LHHDZ
5 months ago
39 changed files with 2796 additions and 1092 deletions
-
9weed/filer/filer_conf.go
-
2weed/pb/iam.proto
-
68weed/pb/iam_pb/iam.pb.go
-
54weed/s3api/auth_credentials.go
-
4weed/s3api/auth_credentials_subscribe.go
-
9weed/s3api/auth_credentials_test.go
-
10weed/s3api/auth_signature_v4.go
-
6weed/s3api/auth_signature_v4_test.go
-
73weed/s3api/bucket_metadata.go
-
52weed/s3api/bucket_metadata_test.go
-
33weed/s3api/chunked_reader_v4.go
-
29weed/s3api/filer_multipart.go
-
4weed/s3api/s3_constants/acp_ownership.go
-
7weed/s3api/s3_constants/extend_key.go
-
3weed/s3api/s3_constants/header.go
-
416weed/s3api/s3acl/s3api_acl_helper.go
-
1477weed/s3api/s3acl/s3api_acl_helper_test.go
-
709weed/s3api/s3api_acl_helper_test.go
-
400weed/s3api/s3api_acp.go
-
3weed/s3api/s3api_auth.go
-
160weed/s3api/s3api_bucket_handlers.go
-
2weed/s3api/s3api_circuit_breaker.go
-
81weed/s3api/s3api_object_handlers.go
-
5weed/s3api/s3api_object_handlers_copy.go
-
14weed/s3api/s3api_object_handlers_list.go
-
72weed/s3api/s3api_object_handlers_multipart.go
-
36weed/s3api/s3api_object_handlers_put.go
-
16weed/s3api/s3api_object_handlers_skip.go
-
42weed/s3api/s3api_server.go
-
25weed/s3api/s3err/s3api_errors.go
-
32weed/server/filer_server_handlers_read.go
-
6weed/server/filer_server_handlers_write_autochunk.go
-
2weed/shell/command_collection_delete.go
-
2weed/shell/command_fs_mv.go
-
2weed/shell/command_fs_rm.go
-
2weed/shell/command_s3_bucket_delete.go
-
2weed/shell/command_volume_balance_test.go
-
2weed/shell/command_volume_delete.go
-
17weed/util/http/http_global_client_util.go
@ -1,7 +1,8 @@ |
|||
package s3_constants |
|||
|
|||
const ( |
|||
ExtAmzOwnerKey = "Seaweed-X-Amz-Owner" |
|||
ExtAmzAclKey = "Seaweed-X-Amz-Acl" |
|||
ExtOwnershipKey = "Seaweed-X-Amz-Ownership" |
|||
ExtAmzOwnerKey = "Seaweed-X-Amz-Owner" |
|||
ExtAmzMultipartInitiator = "Seaweed-X-Amz-Multipart-Initiator" |
|||
ExtAmzAclKey = "Seaweed-X-Amz-Acl" |
|||
ExtOwnershipKey = "Seaweed-X-Amz-Ownership" |
|||
) |
|||
1477
weed/s3api/s3acl/s3api_acl_helper_test.go
File diff suppressed because it is too large
View File
File diff suppressed because it is too large
View File
@ -1,709 +0,0 @@ |
|||
package s3api |
|||
|
|||
import ( |
|||
"bytes" |
|||
"encoding/json" |
|||
"github.com/aws/aws-sdk-go/aws" |
|||
"github.com/aws/aws-sdk-go/service/s3" |
|||
"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb" |
|||
"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb" |
|||
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants" |
|||
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err" |
|||
"io" |
|||
"net/http" |
|||
"testing" |
|||
) |
|||
|
|||
var accountManager *IdentityAccessManagement |
|||
|
|||
func init() { |
|||
accountManager = &IdentityAccessManagement{} |
|||
_ = accountManager.loadS3ApiConfiguration(&iam_pb.S3ApiConfiguration{ |
|||
Accounts: []*iam_pb.Account{ |
|||
{ |
|||
Id: "accountA", |
|||
DisplayName: "accountAName", |
|||
EmailAddress: "accountA@example.com", |
|||
}, |
|||
{ |
|||
Id: "accountB", |
|||
DisplayName: "accountBName", |
|||
EmailAddress: "accountB@example.com", |
|||
}, |
|||
}, |
|||
}) |
|||
} |
|||
|
|||
func TestGetAccountId(t *testing.T) { |
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
//case1
|
|||
//accountId: "admin"
|
|||
req.Header.Set(s3_constants.AmzAccountId, s3_constants.AccountAdminId) |
|||
if GetAccountId(req) != s3_constants.AccountAdminId { |
|||
t.Fatal("expect accountId: admin") |
|||
} |
|||
|
|||
//case2
|
|||
//accountId: "anoymous"
|
|||
req.Header.Set(s3_constants.AmzAccountId, s3_constants.AccountAnonymousId) |
|||
if GetAccountId(req) != s3_constants.AccountAnonymousId { |
|||
t.Fatal("expect accountId: anonymous") |
|||
} |
|||
|
|||
//case3
|
|||
//accountId is nil => "anonymous"
|
|||
req.Header.Del(s3_constants.AmzAccountId) |
|||
if GetAccountId(req) != s3_constants.AccountAnonymousId { |
|||
t.Fatal("expect accountId: anonymous") |
|||
} |
|||
} |
|||
|
|||
func TestExtractAcl(t *testing.T) { |
|||
type Case struct { |
|||
id int |
|||
resultErrCode, expectErrCode s3err.ErrorCode |
|||
resultGrants, expectGrants []*s3.Grant |
|||
} |
|||
testCases := make([]*Case, 0) |
|||
accountAdminId := "admin" |
|||
{ |
|||
//case1 (good case)
|
|||
//parse acp from request body
|
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
req.Body = io.NopCloser(bytes.NewReader([]byte(` |
|||
<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> |
|||
<Owner> |
|||
<ID>admin</ID> |
|||
<DisplayName>admin</DisplayName> |
|||
</Owner> |
|||
