2015-06-30 23:42:29 +02:00
|
|
|
/*
|
2016-03-06 01:43:48 +01:00
|
|
|
* Minio Cloud Storage, (C) 2015, 2016 Minio, Inc.
|
2015-06-30 23:42:29 +02:00
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
2016-08-19 01:23:42 +02:00
|
|
|
package cmd
|
2015-06-30 23:42:29 +02:00
|
|
|
|
|
|
|
import (
|
2016-03-06 01:43:48 +01:00
|
|
|
"encoding/xml"
|
2016-02-16 02:42:39 +01:00
|
|
|
"io"
|
2015-06-30 23:42:29 +02:00
|
|
|
"net/http"
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
"net/url"
|
|
|
|
"strings"
|
2016-09-02 10:59:08 +02:00
|
|
|
"sync"
|
2015-06-30 23:42:29 +02:00
|
|
|
|
2016-02-22 02:57:05 +01:00
|
|
|
mux "github.com/gorilla/mux"
|
2016-08-20 12:16:38 +02:00
|
|
|
"github.com/minio/minio-go/pkg/set"
|
2015-06-30 23:42:29 +02:00
|
|
|
)
|
|
|
|
|
2016-04-07 03:31:40 +02:00
|
|
|
// http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
|
2016-08-11 05:10:48 +02:00
|
|
|
// Enforces bucket policies for a bucket for a given tatusaction.
|
|
|
|
func enforceBucketPolicy(bucket string, action string, reqURL *url.URL) (s3Error APIErrorCode) {
|
2016-09-26 23:28:35 +02:00
|
|
|
// Verify if bucket actually exists
|
|
|
|
if err := isBucketExist(bucket, newObjectLayerFn()); err != nil {
|
2016-09-23 08:47:48 +02:00
|
|
|
err = errorCause(err)
|
|
|
|
switch err.(type) {
|
|
|
|
case BucketNameInvalid:
|
|
|
|
// Return error for invalid bucket name.
|
|
|
|
return ErrInvalidBucketName
|
|
|
|
case BucketNotFound:
|
|
|
|
// For no bucket found we return NoSuchBucket instead.
|
|
|
|
return ErrNoSuchBucket
|
|
|
|
}
|
|
|
|
errorIf(err, "Unable to read bucket policy.")
|
|
|
|
// Return internal error for any other errors so that we can investigate.
|
|
|
|
return ErrInternalError
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
}
|
|
|
|
|
2016-09-26 23:28:35 +02:00
|
|
|
// Fetch bucket policy, if policy is not set return access denied.
|
|
|
|
policy := globalBucketPolicies.GetBucketPolicy(bucket)
|
|
|
|
if policy == nil {
|
|
|
|
return ErrAccessDenied
|
|
|
|
}
|
|
|
|
|
2016-05-05 01:56:57 +02:00
|
|
|
// Construct resource in 'arn:aws:s3:::examplebucket/object' format.
|
2016-09-11 19:33:49 +02:00
|
|
|
resource := AWSResourcePrefix + strings.TrimSuffix(strings.TrimPrefix(reqURL.Path, "/"), "/")
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
|
|
|
|
// Get conditions for policy verification.
|
2016-08-20 12:16:38 +02:00
|
|
|
conditionKeyMap := make(map[string]set.StringSet)
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
for queryParam := range reqURL.Query() {
|
2016-08-20 12:16:38 +02:00
|
|
|
conditionKeyMap[queryParam] = set.CreateStringSet(reqURL.Query().Get(queryParam))
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
// Validate action, resource and conditions with current policy statements.
|
2016-08-20 12:16:38 +02:00
|
|
|
if !bucketPolicyEvalStatements(action, resource, conditionKeyMap, policy.Statements) {
|
2016-03-10 11:24:52 +01:00
|
|
|
return ErrAccessDenied
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
}
|
2016-03-10 11:24:52 +01:00
|
|
|
return ErrNone
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
}
|
|
|
|
|
2015-12-27 08:38:38 +01:00
|
|
|
// GetBucketLocationHandler - GET Bucket location.
|
|
|
|
// -------------------------
|
|
|
|
// This operation returns bucket location.
|
2016-04-12 21:45:15 +02:00
|
|
|
func (api objectAPIHandlers) GetBucketLocationHandler(w http.ResponseWriter, r *http.Request) {
|
2016-02-16 02:42:39 +01:00
|
|
|
vars := mux.Vars(r)
|
2015-12-27 08:38:38 +01:00
|
|
|
bucket := vars["bucket"]
|
|
|
|
|
2016-08-11 03:47:49 +02:00
|
|
|
objectAPI := api.ObjectAPI()
|
|
|
|
if objectAPI == nil {
|
|
|
|
writeErrorResponse(w, r, ErrServerNotInitialized, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
switch getRequestAuthType(r) {
|
|
|
|
default:
|
|
|
|
// For all unknown auth types return error.
|
2016-03-10 11:24:52 +01:00
|
|
|
writeErrorResponse(w, r, ErrAccessDenied, r.URL.Path)
|
2016-02-16 02:42:39 +01:00
|
|
|
return
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
case authTypeAnonymous:
|
2016-04-07 03:31:40 +02:00
|
|
|
// http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
|
2016-08-11 05:10:48 +02:00
|
|
|
if s3Error := enforceBucketPolicy(bucket, "s3:GetBucketLocation", r.URL); s3Error != ErrNone {
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
2016-09-30 23:32:13 +02:00
|
|
|
case authTypePresignedV2, authTypeSignedV2:
|
|
|
|
// Signature V2 validation.
