1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
2 // vim: ts=8 sw=2 smarttab ft=cpp
6 #include <system_error>
10 #include <string_view>
12 #include <boost/algorithm/string/predicate.hpp>
13 #include <boost/optional.hpp>
14 #include <boost/utility/in_place_factory.hpp>
16 #include "include/scope_guard.h"
17 #include "common/Clock.h"
18 #include "common/armor.h"
19 #include "common/errno.h"
20 #include "common/mime.h"
21 #include "common/utf8.h"
22 #include "common/ceph_json.h"
23 #include "common/static_ptr.h"
25 #include "rgw_rados.h"
30 #include "rgw_acl_s3.h"
31 #include "rgw_acl_swift.h"
32 #include "rgw_aio_throttle.h"
34 #include "rgw_bucket.h"
36 #include "rgw_multi.h"
37 #include "rgw_multi_del.h"
39 #include "rgw_cors_s3.h"
40 #include "rgw_rest_conn.h"
41 #include "rgw_rest_s3.h"
43 #include "rgw_client_io.h"
44 #include "rgw_compression.h"
46 #include "rgw_tag_s3.h"
47 #include "rgw_putobj_processor.h"
48 #include "rgw_crypt.h"
49 #include "rgw_perf_counters.h"
50 #include "rgw_notify.h"
51 #include "rgw_notify_event_type.h"
52 #include "rgw_sal_rados.h"
54 #include "services/svc_zone.h"
55 #include "services/svc_quota.h"
56 #include "services/svc_sys_obj.h"
58 #include "cls/lock/cls_lock_client.h"
59 #include "cls/rgw/cls_rgw_client.h"
62 #include "include/ceph_assert.h"
64 #include "compressor/Compressor.h"
67 #define TRACEPOINT_DEFINE
68 #define TRACEPOINT_PROBE_DYNAMIC_LINKAGE
69 #include "tracing/rgw_op.h"
70 #undef TRACEPOINT_PROBE_DYNAMIC_LINKAGE
71 #undef TRACEPOINT_DEFINE
73 #define tracepoint(...)
76 #define dout_context g_ceph_context
77 #define dout_subsys ceph_subsys_rgw
79 using namespace librados
;
80 using ceph::crypto::MD5
;
81 using boost::optional
;
85 using rgw::IAM::Effect
;
86 using rgw::IAM::Policy
;
88 static string mp_ns
= RGW_OBJ_NS_MULTIPART
;
89 static string shadow_ns
= RGW_OBJ_NS_SHADOW
;
91 static void forward_req_info(CephContext
*cct
, req_info
& info
, const std::string
& bucket_name
);
93 static MultipartMetaFilter mp_filter
;
95 // this probably should belong in the rgw_iam_policy_keywords, I'll get it to it
97 static constexpr auto S3_EXISTING_OBJTAG
= "s3:ExistingObjectTag";
99 int RGWGetObj::parse_range(void)
102 string
rs(range_str
);
106 ignore_invalid_range
= s
->cct
->_conf
->rgw_ignore_get_invalid_range
;
107 partial_content
= false;
109 size_t pos
= rs
.find("bytes=");
110 if (pos
== string::npos
) {
112 while (isspace(rs
[pos
]))
115 while (isalpha(rs
[end
]))
117 if (strncasecmp(rs
.c_str(), "bytes", end
- pos
) != 0)
119 while (isspace(rs
[end
]))
123 rs
= rs
.substr(end
+ 1);
125 rs
= rs
.substr(pos
+ 6); /* size of("bytes=") */
128 if (pos
== string::npos
)
131 partial_content
= true;
133 ofs_str
= rs
.substr(0, pos
);
134 end_str
= rs
.substr(pos
+ 1);
135 if (end_str
.length()) {
136 end
= atoll(end_str
.c_str());
141 if (ofs_str
.length()) {
142 ofs
= atoll(ofs_str
.c_str());
143 } else { // RFC2616 suffix-byte-range-spec
148 if (end
>= 0 && end
< ofs
)
155 if (ignore_invalid_range
) {
156 partial_content
= false;
159 range_parsed
= false; // allow retry
166 static int decode_policy(const DoutPrefixProvider
*dpp
,
169 RGWAccessControlPolicy
*policy
)
171 auto iter
= bl
.cbegin();
173 policy
->decode(iter
);
174 } catch (buffer::error
& err
) {
175 ldpp_dout(dpp
, 0) << "ERROR: could not decode policy, caught buffer::error" << dendl
;
178 if (cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
179 ldpp_dout(dpp
, 15) << __func__
<< " Read AccessControlPolicy";
180 RGWAccessControlPolicy_S3
*s3policy
= static_cast<RGWAccessControlPolicy_S3
*>(policy
);
181 s3policy
->to_xml(*_dout
);
188 static int get_user_policy_from_attr(const DoutPrefixProvider
*dpp
,
189 CephContext
* const cct
,
190 rgw::sal::RGWRadosStore
* const store
,
191 map
<string
, bufferlist
>& attrs
,
192 RGWAccessControlPolicy
& policy
/* out */)
194 auto aiter
= attrs
.find(RGW_ATTR_ACL
);
195 if (aiter
!= attrs
.end()) {
196 int ret
= decode_policy(dpp
, cct
, aiter
->second
, &policy
);
208 * Get the AccessControlPolicy for an object off of disk.
209 * policy: must point to a valid RGWACL, and will be filled upon return.
210 * bucket: name of the bucket containing the object.
211 * object: name of the object to get the ACL for.
212 * Returns: 0 on success, -ERR# otherwise.
214 int rgw_op_get_bucket_policy_from_attr(const DoutPrefixProvider
*dpp
,
216 rgw::sal::RGWStore
*store
,
217 RGWBucketInfo
& bucket_info
,
218 map
<string
, bufferlist
>& bucket_attrs
,
219 RGWAccessControlPolicy
*policy
,
222 map
<string
, bufferlist
>::iterator aiter
= bucket_attrs
.find(RGW_ATTR_ACL
);
224 if (aiter
!= bucket_attrs
.end()) {
225 int ret
= decode_policy(dpp
, cct
, aiter
->second
, policy
);
229 ldpp_dout(dpp
, 0) << "WARNING: couldn't find acl header for bucket, generating default" << dendl
;
230 std::unique_ptr
<rgw::sal::RGWUser
> user
= store
->get_user(bucket_info
.owner
);
231 /* object exists, but policy is broken */
232 int r
= user
->load_by_id(dpp
, y
);
236 policy
->create_default(bucket_info
.owner
, user
->get_display_name());
241 static int get_obj_policy_from_attr(const DoutPrefixProvider
*dpp
,
243 rgw::sal::RGWStore
*store
,
244 RGWObjectCtx
& obj_ctx
,
245 RGWBucketInfo
& bucket_info
,
246 map
<string
, bufferlist
>& bucket_attrs
,
247 RGWAccessControlPolicy
*policy
,
248 string
*storage_class
,
249 rgw::sal::RGWObject
* obj
,
255 std::unique_ptr
<rgw::sal::RGWObject::ReadOp
> rop
= obj
->get_read_op(&obj_ctx
);
257 ret
= rop
->get_attr(dpp
, RGW_ATTR_ACL
, bl
, y
);
259 ret
= decode_policy(dpp
, cct
, bl
, policy
);
262 } else if (ret
== -ENODATA
) {
263 /* object exists, but policy is broken */
264 ldpp_dout(dpp
, 0) << "WARNING: couldn't find acl header for object, generating default" << dendl
;
265 std::unique_ptr
<rgw::sal::RGWUser
> user
= store
->get_user(bucket_info
.owner
);
266 ret
= user
->load_by_id(dpp
, y
);
270 policy
->create_default(bucket_info
.owner
, user
->get_display_name());
275 int r
= rop
->get_attr(dpp
, RGW_ATTR_STORAGE_CLASS
, scbl
, y
);
277 *storage_class
= scbl
.to_str();
279 storage_class
->clear();
287 static boost::optional
<Policy
> get_iam_policy_from_attr(CephContext
* cct
,
288 map
<string
, bufferlist
>& attrs
,
289 const string
& tenant
) {
290 auto i
= attrs
.find(RGW_ATTR_IAM_POLICY
);
291 if (i
!= attrs
.end()) {
292 return Policy(cct
, tenant
, i
->second
);
298 static boost::optional
<PublicAccessBlockConfiguration
>
299 get_public_access_conf_from_attr(const map
<string
, bufferlist
>& attrs
)
301 if (auto aiter
= attrs
.find(RGW_ATTR_PUBLIC_ACCESS
);
302 aiter
!= attrs
.end()) {
303 bufferlist::const_iterator iter
{&aiter
->second
};
304 PublicAccessBlockConfiguration access_conf
;
306 access_conf
.decode(iter
);
307 } catch (const buffer::error
& e
) {
315 vector
<Policy
> get_iam_user_policy_from_attr(CephContext
* cct
,
316 rgw::sal::RGWRadosStore
* store
,
317 map
<string
, bufferlist
>& attrs
,
318 const string
& tenant
) {
319 vector
<Policy
> policies
;
320 if (auto it
= attrs
.find(RGW_ATTR_USER_POLICY
); it
!= attrs
.end()) {
321 bufferlist out_bl
= attrs
[RGW_ATTR_USER_POLICY
];
322 map
<string
, string
> policy_map
;
323 decode(policy_map
, out_bl
);
324 for (auto& it
: policy_map
) {
325 bufferlist bl
= bufferlist::static_from_string(it
.second
);
326 Policy
p(cct
, tenant
, bl
);
327 policies
.push_back(std::move(p
));
333 static int get_obj_head(const DoutPrefixProvider
*dpp
,
335 rgw::sal::RGWObject
* obj
,
338 std::unique_ptr
<rgw::sal::RGWObject::ReadOp
> read_op
= obj
->get_read_op(s
->obj_ctx
);
339 obj
->set_prefetch_data(s
->obj_ctx
);
341 int ret
= read_op
->prepare(s
->yield
, dpp
);
350 ret
= read_op
->read(0, s
->cct
->_conf
->rgw_max_chunk_size
, *pbl
, s
->yield
, dpp
);
355 struct multipart_upload_info
357 rgw_placement_rule dest_placement
;
359 void encode(bufferlist
& bl
) const {
360 ENCODE_START(1, 1, bl
);
361 encode(dest_placement
, bl
);
365 void decode(bufferlist::const_iterator
& bl
) {
367 decode(dest_placement
, bl
);
371 WRITE_CLASS_ENCODER(multipart_upload_info
)
373 static int get_multipart_info(const DoutPrefixProvider
*dpp
, struct req_state
*s
,
374 rgw::sal::RGWObject
* obj
,
375 multipart_upload_info
*upload_info
)
380 bufferlist
*pheadbl
= (upload_info
? &headbl
: nullptr);
382 int op_ret
= get_obj_head(dpp
, s
, obj
, pheadbl
);
384 if (op_ret
== -ENOENT
) {
385 return -ERR_NO_SUCH_UPLOAD
;
390 if (upload_info
&& headbl
.length() > 0) {
391 auto hiter
= headbl
.cbegin();
393 decode(*upload_info
, hiter
);
394 } catch (buffer::error
& err
) {
395 ldpp_dout(s
, 0) << "ERROR: failed to decode multipart upload info" << dendl
;
403 static int get_multipart_info(const DoutPrefixProvider
*dpp
, struct req_state
*s
,
404 const string
& meta_oid
,
405 multipart_upload_info
*upload_info
)
407 map
<string
, bufferlist
>::iterator iter
;
410 std::unique_ptr
<rgw::sal::RGWObject
> meta_obj
;
411 meta_obj
= s
->bucket
->get_object(rgw_obj_key(meta_oid
, string(), mp_ns
));
412 meta_obj
->set_in_extra_data(true);
414 return get_multipart_info(dpp
, s
, meta_obj
.get(), upload_info
);
417 static int read_bucket_policy(const DoutPrefixProvider
*dpp
,
418 rgw::sal::RGWStore
*store
,
420 RGWBucketInfo
& bucket_info
,
421 map
<string
, bufferlist
>& bucket_attrs
,
422 RGWAccessControlPolicy
*policy
,
426 if (!s
->system_request
&& bucket_info
.flags
& BUCKET_SUSPENDED
) {
427 ldpp_dout(dpp
, 0) << "NOTICE: bucket " << bucket_info
.bucket
.name
428 << " is suspended" << dendl
;
429 return -ERR_USER_SUSPENDED
;
432 if (bucket
.name
.empty()) {
436 int ret
= rgw_op_get_bucket_policy_from_attr(dpp
, s
->cct
, store
, bucket_info
, bucket_attrs
, policy
, y
);
437 if (ret
== -ENOENT
) {
438 ret
= -ERR_NO_SUCH_BUCKET
;
444 static int read_obj_policy(const DoutPrefixProvider
*dpp
,
445 rgw::sal::RGWStore
*store
,
447 RGWBucketInfo
& bucket_info
,
448 map
<string
, bufferlist
>& bucket_attrs
,
449 RGWAccessControlPolicy
* acl
,
450 string
*storage_class
,
451 boost::optional
<Policy
>& policy
,
452 rgw::sal::RGWBucket
* bucket
,
453 rgw::sal::RGWObject
* object
,
458 upload_id
= s
->info
.args
.get("uploadId");
459 std::unique_ptr
<rgw::sal::RGWObject
> mpobj
;
462 if (!s
->system_request
&& bucket_info
.flags
& BUCKET_SUSPENDED
) {
463 ldpp_dout(dpp
, 0) << "NOTICE: bucket " << bucket_info
.bucket
.name
464 << " is suspended" << dendl
;
465 return -ERR_USER_SUSPENDED
;
468 // when getting policy info for copy-source obj, upload_id makes no sense.
469 // 'copy_src' is used to make this function backward compatible.
470 if (!upload_id
.empty() && !copy_src
) {
471 /* multipart upload */
472 RGWMPObj
mp(object
->get_name(), upload_id
);
473 string oid
= mp
.get_meta();
474 mpobj
= bucket
->get_object(rgw_obj_key(oid
, string(), mp_ns
));
475 mpobj
->set_in_extra_data(true);
476 object
= mpobj
.get();
478 policy
= get_iam_policy_from_attr(s
->cct
, bucket_attrs
, bucket
->get_tenant());
480 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
481 int ret
= get_obj_policy_from_attr(dpp
, s
->cct
, store
, *obj_ctx
,
482 bucket_info
, bucket_attrs
, acl
, storage_class
, object
, s
->yield
);
483 if (ret
== -ENOENT
) {
484 /* object does not exist checking the bucket's ACL to make sure
485 that we send a proper error code */
486 RGWAccessControlPolicy
bucket_policy(s
->cct
);
487 ret
= rgw_op_get_bucket_policy_from_attr(dpp
, s
->cct
, store
, bucket_info
, bucket_attrs
, &bucket_policy
, y
);
491 const rgw_user
& bucket_owner
= bucket_policy
.get_owner().get_id();
492 if (bucket_owner
.compare(s
->user
->get_id()) != 0 &&
493 ! s
->auth
.identity
->is_admin_of(bucket_owner
)) {
494 auto r
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
495 *s
->auth
.identity
, rgw::IAM::s3ListBucket
,
496 ARN(bucket
->get_key()));
497 if (r
== Effect::Allow
)
499 if (r
== Effect::Deny
)
502 r
= policy
->eval(s
->env
, *s
->auth
.identity
, rgw::IAM::s3ListBucket
, ARN(bucket
->get_key()));
503 if (r
== Effect::Allow
)
505 if (r
== Effect::Deny
)
508 if (! s
->session_policies
.empty()) {
509 r
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
510 *s
->auth
.identity
, rgw::IAM::s3ListBucket
,
511 ARN(bucket
->get_key()));
512 if (r
== Effect::Allow
)
514 if (r
== Effect::Deny
)
517 if (! bucket_policy
.verify_permission(s
, *s
->auth
.identity
, s
->perm_mask
, RGW_PERM_READ
))
530 * Get the AccessControlPolicy for an user, bucket or object off of disk.
531 * s: The req_state to draw information from.
532 * only_bucket: If true, reads the user and bucket ACLs rather than the object ACL.
533 * Returns: 0 on success, -ERR# otherwise.
535 int rgw_build_bucket_policies(const DoutPrefixProvider
*dpp
, rgw::sal::RGWRadosStore
* store
, struct req_state
* s
, optional_yield y
)
538 auto obj_ctx
= store
->svc()->sysobj
->init_obj_ctx();
540 string bi
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"bucket-instance");
542 // note: overwrites s->bucket_name, may include a tenant/
543 ret
= rgw_bucket_parse_bucket_instance(bi
, &s
->bucket_name
, &s
->bucket_instance_id
, &s
->bucket_instance_shard_id
);
549 if(s
->dialect
.compare("s3") == 0) {
550 s
->bucket_acl
= std::make_unique
<RGWAccessControlPolicy_S3
>(s
->cct
);
551 } else if(s
->dialect
.compare("swift") == 0) {
552 /* We aren't allocating the account policy for those operations using
553 * the Swift's infrastructure that don't really need req_state::user.
554 * Typical example here is the implementation of /info. */
555 if (!s
->user
->get_id().empty()) {
556 s
->user_acl
= std::make_unique
<RGWAccessControlPolicy_SWIFTAcct
>(s
->cct
);
558 s
->bucket_acl
= std::make_unique
<RGWAccessControlPolicy_SWIFT
>(s
->cct
);
560 s
->bucket_acl
= std::make_unique
<RGWAccessControlPolicy
>(s
->cct
);
563 /* check if copy source is within the current domain */
564 if (!s
->src_bucket_name
.empty()) {
565 std::unique_ptr
<rgw::sal::RGWBucket
> src_bucket
;
566 ret
= store
->get_bucket(dpp
, nullptr, s
->src_tenant_name
, s
->src_bucket_name
, &src_bucket
, y
);
568 ret
= src_bucket
->load_by_name(dpp
, s
->src_tenant_name
, s
->src_bucket_name
,
569 s
->bucket_instance_id
, &obj_ctx
, s
->yield
);
572 string
& zonegroup
= src_bucket
->get_info().zonegroup
;
573 s
->local_source
= store
->get_zonegroup().equals(zonegroup
);
579 std::string display_name
;
582 s
->user
->get_display_name(),
585 if (!s
->bucket_name
.empty()) {
586 s
->bucket_exists
= true;
588 ret
= store
->get_bucket(dpp
, s
->user
.get(), rgw_bucket(rgw_bucket_key(s
->bucket_tenant
, s
->bucket_name
, s
->bucket_instance_id
)), &s
->bucket
, y
);
590 if (ret
!= -ENOENT
) {
592 bucket_log
= rgw_make_bucket_entry_name(s
->bucket_tenant
, s
->bucket_name
);
593 ldpp_dout(dpp
, 0) << "NOTICE: couldn't get bucket from bucket_name (name="
594 << bucket_log
<< ")" << dendl
;
597 s
->bucket_exists
= false;
598 return -ERR_NO_SUCH_BUCKET
;
600 if (!rgw::sal::RGWObject::empty(s
->object
.get())) {
601 s
->object
->set_bucket(s
->bucket
.get());
604 s
->bucket_mtime
= s
->bucket
->get_modification_time();
605 s
->bucket_attrs
= s
->bucket
->get_attrs();
606 ret
= read_bucket_policy(dpp
, store
, s
, s
->bucket
->get_info(),
607 s
->bucket
->get_attrs(),
608 s
->bucket_acl
.get(), s
->bucket
->get_key(), y
);
610 s
->bucket
->get_info().owner
,
611 s
->bucket_acl
->get_owner().get_display_name(),
614 s
->bucket_owner
= s
->bucket_acl
->get_owner();
616 RGWZoneGroup zonegroup
;
617 int r
= store
->get_zonegroup(s
->bucket
->get_info().zonegroup
, zonegroup
);
619 if (!zonegroup
.endpoints
.empty()) {
620 s
->zonegroup_endpoint
= zonegroup
.endpoints
.front();
622 // use zonegroup's master zone endpoints
623 auto z
= zonegroup
.zones
.find(zonegroup
.master_zone
);
624 if (z
!= zonegroup
.zones
.end() && !z
->second
.endpoints
.empty()) {
625 s
->zonegroup_endpoint
= z
->second
.endpoints
.front();
628 s
->zonegroup_name
= zonegroup
.get_name();
630 if (r
< 0 && ret
== 0) {
634 if (!store
->get_zonegroup().equals(s
->bucket
->get_info().zonegroup
)) {
635 ldpp_dout(dpp
, 0) << "NOTICE: request for data in a different zonegroup ("
636 << s
->bucket
->get_info().zonegroup
<< " != "
637 << store
->get_zonegroup().get_id() << ")" << dendl
;
638 /* we now need to make sure that the operation actually requires copy source, that is
639 * it's a copy operation
641 if (store
->get_zonegroup().is_master_zonegroup() && s
->system_request
) {
642 /*If this is the master, don't redirect*/
643 } else if (s
->op_type
== RGW_OP_GET_BUCKET_LOCATION
) {
644 /* If op is get bucket location, don't redirect */
645 } else if (!s
->local_source
||
646 (s
->op
!= OP_PUT
&& s
->op
!= OP_COPY
) ||
647 rgw::sal::RGWObject::empty(s
->object
.get())) {
648 return -ERR_PERMANENT_REDIRECT
;
652 /* init dest placement */
653 s
->dest_placement
.storage_class
= s
->info
.storage_class
;
654 s
->dest_placement
.inherit_from(s
->bucket
->get_placement_rule());
656 if (!store
->svc()->zone
->get_zone_params().valid_placement(s
->dest_placement
)) {
657 ldpp_dout(dpp
, 0) << "NOTICE: invalid dest placement: " << s
->dest_placement
.to_str() << dendl
;
661 s
->bucket_access_conf
= get_public_access_conf_from_attr(s
->bucket
->get_attrs());
664 /* handle user ACL only for those APIs which support it */
666 map
<string
, bufferlist
> uattrs
;
667 ret
= store
->ctl()->user
->get_attrs_by_uid(dpp
, acct_acl_user
.uid
, &uattrs
, s
->yield
);
669 ret
= get_user_policy_from_attr(dpp
, s
->cct
, store
, uattrs
, *s
->user_acl
);
671 if (-ENOENT
== ret
) {
672 /* In already existing clusters users won't have ACL. In such case
673 * assuming that only account owner has the rights seems to be
674 * reasonable. That allows to have only one verification logic.
675 * NOTE: there is small compatibility kludge for global, empty tenant:
676 * 1. if we try to reach an existing bucket, its owner is considered
678 * 2. otherwise account owner is identity stored in s->user->user_id. */
679 s
->user_acl
->create_default(acct_acl_user
.uid
,
680 acct_acl_user
.display_name
);
682 } else if (ret
< 0) {
683 ldpp_dout(dpp
, 0) << "NOTICE: couldn't get user attrs for handling ACL "
684 "(user_id=" << s
->user
->get_id() << ", ret=" << ret
<< ")" << dendl
;
688 // We don't need user policies in case of STS token returned by AssumeRole,
689 // hence the check for user type
690 if (! s
->user
->get_id().empty() && s
->auth
.identity
->get_identity_type() != TYPE_ROLE
) {
692 map
<string
, bufferlist
> uattrs
;
693 if (ret
= store
->ctl()->user
->get_attrs_by_uid(dpp
, s
->user
->get_id(), &uattrs
, s
->yield
); ! ret
) {
694 auto user_policies
= get_iam_user_policy_from_attr(s
->cct
, store
, uattrs
, s
->user
->get_tenant());
695 s
->iam_user_policies
.insert(s
->iam_user_policies
.end(),
696 std::make_move_iterator(user_policies
.begin()),
697 std::make_move_iterator(user_policies
.end()));
703 } catch (const std::exception
& e
) {
704 ldpp_dout(dpp
, -1) << "Error reading IAM User Policy: " << e
.what() << dendl
;
710 s
->iam_policy
= get_iam_policy_from_attr(s
->cct
, s
->bucket_attrs
, s
->bucket_tenant
);
711 } catch (const std::exception
& e
) {
712 // Really this is a can't happen condition. We parse the policy
713 // when it's given to us, so perhaps we should abort or otherwise
714 // raise bloody murder.
715 ldpp_dout(dpp
, 0) << "Error reading IAM Policy: " << e
.what() << dendl
;
719 bool success
= store
->svc()->zone
->get_redirect_zone_endpoint(&s
->redirect_zone_endpoint
);
721 ldpp_dout(dpp
, 20) << "redirect_zone_endpoint=" << s
->redirect_zone_endpoint
<< dendl
;
728 * Get the AccessControlPolicy for a bucket or object off of disk.
729 * s: The req_state to draw information from.
730 * only_bucket: If true, reads the bucket ACL rather than the object ACL.
731 * Returns: 0 on success, -ERR# otherwise.
733 int rgw_build_object_policies(const DoutPrefixProvider
*dpp
, rgw::sal::RGWRadosStore
*store
, struct req_state
*s
,
734 bool prefetch_data
, optional_yield y
)
738 if (!rgw::sal::RGWObject::empty(s
->object
.get())) {
739 if (!s
->bucket_exists
) {
740 return -ERR_NO_SUCH_BUCKET
;
742 s
->object_acl
= std::make_unique
<RGWAccessControlPolicy
>(s
->cct
);
744 s
->object
->set_bucket(s
->bucket
.get());
746 s
->object
->set_atomic(s
->obj_ctx
);
748 s
->object
->set_prefetch_data(s
->obj_ctx
);
750 ret
= read_obj_policy(dpp
, store
, s
, s
->bucket
->get_info(), s
->bucket_attrs
,
751 s
->object_acl
.get(), nullptr, s
->iam_policy
, s
->bucket
.get(),
758 void rgw_add_to_iam_environment(rgw::IAM::Environment
& e
, std::string_view key
, std::string_view val
){
759 // This variant just adds non empty key pairs to IAM env., values can be empty
760 // in certain cases like tagging
765 static int rgw_iam_add_tags_from_bl(struct req_state
* s
, bufferlist
& bl
){
766 RGWObjTags
& tagset
= s
->tagset
;
768 auto bliter
= bl
.cbegin();
769 tagset
.decode(bliter
);
770 } catch (buffer::error
& err
) {
771 ldpp_dout(s
, 0) << "ERROR: caught buffer::error, couldn't decode TagSet" << dendl
;
775 for (const auto& tag
: tagset
.get_tags()){
776 rgw_add_to_iam_environment(s
->env
, "s3:ExistingObjectTag/" + tag
.first
, tag
.second
);
781 static int rgw_iam_add_existing_objtags(const DoutPrefixProvider
*dpp
, rgw::sal::RGWRadosStore
* store
, struct req_state
* s
, std::uint64_t action
) {
782 s
->object
->set_atomic(s
->obj_ctx
);
783 int op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, dpp
);
786 rgw::sal::RGWAttrs attrs
= s
->object
->get_attrs();
787 auto tags
= attrs
.find(RGW_ATTR_TAGS
);
788 if (tags
!= attrs
.end()){
789 return rgw_iam_add_tags_from_bl(s
, tags
->second
);
794 static void rgw_add_grant_to_iam_environment(rgw::IAM::Environment
& e
, struct req_state
*s
){
796 using header_pair_t
= std::pair
<const char*, const char*>;
797 static const std::initializer_list
<header_pair_t
> acl_header_conditionals
{
798 {"HTTP_X_AMZ_GRANT_READ", "s3:x-amz-grant-read"},
799 {"HTTP_X_AMZ_GRANT_WRITE", "s3:x-amz-grant-write"},
800 {"HTTP_X_AMZ_GRANT_READ_ACP", "s3:x-amz-grant-read-acp"},
801 {"HTTP_X_AMZ_GRANT_WRITE_ACP", "s3:x-amz-grant-write-acp"},
802 {"HTTP_X_AMZ_GRANT_FULL_CONTROL", "s3:x-amz-grant-full-control"}
805 if (s
->has_acl_header
){
806 for (const auto& c
: acl_header_conditionals
){
807 auto hdr
= s
->info
.env
->get(c
.first
);
815 void rgw_build_iam_environment(rgw::sal::RGWRadosStore
* store
,
818 const auto& m
= s
->info
.env
->get_map();
819 auto t
= ceph::real_clock::now();
820 s
->env
.emplace("aws:CurrentTime", std::to_string(ceph::real_clock::to_time_t(t
)));
821 s
->env
.emplace("aws:EpochTime", ceph::to_iso_8601(t
));
822 // TODO: This is fine for now, but once we have STS we'll need to
823 // look and see. Also this won't work with the IdentityApplier
824 // model, since we need to know the actual credential.
825 s
->env
.emplace("aws:PrincipalType", "User");
827 auto i
= m
.find("HTTP_REFERER");
829 s
->env
.emplace("aws:Referer", i
->second
);
832 if (rgw_transport_is_secure(s
->cct
, *s
->info
.env
)) {
833 s
->env
.emplace("aws:SecureTransport", "true");
836 const auto remote_addr_param
= s
->cct
->_conf
->rgw_remote_addr_param
;
837 if (remote_addr_param
.length()) {
838 i
= m
.find(remote_addr_param
);
840 i
= m
.find("REMOTE_ADDR");
843 const string
* ip
= &(i
->second
);
845 if (remote_addr_param
== "HTTP_X_FORWARDED_FOR") {
846 const auto comma
= ip
->find(',');
847 if (comma
!= string::npos
) {
848 temp
.assign(*ip
, 0, comma
);
852 s
->env
.emplace("aws:SourceIp", *ip
);
855 i
= m
.find("HTTP_USER_AGENT"); {
857 s
->env
.emplace("aws:UserAgent", i
->second
);
861 // What to do about aws::userid? One can have multiple access
862 // keys so that isn't really suitable. Do we have a durable
863 // identifier that can persist through name changes?
864 s
->env
.emplace("aws:username", s
->user
->get_id().id
);
867 i
= m
.find("HTTP_X_AMZ_SECURITY_TOKEN");
869 s
->env
.emplace("sts:authentication", "true");
871 s
->env
.emplace("sts:authentication", "false");
875 void rgw_bucket_object_pre_exec(struct req_state
*s
)
880 dump_bucket_from_state(s
);
883 // So! Now and then when we try to update bucket information, the
884 // bucket has changed during the course of the operation. (Or we have
885 // a cache consistency problem that Watch/Notify isn't ruling out
888 // When this happens, we need to update the bucket info and try
889 // again. We have, however, to try the right *part* again. We can't
890 // simply re-send, since that will obliterate the previous update.
892 // Thus, callers of this function should include everything that
893 // merges information to be changed into the bucket information as
894 // well as the call to set it.
896 // The called function must return an integer, negative on error. In
897 // general, they should just return op_ret.
900 int retry_raced_bucket_write(const DoutPrefixProvider
*dpp
, rgw::sal::RGWBucket
* b
, const F
& f
) {
902 for (auto i
= 0u; i
< 15u && r
== -ECANCELED
; ++i
) {
903 r
= b
->try_refresh_info(dpp
, nullptr);
913 int RGWGetObj::verify_permission(optional_yield y
)
915 s
->object
->set_atomic(s
->obj_ctx
);
917 if (prefetch_data()) {
918 s
->object
->set_prefetch_data(s
->obj_ctx
);
921 if (torrent
.get_flag()) {
922 if (s
->object
->get_instance().empty()) {
923 action
= rgw::IAM::s3GetObjectTorrent
;
925 action
= rgw::IAM::s3GetObjectVersionTorrent
;
928 if (s
->object
->get_instance().empty()) {
929 action
= rgw::IAM::s3GetObject
;
931 action
= rgw::IAM::s3GetObjectVersion
;
933 if (s
->iam_policy
&& s
->iam_policy
->has_partial_conditional(S3_EXISTING_OBJTAG
))
934 rgw_iam_add_existing_objtags(this, store
, s
, action
);
935 if (! s
->iam_user_policies
.empty()) {
936 for (auto& user_policy
: s
->iam_user_policies
) {
937 if (user_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
))
938 rgw_iam_add_existing_objtags(this, store
, s
, action
);
943 if (!verify_object_permission(this, s
, action
)) {
947 if (s
->bucket
->get_info().obj_lock_enabled()) {
948 get_retention
= verify_object_permission(this, s
, rgw::IAM::s3GetObjectRetention
);
949 get_legal_hold
= verify_object_permission(this, s
, rgw::IAM::s3GetObjectLegalHold
);
955 int RGWOp::verify_op_mask()
957 uint32_t required_mask
= op_mask();
959 ldpp_dout(this, 20) << "required_mask= " << required_mask
960 << " user.op_mask=" << s
->user
->get_info().op_mask
<< dendl
;
962 if ((s
->user
->get_info().op_mask
& required_mask
) != required_mask
) {
966 if (!s
->system_request
&& (required_mask
& RGW_OP_TYPE_MODIFY
) && !store
->svc()->zone
->zone_is_writeable()) {
967 ldpp_dout(this, 5) << "NOTICE: modify request to a read-only zone by a "
968 "non-system user, permission denied" << dendl
;
975 int RGWGetObjTags::verify_permission(optional_yield y
)
977 auto iam_action
= s
->object
->get_instance().empty()?
