ceph/src/rgw/rgw_iam_policy.h

   1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
   2 // vim: ts=8 sw=2 smarttab ft=cpp
   3
   4 #ifndef CEPH_RGW_IAM_POLICY_H
   5 #define CEPH_RGW_IAM_POLICY_H
   6
   7 #include <bitset>
   8 #include <chrono>
   9 #include <cstdint>
  10 #include <iostream>
  11 #include <string>
  12
  13 #include <boost/algorithm/string/predicate.hpp>
  14 #include <boost/container/flat_map.hpp>
  15 #include <boost/container/flat_set.hpp>
  16 #include <boost/optional.hpp>
  17 #include <boost/thread/shared_mutex.hpp>
  18 #include <boost/utility/string_ref.hpp>
  19 #include <boost/variant.hpp>
  20
  21 #include "common/ceph_time.h"
  22 #include "common/iso_8601.h"
  23
  24 #include "rapidjson/error/error.h"
  25 #include "rapidjson/error/en.h"
  26
  27 #include "rgw_acl.h"
  28 #include "rgw_basic_types.h"
  29 #include "rgw_iam_policy_keywords.h"
  30 #include "rgw_string.h"
  31 #include "rgw_arn.h"
  32
  33 namespace rgw {
  34 namespace auth {
  35 class Identity;
  36 }
  37 }
  38
  39 namespace rgw {
  40 namespace IAM {
  41
  42 static constexpr std::uint64_t s3GetObject = 0;
  43 static constexpr std::uint64_t s3GetObjectVersion = 1;
  44 static constexpr std::uint64_t s3PutObject = 2;
  45 static constexpr std::uint64_t s3GetObjectAcl = 3;
  46 static constexpr std::uint64_t s3GetObjectVersionAcl = 4;
  47 static constexpr std::uint64_t s3PutObjectAcl = 5;
  48 static constexpr std::uint64_t s3PutObjectVersionAcl = 6;
  49 static constexpr std::uint64_t s3DeleteObject = 7;
  50 static constexpr std::uint64_t s3DeleteObjectVersion = 8;
  51 static constexpr std::uint64_t s3ListMultipartUploadParts = 9;
  52 static constexpr std::uint64_t s3AbortMultipartUpload = 10;
  53 static constexpr std::uint64_t s3GetObjectTorrent = 11;
  54 static constexpr std::uint64_t s3GetObjectVersionTorrent = 12;
  55 static constexpr std::uint64_t s3RestoreObject = 13;
  56 static constexpr std::uint64_t s3CreateBucket = 14;
  57 static constexpr std::uint64_t s3DeleteBucket = 15;
  58 static constexpr std::uint64_t s3ListBucket = 16;
  59 static constexpr std::uint64_t s3ListBucketVersions = 17;
  60 static constexpr std::uint64_t s3ListAllMyBuckets = 18;
  61 static constexpr std::uint64_t s3ListBucketMultipartUploads = 19;
  62 static constexpr std::uint64_t s3GetAccelerateConfiguration = 20;
  63 static constexpr std::uint64_t s3PutAccelerateConfiguration = 21;
  64 static constexpr std::uint64_t s3GetBucketAcl = 22;
  65 static constexpr std::uint64_t s3PutBucketAcl = 23;
  66 static constexpr std::uint64_t s3GetBucketCORS = 24;
  67 static constexpr std::uint64_t s3PutBucketCORS = 25;
  68 static constexpr std::uint64_t s3GetBucketVersioning = 26;
  69 static constexpr std::uint64_t s3PutBucketVersioning = 27;
  70 static constexpr std::uint64_t s3GetBucketRequestPayment = 28;
  71 static constexpr std::uint64_t s3PutBucketRequestPayment = 29;
  72 static constexpr std::uint64_t s3GetBucketLocation = 30;
  73 static constexpr std::uint64_t s3GetBucketPolicy = 31;
  74 static constexpr std::uint64_t s3DeleteBucketPolicy = 32;
  75 static constexpr std::uint64_t s3PutBucketPolicy = 33;
  76 static constexpr std::uint64_t s3GetBucketNotification = 34;
  77 static constexpr std::uint64_t s3PutBucketNotification = 35;
  78 static constexpr std::uint64_t s3GetBucketLogging = 36;
  79 static constexpr std::uint64_t s3PutBucketLogging = 37;
  80 static constexpr std::uint64_t s3GetBucketTagging = 38;
  81 static constexpr std::uint64_t s3PutBucketTagging = 39;
  82 static constexpr std::uint64_t s3GetBucketWebsite = 40;
  83 static constexpr std::uint64_t s3PutBucketWebsite = 41;
  84 static constexpr std::uint64_t s3DeleteBucketWebsite = 42;
  85 static constexpr std::uint64_t s3GetLifecycleConfiguration = 43;
  86 static constexpr std::uint64_t s3PutLifecycleConfiguration = 44;
  87 static constexpr std::uint64_t s3PutReplicationConfiguration = 45;
  88 static constexpr std::uint64_t s3GetReplicationConfiguration = 46;
  89 static constexpr std::uint64_t s3DeleteReplicationConfiguration = 47;