<AccessControlList> |
|||
<Grant> |
|||
<Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser"> |
|||
<ID>admin</ID> |
|||
</Grantee> |
|||
<Permission>FULL_CONTROL</Permission> |
|||
</Grant> |
|||
<Grant> |
|||
<Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group"> |
|||
<URI>http://acs.amazonaws.com/groups/global/AllUsers</URI>
|
|||
</Grantee> |
|||
<Permission>FULL_CONTROL</Permission> |
|||
</Grant> |
|||
</AccessControlList> |
|||
</AccessControlPolicy> |
|||
`))) |
|||
objectWriter := "accountA" |
|||
grants, errCode := ExtractAcl(req, accountManager, s3_constants.OwnershipObjectWriter, accountAdminId, accountAdminId, objectWriter) |
|||
testCases = append(testCases, &Case{ |
|||
1, |
|||
errCode, s3err.ErrNone, |
|||
grants, []*s3.Grant{ |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeCanonicalUser, |
|||
ID: &accountAdminId, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
}, |
|||
}) |
|||
} |
|||
|
|||
{ |
|||
//case2 (good case)
|
|||
//parse acp from header (cannedAcl)
|
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
req.Body = nil |
|||
req.Header.Set(s3_constants.AmzCannedAcl, s3_constants.CannedAclPrivate) |
|||
objectWriter := "accountA" |
|||
grants, errCode := ExtractAcl(req, accountManager, s3_constants.OwnershipObjectWriter, accountAdminId, accountAdminId, objectWriter) |
|||
testCases = append(testCases, &Case{ |
|||
2, |
|||
errCode, s3err.ErrNone, |
|||
grants, []*s3.Grant{ |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeCanonicalUser, |
|||
ID: &objectWriter, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
}, |
|||
}) |
|||
} |
|||
|
|||
{ |
|||
//case3 (bad case)
|
|||
//parse acp from request body (content is invalid)
|
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
req.Body = io.NopCloser(bytes.NewReader([]byte("zdfsaf"))) |
|||
req.Header.Set(s3_constants.AmzCannedAcl, s3_constants.CannedAclPrivate) |
|||
objectWriter := "accountA" |
|||
_, errCode := ExtractAcl(req, accountManager, s3_constants.OwnershipObjectWriter, accountAdminId, accountAdminId, objectWriter) |
|||
testCases = append(testCases, &Case{ |
|||
id: 3, |
|||
resultErrCode: errCode, expectErrCode: s3err.ErrInvalidRequest, |
|||
}) |
|||
} |
|||
|
|||
//case4 (bad case)
|
|||
//parse acp from header (cannedAcl is invalid)
|
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
req.Body = nil |
|||
req.Header.Set(s3_constants.AmzCannedAcl, "dfaksjfk") |
|||
objectWriter := "accountA" |
|||
_, errCode := ExtractAcl(req, accountManager, s3_constants.OwnershipObjectWriter, accountAdminId, "", objectWriter) |
|||
testCases = append(testCases, &Case{ |
|||
id: 4, |
|||
resultErrCode: errCode, expectErrCode: s3err.ErrInvalidRequest, |
|||
}) |
|||
|
|||
{ |
|||
//case5 (bad case)
|
|||
//parse acp from request body: owner is inconsistent
|
|||
req.Body = io.NopCloser(bytes.NewReader([]byte(` |
|||
<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> |
|||
<Owner> |
|||
<ID>admin</ID> |
|||
<DisplayName>admin</DisplayName> |
|||
</Owner> |
|||
<AccessControlList> |
|||
<Grant> |
|||
<Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser"> |
|||
<ID>admin</ID> |
|||
</Grantee> |
|||
<Permission>FULL_CONTROL</Permission> |
|||
</Grant> |
|||
<Grant> |
|||
<Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group"> |
|||
<URI>http://acs.amazonaws.com/groups/global/AllUsers</URI>
|
|||
</Grantee> |
|||
<Permission>FULL_CONTROL</Permission> |
|||
</Grant> |
|||
</AccessControlList> |
|||
</AccessControlPolicy> |
|||
`))) |
|||
objectWriter = "accountA" |
|||
_, errCode := ExtractAcl(req, accountManager, s3_constants.OwnershipObjectWriter, accountAdminId, objectWriter, objectWriter) |
|||
testCases = append(testCases, &Case{ |
|||
id: 5, |
|||
resultErrCode: errCode, expectErrCode: s3err.ErrAccessDenied, |
|||
}) |
|||
} |
|||
|
|||
for _, tc := range testCases { |
|||
if tc.resultErrCode != tc.expectErrCode { |
|||
t.Fatalf("case[%d]: errorCode not expect", tc.id) |
|||
} |
|||
if !grantsEquals(tc.resultGrants, tc.expectGrants) { |
|||
t.Fatalf("case[%d]: grants not expect", tc.id) |
|||
} |
|||
} |
|||
} |
|||
|
|||
func TestParseAndValidateAclHeaders(t *testing.T) { |
|||
type Case struct { |
|||
id int |
|||
resultOwner, expectOwner string |
|||
resultErrCode, expectErrCode s3err.ErrorCode |
|||
resultGrants, expectGrants []*s3.Grant |
|||
} |
|||
testCases := make([]*Case, 0) |
|||
bucketOwner := "admin" |
|||
|
|||
{ |
|||
//case1 (good case)
|
|||
//parse custom acl
|
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
