedRoute := reverseRoute(req.GetVerifyHeader())
@@ -323,7 +323,7 @@ func (s *reputationServer) AnnounceIntermediateResult(ctx context.Context, req *
 
 	w, err := s.intermediateRouter.InitWriter(reputationrouter.NewRouteContext(eiCtx, passedRoute))
 	if err != nil {
-		return s.makeIntermediateResponse(fmt.Errorf("could not initialize trust writer: %w", err))
+		return s.makeIntermediateResponse(fmt.Errorf("could not initialize trust writer: %w", err), req)
 	}
 
 	v2Trust := body.GetTrust()
@@ -332,10 +332,10 @@ func (s *reputationServer) AnnounceIntermediateResult(ctx context.Context, req *
 
 	err = w.Write(trust)
 	if err != nil {
-		return s.makeIntermediateResponse(fmt.Errorf("could not write trust: %w", err))
+		return s.makeIntermediateResponse(fmt.Errorf("could not write trust: %w", err), req)
 	}
 
-	return s.makeIntermediateResponse(util.StatusOKErr)
+	return s.makeIntermediateResponse(util.StatusOKErr, req)
 }
 
 func (s *reputationServer) processLocalTrust(epoch uint64, t reputation.Trust,

go.mod

@@ -22,7 +22,7 @@ require (
 	github.com/nspcc-dev/neo-go v0.116.0
 	github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240827150555-5ce597aa14ea
 	github.com/nspcc-dev/neofs-contract v0.26.0
-	github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.16.0.20260119140653-e47bb5276235
+	github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.16.0.20260126121331-02dc50e477f2
 	github.com/nspcc-dev/tzhash v1.8.3
 	github.com/panjf2000/ants/v2 v2.11.3
 	github.com/prometheus/client_golang v1.23.2

go.sum

@@ -199,8 +199,8 @@ github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240827150555-5ce597aa14ea h1:mK
 github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240827150555-5ce597aa14ea/go.mod h1:YzhD4EZmC9Z/PNyd7ysC7WXgIgURc9uCG1UWDeV027Y=
 github.com/nspcc-dev/neofs-contract v0.26.0 h1:HoYsJN3shTB8uHZn/FP1Ce2N6mnG5lpDKQXvEvzsAQA=
 github.com/nspcc-dev/neofs-contract v0.26.0/go.mod h1:pevVF9OWdEN5bweKxOu6ryZv9muCEtS1ppzYM4RfBIo=
-github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.16.0.20260119140653-e47bb5276235 h1:DQ3DLLTQusuy4amow7Ctp3P+rctNbOEJq4keRsnT65E=
-github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.16.0.20260119140653-e47bb5276235/go.mod h1:IrM1JG/klBtecZEApIf8USgLonNcarv32R1O0dj4kQI=
+github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.16.0.20260126121331-02dc50e477f2 h1:c7m2BxutbZ+/EKF1fBLuqSWyPzKHszAZCuydeXDMjbE=
+github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.16.0.20260126121331-02dc50e477f2/go.mod h1:IrM1JG/klBtecZEApIf8USgLonNcarv32R1O0dj4kQI=
 github.com/nspcc-dev/rfc6979 v0.2.4 h1:NBgsdCjhLpEPJZqmC9rciMZDcSY297po2smeaRjw57k=
 github.com/nspcc-dev/rfc6979 v0.2.4/go.mod h1:86ylDw6Kss+P6v4QAJqo1Sp3mC0/Zr9G97xSjQ9TuFg=
 github.com/nspcc-dev/tzhash v1.8.3 h1:EWJMOL/ppdqNBvkKjHECljusopcsNu4i4kH8KctTv10=

pkg/network/cache/clients.go

@@ -1,7 +1,6 @@
 package cache
 
 import (
-	"bytes"
 	"context"
 	"encoding/hex"
 	"fmt"
@@ -129,8 +128,7 @@ func (x *Clients) SyncWithNewNetmap(sns []netmap.NodeInfo, local int) {
 }
 
 func (x *Clients) syncWithNetmapSN(sn netmap.NodeInfo) error {
-	pub := sn.PublicKey()
-	conns, ok := x.conns[snCacheKey(pub)]
+	conns, ok := x.conns[snCacheKey(sn.PublicKey())]
 	if !ok {
 		return nil
 	}
@@ -168,7 +166,7 @@ func (x *Clients) syncWithNetmapSN(sn netmap.NodeInfo) error {
 			continue
 		}
 		x.log.Info("initializing connection to new SN address in the new network map...", zap.String("address", ma))
-		c, err := x.initConnection(pub, as[i].URIAddr())
+		c, err := x.initConnection(as[i].URIAddr())
 		if err != nil {
 			x.log.Info("failed to init connection to new SN address in the new network map",
 				zap.String("address", ma), zap.Error(err))
@@ -187,7 +185,7 @@ func (x *Clients) initConnections(pub []byte, as network.AddressGroup) (*connect
 	for i := range as {
 		cacheKey := as[i].String()
 		l.Info("initializing connection to the SN...", zap.String("address", cacheKey))
-		c, err := x.initConnection(pub, as[i].URIAddr())
+		c, err := x.initConnection(as[i].URIAddr())
 		if err != nil {
 			// TODO: if at least one address is OK, SN can be operational
 			for cl := range maps.Values(m) {
@@ -206,7 +204,7 @@ func (x *Clients) initConnections(pub []byte, as network.AddressGroup) (*connect
 	}, nil
 }
 