978 rgw::IAM::s3GetObjectTagging
:
979 rgw::IAM::s3GetObjectVersionTagging
;
980 // TODO since we are parsing the bl now anyway, we probably change
981 // the send_response function to accept RGWObjTag instead of a bl
982 if (s
->iam_policy
&& s
->iam_policy
->has_partial_conditional(S3_EXISTING_OBJTAG
)){
983 rgw_iam_add_existing_objtags(this, store
, s
, iam_action
);
985 if (! s
->iam_user_policies
.empty()) {
986 for (auto& user_policy
: s
->iam_user_policies
) {
987 if (user_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
)) {
988 rgw_iam_add_existing_objtags(this, store
, s
, iam_action
);
992 if (!verify_object_permission(this, s
,iam_action
))
998 void RGWGetObjTags::pre_exec()
1000 rgw_bucket_object_pre_exec(s
);
1003 void RGWGetObjTags::execute(optional_yield y
)
1005 rgw::sal::RGWAttrs attrs
;
1007 s
->object
->set_atomic(s
->obj_ctx
);
1009 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, y
, this);
1011 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << s
->object
1012 << " ret=" << op_ret
<< dendl
;
1016 attrs
= s
->object
->get_attrs();
1017 auto tags
= attrs
.find(RGW_ATTR_TAGS
);
1018 if(tags
!= attrs
.end()){
1020 tags_bl
.append(tags
->second
);
1022 send_response_data(tags_bl
);
1025 int RGWPutObjTags::verify_permission(optional_yield y
)
1027 auto iam_action
= s
->object
->get_instance().empty() ?
1028 rgw::IAM::s3PutObjectTagging
:
1029 rgw::IAM::s3PutObjectVersionTagging
;
1031 if(s
->iam_policy
&& s
->iam_policy
->has_partial_conditional(S3_EXISTING_OBJTAG
)){
1032 rgw_iam_add_existing_objtags(this, store
, s
, iam_action
);
1034 if (! s
->iam_user_policies
.empty()) {
1035 for (auto& user_policy
: s
->iam_user_policies
) {
1036 if (user_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
)) {
1037 rgw_iam_add_existing_objtags(this, store
, s
, iam_action
);
1041 if (!verify_object_permission(this, s
,iam_action
))
1046 void RGWPutObjTags::execute(optional_yield y
)
1048 op_ret
= get_params(y
);
1052 if (rgw::sal::RGWObject::empty(s
->object
.get())){
1053 op_ret
= -EINVAL
; // we only support tagging on existing objects
1057 s
->object
->set_atomic(s
->obj_ctx
);
1058 op_ret
= s
->object
->modify_obj_attrs(s
->obj_ctx
, RGW_ATTR_TAGS
, tags_bl
, y
, this);
1059 if (op_ret
== -ECANCELED
){
1060 op_ret
= -ERR_TAG_CONFLICT
;
1064 void RGWDeleteObjTags::pre_exec()
1066 rgw_bucket_object_pre_exec(s
);
1070 int RGWDeleteObjTags::verify_permission(optional_yield y
)
1072 if (!rgw::sal::RGWObject::empty(s
->object
.get())) {
1073 auto iam_action
= s
->object
->get_instance().empty() ?
1074 rgw::IAM::s3DeleteObjectTagging
:
1075 rgw::IAM::s3DeleteObjectVersionTagging
;
1077 if (s
->iam_policy
&& s
->iam_policy
->has_partial_conditional(S3_EXISTING_OBJTAG
)){
1078 rgw_iam_add_existing_objtags(this, store
, s
, iam_action
);
1080 if (! s
->iam_user_policies
.empty()) {
1081 for (auto& user_policy
: s
->iam_user_policies
) {
1082 if (user_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
)) {
1083 rgw_iam_add_existing_objtags(this, store
, s
, iam_action
);
1087 if (!verify_object_permission(this, s
, iam_action
))
1093 void RGWDeleteObjTags::execute(optional_yield y
)
1095 if (rgw::sal::RGWObject::empty(s
->object
.get()))
1098 op_ret
= s
->object
->delete_obj_attrs(this, s
->obj_ctx
, RGW_ATTR_TAGS
, y
);
1101 int RGWGetBucketTags::verify_permission(optional_yield y
)
1104 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketTagging
)) {
1111 void RGWGetBucketTags::pre_exec()
1113 rgw_bucket_object_pre_exec(s
);
1116 void RGWGetBucketTags::execute(optional_yield y
)
1118 auto iter
= s
->bucket_attrs
.find(RGW_ATTR_TAGS
);
1119 if (iter
!= s
->bucket_attrs
.end()) {
1121 tags_bl
.append(iter
->second
);
1123 op_ret
= -ERR_NO_SUCH_TAG_SET
;
1125 send_response_data(tags_bl
);
1128 int RGWPutBucketTags::verify_permission(optional_yield y
) {
1129 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketTagging
);
1132 void RGWPutBucketTags::execute(optional_yield y
)
1135 op_ret
= get_params(this, y
);
1139 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
1141 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
1144 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this, y
] {
1145 rgw::sal::RGWAttrs attrs
= s
->bucket
->get_attrs();
1146 attrs
[RGW_ATTR_TAGS
] = tags_bl
;
1147 return s
->bucket
->set_instance_attrs(this, attrs
, y
);
1152 void RGWDeleteBucketTags::pre_exec()
1154 rgw_bucket_object_pre_exec(s
);
1157 int RGWDeleteBucketTags::verify_permission(optional_yield y
)
1159 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketTagging
);
1162 void RGWDeleteBucketTags::execute(optional_yield y
)
1165 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
1167 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
1171 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this, y
] {
1172 rgw::sal::RGWAttrs attrs
= s
->bucket
->get_attrs();
1173 attrs
.erase(RGW_ATTR_TAGS
);
1174 op_ret
= s
->bucket
->set_instance_attrs(this, attrs
, y
);
1176 ldpp_dout(this, 0) << "RGWDeleteBucketTags() failed to remove RGW_ATTR_TAGS on bucket="
1177 << s
->bucket
->get_name()
1178 << " returned err= " << op_ret
<< dendl
;
1184 int RGWGetBucketReplication::verify_permission(optional_yield y
)
1186 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetReplicationConfiguration
)) {
1193 void RGWGetBucketReplication::pre_exec()
1195 rgw_bucket_object_pre_exec(s
);
1198 void RGWGetBucketReplication::execute(optional_yield y
)
1200 send_response_data();
1203 int RGWPutBucketReplication::verify_permission(optional_yield y
) {
1204 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutReplicationConfiguration
);
1207 void RGWPutBucketReplication::execute(optional_yield y
) {
1209 op_ret
= get_params(y
);
1213 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
1215 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
1219 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
1220 auto sync_policy
= (s
->bucket
->get_info().sync_policy
? *s
->bucket
->get_info().sync_policy
: rgw_sync_policy_info());
1222 for (auto& group
: sync_policy_groups
) {
1223 sync_policy
.groups
[group
.id
] = group
;
1226 s
->bucket
->get_info().set_sync_policy(std::move(sync_policy
));
1228 int ret
= s
->bucket
->put_instance_info(this, false, real_time());
1230 ldpp_dout(this, 0) << "ERROR: put_bucket_instance_info (bucket=" << s
->bucket
<< ") returned ret=" << ret
<< dendl
;
1238 void RGWDeleteBucketReplication::pre_exec()
1240 rgw_bucket_object_pre_exec(s
);
1243 int RGWDeleteBucketReplication::verify_permission(optional_yield y
)
1245 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3DeleteReplicationConfiguration
);
1248 void RGWDeleteBucketReplication::execute(optional_yield y
)
1251 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
1253 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
1257 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
1258 if (!s
->bucket
->get_info().sync_policy
) {
1262 rgw_sync_policy_info sync_policy
= *s
->bucket
->get_info().sync_policy
;
1264 update_sync_policy(&sync_policy
);
1266 s
->bucket
->get_info().set_sync_policy(std::move(sync_policy
));
1268 int ret
= s
->bucket
->put_instance_info(this, false, real_time());
1270 ldpp_dout(this, 0) << "ERROR: put_bucket_instance_info (bucket=" << s
->bucket
<< ") returned ret=" << ret
<< dendl
;
1278 int RGWOp::do_aws4_auth_completion()
1280 ldpp_dout(this, 5) << "NOTICE: call to do_aws4_auth_completion" << dendl
;
1281 if (s
->auth
.completer
) {
1282 if (!s
->auth
.completer
->complete()) {
1283 return -ERR_AMZ_CONTENT_SHA256_MISMATCH
;
1285 ldpp_dout(this, 10) << "v4 auth ok -- do_aws4_auth_completion" << dendl
;
1288 /* TODO(rzarzynski): yes, we're really called twice on PUTs. Only first
1289 * call passes, so we disable second one. This is old behaviour, sorry!
1290 * Plan for tomorrow: seek and destroy. */
1291 s
->auth
.completer
= nullptr;
1297 int RGWOp::init_quota()
1299 /* no quota enforcement for system requests */
1300 if (s
->system_request
)
1303 /* init quota related stuff */
1304 if (!(s
->user
->get_info().op_mask
& RGW_OP_TYPE_MODIFY
)) {
1308 /* only interested in object related ops */
1309 if (rgw::sal::RGWBucket::empty(s
->bucket
.get())
1310 || rgw::sal::RGWObject::empty(s
->object
.get())) {
1314 rgw::sal::RGWRadosUser
owner_user(store
, s
->bucket
->get_info().owner
);
1315 rgw::sal::RGWUser
* user
;
1317 if (s
->user
->get_id() == s
->bucket_owner
.get_id()) {
1318 user
= s
->user
.get();
1320 int r
= owner_user
.load_by_id(this, s
->yield
);
1326 if (s
->bucket
->get_info().quota
.enabled
) {
1327 bucket_quota
= s
->bucket
->get_info().quota
;
1328 } else if (user
->get_info().bucket_quota
.enabled
) {
1329 bucket_quota
= user
->get_info().bucket_quota
;
1331 bucket_quota
= store
->svc()->quota
->get_bucket_quota();
1334 if (user
->get_info().user_quota
.enabled
) {
1335 user_quota
= user
->get_info().user_quota
;
1337 user_quota
= store
->svc()->quota
->get_user_quota();
1343 static bool validate_cors_rule_method(RGWCORSRule
*rule
, const char *req_meth
) {
1347 dout(5) << "req_meth is null" << dendl
;
1351 if (strcmp(req_meth
, "GET") == 0) flags
= RGW_CORS_GET
;
1352 else if (strcmp(req_meth
, "POST") == 0) flags
= RGW_CORS_POST
;
1353 else if (strcmp(req_meth
, "PUT") == 0) flags
= RGW_CORS_PUT
;
1354 else if (strcmp(req_meth
, "DELETE") == 0) flags
= RGW_CORS_DELETE
;
1355 else if (strcmp(req_meth
, "HEAD") == 0) flags
= RGW_CORS_HEAD
;
1357 if (rule
->get_allowed_methods() & flags
) {
1358 dout(10) << "Method " << req_meth
<< " is supported" << dendl
;
1360 dout(5) << "Method " << req_meth
<< " is not supported" << dendl
;
1367 static bool validate_cors_rule_header(RGWCORSRule
*rule
, const char *req_hdrs
) {
1369 vector
<string
> hdrs
;
1370 get_str_vec(req_hdrs
, hdrs
);
1371 for (const auto& hdr
: hdrs
) {
1372 if (!rule
->is_header_allowed(hdr
.c_str(), hdr
.length())) {
1373 dout(5) << "Header " << hdr
<< " is not registered in this rule" << dendl
;
1381 int RGWOp::read_bucket_cors()
1385 map
<string
, bufferlist
>::iterator aiter
= s
->bucket_attrs
.find(RGW_ATTR_CORS
);
1386 if (aiter
== s
->bucket_attrs
.end()) {
1387 ldpp_dout(this, 20) << "no CORS configuration attr found" << dendl
;
1389 return 0; /* no CORS configuration found */
1396 auto iter
= bl
.cbegin();
1398 bucket_cors
.decode(iter
);
1399 } catch (buffer::error
& err
) {
1400 ldpp_dout(this, 0) << "ERROR: could not decode CORS, caught buffer::error" << dendl
;
1403 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
1404 RGWCORSConfiguration_S3
*s3cors
= static_cast<RGWCORSConfiguration_S3
*>(&bucket_cors
);
1405 ldpp_dout(this, 15) << "Read RGWCORSConfiguration";
1406 s3cors
->to_xml(*_dout
);
1413 * If any of the header field-names is not a ASCII case-insensitive match for
1414 * any of the values in list of headers do not set any additional headers and
1415 * terminate this set of steps.
1417 static void get_cors_response_headers(RGWCORSRule
*rule
, const char *req_hdrs
, string
& hdrs
, string
& exp_hdrs
, unsigned *max_age
) {
1420 get_str_list(req_hdrs
, hl
);
1421 for(list
<string
>::iterator it
= hl
.begin(); it
!= hl
.end(); ++it
) {
1422 if (!rule
->is_header_allowed((*it
).c_str(), (*it
).length())) {
1423 dout(5) << "Header " << (*it
) << " is not registered in this rule" << dendl
;
1425 if (hdrs
.length() > 0) hdrs
.append(",");
1430 rule
->format_exp_headers(exp_hdrs
);
1431 *max_age
= rule
->get_max_age();
1435 * Generate the CORS header response
1437 * This is described in the CORS standard, section 6.2.
1439 bool RGWOp::generate_cors_headers(string
& origin
, string
& method
, string
& headers
, string
& exp_headers
, unsigned *max_age
)
1442 const char *orig
= s
->info
.env
->get("HTTP_ORIGIN");
1449 int temp_op_ret
= read_bucket_cors();
1450 if (temp_op_ret
< 0) {
1451 op_ret
= temp_op_ret
;
1456 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
1461 RGWCORSRule
*rule
= bucket_cors
.host_name_rule(orig
);
1466 * Set the Allowed-Origin header to a asterisk if this is allowed in the rule
1467 * and no Authorization was send by the client
1469 * The origin parameter specifies a URI that may access the resource. The browser must enforce this.
1470 * For requests without credentials, the server may specify "*" as a wildcard,
1471 * thereby allowing any origin to access the resource.
1473 const char *authorization
= s
->info
.env
->get("HTTP_AUTHORIZATION");
1474 if (!authorization
&& rule
->has_wildcard_origin())
1478 const char *req_meth
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
1480 req_meth
= s
->info
.method
;
1486 if (!validate_cors_rule_method(rule
, req_meth
)) {
1492 const char *req_hdrs
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
1495 get_cors_response_headers(rule
, req_hdrs
, headers
, exp_headers
, max_age
);
1500 int RGWGetObj::read_user_manifest_part(rgw::sal::RGWBucket
* bucket
,
1501 const rgw_bucket_dir_entry
& ent
,
1502 RGWAccessControlPolicy
* const bucket_acl
,
1503 const boost::optional
<Policy
>& bucket_policy
,
1504 const off_t start_ofs
,
1505 const off_t end_ofs
,
1508 ldpp_dout(this, 20) << "user manifest obj=" << ent
.key
.name
1509 << "[" << ent
.key
.instance
<< "]" << dendl
;
1510 RGWGetObj_CB
cb(this);
1511 RGWGetObj_Filter
* filter
= &cb
;
1512 boost::optional
<RGWGetObj_Decompress
> decompress
;
1514 int64_t cur_ofs
= start_ofs
;
1515 int64_t cur_end
= end_ofs
;
1517 std::unique_ptr
<rgw::sal::RGWObject
> part
= bucket
->get_object(ent
.key
);
1519 RGWObjectCtx
obj_ctx(store
);
1520 RGWAccessControlPolicy
obj_policy(s
->cct
);
1522 ldpp_dout(this, 20) << "reading obj=" << part
<< " ofs=" << cur_ofs
1523 << " end=" << cur_end
<< dendl
;
1525 part
->set_atomic(&obj_ctx
);
1526 part
->set_prefetch_data(&obj_ctx
);
1528 std::unique_ptr
<rgw::sal::RGWObject::ReadOp
> read_op
= part
->get_read_op(&obj_ctx
);
1531 /* SLO etag is optional */
1532 read_op
->params
.if_match
= ent
.meta
.etag
.c_str();
1535 op_ret
= read_op
->prepare(s
->yield
, this);
1538 op_ret
= part
->range_to_ofs(ent
.meta
.accounted_size
, cur_ofs
, cur_end
);
1541 bool need_decompress
;
1542 op_ret
= rgw_compression_info_from_attrset(part
->get_attrs(), need_decompress
, cs_info
);
1544 ldpp_dout(this, 0) << "ERROR: failed to decode compression info" << dendl
;
1548 if (need_decompress
)
1550 if (cs_info
.orig_size
!= ent
.meta
.accounted_size
) {
1551 // hmm.. something wrong, object not as expected, abort!
1552 ldpp_dout(this, 0) << "ERROR: expected cs_info.orig_size=" << cs_info
.orig_size
1553 << ", actual read size=" << ent
.meta
.size
<< dendl
;
1556 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
1557 filter
= &*decompress
;
1561 if (part
->get_obj_size() != ent
.meta
.size
) {
1562 // hmm.. something wrong, object not as expected, abort!
1563 ldpp_dout(this, 0) << "ERROR: expected obj_size=" << part
->get_obj_size()
1564 << ", actual read size=" << ent
.meta
.size
<< dendl
;
1569 op_ret
= rgw_policy_from_attrset(s
, s
->cct
, part
->get_attrs(), &obj_policy
);
1573 /* We can use global user_acl because LOs cannot have segments
1574 * stored inside different accounts. */
1575 if (s
->system_request
) {
1576 ldpp_dout(this, 2) << "overriding permissions due to system operation" << dendl
;
1577 } else if (s
->auth
.identity
->is_admin_of(s
->user
->get_id())) {
1578 ldpp_dout(this, 2) << "overriding permissions due to admin operation" << dendl
;
1579 } else if (!verify_object_permission(this, s
, part
->get_obj(), s
->user_acl
.get(),
1580 bucket_acl
, &obj_policy
, bucket_policy
,
1581 s
->iam_user_policies
, s
->session_policies
, action
)) {
1584 if (ent
.meta
.size
== 0) {
1588 perfcounter
->inc(l_rgw_get_b
, cur_end
- cur_ofs
);
1589 filter
->fixup_range(cur_ofs
, cur_end
);
1590 op_ret
= read_op
->iterate(this, cur_ofs
, cur_end
, filter
, s
->yield
);
1592 op_ret
= filter
->flush();
1596 static int iterate_user_manifest_parts(const DoutPrefixProvider
*dpp
,
1597 CephContext
* const cct
,
1598 rgw::sal::RGWStore
* const store
,
1601 rgw::sal::RGWBucket
* bucket
,
1602 const string
& obj_prefix
,
1603 RGWAccessControlPolicy
* const bucket_acl
,
1604 const boost::optional
<Policy
>& bucket_policy
,
1605 uint64_t * const ptotal_len
,
1606 uint64_t * const pobj_size
,
1607 string
* const pobj_sum
,
1608 int (*cb
)(rgw::sal::RGWBucket
* bucket
,
1609 const rgw_bucket_dir_entry
& ent
,
1610 RGWAccessControlPolicy
* const bucket_acl
,
1611 const boost::optional
<Policy
>& bucket_policy
,
1616 void * const cb_param
,
1619 uint64_t obj_ofs
= 0, len_count
= 0;
1620 bool found_start
= false, found_end
= false, handled_end
= false;
1623 utime_t start_time
= ceph_clock_now();
1625 rgw::sal::RGWBucket::ListParams params
;
1626 params
.prefix
= obj_prefix
;
1627 params
.delim
= delim
;
1629 rgw::sal::RGWBucket::ListResults results
;
1632 static constexpr auto MAX_LIST_OBJS
= 100u;
1633 int r
= bucket
->list(dpp
, params
, MAX_LIST_OBJS
, results
, y
);
1638 for (rgw_bucket_dir_entry
& ent
: results
.objs
) {
1639 const uint64_t cur_total_len
= obj_ofs
;
1640 const uint64_t obj_size
= ent
.meta
.accounted_size
;
1641 uint64_t start_ofs
= 0, end_ofs
= obj_size
;
1643 if ((ptotal_len
|| cb
) && !found_start
&& cur_total_len
+ obj_size
> (uint64_t)ofs
) {
1644 start_ofs
= ofs
- obj_ofs
;
1648 obj_ofs
+= obj_size
;
1650 etag_sum
.Update((const unsigned char *)ent
.meta
.etag
.c_str(),
1651 ent
.meta
.etag
.length());
1654 if ((ptotal_len
|| cb
) && !found_end
&& obj_ofs
> (uint64_t)end
) {
1655 end_ofs
= end
- cur_total_len
+ 1;
1659 perfcounter
->tinc(l_rgw_get_lat
,
1660 (ceph_clock_now() - start_time
));
1662 if (found_start
&& !handled_end
) {
1663 len_count
+= end_ofs
- start_ofs
;
1666 r
= cb(bucket
, ent
, bucket_acl
, bucket_policy
, start_ofs
, end_ofs
,
1667 cb_param
, false /* swift_slo */);
1674 handled_end
= found_end
;
1675 start_time
= ceph_clock_now();
1677 } while (results
.is_truncated
);
1680 *ptotal_len
= len_count
;
1683 *pobj_size
= obj_ofs
;
1686 complete_etag(etag_sum
, pobj_sum
);
1692 struct rgw_slo_part
{
1693 RGWAccessControlPolicy
*bucket_acl
= nullptr;
1694 Policy
* bucket_policy
= nullptr;
1695 rgw::sal::RGWBucket
* bucket
;
1701 static int iterate_slo_parts(CephContext
*cct
,
1702 rgw::sal::RGWStore
*store
,
1705 map
<uint64_t, rgw_slo_part
>& slo_parts
,
1706 int (*cb
)(rgw::sal::RGWBucket
* bucket
,
1707 const rgw_bucket_dir_entry
& ent
,
1708 RGWAccessControlPolicy
*bucket_acl
,
1709 const boost::optional
<Policy
>& bucket_policy
,
1716 bool found_start
= false, found_end
= false;
1718 if (slo_parts
.empty()) {
1722 utime_t start_time
= ceph_clock_now();
1724 map
<uint64_t, rgw_slo_part
>::iterator iter
= slo_parts
.upper_bound(ofs
);
1725 if (iter
!= slo_parts
.begin()) {
1729 uint64_t obj_ofs
= iter
->first
;
1731 for (; iter
!= slo_parts
.end() && !found_end
; ++iter
) {
1732 rgw_slo_part
& part
= iter
->second
;
1733 rgw_bucket_dir_entry ent
;
1735 ent
.key
.name
= part
.obj_name
;
1736 ent
.meta
.accounted_size
= ent
.meta
.size
= part
.size
;
1737 ent
.meta
.etag
= part
.etag
;
1739 uint64_t cur_total_len
= obj_ofs
;
1740 uint64_t start_ofs
= 0, end_ofs
= ent
.meta
.size
- 1;
1742 if (!found_start
&& cur_total_len
+ ent
.meta
.size
> (uint64_t)ofs
) {
1743 start_ofs
= ofs
- obj_ofs
;
1747 obj_ofs
+= ent
.meta
.size
;
1749 if (!found_end
&& obj_ofs
> (uint64_t)end
) {
1750 end_ofs
= end
- cur_total_len
;
1754 perfcounter
->tinc(l_rgw_get_lat
,
1755 (ceph_clock_now() - start_time
));
1759 dout(20) << "iterate_slo_parts()"
1760 << " obj=" << part
.obj_name
1761 << " start_ofs=" << start_ofs
1762 << " end_ofs=" << end_ofs
1765 // SLO is a Swift thing, and Swift has no knowledge of S3 Policies.
1766 int r
= cb(part
.bucket
, ent
, part
.bucket_acl
,
1767 (part
.bucket_policy
?
1768 boost::optional
<Policy
>(*part
.bucket_policy
) : none
),
1769 start_ofs
, end_ofs
, cb_param
, true /* swift_slo */);
1775 start_time
= ceph_clock_now();
1781 static int get_obj_user_manifest_iterate_cb(rgw::sal::RGWBucket
* bucket
,
1782 const rgw_bucket_dir_entry
& ent
,
1783 RGWAccessControlPolicy
* const bucket_acl
,
1784 const boost::optional
<Policy
>& bucket_policy
,
1785 const off_t start_ofs
,
1786 const off_t end_ofs
,
1788 bool swift_slo
= false)
1790 RGWGetObj
*op
= static_cast<RGWGetObj
*>(param
);
1791 return op
->read_user_manifest_part(
1792 bucket
, ent
, bucket_acl
, bucket_policy
, start_ofs
, end_ofs
, swift_slo
);
1795 int RGWGetObj::handle_user_manifest(const char *prefix
, optional_yield y
)
1797 const std::string_view
prefix_view(prefix
);
1798 ldpp_dout(this, 2) << "RGWGetObj::handle_user_manifest() prefix="
1799 << prefix_view
<< dendl
;
1801 const size_t pos
= prefix_view
.find('/');
1802 if (pos
== string::npos
) {
1806 const std::string bucket_name
= url_decode(prefix_view
.substr(0, pos
));
1807 const std::string obj_prefix
= url_decode(prefix_view
.substr(pos
+ 1));
1809 RGWAccessControlPolicy
_bucket_acl(s
->cct
);
1810 RGWAccessControlPolicy
*bucket_acl
;
1811 boost::optional
<Policy
> _bucket_policy
;
1812 boost::optional
<Policy
>* bucket_policy
;
1813 RGWBucketInfo bucket_info
;
1814 std::unique_ptr
<rgw::sal::RGWBucket
> ubucket
;
1815 rgw::sal::RGWBucket
*pbucket
= NULL
;
1818 if (bucket_name
.compare(s
->bucket
->get_name()) != 0) {
1819 map
<string
, bufferlist
> bucket_attrs
;
1820 r
= store
->get_bucket(this, s
->user
.get(), s
->user
->get_tenant(), bucket_name
, &ubucket
, y
);
1822 ldpp_dout(this, 0) << "could not get bucket info for bucket="
1823 << bucket_name
<< dendl
;
1826 bucket_acl
= &_bucket_acl
;
1827 r
= read_bucket_policy(this, store
, s
, ubucket
->get_info(), bucket_attrs
, bucket_acl
, ubucket
->get_key(), y
);
1829 ldpp_dout(this, 0) << "failed to read bucket policy" << dendl
;
1832 _bucket_policy
= get_iam_policy_from_attr(s
->cct
, bucket_attrs
, s
->user
->get_tenant());
1833 bucket_policy
= &_bucket_policy
;
1834 pbucket
= ubucket
.get();
1836 pbucket
= s
->bucket
.get();
1837 bucket_acl
= s
->bucket_acl
.get();
1838 bucket_policy
= &s
->iam_policy
;
1841 /* dry run to find out:
1842 * - total length (of the parts we are going to send to client),
1843 * - overall DLO's content size,
1844 * - md5 sum of overall DLO's content (for etag of Swift API). */
1845 r
= iterate_user_manifest_parts(this, s
->cct
, store
, ofs
, end
,
1846 pbucket
, obj_prefix
, bucket_acl
, *bucket_policy
,
1847 nullptr, &s
->obj_size
, &lo_etag
,
1848 nullptr /* cb */, nullptr /* cb arg */, y
);
1852 s
->object
->set_obj_size(s
->obj_size
);
1854 r
= RGWRados::Object::Read::range_to_ofs(s
->obj_size
, ofs
, end
);
1859 r
= iterate_user_manifest_parts(this, s
->cct
, store
, ofs
, end
,
1860 pbucket
, obj_prefix
, bucket_acl
, *bucket_policy
,
1861 &total_len
, nullptr, nullptr,
1862 nullptr, nullptr, y
);
1869 send_response_data(bl
, 0, 0);
1873 r
= iterate_user_manifest_parts(this, s
->cct
, store
, ofs
, end
,
1874 pbucket
, obj_prefix
, bucket_acl
, *bucket_policy
,
1875 nullptr, nullptr, nullptr,
1876 get_obj_user_manifest_iterate_cb
, (void *)this, y
);
1883 send_response_data(bl
, 0, 0);
1889 int RGWGetObj::handle_slo_manifest(bufferlist
& bl
, optional_yield y
)
1891 RGWSLOInfo slo_info
;
1892 auto bliter
= bl
.cbegin();
1894 decode(slo_info
, bliter
);
1895 } catch (buffer::error
& err
) {
1896 ldpp_dout(this, 0) << "ERROR: failed to decode slo manifest" << dendl
;
1899 ldpp_dout(this, 2) << "RGWGetObj::handle_slo_manifest()" << dendl
;
1901 vector
<RGWAccessControlPolicy
> allocated_acls
;
1902 map
<string
, pair
<RGWAccessControlPolicy
*, boost::optional
<Policy
>>> policies
;
1903 map
<string
, std::unique_ptr
<rgw::sal::RGWBucket
>> buckets
;
1905 map
<uint64_t, rgw_slo_part
> slo_parts
;
1910 for (const auto& entry
: slo_info
.entries
) {
1911 const string
& path
= entry
.path
;
1913 /* If the path starts with slashes, strip them all. */
1914 const size_t pos_init
= path
.find_first_not_of('/');
1915 /* According to the documentation of std::string::find following check
1916 * is not necessary as we should get the std::string::npos propagation
1917 * here. This might be true with the accuracy to implementation's bugs.
