1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
2 // vim: ts=8 sw=2 smarttab ft=cpp
6 #include <system_error>
10 #include <string_view>
12 #include <boost/algorithm/string/predicate.hpp>
13 #include <boost/optional.hpp>
14 #include <boost/utility/in_place_factory.hpp>
16 #include "include/scope_guard.h"
17 #include "common/Clock.h"
18 #include "common/armor.h"
19 #include "common/errno.h"
20 #include "common/mime.h"
21 #include "common/utf8.h"
22 #include "common/ceph_json.h"
23 #include "common/static_ptr.h"
24 #include "rgw_tracer.h"
26 #include "rgw_rados.h"
31 #include "rgw_acl_s3.h"
32 #include "rgw_acl_swift.h"
33 #include "rgw_aio_throttle.h"
35 #include "rgw_bucket.h"
37 #include "rgw_multi.h"
38 #include "rgw_multi_del.h"
40 #include "rgw_cors_s3.h"
41 #include "rgw_rest_conn.h"
42 #include "rgw_rest_s3.h"
44 #include "rgw_client_io.h"
45 #include "rgw_compression.h"
47 #include "rgw_tag_s3.h"
48 #include "rgw_putobj_processor.h"
49 #include "rgw_crypt.h"
50 #include "rgw_perf_counters.h"
51 #include "rgw_notify.h"
52 #include "rgw_notify_event_type.h"
54 #include "rgw_sal_rados.h"
56 #include "services/svc_zone.h"
57 #include "services/svc_quota.h"
58 #include "services/svc_sys_obj.h"
60 #include "cls/lock/cls_lock_client.h"
61 #include "cls/rgw/cls_rgw_client.h"
64 #include "include/ceph_assert.h"
66 #include "compressor/Compressor.h"
69 #define TRACEPOINT_DEFINE
70 #define TRACEPOINT_PROBE_DYNAMIC_LINKAGE
71 #include "tracing/rgw_op.h"
72 #undef TRACEPOINT_PROBE_DYNAMIC_LINKAGE
73 #undef TRACEPOINT_DEFINE
75 #define tracepoint(...)
78 #define dout_context g_ceph_context
79 #define dout_subsys ceph_subsys_rgw
82 using namespace librados
;
83 using ceph::crypto::MD5
;
84 using boost::optional
;
88 using rgw::IAM::Effect
;
89 using rgw::IAM::Policy
;
91 static string mp_ns
= RGW_OBJ_NS_MULTIPART
;
92 static string shadow_ns
= RGW_OBJ_NS_SHADOW
;
94 static void forward_req_info(const DoutPrefixProvider
*dpp
, CephContext
*cct
, req_info
& info
, const std::string
& bucket_name
);
96 static MultipartMetaFilter mp_filter
;
98 // this probably should belong in the rgw_iam_policy_keywords, I'll get it to it
100 static constexpr auto S3_EXISTING_OBJTAG
= "s3:ExistingObjectTag";
101 static constexpr auto S3_RESOURCE_TAG
= "s3:ResourceTag";
102 static constexpr auto S3_RUNTIME_RESOURCE_VAL
= "${s3:ResourceTag";
104 int RGWGetObj::parse_range(void)
107 string
rs(range_str
);
111 ignore_invalid_range
= s
->cct
->_conf
->rgw_ignore_get_invalid_range
;
112 partial_content
= false;
114 size_t pos
= rs
.find("bytes=");
115 if (pos
== string::npos
) {
117 while (isspace(rs
[pos
]))
120 while (isalpha(rs
[end
]))
122 if (strncasecmp(rs
.c_str(), "bytes", end
- pos
) != 0)
124 while (isspace(rs
[end
]))
128 rs
= rs
.substr(end
+ 1);
130 rs
= rs
.substr(pos
+ 6); /* size of("bytes=") */
133 if (pos
== string::npos
)
136 partial_content
= true;
138 ofs_str
= rs
.substr(0, pos
);
139 end_str
= rs
.substr(pos
+ 1);
140 if (end_str
.length()) {
141 end
= atoll(end_str
.c_str());
146 if (ofs_str
.length()) {
147 ofs
= atoll(ofs_str
.c_str());
148 } else { // RFC2616 suffix-byte-range-spec
153 if (end
>= 0 && end
< ofs
)
160 if (ignore_invalid_range
) {
161 partial_content
= false;
164 range_parsed
= false; // allow retry
171 static int decode_policy(const DoutPrefixProvider
*dpp
,
174 RGWAccessControlPolicy
*policy
)
176 auto iter
= bl
.cbegin();
178 policy
->decode(iter
);
179 } catch (buffer::error
& err
) {
180 ldpp_dout(dpp
, 0) << "ERROR: could not decode policy, caught buffer::error" << dendl
;
183 if (cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
184 ldpp_dout(dpp
, 15) << __func__
<< " Read AccessControlPolicy";
185 RGWAccessControlPolicy_S3
*s3policy
= static_cast<RGWAccessControlPolicy_S3
*>(policy
);
186 s3policy
->to_xml(*_dout
);
193 static int get_user_policy_from_attr(const DoutPrefixProvider
*dpp
,
194 CephContext
* const cct
,
195 map
<string
, bufferlist
>& attrs
,
196 RGWAccessControlPolicy
& policy
/* out */)
198 auto aiter
= attrs
.find(RGW_ATTR_ACL
);
199 if (aiter
!= attrs
.end()) {
200 int ret
= decode_policy(dpp
, cct
, aiter
->second
, &policy
);
212 * Get the AccessControlPolicy for an object off of disk.
213 * policy: must point to a valid RGWACL, and will be filled upon return.
214 * bucket: name of the bucket containing the object.
215 * object: name of the object to get the ACL for.
216 * Returns: 0 on success, -ERR# otherwise.
218 int rgw_op_get_bucket_policy_from_attr(const DoutPrefixProvider
*dpp
,
220 rgw::sal::Store
* store
,
221 RGWBucketInfo
& bucket_info
,
222 map
<string
, bufferlist
>& bucket_attrs
,
223 RGWAccessControlPolicy
*policy
,
226 map
<string
, bufferlist
>::iterator aiter
= bucket_attrs
.find(RGW_ATTR_ACL
);
228 if (aiter
!= bucket_attrs
.end()) {
229 int ret
= decode_policy(dpp
, cct
, aiter
->second
, policy
);
233 ldpp_dout(dpp
, 0) << "WARNING: couldn't find acl header for bucket, generating default" << dendl
;
234 std::unique_ptr
<rgw::sal::User
> user
= store
->get_user(bucket_info
.owner
);
235 /* object exists, but policy is broken */
236 int r
= user
->load_user(dpp
, y
);
240 policy
->create_default(bucket_info
.owner
, user
->get_display_name());
245 static int get_obj_policy_from_attr(const DoutPrefixProvider
*dpp
,
247 rgw::sal::Store
* store
,
248 RGWObjectCtx
& obj_ctx
,
249 RGWBucketInfo
& bucket_info
,
250 map
<string
, bufferlist
>& bucket_attrs
,
251 RGWAccessControlPolicy
*policy
,
252 string
*storage_class
,
253 rgw::sal::Object
* obj
,
259 std::unique_ptr
<rgw::sal::Object::ReadOp
> rop
= obj
->get_read_op(&obj_ctx
);
261 ret
= rop
->get_attr(dpp
, RGW_ATTR_ACL
, bl
, y
);
263 ret
= decode_policy(dpp
, cct
, bl
, policy
);
266 } else if (ret
== -ENODATA
) {
267 /* object exists, but policy is broken */
268 ldpp_dout(dpp
, 0) << "WARNING: couldn't find acl header for object, generating default" << dendl
;
269 std::unique_ptr
<rgw::sal::User
> user
= store
->get_user(bucket_info
.owner
);
270 ret
= user
->load_user(dpp
, y
);
274 policy
->create_default(bucket_info
.owner
, user
->get_display_name());
279 int r
= rop
->get_attr(dpp
, RGW_ATTR_STORAGE_CLASS
, scbl
, y
);
281 *storage_class
= scbl
.to_str();
283 storage_class
->clear();
291 static boost::optional
<Policy
> get_iam_policy_from_attr(CephContext
* cct
,
292 map
<string
, bufferlist
>& attrs
,
293 const string
& tenant
) {
294 auto i
= attrs
.find(RGW_ATTR_IAM_POLICY
);
295 if (i
!= attrs
.end()) {
296 return Policy(cct
, tenant
, i
->second
);
302 static boost::optional
<PublicAccessBlockConfiguration
>
303 get_public_access_conf_from_attr(const map
<string
, bufferlist
>& attrs
)
305 if (auto aiter
= attrs
.find(RGW_ATTR_PUBLIC_ACCESS
);
306 aiter
!= attrs
.end()) {
307 bufferlist::const_iterator iter
{&aiter
->second
};
308 PublicAccessBlockConfiguration access_conf
;
310 access_conf
.decode(iter
);
311 } catch (const buffer::error
& e
) {
319 vector
<Policy
> get_iam_user_policy_from_attr(CephContext
* cct
,
320 map
<string
, bufferlist
>& attrs
,
321 const string
& tenant
) {
322 vector
<Policy
> policies
;
323 if (auto it
= attrs
.find(RGW_ATTR_USER_POLICY
); it
!= attrs
.end()) {
324 bufferlist out_bl
= attrs
[RGW_ATTR_USER_POLICY
];
325 map
<string
, string
> policy_map
;
326 decode(policy_map
, out_bl
);
327 for (auto& it
: policy_map
) {
328 bufferlist bl
= bufferlist::static_from_string(it
.second
);
329 Policy
p(cct
, tenant
, bl
);
330 policies
.push_back(std::move(p
));
336 static int read_bucket_policy(const DoutPrefixProvider
*dpp
,
337 rgw::sal::Store
* store
,
339 RGWBucketInfo
& bucket_info
,
340 map
<string
, bufferlist
>& bucket_attrs
,
341 RGWAccessControlPolicy
*policy
,
345 if (!s
->system_request
&& bucket_info
.flags
& BUCKET_SUSPENDED
) {
346 ldpp_dout(dpp
, 0) << "NOTICE: bucket " << bucket_info
.bucket
.name
347 << " is suspended" << dendl
;
348 return -ERR_USER_SUSPENDED
;
351 if (bucket
.name
.empty()) {
355 int ret
= rgw_op_get_bucket_policy_from_attr(dpp
, s
->cct
, store
, bucket_info
, bucket_attrs
, policy
, y
);
356 if (ret
== -ENOENT
) {
357 ret
= -ERR_NO_SUCH_BUCKET
;
363 static int read_obj_policy(const DoutPrefixProvider
*dpp
,
364 rgw::sal::Store
* store
,
366 RGWBucketInfo
& bucket_info
,
367 map
<string
, bufferlist
>& bucket_attrs
,
368 RGWAccessControlPolicy
* acl
,
369 string
*storage_class
,
370 boost::optional
<Policy
>& policy
,
371 rgw::sal::Bucket
* bucket
,
372 rgw::sal::Object
* object
,
377 upload_id
= s
->info
.args
.get("uploadId");
378 std::unique_ptr
<rgw::sal::Object
> mpobj
;
381 if (!s
->system_request
&& bucket_info
.flags
& BUCKET_SUSPENDED
) {
382 ldpp_dout(dpp
, 0) << "NOTICE: bucket " << bucket_info
.bucket
.name
383 << " is suspended" << dendl
;
384 return -ERR_USER_SUSPENDED
;
387 // when getting policy info for copy-source obj, upload_id makes no sense.
388 // 'copy_src' is used to make this function backward compatible.
389 if (!upload_id
.empty() && !copy_src
) {
390 /* multipart upload */
391 std::unique_ptr
<rgw::sal::MultipartUpload
> upload
;
392 upload
= bucket
->get_multipart_upload(object
->get_name(), upload_id
);
393 mpobj
= upload
->get_meta_obj();
394 mpobj
->set_in_extra_data(true);
395 object
= mpobj
.get();
397 policy
= get_iam_policy_from_attr(s
->cct
, bucket_attrs
, bucket
->get_tenant());
399 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
400 int ret
= get_obj_policy_from_attr(dpp
, s
->cct
, store
, *obj_ctx
,
401 bucket_info
, bucket_attrs
, acl
, storage_class
, object
, s
->yield
);
402 if (ret
== -ENOENT
) {
403 /* object does not exist checking the bucket's ACL to make sure
404 that we send a proper error code */
405 RGWAccessControlPolicy
bucket_policy(s
->cct
);
406 ret
= rgw_op_get_bucket_policy_from_attr(dpp
, s
->cct
, store
, bucket_info
, bucket_attrs
, &bucket_policy
, y
);
410 const rgw_user
& bucket_owner
= bucket_policy
.get_owner().get_id();
411 if (bucket_owner
.compare(s
->user
->get_id()) != 0 &&
412 ! s
->auth
.identity
->is_admin_of(bucket_owner
)) {
413 auto r
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
414 rgw::IAM::s3ListBucket
, ARN(bucket
->get_key()));
415 if (r
== Effect::Allow
)
417 if (r
== Effect::Deny
)
420 ARN
b_arn(bucket
->get_key());
421 r
= policy
->eval(s
->env
, *s
->auth
.identity
, rgw::IAM::s3ListBucket
, b_arn
);
422 if (r
== Effect::Allow
)
424 if (r
== Effect::Deny
)
427 if (! s
->session_policies
.empty()) {
428 r
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
429 rgw::IAM::s3ListBucket
, ARN(bucket
->get_key()));
430 if (r
== Effect::Allow
)
432 if (r
== Effect::Deny
)
435 if (! bucket_policy
.verify_permission(s
, *s
->auth
.identity
, s
->perm_mask
, RGW_PERM_READ
))
448 * Get the AccessControlPolicy for an user, bucket or object off of disk.
449 * s: The req_state to draw information from.
450 * only_bucket: If true, reads the user and bucket ACLs rather than the object ACL.
451 * Returns: 0 on success, -ERR# otherwise.
453 int rgw_build_bucket_policies(const DoutPrefixProvider
*dpp
, rgw::sal::Store
* store
, struct req_state
* s
, optional_yield y
)
457 string bi
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"bucket-instance");
459 // note: overwrites s->bucket_name, may include a tenant/
460 ret
= rgw_bucket_parse_bucket_instance(bi
, &s
->bucket_name
, &s
->bucket_instance_id
, &s
->bucket_instance_shard_id
);
466 if(s
->dialect
.compare("s3") == 0) {
467 s
->bucket_acl
= std::make_unique
<RGWAccessControlPolicy_S3
>(s
->cct
);
468 } else if(s
->dialect
.compare("swift") == 0) {
469 /* We aren't allocating the account policy for those operations using
470 * the Swift's infrastructure that don't really need req_state::user.
471 * Typical example here is the implementation of /info. */
472 if (!s
->user
->get_id().empty()) {
473 s
->user_acl
= std::make_unique
<RGWAccessControlPolicy_SWIFTAcct
>(s
->cct
);
475 s
->bucket_acl
= std::make_unique
<RGWAccessControlPolicy_SWIFT
>(s
->cct
);
477 s
->bucket_acl
= std::make_unique
<RGWAccessControlPolicy
>(s
->cct
);
480 /* check if copy source is within the current domain */
481 if (!s
->src_bucket_name
.empty()) {
482 std::unique_ptr
<rgw::sal::Bucket
> src_bucket
;
483 ret
= store
->get_bucket(dpp
, nullptr,
484 rgw_bucket(s
->src_tenant_name
,
486 s
->bucket_instance_id
),
489 string
& zonegroup
= src_bucket
->get_info().zonegroup
;
490 s
->local_source
= store
->get_zone()->get_zonegroup().equals(zonegroup
);
496 std::string display_name
;
499 s
->user
->get_display_name(),
502 if (!s
->bucket_name
.empty()) {
503 s
->bucket_exists
= true;
505 /* This is the only place that s->bucket is created. It should never be
507 ret
= store
->get_bucket(dpp
, s
->user
.get(), rgw_bucket(rgw_bucket_key(s
->bucket_tenant
, s
->bucket_name
, s
->bucket_instance_id
)), &s
->bucket
, y
);
509 if (ret
!= -ENOENT
) {
511 bucket_log
= rgw_make_bucket_entry_name(s
->bucket_tenant
, s
->bucket_name
);
512 ldpp_dout(dpp
, 0) << "NOTICE: couldn't get bucket from bucket_name (name="
513 << bucket_log
<< ")" << dendl
;
516 s
->bucket_exists
= false;
517 return -ERR_NO_SUCH_BUCKET
;
519 if (!rgw::sal::Object::empty(s
->object
.get())) {
520 s
->object
->set_bucket(s
->bucket
.get());
523 s
->bucket_mtime
= s
->bucket
->get_modification_time();
524 s
->bucket_attrs
= s
->bucket
->get_attrs();
525 ret
= read_bucket_policy(dpp
, store
, s
, s
->bucket
->get_info(),
526 s
->bucket
->get_attrs(),
527 s
->bucket_acl
.get(), s
->bucket
->get_key(), y
);
529 s
->bucket
->get_info().owner
,
530 s
->bucket_acl
->get_owner().get_display_name(),
533 s
->bucket_owner
= s
->bucket_acl
->get_owner();
535 RGWZoneGroup zonegroup
;
536 int r
= store
->get_zone()->get_zonegroup(s
->bucket
->get_info().zonegroup
, zonegroup
);
538 if (!zonegroup
.endpoints
.empty()) {
539 s
->zonegroup_endpoint
= zonegroup
.endpoints
.front();
541 // use zonegroup's master zone endpoints
542 auto z
= zonegroup
.zones
.find(zonegroup
.master_zone
);
543 if (z
!= zonegroup
.zones
.end() && !z
->second
.endpoints
.empty()) {
544 s
->zonegroup_endpoint
= z
->second
.endpoints
.front();
547 s
->zonegroup_name
= zonegroup
.get_name();
549 if (r
< 0 && ret
== 0) {
553 if (!store
->get_zone()->get_zonegroup().equals(s
->bucket
->get_info().zonegroup
)) {
554 ldpp_dout(dpp
, 0) << "NOTICE: request for data in a different zonegroup ("
555 << s
->bucket
->get_info().zonegroup
<< " != "
556 << store
->get_zone()->get_zonegroup().get_id() << ")" << dendl
;
557 /* we now need to make sure that the operation actually requires copy source, that is
558 * it's a copy operation
560 if (store
->get_zone()->get_zonegroup().is_master_zonegroup() && s
->system_request
) {
561 /*If this is the master, don't redirect*/
562 } else if (s
->op_type
== RGW_OP_GET_BUCKET_LOCATION
) {
563 /* If op is get bucket location, don't redirect */
564 } else if (!s
->local_source
||
565 (s
->op
!= OP_PUT
&& s
->op
!= OP_COPY
) ||
566 rgw::sal::Object::empty(s
->object
.get())) {
567 return -ERR_PERMANENT_REDIRECT
;
571 /* init dest placement */
572 s
->dest_placement
.storage_class
= s
->info
.storage_class
;
573 s
->dest_placement
.inherit_from(s
->bucket
->get_placement_rule());
575 if (!store
->get_zone()->get_params().valid_placement(s
->dest_placement
)) {
576 ldpp_dout(dpp
, 0) << "NOTICE: invalid dest placement: " << s
->dest_placement
.to_str() << dendl
;
580 s
->bucket_access_conf
= get_public_access_conf_from_attr(s
->bucket
->get_attrs());
583 /* handle user ACL only for those APIs which support it */
585 std::unique_ptr
<rgw::sal::User
> acl_user
= store
->get_user(acct_acl_user
.uid
);
587 ret
= acl_user
->read_attrs(dpp
, y
);
589 ret
= get_user_policy_from_attr(dpp
, s
->cct
, acl_user
->get_attrs(), *s
->user_acl
);
591 if (-ENOENT
== ret
) {
592 /* In already existing clusters users won't have ACL. In such case
593 * assuming that only account owner has the rights seems to be
594 * reasonable. That allows to have only one verification logic.
595 * NOTE: there is small compatibility kludge for global, empty tenant:
596 * 1. if we try to reach an existing bucket, its owner is considered
598 * 2. otherwise account owner is identity stored in s->user->user_id. */
599 s
->user_acl
->create_default(acct_acl_user
.uid
,
600 acct_acl_user
.display_name
);
602 } else if (ret
< 0) {
603 ldpp_dout(dpp
, 0) << "NOTICE: couldn't get user attrs for handling ACL "
604 "(user_id=" << s
->user
->get_id() << ", ret=" << ret
<< ")" << dendl
;
608 // We don't need user policies in case of STS token returned by AssumeRole,
609 // hence the check for user type
610 if (! s
->user
->get_id().empty() && s
->auth
.identity
->get_identity_type() != TYPE_ROLE
) {
612 ret
= s
->user
->read_attrs(dpp
, y
);
614 auto user_policies
= get_iam_user_policy_from_attr(s
->cct
,
615 s
->user
->get_attrs(),
616 s
->user
->get_tenant());
617 s
->iam_user_policies
.insert(s
->iam_user_policies
.end(),
618 std::make_move_iterator(user_policies
.begin()),
619 std::make_move_iterator(user_policies
.end()));
625 } catch (const std::exception
& e
) {
626 ldpp_dout(dpp
, -1) << "Error reading IAM User Policy: " << e
.what() << dendl
;
632 s
->iam_policy
= get_iam_policy_from_attr(s
->cct
, s
->bucket_attrs
, s
->bucket_tenant
);
633 } catch (const std::exception
& e
) {
634 // Really this is a can't happen condition. We parse the policy
635 // when it's given to us, so perhaps we should abort or otherwise
636 // raise bloody murder.