  90 static constexpr std::uint64_t s3GetObjectTagging = 48;
  91 static constexpr std::uint64_t s3PutObjectTagging = 49;
  92 static constexpr std::uint64_t s3DeleteObjectTagging = 50;
  93 static constexpr std::uint64_t s3GetObjectVersionTagging = 51;
  94 static constexpr std::uint64_t s3PutObjectVersionTagging = 52;
  95 static constexpr std::uint64_t s3DeleteObjectVersionTagging = 53;
  96 static constexpr std::uint64_t s3PutBucketObjectLockConfiguration = 54;
  97 static constexpr std::uint64_t s3GetBucketObjectLockConfiguration = 55;
  98 static constexpr std::uint64_t s3PutObjectRetention = 56;
  99 static constexpr std::uint64_t s3GetObjectRetention = 57;
 100 static constexpr std::uint64_t s3PutObjectLegalHold = 58;
 101 static constexpr std::uint64_t s3GetObjectLegalHold = 59;
 102 static constexpr std::uint64_t s3BypassGovernanceRetention = 60;
 103 static constexpr std::uint64_t s3GetBucketPolicyStatus = 61;
 104 static constexpr std::uint64_t s3PutPublicAccessBlock = 62;
 105 static constexpr std::uint64_t s3GetPublicAccessBlock = 63;
 106 static constexpr std::uint64_t s3DeletePublicAccessBlock = 64;
 107 static constexpr std::uint64_t s3GetBucketPublicAccessBlock = 65;
 108 static constexpr std::uint64_t s3PutBucketPublicAccessBlock = 66;
 109 static constexpr std::uint64_t s3DeleteBucketPublicAccessBlock = 67;
 110 static constexpr std::uint64_t s3All = 68;
 111
 112 static constexpr std::uint64_t iamPutUserPolicy = s3All + 1;
 113 static constexpr std::uint64_t iamGetUserPolicy = s3All + 2;
 114 static constexpr std::uint64_t iamDeleteUserPolicy = s3All + 3;
 115 static constexpr std::uint64_t iamListUserPolicies = s3All + 4;
 116 static constexpr std::uint64_t iamCreateRole = s3All + 5;
 117 static constexpr std::uint64_t iamDeleteRole = s3All + 6;
 118 static constexpr std::uint64_t iamModifyRole = s3All + 7;
 119 static constexpr std::uint64_t iamGetRole = s3All + 8;
 120 static constexpr std::uint64_t iamListRoles = s3All + 9;
 121 static constexpr std::uint64_t iamPutRolePolicy = s3All + 10;
 122 static constexpr std::uint64_t iamGetRolePolicy = s3All + 11;
 123 static constexpr std::uint64_t iamListRolePolicies = s3All + 12;
 124 static constexpr std::uint64_t iamDeleteRolePolicy = s3All + 13;
 125 static constexpr std::uint64_t iamCreateOIDCProvider = s3All + 14;
 126 static constexpr std::uint64_t iamDeleteOIDCProvider = s3All + 15;
 127 static constexpr std::uint64_t iamGetOIDCProvider = s3All + 16;
 128 static constexpr std::uint64_t iamListOIDCProviders = s3All + 17;
 129 static constexpr std::uint64_t iamAll = s3All + 18;
 130
 131 static constexpr std::uint64_t stsAssumeRole = iamAll + 1;
 132 static constexpr std::uint64_t stsAssumeRoleWithWebIdentity = iamAll + 2;
 133 static constexpr std::uint64_t stsGetSessionToken = iamAll + 3;
 134 static constexpr std::uint64_t stsAll = iamAll + 4;
 135
 136 static constexpr std::uint64_t s3Count = s3All;
 137 static constexpr std::uint64_t allCount = stsAll + 1;
 138
 139 using Action_t = std::bitset<allCount>;
 140 using NotAction_t = Action_t;
 141
 142 template <size_t N>
 143 constexpr std::bitset<N> make_bitmask(size_t s) {
 144   // unfortunately none of the shift/logic operators of std::bitset have a constexpr variation
 145   return s < 64 ? std::bitset<N> ((1ULL << s) - 1) :
 146     std::bitset<N>((1ULL << 63) - 1) | make_bitmask<N> (s - 63) << 63;
 147 }
 148
 149 template <size_t N>
 150 constexpr std::bitset<N> set_cont_bits(size_t start, size_t end)
 151 {
 152   return (make_bitmask<N>(end - start)) << start;
 153 }
 154
 155 static const Action_t None(0);
 156 static const Action_t s3AllValue = set_cont_bits<allCount>(0,s3All);
 157 static const Action_t iamAllValue = set_cont_bits<allCount>(s3All+1,iamAll);
 158 static const Action_t stsAllValue = set_cont_bits<allCount>(iamAll+1,stsAll);
 159 static const Action_t allValue = set_cont_bits<allCount>(0,allCount);
 160
 161 namespace {
 162 // Please update the table in doc/radosgw/s3/authentication.rst if you
 163 // modify this function.