objectWriter := "accountA" |
|||
req.Header.Set(s3_constants.AmzAclFullControl, `uri="http://acs.amazonaws.com/groups/global/AllUsers", id="anonymous", emailAddress="admin@example.com"`) |
|||
ownerId, grants, errCode := ParseAndValidateAclHeaders(req, accountManager, s3_constants.OwnershipObjectWriter, bucketOwner, objectWriter, false) |
|||
testCases = append(testCases, &Case{ |
|||
1, |
|||
ownerId, objectWriter, |
|||
errCode, s3err.ErrNone, |
|||
grants, []*s3.Grant{ |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeCanonicalUser, |
|||
ID: aws.String(s3_constants.AccountAnonymousId), |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeCanonicalUser, |
|||
ID: aws.String(s3_constants.AccountAdminId), |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
}, |
|||
}) |
|||
} |
|||
{ |
|||
//case2 (good case)
|
|||
//parse canned acl (ownership=ObjectWriter)
|
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
objectWriter := "accountA" |
|||
req.Header.Set(s3_constants.AmzCannedAcl, s3_constants.CannedAclBucketOwnerFullControl) |
|||
ownerId, grants, errCode := ParseAndValidateAclHeaders(req, accountManager, s3_constants.OwnershipObjectWriter, bucketOwner, objectWriter, false) |
|||
testCases = append(testCases, &Case{ |
|||
2, |
|||
ownerId, objectWriter, |
|||
errCode, s3err.ErrNone, |
|||
grants, []*s3.Grant{ |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeCanonicalUser, |
|||
ID: &objectWriter, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeCanonicalUser, |
|||
ID: &bucketOwner, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
}, |
|||
}) |
|||
} |
|||
{ |
|||
//case3 (good case)
|
|||
//parse canned acl (ownership=OwnershipBucketOwnerPreferred)
|
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
objectWriter := "accountA" |
|||
req.Header.Set(s3_constants.AmzCannedAcl, s3_constants.CannedAclBucketOwnerFullControl) |
|||
ownerId, grants, errCode := ParseAndValidateAclHeaders(req, accountManager, s3_constants.OwnershipBucketOwnerPreferred, bucketOwner, objectWriter, false) |
|||
testCases = append(testCases, &Case{ |
|||
3, |
|||
ownerId, bucketOwner, |
|||
errCode, s3err.ErrNone, |
|||
grants, []*s3.Grant{ |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeCanonicalUser, |
|||
ID: &bucketOwner, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
}, |
|||
}) |
|||
} |
|||
{ |
|||
//case4 (bad case)
|
|||
//parse custom acl (grantee id not exists)
|
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
objectWriter := "accountA" |
|||
req.Header.Set(s3_constants.AmzAclFullControl, `uri="http://acs.amazonaws.com/groups/global/AllUsers", id="notExistsAccount", emailAddress="admin@example.com"`) |
|||
_, _, errCode := ParseAndValidateAclHeaders(req, accountManager, s3_constants.OwnershipObjectWriter, bucketOwner, objectWriter, false) |
|||
testCases = append(testCases, &Case{ |
|||
id: 4, |
|||
resultErrCode: errCode, expectErrCode: s3err.ErrInvalidRequest, |
|||
}) |
|||
} |
|||
|
|||
{ |
|||
//case5 (bad case)
|
|||
//parse custom acl (invalid format)
|
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
objectWriter := "accountA" |
|||
req.Header.Set(s3_constants.AmzAclFullControl, `uri="http:sfasf"`) |
|||
_, _, errCode := ParseAndValidateAclHeaders(req, accountManager, s3_constants.OwnershipObjectWriter, bucketOwner, objectWriter, false) |
|||
testCases = append(testCases, &Case{ |
|||
id: 5, |
|||
resultErrCode: errCode, expectErrCode: s3err.ErrInvalidRequest, |
|||
}) |
|||
} |
|||
|
|||
{ |
|||
//case6 (bad case)
|
|||
//parse canned acl (invalid value)
|
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
objectWriter := "accountA" |
|||
req.Header.Set(s3_constants.AmzCannedAcl, `uri="http:sfasf"`) |
|||
_, _, errCode := ParseAndValidateAclHeaders(req, accountManager, s3_constants.OwnershipObjectWriter, bucketOwner, objectWriter, false) |
|||
testCases = append(testCases, &Case{ |
|||
id: 5, |
|||
resultErrCode: errCode, expectErrCode: s3err.ErrInvalidRequest, |
|||
}) |
|||
} |
|||
|
|||
for _, tc := range testCases { |
|||
if tc.expectErrCode != tc.resultErrCode { |
|||
t.Errorf("case[%d]: errCode unexpect", tc.id) |
|||
} |
|||
if tc.resultOwner != tc.expectOwner { |
|||
t.Errorf("case[%d]: ownerId unexpect", tc.id) |
|||
} |
|||
if !grantsEquals(tc.resultGrants, tc.expectGrants) { |
|||
t.Fatalf("case[%d]: grants not expect", tc.id) |
|||
} |
|||
} |
|||
} |
|||
|
|||
func grantsEquals(a, b []*s3.Grant) bool { |
|||
if len(a) != len(b) { |
|||
return false |
|||
} |
|||
for i, grant := range a { |
|||
if !GrantEquals(grant, b[i]) { |