|
|
|
|
if s3Error := isReqAuthenticatedV2(r); s3Error != ErrNone {
|
|
|
|
errorIf(errSignatureMismatch, dumpRequest(r))
|
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
case authTypeSigned, authTypePresigned:
|
2016-09-30 00:51:00 +02:00
|
|
|
if s3Error := isReqAuthenticated(r, "us-east-1"); s3Error != ErrNone {
|
2016-09-19 19:17:46 +02:00
|
|
|
errorIf(errSignatureMismatch, dumpRequest(r))
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
2016-02-04 21:52:25 +01:00
|
|
|
}
|
|
|
|
|
2016-07-31 23:11:14 +02:00
|
|
|
if _, err := objectAPI.GetBucketInfo(bucket); err != nil {
|
2016-05-16 23:31:28 +02:00
|
|
|
errorIf(err, "Unable to fetch bucket info.")
|
2016-05-06 05:24:29 +02:00
|
|
|
writeErrorResponse(w, r, toAPIErrorCode(err), r.URL.Path)
|
2016-01-20 02:49:48 +01:00
|
|
|
return
|
2015-12-27 08:38:38 +01:00
|
|
|
}
|
|
|
|
|
2016-02-16 02:42:39 +01:00
|
|
|
// Generate response.
|
2016-03-06 21:16:22 +01:00
|
|
|
encodedSuccessResponse := encodeResponse(LocationResponse{})
|
config/main: Re-write config files - add to new config v3
- New config format.
```
{
"version": "3",
"address": ":9000",
"backend": {
"type": "fs",
"disk": "/path"
},
"credential": {
"accessKey": "WLGDGYAQYIGI833EV05A",
"secretKey": "BYvgJM101sHngl2uzjXS/OBF/aMxAN06JrJ3qJlF"
},
"region": "us-east-1",
"logger": {
"file": {
"enable": false,
"fileName": "",
"level": "error"
},
"syslog": {
"enable": false,
"address": "",
"level": "debug"
},
"console": {
"enable": true,
"level": "fatal"
}
}
}
```
New command lines in lieu of supporting XL.
Minio initialize filesystem backend.
~~~
$ minio init fs <path>
~~~
Minio initialize XL backend.
~~~
$ minio init xl <url1>...<url16>
~~~
For 'fs' backend it starts the server.
~~~
$ minio server
~~~
For 'xl' backend it waits for servers to join.
~~~
$ minio server
... [PROGRESS BAR] of servers connecting
~~~
Now on other servers execute 'join' and they connect.
~~~
....
minio join <url1> -- from <url2> && minio server
minio join <url1> -- from <url3> && minio server
...
...
minio join <url1> -- from <url16> && minio server
~~~
2016-02-13 00:27:10 +01:00
|
|
|
// Get current region.
|
|
|
|
region := serverConfig.GetRegion()
|
|
|
|
if region != "us-east-1" {
|
2016-03-06 21:16:22 +01:00
|
|
|
encodedSuccessResponse = encodeResponse(LocationResponse{
|
config/main: Re-write config files - add to new config v3
- New config format.
```
{
"version": "3",
"address": ":9000",
"backend": {
"type": "fs",
"disk": "/path"
},
"credential": {
"accessKey": "WLGDGYAQYIGI833EV05A",
"secretKey": "BYvgJM101sHngl2uzjXS/OBF/aMxAN06JrJ3qJlF"
},
"region": "us-east-1",
"logger": {
"file": {
"enable": false,
"fileName": "",
"level": "error"
},
"syslog": {
"enable": false,
"address": "",
"level": "debug"
},
"console": {
"enable": true,
"level": "fatal"
}
}
}
```
New command lines in lieu of supporting XL.
Minio initialize filesystem backend.
~~~
$ minio init fs <path>
~~~
Minio initialize XL backend.
~~~
$ minio init xl <url1>...<url16>
~~~
For 'fs' backend it starts the server.
~~~
$ minio server
~~~
For 'xl' backend it waits for servers to join.
~~~
$ minio server
... [PROGRESS BAR] of servers connecting
~~~
Now on other servers execute 'join' and they connect.
~~~
....
minio join <url1> -- from <url2> && minio server
minio join <url1> -- from <url3> && minio server
...
...
minio join <url1> -- from <url16> && minio server
~~~
2016-02-13 00:27:10 +01:00
|
|
|
Location: region,
|
2016-02-16 02:42:39 +01:00
|
|
|
})
|
|
|
|
}
|
2016-04-02 07:45:27 +02:00
|
|
|
setCommonHeaders(w) // Write headers.
|
2016-01-08 09:40:06 +01:00
|
|
|
writeSuccessResponse(w, encodedSuccessResponse)
|
2015-12-27 08:38:38 +01:00
|
|
|
}
|
|
|
|
|
2015-07-01 05:15:48 +02:00
|
|
|
// ListMultipartUploadsHandler - GET Bucket (List Multipart uploads)
|
2015-06-30 23:42:29 +02:00
|
|
|
// -------------------------
|
|
|
|
// This operation lists in-progress multipart uploads. An in-progress
|
|
|
|
// multipart upload is a multipart upload that has been initiated,
|
2015-10-17 04:09:35 +02:00
|
|
|
// using the Initiate Multipart Upload request, but has not yet been
|
|
|
|
// completed or aborted. This operation returns at most 1,000 multipart
|
|
|
|
// uploads in the response.
