2018-04-25 00:53:30 +02:00
|
|
|
/*
|
2019-04-09 20:39:42 +02:00
|
|
|
* MinIO Cloud Storage, (C) 2018 MinIO, Inc.
|
2018-04-25 00:53:30 +02:00
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
|
|
|
package cmd
|
|
|
|
|
|
|
|
import (
|
2018-10-09 23:00:01 +02:00
|
|
|
"bytes"
|
2018-04-25 00:53:30 +02:00
|
|
|
"context"
|
|
|
|
"encoding/json"
|
|
|
|
"net/http"
|
2020-04-01 09:04:25 +02:00
|
|
|
"net/url"
|
2018-04-25 00:53:30 +02:00
|
|
|
"path"
|
2020-04-06 22:44:16 +02:00
|
|
|
"strconv"
|
2020-04-01 09:04:25 +02:00
|
|
|
"strings"
|
2018-04-25 00:53:30 +02:00
|
|
|
"sync"
|
2020-04-01 09:04:25 +02:00
|
|
|
"time"
|
2018-04-25 00:53:30 +02:00
|
|
|
|
2020-01-08 12:31:43 +01:00
|
|
|
jsoniter "github.com/json-iterator/go"
|
2019-05-30 01:35:12 +02:00
|
|
|
miniogopolicy "github.com/minio/minio-go/v6/pkg/policy"
|
2020-04-01 09:04:25 +02:00
|
|
|
xhttp "github.com/minio/minio/cmd/http"
|
2018-04-28 00:02:54 +02:00
|
|
|
"github.com/minio/minio/cmd/logger"
|
2020-01-27 23:12:34 +01:00
|
|
|
"github.com/minio/minio/pkg/bucket/policy"
|
2018-04-25 00:53:30 +02:00
|
|
|
"github.com/minio/minio/pkg/handlers"
|
|
|
|
)
|
|
|
|
|
2018-06-06 21:52:56 +02:00
|
|
|
// PolicySys - policy subsystem.
|
2018-04-25 00:53:30 +02:00
|
|
|
type PolicySys struct {
|
|
|
|
sync.RWMutex
|
2020-05-04 18:42:58 +02:00
|
|
|
bucketPolicyMap map[string]*policy.Policy
|
2018-04-25 00:53:30 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// Set - sets policy to given bucket name. If policy is empty, existing policy is removed.
|
2020-05-04 18:42:58 +02:00
|
|
|
func (sys *PolicySys) Set(bucketName string, policy *policy.Policy) {
|
2019-06-03 20:06:13 +02:00
|
|
|
if globalIsGateway {
|
|
|
|
// Set policy is a non-op under gateway mode.
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2018-04-25 00:53:30 +02:00
|
|
|
sys.Lock()
|
|
|
|
defer sys.Unlock()
|
|
|
|
|
|
|
|
if policy.IsEmpty() {
|
|
|
|
delete(sys.bucketPolicyMap, bucketName)
|
|
|
|
} else {
|
|
|
|
sys.bucketPolicyMap[bucketName] = policy
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Remove - removes policy for given bucket name.
|
|
|
|
func (sys *PolicySys) Remove(bucketName string) {
|
|
|
|
sys.Lock()
|
|
|
|
defer sys.Unlock()
|
|
|
|
|
|
|
|
delete(sys.bucketPolicyMap, bucketName)
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsAllowed - checks given policy args is allowed to continue the Rest API.
|
|
|
|
func (sys *PolicySys) IsAllowed(args policy.Args) bool {
|
2019-06-03 20:06:13 +02:00
|
|
|
if globalIsGateway {
|
|
|
|
// When gateway is enabled, no cached value
|
|
|
|
// is used to validate bucket policies.
|
2019-11-09 18:27:23 +01:00
|
|
|
objAPI := newObjectLayerFn()
|
2019-06-03 20:06:13 +02:00
|
|
|
if objAPI != nil {
|
2020-04-09 18:30:02 +02:00
|
|
|
config, err := objAPI.GetBucketPolicy(GlobalContext, args.BucketName)
|
2019-06-03 20:06:13 +02:00
|
|
|
if err == nil {
|
|
|
|
return config.IsAllowed(args)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
2019-06-15 19:11:10 +02:00
|
|
|
sys.RLock()
|
|
|
|
defer sys.RUnlock()
|
|
|
|
|
2019-06-03 20:06:13 +02:00
|
|
|
// If policy is available for given bucket, check the policy.