1918 * See following question on SO:
1919 * http://stackoverflow.com/questions/1011790/why-does-stdstring-findtext-stdstringnpos-not-return-npos
1921 if (pos_init
== string::npos
) {
1925 const size_t pos_sep
= path
.find('/', pos_init
);
1926 if (pos_sep
== string::npos
) {
1930 string bucket_name
= path
.substr(pos_init
, pos_sep
- pos_init
);
1931 string obj_name
= path
.substr(pos_sep
+ 1);
1933 rgw::sal::RGWBucket
* bucket
;
1934 RGWAccessControlPolicy
*bucket_acl
;
1935 Policy
* bucket_policy
;
1937 if (bucket_name
.compare(s
->bucket
->get_name()) != 0) {
1938 const auto& piter
= policies
.find(bucket_name
);
1939 if (piter
!= policies
.end()) {
1940 bucket_acl
= piter
->second
.first
;
1941 bucket_policy
= piter
->second
.second
.get_ptr();
1942 bucket
= buckets
[bucket_name
].get();
1944 allocated_acls
.push_back(RGWAccessControlPolicy(s
->cct
));
1945 RGWAccessControlPolicy
& _bucket_acl
= allocated_acls
.back();
1947 std::unique_ptr
<rgw::sal::RGWBucket
> tmp_bucket
;
1948 auto obj_ctx
= store
->svc()->sysobj
->init_obj_ctx();
1949 int r
= store
->get_bucket(this, s
->user
.get(), s
->user
->get_tenant(), bucket_name
, &tmp_bucket
, y
);
1951 ldpp_dout(this, 0) << "could not get bucket info for bucket="
1952 << bucket_name
<< dendl
;
1955 bucket
= tmp_bucket
.get();
1956 bucket_acl
= &_bucket_acl
;
1957 r
= read_bucket_policy(this, store
, s
, tmp_bucket
->get_info(), tmp_bucket
->get_attrs(), bucket_acl
,
1958 tmp_bucket
->get_key(), y
);
1960 ldpp_dout(this, 0) << "failed to read bucket ACL for bucket "
1964 auto _bucket_policy
= get_iam_policy_from_attr(
1965 s
->cct
, tmp_bucket
->get_attrs(), tmp_bucket
->get_tenant());
1966 bucket_policy
= _bucket_policy
.get_ptr();
1967 buckets
[bucket_name
].swap(tmp_bucket
);
1968 policies
[bucket_name
] = make_pair(bucket_acl
, _bucket_policy
);
1971 bucket
= s
->bucket
.get();
1972 bucket_acl
= s
->bucket_acl
.get();
1973 bucket_policy
= s
->iam_policy
.get_ptr();
1977 part
.bucket_acl
= bucket_acl
;
1978 part
.bucket_policy
= bucket_policy
;
1979 part
.bucket
= bucket
;
1980 part
.obj_name
= obj_name
;
1981 part
.size
= entry
.size_bytes
;
1982 part
.etag
= entry
.etag
;
1983 ldpp_dout(this, 20) << "slo_part: bucket=" << part
.bucket
1984 << " obj=" << part
.obj_name
1985 << " size=" << part
.size
1986 << " etag=" << part
.etag
1989 etag_sum
.Update((const unsigned char *)entry
.etag
.c_str(),
1990 entry
.etag
.length());
1992 slo_parts
[total_len
] = part
;
1993 total_len
+= part
.size
;
1994 } /* foreach entry */
1996 complete_etag(etag_sum
, &lo_etag
);
1998 s
->obj_size
= slo_info
.total_size
;
1999 s
->object
->set_obj_size(slo_info
.total_size
);
2000 ldpp_dout(this, 20) << "s->obj_size=" << s
->obj_size
<< dendl
;
2002 int r
= RGWRados::Object::Read::range_to_ofs(total_len
, ofs
, end
);
2007 total_len
= end
- ofs
+ 1;
2008 ldpp_dout(this, 20) << "Requested: ofs=" << ofs
2010 << " total=" << total_len
2013 r
= iterate_slo_parts(s
->cct
, store
, ofs
, end
, slo_parts
,
2014 get_obj_user_manifest_iterate_cb
, (void *)this);
2022 int RGWGetObj::get_data_cb(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
)
2024 /* garbage collection related handling:
2025 * defer_gc disabled for https://tracker.ceph.com/issues/47866 */
2026 return send_response_data(bl
, bl_ofs
, bl_len
);
2029 bool RGWGetObj::prefetch_data()
2031 /* HEAD request, stop prefetch*/
2032 if (!get_data
|| s
->info
.env
->exists("HTTP_X_RGW_AUTH")) {
2036 range_str
= s
->info
.env
->get("HTTP_RANGE");
2037 // TODO: add range prefetch
2046 void RGWGetObj::pre_exec()
2048 rgw_bucket_object_pre_exec(s
);
2051 static inline void rgw_cond_decode_objtags(
2052 struct req_state
*s
,
2053 const std::map
<std::string
, buffer::list
> &attrs
)
2055 const auto& tags
= attrs
.find(RGW_ATTR_TAGS
);
2056 if (tags
!= attrs
.end()) {
2058 bufferlist::const_iterator iter
{&tags
->second
};
2059 s
->tagset
.decode(iter
);
2060 } catch (buffer::error
& err
) {
2062 << "ERROR: caught buffer::error, couldn't decode TagSet" << dendl
;
2067 void RGWGetObj::execute(optional_yield y
)
2070 gc_invalidate_time
= ceph_clock_now();
2071 gc_invalidate_time
+= (s
->cct
->_conf
->rgw_gc_obj_min_wait
/ 2);
2073 bool need_decompress
;
2074 int64_t ofs_x
, end_x
;
2076 RGWGetObj_CB
cb(this);
2077 RGWGetObj_Filter
* filter
= (RGWGetObj_Filter
*)&cb
;
2078 boost::optional
<RGWGetObj_Decompress
> decompress
;
2079 std::unique_ptr
<RGWGetObj_Filter
> decrypt
;
2080 map
<string
, bufferlist
>::iterator attr_iter
;
2082 perfcounter
->inc(l_rgw_get
);
2084 std::unique_ptr
<rgw::sal::RGWObject::ReadOp
> read_op(s
->object
->get_read_op(s
->obj_ctx
));
2086 op_ret
= get_params(y
);
2090 op_ret
= init_common();
2094 read_op
->params
.mod_ptr
= mod_ptr
;
2095 read_op
->params
.unmod_ptr
= unmod_ptr
;
2096 read_op
->params
.high_precision_time
= s
->system_request
; /* system request need to use high precision time */
2097 read_op
->params
.mod_zone_id
= mod_zone_id
;
2098 read_op
->params
.mod_pg_ver
= mod_pg_ver
;
2099 read_op
->params
.if_match
= if_match
;
2100 read_op
->params
.if_nomatch
= if_nomatch
;
2101 read_op
->params
.lastmod
= &lastmod
;
2103 op_ret
= read_op
->prepare(s
->yield
, this);
2106 version_id
= s
->object
->get_instance();
2107 s
->obj_size
= s
->object
->get_obj_size();
2108 attrs
= s
->object
->get_attrs();
2110 /* STAT ops don't need data, and do no i/o */
2111 if (get_type() == RGW_OP_STAT_OBJ
) {
2114 if (s
->info
.env
->exists("HTTP_X_RGW_AUTH")) {
2118 /* start gettorrent */
2119 if (torrent
.get_flag())
2121 attr_iter
= attrs
.find(RGW_ATTR_CRYPT_MODE
);
2122 if (attr_iter
!= attrs
.end() && attr_iter
->second
.to_str() == "SSE-C-AES256") {
2123 ldpp_dout(this, 0) << "ERROR: torrents are not supported for objects "
2124 "encrypted with SSE-C" << dendl
;
2128 torrent
.init(s
, store
);
2129 rgw_obj obj
= s
->object
->get_obj();
2130 op_ret
= torrent
.get_torrent_file(s
->object
.get(), total_len
, bl
, obj
);
2133 ldpp_dout(this, 0) << "ERROR: failed to get_torrent_file ret= " << op_ret
2137 op_ret
= send_response_data(bl
, 0, total_len
);
2140 ldpp_dout(this, 0) << "ERROR: failed to send_response_data ret= " << op_ret
<< dendl
;
2145 /* end gettorrent */
2147 op_ret
= rgw_compression_info_from_attrset(attrs
, need_decompress
, cs_info
);
2149 ldpp_dout(this, 0) << "ERROR: failed to decode compression info, cannot decompress" << dendl
;
2152 if (need_decompress
) {
2153 s
->obj_size
= cs_info
.orig_size
;
2154 s
->object
->set_obj_size(cs_info
.orig_size
);
2155 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
2156 filter
= &*decompress
;
2159 attr_iter
= attrs
.find(RGW_ATTR_USER_MANIFEST
);
2160 if (attr_iter
!= attrs
.end() && !skip_manifest
) {
2161 op_ret
= handle_user_manifest(attr_iter
->second
.c_str(), y
);
2163 ldpp_dout(this, 0) << "ERROR: failed to handle user manifest ret="
2170 attr_iter
= attrs
.find(RGW_ATTR_SLO_MANIFEST
);
2171 if (attr_iter
!= attrs
.end() && !skip_manifest
) {
2173 op_ret
= handle_slo_manifest(attr_iter
->second
, y
);
2175 ldpp_dout(this, 0) << "ERROR: failed to handle slo manifest ret=" << op_ret
2182 // for range requests with obj size 0
2183 if (range_str
&& !(s
->obj_size
)) {
2189 op_ret
= s
->object
->range_to_ofs(s
->obj_size
, ofs
, end
);
2192 total_len
= (ofs
<= end
? end
+ 1 - ofs
: 0);
2194 /* Check whether the object has expired. Swift API documentation
2195 * stands that we should return 404 Not Found in such case. */
2196 if (need_object_expiration() && s
->object
->is_expired()) {
2201 /* Decode S3 objtags, if any */
2202 rgw_cond_decode_objtags(s
, attrs
);
2206 attr_iter
= attrs
.find(RGW_ATTR_MANIFEST
);
2207 op_ret
= this->get_decrypt_filter(&decrypt
, filter
,
2208 attr_iter
!= attrs
.end() ? &(attr_iter
->second
) : nullptr);
2209 if (decrypt
!= nullptr) {
2210 filter
= decrypt
.get();
2216 if (!get_data
|| ofs
> end
) {
2217 send_response_data(bl
, 0, 0);
2221 perfcounter
->inc(l_rgw_get_b
, end
- ofs
);
2225 filter
->fixup_range(ofs_x
, end_x
);
2226 op_ret
= read_op
->iterate(this, ofs_x
, end_x
, filter
, s
->yield
);
2229 op_ret
= filter
->flush();
2231 perfcounter
->tinc(l_rgw_get_lat
, s
->time_elapsed());
2236 op_ret
= send_response_data(bl
, 0, 0);
2243 send_response_data_error(y
);
2246 int RGWGetObj::init_common()
2249 /* range parsed error when prefetch */
2250 if (!range_parsed
) {
2251 int r
= parse_range();
2257 if (parse_time(if_mod
, &mod_time
) < 0)
2259 mod_ptr
= &mod_time
;
2263 if (parse_time(if_unmod
, &unmod_time
) < 0)
2265 unmod_ptr
= &unmod_time
;
2271 int RGWListBuckets::verify_permission(optional_yield y
)
2273 rgw::Partition partition
= rgw::Partition::aws
;
2274 rgw::Service service
= rgw::Service::s3
;
2277 if (s
->auth
.identity
->get_identity_type() == TYPE_ROLE
) {
2278 tenant
= s
->auth
.identity
->get_role_tenant();
2280 tenant
= s
->user
->get_tenant();
2283 if (!verify_user_permission(this, s
, ARN(partition
, service
, "", tenant
, "*"), rgw::IAM::s3ListAllMyBuckets
)) {
2290 int RGWGetUsage::verify_permission(optional_yield y
)
2292 if (s
->auth
.identity
->is_anonymous()) {
2299 void RGWListBuckets::execute(optional_yield y
)
2302 bool started
= false;
2303 uint64_t total_count
= 0;
2305 const uint64_t max_buckets
= s
->cct
->_conf
->rgw_list_buckets_max_chunk
;
2307 op_ret
= get_params(y
);
2312 if (supports_account_metadata()) {
2313 op_ret
= store
->ctl()->user
->get_attrs_by_uid(this, s
->user
->get_id(), &attrs
, s
->yield
);
2319 is_truncated
= false;
2321 rgw::sal::RGWBucketList buckets
;
2322 uint64_t read_count
;
2324 read_count
= min(limit
- total_count
, max_buckets
);
2326 read_count
= max_buckets
;
2329 op_ret
= s
->user
->list_buckets(this, marker
, end_marker
, read_count
, should_get_stats(), buckets
, y
);
2332 /* hmm.. something wrong here.. the user was authenticated, so it
2334 ldpp_dout(this, 10) << "WARNING: failed on rgw_get_user_buckets uid="
2335 << s
->user
->get_id() << dendl
;
2339 /* We need to have stats for all our policies - even if a given policy
2340 * isn't actually used in a given account. In such situation its usage
2341 * stats would be simply full of zeros. */
2342 for (const auto& policy
: store
->get_zonegroup().placement_targets
) {
2343 policies_stats
.emplace(policy
.second
.name
,
2344 decltype(policies_stats
)::mapped_type());
2347 std::map
<std::string
, std::unique_ptr
<rgw::sal::RGWBucket
>>& m
= buckets
.get_buckets();
2348 for (const auto& kv
: m
) {
2349 const auto& bucket
= kv
.second
;
2351 global_stats
.bytes_used
+= bucket
->get_size();
2352 global_stats
.bytes_used_rounded
+= bucket
->get_size_rounded();
2353 global_stats
.objects_count
+= bucket
->get_count();
2355 /* operator[] still can create a new entry for storage policy seen
2356 * for first time. */
2357 auto& policy_stats
= policies_stats
[bucket
->get_placement_rule().to_str()];
2358 policy_stats
.bytes_used
+= bucket
->get_size();
2359 policy_stats
.bytes_used_rounded
+= bucket
->get_size_rounded();
2360 policy_stats
.buckets_count
++;
2361 policy_stats
.objects_count
+= bucket
->get_count();
2363 global_stats
.buckets_count
+= m
.size();
2364 total_count
+= m
.size();
2366 done
= (m
.size() < read_count
|| (limit
>= 0 && total_count
>= (uint64_t)limit
));
2369 send_response_begin(buckets
.count() > 0);
2373 if (read_count
> 0 &&
2375 auto riter
= m
.rbegin();
2376 marker
= riter
->first
;
2378 handle_listing_chunk(std::move(buckets
));
2380 } while (is_truncated
&& !done
);
2384 send_response_begin(false);
2386 send_response_end();
2389 void RGWGetUsage::execute(optional_yield y
)
2391 uint64_t start_epoch
= 0;
2392 uint64_t end_epoch
= (uint64_t)-1;
2393 op_ret
= get_params(y
);
2397 if (!start_date
.empty()) {
2398 op_ret
= utime_t::parse_date(start_date
, &start_epoch
, NULL
);
2400 ldpp_dout(this, 0) << "ERROR: failed to parse start date" << dendl
;
2405 if (!end_date
.empty()) {
2406 op_ret
= utime_t::parse_date(end_date
, &end_epoch
, NULL
);
2408 ldpp_dout(this, 0) << "ERROR: failed to parse end date" << dendl
;
2413 uint32_t max_entries
= 1000;
2415 bool is_truncated
= true;
2417 RGWUsageIter usage_iter
;
2419 while (s
->bucket
&& is_truncated
) {
2420 op_ret
= s
->bucket
->read_usage(this, start_epoch
, end_epoch
, max_entries
, &is_truncated
,
2422 if (op_ret
== -ENOENT
) {
2424 is_truncated
= false;
2432 op_ret
= rgw_user_sync_all_stats(this, store
, s
->user
->get_id(), y
);
2434 ldpp_dout(this, 0) << "ERROR: failed to sync user stats" << dendl
;
2438 op_ret
= rgw_user_get_all_buckets_stats(this, store
, s
->user
->get_id(), buckets_usage
, y
);
2440 ldpp_dout(this, 0) << "ERROR: failed to get user's buckets stats" << dendl
;
2444 op_ret
= store
->ctl()->user
->read_stats(this, s
->user
->get_id(), &stats
, y
);
2446 ldpp_dout(this, 0) << "ERROR: can't read user header" << dendl
;
2453 int RGWStatAccount::verify_permission(optional_yield y
)
2455 if (!verify_user_permission_no_policy(this, s
, RGW_PERM_READ
)) {
2462 void RGWStatAccount::execute(optional_yield y
)
2465 rgw::sal::RGWBucketList buckets
;
2466 uint64_t max_buckets
= s
->cct
->_conf
->rgw_list_buckets_max_chunk
;
2467 const string
*lastmarker
;
2471 lastmarker
= nullptr;
2472 op_ret
= rgw_read_user_buckets(this, store
, s
->user
->get_id(), buckets
, marker
,
2473 string(), max_buckets
, true, y
);
2475 /* hmm.. something wrong here.. the user was authenticated, so it
2477 ldpp_dout(this, 10) << "WARNING: failed on rgw_read_user_buckets uid="
2478 << s
->user
->get_id() << " ret=" << op_ret
<< dendl
;
2481 /* We need to have stats for all our policies - even if a given policy
2482 * isn't actually used in a given account. In such situation its usage
2483 * stats would be simply full of zeros. */
2484 for (const auto& policy
: store
->get_zonegroup().placement_targets
) {
2485 policies_stats
.emplace(policy
.second
.name
,
2486 decltype(policies_stats
)::mapped_type());
2489 std::map
<std::string
, std::unique_ptr
<rgw::sal::RGWBucket
>>& m
= buckets
.get_buckets();
2490 for (const auto& kv
: m
) {
2491 const auto& bucket
= kv
.second
;
2492 lastmarker
= &kv
.first
;
2494 global_stats
.bytes_used
+= bucket
->get_size();
2495 global_stats
.bytes_used_rounded
+= bucket
->get_size_rounded();
2496 global_stats
.objects_count
+= bucket
->get_count();
2498 /* operator[] still can create a new entry for storage policy seen
2499 * for first time. */
2500 auto& policy_stats
= policies_stats
[bucket
->get_placement_rule().to_str()];
2501 policy_stats
.bytes_used
+= bucket
->get_size();
2502 policy_stats
.bytes_used_rounded
+= bucket
->get_size_rounded();
2503 policy_stats
.buckets_count
++;
2504 policy_stats
.objects_count
+= bucket
->get_count();
2506 global_stats
.buckets_count
+= m
.size();
2510 ldpp_dout(this, -1) << "ERROR: rgw_read_user_buckets, stasis at marker="
2511 << marker
<< " uid=" << s
->user
->get_id() << dendl
;
2514 marker
= *lastmarker
;
2515 } while (buckets
.is_truncated());
2518 int RGWGetBucketVersioning::verify_permission(optional_yield y
)
2520 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketVersioning
);
2523 void RGWGetBucketVersioning::pre_exec()
2525 rgw_bucket_object_pre_exec(s
);
2528 void RGWGetBucketVersioning::execute(optional_yield y
)
2530 if (! s
->bucket_exists
) {
2531 op_ret
= -ERR_NO_SUCH_BUCKET
;
2535 versioned
= s
->bucket
->versioned();
2536 versioning_enabled
= s
->bucket
->versioning_enabled();
2537 mfa_enabled
= s
->bucket
->get_info().mfa_enabled();
2540 int RGWSetBucketVersioning::verify_permission(optional_yield y
)
2542 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketVersioning
);
2545 void RGWSetBucketVersioning::pre_exec()
2547 rgw_bucket_object_pre_exec(s
);
2550 void RGWSetBucketVersioning::execute(optional_yield y
)
2552 op_ret
= get_params(y
);
2556 if (! s
->bucket_exists
) {
2557 op_ret
= -ERR_NO_SUCH_BUCKET
;
2561 if (s
->bucket
->get_info().obj_lock_enabled() && versioning_status
!= VersioningEnabled
) {
2562 s
->err
.message
= "bucket versioning cannot be disabled on buckets with object lock enabled";
2563 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
2564 op_ret
= -ERR_INVALID_BUCKET_STATE
;
2568 bool cur_mfa_status
= s
->bucket
->get_info().mfa_enabled();
2570 mfa_set_status
&= (mfa_status
!= cur_mfa_status
);
2572 if (mfa_set_status
&&
2574 op_ret
= -ERR_MFA_REQUIRED
;
2577 //if mfa is enabled for bucket, make sure mfa code is validated in case versioned status gets changed
2578 if (cur_mfa_status
) {
2579 bool req_versioning_status
= false;
2580 //if requested versioning status is not the same as the one set for the bucket, return error
2581 if (versioning_status
== VersioningEnabled
) {
2582 req_versioning_status
= (s
->bucket
->get_info().flags
& BUCKET_VERSIONS_SUSPENDED
) != 0;
2583 } else if (versioning_status
== VersioningSuspended
) {
2584 req_versioning_status
= (s
->bucket
->get_info().flags
& BUCKET_VERSIONS_SUSPENDED
) == 0;
2586 if (req_versioning_status
&& !s
->mfa_verified
) {
2587 op_ret
= -ERR_MFA_REQUIRED
;
2592 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
2594 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
2598 bool modified
= mfa_set_status
;
2600 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [&] {
2601 if (mfa_set_status
) {
2603 s
->bucket
->get_info().flags
|= BUCKET_MFA_ENABLED
;
2605 s
->bucket
->get_info().flags
&= ~BUCKET_MFA_ENABLED
;
2609 if (versioning_status
== VersioningEnabled
) {
2610 s
->bucket
->get_info().flags
|= BUCKET_VERSIONED
;
2611 s
->bucket
->get_info().flags
&= ~BUCKET_VERSIONS_SUSPENDED
;
2613 } else if (versioning_status
== VersioningSuspended
) {
2614 s
->bucket
->get_info().flags
|= (BUCKET_VERSIONED
| BUCKET_VERSIONS_SUSPENDED
);
2619 s
->bucket
->set_attrs(rgw::sal::RGWAttrs(s
->bucket_attrs
));
2620 return s
->bucket
->put_instance_info(this, false, real_time());
2628 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
->get_name()
2629 << " returned err=" << op_ret
<< dendl
;
2634 int RGWGetBucketWebsite::verify_permission(optional_yield y
)
2636 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketWebsite
);
2639 void RGWGetBucketWebsite::pre_exec()
2641 rgw_bucket_object_pre_exec(s
);
2644 void RGWGetBucketWebsite::execute(optional_yield y
)
2646 if (!s
->bucket
->get_info().has_website
) {
2647 op_ret
= -ERR_NO_SUCH_WEBSITE_CONFIGURATION
;
2651 int RGWSetBucketWebsite::verify_permission(optional_yield y
)
2653 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketWebsite
);
2656 void RGWSetBucketWebsite::pre_exec()
2658 rgw_bucket_object_pre_exec(s
);
2661 void RGWSetBucketWebsite::execute(optional_yield y
)
2663 op_ret
= get_params(y
);
2668 if (!s
->bucket_exists
) {
2669 op_ret
= -ERR_NO_SUCH_BUCKET
;
2673 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
2675 ldpp_dout(this, 0) << " forward_request_to_master returned ret=" << op_ret
<< dendl
;
2679 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
2680 s
->bucket
->get_info().has_website
= true;
2681 s
->bucket
->get_info().website_conf
= website_conf
;
2682 op_ret
= s
->bucket
->put_instance_info(this, false, real_time());
2687 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
->get_name()
2688 << " returned err=" << op_ret
<< dendl
;
2693 int RGWDeleteBucketWebsite::verify_permission(optional_yield y
)
2695 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3DeleteBucketWebsite
);
2698 void RGWDeleteBucketWebsite::pre_exec()
2700 rgw_bucket_object_pre_exec(s
);
2703 void RGWDeleteBucketWebsite::execute(optional_yield y
)
2705 if (!s
->bucket_exists
) {
2706 op_ret
= -ERR_NO_SUCH_BUCKET
;
2712 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
2714 ldpp_dout(this, 0) << "NOTICE: forward_to_master failed on bucket=" << s
->bucket
->get_name()
2715 << "returned err=" << op_ret
<< dendl
;
2718 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
2719 s
->bucket
->get_info().has_website
= false;
2720 s
->bucket
->get_info().website_conf
= RGWBucketWebsiteConf();
2721 op_ret
= s
->bucket
->put_instance_info(this, false, real_time());
2725 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
2726 << " returned err=" << op_ret
<< dendl
;
2731 int RGWStatBucket::verify_permission(optional_yield y
)
2733 // This (a HEAD request on a bucket) is governed by the s3:ListBucket permission.
2734 if (!verify_bucket_permission(this, s
, rgw::IAM::s3ListBucket
)) {
2741 void RGWStatBucket::pre_exec()
2743 rgw_bucket_object_pre_exec(s
);
2746 void RGWStatBucket::execute(optional_yield y
)
2748 if (!s
->bucket_exists
) {
2749 op_ret
= -ERR_NO_SUCH_BUCKET
;
2753 op_ret
= store
->get_bucket(this, s
->user
.get(), s
->bucket
->get_key(), &bucket
, y
);
2757 op_ret
= bucket
->update_container_stats(s
);
2760 int RGWListBucket::verify_permission(optional_yield y
)
2762 op_ret
= get_params(y
);
2766 if (!prefix
.empty())
2767 s
->env
.emplace("s3:prefix", prefix
);
2769 if (!delimiter
.empty())
2770 s
->env
.emplace("s3:delimiter", delimiter
);
2772 s
->env
.emplace("s3:max-keys", std::to_string(max
));
2774 if (!verify_bucket_permission(this,
2777 rgw::IAM::s3ListBucketVersions
:
2778 rgw::IAM::s3ListBucket
)) {
2785 int RGWListBucket::parse_max_keys()
2787 // Bound max value of max-keys to configured value for security
2788 // Bound min value of max-keys to '0'
2789 // Some S3 clients explicitly send max-keys=0 to detect if the bucket is
2790 // empty without listing any items.
2791 return parse_value_and_bound(max_keys
, max
, 0,
2792 g_conf().get_val
<uint64_t>("rgw_max_listing_results"),
2796 void RGWListBucket::pre_exec()
2798 rgw_bucket_object_pre_exec(s
);
2801 void RGWListBucket::execute(optional_yield y
)
2803 if (!s
->bucket_exists
) {
2804 op_ret
= -ERR_NO_SUCH_BUCKET
;
2808 if (allow_unordered
&& !delimiter
.empty()) {
2809 ldpp_dout(this, 0) <<
2810 "ERROR: unordered bucket listing requested with a delimiter" << dendl
;
2815 if (need_container_stats()) {
2816 op_ret
= s
->bucket
->update_container_stats(s
);
2819 rgw::sal::RGWBucket::ListParams params
;
2820 params
.prefix
= prefix
;
2821 params
.delim
= delimiter
;
2822 params
.marker
= marker
;
2823 params
.end_marker
= end_marker
;
2824 params
.list_versions
= list_versions
;
2825 params
.allow_unordered
= allow_unordered
;
2826 params
.shard_id
= shard_id
;
2828 rgw::sal::RGWBucket::ListResults results
;
2830 op_ret
= s
->bucket
->list(this, params
, max
, results
, y
);
2832 next_marker
= results
.next_marker
;
2833 is_truncated
= results
.is_truncated
;
2834 objs
= std::move(results
.objs
);
2835 common_prefixes
= std::move(results
.common_prefixes
);
2839 int RGWGetBucketLogging::verify_permission(optional_yield y
)
2841 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketLogging
);
2844 int RGWGetBucketLocation::verify_permission(optional_yield y
)
2846 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketLocation
);
2849 int RGWCreateBucket::verify_permission(optional_yield y
)
2851 /* This check is mostly needed for S3 that doesn't support account ACL.
2852 * Swift doesn't allow to delegate any permission to an anonymous user,
2853 * so it will become an early exit in such case. */
2854 if (s
->auth
.identity
->is_anonymous()) {
2859 bucket
.name
= s
->bucket_name
;
2860 bucket
.tenant
= s
->bucket_tenant
;
2861 ARN arn
= ARN(bucket
);
2862 if (!verify_user_permission(this, s
, arn
, rgw::IAM::s3CreateBucket
)) {
2866 if (s
->user
->get_tenant() != s
->bucket_tenant
) {
2867 //AssumeRole is meant for cross account access
2868 if (s
->auth
.identity
->get_identity_type() != TYPE_ROLE
) {
2869 ldpp_dout(this, 10) << "user cannot create a bucket in a different tenant"
2870 << " (user_id.tenant=" << s
->user
->get_tenant()
2871 << " requested=" << s
->bucket_tenant
<< ")"
2877 if (s
->user
->get_max_buckets() < 0) {
2881 if (s
->user
->get_max_buckets()) {
2882 rgw::sal::RGWBucketList buckets
;
2884 op_ret
= rgw_read_user_buckets(this, store
, s
->user
->get_id(), buckets
,
2885 marker
, string(), s
->user
->get_max_buckets(),
2891 if ((int)buckets
.count() >= s
->user
->get_max_buckets()) {
2892 return -ERR_TOO_MANY_BUCKETS
;
2899 void RGWCreateBucket::pre_exec()
2901 rgw_bucket_object_pre_exec(s
);
2904 static void prepare_add_del_attrs(const map
<string
, bufferlist
>& orig_attrs
,
2905 map
<string
, bufferlist
>& out_attrs
,
2906 map
<string
, bufferlist
>& out_rmattrs
)
2908 for (const auto& kv
: orig_attrs
) {
2909 const string
& name
= kv
.first
;
2911 /* Check if the attr is user-defined metadata item. */
2912 if (name
.compare(0, sizeof(RGW_ATTR_META_PREFIX
) - 1,
2913 RGW_ATTR_META_PREFIX
) == 0) {
2914 /* For the objects all existing meta attrs have to be removed. */
2915 out_rmattrs
[name
] = kv
.second
;
2916 } else if (out_attrs
.find(name
) == std::end(out_attrs
)) {
2917 out_attrs
[name
] = kv
.second
;
2922 /* Fuse resource metadata basing on original attributes in @orig_attrs, set
2923 * of _custom_ attribute names to remove in @rmattr_names and attributes in
2924 * @out_attrs. Place results in @out_attrs.
2926 * NOTE: it's supposed that all special attrs already present in @out_attrs
2927 * will be preserved without any change. Special attributes are those which
2928 * names start with RGW_ATTR_META_PREFIX. They're complement to custom ones
2929 * used for X-Account-Meta-*, X-Container-Meta-*, X-Amz-Meta and so on. */
2930 static void prepare_add_del_attrs(const map
<string
, bufferlist
>& orig_attrs
,
2931 const set
<string
>& rmattr_names
,
2932 map
<string
, bufferlist
>& out_attrs
)
2934 for (const auto& kv
: orig_attrs
) {
2935 const string
& name
= kv
.first
;
2937 /* Check if the attr is user-defined metadata item. */
2938 if (name
.compare(0, strlen(RGW_ATTR_META_PREFIX
),
2939 RGW_ATTR_META_PREFIX
) == 0) {
2940 /* For the buckets all existing meta attrs are preserved,
2941 except those that are listed in rmattr_names. */
2942 if (rmattr_names
.find(name
) != std::end(rmattr_names
)) {
2943 const auto aiter
= out_attrs
.find(name
);
2945 if (aiter
!= std::end(out_attrs
)) {
2946 out_attrs
.erase(aiter
);
2949 /* emplace() won't alter the map if the key is already present.