 164 inline int op_to_perm(std::uint64_t op) {
 165   switch (op) {
 166   case s3GetObject:
 167   case s3GetObjectTorrent:
 168   case s3GetObjectVersion:
 169   case s3GetObjectVersionTorrent:
 170   case s3GetObjectTagging:
 171   case s3GetObjectVersionTagging:
 172   case s3GetObjectRetention:
 173   case s3GetObjectLegalHold:
 174   case s3ListAllMyBuckets:
 175   case s3ListBucket:
 176   case s3ListBucketMultipartUploads:
 177   case s3ListBucketVersions:
 178   case s3ListMultipartUploadParts:
 179     return RGW_PERM_READ;
 180
 181   case s3AbortMultipartUpload:
 182   case s3CreateBucket:
 183   case s3DeleteBucket:
 184   case s3DeleteObject:
 185   case s3DeleteObjectVersion:
 186   case s3PutObject:
 187   case s3PutObjectTagging:
 188   case s3PutObjectVersionTagging:
 189   case s3DeleteObjectTagging:
 190   case s3DeleteObjectVersionTagging:
 191   case s3RestoreObject:
 192   case s3PutObjectRetention:
 193   case s3PutObjectLegalHold:
 194   case s3BypassGovernanceRetention:
 195     return RGW_PERM_WRITE;
 196
 197   case s3GetAccelerateConfiguration:
 198   case s3GetBucketAcl:
 199   case s3GetBucketCORS:
 200   case s3GetBucketLocation:
 201   case s3GetBucketLogging:
 202   case s3GetBucketNotification:
 203   case s3GetBucketPolicy:
 204   case s3GetBucketPolicyStatus:
 205   case s3GetBucketRequestPayment:
 206   case s3GetBucketTagging:
 207   case s3GetBucketVersioning:
 208   case s3GetBucketWebsite:
 209   case s3GetLifecycleConfiguration:
 210   case s3GetObjectAcl:
 211   case s3GetObjectVersionAcl:
 212   case s3GetReplicationConfiguration:
 213   case s3GetBucketObjectLockConfiguration:
 214   case s3GetBucketPublicAccessBlock:
 215     return RGW_PERM_READ_ACP;
 216
 217   case s3DeleteBucketPolicy:
 218   case s3DeleteBucketWebsite:
 219   case s3DeleteReplicationConfiguration:
 220   case s3PutAccelerateConfiguration:
 221   case s3PutBucketAcl:
 222   case s3PutBucketCORS:
 223   case s3PutBucketLogging:
 224   case s3PutBucketNotification:
 225   case s3PutBucketPolicy:
 226   case s3PutBucketRequestPayment:
 227   case s3PutBucketTagging:
 228   case s3PutBucketVersioning:
 229   case s3PutBucketWebsite:
 230   case s3PutLifecycleConfiguration:
 231   case s3PutObjectAcl:
 232   case s3PutObjectVersionAcl:
 233   case s3PutReplicationConfiguration:
 234   case s3PutBucketObjectLockConfiguration:
 235   case s3PutBucketPublicAccessBlock:
 236     return RGW_PERM_WRITE_ACP;
 237
 238   case s3All:
 239     return RGW_PERM_FULL_CONTROL;
 240   }
 241   return RGW_PERM_INVALID;
 242 }
 243 }
 244
 245 using Environment = boost::container::flat_map<std::string, std::string>;
 246
 247 using Address = std::bitset<128>;
 248 struct MaskedIP {
 249   bool v6;
 250   Address addr;
 251   // Since we're mapping IPv6 to IPv4 addresses, we may want to
 252   // consider making the prefix always be in terms of a v6 address
 253   // and just use the v6 bit to rewrite it as a v4 prefix for
 254   // output.