|||
return false |
|||
} |
|||
} |
|||
return true |
|||
} |
|||
|
|||
func TestDetermineReqGrants(t *testing.T) { |
|||
{ |
|||
//case1: request account is anonymous
|
|||
accountId := s3_constants.AccountAnonymousId |
|||
reqPermission := s3_constants.PermissionRead |
|||
|
|||
resultGrants := DetermineReqGrants(accountId, reqPermission) |
|||
expectGrants := []*s3.Grant{ |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
Permission: &reqPermission, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeCanonicalUser, |
|||
ID: &accountId, |
|||
}, |
|||
Permission: &reqPermission, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeCanonicalUser, |
|||
ID: &accountId, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
} |
|||
if !grantsEquals(resultGrants, expectGrants) { |
|||
t.Fatalf("grants not expect") |
|||
} |
|||
} |
|||
{ |
|||
//case2: request account is not anonymous (Iam authed)
|
|||
accountId := "accountX" |
|||
reqPermission := s3_constants.PermissionRead |
|||
|
|||
resultGrants := DetermineReqGrants(accountId, reqPermission) |
|||
expectGrants := []*s3.Grant{ |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
Permission: &reqPermission, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeCanonicalUser, |
|||
ID: &accountId, |
|||
}, |
|||
Permission: &reqPermission, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeCanonicalUser, |
|||
ID: &accountId, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAuthenticatedUsers, |
|||
}, |
|||
Permission: &reqPermission, |
|||
}, |
|||
{ |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAuthenticatedUsers, |
|||
}, |
|||
Permission: &s3_constants.PermissionFullControl, |
|||
}, |
|||
} |
|||
if !grantsEquals(resultGrants, expectGrants) { |
|||
t.Fatalf("grants not expect") |
|||
} |
|||
} |
|||
} |
|||
|
|||
func TestAssembleEntryWithAcp(t *testing.T) { |
|||
defaultOwner := "admin" |
|||
|
|||
//case1
|
|||
//assemble with non-empty grants
|
|||
expectOwner := "accountS" |
|||
expectGrants := []*s3.Grant{ |
|||
{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
ID: aws.String(s3_constants.AccountAdminId), |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
}, |
|||
} |
|||
entry := &filer_pb.Entry{} |
|||
AssembleEntryWithAcp(entry, expectOwner, expectGrants) |
|||
|
|||
resultOwner := GetAcpOwner(entry.Extended, defaultOwner) |
|||
if resultOwner != expectOwner { |
|||
t.Fatalf("owner not expect") |
|||
} |
|||
|
|||
resultGrants := GetAcpGrants(entry.Extended) |
|||
if !grantsEquals(resultGrants, expectGrants) { |
|||
t.Fatal("grants not expect") |
|||
} |
|||
|
|||
//case2
|
|||
//assemble with empty grants (override)
|
|||
AssembleEntryWithAcp(entry, "", nil) |
|||
resultOwner = GetAcpOwner(entry.Extended, defaultOwner) |
|||
if resultOwner != defaultOwner { |
|||
t.Fatalf("owner not expect") |
|||
} |
|||
|
|||
resultGrants = GetAcpGrants(entry.Extended) |
|||
if len(resultGrants) != 0 { |
|||
t.Fatal("grants not expect") |
|||
} |
|||
|
|||
} |
|||
|
|||
func TestGrantEquals(t *testing.T) { |
|||
testCases := map[bool]bool{ |
|||
GrantEquals(nil, nil): true, |
|||
|
|||
GrantEquals(&s3.Grant{}, nil): false, |
|||
|
|||
GrantEquals(&s3.Grant{}, &s3.Grant{}): true, |
|||
|
|||
GrantEquals(&s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
}, &s3.Grant{}): false, |
|||
|
|||
GrantEquals(&s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
}, &s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
}): true, |
|||
|
|||
GrantEquals(&s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{}, |
|||
}, &s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{}, |
|||
}): true, |
|||
|
|||
GrantEquals(&s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
}, |
|||
}, &s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{}, |
|||
}): false, |
|||
|
|||
//type not present, compare other fields of grant is meaningless
|
|||
GrantEquals(&s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
ID: aws.String(s3_constants.AccountAdminId), |
|||
//EmailAddress: &s3account.AccountAdmin.EmailAddress,
|
|||
}, |
|||
}, &s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
ID: aws.String(s3_constants.AccountAdminId), |
|||
}, |
|||
}): true, |
|||
|
|||
GrantEquals(&s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
}, |
|||
}, &s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
}, |
|||
}): true, |
|||
|
|||
GrantEquals(&s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
}, &s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
}): true, |
|||
|
|||
GrantEquals(&s3.Grant{ |
