ceph/src/rgw/rgw_iam_policy.h

   1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
   2 // vim: ts=8 sw=2 smarttab
   3
   4 #ifndef CEPH_RGW_IAM_POLICY_H
   5 #define CEPH_RGW_IAM_POLICY_H
   6
   7 #include <bitset>
   8 #include <chrono>
   9 #include <cstdint>
  10 #include <iostream>
  11 #include <string>
  12
  13 #include <boost/algorithm/string/predicate.hpp>
  14 #include <boost/container/flat_map.hpp>
  15 #include <boost/container/flat_set.hpp>
  16 #include <boost/optional.hpp>
  17 #include <boost/thread/shared_mutex.hpp>
  18 #include <boost/utility/string_ref.hpp>
  19 #include <boost/variant.hpp>
  20
  21 #include "common/ceph_time.h"
  22 #include "common/iso_8601.h"
  23
  24 #include "rapidjson/error/error.h"
  25 #include "rapidjson/error/en.h"
  26
  27 #include "rgw_acl.h"
  28 #include "rgw_basic_types.h"
  29 #include "rgw_iam_policy_keywords.h"
  30 #include "rgw_string.h"
  31 #include "rgw_arn.h"
  32
  33 class RGWRados;
  34 namespace rgw {
  35 namespace auth {
  36 class Identity;
  37 }
  38 }
  39 struct rgw_obj;
  40 struct rgw_bucket;
  41
  42 namespace rgw {
  43 namespace IAM {
  44
  45 static constexpr std::uint64_t s3GetObject = 0;
  46 static constexpr std::uint64_t s3GetObjectVersion = 1;
  47 static constexpr std::uint64_t s3PutObject = 2;
  48 static constexpr std::uint64_t s3GetObjectAcl = 3;
  49 static constexpr std::uint64_t s3GetObjectVersionAcl = 4;
  50 static constexpr std::uint64_t s3PutObjectAcl = 5;
  51 static constexpr std::uint64_t s3PutObjectVersionAcl = 6;
  52 static constexpr std::uint64_t s3DeleteObject = 7;
  53 static constexpr std::uint64_t s3DeleteObjectVersion = 8;
  54 static constexpr std::uint64_t s3ListMultipartUploadParts = 9;
  55 static constexpr std::uint64_t s3AbortMultipartUpload = 10;
  56 static constexpr std::uint64_t s3GetObjectTorrent = 11;
  57 static constexpr std::uint64_t s3GetObjectVersionTorrent = 12;
  58 static constexpr std::uint64_t s3RestoreObject = 13;
  59 static constexpr std::uint64_t s3CreateBucket = 14;
  60 static constexpr std::uint64_t s3DeleteBucket = 15;
  61 static constexpr std::uint64_t s3ListBucket = 16;
  62 static constexpr std::uint64_t s3ListBucketVersions = 17;
  63 static constexpr std::uint64_t s3ListAllMyBuckets = 18;
  64 static constexpr std::uint64_t s3ListBucketMultipartUploads = 19;
  65 static constexpr std::uint64_t s3GetAccelerateConfiguration = 20;
  66 static constexpr std::uint64_t s3PutAccelerateConfiguration = 21;
  67 static constexpr std::uint64_t s3GetBucketAcl = 22;
  68 static constexpr std::uint64_t s3PutBucketAcl = 23;
  69 static constexpr std::uint64_t s3GetBucketCORS = 24;
  70 static constexpr std::uint64_t s3PutBucketCORS = 25;
  71 static constexpr std::uint64_t s3GetBucketVersioning = 26;
  72 static constexpr std::uint64_t s3PutBucketVersioning = 27;
  73 static constexpr std::uint64_t s3GetBucketRequestPayment = 28;
  74 static constexpr std::uint64_t s3PutBucketRequestPayment = 29;
  75 static constexpr std::uint64_t s3GetBucketLocation = 30;
  76 static constexpr std::uint64_t s3GetBucketPolicy = 31;
  77 static constexpr std::uint64_t s3DeleteBucketPolicy = 32;
  78 static constexpr std::uint64_t s3PutBucketPolicy = 33;
  79 static constexpr std::uint64_t s3GetBucketNotification = 34;
  80 static constexpr std::uint64_t s3PutBucketNotification = 35;
  81 static constexpr std::uint64_t s3GetBucketLogging = 36;
  82 static constexpr std::uint64_t s3PutBucketLogging = 37;