 255   unsigned int prefix;
 256 };
 257
 258 std::ostream& operator <<(std::ostream& m, const MaskedIP& ip);
 259
 260 inline bool operator ==(const MaskedIP& l, const MaskedIP& r) {
 261   auto shift = std::max((l.v6 ? 128 : 32) - ((int) l.prefix),
 262                         (r.v6 ? 128 : 32) - ((int) r.prefix));
 263   ceph_assert(shift >= 0);
 264   return (l.addr >> shift) == (r.addr >> shift);
 265 }
 266
 267 struct Condition {
 268   TokenID op;
 269   // Originally I was going to use a perfect hash table, but Marcus
 270   // says keys are to be added at run-time not compile time.
 271
 272   // In future development, use symbol internment.
 273   std::string key;
 274   bool ifexists = false;
 275   // Much to my annoyance there is no actual way to do this in a
 276   // typed way that is compatible with AWS. I know this because I've
 277   // seen examples where the same value is used as a string in one
 278   // context and a date in another.
 279   std::vector<std::string> vals;
 280
 281   Condition() = default;
 282   Condition(TokenID op, const char* s, std::size_t len, bool ifexists)
 283     : op(op), key(s, len), ifexists(ifexists) {}
 284
 285   bool eval(const Environment& e) const;
 286
 287   static boost::optional<double> as_number(const std::string& s) {
 288     std::size_t p = 0;
 289
 290     try {
 291       double d = std::stod(s, &p);
 292       if (p < s.length()) {
 293         return boost::none;
 294       }
 295
 296       return d;
 297     } catch (const std::logic_error& e) {
 298       return boost::none;
 299     }
 300   }
 301
 302   static boost::optional<ceph::real_time> as_date(const std::string& s) {
 303     std::size_t p = 0;
 304
 305     try {
 306       double d = std::stod(s, &p);
 307       if (p == s.length()) {
 308         return ceph::real_time(
 309           std::chrono::seconds(static_cast<uint64_t>(d)) +
 310           std::chrono::nanoseconds(
 311             static_cast<uint64_t>((d - static_cast<uint64_t>(d))
 312                                   * 1000000000)));
 313       }
 314
 315       return from_iso_8601(boost::string_ref(s), false);
 316     } catch (const std::logic_error& e) {
 317       return boost::none;
 318     }
 319   }
 320
 321   static boost::optional<bool> as_bool(const std::string& s) {
 322     std::size_t p = 0;
 323
 324     if (s.empty() || boost::iequals(s, "false")) {
 325       return false;
 326     }
 327
 328     try {
 329       double d = std::stod(s, &p);
 330       if (p == s.length()) {
 331         return !((d == +0.0) || (d == -0.0) || std::isnan(d));
 332       }
 333     } catch (const std::logic_error& e) {
 334       // Fallthrough
 335     }
 336
 337     return true;
 338   }
 339
 340   static boost::optional<ceph::bufferlist> as_binary(const std::string& s) {
 341     // In a just world
 342     ceph::bufferlist base64;
 343     // I could populate a bufferlist
 344     base64.push_back(buffer::create_static(
 345                        s.length(),
 346                        const_cast<char*>(s.data()))); // Yuck
 347     // From a base64 encoded std::string.