|||
Permission: &s3_constants.PermissionWrite, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
}, &s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
}): false, |
|||
|
|||
GrantEquals(&s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
ID: aws.String(s3_constants.AccountAdminId), |
|||
}, |
|||
}, &s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
ID: aws.String(s3_constants.AccountAdminId), |
|||
}, |
|||
}): true, |
|||
|
|||
GrantEquals(&s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
ID: aws.String(s3_constants.AccountAdminId), |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
}, &s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
ID: aws.String(s3_constants.AccountAdminId), |
|||
}, |
|||
}): false, |
|||
|
|||
GrantEquals(&s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
ID: aws.String(s3_constants.AccountAdminId), |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
}, &s3.Grant{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
}): true, |
|||
} |
|||
|
|||
for tc, expect := range testCases { |
|||
if tc != expect { |
|||
t.Fatal("TestGrantEquals not expect!") |
|||
} |
|||
} |
|||
} |
|||
|
|||
func TestSetAcpOwnerHeader(t *testing.T) { |
|||
ownerId := "accountZ" |
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
SetAcpOwnerHeader(req, ownerId) |
|||
|
|||
if req.Header.Get(s3_constants.ExtAmzOwnerKey) != ownerId { |
|||
t.Fatalf("owner unexpect") |
|||
} |
|||
} |
|||
|
|||
func TestSetAcpGrantsHeader(t *testing.T) { |
|||
req := &http.Request{ |
|||
Header: make(map[string][]string), |
|||
} |
|||
grants := []*s3.Grant{ |
|||
{ |
|||
Permission: &s3_constants.PermissionRead, |
|||
Grantee: &s3.Grantee{ |
|||
Type: &s3_constants.GrantTypeGroup, |
|||
ID: aws.String(s3_constants.AccountAdminId), |
|||
URI: &s3_constants.GranteeGroupAllUsers, |
|||
}, |
|||
}, |
|||
} |
|||
SetAcpGrantsHeader(req, grants) |
|||
|
|||
grantsJson, _ := json.Marshal(grants) |
|||
if req.Header.Get(s3_constants.ExtAmzAclKey) != string(grantsJson) { |
|||
t.Fatalf("owner unexpect") |
|||
} |
|||
} |
|||
@ -1,28 +1,406 @@ |
|||
package s3api |
|||
|
|||
import ( |
|||
"net/http" |
|||
"path/filepath" |
|||
|
|||
"github.com/aws/aws-sdk-go/service/s3" |
|||
"github.com/seaweedfs/seaweedfs/weed/glog" |
|||
"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb" |
|||
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants" |
|||
"github.com/seaweedfs/seaweedfs/weed/s3api/s3acl" |
|||
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err" |
|||
"net/http" |
|||
"github.com/seaweedfs/seaweedfs/weed/util" |
|||
) |
|||
|
|||
func getAccountId(r *http.Request) string { |
|||
id := r.Header.Get(s3_constants.AmzAccountId) |
|||
if len(id) == 0 { |
|||
return AccountAnonymous.Id |
|||
} else { |
|||
return id |
|||
func (s3a *S3ApiServer) checkAccessByOwnership(r *http.Request, bucket string) s3err.ErrorCode { |
|||
bucketMetadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket) |
|||
if errCode != s3err.ErrNone { |
|||
return errCode |
|||
} |
|||
requestAccountId := s3acl.GetAccountId(r) |
|||
if s3acl.ValidateAccount(requestAccountId, *bucketMetadata.Owner.ID) { |
|||
return s3err.ErrNone |
|||
} |
|||
return s3err.ErrAccessDenied |
|||
} |
|||
|
|||
func (s3a *S3ApiServer) checkAccessByOwnership(r *http.Request, bucket string) s3err.ErrorCode { |
|||
metadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket) |
|||
// Check access for PutBucketAclHandler
|
|||
func (s3a *S3ApiServer) checkAccessForPutBucketAcl(requestAccountId, bucket string) (*BucketMetaData, s3err.ErrorCode) { |
|||
bucketMetadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket) |
|||
if errCode != s3err.ErrNone { |
|||
return nil, errCode |
|||
} |
|||
|
|||
if bucketMetadata.ObjectOwnership == s3_constants.OwnershipBucketOwnerEnforced { |
|||
return nil, s3err.AccessControlListNotSupported |
|||
} |
|||
|
|||
if s3acl.ValidateAccount(requestAccountId, *bucketMetadata.Owner.ID) { |
|||
return bucketMetadata, s3err.ErrNone |
|||
} |
|||
|
|||
if len(bucketMetadata.Acl) > 0 { |
|||
reqGrants := s3acl.DetermineRequiredGrants(requestAccountId, s3_constants.PermissionWriteAcp) |
|||
for _, bucketGrant := range bucketMetadata.Acl { |
|||
for _, reqGrant := range reqGrants { |
|||
if s3acl.GrantEquals(bucketGrant, reqGrant) { |
|||
return bucketMetadata, s3err.ErrNone |
|||
} |
|||
} |
|||
} |
|||
} |
|||
glog.V(3).Infof("acl denied! request account id: %s", requestAccountId) |
|||
return nil, s3err.ErrAccessDenied |
|||
} |
|||
|
|||