|
2015-06-30 23:42:29 +02:00
|
|
|
//
|
2016-04-12 21:45:15 +02:00
|
|
|
func (api objectAPIHandlers) ListMultipartUploadsHandler(w http.ResponseWriter, r *http.Request) {
|
2016-02-16 02:42:39 +01:00
|
|
|
vars := mux.Vars(r)
|
2015-10-17 04:09:35 +02:00
|
|
|
bucket := vars["bucket"]
|
|
|
|
|
2016-08-11 03:47:49 +02:00
|
|
|
objectAPI := api.ObjectAPI()
|
|
|
|
if objectAPI == nil {
|
|
|
|
writeErrorResponse(w, r, ErrServerNotInitialized, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
switch getRequestAuthType(r) {
|
|
|
|
default:
|
|
|
|
// For all unknown auth types return error.
|
2016-03-10 11:24:52 +01:00
|
|
|
writeErrorResponse(w, r, ErrAccessDenied, r.URL.Path)
|
2016-02-16 02:42:39 +01:00
|
|
|
return
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
case authTypeAnonymous:
|
|
|
|
// http://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html
|
2016-08-11 05:10:48 +02:00
|
|
|
if s3Error := enforceBucketPolicy(bucket, "s3:ListBucketMultipartUploads", r.URL); s3Error != ErrNone {
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
2016-09-30 23:32:13 +02:00
|
|
|
case authTypePresignedV2, authTypeSignedV2:
|
|
|
|
// Signature V2 validation.
|
|
|
|
if s3Error := isReqAuthenticatedV2(r); s3Error != ErrNone {
|
|
|
|
errorIf(errSignatureMismatch, dumpRequest(r))
|
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
case authTypePresigned, authTypeSigned:
|
2016-09-30 00:51:00 +02:00
|
|
|
if s3Error := isReqAuthenticated(r, serverConfig.GetRegion()); s3Error != ErrNone {
|
2016-09-19 19:17:46 +02:00
|
|
|
errorIf(errSignatureMismatch, dumpRequest(r))
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
2016-02-04 21:52:25 +01:00
|
|
|
}
|
|
|
|
|
objectAPI: Fix object API interface, remove unnecessary structs.
ObjectAPI changes.
```
ListObjects(bucket, prefix, marker, delimiter string, maxKeys int) (ListObjectsInfo, *probe.Error)
ListMultipartUploads(bucket, objectPrefix, keyMarker, uploadIDMarker, delimiter string, maxUploads int) (ListMultipartsInfo, *probe.Error)
ListObjectParts(bucket, object, uploadID string, partNumberMarker, maxParts int) (ListPartsInfo, *probe.Error)
CompleteMultipartUpload(bucket string, object string, uploadID string, parts []completePart) (ObjectInfo, *probe.Error)
```
2016-04-03 10:34:20 +02:00
|
|
|
prefix, keyMarker, uploadIDMarker, delimiter, maxUploads, _ := getBucketMultipartResources(r.URL.Query())
|
|
|
|
if maxUploads < 0 {
|
2016-03-10 11:24:52 +01:00
|
|
|
writeErrorResponse(w, r, ErrInvalidMaxUploads, r.URL.Path)
|
2015-07-17 02:22:45 +02:00
|
|
|
return
|
|
|
|
}
|
2016-04-05 21:26:17 +02:00
|
|
|
if keyMarker != "" {
|
2016-04-29 23:24:10 +02:00
|
|
|
// Marker not common with prefix is not implemented.
|
|
|
|
if !strings.HasPrefix(keyMarker, prefix) {
|
|
|
|
writeErrorResponse(w, r, ErrNotImplemented, r.URL.Path)
|
|
|
|
return
|
2016-04-05 21:26:17 +02:00
|
|
|
}
|
2015-06-30 23:42:29 +02:00
|
|
|
}
|
|
|
|
|
2016-07-31 23:11:14 +02:00
|
|
|
listMultipartsInfo, err := objectAPI.ListMultipartUploads(bucket, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads)
|
2015-09-19 12:20:07 +02:00
|
|
|
if err != nil {
|
2016-05-16 23:31:28 +02:00
|
|
|
errorIf(err, "Unable to list multipart uploads.")
|
2016-05-06 05:24:29 +02:00
|
|
|
writeErrorResponse(w, r, toAPIErrorCode(err), r.URL.Path)
|
2015-08-04 01:17:21 +02:00
|
|
|
return
|
|
|
|
}
|
2015-09-19 12:20:07 +02:00
|
|
|
// generate response
|
objectAPI: Fix object API interface, remove unnecessary structs.
ObjectAPI changes.