|
|
|
|
if p, found := sys.bucketPolicyMap[args.BucketName]; found {
|
|
|
|
return p.IsAllowed(args)
|
|
|
|
}
|
2018-04-25 00:53:30 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// As policy is not available for given bucket name, returns IsOwner i.e.
|
|
|
|
// operation is allowed only for owner.
|
|
|
|
return args.IsOwner
|
|
|
|
}
|
|
|
|
|
2019-10-02 02:05:02 +02:00
|
|
|
// Loads policies for all buckets into PolicySys.
|
|
|
|
func (sys *PolicySys) load(buckets []BucketInfo, objAPI ObjectLayer) error {
|
2018-04-25 00:53:30 +02:00
|
|
|
for _, bucket := range buckets {
|
2020-05-04 18:42:58 +02:00
|
|
|
config, err := getPolicyConfig(objAPI, bucket.Name)
|
2018-04-25 00:53:30 +02:00
|
|
|
if err != nil {
|
2018-06-06 21:52:56 +02:00
|
|
|
if _, ok := err.(BucketPolicyNotFound); ok {
|
2020-05-04 18:42:58 +02:00
|
|
|
continue
|
2018-04-25 00:53:30 +02:00
|
|
|
}
|
2020-05-04 18:42:58 +02:00
|
|
|
return err
|
2018-06-06 21:52:56 +02:00
|
|
|
}
|
|
|
|
// This part is specifically written to handle migration
|
|
|
|
// when the Version string is empty, this was allowed
|
|
|
|
// in all previous minio releases but we need to migrate
|
|
|
|
// those policies by properly setting the Version string
|
|
|
|
// from now on.
|
|
|
|
if config.Version == "" {
|
|
|
|
logger.Info("Found in-consistent bucket policies, Migrating them for Bucket: (%s)", bucket.Name)
|
|
|
|
config.Version = policy.DefaultVersion
|
|
|
|
|
2020-04-09 18:30:02 +02:00
|
|
|
if err = savePolicyConfig(GlobalContext, objAPI, bucket.Name, config); err != nil {
|
|
|
|
logger.LogIf(GlobalContext, err)
|
2018-06-06 21:52:56 +02:00
|
|
|
return err
|
2018-04-28 00:02:54 +02:00
|
|
|
}
|
2018-04-25 00:53:30 +02:00
|
|
|
}
|
2020-05-04 18:42:58 +02:00
|
|
|
sys.Set(bucket.Name, config)
|
2018-06-06 21:52:56 +02:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Init - initializes policy system from policy.json of all buckets.
|
2019-10-02 02:05:02 +02:00
|
|
|
func (sys *PolicySys) Init(buckets []BucketInfo, objAPI ObjectLayer) error {
|
2018-06-06 21:52:56 +02:00
|
|
|
if objAPI == nil {
|
2020-05-04 18:42:58 +02:00
|
|
|
return errServerNotInitialized
|
2018-06-06 21:52:56 +02:00
|
|
|
}
|
|
|
|
|
2019-06-03 20:06:13 +02:00
|
|
|
// In gateway mode, we don't need to load the policies
|
|
|
|
// from the backend.
|
|
|
|
if globalIsGateway {
|
|
|
|
return nil
|
|
|
|
}
|
2018-04-25 00:53:30 +02:00
|
|
|
|
2020-02-02 02:07:43 +01:00
|
|
|
// Load PolicySys once during boot.
|
|
|
|
return sys.load(buckets, objAPI)
|
2018-04-25 00:53:30 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// NewPolicySys - creates new policy system.