func updateBucketEntry(s3a *S3ApiServer, entry *filer_pb.Entry) error { |
|||
return s3a.updateEntry(s3a.option.BucketsPath, entry) |
|||
} |
|||
|
|||
// Check Bucket/BucketAcl Read related access
|
|||
// includes:
|
|||
// - HeadBucketHandler
|
|||
// - GetBucketAclHandler
|
|||
// - ListObjectsV1Handler
|
|||
// - ListObjectsV2Handler
|
|||
// - ListMultipartUploadsHandler
|
|||
func (s3a *S3ApiServer) checkAccessForReadBucket(r *http.Request, bucket, aclAction string) (*BucketMetaData, s3err.ErrorCode) { |
|||
bucketMetadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket) |
|||
if errCode != s3err.ErrNone { |
|||
return nil, errCode |
|||
} |
|||
|
|||
if bucketMetadata.ObjectOwnership == s3_constants.OwnershipBucketOwnerEnforced { |
|||
return bucketMetadata, s3err.ErrNone |
|||
} |
|||
|
|||
requestAccountId := s3acl.GetAccountId(r) |
|||
if s3acl.ValidateAccount(requestAccountId, *bucketMetadata.Owner.ID) { |
|||
return bucketMetadata, s3err.ErrNone |
|||
} |
|||
|
|||
if len(bucketMetadata.Acl) > 0 { |
|||
reqGrants := s3acl.DetermineRequiredGrants(requestAccountId, aclAction) |
|||
for _, bucketGrant := range bucketMetadata.Acl { |
|||
for _, reqGrant := range reqGrants { |
|||
if s3acl.GrantEquals(bucketGrant, reqGrant) { |
|||
return bucketMetadata, s3err.ErrNone |
|||
} |
|||
} |
|||
} |
|||
} |
|||
|
|||
glog.V(3).Infof("acl denied! request account id: %s", requestAccountId) |
|||
return nil, s3err.ErrAccessDenied |
|||
} |
|||
|
|||
// Check ObjectAcl-Read related access
|
|||
// includes:
|
|||
// - GetObjectAclHandler
|
|||
func (s3a *S3ApiServer) checkAccessForReadObjectAcl(r *http.Request, bucket, object string) (acp *s3.AccessControlPolicy, errCode s3err.ErrorCode) { |
|||
bucketMetadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket) |
|||
if errCode != s3err.ErrNone { |
|||
return nil, errCode |
|||
} |
|||
|
|||
getAcpFunc := func() (*s3.AccessControlPolicy, s3err.ErrorCode) { |
|||
entry, err := getObjectEntry(s3a, bucket, object) |
|||
if err != nil { |
|||
if err == filer_pb.ErrNotFound { |
|||
return nil, s3err.ErrNoSuchKey |
|||
} else { |
|||
return nil, s3err.ErrInternalError |
|||
} |
|||
} |
|||
if entry.IsDirectory { |
|||
return nil, s3err.ErrExistingObjectIsDirectory |
|||
} |
|||
acpOwnerId := s3acl.GetAcpOwner(entry.Extended, *bucketMetadata.Owner.ID) |
|||
acpOwnerName := s3a.iam.GetAccountNameById(acpOwnerId) |
|||
acpGrants := s3acl.GetAcpGrants(&acpOwnerId, entry.Extended) |
|||
acp = &s3.AccessControlPolicy{ |
|||
Owner: &s3.Owner{ |
|||
ID: &acpOwnerId, |
|||
DisplayName: &acpOwnerName, |
|||
}, |
|||
Grants: acpGrants, |
|||
} |
|||
return acp, s3err.ErrNone |
|||
} |
|||
if bucketMetadata.ObjectOwnership == s3_constants.OwnershipBucketOwnerEnforced { |
|||
return getAcpFunc() |
|||
} |
|||
requestAccountId := s3acl.GetAccountId(r) |
|||
acp, errCode = getAcpFunc() |
|||
if errCode != s3err.ErrNone { |
|||
return nil, errCode |
|||
} |
|||
if s3acl.ValidateAccount(requestAccountId, *acp.Owner.ID) { |
|||
return acp, s3err.ErrNone |
|||
} |
|||
if acp.Grants != nil { |
|||
reqGrants := s3acl.DetermineRequiredGrants(requestAccountId, s3_constants.PermissionReadAcp) |
|||
for _, requiredGrant := range reqGrants { |
|||
for _, grant := range acp.Grants { |
|||
if s3acl.GrantEquals(requiredGrant, grant) { |
|||
return acp, s3err.ErrNone |
|||
} |
|||
} |
|||
} |
|||
} |
|||
glog.V(3).Infof("CheckAccessForReadObjectAcl denied! request account id: %s", requestAccountId) |
|||
return nil, s3err.ErrAccessDenied |
|||
} |
|||
|
|||
// Check Object-Read related access
|
|||
// includes:
|
|||
// - GetObjectHandler
|
|||
//
|
|||
// offload object access validation to Filer layer
|
|||
// - CheckObjectAccessForReadObject
|
|||
func (s3a *S3ApiServer) checkBucketAccessForReadObject(r *http.Request, bucket string) s3err.ErrorCode { |
|||
bucketMetadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket) |
|||
if errCode != s3err.ErrNone { |
|||
return errCode |
|||
} |
|||
accountId := getAccountId(r) |
|||
if accountId == AccountAdmin.Id || accountId == *metadata.Owner.ID { |
|||
|
|||
if bucketMetadata.ObjectOwnership != s3_constants.OwnershipBucketOwnerEnforced { |
|||
//offload object acl validation to filer layer
|
|||
_, defaultErrorCode := s3a.checkAccessForReadBucket(r, bucket, s3_constants.PermissionRead) |
|||
if defaultErrorCode != s3err.ErrNone { |
|||
r.Header.Set(s3_constants.XAmzBucketAccessDenied, "true") |
|||
} |
|||
r.Header.Set(s3_constants.XAmzBucketOwnerId, *bucketMetadata.Owner.ID) |
|||
} |
|||
|
|||
return s3err.ErrNone |
