From 5b636b3242ab16043242e12a93b414931023fca2 Mon Sep 17 00:00:00 2001 From: "ruitao.liu" Date: Wed, 11 Nov 2020 16:20:59 +0800 Subject: [PATCH 1/3] Add bucket owner attr. --- weed/s3api/auth_credentials.go | 28 ++++++++++++++++------------ weed/s3api/http/header.go | 5 +++++ weed/s3api/s3api_bucket_handlers.go | 23 +++++++++++++++++++---- 3 files changed, 40 insertions(+), 16 deletions(-) diff --git a/weed/s3api/auth_credentials.go b/weed/s3api/auth_credentials.go index 2b7666345..02138af8d 100644 --- a/weed/s3api/auth_credentials.go +++ b/weed/s3api/auth_credentials.go @@ -3,10 +3,11 @@ package s3api import ( "bytes" "fmt" - "github.com/chrislusf/seaweedfs/weed/s3api/s3err" "io/ioutil" "net/http" + xhttp "github.com/chrislusf/seaweedfs/weed/s3api/http" + "github.com/chrislusf/seaweedfs/weed/s3api/s3err" "github.com/golang/protobuf/jsonpb" "github.com/chrislusf/seaweedfs/weed/glog" @@ -127,8 +128,11 @@ func (iam *IdentityAccessManagement) Auth(f http.HandlerFunc, action Action) htt } return func(w http.ResponseWriter, r *http.Request) { - errCode := iam.authRequest(r, action) + identity, errCode := iam.authRequest(r, action) if errCode == s3err.ErrNone { + if identity != nil && identity.Name != "" { + r.Header.Set(xhttp.AmzIdentityId, identity.Name) + } f(w, r) return } @@ -137,16 +141,16 @@ func (iam *IdentityAccessManagement) Auth(f http.HandlerFunc, action Action) htt } // check whether the request has valid access keys -func (iam *IdentityAccessManagement) authRequest(r *http.Request, action Action) s3err.ErrorCode { +func (iam *IdentityAccessManagement) authRequest(r *http.Request, action Action) (*Identity, s3err.ErrorCode) { var identity *Identity var s3Err s3err.ErrorCode var found bool switch getRequestAuthType(r) { case authTypeStreamingSigned: - return s3err.ErrNone + return identity, s3err.ErrNone case authTypeUnknown: glog.V(3).Infof("unknown auth type") - return s3err.ErrAccessDenied + return identity, s3err.ErrAccessDenied case authTypePresignedV2, authTypeSignedV2: glog.V(3).Infof("v2 auth type") identity, s3Err = iam.isReqAuthenticatedV2(r) @@ -155,22 +159,22 @@ func (iam *IdentityAccessManagement) authRequest(r *http.Request, action Action) identity, s3Err = iam.reqSignatureV4Verify(r) case authTypePostPolicy: glog.V(3).Infof("post policy auth type") - return s3err.ErrNone + return identity, s3err.ErrNone case authTypeJWT: glog.V(3).Infof("jwt auth type") - return s3err.ErrNotImplemented + return identity, s3err.ErrNotImplemented case authTypeAnonymous: identity, found = iam.lookupAnonymous() if !found { - return s3err.ErrAccessDenied + return identity, s3err.ErrAccessDenied } default: - return s3err.ErrNotImplemented + return identity, s3err.ErrNotImplemented } glog.V(3).Infof("auth error: %v", s3Err) if s3Err != s3err.ErrNone { - return s3Err + return identity, s3Err } glog.V(3).Infof("user name: %v actions: %v", identity.Name, identity.Actions) @@ -178,10 +182,10 @@ func (iam *IdentityAccessManagement) authRequest(r *http.Request, action Action) bucket, _ := getBucketAndObject(r) if !identity.canDo(action, bucket) { - return s3err.ErrAccessDenied + return identity, s3err.ErrAccessDenied } - return s3err.ErrNone + return identity, s3err.ErrNone } diff --git a/weed/s3api/http/header.go b/weed/s3api/http/header.go index 2802b560f..cdd383c84 100644 --- a/weed/s3api/http/header.go +++ b/weed/s3api/http/header.go @@ -28,3 +28,8 @@ const ( AmzObjectTagging = "X-Amz-Tagging" AmzTagCount = "x-amz-tagging-count" ) + +// Non-Standard S3 HTTP request constants +const ( + AmzIdentityId = "x-amz-identity-id" +) diff --git a/weed/s3api/s3api_bucket_handlers.go b/weed/s3api/s3api_bucket_handlers.go index ab48b19c1..643d15a04 100644 --- a/weed/s3api/s3api_bucket_handlers.go +++ b/weed/s3api/s3api_bucket_handlers.go @@ -4,11 +4,13 @@ import ( "context" "encoding/xml" "fmt" - "github.com/chrislusf/seaweedfs/weed/s3api/s3err" "math" "net/http" "time" + xhttp "github.com/chrislusf/seaweedfs/weed/s3api/http" + "github.com/chrislusf/seaweedfs/weed/s3api/s3err" + "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/service/s3" @@ -33,9 +35,16 @@ func (s3a *S3ApiServer) ListBucketsHandler(w http.ResponseWriter, r *http.Reques return } + identityId := r.Header.Get(xhttp.AmzIdentityId) + var buckets []*s3.Bucket for _, entry := range entries { if entry.IsDirectory { + if id, ok := entry.Extended[xhttp.AmzIdentityId]; ok { + if identityId != string(id) { + continue + } + } buckets = append(buckets, &s3.Bucket{ Name: aws.String(entry.Name), CreationDate: aws.Time(time.Unix(entry.Attributes.Crtime, 0).UTC()), @@ -45,8 +54,8 @@ func (s3a *S3ApiServer) ListBucketsHandler(w http.ResponseWriter, r *http.Reques response = ListAllMyBucketsResult{ Owner: &s3.Owner{ - ID: aws.String(""), - DisplayName: aws.String(""), + ID: aws.String(identityId), + DisplayName: aws.String(identityId), }, Buckets: buckets, } @@ -85,8 +94,14 @@ func (s3a *S3ApiServer) PutBucketHandler(w http.ResponseWriter, r *http.Request) return } + fn := func(entry *filer_pb.Entry) { + if identityId := r.Header.Get(xhttp.AmzIdentityId); identityId != "" { + entry.Extended[xhttp.AmzIdentityId] = []byte(identityId) + } + } + // create the folder for bucket, but lazily create actual collection - if err := s3a.mkdir(s3a.option.BucketsPath, bucket, nil); err != nil { + if err := s3a.mkdir(s3a.option.BucketsPath, bucket, fn); err != nil { glog.Errorf("PutBucketHandler mkdir: %v", err) writeErrorResponse(w, s3err.ErrInternalError, r.URL) return From dbba8cb57ed6b2a29e2940e5de7618163fae3fbc Mon Sep 17 00:00:00 2001 From: "ruitao.liu" Date: Thu, 12 Nov 2020 11:50:19 +0800 Subject: [PATCH 2/3] fix if nil map in entry. --- weed/s3api/s3api_bucket_handlers.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/weed/s3api/s3api_bucket_handlers.go b/weed/s3api/s3api_bucket_handlers.go index 643d15a04..b4f83a87f 100644 --- a/weed/s3api/s3api_bucket_handlers.go +++ b/weed/s3api/s3api_bucket_handlers.go @@ -96,6 +96,9 @@ func (s3a *S3ApiServer) PutBucketHandler(w http.ResponseWriter, r *http.Request) fn := func(entry *filer_pb.Entry) { if identityId := r.Header.Get(xhttp.AmzIdentityId); identityId != "" { + if entry.Extended == nil { + entry.Extended = make(map[string][]byte) + } entry.Extended[xhttp.AmzIdentityId] = []byte(identityId) } } From d7cc0498e012dd5a1d641d80187b1f4241bf56e3 Mon Sep 17 00:00:00 2001 From: "ruitao.liu" Date: Thu, 12 Nov 2020 14:11:03 +0800 Subject: [PATCH 3/3] check if bucket already exists. --- weed/s3api/s3api_bucket_handlers.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/weed/s3api/s3api_bucket_handlers.go b/weed/s3api/s3api_bucket_handlers.go index b4f83a87f..bd3d7fd58 100644 --- a/weed/s3api/s3api_bucket_handlers.go +++ b/weed/s3api/s3api_bucket_handlers.go @@ -89,6 +89,9 @@ func (s3a *S3ApiServer) PutBucketHandler(w http.ResponseWriter, r *http.Request) writeErrorResponse(w, s3err.ErrInternalError, r.URL) return } + if exist, err := s3a.exists(s3a.option.BucketsPath, bucket, true); err == nil && exist { + errCode = s3err.ErrBucketAlreadyExists + } if errCode != s3err.ErrNone { writeErrorResponse(w, errCode, r.URL) return