2950 * This behaviour is fully intensional here. */
2951 out_attrs
.emplace(kv
);
2953 } else if (out_attrs
.find(name
) == std::end(out_attrs
)) {
2954 out_attrs
[name
] = kv
.second
;
2960 static void populate_with_generic_attrs(const req_state
* const s
,
2961 map
<string
, bufferlist
>& out_attrs
)
2963 for (const auto& kv
: s
->generic_attrs
) {
2964 bufferlist
& attrbl
= out_attrs
[kv
.first
];
2965 const string
& val
= kv
.second
;
2967 attrbl
.append(val
.c_str(), val
.size() + 1);
2972 static int filter_out_quota_info(std::map
<std::string
, bufferlist
>& add_attrs
,
2973 const std::set
<std::string
>& rmattr_names
,
2974 RGWQuotaInfo
& quota
,
2975 bool * quota_extracted
= nullptr)
2977 bool extracted
= false;
2979 /* Put new limit on max objects. */
2980 auto iter
= add_attrs
.find(RGW_ATTR_QUOTA_NOBJS
);
2982 if (std::end(add_attrs
) != iter
) {
2984 static_cast<int64_t>(strict_strtoll(iter
->second
.c_str(), 10, &err
));
2988 add_attrs
.erase(iter
);
2992 /* Put new limit on bucket (container) size. */
2993 iter
= add_attrs
.find(RGW_ATTR_QUOTA_MSIZE
);
2994 if (iter
!= add_attrs
.end()) {
2996 static_cast<int64_t>(strict_strtoll(iter
->second
.c_str(), 10, &err
));
3000 add_attrs
.erase(iter
);
3004 for (const auto& name
: rmattr_names
) {
3005 /* Remove limit on max objects. */
3006 if (name
.compare(RGW_ATTR_QUOTA_NOBJS
) == 0) {
3007 quota
.max_objects
= -1;
3011 /* Remove limit on max bucket size. */
3012 if (name
.compare(RGW_ATTR_QUOTA_MSIZE
) == 0) {
3013 quota
.max_size
= -1;
3018 /* Swift requries checking on raw usage instead of the 4 KiB rounded one. */
3019 quota
.check_on_raw
= true;
3020 quota
.enabled
= quota
.max_size
> 0 || quota
.max_objects
> 0;
3022 if (quota_extracted
) {
3023 *quota_extracted
= extracted
;
3030 static void filter_out_website(std::map
<std::string
, ceph::bufferlist
>& add_attrs
,
3031 const std::set
<std::string
>& rmattr_names
,
3032 RGWBucketWebsiteConf
& ws_conf
)
3036 /* Let's define a mapping between each custom attribute and the memory where
3037 * attribute's value should be stored. The memory location is expressed by
3038 * a non-const reference. */
3039 const auto mapping
= {
3040 std::make_pair(RGW_ATTR_WEB_INDEX
, std::ref(ws_conf
.index_doc_suffix
)),
3041 std::make_pair(RGW_ATTR_WEB_ERROR
, std::ref(ws_conf
.error_doc
)),
3042 std::make_pair(RGW_ATTR_WEB_LISTINGS
, std::ref(lstval
)),
3043 std::make_pair(RGW_ATTR_WEB_LIST_CSS
, std::ref(ws_conf
.listing_css_doc
)),
3044 std::make_pair(RGW_ATTR_SUBDIR_MARKER
, std::ref(ws_conf
.subdir_marker
))
3047 for (const auto& kv
: mapping
) {
3048 const char * const key
= kv
.first
;
3049 auto& target
= kv
.second
;
3051 auto iter
= add_attrs
.find(key
);
3053 if (std::end(add_attrs
) != iter
) {
3054 /* The "target" is a reference to ws_conf. */
3055 target
= iter
->second
.c_str();
3056 add_attrs
.erase(iter
);
3059 if (rmattr_names
.count(key
)) {
3060 target
= std::string();
3064 if (! lstval
.empty()) {
3065 ws_conf
.listing_enabled
= boost::algorithm::iequals(lstval
, "true");
3070 void RGWCreateBucket::execute(optional_yield y
)
3073 buffer::list corsbl
;
3074 string bucket_name
= rgw_make_bucket_entry_name(s
->bucket_tenant
, s
->bucket_name
);
3075 rgw_raw_obj
obj(store
->svc()->zone
->get_zone_params().domain_root
, bucket_name
);
3077 op_ret
= get_params(y
);
3081 if (!relaxed_region_enforcement
&&
3082 !location_constraint
.empty() &&
3083 !store
->svc()->zone
->has_zonegroup_api(location_constraint
)) {
3084 ldpp_dout(this, 0) << "location constraint (" << location_constraint
<< ")"
3085 << " can't be found." << dendl
;
3086 op_ret
= -ERR_INVALID_LOCATION_CONSTRAINT
;
3087 s
->err
.message
= "The specified location-constraint is not valid";
3091 if (!relaxed_region_enforcement
&& !store
->get_zonegroup().is_master_zonegroup() && !location_constraint
.empty() &&
3092 store
->get_zonegroup().api_name
!= location_constraint
) {
3093 ldpp_dout(this, 0) << "location constraint (" << location_constraint
<< ")"
3094 << " doesn't match zonegroup" << " (" << store
->get_zonegroup().api_name
<< ")"
3096 op_ret
= -ERR_INVALID_LOCATION_CONSTRAINT
;
3097 s
->err
.message
= "The specified location-constraint is not valid";
3101 const auto& zonegroup
= store
->get_zonegroup();
3102 if (!placement_rule
.name
.empty() &&
3103 !zonegroup
.placement_targets
.count(placement_rule
.name
)) {
3104 ldpp_dout(this, 0) << "placement target (" << placement_rule
.name
<< ")"
3105 << " doesn't exist in the placement targets of zonegroup"
3106 << " (" << store
->get_zonegroup().api_name
<< ")" << dendl
;
3107 op_ret
= -ERR_INVALID_LOCATION_CONSTRAINT
;
3108 s
->err
.message
= "The specified placement target does not exist";
3112 /* we need to make sure we read bucket info, it's not read before for this
3113 * specific request */
3114 op_ret
= store
->get_bucket(this, s
->user
.get(), s
->bucket_tenant
, s
->bucket_name
, &s
->bucket
, y
);
3115 if (op_ret
< 0 && op_ret
!= -ENOENT
)
3117 s
->bucket_exists
= (op_ret
!= -ENOENT
);
3119 if (s
->bucket_exists
) {
3120 if (!s
->system_request
&&
3121 store
->svc()->zone
->get_zonegroup().get_id() != s
->bucket
->get_info().zonegroup
) {
3125 /* Initialize info from req_state */
3126 info
= s
->bucket
->get_info();
3129 s
->bucket_owner
.set_id(s
->user
->get_id()); /* XXX dang use s->bucket->owner */
3130 s
->bucket_owner
.set_name(s
->user
->get_display_name());
3132 string zonegroup_id
;
3134 if (s
->system_request
) {
3135 zonegroup_id
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"zonegroup");
3136 if (zonegroup_id
.empty()) {
3137 zonegroup_id
= store
->get_zonegroup().get_id();
3140 zonegroup_id
= store
->get_zonegroup().get_id();
3143 /* Encode special metadata first as we're using std::map::emplace under
3144 * the hood. This method will add the new items only if the map doesn't
3145 * contain such keys yet. */
3146 policy
.encode(aclbl
);
3147 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
3150 cors_config
.encode(corsbl
);
3151 emplace_attr(RGW_ATTR_CORS
, std::move(corsbl
));
3154 RGWQuotaInfo quota_info
;
3155 const RGWQuotaInfo
* pquota_info
= nullptr;
3156 if (need_metadata_upload()) {
3157 /* It's supposed that following functions WILL NOT change any special
3158 * attributes (like RGW_ATTR_ACL) if they are already present in attrs. */
3159 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
, false);
3163 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
3164 populate_with_generic_attrs(s
, attrs
);
3166 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, quota_info
);
3170 pquota_info
= "a_info
;
3173 /* Web site of Swift API. */
3174 filter_out_website(attrs
, rmattr_names
, info
.website_conf
);
3175 info
.has_website
= !info
.website_conf
.is_empty();
3178 rgw_bucket tmp_bucket
;
3179 tmp_bucket
.tenant
= s
->bucket_tenant
; /* ignored if bucket exists */
3180 tmp_bucket
.name
= s
->bucket_name
;
3182 /* Handle updates of the metadata for Swift's object versioning. */
3183 if (swift_ver_location
) {
3184 info
.swift_ver_location
= *swift_ver_location
;
3185 info
.swift_versioning
= (! swift_ver_location
->empty());
3188 /* We're replacing bucket with the newly created one */
3189 ldpp_dout(this, 10) << "user=" << s
->user
<< " bucket=" << tmp_bucket
<< dendl
;
3190 op_ret
= store
->create_bucket(this, *s
->user
, tmp_bucket
, zonegroup_id
,
3192 info
.swift_ver_location
,
3193 pquota_info
, policy
, attrs
, info
, ep_objv
,
3194 true, obj_lock_enabled
, &s
->bucket_exists
, s
->info
,
3197 /* continue if EEXIST and create_bucket will fail below. this way we can
3198 * recover from a partial create by retrying it. */
3199 ldpp_dout(this, 20) << "rgw_create_bucket returned ret=" << op_ret
<< " bucket=" << s
->bucket
.get() << dendl
;
3204 const bool existed
= s
->bucket_exists
;
3206 /* bucket already existed, might have raced with another bucket creation, or
3207 * might be partial bucket creation that never completed. Read existing bucket
3208 * info, verify that the reported bucket owner is the current user.
3209 * If all is ok then update the user's list of buckets.
3210 * Otherwise inform client about a name conflict.
3212 if (s
->bucket
->get_info().owner
.compare(s
->user
->get_id()) != 0) {
3218 op_ret
= store
->ctl()->bucket
->link_bucket(s
->user
->get_id(), s
->bucket
->get_key(),
3219 s
->bucket
->get_creation_time(), y
, s
, false);
3220 if (op_ret
&& !existed
&& op_ret
!= -EEXIST
) {
3221 /* if it exists (or previously existed), don't remove it! */
3222 op_ret
= store
->ctl()->bucket
->unlink_bucket(s
->user
->get_id(), s
->bucket
->get_key(), y
, this);
3224 ldpp_dout(this, 0) << "WARNING: failed to unlink bucket: ret=" << op_ret
3227 } else if (op_ret
== -EEXIST
|| (op_ret
== 0 && existed
)) {
3228 op_ret
= -ERR_BUCKET_EXISTS
;
3231 if (need_metadata_upload() && existed
) {
3232 /* OK, it looks we lost race with another request. As it's required to
3233 * handle metadata fusion and upload, the whole operation becomes very
3234 * similar in nature to PutMetadataBucket. However, as the attrs may
3235 * changed in the meantime, we have to refresh. */
3238 map
<string
, bufferlist
> battrs
;
3240 op_ret
= s
->bucket
->get_bucket_info(this, y
);
3243 } else if (!s
->bucket
->is_owner(s
->user
.get())) {
3244 /* New bucket doesn't belong to the account we're operating on. */
3248 s
->bucket_attrs
= s
->bucket
->get_attrs();
3253 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
, false);
3257 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
3258 populate_with_generic_attrs(s
, attrs
);
3259 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, s
->bucket
->get_info().quota
);
3264 /* Handle updates of the metadata for Swift's object versioning. */
3265 if (swift_ver_location
) {
3266 s
->bucket
->get_info().swift_ver_location
= *swift_ver_location
;
3267 s
->bucket
->get_info().swift_versioning
= (! swift_ver_location
->empty());
3270 /* Web site of Swift API. */
3271 filter_out_website(attrs
, rmattr_names
, s
->bucket
->get_info().website_conf
);
3272 s
->bucket
->get_info().has_website
= !s
->bucket
->get_info().website_conf
.is_empty();
3274 /* This will also set the quota on the bucket. */
3275 op_ret
= store
->ctl()->bucket
->set_bucket_instance_attrs(s
->bucket
->get_info(), attrs
,
3276 &s
->bucket
->get_info().objv_tracker
,
3278 } while (op_ret
== -ECANCELED
&& tries
++ < 20);
3280 /* Restore the proper return code. */
3282 op_ret
= -ERR_BUCKET_EXISTS
;
3287 int RGWDeleteBucket::verify_permission(optional_yield y
)
3289 if (!verify_bucket_permission(this, s
, rgw::IAM::s3DeleteBucket
)) {
3296 void RGWDeleteBucket::pre_exec()
3298 rgw_bucket_object_pre_exec(s
);
3301 void RGWDeleteBucket::execute(optional_yield y
)
3303 if (s
->bucket_name
.empty()) {
3308 if (!s
->bucket_exists
) {
3309 ldpp_dout(this, 0) << "ERROR: bucket " << s
->bucket_name
<< " not found" << dendl
;
3310 op_ret
= -ERR_NO_SUCH_BUCKET
;
3313 RGWObjVersionTracker ot
;
3314 ot
.read_version
= s
->bucket
->get_version();
3316 if (s
->system_request
) {
3317 string tag
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"tag");
3318 string ver_str
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"ver");
3320 ot
.read_version
.tag
= tag
;
3323 ver
= strict_strtol(ver_str
.c_str(), 10, &err
);
3325 ldpp_dout(this, 0) << "failed to parse ver param" << dendl
;
3329 ot
.read_version
.ver
= ver
;
3333 op_ret
= s
->bucket
->sync_user_stats(this, y
);
3335 ldpp_dout(this, 1) << "WARNING: failed to sync user stats before bucket delete: op_ret= " << op_ret
<< dendl
;
3338 op_ret
= s
->bucket
->check_empty(this, y
);
3344 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), &ot
.read_version
, in_data
, nullptr, s
->info
, y
);
3346 if (op_ret
== -ENOENT
) {
3347 /* adjust error, we want to return with NoSuchBucket and not
3349 op_ret
= -ERR_NO_SUCH_BUCKET
;
3354 op_ret
= s
->bucket
->remove_bucket(this, false, false, nullptr, y
);
3355 if (op_ret
< 0 && op_ret
== -ECANCELED
) {
3356 // lost a race, either with mdlog sync or another delete bucket operation.
3357 // in either case, we've already called ctl.bucket->unlink_bucket()
3363 int RGWPutObj::init_processing(optional_yield y
) {
3364 copy_source
= url_decode(s
->info
.env
->get("HTTP_X_AMZ_COPY_SOURCE", ""));
3365 copy_source_range
= s
->info
.env
->get("HTTP_X_AMZ_COPY_SOURCE_RANGE");
3369 /* handle x-amz-copy-source */
3370 std::string_view
cs_view(copy_source
);
3371 if (! cs_view
.empty()) {
3372 if (cs_view
[0] == '/')
3373 cs_view
.remove_prefix(1);
3374 copy_source_bucket_name
= std::string(cs_view
);
3375 pos
= copy_source_bucket_name
.find("/");
3376 if (pos
== std::string::npos
) {
3378 ldpp_dout(this, 5) << "x-amz-copy-source bad format" << dendl
;
3381 copy_source_object_name
=
3382 copy_source_bucket_name
.substr(pos
+ 1, copy_source_bucket_name
.size());
3383 copy_source_bucket_name
= copy_source_bucket_name
.substr(0, pos
);
3384 #define VERSION_ID_STR "?versionId="
3385 pos
= copy_source_object_name
.find(VERSION_ID_STR
);
3386 if (pos
== std::string::npos
) {
3387 copy_source_object_name
= url_decode(copy_source_object_name
);
3389 copy_source_version_id
=
3390 copy_source_object_name
.substr(pos
+ sizeof(VERSION_ID_STR
) - 1);
3391 copy_source_object_name
=
3392 url_decode(copy_source_object_name
.substr(0, pos
));
3394 pos
= copy_source_bucket_name
.find(":");
3395 if (pos
== std::string::npos
) {
3396 // if tenant is not specified in x-amz-copy-source, use tenant of the requester
3397 copy_source_tenant_name
= s
->user
->get_tenant();
3399 copy_source_tenant_name
= copy_source_bucket_name
.substr(0, pos
);
3400 copy_source_bucket_name
= copy_source_bucket_name
.substr(pos
+ 1, copy_source_bucket_name
.size());
3401 if (copy_source_bucket_name
.empty()) {
3403 ldpp_dout(this, 5) << "source bucket name is empty" << dendl
;
3407 std::unique_ptr
<rgw::sal::RGWBucket
> bucket
;
3408 ret
= store
->get_bucket(this, s
->user
.get(), copy_source_tenant_name
, copy_source_bucket_name
,
3411 ldpp_dout(this, 5) << __func__
<< "(): get_bucket() returned ret=" << ret
<< dendl
;
3415 ret
= bucket
->get_bucket_info(this, y
);
3417 ldpp_dout(this, 5) << __func__
<< "(): get_bucket_info() returned ret=" << ret
<< dendl
;
3420 copy_source_bucket_info
= bucket
->get_info();
3422 /* handle x-amz-copy-source-range */
3423 if (copy_source_range
) {
3424 string range
= copy_source_range
;
3425 pos
= range
.find("bytes=");
3426 if (pos
== std::string::npos
|| pos
!= 0) {
3428 ldpp_dout(this, 5) << "x-amz-copy-source-range bad format" << dendl
;
3431 /* 6 is the length of "bytes=" */
3432 range
= range
.substr(pos
+ 6);
3433 pos
= range
.find("-");
3434 if (pos
== std::string::npos
) {
3436 ldpp_dout(this, 5) << "x-amz-copy-source-range bad format" << dendl
;
3439 string first
= range
.substr(0, pos
);
3440 string last
= range
.substr(pos
+ 1);
3441 if (first
.find_first_not_of("0123456789") != std::string::npos
||
3442 last
.find_first_not_of("0123456789") != std::string::npos
) {
3443 ldpp_dout(this, 5) << "x-amz-copy-source-range bad format not an integer" << dendl
;
3447 copy_source_range_fst
= strtoull(first
.c_str(), NULL
, 10);
3448 copy_source_range_lst
= strtoull(last
.c_str(), NULL
, 10);
3449 if (copy_source_range_fst
> copy_source_range_lst
) {
3451 ldpp_dout(this, 5) << "x-amz-copy-source-range bad format first number bigger than second" << dendl
;
3457 return RGWOp::init_processing(y
);
3460 int RGWPutObj::verify_permission(optional_yield y
)
3462 if (! copy_source
.empty()) {
3464 RGWAccessControlPolicy
cs_acl(s
->cct
);
3465 boost::optional
<Policy
> policy
;
3466 map
<string
, bufferlist
> cs_attrs
;
3467 std::unique_ptr
<rgw::sal::RGWBucket
> cs_bucket
;
3468 int ret
= store
->get_bucket(NULL
, copy_source_bucket_info
, &cs_bucket
);
3472 std::unique_ptr
<rgw::sal::RGWObject
> cs_object
=
3473 cs_bucket
->get_object(rgw_obj_key(copy_source_object_name
, copy_source_version_id
));
3475 cs_object
->set_atomic(s
->obj_ctx
);
3476 cs_object
->set_prefetch_data(s
->obj_ctx
);
3478 /* check source object permissions */
3479 if (read_obj_policy(this, store
, s
, copy_source_bucket_info
, cs_attrs
, &cs_acl
, nullptr,
3480 policy
, cs_bucket
.get(), cs_object
.get(), y
, true) < 0) {
3484 /* admin request overrides permission checks */
3485 if (! s
->auth
.identity
->is_admin_of(cs_acl
.get_owner().get_id())) {
3486 if (policy
|| ! s
->iam_user_policies
.empty()) {
3487 auto usr_policy_res
= Effect::Pass
;
3488 for (auto& user_policy
: s
->iam_user_policies
) {
3489 if (usr_policy_res
= user_policy
.eval(s
->env
, *s
->auth
.identity
,
3490 cs_object
->get_instance().empty() ?
3491 rgw::IAM::s3GetObject
:
3492 rgw::IAM::s3GetObjectVersion
,
3493 rgw::ARN(cs_object
->get_obj())); usr_policy_res
== Effect::Deny
)
3495 else if (usr_policy_res
== Effect::Allow
)
3498 rgw::IAM::Effect e
= Effect::Pass
;
3500 e
= policy
->eval(s
->env
, *s
->auth
.identity
,
3501 cs_object
->get_instance().empty() ?
3502 rgw::IAM::s3GetObject
:
3503 rgw::IAM::s3GetObjectVersion
,
3504 rgw::ARN(cs_object
->get_obj()));
3506 if (e
== Effect::Deny
) {
3508 } else if (usr_policy_res
== Effect::Pass
&& e
== Effect::Pass
&&
3509 !cs_acl
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
3513 } else if (!cs_acl
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
3520 if (s
->bucket_access_conf
&& s
->bucket_access_conf
->block_public_acls()) {
3521 if (s
->canned_acl
.compare("public-read") ||
3522 s
->canned_acl
.compare("public-read-write") ||
3523 s
->canned_acl
.compare("authenticated-read"))
3527 auto op_ret
= get_params(y
);
3529 ldpp_dout(this, 20) << "get_params() returned ret=" << op_ret
<< dendl
;
3533 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty()) {
3534 rgw_add_grant_to_iam_environment(s
->env
, s
);
3536 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-acl", s
->canned_acl
);
3538 if (obj_tags
!= nullptr && obj_tags
->count() > 0){
3539 auto tags
= obj_tags
->get_tags();
3540 for (const auto& kv
: tags
){
3541 rgw_add_to_iam_environment(s
->env
, "s3:RequestObjectTag/"+kv
.first
, kv
.second
);
3545 constexpr auto encrypt_attr
= "x-amz-server-side-encryption";
3546 constexpr auto s3_encrypt_attr
= "s3:x-amz-server-side-encryption";
3547 auto enc_header
= s
->info
.x_meta_map
.find(encrypt_attr
);
3548 if (enc_header
!= s
->info
.x_meta_map
.end()){
3549 rgw_add_to_iam_environment(s
->env
, s3_encrypt_attr
, enc_header
->second
);
3552 constexpr auto kms_attr
= "x-amz-server-side-encryption-aws-kms-key-id";
3553 constexpr auto s3_kms_attr
= "s3:x-amz-server-side-encryption-aws-kms-key-id";
3554 auto kms_header
= s
->info
.x_meta_map
.find(kms_attr
);
3555 if (kms_header
!= s
->info
.x_meta_map
.end()){
3556 rgw_add_to_iam_environment(s
->env
, s3_kms_attr
, kms_header
->second
);
3559 /* Object needs a bucket from this point */
3560 s
->object
->set_bucket(s
->bucket
.get());
3562 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
3564 rgw::IAM::s3PutObject
,
3565 s
->object
->get_obj());
3566 if (identity_policy_res
== Effect::Deny
)
3569 rgw::IAM::Effect e
= Effect::Pass
;
3570 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
3571 if (s
->iam_policy
) {
3572 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
3573 rgw::IAM::s3PutObject
,
3574 s
->object
->get_obj(),
3577 if (e
== Effect::Deny
) {
3581 if (!s
->session_policies
.empty()) {
3582 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
3584 rgw::IAM::s3PutObject
,
3585 s
->object
->get_obj());
3586 if (session_policy_res
== Effect::Deny
) {
3589 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
3590 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
3591 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
3592 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
))
3594 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
3595 //Intersection of session policy and identity policy plus bucket policy
3596 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
)
3598 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
3599 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
)
3604 if (e
== Effect::Allow
|| identity_policy_res
== Effect::Allow
) {
3609 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
3617 void RGWPutObj::pre_exec()
3619 rgw_bucket_object_pre_exec(s
);
3622 class RGWPutObj_CB
: public RGWGetObj_Filter
3626 explicit RGWPutObj_CB(RGWPutObj
*_op
) : op(_op
) {}
3627 ~RGWPutObj_CB() override
{}
3629 int handle_data(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
) override
{
3630 return op
->get_data_cb(bl
, bl_ofs
, bl_len
);
3634 int RGWPutObj::get_data_cb(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
)
3637 bl
.begin(bl_ofs
).copy(bl_len
, bl_tmp
);
3639 bl_aux
.append(bl_tmp
);
3644 int RGWPutObj::get_data(const off_t fst
, const off_t lst
, bufferlist
& bl
)
3646 RGWPutObj_CB
cb(this);
3647 RGWGetObj_Filter
* filter
= &cb
;
3648 boost::optional
<RGWGetObj_Decompress
> decompress
;
3649 std::unique_ptr
<RGWGetObj_Filter
> decrypt
;
3650 RGWCompressionInfo cs_info
;
3651 map
<string
, bufferlist
> attrs
;
3655 int64_t new_ofs
, new_end
;
3660 std::unique_ptr
<rgw::sal::RGWBucket
> bucket
;
3661 ret
= store
->get_bucket(nullptr, copy_source_bucket_info
, &bucket
);
3665 std::unique_ptr
<rgw::sal::RGWObject
> obj
= bucket
->get_object(rgw_obj_key(copy_source_object_name
, copy_source_version_id
));
3666 std::unique_ptr
<rgw::sal::RGWObject::ReadOp
> read_op(obj
->get_read_op(s
->obj_ctx
));
3668 ret
= read_op
->prepare(s
->yield
, this);
3672 obj_size
= obj
->get_obj_size();
3674 bool need_decompress
;
3675 op_ret
= rgw_compression_info_from_attrset(obj
->get_attrs(), need_decompress
, cs_info
);
3677 ldpp_dout(this, 0) << "ERROR: failed to decode compression info" << dendl
;
3681 bool partial_content
= true;
3682 if (need_decompress
)
3684 obj_size
= cs_info
.orig_size
;
3685 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
3686 filter
= &*decompress
;
3689 auto attr_iter
= obj
->get_attrs().find(RGW_ATTR_MANIFEST
);
3690 op_ret
= this->get_decrypt_filter(&decrypt
,
3693 attr_iter
!= obj
->get_attrs().end() ? &(attr_iter
->second
) : nullptr);
3694 if (decrypt
!= nullptr) {
3695 filter
= decrypt
.get();
3701 ret
= obj
->range_to_ofs(obj_size
, new_ofs
, new_end
);
3705 filter
->fixup_range(new_ofs
, new_end
);
3706 ret
= read_op
->iterate(this, new_ofs
, new_end
, filter
, s
->yield
);
3709 ret
= filter
->flush();
3711 bl
.claim_append(bl_aux
);
3716 // special handling for compression type = "random" with multipart uploads
3717 static CompressorRef
get_compressor_plugin(const req_state
*s
,
3718 const std::string
& compression_type
)
3720 if (compression_type
!= "random") {
3721 return Compressor::create(s
->cct
, compression_type
);
3724 bool is_multipart
{false};
3725 const auto& upload_id
= s
->info
.args
.get("uploadId", &is_multipart
);
3727 if (!is_multipart
) {
3728 return Compressor::create(s
->cct
, compression_type
);
3731 // use a hash of the multipart upload id so all parts use the same plugin
3732 const auto alg
= std::hash
<std::string
>{}(upload_id
) % Compressor::COMP_ALG_LAST
;
3733 if (alg
== Compressor::COMP_ALG_NONE
) {
3736 return Compressor::create(s
->cct
, alg
);
3739 void RGWPutObj::execute(optional_yield y
)
3741 char supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1];
3742 char supplied_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
3743 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
3744 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
3746 bufferlist bl
, aclbl
, bs
;
3752 bool need_calc_md5
= (dlo_manifest
== NULL
) && (slo_info
== NULL
);
3753 perfcounter
->inc(l_rgw_put
);
3754 // report latency on return
3755 auto put_lat
= make_scope_guard([&] {
3756 perfcounter
->tinc(l_rgw_put_lat
, s
->time_elapsed());
3760 if (rgw::sal::RGWObject::empty(s
->object
.get())) {
3764 if (!s
->bucket_exists
) {
3765 op_ret
= -ERR_NO_SUCH_BUCKET
;
3769 /* Object needs a bucket from this point */
3770 s
->object
->set_bucket(s
->bucket
.get());
3772 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
3774 ldpp_dout(this, 20) << "get_system_versioning_params() returned ret="
3779 if (supplied_md5_b64
) {
3780 need_calc_md5
= true;
3782 ldpp_dout(this, 15) << "supplied_md5_b64=" << supplied_md5_b64
<< dendl
;
3783 op_ret
= ceph_unarmor(supplied_md5_bin
, &supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1],
3784 supplied_md5_b64
, supplied_md5_b64
+ strlen(supplied_md5_b64
));
3785 ldpp_dout(this, 15) << "ceph_armor ret=" << op_ret
<< dendl
;
3786 if (op_ret
!= CEPH_CRYPTO_MD5_DIGESTSIZE
) {
3787 op_ret
= -ERR_INVALID_DIGEST
;
3791 buf_to_hex((const unsigned char *)supplied_md5_bin
, CEPH_CRYPTO_MD5_DIGESTSIZE
, supplied_md5
);
3792 ldpp_dout(this, 15) << "supplied_md5=" << supplied_md5
<< dendl
;
3795 if (!chunked_upload
) { /* with chunked upload we don't know how big is the upload.