637 ldpp_dout(dpp
, 0) << "Error reading IAM Policy: " << e
.what() << dendl
;
641 bool success
= store
->get_zone()->get_redirect_endpoint(&s
->redirect_zone_endpoint
);
643 ldpp_dout(dpp
, 20) << "redirect_zone_endpoint=" << s
->redirect_zone_endpoint
<< dendl
;
650 * Get the AccessControlPolicy for a bucket or object off of disk.
651 * s: The req_state to draw information from.
652 * only_bucket: If true, reads the bucket ACL rather than the object ACL.
653 * Returns: 0 on success, -ERR# otherwise.
655 int rgw_build_object_policies(const DoutPrefixProvider
*dpp
, rgw::sal::Store
* store
,
656 struct req_state
*s
, bool prefetch_data
, optional_yield y
)
660 if (!rgw::sal::Object::empty(s
->object
.get())) {
661 if (!s
->bucket_exists
) {
662 return -ERR_NO_SUCH_BUCKET
;
664 s
->object_acl
= std::make_unique
<RGWAccessControlPolicy
>(s
->cct
);
666 s
->object
->set_atomic(s
->obj_ctx
);
668 s
->object
->set_prefetch_data(s
->obj_ctx
);
670 ret
= read_obj_policy(dpp
, store
, s
, s
->bucket
->get_info(), s
->bucket_attrs
,
671 s
->object_acl
.get(), nullptr, s
->iam_policy
, s
->bucket
.get(),
678 static int rgw_iam_remove_objtags(const DoutPrefixProvider
*dpp
, struct req_state
* s
, rgw::sal::Object
* object
, bool has_existing_obj_tag
, bool has_resource_tag
) {
679 object
->set_atomic(s
->obj_ctx
);
680 int op_ret
= object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, dpp
);
683 rgw::sal::Attrs attrs
= object
->get_attrs();
684 auto tags
= attrs
.find(RGW_ATTR_TAGS
);
685 if (tags
!= attrs
.end()) {
688 auto bliter
= tags
->second
.cbegin();
689 tagset
.decode(bliter
);
690 } catch (buffer::error
& err
) {
691 ldpp_dout(s
, 0) << "ERROR: caught buffer::error, couldn't decode TagSet" << dendl
;
694 for (auto& tag
: tagset
.get_tags()) {
695 if (has_existing_obj_tag
) {
696 vector
<std::unordered_multimap
<string
, string
>::iterator
> iters
;
697 string key
= "s3:ExistingObjectTag/" + tag
.first
;
698 auto result
= s
->env
.equal_range(key
);
699 for (auto& it
= result
.first
; it
!= result
.second
; ++it
)
701 if (tag
.second
== it
->second
) {
702 iters
.emplace_back(it
);
705 for (auto& it
: iters
) {
708 }//end if has_existing_obj_tag
709 if (has_resource_tag
) {
710 vector
<std::unordered_multimap
<string
, string
>::iterator
> iters
;
711 string key
= "s3:ResourceTag/" + tag
.first
;
712 auto result
= s
->env
.equal_range(key
);
713 for (auto& it
= result
.first
; it
!= result
.second
; ++it
)
715 if (tag
.second
== it
->second
) {
716 iters
.emplace_back(it
);
719 for (auto& it
: iters
) {
722 }//end if has_resource_tag
728 void rgw_add_to_iam_environment(rgw::IAM::Environment
& e
, std::string_view key
, std::string_view val
){
729 // This variant just adds non empty key pairs to IAM env., values can be empty
730 // in certain cases like tagging
735 static int rgw_iam_add_tags_from_bl(struct req_state
* s
, bufferlist
& bl
, bool has_existing_obj_tag
=false, bool has_resource_tag
=false){
736 RGWObjTags
& tagset
= s
->tagset
;
738 auto bliter
= bl
.cbegin();
739 tagset
.decode(bliter
);
740 } catch (buffer::error
& err
) {
741 ldpp_dout(s
, 0) << "ERROR: caught buffer::error, couldn't decode TagSet" << dendl
;
745 for (const auto& tag
: tagset
.get_tags()){
746 if (has_existing_obj_tag
)
747 rgw_add_to_iam_environment(s
->env
, "s3:ExistingObjectTag/" + tag
.first
, tag
.second
);
748 if (has_resource_tag
)
749 rgw_add_to_iam_environment(s
->env
, "s3:ResourceTag/" + tag
.first
, tag
.second
);
754 static int rgw_iam_add_objtags(const DoutPrefixProvider
*dpp
, struct req_state
* s
, rgw::sal::Object
* object
, bool has_existing_obj_tag
, bool has_resource_tag
) {
755 object
->set_atomic(s
->obj_ctx
);
756 int op_ret
= object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, dpp
);
759 rgw::sal::Attrs attrs
= object
->get_attrs();
760 auto tags
= attrs
.find(RGW_ATTR_TAGS
);
761 if (tags
!= attrs
.end()){
762 return rgw_iam_add_tags_from_bl(s
, tags
->second
, has_existing_obj_tag
, has_resource_tag
);
767 static int rgw_iam_add_objtags(const DoutPrefixProvider
*dpp
, struct req_state
* s
, bool has_existing_obj_tag
, bool has_resource_tag
) {
768 if (!rgw::sal::Object::empty(s
->object
.get())) {
769 return rgw_iam_add_objtags(dpp
, s
, s
->object
.get(), has_existing_obj_tag
, has_resource_tag
);
774 static int rgw_iam_add_buckettags(const DoutPrefixProvider
*dpp
, struct req_state
* s
, rgw::sal::Bucket
* bucket
) {
775 rgw::sal::Attrs attrs
= bucket
->get_attrs();
776 auto tags
= attrs
.find(RGW_ATTR_TAGS
);
777 if (tags
!= attrs
.end()) {
778 return rgw_iam_add_tags_from_bl(s
, tags
->second
, false, true);
783 static int rgw_iam_add_buckettags(const DoutPrefixProvider
*dpp
, struct req_state
* s
) {
784 return rgw_iam_add_buckettags(dpp
, s
, s
->bucket
.get());
787 static std::tuple
<bool, bool> rgw_check_policy_condition(const DoutPrefixProvider
*dpp
,
788 boost::optional
<rgw::IAM::Policy
> iam_policy
,
789 boost::optional
<vector
<rgw::IAM::Policy
>> identity_policies
,
790 boost::optional
<vector
<rgw::IAM::Policy
>> session_policies
,
791 bool check_obj_exist_tag
=true) {
792 bool has_existing_obj_tag
= false, has_resource_tag
= false;
793 bool iam_policy_s3_exist_tag
= false, iam_policy_s3_resource_tag
= false;
795 if (check_obj_exist_tag
) {
796 iam_policy_s3_exist_tag
= iam_policy
->has_partial_conditional(S3_EXISTING_OBJTAG
);
798 iam_policy_s3_resource_tag
= iam_policy
->has_partial_conditional(S3_RESOURCE_TAG
) || iam_policy
->has_partial_conditional_value(S3_RUNTIME_RESOURCE_VAL
);
801 bool identity_policy_s3_exist_tag
= false, identity_policy_s3_resource_tag
= false;
802 if (identity_policies
) {
803 for (auto& identity_policy
: identity_policies
.get()) {
804 if (check_obj_exist_tag
) {
805 if (identity_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
))
806 identity_policy_s3_exist_tag
= true;
808 if (identity_policy
.has_partial_conditional(S3_RESOURCE_TAG
) || identity_policy
.has_partial_conditional_value(S3_RUNTIME_RESOURCE_VAL
))
809 identity_policy_s3_resource_tag
= true;
810 if (identity_policy_s3_exist_tag
&& identity_policy_s3_resource_tag
) // check all policies till both are set to true
815 bool session_policy_s3_exist_tag
= false, session_policy_s3_resource_flag
= false;
816 if (session_policies
) {
817 for (auto& session_policy
: session_policies
.get()) {
818 if (check_obj_exist_tag
) {
819 if (session_policy
.has_partial_conditional(S3_EXISTING_OBJTAG
))
820 session_policy_s3_exist_tag
= true;
822 if (session_policy
.has_partial_conditional(S3_RESOURCE_TAG
) || session_policy
.has_partial_conditional_value(S3_RUNTIME_RESOURCE_VAL
))
823 session_policy_s3_resource_flag
= true;
824 if (session_policy_s3_exist_tag
&& session_policy_s3_resource_flag
)
829 has_existing_obj_tag
= iam_policy_s3_exist_tag
|| identity_policy_s3_exist_tag
|| session_policy_s3_exist_tag
;
830 has_resource_tag
= iam_policy_s3_resource_tag
|| identity_policy_s3_resource_tag
|| session_policy_s3_resource_flag
;
831 return make_tuple(has_existing_obj_tag
, has_resource_tag
);
834 static std::tuple
<bool, bool> rgw_check_policy_condition(const DoutPrefixProvider
*dpp
, struct req_state
* s
, bool check_obj_exist_tag
=true) {
835 return rgw_check_policy_condition(dpp
, s
->iam_policy
, s
->iam_user_policies
, s
->session_policies
, check_obj_exist_tag
);
838 static void rgw_add_grant_to_iam_environment(rgw::IAM::Environment
& e
, struct req_state
*s
){
840 using header_pair_t
= std::pair
<const char*, const char*>;
841 static const std::initializer_list
<header_pair_t
> acl_header_conditionals
{
842 {"HTTP_X_AMZ_GRANT_READ", "s3:x-amz-grant-read"},
843 {"HTTP_X_AMZ_GRANT_WRITE", "s3:x-amz-grant-write"},
844 {"HTTP_X_AMZ_GRANT_READ_ACP", "s3:x-amz-grant-read-acp"},
845 {"HTTP_X_AMZ_GRANT_WRITE_ACP", "s3:x-amz-grant-write-acp"},
846 {"HTTP_X_AMZ_GRANT_FULL_CONTROL", "s3:x-amz-grant-full-control"}
849 if (s
->has_acl_header
){
850 for (const auto& c
: acl_header_conditionals
){
851 auto hdr
= s
->info
.env
->get(c
.first
);
853 e
.emplace(c
.second
, hdr
);
859 void rgw_build_iam_environment(rgw::sal::Store
* store
,
862 const auto& m
= s
->info
.env
->get_map();
863 auto t
= ceph::real_clock::now();
864 s
->env
.emplace("aws:CurrentTime", std::to_string(ceph::real_clock::to_time_t(t
)));
865 s
->env
.emplace("aws:EpochTime", ceph::to_iso_8601(t
));
866 // TODO: This is fine for now, but once we have STS we'll need to
867 // look and see. Also this won't work with the IdentityApplier
868 // model, since we need to know the actual credential.
869 s
->env
.emplace("aws:PrincipalType", "User");
871 auto i
= m
.find("HTTP_REFERER");
873 s
->env
.emplace("aws:Referer", i
->second
);
876 if (rgw_transport_is_secure(s
->cct
, *s
->info
.env
)) {
877 s
->env
.emplace("aws:SecureTransport", "true");
880 const auto remote_addr_param
= s
->cct
->_conf
->rgw_remote_addr_param
;
881 if (remote_addr_param
.length()) {
882 i
= m
.find(remote_addr_param
);
884 i
= m
.find("REMOTE_ADDR");
887 const string
* ip
= &(i
->second
);
889 if (remote_addr_param
== "HTTP_X_FORWARDED_FOR") {
890 const auto comma
= ip
->find(',');
891 if (comma
!= string::npos
) {
892 temp
.assign(*ip
, 0, comma
);
896 s
->env
.emplace("aws:SourceIp", *ip
);
899 i
= m
.find("HTTP_USER_AGENT"); {
901 s
->env
.emplace("aws:UserAgent", i
->second
);
905 // What to do about aws::userid? One can have multiple access
906 // keys so that isn't really suitable. Do we have a durable
907 // identifier that can persist through name changes?
908 s
->env
.emplace("aws:username", s
->user
->get_id().id
);
911 i
= m
.find("HTTP_X_AMZ_SECURITY_TOKEN");
913 s
->env
.emplace("sts:authentication", "true");
915 s
->env
.emplace("sts:authentication", "false");
919 void rgw_bucket_object_pre_exec(struct req_state
*s
)
924 dump_bucket_from_state(s
);
927 // So! Now and then when we try to update bucket information, the
928 // bucket has changed during the course of the operation. (Or we have
929 // a cache consistency problem that Watch/Notify isn't ruling out
932 // When this happens, we need to update the bucket info and try
933 // again. We have, however, to try the right *part* again. We can't
934 // simply re-send, since that will obliterate the previous update.
936 // Thus, callers of this function should include everything that
937 // merges information to be changed into the bucket information as
938 // well as the call to set it.
940 // The called function must return an integer, negative on error. In
941 // general, they should just return op_ret.
944 int retry_raced_bucket_write(const DoutPrefixProvider
*dpp
, rgw::sal::Bucket
* b
, const F
& f
) {
946 for (auto i
= 0u; i
< 15u && r
== -ECANCELED
; ++i
) {
947 r
= b
->try_refresh_info(dpp
, nullptr);
957 int RGWGetObj::verify_permission(optional_yield y
)
959 s
->object
->set_atomic(s
->obj_ctx
);
961 if (prefetch_data()) {
962 s
->object
->set_prefetch_data(s
->obj_ctx
);
965 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
966 if (has_s3_existing_tag
|| has_s3_resource_tag
)
967 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
969 if (torrent
.get_flag()) {
970 if (s
->object
->get_instance().empty()) {
971 action
= rgw::IAM::s3GetObjectTorrent
;
973 action
= rgw::IAM::s3GetObjectVersionTorrent
;
976 if (s
->object
->get_instance().empty()) {
977 action
= rgw::IAM::s3GetObject
;
979 action
= rgw::IAM::s3GetObjectVersion
;
983 if (!verify_object_permission(this, s
, action
)) {
987 if (s
->bucket
->get_info().obj_lock_enabled()) {
988 get_retention
= verify_object_permission(this, s
, rgw::IAM::s3GetObjectRetention
);
989 get_legal_hold
= verify_object_permission(this, s
, rgw::IAM::s3GetObjectLegalHold
);
997 int RGWOp::verify_op_mask()
999 uint32_t required_mask
= op_mask();
1001 ldpp_dout(this, 20) << "required_mask= " << required_mask
1002 << " user.op_mask=" << s
->user
->get_info().op_mask
<< dendl
;
1004 if ((s
->user
->get_info().op_mask
& required_mask
) != required_mask
) {
1008 if (!s
->system_request
&& (required_mask
& RGW_OP_TYPE_MODIFY
) && !store
->get_zone()->is_writeable()) {
1009 ldpp_dout(this, 5) << "NOTICE: modify request to a read-only zone by a "
1010 "non-system user, permission denied" << dendl
;
1017 int RGWGetObjTags::verify_permission(optional_yield y
)
1019 auto iam_action
= s
->object
->get_instance().empty()?
1020 rgw::IAM::s3GetObjectTagging
:
1021 rgw::IAM::s3GetObjectVersionTagging
;
1023 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
1024 if (has_s3_existing_tag
|| has_s3_resource_tag
)
1025 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
1026 if (!verify_object_permission(this, s
,iam_action
))
1032 void RGWGetObjTags::pre_exec()
1034 rgw_bucket_object_pre_exec(s
);
1037 void RGWGetObjTags::execute(optional_yield y
)
1039 rgw::sal::Attrs attrs
;
1041 s
->object
->set_atomic(s
->obj_ctx
);
1043 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, y
, this);
1045 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << s
->object
1046 << " ret=" << op_ret
<< dendl
;
1050 attrs
= s
->object
->get_attrs();
1051 auto tags
= attrs
.find(RGW_ATTR_TAGS
);
1052 if(tags
!= attrs
.end()){
1054 tags_bl
.append(tags
->second
);
1056 send_response_data(tags_bl
);
1059 int RGWPutObjTags::verify_permission(optional_yield y
)
1061 auto iam_action
= s
->object
->get_instance().empty() ?
1062 rgw::IAM::s3PutObjectTagging
:
1063 rgw::IAM::s3PutObjectVersionTagging
;
1065 //Using buckets tags for authorization makes more sense.
1066 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, true);
1067 if (has_s3_existing_tag
)
1068 rgw_iam_add_objtags(this, s
, true, false);
1069 if (has_s3_resource_tag
)
1070 rgw_iam_add_buckettags(this, s
);
1071 if (!verify_object_permission(this, s
,iam_action
))
1076 void RGWPutObjTags::execute(optional_yield y
)
1078 op_ret
= get_params(y
);
1082 if (rgw::sal::Object::empty(s
->object
.get())){
1083 op_ret
= -EINVAL
; // we only support tagging on existing objects
1087 s
->object
->set_atomic(s
->obj_ctx
);
1088 op_ret
= s
->object
->modify_obj_attrs(s
->obj_ctx
, RGW_ATTR_TAGS
, tags_bl
, y
, this);
1089 if (op_ret
== -ECANCELED
){
1090 op_ret
= -ERR_TAG_CONFLICT
;
1094 void RGWDeleteObjTags::pre_exec()
1096 rgw_bucket_object_pre_exec(s
);
1100 int RGWDeleteObjTags::verify_permission(optional_yield y
)
1102 if (!rgw::sal::Object::empty(s
->object
.get())) {
1103 auto iam_action
= s
->object
->get_instance().empty() ?
1104 rgw::IAM::s3DeleteObjectTagging
:
1105 rgw::IAM::s3DeleteObjectVersionTagging
;
1107 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
1108 if (has_s3_existing_tag
|| has_s3_resource_tag
)
1109 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
1110 if (!verify_object_permission(this, s
, iam_action
))
1116 void RGWDeleteObjTags::execute(optional_yield y
)
1118 if (rgw::sal::Object::empty(s
->object
.get()))
1121 op_ret
= s
->object
->delete_obj_attrs(this, s
->obj_ctx
, RGW_ATTR_TAGS
, y
);
1124 int RGWGetBucketTags::verify_permission(optional_yield y
)
1126 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
1127 if (has_s3_resource_tag
)
1128 rgw_iam_add_buckettags(this, s
);
1130 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketTagging
)) {
1137 void RGWGetBucketTags::pre_exec()
1139 rgw_bucket_object_pre_exec(s
);
1142 void RGWGetBucketTags::execute(optional_yield y
)
1144 auto iter
= s
->bucket_attrs
.find(RGW_ATTR_TAGS
);
1145 if (iter
!= s
->bucket_attrs
.end()) {
1147 tags_bl
.append(iter
->second
);
1149 op_ret
= -ERR_NO_SUCH_TAG_SET
;
1151 send_response_data(tags_bl
);
1154 int RGWPutBucketTags::verify_permission(optional_yield y
) {
1155 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
1156 if (has_s3_resource_tag
)
1157 rgw_iam_add_buckettags(this, s
);
1159 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketTagging
);
1162 void RGWPutBucketTags::execute(optional_yield y
)
1165 op_ret
= get_params(this, y
);
1169 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
1171 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
1174 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this, y
] {
1175 rgw::sal::Attrs attrs
= s
->bucket
->get_attrs();
1176 attrs
[RGW_ATTR_TAGS
] = tags_bl
;
1177 return s
->bucket
->merge_and_store_attrs(this, attrs
, y
);
1182 void RGWDeleteBucketTags::pre_exec()
1184 rgw_bucket_object_pre_exec(s
);
1187 int RGWDeleteBucketTags::verify_permission(optional_yield y
)
1189 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
1190 if (has_s3_resource_tag
)
1191 rgw_iam_add_buckettags(this, s
);
1193 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketTagging
);
1196 void RGWDeleteBucketTags::execute(optional_yield y
)
1199 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
1201 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
1205 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this, y
] {
1206 rgw::sal::Attrs attrs
= s
->bucket
->get_attrs();
1207 attrs
.erase(RGW_ATTR_TAGS
);
1208 op_ret
= s
->bucket
->merge_and_store_attrs(this, attrs
, y
);
1210 ldpp_dout(this, 0) << "RGWDeleteBucketTags() failed to remove RGW_ATTR_TAGS on bucket="
1211 << s
->bucket
->get_name()
1212 << " returned err= " << op_ret
<< dendl
;
1218 int RGWGetBucketReplication::verify_permission(optional_yield y
)
1220 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
1221 if (has_s3_resource_tag
)
1222 rgw_iam_add_buckettags(this, s
);
1224 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetReplicationConfiguration
)) {
1231 void RGWGetBucketReplication::pre_exec()
1233 rgw_bucket_object_pre_exec(s
);
1236 void RGWGetBucketReplication::execute(optional_yield y
)
1238 send_response_data();
1241 int RGWPutBucketReplication::verify_permission(optional_yield y
) {
1242 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
1243 if (has_s3_resource_tag
)
1244 rgw_iam_add_buckettags(this, s
);
1245 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutReplicationConfiguration
);
1248 void RGWPutBucketReplication::execute(optional_yield y
) {
1250 op_ret
= get_params(y
);
1254 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
1256 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
1260 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
1261 auto sync_policy
= (s
->bucket
->get_info().sync_policy
? *s
->bucket
->get_info().sync_policy
: rgw_sync_policy_info());
1263 for (auto& group
: sync_policy_groups
) {
1264 sync_policy
.groups
[group
.id
] = group
;
1267 s
->bucket
->get_info().set_sync_policy(std::move(sync_policy
));
1269 int ret
= s
->bucket
->put_info(this, false, real_time());
1271 ldpp_dout(this, 0) << "ERROR: put_bucket_instance_info (bucket=" << s
->bucket
<< ") returned ret=" << ret
<< dendl
;
1279 void RGWDeleteBucketReplication::pre_exec()
1281 rgw_bucket_object_pre_exec(s
);
1284 int RGWDeleteBucketReplication::verify_permission(optional_yield y
)
1286 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
1287 if (has_s3_resource_tag
)
1288 rgw_iam_add_buckettags(this, s
);
1290 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3DeleteReplicationConfiguration
);
1293 void RGWDeleteBucketReplication::execute(optional_yield y
)
1296 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
1298 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
1302 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
1303 if (!s
->bucket
->get_info().sync_policy
) {
1307 rgw_sync_policy_info sync_policy
= *s
->bucket
->get_info().sync_policy
;
1309 update_sync_policy(&sync_policy
);
1311 s
->bucket
->get_info().set_sync_policy(std::move(sync_policy
));
1313 int ret
= s
->bucket
->put_info(this, false, real_time());
1315 ldpp_dout(this, 0) << "ERROR: put_bucket_instance_info (bucket=" << s
->bucket
<< ") returned ret=" << ret
<< dendl
;
1323 int RGWOp::do_aws4_auth_completion()
1325 ldpp_dout(this, 5) << "NOTICE: call to do_aws4_auth_completion" << dendl
;
1326 if (s
->auth
.completer
) {
1327 if (!s
->auth
.completer
->complete()) {
1328 return -ERR_AMZ_CONTENT_SHA256_MISMATCH
;
1330 ldpp_dout(this, 10) << "v4 auth ok -- do_aws4_auth_completion" << dendl
;
1333 /* TODO(rzarzynski): yes, we're really called twice on PUTs. Only first
1334 * call passes, so we disable second one. This is old behaviour, sorry!