```
ListObjects(bucket, prefix, marker, delimiter string, maxKeys int) (ListObjectsInfo, *probe.Error)
ListMultipartUploads(bucket, objectPrefix, keyMarker, uploadIDMarker, delimiter string, maxUploads int) (ListMultipartsInfo, *probe.Error)
ListObjectParts(bucket, object, uploadID string, partNumberMarker, maxParts int) (ListPartsInfo, *probe.Error)
CompleteMultipartUpload(bucket string, object string, uploadID string, parts []completePart) (ObjectInfo, *probe.Error)
```
2016-04-03 10:34:20 +02:00
|
|
|
response := generateListMultipartUploadsResponse(bucket, listMultipartsInfo)
|
2016-03-06 21:16:22 +01:00
|
|
|
encodedSuccessResponse := encodeResponse(response)
|
2016-01-08 09:40:06 +01:00
|
|
|
// write headers.
|
|
|
|
setCommonHeaders(w)
|
|
|
|
// write success response.
|
|
|
|
writeSuccessResponse(w, encodedSuccessResponse)
|
2015-06-30 23:42:29 +02:00
|
|
|
}
|
|
|
|
|
2016-10-09 18:21:37 +02:00
|
|
|
// ListBucketsHandler - GET Service.
|
2015-06-30 23:42:29 +02:00
|
|
|
// -----------
|
|
|
|
// This implementation of the GET operation returns a list of all buckets
|
|
|
|
// owned by the authenticated sender of the request.
|
2016-04-12 21:45:15 +02:00
|
|
|
func (api objectAPIHandlers) ListBucketsHandler(w http.ResponseWriter, r *http.Request) {
|
2016-08-11 03:47:49 +02:00
|
|
|
objectAPI := api.ObjectAPI()
|
|
|
|
if objectAPI == nil {
|
|
|
|
writeErrorResponse(w, r, ErrServerNotInitialized, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2016-07-17 22:23:15 +02:00
|
|
|
// List buckets does not support bucket policies, no need to enforce it.
|
2016-09-30 00:51:00 +02:00
|
|
|
// Proceed to validate signature.
|
2016-09-30 23:32:13 +02:00
|
|
|
// Validates the request for both Presigned and Signed.
|
2016-09-30 00:51:00 +02:00
|
|
|
if s3Error := checkAuthWithRegion(r, ""); s3Error != ErrNone {
|
2016-09-19 19:17:46 +02:00
|
|
|
errorIf(errSignatureMismatch, dumpRequest(r))
|
2016-07-17 22:23:15 +02:00
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
2016-02-16 02:42:39 +01:00
|
|
|
return
|
2016-02-04 21:52:25 +01:00
|
|
|
}
|
|
|
|
|
2016-08-11 03:47:49 +02:00
|
|
|
// Invoke the list buckets.
|
2016-07-31 23:11:14 +02:00
|
|
|
bucketsInfo, err := objectAPI.ListBuckets()
|
2016-07-17 22:23:15 +02:00
|
|
|
if err != nil {
|
|
|
|
errorIf(err, "Unable to list buckets.")
|
|
|
|
writeErrorResponse(w, r, toAPIErrorCode(err), r.URL.Path)
|
2015-08-04 01:17:21 +02:00
|
|
|
return
|
|
|
|
}
|
2016-07-17 22:23:15 +02:00
|
|
|
|
|
|
|
// Generate response.
|
|
|
|
response := generateListBucketsResponse(bucketsInfo)
|
|
|
|
encodedSuccessResponse := encodeResponse(response)
|
|
|
|
// Write headers.
|
|
|
|
setCommonHeaders(w)
|
|
|
|
// Write response.
|
|
|
|
writeSuccessResponse(w, encodedSuccessResponse)
|
2015-06-30 23:42:29 +02:00
|
|
|
}
|
|
|
|
|
2016-03-06 01:43:48 +01:00
|
|
|
// DeleteMultipleObjectsHandler - deletes multiple objects.
|
2016-04-12 21:45:15 +02:00
|
|
|
func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter, r *http.Request) {
|
2016-03-06 01:43:48 +01:00
|
|
|
vars := mux.Vars(r)
|
|
|
|
bucket := vars["bucket"]
|
|
|
|
|
2016-08-11 03:47:49 +02:00
|
|
|
objectAPI := api.ObjectAPI()
|
|
|
|
if objectAPI == nil {
|
|
|
|
writeErrorResponse(w, r, ErrServerNotInitialized, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2016-03-13 01:08:15 +01:00
|
|
|
switch getRequestAuthType(r) {
|
|
|
|
default:
|
|
|
|
// For all unknown auth types return error.
|
|
|
|
writeErrorResponse(w, r, ErrAccessDenied, r.URL.Path)
|
|
|
|
return
|
|
|
|
case authTypeAnonymous:
|
2016-04-07 03:31:40 +02:00
|
|
|
// http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
|
2016-08-11 05:10:48 +02:00
|
|
|
if s3Error := enforceBucketPolicy(bucket, "s3:DeleteObject", r.URL); s3Error != ErrNone {
|
2016-03-13 01:08:15 +01:00
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
2016-09-30 23:32:13 +02:00
|
|
|
case authTypePresignedV2, authTypeSignedV2:
|
|
|
|
// Signature V2 validation.