 348     ceph::bufferlist bin;
 349
 350     try {
 351       bin.decode_base64(base64);
 352     } catch (const ceph::buffer::malformed_input& e) {
 353       return boost::none;
 354     }
 355     return bin;
 356   }
 357
 358   static boost::optional<MaskedIP> as_network(const std::string& s);
 359
 360
 361   struct ci_equal_to {
 362     bool operator ()(const std::string& s1,
 363                      const std::string& s2) const {
 364       return boost::iequals(s1, s2);
 365     }
 366   };
 367
 368   struct string_like {
 369     bool operator ()(const std::string& input,
 370                      const std::string& pattern) const {
 371       return match_wildcards(pattern, input, 0);
 372     }
 373   };
 374
 375   struct ci_starts_with {
 376     bool operator()(const std::string& s1,
 377                     const std::string& s2) const {
 378       return boost::istarts_with(s1, s2);
 379     }
 380   };
 381
 382   template<typename F>
 383   static bool orrible(F&& f, const std::string& c,
 384                       const std::vector<std::string>& v) {
 385     for (const auto& d : v) {
 386       if (std::forward<F>(f)(c, d)) {
 387         return true;
 388       }
 389     }
 390     return false;
 391   }
 392
 393   template<typename F, typename X>
 394   static bool shortible(F&& f, X& x, const std::string& c,
 395                         const std::vector<std::string>& v) {
 396     auto xc = std::forward<X>(x)(c);
 397     if (!xc) {
 398       return false;
 399     }
 400
 401     for (const auto& d : v) {
 402       auto xd = std::forward<X>(x)(d);
 403       if (!xd) {
 404         continue;
 405       }
 406
 407       if (std::forward<F>(f)(*xc, *xd)) {
 408         return true;
 409       }
 410     }
 411     return false;
 412   }
 413
 414   template <typename F>
 415   bool has_key_p(const std::string& _key, F p) const {
 416     return p(key, _key);
 417   }
 418 };
 419
 420 std::ostream& operator <<(std::ostream& m, const Condition& c);
 421
 422 struct Statement {
 423   boost::optional<std::string> sid = boost::none;
 424
 425   boost::container::flat_set<rgw::auth::Principal> princ;
 426   boost::container::flat_set<rgw::auth::Principal> noprinc;
 427
 428   // Every statement MUST provide an effect. I just initialize it to
 429   // deny as defensive programming.
 430   Effect effect = Effect::Deny;
 431
 432   Action_t action = 0;
 433   NotAction_t notaction = 0;
 434
 435   boost::container::flat_set<ARN> resource;
 436   boost::container::flat_set<ARN> notresource;
 437
 438   std::vector<Condition> conditions;
 439
 440   Effect eval(const Environment& e,
 441               boost::optional<const rgw::auth::Identity&> ida,
 442               std::uint64_t action, const ARN& resource) const;
 443
 444   Effect eval_principal(const Environment& e,
 445                        boost::optional<const rgw::auth::Identity&> ida) const;
 446
 447   Effect eval_conditions(const Environment& e) const;
 448 };
 449
 450 std::ostream& operator <<(ostream& m, const Statement& s);
 451
 452 struct PolicyParseException : public std::exception {
 453   rapidjson::ParseResult pr;
 454
 455   explicit PolicyParseException(rapidjson::ParseResult&& pr)
 456     : pr(pr) { }
 457   const char* what() const noexcept override {
 458     return rapidjson::GetParseError_En(pr.Code());
 459   }
 460 };
 461
 462 struct Policy {
 463   std::string text;
 464   Version version = Version::v2008_10_17;
 465   boost::optional<std::string> id = boost::none;
 466
 467   std::vector<Statement> statements;
 468
 469   Policy(CephContext* cct, const std::string& tenant,
 470          const bufferlist& text);
 471
 472   Effect eval(const Environment& e,
 473               boost::optional<const rgw::auth::Identity&> ida,
 474               std::uint64_t action, const ARN& resource) const;
 475
 476   Effect eval_principal(const Environment& e,
 477               boost::optional<const rgw::auth::Identity&> ida) const;
 478
 479   Effect eval_conditions(const Environment& e) const;
 480
 481   template <typename F>
 482   bool has_conditional(const string& conditional, F p) const {
 483     for (const auto&s: statements){
 484       if (std::any_of(s.conditions.begin(), s.conditions.end(),
 485                       [&](const Condition& c) { return c.has_key_p(conditional, p);}))
 486         return true;
 487     }
 488     return false;
 489   }
 490
 491   bool has_conditional(const string& c) const {
 492     return has_conditional(c, Condition::ci_equal_to());
 493   }
 494
 495   bool has_partial_conditional(const string& c) const {
 496     return has_conditional(c, Condition::ci_starts_with());
 497   }
 498 };
 499
 500 std::ostream& operator <<(ostream& m, const Policy& p);
 501 bool is_public(const Policy& p);
 502
 503 }
 504 }
 505
 506 #endif