1335 * Plan for tomorrow: seek and destroy. */
1336 s
->auth
.completer
= nullptr;
1342 int RGWOp::init_quota()
1344 /* no quota enforcement for system requests */
1345 if (s
->system_request
)
1348 /* init quota related stuff */
1349 if (!(s
->user
->get_info().op_mask
& RGW_OP_TYPE_MODIFY
)) {
1353 /* only interested in object related ops */
1354 if (rgw::sal::Bucket::empty(s
->bucket
.get())
1355 || rgw::sal::Object::empty(s
->object
.get())) {
1359 std::unique_ptr
<rgw::sal::User
> owner_user
=
1360 store
->get_user(s
->bucket
->get_info().owner
);
1361 rgw::sal::User
* user
;
1363 if (s
->user
->get_id() == s
->bucket_owner
.get_id()) {
1364 user
= s
->user
.get();
1366 int r
= owner_user
->load_user(this, s
->yield
);
1369 user
= owner_user
.get();
1372 store
->get_quota(bucket_quota
, user_quota
);
1374 if (s
->bucket
->get_info().quota
.enabled
) {
1375 bucket_quota
= s
->bucket
->get_info().quota
;
1376 } else if (user
->get_info().bucket_quota
.enabled
) {
1377 bucket_quota
= user
->get_info().bucket_quota
;
1380 if (user
->get_info().user_quota
.enabled
) {
1381 user_quota
= user
->get_info().user_quota
;
1387 static bool validate_cors_rule_method(const DoutPrefixProvider
*dpp
, RGWCORSRule
*rule
, const char *req_meth
) {
1391 ldpp_dout(dpp
, 5) << "req_meth is null" << dendl
;
1395 if (strcmp(req_meth
, "GET") == 0) flags
= RGW_CORS_GET
;
1396 else if (strcmp(req_meth
, "POST") == 0) flags
= RGW_CORS_POST
;
1397 else if (strcmp(req_meth
, "PUT") == 0) flags
= RGW_CORS_PUT
;
1398 else if (strcmp(req_meth
, "DELETE") == 0) flags
= RGW_CORS_DELETE
;
1399 else if (strcmp(req_meth
, "HEAD") == 0) flags
= RGW_CORS_HEAD
;
1401 if (rule
->get_allowed_methods() & flags
) {
1402 ldpp_dout(dpp
, 10) << "Method " << req_meth
<< " is supported" << dendl
;
1404 ldpp_dout(dpp
, 5) << "Method " << req_meth
<< " is not supported" << dendl
;
1411 static bool validate_cors_rule_header(const DoutPrefixProvider
*dpp
, RGWCORSRule
*rule
, const char *req_hdrs
) {
1413 vector
<string
> hdrs
;
1414 get_str_vec(req_hdrs
, hdrs
);
1415 for (const auto& hdr
: hdrs
) {
1416 if (!rule
->is_header_allowed(hdr
.c_str(), hdr
.length())) {
1417 ldpp_dout(dpp
, 5) << "Header " << hdr
<< " is not registered in this rule" << dendl
;
1425 int RGWOp::read_bucket_cors()
1429 map
<string
, bufferlist
>::iterator aiter
= s
->bucket_attrs
.find(RGW_ATTR_CORS
);
1430 if (aiter
== s
->bucket_attrs
.end()) {
1431 ldpp_dout(this, 20) << "no CORS configuration attr found" << dendl
;
1433 return 0; /* no CORS configuration found */
1440 auto iter
= bl
.cbegin();
1442 bucket_cors
.decode(iter
);
1443 } catch (buffer::error
& err
) {
1444 ldpp_dout(this, 0) << "ERROR: could not decode CORS, caught buffer::error" << dendl
;
1447 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
1448 RGWCORSConfiguration_S3
*s3cors
= static_cast<RGWCORSConfiguration_S3
*>(&bucket_cors
);
1449 ldpp_dout(this, 15) << "Read RGWCORSConfiguration";
1450 s3cors
->to_xml(*_dout
);
1457 * If any of the header field-names is not a ASCII case-insensitive match for
1458 * any of the values in list of headers do not set any additional headers and
1459 * terminate this set of steps.
1461 static void get_cors_response_headers(const DoutPrefixProvider
*dpp
, RGWCORSRule
*rule
, const char *req_hdrs
, string
& hdrs
, string
& exp_hdrs
, unsigned *max_age
) {
1464 get_str_list(req_hdrs
, hl
);
1465 for(list
<string
>::iterator it
= hl
.begin(); it
!= hl
.end(); ++it
) {
1466 if (!rule
->is_header_allowed((*it
).c_str(), (*it
).length())) {
1467 ldpp_dout(dpp
, 5) << "Header " << (*it
) << " is not registered in this rule" << dendl
;
1469 if (hdrs
.length() > 0) hdrs
.append(",");
1474 rule
->format_exp_headers(exp_hdrs
);
1475 *max_age
= rule
->get_max_age();
1479 * Generate the CORS header response
1481 * This is described in the CORS standard, section 6.2.
1483 bool RGWOp::generate_cors_headers(string
& origin
, string
& method
, string
& headers
, string
& exp_headers
, unsigned *max_age
)
1486 const char *orig
= s
->info
.env
->get("HTTP_ORIGIN");
1493 int temp_op_ret
= read_bucket_cors();
1494 if (temp_op_ret
< 0) {
1495 op_ret
= temp_op_ret
;
1500 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
1505 RGWCORSRule
*rule
= bucket_cors
.host_name_rule(orig
);
1510 * Set the Allowed-Origin header to a asterisk if this is allowed in the rule
1511 * and no Authorization was send by the client
1513 * The origin parameter specifies a URI that may access the resource. The browser must enforce this.
1514 * For requests without credentials, the server may specify "*" as a wildcard,
1515 * thereby allowing any origin to access the resource.
1517 const char *authorization
= s
->info
.env
->get("HTTP_AUTHORIZATION");
1518 if (!authorization
&& rule
->has_wildcard_origin())
1522 const char *req_meth
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
1524 req_meth
= s
->info
.method
;
1530 if (!validate_cors_rule_method(this, rule
, req_meth
)) {
1536 const char *req_hdrs
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
1539 get_cors_response_headers(this, rule
, req_hdrs
, headers
, exp_headers
, max_age
);
1544 int RGWGetObj::read_user_manifest_part(rgw::sal::Bucket
* bucket
,
1545 const rgw_bucket_dir_entry
& ent
,
1546 RGWAccessControlPolicy
* const bucket_acl
,
1547 const boost::optional
<Policy
>& bucket_policy
,
1548 const off_t start_ofs
,
1549 const off_t end_ofs
,
1552 ldpp_dout(this, 20) << "user manifest obj=" << ent
.key
.name
1553 << "[" << ent
.key
.instance
<< "]" << dendl
;
1554 RGWGetObj_CB
cb(this);
1555 RGWGetObj_Filter
* filter
= &cb
;
1556 boost::optional
<RGWGetObj_Decompress
> decompress
;
1558 int64_t cur_ofs
= start_ofs
;
1559 int64_t cur_end
= end_ofs
;
1561 std::unique_ptr
<rgw::sal::Object
> part
= bucket
->get_object(ent
.key
);
1563 RGWObjectCtx
obj_ctx(store
);
1564 RGWAccessControlPolicy
obj_policy(s
->cct
);
1566 ldpp_dout(this, 20) << "reading obj=" << part
<< " ofs=" << cur_ofs
1567 << " end=" << cur_end
<< dendl
;
1569 part
->set_atomic(&obj_ctx
);
1570 part
->set_prefetch_data(&obj_ctx
);
1572 std::unique_ptr
<rgw::sal::Object::ReadOp
> read_op
= part
->get_read_op(&obj_ctx
);
1575 /* SLO etag is optional */
1576 read_op
->params
.if_match
= ent
.meta
.etag
.c_str();
1579 op_ret
= read_op
->prepare(s
->yield
, this);
1582 op_ret
= part
->range_to_ofs(ent
.meta
.accounted_size
, cur_ofs
, cur_end
);
1585 bool need_decompress
;
1586 op_ret
= rgw_compression_info_from_attrset(part
->get_attrs(), need_decompress
, cs_info
);
1588 ldpp_dout(this, 0) << "ERROR: failed to decode compression info" << dendl
;
1592 if (need_decompress
)
1594 if (cs_info
.orig_size
!= ent
.meta
.accounted_size
) {
1595 // hmm.. something wrong, object not as expected, abort!
1596 ldpp_dout(this, 0) << "ERROR: expected cs_info.orig_size=" << cs_info
.orig_size
1597 << ", actual read size=" << ent
.meta
.size
<< dendl
;
1600 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
1601 filter
= &*decompress
;
1605 if (part
->get_obj_size() != ent
.meta
.size
) {
1606 // hmm.. something wrong, object not as expected, abort!
1607 ldpp_dout(this, 0) << "ERROR: expected obj_size=" << part
->get_obj_size()
1608 << ", actual read size=" << ent
.meta
.size
<< dendl
;
1613 op_ret
= rgw_policy_from_attrset(s
, s
->cct
, part
->get_attrs(), &obj_policy
);
1617 /* We can use global user_acl because LOs cannot have segments
1618 * stored inside different accounts. */
1619 if (s
->system_request
) {
1620 ldpp_dout(this, 2) << "overriding permissions due to system operation" << dendl
;
1621 } else if (s
->auth
.identity
->is_admin_of(s
->user
->get_id())) {
1622 ldpp_dout(this, 2) << "overriding permissions due to admin operation" << dendl
;
1623 } else if (!verify_object_permission(this, s
, part
->get_obj(), s
->user_acl
.get(),
1624 bucket_acl
, &obj_policy
, bucket_policy
,
1625 s
->iam_user_policies
, s
->session_policies
, action
)) {
1628 if (ent
.meta
.size
== 0) {
1632 perfcounter
->inc(l_rgw_get_b
, cur_end
- cur_ofs
);
1633 filter
->fixup_range(cur_ofs
, cur_end
);
1634 op_ret
= read_op
->iterate(this, cur_ofs
, cur_end
, filter
, s
->yield
);
1636 op_ret
= filter
->flush();
1640 static int iterate_user_manifest_parts(const DoutPrefixProvider
*dpp
,
1641 CephContext
* const cct
,
1642 rgw::sal::Store
* const store
,
1645 rgw::sal::Bucket
* bucket
,
1646 const string
& obj_prefix
,
1647 RGWAccessControlPolicy
* const bucket_acl
,
1648 const boost::optional
<Policy
>& bucket_policy
,
1649 uint64_t * const ptotal_len
,
1650 uint64_t * const pobj_size
,
1651 string
* const pobj_sum
,
1652 int (*cb
)(rgw::sal::Bucket
* bucket
,
1653 const rgw_bucket_dir_entry
& ent
,
1654 RGWAccessControlPolicy
* const bucket_acl
,
1655 const boost::optional
<Policy
>& bucket_policy
,
1660 void * const cb_param
,
1663 uint64_t obj_ofs
= 0, len_count
= 0;
1664 bool found_start
= false, found_end
= false, handled_end
= false;
1667 utime_t start_time
= ceph_clock_now();
1669 rgw::sal::Bucket::ListParams params
;
1670 params
.prefix
= obj_prefix
;
1671 params
.delim
= delim
;
1673 rgw::sal::Bucket::ListResults results
;
1675 // Allow use of MD5 digest in FIPS mode for non-cryptographic purposes
1676 etag_sum
.SetFlags(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
);
1678 static constexpr auto MAX_LIST_OBJS
= 100u;
1679 int r
= bucket
->list(dpp
, params
, MAX_LIST_OBJS
, results
, y
);
1684 for (rgw_bucket_dir_entry
& ent
: results
.objs
) {
1685 const uint64_t cur_total_len
= obj_ofs
;
1686 const uint64_t obj_size
= ent
.meta
.accounted_size
;
1687 uint64_t start_ofs
= 0, end_ofs
= obj_size
;
1689 if ((ptotal_len
|| cb
) && !found_start
&& cur_total_len
+ obj_size
> (uint64_t)ofs
) {
1690 start_ofs
= ofs
- obj_ofs
;
1694 obj_ofs
+= obj_size
;
1696 etag_sum
.Update((const unsigned char *)ent
.meta
.etag
.c_str(),
1697 ent
.meta
.etag
.length());
1700 if ((ptotal_len
|| cb
) && !found_end
&& obj_ofs
> (uint64_t)end
) {
1701 end_ofs
= end
- cur_total_len
+ 1;
1705 perfcounter
->tinc(l_rgw_get_lat
,
1706 (ceph_clock_now() - start_time
));
1708 if (found_start
&& !handled_end
) {
1709 len_count
+= end_ofs
- start_ofs
;
1712 r
= cb(bucket
, ent
, bucket_acl
, bucket_policy
, start_ofs
, end_ofs
,
1713 cb_param
, false /* swift_slo */);
1720 handled_end
= found_end
;
1721 start_time
= ceph_clock_now();
1723 } while (results
.is_truncated
);
1726 *ptotal_len
= len_count
;
1729 *pobj_size
= obj_ofs
;
1732 complete_etag(etag_sum
, pobj_sum
);
1738 struct rgw_slo_part
{
1739 RGWAccessControlPolicy
*bucket_acl
= nullptr;
1740 Policy
* bucket_policy
= nullptr;
1741 rgw::sal::Bucket
* bucket
;
1747 static int iterate_slo_parts(const DoutPrefixProvider
*dpp
,
1749 rgw::sal::Store
*store
,
1752 map
<uint64_t, rgw_slo_part
>& slo_parts
,
1753 int (*cb
)(rgw::sal::Bucket
* bucket
,
1754 const rgw_bucket_dir_entry
& ent
,
1755 RGWAccessControlPolicy
*bucket_acl
,
1756 const boost::optional
<Policy
>& bucket_policy
,
1763 bool found_start
= false, found_end
= false;
1765 if (slo_parts
.empty()) {
1769 utime_t start_time
= ceph_clock_now();
1771 map
<uint64_t, rgw_slo_part
>::iterator iter
= slo_parts
.upper_bound(ofs
);
1772 if (iter
!= slo_parts
.begin()) {
1776 uint64_t obj_ofs
= iter
->first
;
1778 for (; iter
!= slo_parts
.end() && !found_end
; ++iter
) {
1779 rgw_slo_part
& part
= iter
->second
;
1780 rgw_bucket_dir_entry ent
;
1782 ent
.key
.name
= part
.obj_name
;
1783 ent
.meta
.accounted_size
= ent
.meta
.size
= part
.size
;
1784 ent
.meta
.etag
= part
.etag
;
1786 uint64_t cur_total_len
= obj_ofs
;
1787 uint64_t start_ofs
= 0, end_ofs
= ent
.meta
.size
- 1;
1789 if (!found_start
&& cur_total_len
+ ent
.meta
.size
> (uint64_t)ofs
) {
1790 start_ofs
= ofs
- obj_ofs
;
1794 obj_ofs
+= ent
.meta
.size
;
1796 if (!found_end
&& obj_ofs
> (uint64_t)end
) {
1797 end_ofs
= end
- cur_total_len
;
1801 perfcounter
->tinc(l_rgw_get_lat
,
1802 (ceph_clock_now() - start_time
));
1806 ldpp_dout(dpp
, 20) << "iterate_slo_parts()"
1807 << " obj=" << part
.obj_name
1808 << " start_ofs=" << start_ofs
1809 << " end_ofs=" << end_ofs
1812 // SLO is a Swift thing, and Swift has no knowledge of S3 Policies.
1813 int r
= cb(part
.bucket
, ent
, part
.bucket_acl
,
1814 (part
.bucket_policy
?