|
|
|
|
if s3Error := isReqAuthenticatedV2(r); s3Error != ErrNone {
|
|
|
|
errorIf(errSignatureMismatch, dumpRequest(r))
|
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
2016-03-13 01:08:15 +01:00
|
|
|
case authTypePresigned, authTypeSigned:
|
2016-09-30 00:51:00 +02:00
|
|
|
if s3Error := isReqAuthenticated(r, serverConfig.GetRegion()); s3Error != ErrNone {
|
2016-09-19 19:17:46 +02:00
|
|
|
errorIf(errSignatureMismatch, dumpRequest(r))
|
2016-03-13 01:08:15 +01:00
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-03-06 01:43:48 +01:00
|
|
|
// Content-Length is required and should be non-zero
|
|
|
|
// http://docs.aws.amazon.com/AmazonS3/latest/API/multiobjectdeleteapi.html
|
|
|
|
if r.ContentLength <= 0 {
|
2016-03-10 11:24:52 +01:00
|
|
|
writeErrorResponse(w, r, ErrMissingContentLength, r.URL.Path)
|
2016-03-06 01:43:48 +01:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Content-Md5 is requied should be set
|
|
|
|
// http://docs.aws.amazon.com/AmazonS3/latest/API/multiobjectdeleteapi.html
|
|
|
|
if _, ok := r.Header["Content-Md5"]; !ok {
|
2016-03-10 11:24:52 +01:00
|
|
|
writeErrorResponse(w, r, ErrMissingContentMD5, r.URL.Path)
|
2016-03-06 01:43:48 +01:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Allocate incoming content length bytes.
|
|
|
|
deleteXMLBytes := make([]byte, r.ContentLength)
|
|
|
|
|
|
|
|
// Read incoming body XML bytes.
|
2016-04-29 23:24:10 +02:00
|
|
|
if _, err := io.ReadFull(r.Body, deleteXMLBytes); err != nil {
|
2016-05-16 23:31:28 +02:00
|
|
|
errorIf(err, "Unable to read HTTP body.")
|
2016-03-10 11:24:52 +01:00
|
|
|
writeErrorResponse(w, r, ErrInternalError, r.URL.Path)
|
2016-03-06 01:43:48 +01:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Unmarshal list of keys to be deleted.
|
|
|
|
deleteObjects := &DeleteObjectsRequest{}
|
2016-04-29 23:24:10 +02:00
|
|
|
if err := xml.Unmarshal(deleteXMLBytes, deleteObjects); err != nil {
|
2016-05-16 23:31:28 +02:00
|
|
|
errorIf(err, "Unable to unmarshal delete objects request XML.")
|
2016-03-10 11:24:52 +01:00
|
|
|
writeErrorResponse(w, r, ErrMalformedXML, r.URL.Path)
|
2016-03-06 01:43:48 +01:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2016-09-02 10:59:08 +02:00
|
|
|
var wg = &sync.WaitGroup{} // Allocate a new wait group.
|
|
|
|
var dErrs = make([]error, len(deleteObjects.Objects))
|
|
|
|
|
|
|
|
// Delete all requested objects in parallel.
|
|
|
|
for index, object := range deleteObjects.Objects {
|
|
|
|
wg.Add(1)
|
|
|
|
go func(i int, obj ObjectIdentifier) {
|
|
|
|
defer wg.Done()
|
2016-09-06 22:30:05 +02:00
|
|
|
dErr := objectAPI.DeleteObject(bucket, obj.ObjectName)
|
2016-09-02 10:59:08 +02:00
|
|
|
if dErr != nil {
|
|
|
|
dErrs[i] = dErr
|
|
|
|
}
|
|
|
|
}(index, object)
|
|
|
|
}
|
|
|
|
wg.Wait()
|
|
|
|
|
|
|
|
// Collect deleted objects and errors if any.
|
2016-03-06 01:43:48 +01:00
|
|
|
var deletedObjects []ObjectIdentifier
|
2016-09-02 10:59:08 +02:00
|
|
|
var deleteErrors []DeleteError
|
|
|
|
for index, err := range dErrs {
|
|
|
|
object := deleteObjects.Objects[index]
|
|
|
|
// Success deleted objects are collected separately.
|
2016-03-06 01:43:48 +01:00
|
|
|
if err == nil {
|
2016-09-02 10:59:08 +02:00
|
|
|
deletedObjects = append(deletedObjects, object)
|
|
|
|
continue
|
2016-03-06 01:43:48 +01:00
|
|
|
}
|
2016-09-10 00:32:08 +02:00
|
|
|
if _, ok := errorCause(err).(ObjectNotFound); ok {
|
2016-09-07 20:49:12 +02:00
|
|
|
// If the object is not found it should be
|
|
|
|
// accounted as deleted as per S3 spec.
|
|
|
|
deletedObjects = append(deletedObjects, object)
|
|
|
|
continue
|
|
|
|
}
|
2016-09-02 10:59:08 +02:00
|
|
|
errorIf(err, "Unable to delete object. %s", object.ObjectName)
|
|
|
|
// Error during delete should be collected separately.
|
|
|
|
deleteErrors = append(deleteErrors, DeleteError{
|
|
|
|
Code: errorCodeResponse[toAPIErrorCode(err)].Code,
|
|
|
|
Message: errorCodeResponse[toAPIErrorCode(err)].Description,
|
|
|
|
Key: object.ObjectName,
|
|
|
|
})
|
2016-03-06 01:43:48 +01:00
|
|
|
}
|
2016-09-02 10:59:08 +02:00
|
|
|
|
2016-03-06 01:43:48 +01:00
|
|
|
// Generate response
|
|
|
|
response := generateMultiDeleteResponse(deleteObjects.Quiet, deletedObjects, deleteErrors)
|
|
|
|
encodedSuccessResponse := encodeResponse(response)
|
|
|
|
// Write headers
|
|
|
|
setCommonHeaders(w)
|
|
|
|
// Write success response.