  83 static constexpr std::uint64_t s3GetBucketTagging = 38;
  84 static constexpr std::uint64_t s3PutBucketTagging = 39;
  85 static constexpr std::uint64_t s3GetBucketWebsite = 40;
  86 static constexpr std::uint64_t s3PutBucketWebsite = 41;
  87 static constexpr std::uint64_t s3DeleteBucketWebsite = 42;
  88 static constexpr std::uint64_t s3GetLifecycleConfiguration = 43;
  89 static constexpr std::uint64_t s3PutLifecycleConfiguration = 44;
  90 static constexpr std::uint64_t s3PutReplicationConfiguration = 45;
  91 static constexpr std::uint64_t s3GetReplicationConfiguration = 46;
  92 static constexpr std::uint64_t s3DeleteReplicationConfiguration = 47;
  93 static constexpr std::uint64_t s3GetObjectTagging = 48;
  94 static constexpr std::uint64_t s3PutObjectTagging = 49;
  95 static constexpr std::uint64_t s3DeleteObjectTagging = 50;
  96 static constexpr std::uint64_t s3GetObjectVersionTagging = 51;
  97 static constexpr std::uint64_t s3PutObjectVersionTagging = 52;
  98 static constexpr std::uint64_t s3DeleteObjectVersionTagging = 53;
  99 static constexpr std::uint64_t s3PutBucketObjectLockConfiguration = 54;
 100 static constexpr std::uint64_t s3GetBucketObjectLockConfiguration = 55;
 101 static constexpr std::uint64_t s3PutObjectRetention = 56;
 102 static constexpr std::uint64_t s3GetObjectRetention = 57;
 103 static constexpr std::uint64_t s3PutObjectLegalHold = 58;
 104 static constexpr std::uint64_t s3GetObjectLegalHold = 59;
 105 static constexpr std::uint64_t s3BypassGovernanceRetention = 60;
 106 static constexpr std::uint64_t s3All = 61;
 107
 108 static constexpr std::uint64_t iamPutUserPolicy = 62;
 109 static constexpr std::uint64_t iamGetUserPolicy = 63;
 110 static constexpr std::uint64_t iamDeleteUserPolicy = 64;
 111 static constexpr std::uint64_t iamListUserPolicies = 65;
 112 static constexpr std::uint64_t iamCreateRole = 66;
 113 static constexpr std::uint64_t iamDeleteRole = 67;
 114 static constexpr std::uint64_t iamModifyRole = 68;
 115 static constexpr std::uint64_t iamGetRole = 69;
 116 static constexpr std::uint64_t iamListRoles = 70;
 117 static constexpr std::uint64_t iamPutRolePolicy = 71;
 118 static constexpr std::uint64_t iamGetRolePolicy = 72;
 119 static constexpr std::uint64_t iamListRolePolicies = 73;
 120 static constexpr std::uint64_t iamDeleteRolePolicy = 74;
 121 static constexpr std::uint64_t iamAll = 75;
 122 static constexpr std::uint64_t stsAssumeRole = 76;
 123 static constexpr std::uint64_t stsAssumeRoleWithWebIdentity = 77;
 124 static constexpr std::uint64_t stsGetSessionToken = 78;
 125 static constexpr std::uint64_t stsAll = 79;
 126
 127 static constexpr std::uint64_t s3Count = s3BypassGovernanceRetention + 1;
 128 static constexpr std::uint64_t allCount = stsAll + 1;
 129
 130 using Action_t = std::bitset<allCount>;
 131 using NotAction_t = Action_t;
 132
 133 static const Action_t None(0);
 134 static const Action_t s3AllValue("1111111111111111111111111111111111111111111111111111111111111");
 135 static const Action_t iamAllValue("111111111111100000000000000000000000000000000000000000000000000000000000000");
 136 static const Action_t stsAllValue("1110000000000000000000000000000000000000000000000000000000000000000000000000000");
 137 //Modify allValue if more Actions are added
 138 static const Action_t allValue("11111111111111111111111111111111111111111111111111111111111111111111111111111111");
 139
 140 namespace {
 141 // Please update the table in doc/radosgw/s3/authentication.rst if you
 142 // modify this function.