1815 boost::optional
<Policy
>(*part
.bucket_policy
) : none
),
1816 start_ofs
, end_ofs
, cb_param
, true /* swift_slo */);
1822 start_time
= ceph_clock_now();
1828 static int get_obj_user_manifest_iterate_cb(rgw::sal::Bucket
* bucket
,
1829 const rgw_bucket_dir_entry
& ent
,
1830 RGWAccessControlPolicy
* const bucket_acl
,
1831 const boost::optional
<Policy
>& bucket_policy
,
1832 const off_t start_ofs
,
1833 const off_t end_ofs
,
1835 bool swift_slo
= false)
1837 RGWGetObj
*op
= static_cast<RGWGetObj
*>(param
);
1838 return op
->read_user_manifest_part(
1839 bucket
, ent
, bucket_acl
, bucket_policy
, start_ofs
, end_ofs
, swift_slo
);
1842 int RGWGetObj::handle_user_manifest(const char *prefix
, optional_yield y
)
1844 const std::string_view
prefix_view(prefix
);
1845 ldpp_dout(this, 2) << "RGWGetObj::handle_user_manifest() prefix="
1846 << prefix_view
<< dendl
;
1848 const size_t pos
= prefix_view
.find('/');
1849 if (pos
== string::npos
) {
1853 const std::string bucket_name
= url_decode(prefix_view
.substr(0, pos
));
1854 const std::string obj_prefix
= url_decode(prefix_view
.substr(pos
+ 1));
1856 RGWAccessControlPolicy
_bucket_acl(s
->cct
);
1857 RGWAccessControlPolicy
*bucket_acl
;
1858 boost::optional
<Policy
> _bucket_policy
;
1859 boost::optional
<Policy
>* bucket_policy
;
1860 RGWBucketInfo bucket_info
;
1861 std::unique_ptr
<rgw::sal::Bucket
> ubucket
;
1862 rgw::sal::Bucket
* pbucket
= NULL
;
1865 if (bucket_name
.compare(s
->bucket
->get_name()) != 0) {
1866 map
<string
, bufferlist
> bucket_attrs
;
1867 r
= store
->get_bucket(this, s
->user
.get(), s
->user
->get_tenant(), bucket_name
, &ubucket
, y
);
1869 ldpp_dout(this, 0) << "could not get bucket info for bucket="
1870 << bucket_name
<< dendl
;
1873 bucket_acl
= &_bucket_acl
;
1874 r
= read_bucket_policy(this, store
, s
, ubucket
->get_info(), bucket_attrs
, bucket_acl
, ubucket
->get_key(), y
);
1876 ldpp_dout(this, 0) << "failed to read bucket policy" << dendl
;
1879 _bucket_policy
= get_iam_policy_from_attr(s
->cct
, bucket_attrs
, s
->user
->get_tenant());
1880 bucket_policy
= &_bucket_policy
;
1881 pbucket
= ubucket
.get();
1883 pbucket
= s
->bucket
.get();
1884 bucket_acl
= s
->bucket_acl
.get();
1885 bucket_policy
= &s
->iam_policy
;
1888 /* dry run to find out:
1889 * - total length (of the parts we are going to send to client),
1890 * - overall DLO's content size,
1891 * - md5 sum of overall DLO's content (for etag of Swift API). */
1892 r
= iterate_user_manifest_parts(this, s
->cct
, store
, ofs
, end
,
1893 pbucket
, obj_prefix
, bucket_acl
, *bucket_policy
,
1894 nullptr, &s
->obj_size
, &lo_etag
,
1895 nullptr /* cb */, nullptr /* cb arg */, y
);
1899 s
->object
->set_obj_size(s
->obj_size
);
1901 r
= s
->object
->range_to_ofs(s
->obj_size
, ofs
, end
);
1906 r
= iterate_user_manifest_parts(this, s
->cct
, store
, ofs
, end
,
1907 pbucket
, obj_prefix
, bucket_acl
, *bucket_policy
,
1908 &total_len
, nullptr, nullptr,
1909 nullptr, nullptr, y
);
1916 send_response_data(bl
, 0, 0);
1920 r
= iterate_user_manifest_parts(this, s
->cct
, store
, ofs
, end
,
1921 pbucket
, obj_prefix
, bucket_acl
, *bucket_policy
,
1922 nullptr, nullptr, nullptr,
1923 get_obj_user_manifest_iterate_cb
, (void *)this, y
);
1930 send_response_data(bl
, 0, 0);
1936 int RGWGetObj::handle_slo_manifest(bufferlist
& bl
, optional_yield y
)
1938 RGWSLOInfo slo_info
;
1939 auto bliter
= bl
.cbegin();
1941 decode(slo_info
, bliter
);
1942 } catch (buffer::error
& err
) {
1943 ldpp_dout(this, 0) << "ERROR: failed to decode slo manifest" << dendl
;
1946 ldpp_dout(this, 2) << "RGWGetObj::handle_slo_manifest()" << dendl
;
1948 vector
<RGWAccessControlPolicy
> allocated_acls
;
1949 map
<string
, pair
<RGWAccessControlPolicy
*, boost::optional
<Policy
>>> policies
;
1950 map
<string
, std::unique_ptr
<rgw::sal::Bucket
>> buckets
;
1952 map
<uint64_t, rgw_slo_part
> slo_parts
;
1955 // Allow use of MD5 digest in FIPS mode for non-cryptographic purposes
1956 etag_sum
.SetFlags(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
);
1959 for (const auto& entry
: slo_info
.entries
) {
1960 const string
& path
= entry
.path
;
1962 /* If the path starts with slashes, strip them all. */
1963 const size_t pos_init
= path
.find_first_not_of('/');
1964 /* According to the documentation of std::string::find following check
1965 * is not necessary as we should get the std::string::npos propagation
1966 * here. This might be true with the accuracy to implementation's bugs.
1967 * See following question on SO:
1968 * http://stackoverflow.com/questions/1011790/why-does-stdstring-findtext-stdstringnpos-not-return-npos
1970 if (pos_init
== string::npos
) {
1974 const size_t pos_sep
= path
.find('/', pos_init
);
1975 if (pos_sep
== string::npos
) {
1979 string bucket_name
= path
.substr(pos_init
, pos_sep
- pos_init
);
1980 string obj_name
= path
.substr(pos_sep
+ 1);
1982 rgw::sal::Bucket
* bucket
;
1983 RGWAccessControlPolicy
*bucket_acl
;
1984 Policy
* bucket_policy
;
1986 if (bucket_name
.compare(s
->bucket
->get_name()) != 0) {
1987 const auto& piter
= policies
.find(bucket_name
);
1988 if (piter
!= policies
.end()) {
1989 bucket_acl
= piter
->second
.first
;
1990 bucket_policy
= piter
->second
.second
.get_ptr();
1991 bucket
= buckets
[bucket_name
].get();
1993 allocated_acls
.push_back(RGWAccessControlPolicy(s
->cct
));
1994 RGWAccessControlPolicy
& _bucket_acl
= allocated_acls
.back();
1996 std::unique_ptr
<rgw::sal::Bucket
> tmp_bucket
;
1997 int r
= store
->get_bucket(this, s
->user
.get(), s
->user
->get_tenant(), bucket_name
, &tmp_bucket
, y
);
1999 ldpp_dout(this, 0) << "could not get bucket info for bucket="
2000 << bucket_name
<< dendl
;
2003 bucket
= tmp_bucket
.get();
2004 bucket_acl
= &_bucket_acl
;
2005 r
= read_bucket_policy(this, store
, s
, tmp_bucket
->get_info(), tmp_bucket
->get_attrs(), bucket_acl
,
2006 tmp_bucket
->get_key(), y
);
2008 ldpp_dout(this, 0) << "failed to read bucket ACL for bucket "
2012 auto _bucket_policy
= get_iam_policy_from_attr(
2013 s
->cct
, tmp_bucket
->get_attrs(), tmp_bucket
->get_tenant());
2014 bucket_policy
= _bucket_policy
.get_ptr();
2015 buckets
[bucket_name
].swap(tmp_bucket
);
2016 policies
[bucket_name
] = make_pair(bucket_acl
, _bucket_policy
);
2019 bucket
= s
->bucket
.get();
2020 bucket_acl
= s
->bucket_acl
.get();
2021 bucket_policy
= s
->iam_policy
.get_ptr();
2025 part
.bucket_acl
= bucket_acl
;
2026 part
.bucket_policy
= bucket_policy
;
2027 part
.bucket
= bucket
;
2028 part
.obj_name
= obj_name
;
2029 part
.size
= entry
.size_bytes
;
2030 part
.etag
= entry
.etag
;
2031 ldpp_dout(this, 20) << "slo_part: bucket=" << part
.bucket
2032 << " obj=" << part
.obj_name
2033 << " size=" << part
.size
2034 << " etag=" << part
.etag
2037 etag_sum
.Update((const unsigned char *)entry
.etag
.c_str(),
2038 entry
.etag
.length());
2040 slo_parts
[total_len
] = part
;
2041 total_len
+= part
.size
;
2042 } /* foreach entry */
2044 complete_etag(etag_sum
, &lo_etag
);
2046 s
->obj_size
= slo_info
.total_size
;
2047 s
->object
->set_obj_size(slo_info
.total_size
);
2048 ldpp_dout(this, 20) << "s->obj_size=" << s
->obj_size
<< dendl
;
2050 int r
= s
->object
->range_to_ofs(total_len
, ofs
, end
);
2055 total_len
= end
- ofs
+ 1;
2056 ldpp_dout(this, 20) << "Requested: ofs=" << ofs
2058 << " total=" << total_len
2061 r
= iterate_slo_parts(this, s
->cct
, store
, ofs
, end
, slo_parts
,
2062 get_obj_user_manifest_iterate_cb
, (void *)this);
2070 int RGWGetObj::get_data_cb(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
)
2072 /* garbage collection related handling:
2073 * defer_gc disabled for https://tracker.ceph.com/issues/47866 */
2074 return send_response_data(bl
, bl_ofs
, bl_len
);
2077 bool RGWGetObj::prefetch_data()
2079 /* HEAD request, stop prefetch*/
2080 if (!get_data
|| s
->info
.env
->exists("HTTP_X_RGW_AUTH")) {
2084 range_str
= s
->info
.env
->get("HTTP_RANGE");
2085 // TODO: add range prefetch
2094 void RGWGetObj::pre_exec()
2096 rgw_bucket_object_pre_exec(s
);
2099 static inline void rgw_cond_decode_objtags(
2100 struct req_state
*s
,
2101 const std::map
<std::string
, buffer::list
> &attrs
)
2103 const auto& tags
= attrs
.find(RGW_ATTR_TAGS
);
2104 if (tags
!= attrs
.end()) {
2106 bufferlist::const_iterator iter
{&tags
->second
};
2107 s
->tagset
.decode(iter
);
2108 } catch (buffer::error
& err
) {
2110 << "ERROR: caught buffer::error, couldn't decode TagSet" << dendl
;
2115 void RGWGetObj::execute(optional_yield y
)
2118 gc_invalidate_time
= ceph_clock_now();
2119 gc_invalidate_time
+= (s
->cct
->_conf
->rgw_gc_obj_min_wait
/ 2);
2121 bool need_decompress
;
2122 int64_t ofs_x
, end_x
;
2124 RGWGetObj_CB
cb(this);
2125 RGWGetObj_Filter
* filter
= (RGWGetObj_Filter
*)&cb
;
2126 boost::optional
<RGWGetObj_Decompress
> decompress
;
2127 std::unique_ptr
<RGWGetObj_Filter
> decrypt
;
2128 map
<string
, bufferlist
>::iterator attr_iter
;
2130 perfcounter
->inc(l_rgw_get
);
2132 std::unique_ptr
<rgw::sal::Object::ReadOp
> read_op(s
->object
->get_read_op(s
->obj_ctx
));
2134 op_ret
= get_params(y
);
2138 op_ret
= init_common();
2142 read_op
->params
.mod_ptr
= mod_ptr
;
2143 read_op
->params
.unmod_ptr
= unmod_ptr
;
2144 read_op
->params
.high_precision_time
= s
->system_request
; /* system request need to use high precision time */
2145 read_op
->params
.mod_zone_id
= mod_zone_id
;
2146 read_op
->params
.mod_pg_ver
= mod_pg_ver
;
2147 read_op
->params
.if_match
= if_match
;
2148 read_op
->params
.if_nomatch
= if_nomatch
;
2149 read_op
->params
.lastmod
= &lastmod
;
2151 op_ret
= read_op
->prepare(s
->yield
, this);
2154 version_id
= s
->object
->get_instance();
2155 s
->obj_size
= s
->object
->get_obj_size();
2156 attrs
= s
->object
->get_attrs();
2158 /* STAT ops don't need data, and do no i/o */
2159 if (get_type() == RGW_OP_STAT_OBJ
) {
2162 if (s
->info
.env
->exists("HTTP_X_RGW_AUTH")) {
2166 /* start gettorrent */
2167 if (torrent
.get_flag())
2169 attr_iter
= attrs
.find(RGW_ATTR_CRYPT_MODE
);
2170 if (attr_iter
!= attrs
.end() && attr_iter
->second
.to_str() == "SSE-C-AES256") {
2171 ldpp_dout(this, 0) << "ERROR: torrents are not supported for objects "
2172 "encrypted with SSE-C" << dendl
;
2176 torrent
.init(s
, store
);
2177 rgw_obj obj
= s
->object
->get_obj();
2178 op_ret
= torrent
.get_torrent_file(s
->object
.get(), total_len
, bl
, obj
);
2181 ldpp_dout(this, 0) << "ERROR: failed to get_torrent_file ret= " << op_ret
2185 op_ret
= send_response_data(bl
, 0, total_len
);
2188 ldpp_dout(this, 0) << "ERROR: failed to send_response_data ret= " << op_ret
<< dendl
;
2193 /* end gettorrent */
2195 op_ret
= rgw_compression_info_from_attrset(attrs
, need_decompress
, cs_info
);
2197 ldpp_dout(this, 0) << "ERROR: failed to decode compression info, cannot decompress" << dendl
;
2200 if (need_decompress
) {
2201 s
->obj_size
= cs_info
.orig_size
;
2202 s
->object
->set_obj_size(cs_info
.orig_size
);
2203 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
2204 filter
= &*decompress
;
2207 attr_iter
= attrs
.find(RGW_ATTR_MANIFEST
);
2208 if (attr_iter
!= attrs
.end() && get_type() == RGW_OP_GET_OBJ
&& get_data
) {
2210 decode(m
, attr_iter
->second
);
2211 if (m
.get_tier_type() == "cloud-s3") {
2212 /* XXX: Instead send presigned redirect or read-through */
2213 op_ret
= -ERR_INVALID_OBJECT_STATE
;
2214 ldpp_dout(this, 0) << "ERROR: Cannot get cloud tiered object. Failing with "
2220 attr_iter
= attrs
.find(RGW_ATTR_USER_MANIFEST
);
2221 if (attr_iter
!= attrs
.end() && !skip_manifest
) {
2222 op_ret
= handle_user_manifest(attr_iter
->second
.c_str(), y
);
2224 ldpp_dout(this, 0) << "ERROR: failed to handle user manifest ret="
2231 attr_iter
= attrs
.find(RGW_ATTR_SLO_MANIFEST
);
2232 if (attr_iter
!= attrs
.end() && !skip_manifest
) {
2234 op_ret
= handle_slo_manifest(attr_iter
->second
, y
);
2236 ldpp_dout(this, 0) << "ERROR: failed to handle slo manifest ret=" << op_ret
2243 // for range requests with obj size 0
2244 if (range_str
&& !(s
->obj_size
)) {
2250 op_ret
= s
->object
->range_to_ofs(s
->obj_size
, ofs
, end
);
2253 total_len
= (ofs
<= end
? end
+ 1 - ofs
: 0);
2255 /* Check whether the object has expired. Swift API documentation
2256 * stands that we should return 404 Not Found in such case. */
2257 if (need_object_expiration() && s
->object
->is_expired()) {
2262 /* Decode S3 objtags, if any */
2263 rgw_cond_decode_objtags(s
, attrs
);
2267 attr_iter
= attrs
.find(RGW_ATTR_MANIFEST
);
2268 op_ret
= this->get_decrypt_filter(&decrypt
, filter
,
2269 attr_iter
!= attrs
.end() ? &(attr_iter
->second
) : nullptr);
2270 if (decrypt
!= nullptr) {
2271 filter
= decrypt
.get();
2277 if (!get_data
|| ofs
> end
) {
2278 send_response_data(bl
, 0, 0);
2282 perfcounter
->inc(l_rgw_get_b
, end
- ofs
);
2286 filter
->fixup_range(ofs_x
, end_x
);
2287 op_ret
= read_op
->iterate(this, ofs_x
, end_x
, filter
, s
->yield
);
2290 op_ret
= filter
->flush();
2292 perfcounter
->tinc(l_rgw_get_lat
, s
->time_elapsed());
2297 op_ret
= send_response_data(bl
, 0, 0);
2304 send_response_data_error(y
);
2307 int RGWGetObj::init_common()
2310 /* range parsed error when prefetch */
2311 if (!range_parsed
) {
2312 int r
= parse_range();
2318 if (parse_time(if_mod
, &mod_time
) < 0)
2320 mod_ptr
= &mod_time
;
2324 if (parse_time(if_unmod
, &unmod_time
) < 0)
2326 unmod_ptr
= &unmod_time
;
2332 int RGWListBuckets::verify_permission(optional_yield y
)
2334 rgw::Partition partition
= rgw::Partition::aws
;
2335 rgw::Service service
= rgw::Service::s3
;
2338 if (s
->auth
.identity
->get_identity_type() == TYPE_ROLE
) {
2339 tenant
= s
->auth
.identity
->get_role_tenant();
2341 tenant
= s
->user
->get_tenant();
2344 if (!verify_user_permission(this, s
, ARN(partition
, service
, "", tenant
, "*"), rgw::IAM::s3ListAllMyBuckets
)) {
2351 int RGWGetUsage::verify_permission(optional_yield y
)
2353 if (s
->auth
.identity
->is_anonymous()) {
2360 void RGWListBuckets::execute(optional_yield y
)
2363 bool started
= false;
2364 uint64_t total_count
= 0;
2366 const uint64_t max_buckets
= s
->cct
->_conf
->rgw_list_buckets_max_chunk
;
2368 op_ret
= get_params(y
);
2373 if (supports_account_metadata()) {
2374 op_ret
= s
->user
->read_attrs(this, s
->yield
);
2380 is_truncated
= false;
2382 rgw::sal::BucketList buckets
;
2383 uint64_t read_count
;
2385 read_count
= min(limit
- total_count
, max_buckets
);
2387 read_count
= max_buckets
;
2390 op_ret
= s
->user
->list_buckets(this, marker
, end_marker
, read_count
, should_get_stats(), buckets
, y
);
2393 /* hmm.. something wrong here.. the user was authenticated, so it
2395 ldpp_dout(this, 10) << "WARNING: failed on rgw_get_user_buckets uid="
2396 << s
->user
->get_id() << dendl
;
2400 /* We need to have stats for all our policies - even if a given policy
2401 * isn't actually used in a given account. In such situation its usage
2402 * stats would be simply full of zeros. */
2403 for (const auto& policy
: store
->get_zone()->get_zonegroup().placement_targets
) {
2404 policies_stats
.emplace(policy
.second
.name
,
2405 decltype(policies_stats
)::mapped_type());
2408 std::map
<std::string
, std::unique_ptr
<rgw::sal::Bucket
>>& m
= buckets
.get_buckets();
2409 for (const auto& kv
: m
) {
2410 const auto& bucket
= kv
.second
;
2412 global_stats
.bytes_used
+= bucket
->get_size();
2413 global_stats
.bytes_used_rounded
+= bucket
->get_size_rounded();
2414 global_stats
.objects_count
+= bucket
->get_count();
2416 /* operator[] still can create a new entry for storage policy seen
2417 * for first time. */
2418 auto& policy_stats
= policies_stats
[bucket
->get_placement_rule().to_str()];
2419 policy_stats
.bytes_used
+= bucket
->get_size();
2420 policy_stats
.bytes_used_rounded
+= bucket
->get_size_rounded();
2421 policy_stats
.buckets_count
++;
2422 policy_stats
.objects_count
+= bucket
->get_count();
2424 global_stats
.buckets_count
+= m
.size();
2425 total_count
+= m
.size();