3796 we also check sizes at the end anyway */
3797 op_ret
= s
->bucket
->check_quota(user_quota
, bucket_quota
, s
->content_length
, y
);
3799 ldpp_dout(this, 20) << "check_quota() returned ret=" << op_ret
<< dendl
;
3804 if (supplied_etag
) {
3805 strncpy(supplied_md5
, supplied_etag
, sizeof(supplied_md5
) - 1);
3806 supplied_md5
[sizeof(supplied_md5
) - 1] = '\0';
3809 const bool multipart
= !multipart_upload_id
.empty();
3810 auto& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
3812 /* Handle object versioning of Swift API. */
3814 op_ret
= s
->object
->swift_versioning_copy(s
->obj_ctx
, this, s
->yield
);
3820 // make reservation for notification if needed
3821 rgw::notify::reservation_t
res(this, store
, s
, s
->object
.get());
3822 const auto event_type
= rgw::notify::ObjectCreatedPut
;
3823 op_ret
= rgw::notify::publish_reserve(this, event_type
, res
, obj_tags
.get());
3828 // create the object processor
3829 auto aio
= rgw::make_throttle(s
->cct
->_conf
->rgw_put_obj_min_window_size
,
3831 using namespace rgw::putobj
;
3832 constexpr auto max_processor_size
= std::max({sizeof(MultipartObjectProcessor
),
3833 sizeof(AtomicObjectProcessor
),
3834 sizeof(AppendObjectProcessor
)});
3835 ceph::static_ptr
<ObjectProcessor
, max_processor_size
> processor
;
3837 rgw_placement_rule
*pdest_placement
;
3839 multipart_upload_info upload_info
;
3841 RGWMPObj
mp(s
->object
->get_name(), multipart_upload_id
);
3843 op_ret
= get_multipart_info(this, s
, mp
.get_meta(), &upload_info
);
3845 if (op_ret
!= -ENOENT
) {
3846 ldpp_dout(this, 0) << "ERROR: get_multipart_info returned " << op_ret
<< ": " << cpp_strerror(-op_ret
) << dendl
;
3847 } else {// -ENOENT: raced with upload complete/cancel, no need to spam log
3848 ldpp_dout(this, 20) << "failed to get multipart info (returned " << op_ret
<< ": " << cpp_strerror(-op_ret
) << "): probably raced with upload complete / cancel" << dendl
;
3852 pdest_placement
= &upload_info
.dest_placement
;
3853 ldpp_dout(this, 20) << "dest_placement for part=" << upload_info
.dest_placement
<< dendl
;
3854 processor
.emplace
<MultipartObjectProcessor
>(
3855 &*aio
, store
, s
->bucket
.get(), pdest_placement
,
3856 s
->owner
.get_id(), obj_ctx
, s
->object
->clone(),
3857 multipart_upload_id
, multipart_part_num
, multipart_part_str
,
3860 if (s
->bucket
->versioned()) {
3861 op_ret
= -ERR_INVALID_BUCKET_STATE
;
3864 pdest_placement
= &s
->dest_placement
;
3865 processor
.emplace
<AppendObjectProcessor
>(
3866 &*aio
, store
, s
->bucket
.get(), pdest_placement
, s
->bucket_owner
.get_id(),
3867 obj_ctx
, s
->object
->clone(),
3868 s
->req_id
, position
, &cur_accounted_size
, this, s
->yield
);
3870 if (s
->bucket
->versioning_enabled()) {
3871 if (!version_id
.empty()) {
3872 s
->object
->set_instance(version_id
);
3874 s
->object
->gen_rand_obj_instance_name();
3875 version_id
= s
->object
->get_instance();
3878 pdest_placement
= &s
->dest_placement
;
3879 processor
.emplace
<AtomicObjectProcessor
>(
3880 &*aio
, store
, s
->bucket
.get(), pdest_placement
,
3881 s
->bucket_owner
.get_id(), obj_ctx
, s
->object
->clone(),
3882 olh_epoch
, s
->req_id
, this, s
->yield
);
3885 op_ret
= processor
->prepare(s
->yield
);
3887 ldpp_dout(this, 20) << "processor->prepare() returned ret=" << op_ret
3892 if ((! copy_source
.empty()) && !copy_source_range
) {
3893 rgw::sal::RGWRadosObject
obj(store
, rgw_obj_key(copy_source_object_name
, copy_source_version_id
));
3894 rgw::sal::RGWRadosBucket
bucket(store
, copy_source_bucket_info
);
3896 RGWObjState
*astate
;
3897 op_ret
= obj
.get_obj_state(this, &obj_ctx
, bucket
, &astate
, s
->yield
);
3899 ldpp_dout(this, 0) << "ERROR: get copy source obj state returned with error" << op_ret
<< dendl
;
3902 if (!astate
->exists
){
3906 lst
= astate
->accounted_size
- 1;
3908 lst
= copy_source_range_lst
;
3911 fst
= copy_source_range_fst
;
3913 // no filters by default
3914 DataProcessor
*filter
= processor
.get();
3916 const auto& compression_type
= store
->svc()->zone
->get_zone_params().get_compression_type(*pdest_placement
);
3917 CompressorRef plugin
;
3918 boost::optional
<RGWPutObj_Compress
> compressor
;
3920 std::unique_ptr
<DataProcessor
> encrypt
;
3922 if (!append
) { // compression and encryption only apply to full object uploads
3923 op_ret
= get_encrypt_filter(&encrypt
, filter
);
3927 if (encrypt
!= nullptr) {
3929 } else if (compression_type
!= "none") {
3930 plugin
= get_compressor_plugin(s
, compression_type
);
3932 ldpp_dout(this, 1) << "Cannot load plugin for compression type "
3933 << compression_type
<< dendl
;
3935 compressor
.emplace(s
->cct
, plugin
, filter
);
3936 filter
= &*compressor
;
3940 tracepoint(rgw_op
, before_data_transfer
, s
->req_id
.c_str());
3945 if (copy_source
.empty()) {
3946 len
= get_data(data
);
3948 uint64_t cur_lst
= min(fst
+ s
->cct
->_conf
->rgw_max_chunk_size
- 1, lst
);
3949 op_ret
= get_data(fst
, cur_lst
, data
);
3952 len
= data
.length();
3953 s
->content_length
+= len
;
3958 ldpp_dout(this, 20) << "get_data() returned ret=" << op_ret
<< dendl
;
3960 } else if (len
== 0) {
3964 if (need_calc_md5
) {
3965 hash
.Update((const unsigned char *)data
.c_str(), data
.length());
3968 /* update torrrent */
3969 torrent
.update(data
);
3971 op_ret
= filter
->process(std::move(data
), ofs
);
3973 ldpp_dout(this, 20) << "processor->process() returned ret="
3980 tracepoint(rgw_op
, after_data_transfer
, s
->req_id
.c_str(), ofs
);
3982 // flush any data in filters
3983 op_ret
= filter
->process({}, ofs
);
3988 if (!chunked_upload
&& ofs
!= s
->content_length
) {
3989 op_ret
= -ERR_REQUEST_TIMEOUT
;
3993 s
->object
->set_obj_size(ofs
);
3995 perfcounter
->inc(l_rgw_put_b
, s
->obj_size
);
3997 op_ret
= do_aws4_auth_completion();
4002 op_ret
= s
->bucket
->check_quota(user_quota
, bucket_quota
, s
->obj_size
, y
);
4004 ldpp_dout(this, 20) << "second check_quota() returned op_ret=" << op_ret
<< dendl
;
4010 if (compressor
&& compressor
->is_compressed()) {
4012 RGWCompressionInfo cs_info
;
4013 cs_info
.compression_type
= plugin
->get_type_name();
4014 cs_info
.orig_size
= s
->obj_size
;
4015 cs_info
.compressor_message
= compressor
->get_compressor_message();
4016 cs_info
.blocks
= move(compressor
->get_compression_blocks());
4017 encode(cs_info
, tmp
);
4018 attrs
[RGW_ATTR_COMPRESSION
] = tmp
;
4019 ldpp_dout(this, 20) << "storing " << RGW_ATTR_COMPRESSION
4020 << " with type=" << cs_info
.compression_type
4021 << ", orig_size=" << cs_info
.orig_size
4022 << ", blocks=" << cs_info
.blocks
.size() << dendl
;
4025 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
4029 if (supplied_md5_b64
&& strcmp(calc_md5
, supplied_md5
)) {
4030 op_ret
= -ERR_BAD_DIGEST
;
4034 policy
.encode(aclbl
);
4035 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
4038 op_ret
= encode_dlo_manifest_attr(dlo_manifest
, attrs
);
4040 ldpp_dout(this, 0) << "bad user manifest: " << dlo_manifest
<< dendl
;
4046 bufferlist manifest_bl
;
4047 encode(*slo_info
, manifest_bl
);
4048 emplace_attr(RGW_ATTR_SLO_MANIFEST
, std::move(manifest_bl
));
4051 if (supplied_etag
&& etag
.compare(supplied_etag
) != 0) {
4052 op_ret
= -ERR_UNPROCESSABLE_ENTITY
;
4055 bl
.append(etag
.c_str(), etag
.size());
4056 emplace_attr(RGW_ATTR_ETAG
, std::move(bl
));
4058 populate_with_generic_attrs(s
, attrs
);
4059 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
);
4063 encode_delete_at_attr(delete_at
, attrs
);
4064 encode_obj_tags_attr(obj_tags
.get(), attrs
);
4065 rgw_cond_decode_objtags(s
, attrs
);
4067 /* Add a custom metadata to expose the information whether an object
4068 * is an SLO or not. Appending the attribute must be performed AFTER
4069 * processing any input from user in order to prohibit overwriting. */
4071 bufferlist slo_userindicator_bl
;
4072 slo_userindicator_bl
.append("True", 4);
4073 emplace_attr(RGW_ATTR_SLO_UINDICATOR
, std::move(slo_userindicator_bl
));
4075 if (obj_legal_hold
) {
4076 bufferlist obj_legal_hold_bl
;
4077 obj_legal_hold
->encode(obj_legal_hold_bl
);
4078 emplace_attr(RGW_ATTR_OBJECT_LEGAL_HOLD
, std::move(obj_legal_hold_bl
));
4080 if (obj_retention
) {
4081 bufferlist obj_retention_bl
;
4082 obj_retention
->encode(obj_retention_bl
);
4083 emplace_attr(RGW_ATTR_OBJECT_RETENTION
, std::move(obj_retention_bl
));
4086 tracepoint(rgw_op
, processor_complete_enter
, s
->req_id
.c_str());
4087 op_ret
= processor
->complete(s
->obj_size
, etag
, &mtime
, real_time(), attrs
,
4088 (delete_at
? *delete_at
: real_time()), if_match
, if_nomatch
,
4089 (user_data
.empty() ? nullptr : &user_data
), nullptr, nullptr,
4091 tracepoint(rgw_op
, processor_complete_exit
, s
->req_id
.c_str());
4093 /* produce torrent */
4094 if (s
->cct
->_conf
->rgw_torrent_flag
&& (ofs
== torrent
.get_data_len()))
4096 torrent
.init(s
, store
);
4097 torrent
.set_create_date(mtime
);
4098 op_ret
= torrent
.complete(y
);
4101 ldpp_dout(this, 0) << "ERROR: torrent.handle_data() returned " << op_ret
<< dendl
;
4106 // send request to notification manager
4107 const auto ret
= rgw::notify::publish_commit(s
->object
.get(), s
->obj_size
, mtime
, etag
, event_type
, res
, this);
4109 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
4110 // too late to rollback operation, hence op_ret is not set here
4114 int RGWPostObj::verify_permission(optional_yield y
)
4119 void RGWPostObj::pre_exec()
4121 rgw_bucket_object_pre_exec(s
);
4124 void RGWPostObj::execute(optional_yield y
)
4126 boost::optional
<RGWPutObj_Compress
> compressor
;
4127 CompressorRef plugin
;
4128 char supplied_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
4130 /* Read in the data from the POST form. */
4131 op_ret
= get_params(y
);
4136 op_ret
= verify_params();
4141 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
4142 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
4144 rgw::IAM::s3PutObject
,
4145 s
->object
->get_obj());
4146 if (identity_policy_res
== Effect::Deny
) {
4151 rgw::IAM::Effect e
= Effect::Pass
;
4152 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
4153 if (s
->iam_policy
) {
4154 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
4155 rgw::IAM::s3PutObject
,
4156 s
->object
->get_obj(),
4159 if (e
== Effect::Deny
) {
4164 if (!s
->session_policies
.empty()) {
4165 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
4167 rgw::IAM::s3PutObject
,
4168 s
->object
->get_obj());
4169 if (session_policy_res
== Effect::Deny
) {
4173 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
4174 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
4175 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
4176 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
)) {
4180 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
4181 //Intersection of session policy and identity policy plus bucket policy
4182 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
) {
4186 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
4187 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
4195 if (identity_policy_res
== Effect::Pass
&& e
== Effect::Pass
&& !verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4199 } else if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4204 // make reservation for notification if needed
4205 rgw::notify::reservation_t
res(this, store
, s
, s
->object
.get());
4206 const auto event_type
= rgw::notify::ObjectCreatedPost
;
4207 op_ret
= rgw::notify::publish_reserve(this, event_type
, res
, nullptr);
4212 /* Start iteration over data fields. It's necessary as Swift's FormPost
4213 * is capable to handle multiple files in single form. */
4215 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
4216 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
4218 ceph::buffer::list bl
, aclbl
;
4221 op_ret
= s
->bucket
->check_quota(user_quota
, bucket_quota
, s
->content_length
, y
);
4226 if (supplied_md5_b64
) {
4227 char supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1];
4228 ldpp_dout(this, 15) << "supplied_md5_b64=" << supplied_md5_b64
<< dendl
;
4229 op_ret
= ceph_unarmor(supplied_md5_bin
, &supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1],
4230 supplied_md5_b64
, supplied_md5_b64
+ strlen(supplied_md5_b64
));
4231 ldpp_dout(this, 15) << "ceph_armor ret=" << op_ret
<< dendl
;
4232 if (op_ret
!= CEPH_CRYPTO_MD5_DIGESTSIZE
) {
4233 op_ret
= -ERR_INVALID_DIGEST
;
4237 buf_to_hex((const unsigned char *)supplied_md5_bin
, CEPH_CRYPTO_MD5_DIGESTSIZE
, supplied_md5
);
4238 ldpp_dout(this, 15) << "supplied_md5=" << supplied_md5
<< dendl
;
4241 std::unique_ptr
<rgw::sal::RGWObject
> obj
=
4242 s
->bucket
->get_object(rgw_obj_key(get_current_filename()));
4243 if (s
->bucket
->versioning_enabled()) {
4244 obj
->gen_rand_obj_instance_name();
4247 auto aio
= rgw::make_throttle(s
->cct
->_conf
->rgw_put_obj_min_window_size
,
4250 using namespace rgw::putobj
;
4251 AtomicObjectProcessor
processor(&*aio
, store
, s
->bucket
.get(),
4253 s
->bucket_owner
.get_id(),
4254 *static_cast<RGWObjectCtx
*>(s
->obj_ctx
),
4255 std::move(obj
), 0, s
->req_id
, this, s
->yield
);
4256 op_ret
= processor
.prepare(s
->yield
);
4261 /* No filters by default. */
4262 DataProcessor
*filter
= &processor
;
4264 std::unique_ptr
<DataProcessor
> encrypt
;
4265 op_ret
= get_encrypt_filter(&encrypt
, filter
);
4269 if (encrypt
!= nullptr) {
4270 filter
= encrypt
.get();
4272 const auto& compression_type
= store
->svc()->zone
->get_zone_params().get_compression_type(
4274 if (compression_type
!= "none") {
4275 plugin
= Compressor::create(s
->cct
, compression_type
);
4277 ldpp_dout(this, 1) << "Cannot load plugin for compression type "
4278 << compression_type
<< dendl
;
4280 compressor
.emplace(s
->cct
, plugin
, filter
);
4281 filter
= &*compressor
;
4288 ceph::bufferlist data
;
4289 len
= get_data(data
, again
);
4300 hash
.Update((const unsigned char *)data
.c_str(), data
.length());
4301 op_ret
= filter
->process(std::move(data
), ofs
);
4305 if (ofs
> max_len
) {
4306 op_ret
= -ERR_TOO_LARGE
;
4312 op_ret
= filter
->process({}, ofs
);
4317 if (len
< min_len
) {
4318 op_ret
= -ERR_TOO_SMALL
;
4323 s
->object
->set_obj_size(ofs
);
4326 op_ret
= s
->bucket
->check_quota(user_quota
, bucket_quota
, s
->obj_size
, y
);
4332 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
4336 if (supplied_md5_b64
&& strcmp(calc_md5
, supplied_md5
)) {
4337 op_ret
= -ERR_BAD_DIGEST
;
4341 bl
.append(etag
.c_str(), etag
.size());
4342 emplace_attr(RGW_ATTR_ETAG
, std::move(bl
));
4344 policy
.encode(aclbl
);
4345 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
4347 const std::string content_type
= get_current_content_type();
4348 if (! content_type
.empty()) {
4349 ceph::bufferlist ct_bl
;
4350 ct_bl
.append(content_type
.c_str(), content_type
.size() + 1);
4351 emplace_attr(RGW_ATTR_CONTENT_TYPE
, std::move(ct_bl
));
4354 if (compressor
&& compressor
->is_compressed()) {
4355 ceph::bufferlist tmp
;
4356 RGWCompressionInfo cs_info
;
4357 cs_info
.compression_type
= plugin
->get_type_name();
4358 cs_info
.orig_size
= s
->obj_size
;
4359 cs_info
.compressor_message
= compressor
->get_compressor_message();
4360 cs_info
.blocks
= move(compressor
->get_compression_blocks());
4361 encode(cs_info
, tmp
);
4362 emplace_attr(RGW_ATTR_COMPRESSION
, std::move(tmp
));
4365 op_ret
= processor
.complete(s
->obj_size
, etag
, nullptr, real_time(), attrs
,
4366 (delete_at
? *delete_at
: real_time()),
4367 nullptr, nullptr, nullptr, nullptr, nullptr,
4372 } while (is_next_file_to_upload());
4374 // send request to notification manager
4375 const auto ret
= rgw::notify::publish_commit(s
->object
.get(), ofs
, ceph::real_clock::now(), etag
, event_type
, res
, this);
4377 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
4378 // too late to rollback operation, hence op_ret is not set here
4383 void RGWPutMetadataAccount::filter_out_temp_url(map
<string
, bufferlist
>& add_attrs
,
4384 const set
<string
>& rmattr_names
,
4385 map
<int, string
>& temp_url_keys
)
4387 map
<string
, bufferlist
>::iterator iter
;
4389 iter
= add_attrs
.find(RGW_ATTR_TEMPURL_KEY1
);
4390 if (iter
!= add_attrs
.end()) {
4391 temp_url_keys
[0] = iter
->second
.c_str();
4392 add_attrs
.erase(iter
);
4395 iter
= add_attrs
.find(RGW_ATTR_TEMPURL_KEY2
);
4396 if (iter
!= add_attrs
.end()) {
4397 temp_url_keys
[1] = iter
->second
.c_str();
4398 add_attrs
.erase(iter
);
4401 for (const string
& name
: rmattr_names
) {
4402 if (name
.compare(RGW_ATTR_TEMPURL_KEY1
) == 0) {
4403 temp_url_keys
[0] = string();
4405 if (name
.compare(RGW_ATTR_TEMPURL_KEY2
) == 0) {
4406 temp_url_keys
[1] = string();
4411 int RGWPutMetadataAccount::init_processing(optional_yield y
)
4413 /* First, go to the base class. At the time of writing the method was
4414 * responsible only for initializing the quota. This isn't necessary
4415 * here as we are touching metadata only. I'm putting this call only
4416 * for the future. */
4417 op_ret
= RGWOp::init_processing(y
);
4422 op_ret
= get_params(y
);
4427 op_ret
= store
->ctl()->user
->get_attrs_by_uid(this, s
->user
->get_id(), &orig_attrs
,
4436 policy
.encode(acl_bl
);
4437 attrs
.emplace(RGW_ATTR_ACL
, std::move(acl_bl
));
4440 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
, false);
4444 prepare_add_del_attrs(orig_attrs
, rmattr_names
, attrs
);
4445 populate_with_generic_attrs(s
, attrs
);
4447 /* Try extract the TempURL-related stuff now to allow verify_permission
4448 * evaluate whether we need FULL_CONTROL or not. */
4449 filter_out_temp_url(attrs
, rmattr_names
, temp_url_keys
);
4451 /* The same with quota except a client needs to be reseller admin. */
4452 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, new_quota
,
4453 &new_quota_extracted
);
4461 int RGWPutMetadataAccount::verify_permission(optional_yield y
)
4463 if (s
->auth
.identity
->is_anonymous()) {
4467 if (!verify_user_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4471 /* Altering TempURL keys requires FULL_CONTROL. */
4472 if (!temp_url_keys
.empty() && s
->perm_mask
!= RGW_PERM_FULL_CONTROL
) {
4476 /* We are failing this intensionally to allow system user/reseller admin
4477 * override in rgw_process.cc. This is the way to specify a given RGWOp
4478 * expect extra privileges. */
4479 if (new_quota_extracted
) {
4486 void RGWPutMetadataAccount::execute(optional_yield y
)
4488 /* Params have been extracted earlier. See init_processing(). */
4489 RGWUserInfo new_uinfo
;
4490 op_ret
= store
->ctl()->user
->get_info_by_uid(this, s
->user
->get_id(), &new_uinfo
, s
->yield
,
4491 RGWUserCtl::GetParams()
4492 .set_objv_tracker(&acct_op_tracker
));
4497 /* Handle the TempURL-related stuff. */
4498 if (!temp_url_keys
.empty()) {
4499 for (auto& pair
: temp_url_keys
) {
4500 new_uinfo
.temp_url_keys
[pair
.first
] = std::move(pair
.second
);
4504 /* Handle the quota extracted at the verify_permission step. */
4505 if (new_quota_extracted
) {
4506 new_uinfo
.user_quota
= std::move(new_quota
);
4509 /* We are passing here the current (old) user info to allow the function
4510 * optimize-out some operations. */
4511 op_ret
= store
->ctl()->user
->store_info(this, new_uinfo
, s
->yield
,
4512 RGWUserCtl::PutParams()
4513 .set_old_info(&s
->user
->get_info())
4514 .set_objv_tracker(&acct_op_tracker
)
4515 .set_attrs(&attrs
));
4518 int RGWPutMetadataBucket::verify_permission(optional_yield y
)
4520 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4527 void RGWPutMetadataBucket::pre_exec()
4529 rgw_bucket_object_pre_exec(s
);
4532 void RGWPutMetadataBucket::execute(optional_yield y
)
4534 op_ret
= get_params(y
);
4539 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
, false);
4544 if (!placement_rule
.empty() &&
4545 placement_rule
!= s
->bucket
->get_placement_rule()) {
4550 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
4551 /* Encode special metadata first as we're using std::map::emplace under
4552 * the hood. This method will add the new items only if the map doesn't
4553 * contain such keys yet. */
4555 if (s
->dialect
.compare("swift") == 0) {
4557 static_cast<RGWAccessControlPolicy_SWIFT
*>(s
->bucket_acl
.get());
4558 auto new_policy
= static_cast<RGWAccessControlPolicy_SWIFT
*>(&policy
);
4559 new_policy
->filter_merge(policy_rw_mask
, old_policy
);
4560 policy
= *new_policy
;
4564 emplace_attr(RGW_ATTR_ACL
, std::move(bl
));
4569 cors_config
.encode(bl
);
4570 emplace_attr(RGW_ATTR_CORS
, std::move(bl
));
4573 /* It's supposed that following functions WILL NOT change any
4574 * special attributes (like RGW_ATTR_ACL) if they are already
4575 * present in attrs. */
4576 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
4577 populate_with_generic_attrs(s
, attrs
);
4579 /* According to the Swift's behaviour and its container_quota
4580 * WSGI middleware implementation: anyone with write permissions
4581 * is able to set the bucket quota. This stays in contrast to
4582 * account quotas that can be set only by clients holding
4583 * reseller admin privileges. */
4584 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, s
->bucket
->get_info().quota
);
4589 if (swift_ver_location
) {
4590 s
->bucket
->get_info().swift_ver_location
= *swift_ver_location
;
4591 s
->bucket
->get_info().swift_versioning
= (!swift_ver_location
->empty());
4594 /* Web site of Swift API. */
4595 filter_out_website(attrs
, rmattr_names
, s
->bucket
->get_info().website_conf
);
4596 s
->bucket
->get_info().has_website
= !s
->bucket
->get_info().website_conf
.is_empty();
4598 /* Setting attributes also stores the provided bucket info. Due
4599 * to this fact, the new quota settings can be serialized with
4601 op_ret
= s
->bucket
->set_instance_attrs(this, attrs
, s
->yield
);
4606 int RGWPutMetadataObject::verify_permission(optional_yield y
)
4608 // This looks to be something specific to Swift. We could add
4609 // operations like swift:PutMetadataObject to the Policy Engine.
4610 if (!verify_object_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4617 void RGWPutMetadataObject::pre_exec()
4619 rgw_bucket_object_pre_exec(s
);
4622 void RGWPutMetadataObject::execute(optional_yield y
)
4625 rgw::sal::RGWAttrs attrs
, rmattrs
;
4627 s
->object
->set_atomic(s
->obj_ctx
);
4629 op_ret
= get_params(y
);
4634 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
);
4639 /* check if obj exists, read orig attrs */
4640 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, s
, &target_obj
);
4645 /* Check whether the object has expired. Swift API documentation
4646 * stands that we should return 404 Not Found in such case. */
4647 if (need_object_expiration() && s
->object
->is_expired()) {
4652 /* Filter currently existing attributes. */
4653 prepare_add_del_attrs(s
->object
->get_attrs(), attrs
, rmattrs
);
4654 populate_with_generic_attrs(s
, attrs
);
4655 encode_delete_at_attr(delete_at
, attrs
);
4658 op_ret
= encode_dlo_manifest_attr(dlo_manifest
, attrs
);
4660 ldpp_dout(this, 0) << "bad user manifest: " << dlo_manifest
<< dendl
;
4665 op_ret
= s
->object
->set_obj_attrs(this, s
->obj_ctx
, &attrs
, &rmattrs
, s
->yield
, &target_obj
);
4668 int RGWDeleteObj::handle_slo_manifest(bufferlist
& bl
, optional_yield y
)
4670 RGWSLOInfo slo_info
;
4671 auto bliter
= bl
.cbegin();
4673 decode(slo_info
, bliter
);
4674 } catch (buffer::error
& err
) {
4675 ldpp_dout(this, 0) << "ERROR: failed to decode slo manifest" << dendl
;
4680 deleter
= std::unique_ptr
<RGWBulkDelete::Deleter
>(\
4681 new RGWBulkDelete::Deleter(this, store
, s
));
4682 } catch (const std::bad_alloc
&) {
4686 list
<RGWBulkDelete::acct_path_t
> items
;
4687 for (const auto& iter
: slo_info
.entries
) {
4688 const string
& path_str
= iter
.path
;
4690 const size_t sep_pos
= path_str
.find('/', 1 /* skip first slash */);
4691 if (std::string_view::npos
== sep_pos
) {
4695 RGWBulkDelete::acct_path_t path
;
4697 path
.bucket_name
= url_decode(path_str
.substr(1, sep_pos
- 1));
4698 path
.obj_key
= url_decode(path_str
.substr(sep_pos
+ 1));
4700 items
.push_back(path
);
4703 /* Request removal of the manifest object itself. */
4704 RGWBulkDelete::acct_path_t path
;
4705 path
.bucket_name
= s
->bucket_name
;
4706 path
.obj_key
= s
->object
->get_key();
4707 items
.push_back(path
);
4709 int ret
= deleter
->delete_chunk(items
, y
);
4717 int RGWDeleteObj::verify_permission(optional_yield y
)
4719 int op_ret
= get_params(y
);
4723 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || ! s
->session_policies
.empty()) {
4724 if (s
->bucket
->get_info().obj_lock_enabled() && bypass_governance_mode
) {
4725 auto r
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
, boost::none
,
4726 rgw::IAM::s3BypassGovernanceRetention
, ARN(s
->bucket
->get_key(), s
->object
->get_name()));
4727 if (r
== Effect::Deny
) {
4728 bypass_perm
= false;
4729 } else if (r
== Effect::Pass
&& s
->iam_policy
) {
4730 r
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
, rgw::IAM::s3BypassGovernanceRetention
,
4731 ARN(s
->bucket
->get_key(), s
->object
->get_name()));
4732 if (r
== Effect::Deny
) {
4733 bypass_perm
= false;
4735 } else if (r
== Effect::Pass
&& !s
->session_policies
.empty()) {
4736 r
= eval_identity_or_session_policies(s
->session_policies
, s
->env
, boost::none
,
4737 rgw::IAM::s3BypassGovernanceRetention
, ARN(s
->bucket
->get_key(), s
->object
->get_name()));
4738 if (r
== Effect::Deny
) {
4739 bypass_perm
= false;
4743 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
4745 s
->object
->get_instance().empty() ?
4746 rgw::IAM::s3DeleteObject
:
4747 rgw::IAM::s3DeleteObjectVersion
,
4748 ARN(s
->bucket
->get_key(), s
->object
->get_name()));
4749 if (identity_policy_res
== Effect::Deny
) {
4753 rgw::IAM::Effect r
= Effect::Pass
;
4754 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
4755 if (s
->iam_policy
) {
4756 r
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
4757 s
->object
->get_instance().empty() ?
4758 rgw::IAM::s3DeleteObject
:
4759 rgw::IAM::s3DeleteObjectVersion
,
4760 ARN(s
->bucket
->get_key(), s
->object
->get_name()),
4763 if (r
== Effect::Deny
)
4766 if (!s
->session_policies
.empty()) {
4767 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
4769 s
->object
->get_instance().empty() ?
4770 rgw::IAM::s3DeleteObject
:
4771 rgw::IAM::s3DeleteObjectVersion
,
4772 ARN(s
->bucket
->get_key(), s
->object
->get_name()));
4773 if (session_policy_res
== Effect::Deny
) {
4776 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
4777 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
4778 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
4779 (session_policy_res
== Effect::Allow
&& r
== Effect::Allow
)) {
4782 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
4783 //Intersection of session policy and identity policy plus bucket policy
4784 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || r
== Effect::Allow
) {
4787 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
4788 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
4794 if (r
== Effect::Allow
|| identity_policy_res
== Effect::Allow
)
4798 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4802 if (s
->bucket
->get_info().mfa_enabled() &&
4803 !s
->object
->get_instance().empty() &&
4805 ldpp_dout(this, 5) << "NOTICE: object delete request with a versioned object, mfa auth not provided" << dendl
;
4806 return -ERR_MFA_REQUIRED
;
4812 void RGWDeleteObj::pre_exec()
4814 rgw_bucket_object_pre_exec(s
);
4817 void RGWDeleteObj::execute(optional_yield y
)
4819 if (!s
->bucket_exists
) {
4820 op_ret
= -ERR_NO_SUCH_BUCKET
;
4823 s
->object
->set_bucket(s
->bucket
.get());
4825 if (!rgw::sal::RGWObject::empty(s
->object
.get())) {
4826 uint64_t obj_size
= 0;
4828 RGWObjectCtx
* obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
4830 RGWObjState
* astate
= nullptr;
4831 bool check_obj_lock
= s
->object
->have_instance() && s
->bucket
->get_info().obj_lock_enabled();
4833 op_ret
= s
->object
->get_obj_state(this, obj_ctx
, *s
->bucket
.get(), &astate
, s
->yield
, true);
4835 if (need_object_expiration() || multipart_delete
) {
4839 if (check_obj_lock
) {
4840 /* check if obj exists, read orig attrs */
4841 if (op_ret
== -ENOENT
) {
4842 /* object maybe delete_marker, skip check_obj_lock*/
4843 check_obj_lock
= false;
4849 obj_size
= astate
->size
;
4850 etag
= astate
->attrset
[RGW_ATTR_ETAG
].to_str();
4853 // ignore return value from get_obj_attrs in all other cases
4856 if (check_obj_lock
) {
4857 ceph_assert(astate
);
4858 int object_lock_response
= verify_object_lock(this, astate
->attrset
, bypass_perm
, bypass_governance_mode
);
4859 if (object_lock_response
!= 0) {
4860 op_ret
= object_lock_response
;
4861 if (op_ret
== -EACCES
) {
4862 s
->err
.message
= "forbidden by object lock";
4868 if (multipart_delete
) {
4870 op_ret
= -ERR_NOT_SLO_MANIFEST
;
4874 const auto slo_attr
= astate
->attrset
.find(RGW_ATTR_SLO_MANIFEST
);
4876 if (slo_attr
!= astate
->attrset
.end()) {
4877 op_ret
= handle_slo_manifest(slo_attr
->second
, y
);
4879 ldpp_dout(this, 0) << "ERROR: failed to handle slo manifest ret=" << op_ret
<< dendl
;
4882 op_ret
= -ERR_NOT_SLO_MANIFEST
;
4889 // make reservation for notification if needed
4890 rgw::notify::reservation_t
res(this, store
, s
, s
->object
.get());
4891 const auto versioned_object
= s
->bucket
->versioning_enabled();
4892 const auto event_type
= versioned_object
&& s
->object
->get_instance().empty() ?
4893 rgw::notify::ObjectRemovedDeleteMarkerCreated
: rgw::notify::ObjectRemovedDelete
;
4894 op_ret
= rgw::notify::publish_reserve(this, event_type
, res
, nullptr);
4899 s
->object
->set_atomic(s
->obj_ctx
);
4901 bool ver_restored
= false;
4902 op_ret
= s
->object
->swift_versioning_restore(s
->obj_ctx
, ver_restored
, this);
4907 if (!ver_restored
) {
4910 /* Swift's versioning mechanism hasn't found any previous version of
4911 * the object that could be restored. This means we should proceed
4912 * with the regular delete path. */
4913 op_ret
= get_system_versioning_params(s
, &epoch
, &version_id
);
4918 op_ret
= s
->object
->delete_object(this, obj_ctx
, s
->owner
, s
->bucket_owner
, unmod_since
,
4919 s
->system_request
, epoch
, version_id
, s
->yield
);
4921 delete_marker
= s
->object
->get_delete_marker();
4924 /* Check whether the object has expired. Swift API documentation
4925 * stands that we should return 404 Not Found in such case. */
4926 if (need_object_expiration() && s
->object
->is_expired()) {
4932 if (op_ret
== -ECANCELED
) {
4935 if (op_ret
== -ERR_PRECONDITION_FAILED
&& no_precondition_error
) {
4939 // send request to notification manager
4940 const auto ret
= rgw::notify::publish_commit(s
->object
.get(), obj_size
, ceph::real_clock::now(), etag
, event_type
, res
, this);
4942 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
4943 // too late to rollback operation, hence op_ret is not set here
4950 bool RGWCopyObj::parse_copy_location(const std::string_view
& url_src
,
4951 string
& bucket_name
,
4955 std::string_view name_str
;
4956 std::string_view params_str
;
4958 // search for ? before url-decoding so we don't accidentally match %3F
4959 size_t pos
= url_src
.find('?');
4960 if (pos
== string::npos
) {
4963 name_str
= url_src
.substr(0, pos
);
4964 params_str
= url_src
.substr(pos
+ 1);
4967 std::string_view dec_src
{name_str
};
4968 if (dec_src
[0] == '/')
4969 dec_src
.remove_prefix(1);
4971 pos
= dec_src
.find('/');
4972 if (pos
== string::npos
)
4975 bucket_name
= url_decode(dec_src
.substr(0, pos
));
4976 key
.name
= url_decode(dec_src
.substr(pos
+ 1));
4978 if (key
.name
.empty()) {
4982 if (! params_str
.empty()) {
4984 args
.set(std::string(params_str
));
4987 key
.instance
= args
.get("versionId", NULL
);
4993 int RGWCopyObj::verify_permission(optional_yield y
)
4995 RGWAccessControlPolicy
src_acl(s
->cct
);
4996 boost::optional
<Policy
> src_policy
;
4997 op_ret
= get_params(y
);
5001 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
5006 /* This is a bit of a hack; create an empty bucket, then load it below. */
5007 op_ret
= store
->get_bucket(s
->user
.get(), RGWBucketInfo(), &src_bucket
);
5009 if (op_ret
== -ENOENT
) {
5010 op_ret
= -ERR_NO_SUCH_BUCKET
;
5015 op_ret
= src_bucket
->load_by_name(this, src_tenant_name
, src_bucket_name
, s
->bucket_instance_id
,
5016 s
->sysobj_ctx
, s
->yield
);
5018 if (op_ret
== -ENOENT
) {
5019 op_ret
= -ERR_NO_SUCH_BUCKET
;
5024 src_object
->set_bucket(src_bucket
.get());
5025 /* get buckets info (source and dest) */
5026 if (s
->local_source
&& source_zone
.empty()) {
5027 src_object
->set_atomic(s
->obj_ctx
);
5028 src_object
->set_prefetch_data(s
->obj_ctx
);
5030 rgw_placement_rule src_placement
;
5032 /* check source object permissions */
5033 op_ret
= read_obj_policy(this, store
, s
, src_bucket
->get_info(), src_bucket
->get_attrs(), &src_acl
, &src_placement
.storage_class
,
5034 src_policy
, src_bucket
.get(), src_object
.get(), y
);
5039 /* follow up on previous checks that required reading source object head */
5040 if (need_to_check_storage_class
) {
5041 src_placement
.inherit_from(src_bucket
->get_placement_rule());
5043 op_ret
= check_storage_class(src_placement
);
5049 /* admin request overrides permission checks */
5050 if (!s
->auth
.identity
->is_admin_of(src_acl
.get_owner().get_id())) {
5051 if (src_policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
5052 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
5054 src_object
->get_instance().empty() ?
5055 rgw::IAM::s3GetObject
:
5056 rgw::IAM::s3GetObjectVersion
,
5057 ARN(src_object
->get_obj()));
5058 if (identity_policy_res
== Effect::Deny
) {
5061 auto e
= Effect::Pass
;
5062 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
5064 e
= src_policy
->eval(s
->env
, *s
->auth
.identity
,
5065 src_object
->get_instance().empty() ?
5066 rgw::IAM::s3GetObject
:
5067 rgw::IAM::s3GetObjectVersion
,
5068 ARN(src_object
->get_obj()),
5071 if (e
== Effect::Deny
) {
5074 if (!s
->session_policies
.empty()) {
5075 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
5077 src_object
->get_instance().empty() ?
5078 rgw::IAM::s3GetObject
:
5079 rgw::IAM::s3GetObjectVersion
,
5080 ARN(src_object
->get_obj()));
5081 if (session_policy_res
== Effect::Deny
) {
5084 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
5085 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
5086 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) &&
5087 (session_policy_res
!= Effect::Allow
|| e
!= Effect::Allow
)) {
5090 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
5091 //Intersection of session policy and identity policy plus bucket policy
5092 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) && e
!= Effect::Allow
) {
5095 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
5096 if (session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) {
5101 if (identity_policy_res
== Effect::Pass
&& e
== Effect::Pass
&&
5102 !src_acl
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
5106 } else if (!src_acl
.verify_permission(this, *s
->auth
.identity
,
5114 RGWAccessControlPolicy
dest_bucket_policy(s
->cct
);
5116 if (src_bucket_name
.compare(dest_bucket_name
) == 0) { /* will only happen if s->local_source
5117 or intra region sync */
5118 dest_bucket
= src_bucket
->clone();
5120 op_ret
= store
->get_bucket(s
->user
.get(), RGWBucketInfo(), &dest_bucket
);
5122 if (op_ret
== -ENOENT
) {
5123 ldpp_dout(this, 0) << "ERROR: Destination Bucket not found for user: " << s
->user
->get_id().to_str() << dendl
;
5124 op_ret
= -ERR_NO_SUCH_BUCKET
;
5128 op_ret
= dest_bucket
->load_by_name(this, dest_tenant_name
, dest_bucket_name
, std::string(),
5129 s
->sysobj_ctx
, s
->yield
);
5131 if (op_ret
== -ENOENT
) {
5132 op_ret
= -ERR_NO_SUCH_BUCKET
;
5138 dest_object
= store
->get_object(rgw_obj_key(dest_obj_name
));
5139 dest_object
->set_bucket(dest_bucket
.get());
5140 dest_object
->set_atomic(s
->obj_ctx
);
5142 /* check dest bucket permissions */
5143 op_ret
= read_bucket_policy(this, store
, s
, dest_bucket
->get_info(),
5144 dest_bucket
->get_attrs(),
5145 &dest_bucket_policy
, dest_bucket
->get_key(), y
);
5149 auto dest_iam_policy
= get_iam_policy_from_attr(s
->cct
, dest_bucket
->get_attrs(), dest_bucket
->get_tenant());
5150 /* admin request overrides permission checks */
5151 if (! s
->auth
.identity
->is_admin_of(dest_policy
.get_owner().get_id())){
5152 if (dest_iam_policy
!= boost::none
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
5153 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-copy-source", copy_source
);
5155 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-metadata-directive",
5158 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
,
5159 s
->env
, boost::none
,
5160 rgw::IAM::s3PutObject
,
5161 ARN(dest_object
->get_obj()));
5162 if (identity_policy_res
== Effect::Deny
) {
5165 auto e
= Effect::Pass
;
5166 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
5167 if (dest_iam_policy
) {
5168 e
= dest_iam_policy
->eval(s
->env
, *s
->auth
.identity
,
5169 rgw::IAM::s3PutObject
,
5170 ARN(dest_object
->get_obj()),
5173 if (e
== Effect::Deny
) {
5176 if (!s
->session_policies
.empty()) {
5177 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
, boost::none
, rgw::IAM::s3PutObject
, ARN(dest_object
->get_obj()));
5178 if (session_policy_res
== Effect::Deny
) {
5181 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
5182 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
5183 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) &&
5184 (session_policy_res
!= Effect::Allow
|| e
== Effect::Allow
)) {
5187 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
5188 //Intersection of session policy and identity policy plus bucket policy
5189 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) && e
!= Effect::Allow
) {
5192 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
5193 if (session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) {
5198 if (identity_policy_res
== Effect::Pass
&& e
== Effect::Pass
&&
5199 ! dest_bucket_policy
.verify_permission(this,
5205 } else if (! dest_bucket_policy
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
5212 op_ret
= init_dest_policy();
5221 int RGWCopyObj::init_common()
5224 if (parse_time(if_mod
, &mod_time
) < 0) {
5228 mod_ptr
= &mod_time
;
5232 if (parse_time(if_unmod
, &unmod_time
) < 0) {
5236 unmod_ptr
= &unmod_time
;
5240 dest_policy
.encode(aclbl
);
5241 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
5243 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
);
5247 populate_with_generic_attrs(s
, attrs
);
5252 static void copy_obj_progress_cb(off_t ofs
, void *param
)
5254 RGWCopyObj
*op
= static_cast<RGWCopyObj
*>(param
);
5255 op
->progress_cb(ofs
);
5258 void RGWCopyObj::progress_cb(off_t ofs
)
5260 if (!s
->cct
->_conf
->rgw_copy_obj_progress
)
5263 if (ofs
- last_ofs
< s
->cct
->_conf
->rgw_copy_obj_progress_every_bytes
)
5266 send_partial_response(ofs
);
5271 void RGWCopyObj::pre_exec()
5273 rgw_bucket_object_pre_exec(s
);
5276 void RGWCopyObj::execute(optional_yield y
)
5278 if (init_common() < 0)
5281 if (! s
->object
->get_bucket()) {
5282 s
->bucket
= src_object
->get_bucket()->clone();
5283 s
->object
->set_bucket(s
->bucket
.get());
5286 // make reservation for notification if needed
5287 rgw::notify::reservation_t
res(this, store
, s
, s
->object
.get());
5288 const auto event_type
= rgw::notify::ObjectCreatedCopy
;
5289 op_ret
= rgw::notify::publish_reserve(this, event_type
, res
, nullptr);
5294 if ( ! version_id
.empty()) {
5295 dest_object
->set_instance(version_id
);
5296 } else if (dest_bucket
->versioning_enabled()) {
5297 dest_object
->gen_rand_obj_instance_name();
5300 src_object
->set_atomic(s
->obj_ctx
);
5301 dest_object
->set_atomic(s
->obj_ctx
);
5303 encode_delete_at_attr(delete_at
, attrs
);
5305 uint64_t obj_size
= 0;
5307 // get src object size (cached in obj_ctx from verify_permission())
5308 RGWObjState
* astate
= nullptr;
5309 op_ret
= src_object
->get_obj_state(this, s
->obj_ctx
, *src_bucket
, &astate
,
5314 obj_size
= astate
->size
;
5316 if (!s
->system_request
) { // no quota enforcement for system requests
5317 // enforce quota against the destination bucket owner
5318 op_ret
= dest_bucket
->check_quota(user_quota
, bucket_quota
,
5319 astate
->accounted_size
, y
);
5326 bool high_precision_time
= (s
->system_request
);
5328 /* Handle object versioning of Swift API. In case of copying to remote this
5329 * should fail gently (op_ret == 0) as the dst_obj will not exist here. */
5330 op_ret
= dest_object
->swift_versioning_copy(s
->obj_ctx
, this, s
->yield
);
5335 RGWObjectCtx
& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
5336 op_ret
= src_object
->copy_object(obj_ctx
,
5348 high_precision_time
,
5354 RGWObjCategory::Main
,
5357 (version_id
.empty() ? NULL
: &version_id
),
5358 &s
->req_id
, /* use req_id as tag */
5360 copy_obj_progress_cb
, (void *)this,
5364 // send request to notification manager
5365 const auto ret
= rgw::notify::publish_commit(s
->object
.get(), obj_size
, mtime
, etag
, event_type
, res
, this);
5367 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
5368 // too late to rollback operation, hence op_ret is not set here
5372 int RGWGetACLs::verify_permission(optional_yield y
)
5375 if (!rgw::sal::RGWObject::empty(s
->object
.get())) {
5376 auto iam_action
= s
->object
->get_instance().empty() ?
5377 rgw::IAM::s3GetObjectAcl
:
5378 rgw::IAM::s3GetObjectVersionAcl
;
5380 if (s
->iam_policy
&& s
->iam_policy
->has_partial_conditional(S3_EXISTING_OBJTAG
)){
5381 rgw_iam_add_existing_objtags(this, store
, s
, iam_action
);
5383 if (! s
->iam_user_policies
.empty()) {
5384 for (auto& user_policy
: s
->iam_user_policies
) {
5385 if (user_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
)) {
5386 rgw_iam_add_existing_objtags(this, store
, s
, iam_action
);
5390 perm
= verify_object_permission(this, s
, iam_action
);
5392 if (!s
->bucket_exists
) {
5393 return -ERR_NO_SUCH_BUCKET
;
5395 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketAcl
);
5403 void RGWGetACLs::pre_exec()
5405 rgw_bucket_object_pre_exec(s
);
5408 void RGWGetACLs::execute(optional_yield y
)
5411 RGWAccessControlPolicy
* const acl
= \
5412 (!rgw::sal::RGWObject::empty(s
->object
.get()) ? s
->object_acl
.get() : s
->bucket_acl
.get());
5413 RGWAccessControlPolicy_S3
* const s3policy
= \
5414 static_cast<RGWAccessControlPolicy_S3
*>(acl
);
5415 s3policy
->to_xml(ss
);
5421 int RGWPutACLs::verify_permission(optional_yield y
)
5425 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-acl", s
->canned_acl
);
5427 rgw_add_grant_to_iam_environment(s
->env
, s
);
5428 if (!rgw::sal::RGWObject::empty(s
->object
.get())) {
5429 auto iam_action
= s
->object
->get_instance().empty() ? rgw::IAM::s3PutObjectAcl
: rgw::IAM::s3PutObjectVersionAcl
;
5430 op_ret
= rgw_iam_add_existing_objtags(this, store
, s
, iam_action
);
5431 perm
= verify_object_permission(this, s
, iam_action
);
5433 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketAcl
);
5441 int RGWGetLC::verify_permission(optional_yield y
)
5444 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3GetLifecycleConfiguration
);
5451 int RGWPutLC::verify_permission(optional_yield y
)
5454 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3PutLifecycleConfiguration
);
5461 int RGWDeleteLC::verify_permission(optional_yield y
)
5464 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3PutLifecycleConfiguration
);
5471 void RGWPutACLs::pre_exec()
5473 rgw_bucket_object_pre_exec(s
);
5476 void RGWGetLC::pre_exec()
5478 rgw_bucket_object_pre_exec(s
);
5481 void RGWPutLC::pre_exec()
5483 rgw_bucket_object_pre_exec(s
);
5486 void RGWDeleteLC::pre_exec()
5488 rgw_bucket_object_pre_exec(s
);
5491 void RGWPutACLs::execute(optional_yield y
)
5495 RGWAccessControlPolicy_S3
*policy
= NULL
;
5496 RGWACLXMLParser_S3
parser(s
->cct
);
5497 RGWAccessControlPolicy_S3
new_policy(s
->cct
);
5500 op_ret
= 0; /* XXX redundant? */
5502 if (!parser
.init()) {
5508 RGWAccessControlPolicy
* const existing_policy
= \
5509 (rgw::sal::RGWObject::empty(s
->object
.get()) ? s
->bucket_acl
.get() : s
->object_acl
.get());
5511 owner
= existing_policy
->get_owner();
5513 op_ret
= get_params(y
);
5515 if (op_ret
== -ERANGE
) {
5516 ldpp_dout(this, 4) << "The size of request xml data is larger than the max limitation, data size = "
5517 << s
->length
<< dendl
;
5518 op_ret
= -ERR_MALFORMED_XML
;
5519 s
->err
.message
= "The XML you provided was larger than the maximum " +
5520 std::to_string(s
->cct
->_conf
->rgw_max_put_param_size
) +
5526 char* buf
= data
.c_str();
5527 ldpp_dout(this, 15) << "read len=" << data
.length() << " data=" << (buf
? buf
: "") << dendl
;
5529 if (!s
->canned_acl
.empty() && data
.length() > 0) {
5534 if (!s
->canned_acl
.empty() || s
->has_acl_header
) {
5535 op_ret
= get_policy_from_state(store
, s
, ss
);
5540 data
.append(ss
.str());
5543 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
5547 policy
= static_cast<RGWAccessControlPolicy_S3
*>(parser
.find_first("AccessControlPolicy"));
5553 const RGWAccessControlList
& req_acl
= policy
->get_acl();
5554 const multimap
<string
, ACLGrant
>& req_grant_map
= req_acl
.get_grant_map();
5555 #define ACL_GRANTS_MAX_NUM 100
5556 int max_num
= s
->cct
->_conf
->rgw_acl_grants_max_num
;
5558 max_num
= ACL_GRANTS_MAX_NUM
;
5561 int grants_num
= req_grant_map
.size();
5562 if (grants_num
> max_num
) {
5563 ldpp_dout(this, 4) << "An acl can have up to " << max_num
5564 << " grants, request acl grants num: " << grants_num
<< dendl
;
5565 op_ret
= -ERR_LIMIT_EXCEEDED
;
5566 s
->err
.message
= "The request is rejected, because the acl grants number you requested is larger than the maximum "
5567 + std::to_string(max_num
)
5568 + " grants allowed in an acl.";
5572 // forward bucket acl requests to meta master zone
5573 if ((rgw::sal::RGWObject::empty(s
->object
.get()))) {
5575 // include acl data unless it was generated from a canned_acl
5576 if (s
->canned_acl
.empty()) {
5577 in_data
.append(data
);
5579 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
5581 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5586 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
5587 ldpp_dout(this, 15) << "Old AccessControlPolicy";
5588 policy
->to_xml(*_dout
);
5592 op_ret
= policy
->rebuild(this, store
->ctl()->user
, &owner
, new_policy
, s
->err
.message
);
5596 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
5597 ldpp_dout(this, 15) << "New AccessControlPolicy:";
5598 new_policy
.to_xml(*_dout
);
5602 if (s
->bucket_access_conf
&&
5603 s
->bucket_access_conf
->block_public_acls() &&
5604 new_policy
.is_public(this)) {
5608 new_policy
.encode(bl
);
5609 map
<string
, bufferlist
> attrs
;
5611 if (!rgw::sal::RGWObject::empty(s
->object
.get())) {
5612 s
->object
->set_atomic(s
->obj_ctx
);
5613 //if instance is empty, we should modify the latest object
5614 op_ret
= s
->object
->modify_obj_attrs(s
->obj_ctx
, RGW_ATTR_ACL
, bl
, s
->yield
, this);
5616 map
<string
,bufferlist
> attrs
= s
->bucket_attrs
;
5617 attrs
[RGW_ATTR_ACL
] = bl
;
5618 op_ret
= store
->ctl()->bucket
->set_bucket_instance_attrs(s
->bucket
->get_info(), attrs
,
5619 &s
->bucket
->get_info().objv_tracker
,
5622 if (op_ret
== -ECANCELED
) {
5623 op_ret
= 0; /* lost a race, but it's ok because acls are immutable */
5627 void RGWPutLC::execute(optional_yield y
)
5631 RGWLifecycleConfiguration_S3
config(s
->cct
);
5632 RGWXMLParser parser
;
5633 RGWLifecycleConfiguration_S3
new_config(s
->cct
);
5635 content_md5
= s
->info
.env
->get("HTTP_CONTENT_MD5");
5636 if (content_md5
== nullptr) {
5637 op_ret
= -ERR_INVALID_REQUEST
;
5638 s
->err
.message
= "Missing required header for this request: Content-MD5";
5639 ldpp_dout(this, 5) << s
->err
.message
<< dendl
;
5643 std::string content_md5_bin
;
5645 content_md5_bin
= rgw::from_base64(std::string_view(content_md5
));
5647 s
->err
.message
= "Request header Content-MD5 contains character "
5648 "that is not base64 encoded.";
5649 ldpp_dout(this, 5) << s
->err
.message
<< dendl
;
5650 op_ret
= -ERR_BAD_DIGEST
;
5654 if (!parser
.init()) {
5659 op_ret
= get_params(y
);
5663 char* buf
= data
.c_str();
5664 ldpp_dout(this, 15) << "read len=" << data
.length() << " data=" << (buf
? buf
: "") << dendl
;
5667 unsigned char data_hash_res
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
5668 data_hash
.Update(reinterpret_cast<const unsigned char*>(buf
), data
.length());
5669 data_hash
.Final(data_hash_res
);
5671 if (memcmp(data_hash_res
, content_md5_bin
.c_str(), CEPH_CRYPTO_MD5_DIGESTSIZE
) != 0) {
5672 op_ret
= -ERR_BAD_DIGEST
;
5673 s
->err
.message
= "The Content-MD5 you specified did not match what we received.";
5674 ldpp_dout(this, 5) << s
->err
.message
5675 << " Specified content md5: " << content_md5
5676 << ", calculated content md5: " << data_hash_res
5681 if (!parser
.parse(buf
, data
.length(), 1)) {
5682 op_ret
= -ERR_MALFORMED_XML
;
5687 RGWXMLDecoder::decode_xml("LifecycleConfiguration", config
, &parser
);
5688 } catch (RGWXMLDecoder::err
& err
) {
5689 ldpp_dout(this, 5) << "Bad lifecycle configuration: " << err
<< dendl
;
5690 op_ret
= -ERR_MALFORMED_XML
;
5694 op_ret
= config
.rebuild(new_config
);
5698 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
5700 new_config
.dump_xml(&xf
);
5703 ldpp_dout(this, 15) << "New LifecycleConfiguration:" << ss
.str() << dendl
;
5706 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
5708 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5712 op_ret
= store
->get_rgwlc()->set_bucket_config(s
->bucket
->get_info(), s
->bucket_attrs
, &new_config
);
5719 void RGWDeleteLC::execute(optional_yield y
)
5722 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
5724 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5728 op_ret
= store
->get_rgwlc()->remove_bucket_config(s
->bucket
->get_info(), s
->bucket_attrs
);
5735 int RGWGetCORS::verify_permission(optional_yield y
)
5737 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketCORS
);
5740 void RGWGetCORS::execute(optional_yield y
)
5742 op_ret
= read_bucket_cors();
5747 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
5748 op_ret
= -ERR_NO_CORS_FOUND
;
5753 int RGWPutCORS::verify_permission(optional_yield y
)
5755 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketCORS
);
5758 void RGWPutCORS::execute(optional_yield y
)
5762 op_ret
= get_params(y
);
5766 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
5768 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5772 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
5773 rgw::sal::RGWAttrs
attrs(s
->bucket_attrs
);
5774 attrs
[RGW_ATTR_CORS
] = cors_bl
;
5775 return s
->bucket
->set_instance_attrs(this, attrs
, s
->yield
);
5779 int RGWDeleteCORS::verify_permission(optional_yield y
)
5781 // No separate delete permission
5782 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketCORS
);
5785 void RGWDeleteCORS::execute(optional_yield y
)
5788 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
5790 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5794 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
5795 op_ret
= read_bucket_cors();
5800 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
5805 rgw::sal::RGWAttrs
attrs(s
->bucket_attrs
);
5806 attrs
.erase(RGW_ATTR_CORS
);
5807 op_ret
= s
->bucket
->set_instance_attrs(this, attrs
, s
->yield
);
5809 ldpp_dout(this, 0) << "RGWLC::RGWDeleteCORS() failed to set attrs on bucket=" << s
->bucket
->get_name()
5810 << " returned err=" << op_ret
<< dendl
;
5816 void RGWOptionsCORS::get_response_params(string
& hdrs
, string
& exp_hdrs
, unsigned *max_age
) {
5817 get_cors_response_headers(rule
, req_hdrs
, hdrs
, exp_hdrs
, max_age
);
5820 int RGWOptionsCORS::validate_cors_request(RGWCORSConfiguration
*cc
) {
5821 rule
= cc
->host_name_rule(origin
);
5823 ldpp_dout(this, 10) << "There is no cors rule present for " << origin
<< dendl
;
5827 if (!validate_cors_rule_method(rule
, req_meth
)) {
5831 if (!validate_cors_rule_header(rule
, req_hdrs
)) {
5838 void RGWOptionsCORS::execute(optional_yield y
)
5840 op_ret
= read_bucket_cors();
5844 origin
= s
->info
.env
->get("HTTP_ORIGIN");
5846 ldpp_dout(this, 0) << "Missing mandatory Origin header" << dendl
;
5850 req_meth
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
5852 ldpp_dout(this, 0) << "Missing mandatory Access-control-request-method header" << dendl
;
5857 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
5861 req_hdrs
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
5862 op_ret
= validate_cors_request(&bucket_cors
);
5864 origin
= req_meth
= NULL
;
5870 int RGWGetRequestPayment::verify_permission(optional_yield y
)
5872 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketRequestPayment
);
5875 void RGWGetRequestPayment::pre_exec()
5877 rgw_bucket_object_pre_exec(s
);
5880 void RGWGetRequestPayment::execute(optional_yield y
)
5882 requester_pays
= s
->bucket
->get_info().requester_pays
;
5885 int RGWSetRequestPayment::verify_permission(optional_yield y
)
5887 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketRequestPayment
);
5890 void RGWSetRequestPayment::pre_exec()
5892 rgw_bucket_object_pre_exec(s
);
5895 void RGWSetRequestPayment::execute(optional_yield y
)
5898 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
5900 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5904 op_ret
= get_params(y
);
5909 s
->bucket
->get_info().requester_pays
= requester_pays
;
5910 op_ret
= s
->bucket
->put_instance_info(this, false, real_time());
5912 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
->get_name()
5913 << " returned err=" << op_ret
<< dendl
;
5916 s
->bucket_attrs
= s
->bucket
->get_attrs();
5919 int RGWInitMultipart::verify_permission(optional_yield y
)
5921 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
5922 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
5924 rgw::IAM::s3PutObject
,
5925 s
->object
->get_obj());
5926 if (identity_policy_res
== Effect::Deny
) {
5930 rgw::IAM::Effect e
= Effect::Pass
;
5931 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
5932 if (s
->iam_policy
) {
5933 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
5934 rgw::IAM::s3PutObject
,
5935 s
->object
->get_obj(),
5938 if (e
== Effect::Deny
) {
5942 if (!s
->session_policies
.empty()) {
5943 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
5945 rgw::IAM::s3PutObject
,
5946 s
->object
->get_obj());
5947 if (session_policy_res
== Effect::Deny
) {
5950 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
5951 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
5952 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
5953 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
)) {
5956 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
5957 //Intersection of session policy and identity policy plus bucket policy
5958 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
) {
5961 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
5962 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
5968 if (e
== Effect::Allow
|| identity_policy_res
== Effect::Allow
) {
5973 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
5980 void RGWInitMultipart::pre_exec()
5982 rgw_bucket_object_pre_exec(s
);
5985 void RGWInitMultipart::execute(optional_yield y
)
5988 rgw::sal::RGWAttrs attrs
;
5990 if (get_params(y
) < 0)
5993 if (rgw::sal::RGWObject::empty(s
->object
.get()))
5996 policy
.encode(aclbl
);
5997 attrs
[RGW_ATTR_ACL
] = aclbl
;
5999 populate_with_generic_attrs(s
, attrs
);
6001 /* select encryption mode */
6002 op_ret
= prepare_encryption(attrs
);
6006 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
);
6011 // make reservation for notification if needed
6012 rgw::notify::reservation_t
res(this, store
, s
, s
->object
.get());
6013 const auto event_type
= rgw::notify::ObjectCreatedPost
;
6014 op_ret
= rgw::notify::publish_reserve(this, event_type
, res
, nullptr);
6021 std::unique_ptr
<rgw::sal::RGWObject
> obj
;
6022 gen_rand_alphanumeric(s
->cct
, buf
, sizeof(buf
) - 1);
6023 upload_id
= MULTIPART_UPLOAD_ID_PREFIX
; /* v2 upload id */
6024 upload_id
.append(buf
);
6026 string tmp_obj_name
;
6027 RGWMPObj
mp(s
->object
->get_name(), upload_id
);
6028 tmp_obj_name
= mp
.get_meta();
6030 obj
= s
->bucket
->get_object(rgw_obj_key(tmp_obj_name
, string(), mp_ns
));
6031 // the meta object will be indexed with 0 size, we c
6032 obj
->set_in_extra_data(true);
6033 obj
->set_hash_source(s
->object
->get_name());
6035 std::unique_ptr
<rgw::sal::RGWObject::WriteOp
> obj_op
= obj
->get_write_op(s
->obj_ctx
);
6037 obj_op
->params
.versioning_disabled
= true; /* no versioning for multipart meta */
6038 obj_op
->params
.owner
= s
->owner
;
6039 obj_op
->params
.category
= RGWObjCategory::MultiMeta
;
6040 obj_op
->params
.flags
= PUT_OBJ_CREATE_EXCL
;
6041 obj_op
->params
.mtime
= &mtime
;
6042 obj_op
->params
.attrs
= &attrs
;
6044 multipart_upload_info upload_info
;
6045 upload_info
.dest_placement
= s
->dest_placement
;
6048 encode(upload_info
, bl
);
6049 obj_op
->params
.data
= &bl
;
6051 op_ret
= obj_op
->prepare(s
->yield
);
6053 op_ret
= obj_op
->write_meta(this, bl
.length(), 0, s
->yield
);
6054 } while (op_ret
== -EEXIST
);
6056 // send request to notification manager
6057 const auto ret
= rgw::notify::publish_commit(s
->object
.get(), s
->obj_size
, ceph::real_clock::now(), attrs
[RGW_ATTR_ETAG
].to_str(), event_type
, res
, this);
6059 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
6060 // too late to rollback operation, hence op_ret is not set here
6064 int RGWCompleteMultipart::verify_permission(optional_yield y
)
6066 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || ! s
->session_policies
.empty()) {
6067 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
6069 rgw::IAM::s3PutObject
,
6070 s
->object
->get_obj());
6071 if (identity_policy_res
== Effect::Deny
) {
6075 rgw::IAM::Effect e
= Effect::Pass
;
6076 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
6077 if (s
->iam_policy
) {
6078 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
6079 rgw::IAM::s3PutObject
,
6080 s
->object
->get_obj(),
6083 if (e
== Effect::Deny
) {
6087 if (!s
->session_policies
.empty()) {
6088 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
6090 rgw::IAM::s3PutObject
,
6091 s
->object
->get_obj());
6092 if (session_policy_res
== Effect::Deny
) {
6095 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
6096 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
6097 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
6098 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
)) {
6101 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
6102 //Intersection of session policy and identity policy plus bucket policy
6103 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
) {
6106 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
6107 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
6113 if (e
== Effect::Allow
|| identity_policy_res
== Effect::Allow
) {
6118 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
6125 void RGWCompleteMultipart::pre_exec()
6127 rgw_bucket_object_pre_exec(s
);
6130 void RGWCompleteMultipart::execute(optional_yield y
)
6132 RGWMultiCompleteUpload
*parts
;
6133 map
<int, string
>::iterator iter
;
6134 RGWMultiXMLParser parser
;
6136 map
<uint32_t, RGWUploadPartInfo
> obj_parts
;
6137 map
<uint32_t, RGWUploadPartInfo
>::iterator obj_iter
;
6138 rgw::sal::RGWAttrs attrs
;
6141 char final_etag
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
6142 char final_etag_str
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 16];
6144 std::unique_ptr
<rgw::sal::RGWObject
> meta_obj
;
6145 std::unique_ptr
<rgw::sal::RGWObject
> target_obj
;
6147 RGWObjManifest manifest
;
6148 uint64_t olh_epoch
= 0;
6150 op_ret
= get_params(y
);
6153 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
6158 if (!data
.length()) {
6159 op_ret
= -ERR_MALFORMED_XML
;
6163 if (!parser
.init()) {
6168 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
6169 op_ret
= -ERR_MALFORMED_XML
;
6173 parts
= static_cast<RGWMultiCompleteUpload
*>(parser
.find_first("CompleteMultipartUpload"));
6174 if (!parts
|| parts
->parts
.empty()) {
6175 op_ret
= -ERR_MALFORMED_XML
;
6179 if ((int)parts
->parts
.size() >
6180 s
->cct
->_conf
->rgw_multipart_part_upload_limit
) {
6185 mp
.init(s
->object
->get_name(), upload_id
);
6187 meta_oid
= mp
.get_meta();
6189 int total_parts
= 0;
6190 int handled_parts
= 0;
6191 int max_parts
= 1000;
6194 RGWCompressionInfo cs_info
;
6195 bool compressed
= false;
6196 uint64_t accounted_size
= 0;
6198 uint64_t min_part_size
= s
->cct
->_conf
->rgw_multipart_min_part_size
;
6200 list
<rgw_obj_index_key
> remove_objs
; /* objects to be removed from index listing */
6202 bool versioned_object
= s
->bucket
->versioning_enabled();
6204 iter
= parts
->parts
.begin();
6206 meta_obj
= s
->bucket
->get_object(rgw_obj_key(meta_oid
, string(), mp_ns
));
6207 meta_obj
->set_in_extra_data(true);
6208 meta_obj
->set_hash_source(s
->object
->get_name());
6210 /*take a cls lock on meta_obj to prevent racing completions (or retries)
6211 from deleting the parts*/
6212 int max_lock_secs_mp
=
6213 s
->cct
->_conf
.get_val
<int64_t>("rgw_mp_lock_max_time");
6214 utime_t
dur(max_lock_secs_mp
, 0);
6216 serializer
= meta_obj
->get_serializer(this, "RGWCompleteMultipart");
6217 op_ret
= serializer
->try_lock(this, dur
, y
);
6219 ldpp_dout(this, 0) << "failed to acquire lock" << dendl
;
6220 op_ret
= -ERR_INTERNAL_ERROR
;
6221 s
->err
.message
= "This multipart completion is already in progress";
6225 op_ret
= meta_obj
->get_obj_attrs(s
->obj_ctx
, s
->yield
, this);
6227 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << meta_obj
6228 << " ret=" << op_ret
<< dendl
;
6231 attrs
= meta_obj
->get_attrs();
6233 // make reservation for notification if needed
6234 rgw::notify::reservation_t
res(this, store
, s
, meta_obj
.get(), &s
->object
->get_name());
6235 const auto event_type
= rgw::notify::ObjectCreatedCompleteMultipartUpload
;
6236 op_ret
= rgw::notify::publish_reserve(this, event_type
, res
, nullptr);
6242 op_ret
= list_multipart_parts(this, store
, s
, upload_id
, meta_oid
, max_parts
,
6243 marker
, obj_parts
, &marker
, &truncated
);
6244 if (op_ret
== -ENOENT
) {
6245 op_ret
= -ERR_NO_SUCH_UPLOAD
;
6250 total_parts
+= obj_parts
.size();
6251 if (!truncated
&& total_parts
!= (int)parts
->parts
.size()) {
6252 ldpp_dout(this, 0) << "NOTICE: total parts mismatch: have: " << total_parts
6253 << " expected: " << parts
->parts
.size() << dendl
;
6254 op_ret
= -ERR_INVALID_PART
;
6258 for (obj_iter
= obj_parts
.begin(); iter
!= parts
->parts
.end() && obj_iter
!= obj_parts
.end(); ++iter
, ++obj_iter
, ++handled_parts
) {
6259 uint64_t part_size
= obj_iter
->second
.accounted_size
;
6260 if (handled_parts
< (int)parts
->parts
.size() - 1 &&
6261 part_size
< min_part_size
) {
6262 op_ret
= -ERR_TOO_SMALL
;
6266 char petag
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
6267 if (iter
->first
!= (int)obj_iter
->first
) {
6268 ldpp_dout(this, 0) << "NOTICE: parts num mismatch: next requested: "
6269 << iter
->first
<< " next uploaded: "
6270 << obj_iter
->first
<< dendl
;
6271 op_ret
= -ERR_INVALID_PART
;
6274 string part_etag
= rgw_string_unquote(iter
->second
);
6275 if (part_etag
.compare(obj_iter
->second
.etag
) != 0) {
6276 ldpp_dout(this, 0) << "NOTICE: etag mismatch: part: " << iter
->first
6277 << " etag: " << iter
->second
<< dendl
;
6278 op_ret
= -ERR_INVALID_PART
;
6282 hex_to_buf(obj_iter
->second
.etag
.c_str(), petag
,
6283 CEPH_CRYPTO_MD5_DIGESTSIZE
);
6284 hash
.Update((const unsigned char *)petag
, sizeof(petag
));
6286 RGWUploadPartInfo
& obj_part
= obj_iter
->second
;
6288 /* update manifest for part */
6289 string oid
= mp
.get_part(obj_iter
->second
.num
);
6291 src_obj
.init_ns(s
->bucket
->get_key(), oid
, mp_ns
);
6293 if (obj_part
.manifest
.empty()) {
6294 ldpp_dout(this, 0) << "ERROR: empty manifest for object part: obj="
6295 << src_obj
<< dendl
;
6296 op_ret
= -ERR_INVALID_PART
;
6299 manifest
.append(this, obj_part
.manifest
, store
->svc()->zone
);
6302 bool part_compressed
= (obj_part
.cs_info
.compression_type
!= "none");
6303 if ((handled_parts
> 0) &&
6304 ((part_compressed
!= compressed
) ||
6305 (cs_info
.compression_type
!= obj_part
.cs_info
.compression_type
))) {
6306 ldpp_dout(this, 0) << "ERROR: compression type was changed during multipart upload ("
6307 << cs_info
.compression_type
<< ">>" << obj_part
.cs_info
.compression_type
<< ")" << dendl
;
6308 op_ret
= -ERR_INVALID_PART
;
6312 if (part_compressed
) {
6313 int64_t new_ofs
; // offset in compression data for new part
6314 if (cs_info
.blocks
.size() > 0)
6315 new_ofs
= cs_info
.blocks
.back().new_ofs
+ cs_info
.blocks
.back().len
;
6318 for (const auto& block
: obj_part
.cs_info
.blocks
) {
6319 compression_block cb
;
6320 cb
.old_ofs
= block
.old_ofs
+ cs_info
.orig_size
;
6321 cb
.new_ofs
= new_ofs
;
6323 cs_info
.blocks
.push_back(cb
);
6324 new_ofs
= cb
.new_ofs
+ cb
.len
;
6327 cs_info
.compression_type
= obj_part
.cs_info
.compression_type
;
6328 cs_info
.orig_size
+= obj_part
.cs_info
.orig_size
;
6332 rgw_obj_index_key remove_key
;
6333 src_obj
.key
.get_index_key(&remove_key
);
6335 remove_objs
.push_back(remove_key
);
6337 ofs
+= obj_part
.size
;
6338 accounted_size
+= obj_part
.accounted_size
;
6340 } while (truncated
);
6342 hash
.Final((unsigned char *)final_etag
);
6344 buf_to_hex((unsigned char *)final_etag
, sizeof(final_etag
), final_etag_str
);
6345 snprintf(&final_etag_str
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2], sizeof(final_etag_str
) - CEPH_CRYPTO_MD5_DIGESTSIZE
* 2,
6346 "-%lld", (long long)parts
->parts
.size());
6347 etag
= final_etag_str
;
6348 ldpp_dout(this, 10) << "calculated etag: " << final_etag_str
<< dendl
;
6350 etag_bl
.append(final_etag_str
, strlen(final_etag_str
));
6352 attrs
[RGW_ATTR_ETAG
] = etag_bl
;
6355 // write compression attribute to full object
6357 encode(cs_info
, tmp
);
6358 attrs
[RGW_ATTR_COMPRESSION
] = tmp
;
6361 target_obj
= s
->bucket
->get_object(rgw_obj_key(s
->object
->get_name()));
6362 if (versioned_object
) {
6363 if (!version_id
.empty()) {
6364 target_obj
->set_instance(version_id
);
6366 target_obj
->gen_rand_obj_instance_name();
6367 version_id
= target_obj
->get_instance();
6371 RGWObjectCtx
& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
6373 target_obj
->set_atomic(&obj_ctx
);
6375 std::unique_ptr
<rgw::sal::RGWObject::WriteOp
> obj_op
= target_obj
->get_write_op(&obj_ctx
);
6377 obj_op
->params
.manifest
= &manifest
;
6378 obj_op
->params
.remove_objs
= &remove_objs
;
6380 obj_op
->params
.ptag
= &s
->req_id
; /* use req_id as operation tag */
6381 obj_op
->params
.owner
= s
->owner
;
6382 obj_op
->params
.flags
= PUT_OBJ_CREATE
;
6383 obj_op
->params
.modify_tail
= true;
6384 obj_op
->params
.completeMultipart
= true;
6385 obj_op
->params
.olh_epoch
= olh_epoch
;
6386 obj_op
->params
.attrs
= &attrs
;
6388 op_ret
= obj_op
->prepare(s
->yield
);
6393 op_ret
= obj_op
->write_meta(this, ofs
, accounted_size
, s
->yield
);
6398 // remove the upload meta object
6401 // remove the upload meta object ; the meta object is not versioned
6402 // when the bucket is, as that would add an unneeded delete marker
6403 int r
= meta_obj
->delete_object(this, s
->obj_ctx
, ACLOwner(), ACLOwner(), ceph::real_time(), false, 0,
6404 version_id
, null_yield
, true /* prevent versioning*/ );
6406 /* serializer's exclusive lock is released */
6407 serializer
->clear_locked();
6409 ldpp_dout(this, 0) << "WARNING: failed to remove object " << meta_obj
<< dendl
;
6412 // send request to notification manager
6413 const auto ret
= rgw::notify::publish_commit(s
->object
.get(), ofs
, ceph::real_clock::now(), final_etag_str
, event_type
, res
, this);
6415 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
6416 // too late to rollback operation, hence op_ret is not set here
6418 } // RGWCompleteMultipart::execute
6420 void RGWCompleteMultipart::complete()
6422 /* release exclusive lock iff not already */
6423 if (unlikely(serializer
&& serializer
->locked
)) {
6424 int r
= serializer
->unlock();
6426 ldpp_dout(this, 0) << "WARNING: failed to unlock " << serializer
->oid
<< dendl
;
6432 int RGWAbortMultipart::verify_permission(optional_yield y
)
6434 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
6435 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
6437 rgw::IAM::s3AbortMultipartUpload
,
6438 s
->object
->get_obj());
6439 if (identity_policy_res
== Effect::Deny
) {
6443 rgw::IAM::Effect e
= Effect::Pass
;
6444 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
6445 if (s
->iam_policy
) {
6446 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
6447 rgw::IAM::s3AbortMultipartUpload
,
6448 s
->object
->get_obj(), princ_type
);
6451 if (e
== Effect::Deny
) {
6455 if (!s
->session_policies
.empty()) {
6456 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
6458 rgw::IAM::s3PutObject
,
6459 s
->object
->get_obj());
6460 if (session_policy_res
== Effect::Deny
) {
6463 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
6464 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
6465 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
6466 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
)) {
6469 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
6470 //Intersection of session policy and identity policy plus bucket policy
6471 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
) {
6474 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
6475 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
6481 if (e
== Effect::Allow
|| identity_policy_res
== Effect::Allow
) {
6486 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
6493 void RGWAbortMultipart::pre_exec()
6495 rgw_bucket_object_pre_exec(s
);
6498 void RGWAbortMultipart::execute(optional_yield y
)
6503 upload_id
= s
->info
.args
.get("uploadId");
6507 if (upload_id
.empty() || rgw::sal::RGWObject::empty(s
->object
.get()))
6510 mp
.init(s
->object
->get_name(), upload_id
);
6511 meta_oid
= mp
.get_meta();
6513 op_ret
= get_multipart_info(this, s
, meta_oid
, nullptr);
6517 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
6518 op_ret
= abort_multipart_upload(this, store
, s
->cct
, obj_ctx
, s
->bucket
->get_info(), mp
);
6521 int RGWListMultipart::verify_permission(optional_yield y
)
6523 if (!verify_object_permission(this, s
, rgw::IAM::s3ListMultipartUploadParts
))
6529 void RGWListMultipart::pre_exec()
6531 rgw_bucket_object_pre_exec(s
);
6534 void RGWListMultipart::execute(optional_yield y
)
6539 op_ret
= get_params(y
);
6543 mp
.init(s
->object
->get_name(), upload_id
);
6544 meta_oid
= mp
.get_meta();
6546 op_ret
= get_multipart_info(this, s
, meta_oid
, nullptr);
6550 op_ret
= list_multipart_parts(this, store
, s
, upload_id
, meta_oid
, max_parts
,
6551 marker
, parts
, NULL
, &truncated
);
6554 int RGWListBucketMultiparts::verify_permission(optional_yield y
)
6556 if (!verify_bucket_permission(this,
6558 rgw::IAM::s3ListBucketMultipartUploads
))
6564 void RGWListBucketMultiparts::pre_exec()
6566 rgw_bucket_object_pre_exec(s
);
6569 void RGWListBucketMultiparts::execute(optional_yield y
)
6571 vector
<rgw_bucket_dir_entry
> objs
;
6574 op_ret
= get_params(y
);
6578 if (s
->prot_flags
& RGW_REST_SWIFT
) {
6580 path_args
= s
->info
.args
.get("path");
6581 if (!path_args
.empty()) {
6582 if (!delimiter
.empty() || !prefix
.empty()) {
6590 marker_meta
= marker
.get_meta();
6592 op_ret
= list_bucket_multiparts(this, store
, s
->bucket
->get_info(), prefix
, marker_meta
, delimiter
,
6593 max_uploads
, &objs
, &common_prefixes
, &is_truncated
);
6598 if (!objs
.empty()) {
6599 vector
<rgw_bucket_dir_entry
>::iterator iter
;
6600 RGWMultipartUploadEntry entry
;
6601 for (iter
= objs
.begin(); iter
!= objs
.end(); ++iter
) {
6602 rgw_obj_key
key(iter
->key
);
6603 if (!entry
.mp
.from_meta(key
.name
))
6606 uploads
.push_back(entry
);
6608 next_marker
= entry
;
6612 void RGWGetHealthCheck::execute(optional_yield y
)
6614 if (!g_conf()->rgw_healthcheck_disabling_path
.empty() &&
6615 (::access(g_conf()->rgw_healthcheck_disabling_path
.c_str(), F_OK
) == 0)) {
6616 /* Disabling path specified & existent in the filesystem. */
6617 op_ret
= -ERR_SERVICE_UNAVAILABLE
; /* 503 */
6619 op_ret
= 0; /* 200 OK */
6623 int RGWDeleteMultiObj::verify_permission(optional_yield y
)
6625 int op_ret
= get_params(y
);
6630 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || ! s
->session_policies
.empty()) {
6631 if (s
->bucket
->get_info().obj_lock_enabled() && bypass_governance_mode
) {
6632 auto r
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
, boost::none
,
6633 rgw::IAM::s3BypassGovernanceRetention
, ARN(s
->bucket
->get_key()));
6634 if (r
== Effect::Deny
) {
6635 bypass_perm
= false;
6636 } else if (r
== Effect::Pass
&& s
->iam_policy
) {
6637 r
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
, rgw::IAM::s3BypassGovernanceRetention
,
6638 ARN(s
->bucket
->get_key()));
6639 if (r
== Effect::Deny
) {
6640 bypass_perm
= false;
6642 } else if (r
== Effect::Pass
&& !s
->session_policies
.empty()) {
6643 r
= eval_identity_or_session_policies(s
->session_policies
, s
->env
, boost::none
,
6644 rgw::IAM::s3BypassGovernanceRetention
, ARN(s
->bucket
->get_key()));
6645 if (r
== Effect::Deny
) {
6646 bypass_perm
= false;
6651 bool not_versioned
= rgw::sal::RGWObject::empty(s
->object
.get()) || s
->object
->get_instance().empty();
6653 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
6656 rgw::IAM::s3DeleteObject
:
6657 rgw::IAM::s3DeleteObjectVersion
,
6658 ARN(s
->bucket
->get_key()));
6659 if (identity_policy_res
== Effect::Deny
) {
6663 rgw::IAM::Effect r
= Effect::Pass
;
6664 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
6665 if (s
->iam_policy
) {
6666 r
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
6668 rgw::IAM::s3DeleteObject
:
6669 rgw::IAM::s3DeleteObjectVersion
,
6670 ARN(s
->bucket
->get_key()),
6673 if (r
== Effect::Deny
)
6676 if (!s
->session_policies
.empty()) {
6677 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
6680 rgw::IAM::s3DeleteObject
:
6681 rgw::IAM::s3DeleteObjectVersion
,
6682 ARN(s
->bucket
->get_key()));
6683 if (session_policy_res
== Effect::Deny
) {
6686 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
6687 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
6688 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
6689 (session_policy_res
== Effect::Allow
&& r
== Effect::Allow
)) {
6692 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
6693 //Intersection of session policy and identity policy plus bucket policy
6694 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || r
== Effect::Allow
) {
6697 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
6698 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
6704 if (r
== Effect::Allow
|| identity_policy_res
== Effect::Allow
)
6708 acl_allowed
= verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
);
6715 void RGWDeleteMultiObj::pre_exec()
6717 rgw_bucket_object_pre_exec(s
);
6720 void RGWDeleteMultiObj::execute(optional_yield y
)
6722 RGWMultiDelDelete
*multi_delete
;
6723 vector
<rgw_obj_key
>::iterator iter
;
6724 RGWMultiDelXMLParser parser
;
6725 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
6734 if (!parser
.init()) {
6739 if (!parser
.parse(buf
, data
.length(), 1)) {
6744 multi_delete
= static_cast<RGWMultiDelDelete
*>(parser
.find_first("Delete"));
6745 if (!multi_delete
) {
6749 #define DELETE_MULTI_OBJ_MAX_NUM 1000
6750 int max_num
= s
->cct
->_conf
->rgw_delete_multi_obj_max_num
;
6752 max_num
= DELETE_MULTI_OBJ_MAX_NUM
;
6754 int multi_delete_object_num
= multi_delete
->objects
.size();
6755 if (multi_delete_object_num
> max_num
) {
6756 op_ret
= -ERR_MALFORMED_XML
;
6761 if (multi_delete
->is_quiet())
6764 if (s
->bucket
->get_info().mfa_enabled()) {
6765 bool has_versioned
= false;
6766 for (auto i
: multi_delete
->objects
) {
6767 if (!i
.instance
.empty()) {
6768 has_versioned
= true;
6772 if (has_versioned
&& !s
->mfa_verified
) {
6773 ldpp_dout(this, 5) << "NOTICE: multi-object delete request with a versioned object, mfa auth not provided" << dendl
;
6774 op_ret
= -ERR_MFA_REQUIRED
;
6780 if (multi_delete
->objects
.empty()) {
6784 for (iter
= multi_delete
->objects
.begin();
6785 iter
!= multi_delete
->objects
.end();
6787 std::string version_id
;
6788 std::unique_ptr
<rgw::sal::RGWObject
> obj
= bucket
->get_object(*iter
);
6789 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
6790 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
6792 iter
->instance
.empty() ?
6793 rgw::IAM::s3DeleteObject
:
6794 rgw::IAM::s3DeleteObjectVersion
,
6795 ARN(obj
->get_obj()));
6796 if (identity_policy_res
== Effect::Deny
) {
6797 send_partial_response(*iter
, false, "", -EACCES
);
6801 rgw::IAM::Effect e
= Effect::Pass
;
6802 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
6803 if (s
->iam_policy
) {
6804 e
= s
->iam_policy
->eval(s
->env
,
6806 iter
->instance
.empty() ?
6807 rgw::IAM::s3DeleteObject
:
6808 rgw::IAM::s3DeleteObjectVersion
,
6809 ARN(obj
->get_obj()),
6812 if (e
== Effect::Deny
) {
6813 send_partial_response(*iter
, false, "", -EACCES
);
6817 if (!s
->session_policies
.empty()) {
6818 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
6820 iter
->instance
.empty() ?
6821 rgw::IAM::s3DeleteObject
:
6822 rgw::IAM::s3DeleteObjectVersion
,
6823 ARN(obj
->get_obj()));
6824 if (session_policy_res
== Effect::Deny
) {
6825 send_partial_response(*iter
, false, "", -EACCES
);
6828 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
6829 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
6830 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) &&
6831 (session_policy_res
!= Effect::Allow
|| e
!= Effect::Allow
)) {
6832 send_partial_response(*iter
, false, "", -EACCES
);
6835 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
6836 //Intersection of session policy and identity policy plus bucket policy
6837 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) && e
!= Effect::Allow
) {
6838 send_partial_response(*iter
, false, "", -EACCES
);
6841 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
6842 if (session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) {
6843 send_partial_response(*iter
, false, "", -EACCES
);
6847 send_partial_response(*iter
, false, "", -EACCES
);
6851 if ((identity_policy_res
== Effect::Pass
&& e
== Effect::Pass
&& !acl_allowed
)) {
6852 send_partial_response(*iter
, false, "", -EACCES
);
6857 uint64_t obj_size
= 0;
6860 if (!rgw::sal::RGWObject::empty(obj
.get())) {
6861 RGWObjState
* astate
= nullptr;
6862 bool check_obj_lock
= obj
->have_instance() && bucket
->get_info().obj_lock_enabled();
6863 const auto ret
= obj
->get_obj_state(this, obj_ctx
, *bucket
, &astate
, s
->yield
, true);
6866 if (ret
== -ENOENT
) {
6867 // object maybe delete_marker, skip check_obj_lock
6868 check_obj_lock
= false;
6870 // Something went wrong.
6871 send_partial_response(*iter
, false, "", ret
);
6875 obj_size
= astate
->size
;
6876 etag
= astate
->attrset
[RGW_ATTR_ETAG
].to_str();
6879 if (check_obj_lock
) {
6880 ceph_assert(astate
);
6881 int object_lock_response
= verify_object_lock(this, astate
->attrset
, bypass_perm
, bypass_governance_mode
);
6882 if (object_lock_response
!= 0) {
6883 send_partial_response(*iter
, false, "", object_lock_response
);
6889 // make reservation for notification if needed
6890 const auto versioned_object
= s
->bucket
->versioning_enabled();
6891 rgw::notify::reservation_t
res(this, store
, s
, obj
.get());
6892 const auto event_type
= versioned_object
&& obj
->get_instance().empty() ?
6893 rgw::notify::ObjectRemovedDeleteMarkerCreated
: rgw::notify::ObjectRemovedDelete
;
6894 op_ret
= rgw::notify::publish_reserve(this, event_type
, res
, nullptr);
6896 send_partial_response(*iter
, false, "", op_ret
);
6900 obj
->set_atomic(obj_ctx
);
6902 op_ret
= obj
->delete_object(this, obj_ctx
, s
->owner
, s
->bucket_owner
, ceph::real_time(),
6903 false, 0, version_id
, s
->yield
);
6904 if (op_ret
== -ENOENT
) {
6908 send_partial_response(*iter
, obj
->get_delete_marker(), version_id
, op_ret
);
6910 // send request to notification manager
6911 const auto ret
= rgw::notify::publish_commit(obj
.get(), obj_size
, ceph::real_clock::now(), etag
, event_type
, res
, this);
6913 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
6914 // too late to rollback operation, hence op_ret is not set here
6918 /* set the return code to zero, errors at this point will be
6919 dumped to the response */
6923 // will likely segfault if begin_response() has not been called
6933 bool RGWBulkDelete::Deleter::verify_permission(RGWBucketInfo
& binfo
,
6934 map
<string
, bufferlist
>& battrs
,
6935 ACLOwner
& bucket_owner
/* out */,
6938 RGWAccessControlPolicy
bacl(store
->ctx());
6939 int ret
= read_bucket_policy(dpp
, store
, s
, binfo
, battrs
, &bacl
, binfo
.bucket
, y
);
6944 auto policy
= get_iam_policy_from_attr(s
->cct
, battrs
, binfo
.bucket
.tenant
);
6946 bucket_owner
= bacl
.get_owner();
6948 /* We can use global user_acl because each BulkDelete request is allowed
6949 * to work on entities from a single account only. */
6950 return verify_bucket_permission(dpp
, s
, binfo
.bucket
, s
->user_acl
.get(),
6951 &bacl
, policy
, s
->iam_user_policies
, s
->session_policies
, rgw::IAM::s3DeleteBucket
);
6954 bool RGWBulkDelete::Deleter::delete_single(const acct_path_t
& path
, optional_yield y
)
6956 std::unique_ptr
<rgw::sal::RGWBucket
> bucket
;
6958 RGWObjVersionTracker ot
;
6960 int ret
= store
->get_bucket(dpp
, s
->user
.get(), s
->user
->get_tenant(), path
.bucket_name
, &bucket
, y
);
6965 ret
= bucket
->get_bucket_info(dpp
, s
->yield
);
6970 if (!verify_permission(bucket
->get_info(), bucket
->get_attrs(), bowner
, y
)) {
6975 if (!path
.obj_key
.empty()) {
6976 ACLOwner bucket_owner
;
6977 std::string version_id
;
6979 bucket_owner
.set_id(bucket
->get_info().owner
);
6980 std::unique_ptr
<rgw::sal::RGWObject
> obj
= bucket
->get_object(path
.obj_key
);
6981 obj
->set_atomic(s
->obj_ctx
);
6983 ret
= obj
->delete_object(dpp
, s
->obj_ctx
, bowner
, bucket_owner
, ceph::real_time(), false, 0,
6984 version_id
, s
->yield
);
6989 ret
= bucket
->remove_bucket(dpp
, false, true, &s
->info
, s
->yield
);
7000 if (-ENOENT
== ret
) {
7001 ldpp_dout(dpp
, 20) << "cannot find bucket = " << path
.bucket_name
<< dendl
;
7004 ldpp_dout(dpp
, 20) << "cannot get bucket info, ret = " << ret
<< dendl
;
7006 fail_desc_t failed_item
= {
7010 failures
.push_back(failed_item
);
7015 ldpp_dout(dpp
, 20) << "wrong auth for " << path
<< dendl
;
7017 fail_desc_t failed_item
= {
7021 failures
.push_back(failed_item
);
7026 if (-ENOENT
== ret
) {
7027 ldpp_dout(dpp
, 20) << "cannot find entry " << path
<< dendl
;
7030 fail_desc_t failed_item
= {
7034 failures
.push_back(failed_item
);
7039 bool RGWBulkDelete::Deleter::delete_chunk(const std::list
<acct_path_t
>& paths
, optional_yield y
)
7041 ldpp_dout(dpp
, 20) << "in delete_chunk" << dendl
;
7042 for (auto path
: paths
) {
7043 ldpp_dout(dpp
, 20) << "bulk deleting path: " << path
<< dendl
;
7044 delete_single(path
, y
);
7050 int RGWBulkDelete::verify_permission(optional_yield y
)
7055 void RGWBulkDelete::pre_exec()
7057 rgw_bucket_object_pre_exec(s
);
7060 void RGWBulkDelete::execute(optional_yield y
)
7062 deleter
= std::unique_ptr
<Deleter
>(new Deleter(this, store
, s
));
7064 bool is_truncated
= false;
7066 list
<RGWBulkDelete::acct_path_t
> items
;
7068 int ret
= get_data(items
, &is_truncated
);
7073 ret
= deleter
->delete_chunk(items
, y
);
7074 } while (!op_ret
&& is_truncated
);
7080 constexpr std::array
<int, 2> RGWBulkUploadOp::terminal_errors
;
7082 int RGWBulkUploadOp::verify_permission(optional_yield y
)
7084 if (s
->auth
.identity
->is_anonymous()) {
7088 if (! verify_user_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
7092 if (s
->user
->get_tenant() != s
->bucket_tenant
) {
7093 ldpp_dout(this, 10) << "user cannot create a bucket in a different tenant"
7094 << " (user_id.tenant=" << s
->user
->get_tenant()
7095 << " requested=" << s
->bucket_tenant
<< ")" << dendl
;
7099 if (s
->user
->get_max_buckets() < 0) {
7106 void RGWBulkUploadOp::pre_exec()
7108 rgw_bucket_object_pre_exec(s
);
7111 boost::optional
<std::pair
<std::string
, rgw_obj_key
>>
7112 RGWBulkUploadOp::parse_path(const std::string_view
& path
)
7114 /* We need to skip all slashes at the beginning in order to preserve
7115 * compliance with Swift. */
7116 const size_t start_pos
= path
.find_first_not_of('/');
7118 if (std::string_view::npos
!= start_pos
) {
7119 /* Seperator is the first slash after the leading ones. */
7120 const size_t sep_pos
= path
.substr(start_pos
).find('/');
7122 if (std::string_view::npos
!= sep_pos
) {
7123 const auto bucket_name
= path
.substr(start_pos
, sep_pos
- start_pos
);
7124 const auto obj_name
= path
.substr(sep_pos
+ 1);
7126 return std::make_pair(std::string(bucket_name
),
7127 rgw_obj_key(std::string(obj_name
)));
7129 /* It's guaranteed here that bucket name is at least one character
7130 * long and is different than slash. */
7131 return std::make_pair(std::string(path
.substr(start_pos
)),
7139 std::pair
<std::string
, std::string
>
7140 RGWBulkUploadOp::handle_upload_path(struct req_state
*s
)
7142 std::string bucket_path
, file_prefix
;
7143 if (! s
->init_state
.url_bucket
.empty()) {
7144 file_prefix
= bucket_path
= s
->init_state
.url_bucket
+ "/";
7145 if (!rgw::sal::RGWObject::empty(s
->object
.get())) {
7146 const std::string
& object_name
= s
->object
->get_name();
7148 /* As rgw_obj_key::empty() already verified emptiness of s->object->get_name(),
7149 * we can safely examine its last element. */
7150 if (object_name
.back() == '/') {
7151 file_prefix
.append(object_name
);
7153 file_prefix
.append(object_name
).append("/");
7157 return std::make_pair(bucket_path
, file_prefix
);
7160 int RGWBulkUploadOp::handle_dir_verify_permission(optional_yield y
)
7162 if (s
->user
->get_max_buckets() > 0) {
7163 rgw::sal::RGWBucketList buckets
;
7165 op_ret
= rgw_read_user_buckets(this, store
, s
->user
->get_user(), buckets
,
7166 marker
, std::string(), s
->user
->get_max_buckets(),
7172 if (buckets
.count() >= static_cast<size_t>(s
->user
->get_max_buckets())) {
7173 return -ERR_TOO_MANY_BUCKETS
;
7180 static void forward_req_info(CephContext
*cct
, req_info
& info
, const std::string
& bucket_name
)
7182 /* the request of container or object level will contain bucket name.
7183 * only at account level need to append the bucket name */
7184 if (info
.script_uri
.find(bucket_name
) != std::string::npos
) {
7188 ldout(cct
, 20) << "append the bucket: "<< bucket_name
<< " to req_info" << dendl
;
7189 info
.script_uri
.append("/").append(bucket_name
);
7190 info
.request_uri_aws4
= info
.request_uri
= info
.script_uri
;
7191 info
.effective_uri
= "/" + bucket_name
;
7194 void RGWBulkUploadOp::init(rgw::sal::RGWRadosStore
* const store
,
7195 struct req_state
* const s
,
7196 RGWHandler
* const h
)
7198 RGWOp::init(store
, s
, h
);
7199 dir_ctx
.emplace(store
->svc()->sysobj
->init_obj_ctx());
7202 int RGWBulkUploadOp::handle_dir(const std::string_view path
, optional_yield y
)
7204 ldpp_dout(this, 20) << "got directory=" << path
<< dendl
;
7206 op_ret
= handle_dir_verify_permission(y
);
7211 std::string bucket_name
;
7212 rgw_obj_key object_junk
;
7213 std::tie(bucket_name
, object_junk
) = *parse_path(path
);
7215 rgw_raw_obj
obj(store
->svc()->zone
->get_zone_params().domain_root
,
7216 rgw_make_bucket_entry_name(s
->bucket_tenant
, bucket_name
));
7218 /* we need to make sure we read bucket info, it's not read before for this
7219 * specific request */
7220 std::unique_ptr
<rgw::sal::RGWBucket
> bucket
;
7222 /* Create metadata: ACLs. */
7223 std::map
<std::string
, ceph::bufferlist
> attrs
;
7224 RGWAccessControlPolicy policy
;
7225 policy
.create_default(s
->user
->get_id(), s
->user
->get_display_name());
7226 ceph::bufferlist aclbl
;
7227 policy
.encode(aclbl
);
7228 attrs
.emplace(RGW_ATTR_ACL
, std::move(aclbl
));
7230 obj_version objv
, ep_objv
;
7232 RGWQuotaInfo quota_info
;
7233 const RGWQuotaInfo
* pquota_info
= nullptr;
7234 RGWBucketInfo out_info
;
7235 string swift_ver_location
;
7236 rgw_bucket new_bucket
;
7237 req_info info
= s
->info
;
7238 new_bucket
.tenant
= s
->bucket_tenant
; /* ignored if bucket exists */
7239 new_bucket
.name
= bucket_name
;
7240 rgw_placement_rule placement_rule
;
7241 placement_rule
.storage_class
= s
->info
.storage_class
;
7242 forward_req_info(s
->cct
, info
, bucket_name
);
7244 op_ret
= store
->create_bucket(this, *s
->user
, new_bucket
,
7245 store
->get_zonegroup().get_id(),
7246 placement_rule
, swift_ver_location
,
7247 pquota_info
, policy
, attrs
,
7249 true, false, &bucket_exists
,
7251 /* continue if EEXIST and create_bucket will fail below. this way we can
7252 * recover from a partial create by retrying it. */
7253 ldpp_dout(this, 20) << "rgw_create_bucket returned ret=" << op_ret
7254 << ", bucket=" << bucket
<< dendl
;
7256 if (op_ret
&& op_ret
!= -EEXIST
) {
7260 const bool existed
= (op_ret
== -EEXIST
);
7262 /* bucket already existed, might have raced with another bucket creation, or
7263 * might be partial bucket creation that never completed. Read existing bucket
7264 * info, verify that the reported bucket owner is the current user.
7265 * If all is ok then update the user's list of buckets.
7266 * Otherwise inform client about a name conflict.
7268 if (out_info
.owner
.compare(s
->user
->get_id()) != 0) {
7270 ldpp_dout(this, 20) << "conflicting bucket name" << dendl
;
7273 new_bucket
= out_info
.bucket
;
7276 op_ret
= store
->ctl()->bucket
->link_bucket(s
->user
->get_id(), new_bucket
,
7277 out_info
.creation_time
,
7278 s
->yield
, s
, false);
7279 if (op_ret
&& !existed
&& op_ret
!= -EEXIST
) {
7280 /* if it exists (or previously existed), don't remove it! */
7281 op_ret
= store
->ctl()->bucket
->unlink_bucket(s
->user
->get_id(), new_bucket
, s
->yield
, this);
7283 ldpp_dout(this, 0) << "WARNING: failed to unlink bucket: ret=" << op_ret
<< dendl
;
7285 } else if (op_ret
== -EEXIST
|| (op_ret
== 0 && existed
)) {
7286 ldpp_dout(this, 20) << "containers already exists" << dendl
;
7287 op_ret
= -ERR_BUCKET_EXISTS
;
7294 bool RGWBulkUploadOp::handle_file_verify_permission(RGWBucketInfo
& binfo
,
7296 std::map
<std::string
, ceph::bufferlist
>& battrs
,
7297 ACLOwner
& bucket_owner
/* out */,
7300 RGWAccessControlPolicy
bacl(store
->ctx());
7301 op_ret
= read_bucket_policy(this, store
, s
, binfo
, battrs
, &bacl
, binfo
.bucket
, y
);
7303 ldpp_dout(this, 20) << "cannot read_policy() for bucket" << dendl
;
7307 auto policy
= get_iam_policy_from_attr(s
->cct
, battrs
, binfo
.bucket
.tenant
);
7309 bucket_owner
= bacl
.get_owner();
7310 if (policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
7311 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
7313 rgw::IAM::s3PutObject
, obj
);
7314 if (identity_policy_res
== Effect::Deny
) {
7318 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
7319 auto e
= policy
->eval(s
->env
, *s
->auth
.identity
,
7320 rgw::IAM::s3PutObject
, obj
, princ_type
);
7321 if (e
== Effect::Deny
) {
7325 if (!s
->session_policies
.empty()) {
7326 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
7328 rgw::IAM::s3PutObject
, obj
);
7329 if (session_policy_res
== Effect::Deny
) {
7332 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
7333 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
7334 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
7335 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
)) {
7338 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
7339 //Intersection of session policy and identity policy plus bucket policy
7340 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
) {
7343 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
7344 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
7350 if (e
== Effect::Allow
|| identity_policy_res
== Effect::Allow
) {
7355 return verify_bucket_permission_no_policy(this, s
, s
->user_acl
.get(),
7356 &bacl
, RGW_PERM_WRITE
);
7359 int RGWBulkUploadOp::handle_file(const std::string_view path
,
7361 AlignedStreamGetter
& body
, optional_yield y
)
7364 ldpp_dout(this, 20) << "got file=" << path
<< ", size=" << size
<< dendl
;
7366 if (size
> static_cast<size_t>(s
->cct
->_conf
->rgw_max_put_size
)) {
7367 op_ret
= -ERR_TOO_LARGE
;
7371 std::string bucket_name
;
7373 std::tie(bucket_name
, object
) = *parse_path(path
);
7375 auto& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
7376 std::unique_ptr
<rgw::sal::RGWBucket
> bucket
;
7379 op_ret
= store
->get_bucket(this, s
->user
.get(), rgw_bucket(rgw_bucket_key(s
->user
->get_tenant(), bucket_name
)), &bucket
, y
);
7380 if (op_ret
== -ENOENT
) {
7381 ldpp_dout(this, 20) << "non existent directory=" << bucket_name
<< dendl
;
7382 } else if (op_ret
< 0) {
7386 std::unique_ptr
<rgw::sal::RGWObject
> obj
= bucket
->get_object(object
);
7388 if (! handle_file_verify_permission(bucket
->get_info(),
7390 bucket
->get_attrs(), bowner
, y
)) {
7391 ldpp_dout(this, 20) << "object creation unauthorized" << dendl
;
7396 op_ret
= bucket
->check_quota(user_quota
, bucket_quota
, size
, y
);
7401 if (bucket
->versioning_enabled()) {
7402 obj
->gen_rand_obj_instance_name();
7405 rgw_placement_rule dest_placement
= s
->dest_placement
;
7406 dest_placement
.inherit_from(bucket
->get_placement_rule());
7408 auto aio
= rgw::make_throttle(s
->cct
->_conf
->rgw_put_obj_min_window_size
,
7411 using namespace rgw::putobj
;
7412 AtomicObjectProcessor
processor(&*aio
, store
, bucket
.get(), &s
->dest_placement
, bowner
.get_id(),
7413 obj_ctx
, std::move(obj
), 0, s
->req_id
, this, s
->yield
);
7415 op_ret
= processor
.prepare(s
->yield
);
7417 ldpp_dout(this, 20) << "cannot prepare processor due to ret=" << op_ret
<< dendl
;
7421 /* No filters by default. */
7422 DataProcessor
*filter
= &processor
;
7424 const auto& compression_type
= store
->svc()->zone
->get_zone_params().get_compression_type(
7426 CompressorRef plugin
;
7427 boost::optional
<RGWPutObj_Compress
> compressor
;
7428 if (compression_type
!= "none") {
7429 plugin
= Compressor::create(s
->cct
, compression_type
);
7431 ldpp_dout(this, 1) << "Cannot load plugin for rgw_compression_type "
7432 << compression_type
<< dendl
;
7434 compressor
.emplace(s
->cct
, plugin
, filter
);
7435 filter
= &*compressor
;
7439 /* Upload file content. */
7444 ceph::bufferlist data
;
7445 len
= body
.get_at_most(s
->cct
->_conf
->rgw_max_chunk_size
, data
);
7447 ldpp_dout(this, 20) << "body=" << data
.c_str() << dendl
;
7451 } else if (len
> 0) {
7452 hash
.Update((const unsigned char *)data
.c_str(), data
.length());
7453 op_ret
= filter
->process(std::move(data
), ofs
);
7455 ldpp_dout(this, 20) << "filter->process() returned ret=" << op_ret
<< dendl
;
7465 op_ret
= filter
->process({}, ofs
);
7471 ldpp_dout(this, 10) << "real file size different from declared" << dendl
;
7476 op_ret
= bucket
->check_quota(user_quota
, bucket_quota
, size
, y
);
7478 ldpp_dout(this, 20) << "quota exceeded for path=" << path
<< dendl
;
7482 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
7483 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
7485 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
7487 /* Create metadata: ETAG. */
7488 std::map
<std::string
, ceph::bufferlist
> attrs
;
7489 std::string etag
= calc_md5
;
7490 ceph::bufferlist etag_bl
;
7491 etag_bl
.append(etag
.c_str(), etag
.size() + 1);
7492 attrs
.emplace(RGW_ATTR_ETAG
, std::move(etag_bl
));
7494 /* Create metadata: ACLs. */
7495 RGWAccessControlPolicy policy
;
7496 policy
.create_default(s
->user
->get_id(), s
->user
->get_display_name());
7497 ceph::bufferlist aclbl
;
7498 policy
.encode(aclbl
);
7499 attrs
.emplace(RGW_ATTR_ACL
, std::move(aclbl
));
7501 /* Create metadata: compression info. */
7502 if (compressor
&& compressor
->is_compressed()) {
7503 ceph::bufferlist tmp
;
7504 RGWCompressionInfo cs_info
;
7505 cs_info
.compression_type
= plugin
->get_type_name();
7506 cs_info
.orig_size
= s
->obj_size
;
7507 cs_info
.compressor_message
= compressor
->get_compressor_message();
7508 cs_info
.blocks
= std::move(compressor
->get_compression_blocks());
7509 encode(cs_info
, tmp
);
7510 attrs
.emplace(RGW_ATTR_COMPRESSION
, std::move(tmp
));
7513 /* Complete the transaction. */
7514 op_ret
= processor
.complete(size
, etag
, nullptr, ceph::real_time(),
7515 attrs
, ceph::real_time() /* delete_at */,
7516 nullptr, nullptr, nullptr, nullptr, nullptr,
7519 ldpp_dout(this, 20) << "processor::complete returned op_ret=" << op_ret
<< dendl
;
7525 void RGWBulkUploadOp::execute(optional_yield y
)
7527 ceph::bufferlist
buffer(64 * 1024);
7529 ldpp_dout(this, 20) << "start" << dendl
;
7531 /* Create an instance of stream-abstracting class. Having this indirection
7532 * allows for easy introduction of decompressors like gzip and bzip2. */
7533 auto stream
= create_stream();
7538 /* Handling the $UPLOAD_PATH accordingly to the Swift's Bulk middleware. See:
7539 * https://github.com/openstack/swift/blob/2.13.0/swift/common/middleware/bulk.py#L31-L41 */
7540 std::string bucket_path
, file_prefix
;
7541 std::tie(bucket_path
, file_prefix
) = handle_upload_path(s
);
7543 auto status
= rgw::tar::StatusIndicator::create();
7545 op_ret
= stream
->get_exactly(rgw::tar::BLOCK_SIZE
, buffer
);
7547 ldpp_dout(this, 2) << "cannot read header" << dendl
;
7551 /* We need to re-interpret the buffer as a TAR block. Exactly two blocks
7552 * must be tracked to detect out end-of-archive. It occurs when both of
7553 * them are empty (zeroed). Tracing this particular inter-block dependency
7554 * is responsibility of the rgw::tar::StatusIndicator class. */
7555 boost::optional
<rgw::tar::HeaderView
> header
;
7556 std::tie(status
, header
) = rgw::tar::interpret_block(status
, buffer
);
7558 if (! status
.empty() && header
) {
7559 /* This specific block isn't empty (entirely zeroed), so we can parse
7560 * it as a TAR header and dispatch. At the moment we do support only
7561 * regular files and directories. Everything else (symlinks, devices)
7562 * will be ignored but won't cease the whole upload. */
7563 switch (header
->get_filetype()) {
7564 case rgw::tar::FileType::NORMAL_FILE
: {
7565 ldpp_dout(this, 2) << "handling regular file" << dendl
;
7567 std::string_view filename
;
7568 if (bucket_path
.empty())
7569 filename
= header
->get_filename();
7571 filename
= file_prefix
+ std::string(header
->get_filename());
7572 auto body
= AlignedStreamGetter(0, header
->get_filesize(),
7573 rgw::tar::BLOCK_SIZE
, *stream
);
7574 op_ret
= handle_file(filename
,
7575 header
->get_filesize(),
7578 /* Only regular files counts. */
7581 failures
.emplace_back(op_ret
, std::string(filename
));
7585 case rgw::tar::FileType::DIRECTORY
: {
7586 ldpp_dout(this, 2) << "handling regular directory" << dendl
;
7588 std::string_view dirname
= bucket_path
.empty() ? header
->get_filename() : bucket_path
;
7589 op_ret
= handle_dir(dirname
, y
);
7590 if (op_ret
< 0 && op_ret
!= -ERR_BUCKET_EXISTS
) {
7591 failures
.emplace_back(op_ret
, std::string(dirname
));
7596 /* Not recognized. Skip. */
7602 /* In case of any problems with sub-request authorization Swift simply
7603 * terminates whole upload immediately. */
7604 if (boost::algorithm::contains(std::initializer_list
<int>{ op_ret
},
7606 ldpp_dout(this, 2) << "terminating due to ret=" << op_ret
<< dendl
;
7610 ldpp_dout(this, 2) << "an empty block" << dendl
;
7615 } while (! status
.eof());
7620 RGWBulkUploadOp::AlignedStreamGetter::~AlignedStreamGetter()
7622 const size_t aligned_legnth
= length
+ (-length
% alignment
);
7623 ceph::bufferlist junk
;
7625 DecoratedStreamGetter::get_exactly(aligned_legnth
- position
, junk
);
7628 ssize_t
RGWBulkUploadOp::AlignedStreamGetter::get_at_most(const size_t want
,
7629 ceph::bufferlist
& dst
)
7631 const size_t max_to_read
= std::min(want
, length
- position
);
7632 const auto len
= DecoratedStreamGetter::get_at_most(max_to_read
, dst
);
7639 ssize_t
RGWBulkUploadOp::AlignedStreamGetter::get_exactly(const size_t want
,
7640 ceph::bufferlist
& dst
)
7642 const auto len
= DecoratedStreamGetter::get_exactly(want
, dst
);
7649 int RGWGetAttrs::verify_permission(optional_yield y
)
7651 s
->object
->set_atomic(s
->obj_ctx
);
7653 auto iam_action
= s
->object
->get_instance().empty() ?
7654 rgw::IAM::s3GetObject
:
7655 rgw::IAM::s3GetObjectVersion
;
7657 if (!verify_object_permission(this, s
, iam_action
)) {
7664 void RGWGetAttrs::pre_exec()
7666 rgw_bucket_object_pre_exec(s
);
7669 void RGWGetAttrs::execute(optional_yield y
)
7671 op_ret
= get_params();
7675 s
->object
->set_atomic(s
->obj_ctx
);
7677 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, this);
7679 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << s
->object
7680 << " ret=" << op_ret
<< dendl
;
7684 /* XXX RGWObject::get_obj_attrs() does not support filtering (yet) */
7685 auto& obj_attrs
= s
->object
->get_attrs();
7686 if (attrs
.size() != 0) {
7687 /* return only attrs requested */
7688 for (auto& att
: attrs
) {
7689 auto iter
= obj_attrs
.find(att
.first
);
7690 if (iter
!= obj_attrs
.end()) {
7691 att
.second
= iter
->second
;
7695 /* return all attrs */
7696 for (auto& att
: obj_attrs
) {
7697 attrs
.insert(get_attrs_t::value_type(att
.first
, att
.second
));;
7704 int RGWRMAttrs::verify_permission(optional_yield y
)
7706 // This looks to be part of the RGW-NFS machinery and has no S3 or
7707 // Swift equivalent.
7709 if (!rgw::sal::RGWObject::empty(s
->object
.get())) {
7710 perm
= verify_object_permission_no_policy(this, s
, RGW_PERM_WRITE
);
7712 perm
= verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
);
7720 void RGWRMAttrs::pre_exec()
7722 rgw_bucket_object_pre_exec(s
);
7725 void RGWRMAttrs::execute(optional_yield y
)
7727 op_ret
= get_params();
7731 s
->object
->set_atomic(s
->obj_ctx
);
7733 op_ret
= s
->object
->set_obj_attrs(this, s
->obj_ctx
, nullptr, &attrs
, y
);
7735 ldpp_dout(this, 0) << "ERROR: failed to delete obj attrs, obj=" << s
->object
7736 << " ret=" << op_ret
<< dendl
;
7741 int RGWSetAttrs::verify_permission(optional_yield y
)
7743 // This looks to be part of the RGW-NFS machinery and has no S3 or
7744 // Swift equivalent.
7746 if (!rgw::sal::RGWObject::empty(s
->object
.get())) {
7747 perm
= verify_object_permission_no_policy(this, s
, RGW_PERM_WRITE
);
7749 perm
= verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
);
7757 void RGWSetAttrs::pre_exec()
7759 rgw_bucket_object_pre_exec(s
);
7762 void RGWSetAttrs::execute(optional_yield y
)
7764 op_ret
= get_params(y
);
7768 if (!rgw::sal::RGWObject::empty(s
->object
.get())) {
7769 rgw::sal::RGWAttrs
a(attrs
);
7770 op_ret
= s
->object
->set_obj_attrs(this, s
->obj_ctx
, &a
, nullptr, y
);
7772 op_ret
= store
->ctl()->bucket
->set_bucket_instance_attrs(
7773 s
->bucket
->get_info(), attrs
, &s
->bucket
->get_info().objv_tracker
,
7777 } /* RGWSetAttrs::execute() */
7779 void RGWGetObjLayout::pre_exec()
7781 rgw_bucket_object_pre_exec(s
);
7784 void RGWGetObjLayout::execute(optional_yield y
)
7786 /* Make sure bucket is correct */
7787 s
->object
->set_bucket(s
->bucket
.get());
7789 std::unique_ptr
<rgw::sal::RGWObject::ReadOp
> stat_op(s
->object
->get_read_op(s
->obj_ctx
));
7792 op_ret
= stat_op
->prepare(y
, this);
7797 head_obj
= stat_op
->result
.head_obj
;
7799 op_ret
= stat_op
->get_manifest(this, &manifest
, y
);
7803 int RGWConfigBucketMetaSearch::verify_permission(optional_yield y
)
7805 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
7812 void RGWConfigBucketMetaSearch::pre_exec()
7814 rgw_bucket_object_pre_exec(s
);
7817 void RGWConfigBucketMetaSearch::execute(optional_yield y
)
7819 op_ret
= get_params(y
);
7821 ldpp_dout(this, 20) << "NOTICE: get_params() returned ret=" << op_ret
<< dendl
;
7825 s
->bucket
->get_info().mdsearch_config
= mdsearch_config
;
7827 op_ret
= s
->bucket
->put_instance_info(this, false, real_time());
7829 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
->get_name()
7830 << " returned err=" << op_ret
<< dendl
;
7833 s
->bucket_attrs
= s
->bucket
->get_attrs();
7836 int RGWGetBucketMetaSearch::verify_permission(optional_yield y
)
7838 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
7845 void RGWGetBucketMetaSearch::pre_exec()
7847 rgw_bucket_object_pre_exec(s
);
7850 int RGWDelBucketMetaSearch::verify_permission(optional_yield y
)
7852 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
7859 void RGWDelBucketMetaSearch::pre_exec()
7861 rgw_bucket_object_pre_exec(s
);
7864 void RGWDelBucketMetaSearch::execute(optional_yield y
)
7866 s
->bucket
->get_info().mdsearch_config
.clear();
7868 op_ret
= s
->bucket
->put_instance_info(this, false, real_time());
7870 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
->get_name()
7871 << " returned err=" << op_ret
<< dendl
;
7874 s
->bucket_attrs
= s
->bucket
->get_attrs();
7878 RGWHandler::~RGWHandler()
7882 int RGWHandler::init(rgw::sal::RGWRadosStore
*_store
,
7883 struct req_state
*_s
,
7884 rgw::io::BasicClient
*cio
)
7892 int RGWHandler::do_init_permissions(const DoutPrefixProvider
*dpp
, optional_yield y
)
7894 int ret
= rgw_build_bucket_policies(dpp
, store
, s
, y
);
7896 ldpp_dout(dpp
, 10) << "init_permissions on " << s
->bucket
7897 << " failed, ret=" << ret
<< dendl
;
7898 return ret
==-ENODATA
? -EACCES
: ret
;
7901 rgw_build_iam_environment(store
, s
);
7905 int RGWHandler::do_read_permissions(RGWOp
*op
, bool only_bucket
, optional_yield y
)
7908 /* already read bucket info */
7911 int ret
= rgw_build_object_policies(op
, store
, s
, op
->prefetch_data(), y
);
7914 ldpp_dout(op
, 10) << "read_permissions on " << s
->bucket
<< ":"
7915 << s
->object
<< " only_bucket=" << only_bucket
7916 << " ret=" << ret
<< dendl
;
7917 if (ret
== -ENODATA
)
7919 if (s
->auth
.identity
->is_anonymous() && ret
== -EACCES
)
7926 int RGWOp::error_handler(int err_no
, string
*error_content
, optional_yield y
) {
7927 return dialect_handler
->error_handler(err_no
, error_content
, y
);
7930 int RGWHandler::error_handler(int err_no
, string
*error_content
, optional_yield
) {
7931 // This is the do-nothing error handler
7935 std::ostream
& RGWOp::gen_prefix(std::ostream
& out
) const
7937 // append <dialect>:<op name> to the prefix
7938 return s
->gen_prefix(out
) << s
->dialect
<< ':' << name() << ' ';
7941 void RGWDefaultResponseOp::send_response() {
7943 set_req_state_err(s
, op_ret
);
7949 void RGWPutBucketPolicy::send_response()
7952 /* A successful Put Bucket Policy should return a 204 on success */
7953 op_ret
= STATUS_NO_CONTENT
;
7956 set_req_state_err(s
, op_ret
);
7962 int RGWPutBucketPolicy::verify_permission(optional_yield y
)
7964 if (!verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketPolicy
)) {
7971 int RGWPutBucketPolicy::get_params(optional_yield y
)
7973 const auto max_size
= s
->cct
->_conf
->rgw_max_put_param_size
;
7974 // At some point when I have more time I want to make a version of
7975 // rgw_rest_read_all_input that doesn't use malloc.
7976 std::tie(op_ret
, data
) = rgw_rest_read_all_input(s
, max_size
, false);
7978 // And throws exceptions.
7982 void RGWPutBucketPolicy::execute(optional_yield y
)
7984 op_ret
= get_params(y
);
7989 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
7991 ldpp_dout(this, 20) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
7996 const Policy
p(s
->cct
, s
->bucket_tenant
, data
);
7997 rgw::sal::RGWAttrs
attrs(s
->bucket_attrs
);
7998 if (s
->bucket_access_conf
&&
7999 s
->bucket_access_conf
->block_public_policy() &&
8000 rgw::IAM::is_public(p
)) {
8005 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [&p
, this, &attrs
] {
8006 attrs
[RGW_ATTR_IAM_POLICY
].clear();
8007 attrs
[RGW_ATTR_IAM_POLICY
].append(p
.text
);
8008 op_ret
= s
->bucket
->set_instance_attrs(this, attrs
, s
->yield
);
8011 } catch (rgw::IAM::PolicyParseException
& e
) {
8012 ldpp_dout(this, 20) << "failed to parse policy: " << e
.what() << dendl
;
8017 void RGWGetBucketPolicy::send_response()
8020 set_req_state_err(s
, op_ret
);
8023 end_header(s
, this, "application/json");
8024 dump_body(s
, policy
);
8027 int RGWGetBucketPolicy::verify_permission(optional_yield y
)
8029 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketPolicy
)) {
8036 void RGWGetBucketPolicy::execute(optional_yield y
)
8038 rgw::sal::RGWAttrs
attrs(s
->bucket_attrs
);
8039 auto aiter
= attrs
.find(RGW_ATTR_IAM_POLICY
);
8040 if (aiter
== attrs
.end()) {
8041 ldpp_dout(this, 0) << "can't find bucket IAM POLICY attr bucket_name = "
8042 << s
->bucket_name
<< dendl
;
8043 op_ret
= -ERR_NO_SUCH_BUCKET_POLICY
;
8044 s
->err
.message
= "The bucket policy does not exist";
8047 policy
= attrs
[RGW_ATTR_IAM_POLICY
];
8049 if (policy
.length() == 0) {
8050 ldpp_dout(this, 10) << "The bucket policy does not exist, bucket: "
8051 << s
->bucket_name
<< dendl
;
8052 op_ret
= -ERR_NO_SUCH_BUCKET_POLICY
;
8053 s
->err
.message
= "The bucket policy does not exist";
8059 void RGWDeleteBucketPolicy::send_response()
8062 set_req_state_err(s
, op_ret
);
8068 int RGWDeleteBucketPolicy::verify_permission(optional_yield y
)
8070 if (!verify_bucket_permission(this, s
, rgw::IAM::s3DeleteBucketPolicy
)) {
8077 void RGWDeleteBucketPolicy::execute(optional_yield y
)
8079 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
8080 rgw::sal::RGWAttrs
attrs(s
->bucket_attrs
);
8081 attrs
.erase(RGW_ATTR_IAM_POLICY
);
8082 op_ret
= s
->bucket
->set_instance_attrs(this, attrs
, s
->yield
);
8087 void RGWPutBucketObjectLock::pre_exec()
8089 rgw_bucket_object_pre_exec(s
);
8092 int RGWPutBucketObjectLock::verify_permission(optional_yield y
)
8094 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketObjectLockConfiguration
);
8097 void RGWPutBucketObjectLock::execute(optional_yield y
)
8099 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8100 s
->err
.message
= "object lock configuration can't be set if bucket object lock not enabled";
8101 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8102 op_ret
= -ERR_INVALID_BUCKET_STATE
;
8106 RGWXMLDecoder::XMLParser parser
;
8107 if (!parser
.init()) {
8108 ldpp_dout(this, 0) << "ERROR: failed to initialize parser" << dendl
;
8112 op_ret
= get_params(y
);
8116 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
8117 op_ret
= -ERR_MALFORMED_XML
;
8122 RGWXMLDecoder::decode_xml("ObjectLockConfiguration", obj_lock
, &parser
, true);
8123 } catch (RGWXMLDecoder::err
& err
) {
8124 ldpp_dout(this, 5) << "unexpected xml:" << err
<< dendl
;
8125 op_ret
= -ERR_MALFORMED_XML
;
8128 if (obj_lock
.has_rule() && !obj_lock
.retention_period_valid()) {
8129 s
->err
.message
= "retention period must be a positive integer value";
8130 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8131 op_ret
= -ERR_INVALID_RETENTION_PERIOD
;
8135 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
8137 ldpp_dout(this, 20) << __func__
<< "forward_request_to_master returned ret=" << op_ret
<< dendl
;
8141 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
8142 s
->bucket
->get_info().obj_lock
= obj_lock
;
8143 op_ret
= s
->bucket
->put_instance_info(this, false, real_time());
8149 void RGWGetBucketObjectLock::pre_exec()
8151 rgw_bucket_object_pre_exec(s
);
8154 int RGWGetBucketObjectLock::verify_permission(optional_yield y
)
8156 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketObjectLockConfiguration
);
8159 void RGWGetBucketObjectLock::execute(optional_yield y
)
8161 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8162 op_ret
= -ERR_NO_SUCH_OBJECT_LOCK_CONFIGURATION
;
8167 int RGWPutObjRetention::verify_permission(optional_yield y
)
8169 if (!verify_object_permission(this, s
, rgw::IAM::s3PutObjectRetention
)) {
8172 op_ret
= get_params(y
);
8176 if (bypass_governance_mode
) {
8177 bypass_perm
= verify_object_permission(this, s
, rgw::IAM::s3BypassGovernanceRetention
);
8182 void RGWPutObjRetention::pre_exec()
8184 rgw_bucket_object_pre_exec(s
);
8187 void RGWPutObjRetention::execute(optional_yield y
)
8189 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8190 s
->err
.message
= "object retention can't be set if bucket object lock not configured";
8191 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8192 op_ret
= -ERR_INVALID_REQUEST
;
8196 RGWXMLDecoder::XMLParser parser
;
8197 if (!parser
.init()) {
8198 ldpp_dout(this, 0) << "ERROR: failed to initialize parser" << dendl
;
8203 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
8204 op_ret
= -ERR_MALFORMED_XML
;
8209 RGWXMLDecoder::decode_xml("Retention", obj_retention
, &parser
, true);
8210 } catch (RGWXMLDecoder::err
& err
) {
8211 ldpp_dout(this, 5) << "unexpected xml:" << err
<< dendl
;
8212 op_ret
= -ERR_MALFORMED_XML
;
8216 if (ceph::real_clock::to_time_t(obj_retention
.get_retain_until_date()) < ceph_clock_now()) {
8217 s
->err
.message
= "the retain-until date must be in the future";
8218 ldpp_dout(this, 0) << "ERROR: " << s
->err
.message
<< dendl
;
8223 obj_retention
.encode(bl
);
8225 //check old retention
8226 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, this);
8228 ldpp_dout(this, 0) << "ERROR: get obj attr error"<< dendl
;
8231 rgw::sal::RGWAttrs attrs
= s
->object
->get_attrs();
8232 auto aiter
= attrs
.find(RGW_ATTR_OBJECT_RETENTION
);
8233 if (aiter
!= attrs
.end()) {
8234 RGWObjectRetention old_obj_retention
;
8236 decode(old_obj_retention
, aiter
->second
);
8237 } catch (buffer::error
& err
) {
8238 ldpp_dout(this, 0) << "ERROR: failed to decode RGWObjectRetention" << dendl
;
8242 if (ceph::real_clock::to_time_t(obj_retention
.get_retain_until_date()) < ceph::real_clock::to_time_t(old_obj_retention
.get_retain_until_date())) {
8243 if (old_obj_retention
.get_mode().compare("GOVERNANCE") != 0 || !bypass_perm
|| !bypass_governance_mode
) {
8244 s
->err
.message
= "proposed retain-until date shortens an existing retention period and governance bypass check failed";
8251 op_ret
= s
->object
->modify_obj_attrs(s
->obj_ctx
, RGW_ATTR_OBJECT_RETENTION
, bl
, s
->yield
, this);
8256 int RGWGetObjRetention::verify_permission(optional_yield y
)
8258 if (!verify_object_permission(this, s
, rgw::IAM::s3GetObjectRetention
)) {
8264 void RGWGetObjRetention::pre_exec()
8266 rgw_bucket_object_pre_exec(s
);
8269 void RGWGetObjRetention::execute(optional_yield y
)
8271 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8272 s
->err
.message
= "bucket object lock not configured";
8273 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8274 op_ret
= -ERR_INVALID_REQUEST
;
8277 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, this);
8279 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << s
->object
8280 << " ret=" << op_ret
<< dendl
;
8283 rgw::sal::RGWAttrs attrs
= s
->object
->get_attrs();
8284 auto aiter
= attrs
.find(RGW_ATTR_OBJECT_RETENTION
);
8285 if (aiter
== attrs
.end()) {
8286 op_ret
= -ERR_NO_SUCH_OBJECT_LOCK_CONFIGURATION
;
8290 bufferlist::const_iterator iter
{&aiter
->second
};
8292 obj_retention
.decode(iter
);
8293 } catch (const buffer::error
& e
) {
8294 ldpp_dout(this, 0) << __func__
<< "decode object retention config failed" << dendl
;
8301 int RGWPutObjLegalHold::verify_permission(optional_yield y
)
8303 if (!verify_object_permission(this, s
, rgw::IAM::s3PutObjectLegalHold
)) {
8309 void RGWPutObjLegalHold::pre_exec()
8311 rgw_bucket_object_pre_exec(s
);
8314 void RGWPutObjLegalHold::execute(optional_yield y
) {
8315 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8316 s
->err
.message
= "object legal hold can't be set if bucket object lock not enabled";
8317 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8318 op_ret
= -ERR_INVALID_REQUEST
;
8322 RGWXMLDecoder::XMLParser parser
;
8323 if (!parser
.init()) {
8324 ldpp_dout(this, 0) << "ERROR: failed to initialize parser" << dendl
;
8329 op_ret
= get_params(y
);
8333 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
8334 op_ret
= -ERR_MALFORMED_XML
;
8339 RGWXMLDecoder::decode_xml("LegalHold", obj_legal_hold
, &parser
, true);
8340 } catch (RGWXMLDecoder::err
&err
) {
8341 ldpp_dout(this, 5) << "unexpected xml:" << err
<< dendl
;
8342 op_ret
= -ERR_MALFORMED_XML
;
8346 obj_legal_hold
.encode(bl
);
8347 //if instance is empty, we should modify the latest object
8348 op_ret
= s
->object
->modify_obj_attrs(s
->obj_ctx
, RGW_ATTR_OBJECT_LEGAL_HOLD
, bl
, s
->yield
, this);
8352 int RGWGetObjLegalHold::verify_permission(optional_yield y
)
8354 if (!verify_object_permission(this, s
, rgw::IAM::s3GetObjectLegalHold
)) {
8360 void RGWGetObjLegalHold::pre_exec()
8362 rgw_bucket_object_pre_exec(s
);
8365 void RGWGetObjLegalHold::execute(optional_yield y
)
8367 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8368 s
->err
.message
= "bucket object lock not configured";
8369 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8370 op_ret
= -ERR_INVALID_REQUEST
;
8373 map
<string
, bufferlist
> attrs
;
8374 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, this);
8376 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << s
->object
8377 << " ret=" << op_ret
<< dendl
;
8380 auto aiter
= s
->object
->get_attrs().find(RGW_ATTR_OBJECT_LEGAL_HOLD
);
8381 if (aiter
== s
->object
->get_attrs().end()) {
8382 op_ret
= -ERR_NO_SUCH_OBJECT_LOCK_CONFIGURATION
;
8386 bufferlist::const_iterator iter
{&aiter
->second
};
8388 obj_legal_hold
.decode(iter
);
8389 } catch (const buffer::error
& e
) {
8390 ldpp_dout(this, 0) << __func__
<< "decode object legal hold config failed" << dendl
;
8397 void RGWGetClusterStat::execute(optional_yield y
)
8399 op_ret
= store
->cluster_stat(stats_op
);
8402 int RGWGetBucketPolicyStatus::verify_permission(optional_yield y
)
8404 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketPolicyStatus
)) {
8411 void RGWGetBucketPolicyStatus::execute(optional_yield y
)
8413 isPublic
= (s
->iam_policy
&& rgw::IAM::is_public(*s
->iam_policy
)) || s
->bucket_acl
->is_public(this);
8416 int RGWPutBucketPublicAccessBlock::verify_permission(optional_yield y
)
8418 if (!verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketPublicAccessBlock
)) {
8425 int RGWPutBucketPublicAccessBlock::get_params(optional_yield y
)
8427 const auto max_size
= s
->cct
->_conf
->rgw_max_put_param_size
;
8428 std::tie(op_ret
, data
) = rgw_rest_read_all_input(s
, max_size
, false);
8432 void RGWPutBucketPublicAccessBlock::execute(optional_yield y
)
8434 RGWXMLDecoder::XMLParser parser
;
8435 if (!parser
.init()) {
8436 ldpp_dout(this, 0) << "ERROR: failed to initialize parser" << dendl
;
8441 op_ret
= get_params(y
);
8445 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
8446 ldpp_dout(this, 0) << "ERROR: malformed XML" << dendl
;
8447 op_ret
= -ERR_MALFORMED_XML
;
8452 RGWXMLDecoder::decode_xml("PublicAccessBlockConfiguration", access_conf
, &parser
, true);
8453 } catch (RGWXMLDecoder::err
&err
) {
8454 ldpp_dout(this, 5) << "unexpected xml:" << err
<< dendl
;
8455 op_ret
= -ERR_MALFORMED_XML
;
8459 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
8461 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
8466 access_conf
.encode(bl
);
8467 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this, &bl
] {
8468 rgw::sal::RGWAttrs
attrs(s
->bucket_attrs
);
8469 attrs
[RGW_ATTR_PUBLIC_ACCESS
] = bl
;
8470 return s
->bucket
->set_instance_attrs(this, attrs
, s
->yield
);
8475 int RGWGetBucketPublicAccessBlock::verify_permission(optional_yield y
)
8477 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketPolicy
)) {
8484 void RGWGetBucketPublicAccessBlock::execute(optional_yield y
)
8486 auto attrs
= s
->bucket_attrs
;
8487 if (auto aiter
= attrs
.find(RGW_ATTR_PUBLIC_ACCESS
);
8488 aiter
== attrs
.end()) {
8489 ldpp_dout(this, 0) << "can't find bucket IAM POLICY attr bucket_name = "
8490 << s
->bucket_name
<< dendl
;
8491 // return the default;
8494 bufferlist::const_iterator iter
{&aiter
->second
};
8496 access_conf
.decode(iter
);
8497 } catch (const buffer::error
& e
) {
8498 ldpp_dout(this, 0) << __func__
<< "decode access_conf failed" << dendl
;
8506 void RGWDeleteBucketPublicAccessBlock::send_response()
8509 set_req_state_err(s
, op_ret
);
8515 int RGWDeleteBucketPublicAccessBlock::verify_permission(optional_yield y
)
8517 if (!verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketPublicAccessBlock
)) {
8524 void RGWDeleteBucketPublicAccessBlock::execute(optional_yield y
)
8526 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
8527 rgw::sal::RGWAttrs
attrs(s
->bucket_attrs
);
8528 attrs
.erase(RGW_ATTR_PUBLIC_ACCESS
);
8529 op_ret
= s
->bucket
->set_instance_attrs(this, attrs
, s
->yield
);