|||
} |
|||
|
|||
// Check ObjectAcl-Write related access
|
|||
// includes:
|
|||
// - PutObjectAclHandler
|
|||
func (s3a *S3ApiServer) checkAccessForWriteObjectAcl(r *http.Request, bucket, object string) (*filer_pb.Entry, string, []*s3.Grant, s3err.ErrorCode) { |
|||
bucketMetadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket) |
|||
if errCode != s3err.ErrNone { |
|||
return nil, "", nil, errCode |
|||
} |
|||
|
|||
requestAccountId := s3acl.GetAccountId(r) |
|||
reqOwnerId, grants, errCode := s3acl.ExtractObjectAcl(r, s3a.iam, bucketMetadata.ObjectOwnership, *bucketMetadata.Owner.ID, requestAccountId, false) |
|||
if errCode != s3err.ErrNone { |
|||
return nil, "", nil, errCode |
|||
} |
|||
|
|||
if bucketMetadata.ObjectOwnership == s3_constants.OwnershipBucketOwnerEnforced { |
|||
return nil, "", nil, s3err.AccessControlListNotSupported |
|||
} |
|||
|
|||
//object acl
|
|||
objectEntry, err := getObjectEntry(s3a, bucket, object) |
|||
if err != nil { |
|||
if err == filer_pb.ErrNotFound { |
|||
return nil, "", nil, s3err.ErrNoSuchKey |
|||
} |
|||
return nil, "", nil, s3err.ErrInternalError |
|||
} |
|||
|
|||
if objectEntry.IsDirectory { |
|||
return nil, "", nil, s3err.ErrExistingObjectIsDirectory |
|||
} |
|||
|
|||
objectOwner := s3acl.GetAcpOwner(objectEntry.Extended, *bucketMetadata.Owner.ID) |
|||
//object owner is immutable
|
|||
if reqOwnerId != "" && reqOwnerId != objectOwner { |
|||
return nil, "", nil, s3err.ErrAccessDenied |
|||
} |
|||
if s3acl.ValidateAccount(requestAccountId, objectOwner) { |
|||
return objectEntry, objectOwner, grants, s3err.ErrNone |
|||
} |
|||
|
|||
objectGrants := s3acl.GetAcpGrants(nil, objectEntry.Extended) |
|||
if objectGrants != nil { |
|||
requiredGrants := s3acl.DetermineRequiredGrants(requestAccountId, s3_constants.PermissionWriteAcp) |
|||
for _, objectGrant := range objectGrants { |
|||
for _, requiredGrant := range requiredGrants { |
|||
if s3acl.GrantEquals(objectGrant, requiredGrant) { |
|||
return objectEntry, objectOwner, grants, s3err.ErrNone |
|||
} |
|||
} |
|||
} |
|||
} |
|||
|
|||
glog.V(3).Infof("checkAccessForWriteObjectAcl denied! request account id: %s", requestAccountId) |
|||
return nil, "", nil, s3err.ErrAccessDenied |
|||
} |
|||
|
|||
func updateObjectEntry(s3a *S3ApiServer, bucket, object string, entry *filer_pb.Entry) error { |
|||
dir, _ := filepath.Split(object) |
|||
return s3a.updateEntry(util.Join(s3a.option.BucketsPath, bucket, dir), entry) |
|||
} |
|||
|
|||
// CheckAccessForPutObject Check ACL for PutObject API
|
|||
// includes:
|
|||
// - PutObjectHandler
|
|||
func (s3a *S3ApiServer) CheckAccessForPutObject(r *http.Request, bucket, object string) s3err.ErrorCode { |
|||
accountId := s3acl.GetAccountId(r) |
|||
return s3a.checkAccessForPutObject(r, bucket, object, accountId) |
|||
} |
|||
|
|||
// CheckAccessForPutObjectPartHandler Check Acl for Upload object part
|
|||
// includes:
|
|||
// - PutObjectPartHandler
|
|||
func (s3a *S3ApiServer) CheckAccessForPutObjectPartHandler(r *http.Request, bucket string) s3err.ErrorCode { |
|||
bucketMetadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket) |
|||
if errCode != s3err.ErrNone { |
|||
return errCode |
|||
} |
|||
if bucketMetadata.ObjectOwnership == s3_constants.OwnershipBucketOwnerEnforced { |
|||
return s3err.ErrNone |
|||
} |
|||
accountId := s3acl.GetAccountId(r) |
|||
if !CheckBucketAccess(accountId, bucketMetadata, s3_constants.PermissionWrite) { |
|||
return s3err.ErrAccessDenied |
|||
} |
|||
return s3err.ErrNone |
|||
} |
|||
|
|||
// CheckAccessForNewMultipartUpload Check Acl for API
|
|||
// includes:
|
|||
// - NewMultipartUploadHandler
|
|||
func (s3a *S3ApiServer) CheckAccessForNewMultipartUpload(r *http.Request, bucket, object string) (s3err.ErrorCode, string) { |
|||
accountId := s3acl.GetAccountId(r) |
|||
if accountId == AccountAnonymous.Id { |
|||
return s3err.ErrAccessDenied, "" |
|||
} |
|||
errCode := s3a.checkAccessForPutObject(r, bucket, object, accountId) |
|||
return errCode, accountId |
|||
} |
|||
|
|||
func (s3a *S3ApiServer) CheckAccessForAbortMultipartUpload(r *http.Request, bucket, object string) s3err.ErrorCode { |
|||
return s3a.CheckAccessWithBucketOwnerAndInitiator(r, bucket, object) |
|||
} |
|||
|
|||
func (s3a *S3ApiServer) CheckAccessForCompleteMultipartUpload(r *http.Request, bucket, object string) s3err.ErrorCode { |
|||
bucketMetadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket) |
|||
if errCode != s3err.ErrNone { |
|||
return errCode |
|||
} |
|||
|
|||