2427 done
= (m
.size() < read_count
|| (limit
>= 0 && total_count
>= (uint64_t)limit
));
2430 send_response_begin(buckets
.count() > 0);
2434 if (read_count
> 0 &&
2436 auto riter
= m
.rbegin();
2437 marker
= riter
->first
;
2439 handle_listing_chunk(std::move(buckets
));
2441 } while (is_truncated
&& !done
);
2445 send_response_begin(false);
2447 send_response_end();
2450 void RGWGetUsage::execute(optional_yield y
)
2452 uint64_t start_epoch
= 0;
2453 uint64_t end_epoch
= (uint64_t)-1;
2454 op_ret
= get_params(y
);
2458 if (!start_date
.empty()) {
2459 op_ret
= utime_t::parse_date(start_date
, &start_epoch
, NULL
);
2461 ldpp_dout(this, 0) << "ERROR: failed to parse start date" << dendl
;
2466 if (!end_date
.empty()) {
2467 op_ret
= utime_t::parse_date(end_date
, &end_epoch
, NULL
);
2469 ldpp_dout(this, 0) << "ERROR: failed to parse end date" << dendl
;
2474 uint32_t max_entries
= 1000;
2476 bool is_truncated
= true;
2478 RGWUsageIter usage_iter
;
2480 while (s
->bucket
&& is_truncated
) {
2481 op_ret
= s
->bucket
->read_usage(this, start_epoch
, end_epoch
, max_entries
, &is_truncated
,
2483 if (op_ret
== -ENOENT
) {
2485 is_truncated
= false;
2493 op_ret
= rgw_user_sync_all_stats(this, store
, s
->user
.get(), y
);
2495 ldpp_dout(this, 0) << "ERROR: failed to sync user stats" << dendl
;
2499 op_ret
= rgw_user_get_all_buckets_stats(this, store
, s
->user
.get(), buckets_usage
, y
);
2501 ldpp_dout(this, 0) << "ERROR: failed to get user's buckets stats" << dendl
;
2505 op_ret
= s
->user
->read_stats(this, y
, &stats
);
2507 ldpp_dout(this, 0) << "ERROR: can't read user header" << dendl
;
2514 int RGWStatAccount::verify_permission(optional_yield y
)
2516 if (!verify_user_permission_no_policy(this, s
, RGW_PERM_READ
)) {
2523 void RGWStatAccount::execute(optional_yield y
)
2526 rgw::sal::BucketList buckets
;
2527 uint64_t max_buckets
= s
->cct
->_conf
->rgw_list_buckets_max_chunk
;
2528 const string
*lastmarker
;
2532 lastmarker
= nullptr;
2533 op_ret
= s
->user
->list_buckets(this, marker
, string(), max_buckets
, true, buckets
, y
);
2535 /* hmm.. something wrong here.. the user was authenticated, so it
2537 ldpp_dout(this, 10) << "WARNING: failed on list_buckets uid="
2538 << s
->user
->get_id() << " ret=" << op_ret
<< dendl
;
2541 /* We need to have stats for all our policies - even if a given policy
2542 * isn't actually used in a given account. In such situation its usage
2543 * stats would be simply full of zeros. */
2544 for (const auto& policy
: store
->get_zone()->get_zonegroup().placement_targets
) {
2545 policies_stats
.emplace(policy
.second
.name
,
2546 decltype(policies_stats
)::mapped_type());
2549 std::map
<std::string
, std::unique_ptr
<rgw::sal::Bucket
>>& m
= buckets
.get_buckets();
2550 for (const auto& kv
: m
) {
2551 const auto& bucket
= kv
.second
;
2552 lastmarker
= &kv
.first
;
2554 global_stats
.bytes_used
+= bucket
->get_size();
2555 global_stats
.bytes_used_rounded
+= bucket
->get_size_rounded();
2556 global_stats
.objects_count
+= bucket
->get_count();
2558 /* operator[] still can create a new entry for storage policy seen
2559 * for first time. */
2560 auto& policy_stats
= policies_stats
[bucket
->get_placement_rule().to_str()];
2561 policy_stats
.bytes_used
+= bucket
->get_size();
2562 policy_stats
.bytes_used_rounded
+= bucket
->get_size_rounded();
2563 policy_stats
.buckets_count
++;
2564 policy_stats
.objects_count
+= bucket
->get_count();
2566 global_stats
.buckets_count
+= m
.size();
2570 ldpp_dout(this, -1) << "ERROR: rgw_read_user_buckets, stasis at marker="
2571 << marker
<< " uid=" << s
->user
->get_id() << dendl
;
2574 marker
= *lastmarker
;
2575 } while (buckets
.is_truncated());
2578 int RGWGetBucketVersioning::verify_permission(optional_yield y
)
2580 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
2581 if (has_s3_resource_tag
)
2582 rgw_iam_add_buckettags(this, s
);
2584 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketVersioning
);
2587 void RGWGetBucketVersioning::pre_exec()
2589 rgw_bucket_object_pre_exec(s
);
2592 void RGWGetBucketVersioning::execute(optional_yield y
)
2594 if (! s
->bucket_exists
) {
2595 op_ret
= -ERR_NO_SUCH_BUCKET
;
2599 versioned
= s
->bucket
->versioned();
2600 versioning_enabled
= s
->bucket
->versioning_enabled();
2601 mfa_enabled
= s
->bucket
->get_info().mfa_enabled();
2604 int RGWSetBucketVersioning::verify_permission(optional_yield y
)
2606 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
2607 if (has_s3_resource_tag
)
2608 rgw_iam_add_buckettags(this, s
);
2610 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketVersioning
);
2613 void RGWSetBucketVersioning::pre_exec()
2615 rgw_bucket_object_pre_exec(s
);
2618 void RGWSetBucketVersioning::execute(optional_yield y
)
2620 op_ret
= get_params(y
);
2624 if (! s
->bucket_exists
) {
2625 op_ret
= -ERR_NO_SUCH_BUCKET
;
2629 if (s
->bucket
->get_info().obj_lock_enabled() && versioning_status
!= VersioningEnabled
) {
2630 s
->err
.message
= "bucket versioning cannot be disabled on buckets with object lock enabled";
2631 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
2632 op_ret
= -ERR_INVALID_BUCKET_STATE
;
2636 bool cur_mfa_status
= s
->bucket
->get_info().mfa_enabled();
2638 mfa_set_status
&= (mfa_status
!= cur_mfa_status
);
2640 if (mfa_set_status
&&
2642 op_ret
= -ERR_MFA_REQUIRED
;
2645 //if mfa is enabled for bucket, make sure mfa code is validated in case versioned status gets changed
2646 if (cur_mfa_status
) {
2647 bool req_versioning_status
= false;
2648 //if requested versioning status is not the same as the one set for the bucket, return error
2649 if (versioning_status
== VersioningEnabled
) {
2650 req_versioning_status
= (s
->bucket
->get_info().flags
& BUCKET_VERSIONS_SUSPENDED
) != 0;
2651 } else if (versioning_status
== VersioningSuspended
) {
2652 req_versioning_status
= (s
->bucket
->get_info().flags
& BUCKET_VERSIONS_SUSPENDED
) == 0;
2654 if (req_versioning_status
&& !s
->mfa_verified
) {
2655 op_ret
= -ERR_MFA_REQUIRED
;
2660 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
2662 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
2666 bool modified
= mfa_set_status
;
2668 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [&] {
2669 if (mfa_set_status
) {
2671 s
->bucket
->get_info().flags
|= BUCKET_MFA_ENABLED
;
2673 s
->bucket
->get_info().flags
&= ~BUCKET_MFA_ENABLED
;
2677 if (versioning_status
== VersioningEnabled
) {
2678 s
->bucket
->get_info().flags
|= BUCKET_VERSIONED
;
2679 s
->bucket
->get_info().flags
&= ~BUCKET_VERSIONS_SUSPENDED
;
2681 } else if (versioning_status
== VersioningSuspended
) {
2682 s
->bucket
->get_info().flags
|= (BUCKET_VERSIONED
| BUCKET_VERSIONS_SUSPENDED
);
2687 s
->bucket
->set_attrs(rgw::sal::Attrs(s
->bucket_attrs
));
2688 return s
->bucket
->put_info(this, false, real_time());
2696 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
->get_name()
2697 << " returned err=" << op_ret
<< dendl
;
2702 int RGWGetBucketWebsite::verify_permission(optional_yield y
)
2704 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
2705 if (has_s3_resource_tag
)
2706 rgw_iam_add_buckettags(this, s
);
2708 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketWebsite
);
2711 void RGWGetBucketWebsite::pre_exec()
2713 rgw_bucket_object_pre_exec(s
);
2716 void RGWGetBucketWebsite::execute(optional_yield y
)
2718 if (!s
->bucket
->get_info().has_website
) {
2719 op_ret
= -ERR_NO_SUCH_WEBSITE_CONFIGURATION
;
2723 int RGWSetBucketWebsite::verify_permission(optional_yield y
)
2725 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
2726 if (has_s3_resource_tag
)
2727 rgw_iam_add_buckettags(this, s
);
2729 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketWebsite
);
2732 void RGWSetBucketWebsite::pre_exec()
2734 rgw_bucket_object_pre_exec(s
);
2737 void RGWSetBucketWebsite::execute(optional_yield y
)
2739 op_ret
= get_params(y
);
2744 if (!s
->bucket_exists
) {
2745 op_ret
= -ERR_NO_SUCH_BUCKET
;
2749 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
2751 ldpp_dout(this, 0) << " forward_request_to_master returned ret=" << op_ret
<< dendl
;
2755 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
2756 s
->bucket
->get_info().has_website
= true;
2757 s
->bucket
->get_info().website_conf
= website_conf
;
2758 op_ret
= s
->bucket
->put_info(this, false, real_time());
2763 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
->get_name()
2764 << " returned err=" << op_ret
<< dendl
;
2769 int RGWDeleteBucketWebsite::verify_permission(optional_yield y
)
2771 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
2772 if (has_s3_resource_tag
)
2773 rgw_iam_add_buckettags(this, s
);
2775 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3DeleteBucketWebsite
);
2778 void RGWDeleteBucketWebsite::pre_exec()
2780 rgw_bucket_object_pre_exec(s
);
2783 void RGWDeleteBucketWebsite::execute(optional_yield y
)
2785 if (!s
->bucket_exists
) {
2786 op_ret
= -ERR_NO_SUCH_BUCKET
;
2792 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
2794 ldpp_dout(this, 0) << "NOTICE: forward_to_master failed on bucket=" << s
->bucket
->get_name()
2795 << "returned err=" << op_ret
<< dendl
;
2798 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
2799 s
->bucket
->get_info().has_website
= false;
2800 s
->bucket
->get_info().website_conf
= RGWBucketWebsiteConf();
2801 op_ret
= s
->bucket
->put_info(this, false, real_time());
2805 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
2806 << " returned err=" << op_ret
<< dendl
;
2811 int RGWStatBucket::verify_permission(optional_yield y
)
2813 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
2814 if (has_s3_resource_tag
)
2815 rgw_iam_add_buckettags(this, s
);
2817 // This (a HEAD request on a bucket) is governed by the s3:ListBucket permission.
2818 if (!verify_bucket_permission(this, s
, rgw::IAM::s3ListBucket
)) {
2825 void RGWStatBucket::pre_exec()
2827 rgw_bucket_object_pre_exec(s
);
2830 void RGWStatBucket::execute(optional_yield y
)
2832 if (!s
->bucket_exists
) {
2833 op_ret
= -ERR_NO_SUCH_BUCKET
;
2837 op_ret
= store
->get_bucket(this, s
->user
.get(), s
->bucket
->get_key(), &bucket
, y
);
2841 op_ret
= bucket
->update_container_stats(s
);
2844 int RGWListBucket::verify_permission(optional_yield y
)
2846 op_ret
= get_params(y
);
2850 if (!prefix
.empty())
2851 s
->env
.emplace("s3:prefix", prefix
);
2853 if (!delimiter
.empty())
2854 s
->env
.emplace("s3:delimiter", delimiter
);
2856 s
->env
.emplace("s3:max-keys", std::to_string(max
));
2858 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
2859 if (has_s3_resource_tag
)
2860 rgw_iam_add_buckettags(this, s
);
2862 if (!verify_bucket_permission(this,
2865 rgw::IAM::s3ListBucketVersions
:
2866 rgw::IAM::s3ListBucket
)) {
2873 int RGWListBucket::parse_max_keys()
2875 // Bound max value of max-keys to configured value for security
2876 // Bound min value of max-keys to '0'
2877 // Some S3 clients explicitly send max-keys=0 to detect if the bucket is
2878 // empty without listing any items.
2879 return parse_value_and_bound(max_keys
, max
, 0,
2880 g_conf().get_val
<uint64_t>("rgw_max_listing_results"),
2884 void RGWListBucket::pre_exec()
2886 rgw_bucket_object_pre_exec(s
);
2889 void RGWListBucket::execute(optional_yield y
)
2891 if (!s
->bucket_exists
) {
2892 op_ret
= -ERR_NO_SUCH_BUCKET
;
2896 if (allow_unordered
&& !delimiter
.empty()) {
2897 ldpp_dout(this, 0) <<
2898 "ERROR: unordered bucket listing requested with a delimiter" << dendl
;
2903 if (need_container_stats()) {
2904 op_ret
= s
->bucket
->update_container_stats(s
);
2907 rgw::sal::Bucket::ListParams params
;
2908 params
.prefix
= prefix
;
2909 params
.delim
= delimiter
;
2910 params
.marker
= marker
;
2911 params
.end_marker
= end_marker
;
2912 params
.list_versions
= list_versions
;
2913 params
.allow_unordered
= allow_unordered
;
2914 params
.shard_id
= shard_id
;
2916 rgw::sal::Bucket::ListResults results
;
2918 op_ret
= s
->bucket
->list(this, params
, max
, results
, y
);
2920 next_marker
= results
.next_marker
;
2921 is_truncated
= results
.is_truncated
;
2922 objs
= std::move(results
.objs
);
2923 common_prefixes
= std::move(results
.common_prefixes
);
2927 int RGWGetBucketLogging::verify_permission(optional_yield y
)
2929 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
2930 if (has_s3_resource_tag
)
2931 rgw_iam_add_buckettags(this, s
);
2933 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketLogging
);
2936 int RGWGetBucketLocation::verify_permission(optional_yield y
)
2938 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
2939 if (has_s3_resource_tag
)
2940 rgw_iam_add_buckettags(this, s
);
2942 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketLocation
);
2945 int RGWCreateBucket::verify_permission(optional_yield y
)
2947 /* This check is mostly needed for S3 that doesn't support account ACL.
2948 * Swift doesn't allow to delegate any permission to an anonymous user,
2949 * so it will become an early exit in such case. */
2950 if (s
->auth
.identity
->is_anonymous()) {
2955 bucket
.name
= s
->bucket_name
;
2956 bucket
.tenant
= s
->bucket_tenant
;
2957 ARN arn
= ARN(bucket
);
2958 if (!verify_user_permission(this, s
, arn
, rgw::IAM::s3CreateBucket
)) {
2962 if (s
->user
->get_tenant() != s
->bucket_tenant
) {
2963 //AssumeRole is meant for cross account access
2964 if (s
->auth
.identity
->get_identity_type() != TYPE_ROLE
) {
2965 ldpp_dout(this, 10) << "user cannot create a bucket in a different tenant"
2966 << " (user_id.tenant=" << s
->user
->get_tenant()
2967 << " requested=" << s
->bucket_tenant
<< ")"
2973 if (s
->user
->get_max_buckets() < 0) {
2977 if (s
->user
->get_max_buckets()) {
2978 rgw::sal::BucketList buckets
;
2980 op_ret
= s
->user
->list_buckets(this, marker
, string(), s
->user
->get_max_buckets(),
2986 if ((int)buckets
.count() >= s
->user
->get_max_buckets()) {
2987 return -ERR_TOO_MANY_BUCKETS
;
2994 void RGWCreateBucket::pre_exec()
2996 rgw_bucket_object_pre_exec(s
);
2999 static void prepare_add_del_attrs(const map
<string
, bufferlist
>& orig_attrs
,
3000 map
<string
, bufferlist
>& out_attrs
,
3001 map
<string
, bufferlist
>& out_rmattrs
)
3003 for (const auto& kv
: orig_attrs
) {
3004 const string
& name
= kv
.first
;
3006 /* Check if the attr is user-defined metadata item. */
3007 if (name
.compare(0, sizeof(RGW_ATTR_META_PREFIX
) - 1,
3008 RGW_ATTR_META_PREFIX
) == 0) {
3009 /* For the objects all existing meta attrs have to be removed. */
3010 out_rmattrs
[name
] = kv
.second
;
3011 } else if (out_attrs
.find(name
) == std::end(out_attrs
)) {
3012 out_attrs
[name
] = kv
.second
;
3017 /* Fuse resource metadata basing on original attributes in @orig_attrs, set
3018 * of _custom_ attribute names to remove in @rmattr_names and attributes in
3019 * @out_attrs. Place results in @out_attrs.
3021 * NOTE: it's supposed that all special attrs already present in @out_attrs
3022 * will be preserved without any change. Special attributes are those which
3023 * names start with RGW_ATTR_META_PREFIX. They're complement to custom ones
3024 * used for X-Account-Meta-*, X-Container-Meta-*, X-Amz-Meta and so on. */
3025 static void prepare_add_del_attrs(const map
<string
, bufferlist
>& orig_attrs
,
3026 const set
<string
>& rmattr_names
,
3027 map
<string
, bufferlist
>& out_attrs
)
3029 for (const auto& kv
: orig_attrs
) {
3030 const string
& name
= kv
.first
;
3032 /* Check if the attr is user-defined metadata item. */
3033 if (name
.compare(0, strlen(RGW_ATTR_META_PREFIX
),
3034 RGW_ATTR_META_PREFIX
) == 0) {
3035 /* For the buckets all existing meta attrs are preserved,
3036 except those that are listed in rmattr_names. */
3037 if (rmattr_names
.find(name
) != std::end(rmattr_names
)) {
3038 const auto aiter
= out_attrs
.find(name
);
3040 if (aiter
!= std::end(out_attrs
)) {
3041 out_attrs
.erase(aiter
);
3044 /* emplace() won't alter the map if the key is already present.
3045 * This behaviour is fully intensional here. */
3046 out_attrs
.emplace(kv
);
3048 } else if (out_attrs
.find(name
) == std::end(out_attrs
)) {
3049 out_attrs
[name
] = kv
.second
;
3055 static void populate_with_generic_attrs(const req_state
* const s
,
3056 map
<string
, bufferlist
>& out_attrs
)
3058 for (const auto& kv
: s
->generic_attrs
) {
3059 bufferlist
& attrbl
= out_attrs
[kv
.first
];
3060 const string
& val
= kv
.second
;
3062 attrbl
.append(val
.c_str(), val
.size() + 1);
3067 static int filter_out_quota_info(std::map
<std::string
, bufferlist
>& add_attrs
,
3068 const std::set
<std::string
>& rmattr_names
,
3069 RGWQuotaInfo
& quota
,
3070 bool * quota_extracted
= nullptr)
3072 bool extracted
= false;
3074 /* Put new limit on max objects. */
3075 auto iter
= add_attrs
.find(RGW_ATTR_QUOTA_NOBJS
);
3077 if (std::end(add_attrs
) != iter
) {
3079 static_cast<int64_t>(strict_strtoll(iter
->second
.c_str(), 10, &err
));
3083 add_attrs
.erase(iter
);
3087 /* Put new limit on bucket (container) size. */
3088 iter
= add_attrs
.find(RGW_ATTR_QUOTA_MSIZE
);
3089 if (iter
!= add_attrs
.end()) {
3091 static_cast<int64_t>(strict_strtoll(iter
->second
.c_str(), 10, &err
));
3095 add_attrs
.erase(iter
);
3099 for (const auto& name
: rmattr_names
) {
3100 /* Remove limit on max objects. */
3101 if (name
.compare(RGW_ATTR_QUOTA_NOBJS
) == 0) {
3102 quota
.max_objects
= -1;
3106 /* Remove limit on max bucket size. */
3107 if (name
.compare(RGW_ATTR_QUOTA_MSIZE
) == 0) {
3108 quota
.max_size
= -1;
3113 /* Swift requries checking on raw usage instead of the 4 KiB rounded one. */
3114 quota
.check_on_raw
= true;
3115 quota
.enabled
= quota
.max_size
> 0 || quota
.max_objects
> 0;
3117 if (quota_extracted
) {
3118 *quota_extracted
= extracted
;
3125 static void filter_out_website(std::map
<std::string
, ceph::bufferlist
>& add_attrs
,
3126 const std::set
<std::string
>& rmattr_names
,
3127 RGWBucketWebsiteConf
& ws_conf
)
3131 /* Let's define a mapping between each custom attribute and the memory where
3132 * attribute's value should be stored. The memory location is expressed by
3133 * a non-const reference. */
3134 const auto mapping
= {
3135 std::make_pair(RGW_ATTR_WEB_INDEX
, std::ref(ws_conf
.index_doc_suffix
)),
3136 std::make_pair(RGW_ATTR_WEB_ERROR
, std::ref(ws_conf
.error_doc
)),
3137 std::make_pair(RGW_ATTR_WEB_LISTINGS
, std::ref(lstval
)),
3138 std::make_pair(RGW_ATTR_WEB_LIST_CSS
, std::ref(ws_conf
.listing_css_doc
)),
3139 std::make_pair(RGW_ATTR_SUBDIR_MARKER
, std::ref(ws_conf
.subdir_marker
))
3142 for (const auto& kv
: mapping
) {
3143 const char * const key
= kv
.first
;
3144 auto& target
= kv
.second
;
3146 auto iter
= add_attrs
.find(key
);
3148 if (std::end(add_attrs
) != iter
) {
3149 /* The "target" is a reference to ws_conf. */
3150 target
= iter
->second
.c_str();
3151 add_attrs
.erase(iter
);
3154 if (rmattr_names
.count(key
)) {
3155 target
= std::string();
3159 if (! lstval
.empty()) {
3160 ws_conf
.listing_enabled
= boost::algorithm::iequals(lstval
, "true");
3165 void RGWCreateBucket::execute(optional_yield y
)
3168 buffer::list corsbl
;
3169 string bucket_name
= rgw_make_bucket_entry_name(s
->bucket_tenant
, s
->bucket_name
);
3170 rgw_raw_obj
obj(store
->get_zone()->get_params().domain_root
, bucket_name
);
3172 op_ret
= get_params(y
);
3176 if (!relaxed_region_enforcement
&&
3177 !location_constraint
.empty() &&
3178 !store
->get_zone()->has_zonegroup_api(location_constraint
)) {
3179 ldpp_dout(this, 0) << "location constraint (" << location_constraint
<< ")"
3180 << " can't be found." << dendl
;
3181 op_ret
= -ERR_INVALID_LOCATION_CONSTRAINT
;
3182 s
->err
.message
= "The specified location-constraint is not valid";
3186 if (!relaxed_region_enforcement
&& !store
->get_zone()->get_zonegroup().is_master_zonegroup() && !location_constraint
.empty() &&
3187 store
->get_zone()->get_zonegroup().api_name
!= location_constraint
) {
3188 ldpp_dout(this, 0) << "location constraint (" << location_constraint
<< ")"
3189 << " doesn't match zonegroup" << " (" << store
->get_zone()->get_zonegroup().api_name
<< ")"
3191 op_ret
= -ERR_INVALID_LOCATION_CONSTRAINT
;
3192 s
->err
.message
= "The specified location-constraint is not valid";
3196 const auto& zonegroup
= store
->get_zone()->get_zonegroup();
3197 if (!placement_rule
.name
.empty() &&
3198 !zonegroup
.placement_targets
.count(placement_rule
.name
)) {
3199 ldpp_dout(this, 0) << "placement target (" << placement_rule
.name
<< ")"
3200 << " doesn't exist in the placement targets of zonegroup"
3201 << " (" << store
->get_zone()->get_zonegroup().api_name
<< ")" << dendl
;
3202 op_ret
= -ERR_INVALID_LOCATION_CONSTRAINT
;
3203 s
->err
.message
= "The specified placement target does not exist";
3207 /* we need to make sure we read bucket info, it's not read before for this
3208 * specific request */
3210 std::unique_ptr
<rgw::sal::Bucket
> tmp_bucket
;
3211 op_ret
= store
->get_bucket(this, s
->user
.get(), s
->bucket_tenant
,
3212 s
->bucket_name
, &tmp_bucket
, y
);
3213 if (op_ret
< 0 && op_ret
!= -ENOENT
)
3215 s
->bucket_exists
= (op_ret
!= -ENOENT
);
3217 if (s
->bucket_exists
) {
3218 if (!s
->system_request
&&
3219 store
->get_zone()->get_zonegroup().get_id() !=
3220 tmp_bucket
->get_info().zonegroup
) {
3224 /* Initialize info from req_state */
3225 info
= tmp_bucket
->get_info();
3229 s
->bucket_owner
.set_id(s
->user
->get_id()); /* XXX dang use s->bucket->owner */
3230 s
->bucket_owner
.set_name(s
->user
->get_display_name());
3232 string zonegroup_id
;
3234 if (s
->system_request
) {
3235 zonegroup_id
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"zonegroup");
3236 if (zonegroup_id
.empty()) {
3237 zonegroup_id
= store
->get_zone()->get_zonegroup().get_id();
3240 zonegroup_id
= store
->get_zone()->get_zonegroup().get_id();
3243 /* Encode special metadata first as we're using std::map::emplace under
3244 * the hood. This method will add the new items only if the map doesn't
3245 * contain such keys yet. */
3246 policy
.encode(aclbl
);
3247 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
3250 cors_config
.encode(corsbl
);
3251 emplace_attr(RGW_ATTR_CORS
, std::move(corsbl
));
3254 RGWQuotaInfo quota_info
;
3255 const RGWQuotaInfo
* pquota_info
= nullptr;
3256 if (need_metadata_upload()) {
3257 /* It's supposed that following functions WILL NOT change any special
3258 * attributes (like RGW_ATTR_ACL) if they are already present in attrs. */
3259 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
, false);
3263 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
3264 populate_with_generic_attrs(s
, attrs
);
3266 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, quota_info
);
3270 pquota_info
= "a_info
;
3273 /* Web site of Swift API. */
3274 filter_out_website(attrs
, rmattr_names
, info
.website_conf
);
3275 info
.has_website
= !info
.website_conf
.is_empty();
3278 rgw_bucket tmp_bucket
;
3279 tmp_bucket
.tenant
= s
->bucket_tenant
; /* ignored if bucket exists */
3280 tmp_bucket
.name
= s
->bucket_name
;
3282 /* Handle updates of the metadata for Swift's object versioning. */
3283 if (swift_ver_location
) {
3284 info
.swift_ver_location
= *swift_ver_location
;
3285 info
.swift_versioning
= (! swift_ver_location
->empty());
3288 /* We're replacing bucket with the newly created one */
3289 ldpp_dout(this, 10) << "user=" << s
->user
<< " bucket=" << tmp_bucket
<< dendl
;
3290 op_ret
= s
->user
->create_bucket(this, tmp_bucket
, zonegroup_id
,
3292 info
.swift_ver_location
,
3293 pquota_info
, policy
, attrs
, info
, ep_objv
,
3294 true, obj_lock_enabled
, &s
->bucket_exists
, s
->info
,
3297 /* continue if EEXIST and create_bucket will fail below. this way we can
3298 * recover from a partial create by retrying it. */
3299 ldpp_dout(this, 20) << "rgw_create_bucket returned ret=" << op_ret
<< " bucket=" << s
->bucket
.get() << dendl
;
3304 const bool existed
= s
->bucket_exists
;
3305 if (need_metadata_upload() && existed
) {
3306 /* OK, it looks we lost race with another request. As it's required to
3307 * handle metadata fusion and upload, the whole operation becomes very
3308 * similar in nature to PutMetadataBucket. However, as the attrs may
3309 * changed in the meantime, we have to refresh. */
3312 map
<string
, bufferlist
> battrs
;
3314 op_ret
= s
->bucket
->load_bucket(this, y
);
3317 } else if (!s
->bucket
->is_owner(s
->user
.get())) {
3318 /* New bucket doesn't belong to the account we're operating on. */
3322 s
->bucket_attrs
= s
->bucket
->get_attrs();
3327 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
, false);
3331 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
3332 populate_with_generic_attrs(s
, attrs
);
3333 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, s
->bucket
->get_info().quota
);
3338 /* Handle updates of the metadata for Swift's object versioning. */
3339 if (swift_ver_location
) {
3340 s
->bucket
->get_info().swift_ver_location
= *swift_ver_location
;
3341 s
->bucket
->get_info().swift_versioning
= (! swift_ver_location
->empty());
3344 /* Web site of Swift API. */
3345 filter_out_website(attrs
, rmattr_names
, s
->bucket
->get_info().website_conf
);
3346 s
->bucket
->get_info().has_website
= !s
->bucket
->get_info().website_conf
.is_empty();
3348 /* This will also set the quota on the bucket. */
3349 op_ret
= s
->bucket
->merge_and_store_attrs(this, attrs
, y
);
3350 } while (op_ret
== -ECANCELED
&& tries
++ < 20);
3352 /* Restore the proper return code. */
3354 op_ret
= -ERR_BUCKET_EXISTS
;
3359 int RGWDeleteBucket::verify_permission(optional_yield y
)
3361 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
3362 if (has_s3_resource_tag
)
3363 rgw_iam_add_buckettags(this, s
);
3365 if (!verify_bucket_permission(this, s
, rgw::IAM::s3DeleteBucket
)) {
3372 void RGWDeleteBucket::pre_exec()
3374 rgw_bucket_object_pre_exec(s
);
3377 void RGWDeleteBucket::execute(optional_yield y
)
3379 if (s
->bucket_name
.empty()) {
3384 if (!s
->bucket_exists
) {
3385 ldpp_dout(this, 0) << "ERROR: bucket " << s
->bucket_name
<< " not found" << dendl
;
3386 op_ret
= -ERR_NO_SUCH_BUCKET
;
3389 RGWObjVersionTracker ot
;
3390 ot
.read_version
= s
->bucket
->get_version();
3392 if (s
->system_request
) {
3393 string tag
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"tag");
3394 string ver_str
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"ver");
3396 ot
.read_version
.tag
= tag
;
3399 ver
= strict_strtol(ver_str
.c_str(), 10, &err
);
3401 ldpp_dout(this, 0) << "failed to parse ver param" << dendl
;
3405 ot
.read_version
.ver
= ver
;
3409 op_ret
= s
->bucket
->sync_user_stats(this, y
);
3411 ldpp_dout(this, 1) << "WARNING: failed to sync user stats before bucket delete: op_ret= " << op_ret
<< dendl
;
3414 op_ret
= s
->bucket
->check_empty(this, y
);
3420 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), &ot
.read_version
, in_data
, nullptr, s
->info
, y
);
3422 if (op_ret
== -ENOENT
) {
3423 /* adjust error, we want to return with NoSuchBucket and not
3425 op_ret
= -ERR_NO_SUCH_BUCKET
;
3430 op_ret
= s
->bucket
->remove_bucket(this, false, false, nullptr, y
);
3431 if (op_ret
< 0 && op_ret
== -ECANCELED
) {
3432 // lost a race, either with mdlog sync or another delete bucket operation.
3433 // in either case, we've already called ctl.bucket->unlink_bucket()
3440 int RGWPutObj::init_processing(optional_yield y
) {
3441 copy_source
= url_decode(s
->info
.env
->get("HTTP_X_AMZ_COPY_SOURCE", ""));
3442 copy_source_range
= s
->info
.env
->get("HTTP_X_AMZ_COPY_SOURCE_RANGE");
3446 /* handle x-amz-copy-source */
3447 std::string_view
cs_view(copy_source
);
3448 if (! cs_view
.empty()) {
3449 if (cs_view
[0] == '/')
3450 cs_view
.remove_prefix(1);
3451 copy_source_bucket_name
= std::string(cs_view
);
3452 pos
= copy_source_bucket_name
.find("/");
3453 if (pos
== std::string::npos
) {
3455 ldpp_dout(this, 5) << "x-amz-copy-source bad format" << dendl
;
3458 copy_source_object_name
=
3459 copy_source_bucket_name
.substr(pos
+ 1, copy_source_bucket_name
.size());
3460 copy_source_bucket_name
= copy_source_bucket_name
.substr(0, pos
);
3461 #define VERSION_ID_STR "?versionId="
3462 pos
= copy_source_object_name
.find(VERSION_ID_STR
);
3463 if (pos
== std::string::npos
) {
3464 copy_source_object_name
= url_decode(copy_source_object_name
);
3466 copy_source_version_id
=
3467 copy_source_object_name
.substr(pos
+ sizeof(VERSION_ID_STR
) - 1);
3468 copy_source_object_name
=
3469 url_decode(copy_source_object_name
.substr(0, pos
));
3471 pos
= copy_source_bucket_name
.find(":");
3472 if (pos
== std::string::npos
) {
3473 // if tenant is not specified in x-amz-copy-source, use tenant of the requester
3474 copy_source_tenant_name
= s
->user
->get_tenant();
3476 copy_source_tenant_name
= copy_source_bucket_name
.substr(0, pos
);
3477 copy_source_bucket_name
= copy_source_bucket_name
.substr(pos
+ 1, copy_source_bucket_name
.size());
3478 if (copy_source_bucket_name
.empty()) {
3480 ldpp_dout(this, 5) << "source bucket name is empty" << dendl
;
3484 std::unique_ptr
<rgw::sal::Bucket
> bucket
;
3485 ret
= store
->get_bucket(this, s
->user
.get(), copy_source_tenant_name
, copy_source_bucket_name
,
3488 ldpp_dout(this, 5) << __func__
<< "(): get_bucket() returned ret=" << ret
<< dendl
;
3489 if (ret
== -ENOENT
) {
3490 ret
= -ERR_NO_SUCH_BUCKET
;
3495 ret
= bucket
->load_bucket(this, y
);
3497 ldpp_dout(this, 5) << __func__
<< "(): load_bucket() returned ret=" << ret
<< dendl
;
3500 copy_source_bucket_info
= bucket
->get_info();
3502 /* handle x-amz-copy-source-range */
3503 if (copy_source_range
) {
3504 string range
= copy_source_range
;
3505 pos
= range
.find("bytes=");
3506 if (pos
== std::string::npos
|| pos
!= 0) {
3508 ldpp_dout(this, 5) << "x-amz-copy-source-range bad format" << dendl
;
3511 /* 6 is the length of "bytes=" */
3512 range
= range
.substr(pos
+ 6);
3513 pos
= range
.find("-");
3514 if (pos
== std::string::npos
) {
3516 ldpp_dout(this, 5) << "x-amz-copy-source-range bad format" << dendl
;
3519 string first
= range
.substr(0, pos
);
3520 string last
= range
.substr(pos
+ 1);
3521 if (first
.find_first_not_of("0123456789") != std::string::npos
||
3522 last
.find_first_not_of("0123456789") != std::string::npos
) {
3523 ldpp_dout(this, 5) << "x-amz-copy-source-range bad format not an integer" << dendl
;
3527 copy_source_range_fst
= strtoull(first
.c_str(), NULL
, 10);
3528 copy_source_range_lst
= strtoull(last
.c_str(), NULL
, 10);
3529 if (copy_source_range_fst
> copy_source_range_lst
) {
3531 ldpp_dout(this, 5) << "x-amz-copy-source-range bad format first number bigger than second" << dendl
;
3537 return RGWOp::init_processing(y
);
3540 int RGWPutObj::verify_permission(optional_yield y
)
3542 if (! copy_source
.empty()) {
3544 RGWAccessControlPolicy
cs_acl(s
->cct
);
3545 boost::optional
<Policy
> policy
;
3546 map
<string
, bufferlist
> cs_attrs
;
3547 std::unique_ptr
<rgw::sal::Bucket
> cs_bucket
;
3548 int ret
= store
->get_bucket(NULL
, copy_source_bucket_info
, &cs_bucket
);
3552 std::unique_ptr
<rgw::sal::Object
> cs_object
=
3553 cs_bucket
->get_object(rgw_obj_key(copy_source_object_name
, copy_source_version_id
));
3555 cs_object
->set_atomic(s
->obj_ctx
);
3556 cs_object
->set_prefetch_data(s
->obj_ctx
);
3558 /* check source object permissions */
3559 if (ret
= read_obj_policy(this, store
, s
, copy_source_bucket_info
, cs_attrs
, &cs_acl
, nullptr,
3560 policy
, cs_bucket
.get(), cs_object
.get(), y
, true); ret
< 0) {
3564 /* admin request overrides permission checks */
3565 if (! s
->auth
.identity
->is_admin_of(cs_acl
.get_owner().get_id())) {
3566 if (policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
3567 //add source object tags for permission evaluation
3568 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, policy
, s
->iam_user_policies
, s
->session_policies
);
3569 if (has_s3_existing_tag
|| has_s3_resource_tag
)
3570 rgw_iam_add_objtags(this, s
, cs_object
.get(), has_s3_existing_tag
, has_s3_resource_tag
);
3571 auto usr_policy_res
= Effect::Pass
;
3572 rgw::ARN
obj_arn(cs_object
->get_obj());
3573 for (auto& user_policy
: s
->iam_user_policies
) {
3574 if (usr_policy_res
= user_policy
.eval(s
->env
, *s
->auth
.identity
,
3575 cs_object
->get_instance().empty() ?
3576 rgw::IAM::s3GetObject
:
3577 rgw::IAM::s3GetObjectVersion
,
3578 obj_arn
); usr_policy_res
== Effect::Deny
)
3580 else if (usr_policy_res
== Effect::Allow
)
3583 rgw::IAM::Effect e
= Effect::Pass
;
3585 rgw::ARN
obj_arn(cs_object
->get_obj());
3586 e
= policy
->eval(s
->env
, *s
->auth
.identity
,
3587 cs_object
->get_instance().empty() ?
3588 rgw::IAM::s3GetObject
:
3589 rgw::IAM::s3GetObjectVersion
,
3592 if (e
== Effect::Deny
) {
3594 } else if (usr_policy_res
== Effect::Pass
&& e
== Effect::Pass
&&
3595 !cs_acl
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
3599 rgw_iam_remove_objtags(this, s
, cs_object
.get(), has_s3_existing_tag
, has_s3_resource_tag
);
3600 } else if (!cs_acl
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
3607 if (s
->bucket_access_conf
&& s
->bucket_access_conf
->block_public_acls()) {
3608 if (s
->canned_acl
.compare("public-read") ||
3609 s
->canned_acl
.compare("public-read-write") ||
3610 s
->canned_acl
.compare("authenticated-read"))
3614 auto op_ret
= get_params(y
);
3616 ldpp_dout(this, 20) << "get_params() returned ret=" << op_ret
<< dendl
;
3620 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
3621 rgw_add_grant_to_iam_environment(s
->env
, s
);
3623 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-acl", s
->canned_acl
);
3625 if (obj_tags
!= nullptr && obj_tags
->count() > 0){
3626 auto tags
= obj_tags
->get_tags();
3627 for (const auto& kv
: tags
){
3628 rgw_add_to_iam_environment(s
->env
, "s3:RequestObjectTag/"+kv
.first
, kv
.second
);
3632 constexpr auto encrypt_attr
= "x-amz-server-side-encryption";
3633 constexpr auto s3_encrypt_attr
= "s3:x-amz-server-side-encryption";
3634 auto enc_header
= s
->info
.x_meta_map
.find(encrypt_attr
);
3635 if (enc_header
!= s
->info
.x_meta_map
.end()){
3636 rgw_add_to_iam_environment(s
->env
, s3_encrypt_attr
, enc_header
->second
);
3639 constexpr auto kms_attr
= "x-amz-server-side-encryption-aws-kms-key-id";
3640 constexpr auto s3_kms_attr
= "s3:x-amz-server-side-encryption-aws-kms-key-id";
3641 auto kms_header
= s
->info
.x_meta_map
.find(kms_attr
);
3642 if (kms_header
!= s
->info
.x_meta_map
.end()){
3643 rgw_add_to_iam_environment(s
->env
, s3_kms_attr
, kms_header
->second
);
3646 // Add bucket tags for authorization
3647 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
3648 if (has_s3_resource_tag
)
3649 rgw_iam_add_buckettags(this, s
);
3651 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
3652 rgw::IAM::s3PutObject
,
3653 s
->object
->get_obj());
3654 if (identity_policy_res
== Effect::Deny
)
3657 rgw::IAM::Effect e
= Effect::Pass
;
3658 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
3659 if (s
->iam_policy
) {
3660 ARN
obj_arn(s
->object
->get_obj());
3661 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
3662 rgw::IAM::s3PutObject
,
3666 if (e
== Effect::Deny
) {
3670 if (!s
->session_policies
.empty()) {
3671 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
3672 rgw::IAM::s3PutObject
,
3673 s
->object
->get_obj());
3674 if (session_policy_res
== Effect::Deny
) {
3677 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
3678 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
3679 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
3680 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
))
3682 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
3683 //Intersection of session policy and identity policy plus bucket policy
3684 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
)
3686 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
3687 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
)
3692 if (e
== Effect::Allow
|| identity_policy_res
== Effect::Allow
) {
3697 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
3705 void RGWPutObj::pre_exec()
3707 rgw_bucket_object_pre_exec(s
);
3710 class RGWPutObj_CB
: public RGWGetObj_Filter
3714 explicit RGWPutObj_CB(RGWPutObj
*_op
) : op(_op
) {}
3715 ~RGWPutObj_CB() override
{}
3717 int handle_data(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
) override
{
3718 return op
->get_data_cb(bl
, bl_ofs
, bl_len
);
3722 int RGWPutObj::get_data_cb(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
)
3725 bl
.begin(bl_ofs
).copy(bl_len
, bl_tmp
);
3727 bl_aux
.append(bl_tmp
);
3732 int RGWPutObj::get_data(const off_t fst
, const off_t lst
, bufferlist
& bl
)
3734 RGWPutObj_CB
cb(this);
3735 RGWGetObj_Filter
* filter
= &cb
;
3736 boost::optional
<RGWGetObj_Decompress
> decompress
;
3737 std::unique_ptr
<RGWGetObj_Filter
> decrypt
;
3738 RGWCompressionInfo cs_info
;
3739 map
<string
, bufferlist
> attrs
;
3743 int64_t new_ofs
, new_end
;
3748 std::unique_ptr
<rgw::sal::Bucket
> bucket
;
3749 ret
= store
->get_bucket(nullptr, copy_source_bucket_info
, &bucket
);
3753 std::unique_ptr
<rgw::sal::Object
> obj
= bucket
->get_object(rgw_obj_key(copy_source_object_name
, copy_source_version_id
));
3754 std::unique_ptr
<rgw::sal::Object::ReadOp
> read_op(obj
->get_read_op(s
->obj_ctx
));
3756 ret
= read_op
->prepare(s
->yield
, this);
3760 obj_size
= obj
->get_obj_size();
3762 bool need_decompress
;
3763 op_ret
= rgw_compression_info_from_attrset(obj
->get_attrs(), need_decompress
, cs_info
);
3765 ldpp_dout(this, 0) << "ERROR: failed to decode compression info" << dendl
;
3769 bool partial_content
= true;
3770 if (need_decompress
)
3772 obj_size
= cs_info
.orig_size
;
3773 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
3774 filter
= &*decompress
;
3777 auto attr_iter
= obj
->get_attrs().find(RGW_ATTR_MANIFEST
);
3778 op_ret
= this->get_decrypt_filter(&decrypt
,
3781 attr_iter
!= obj
->get_attrs().end() ? &(attr_iter
->second
) : nullptr);
3782 if (decrypt
!= nullptr) {
3783 filter
= decrypt
.get();
3789 ret
= obj
->range_to_ofs(obj_size
, new_ofs
, new_end
);
3793 filter
->fixup_range(new_ofs
, new_end
);
3794 ret
= read_op
->iterate(this, new_ofs
, new_end
, filter
, s
->yield
);
3797 ret
= filter
->flush();
3799 bl
.claim_append(bl_aux
);
3804 // special handling for compression type = "random" with multipart uploads
3805 static CompressorRef
get_compressor_plugin(const req_state
*s
,
3806 const std::string
& compression_type
)
3808 if (compression_type
!= "random") {
3809 return Compressor::create(s
->cct
, compression_type
);
3812 bool is_multipart
{false};
3813 const auto& upload_id
= s
->info
.args
.get("uploadId", &is_multipart
);
3815 if (!is_multipart
) {
3816 return Compressor::create(s
->cct
, compression_type
);
3819 // use a hash of the multipart upload id so all parts use the same plugin
3820 const auto alg
= std::hash
<std::string
>{}(upload_id
) % Compressor::COMP_ALG_LAST
;
3821 if (alg
== Compressor::COMP_ALG_NONE
) {
3824 return Compressor::create(s
->cct
, alg
);
3827 void RGWPutObj::execute(optional_yield y
)
3829 char supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1];
3830 char supplied_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
3831 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
3832 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
3834 // Allow use of MD5 digest in FIPS mode for non-cryptographic purposes
3835 hash
.SetFlags(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
);
3836 bufferlist bl
, aclbl
, bs
;
3842 bool need_calc_md5
= (dlo_manifest
== NULL
) && (slo_info
== NULL
);
3843 perfcounter
->inc(l_rgw_put
);
3844 // report latency on return
3845 auto put_lat
= make_scope_guard([&] {
3846 perfcounter
->tinc(l_rgw_put_lat
, s
->time_elapsed());
3850 if (rgw::sal::Object::empty(s
->object
.get())) {
3854 if (!s
->bucket_exists
) {
3855 op_ret
= -ERR_NO_SUCH_BUCKET
;
3859 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
3861 ldpp_dout(this, 20) << "get_system_versioning_params() returned ret="
3866 if (supplied_md5_b64
) {
3867 need_calc_md5
= true;
3869 ldpp_dout(this, 15) << "supplied_md5_b64=" << supplied_md5_b64
<< dendl
;
3870 op_ret
= ceph_unarmor(supplied_md5_bin
, &supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1],
3871 supplied_md5_b64
, supplied_md5_b64
+ strlen(supplied_md5_b64
));
3872 ldpp_dout(this, 15) << "ceph_armor ret=" << op_ret
<< dendl
;
3873 if (op_ret
!= CEPH_CRYPTO_MD5_DIGESTSIZE
) {
3874 op_ret
= -ERR_INVALID_DIGEST
;
3878 buf_to_hex((const unsigned char *)supplied_md5_bin
, CEPH_CRYPTO_MD5_DIGESTSIZE
, supplied_md5
);
3879 ldpp_dout(this, 15) << "supplied_md5=" << supplied_md5
<< dendl
;
3882 if (!chunked_upload
) { /* with chunked upload we don't know how big is the upload.
3883 we also check sizes at the end anyway */
3884 op_ret
= s
->bucket
->check_quota(this, user_quota
, bucket_quota
, s
->content_length
, y
);
3886 ldpp_dout(this, 20) << "check_quota() returned ret=" << op_ret
<< dendl
;
3891 if (supplied_etag
) {
3892 strncpy(supplied_md5
, supplied_etag
, sizeof(supplied_md5
) - 1);
3893 supplied_md5
[sizeof(supplied_md5
) - 1] = '\0';
3896 const bool multipart
= !multipart_upload_id
.empty();
3897 auto& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
3899 /* Handle object versioning of Swift API. */
3901 op_ret
= s
->object
->swift_versioning_copy(s
->obj_ctx
, this, s
->yield
);
3907 // make reservation for notification if needed
3908 std::unique_ptr
<rgw::sal::Notification
> res
3909 = store
->get_notification(
3910 s
->object
.get(), s
->src_object
.get(), s
,
3911 rgw::notify::ObjectCreatedPut
);
3913 op_ret
= res
->publish_reserve(this, obj_tags
.get());
3919 // create the object processor
3920 auto aio
= rgw::make_throttle(s
->cct
->_conf
->rgw_put_obj_min_window_size
,
3922 std::unique_ptr
<rgw::sal::Writer
> processor
;
3924 rgw_placement_rule
*pdest_placement
= &s
->dest_placement
;
3927 std::unique_ptr
<rgw::sal::MultipartUpload
> upload
;
3928 upload
= s
->bucket
->get_multipart_upload(s
->object
->get_name(),
3929 multipart_upload_id
);
3930 op_ret
= upload
->get_info(this, s
->yield
, s
->obj_ctx
, &pdest_placement
);
3932 s
->trace
->SetAttribute(tracing::rgw::UPLOAD_ID
, multipart_upload_id
);
3933 multipart_trace
= tracing::rgw::tracer
.add_span(name(), upload
->get_trace());
3936 if (op_ret
!= -ENOENT
) {
3937 ldpp_dout(this, 0) << "ERROR: get_multipart_info returned " << op_ret
<< ": " << cpp_strerror(-op_ret
) << dendl
;
3938 } else {// -ENOENT: raced with upload complete/cancel, no need to spam log
3939 ldpp_dout(this, 20) << "failed to get multipart info (returned " << op_ret
<< ": " << cpp_strerror(-op_ret
) << "): probably raced with upload complete / cancel" << dendl
;
3943 /* upload will go out of scope, so copy the dest placement for later use */
3944 s
->dest_placement
= *pdest_placement
;
3945 pdest_placement
= &s
->dest_placement
;
3946 ldpp_dout(this, 20) << "dest_placement for part=" << *pdest_placement
<< dendl
;
3947 processor
= upload
->get_writer(this, s
->yield
, s
->object
->clone(),
3948 s
->user
->get_id(), obj_ctx
, pdest_placement
,
3949 multipart_part_num
, multipart_part_str
);
3951 if (s
->bucket
->versioned()) {
3952 op_ret
= -ERR_INVALID_BUCKET_STATE
;
3955 processor
= store
->get_append_writer(this, s
->yield
, s
->object
->clone(),
3956 s
->bucket_owner
.get_id(), obj_ctx
,
3957 pdest_placement
, s
->req_id
, position
,
3958 &cur_accounted_size
);
3960 if (s
->bucket
->versioning_enabled()) {
3961 if (!version_id
.empty()) {
3962 s
->object
->set_instance(version_id
);
3964 s
->object
->gen_rand_obj_instance_name();
3965 version_id
= s
->object
->get_instance();
3968 processor
= store
->get_atomic_writer(this, s
->yield
, s
->object
->clone(),
3969 s
->bucket_owner
.get_id(), obj_ctx
,
3970 pdest_placement
, olh_epoch
, s
->req_id
);
3973 op_ret
= processor
->prepare(s
->yield
);
3975 ldpp_dout(this, 20) << "processor->prepare() returned ret=" << op_ret
3979 if ((! copy_source
.empty()) && !copy_source_range
) {
3980 std::unique_ptr
<rgw::sal::Bucket
> bucket
;
3981 op_ret
= store
->get_bucket(nullptr, copy_source_bucket_info
, &bucket
);
3983 ldpp_dout(this, 0) << "ERROR: failed to get bucket with error" << op_ret
<< dendl
;
3986 std::unique_ptr
<rgw::sal::Object
> obj
=
3987 bucket
->get_object(rgw_obj_key(copy_source_object_name
, copy_source_version_id
));
3989 RGWObjState
*astate
;
3990 op_ret
= obj
->get_obj_state(this, &obj_ctx
, &astate
, s
->yield
);
3992 ldpp_dout(this, 0) << "ERROR: get copy source obj state returned with error" << op_ret
<< dendl
;
3996 if (astate
->get_attr(RGW_ATTR_MANIFEST
, bl
)) {
3999 if (m
.get_tier_type() == "cloud-s3") {
4000 op_ret
= -ERR_INVALID_OBJECT_STATE
;
4001 ldpp_dout(this, 0) << "ERROR: Cannot copy cloud tiered object. Failing with "
4007 if (!astate
->exists
){
4011 lst
= astate
->accounted_size
- 1;
4013 lst
= copy_source_range_lst
;
4015 fst
= copy_source_range_fst
;
4017 // no filters by default
4018 rgw::sal::DataProcessor
*filter
= processor
.get();
4020 const auto& compression_type
= store
->get_zone()->get_params().get_compression_type(*pdest_placement
);
4021 CompressorRef plugin
;
4022 boost::optional
<RGWPutObj_Compress
> compressor
;
4024 std::unique_ptr
<rgw::sal::DataProcessor
> encrypt
;
4026 if (!append
) { // compression and encryption only apply to full object uploads
4027 op_ret
= get_encrypt_filter(&encrypt
, filter
);
4031 if (encrypt
!= nullptr) {
4033 } else if (compression_type
!= "none") {
4034 plugin
= get_compressor_plugin(s
, compression_type
);
4036 ldpp_dout(this, 1) << "Cannot load plugin for compression type "
4037 << compression_type
<< dendl
;
4039 compressor
.emplace(s
->cct
, plugin
, filter
);
4040 filter
= &*compressor
;
4041 // always send incompressible hint when rgw is itself doing compression
4042 s
->object
->set_compressed(s
->obj_ctx
);
4046 tracepoint(rgw_op
, before_data_transfer
, s
->req_id
.c_str());
4051 if (copy_source
.empty()) {
4052 len
= get_data(data
);
4054 off_t cur_lst
= min
<off_t
>(fst
+ s
->cct
->_conf
->rgw_max_chunk_size
- 1, lst
);
4055 op_ret
= get_data(fst
, cur_lst
, data
);
4058 len
= data
.length();
4059 s
->content_length
+= len
;
4064 ldpp_dout(this, 20) << "get_data() returned ret=" << op_ret
<< dendl
;
4066 } else if (len
== 0) {
4070 if (need_calc_md5
) {
4071 hash
.Update((const unsigned char *)data
.c_str(), data
.length());
4074 /* update torrrent */
4075 torrent
.update(data
);
4077 op_ret
= filter
->process(std::move(data
), ofs
);
4079 ldpp_dout(this, 20) << "processor->process() returned ret="
4086 tracepoint(rgw_op
, after_data_transfer
, s
->req_id
.c_str(), ofs
);
4088 // flush any data in filters
4089 op_ret
= filter
->process({}, ofs
);
4094 if (!chunked_upload
&& ofs
!= s
->content_length
) {
4095 op_ret
= -ERR_REQUEST_TIMEOUT
;
4099 s
->object
->set_obj_size(ofs
);
4101 perfcounter
->inc(l_rgw_put_b
, s
->obj_size
);
4103 op_ret
= do_aws4_auth_completion();
4108 op_ret
= s
->bucket
->check_quota(this, user_quota
, bucket_quota
, s
->obj_size
, y
);
4110 ldpp_dout(this, 20) << "second check_quota() returned op_ret=" << op_ret
<< dendl
;
4116 if (compressor
&& compressor
->is_compressed()) {
4118 RGWCompressionInfo cs_info
;
4119 cs_info
.compression_type
= plugin
->get_type_name();
4120 cs_info
.orig_size
= s
->obj_size
;
4121 cs_info
.compressor_message
= compressor
->get_compressor_message();
4122 cs_info
.blocks
= move(compressor
->get_compression_blocks());
4123 encode(cs_info
, tmp
);
4124 attrs
[RGW_ATTR_COMPRESSION
] = tmp
;
4125 ldpp_dout(this, 20) << "storing " << RGW_ATTR_COMPRESSION
4126 << " with type=" << cs_info
.compression_type
4127 << ", orig_size=" << cs_info
.orig_size
4128 << ", blocks=" << cs_info
.blocks
.size() << dendl
;
4131 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
4135 if (supplied_md5_b64
&& strcmp(calc_md5
, supplied_md5
)) {
4136 op_ret
= -ERR_BAD_DIGEST
;
4140 policy
.encode(aclbl
);
4141 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
4144 op_ret
= encode_dlo_manifest_attr(dlo_manifest
, attrs
);
4146 ldpp_dout(this, 0) << "bad user manifest: " << dlo_manifest
<< dendl
;
4152 bufferlist manifest_bl
;
4153 encode(*slo_info
, manifest_bl
);
4154 emplace_attr(RGW_ATTR_SLO_MANIFEST
, std::move(manifest_bl
));
4157 if (supplied_etag
&& etag
.compare(supplied_etag
) != 0) {
4158 op_ret
= -ERR_UNPROCESSABLE_ENTITY
;
4161 bl
.append(etag
.c_str(), etag
.size());
4162 emplace_attr(RGW_ATTR_ETAG
, std::move(bl
));
4164 populate_with_generic_attrs(s
, attrs
);
4165 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
);
4169 encode_delete_at_attr(delete_at
, attrs
);
4170 encode_obj_tags_attr(obj_tags
.get(), attrs
);
4171 rgw_cond_decode_objtags(s
, attrs
);
4173 /* Add a custom metadata to expose the information whether an object
4174 * is an SLO or not. Appending the attribute must be performed AFTER
4175 * processing any input from user in order to prohibit overwriting. */
4177 bufferlist slo_userindicator_bl
;
4178 slo_userindicator_bl
.append("True", 4);
4179 emplace_attr(RGW_ATTR_SLO_UINDICATOR
, std::move(slo_userindicator_bl
));
4181 if (obj_legal_hold
) {
4182 bufferlist obj_legal_hold_bl
;
4183 obj_legal_hold
->encode(obj_legal_hold_bl
);
4184 emplace_attr(RGW_ATTR_OBJECT_LEGAL_HOLD
, std::move(obj_legal_hold_bl
));
4186 if (obj_retention
) {
4187 bufferlist obj_retention_bl
;
4188 obj_retention
->encode(obj_retention_bl
);
4189 emplace_attr(RGW_ATTR_OBJECT_RETENTION
, std::move(obj_retention_bl
));
4192 tracepoint(rgw_op
, processor_complete_enter
, s
->req_id
.c_str());
4193 op_ret
= processor
->complete(s
->obj_size
, etag
, &mtime
, real_time(), attrs
,
4194 (delete_at
? *delete_at
: real_time()), if_match
, if_nomatch
,
4195 (user_data
.empty() ? nullptr : &user_data
), nullptr, nullptr,
4197 tracepoint(rgw_op
, processor_complete_exit
, s
->req_id
.c_str());
4199 /* produce torrent */
4200 if (s
->cct
->_conf
->rgw_torrent_flag
&& (ofs
== torrent
.get_data_len()))
4202 torrent
.init(s
, store
);
4203 torrent
.set_create_date(mtime
);
4204 op_ret
= torrent
.complete(y
);
4207 ldpp_dout(this, 0) << "ERROR: torrent.handle_data() returned " << op_ret
<< dendl
;
4212 // send request to notification manager
4213 int ret
= res
->publish_commit(this, s
->obj_size
, mtime
, etag
, s
->object
->get_instance());
4215 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
4216 // too late to rollback operation, hence op_ret is not set here
4220 int RGWPostObj::verify_permission(optional_yield y
)
4225 void RGWPostObj::pre_exec()
4227 rgw_bucket_object_pre_exec(s
);
4230 void RGWPostObj::execute(optional_yield y
)
4232 boost::optional
<RGWPutObj_Compress
> compressor
;
4233 CompressorRef plugin
;
4234 char supplied_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
4236 /* Read in the data from the POST form. */
4237 op_ret
= get_params(y
);
4242 op_ret
= verify_params();
4247 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
4248 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
4249 rgw::IAM::s3PutObject
,
4250 s
->object
->get_obj());
4251 if (identity_policy_res
== Effect::Deny
) {
4256 rgw::IAM::Effect e
= Effect::Pass
;
4257 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
4258 if (s
->iam_policy
) {
4259 ARN
obj_arn(s
->object
->get_obj());
4260 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
4261 rgw::IAM::s3PutObject
,
4265 if (e
== Effect::Deny
) {
4270 if (!s
->session_policies
.empty()) {
4271 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
4272 rgw::IAM::s3PutObject
,
4273 s
->object
->get_obj());
4274 if (session_policy_res
== Effect::Deny
) {
4278 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
4279 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
4280 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
4281 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
)) {
4285 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
4286 //Intersection of session policy and identity policy plus bucket policy
4287 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
) {
4291 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
4292 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
4300 if (identity_policy_res
== Effect::Pass
&& e
== Effect::Pass
&& !verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4304 } else if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4309 // make reservation for notification if needed
4310 std::unique_ptr
<rgw::sal::Notification
> res
4311 = store
->get_notification(s
->object
.get(), s
->src_object
.get(), s
, rgw::notify::ObjectCreatedPost
);
4312 op_ret
= res
->publish_reserve(this);
4317 /* Start iteration over data fields. It's necessary as Swift's FormPost
4318 * is capable to handle multiple files in single form. */
4320 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
4321 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
4323 // Allow use of MD5 digest in FIPS mode for non-cryptographic purposes
4324 hash
.SetFlags(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
);
4325 ceph::buffer::list bl
, aclbl
;
4328 op_ret
= s
->bucket
->check_quota(this, user_quota
, bucket_quota
, s
->content_length
, y
);
4333 if (supplied_md5_b64
) {
4334 char supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1];
4335 ldpp_dout(this, 15) << "supplied_md5_b64=" << supplied_md5_b64
<< dendl
;
4336 op_ret
= ceph_unarmor(supplied_md5_bin
, &supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1],
4337 supplied_md5_b64
, supplied_md5_b64
+ strlen(supplied_md5_b64
));
4338 ldpp_dout(this, 15) << "ceph_armor ret=" << op_ret
<< dendl
;
4339 if (op_ret
!= CEPH_CRYPTO_MD5_DIGESTSIZE
) {
4340 op_ret
= -ERR_INVALID_DIGEST
;
4344 buf_to_hex((const unsigned char *)supplied_md5_bin
, CEPH_CRYPTO_MD5_DIGESTSIZE
, supplied_md5
);
4345 ldpp_dout(this, 15) << "supplied_md5=" << supplied_md5
<< dendl
;
4348 std::unique_ptr
<rgw::sal::Object
> obj
=
4349 s
->bucket
->get_object(rgw_obj_key(get_current_filename()));
4350 if (s
->bucket
->versioning_enabled()) {
4351 obj
->gen_rand_obj_instance_name();
4354 auto aio
= rgw::make_throttle(s
->cct
->_conf
->rgw_put_obj_min_window_size
,
4357 std::unique_ptr
<rgw::sal::Writer
> processor
;
4358 processor
= store
->get_atomic_writer(this, s
->yield
, std::move(obj
),
4359 s
->bucket_owner
.get_id(), *s
->obj_ctx
,
4360 &s
->dest_placement
, 0, s
->req_id
);
4361 op_ret
= processor
->prepare(s
->yield
);
4366 /* No filters by default. */
4367 rgw::sal::DataProcessor
*filter
= processor
.get();
4369 std::unique_ptr
<rgw::sal::DataProcessor
> encrypt
;
4370 op_ret
= get_encrypt_filter(&encrypt
, filter
);
4374 if (encrypt
!= nullptr) {
4375 filter
= encrypt
.get();
4377 const auto& compression_type
= store
->get_zone()->get_params().get_compression_type(
4379 if (compression_type
!= "none") {
4380 plugin
= Compressor::create(s
->cct
, compression_type
);
4382 ldpp_dout(this, 1) << "Cannot load plugin for compression type "
4383 << compression_type
<< dendl
;
4385 compressor
.emplace(s
->cct
, plugin
, filter
);
4386 filter
= &*compressor
;
4393 ceph::bufferlist data
;
4394 len
= get_data(data
, again
);
4405 hash
.Update((const unsigned char *)data
.c_str(), data
.length());
4406 op_ret
= filter
->process(std::move(data
), ofs
);
4410 if (ofs
> max_len
) {
4411 op_ret
= -ERR_TOO_LARGE
;
4417 op_ret
= filter
->process({}, ofs
);
4422 if (len
< min_len
) {
4423 op_ret
= -ERR_TOO_SMALL
;
4428 s
->object
->set_obj_size(ofs
);
4431 op_ret
= s
->bucket
->check_quota(this, user_quota
, bucket_quota
, s
->obj_size
, y
);
4437 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
4441 if (supplied_md5_b64
&& strcmp(calc_md5
, supplied_md5
)) {
4442 op_ret
= -ERR_BAD_DIGEST
;
4446 bl
.append(etag
.c_str(), etag
.size());
4447 emplace_attr(RGW_ATTR_ETAG
, std::move(bl
));
4449 policy
.encode(aclbl
);
4450 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
4452 const std::string content_type
= get_current_content_type();
4453 if (! content_type
.empty()) {
4454 ceph::bufferlist ct_bl
;
4455 ct_bl
.append(content_type
.c_str(), content_type
.size() + 1);
4456 emplace_attr(RGW_ATTR_CONTENT_TYPE
, std::move(ct_bl
));
4459 if (compressor
&& compressor
->is_compressed()) {
4460 ceph::bufferlist tmp
;
4461 RGWCompressionInfo cs_info
;
4462 cs_info
.compression_type
= plugin
->get_type_name();
4463 cs_info
.orig_size
= s
->obj_size
;
4464 cs_info
.compressor_message
= compressor
->get_compressor_message();
4465 cs_info
.blocks
= move(compressor
->get_compression_blocks());
4466 encode(cs_info
, tmp
);
4467 emplace_attr(RGW_ATTR_COMPRESSION
, std::move(tmp
));
4470 op_ret
= processor
->complete(s
->obj_size
, etag
, nullptr, real_time(), attrs
,
4471 (delete_at
? *delete_at
: real_time()),
4472 nullptr, nullptr, nullptr, nullptr, nullptr,
4477 } while (is_next_file_to_upload());
4479 // send request to notification manager
4480 int ret
= res
->publish_commit(this, ofs
, s
->object
->get_mtime(), etag
, s
->object
->get_instance());
4482 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
4483 // too late to rollback operation, hence op_ret is not set here
4488 void RGWPutMetadataAccount::filter_out_temp_url(map
<string
, bufferlist
>& add_attrs
,
4489 const set
<string
>& rmattr_names
,
4490 map
<int, string
>& temp_url_keys
)
4492 map
<string
, bufferlist
>::iterator iter
;
4494 iter
= add_attrs
.find(RGW_ATTR_TEMPURL_KEY1
);
4495 if (iter
!= add_attrs
.end()) {
4496 temp_url_keys
[0] = iter
->second
.c_str();
4497 add_attrs
.erase(iter
);
4500 iter
= add_attrs
.find(RGW_ATTR_TEMPURL_KEY2
);
4501 if (iter
!= add_attrs
.end()) {
4502 temp_url_keys
[1] = iter
->second
.c_str();
4503 add_attrs
.erase(iter
);
4506 for (const string
& name
: rmattr_names
) {
4507 if (name
.compare(RGW_ATTR_TEMPURL_KEY1
) == 0) {
4508 temp_url_keys
[0] = string();
4510 if (name
.compare(RGW_ATTR_TEMPURL_KEY2
) == 0) {
4511 temp_url_keys
[1] = string();
4516 int RGWPutMetadataAccount::init_processing(optional_yield y
)
4518 /* First, go to the base class. At the time of writing the method was
4519 * responsible only for initializing the quota. This isn't necessary
4520 * here as we are touching metadata only. I'm putting this call only
4521 * for the future. */
4522 op_ret
= RGWOp::init_processing(y
);
4527 op_ret
= get_params(y
);
4532 op_ret
= s
->user
->read_attrs(this, y
);
4536 orig_attrs
= s
->user
->get_attrs();
4540 policy
.encode(acl_bl
);
4541 attrs
.emplace(RGW_ATTR_ACL
, std::move(acl_bl
));
4544 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
, false);
4548 prepare_add_del_attrs(orig_attrs
, rmattr_names
, attrs
);
4549 populate_with_generic_attrs(s
, attrs
);
4551 /* Try extract the TempURL-related stuff now to allow verify_permission
4552 * evaluate whether we need FULL_CONTROL or not. */
4553 filter_out_temp_url(attrs
, rmattr_names
, temp_url_keys
);
4555 /* The same with quota except a client needs to be reseller admin. */
4556 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, new_quota
,
4557 &new_quota_extracted
);
4565 int RGWPutMetadataAccount::verify_permission(optional_yield y
)
4567 if (s
->auth
.identity
->is_anonymous()) {
4571 if (!verify_user_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4575 /* Altering TempURL keys requires FULL_CONTROL. */
4576 if (!temp_url_keys
.empty() && s
->perm_mask
!= RGW_PERM_FULL_CONTROL
) {
4580 /* We are failing this intensionally to allow system user/reseller admin
4581 * override in rgw_process.cc. This is the way to specify a given RGWOp
4582 * expect extra privileges. */
4583 if (new_quota_extracted
) {
4590 void RGWPutMetadataAccount::execute(optional_yield y
)
4592 /* Params have been extracted earlier. See init_processing(). */
4593 op_ret
= s
->user
->load_user(this, y
);
4598 /* Handle the TempURL-related stuff. */
4599 if (!temp_url_keys
.empty()) {
4600 for (auto& pair
: temp_url_keys
) {
4601 s
->user
->get_info().temp_url_keys
[pair
.first
] = std::move(pair
.second
);
4605 /* Handle the quota extracted at the verify_permission step. */
4606 if (new_quota_extracted
) {
4607 s
->user
->get_info().user_quota
= std::move(new_quota
);
4610 /* We are passing here the current (old) user info to allow the function
4611 * optimize-out some operations. */
4612 s
->user
->set_attrs(attrs
);
4613 op_ret
= s
->user
->store_user(this, y
, false, &s
->user
->get_info());
4616 int RGWPutMetadataBucket::verify_permission(optional_yield y
)
4618 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4625 void RGWPutMetadataBucket::pre_exec()
4627 rgw_bucket_object_pre_exec(s
);
4630 void RGWPutMetadataBucket::execute(optional_yield y
)
4632 op_ret
= get_params(y
);
4637 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
, false);
4642 if (!placement_rule
.empty() &&
4643 placement_rule
!= s
->bucket
->get_placement_rule()) {
4648 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
4649 /* Encode special metadata first as we're using std::map::emplace under
4650 * the hood. This method will add the new items only if the map doesn't
4651 * contain such keys yet. */
4653 if (s
->dialect
.compare("swift") == 0) {
4655 static_cast<RGWAccessControlPolicy_SWIFT
*>(s
->bucket_acl
.get());
4656 auto new_policy
= static_cast<RGWAccessControlPolicy_SWIFT
*>(&policy
);
4657 new_policy
->filter_merge(policy_rw_mask
, old_policy
);
4658 policy
= *new_policy
;
4662 emplace_attr(RGW_ATTR_ACL
, std::move(bl
));
4667 cors_config
.encode(bl
);
4668 emplace_attr(RGW_ATTR_CORS
, std::move(bl
));
4671 /* It's supposed that following functions WILL NOT change any
4672 * special attributes (like RGW_ATTR_ACL) if they are already
4673 * present in attrs. */
4674 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
4675 populate_with_generic_attrs(s
, attrs
);
4677 /* According to the Swift's behaviour and its container_quota
4678 * WSGI middleware implementation: anyone with write permissions
4679 * is able to set the bucket quota. This stays in contrast to
4680 * account quotas that can be set only by clients holding
4681 * reseller admin privileges. */
4682 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, s
->bucket
->get_info().quota
);
4687 if (swift_ver_location
) {
4688 s
->bucket
->get_info().swift_ver_location
= *swift_ver_location
;
4689 s
->bucket
->get_info().swift_versioning
= (!swift_ver_location
->empty());
4692 /* Web site of Swift API. */
4693 filter_out_website(attrs
, rmattr_names
, s
->bucket
->get_info().website_conf
);
4694 s
->bucket
->get_info().has_website
= !s
->bucket
->get_info().website_conf
.is_empty();
4696 /* Setting attributes also stores the provided bucket info. Due
4697 * to this fact, the new quota settings can be serialized with
4699 op_ret
= s
->bucket
->merge_and_store_attrs(this, attrs
, s
->yield
);
4704 int RGWPutMetadataObject::verify_permission(optional_yield y
)
4706 // This looks to be something specific to Swift. We could add
4707 // operations like swift:PutMetadataObject to the Policy Engine.