|
|
|
|
func NewPolicySys() *PolicySys {
|
|
|
|
return &PolicySys{
|
2020-05-04 18:42:58 +02:00
|
|
|
bucketPolicyMap: make(map[string]*policy.Policy),
|
2018-04-25 00:53:30 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-04-06 22:44:16 +02:00
|
|
|
func getConditionValues(r *http.Request, lc string, username string, claims map[string]interface{}) map[string][]string {
|
2019-01-21 05:57:14 +01:00
|
|
|
currTime := UTCNow()
|
2020-04-01 09:04:25 +02:00
|
|
|
|
|
|
|
principalType := "Anonymous"
|
|
|
|
if username != "" {
|
|
|
|
principalType = "User"
|
|
|
|
}
|
|
|
|
|
2018-12-27 02:39:30 +01:00
|
|
|
args := map[string][]string{
|
2020-04-01 09:04:25 +02:00
|
|
|
"CurrentTime": {currTime.Format(time.RFC3339)},
|
2020-04-06 22:44:16 +02:00
|
|
|
"EpochTime": {strconv.FormatInt(currTime.Unix(), 10)},
|
|
|
|
"SecureTransport": {strconv.FormatBool(r.TLS != nil)},
|
|
|
|
"SourceIp": {handlers.GetSourceIP(r)},
|
|
|
|
"UserAgent": {r.UserAgent()},
|
|
|
|
"Referer": {r.Referer()},
|
2019-01-21 05:57:14 +01:00
|
|
|
"principaltype": {principalType},
|
|
|
|
"userid": {username},
|
|
|
|
"username": {username},
|
2018-12-27 02:39:30 +01:00
|
|
|
}
|
2018-04-25 00:53:30 +02:00
|
|
|
|
2020-04-06 22:44:16 +02:00
|
|
|
if lc != "" {
|
|
|
|
args["LocationConstraint"] = []string{lc}
|
2020-04-01 09:04:25 +02:00
|
|
|
}
|
|
|
|
|
2020-04-06 22:44:16 +02:00
|
|
|
cloneHeader := r.Header.Clone()
|
2020-04-01 09:04:25 +02:00
|
|
|
|
|
|
|
for _, objLock := range []string{
|
|
|
|
xhttp.AmzObjectLockMode,
|
|
|
|
xhttp.AmzObjectLockLegalHold,
|
|
|
|
xhttp.AmzObjectLockRetainUntilDate,
|
|
|
|
} {
|
|
|
|
if values, ok := cloneHeader[objLock]; ok {
|
|
|
|
args[strings.TrimPrefix(objLock, "X-Amz-")] = values
|
|
|
|
}
|
|
|
|
cloneHeader.Del(objLock)
|
|
|
|
}
|
|
|
|
|
|
|
|
for key, values := range cloneHeader {
|
2018-04-25 00:53:30 +02:00
|
|
|
if existingValues, found := args[key]; found {
|
|
|
|
args[key] = append(existingValues, values...)
|
|
|
|
} else {
|
|
|
|
args[key] = values
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-04-01 09:04:25 +02:00
|
|
|
var cloneURLValues = url.Values{}
|
2020-04-06 22:44:16 +02:00
|
|
|
for k, v := range r.URL.Query() {
|
2020-04-01 09:04:25 +02:00
|
|
|
cloneURLValues[k] = v
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, objLock := range []string{
|
|
|
|
xhttp.AmzObjectLockMode,
|
|
|
|
xhttp.AmzObjectLockLegalHold,
|
|
|
|
xhttp.AmzObjectLockRetainUntilDate,
|
|
|
|
} {
|
|
|
|
if values, ok := cloneURLValues[objLock]; ok {
|
|
|
|
args[strings.TrimPrefix(objLock, "X-Amz-")] = values
|
|
|
|
}
|
|
|
|
cloneURLValues.Del(objLock)
|
|
|
|
}
|
|
|
|
|
|
|
|
for key, values := range cloneURLValues {
|
2018-04-25 00:53:30 +02:00
|
|
|
if existingValues, found := args[key]; found {
|
|
|
|
args[key] = append(existingValues, values...)
|
|
|
|
} else {
|
|
|
|
args[key] = values
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-10-16 17:59:59 +02:00
|
|
|
// JWT specific values
|
|
|
|
for k, v := range claims {
|
|
|
|
vStr, ok := v.(string)
|
|
|
|
if ok {
|
|
|
|
args[k] = []string{vStr}
|
|
|
|
}
|
|
|
|
}
|
2020-04-01 09:04:25 +02:00
|
|
|
|
2018-04-25 00:53:30 +02:00
|
|
|
return args
|
|
|
|
}
|
|
|
|
|
2018-06-27 08:59:48 +02:00
|
|
|
// getPolicyConfig - get policy config for given bucket name.
