2018-10-09 23:00:01 +02:00
|
|
|
/*
|
2019-04-09 20:39:42 +02:00
|
|
|
* MinIO Cloud Storage, (C) 2018 MinIO, Inc.
|
2018-10-09 23:00:01 +02:00
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
|
|
|
package iampolicy
|
|
|
|
|
|
|
|
import (
|
|
|
|
"encoding/json"
|
|
|
|
"io"
|
2020-01-09 02:21:58 +01:00
|
|
|
"strings"
|
2018-10-09 23:00:01 +02:00
|
|
|
|
2020-07-14 18:38:05 +02:00
|
|
|
"github.com/minio/minio-go/v7/pkg/set"
|
2020-01-27 23:12:34 +01:00
|
|
|
"github.com/minio/minio/pkg/bucket/policy"
|
2018-10-09 23:00:01 +02:00
|
|
|
)
|
|
|
|
|
|
|
|
// DefaultVersion - default policy version as per AWS S3 specification.
|
|
|
|
const DefaultVersion = "2012-10-17"
|
|
|
|
|
|
|
|
// Args - arguments to policy to check whether it is allowed
|
|
|
|
type Args struct {
|
|
|
|
AccountName string `json:"account"`
|
|
|
|
Action Action `json:"action"`
|
|
|
|
BucketName string `json:"bucket"`
|
|
|
|
ConditionValues map[string][]string `json:"conditions"`
|
|
|
|
IsOwner bool `json:"owner"`
|
|
|
|
ObjectName string `json:"object"`
|
|
|
|
Claims map[string]interface{} `json:"claims"`
|
|
|
|
}
|
|
|
|
|
2020-07-10 23:48:44 +02:00
|
|
|
// GetPoliciesFromClaims returns the list of policies to be applied for this
|
|
|
|
// incoming request, extracting the information from input JWT claims.
|
|
|
|
func GetPoliciesFromClaims(claims map[string]interface{}, policyClaimName string) (set.StringSet, bool) {
|
2020-05-11 22:04:11 +02:00
|
|
|
s := set.NewStringSet()
|
2020-07-10 23:48:44 +02:00
|
|
|
pname, ok := claims[policyClaimName]
|
2020-01-09 02:21:58 +01:00
|
|
|
if !ok {
|
2020-05-11 22:04:11 +02:00
|
|
|
return s, false
|
2020-01-09 02:21:58 +01:00
|
|
|
}
|
2020-07-14 19:26:47 +02:00
|
|
|
pnames, ok := pname.([]interface{})
|
2020-05-11 22:04:11 +02:00
|
|
|
if !ok {
|
|
|
|
pnameStr, ok := pname.(string)
|
|
|
|
if ok {
|
2020-07-14 19:26:47 +02:00
|
|
|
for _, pname := range strings.Split(pnameStr, ",") {
|
|
|
|
pname = strings.TrimSpace(pname)
|
|
|
|
if pname == "" {
|
|
|
|
// ignore any empty strings, considerate
|
|
|
|
// towards some user errors.
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
s.Add(pname)
|
|
|
|
}
|
|
|
|
return s, true
|
2020-05-11 22:04:11 +02:00
|
|
|
}
|
2020-07-14 19:26:47 +02:00
|
|
|
return s, false
|
2020-05-11 22:04:11 +02:00
|
|
|
}
|
|
|
|
for _, pname := range pnames {
|
2020-07-14 19:26:47 +02:00
|
|
|
pnameStr, ok := pname.(string)
|
|
|
|
if ok {
|
|
|
|
for _, pnameStr := range strings.Split(pnameStr, ",") {
|
|
|
|
pnameStr = strings.TrimSpace(pnameStr)
|
|
|
|
if pnameStr == "" {
|
|
|
|
// ignore any empty strings, considerate
|
|
|
|
// towards some user errors.
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
s.Add(pnameStr)
|
|
|
|
}
|
2020-05-11 22:04:11 +02:00
|
|
|
}
|
2020-01-09 02:21:58 +01:00
|
|
|
}
|
2020-05-11 22:04:11 +02:00
|
|
|
return s, true
|
2020-01-09 02:21:58 +01:00
|
|
|
}
|
|
|
|
|
2020-07-10 23:48:44 +02:00
|
|
|
// GetPolicies returns the list of policies to be applied for this
|
|
|
|
// incoming request, extracting the information from JWT claims.
|
|
|
|
func (a Args) GetPolicies(policyClaimName string) (set.StringSet, bool) {
|
|
|
|
return GetPoliciesFromClaims(a.Claims, policyClaimName)
|
|
|
|
}
|
|
|
|
|
2018-10-09 23:00:01 +02:00
|
|
|
// Policy - iam bucket iamp.
|
|
|
|
type Policy struct {
|
|
|
|
ID policy.ID `json:"ID,omitempty"`
|
|
|
|
Version string
|
|
|
|
Statements []Statement `json:"Statement"`
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsAllowed - checks given policy args is allowed to continue the Rest API.
|
|
|
|
func (iamp Policy) IsAllowed(args Args) bool {
|
|
|
|
// Check all deny statements. If any one statement denies, return false.
|
|
|
|
for _, statement := range iamp.Statements {
|
|
|
|
if statement.Effect == policy.Deny {
|
|
|
|
if !statement.IsAllowed(args) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// For owner, its allowed by default.
|
|
|
|
if args.IsOwner {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check all allow statements. If any one statement allows, return true.
|
|
|
|
for _, statement := range iamp.Statements {
|
|
|
|
if statement.Effect == policy.Allow {
|
|
|
|
if statement.IsAllowed(args) {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsEmpty - returns whether policy is empty or not.
|
|
|
|
func (iamp Policy) IsEmpty() bool {
|
|
|
|
return len(iamp.Statements) == 0
|
|
|
|
}
|
|
|
|
|
|
|
|
// isValid - checks if Policy is valid or not.
|
|
|
|
func (iamp Policy) isValid() error {
|
|
|
|
if iamp.Version != DefaultVersion && iamp.Version != "" {
|
2020-01-03 20:28:52 +01:00
|
|
|
return Errorf("invalid version '%v'", iamp.Version)
|
2018-10-09 23:00:01 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, statement := range iamp.Statements {
|
|
|
|
if err := statement.isValid(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
2020-04-18 06:26:42 +02:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (iamp *Policy) dropDuplicateStatements() {
|
|
|
|
redo:
|
2018-10-09 23:00:01 +02:00
|
|
|
for i := range iamp.Statements {
|
2020-04-18 06:26:42 +02:00
|
|
|
for j, statement := range iamp.Statements[i+1:] {
|
2020-01-09 08:00:54 +01:00
|
|
|
if iamp.Statements[i].Effect != statement.Effect {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2020-01-10 04:29:57 +01:00
|
|
|
if !iamp.Statements[i].Actions.Equals(statement.Actions) {
|
2018-10-09 23:00:01 +02:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2020-01-10 04:29:57 +01:00
|
|
|
if !iamp.Statements[i].Resources.Equals(statement.Resources) {
|
2018-10-09 23:00:01 +02:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
if iamp.Statements[i].Conditions.String() != statement.Conditions.String() {
|
|
|
|
continue
|
|
|
|
}
|
2020-04-18 06:26:42 +02:00
|
|
|
iamp.Statements = append(iamp.Statements[:j], iamp.Statements[j+1:]...)
|
|
|
|
goto redo
|
2018-10-09 23:00:01 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// UnmarshalJSON - decodes JSON data to Iamp.
|
|
|
|
func (iamp *Policy) UnmarshalJSON(data []byte) error {
|
|
|
|
// subtype to avoid recursive call to UnmarshalJSON()
|
|
|
|
type subPolicy Policy
|
|
|
|
var sp subPolicy
|
|
|
|
if err := json.Unmarshal(data, &sp); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
p := Policy(sp)
|
2020-04-18 06:26:42 +02:00
|
|
|
p.dropDuplicateStatements()
|
2018-10-09 23:00:01 +02:00
|
|
|
*iamp = p
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Validate - validates all statements are for given bucket or not.
|
|
|
|
func (iamp Policy) Validate() error {
|
2020-05-10 19:55:28 +02:00
|
|
|
return iamp.isValid()
|
2018-10-09 23:00:01 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// ParseConfig - parses data in given reader to Iamp.
|
|
|
|
func ParseConfig(reader io.Reader) (*Policy, error) {
|
|
|
|
var iamp Policy
|
|
|
|
|
|
|
|
decoder := json.NewDecoder(reader)
|
|
|
|
decoder.DisallowUnknownFields()
|
|
|
|
if err := decoder.Decode(&iamp); err != nil {
|
2020-01-07 01:15:22 +01:00
|
|
|
return nil, Errorf("%w", err)
|
2018-10-09 23:00:01 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return &iamp, iamp.Validate()
|
|
|
|
}
|