if bucketMetadata.ObjectOwnership != s3_constants.OwnershipBucketOwnerEnforced { |
|||
accountId := s3acl.GetAccountId(r) |
|||
if !CheckBucketAccess(accountId, bucketMetadata, s3_constants.PermissionWrite) { |
|||
return s3err.ErrAccessDenied |
|||
} |
|||
} |
|||
return s3err.ErrNone |
|||
} |
|||
|
|||
func (s3a *S3ApiServer) CheckAccessForListMultipartUploadParts(r *http.Request, bucket, object string) s3err.ErrorCode { |
|||
return s3a.CheckAccessWithBucketOwnerAndInitiator(r, bucket, object) |
|||
} |
|||
|
|||
// CheckAccessWithBucketOwnerAndInitiator Check Access Permission with 'bucketOwner' and 'multipartUpload initiator'
|
|||
func (s3a *S3ApiServer) CheckAccessWithBucketOwnerAndInitiator(r *http.Request, bucket, object string) s3err.ErrorCode { |
|||
bucketMetadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket) |
|||
if errCode != s3err.ErrNone { |
|||
return errCode |
|||
} |
|||
|
|||
//bucket access allowed
|
|||
accountId := s3acl.GetAccountId(r) |
|||
if s3acl.ValidateAccount(*bucketMetadata.Owner.ID, accountId) { |
|||
return s3err.ErrNone |
|||
} |
|||
|
|||
//multipart initiator allowed
|
|||
entry, err := getMultipartUpload(s3a, bucket, object) |
|||
if err != nil { |
|||
if err != filer_pb.ErrNotFound { |
|||
return s3err.ErrInternalError |
|||
} |
|||
} else { |
|||
uploadInitiator, ok := entry.Extended[s3_constants.ExtAmzMultipartInitiator] |
|||
if !ok || accountId == string(uploadInitiator) { |
|||
return s3err.ErrNone |
|||
} |
|||
} |
|||
glog.V(3).Infof("CheckAccessWithBucketOwnerAndInitiator denied! request account id: %s", accountId) |
|||
return s3err.ErrAccessDenied |
|||
} |
|||
|
|||
func (s3a *S3ApiServer) checkAccessForPutObject(r *http.Request, bucket, object, requestAccountId string) s3err.ErrorCode { |
|||
bucketMetadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket) |
|||
if errCode != s3err.ErrNone { |
|||
return errCode |
|||
} |
|||
|
|||
// if ownership is 'OwnershipBucketOwnerEnforced', acl is not supportedG
|
|||
if bucketMetadata.ObjectOwnership == s3_constants.OwnershipBucketOwnerEnforced { |
|||
_, _, errCode := s3acl.ExtractObjectAcl(r, s3a.iam, bucketMetadata.ObjectOwnership, *bucketMetadata.Owner.ID, requestAccountId, true) |
|||
if errCode != s3err.ErrNone { |
|||
return errCode |
|||
} |
|||
return s3err.ErrNone |
|||
} |
|||
|
|||
requestOwnerId, grants, errCode := s3acl.ExtractObjectAcl(r, s3a.iam, bucketMetadata.ObjectOwnership, *bucketMetadata.Owner.ID, requestAccountId, true) |
|||
if errCode != s3err.ErrNone { |
|||
return errCode |
|||
} |
|||
|
|||
if !CheckBucketAccess(requestAccountId, bucketMetadata, s3_constants.PermissionWrite) { |
|||
return s3err.ErrAccessDenied |
|||
} |
|||
|
|||
if requestOwnerId == "" { |
|||
requestOwnerId = requestAccountId |
|||
} |
|||
entry, err := getObjectEntry(s3a, bucket, object) |
|||
if err != nil { |
|||
if err == filer_pb.ErrNotFound { |
|||
s3acl.SetAcpOwnerHeader(r, requestOwnerId) |
|||
s3acl.SetAcpGrantsHeader(r, grants) |
|||
return s3err.ErrNone |
|||
} |
|||
return s3err.ErrInternalError |
|||
} |
|||
|
|||
objectOwnerId := s3acl.GetAcpOwner(entry.Extended, *bucketMetadata.Owner.ID) |
|||
|
|||
//object owner is immutable
|
|||
if !s3acl.ValidateAccount(requestOwnerId, objectOwnerId, *bucketMetadata.Owner.ID) { |
|||
return s3err.ErrAccessDenied |
|||
} |
|||
|
|||
s3acl.SetAcpOwnerHeader(r, objectOwnerId) |
|||
s3acl.SetAcpGrantsHeader(r, grants) |
|||
return s3err.ErrNone |
|||
} |
|||
|
|||
func CheckBucketAccess(requestAccountId string, bucketMetadata *BucketMetaData, permission string) bool { |
|||
if s3acl.ValidateAccount(requestAccountId, *bucketMetadata.Owner.ID) { |
|||
return true |
|||
} else { |
|||
if len(bucketMetadata.Acl) > 0 { |
|||
reqGrants := s3acl.DetermineRequiredGrants(requestAccountId, permission) |
|||
for _, bucketGrant := range bucketMetadata.Acl { |
|||
for _, requiredGrant := range reqGrants { |
|||
if s3acl.GrantEquals(bucketGrant, requiredGrant) { |
|||
return true |
|||
} |
|||
} |
|||
} |
|||
} |
|||
} |
|||
glog.V(3).Infof("CheckBucketAccess denied! request account id: %s", requestAccountId) |
|||
return false |
|||
} |
|||
|
|||
func getObjectEntry(s3a *S3ApiServer, bucket, object string) (*filer_pb.Entry, error) { |
|||
return s3a.getEntry(util.Join(s3a.option.BucketsPath, bucket), object) |
|||
} |
|||
|
|||
func getMultipartUpload(s3a *S3ApiServer, bucket, object string) (*filer_pb.Entry, error) { |
|||
return s3a.getEntry(s3a.genUploadsFolder(bucket), object) |
|||
} |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue