1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
2 // vim: ts=8 sw=2 smarttab
6 #include <system_error>
11 #include <boost/algorithm/string/predicate.hpp>
12 #include <boost/bind.hpp>
13 #include <boost/optional.hpp>
14 #include <boost/utility/in_place_factory.hpp>
15 #include <boost/utility/string_view.hpp>
17 #include "include/scope_guard.h"
18 #include "common/Clock.h"
19 #include "common/armor.h"
20 #include "common/errno.h"
21 #include "common/mime.h"
22 #include "common/utf8.h"
23 #include "common/ceph_json.h"
24 #include "common/static_ptr.h"
26 #include "rgw_rados.h"
31 #include "rgw_acl_s3.h"
32 #include "rgw_acl_swift.h"
33 #include "rgw_aio_throttle.h"
35 #include "rgw_bucket.h"
37 #include "rgw_multi.h"
38 #include "rgw_multi_del.h"
40 #include "rgw_cors_s3.h"
41 #include "rgw_rest_conn.h"
42 #include "rgw_rest_s3.h"
44 #include "rgw_client_io.h"
45 #include "rgw_compression.h"
47 #include "rgw_tag_s3.h"
48 #include "rgw_putobj_processor.h"
49 #include "rgw_crypt.h"
50 #include "rgw_perf_counters.h"
52 #include "services/svc_zone.h"
53 #include "services/svc_quota.h"
54 #include "services/svc_sys_obj.h"
56 #include "cls/lock/cls_lock_client.h"
57 #include "cls/rgw/cls_rgw_client.h"
60 #include "include/ceph_assert.h"
62 #include "compressor/Compressor.h"
65 #define TRACEPOINT_DEFINE
66 #define TRACEPOINT_PROBE_DYNAMIC_LINKAGE
67 #include "tracing/rgw_op.h"
68 #undef TRACEPOINT_PROBE_DYNAMIC_LINKAGE
69 #undef TRACEPOINT_DEFINE
71 #define tracepoint(...)
74 #define dout_context g_ceph_context
75 #define dout_subsys ceph_subsys_rgw
77 using namespace librados
;
78 using ceph::crypto::MD5
;
79 using boost::optional
;
83 using rgw::IAM::Effect
;
84 using rgw::IAM::Policy
;
86 using rgw::IAM::Policy
;
88 static string mp_ns
= RGW_OBJ_NS_MULTIPART
;
89 static string shadow_ns
= RGW_OBJ_NS_SHADOW
;
91 static void forward_req_info(CephContext
*cct
, req_info
& info
, const std::string
& bucket_name
);
92 static int forward_request_to_master(struct req_state
*s
, obj_version
*objv
, RGWRados
*store
,
93 bufferlist
& in_data
, JSONParser
*jp
, req_info
*forward_info
= nullptr);
95 static MultipartMetaFilter mp_filter
;
97 // this probably should belong in the rgw_iam_policy_keywords, I'll get it to it
99 static constexpr auto S3_EXISTING_OBJTAG
= "s3:ExistingObjectTag";
101 int RGWGetObj::parse_range(void)
104 string
rs(range_str
);
108 ignore_invalid_range
= s
->cct
->_conf
->rgw_ignore_get_invalid_range
;
109 partial_content
= false;
111 size_t pos
= rs
.find("bytes=");
112 if (pos
== string::npos
) {
114 while (isspace(rs
[pos
]))
117 while (isalpha(rs
[end
]))
119 if (strncasecmp(rs
.c_str(), "bytes", end
- pos
) != 0)
121 while (isspace(rs
[end
]))
125 rs
= rs
.substr(end
+ 1);
127 rs
= rs
.substr(pos
+ 6); /* size of("bytes=") */
130 if (pos
== string::npos
)
133 partial_content
= true;
135 ofs_str
= rs
.substr(0, pos
);
136 end_str
= rs
.substr(pos
+ 1);
137 if (end_str
.length()) {
138 end
= atoll(end_str
.c_str());
143 if (ofs_str
.length()) {
144 ofs
= atoll(ofs_str
.c_str());
145 } else { // RFC2616 suffix-byte-range-spec
150 if (end
>= 0 && end
< ofs
)
157 if (ignore_invalid_range
) {
158 partial_content
= false;
161 range_parsed
= false; // allow retry
168 static int decode_policy(CephContext
*cct
,
170 RGWAccessControlPolicy
*policy
)
172 auto iter
= bl
.cbegin();
174 policy
->decode(iter
);
175 } catch (buffer::error
& err
) {
176 ldout(cct
, 0) << "ERROR: could not decode policy, caught buffer::error" << dendl
;
179 if (cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
180 ldout(cct
, 15) << __func__
<< " Read AccessControlPolicy";
181 RGWAccessControlPolicy_S3
*s3policy
= static_cast<RGWAccessControlPolicy_S3
*>(policy
);
182 s3policy
->to_xml(*_dout
);
189 static int get_user_policy_from_attr(CephContext
* const cct
,
190 RGWRados
* const store
,
191 map
<string
, bufferlist
>& attrs
,
192 RGWAccessControlPolicy
& policy
/* out */)
194 auto aiter
= attrs
.find(RGW_ATTR_ACL
);
195 if (aiter
!= attrs
.end()) {
196 int ret
= decode_policy(cct
, aiter
->second
, &policy
);
207 static int get_bucket_instance_policy_from_attr(CephContext
*cct
,
209 RGWBucketInfo
& bucket_info
,
210 map
<string
, bufferlist
>& bucket_attrs
,
211 RGWAccessControlPolicy
*policy
)
213 map
<string
, bufferlist
>::iterator aiter
= bucket_attrs
.find(RGW_ATTR_ACL
);
215 if (aiter
!= bucket_attrs
.end()) {
216 int ret
= decode_policy(cct
, aiter
->second
, policy
);
220 ldout(cct
, 0) << "WARNING: couldn't find acl header for bucket, generating default" << dendl
;
222 /* object exists, but policy is broken */
223 int r
= rgw_get_user_info_by_uid(store
, bucket_info
.owner
, uinfo
);
227 policy
->create_default(bucket_info
.owner
, uinfo
.display_name
);
232 static int get_obj_policy_from_attr(CephContext
*cct
,
234 RGWObjectCtx
& obj_ctx
,
235 RGWBucketInfo
& bucket_info
,
236 map
<string
, bufferlist
>& bucket_attrs
,
237 RGWAccessControlPolicy
*policy
,
238 string
*storage_class
,
244 RGWRados::Object
op_target(store
, bucket_info
, obj_ctx
, obj
);
245 RGWRados::Object::Read
rop(&op_target
);
247 ret
= rop
.get_attr(RGW_ATTR_ACL
, bl
);
249 ret
= decode_policy(cct
, bl
, policy
);
252 } else if (ret
== -ENODATA
) {
253 /* object exists, but policy is broken */
254 ldout(cct
, 0) << "WARNING: couldn't find acl header for object, generating default" << dendl
;
256 ret
= rgw_get_user_info_by_uid(store
, bucket_info
.owner
, uinfo
);
260 policy
->create_default(bucket_info
.owner
, uinfo
.display_name
);
265 int r
= rop
.get_attr(RGW_ATTR_STORAGE_CLASS
, scbl
);
267 *storage_class
= scbl
.to_str();
269 storage_class
->clear();
278 * Get the AccessControlPolicy for an object off of disk.
279 * policy: must point to a valid RGWACL, and will be filled upon return.
280 * bucket: name of the bucket containing the object.
281 * object: name of the object to get the ACL for.
282 * Returns: 0 on success, -ERR# otherwise.
284 int rgw_op_get_bucket_policy_from_attr(CephContext
*cct
,
286 RGWBucketInfo
& bucket_info
,
287 map
<string
, bufferlist
>& bucket_attrs
,
288 RGWAccessControlPolicy
*policy
)
290 return get_bucket_instance_policy_from_attr(cct
, store
, bucket_info
, bucket_attrs
, policy
);
293 static boost::optional
<Policy
> get_iam_policy_from_attr(CephContext
* cct
,
295 map
<string
, bufferlist
>& attrs
,
296 const string
& tenant
) {
297 auto i
= attrs
.find(RGW_ATTR_IAM_POLICY
);
298 if (i
!= attrs
.end()) {
299 return Policy(cct
, tenant
, i
->second
);
305 vector
<Policy
> get_iam_user_policy_from_attr(CephContext
* cct
,
307 map
<string
, bufferlist
>& attrs
,
308 const string
& tenant
) {
309 vector
<Policy
> policies
;
310 if (auto it
= attrs
.find(RGW_ATTR_USER_POLICY
); it
!= attrs
.end()) {
311 bufferlist out_bl
= attrs
[RGW_ATTR_USER_POLICY
];
312 map
<string
, string
> policy_map
;
313 decode(policy_map
, out_bl
);
314 for (auto& it
: policy_map
) {
315 bufferlist bl
= bufferlist::static_from_string(it
.second
);
316 Policy
p(cct
, tenant
, bl
);
317 policies
.push_back(std::move(p
));
323 static int get_obj_attrs(RGWRados
*store
, struct req_state
*s
, const rgw_obj
& obj
, map
<string
, bufferlist
>& attrs
)
325 RGWRados::Object
op_target(store
, s
->bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
326 RGWRados::Object::Read
read_op(&op_target
);
328 read_op
.params
.attrs
= &attrs
;
330 return read_op
.prepare();
333 static int get_obj_head(RGWRados
*store
, struct req_state
*s
,
335 map
<string
, bufferlist
> *attrs
,
338 store
->set_prefetch_data(s
->obj_ctx
, obj
);
340 RGWRados::Object
op_target(store
, s
->bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
341 RGWRados::Object::Read
read_op(&op_target
);
343 read_op
.params
.attrs
= attrs
;
345 int ret
= read_op
.prepare();
354 ret
= read_op
.read(0, s
->cct
->_conf
->rgw_max_chunk_size
, *pbl
);
359 struct multipart_upload_info
361 rgw_placement_rule dest_placement
;
363 void encode(bufferlist
& bl
) const {
364 ENCODE_START(1, 1, bl
);
365 encode(dest_placement
, bl
);
369 void decode(bufferlist::const_iterator
& bl
) {
371 decode(dest_placement
, bl
);
375 WRITE_CLASS_ENCODER(multipart_upload_info
)
377 static int get_multipart_info(RGWRados
*store
, struct req_state
*s
,
379 RGWAccessControlPolicy
*policy
,
380 map
<string
, bufferlist
> *attrs
,
381 multipart_upload_info
*upload_info
)
386 bufferlist
*pheadbl
= (upload_info
? &headbl
: nullptr);
388 int op_ret
= get_obj_head(store
, s
, obj
, attrs
, pheadbl
);
390 if (op_ret
== -ENOENT
) {
391 return -ERR_NO_SUCH_UPLOAD
;
396 if (upload_info
&& headbl
.length() > 0) {
397 auto hiter
= headbl
.cbegin();
399 decode(*upload_info
, hiter
);
400 } catch (buffer::error
& err
) {
401 ldpp_dout(s
, 0) << "ERROR: failed to decode multipart upload info" << dendl
;
406 if (policy
&& attrs
) {
407 for (auto& iter
: *attrs
) {
408 string name
= iter
.first
;
409 if (name
.compare(RGW_ATTR_ACL
) == 0) {
410 bufferlist
& bl
= iter
.second
;
411 auto bli
= bl
.cbegin();
413 decode(*policy
, bli
);
414 } catch (buffer::error
& err
) {
415 ldpp_dout(s
, 0) << "ERROR: could not decode policy" << dendl
;
426 static int get_multipart_info(RGWRados
*store
, struct req_state
*s
,
427 const string
& meta_oid
,
428 RGWAccessControlPolicy
*policy
,
429 map
<string
, bufferlist
> *attrs
,
430 multipart_upload_info
*upload_info
)
432 map
<string
, bufferlist
>::iterator iter
;
436 meta_obj
.init_ns(s
->bucket
, meta_oid
, mp_ns
);
437 meta_obj
.set_in_extra_data(true);
439 return get_multipart_info(store
, s
, meta_obj
, policy
, attrs
, upload_info
);
442 static int modify_obj_attr(RGWRados
*store
, struct req_state
*s
, const rgw_obj
& obj
, const char* attr_name
, bufferlist
& attr_val
)
444 map
<string
, bufferlist
> attrs
;
445 RGWRados::Object
op_target(store
, s
->bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
446 RGWRados::Object::Read
read_op(&op_target
);
448 read_op
.params
.attrs
= &attrs
;
450 int r
= read_op
.prepare();
454 store
->set_atomic(s
->obj_ctx
, read_op
.state
.obj
);
455 attrs
[attr_name
] = attr_val
;
456 return store
->set_attrs(s
->obj_ctx
, s
->bucket_info
, read_op
.state
.obj
, attrs
, NULL
);
459 static int read_bucket_policy(RGWRados
*store
,
461 RGWBucketInfo
& bucket_info
,
462 map
<string
, bufferlist
>& bucket_attrs
,
463 RGWAccessControlPolicy
*policy
,
466 if (!s
->system_request
&& bucket_info
.flags
& BUCKET_SUSPENDED
) {
467 ldpp_dout(s
, 0) << "NOTICE: bucket " << bucket_info
.bucket
.name
468 << " is suspended" << dendl
;
469 return -ERR_USER_SUSPENDED
;
472 if (bucket
.name
.empty()) {
476 int ret
= rgw_op_get_bucket_policy_from_attr(s
->cct
, store
, bucket_info
, bucket_attrs
, policy
);
477 if (ret
== -ENOENT
) {
478 ret
= -ERR_NO_SUCH_BUCKET
;
484 static int read_obj_policy(RGWRados
*store
,
486 RGWBucketInfo
& bucket_info
,
487 map
<string
, bufferlist
>& bucket_attrs
,
488 RGWAccessControlPolicy
* acl
,
489 string
*storage_class
,
490 boost::optional
<Policy
>& policy
,
495 upload_id
= s
->info
.args
.get("uploadId");
498 if (!s
->system_request
&& bucket_info
.flags
& BUCKET_SUSPENDED
) {
499 ldpp_dout(s
, 0) << "NOTICE: bucket " << bucket_info
.bucket
.name
500 << " is suspended" << dendl
;
501 return -ERR_USER_SUSPENDED
;
504 if (!upload_id
.empty()) {
505 /* multipart upload */
506 RGWMPObj
mp(object
.name
, upload_id
);
507 string oid
= mp
.get_meta();
508 obj
.init_ns(bucket
, oid
, mp_ns
);
509 obj
.set_in_extra_data(true);
511 obj
= rgw_obj(bucket
, object
);
513 policy
= get_iam_policy_from_attr(s
->cct
, store
, bucket_attrs
, bucket
.tenant
);
515 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
516 int ret
= get_obj_policy_from_attr(s
->cct
, store
, *obj_ctx
,
517 bucket_info
, bucket_attrs
, acl
, storage_class
, obj
);
518 if (ret
== -ENOENT
) {
519 /* object does not exist checking the bucket's ACL to make sure
520 that we send a proper error code */
521 RGWAccessControlPolicy
bucket_policy(s
->cct
);
522 ret
= rgw_op_get_bucket_policy_from_attr(s
->cct
, store
, bucket_info
, bucket_attrs
, &bucket_policy
);
527 const rgw_user
& bucket_owner
= bucket_policy
.get_owner().get_id();
528 if (bucket_owner
.compare(s
->user
->user_id
) != 0 &&
529 ! s
->auth
.identity
->is_admin_of(bucket_owner
) &&
530 ! bucket_policy
.verify_permission(s
, *s
->auth
.identity
, s
->perm_mask
,
542 * Get the AccessControlPolicy for an user, bucket or object off of disk.
543 * s: The req_state to draw information from.
544 * only_bucket: If true, reads the user and bucket ACLs rather than the object ACL.
545 * Returns: 0 on success, -ERR# otherwise.
547 int rgw_build_bucket_policies(RGWRados
* store
, struct req_state
* s
)
551 RGWUserInfo bucket_owner_info
;
552 auto obj_ctx
= store
->svc
.sysobj
->init_obj_ctx();
554 string bi
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"bucket-instance");
556 ret
= rgw_bucket_parse_bucket_instance(bi
, &s
->bucket_instance_id
, &s
->bucket_instance_shard_id
);
562 if(s
->dialect
.compare("s3") == 0) {
563 s
->bucket_acl
= std::make_unique
<RGWAccessControlPolicy_S3
>(s
->cct
);
564 } else if(s
->dialect
.compare("swift") == 0) {
565 /* We aren't allocating the account policy for those operations using
566 * the Swift's infrastructure that don't really need req_state::user.
567 * Typical example here is the implementation of /info. */
568 if (!s
->user
->user_id
.empty()) {
569 s
->user_acl
= std::make_unique
<RGWAccessControlPolicy_SWIFTAcct
>(s
->cct
);
571 s
->bucket_acl
= std::make_unique
<RGWAccessControlPolicy_SWIFT
>(s
->cct
);
573 s
->bucket_acl
= std::make_unique
<RGWAccessControlPolicy
>(s
->cct
);
576 /* check if copy source is within the current domain */
577 if (!s
->src_bucket_name
.empty()) {
578 RGWBucketInfo source_info
;
580 if (s
->bucket_instance_id
.empty()) {
581 ret
= store
->get_bucket_info(obj_ctx
, s
->src_tenant_name
, s
->src_bucket_name
, source_info
, NULL
);
583 ret
= store
->get_bucket_instance_info(obj_ctx
, s
->bucket_instance_id
, source_info
, NULL
, NULL
);
586 string
& zonegroup
= source_info
.zonegroup
;
587 s
->local_source
= store
->svc
.zone
->get_zonegroup().equals(zonegroup
);
593 std::string display_name
;
596 s
->user
->display_name
,
599 if (!s
->bucket_name
.empty()) {
600 s
->bucket_exists
= true;
601 if (s
->bucket_instance_id
.empty()) {
602 ret
= store
->get_bucket_info(obj_ctx
, s
->bucket_tenant
, s
->bucket_name
,
603 s
->bucket_info
, &s
->bucket_mtime
,
606 ret
= store
->get_bucket_instance_info(obj_ctx
, s
->bucket_instance_id
,
607 s
->bucket_info
, &s
->bucket_mtime
,
611 if (ret
!= -ENOENT
) {
613 rgw_make_bucket_entry_name(s
->bucket_tenant
, s
->bucket_name
, bucket_log
);
614 ldpp_dout(s
, 0) << "NOTICE: couldn't get bucket from bucket_name (name="
615 << bucket_log
<< ")" << dendl
;
618 s
->bucket_exists
= false;
620 s
->bucket
= s
->bucket_info
.bucket
;
622 if (s
->bucket_exists
) {
623 ret
= read_bucket_policy(store
, s
, s
->bucket_info
, s
->bucket_attrs
,
624 s
->bucket_acl
.get(), s
->bucket
);
626 s
->bucket_info
.owner
,
627 s
->bucket_acl
->get_owner().get_display_name(),
630 s
->bucket_acl
->create_default(s
->user
->user_id
, s
->user
->display_name
);
631 ret
= -ERR_NO_SUCH_BUCKET
;
634 s
->bucket_owner
= s
->bucket_acl
->get_owner();
636 RGWZoneGroup zonegroup
;
637 int r
= store
->svc
.zone
->get_zonegroup(s
->bucket_info
.zonegroup
, zonegroup
);
639 if (!zonegroup
.endpoints
.empty()) {
640 s
->zonegroup_endpoint
= zonegroup
.endpoints
.front();
642 // use zonegroup's master zone endpoints
643 auto z
= zonegroup
.zones
.find(zonegroup
.master_zone
);
644 if (z
!= zonegroup
.zones
.end() && !z
->second
.endpoints
.empty()) {
645 s
->zonegroup_endpoint
= z
->second
.endpoints
.front();
648 s
->zonegroup_name
= zonegroup
.get_name();
650 if (r
< 0 && ret
== 0) {
654 if (s
->bucket_exists
&& !store
->svc
.zone
->get_zonegroup().equals(s
->bucket_info
.zonegroup
)) {
655 ldpp_dout(s
, 0) << "NOTICE: request for data in a different zonegroup ("
656 << s
->bucket_info
.zonegroup
<< " != "
657 << store
->svc
.zone
->get_zonegroup().get_id() << ")" << dendl
;
658 /* we now need to make sure that the operation actually requires copy source, that is
659 * it's a copy operation
661 if (store
->svc
.zone
->get_zonegroup().is_master_zonegroup() && s
->system_request
) {
662 /*If this is the master, don't redirect*/
663 } else if (s
->op_type
== RGW_OP_GET_BUCKET_LOCATION
) {
664 /* If op is get bucket location, don't redirect */
665 } else if (!s
->local_source
||
666 (s
->op
!= OP_PUT
&& s
->op
!= OP_COPY
) ||
668 return -ERR_PERMANENT_REDIRECT
;
672 /* init dest placement -- only if bucket exists, otherwise request is either not relevant, or
673 * it's a create_bucket request, in which case the op will deal with the placement later */
674 if (s
->bucket_exists
) {
675 s
->dest_placement
.storage_class
= s
->info
.storage_class
;
676 s
->dest_placement
.inherit_from(s
->bucket_info
.placement_rule
);
678 if (!store
->svc
.zone
->get_zone_params().valid_placement(s
->dest_placement
)) {
679 ldpp_dout(s
, 0) << "NOTICE: invalid dest placement: " << s
->dest_placement
.to_str() << dendl
;
685 /* handle user ACL only for those APIs which support it */
687 map
<string
, bufferlist
> uattrs
;
688 ret
= rgw_get_user_attrs_by_uid(store
, acct_acl_user
.uid
, uattrs
);
690 ret
= get_user_policy_from_attr(s
->cct
, store
, uattrs
, *s
->user_acl
);
692 if (-ENOENT
== ret
) {
693 /* In already existing clusters users won't have ACL. In such case
694 * assuming that only account owner has the rights seems to be
695 * reasonable. That allows to have only one verification logic.
696 * NOTE: there is small compatibility kludge for global, empty tenant:
697 * 1. if we try to reach an existing bucket, its owner is considered
699 * 2. otherwise account owner is identity stored in s->user->user_id. */
700 s
->user_acl
->create_default(acct_acl_user
.uid
,
701 acct_acl_user
.display_name
);
703 } else if (ret
< 0) {
704 ldpp_dout(s
, 0) << "NOTICE: couldn't get user attrs for handling ACL "
705 "(user_id=" << s
->user
->user_id
<< ", ret=" << ret
<< ")" << dendl
;
709 // We don't need user policies in case of STS token returned by AssumeRole,
710 // hence the check for user type
711 if (! s
->user
->user_id
.empty() && s
->auth
.identity
->get_identity_type() != TYPE_ROLE
) {
713 map
<string
, bufferlist
> uattrs
;
714 if (ret
= rgw_get_user_attrs_by_uid(store
, s
->user
->user_id
, uattrs
); ! ret
) {
715 if (s
->iam_user_policies
.empty()) {
716 s
->iam_user_policies
= get_iam_user_policy_from_attr(s
->cct
, store
, uattrs
, s
->user
->user_id
.tenant
);
718 // This scenario can happen when a STS token has a policy, then we need to append other user policies
719 // to the existing ones. (e.g. token returned by GetSessionToken)
720 auto user_policies
= get_iam_user_policy_from_attr(s
->cct
, store
, uattrs
, s
->user
->user_id
.tenant
);
721 s
->iam_user_policies
.insert(s
->iam_user_policies
.end(), user_policies
.begin(), user_policies
.end());
728 } catch (const std::exception
& e
) {
729 lderr(s
->cct
) << "Error reading IAM User Policy: " << e
.what() << dendl
;
735 s
->iam_policy
= get_iam_policy_from_attr(s
->cct
, store
, s
->bucket_attrs
,
737 } catch (const std::exception
& e
) {
738 // Really this is a can't happen condition. We parse the policy
739 // when it's given to us, so perhaps we should abort or otherwise
740 // raise bloody murder.
741 ldpp_dout(s
, 0) << "Error reading IAM Policy: " << e
.what() << dendl
;
745 bool success
= store
->svc
.zone
->get_redirect_zone_endpoint(&s
->redirect_zone_endpoint
);
747 ldpp_dout(s
, 20) << "redirect_zone_endpoint=" << s
->redirect_zone_endpoint
<< dendl
;
754 * Get the AccessControlPolicy for a bucket or object off of disk.
755 * s: The req_state to draw information from.
756 * only_bucket: If true, reads the bucket ACL rather than the object ACL.
757 * Returns: 0 on success, -ERR# otherwise.
759 int rgw_build_object_policies(RGWRados
*store
, struct req_state
*s
,
764 if (!s
->object
.empty()) {
765 if (!s
->bucket_exists
) {
766 return -ERR_NO_SUCH_BUCKET
;
768 s
->object_acl
= std::make_unique
<RGWAccessControlPolicy
>(s
->cct
);
769 rgw_obj
obj(s
->bucket
, s
->object
);
771 store
->set_atomic(s
->obj_ctx
, obj
);
773 store
->set_prefetch_data(s
->obj_ctx
, obj
);
775 ret
= read_obj_policy(store
, s
, s
->bucket_info
, s
->bucket_attrs
,
776 s
->object_acl
.get(), nullptr, s
->iam_policy
, s
->bucket
,
783 void rgw_add_to_iam_environment(rgw::IAM::Environment
& e
, std::string_view key
, std::string_view val
){
784 // This variant just adds non empty key pairs to IAM env., values can be empty
785 // in certain cases like tagging
790 static int rgw_iam_add_tags_from_bl(struct req_state
* s
, bufferlist
& bl
){
793 auto bliter
= bl
.cbegin();
794 tagset
.decode(bliter
);
795 } catch (buffer::error
& err
) {
796 ldpp_dout(s
, 0) << "ERROR: caught buffer::error, couldn't decode TagSet" << dendl
;
800 for (const auto& tag
: tagset
.get_tags()){
801 rgw_add_to_iam_environment(s
->env
, "s3:ExistingObjectTag/" + tag
.first
, tag
.second
);
806 static int rgw_iam_add_existing_objtags(RGWRados
* store
, struct req_state
* s
, rgw_obj
& obj
, std::uint64_t action
){
807 map
<string
, bufferlist
> attrs
;
808 store
->set_atomic(s
->obj_ctx
, obj
);
809 int op_ret
= get_obj_attrs(store
, s
, obj
, attrs
);
812 auto tags
= attrs
.find(RGW_ATTR_TAGS
);
813 if (tags
!= attrs
.end()){
814 return rgw_iam_add_tags_from_bl(s
, tags
->second
);
819 static void rgw_add_grant_to_iam_environment(rgw::IAM::Environment
& e
, struct req_state
*s
){
821 using header_pair_t
= std::pair
<const char*, const char*>;
822 static const std::initializer_list
<header_pair_t
> acl_header_conditionals
{
823 {"HTTP_X_AMZ_GRANT_READ", "s3:x-amz-grant-read"},
824 {"HTTP_X_AMZ_GRANT_WRITE", "s3:x-amz-grant-write"},
825 {"HTTP_X_AMZ_GRANT_READ_ACP", "s3:x-amz-grant-read-acp"},
826 {"HTTP_X_AMZ_GRANT_WRITE_ACP", "s3:x-amz-grant-write-acp"},
827 {"HTTP_X_AMZ_GRANT_FULL_CONTROL", "s3:x-amz-grant-full-control"}
830 if (s
->has_acl_header
){
831 for (const auto& c
: acl_header_conditionals
){
832 auto hdr
= s
->info
.env
->get(c
.first
);
840 void rgw_build_iam_environment(RGWRados
* store
,
843 const auto& m
= s
->info
.env
->get_map();
844 auto t
= ceph::real_clock::now();
845 s
->env
.emplace("aws:CurrentTime", std::to_string(ceph::real_clock::to_time_t(t
)));
846 s
->env
.emplace("aws:EpochTime", ceph::to_iso_8601(t
));
847 // TODO: This is fine for now, but once we have STS we'll need to
848 // look and see. Also this won't work with the IdentityApplier
849 // model, since we need to know the actual credential.
850 s
->env
.emplace("aws:PrincipalType", "User");
852 auto i
= m
.find("HTTP_REFERER");
854 s
->env
.emplace("aws:Referer", i
->second
);
857 if (rgw_transport_is_secure(s
->cct
, *s
->info
.env
)) {
858 s
->env
.emplace("aws:SecureTransport", "true");
861 const auto remote_addr_param
= s
->cct
->_conf
->rgw_remote_addr_param
;
862 if (remote_addr_param
.length()) {
863 i
= m
.find(remote_addr_param
);
865 i
= m
.find("REMOTE_ADDR");
868 const string
* ip
= &(i
->second
);
870 if (remote_addr_param
== "HTTP_X_FORWARDED_FOR") {
871 const auto comma
= ip
->find(',');
872 if (comma
!= string::npos
) {
873 temp
.assign(*ip
, 0, comma
);
877 s
->env
.emplace("aws:SourceIp", *ip
);
880 i
= m
.find("HTTP_USER_AGENT"); {
882 s
->env
.emplace("aws:UserAgent", i
->second
);
886 // What to do about aws::userid? One can have multiple access
887 // keys so that isn't really suitable. Do we have a durable
888 // identifier that can persist through name changes?
889 s
->env
.emplace("aws:username", s
->user
->user_id
.id
);
892 i
= m
.find("HTTP_X_AMZ_SECURITY_TOKEN");
894 s
->env
.emplace("sts:authentication", "true");
896 s
->env
.emplace("sts:authentication", "false");
900 void rgw_bucket_object_pre_exec(struct req_state
*s
)
905 dump_bucket_from_state(s
);
908 // So! Now and then when we try to update bucket information, the
909 // bucket has changed during the course of the operation. (Or we have
910 // a cache consistency problem that Watch/Notify isn't ruling out
913 // When this happens, we need to update the bucket info and try
914 // again. We have, however, to try the right *part* again. We can't
915 // simply re-send, since that will obliterate the previous update.
917 // Thus, callers of this function should include everything that
918 // merges information to be changed into the bucket information as
919 // well as the call to set it.
921 // The called function must return an integer, negative on error. In
922 // general, they should just return op_ret.
925 int retry_raced_bucket_write(RGWRados
* g
, req_state
* s
, const F
& f
) {
927 for (auto i
= 0u; i
< 15u && r
== -ECANCELED
; ++i
) {
928 r
= g
->try_refresh_bucket_info(s
->bucket_info
, nullptr,
939 int RGWGetObj::verify_permission()
941 obj
= rgw_obj(s
->bucket
, s
->object
);
942 store
->set_atomic(s
->obj_ctx
, obj
);
944 store
->set_prefetch_data(s
->obj_ctx
, obj
);
947 if (torrent
.get_flag()) {
948 if (obj
.key
.instance
.empty()) {
949 action
= rgw::IAM::s3GetObjectTorrent
;
951 action
= rgw::IAM::s3GetObjectVersionTorrent
;
954 if (obj
.key
.instance
.empty()) {
955 action
= rgw::IAM::s3GetObject
;
957 action
= rgw::IAM::s3GetObjectVersion
;
959 if (s
->iam_policy
&& s
->iam_policy
->has_partial_conditional(S3_EXISTING_OBJTAG
))
960 rgw_iam_add_existing_objtags(store
, s
, obj
, action
);
961 if (! s
->iam_user_policies
.empty()) {
962 for (auto& user_policy
: s
->iam_user_policies
) {
963 if (user_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
))
964 rgw_iam_add_existing_objtags(store
, s
, obj
, action
);
969 if (!verify_object_permission(this, s
, action
)) {
977 int RGWOp::verify_op_mask()
979 uint32_t required_mask
= op_mask();
981 ldpp_dout(this, 20) << "required_mask= " << required_mask
982 << " user.op_mask=" << s
->user
->op_mask
<< dendl
;
984 if ((s
->user
->op_mask
& required_mask
) != required_mask
) {
988 if (!s
->system_request
&& (required_mask
& RGW_OP_TYPE_MODIFY
) && !store
->svc
.zone
->zone_is_writeable()) {
989 ldpp_dout(this, 5) << "NOTICE: modify request to a read-only zone by a "
990 "non-system user, permission denied" << dendl
;
997 int RGWGetObjTags::verify_permission()
999 auto iam_action
= s
->object
.instance
.empty()?
1000 rgw::IAM::s3GetObjectTagging
:
1001 rgw::IAM::s3GetObjectVersionTagging
;
1002 // TODO since we are parsing the bl now anyway, we probably change
1003 // the send_response function to accept RGWObjTag instead of a bl
1004 if (s
->iam_policy
&& s
->iam_policy
->has_partial_conditional(S3_EXISTING_OBJTAG
)){
1005 rgw_obj obj
= rgw_obj(s
->bucket
, s
->object
);
1006 rgw_iam_add_existing_objtags(store
, s
, obj
, iam_action
);
1008 if (! s
->iam_user_policies
.empty()) {
1009 for (auto& user_policy
: s
->iam_user_policies
) {
1010 if (user_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
)) {
1011 rgw_obj obj
= rgw_obj(s
->bucket
, s
->object
);
1012 rgw_iam_add_existing_objtags(store
, s
, obj
, iam_action
);
1016 if (!verify_object_permission(this, s
,iam_action
))
1022 void RGWGetObjTags::pre_exec()
1024 rgw_bucket_object_pre_exec(s
);
1027 void RGWGetObjTags::execute()
1030 map
<string
,bufferlist
> attrs
;
1032 obj
= rgw_obj(s
->bucket
, s
->object
);
1034 store
->set_atomic(s
->obj_ctx
, obj
);
1036 op_ret
= get_obj_attrs(store
, s
, obj
, attrs
);
1038 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << obj
1039 << " ret=" << op_ret
<< dendl
;
1043 auto tags
= attrs
.find(RGW_ATTR_TAGS
);
1044 if(tags
!= attrs
.end()){
1046 tags_bl
.append(tags
->second
);
1048 send_response_data(tags_bl
);
1051 int RGWPutObjTags::verify_permission()
1053 auto iam_action
= s
->object
.instance
.empty() ?
1054 rgw::IAM::s3PutObjectTagging
:
1055 rgw::IAM::s3PutObjectVersionTagging
;
1057 if(s
->iam_policy
&& s
->iam_policy
->has_partial_conditional(S3_EXISTING_OBJTAG
)){
1058 auto obj
= rgw_obj(s
->bucket
, s
->object
);
1059 rgw_iam_add_existing_objtags(store
, s
, obj
, iam_action
);
1061 if (! s
->iam_user_policies
.empty()) {
1062 for (auto& user_policy
: s
->iam_user_policies
) {
1063 if (user_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
)) {
1064 rgw_obj obj
= rgw_obj(s
->bucket
, s
->object
);
1065 rgw_iam_add_existing_objtags(store
, s
, obj
, iam_action
);
1069 if (!verify_object_permission(this, s
,iam_action
))
1074 void RGWPutObjTags::execute()
1076 op_ret
= get_params();
1080 if (s
->object
.empty()){
1081 op_ret
= -EINVAL
; // we only support tagging on existing objects
1086 obj
= rgw_obj(s
->bucket
, s
->object
);
1087 store
->set_atomic(s
->obj_ctx
, obj
);
1088 op_ret
= modify_obj_attr(store
, s
, obj
, RGW_ATTR_TAGS
, tags_bl
);
1089 if (op_ret
== -ECANCELED
){
1090 op_ret
= -ERR_TAG_CONFLICT
;
1094 void RGWDeleteObjTags::pre_exec()
1096 rgw_bucket_object_pre_exec(s
);
1100 int RGWDeleteObjTags::verify_permission()
1102 if (!s
->object
.empty()) {
1103 auto iam_action
= s
->object
.instance
.empty() ?
1104 rgw::IAM::s3DeleteObjectTagging
:
1105 rgw::IAM::s3DeleteObjectVersionTagging
;
1107 if (s
->iam_policy
&& s
->iam_policy
->has_partial_conditional(S3_EXISTING_OBJTAG
)){
1108 auto obj
= rgw_obj(s
->bucket
, s
->object
);
1109 rgw_iam_add_existing_objtags(store
, s
, obj
, iam_action
);
1111 if (! s
->iam_user_policies
.empty()) {
1112 for (auto& user_policy
: s
->iam_user_policies
) {
1113 if (user_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
)) {
1114 auto obj
= rgw_obj(s
->bucket
, s
->object
);
1115 rgw_iam_add_existing_objtags(store
, s
, obj
, iam_action
);
1119 if (!verify_object_permission(this, s
, iam_action
))
1125 void RGWDeleteObjTags::execute()
1127 if (s
->object
.empty())
1131 obj
= rgw_obj(s
->bucket
, s
->object
);
1132 store
->set_atomic(s
->obj_ctx
, obj
);
1133 map
<string
, bufferlist
> attrs
;
1134 map
<string
, bufferlist
> rmattr
;
1136 rmattr
[RGW_ATTR_TAGS
] = bl
;
1137 op_ret
= store
->set_attrs(s
->obj_ctx
, s
->bucket_info
, obj
, attrs
, &rmattr
);
1140 int RGWOp::do_aws4_auth_completion()
1142 ldpp_dout(this, 5) << "NOTICE: call to do_aws4_auth_completion" << dendl
;
1143 if (s
->auth
.completer
) {
1144 if (!s
->auth
.completer
->complete()) {
1145 return -ERR_AMZ_CONTENT_SHA256_MISMATCH
;
1147 ldpp_dout(this, 10) << "v4 auth ok -- do_aws4_auth_completion" << dendl
;
1150 /* TODO(rzarzynski): yes, we're really called twice on PUTs. Only first
1151 * call passes, so we disable second one. This is old behaviour, sorry!
1152 * Plan for tomorrow: seek and destroy. */
1153 s
->auth
.completer
= nullptr;
1159 int RGWOp::init_quota()
1161 /* no quota enforcement for system requests */
1162 if (s
->system_request
)
1165 /* init quota related stuff */
1166 if (!(s
->user
->op_mask
& RGW_OP_TYPE_MODIFY
)) {
1170 /* only interested in object related ops */
1171 if (s
->object
.empty()) {
1175 RGWUserInfo owner_info
;
1178 if (s
->user
->user_id
== s
->bucket_owner
.get_id()) {
1181 int r
= rgw_get_user_info_by_uid(store
, s
->bucket_info
.owner
, owner_info
);
1184 uinfo
= &owner_info
;
1187 if (s
->bucket_info
.quota
.enabled
) {
1188 bucket_quota
= s
->bucket_info
.quota
;
1189 } else if (uinfo
->bucket_quota
.enabled
) {
1190 bucket_quota
= uinfo
->bucket_quota
;
1192 bucket_quota
= store
->svc
.quota
->get_bucket_quota();
1195 if (uinfo
->user_quota
.enabled
) {
1196 user_quota
= uinfo
->user_quota
;
1198 user_quota
= store
->svc
.quota
->get_user_quota();
1204 static bool validate_cors_rule_method(RGWCORSRule
*rule
, const char *req_meth
) {
1208 dout(5) << "req_meth is null" << dendl
;
1212 if (strcmp(req_meth
, "GET") == 0) flags
= RGW_CORS_GET
;
1213 else if (strcmp(req_meth
, "POST") == 0) flags
= RGW_CORS_POST
;
1214 else if (strcmp(req_meth
, "PUT") == 0) flags
= RGW_CORS_PUT
;
1215 else if (strcmp(req_meth
, "DELETE") == 0) flags
= RGW_CORS_DELETE
;
1216 else if (strcmp(req_meth
, "HEAD") == 0) flags
= RGW_CORS_HEAD
;
1218 if (rule
->get_allowed_methods() & flags
) {
1219 dout(10) << "Method " << req_meth
<< " is supported" << dendl
;
1221 dout(5) << "Method " << req_meth
<< " is not supported" << dendl
;
1228 static bool validate_cors_rule_header(RGWCORSRule
*rule
, const char *req_hdrs
) {
1230 vector
<string
> hdrs
;
1231 get_str_vec(req_hdrs
, hdrs
);
1232 for (const auto& hdr
: hdrs
) {
1233 if (!rule
->is_header_allowed(hdr
.c_str(), hdr
.length())) {
1234 dout(5) << "Header " << hdr
<< " is not registered in this rule" << dendl
;
1242 int RGWOp::read_bucket_cors()
1246 map
<string
, bufferlist
>::iterator aiter
= s
->bucket_attrs
.find(RGW_ATTR_CORS
);
1247 if (aiter
== s
->bucket_attrs
.end()) {
1248 ldpp_dout(this, 20) << "no CORS configuration attr found" << dendl
;
1250 return 0; /* no CORS configuration found */
1257 auto iter
= bl
.cbegin();
1259 bucket_cors
.decode(iter
);
1260 } catch (buffer::error
& err
) {
1261 ldpp_dout(this, 0) << "ERROR: could not decode policy, caught buffer::error" << dendl
;
1264 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
1265 RGWCORSConfiguration_S3
*s3cors
= static_cast<RGWCORSConfiguration_S3
*>(&bucket_cors
);
1266 ldpp_dout(this, 15) << "Read RGWCORSConfiguration";
1267 s3cors
->to_xml(*_dout
);
1274 * If any of the header field-names is not a ASCII case-insensitive match for
1275 * any of the values in list of headers do not set any additional headers and
1276 * terminate this set of steps.
1278 static void get_cors_response_headers(RGWCORSRule
*rule
, const char *req_hdrs
, string
& hdrs
, string
& exp_hdrs
, unsigned *max_age
) {
1281 get_str_list(req_hdrs
, hl
);
1282 for(list
<string
>::iterator it
= hl
.begin(); it
!= hl
.end(); ++it
) {
1283 if (!rule
->is_header_allowed((*it
).c_str(), (*it
).length())) {
1284 dout(5) << "Header " << (*it
) << " is not registered in this rule" << dendl
;
1286 if (hdrs
.length() > 0) hdrs
.append(",");
1291 rule
->format_exp_headers(exp_hdrs
);
1292 *max_age
= rule
->get_max_age();
1296 * Generate the CORS header response
1298 * This is described in the CORS standard, section 6.2.
1300 bool RGWOp::generate_cors_headers(string
& origin
, string
& method
, string
& headers
, string
& exp_headers
, unsigned *max_age
)
1303 const char *orig
= s
->info
.env
->get("HTTP_ORIGIN");
1310 op_ret
= read_bucket_cors();
1316 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
1321 RGWCORSRule
*rule
= bucket_cors
.host_name_rule(orig
);
1326 * Set the Allowed-Origin header to a asterisk if this is allowed in the rule
1327 * and no Authorization was send by the client
1329 * The origin parameter specifies a URI that may access the resource. The browser must enforce this.
1330 * For requests without credentials, the server may specify "*" as a wildcard,
1331 * thereby allowing any origin to access the resource.
1333 const char *authorization
= s
->info
.env
->get("HTTP_AUTHORIZATION");
1334 if (!authorization
&& rule
->has_wildcard_origin())
1338 const char *req_meth
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
1340 req_meth
= s
->info
.method
;
1346 if (!validate_cors_rule_method(rule
, req_meth
)) {
1352 const char *req_hdrs
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
1355 get_cors_response_headers(rule
, req_hdrs
, headers
, exp_headers
, max_age
);
1360 int RGWGetObj::read_user_manifest_part(rgw_bucket
& bucket
,
1361 const rgw_bucket_dir_entry
& ent
,
1362 RGWAccessControlPolicy
* const bucket_acl
,
1363 const boost::optional
<Policy
>& bucket_policy
,
1364 const off_t start_ofs
,
1365 const off_t end_ofs
,
1368 ldpp_dout(this, 20) << "user manifest obj=" << ent
.key
.name
1369 << "[" << ent
.key
.instance
<< "]" << dendl
;
1370 RGWGetObj_CB
cb(this);
1371 RGWGetObj_Filter
* filter
= &cb
;
1372 boost::optional
<RGWGetObj_Decompress
> decompress
;
1374 int64_t cur_ofs
= start_ofs
;
1375 int64_t cur_end
= end_ofs
;
1377 rgw_obj
part(bucket
, ent
.key
);
1379 map
<string
, bufferlist
> attrs
;
1382 RGWObjectCtx
obj_ctx(store
);
1383 RGWAccessControlPolicy
obj_policy(s
->cct
);
1385 ldpp_dout(this, 20) << "reading obj=" << part
<< " ofs=" << cur_ofs
1386 << " end=" << cur_end
<< dendl
;
1388 obj_ctx
.set_atomic(part
);
1389 store
->set_prefetch_data(&obj_ctx
, part
);
1391 RGWRados::Object
op_target(store
, s
->bucket_info
, obj_ctx
, part
);
1392 RGWRados::Object::Read
read_op(&op_target
);
1395 /* SLO etag is optional */
1396 read_op
.conds
.if_match
= ent
.meta
.etag
.c_str();
1398 read_op
.params
.attrs
= &attrs
;
1399 read_op
.params
.obj_size
= &obj_size
;
1401 op_ret
= read_op
.prepare();
1404 op_ret
= read_op
.range_to_ofs(ent
.meta
.accounted_size
, cur_ofs
, cur_end
);
1407 bool need_decompress
;
1408 op_ret
= rgw_compression_info_from_attrset(attrs
, need_decompress
, cs_info
);
1410 ldpp_dout(this, 0) << "ERROR: failed to decode compression info" << dendl
;
1414 if (need_decompress
)
1416 if (cs_info
.orig_size
!= ent
.meta
.accounted_size
) {
1417 // hmm.. something wrong, object not as expected, abort!
1418 ldpp_dout(this, 0) << "ERROR: expected cs_info.orig_size=" << cs_info
.orig_size
1419 << ", actual read size=" << ent
.meta
.size
<< dendl
;
1422 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
1423 filter
= &*decompress
;
1427 if (obj_size
!= ent
.meta
.size
) {
1428 // hmm.. something wrong, object not as expected, abort!
1429 ldpp_dout(this, 0) << "ERROR: expected obj_size=" << obj_size
1430 << ", actual read size=" << ent
.meta
.size
<< dendl
;
1435 op_ret
= rgw_policy_from_attrset(s
->cct
, attrs
, &obj_policy
);
1439 /* We can use global user_acl because LOs cannot have segments
1440 * stored inside different accounts. */
1441 if (s
->system_request
) {
1442 ldpp_dout(this, 2) << "overriding permissions due to system operation" << dendl
;
1443 } else if (s
->auth
.identity
->is_admin_of(s
->user
->user_id
)) {
1444 ldpp_dout(this, 2) << "overriding permissions due to admin operation" << dendl
;
1445 } else if (!verify_object_permission(this, s
, part
, s
->user_acl
.get(), bucket_acl
,
1446 &obj_policy
, bucket_policy
, s
->iam_user_policies
, action
)) {
1449 if (ent
.meta
.size
== 0) {
1453 perfcounter
->inc(l_rgw_get_b
, cur_end
- cur_ofs
);
1454 filter
->fixup_range(cur_ofs
, cur_end
);
1455 op_ret
= read_op
.iterate(cur_ofs
, cur_end
, filter
);
1457 op_ret
= filter
->flush();
1461 static int iterate_user_manifest_parts(CephContext
* const cct
,
1462 RGWRados
* const store
,
1465 RGWBucketInfo
*pbucket_info
,
1466 const string
& obj_prefix
,
1467 RGWAccessControlPolicy
* const bucket_acl
,
1468 const boost::optional
<Policy
>& bucket_policy
,
1469 uint64_t * const ptotal_len
,
1470 uint64_t * const pobj_size
,
1471 string
* const pobj_sum
,
1472 int (*cb
)(rgw_bucket
& bucket
,
1473 const rgw_bucket_dir_entry
& ent
,
1474 RGWAccessControlPolicy
* const bucket_acl
,
1475 const boost::optional
<Policy
>& bucket_policy
,
1480 void * const cb_param
)
1482 rgw_bucket
& bucket
= pbucket_info
->bucket
;
1483 uint64_t obj_ofs
= 0, len_count
= 0;
1484 bool found_start
= false, found_end
= false, handled_end
= false;
1487 vector
<rgw_bucket_dir_entry
> objs
;
1489 utime_t start_time
= ceph_clock_now();
1491 RGWRados::Bucket
target(store
, *pbucket_info
);
1492 RGWRados::Bucket::List
list_op(&target
);
1494 list_op
.params
.prefix
= obj_prefix
;
1495 list_op
.params
.delim
= delim
;
1499 #define MAX_LIST_OBJS 100
1500 int r
= list_op
.list_objects(MAX_LIST_OBJS
, &objs
, NULL
, &is_truncated
);
1505 for (rgw_bucket_dir_entry
& ent
: objs
) {
1506 const uint64_t cur_total_len
= obj_ofs
;
1507 const uint64_t obj_size
= ent
.meta
.accounted_size
;
1508 uint64_t start_ofs
= 0, end_ofs
= obj_size
;
1510 if ((ptotal_len
|| cb
) && !found_start
&& cur_total_len
+ obj_size
> (uint64_t)ofs
) {
1511 start_ofs
= ofs
- obj_ofs
;
1515 obj_ofs
+= obj_size
;
1517 etag_sum
.Update((const unsigned char *)ent
.meta
.etag
.c_str(),
1518 ent
.meta
.etag
.length());
1521 if ((ptotal_len
|| cb
) && !found_end
&& obj_ofs
> (uint64_t)end
) {
1522 end_ofs
= end
- cur_total_len
+ 1;
1526 perfcounter
->tinc(l_rgw_get_lat
,
1527 (ceph_clock_now() - start_time
));
1529 if (found_start
&& !handled_end
) {
1530 len_count
+= end_ofs
- start_ofs
;
1533 r
= cb(bucket
, ent
, bucket_acl
, bucket_policy
, start_ofs
, end_ofs
,
1534 cb_param
, false /* swift_slo */);
1541 handled_end
= found_end
;
1542 start_time
= ceph_clock_now();
1544 } while (is_truncated
);
1547 *ptotal_len
= len_count
;
1550 *pobj_size
= obj_ofs
;
1553 complete_etag(etag_sum
, pobj_sum
);
1559 struct rgw_slo_part
{
1560 RGWAccessControlPolicy
*bucket_acl
= nullptr;
1561 Policy
* bucket_policy
= nullptr;
1568 static int iterate_slo_parts(CephContext
*cct
,
1572 map
<uint64_t, rgw_slo_part
>& slo_parts
,
1573 int (*cb
)(rgw_bucket
& bucket
,
1574 const rgw_bucket_dir_entry
& ent
,
1575 RGWAccessControlPolicy
*bucket_acl
,
1576 const boost::optional
<Policy
>& bucket_policy
,
1583 bool found_start
= false, found_end
= false;
1585 if (slo_parts
.empty()) {
1589 utime_t start_time
= ceph_clock_now();
1591 map
<uint64_t, rgw_slo_part
>::iterator iter
= slo_parts
.upper_bound(ofs
);
1592 if (iter
!= slo_parts
.begin()) {
1596 uint64_t obj_ofs
= iter
->first
;
1598 for (; iter
!= slo_parts
.end() && !found_end
; ++iter
) {
1599 rgw_slo_part
& part
= iter
->second
;
1600 rgw_bucket_dir_entry ent
;
1602 ent
.key
.name
= part
.obj_name
;
1603 ent
.meta
.accounted_size
= ent
.meta
.size
= part
.size
;
1604 ent
.meta
.etag
= part
.etag
;
1606 uint64_t cur_total_len
= obj_ofs
;
1607 uint64_t start_ofs
= 0, end_ofs
= ent
.meta
.size
;
1609 if (!found_start
&& cur_total_len
+ ent
.meta
.size
> (uint64_t)ofs
) {
1610 start_ofs
= ofs
- obj_ofs
;
1614 obj_ofs
+= ent
.meta
.size
;
1616 if (!found_end
&& obj_ofs
> (uint64_t)end
) {
1617 end_ofs
= end
- cur_total_len
+ 1;
1621 perfcounter
->tinc(l_rgw_get_lat
,
1622 (ceph_clock_now() - start_time
));
1626 // SLO is a Swift thing, and Swift has no knowledge of S3 Policies.
1627 int r
= cb(part
.bucket
, ent
, part
.bucket_acl
,
1628 (part
.bucket_policy
?
1629 boost::optional
<Policy
>(*part
.bucket_policy
) : none
),
1630 start_ofs
, end_ofs
, cb_param
, true /* swift_slo */);
1636 start_time
= ceph_clock_now();
1642 static int get_obj_user_manifest_iterate_cb(rgw_bucket
& bucket
,
1643 const rgw_bucket_dir_entry
& ent
,
1644 RGWAccessControlPolicy
* const bucket_acl
,
1645 const boost::optional
<Policy
>& bucket_policy
,
1646 const off_t start_ofs
,
1647 const off_t end_ofs
,
1649 bool swift_slo
= false)
1651 RGWGetObj
*op
= static_cast<RGWGetObj
*>(param
);
1652 return op
->read_user_manifest_part(
1653 bucket
, ent
, bucket_acl
, bucket_policy
, start_ofs
, end_ofs
, swift_slo
);
1656 int RGWGetObj::handle_user_manifest(const char *prefix
)
1658 const boost::string_view
prefix_view(prefix
);
1659 ldpp_dout(this, 2) << "RGWGetObj::handle_user_manifest() prefix="
1660 << prefix_view
<< dendl
;
1662 const size_t pos
= prefix_view
.find('/');
1663 if (pos
== string::npos
) {
1667 const std::string bucket_name
= url_decode(prefix_view
.substr(0, pos
));
1668 const std::string obj_prefix
= url_decode(prefix_view
.substr(pos
+ 1));
1672 RGWAccessControlPolicy
_bucket_acl(s
->cct
);
1673 RGWAccessControlPolicy
*bucket_acl
;
1674 boost::optional
<Policy
> _bucket_policy
;
1675 boost::optional
<Policy
>* bucket_policy
;
1676 RGWBucketInfo bucket_info
;
1677 RGWBucketInfo
*pbucket_info
;
1679 if (bucket_name
.compare(s
->bucket
.name
) != 0) {
1680 map
<string
, bufferlist
> bucket_attrs
;
1681 auto obj_ctx
= store
->svc
.sysobj
->init_obj_ctx();
1682 int r
= store
->get_bucket_info(obj_ctx
, s
->user
->user_id
.tenant
,
1683 bucket_name
, bucket_info
, NULL
,
1686 ldpp_dout(this, 0) << "could not get bucket info for bucket="
1687 << bucket_name
<< dendl
;
1690 bucket
= bucket_info
.bucket
;
1691 pbucket_info
= &bucket_info
;
1692 bucket_acl
= &_bucket_acl
;
1693 r
= read_bucket_policy(store
, s
, bucket_info
, bucket_attrs
, bucket_acl
, bucket
);
1695 ldpp_dout(this, 0) << "failed to read bucket policy" << dendl
;
1698 _bucket_policy
= get_iam_policy_from_attr(s
->cct
, store
, bucket_attrs
,
1699 bucket_info
.bucket
.tenant
);
1700 bucket_policy
= &_bucket_policy
;
1703 pbucket_info
= &s
->bucket_info
;
1704 bucket_acl
= s
->bucket_acl
.get();
1705 bucket_policy
= &s
->iam_policy
;
1708 /* dry run to find out:
1709 * - total length (of the parts we are going to send to client),
1710 * - overall DLO's content size,
1711 * - md5 sum of overall DLO's content (for etag of Swift API). */
1712 int r
= iterate_user_manifest_parts(s
->cct
, store
, ofs
, end
,
1713 pbucket_info
, obj_prefix
, bucket_acl
, *bucket_policy
,
1714 nullptr, &s
->obj_size
, &lo_etag
,
1715 nullptr /* cb */, nullptr /* cb arg */);
1720 r
= RGWRados::Object::Read::range_to_ofs(s
->obj_size
, ofs
, end
);
1725 r
= iterate_user_manifest_parts(s
->cct
, store
, ofs
, end
,
1726 pbucket_info
, obj_prefix
, bucket_acl
, *bucket_policy
,
1727 &total_len
, nullptr, nullptr,
1735 send_response_data(bl
, 0, 0);
1739 r
= iterate_user_manifest_parts(s
->cct
, store
, ofs
, end
,
1740 pbucket_info
, obj_prefix
, bucket_acl
, *bucket_policy
,
1741 nullptr, nullptr, nullptr,
1742 get_obj_user_manifest_iterate_cb
, (void *)this);
1749 send_response_data(bl
, 0, 0);
1755 int RGWGetObj::handle_slo_manifest(bufferlist
& bl
)
1757 RGWSLOInfo slo_info
;
1758 auto bliter
= bl
.cbegin();
1760 decode(slo_info
, bliter
);
1761 } catch (buffer::error
& err
) {
1762 ldpp_dout(this, 0) << "ERROR: failed to decode slo manifest" << dendl
;
1765 ldpp_dout(this, 2) << "RGWGetObj::handle_slo_manifest()" << dendl
;
1767 vector
<RGWAccessControlPolicy
> allocated_acls
;
1768 map
<string
, pair
<RGWAccessControlPolicy
*, boost::optional
<Policy
>>> policies
;
1769 map
<string
, rgw_bucket
> buckets
;
1771 map
<uint64_t, rgw_slo_part
> slo_parts
;
1776 for (const auto& entry
: slo_info
.entries
) {
1777 const string
& path
= entry
.path
;
1779 /* If the path starts with slashes, strip them all. */
1780 const size_t pos_init
= path
.find_first_not_of('/');
1781 /* According to the documentation of std::string::find following check
1782 * is not necessary as we should get the std::string::npos propagation
1783 * here. This might be true with the accuracy to implementation's bugs.
1784 * See following question on SO:
1785 * http://stackoverflow.com/questions/1011790/why-does-stdstring-findtext-stdstringnpos-not-return-npos
1787 if (pos_init
== string::npos
) {
1791 const size_t pos_sep
= path
.find('/', pos_init
);
1792 if (pos_sep
== string::npos
) {
1796 string bucket_name
= path
.substr(pos_init
, pos_sep
- pos_init
);
1797 string obj_name
= path
.substr(pos_sep
+ 1);
1800 RGWAccessControlPolicy
*bucket_acl
;
1801 Policy
* bucket_policy
;
1803 if (bucket_name
.compare(s
->bucket
.name
) != 0) {
1804 const auto& piter
= policies
.find(bucket_name
);
1805 if (piter
!= policies
.end()) {
1806 bucket_acl
= piter
->second
.first
;
1807 bucket_policy
= piter
->second
.second
.get_ptr();
1808 bucket
= buckets
[bucket_name
];
1810 allocated_acls
.push_back(RGWAccessControlPolicy(s
->cct
));
1811 RGWAccessControlPolicy
& _bucket_acl
= allocated_acls
.back();
1813 RGWBucketInfo bucket_info
;
1814 map
<string
, bufferlist
> bucket_attrs
;
1815 auto obj_ctx
= store
->svc
.sysobj
->init_obj_ctx();
1816 int r
= store
->get_bucket_info(obj_ctx
, s
->user
->user_id
.tenant
,
1817 bucket_name
, bucket_info
, nullptr,
1820 ldpp_dout(this, 0) << "could not get bucket info for bucket="
1821 << bucket_name
<< dendl
;
1824 bucket
= bucket_info
.bucket
;
1825 bucket_acl
= &_bucket_acl
;
1826 r
= read_bucket_policy(store
, s
, bucket_info
, bucket_attrs
, bucket_acl
,
1829 ldpp_dout(this, 0) << "failed to read bucket ACL for bucket "
1833 auto _bucket_policy
= get_iam_policy_from_attr(
1834 s
->cct
, store
, bucket_attrs
, bucket_info
.bucket
.tenant
);
1835 bucket_policy
= _bucket_policy
.get_ptr();
1836 buckets
[bucket_name
] = bucket
;
1837 policies
[bucket_name
] = make_pair(bucket_acl
, _bucket_policy
);
1841 bucket_acl
= s
->bucket_acl
.get();
1842 bucket_policy
= s
->iam_policy
.get_ptr();
1846 part
.bucket_acl
= bucket_acl
;
1847 part
.bucket_policy
= bucket_policy
;
1848 part
.bucket
= bucket
;
1849 part
.obj_name
= obj_name
;
1850 part
.size
= entry
.size_bytes
;
1851 part
.etag
= entry
.etag
;
1852 ldpp_dout(this, 20) << "slo_part: ofs=" << ofs
1853 << " bucket=" << part
.bucket
1854 << " obj=" << part
.obj_name
1855 << " size=" << part
.size
1856 << " etag=" << part
.etag
1859 etag_sum
.Update((const unsigned char *)entry
.etag
.c_str(),
1860 entry
.etag
.length());
1862 slo_parts
[total_len
] = part
;
1863 total_len
+= part
.size
;
1864 } /* foreach entry */
1866 complete_etag(etag_sum
, &lo_etag
);
1868 s
->obj_size
= slo_info
.total_size
;
1869 ldpp_dout(this, 20) << "s->obj_size=" << s
->obj_size
<< dendl
;
1871 int r
= RGWRados::Object::Read::range_to_ofs(total_len
, ofs
, end
);
1876 total_len
= end
- ofs
+ 1;
1878 r
= iterate_slo_parts(s
->cct
, store
, ofs
, end
, slo_parts
,
1879 get_obj_user_manifest_iterate_cb
, (void *)this);
1887 int RGWGetObj::get_data_cb(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
)
1889 /* garbage collection related handling */
1890 utime_t start_time
= ceph_clock_now();
1891 if (start_time
> gc_invalidate_time
) {
1892 int r
= store
->defer_gc(s
->obj_ctx
, s
->bucket_info
, obj
);
1894 ldpp_dout(this, 0) << "WARNING: could not defer gc entry for obj" << dendl
;
1896 gc_invalidate_time
= start_time
;
1897 gc_invalidate_time
+= (s
->cct
->_conf
->rgw_gc_obj_min_wait
/ 2);
1899 return send_response_data(bl
, bl_ofs
, bl_len
);
1902 bool RGWGetObj::prefetch_data()
1904 /* HEAD request, stop prefetch*/
1909 bool prefetch_first_chunk
= true;
1910 range_str
= s
->info
.env
->get("HTTP_RANGE");
1913 int r
= parse_range();
1914 /* error on parsing the range, stop prefetch and will fail in execute() */
1916 return false; /* range_parsed==false */
1918 /* range get goes to shadow objects, stop prefetch */
1919 if (ofs
>= s
->cct
->_conf
->rgw_max_chunk_size
) {
1920 prefetch_first_chunk
= false;
1924 return get_data
&& prefetch_first_chunk
;
1927 void RGWGetObj::pre_exec()
1929 rgw_bucket_object_pre_exec(s
);
1932 static bool object_is_expired(map
<string
, bufferlist
>& attrs
) {
1933 map
<string
, bufferlist
>::iterator iter
= attrs
.find(RGW_ATTR_DELETE_AT
);
1934 if (iter
!= attrs
.end()) {
1937 decode(delete_at
, iter
->second
);
1938 } catch (buffer::error
& err
) {
1939 dout(0) << "ERROR: " << __func__
<< ": failed to decode " RGW_ATTR_DELETE_AT
" attr" << dendl
;
1943 if (delete_at
<= ceph_clock_now() && !delete_at
.is_zero()) {
1951 void RGWGetObj::execute()
1954 gc_invalidate_time
= ceph_clock_now();
1955 gc_invalidate_time
+= (s
->cct
->_conf
->rgw_gc_obj_min_wait
/ 2);
1957 bool need_decompress
;
1958 int64_t ofs_x
, end_x
;
1960 RGWGetObj_CB
cb(this);
1961 RGWGetObj_Filter
* filter
= (RGWGetObj_Filter
*)&cb
;
1962 boost::optional
<RGWGetObj_Decompress
> decompress
;
1963 std::unique_ptr
<RGWGetObj_Filter
> decrypt
;
1964 map
<string
, bufferlist
>::iterator attr_iter
;
1966 perfcounter
->inc(l_rgw_get
);
1968 RGWRados::Object
op_target(store
, s
->bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
1969 RGWRados::Object::Read
read_op(&op_target
);
1971 op_ret
= get_params();
1975 op_ret
= init_common();
1979 read_op
.conds
.mod_ptr
= mod_ptr
;
1980 read_op
.conds
.unmod_ptr
= unmod_ptr
;
1981 read_op
.conds
.high_precision_time
= s
->system_request
; /* system request need to use high precision time */
1982 read_op
.conds
.mod_zone_id
= mod_zone_id
;
1983 read_op
.conds
.mod_pg_ver
= mod_pg_ver
;
1984 read_op
.conds
.if_match
= if_match
;
1985 read_op
.conds
.if_nomatch
= if_nomatch
;
1986 read_op
.params
.attrs
= &attrs
;
1987 read_op
.params
.lastmod
= &lastmod
;
1988 read_op
.params
.obj_size
= &s
->obj_size
;
1990 op_ret
= read_op
.prepare();
1993 version_id
= read_op
.state
.obj
.key
.instance
;
1995 /* STAT ops don't need data, and do no i/o */
1996 if (get_type() == RGW_OP_STAT_OBJ
) {
2000 /* start gettorrent */
2001 if (torrent
.get_flag())
2003 attr_iter
= attrs
.find(RGW_ATTR_CRYPT_MODE
);
2004 if (attr_iter
!= attrs
.end() && attr_iter
->second
.to_str() == "SSE-C-AES256") {
2005 ldpp_dout(this, 0) << "ERROR: torrents are not supported for objects "
2006 "encrypted with SSE-C" << dendl
;
2010 torrent
.init(s
, store
);
2011 op_ret
= torrent
.get_torrent_file(read_op
, total_len
, bl
, obj
);
2014 ldpp_dout(this, 0) << "ERROR: failed to get_torrent_file ret= " << op_ret
2018 op_ret
= send_response_data(bl
, 0, total_len
);
2021 ldpp_dout(this, 0) << "ERROR: failed to send_response_data ret= " << op_ret
<< dendl
;
2026 /* end gettorrent */
2028 op_ret
= rgw_compression_info_from_attrset(attrs
, need_decompress
, cs_info
);
2030 ldpp_dout(s
, 0) << "ERROR: failed to decode compression info, cannot decompress" << dendl
;
2033 if (need_decompress
) {
2034 s
->obj_size
= cs_info
.orig_size
;
2035 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
2036 filter
= &*decompress
;
2039 attr_iter
= attrs
.find(RGW_ATTR_USER_MANIFEST
);
2040 if (attr_iter
!= attrs
.end() && !skip_manifest
) {
2041 op_ret
= handle_user_manifest(attr_iter
->second
.c_str());
2043 ldpp_dout(this, 0) << "ERROR: failed to handle user manifest ret="
2050 attr_iter
= attrs
.find(RGW_ATTR_SLO_MANIFEST
);
2051 if (attr_iter
!= attrs
.end() && !skip_manifest
) {
2053 op_ret
= handle_slo_manifest(attr_iter
->second
);
2055 ldpp_dout(this, 0) << "ERROR: failed to handle slo manifest ret=" << op_ret
2062 // for range requests with obj size 0
2063 if (range_str
&& !(s
->obj_size
)) {
2069 op_ret
= read_op
.range_to_ofs(s
->obj_size
, ofs
, end
);
2072 total_len
= (ofs
<= end
? end
+ 1 - ofs
: 0);
2074 /* Check whether the object has expired. Swift API documentation
2075 * stands that we should return 404 Not Found in such case. */
2076 if (need_object_expiration() && object_is_expired(attrs
)) {
2083 attr_iter
= attrs
.find(RGW_ATTR_MANIFEST
);
2084 op_ret
= this->get_decrypt_filter(&decrypt
, filter
,
2085 attr_iter
!= attrs
.end() ? &(attr_iter
->second
) : nullptr);
2086 if (decrypt
!= nullptr) {
2087 filter
= decrypt
.get();
2093 if (!get_data
|| ofs
> end
) {
2094 send_response_data(bl
, 0, 0);
2098 perfcounter
->inc(l_rgw_get_b
, end
- ofs
);
2102 filter
->fixup_range(ofs_x
, end_x
);
2103 op_ret
= read_op
.iterate(ofs_x
, end_x
, filter
);
2106 op_ret
= filter
->flush();
2108 perfcounter
->tinc(l_rgw_get_lat
, s
->time_elapsed());
2113 op_ret
= send_response_data(bl
, 0, 0);
2120 send_response_data_error();
2123 int RGWGetObj::init_common()
2126 /* range parsed error when prefetch */
2127 if (!range_parsed
) {
2128 int r
= parse_range();
2134 if (parse_time(if_mod
, &mod_time
) < 0)
2136 mod_ptr
= &mod_time
;
2140 if (parse_time(if_unmod
, &unmod_time
) < 0)
2142 unmod_ptr
= &unmod_time
;
2148 int RGWListBuckets::verify_permission()
2150 rgw::IAM::Partition partition
= rgw::IAM::Partition::aws
;
2151 rgw::IAM::Service service
= rgw::IAM::Service::s3
;
2153 if (!verify_user_permission(this, s
, ARN(partition
, service
, "", s
->user
->user_id
.tenant
, "*"), rgw::IAM::s3ListAllMyBuckets
)) {
2160 int RGWGetUsage::verify_permission()
2162 if (s
->auth
.identity
->is_anonymous()) {
2169 void RGWListBuckets::execute()
2172 bool started
= false;
2173 uint64_t total_count
= 0;
2175 const uint64_t max_buckets
= s
->cct
->_conf
->rgw_list_buckets_max_chunk
;
2177 op_ret
= get_params();
2182 if (supports_account_metadata()) {
2183 op_ret
= rgw_get_user_attrs_by_uid(store
, s
->user
->user_id
, attrs
);
2189 is_truncated
= false;
2191 RGWUserBuckets buckets
;
2192 uint64_t read_count
;
2194 read_count
= min(limit
- total_count
, max_buckets
);
2196 read_count
= max_buckets
;
2199 op_ret
= rgw_read_user_buckets(store
, s
->user
->user_id
, buckets
,
2200 marker
, end_marker
, read_count
,
2201 should_get_stats(), &is_truncated
,
2204 /* hmm.. something wrong here.. the user was authenticated, so it
2206 ldpp_dout(this, 10) << "WARNING: failed on rgw_get_user_buckets uid="
2207 << s
->user
->user_id
<< dendl
;
2211 /* We need to have stats for all our policies - even if a given policy
2212 * isn't actually used in a given account. In such situation its usage
2213 * stats would be simply full of zeros. */
2214 for (const auto& policy
: store
->svc
.zone
->get_zonegroup().placement_targets
) {
2215 policies_stats
.emplace(policy
.second
.name
,
2216 decltype(policies_stats
)::mapped_type());
2219 std::map
<std::string
, RGWBucketEnt
>& m
= buckets
.get_buckets();
2220 for (const auto& kv
: m
) {
2221 const auto& bucket
= kv
.second
;
2223 global_stats
.bytes_used
+= bucket
.size
;
2224 global_stats
.bytes_used_rounded
+= bucket
.size_rounded
;
2225 global_stats
.objects_count
+= bucket
.count
;
2227 /* operator[] still can create a new entry for storage policy seen
2228 * for first time. */
2229 auto& policy_stats
= policies_stats
[bucket
.placement_rule
.to_str()];
2230 policy_stats
.bytes_used
+= bucket
.size
;
2231 policy_stats
.bytes_used_rounded
+= bucket
.size_rounded
;
2232 policy_stats
.buckets_count
++;
2233 policy_stats
.objects_count
+= bucket
.count
;
2235 global_stats
.buckets_count
+= m
.size();
2236 total_count
+= m
.size();
2238 done
= (m
.size() < read_count
|| (limit
>= 0 && total_count
>= (uint64_t)limit
));
2241 send_response_begin(buckets
.count() > 0);
2246 map
<string
, RGWBucketEnt
>::reverse_iterator riter
= m
.rbegin();
2247 marker
= riter
->first
;
2249 handle_listing_chunk(std::move(buckets
));
2251 } while (is_truncated
&& !done
);
2255 send_response_begin(false);
2257 send_response_end();
2260 void RGWGetUsage::execute()
2262 uint64_t start_epoch
= 0;
2263 uint64_t end_epoch
= (uint64_t)-1;
2264 op_ret
= get_params();
2268 if (!start_date
.empty()) {
2269 op_ret
= utime_t::parse_date(start_date
, &start_epoch
, NULL
);
2271 ldpp_dout(this, 0) << "ERROR: failed to parse start date" << dendl
;
2276 if (!end_date
.empty()) {
2277 op_ret
= utime_t::parse_date(end_date
, &end_epoch
, NULL
);
2279 ldpp_dout(this, 0) << "ERROR: failed to parse end date" << dendl
;
2284 uint32_t max_entries
= 1000;
2286 bool is_truncated
= true;
2288 RGWUsageIter usage_iter
;
2290 while (is_truncated
) {
2291 op_ret
= store
->read_usage(s
->user
->user_id
, s
->bucket_name
, start_epoch
, end_epoch
, max_entries
,
2292 &is_truncated
, usage_iter
, usage
);
2294 if (op_ret
== -ENOENT
) {
2296 is_truncated
= false;
2304 op_ret
= rgw_user_sync_all_stats(store
, s
->user
->user_id
);
2306 ldpp_dout(this, 0) << "ERROR: failed to sync user stats" << dendl
;
2310 op_ret
= rgw_user_get_all_buckets_stats(store
, s
->user
->user_id
, buckets_usage
);
2312 ldpp_dout(this, 0) << "ERROR: failed to get user's buckets stats" << dendl
;
2316 string user_str
= s
->user
->user_id
.to_str();
2317 op_ret
= store
->cls_user_get_header(user_str
, &header
);
2319 ldpp_dout(this, 0) << "ERROR: can't read user header" << dendl
;
2326 int RGWStatAccount::verify_permission()
2328 if (!verify_user_permission_no_policy(this, s
, RGW_PERM_READ
)) {
2335 void RGWStatAccount::execute()
2338 bool is_truncated
= false;
2339 uint64_t max_buckets
= s
->cct
->_conf
->rgw_list_buckets_max_chunk
;
2342 RGWUserBuckets buckets
;
2344 op_ret
= rgw_read_user_buckets(store
, s
->user
->user_id
, buckets
, marker
,
2345 string(), max_buckets
, true, &is_truncated
);
2347 /* hmm.. something wrong here.. the user was authenticated, so it
2349 ldpp_dout(this, 10) << "WARNING: failed on rgw_get_user_buckets uid="
2350 << s
->user
->user_id
<< dendl
;
2353 /* We need to have stats for all our policies - even if a given policy
2354 * isn't actually used in a given account. In such situation its usage
2355 * stats would be simply full of zeros. */
2356 for (const auto& policy
: store
->svc
.zone
->get_zonegroup().placement_targets
) {
2357 policies_stats
.emplace(policy
.second
.name
,
2358 decltype(policies_stats
)::mapped_type());
2361 std::map
<std::string
, RGWBucketEnt
>& m
= buckets
.get_buckets();
2362 for (const auto& kv
: m
) {
2363 const auto& bucket
= kv
.second
;
2365 global_stats
.bytes_used
+= bucket
.size
;
2366 global_stats
.bytes_used_rounded
+= bucket
.size_rounded
;
2367 global_stats
.objects_count
+= bucket
.count
;
2369 /* operator[] still can create a new entry for storage policy seen
2370 * for first time. */
2371 auto& policy_stats
= policies_stats
[bucket
.placement_rule
.to_str()];
2372 policy_stats
.bytes_used
+= bucket
.size
;
2373 policy_stats
.bytes_used_rounded
+= bucket
.size_rounded
;
2374 policy_stats
.buckets_count
++;
2375 policy_stats
.objects_count
+= bucket
.count
;
2377 global_stats
.buckets_count
+= m
.size();
2380 } while (is_truncated
);
2383 int RGWGetBucketVersioning::verify_permission()
2385 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketVersioning
);
2388 void RGWGetBucketVersioning::pre_exec()
2390 rgw_bucket_object_pre_exec(s
);
2393 void RGWGetBucketVersioning::execute()
2395 versioned
= s
->bucket_info
.versioned();
2396 versioning_enabled
= s
->bucket_info
.versioning_enabled();
2397 mfa_enabled
= s
->bucket_info
.mfa_enabled();
2400 int RGWSetBucketVersioning::verify_permission()
2402 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketVersioning
);
2405 void RGWSetBucketVersioning::pre_exec()
2407 rgw_bucket_object_pre_exec(s
);
2410 void RGWSetBucketVersioning::execute()
2412 op_ret
= get_params();
2416 bool cur_mfa_status
= (s
->bucket_info
.flags
& BUCKET_MFA_ENABLED
) != 0;
2418 mfa_set_status
&= (mfa_status
!= cur_mfa_status
);
2420 if (mfa_set_status
&&
2422 op_ret
= -ERR_MFA_REQUIRED
;
2426 if (!store
->svc
.zone
->is_meta_master()) {
2427 op_ret
= forward_request_to_master(s
, NULL
, store
, in_data
, nullptr);
2429 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
2434 bool modified
= mfa_set_status
;
2436 op_ret
= retry_raced_bucket_write(store
, s
, [&] {
2437 if (mfa_set_status
) {
2439 s
->bucket_info
.flags
|= BUCKET_MFA_ENABLED
;
2441 s
->bucket_info
.flags
&= ~BUCKET_MFA_ENABLED
;
2445 if (versioning_status
== VersioningEnabled
) {
2446 s
->bucket_info
.flags
|= BUCKET_VERSIONED
;
2447 s
->bucket_info
.flags
&= ~BUCKET_VERSIONS_SUSPENDED
;
2449 } else if (versioning_status
== VersioningSuspended
) {
2450 s
->bucket_info
.flags
|= (BUCKET_VERSIONED
| BUCKET_VERSIONS_SUSPENDED
);
2455 return store
->put_bucket_instance_info(s
->bucket_info
, false, real_time(),
2464 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
2465 << " returned err=" << op_ret
<< dendl
;
2470 int RGWGetBucketWebsite::verify_permission()
2472 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketWebsite
);
2475 void RGWGetBucketWebsite::pre_exec()
2477 rgw_bucket_object_pre_exec(s
);
2480 void RGWGetBucketWebsite::execute()
2482 if (!s
->bucket_info
.has_website
) {
2483 op_ret
= -ERR_NO_SUCH_WEBSITE_CONFIGURATION
;
2487 int RGWSetBucketWebsite::verify_permission()
2489 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketWebsite
);
2492 void RGWSetBucketWebsite::pre_exec()
2494 rgw_bucket_object_pre_exec(s
);
2497 void RGWSetBucketWebsite::execute()
2499 op_ret
= get_params();
2504 if (!store
->svc
.zone
->is_meta_master()) {
2505 op_ret
= forward_request_to_master(s
, NULL
, store
, in_data
, nullptr);
2507 ldpp_dout(this, 0) << " forward_request_to_master returned ret=" << op_ret
<< dendl
;
2512 op_ret
= retry_raced_bucket_write(store
, s
, [this] {
2513 s
->bucket_info
.has_website
= true;
2514 s
->bucket_info
.website_conf
= website_conf
;
2515 op_ret
= store
->put_bucket_instance_info(s
->bucket_info
, false,
2516 real_time(), &s
->bucket_attrs
);
2521 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
2522 << " returned err=" << op_ret
<< dendl
;
2527 int RGWDeleteBucketWebsite::verify_permission()
2529 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3DeleteBucketWebsite
);
2532 void RGWDeleteBucketWebsite::pre_exec()
2534 rgw_bucket_object_pre_exec(s
);
2537 void RGWDeleteBucketWebsite::execute()
2539 op_ret
= retry_raced_bucket_write(store
, s
, [this] {
2540 s
->bucket_info
.has_website
= false;
2541 s
->bucket_info
.website_conf
= RGWBucketWebsiteConf();
2542 op_ret
= store
->put_bucket_instance_info(s
->bucket_info
, false,
2543 real_time(), &s
->bucket_attrs
);
2547 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
2548 << " returned err=" << op_ret
<< dendl
;
2553 int RGWStatBucket::verify_permission()
2555 // This (a HEAD request on a bucket) is governed by the s3:ListBucket permission.
2556 if (!verify_bucket_permission(this, s
, rgw::IAM::s3ListBucket
)) {
2563 void RGWStatBucket::pre_exec()
2565 rgw_bucket_object_pre_exec(s
);
2568 void RGWStatBucket::execute()
2570 if (!s
->bucket_exists
) {
2571 op_ret
= -ERR_NO_SUCH_BUCKET
;
2575 RGWUserBuckets buckets
;
2576 bucket
.bucket
= s
->bucket
;
2577 buckets
.add(bucket
);
2578 map
<string
, RGWBucketEnt
>& m
= buckets
.get_buckets();
2579 op_ret
= store
->update_containers_stats(m
);
2584 map
<string
, RGWBucketEnt
>::iterator iter
= m
.find(bucket
.bucket
.name
);
2585 if (iter
!= m
.end()) {
2586 bucket
= iter
->second
;
2593 int RGWListBucket::verify_permission()
2595 op_ret
= get_params();
2599 if (!prefix
.empty())
2600 s
->env
.emplace("s3:prefix", prefix
);
2602 if (!delimiter
.empty())
2603 s
->env
.emplace("s3:delimiter", delimiter
);
2605 s
->env
.emplace("s3:max-keys", std::to_string(max
));
2607 if (!verify_bucket_permission(this,
2610 rgw::IAM::s3ListBucketVersions
:
2611 rgw::IAM::s3ListBucket
)) {
2618 int RGWListBucket::parse_max_keys()
2620 // Bound max value of max-keys to configured value for security
2621 // Bound min value of max-keys to '0'
2622 // Some S3 clients explicitly send max-keys=0 to detect if the bucket is
2623 // empty without listing any items.
2624 return parse_value_and_bound(max_keys
, max
, 0,
2625 g_conf().get_val
<uint64_t>("rgw_max_listing_results"),
2629 void RGWListBucket::pre_exec()
2631 rgw_bucket_object_pre_exec(s
);
2634 void RGWListBucket::execute()
2636 if (!s
->bucket_exists
) {
2637 op_ret
= -ERR_NO_SUCH_BUCKET
;
2641 if (allow_unordered
&& !delimiter
.empty()) {
2642 ldpp_dout(this, 0) <<
2643 "ERROR: unordered bucket listing requested with a delimiter" << dendl
;
2648 if (need_container_stats()) {
2649 map
<string
, RGWBucketEnt
> m
;
2650 m
[s
->bucket
.name
] = RGWBucketEnt();
2651 m
.begin()->second
.bucket
= s
->bucket
;
2652 op_ret
= store
->update_containers_stats(m
);
2654 bucket
= m
.begin()->second
;
2658 RGWRados::Bucket
target(store
, s
->bucket_info
);
2659 if (shard_id
>= 0) {
2660 target
.set_shard_id(shard_id
);
2662 RGWRados::Bucket::List
list_op(&target
);
2664 list_op
.params
.prefix
= prefix
;
2665 list_op
.params
.delim
= delimiter
;
2666 list_op
.params
.marker
= marker
;
2667 list_op
.params
.end_marker
= end_marker
;
2668 list_op
.params
.list_versions
= list_versions
;
2669 list_op
.params
.allow_unordered
= allow_unordered
;
2671 op_ret
= list_op
.list_objects(max
, &objs
, &common_prefixes
, &is_truncated
);
2673 next_marker
= list_op
.get_next_marker();
2677 int RGWGetBucketLogging::verify_permission()
2679 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketLogging
);
2682 int RGWGetBucketLocation::verify_permission()
2684 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketLocation
);
2687 int RGWCreateBucket::verify_permission()
2689 /* This check is mostly needed for S3 that doesn't support account ACL.
2690 * Swift doesn't allow to delegate any permission to an anonymous user,
2691 * so it will become an early exit in such case. */
2692 if (s
->auth
.identity
->is_anonymous()) {
2697 bucket
.name
= s
->bucket_name
;
2698 bucket
.tenant
= s
->bucket_tenant
;
2699 ARN arn
= ARN(bucket
);
2700 if (!verify_user_permission(this, s
, arn
, rgw::IAM::s3CreateBucket
)) {
2704 if (s
->user
->user_id
.tenant
!= s
->bucket_tenant
) {
2705 ldpp_dout(this, 10) << "user cannot create a bucket in a different tenant"
2706 << " (user_id.tenant=" << s
->user
->user_id
.tenant
2707 << " requested=" << s
->bucket_tenant
<< ")"
2711 if (s
->user
->max_buckets
< 0) {
2715 if (s
->user
->max_buckets
) {
2716 RGWUserBuckets buckets
;
2718 bool is_truncated
= false;
2719 op_ret
= rgw_read_user_buckets(store
, s
->user
->user_id
, buckets
,
2720 marker
, string(), s
->user
->max_buckets
,
2721 false, &is_truncated
);
2726 if ((int)buckets
.count() >= s
->user
->max_buckets
) {
2727 return -ERR_TOO_MANY_BUCKETS
;
2734 static int forward_request_to_master(struct req_state
*s
, obj_version
*objv
,
2735 RGWRados
*store
, bufferlist
& in_data
,
2736 JSONParser
*jp
, req_info
*forward_info
)
2738 if (!store
->svc
.zone
->get_master_conn()) {
2739 ldpp_dout(s
, 0) << "rest connection is invalid" << dendl
;
2742 ldpp_dout(s
, 0) << "sending request to master zonegroup" << dendl
;
2743 bufferlist response
;
2744 string uid_str
= s
->user
->user_id
.to_str();
2745 #define MAX_REST_RESPONSE (128 * 1024) // we expect a very small response
2746 int ret
= store
->svc
.zone
->get_master_conn()->forward(uid_str
, (forward_info
? *forward_info
: s
->info
),
2747 objv
, MAX_REST_RESPONSE
, &in_data
, &response
);
2751 ldpp_dout(s
, 20) << "response: " << response
.c_str() << dendl
;
2752 if (jp
&& !jp
->parse(response
.c_str(), response
.length())) {
2753 ldpp_dout(s
, 0) << "failed parsing response from master zonegroup" << dendl
;
2760 void RGWCreateBucket::pre_exec()
2762 rgw_bucket_object_pre_exec(s
);
2765 static void prepare_add_del_attrs(const map
<string
, bufferlist
>& orig_attrs
,
2766 map
<string
, bufferlist
>& out_attrs
,
2767 map
<string
, bufferlist
>& out_rmattrs
)
2769 for (const auto& kv
: orig_attrs
) {
2770 const string
& name
= kv
.first
;
2772 /* Check if the attr is user-defined metadata item. */
2773 if (name
.compare(0, sizeof(RGW_ATTR_META_PREFIX
) - 1,
2774 RGW_ATTR_META_PREFIX
) == 0) {
2775 /* For the objects all existing meta attrs have to be removed. */
2776 out_rmattrs
[name
] = kv
.second
;
2777 } else if (out_attrs
.find(name
) == std::end(out_attrs
)) {
2778 out_attrs
[name
] = kv
.second
;
2783 /* Fuse resource metadata basing on original attributes in @orig_attrs, set
2784 * of _custom_ attribute names to remove in @rmattr_names and attributes in
2785 * @out_attrs. Place results in @out_attrs.
2787 * NOTE: it's supposed that all special attrs already present in @out_attrs
2788 * will be preserved without any change. Special attributes are those which
2789 * names start with RGW_ATTR_META_PREFIX. They're complement to custom ones
2790 * used for X-Account-Meta-*, X-Container-Meta-*, X-Amz-Meta and so on. */
2791 static void prepare_add_del_attrs(const map
<string
, bufferlist
>& orig_attrs
,
2792 const set
<string
>& rmattr_names
,
2793 map
<string
, bufferlist
>& out_attrs
)
2795 for (const auto& kv
: orig_attrs
) {
2796 const string
& name
= kv
.first
;
2798 /* Check if the attr is user-defined metadata item. */
2799 if (name
.compare(0, strlen(RGW_ATTR_META_PREFIX
),
2800 RGW_ATTR_META_PREFIX
) == 0) {
2801 /* For the buckets all existing meta attrs are preserved,
2802 except those that are listed in rmattr_names. */
2803 if (rmattr_names
.find(name
) != std::end(rmattr_names
)) {
2804 const auto aiter
= out_attrs
.find(name
);
2806 if (aiter
!= std::end(out_attrs
)) {
2807 out_attrs
.erase(aiter
);
2810 /* emplace() won't alter the map if the key is already present.
2811 * This behaviour is fully intensional here. */
2812 out_attrs
.emplace(kv
);
2814 } else if (out_attrs
.find(name
) == std::end(out_attrs
)) {
2815 out_attrs
[name
] = kv
.second
;
2821 static void populate_with_generic_attrs(const req_state
* const s
,
2822 map
<string
, bufferlist
>& out_attrs
)
2824 for (const auto& kv
: s
->generic_attrs
) {
2825 bufferlist
& attrbl
= out_attrs
[kv
.first
];
2826 const string
& val
= kv
.second
;
2828 attrbl
.append(val
.c_str(), val
.size() + 1);
2833 static int filter_out_quota_info(std::map
<std::string
, bufferlist
>& add_attrs
,
2834 const std::set
<std::string
>& rmattr_names
,
2835 RGWQuotaInfo
& quota
,
2836 bool * quota_extracted
= nullptr)
2838 bool extracted
= false;
2840 /* Put new limit on max objects. */
2841 auto iter
= add_attrs
.find(RGW_ATTR_QUOTA_NOBJS
);
2843 if (std::end(add_attrs
) != iter
) {
2845 static_cast<int64_t>(strict_strtoll(iter
->second
.c_str(), 10, &err
));
2849 add_attrs
.erase(iter
);
2853 /* Put new limit on bucket (container) size. */
2854 iter
= add_attrs
.find(RGW_ATTR_QUOTA_MSIZE
);
2855 if (iter
!= add_attrs
.end()) {
2857 static_cast<int64_t>(strict_strtoll(iter
->second
.c_str(), 10, &err
));
2861 add_attrs
.erase(iter
);
2865 for (const auto& name
: rmattr_names
) {
2866 /* Remove limit on max objects. */
2867 if (name
.compare(RGW_ATTR_QUOTA_NOBJS
) == 0) {
2868 quota
.max_objects
= -1;
2872 /* Remove limit on max bucket size. */
2873 if (name
.compare(RGW_ATTR_QUOTA_MSIZE
) == 0) {
2874 quota
.max_size
= -1;
2879 /* Swift requries checking on raw usage instead of the 4 KiB rounded one. */
2880 quota
.check_on_raw
= true;
2881 quota
.enabled
= quota
.max_size
> 0 || quota
.max_objects
> 0;
2883 if (quota_extracted
) {
2884 *quota_extracted
= extracted
;
2891 static void filter_out_website(std::map
<std::string
, ceph::bufferlist
>& add_attrs
,
2892 const std::set
<std::string
>& rmattr_names
,
2893 RGWBucketWebsiteConf
& ws_conf
)
2897 /* Let's define a mapping between each custom attribute and the memory where
2898 * attribute's value should be stored. The memory location is expressed by
2899 * a non-const reference. */
2900 const auto mapping
= {
2901 std::make_pair(RGW_ATTR_WEB_INDEX
, std::ref(ws_conf
.index_doc_suffix
)),
2902 std::make_pair(RGW_ATTR_WEB_ERROR
, std::ref(ws_conf
.error_doc
)),
2903 std::make_pair(RGW_ATTR_WEB_LISTINGS
, std::ref(lstval
)),
2904 std::make_pair(RGW_ATTR_WEB_LIST_CSS
, std::ref(ws_conf
.listing_css_doc
)),
2905 std::make_pair(RGW_ATTR_SUBDIR_MARKER
, std::ref(ws_conf
.subdir_marker
))
2908 for (const auto& kv
: mapping
) {
2909 const char * const key
= kv
.first
;
2910 auto& target
= kv
.second
;
2912 auto iter
= add_attrs
.find(key
);
2914 if (std::end(add_attrs
) != iter
) {
2915 /* The "target" is a reference to ws_conf. */
2916 target
= iter
->second
.c_str();
2917 add_attrs
.erase(iter
);
2920 if (rmattr_names
.count(key
)) {
2921 target
= std::string();
2925 if (! lstval
.empty()) {
2926 ws_conf
.listing_enabled
= boost::algorithm::iequals(lstval
, "true");
2931 void RGWCreateBucket::execute()
2933 RGWAccessControlPolicy
old_policy(s
->cct
);
2935 buffer::list corsbl
;
2938 rgw_make_bucket_entry_name(s
->bucket_tenant
, s
->bucket_name
, bucket_name
);
2939 rgw_raw_obj
obj(store
->svc
.zone
->get_zone_params().domain_root
, bucket_name
);
2940 obj_version objv
, *pobjv
= NULL
;
2942 op_ret
= get_params();
2946 if (!relaxed_region_enforcement
&&
2947 !location_constraint
.empty() &&
2948 !store
->svc
.zone
->has_zonegroup_api(location_constraint
)) {
2949 ldpp_dout(this, 0) << "location constraint (" << location_constraint
<< ")"
2950 << " can't be found." << dendl
;
2951 op_ret
= -ERR_INVALID_LOCATION_CONSTRAINT
;
2952 s
->err
.message
= "The specified location-constraint is not valid";
2956 if (!relaxed_region_enforcement
&& !store
->svc
.zone
->get_zonegroup().is_master_zonegroup() && !location_constraint
.empty() &&
2957 store
->svc
.zone
->get_zonegroup().api_name
!= location_constraint
) {
2958 ldpp_dout(this, 0) << "location constraint (" << location_constraint
<< ")"
2959 << " doesn't match zonegroup" << " (" << store
->svc
.zone
->get_zonegroup().api_name
<< ")"
2961 op_ret
= -ERR_INVALID_LOCATION_CONSTRAINT
;
2962 s
->err
.message
= "The specified location-constraint is not valid";
2966 const auto& zonegroup
= store
->svc
.zone
->get_zonegroup();
2967 if (!placement_rule
.name
.empty() &&
2968 !zonegroup
.placement_targets
.count(placement_rule
.name
)) {
2969 ldpp_dout(this, 0) << "placement target (" << placement_rule
.name
<< ")"
2970 << " doesn't exist in the placement targets of zonegroup"
2971 << " (" << store
->svc
.zone
->get_zonegroup().api_name
<< ")" << dendl
;
2972 op_ret
= -ERR_INVALID_LOCATION_CONSTRAINT
;
2973 s
->err
.message
= "The specified placement target does not exist";
2977 /* we need to make sure we read bucket info, it's not read before for this
2978 * specific request */
2979 op_ret
= store
->get_bucket_info(*s
->sysobj_ctx
, s
->bucket_tenant
, s
->bucket_name
,
2980 s
->bucket_info
, nullptr, &s
->bucket_attrs
);
2981 if (op_ret
< 0 && op_ret
!= -ENOENT
)
2983 s
->bucket_exists
= (op_ret
!= -ENOENT
);
2985 s
->bucket_owner
.set_id(s
->user
->user_id
);
2986 s
->bucket_owner
.set_name(s
->user
->display_name
);
2987 if (s
->bucket_exists
) {
2988 int r
= rgw_op_get_bucket_policy_from_attr(s
->cct
, store
, s
->bucket_info
,
2989 s
->bucket_attrs
, &old_policy
);
2991 if (old_policy
.get_owner().get_id().compare(s
->user
->user_id
) != 0) {
2998 RGWBucketInfo master_info
;
2999 rgw_bucket
*pmaster_bucket
;
3000 uint32_t *pmaster_num_shards
;
3001 real_time creation_time
;
3003 if (!store
->svc
.zone
->is_meta_master()) {
3005 op_ret
= forward_request_to_master(s
, NULL
, store
, in_data
, &jp
);
3010 JSONDecoder::decode_json("entry_point_object_ver", ep_objv
, &jp
);
3011 JSONDecoder::decode_json("object_ver", objv
, &jp
);
3012 JSONDecoder::decode_json("bucket_info", master_info
, &jp
);
3013 ldpp_dout(this, 20) << "parsed: objv.tag=" << objv
.tag
<< " objv.ver=" << objv
.ver
<< dendl
;
3014 ldpp_dout(this, 20) << "got creation time: << " << master_info
.creation_time
<< dendl
;
3015 pmaster_bucket
= &master_info
.bucket
;
3016 creation_time
= master_info
.creation_time
;
3017 pmaster_num_shards
= &master_info
.num_shards
;
3020 pmaster_bucket
= NULL
;
3021 pmaster_num_shards
= NULL
;
3024 string zonegroup_id
;
3026 if (s
->system_request
) {
3027 zonegroup_id
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"zonegroup");
3028 if (zonegroup_id
.empty()) {
3029 zonegroup_id
= store
->svc
.zone
->get_zonegroup().get_id();
3032 zonegroup_id
= store
->svc
.zone
->get_zonegroup().get_id();
3035 if (s
->bucket_exists
) {
3036 rgw_placement_rule selected_placement_rule
;
3038 bucket
.tenant
= s
->bucket_tenant
;
3039 bucket
.name
= s
->bucket_name
;
3040 op_ret
= store
->svc
.zone
->select_bucket_placement(*(s
->user
), zonegroup_id
,
3042 &selected_placement_rule
, nullptr);
3043 if (selected_placement_rule
!= s
->bucket_info
.placement_rule
) {
3049 /* Encode special metadata first as we're using std::map::emplace under
3050 * the hood. This method will add the new items only if the map doesn't
3051 * contain such keys yet. */
3052 policy
.encode(aclbl
);
3053 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
3056 cors_config
.encode(corsbl
);
3057 emplace_attr(RGW_ATTR_CORS
, std::move(corsbl
));
3060 RGWQuotaInfo quota_info
;
3061 const RGWQuotaInfo
* pquota_info
= nullptr;
3062 if (need_metadata_upload()) {
3063 /* It's supposed that following functions WILL NOT change any special
3064 * attributes (like RGW_ATTR_ACL) if they are already present in attrs. */
3065 op_ret
= rgw_get_request_metadata(s
->cct
, s
->info
, attrs
, false);
3069 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
3070 populate_with_generic_attrs(s
, attrs
);
3072 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, quota_info
);
3076 pquota_info
= "a_info
;
3079 /* Web site of Swift API. */
3080 filter_out_website(attrs
, rmattr_names
, s
->bucket_info
.website_conf
);
3081 s
->bucket_info
.has_website
= !s
->bucket_info
.website_conf
.is_empty();
3084 s
->bucket
.tenant
= s
->bucket_tenant
; /* ignored if bucket exists */
3085 s
->bucket
.name
= s
->bucket_name
;
3087 /* Handle updates of the metadata for Swift's object versioning. */
3088 if (swift_ver_location
) {
3089 s
->bucket_info
.swift_ver_location
= *swift_ver_location
;
3090 s
->bucket_info
.swift_versioning
= (! swift_ver_location
->empty());
3093 op_ret
= store
->create_bucket(*(s
->user
), s
->bucket
, zonegroup_id
,
3094 placement_rule
, s
->bucket_info
.swift_ver_location
,
3096 info
, pobjv
, &ep_objv
, creation_time
,
3097 pmaster_bucket
, pmaster_num_shards
, true);
3098 /* continue if EEXIST and create_bucket will fail below. this way we can
3099 * recover from a partial create by retrying it. */
3100 ldpp_dout(this, 20) << "rgw_create_bucket returned ret=" << op_ret
<< " bucket=" << s
->bucket
<< dendl
;
3102 if (op_ret
&& op_ret
!= -EEXIST
)
3105 existed
= (op_ret
== -EEXIST
);
3108 /* bucket already existed, might have raced with another bucket creation, or
3109 * might be partial bucket creation that never completed. Read existing bucket
3110 * info, verify that the reported bucket owner is the current user.
3111 * If all is ok then update the user's list of buckets.
3112 * Otherwise inform client about a name conflict.
3114 if (info
.owner
.compare(s
->user
->user_id
) != 0) {
3118 s
->bucket
= info
.bucket
;
3121 op_ret
= rgw_link_bucket(store
, s
->user
->user_id
, s
->bucket
,
3122 info
.creation_time
, false);
3123 if (op_ret
&& !existed
&& op_ret
!= -EEXIST
) {
3124 /* if it exists (or previously existed), don't remove it! */
3125 op_ret
= rgw_unlink_bucket(store
, s
->user
->user_id
, s
->bucket
.tenant
,
3128 ldpp_dout(this, 0) << "WARNING: failed to unlink bucket: ret=" << op_ret
3131 } else if (op_ret
== -EEXIST
|| (op_ret
== 0 && existed
)) {
3132 op_ret
= -ERR_BUCKET_EXISTS
;
3135 if (need_metadata_upload() && existed
) {
3136 /* OK, it looks we lost race with another request. As it's required to
3137 * handle metadata fusion and upload, the whole operation becomes very
3138 * similar in nature to PutMetadataBucket. However, as the attrs may
3139 * changed in the meantime, we have to refresh. */
3142 RGWBucketInfo binfo
;
3143 map
<string
, bufferlist
> battrs
;
3145 op_ret
= store
->get_bucket_info(*s
->sysobj_ctx
, s
->bucket_tenant
, s
->bucket_name
,
3146 binfo
, nullptr, &battrs
);
3149 } else if (binfo
.owner
.compare(s
->user
->user_id
) != 0) {
3150 /* New bucket doesn't belong to the account we're operating on. */
3154 s
->bucket_info
= binfo
;
3155 s
->bucket_attrs
= battrs
;
3160 op_ret
= rgw_get_request_metadata(s
->cct
, s
->info
, attrs
, false);
3164 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
3165 populate_with_generic_attrs(s
, attrs
);
3166 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, s
->bucket_info
.quota
);
3171 /* Handle updates of the metadata for Swift's object versioning. */
3172 if (swift_ver_location
) {
3173 s
->bucket_info
.swift_ver_location
= *swift_ver_location
;
3174 s
->bucket_info
.swift_versioning
= (! swift_ver_location
->empty());
3177 /* Web site of Swift API. */
3178 filter_out_website(attrs
, rmattr_names
, s
->bucket_info
.website_conf
);
3179 s
->bucket_info
.has_website
= !s
->bucket_info
.website_conf
.is_empty();
3181 /* This will also set the quota on the bucket. */
3182 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
,
3183 &s
->bucket_info
.objv_tracker
);
3184 } while (op_ret
== -ECANCELED
&& tries
++ < 20);
3186 /* Restore the proper return code. */
3188 op_ret
= -ERR_BUCKET_EXISTS
;
3193 int RGWDeleteBucket::verify_permission()
3195 if (!verify_bucket_permission(this, s
, rgw::IAM::s3DeleteBucket
)) {
3202 void RGWDeleteBucket::pre_exec()
3204 rgw_bucket_object_pre_exec(s
);
3207 void RGWDeleteBucket::execute()
3209 if (s
->bucket_name
.empty()) {
3214 if (!s
->bucket_exists
) {
3215 ldpp_dout(this, 0) << "ERROR: bucket " << s
->bucket_name
<< " not found" << dendl
;
3216 op_ret
= -ERR_NO_SUCH_BUCKET
;
3219 RGWObjVersionTracker ot
;
3220 ot
.read_version
= s
->bucket_info
.ep_objv
;
3222 if (s
->system_request
) {
3223 string tag
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"tag");
3224 string ver_str
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"ver");
3226 ot
.read_version
.tag
= tag
;
3229 ver
= strict_strtol(ver_str
.c_str(), 10, &err
);
3231 ldpp_dout(this, 0) << "failed to parse ver param" << dendl
;
3235 ot
.read_version
.ver
= ver
;
3239 op_ret
= rgw_bucket_sync_user_stats(store
, s
->user
->user_id
, s
->bucket_info
);
3241 ldpp_dout(this, 1) << "WARNING: failed to sync user stats before bucket delete: op_ret= " << op_ret
<< dendl
;
3244 op_ret
= store
->check_bucket_empty(s
->bucket_info
);
3249 if (!store
->svc
.zone
->is_meta_master()) {
3251 op_ret
= forward_request_to_master(s
, &ot
.read_version
, store
, in_data
,
3254 if (op_ret
== -ENOENT
) {
3255 /* adjust error, we want to return with NoSuchBucket and not
3257 op_ret
= -ERR_NO_SUCH_BUCKET
;
3263 string prefix
, delimiter
;
3265 if (s
->prot_flags
& RGW_REST_SWIFT
) {
3267 path_args
= s
->info
.args
.get("path");
3268 if (!path_args
.empty()) {
3269 if (!delimiter
.empty() || !prefix
.empty()) {
3278 op_ret
= abort_bucket_multiparts(store
, s
->cct
, s
->bucket_info
, prefix
, delimiter
);
3284 op_ret
= store
->delete_bucket(s
->bucket_info
, ot
, false);
3286 if (op_ret
== -ECANCELED
) {
3287 // lost a race, either with mdlog sync or another delete bucket operation.
3288 // in either case, we've already called rgw_unlink_bucket()
3294 op_ret
= rgw_unlink_bucket(store
, s
->bucket_info
.owner
, s
->bucket
.tenant
,
3295 s
->bucket
.name
, false);
3297 ldpp_dout(this, 0) << "WARNING: failed to unlink bucket: ret=" << op_ret
3303 int RGWPutObj::verify_permission()
3305 if (! copy_source
.empty()) {
3307 RGWAccessControlPolicy
cs_acl(s
->cct
);
3308 boost::optional
<Policy
> policy
;
3309 map
<string
, bufferlist
> cs_attrs
;
3310 rgw_bucket
cs_bucket(copy_source_bucket_info
.bucket
);
3311 rgw_obj_key
cs_object(copy_source_object_name
, copy_source_version_id
);
3313 rgw_obj
obj(cs_bucket
, cs_object
);
3314 store
->set_atomic(s
->obj_ctx
, obj
);
3315 store
->set_prefetch_data(s
->obj_ctx
, obj
);
3317 /* check source object permissions */
3318 if (read_obj_policy(store
, s
, copy_source_bucket_info
, cs_attrs
, &cs_acl
, nullptr,
3319 policy
, cs_bucket
, cs_object
) < 0) {
3323 /* admin request overrides permission checks */
3324 if (! s
->auth
.identity
->is_admin_of(cs_acl
.get_owner().get_id())) {
3325 if (policy
|| ! s
->iam_user_policies
.empty()) {
3326 auto usr_policy_res
= Effect::Pass
;
3327 for (auto& user_policy
: s
->iam_user_policies
) {
3328 if (usr_policy_res
= user_policy
.eval(s
->env
, *s
->auth
.identity
,
3329 cs_object
.instance
.empty() ?
3330 rgw::IAM::s3GetObject
:
3331 rgw::IAM::s3GetObjectVersion
,
3332 rgw::IAM::ARN(obj
)); usr_policy_res
== Effect::Deny
)
3334 else if (usr_policy_res
== Effect::Allow
)
3337 rgw::IAM::Effect e
= Effect::Pass
;
3339 e
= policy
->eval(s
->env
, *s
->auth
.identity
,
3340 cs_object
.instance
.empty() ?
3341 rgw::IAM::s3GetObject
:
3342 rgw::IAM::s3GetObjectVersion
,
3343 rgw::IAM::ARN(obj
));
3345 if (e
== Effect::Deny
) {
3347 } else if (usr_policy_res
== Effect::Pass
&& e
== Effect::Pass
&&
3348 !cs_acl
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
3352 } else if (!cs_acl
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
3359 auto op_ret
= get_params();
3361 ldpp_dout(this, 20) << "get_params() returned ret=" << op_ret
<< dendl
;
3365 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty()) {
3366 rgw_add_grant_to_iam_environment(s
->env
, s
);
3368 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-acl", s
->canned_acl
);
3370 if (obj_tags
!= nullptr && obj_tags
->count() > 0){
3371 auto tags
= obj_tags
->get_tags();
3372 for (const auto& kv
: tags
){
3373 rgw_add_to_iam_environment(s
->env
, "s3:RequestObjectTag/"+kv
.first
, kv
.second
);
3377 constexpr auto encrypt_attr
= "x-amz-server-side-encryption";
3378 constexpr auto s3_encrypt_attr
= "s3:x-amz-server-side-encryption";
3379 auto enc_header
= s
->info
.x_meta_map
.find(encrypt_attr
);
3380 if (enc_header
!= s
->info
.x_meta_map
.end()){
3381 rgw_add_to_iam_environment(s
->env
, s3_encrypt_attr
, enc_header
->second
);
3384 constexpr auto kms_attr
= "x-amz-server-side-encryption-aws-kms-key-id";
3385 constexpr auto s3_kms_attr
= "s3:x-amz-server-side-encryption-aws-kms-key-id";
3386 auto kms_header
= s
->info
.x_meta_map
.find(kms_attr
);
3387 if (kms_header
!= s
->info
.x_meta_map
.end()){
3388 rgw_add_to_iam_environment(s
->env
, s3_kms_attr
, kms_header
->second
);
3391 auto usr_policy_res
= eval_user_policies(s
->iam_user_policies
, s
->env
,
3393 rgw::IAM::s3PutObject
,
3394 rgw_obj(s
->bucket
, s
->object
));
3395 if (usr_policy_res
== Effect::Deny
)
3398 rgw::IAM::Effect e
= Effect::Pass
;
3399 if (s
->iam_policy
) {
3400 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
3401 rgw::IAM::s3PutObject
,
3402 rgw_obj(s
->bucket
, s
->object
));
3404 if (e
== Effect::Allow
) {
3406 } else if (e
== Effect::Deny
) {
3408 } else if (usr_policy_res
== Effect::Allow
) {
3413 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
3421 void RGWPutObj::pre_exec()
3423 rgw_bucket_object_pre_exec(s
);
3426 class RGWPutObj_CB
: public RGWGetObj_Filter
3430 explicit RGWPutObj_CB(RGWPutObj
*_op
) : op(_op
) {}
3431 ~RGWPutObj_CB() override
{}
3433 int handle_data(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
) override
{
3434 return op
->get_data_cb(bl
, bl_ofs
, bl_len
);
3438 int RGWPutObj::get_data_cb(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
)
3441 bl
.copy(bl_ofs
, bl_len
, bl_tmp
);
3443 bl_aux
.append(bl_tmp
);
3448 int RGWPutObj::get_data(const off_t fst
, const off_t lst
, bufferlist
& bl
)
3450 RGWPutObj_CB
cb(this);
3451 RGWGetObj_Filter
* filter
= &cb
;
3452 boost::optional
<RGWGetObj_Decompress
> decompress
;
3453 std::unique_ptr
<RGWGetObj_Filter
> decrypt
;
3454 RGWCompressionInfo cs_info
;
3455 map
<string
, bufferlist
> attrs
;
3456 map
<string
, bufferlist
>::iterator attr_iter
;
3460 int64_t new_ofs
, new_end
;
3465 rgw_obj_key
obj_key(copy_source_object_name
, copy_source_version_id
);
3466 rgw_obj
obj(copy_source_bucket_info
.bucket
, obj_key
);
3468 RGWRados::Object
op_target(store
, copy_source_bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
3469 RGWRados::Object::Read
read_op(&op_target
);
3470 read_op
.params
.obj_size
= &obj_size
;
3471 read_op
.params
.attrs
= &attrs
;
3473 ret
= read_op
.prepare();
3477 bool need_decompress
;
3478 op_ret
= rgw_compression_info_from_attrset(attrs
, need_decompress
, cs_info
);
3480 ldpp_dout(s
, 0) << "ERROR: failed to decode compression info" << dendl
;
3484 bool partial_content
= true;
3485 if (need_decompress
)
3487 obj_size
= cs_info
.orig_size
;
3488 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
3489 filter
= &*decompress
;
3492 attr_iter
= attrs
.find(RGW_ATTR_MANIFEST
);
3493 op_ret
= this->get_decrypt_filter(&decrypt
,
3496 attr_iter
!= attrs
.end() ? &(attr_iter
->second
) : nullptr);
3497 if (decrypt
!= nullptr) {
3498 filter
= decrypt
.get();
3504 ret
= read_op
.range_to_ofs(obj_size
, new_ofs
, new_end
);
3508 filter
->fixup_range(new_ofs
, new_end
);
3509 ret
= read_op
.iterate(new_ofs
, new_end
, filter
);
3512 ret
= filter
->flush();
3514 bl
.claim_append(bl_aux
);
3519 // special handling for compression type = "random" with multipart uploads
3520 static CompressorRef
get_compressor_plugin(const req_state
*s
,
3521 const std::string
& compression_type
)
3523 if (compression_type
!= "random") {
3524 return Compressor::create(s
->cct
, compression_type
);
3527 bool is_multipart
{false};
3528 const auto& upload_id
= s
->info
.args
.get("uploadId", &is_multipart
);
3530 if (!is_multipart
) {
3531 return Compressor::create(s
->cct
, compression_type
);
3534 // use a hash of the multipart upload id so all parts use the same plugin
3535 const auto alg
= std::hash
<std::string
>{}(upload_id
) % Compressor::COMP_ALG_LAST
;
3536 if (alg
== Compressor::COMP_ALG_NONE
) {
3539 return Compressor::create(s
->cct
, alg
);
3542 void RGWPutObj::execute()
3544 char supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1];
3545 char supplied_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
3546 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
3547 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
3549 bufferlist bl
, aclbl
, bs
;
3555 bool need_calc_md5
= (dlo_manifest
== NULL
) && (slo_info
== NULL
);
3556 perfcounter
->inc(l_rgw_put
);
3557 // report latency on return
3558 auto put_lat
= make_scope_guard([&] {
3559 perfcounter
->tinc(l_rgw_put_lat
, s
->time_elapsed());
3563 if (s
->object
.empty()) {
3567 if (!s
->bucket_exists
) {
3568 op_ret
= -ERR_NO_SUCH_BUCKET
;
3573 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
3575 ldpp_dout(this, 20) << "get_system_versioning_params() returned ret="
3580 if (supplied_md5_b64
) {
3581 need_calc_md5
= true;
3583 ldpp_dout(this, 15) << "supplied_md5_b64=" << supplied_md5_b64
<< dendl
;
3584 op_ret
= ceph_unarmor(supplied_md5_bin
, &supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1],
3585 supplied_md5_b64
, supplied_md5_b64
+ strlen(supplied_md5_b64
));
3586 ldpp_dout(this, 15) << "ceph_armor ret=" << op_ret
<< dendl
;
3587 if (op_ret
!= CEPH_CRYPTO_MD5_DIGESTSIZE
) {
3588 op_ret
= -ERR_INVALID_DIGEST
;
3592 buf_to_hex((const unsigned char *)supplied_md5_bin
, CEPH_CRYPTO_MD5_DIGESTSIZE
, supplied_md5
);
3593 ldpp_dout(this, 15) << "supplied_md5=" << supplied_md5
<< dendl
;
3596 if (!chunked_upload
) { /* with chunked upload we don't know how big is the upload.
3597 we also check sizes at the end anyway */
3598 op_ret
= store
->check_quota(s
->bucket_owner
.get_id(), s
->bucket
,
3599 user_quota
, bucket_quota
, s
->content_length
);
3601 ldpp_dout(this, 20) << "check_quota() returned ret=" << op_ret
<< dendl
;
3604 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
3606 ldpp_dout(this, 20) << "check_bucket_shards() returned ret=" << op_ret
<< dendl
;
3611 if (supplied_etag
) {
3612 strncpy(supplied_md5
, supplied_etag
, sizeof(supplied_md5
) - 1);
3613 supplied_md5
[sizeof(supplied_md5
) - 1] = '\0';
3616 const bool multipart
= !multipart_upload_id
.empty();
3617 auto& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
3618 rgw_obj obj
{s
->bucket
, s
->object
};
3620 /* Handle object versioning of Swift API. */
3622 op_ret
= store
->swift_versioning_copy(obj_ctx
,
3623 s
->bucket_owner
.get_id(),
3631 // create the object processor
3632 rgw::AioThrottle
aio(store
->ctx()->_conf
->rgw_put_obj_min_window_size
);
3633 using namespace rgw::putobj
;
3634 constexpr auto max_processor_size
= std::max({sizeof(MultipartObjectProcessor
),
3635 sizeof(AtomicObjectProcessor
),
3636 sizeof(AppendObjectProcessor
)});
3637 ceph::static_ptr
<ObjectProcessor
, max_processor_size
> processor
;
3639 rgw_placement_rule
*pdest_placement
;
3642 RGWMPObj
mp(s
->object
.name
, multipart_upload_id
);
3644 multipart_upload_info upload_info
;
3645 op_ret
= get_multipart_info(store
, s
, mp
.get_meta(), nullptr, nullptr, &upload_info
);
3647 if (op_ret
!= -ENOENT
) {
3648 ldpp_dout(this, 0) << "ERROR: get_multipart_info returned " << op_ret
<< ": " << cpp_strerror(-op_ret
) << dendl
;
3649 } else {// -ENOENT: raced with upload complete/cancel, no need to spam log
3650 ldpp_dout(this, 20) << "failed to get multipart info (returned " << op_ret
<< ": " << cpp_strerror(-op_ret
) << "): probably raced with upload complete / cancel" << dendl
;
3654 pdest_placement
= &upload_info
.dest_placement
;
3655 ldpp_dout(this, 20) << "dest_placement for part=" << upload_info
.dest_placement
<< dendl
;
3656 processor
.emplace
<MultipartObjectProcessor
>(
3657 &aio
, store
, s
->bucket_info
, pdest_placement
,
3658 s
->owner
.get_id(), obj_ctx
, obj
,
3659 multipart_upload_id
, multipart_part_num
, multipart_part_str
);
3661 if (s
->bucket_info
.versioned()) {
3662 op_ret
= -ERR_INVALID_BUCKET_STATE
;
3665 pdest_placement
= &s
->dest_placement
;
3666 processor
.emplace
<AppendObjectProcessor
>(
3667 &aio
, store
, s
->bucket_info
, pdest_placement
, s
->bucket_owner
.get_id(),obj_ctx
, obj
,
3668 s
->req_id
, position
, &cur_accounted_size
);
3670 if (s
->bucket_info
.versioning_enabled()) {
3671 if (!version_id
.empty()) {
3672 obj
.key
.set_instance(version_id
);
3674 store
->gen_rand_obj_instance_name(&obj
);
3675 version_id
= obj
.key
.instance
;
3678 pdest_placement
= &s
->dest_placement
;
3679 processor
.emplace
<AtomicObjectProcessor
>(
3680 &aio
, store
, s
->bucket_info
, pdest_placement
,
3681 s
->bucket_owner
.get_id(), obj_ctx
, obj
, olh_epoch
, s
->req_id
);
3684 op_ret
= processor
->prepare();
3686 ldpp_dout(this, 20) << "processor->prepare() returned ret=" << op_ret
3691 if ((! copy_source
.empty()) && !copy_source_range
) {
3692 rgw_obj_key
obj_key(copy_source_object_name
, copy_source_version_id
);
3693 rgw_obj
obj(copy_source_bucket_info
.bucket
, obj_key
.name
);
3695 RGWObjState
*astate
;
3696 op_ret
= store
->get_obj_state(&obj_ctx
, copy_source_bucket_info
, obj
,
3697 &astate
, true, false);
3699 ldpp_dout(this, 0) << "ERROR: get copy source obj state returned with error" << op_ret
<< dendl
;
3702 if (!astate
->exists
){
3706 lst
= astate
->accounted_size
- 1;
3708 lst
= copy_source_range_lst
;
3711 fst
= copy_source_range_fst
;
3713 // no filters by default
3714 DataProcessor
*filter
= processor
.get();
3716 const auto& compression_type
= store
->svc
.zone
->get_zone_params().get_compression_type(*pdest_placement
);
3717 CompressorRef plugin
;
3718 boost::optional
<RGWPutObj_Compress
> compressor
;
3720 std::unique_ptr
<DataProcessor
> encrypt
;
3721 op_ret
= get_encrypt_filter(&encrypt
, filter
);
3725 if (encrypt
!= nullptr) {
3727 } else if (compression_type
!= "none") {
3728 plugin
= get_compressor_plugin(s
, compression_type
);
3730 ldpp_dout(this, 1) << "Cannot load plugin for compression type "
3731 << compression_type
<< dendl
;
3733 compressor
.emplace(s
->cct
, plugin
, filter
);
3734 filter
= &*compressor
;
3737 tracepoint(rgw_op
, before_data_transfer
, s
->req_id
.c_str());
3742 if (copy_source
.empty()) {
3743 len
= get_data(data
);
3745 uint64_t cur_lst
= min(fst
+ s
->cct
->_conf
->rgw_max_chunk_size
- 1, lst
);
3746 op_ret
= get_data(fst
, cur_lst
, data
);
3749 len
= data
.length();
3750 s
->content_length
+= len
;
3755 ldpp_dout(this, 20) << "get_data() returned ret=" << op_ret
<< dendl
;
3757 } else if (len
== 0) {
3761 if (need_calc_md5
) {
3762 hash
.Update((const unsigned char *)data
.c_str(), data
.length());
3765 /* update torrrent */
3766 torrent
.update(data
);
3768 op_ret
= filter
->process(std::move(data
), ofs
);
3770 ldpp_dout(this, 20) << "processor->process() returned ret="
3777 tracepoint(rgw_op
, after_data_transfer
, s
->req_id
.c_str(), ofs
);
3779 // flush any data in filters
3780 op_ret
= filter
->process({}, ofs
);
3785 if (!chunked_upload
&& ofs
!= s
->content_length
) {
3786 op_ret
= -ERR_REQUEST_TIMEOUT
;
3791 perfcounter
->inc(l_rgw_put_b
, s
->obj_size
);
3793 op_ret
= do_aws4_auth_completion();
3798 op_ret
= store
->check_quota(s
->bucket_owner
.get_id(), s
->bucket
,
3799 user_quota
, bucket_quota
, s
->obj_size
);
3801 ldpp_dout(this, 20) << "second check_quota() returned op_ret=" << op_ret
<< dendl
;
3805 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
3807 ldpp_dout(this, 20) << "check_bucket_shards() returned ret=" << op_ret
<< dendl
;
3813 if (compressor
&& compressor
->is_compressed()) {
3815 RGWCompressionInfo cs_info
;
3816 cs_info
.compression_type
= plugin
->get_type_name();
3817 cs_info
.orig_size
= s
->obj_size
;
3818 cs_info
.blocks
= move(compressor
->get_compression_blocks());
3819 encode(cs_info
, tmp
);
3820 attrs
[RGW_ATTR_COMPRESSION
] = tmp
;
3821 ldpp_dout(this, 20) << "storing " << RGW_ATTR_COMPRESSION
3822 << " with type=" << cs_info
.compression_type
3823 << ", orig_size=" << cs_info
.orig_size
3824 << ", blocks=" << cs_info
.blocks
.size() << dendl
;
3827 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
3831 if (supplied_md5_b64
&& strcmp(calc_md5
, supplied_md5
)) {
3832 op_ret
= -ERR_BAD_DIGEST
;
3836 policy
.encode(aclbl
);
3837 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
3840 op_ret
= encode_dlo_manifest_attr(dlo_manifest
, attrs
);
3842 ldpp_dout(this, 0) << "bad user manifest: " << dlo_manifest
<< dendl
;
3848 bufferlist manifest_bl
;
3849 encode(*slo_info
, manifest_bl
);
3850 emplace_attr(RGW_ATTR_SLO_MANIFEST
, std::move(manifest_bl
));
3853 if (supplied_etag
&& etag
.compare(supplied_etag
) != 0) {
3854 op_ret
= -ERR_UNPROCESSABLE_ENTITY
;
3857 bl
.append(etag
.c_str(), etag
.size());
3858 emplace_attr(RGW_ATTR_ETAG
, std::move(bl
));
3860 populate_with_generic_attrs(s
, attrs
);
3861 op_ret
= rgw_get_request_metadata(s
->cct
, s
->info
, attrs
);
3865 encode_delete_at_attr(delete_at
, attrs
);
3866 encode_obj_tags_attr(obj_tags
.get(), attrs
);
3868 /* Add a custom metadata to expose the information whether an object
3869 * is an SLO or not. Appending the attribute must be performed AFTER
3870 * processing any input from user in order to prohibit overwriting. */
3872 bufferlist slo_userindicator_bl
;
3873 slo_userindicator_bl
.append("True", 4);
3874 emplace_attr(RGW_ATTR_SLO_UINDICATOR
, std::move(slo_userindicator_bl
));
3877 tracepoint(rgw_op
, processor_complete_enter
, s
->req_id
.c_str());
3878 op_ret
= processor
->complete(s
->obj_size
, etag
, &mtime
, real_time(), attrs
,
3879 (delete_at
? *delete_at
: real_time()), if_match
, if_nomatch
,
3880 (user_data
.empty() ? nullptr : &user_data
), nullptr, nullptr);
3881 tracepoint(rgw_op
, processor_complete_exit
, s
->req_id
.c_str());
3883 /* produce torrent */
3884 if (s
->cct
->_conf
->rgw_torrent_flag
&& (ofs
== torrent
.get_data_len()))
3886 torrent
.init(s
, store
);
3887 torrent
.set_create_date(mtime
);
3888 op_ret
= torrent
.complete();
3891 ldpp_dout(this, 0) << "ERROR: torrent.handle_data() returned " << op_ret
<< dendl
;
3897 int RGWPostObj::verify_permission()
3902 void RGWPostObj::pre_exec()
3904 rgw_bucket_object_pre_exec(s
);
3907 void RGWPostObj::execute()
3909 boost::optional
<RGWPutObj_Compress
> compressor
;
3910 CompressorRef plugin
;
3911 char supplied_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
3913 /* Read in the data from the POST form. */
3914 op_ret
= get_params();
3919 op_ret
= verify_params();
3924 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty()) {
3925 auto usr_policy_res
= eval_user_policies(s
->iam_user_policies
, s
->env
,
3927 rgw::IAM::s3PutObject
,
3928 rgw_obj(s
->bucket
, s
->object
));
3929 if (usr_policy_res
== Effect::Deny
) {
3934 rgw::IAM::Effect e
= Effect::Pass
;
3935 if (s
->iam_policy
) {
3936 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
3937 rgw::IAM::s3PutObject
,
3938 rgw_obj(s
->bucket
, s
->object
));
3940 if (e
== Effect::Deny
) {
3943 } else if (usr_policy_res
== Effect::Pass
&& e
== Effect::Pass
&& !verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
3947 } else if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
3952 /* Start iteration over data fields. It's necessary as Swift's FormPost
3953 * is capable to handle multiple files in single form. */
3955 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
3956 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
3958 ceph::buffer::list bl
, aclbl
;
3961 op_ret
= store
->check_quota(s
->bucket_owner
.get_id(),
3970 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
3975 if (supplied_md5_b64
) {
3976 char supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1];
3977 ldpp_dout(this, 15) << "supplied_md5_b64=" << supplied_md5_b64
<< dendl
;
3978 op_ret
= ceph_unarmor(supplied_md5_bin
, &supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1],
3979 supplied_md5_b64
, supplied_md5_b64
+ strlen(supplied_md5_b64
));
3980 ldpp_dout(this, 15) << "ceph_armor ret=" << op_ret
<< dendl
;
3981 if (op_ret
!= CEPH_CRYPTO_MD5_DIGESTSIZE
) {
3982 op_ret
= -ERR_INVALID_DIGEST
;
3986 buf_to_hex((const unsigned char *)supplied_md5_bin
, CEPH_CRYPTO_MD5_DIGESTSIZE
, supplied_md5
);
3987 ldpp_dout(this, 15) << "supplied_md5=" << supplied_md5
<< dendl
;
3990 rgw_obj
obj(s
->bucket
, get_current_filename());
3991 if (s
->bucket_info
.versioning_enabled()) {
3992 store
->gen_rand_obj_instance_name(&obj
);
3995 rgw::AioThrottle
aio(s
->cct
->_conf
->rgw_put_obj_min_window_size
);
3997 using namespace rgw::putobj
;
3998 AtomicObjectProcessor
processor(&aio
, store
, s
->bucket_info
,
4000 s
->bucket_owner
.get_id(),
4001 *static_cast<RGWObjectCtx
*>(s
->obj_ctx
),
4003 op_ret
= processor
.prepare();
4008 /* No filters by default. */
4009 DataProcessor
*filter
= &processor
;
4011 std::unique_ptr
<DataProcessor
> encrypt
;
4012 op_ret
= get_encrypt_filter(&encrypt
, filter
);
4016 if (encrypt
!= nullptr) {
4017 filter
= encrypt
.get();
4019 const auto& compression_type
= store
->svc
.zone
->get_zone_params().get_compression_type(
4021 if (compression_type
!= "none") {
4022 plugin
= Compressor::create(s
->cct
, compression_type
);
4024 ldpp_dout(this, 1) << "Cannot load plugin for compression type "
4025 << compression_type
<< dendl
;
4027 compressor
.emplace(s
->cct
, plugin
, filter
);
4028 filter
= &*compressor
;
4035 ceph::bufferlist data
;
4036 len
= get_data(data
, again
);
4047 hash
.Update((const unsigned char *)data
.c_str(), data
.length());
4048 op_ret
= filter
->process(std::move(data
), ofs
);
4052 if (ofs
> max_len
) {
4053 op_ret
= -ERR_TOO_LARGE
;
4059 op_ret
= filter
->process({}, ofs
);
4064 if (len
< min_len
) {
4065 op_ret
= -ERR_TOO_SMALL
;
4072 op_ret
= store
->check_quota(s
->bucket_owner
.get_id(), s
->bucket
,
4073 user_quota
, bucket_quota
, s
->obj_size
);
4078 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
4084 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
4088 if (supplied_md5_b64
&& strcmp(calc_md5
, supplied_md5
)) {
4089 op_ret
= -ERR_BAD_DIGEST
;
4093 bl
.append(etag
.c_str(), etag
.size());
4094 emplace_attr(RGW_ATTR_ETAG
, std::move(bl
));
4096 policy
.encode(aclbl
);
4097 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
4099 const std::string content_type
= get_current_content_type();
4100 if (! content_type
.empty()) {
4101 ceph::bufferlist ct_bl
;
4102 ct_bl
.append(content_type
.c_str(), content_type
.size() + 1);
4103 emplace_attr(RGW_ATTR_CONTENT_TYPE
, std::move(ct_bl
));
4106 if (compressor
&& compressor
->is_compressed()) {
4107 ceph::bufferlist tmp
;
4108 RGWCompressionInfo cs_info
;
4109 cs_info
.compression_type
= plugin
->get_type_name();
4110 cs_info
.orig_size
= s
->obj_size
;
4111 cs_info
.blocks
= move(compressor
->get_compression_blocks());
4112 encode(cs_info
, tmp
);
4113 emplace_attr(RGW_ATTR_COMPRESSION
, std::move(tmp
));
4116 op_ret
= processor
.complete(s
->obj_size
, etag
, nullptr, real_time(), attrs
,
4117 (delete_at
? *delete_at
: real_time()),
4118 nullptr, nullptr, nullptr, nullptr, nullptr);
4122 } while (is_next_file_to_upload());
4126 void RGWPutMetadataAccount::filter_out_temp_url(map
<string
, bufferlist
>& add_attrs
,
4127 const set
<string
>& rmattr_names
,
4128 map
<int, string
>& temp_url_keys
)
4130 map
<string
, bufferlist
>::iterator iter
;
4132 iter
= add_attrs
.find(RGW_ATTR_TEMPURL_KEY1
);
4133 if (iter
!= add_attrs
.end()) {
4134 temp_url_keys
[0] = iter
->second
.c_str();
4135 add_attrs
.erase(iter
);
4138 iter
= add_attrs
.find(RGW_ATTR_TEMPURL_KEY2
);
4139 if (iter
!= add_attrs
.end()) {
4140 temp_url_keys
[1] = iter
->second
.c_str();
4141 add_attrs
.erase(iter
);
4144 for (const string
& name
: rmattr_names
) {
4145 if (name
.compare(RGW_ATTR_TEMPURL_KEY1
) == 0) {
4146 temp_url_keys
[0] = string();
4148 if (name
.compare(RGW_ATTR_TEMPURL_KEY2
) == 0) {
4149 temp_url_keys
[1] = string();
4154 int RGWPutMetadataAccount::init_processing()
4156 /* First, go to the base class. At the time of writing the method was
4157 * responsible only for initializing the quota. This isn't necessary
4158 * here as we are touching metadata only. I'm putting this call only
4159 * for the future. */
4160 op_ret
= RGWOp::init_processing();
4165 op_ret
= get_params();
4170 op_ret
= rgw_get_user_attrs_by_uid(store
, s
->user
->user_id
, orig_attrs
,
4178 policy
.encode(acl_bl
);
4179 attrs
.emplace(RGW_ATTR_ACL
, std::move(acl_bl
));
4182 op_ret
= rgw_get_request_metadata(s
->cct
, s
->info
, attrs
, false);
4186 prepare_add_del_attrs(orig_attrs
, rmattr_names
, attrs
);
4187 populate_with_generic_attrs(s
, attrs
);
4189 /* Try extract the TempURL-related stuff now to allow verify_permission
4190 * evaluate whether we need FULL_CONTROL or not. */
4191 filter_out_temp_url(attrs
, rmattr_names
, temp_url_keys
);
4193 /* The same with quota except a client needs to be reseller admin. */
4194 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, new_quota
,
4195 &new_quota_extracted
);
4203 int RGWPutMetadataAccount::verify_permission()
4205 if (s
->auth
.identity
->is_anonymous()) {
4209 if (!verify_user_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4213 /* Altering TempURL keys requires FULL_CONTROL. */
4214 if (!temp_url_keys
.empty() && s
->perm_mask
!= RGW_PERM_FULL_CONTROL
) {
4218 /* We are failing this intensionally to allow system user/reseller admin
4219 * override in rgw_process.cc. This is the way to specify a given RGWOp
4220 * expect extra privileges. */
4221 if (new_quota_extracted
) {
4228 void RGWPutMetadataAccount::execute()
4230 /* Params have been extracted earlier. See init_processing(). */
4231 RGWUserInfo new_uinfo
;
4232 op_ret
= rgw_get_user_info_by_uid(store
, s
->user
->user_id
, new_uinfo
,
4238 /* Handle the TempURL-related stuff. */
4239 if (!temp_url_keys
.empty()) {
4240 for (auto& pair
: temp_url_keys
) {
4241 new_uinfo
.temp_url_keys
[pair
.first
] = std::move(pair
.second
);
4245 /* Handle the quota extracted at the verify_permission step. */
4246 if (new_quota_extracted
) {
4247 new_uinfo
.user_quota
= std::move(new_quota
);
4250 /* We are passing here the current (old) user info to allow the function
4251 * optimize-out some operations. */
4252 op_ret
= rgw_store_user_info(store
, new_uinfo
, s
->user
,
4253 &acct_op_tracker
, real_time(), false, &attrs
);
4256 int RGWPutMetadataBucket::verify_permission()
4258 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4265 void RGWPutMetadataBucket::pre_exec()
4267 rgw_bucket_object_pre_exec(s
);
4270 void RGWPutMetadataBucket::execute()
4272 op_ret
= get_params();
4277 op_ret
= rgw_get_request_metadata(s
->cct
, s
->info
, attrs
, false);
4282 if (!placement_rule
.empty() &&
4283 placement_rule
!= s
->bucket_info
.placement_rule
) {
4288 op_ret
= retry_raced_bucket_write(store
, s
, [this] {
4289 /* Encode special metadata first as we're using std::map::emplace under
4290 * the hood. This method will add the new items only if the map doesn't
4291 * contain such keys yet. */
4293 if (s
->dialect
.compare("swift") == 0) {
4295 static_cast<RGWAccessControlPolicy_SWIFT
*>(s
->bucket_acl
.get());
4296 auto new_policy
= static_cast<RGWAccessControlPolicy_SWIFT
*>(&policy
);
4297 new_policy
->filter_merge(policy_rw_mask
, old_policy
);
4298 policy
= *new_policy
;
4302 emplace_attr(RGW_ATTR_ACL
, std::move(bl
));
4307 cors_config
.encode(bl
);
4308 emplace_attr(RGW_ATTR_CORS
, std::move(bl
));
4311 /* It's supposed that following functions WILL NOT change any
4312 * special attributes (like RGW_ATTR_ACL) if they are already
4313 * present in attrs. */
4314 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
4315 populate_with_generic_attrs(s
, attrs
);
4317 /* According to the Swift's behaviour and its container_quota
4318 * WSGI middleware implementation: anyone with write permissions
4319 * is able to set the bucket quota. This stays in contrast to
4320 * account quotas that can be set only by clients holding
4321 * reseller admin privileges. */
4322 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, s
->bucket_info
.quota
);
4327 if (swift_ver_location
) {
4328 s
->bucket_info
.swift_ver_location
= *swift_ver_location
;
4329 s
->bucket_info
.swift_versioning
= (!swift_ver_location
->empty());
4332 /* Web site of Swift API. */
4333 filter_out_website(attrs
, rmattr_names
, s
->bucket_info
.website_conf
);
4334 s
->bucket_info
.has_website
= !s
->bucket_info
.website_conf
.is_empty();
4336 /* Setting attributes also stores the provided bucket info. Due
4337 * to this fact, the new quota settings can be serialized with
4339 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
,
4340 &s
->bucket_info
.objv_tracker
);
4345 int RGWPutMetadataObject::verify_permission()
4347 // This looks to be something specific to Swift. We could add
4348 // operations like swift:PutMetadataObject to the Policy Engine.
4349 if (!verify_object_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4356 void RGWPutMetadataObject::pre_exec()
4358 rgw_bucket_object_pre_exec(s
);
4361 void RGWPutMetadataObject::execute()
4363 rgw_obj
obj(s
->bucket
, s
->object
);
4364 map
<string
, bufferlist
> attrs
, orig_attrs
, rmattrs
;
4366 store
->set_atomic(s
->obj_ctx
, obj
);
4368 op_ret
= get_params();
4373 op_ret
= rgw_get_request_metadata(s
->cct
, s
->info
, attrs
);
4378 /* check if obj exists, read orig attrs */
4379 op_ret
= get_obj_attrs(store
, s
, obj
, orig_attrs
);
4384 /* Check whether the object has expired. Swift API documentation
4385 * stands that we should return 404 Not Found in such case. */
4386 if (need_object_expiration() && object_is_expired(orig_attrs
)) {
4391 /* Filter currently existing attributes. */
4392 prepare_add_del_attrs(orig_attrs
, attrs
, rmattrs
);
4393 populate_with_generic_attrs(s
, attrs
);
4394 encode_delete_at_attr(delete_at
, attrs
);
4397 op_ret
= encode_dlo_manifest_attr(dlo_manifest
, attrs
);
4399 ldpp_dout(this, 0) << "bad user manifest: " << dlo_manifest
<< dendl
;
4404 op_ret
= store
->set_attrs(s
->obj_ctx
, s
->bucket_info
, obj
, attrs
, &rmattrs
);
4407 int RGWDeleteObj::handle_slo_manifest(bufferlist
& bl
)
4409 RGWSLOInfo slo_info
;
4410 auto bliter
= bl
.cbegin();
4412 decode(slo_info
, bliter
);
4413 } catch (buffer::error
& err
) {
4414 ldpp_dout(this, 0) << "ERROR: failed to decode slo manifest" << dendl
;
4419 deleter
= std::unique_ptr
<RGWBulkDelete::Deleter
>(\
4420 new RGWBulkDelete::Deleter(this, store
, s
));
4421 } catch (const std::bad_alloc
&) {
4425 list
<RGWBulkDelete::acct_path_t
> items
;
4426 for (const auto& iter
: slo_info
.entries
) {
4427 const string
& path_str
= iter
.path
;
4429 const size_t sep_pos
= path_str
.find('/', 1 /* skip first slash */);
4430 if (boost::string_view::npos
== sep_pos
) {
4434 RGWBulkDelete::acct_path_t path
;
4436 path
.bucket_name
= url_decode(path_str
.substr(1, sep_pos
- 1));
4437 path
.obj_key
= url_decode(path_str
.substr(sep_pos
+ 1));
4439 items
.push_back(path
);
4442 /* Request removal of the manifest object itself. */
4443 RGWBulkDelete::acct_path_t path
;
4444 path
.bucket_name
= s
->bucket_name
;
4445 path
.obj_key
= s
->object
;
4446 items
.push_back(path
);
4448 int ret
= deleter
->delete_chunk(items
);
4456 int RGWDeleteObj::verify_permission()
4458 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty()) {
4459 auto usr_policy_res
= eval_user_policies(s
->iam_user_policies
, s
->env
,
4461 s
->object
.instance
.empty() ?
4462 rgw::IAM::s3DeleteObject
:
4463 rgw::IAM::s3DeleteObjectVersion
,
4464 ARN(s
->bucket
, s
->object
.name
));
4465 if (usr_policy_res
== Effect::Deny
) {
4469 rgw::IAM::Effect r
= Effect::Pass
;
4470 if (s
->iam_policy
) {
4471 r
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
4472 s
->object
.instance
.empty() ?
4473 rgw::IAM::s3DeleteObject
:
4474 rgw::IAM::s3DeleteObjectVersion
,
4475 ARN(s
->bucket
, s
->object
.name
));
4477 if (r
== Effect::Allow
)
4479 else if (r
== Effect::Deny
)
4481 else if (usr_policy_res
== Effect::Allow
)
4485 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4489 if (s
->bucket_info
.mfa_enabled() &&
4490 !s
->object
.instance
.empty() &&
4492 ldpp_dout(this, 5) << "NOTICE: object delete request with a versioned object, mfa auth not provided" << dendl
;
4493 return -ERR_MFA_REQUIRED
;
4499 void RGWDeleteObj::pre_exec()
4501 rgw_bucket_object_pre_exec(s
);
4504 void RGWDeleteObj::execute()
4506 if (!s
->bucket_exists
) {
4507 op_ret
= -ERR_NO_SUCH_BUCKET
;
4511 op_ret
= get_params();
4516 rgw_obj
obj(s
->bucket
, s
->object
);
4517 map
<string
, bufferlist
> attrs
;
4520 if (!s
->object
.empty()) {
4521 if (need_object_expiration() || multipart_delete
) {
4522 /* check if obj exists, read orig attrs */
4523 op_ret
= get_obj_attrs(store
, s
, obj
, attrs
);
4529 if (multipart_delete
) {
4530 const auto slo_attr
= attrs
.find(RGW_ATTR_SLO_MANIFEST
);
4532 if (slo_attr
!= attrs
.end()) {
4533 op_ret
= handle_slo_manifest(slo_attr
->second
);
4535 ldpp_dout(this, 0) << "ERROR: failed to handle slo manifest ret=" << op_ret
<< dendl
;
4538 op_ret
= -ERR_NOT_SLO_MANIFEST
;
4544 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
4545 obj_ctx
->set_atomic(obj
);
4547 bool ver_restored
= false;
4548 op_ret
= store
->swift_versioning_restore(*s
->sysobj_ctx
, *obj_ctx
, s
->bucket_owner
.get_id(),
4549 s
->bucket_info
, obj
, ver_restored
);
4554 if (!ver_restored
) {
4555 /* Swift's versioning mechanism hasn't found any previous version of
4556 * the object that could be restored. This means we should proceed
4557 * with the regular delete path. */
4558 RGWRados::Object
del_target(store
, s
->bucket_info
, *obj_ctx
, obj
);
4559 RGWRados::Object::Delete
del_op(&del_target
);
4561 op_ret
= get_system_versioning_params(s
, &del_op
.params
.olh_epoch
,
4562 &del_op
.params
.marker_version_id
);
4567 del_op
.params
.bucket_owner
= s
->bucket_owner
.get_id();
4568 del_op
.params
.versioning_status
= s
->bucket_info
.versioning_status();
4569 del_op
.params
.obj_owner
= s
->owner
;
4570 del_op
.params
.unmod_since
= unmod_since
;
4571 del_op
.params
.high_precision_time
= s
->system_request
; /* system request uses high precision time */
4573 op_ret
= del_op
.delete_obj();
4575 delete_marker
= del_op
.result
.delete_marker
;
4576 version_id
= del_op
.result
.version_id
;
4579 /* Check whether the object has expired. Swift API documentation
4580 * stands that we should return 404 Not Found in such case. */
4581 if (need_object_expiration() && object_is_expired(attrs
)) {
4587 if (op_ret
== -ECANCELED
) {
4590 if (op_ret
== -ERR_PRECONDITION_FAILED
&& no_precondition_error
) {
4598 bool RGWCopyObj::parse_copy_location(const boost::string_view
& url_src
,
4599 string
& bucket_name
,
4602 boost::string_view name_str
;
4603 boost::string_view params_str
;
4605 size_t pos
= url_src
.find('?');
4606 if (pos
== string::npos
) {
4609 name_str
= url_src
.substr(0, pos
);
4610 params_str
= url_src
.substr(pos
+ 1);
4613 boost::string_view dec_src
{name_str
};
4614 if (dec_src
[0] == '/')
4615 dec_src
.remove_prefix(1);
4617 pos
= dec_src
.find('/');
4618 if (pos
==string::npos
)
4621 boost::string_view bn_view
{dec_src
.substr(0, pos
)};
4622 bucket_name
= std::string
{bn_view
.data(), bn_view
.size()};
4624 boost::string_view kn_view
{dec_src
.substr(pos
+ 1)};
4625 key
.name
= std::string
{kn_view
.data(), kn_view
.size()};
4627 if (key
.name
.empty()) {
4631 if (! params_str
.empty()) {
4633 args
.set(params_str
.to_string());
4636 key
.instance
= args
.get("versionId", NULL
);
4642 int RGWCopyObj::verify_permission()
4644 RGWAccessControlPolicy
src_acl(s
->cct
);
4645 boost::optional
<Policy
> src_policy
;
4646 op_ret
= get_params();
4650 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
4654 map
<string
, bufferlist
> src_attrs
;
4656 if (s
->bucket_instance_id
.empty()) {
4657 op_ret
= store
->get_bucket_info(*s
->sysobj_ctx
, src_tenant_name
, src_bucket_name
, src_bucket_info
, NULL
, &src_attrs
);
4659 /* will only happen in intra region sync where the source and dest bucket is the same */
4660 op_ret
= store
->get_bucket_instance_info(*s
->sysobj_ctx
, s
->bucket_instance_id
, src_bucket_info
, NULL
, &src_attrs
);
4663 if (op_ret
== -ENOENT
) {
4664 op_ret
= -ERR_NO_SUCH_BUCKET
;
4669 src_bucket
= src_bucket_info
.bucket
;
4671 /* get buckets info (source and dest) */
4672 if (s
->local_source
&& source_zone
.empty()) {
4673 rgw_obj
src_obj(src_bucket
, src_object
);
4674 store
->set_atomic(s
->obj_ctx
, src_obj
);
4675 store
->set_prefetch_data(s
->obj_ctx
, src_obj
);
4677 rgw_placement_rule src_placement
;
4679 /* check source object permissions */
4680 op_ret
= read_obj_policy(store
, s
, src_bucket_info
, src_attrs
, &src_acl
, &src_placement
.storage_class
,
4681 src_policy
, src_bucket
, src_object
);
4686 /* follow up on previous checks that required reading source object head */
4687 if (need_to_check_storage_class
) {
4688 src_placement
.inherit_from(src_bucket_info
.placement_rule
);
4690 op_ret
= check_storage_class(src_placement
);
4696 /* admin request overrides permission checks */
4697 if (!s
->auth
.identity
->is_admin_of(src_acl
.get_owner().get_id())) {
4699 auto e
= src_policy
->eval(s
->env
, *s
->auth
.identity
,
4700 src_object
.instance
.empty() ?
4701 rgw::IAM::s3GetObject
:
4702 rgw::IAM::s3GetObjectVersion
,
4704 if (e
== Effect::Deny
) {
4706 } else if (e
== Effect::Pass
&&
4707 !src_acl
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
4711 } else if (!src_acl
.verify_permission(this, *s
->auth
.identity
,
4719 RGWAccessControlPolicy
dest_bucket_policy(s
->cct
);
4720 map
<string
, bufferlist
> dest_attrs
;
4722 if (src_bucket_name
.compare(dest_bucket_name
) == 0) { /* will only happen if s->local_source
4723 or intra region sync */
4724 dest_bucket_info
= src_bucket_info
;
4725 dest_attrs
= src_attrs
;
4727 op_ret
= store
->get_bucket_info(*s
->sysobj_ctx
, dest_tenant_name
, dest_bucket_name
,
4728 dest_bucket_info
, nullptr, &dest_attrs
);
4730 if (op_ret
== -ENOENT
) {
4731 op_ret
= -ERR_NO_SUCH_BUCKET
;
4737 dest_bucket
= dest_bucket_info
.bucket
;
4739 rgw_obj
dest_obj(dest_bucket
, dest_object
);
4740 store
->set_atomic(s
->obj_ctx
, dest_obj
);
4742 /* check dest bucket permissions */
4743 op_ret
= read_bucket_policy(store
, s
, dest_bucket_info
, dest_attrs
,
4744 &dest_bucket_policy
, dest_bucket
);
4748 auto dest_iam_policy
= get_iam_policy_from_attr(s
->cct
, store
, dest_attrs
, dest_bucket
.tenant
);
4749 /* admin request overrides permission checks */
4750 if (! s
->auth
.identity
->is_admin_of(dest_policy
.get_owner().get_id())){
4751 if (dest_iam_policy
!= boost::none
) {
4752 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-copy-source", copy_source
);
4753 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-metadata-directive", md_directive
);
4755 auto e
= dest_iam_policy
->eval(s
->env
, *s
->auth
.identity
,
4756 rgw::IAM::s3PutObject
,
4758 if (e
== Effect::Deny
) {
4760 } else if (e
== Effect::Pass
&&
4761 ! dest_bucket_policy
.verify_permission(this,
4768 } else if (! dest_bucket_policy
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
4773 op_ret
= init_dest_policy();
4782 int RGWCopyObj::init_common()
4785 if (parse_time(if_mod
, &mod_time
) < 0) {
4789 mod_ptr
= &mod_time
;
4793 if (parse_time(if_unmod
, &unmod_time
) < 0) {
4797 unmod_ptr
= &unmod_time
;
4801 dest_policy
.encode(aclbl
);
4802 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
4804 op_ret
= rgw_get_request_metadata(s
->cct
, s
->info
, attrs
);
4808 populate_with_generic_attrs(s
, attrs
);
4813 static void copy_obj_progress_cb(off_t ofs
, void *param
)
4815 RGWCopyObj
*op
= static_cast<RGWCopyObj
*>(param
);
4816 op
->progress_cb(ofs
);
4819 void RGWCopyObj::progress_cb(off_t ofs
)
4821 if (!s
->cct
->_conf
->rgw_copy_obj_progress
)
4824 if (ofs
- last_ofs
< s
->cct
->_conf
->rgw_copy_obj_progress_every_bytes
)
4827 send_partial_response(ofs
);
4832 void RGWCopyObj::pre_exec()
4834 rgw_bucket_object_pre_exec(s
);
4837 void RGWCopyObj::execute()
4839 if (init_common() < 0)
4842 rgw_obj
src_obj(src_bucket
, src_object
);
4843 rgw_obj
dst_obj(dest_bucket
, dest_object
);
4845 RGWObjectCtx
& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
4846 if ( ! version_id
.empty()) {
4847 dst_obj
.key
.set_instance(version_id
);
4848 } else if (dest_bucket_info
.versioning_enabled()) {
4849 store
->gen_rand_obj_instance_name(&dst_obj
);
4852 obj_ctx
.set_atomic(src_obj
);
4853 obj_ctx
.set_atomic(dst_obj
);
4855 encode_delete_at_attr(delete_at
, attrs
);
4857 bool high_precision_time
= (s
->system_request
);
4859 /* Handle object versioning of Swift API. In case of copying to remote this
4860 * should fail gently (op_ret == 0) as the dst_obj will not exist here. */
4861 op_ret
= store
->swift_versioning_copy(obj_ctx
,
4862 dest_bucket_info
.owner
,
4869 op_ret
= store
->copy_obj(obj_ctx
,
4882 high_precision_time
,
4887 attrs
, RGWObjCategory::Main
,
4889 (delete_at
? *delete_at
: real_time()),
4890 (version_id
.empty() ? NULL
: &version_id
),
4891 &s
->req_id
, /* use req_id as tag */
4893 copy_obj_progress_cb
, (void *)this
4897 int RGWGetACLs::verify_permission()
4900 if (!s
->object
.empty()) {
4901 auto iam_action
= s
->object
.instance
.empty() ?
4902 rgw::IAM::s3GetObjectAcl
:
4903 rgw::IAM::s3GetObjectVersionAcl
;
4905 if (s
->iam_policy
&& s
->iam_policy
->has_partial_conditional(S3_EXISTING_OBJTAG
)){
4906 rgw_obj obj
= rgw_obj(s
->bucket
, s
->object
);
4907 rgw_iam_add_existing_objtags(store
, s
, obj
, iam_action
);
4909 if (! s
->iam_user_policies
.empty()) {
4910 for (auto& user_policy
: s
->iam_user_policies
) {
4911 if (user_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
)) {
4912 rgw_obj obj
= rgw_obj(s
->bucket
, s
->object
);
4913 rgw_iam_add_existing_objtags(store
, s
, obj
, iam_action
);
4917 perm
= verify_object_permission(this, s
, iam_action
);
4919 if (!s
->bucket_exists
) {
4920 return -ERR_NO_SUCH_BUCKET
;
4922 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketAcl
);
4930 void RGWGetACLs::pre_exec()
4932 rgw_bucket_object_pre_exec(s
);
4935 void RGWGetACLs::execute()
4938 RGWAccessControlPolicy
* const acl
= \
4939 (!s
->object
.empty() ? s
->object_acl
.get() : s
->bucket_acl
.get());
4940 RGWAccessControlPolicy_S3
* const s3policy
= \
4941 static_cast<RGWAccessControlPolicy_S3
*>(acl
);
4942 s3policy
->to_xml(ss
);
4948 int RGWPutACLs::verify_permission()
4952 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-acl", s
->canned_acl
);
4954 rgw_add_grant_to_iam_environment(s
->env
, s
);
4955 if (!s
->object
.empty()) {
4956 auto iam_action
= s
->object
.instance
.empty() ? rgw::IAM::s3PutObjectAcl
: rgw::IAM::s3PutObjectVersionAcl
;
4957 auto obj
= rgw_obj(s
->bucket
, s
->object
);
4958 op_ret
= rgw_iam_add_existing_objtags(store
, s
, obj
, iam_action
);
4959 perm
= verify_object_permission(this, s
, iam_action
);
4961 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketAcl
);
4969 int RGWGetLC::verify_permission()
4972 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3GetLifecycleConfiguration
);
4979 int RGWPutLC::verify_permission()
4982 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3PutLifecycleConfiguration
);
4989 int RGWDeleteLC::verify_permission()
4992 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3PutLifecycleConfiguration
);
4999 void RGWPutACLs::pre_exec()
5001 rgw_bucket_object_pre_exec(s
);
5004 void RGWGetLC::pre_exec()
5006 rgw_bucket_object_pre_exec(s
);
5009 void RGWPutLC::pre_exec()
5011 rgw_bucket_object_pre_exec(s
);
5014 void RGWDeleteLC::pre_exec()
5016 rgw_bucket_object_pre_exec(s
);
5019 void RGWPutACLs::execute()
5023 RGWAccessControlPolicy_S3
*policy
= NULL
;
5024 RGWACLXMLParser_S3
parser(s
->cct
);
5025 RGWAccessControlPolicy_S3
new_policy(s
->cct
);
5029 op_ret
= 0; /* XXX redundant? */
5031 if (!parser
.init()) {
5037 RGWAccessControlPolicy
* const existing_policy
= \
5038 (s
->object
.empty() ? s
->bucket_acl
.get() : s
->object_acl
.get());
5040 owner
= existing_policy
->get_owner();
5042 op_ret
= get_params();
5044 if (op_ret
== -ERANGE
) {
5045 ldpp_dout(this, 4) << "The size of request xml data is larger than the max limitation, data size = "
5046 << s
->length
<< dendl
;
5047 op_ret
= -ERR_MALFORMED_XML
;
5048 s
->err
.message
= "The XML you provided was larger than the maximum " +
5049 std::to_string(s
->cct
->_conf
->rgw_max_put_param_size
) +
5055 char* buf
= data
.c_str();
5056 ldpp_dout(this, 15) << "read len=" << data
.length() << " data=" << (buf
? buf
: "") << dendl
;
5058 if (!s
->canned_acl
.empty() && data
.length() > 0) {
5063 if (!s
->canned_acl
.empty() || s
->has_acl_header
) {
5064 op_ret
= get_policy_from_state(store
, s
, ss
);
5069 data
.append(ss
.str());
5072 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
5076 policy
= static_cast<RGWAccessControlPolicy_S3
*>(parser
.find_first("AccessControlPolicy"));
5082 const RGWAccessControlList
& req_acl
= policy
->get_acl();
5083 const multimap
<string
, ACLGrant
>& req_grant_map
= req_acl
.get_grant_map();
5084 #define ACL_GRANTS_MAX_NUM 100
5085 int max_num
= s
->cct
->_conf
->rgw_acl_grants_max_num
;
5087 max_num
= ACL_GRANTS_MAX_NUM
;
5090 int grants_num
= req_grant_map
.size();
5091 if (grants_num
> max_num
) {
5092 ldpp_dout(this, 4) << "An acl can have up to " << max_num
5093 << " grants, request acl grants num: " << grants_num
<< dendl
;
5094 op_ret
= -ERR_MALFORMED_ACL_ERROR
;
5095 s
->err
.message
= "The request is rejected, because the acl grants number you requested is larger than the maximum "
5096 + std::to_string(max_num
)
5097 + " grants allowed in an acl.";
5101 // forward bucket acl requests to meta master zone
5102 if (s
->object
.empty() && !store
->svc
.zone
->is_meta_master()) {
5104 // include acl data unless it was generated from a canned_acl
5105 if (s
->canned_acl
.empty()) {
5106 in_data
.append(data
);
5108 op_ret
= forward_request_to_master(s
, NULL
, store
, in_data
, NULL
);
5110 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5115 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
5116 ldpp_dout(this, 15) << "Old AccessControlPolicy";
5117 policy
->to_xml(*_dout
);
5121 op_ret
= policy
->rebuild(store
, &owner
, new_policy
);
5125 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
5126 ldpp_dout(this, 15) << "New AccessControlPolicy:";
5127 new_policy
.to_xml(*_dout
);
5131 new_policy
.encode(bl
);
5132 map
<string
, bufferlist
> attrs
;
5134 if (!s
->object
.empty()) {
5135 obj
= rgw_obj(s
->bucket
, s
->object
);
5136 store
->set_atomic(s
->obj_ctx
, obj
);
5137 //if instance is empty, we should modify the latest object
5138 op_ret
= modify_obj_attr(store
, s
, obj
, RGW_ATTR_ACL
, bl
);
5140 attrs
= s
->bucket_attrs
;
5141 attrs
[RGW_ATTR_ACL
] = bl
;
5142 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
, &s
->bucket_info
.objv_tracker
);
5144 if (op_ret
== -ECANCELED
) {
5145 op_ret
= 0; /* lost a race, but it's ok because acls are immutable */
5149 void RGWPutLC::execute()
5153 RGWLifecycleConfiguration_S3
config(s
->cct
);
5154 RGWXMLParser parser
;
5155 RGWLifecycleConfiguration_S3
new_config(s
->cct
);
5157 content_md5
= s
->info
.env
->get("HTTP_CONTENT_MD5");
5158 if (content_md5
== nullptr) {
5159 op_ret
= -ERR_INVALID_REQUEST
;
5160 s
->err
.message
= "Missing required header for this request: Content-MD5";
5161 ldpp_dout(this, 5) << s
->err
.message
<< dendl
;
5165 std::string content_md5_bin
;
5167 content_md5_bin
= rgw::from_base64(boost::string_view(content_md5
));
5169 s
->err
.message
= "Request header Content-MD5 contains character "
5170 "that is not base64 encoded.";
5171 ldpp_dout(this, 5) << s
->err
.message
<< dendl
;
5172 op_ret
= -ERR_BAD_DIGEST
;
5176 if (!parser
.init()) {
5181 op_ret
= get_params();
5185 char* buf
= data
.c_str();
5186 ldpp_dout(this, 15) << "read len=" << data
.length() << " data=" << (buf
? buf
: "") << dendl
;
5189 unsigned char data_hash_res
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
5190 data_hash
.Update(reinterpret_cast<const unsigned char*>(buf
), data
.length());
5191 data_hash
.Final(data_hash_res
);
5193 if (memcmp(data_hash_res
, content_md5_bin
.c_str(), CEPH_CRYPTO_MD5_DIGESTSIZE
) != 0) {
5194 op_ret
= -ERR_BAD_DIGEST
;
5195 s
->err
.message
= "The Content-MD5 you specified did not match what we received.";
5196 ldpp_dout(this, 5) << s
->err
.message
5197 << " Specified content md5: " << content_md5
5198 << ", calculated content md5: " << data_hash_res
5203 if (!parser
.parse(buf
, data
.length(), 1)) {
5204 op_ret
= -ERR_MALFORMED_XML
;
5209 RGWXMLDecoder::decode_xml("LifecycleConfiguration", config
, &parser
);
5210 } catch (RGWXMLDecoder::err
& err
) {
5211 ldpp_dout(this, 5) << "Bad lifecycle configuration: " << err
<< dendl
;
5212 op_ret
= -ERR_MALFORMED_XML
;
5216 op_ret
= config
.rebuild(store
, new_config
);
5220 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
5222 new_config
.dump_xml(&xf
);
5225 ldpp_dout(this, 15) << "New LifecycleConfiguration:" << ss
.str() << dendl
;
5228 op_ret
= store
->get_lc()->set_bucket_config(s
->bucket_info
, s
->bucket_attrs
, &new_config
);
5235 void RGWDeleteLC::execute()
5237 map
<string
, bufferlist
> attrs
= s
->bucket_attrs
;
5238 attrs
.erase(RGW_ATTR_LC
);
5239 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
,
5240 &s
->bucket_info
.objv_tracker
);
5242 ldpp_dout(this, 0) << "RGWLC::RGWDeleteLC() failed to set attrs on bucket="
5243 << s
->bucket
.name
<< " returned err=" << op_ret
<< dendl
;
5247 op_ret
= store
->get_lc()->remove_bucket_config(s
->bucket_info
, s
->bucket_attrs
);
5254 int RGWGetCORS::verify_permission()
5256 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketCORS
);
5259 void RGWGetCORS::execute()
5261 op_ret
= read_bucket_cors();
5266 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
5267 op_ret
= -ERR_NO_CORS_FOUND
;
5272 int RGWPutCORS::verify_permission()
5274 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketCORS
);
5277 void RGWPutCORS::execute()
5281 op_ret
= get_params();
5285 if (!store
->svc
.zone
->is_meta_master()) {
5286 op_ret
= forward_request_to_master(s
, NULL
, store
, in_data
, nullptr);
5288 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5293 op_ret
= retry_raced_bucket_write(store
, s
, [this] {
5294 map
<string
, bufferlist
> attrs
= s
->bucket_attrs
;
5295 attrs
[RGW_ATTR_CORS
] = cors_bl
;
5296 return rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
, &s
->bucket_info
.objv_tracker
);
5300 int RGWDeleteCORS::verify_permission()
5302 // No separate delete permission
5303 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketCORS
);
5306 void RGWDeleteCORS::execute()
5308 op_ret
= retry_raced_bucket_write(store
, s
, [this] {
5309 op_ret
= read_bucket_cors();
5314 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
5319 map
<string
, bufferlist
> attrs
= s
->bucket_attrs
;
5320 attrs
.erase(RGW_ATTR_CORS
);
5321 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
,
5322 &s
->bucket_info
.objv_tracker
);
5324 ldpp_dout(this, 0) << "RGWLC::RGWDeleteCORS() failed to set attrs on bucket=" << s
->bucket
.name
5325 << " returned err=" << op_ret
<< dendl
;
5331 void RGWOptionsCORS::get_response_params(string
& hdrs
, string
& exp_hdrs
, unsigned *max_age
) {
5332 get_cors_response_headers(rule
, req_hdrs
, hdrs
, exp_hdrs
, max_age
);
5335 int RGWOptionsCORS::validate_cors_request(RGWCORSConfiguration
*cc
) {
5336 rule
= cc
->host_name_rule(origin
);
5338 ldpp_dout(this, 10) << "There is no cors rule present for " << origin
<< dendl
;
5342 if (!validate_cors_rule_method(rule
, req_meth
)) {
5346 if (!validate_cors_rule_header(rule
, req_hdrs
)) {
5353 void RGWOptionsCORS::execute()
5355 op_ret
= read_bucket_cors();
5359 origin
= s
->info
.env
->get("HTTP_ORIGIN");
5361 ldpp_dout(this, 0) << "Missing mandatory Origin header" << dendl
;
5365 req_meth
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
5367 ldpp_dout(this, 0) << "Missing mandatory Access-control-request-method header" << dendl
;
5372 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
5376 req_hdrs
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
5377 op_ret
= validate_cors_request(&bucket_cors
);
5379 origin
= req_meth
= NULL
;
5385 int RGWGetRequestPayment::verify_permission()
5387 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketRequestPayment
);
5390 void RGWGetRequestPayment::pre_exec()
5392 rgw_bucket_object_pre_exec(s
);
5395 void RGWGetRequestPayment::execute()
5397 requester_pays
= s
->bucket_info
.requester_pays
;
5400 int RGWSetRequestPayment::verify_permission()
5402 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketRequestPayment
);
5405 void RGWSetRequestPayment::pre_exec()
5407 rgw_bucket_object_pre_exec(s
);
5410 void RGWSetRequestPayment::execute()
5412 op_ret
= get_params();
5417 s
->bucket_info
.requester_pays
= requester_pays
;
5418 op_ret
= store
->put_bucket_instance_info(s
->bucket_info
, false, real_time(),
5421 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
5422 << " returned err=" << op_ret
<< dendl
;
5427 int RGWInitMultipart::verify_permission()
5429 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty()) {
5430 auto usr_policy_res
= eval_user_policies(s
->iam_user_policies
, s
->env
,
5432 rgw::IAM::s3PutObject
,
5433 rgw_obj(s
->bucket
, s
->object
));
5434 if (usr_policy_res
== Effect::Deny
) {
5438 rgw::IAM::Effect e
= Effect::Pass
;
5439 if (s
->iam_policy
) {
5440 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
5441 rgw::IAM::s3PutObject
,
5442 rgw_obj(s
->bucket
, s
->object
));
5444 if (e
== Effect::Allow
) {
5446 } else if (e
== Effect::Deny
) {
5448 } else if (usr_policy_res
== Effect::Allow
) {
5453 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
5460 void RGWInitMultipart::pre_exec()
5462 rgw_bucket_object_pre_exec(s
);
5465 void RGWInitMultipart::execute()
5468 map
<string
, bufferlist
> attrs
;
5471 if (get_params() < 0)
5474 if (s
->object
.empty())
5477 policy
.encode(aclbl
);
5478 attrs
[RGW_ATTR_ACL
] = aclbl
;
5480 populate_with_generic_attrs(s
, attrs
);
5482 /* select encryption mode */
5483 op_ret
= prepare_encryption(attrs
);
5487 op_ret
= rgw_get_request_metadata(s
->cct
, s
->info
, attrs
);
5494 gen_rand_alphanumeric(s
->cct
, buf
, sizeof(buf
) - 1);
5495 upload_id
= MULTIPART_UPLOAD_ID_PREFIX
; /* v2 upload id */
5496 upload_id
.append(buf
);
5498 string tmp_obj_name
;
5499 RGWMPObj
mp(s
->object
.name
, upload_id
);
5500 tmp_obj_name
= mp
.get_meta();
5502 obj
.init_ns(s
->bucket
, tmp_obj_name
, mp_ns
);
5503 // the meta object will be indexed with 0 size, we c
5504 obj
.set_in_extra_data(true);
5505 obj
.index_hash_source
= s
->object
.name
;
5507 RGWRados::Object
op_target(store
, s
->bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
5508 op_target
.set_versioning_disabled(true); /* no versioning for multipart meta */
5510 RGWRados::Object::Write
obj_op(&op_target
);
5512 obj_op
.meta
.owner
= s
->owner
.get_id();
5513 obj_op
.meta
.category
= RGWObjCategory::MultiMeta
;
5514 obj_op
.meta
.flags
= PUT_OBJ_CREATE_EXCL
;
5516 multipart_upload_info upload_info
;
5517 upload_info
.dest_placement
= s
->dest_placement
;
5520 encode(upload_info
, bl
);
5521 obj_op
.meta
.data
= &bl
;
5523 op_ret
= obj_op
.write_meta(bl
.length(), 0, attrs
);
5524 } while (op_ret
== -EEXIST
);
5527 int RGWCompleteMultipart::verify_permission()
5529 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty()) {
5530 auto usr_policy_res
= eval_user_policies(s
->iam_user_policies
, s
->env
,
5532 rgw::IAM::s3PutObject
,
5533 rgw_obj(s
->bucket
, s
->object
));
5534 if (usr_policy_res
== Effect::Deny
) {
5538 rgw::IAM::Effect e
= Effect::Pass
;
5539 if (s
->iam_policy
) {
5540 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
5541 rgw::IAM::s3PutObject
,
5542 rgw_obj(s
->bucket
, s
->object
));
5544 if (e
== Effect::Allow
) {
5546 } else if (e
== Effect::Deny
) {
5548 } else if (usr_policy_res
== Effect::Allow
) {
5553 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
5560 void RGWCompleteMultipart::pre_exec()
5562 rgw_bucket_object_pre_exec(s
);
5565 void RGWCompleteMultipart::execute()
5567 RGWMultiCompleteUpload
*parts
;
5568 map
<int, string
>::iterator iter
;
5569 RGWMultiXMLParser parser
;
5571 map
<uint32_t, RGWUploadPartInfo
> obj_parts
;
5572 map
<uint32_t, RGWUploadPartInfo
>::iterator obj_iter
;
5573 map
<string
, bufferlist
> attrs
;
5576 char final_etag
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
5577 char final_etag_str
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 16];
5582 RGWObjManifest manifest
;
5583 uint64_t olh_epoch
= 0;
5585 op_ret
= get_params();
5588 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
5593 if (!data
.length()) {
5594 op_ret
= -ERR_MALFORMED_XML
;
5598 if (!parser
.init()) {
5603 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
5604 op_ret
= -ERR_MALFORMED_XML
;
5608 parts
= static_cast<RGWMultiCompleteUpload
*>(parser
.find_first("CompleteMultipartUpload"));
5609 if (!parts
|| parts
->parts
.empty()) {
5610 op_ret
= -ERR_MALFORMED_XML
;
5614 if ((int)parts
->parts
.size() >
5615 s
->cct
->_conf
->rgw_multipart_part_upload_limit
) {
5620 mp
.init(s
->object
.name
, upload_id
);
5621 meta_oid
= mp
.get_meta();
5623 int total_parts
= 0;
5624 int handled_parts
= 0;
5625 int max_parts
= 1000;
5628 RGWCompressionInfo cs_info
;
5629 bool compressed
= false;
5630 uint64_t accounted_size
= 0;
5632 uint64_t min_part_size
= s
->cct
->_conf
->rgw_multipart_min_part_size
;
5634 list
<rgw_obj_index_key
> remove_objs
; /* objects to be removed from index listing */
5636 bool versioned_object
= s
->bucket_info
.versioning_enabled();
5638 iter
= parts
->parts
.begin();
5640 meta_obj
.init_ns(s
->bucket
, meta_oid
, mp_ns
);
5641 meta_obj
.set_in_extra_data(true);
5642 meta_obj
.index_hash_source
= s
->object
.name
;
5644 /*take a cls lock on meta_obj to prevent racing completions (or retries)
5645 from deleting the parts*/
5647 rgw_raw_obj raw_obj
;
5648 int max_lock_secs_mp
=
5649 s
->cct
->_conf
.get_val
<int64_t>("rgw_mp_lock_max_time");
5650 utime_t
dur(max_lock_secs_mp
, 0);
5652 store
->obj_to_raw((s
->bucket_info
).placement_rule
, meta_obj
, &raw_obj
);
5653 store
->get_obj_data_pool((s
->bucket_info
).placement_rule
,
5654 meta_obj
,&meta_pool
);
5655 store
->open_pool_ctx(meta_pool
, serializer
.ioctx
);
5657 op_ret
= serializer
.try_lock(raw_obj
.oid
, dur
);
5659 ldpp_dout(this, 0) << "failed to acquire lock" << dendl
;
5660 op_ret
= -ERR_INTERNAL_ERROR
;
5661 s
->err
.message
= "This multipart completion is already in progress";
5665 op_ret
= get_obj_attrs(store
, s
, meta_obj
, attrs
);
5668 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << meta_obj
5669 << " ret=" << op_ret
<< dendl
;
5674 op_ret
= list_multipart_parts(store
, s
, upload_id
, meta_oid
, max_parts
,
5675 marker
, obj_parts
, &marker
, &truncated
);
5676 if (op_ret
== -ENOENT
) {
5677 op_ret
= -ERR_NO_SUCH_UPLOAD
;
5682 total_parts
+= obj_parts
.size();
5683 if (!truncated
&& total_parts
!= (int)parts
->parts
.size()) {
5684 ldpp_dout(this, 0) << "NOTICE: total parts mismatch: have: " << total_parts
5685 << " expected: " << parts
->parts
.size() << dendl
;
5686 op_ret
= -ERR_INVALID_PART
;
5690 for (obj_iter
= obj_parts
.begin(); iter
!= parts
->parts
.end() && obj_iter
!= obj_parts
.end(); ++iter
, ++obj_iter
, ++handled_parts
) {
5691 uint64_t part_size
= obj_iter
->second
.accounted_size
;
5692 if (handled_parts
< (int)parts
->parts
.size() - 1 &&
5693 part_size
< min_part_size
) {
5694 op_ret
= -ERR_TOO_SMALL
;
5698 char petag
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
5699 if (iter
->first
!= (int)obj_iter
->first
) {
5700 ldpp_dout(this, 0) << "NOTICE: parts num mismatch: next requested: "
5701 << iter
->first
<< " next uploaded: "
5702 << obj_iter
->first
<< dendl
;
5703 op_ret
= -ERR_INVALID_PART
;
5706 string part_etag
= rgw_string_unquote(iter
->second
);
5707 if (part_etag
.compare(obj_iter
->second
.etag
) != 0) {
5708 ldpp_dout(this, 0) << "NOTICE: etag mismatch: part: " << iter
->first
5709 << " etag: " << iter
->second
<< dendl
;
5710 op_ret
= -ERR_INVALID_PART
;
5714 hex_to_buf(obj_iter
->second
.etag
.c_str(), petag
,
5715 CEPH_CRYPTO_MD5_DIGESTSIZE
);
5716 hash
.Update((const unsigned char *)petag
, sizeof(petag
));
5718 RGWUploadPartInfo
& obj_part
= obj_iter
->second
;
5720 /* update manifest for part */
5721 string oid
= mp
.get_part(obj_iter
->second
.num
);
5723 src_obj
.init_ns(s
->bucket
, oid
, mp_ns
);
5725 if (obj_part
.manifest
.empty()) {
5726 ldpp_dout(this, 0) << "ERROR: empty manifest for object part: obj="
5727 << src_obj
<< dendl
;
5728 op_ret
= -ERR_INVALID_PART
;
5731 manifest
.append(obj_part
.manifest
, store
->svc
.zone
);
5734 bool part_compressed
= (obj_part
.cs_info
.compression_type
!= "none");
5735 if ((obj_iter
!= obj_parts
.begin()) &&
5736 ((part_compressed
!= compressed
) ||
5737 (cs_info
.compression_type
!= obj_part
.cs_info
.compression_type
))) {
5738 ldpp_dout(this, 0) << "ERROR: compression type was changed during multipart upload ("
5739 << cs_info
.compression_type
<< ">>" << obj_part
.cs_info
.compression_type
<< ")" << dendl
;
5740 op_ret
= -ERR_INVALID_PART
;
5744 if (part_compressed
) {
5745 int64_t new_ofs
; // offset in compression data for new part
5746 if (cs_info
.blocks
.size() > 0)
5747 new_ofs
= cs_info
.blocks
.back().new_ofs
+ cs_info
.blocks
.back().len
;
5750 for (const auto& block
: obj_part
.cs_info
.blocks
) {
5751 compression_block cb
;
5752 cb
.old_ofs
= block
.old_ofs
+ cs_info
.orig_size
;
5753 cb
.new_ofs
= new_ofs
;
5755 cs_info
.blocks
.push_back(cb
);
5756 new_ofs
= cb
.new_ofs
+ cb
.len
;
5759 cs_info
.compression_type
= obj_part
.cs_info
.compression_type
;
5760 cs_info
.orig_size
+= obj_part
.cs_info
.orig_size
;
5764 rgw_obj_index_key remove_key
;
5765 src_obj
.key
.get_index_key(&remove_key
);
5767 remove_objs
.push_back(remove_key
);
5769 ofs
+= obj_part
.size
;
5770 accounted_size
+= obj_part
.accounted_size
;
5772 } while (truncated
);
5773 hash
.Final((unsigned char *)final_etag
);
5775 buf_to_hex((unsigned char *)final_etag
, sizeof(final_etag
), final_etag_str
);
5776 snprintf(&final_etag_str
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2], sizeof(final_etag_str
) - CEPH_CRYPTO_MD5_DIGESTSIZE
* 2,
5777 "-%lld", (long long)parts
->parts
.size());
5778 etag
= final_etag_str
;
5779 ldpp_dout(this, 10) << "calculated etag: " << final_etag_str
<< dendl
;
5781 etag_bl
.append(final_etag_str
, strlen(final_etag_str
));
5783 attrs
[RGW_ATTR_ETAG
] = etag_bl
;
5786 // write compression attribute to full object
5788 encode(cs_info
, tmp
);
5789 attrs
[RGW_ATTR_COMPRESSION
] = tmp
;
5792 target_obj
.init(s
->bucket
, s
->object
.name
);
5793 if (versioned_object
) {
5794 if (!version_id
.empty()) {
5795 target_obj
.key
.set_instance(version_id
);
5797 store
->gen_rand_obj_instance_name(&target_obj
);
5798 version_id
= target_obj
.key
.get_instance();
5802 RGWObjectCtx
& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
5804 obj_ctx
.set_atomic(target_obj
);
5806 RGWRados::Object
op_target(store
, s
->bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), target_obj
);
5807 RGWRados::Object::Write
obj_op(&op_target
);
5809 obj_op
.meta
.manifest
= &manifest
;
5810 obj_op
.meta
.remove_objs
= &remove_objs
;
5812 obj_op
.meta
.ptag
= &s
->req_id
; /* use req_id as operation tag */
5813 obj_op
.meta
.owner
= s
->owner
.get_id();
5814 obj_op
.meta
.flags
= PUT_OBJ_CREATE
;
5815 obj_op
.meta
.modify_tail
= true;
5816 obj_op
.meta
.completeMultipart
= true;
5817 obj_op
.meta
.olh_epoch
= olh_epoch
;
5818 op_ret
= obj_op
.write_meta(ofs
, accounted_size
, attrs
);
5822 // remove the upload obj
5823 int r
= store
->delete_obj(*static_cast<RGWObjectCtx
*>(s
->obj_ctx
),
5824 s
->bucket_info
, meta_obj
, 0);
5826 /* serializer's exclusive lock is released */
5827 serializer
.clear_locked();
5829 ldpp_dout(this, 0) << "WARNING: failed to remove object " << meta_obj
<< dendl
;
5833 int RGWCompleteMultipart::MPSerializer::try_lock(
5834 const std::string
& _oid
,
5839 lock
.set_duration(dur
);
5840 lock
.lock_exclusive(&op
);
5841 int ret
= ioctx
.operate(oid
, &op
);
5848 void RGWCompleteMultipart::complete()
5850 /* release exclusive lock iff not already */
5851 if (unlikely(serializer
.locked
)) {
5852 int r
= serializer
.unlock();
5854 ldpp_dout(this, 0) << "WARNING: failed to unlock " << serializer
.oid
<< dendl
;
5860 int RGWAbortMultipart::verify_permission()
5862 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty()) {
5863 auto usr_policy_res
= eval_user_policies(s
->iam_user_policies
, s
->env
,
5865 rgw::IAM::s3AbortMultipartUpload
,
5866 rgw_obj(s
->bucket
, s
->object
));
5867 if (usr_policy_res
== Effect::Deny
) {
5871 rgw::IAM::Effect e
= Effect::Pass
;
5872 if (s
->iam_policy
) {
5873 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
5874 rgw::IAM::s3AbortMultipartUpload
,
5875 rgw_obj(s
->bucket
, s
->object
));
5877 if (e
== Effect::Allow
) {
5879 } else if (e
== Effect::Deny
) {
5881 } else if (usr_policy_res
== Effect::Allow
)
5885 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
5892 void RGWAbortMultipart::pre_exec()
5894 rgw_bucket_object_pre_exec(s
);
5897 void RGWAbortMultipart::execute()
5902 upload_id
= s
->info
.args
.get("uploadId");
5906 if (upload_id
.empty() || s
->object
.empty())
5909 mp
.init(s
->object
.name
, upload_id
);
5910 meta_oid
= mp
.get_meta();
5912 op_ret
= get_multipart_info(store
, s
, meta_oid
, nullptr, nullptr, nullptr);
5916 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
5917 op_ret
= abort_multipart_upload(store
, s
->cct
, obj_ctx
, s
->bucket_info
, mp
);
5920 int RGWListMultipart::verify_permission()
5922 if (!verify_object_permission(this, s
, rgw::IAM::s3ListMultipartUploadParts
))
5928 void RGWListMultipart::pre_exec()
5930 rgw_bucket_object_pre_exec(s
);
5933 void RGWListMultipart::execute()
5938 op_ret
= get_params();
5942 mp
.init(s
->object
.name
, upload_id
);
5943 meta_oid
= mp
.get_meta();
5945 op_ret
= get_multipart_info(store
, s
, meta_oid
, &policy
, nullptr, nullptr);
5949 op_ret
= list_multipart_parts(store
, s
, upload_id
, meta_oid
, max_parts
,
5950 marker
, parts
, NULL
, &truncated
);
5953 int RGWListBucketMultiparts::verify_permission()
5955 if (!verify_bucket_permission(this,
5957 rgw::IAM::s3ListBucketMultipartUploads
))
5963 void RGWListBucketMultiparts::pre_exec()
5965 rgw_bucket_object_pre_exec(s
);
5968 void RGWListBucketMultiparts::execute()
5970 vector
<rgw_bucket_dir_entry
> objs
;
5973 op_ret
= get_params();
5977 if (s
->prot_flags
& RGW_REST_SWIFT
) {
5979 path_args
= s
->info
.args
.get("path");
5980 if (!path_args
.empty()) {
5981 if (!delimiter
.empty() || !prefix
.empty()) {
5989 marker_meta
= marker
.get_meta();
5991 op_ret
= list_bucket_multiparts(store
, s
->bucket_info
, prefix
, marker_meta
, delimiter
,
5992 max_uploads
, &objs
, &common_prefixes
, &is_truncated
);
5997 if (!objs
.empty()) {
5998 vector
<rgw_bucket_dir_entry
>::iterator iter
;
5999 RGWMultipartUploadEntry entry
;
6000 for (iter
= objs
.begin(); iter
!= objs
.end(); ++iter
) {
6001 rgw_obj_key
key(iter
->key
);
6002 if (!entry
.mp
.from_meta(key
.name
))
6005 uploads
.push_back(entry
);
6007 next_marker
= entry
;
6011 void RGWGetHealthCheck::execute()
6013 if (!g_conf()->rgw_healthcheck_disabling_path
.empty() &&
6014 (::access(g_conf()->rgw_healthcheck_disabling_path
.c_str(), F_OK
) == 0)) {
6015 /* Disabling path specified & existent in the filesystem. */
6016 op_ret
= -ERR_SERVICE_UNAVAILABLE
; /* 503 */
6018 op_ret
= 0; /* 200 OK */
6022 int RGWDeleteMultiObj::verify_permission()
6024 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty()) {
6025 auto usr_policy_res
= eval_user_policies(s
->iam_user_policies
, s
->env
,
6027 s
->object
.instance
.empty() ?
6028 rgw::IAM::s3DeleteObject
:
6029 rgw::IAM::s3DeleteObjectVersion
,
6031 if (usr_policy_res
== Effect::Deny
) {
6035 rgw::IAM::Effect r
= Effect::Pass
;
6036 if (s
->iam_policy
) {
6037 r
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
6038 s
->object
.instance
.empty() ?
6039 rgw::IAM::s3DeleteObject
:
6040 rgw::IAM::s3DeleteObjectVersion
,
6043 if (r
== Effect::Allow
)
6045 else if (r
== Effect::Deny
)
6047 else if (usr_policy_res
== Effect::Allow
)
6051 acl_allowed
= verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
);
6058 void RGWDeleteMultiObj::pre_exec()
6060 rgw_bucket_object_pre_exec(s
);
6063 void RGWDeleteMultiObj::execute()
6065 RGWMultiDelDelete
*multi_delete
;
6066 vector
<rgw_obj_key
>::iterator iter
;
6067 RGWMultiDelXMLParser parser
;
6068 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
6071 op_ret
= get_params();
6082 if (!parser
.init()) {
6087 if (!parser
.parse(buf
, data
.length(), 1)) {
6092 multi_delete
= static_cast<RGWMultiDelDelete
*>(parser
.find_first("Delete"));
6093 if (!multi_delete
) {
6097 #define DELETE_MULTI_OBJ_MAX_NUM 1000
6098 int max_num
= s
->cct
->_conf
->rgw_delete_multi_obj_max_num
;
6100 max_num
= DELETE_MULTI_OBJ_MAX_NUM
;
6102 int multi_delete_object_num
= multi_delete
->objects
.size();
6103 if (multi_delete_object_num
> max_num
) {
6104 op_ret
= -ERR_MALFORMED_XML
;
6109 if (multi_delete
->is_quiet())
6112 if (s
->bucket_info
.mfa_enabled()) {
6113 bool has_versioned
= false;
6114 for (auto i
: multi_delete
->objects
) {
6115 if (!i
.instance
.empty()) {
6116 has_versioned
= true;
6120 if (has_versioned
&& !s
->mfa_verified
) {
6121 ldpp_dout(this, 5) << "NOTICE: multi-object delete request with a versioned object, mfa auth not provided" << dendl
;
6122 op_ret
= -ERR_MFA_REQUIRED
;
6128 if (multi_delete
->objects
.empty()) {
6132 for (iter
= multi_delete
->objects
.begin();
6133 iter
!= multi_delete
->objects
.end();
6135 rgw_obj
obj(bucket
, *iter
);
6136 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty()) {
6137 auto usr_policy_res
= eval_user_policies(s
->iam_user_policies
, s
->env
,
6139 iter
->instance
.empty() ?
6140 rgw::IAM::s3DeleteObject
:
6141 rgw::IAM::s3DeleteObjectVersion
,
6143 if (usr_policy_res
== Effect::Deny
) {
6144 send_partial_response(*iter
, false, "", -EACCES
);
6148 rgw::IAM::Effect e
= Effect::Pass
;
6149 if (s
->iam_policy
) {
6150 e
= s
->iam_policy
->eval(s
->env
,
6152 iter
->instance
.empty() ?
6153 rgw::IAM::s3DeleteObject
:
6154 rgw::IAM::s3DeleteObjectVersion
,
6157 if ((e
== Effect::Deny
) ||
6158 (usr_policy_res
== Effect::Pass
&& e
== Effect::Pass
&& !acl_allowed
)) {
6159 send_partial_response(*iter
, false, "", -EACCES
);
6164 obj_ctx
->set_atomic(obj
);
6166 RGWRados::Object
del_target(store
, s
->bucket_info
, *obj_ctx
, obj
);
6167 RGWRados::Object::Delete
del_op(&del_target
);
6169 del_op
.params
.bucket_owner
= s
->bucket_owner
.get_id();
6170 del_op
.params
.versioning_status
= s
->bucket_info
.versioning_status();
6171 del_op
.params
.obj_owner
= s
->owner
;
6173 op_ret
= del_op
.delete_obj();
6174 if (op_ret
== -ENOENT
) {
6178 send_partial_response(*iter
, del_op
.result
.delete_marker
,
6179 del_op
.result
.version_id
, op_ret
);
6182 /* set the return code to zero, errors at this point will be
6183 dumped to the response */
6187 // will likely segfault if begin_response() has not been called
6197 bool RGWBulkDelete::Deleter::verify_permission(RGWBucketInfo
& binfo
,
6198 map
<string
, bufferlist
>& battrs
,
6199 ACLOwner
& bucket_owner
/* out */)
6201 RGWAccessControlPolicy
bacl(store
->ctx());
6202 int ret
= read_bucket_policy(store
, s
, binfo
, battrs
, &bacl
, binfo
.bucket
);
6207 auto policy
= get_iam_policy_from_attr(s
->cct
, store
, battrs
, binfo
.bucket
.tenant
);
6209 bucket_owner
= bacl
.get_owner();
6211 /* We can use global user_acl because each BulkDelete request is allowed
6212 * to work on entities from a single account only. */
6213 return verify_bucket_permission(dpp
, s
, binfo
.bucket
, s
->user_acl
.get(),
6214 &bacl
, policy
, s
->iam_user_policies
, rgw::IAM::s3DeleteBucket
);
6217 bool RGWBulkDelete::Deleter::delete_single(const acct_path_t
& path
)
6219 auto& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
6221 RGWBucketInfo binfo
;
6222 map
<string
, bufferlist
> battrs
;
6225 int ret
= store
->get_bucket_info(*s
->sysobj_ctx
, s
->user
->user_id
.tenant
,
6226 path
.bucket_name
, binfo
, nullptr,
6232 if (!verify_permission(binfo
, battrs
, bowner
)) {
6237 if (!path
.obj_key
.empty()) {
6238 rgw_obj
obj(binfo
.bucket
, path
.obj_key
);
6239 obj_ctx
.set_atomic(obj
);
6241 RGWRados::Object
del_target(store
, binfo
, obj_ctx
, obj
);
6242 RGWRados::Object::Delete
del_op(&del_target
);
6244 del_op
.params
.bucket_owner
= binfo
.owner
;
6245 del_op
.params
.versioning_status
= binfo
.versioning_status();
6246 del_op
.params
.obj_owner
= bowner
;
6248 ret
= del_op
.delete_obj();
6253 RGWObjVersionTracker ot
;
6254 ot
.read_version
= binfo
.ep_objv
;
6256 ret
= store
->delete_bucket(binfo
, ot
);
6258 ret
= rgw_unlink_bucket(store
, binfo
.owner
, binfo
.bucket
.tenant
,
6259 binfo
.bucket
.name
, false);
6261 ldpp_dout(s
, 0) << "WARNING: failed to unlink bucket: ret=" << ret
<< dendl
;
6268 if (!store
->svc
.zone
->is_meta_master()) {
6270 ret
= forward_request_to_master(s
, &ot
.read_version
, store
, in_data
,
6273 if (ret
== -ENOENT
) {
6274 /* adjust error, we want to return with NoSuchBucket and not
6276 ret
= -ERR_NO_SUCH_BUCKET
;
6288 if (-ENOENT
== ret
) {
6289 ldpp_dout(s
, 20) << "cannot find bucket = " << path
.bucket_name
<< dendl
;
6292 ldpp_dout(s
, 20) << "cannot get bucket info, ret = " << ret
<< dendl
;
6294 fail_desc_t failed_item
= {
6298 failures
.push_back(failed_item
);
6303 ldpp_dout(s
, 20) << "wrong auth for " << path
<< dendl
;
6305 fail_desc_t failed_item
= {
6309 failures
.push_back(failed_item
);
6314 if (-ENOENT
== ret
) {
6315 ldpp_dout(s
, 20) << "cannot find entry " << path
<< dendl
;
6318 fail_desc_t failed_item
= {
6322 failures
.push_back(failed_item
);
6327 bool RGWBulkDelete::Deleter::delete_chunk(const std::list
<acct_path_t
>& paths
)
6329 ldpp_dout(s
, 20) << "in delete_chunk" << dendl
;
6330 for (auto path
: paths
) {
6331 ldpp_dout(s
, 20) << "bulk deleting path: " << path
<< dendl
;
6332 delete_single(path
);
6338 int RGWBulkDelete::verify_permission()
6343 void RGWBulkDelete::pre_exec()
6345 rgw_bucket_object_pre_exec(s
);
6348 void RGWBulkDelete::execute()
6350 deleter
= std::unique_ptr
<Deleter
>(new Deleter(this, store
, s
));
6352 bool is_truncated
= false;
6354 list
<RGWBulkDelete::acct_path_t
> items
;
6356 int ret
= get_data(items
, &is_truncated
);
6361 ret
= deleter
->delete_chunk(items
);
6362 } while (!op_ret
&& is_truncated
);
6368 constexpr std::array
<int, 2> RGWBulkUploadOp::terminal_errors
;
6370 int RGWBulkUploadOp::verify_permission()
6372 if (s
->auth
.identity
->is_anonymous()) {
6376 if (! verify_user_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
6380 if (s
->user
->user_id
.tenant
!= s
->bucket_tenant
) {
6381 ldpp_dout(this, 10) << "user cannot create a bucket in a different tenant"
6382 << " (user_id.tenant=" << s
->user
->user_id
.tenant
6383 << " requested=" << s
->bucket_tenant
<< ")" << dendl
;
6387 if (s
->user
->max_buckets
< 0) {
6394 void RGWBulkUploadOp::pre_exec()
6396 rgw_bucket_object_pre_exec(s
);
6399 boost::optional
<std::pair
<std::string
, rgw_obj_key
>>
6400 RGWBulkUploadOp::parse_path(const boost::string_ref
& path
)
6402 /* We need to skip all slashes at the beginning in order to preserve
6403 * compliance with Swift. */
6404 const size_t start_pos
= path
.find_first_not_of('/');
6406 if (boost::string_ref::npos
!= start_pos
) {
6407 /* Seperator is the first slash after the leading ones. */
6408 const size_t sep_pos
= path
.substr(start_pos
).find('/');
6410 if (boost::string_ref::npos
!= sep_pos
) {
6411 const auto bucket_name
= path
.substr(start_pos
, sep_pos
- start_pos
);
6412 const auto obj_name
= path
.substr(sep_pos
+ 1);
6414 return std::make_pair(bucket_name
.to_string(),
6415 rgw_obj_key(obj_name
.to_string()));
6417 /* It's guaranteed here that bucket name is at least one character
6418 * long and is different than slash. */
6419 return std::make_pair(path
.substr(start_pos
).to_string(),
6427 std::pair
<std::string
, std::string
>
6428 RGWBulkUploadOp::handle_upload_path(struct req_state
*s
)
6430 std::string bucket_path
, file_prefix
;
6431 if (! s
->init_state
.url_bucket
.empty()) {
6432 file_prefix
= bucket_path
= s
->init_state
.url_bucket
+ "/";
6433 if (! s
->object
.empty()) {
6434 std::string
& object_name
= s
->object
.name
;
6436 /* As rgw_obj_key::empty() already verified emptiness of s->object.name,
6437 * we can safely examine its last element. */
6438 if (object_name
.back() == '/') {
6439 file_prefix
.append(object_name
);
6441 file_prefix
.append(object_name
).append("/");
6445 return std::make_pair(bucket_path
, file_prefix
);
6448 int RGWBulkUploadOp::handle_dir_verify_permission()
6450 if (s
->user
->max_buckets
> 0) {
6451 RGWUserBuckets buckets
;
6453 bool is_truncated
= false;
6454 op_ret
= rgw_read_user_buckets(store
, s
->user
->user_id
, buckets
,
6455 marker
, std::string(), s
->user
->max_buckets
,
6456 false, &is_truncated
);
6461 if (buckets
.count() >= static_cast<size_t>(s
->user
->max_buckets
)) {
6462 return -ERR_TOO_MANY_BUCKETS
;
6469 static void forward_req_info(CephContext
*cct
, req_info
& info
, const std::string
& bucket_name
)
6471 /* the request of container or object level will contain bucket name.
6472 * only at account level need to append the bucket name */
6473 if (info
.script_uri
.find(bucket_name
) != std::string::npos
) {
6477 ldout(cct
, 20) << "append the bucket: "<< bucket_name
<< " to req_info" << dendl
;
6478 info
.script_uri
.append("/").append(bucket_name
);
6479 info
.request_uri_aws4
= info
.request_uri
= info
.script_uri
;
6480 info
.effective_uri
= "/" + bucket_name
;
6483 void RGWBulkUploadOp::init(RGWRados
* const store
,
6484 struct req_state
* const s
,
6485 RGWHandler
* const h
)
6487 RGWOp::init(store
, s
, h
);
6488 dir_ctx
.emplace(store
->svc
.sysobj
->init_obj_ctx());
6491 int RGWBulkUploadOp::handle_dir(const boost::string_ref path
)
6493 ldpp_dout(this, 20) << "got directory=" << path
<< dendl
;
6495 op_ret
= handle_dir_verify_permission();
6500 std::string bucket_name
;
6501 rgw_obj_key object_junk
;
6502 std::tie(bucket_name
, object_junk
) = *parse_path(path
);
6504 rgw_raw_obj
obj(store
->svc
.zone
->get_zone_params().domain_root
,
6505 rgw_make_bucket_entry_name(s
->bucket_tenant
, bucket_name
));
6507 /* we need to make sure we read bucket info, it's not read before for this
6508 * specific request */
6509 RGWBucketInfo binfo
;
6510 std::map
<std::string
, ceph::bufferlist
> battrs
;
6511 op_ret
= store
->get_bucket_info(*dir_ctx
, s
->bucket_tenant
, bucket_name
,
6512 binfo
, nullptr, &battrs
);
6513 if (op_ret
< 0 && op_ret
!= -ENOENT
) {
6516 const bool bucket_exists
= (op_ret
!= -ENOENT
);
6518 if (bucket_exists
) {
6519 RGWAccessControlPolicy
old_policy(s
->cct
);
6520 int r
= rgw_op_get_bucket_policy_from_attr(s
->cct
, store
, binfo
,
6521 battrs
, &old_policy
);
6523 if (old_policy
.get_owner().get_id().compare(s
->user
->user_id
) != 0) {
6530 RGWBucketInfo master_info
;
6531 rgw_bucket
*pmaster_bucket
= nullptr;
6532 uint32_t *pmaster_num_shards
= nullptr;
6533 real_time creation_time
;
6534 obj_version objv
, ep_objv
, *pobjv
= nullptr;
6536 if (! store
->svc
.zone
->is_meta_master()) {
6538 ceph::bufferlist in_data
;
6539 req_info info
= s
->info
;
6540 forward_req_info(s
->cct
, info
, bucket_name
);
6541 op_ret
= forward_request_to_master(s
, nullptr, store
, in_data
, &jp
, &info
);
6546 JSONDecoder::decode_json("entry_point_object_ver", ep_objv
, &jp
);
6547 JSONDecoder::decode_json("object_ver", objv
, &jp
);
6548 JSONDecoder::decode_json("bucket_info", master_info
, &jp
);
6550 ldpp_dout(this, 20) << "parsed: objv.tag=" << objv
.tag
<< " objv.ver=" << objv
.ver
<< dendl
;
6551 ldpp_dout(this, 20) << "got creation_time="<< master_info
.creation_time
<< dendl
;
6553 pmaster_bucket
= &master_info
.bucket
;
6554 creation_time
= master_info
.creation_time
;
6555 pmaster_num_shards
= &master_info
.num_shards
;
6558 pmaster_bucket
= nullptr;
6559 pmaster_num_shards
= nullptr;
6562 rgw_placement_rule
placement_rule(binfo
.placement_rule
, s
->info
.storage_class
);
6564 if (bucket_exists
) {
6565 rgw_placement_rule selected_placement_rule
;
6567 bucket
.tenant
= s
->bucket_tenant
;
6568 bucket
.name
= s
->bucket_name
;
6569 op_ret
= store
->svc
.zone
->select_bucket_placement(*(s
->user
),
6570 store
->svc
.zone
->get_zonegroup().get_id(),
6572 &selected_placement_rule
,
6574 if (selected_placement_rule
!= binfo
.placement_rule
) {
6576 ldpp_dout(this, 20) << "non-coherent placement rule" << dendl
;
6581 /* Create metadata: ACLs. */
6582 std::map
<std::string
, ceph::bufferlist
> attrs
;
6583 RGWAccessControlPolicy policy
;
6584 policy
.create_default(s
->user
->user_id
, s
->user
->display_name
);
6585 ceph::bufferlist aclbl
;
6586 policy
.encode(aclbl
);
6587 attrs
.emplace(RGW_ATTR_ACL
, std::move(aclbl
));
6589 RGWQuotaInfo quota_info
;
6590 const RGWQuotaInfo
* pquota_info
= nullptr;
6593 bucket
.tenant
= s
->bucket_tenant
; /* ignored if bucket exists */
6594 bucket
.name
= bucket_name
;
6597 RGWBucketInfo out_info
;
6598 op_ret
= store
->create_bucket(*(s
->user
),
6600 store
->svc
.zone
->get_zonegroup().get_id(),
6601 placement_rule
, binfo
.swift_ver_location
,
6603 out_info
, pobjv
, &ep_objv
, creation_time
,
6604 pmaster_bucket
, pmaster_num_shards
, true);
6605 /* continue if EEXIST and create_bucket will fail below. this way we can
6606 * recover from a partial create by retrying it. */
6607 ldpp_dout(this, 20) << "rgw_create_bucket returned ret=" << op_ret
6608 << ", bucket=" << bucket
<< dendl
;
6610 if (op_ret
&& op_ret
!= -EEXIST
) {
6614 const bool existed
= (op_ret
== -EEXIST
);
6616 /* bucket already existed, might have raced with another bucket creation, or
6617 * might be partial bucket creation that never completed. Read existing bucket
6618 * info, verify that the reported bucket owner is the current user.
6619 * If all is ok then update the user's list of buckets.
6620 * Otherwise inform client about a name conflict.
6622 if (out_info
.owner
.compare(s
->user
->user_id
) != 0) {
6624 ldpp_dout(this, 20) << "conflicting bucket name" << dendl
;
6627 bucket
= out_info
.bucket
;
6630 op_ret
= rgw_link_bucket(store
, s
->user
->user_id
, bucket
,
6631 out_info
.creation_time
, false);
6632 if (op_ret
&& !existed
&& op_ret
!= -EEXIST
) {
6633 /* if it exists (or previously existed), don't remove it! */
6634 op_ret
= rgw_unlink_bucket(store
, s
->user
->user_id
,
6635 bucket
.tenant
, bucket
.name
);
6637 ldpp_dout(this, 0) << "WARNING: failed to unlink bucket: ret=" << op_ret
<< dendl
;
6639 } else if (op_ret
== -EEXIST
|| (op_ret
== 0 && existed
)) {
6640 ldpp_dout(this, 20) << "containers already exists" << dendl
;
6641 op_ret
= -ERR_BUCKET_EXISTS
;
6648 bool RGWBulkUploadOp::handle_file_verify_permission(RGWBucketInfo
& binfo
,
6650 std::map
<std::string
, ceph::bufferlist
>& battrs
,
6651 ACLOwner
& bucket_owner
/* out */)
6653 RGWAccessControlPolicy
bacl(store
->ctx());
6654 op_ret
= read_bucket_policy(store
, s
, binfo
, battrs
, &bacl
, binfo
.bucket
);
6656 ldpp_dout(this, 20) << "cannot read_policy() for bucket" << dendl
;
6660 auto policy
= get_iam_policy_from_attr(s
->cct
, store
, battrs
, binfo
.bucket
.tenant
);
6662 bucket_owner
= bacl
.get_owner();
6663 if (policy
|| ! s
->iam_user_policies
.empty()) {
6664 auto usr_policy_res
= eval_user_policies(s
->iam_user_policies
, s
->env
,
6666 rgw::IAM::s3PutObject
, obj
);
6667 if (usr_policy_res
== Effect::Deny
) {
6670 auto e
= policy
->eval(s
->env
, *s
->auth
.identity
,
6671 rgw::IAM::s3PutObject
, obj
);
6672 if (e
== Effect::Allow
) {
6674 } else if (e
== Effect::Deny
) {
6676 } else if (usr_policy_res
== Effect::Allow
) {
6681 return verify_bucket_permission_no_policy(this, s
, s
->user_acl
.get(),
6682 &bacl
, RGW_PERM_WRITE
);
6685 int RGWBulkUploadOp::handle_file(const boost::string_ref path
,
6687 AlignedStreamGetter
& body
)
6690 ldpp_dout(this, 20) << "got file=" << path
<< ", size=" << size
<< dendl
;
6692 if (size
> static_cast<size_t>(s
->cct
->_conf
->rgw_max_put_size
)) {
6693 op_ret
= -ERR_TOO_LARGE
;
6697 std::string bucket_name
;
6699 std::tie(bucket_name
, object
) = *parse_path(path
);
6701 auto& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
6702 RGWBucketInfo binfo
;
6703 std::map
<std::string
, ceph::bufferlist
> battrs
;
6705 op_ret
= store
->get_bucket_info(*s
->sysobj_ctx
, s
->user
->user_id
.tenant
,
6706 bucket_name
, binfo
, nullptr, &battrs
);
6707 if (op_ret
== -ENOENT
) {
6708 ldpp_dout(this, 20) << "non existent directory=" << bucket_name
<< dendl
;
6709 } else if (op_ret
< 0) {
6713 if (! handle_file_verify_permission(binfo
,
6714 rgw_obj(binfo
.bucket
, object
),
6716 ldpp_dout(this, 20) << "object creation unauthorized" << dendl
;
6721 op_ret
= store
->check_quota(bowner
.get_id(), binfo
.bucket
,
6722 user_quota
, bucket_quota
, size
);
6727 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
6732 rgw_obj
obj(binfo
.bucket
, object
);
6733 if (s
->bucket_info
.versioning_enabled()) {
6734 store
->gen_rand_obj_instance_name(&obj
);
6737 rgw_placement_rule dest_placement
= s
->dest_placement
;
6738 dest_placement
.inherit_from(binfo
.placement_rule
);
6740 rgw::AioThrottle
aio(store
->ctx()->_conf
->rgw_put_obj_min_window_size
);
6742 using namespace rgw::putobj
;
6744 AtomicObjectProcessor
processor(&aio
, store
, binfo
, &s
->dest_placement
, bowner
.get_id(),
6745 obj_ctx
, obj
, 0, s
->req_id
);
6747 op_ret
= processor
.prepare();
6749 ldpp_dout(this, 20) << "cannot prepare processor due to ret=" << op_ret
<< dendl
;
6753 /* No filters by default. */
6754 DataProcessor
*filter
= &processor
;
6756 const auto& compression_type
= store
->svc
.zone
->get_zone_params().get_compression_type(
6758 CompressorRef plugin
;
6759 boost::optional
<RGWPutObj_Compress
> compressor
;
6760 if (compression_type
!= "none") {
6761 plugin
= Compressor::create(s
->cct
, compression_type
);
6763 ldpp_dout(this, 1) << "Cannot load plugin for rgw_compression_type "
6764 << compression_type
<< dendl
;
6766 compressor
.emplace(s
->cct
, plugin
, filter
);
6767 filter
= &*compressor
;
6771 /* Upload file content. */
6776 ceph::bufferlist data
;
6777 len
= body
.get_at_most(s
->cct
->_conf
->rgw_max_chunk_size
, data
);
6779 ldpp_dout(this, 20) << "body=" << data
.c_str() << dendl
;
6783 } else if (len
> 0) {
6784 hash
.Update((const unsigned char *)data
.c_str(), data
.length());
6785 op_ret
= filter
->process(std::move(data
), ofs
);
6787 ldpp_dout(this, 20) << "filter->process() returned ret=" << op_ret
<< dendl
;
6797 op_ret
= filter
->process({}, ofs
);
6803 ldpp_dout(this, 10) << "real file size different from declared" << dendl
;
6808 op_ret
= store
->check_quota(bowner
.get_id(), binfo
.bucket
,
6809 user_quota
, bucket_quota
, size
);
6811 ldpp_dout(this, 20) << "quota exceeded for path=" << path
<< dendl
;
6815 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
6820 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
6821 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
6823 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
6825 /* Create metadata: ETAG. */
6826 std::map
<std::string
, ceph::bufferlist
> attrs
;
6827 std::string etag
= calc_md5
;
6828 ceph::bufferlist etag_bl
;
6829 etag_bl
.append(etag
.c_str(), etag
.size() + 1);
6830 attrs
.emplace(RGW_ATTR_ETAG
, std::move(etag_bl
));
6832 /* Create metadata: ACLs. */
6833 RGWAccessControlPolicy policy
;
6834 policy
.create_default(s
->user
->user_id
, s
->user
->display_name
);
6835 ceph::bufferlist aclbl
;
6836 policy
.encode(aclbl
);
6837 attrs
.emplace(RGW_ATTR_ACL
, std::move(aclbl
));
6839 /* Create metadata: compression info. */
6840 if (compressor
&& compressor
->is_compressed()) {
6841 ceph::bufferlist tmp
;
6842 RGWCompressionInfo cs_info
;
6843 cs_info
.compression_type
= plugin
->get_type_name();
6844 cs_info
.orig_size
= s
->obj_size
;
6845 cs_info
.blocks
= std::move(compressor
->get_compression_blocks());
6846 encode(cs_info
, tmp
);
6847 attrs
.emplace(RGW_ATTR_COMPRESSION
, std::move(tmp
));
6850 /* Complete the transaction. */
6851 op_ret
= processor
.complete(size
, etag
, nullptr, ceph::real_time(),
6852 attrs
, ceph::real_time() /* delete_at */,
6853 nullptr, nullptr, nullptr, nullptr, nullptr);
6855 ldpp_dout(this, 20) << "processor::complete returned op_ret=" << op_ret
<< dendl
;
6861 void RGWBulkUploadOp::execute()
6863 ceph::bufferlist
buffer(64 * 1024);
6865 ldpp_dout(this, 20) << "start" << dendl
;
6867 /* Create an instance of stream-abstracting class. Having this indirection
6868 * allows for easy introduction of decompressors like gzip and bzip2. */
6869 auto stream
= create_stream();
6874 /* Handling the $UPLOAD_PATH accordingly to the Swift's Bulk middleware. See:
6875 * https://github.com/openstack/swift/blob/2.13.0/swift/common/middleware/bulk.py#L31-L41 */
6876 std::string bucket_path
, file_prefix
;
6877 std::tie(bucket_path
, file_prefix
) = handle_upload_path(s
);
6879 auto status
= rgw::tar::StatusIndicator::create();
6881 op_ret
= stream
->get_exactly(rgw::tar::BLOCK_SIZE
, buffer
);
6883 ldpp_dout(this, 2) << "cannot read header" << dendl
;
6887 /* We need to re-interpret the buffer as a TAR block. Exactly two blocks
6888 * must be tracked to detect out end-of-archive. It occurs when both of
6889 * them are empty (zeroed). Tracing this particular inter-block dependency
6890 * is responsibility of the rgw::tar::StatusIndicator class. */
6891 boost::optional
<rgw::tar::HeaderView
> header
;
6892 std::tie(status
, header
) = rgw::tar::interpret_block(status
, buffer
);
6894 if (! status
.empty() && header
) {
6895 /* This specific block isn't empty (entirely zeroed), so we can parse
6896 * it as a TAR header and dispatch. At the moment we do support only
6897 * regular files and directories. Everything else (symlinks, devices)
6898 * will be ignored but won't cease the whole upload. */
6899 switch (header
->get_filetype()) {
6900 case rgw::tar::FileType::NORMAL_FILE
: {
6901 ldpp_dout(this, 2) << "handling regular file" << dendl
;
6903 boost::string_ref filename
= bucket_path
.empty() ? header
->get_filename() : \
6904 file_prefix
+ header
->get_filename().to_string();
6905 auto body
= AlignedStreamGetter(0, header
->get_filesize(),
6906 rgw::tar::BLOCK_SIZE
, *stream
);
6907 op_ret
= handle_file(filename
,
6908 header
->get_filesize(),
6911 /* Only regular files counts. */
6914 failures
.emplace_back(op_ret
, filename
.to_string());
6918 case rgw::tar::FileType::DIRECTORY
: {
6919 ldpp_dout(this, 2) << "handling regular directory" << dendl
;
6921 boost::string_ref dirname
= bucket_path
.empty() ? header
->get_filename() : bucket_path
;
6922 op_ret
= handle_dir(dirname
);
6923 if (op_ret
< 0 && op_ret
!= -ERR_BUCKET_EXISTS
) {
6924 failures
.emplace_back(op_ret
, dirname
.to_string());
6929 /* Not recognized. Skip. */
6935 /* In case of any problems with sub-request authorization Swift simply
6936 * terminates whole upload immediately. */
6937 if (boost::algorithm::contains(std::initializer_list
<int>{ op_ret
},
6939 ldpp_dout(this, 2) << "terminating due to ret=" << op_ret
<< dendl
;
6943 ldpp_dout(this, 2) << "an empty block" << dendl
;
6948 } while (! status
.eof());
6953 RGWBulkUploadOp::AlignedStreamGetter::~AlignedStreamGetter()
6955 const size_t aligned_legnth
= length
+ (-length
% alignment
);
6956 ceph::bufferlist junk
;
6958 DecoratedStreamGetter::get_exactly(aligned_legnth
- position
, junk
);
6961 ssize_t
RGWBulkUploadOp::AlignedStreamGetter::get_at_most(const size_t want
,
6962 ceph::bufferlist
& dst
)
6964 const size_t max_to_read
= std::min(want
, length
- position
);
6965 const auto len
= DecoratedStreamGetter::get_at_most(max_to_read
, dst
);
6972 ssize_t
RGWBulkUploadOp::AlignedStreamGetter::get_exactly(const size_t want
,
6973 ceph::bufferlist
& dst
)
6975 const auto len
= DecoratedStreamGetter::get_exactly(want
, dst
);
6982 int RGWSetAttrs::verify_permission()
6984 // This looks to be part of the RGW-NFS machinery and has no S3 or
6985 // Swift equivalent.
6987 if (!s
->object
.empty()) {
6988 perm
= verify_object_permission_no_policy(this, s
, RGW_PERM_WRITE
);
6990 perm
= verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
);
6998 void RGWSetAttrs::pre_exec()
7000 rgw_bucket_object_pre_exec(s
);
7003 void RGWSetAttrs::execute()
7005 op_ret
= get_params();
7009 rgw_obj
obj(s
->bucket
, s
->object
);
7011 if (!s
->object
.empty()) {
7012 store
->set_atomic(s
->obj_ctx
, obj
);
7013 op_ret
= store
->set_attrs(s
->obj_ctx
, s
->bucket_info
, obj
, attrs
, nullptr);
7015 for (auto& iter
: attrs
) {
7016 s
->bucket_attrs
[iter
.first
] = std::move(iter
.second
);
7018 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, s
->bucket_attrs
,
7019 &s
->bucket_info
.objv_tracker
);
7023 void RGWGetObjLayout::pre_exec()
7025 rgw_bucket_object_pre_exec(s
);
7028 void RGWGetObjLayout::execute()
7030 rgw_obj
obj(s
->bucket
, s
->object
);
7031 RGWRados::Object
target(store
,
7033 *static_cast<RGWObjectCtx
*>(s
->obj_ctx
),
7034 rgw_obj(s
->bucket
, s
->object
));
7035 RGWRados::Object::Read
stat_op(&target
);
7037 op_ret
= stat_op
.prepare();
7042 head_obj
= stat_op
.state
.head_obj
;
7044 op_ret
= target
.get_manifest(&manifest
);
7048 int RGWConfigBucketMetaSearch::verify_permission()
7050 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
7057 void RGWConfigBucketMetaSearch::pre_exec()
7059 rgw_bucket_object_pre_exec(s
);
7062 void RGWConfigBucketMetaSearch::execute()
7064 op_ret
= get_params();
7066 ldpp_dout(this, 20) << "NOTICE: get_params() returned ret=" << op_ret
<< dendl
;
7070 s
->bucket_info
.mdsearch_config
= mdsearch_config
;
7072 op_ret
= store
->put_bucket_instance_info(s
->bucket_info
, false, real_time(), &s
->bucket_attrs
);
7074 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
7075 << " returned err=" << op_ret
<< dendl
;
7080 int RGWGetBucketMetaSearch::verify_permission()
7082 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
7089 void RGWGetBucketMetaSearch::pre_exec()
7091 rgw_bucket_object_pre_exec(s
);
7094 int RGWDelBucketMetaSearch::verify_permission()
7096 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
7103 void RGWDelBucketMetaSearch::pre_exec()
7105 rgw_bucket_object_pre_exec(s
);
7108 void RGWDelBucketMetaSearch::execute()
7110 s
->bucket_info
.mdsearch_config
.clear();
7112 op_ret
= store
->put_bucket_instance_info(s
->bucket_info
, false, real_time(), &s
->bucket_attrs
);
7114 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
7115 << " returned err=" << op_ret
<< dendl
;
7121 RGWHandler::~RGWHandler()
7125 int RGWHandler::init(RGWRados
*_store
,
7126 struct req_state
*_s
,
7127 rgw::io::BasicClient
*cio
)
7135 int RGWHandler::do_init_permissions()
7137 int ret
= rgw_build_bucket_policies(store
, s
);
7139 ldpp_dout(s
, 10) << "init_permissions on " << s
->bucket
7140 << " failed, ret=" << ret
<< dendl
;
7141 return ret
==-ENODATA
? -EACCES
: ret
;
7144 rgw_build_iam_environment(store
, s
);
7148 int RGWHandler::do_read_permissions(RGWOp
*op
, bool only_bucket
)
7151 /* already read bucket info */
7154 int ret
= rgw_build_object_policies(store
, s
, op
->prefetch_data());
7157 ldpp_dout(op
, 10) << "read_permissions on " << s
->bucket
<< ":"
7158 << s
->object
<< " only_bucket=" << only_bucket
7159 << " ret=" << ret
<< dendl
;
7160 if (ret
== -ENODATA
)
7167 int RGWOp::error_handler(int err_no
, string
*error_content
) {
7168 return dialect_handler
->error_handler(err_no
, error_content
);
7171 int RGWHandler::error_handler(int err_no
, string
*error_content
) {
7172 // This is the do-nothing error handler
7176 std::ostream
& RGWOp::gen_prefix(std::ostream
& out
) const
7178 // append <dialect>:<op name> to the prefix
7179 return s
->gen_prefix(out
) << s
->dialect
<< ':' << name() << ' ';
7182 void RGWDefaultResponseOp::send_response() {
7184 set_req_state_err(s
, op_ret
);
7190 void RGWPutBucketPolicy::send_response()
7193 set_req_state_err(s
, op_ret
);
7199 int RGWPutBucketPolicy::verify_permission()
7201 if (!verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketPolicy
)) {
7208 int RGWPutBucketPolicy::get_params()
7210 const auto max_size
= s
->cct
->_conf
->rgw_max_put_param_size
;
7211 // At some point when I have more time I want to make a version of
7212 // rgw_rest_read_all_input that doesn't use malloc.
7213 std::tie(op_ret
, data
) = rgw_rest_read_all_input(s
, max_size
, false);
7215 // And throws exceptions.
7219 void RGWPutBucketPolicy::execute()
7221 op_ret
= get_params();
7226 if (!store
->svc
.zone
->is_meta_master()) {
7227 op_ret
= forward_request_to_master(s
, NULL
, store
, data
, nullptr);
7229 ldpp_dout(this, 20) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
7235 const Policy
p(s
->cct
, s
->bucket_tenant
, data
);
7236 op_ret
= retry_raced_bucket_write(store
, s
, [&p
, this] {
7237 auto attrs
= s
->bucket_attrs
;
7238 attrs
[RGW_ATTR_IAM_POLICY
].clear();
7239 attrs
[RGW_ATTR_IAM_POLICY
].append(p
.text
);
7240 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
,
7241 &s
->bucket_info
.objv_tracker
);
7244 } catch (rgw::IAM::PolicyParseException
& e
) {
7245 ldpp_dout(this, 20) << "failed to parse policy: " << e
.what() << dendl
;
7250 void RGWGetBucketPolicy::send_response()
7253 set_req_state_err(s
, op_ret
);
7256 end_header(s
, this, "application/json");
7257 dump_body(s
, policy
);
7260 int RGWGetBucketPolicy::verify_permission()
7262 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketPolicy
)) {
7269 void RGWGetBucketPolicy::execute()
7271 auto attrs
= s
->bucket_attrs
;
7272 map
<string
, bufferlist
>::iterator aiter
= attrs
.find(RGW_ATTR_IAM_POLICY
);
7273 if (aiter
== attrs
.end()) {
7274 ldpp_dout(this, 0) << "can't find bucket IAM POLICY attr bucket_name = "
7275 << s
->bucket_name
<< dendl
;
7276 op_ret
= -ERR_NO_SUCH_BUCKET_POLICY
;
7277 s
->err
.message
= "The bucket policy does not exist";
7280 policy
= attrs
[RGW_ATTR_IAM_POLICY
];
7282 if (policy
.length() == 0) {
7283 ldpp_dout(this, 10) << "The bucket policy does not exist, bucket: "
7284 << s
->bucket_name
<< dendl
;
7285 op_ret
= -ERR_NO_SUCH_BUCKET_POLICY
;
7286 s
->err
.message
= "The bucket policy does not exist";
7292 void RGWDeleteBucketPolicy::send_response()
7295 set_req_state_err(s
, op_ret
);
7301 int RGWDeleteBucketPolicy::verify_permission()
7303 if (!verify_bucket_permission(this, s
, rgw::IAM::s3DeleteBucketPolicy
)) {
7310 void RGWDeleteBucketPolicy::execute()
7312 op_ret
= retry_raced_bucket_write(store
, s
, [this] {
7313 auto attrs
= s
->bucket_attrs
;
7314 attrs
.erase(RGW_ATTR_IAM_POLICY
);
7315 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
,
7316 &s
->bucket_info
.objv_tracker
);
7321 void RGWGetClusterStat::execute()
7323 op_ret
= this->store
->get_rados_handle()->cluster_stat(stats_op
);