|
|
|
|
writeSuccessResponse(w, encodedSuccessResponse)
|
2016-09-02 10:59:08 +02:00
|
|
|
|
2016-09-29 07:46:19 +02:00
|
|
|
// Notify deleted event for objects.
|
|
|
|
for _, dobj := range deletedObjects {
|
|
|
|
eventNotify(eventData{
|
|
|
|
Type: ObjectRemovedDelete,
|
|
|
|
Bucket: bucket,
|
|
|
|
ObjInfo: ObjectInfo{
|
|
|
|
Name: dobj.ObjectName,
|
|
|
|
},
|
|
|
|
ReqParams: map[string]string{
|
|
|
|
"sourceIPAddress": r.RemoteAddr,
|
|
|
|
},
|
|
|
|
})
|
2016-09-02 10:59:08 +02:00
|
|
|
}
|
2016-03-06 01:43:48 +01:00
|
|
|
}
|
|
|
|
|
2015-07-01 05:15:48 +02:00
|
|
|
// PutBucketHandler - PUT Bucket
|
2015-06-30 23:42:29 +02:00
|
|
|
// ----------
|
|
|
|
// This implementation of the PUT operation creates a new bucket for authenticated request
|
2016-04-12 21:45:15 +02:00
|
|
|
func (api objectAPIHandlers) PutBucketHandler(w http.ResponseWriter, r *http.Request) {
|
2016-08-11 03:47:49 +02:00
|
|
|
objectAPI := api.ObjectAPI()
|
|
|
|
if objectAPI == nil {
|
|
|
|
writeErrorResponse(w, r, ErrServerNotInitialized, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2016-07-19 08:56:27 +02:00
|
|
|
// PutBucket does not support policies, use checkAuth to validate signature.
|
2016-09-30 00:51:00 +02:00
|
|
|
if s3Error := checkAuthWithRegion(r, "us-east-1"); s3Error != ErrNone {
|
2016-09-19 19:17:46 +02:00
|
|
|
errorIf(errSignatureMismatch, dumpRequest(r))
|
2016-07-19 08:56:27 +02:00
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
2016-02-04 21:52:25 +01:00
|
|
|
return
|
2015-07-14 18:17:30 +02:00
|
|
|
}
|
|
|
|
|
2016-07-19 08:56:27 +02:00
|
|
|
vars := mux.Vars(r)
|
|
|
|
bucket := vars["bucket"]
|
|
|
|
|
2016-07-19 06:20:17 +02:00
|
|
|
// Validate if incoming location constraint is valid, reject
|
|
|
|
// requests which do not follow valid region requirements.
|
2016-07-19 08:56:27 +02:00
|
|
|
if s3Error := isValidLocationConstraint(r); s3Error != ErrNone {
|
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
2016-08-26 05:00:47 +02:00
|
|
|
return
|
2016-04-21 02:35:38 +02:00
|
|
|
}
|
2016-07-24 07:51:12 +02:00
|
|
|
|
|
|
|
// Proceed to creating a bucket.
|
2016-07-31 23:11:14 +02:00
|
|
|
err := objectAPI.MakeBucket(bucket)
|
2015-09-19 12:20:07 +02:00
|
|
|
if err != nil {
|
2016-05-16 23:31:28 +02:00
|
|
|
errorIf(err, "Unable to create a bucket.")
|
2016-05-06 05:24:29 +02:00
|
|
|
writeErrorResponse(w, r, toAPIErrorCode(err), r.URL.Path)
|
2015-08-04 01:17:21 +02:00
|
|
|
return
|
|
|
|
}
|
2015-09-19 12:20:07 +02:00
|
|
|
// Make sure to add Location information here only for bucket
|
2016-03-02 05:01:40 +01:00
|
|
|
w.Header().Set("Location", getLocation(r))
|
2016-01-08 09:40:06 +01:00
|
|
|
writeSuccessResponse(w, nil)
|
2015-06-30 23:42:29 +02:00
|
|
|
}
|
|
|
|
|
2015-10-02 08:51:17 +02:00
|
|
|
// PostPolicyBucketHandler - POST policy
|
|
|
|
// ----------
|
|
|
|
// This implementation of the POST operation handles object creation with a specified
|
|
|
|
// signature policy in multipart/form-data
|
2016-04-12 21:45:15 +02:00
|
|
|
func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *http.Request) {
|
2016-08-11 03:47:49 +02:00
|
|
|
objectAPI := api.ObjectAPI()
|
|
|
|
if objectAPI == nil {
|
|
|
|
writeErrorResponse(w, r, ErrServerNotInitialized, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2015-10-02 08:51:17 +02:00
|
|
|
// Here the parameter is the size of the form data that should
|
2016-03-23 01:54:31 +01:00
|
|
|
// be loaded in memory, the remaining being put in temporary files.
|
2016-04-29 23:24:10 +02:00
|
|
|
reader, err := r.MultipartReader()
|
|
|
|
if err != nil {
|
2016-05-16 23:31:28 +02:00
|
|
|
errorIf(err, "Unable to initialize multipart reader.")
|
2016-03-10 11:24:52 +01:00
|
|
|
writeErrorResponse(w, r, ErrMalformedPOSTRequest, r.URL.Path)
|
2015-10-02 08:51:17 +02:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2016-07-28 21:02:22 +02:00
|
|
|
fileBody, fileName, formValues, err := extractPostPolicyFormValues(reader)
|
2016-02-04 21:52:25 +01:00
|
|
|
if err != nil {
|
2016-05-16 23:31:28 +02:00
|
|
|
errorIf(err, "Unable to parse form values.")