 143 inline int op_to_perm(std::uint64_t op) {
 144   switch (op) {
 145   case s3GetObject:
 146   case s3GetObjectTorrent:
 147   case s3GetObjectVersion:
 148   case s3GetObjectVersionTorrent:
 149   case s3GetObjectTagging:
 150   case s3GetObjectVersionTagging:
 151   case s3GetObjectRetention:
 152   case s3GetObjectLegalHold:
 153   case s3ListAllMyBuckets:
 154   case s3ListBucket:
 155   case s3ListBucketMultipartUploads:
 156   case s3ListBucketVersions:
 157   case s3ListMultipartUploadParts:
 158     return RGW_PERM_READ;
 159
 160   case s3AbortMultipartUpload:
 161   case s3CreateBucket:
 162   case s3DeleteBucket:
 163   case s3DeleteObject:
 164   case s3DeleteObjectVersion:
 165   case s3PutObject:
 166   case s3PutObjectTagging:
 167   case s3PutObjectVersionTagging:
 168   case s3DeleteObjectTagging:
 169   case s3DeleteObjectVersionTagging:
 170   case s3RestoreObject:
 171   case s3PutObjectRetention:
 172   case s3PutObjectLegalHold:
 173   case s3BypassGovernanceRetention:
 174     return RGW_PERM_WRITE;
 175
 176   case s3GetAccelerateConfiguration:
 177   case s3GetBucketAcl:
 178   case s3GetBucketCORS:
 179   case s3GetBucketLocation:
 180   case s3GetBucketLogging:
 181   case s3GetBucketNotification:
 182   case s3GetBucketPolicy:
 183   case s3GetBucketRequestPayment:
 184   case s3GetBucketTagging:
 185   case s3GetBucketVersioning:
 186   case s3GetBucketWebsite:
 187   case s3GetLifecycleConfiguration:
 188   case s3GetObjectAcl:
 189   case s3GetObjectVersionAcl:
 190   case s3GetReplicationConfiguration:
 191   case s3GetBucketObjectLockConfiguration:
 192     return RGW_PERM_READ_ACP;
 193
 194   case s3DeleteBucketPolicy:
 195   case s3DeleteBucketWebsite:
 196   case s3DeleteReplicationConfiguration:
 197   case s3PutAccelerateConfiguration:
 198   case s3PutBucketAcl:
 199   case s3PutBucketCORS:
 200   case s3PutBucketLogging:
 201   case s3PutBucketNotification:
 202   case s3PutBucketPolicy:
 203   case s3PutBucketRequestPayment:
 204   case s3PutBucketTagging:
 205   case s3PutBucketVersioning:
 206   case s3PutBucketWebsite:
 207   case s3PutLifecycleConfiguration:
 208   case s3PutObjectAcl:
 209   case s3PutObjectVersionAcl:
 210   case s3PutReplicationConfiguration:
 211   case s3PutBucketObjectLockConfiguration:
 212     return RGW_PERM_WRITE_ACP;
 213
 214   case s3All:
 215     return RGW_PERM_FULL_CONTROL;
 216   }
 217   return RGW_PERM_INVALID;
 218 }
 219 }
 220
 221 using Environment = boost::container::flat_map<std::string, std::string>;
 222
 223 using Address = std::bitset<128>;
 224 struct MaskedIP {
 225   bool v6;
 226   Address addr;
 227   // Since we're mapping IPv6 to IPv4 addresses, we may want to
 228   // consider making the prefix always be in terms of a v6 address
 229   // and just use the v6 bit to rewrite it as a v4 prefix for
 230   // output.