|
|
|
|
func getPolicyConfig(objAPI ObjectLayer, bucketName string) (*policy.Policy, error) {
|
2018-04-25 00:53:30 +02:00
|
|
|
// Construct path to policy.json for the given bucket.
|
|
|
|
configFile := path.Join(bucketConfigPrefix, bucketName, bucketPolicyConfig)
|
|
|
|
|
2020-04-09 18:30:02 +02:00
|
|
|
configData, err := readConfig(GlobalContext, objAPI, configFile)
|
2018-04-25 00:53:30 +02:00
|
|
|
if err != nil {
|
|
|
|
if err == errConfigNotFound {
|
|
|
|
err = BucketPolicyNotFound{Bucket: bucketName}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2018-10-09 23:00:01 +02:00
|
|
|
return policy.ParseConfig(bytes.NewReader(configData), bucketName)
|
2018-04-25 00:53:30 +02:00
|
|
|
}
|
|
|
|
|
2018-10-09 23:00:01 +02:00
|
|
|
func savePolicyConfig(ctx context.Context, objAPI ObjectLayer, bucketName string, bucketPolicy *policy.Policy) error {
|
2018-04-25 00:53:30 +02:00
|
|
|
data, err := json.Marshal(bucketPolicy)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Construct path to policy.json for the given bucket.
|
|
|
|
configFile := path.Join(bucketConfigPrefix, bucketName, bucketPolicyConfig)
|
|
|
|
|
2018-10-09 23:00:01 +02:00
|
|
|
return saveConfig(ctx, objAPI, configFile, data)
|
2018-04-25 00:53:30 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
func removePolicyConfig(ctx context.Context, objAPI ObjectLayer, bucketName string) error {
|
|
|
|
// Construct path to policy.json for the given bucket.
|
|
|
|
configFile := path.Join(bucketConfigPrefix, bucketName, bucketPolicyConfig)
|
|
|
|
|
|
|
|
if err := objAPI.DeleteObject(ctx, minioMetaBucket, configFile); err != nil {
|
|
|
|
if _, ok := err.(ObjectNotFound); ok {
|
|
|
|
return BucketPolicyNotFound{Bucket: bucketName}
|
|
|
|
}
|
|
|
|
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// PolicyToBucketAccessPolicy - converts policy.Policy to minio-go/policy.BucketAccessPolicy.
|
|
|
|
func PolicyToBucketAccessPolicy(bucketPolicy *policy.Policy) (*miniogopolicy.BucketAccessPolicy, error) {
|
|
|
|
// Return empty BucketAccessPolicy for empty bucket policy.
|
|
|
|
if bucketPolicy == nil {
|
|
|
|
return &miniogopolicy.BucketAccessPolicy{Version: policy.DefaultVersion}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
data, err := json.Marshal(bucketPolicy)
|
|
|
|
if err != nil {
|
|
|
|
// This should not happen because bucketPolicy is valid to convert to JSON data.
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
var policyInfo miniogopolicy.BucketAccessPolicy
|
2020-01-08 12:31:43 +01:00
|
|
|
var json = jsoniter.ConfigCompatibleWithStandardLibrary
|
2018-04-25 00:53:30 +02:00
|
|
|
if err = json.Unmarshal(data, &policyInfo); err != nil {
|
|
|
|
// This should not happen because data is valid to JSON data.
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return &policyInfo, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// BucketAccessPolicyToPolicy - converts minio-go/policy.BucketAccessPolicy to policy.Policy.
|
|
|
|
func BucketAccessPolicyToPolicy(policyInfo *miniogopolicy.BucketAccessPolicy) (*policy.Policy, error) {
|
|
|
|
data, err := json.Marshal(policyInfo)
|
|
|
|
if err != nil {
|
|
|
|
// This should not happen because policyInfo is valid to convert to JSON data.
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
var bucketPolicy policy.Policy
|
2020-01-08 12:31:43 +01:00
|
|
|
var json = jsoniter.ConfigCompatibleWithStandardLibrary
|
2018-04-25 00:53:30 +02:00
|
|
|
if err = json.Unmarshal(data, &bucketPolicy); err != nil {
|
|
|
|
// This should not happen because data is valid to JSON data.
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return &bucketPolicy, nil
|
|
|
|
}
|