|
2016-03-10 11:24:52 +01:00
|
|
|
writeErrorResponse(w, r, ErrMalformedPOSTRequest, r.URL.Path)
|
2015-10-02 08:51:17 +02:00
|
|
|
return
|
|
|
|
}
|
2016-02-16 02:42:39 +01:00
|
|
|
bucket := mux.Vars(r)["bucket"]
|
2015-10-02 08:51:17 +02:00
|
|
|
formValues["Bucket"] = bucket
|
2015-10-06 19:12:06 +02:00
|
|
|
object := formValues["Key"]
|
2016-02-16 02:42:39 +01:00
|
|
|
|
2016-07-28 02:51:55 +02:00
|
|
|
if fileName != "" && strings.Contains(object, "${filename}") {
|
|
|
|
// S3 feature to replace ${filename} found in Key form field
|
|
|
|
// by the filename attribute passed in multipart
|
|
|
|
object = strings.Replace(object, "${filename}", fileName, -1)
|
|
|
|
}
|
|
|
|
|
2016-02-16 02:42:39 +01:00
|
|
|
// Verify policy signature.
|
2016-03-31 05:04:51 +02:00
|
|
|
apiErr := doesPolicySignatureMatch(formValues)
|
|
|
|
if apiErr != ErrNone {
|
|
|
|
writeErrorResponse(w, r, apiErr, r.URL.Path)
|
2015-10-02 08:51:17 +02:00
|
|
|
return
|
|
|
|
}
|
2016-03-31 05:04:51 +02:00
|
|
|
if apiErr = checkPostPolicy(formValues); apiErr != ErrNone {
|
|
|
|
writeErrorResponse(w, r, apiErr, r.URL.Path)
|
2015-10-06 19:12:06 +02:00
|
|
|
return
|
|
|
|
}
|
2016-05-20 02:10:08 +02:00
|
|
|
|
|
|
|
// Save metadata.
|
|
|
|
metadata := make(map[string]string)
|
|
|
|
// Nothing to store right now.
|
|
|
|
|
2016-10-03 00:51:49 +02:00
|
|
|
sha256sum := ""
|
|
|
|
|
|
|
|
objInfo, err := objectAPI.PutObject(bucket, object, -1, fileBody, metadata, sha256sum)
|
2016-02-04 21:52:25 +01:00
|
|
|
if err != nil {
|
2016-05-16 23:31:28 +02:00
|
|
|
errorIf(err, "Unable to create object.")
|
2016-05-06 05:24:29 +02:00
|
|
|
writeErrorResponse(w, r, toAPIErrorCode(err), r.URL.Path)
|
2015-10-02 08:51:17 +02:00
|
|
|
return
|
|
|
|
}
|
2016-09-02 21:18:35 +02:00
|
|
|
w.Header().Set("ETag", "\""+objInfo.MD5Sum+"\"")
|
2016-09-06 11:18:02 +02:00
|
|
|
w.Header().Set("Location", getObjectLocation(bucket, object))
|
2016-08-05 07:01:58 +02:00
|
|
|
|
2016-08-30 12:42:37 +02:00
|
|
|
// Set common headers.
|
2016-05-05 00:24:10 +02:00
|
|
|
setCommonHeaders(w)
|
2016-07-24 07:51:12 +02:00
|
|
|
|
2016-08-30 12:42:37 +02:00
|
|
|
// Write successful response.
|
2016-09-06 11:18:02 +02:00
|
|
|
writeSuccessNoContent(w)
|
2016-07-24 07:51:12 +02:00
|
|
|
|
2016-09-29 07:46:19 +02:00
|
|
|
// Notify object created event.
|
|
|
|
eventNotify(eventData{
|
|
|
|
Type: ObjectCreatedPost,
|
|
|
|
Bucket: bucket,
|
|
|
|
ObjInfo: objInfo,
|
|
|
|
ReqParams: map[string]string{
|
|
|
|
"sourceIPAddress": r.RemoteAddr,
|
|
|
|
},
|
|
|
|
})
|
2015-10-02 08:51:17 +02:00
|
|
|
}
|
|
|
|
|
2015-07-01 05:15:48 +02:00
|
|
|
// HeadBucketHandler - HEAD Bucket
|
2015-06-30 23:42:29 +02:00
|
|
|
// ----------
|
|
|
|
// This operation is useful to determine if a bucket exists.
|
|
|
|
// The operation returns a 200 OK if the bucket exists and you
|
|
|
|
// have permission to access it. Otherwise, the operation might
|
|
|
|
// return responses such as 404 Not Found and 403 Forbidden.
|
2016-04-12 21:45:15 +02:00
|
|
|
func (api objectAPIHandlers) HeadBucketHandler(w http.ResponseWriter, r *http.Request) {
|
2016-02-16 02:42:39 +01:00
|
|
|
vars := mux.Vars(r)
|
2015-06-30 23:42:29 +02:00
|
|
|
bucket := vars["bucket"]
|
2015-07-03 05:31:22 +02:00
|
|
|
|
2016-08-11 03:47:49 +02:00
|
|
|
objectAPI := api.ObjectAPI()
|
|
|
|
if objectAPI == nil {
|
|
|
|
writeErrorResponse(w, r, ErrServerNotInitialized, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
switch getRequestAuthType(r) {
|
|
|
|
default:
|
|
|
|
// For all unknown auth types return error.