 231   unsigned int prefix;
 232 };
 233
 234 std::ostream& operator <<(std::ostream& m, const MaskedIP& ip);
 235
 236 inline bool operator ==(const MaskedIP& l, const MaskedIP& r) {
 237   auto shift = std::max((l.v6 ? 128 : 32) - ((int) l.prefix),
 238                         (r.v6 ? 128 : 32) - ((int) r.prefix));
 239   ceph_assert(shift >= 0);
 240   return (l.addr >> shift) == (r.addr >> shift);
 241 }
 242
 243 struct Condition {
 244   TokenID op;
 245   // Originally I was going to use a perfect hash table, but Marcus
 246   // says keys are to be added at run-time not compile time.
 247
 248   // In future development, use symbol internment.
 249   std::string key;
 250   bool ifexists = false;
 251   // Much to my annoyance there is no actual way to do this in a
 252   // typed way that is compatible with AWS. I know this because I've
 253   // seen examples where the same value is used as a string in one
 254   // context and a date in another.
 255   std::vector<std::string> vals;
 256
 257   Condition() = default;
 258   Condition(TokenID op, const char* s, std::size_t len, bool ifexists)
 259     : op(op), key(s, len), ifexists(ifexists) {}
 260
 261   bool eval(const Environment& e) const;
 262
 263   static boost::optional<double> as_number(const std::string& s) {
 264     std::size_t p = 0;
 265
 266     try {
 267       double d = std::stod(s, &p);
 268       if (p < s.length()) {
 269         return boost::none;
 270       }
 271
 272       return d;
 273     } catch (const std::logic_error& e) {
 274       return boost::none;
 275     }
 276   }
 277
 278   static boost::optional<ceph::real_time> as_date(const std::string& s) {
 279     std::size_t p = 0;
 280
 281     try {
 282       double d = std::stod(s, &p);
 283       if (p == s.length()) {
 284         return ceph::real_time(
 285           std::chrono::seconds(static_cast<uint64_t>(d)) +
 286           std::chrono::nanoseconds(
 287             static_cast<uint64_t>((d - static_cast<uint64_t>(d))
 288                                   * 1000000000)));
 289       }
 290
 291       return from_iso_8601(boost::string_ref(s), false);
 292     } catch (const std::logic_error& e) {
 293       return boost::none;
 294     }
 295   }
 296
 297   static boost::optional<bool> as_bool(const std::string& s) {
 298     std::size_t p = 0;
 299
 300     if (s.empty() || boost::iequals(s, "false")) {
 301       return false;
 302     }
 303
 304     try {
 305       double d = std::stod(s, &p);
 306       if (p == s.length()) {
 307         return !((d == +0.0) || (d == -0.0) || std::isnan(d));
 308       }
 309     } catch (const std::logic_error& e) {
 310       // Fallthrough
 311     }
 312
 313     return true;
 314   }
 315
 316   static boost::optional<ceph::bufferlist> as_binary(const std::string& s) {
 317     // In a just world
 318     ceph::bufferlist base64;
 319     // I could populate a bufferlist
 320     base64.push_back(buffer::create_static(
 321                        s.length(),
 322                        const_cast<char*>(s.data()))); // Yuck
 323     // From a base64 encoded std::string.