-func (x *Clients) initConnection(pub []byte, uri string) (*client.Client, error) {
+func (x *Clients) initConnection(uri string) (*client.Client, error) {
 	target, withTLS, err := uriutil.Parse(uri)
 	if err != nil {
 		return nil, fmt.Errorf("parse URI: %w", err)
@@ -232,12 +230,7 @@ func (x *Clients) initConnection(pub []byte, uri string) (*client.Client, error)
 	if err != nil { // should never happen
 		return nil, fmt.Errorf("init gRPC client conn: %w", err)
 	}
-	res, err := client.NewGRPC(grpcConn, x.signBufPool, x.streamMsgTimeout, func(respPub []byte) error {
-		if !bytes.Equal(respPub, pub) {
-			return clientcore.ErrWrongPublicKey
-		}
-		return nil
-	})
+	res, err := client.NewGRPC(grpcConn, x.signBufPool, x.streamMsgTimeout, nil)
 	if err != nil {
 		_ = grpcConn.Close()
 		return res, fmt.Errorf("init NeoFS API client from gRPC client conn: %w", err)

pkg/services/accounting/server.go

@@ -46,7 +46,7 @@ func New(s *ecdsa.PrivateKey, net netmap.State, c BalanceContract) protoaccounti
 	}
 }
 
-func (s *server) makeBalanceResponse(body *protoaccounting.BalanceResponse_Body, st *protostatus.Status) (*protoaccounting.BalanceResponse, error) {
+func (s *server) makeBalanceResponse(body *protoaccounting.BalanceResponse_Body, st *protostatus.Status, req *protoaccounting.BalanceRequest) (*protoaccounting.BalanceResponse, error) {
 	resp := &protoaccounting.BalanceResponse{
 		Body: body,
 		MetaHeader: &protosession.ResponseMetaHeader{
@@ -55,41 +55,41 @@ func (s *server) makeBalanceResponse(body *protoaccounting.BalanceResponse_Body,
 			Status:  st,
 		},
 	}
-	resp.VerifyHeader = util.SignResponse(s.signer, resp)
+	resp.VerifyHeader = util.SignResponseIfNeeded(s.signer, resp, req)
 	return resp, nil
 }
 
-func (s *server) makeFailedBalanceResponse(err error) (*protoaccounting.BalanceResponse, error) {
-	return s.makeBalanceResponse(nil, util.ToStatus(err))
+func (s *server) makeFailedBalanceResponse(err error, req *protoaccounting.BalanceRequest) (*protoaccounting.BalanceResponse, error) {
+	return s.makeBalanceResponse(nil, util.ToStatus(err), req)
 }
 
 // Balance gets current balance of the requested user using underlying
 // [BalanceContract] and returns result in the response.
 func (s *server) Balance(_ context.Context, req *protoaccounting.BalanceRequest) (*protoaccounting.BalanceResponse, error) {
 	if err := icrypto.VerifyRequestSignatures(req); err != nil {
-		return s.makeFailedBalanceResponse(err)
+		return s.makeFailedBalanceResponse(err, nil)
 	}
 
 	mUsr := req.GetBody().GetOwnerId()
 	if mUsr == nil {
-		return s.makeFailedBalanceResponse(errors.New("missing account"))
+		return s.makeFailedBalanceResponse(errors.New("missing account"), req)
 	}
 	var id user.ID
 	if err := id.FromProtoMessage(mUsr); err != nil {
-		return s.makeFailedBalanceResponse(fmt.Errorf("invalid account: %w", err))
+		return s.makeFailedBalanceResponse(fmt.Errorf("invalid account: %w", err), req)
 	}
 
 	bal, err := s.contract.BalanceOf(id)
 	if err != nil {
-		return s.makeFailedBalanceResponse(err)
+		return s.makeFailedBalanceResponse(err, req)
 	}
 	ds, err := s.contract.Decimals()
 	if err != nil {
-		return s.makeFailedBalanceResponse(err)
+		return s.makeFailedBalanceResponse(err, req)
 	}
 
 	body := &protoaccounting.BalanceResponse_Body{
 		Balance: &protoaccounting.Decimal{Value: bal.Int64(), Precision: ds},
 	}
-	return s.makeBalanceResponse(body, util.StatusOK)
+	return s.makeBalanceResponse(body, util.StatusOK, req)
 }