|
2016-03-10 11:24:52 +01:00
|
|
|
writeErrorResponse(w, r, ErrAccessDenied, r.URL.Path)
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
return
|
2016-04-07 01:40:54 +02:00
|
|
|
case authTypeAnonymous:
|
|
|
|
// http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
|
2016-08-11 05:10:48 +02:00
|
|
|
if s3Error := enforceBucketPolicy(bucket, "s3:ListBucket", r.URL); s3Error != ErrNone {
|
2016-04-07 01:40:54 +02:00
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
2016-09-30 23:32:13 +02:00
|
|
|
case authTypePresignedV2, authTypeSignedV2:
|
|
|
|
// Signature V2 validation.
|
|
|
|
if s3Error := isReqAuthenticatedV2(r); s3Error != ErrNone {
|
|
|
|
errorIf(errSignatureMismatch, dumpRequest(r))
|
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
case authTypePresigned, authTypeSigned:
|
2016-09-30 00:51:00 +02:00
|
|
|
if s3Error := isReqAuthenticated(r, serverConfig.GetRegion()); s3Error != ErrNone {
|
2016-09-19 19:17:46 +02:00
|
|
|
errorIf(errSignatureMismatch, dumpRequest(r))
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
2016-02-04 21:52:25 +01:00
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-07-31 23:11:14 +02:00
|
|
|
if _, err := objectAPI.GetBucketInfo(bucket); err != nil {
|
2016-05-16 23:31:28 +02:00
|
|
|
errorIf(err, "Unable to fetch bucket info.")
|
2016-05-06 05:24:29 +02:00
|
|
|
writeErrorResponse(w, r, toAPIErrorCode(err), r.URL.Path)
|
2015-08-04 01:17:21 +02:00
|
|
|
return
|
|
|
|
}
|
2016-01-08 09:40:06 +01:00
|
|
|
writeSuccessResponse(w, nil)
|
2015-06-30 23:42:29 +02:00
|
|
|
}
|
2015-10-16 20:26:01 +02:00
|
|
|
|
|
|
|
// DeleteBucketHandler - Delete bucket
|
2016-04-12 21:45:15 +02:00
|
|
|
func (api objectAPIHandlers) DeleteBucketHandler(w http.ResponseWriter, r *http.Request) {
|
2016-08-11 03:47:49 +02:00
|
|
|
objectAPI := api.ObjectAPI()
|
|
|
|
if objectAPI == nil {
|
|
|
|
writeErrorResponse(w, r, ErrServerNotInitialized, r.URL.Path)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2016-07-19 08:56:27 +02:00
|
|
|
// DeleteBucket does not support bucket policies, use checkAuth to validate signature.
|
|
|
|
if s3Error := checkAuth(r); s3Error != ErrNone {
|
2016-09-19 19:17:46 +02:00
|
|
|
errorIf(errSignatureMismatch, dumpRequest(r))
|
2016-07-19 08:56:27 +02:00
|
|
|
writeErrorResponse(w, r, s3Error, r.URL.Path)
|
2016-02-16 02:42:39 +01:00
|
|
|
return
|
2016-02-04 21:52:25 +01:00
|
|
|
}
|
|
|
|
|
2016-07-19 08:56:27 +02:00
|
|
|
vars := mux.Vars(r)
|
|
|
|
bucket := vars["bucket"]
|
|
|
|
|
2016-07-24 07:51:12 +02:00
|
|
|
// Attempt to delete bucket.
|
2016-07-31 23:11:14 +02:00
|
|
|
if err := objectAPI.DeleteBucket(bucket); err != nil {
|
2016-05-16 23:31:28 +02:00
|
|
|
errorIf(err, "Unable to delete a bucket.")
|
2016-05-06 05:24:29 +02:00
|
|
|
writeErrorResponse(w, r, toAPIErrorCode(err), r.URL.Path)
|
2015-10-16 20:26:01 +02:00
|
|
|
return
|
|
|
|
}
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
|
|
|
|
// Delete bucket access policy, if present - ignore any errors.
|
2016-08-11 03:47:49 +02:00
|
|
|
removeBucketPolicy(bucket, objectAPI)
|
2016-08-09 20:33:45 +02:00
|
|
|
|
|
|
|
// Delete notification config, if present - ignore any errors.
|
2016-08-11 03:47:49 +02:00
|
|
|
removeNotificationConfig(bucket, objectAPI)
|
accessPolicy: Implement Put, Get, Delete access policy.
This patch implements Get,Put,Delete bucket policies
Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
Currently supports following actions.
"*": true,
"s3:*": true,
"s3:GetObject": true,
"s3:ListBucket": true,
"s3:PutObject": true,
"s3:CreateBucket": true,
"s3:GetBucketLocation": true,
"s3:DeleteBucket": true,
"s3:DeleteObject": true,
"s3:AbortMultipartUpload": true,
"s3:ListBucketMultipartUploads": true,
"s3:ListMultipartUploadParts": true,
following conditions for "StringEquals" and "StringNotEquals"
"s3:prefix", "s3:max-keys"
2016-02-04 01:46:56 +01:00
|
|
|
|
|
|
|
// Write success response.
|
2015-10-17 05:02:37 +02:00
|
|
|
writeSuccessNoContent(w)
|
2015-10-16 20:26:01 +02:00
|
|
|
}
|