 324     ceph::bufferlist bin;
 325
 326     try {
 327       bin.decode_base64(base64);
 328     } catch (const ceph::buffer::malformed_input& e) {
 329       return boost::none;
 330     }
 331     return bin;
 332   }
 333
 334   static boost::optional<MaskedIP> as_network(const std::string& s);
 335
 336
 337   struct ci_equal_to {
 338     bool operator ()(const std::string& s1,
 339                      const std::string& s2) const {
 340       return boost::iequals(s1, s2);
 341     }
 342   };
 343
 344   struct string_like {
 345     bool operator ()(const std::string& input,
 346                      const std::string& pattern) const {
 347       return match_wildcards(pattern, input, 0);
 348     }
 349   };
 350
 351   struct ci_starts_with {
 352     bool operator()(const std::string& s1,
 353                     const std::string& s2) const {
 354       return boost::istarts_with(s1, s2);
 355     }
 356   };
 357
 358   template<typename F>
 359   static bool orrible(F&& f, const std::string& c,
 360                       const std::vector<std::string>& v) {
 361     for (const auto& d : v) {
 362       if (std::forward<F>(f)(c, d)) {
 363         return true;
 364       }
 365     }
 366     return false;
 367   }
 368
 369   template<typename F, typename X>
 370   static bool shortible(F&& f, X& x, const std::string& c,
 371                         const std::vector<std::string>& v) {
 372     auto xc = std::forward<X>(x)(c);
 373     if (!xc) {
 374       return false;
 375     }
 376
 377     for (const auto& d : v) {
 378       auto xd = std::forward<X>(x)(d);
 379       if (!xd) {
 380         continue;
 381       }
 382
 383       if (std::forward<F>(f)(*xc, *xd)) {
 384         return true;
 385       }
 386     }
 387     return false;
 388   }
 389
 390   template <typename F>
 391   bool has_key_p(const std::string& _key, F p) const {
 392     return p(key, _key);
 393   }
 394 };
 395
 396 std::ostream& operator <<(std::ostream& m, const Condition& c);
 397
 398 struct Statement {
 399   boost::optional<std::string> sid = boost::none;
 400
 401   boost::container::flat_set<rgw::auth::Principal> princ;
 402   boost::container::flat_set<rgw::auth::Principal> noprinc;
 403
 404   // Every statement MUST provide an effect. I just initialize it to
 405   // deny as defensive programming.
 406   Effect effect = Effect::Deny;
 407
 408   Action_t action = 0;
 409   NotAction_t notaction = 0;
 410
 411   boost::container::flat_set<ARN> resource;
 412   boost::container::flat_set<ARN> notresource;
 413
 414   std::vector<Condition> conditions;
 415
 416   Effect eval(const Environment& e,
 417               boost::optional<const rgw::auth::Identity&> ida,
 418               std::uint64_t action, const ARN& resource) const;
 419
 420   Effect eval_principal(const Environment& e,
 421                        boost::optional<const rgw::auth::Identity&> ida) const;
 422
 423   Effect eval_conditions(const Environment& e) const;
 424 };
 425
 426 std::ostream& operator <<(ostream& m, const Statement& s);
 427
 428 struct PolicyParseException : public std::exception {
 429   rapidjson::ParseResult pr;
 430
 431   explicit PolicyParseException(rapidjson::ParseResult&& pr)
 432     : pr(pr) { }
 433   const char* what() const noexcept override {
 434     return rapidjson::GetParseError_En(pr.Code());
 435   }
 436 };
 437
 438 struct Policy {
 439   std::string text;
 440   Version version = Version::v2008_10_17;
 441   boost::optional<std::string> id = boost::none;
 442
 443   std::vector<Statement> statements;
 444
 445   Policy(CephContext* cct, const std::string& tenant,
 446          const bufferlist& text);
 447
 448   Effect eval(const Environment& e,
 449               boost::optional<const rgw::auth::Identity&> ida,
 450               std::uint64_t action, const ARN& resource) const;
 451
 452   Effect eval_principal(const Environment& e,
 453               boost::optional<const rgw::auth::Identity&> ida) const;
 454
 455   Effect eval_conditions(const Environment& e) const;
 456
 457   template <typename F>
 458   bool has_conditional(const string& conditional, F p) const {
 459     for (const auto&s: statements){
 460       if (std::any_of(s.conditions.begin(), s.conditions.end(),
 461                       [&](const Condition& c) { return c.has_key_p(conditional, p);}))
 462         return true;
 463     }
 464     return false;
 465   }
 466
 467   bool has_conditional(const string& c) const {
 468     return has_conditional(c, Condition::ci_equal_to());
 469   }
 470
 471   bool has_partial_conditional(const string& c) const {
 472     return has_conditional(c, Condition::ci_starts_with());
 473   }
 474 };
 475
 476 std::ostream& operator <<(ostream& m, const Policy& p);
 477 }
 478 }
 479
 480 #endif