4708 if (!verify_object_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4715 void RGWPutMetadataObject::pre_exec()
4717 rgw_bucket_object_pre_exec(s
);
4720 void RGWPutMetadataObject::execute(optional_yield y
)
4723 rgw::sal::Attrs attrs
, rmattrs
;
4725 s
->object
->set_atomic(s
->obj_ctx
);
4727 op_ret
= get_params(y
);
4732 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
);
4737 /* check if obj exists, read orig attrs */
4738 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, s
, &target_obj
);
4743 /* Check whether the object has expired. Swift API documentation
4744 * stands that we should return 404 Not Found in such case. */
4745 if (need_object_expiration() && s
->object
->is_expired()) {
4750 /* Filter currently existing attributes. */
4751 prepare_add_del_attrs(s
->object
->get_attrs(), attrs
, rmattrs
);
4752 populate_with_generic_attrs(s
, attrs
);
4753 encode_delete_at_attr(delete_at
, attrs
);
4756 op_ret
= encode_dlo_manifest_attr(dlo_manifest
, attrs
);
4758 ldpp_dout(this, 0) << "bad user manifest: " << dlo_manifest
<< dendl
;
4763 op_ret
= s
->object
->set_obj_attrs(this, s
->obj_ctx
, &attrs
, &rmattrs
, s
->yield
, &target_obj
);
4766 int RGWDeleteObj::handle_slo_manifest(bufferlist
& bl
, optional_yield y
)
4768 RGWSLOInfo slo_info
;
4769 auto bliter
= bl
.cbegin();
4771 decode(slo_info
, bliter
);
4772 } catch (buffer::error
& err
) {
4773 ldpp_dout(this, 0) << "ERROR: failed to decode slo manifest" << dendl
;
4778 deleter
= std::unique_ptr
<RGWBulkDelete::Deleter
>(\
4779 new RGWBulkDelete::Deleter(this, store
, s
));
4780 } catch (const std::bad_alloc
&) {
4784 list
<RGWBulkDelete::acct_path_t
> items
;
4785 for (const auto& iter
: slo_info
.entries
) {
4786 const string
& path_str
= iter
.path
;
4788 const size_t sep_pos
= path_str
.find('/', 1 /* skip first slash */);
4789 if (std::string_view::npos
== sep_pos
) {
4793 RGWBulkDelete::acct_path_t path
;
4795 path
.bucket_name
= url_decode(path_str
.substr(1, sep_pos
- 1));
4796 path
.obj_key
= url_decode(path_str
.substr(sep_pos
+ 1));
4798 items
.push_back(path
);
4801 /* Request removal of the manifest object itself. */
4802 RGWBulkDelete::acct_path_t path
;
4803 path
.bucket_name
= s
->bucket_name
;
4804 path
.obj_key
= s
->object
->get_key();
4805 items
.push_back(path
);
4807 int ret
= deleter
->delete_chunk(items
, y
);
4815 int RGWDeleteObj::verify_permission(optional_yield y
)
4817 int op_ret
= get_params(y
);
4822 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
4823 if (has_s3_existing_tag
|| has_s3_resource_tag
)
4824 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
4826 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || ! s
->session_policies
.empty()) {
4827 if (s
->bucket
->get_info().obj_lock_enabled() && bypass_governance_mode
) {
4828 auto r
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
4829 rgw::IAM::s3BypassGovernanceRetention
, ARN(s
->bucket
->get_key(), s
->object
->get_name()));
4830 if (r
== Effect::Deny
) {
4831 bypass_perm
= false;
4832 } else if (r
== Effect::Pass
&& s
->iam_policy
) {
4833 ARN
obj_arn(ARN(s
->bucket
->get_key(), s
->object
->get_name()));
4834 r
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
, rgw::IAM::s3BypassGovernanceRetention
, obj_arn
);
4835 if (r
== Effect::Deny
) {
4836 bypass_perm
= false;
4838 } else if (r
== Effect::Pass
&& !s
->session_policies
.empty()) {
4839 r
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
4840 rgw::IAM::s3BypassGovernanceRetention
, ARN(s
->bucket
->get_key(), s
->object
->get_name()));
4841 if (r
== Effect::Deny
) {
4842 bypass_perm
= false;
4846 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
4847 s
->object
->get_instance().empty() ?
4848 rgw::IAM::s3DeleteObject
:
4849 rgw::IAM::s3DeleteObjectVersion
,
4850 ARN(s
->bucket
->get_key(), s
->object
->get_name()));
4851 if (identity_policy_res
== Effect::Deny
) {
4855 rgw::IAM::Effect r
= Effect::Pass
;
4856 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
4857 ARN
obj_arn(ARN(s
->bucket
->get_key(), s
->object
->get_name()));
4858 if (s
->iam_policy
) {
4859 r
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
4860 s
->object
->get_instance().empty() ?
4861 rgw::IAM::s3DeleteObject
:
4862 rgw::IAM::s3DeleteObjectVersion
,
4866 if (r
== Effect::Deny
)
4869 if (!s
->session_policies
.empty()) {
4870 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
4871 s
->object
->get_instance().empty() ?
4872 rgw::IAM::s3DeleteObject
:
4873 rgw::IAM::s3DeleteObjectVersion
,
4875 if (session_policy_res
== Effect::Deny
) {
4878 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
4879 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
4880 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
4881 (session_policy_res
== Effect::Allow
&& r
== Effect::Allow
)) {
4884 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
4885 //Intersection of session policy and identity policy plus bucket policy
4886 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || r
== Effect::Allow
) {
4889 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
4890 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
4896 if (r
== Effect::Allow
|| identity_policy_res
== Effect::Allow
)
4900 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
4904 if (s
->bucket
->get_info().mfa_enabled() &&
4905 !s
->object
->get_instance().empty() &&
4907 ldpp_dout(this, 5) << "NOTICE: object delete request with a versioned object, mfa auth not provided" << dendl
;
4908 return -ERR_MFA_REQUIRED
;
4914 void RGWDeleteObj::pre_exec()
4916 rgw_bucket_object_pre_exec(s
);
4919 void RGWDeleteObj::execute(optional_yield y
)
4921 if (!s
->bucket_exists
) {
4922 op_ret
= -ERR_NO_SUCH_BUCKET
;
4926 if (!rgw::sal::Object::empty(s
->object
.get())) {
4927 uint64_t obj_size
= 0;
4929 RGWObjectCtx
* obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
4931 RGWObjState
* astate
= nullptr;
4932 bool check_obj_lock
= s
->object
->have_instance() && s
->bucket
->get_info().obj_lock_enabled();
4934 op_ret
= s
->object
->get_obj_state(this, obj_ctx
, &astate
, s
->yield
, true);
4936 if (need_object_expiration() || multipart_delete
) {
4940 if (check_obj_lock
) {
4941 /* check if obj exists, read orig attrs */
4942 if (op_ret
== -ENOENT
) {
4943 /* object maybe delete_marker, skip check_obj_lock*/
4944 check_obj_lock
= false;
4950 obj_size
= astate
->size
;
4951 etag
= astate
->attrset
[RGW_ATTR_ETAG
].to_str();
4954 // ignore return value from get_obj_attrs in all other cases
4957 if (check_obj_lock
) {
4958 ceph_assert(astate
);
4959 int object_lock_response
= verify_object_lock(this, astate
->attrset
, bypass_perm
, bypass_governance_mode
);
4960 if (object_lock_response
!= 0) {
4961 op_ret
= object_lock_response
;
4962 if (op_ret
== -EACCES
) {
4963 s
->err
.message
= "forbidden by object lock";
4969 if (multipart_delete
) {
4971 op_ret
= -ERR_NOT_SLO_MANIFEST
;
4975 const auto slo_attr
= astate
->attrset
.find(RGW_ATTR_SLO_MANIFEST
);
4977 if (slo_attr
!= astate
->attrset
.end()) {
4978 op_ret
= handle_slo_manifest(slo_attr
->second
, y
);
4980 ldpp_dout(this, 0) << "ERROR: failed to handle slo manifest ret=" << op_ret
<< dendl
;
4983 op_ret
= -ERR_NOT_SLO_MANIFEST
;
4990 // make reservation for notification if needed
4991 const auto versioned_object
= s
->bucket
->versioning_enabled();
4992 const auto event_type
= versioned_object
&&
4993 s
->object
->get_instance().empty() ?
4994 rgw::notify::ObjectRemovedDeleteMarkerCreated
:
4995 rgw::notify::ObjectRemovedDelete
;
4996 std::unique_ptr
<rgw::sal::Notification
> res
4997 = store
->get_notification(s
->object
.get(), s
->src_object
.get(), s
,
4999 op_ret
= res
->publish_reserve(this);
5004 s
->object
->set_atomic(s
->obj_ctx
);
5006 bool ver_restored
= false;
5007 op_ret
= s
->object
->swift_versioning_restore(s
->obj_ctx
, ver_restored
, this);
5012 if (!ver_restored
) {
5015 /* Swift's versioning mechanism hasn't found any previous version of
5016 * the object that could be restored. This means we should proceed
5017 * with the regular delete path. */
5018 op_ret
= get_system_versioning_params(s
, &epoch
, &version_id
);
5023 std::unique_ptr
<rgw::sal::Object::DeleteOp
> del_op
= s
->object
->get_delete_op(obj_ctx
);
5024 del_op
->params
.obj_owner
= s
->owner
;
5025 del_op
->params
.bucket_owner
= s
->bucket_owner
;
5026 del_op
->params
.versioning_status
= s
->bucket
->get_info().versioning_status();
5027 del_op
->params
.unmod_since
= unmod_since
;
5028 del_op
->params
.high_precision_time
= s
->system_request
;
5029 del_op
->params
.olh_epoch
= epoch
;
5030 del_op
->params
.marker_version_id
= version_id
;
5032 op_ret
= del_op
->delete_obj(this, y
);
5034 delete_marker
= del_op
->result
.delete_marker
;
5035 version_id
= del_op
->result
.version_id
;
5038 /* Check whether the object has expired. Swift API documentation
5039 * stands that we should return 404 Not Found in such case. */
5040 if (need_object_expiration() && s
->object
->is_expired()) {
5046 if (op_ret
== -ECANCELED
) {
5049 if (op_ret
== -ERR_PRECONDITION_FAILED
&& no_precondition_error
) {
5053 // send request to notification manager
5054 int ret
= res
->publish_commit(this, obj_size
, ceph::real_clock::now(), etag
, version_id
);
5056 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
5057 // too late to rollback operation, hence op_ret is not set here
5064 bool RGWCopyObj::parse_copy_location(const std::string_view
& url_src
,
5065 string
& bucket_name
,
5069 std::string_view name_str
;
5070 std::string_view params_str
;
5072 // search for ? before url-decoding so we don't accidentally match %3F
5073 size_t pos
= url_src
.find('?');
5074 if (pos
== string::npos
) {
5077 name_str
= url_src
.substr(0, pos
);
5078 params_str
= url_src
.substr(pos
+ 1);
5081 if (name_str
[0] == '/') // trim leading slash
5082 name_str
.remove_prefix(1);
5084 std::string dec_src
= url_decode(name_str
);
5086 pos
= dec_src
.find('/');
5087 if (pos
== string::npos
)
5090 bucket_name
= dec_src
.substr(0, pos
);
5091 key
.name
= dec_src
.substr(pos
+ 1);
5093 if (key
.name
.empty()) {
5097 if (! params_str
.empty()) {
5099 args
.set(std::string(params_str
));
5102 key
.instance
= args
.get("versionId", NULL
);
5108 int RGWCopyObj::verify_permission(optional_yield y
)
5110 RGWAccessControlPolicy
src_acl(s
->cct
);
5111 boost::optional
<Policy
> src_policy
;
5112 op_ret
= get_params(y
);
5116 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
5121 op_ret
= store
->get_bucket(this, s
->user
.get(),
5122 rgw_bucket(src_tenant_name
,
5124 s
->bucket_instance_id
),
5127 if (op_ret
== -ENOENT
) {
5128 op_ret
= -ERR_NO_SUCH_BUCKET
;
5133 /* This is the only place the bucket is set on src_object */
5134 s
->src_object
->set_bucket(src_bucket
.get());
5135 /* get buckets info (source and dest) */
5136 if (s
->local_source
&& source_zone
.empty()) {
5137 s
->src_object
->set_atomic(s
->obj_ctx
);
5138 s
->src_object
->set_prefetch_data(s
->obj_ctx
);
5140 rgw_placement_rule src_placement
;
5142 /* check source object permissions */
5143 op_ret
= read_obj_policy(this, store
, s
, src_bucket
->get_info(), src_bucket
->get_attrs(), &src_acl
, &src_placement
.storage_class
,
5144 src_policy
, src_bucket
.get(), s
->src_object
.get(), y
);
5149 /* follow up on previous checks that required reading source object head */
5150 if (need_to_check_storage_class
) {
5151 src_placement
.inherit_from(src_bucket
->get_placement_rule());
5153 op_ret
= check_storage_class(src_placement
);
5159 /* admin request overrides permission checks */
5160 if (!s
->auth
.identity
->is_admin_of(src_acl
.get_owner().get_id())) {
5161 if (src_policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
5162 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, src_policy
, s
->iam_user_policies
, s
->session_policies
);
5163 if (has_s3_existing_tag
|| has_s3_resource_tag
)
5164 rgw_iam_add_objtags(this, s
, s
->src_object
.get(), has_s3_existing_tag
, has_s3_resource_tag
);
5166 ARN
obj_arn(s
->src_object
->get_obj());
5167 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
5168 s
->src_object
->get_instance().empty() ?
5169 rgw::IAM::s3GetObject
:
5170 rgw::IAM::s3GetObjectVersion
,
5172 if (identity_policy_res
== Effect::Deny
) {
5175 auto e
= Effect::Pass
;
5176 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
5178 e
= src_policy
->eval(s
->env
, *s
->auth
.identity
,
5179 s
->src_object
->get_instance().empty() ?
5180 rgw::IAM::s3GetObject
:
5181 rgw::IAM::s3GetObjectVersion
,
5185 if (e
== Effect::Deny
) {
5188 if (!s
->session_policies
.empty()) {
5189 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
5190 s
->src_object
->get_instance().empty() ?
5191 rgw::IAM::s3GetObject
:
5192 rgw::IAM::s3GetObjectVersion
,
5194 if (session_policy_res
== Effect::Deny
) {
5197 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
5198 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
5199 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) &&
5200 (session_policy_res
!= Effect::Allow
|| e
!= Effect::Allow
)) {
5203 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
5204 //Intersection of session policy and identity policy plus bucket policy
5205 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) && e
!= Effect::Allow
) {
5208 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
5209 if (session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) {
5214 if (identity_policy_res
== Effect::Pass
&& e
== Effect::Pass
&&
5215 !src_acl
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
5219 //remove src object tags as it may interfere with policy evaluation of destination obj
5220 if (has_s3_existing_tag
|| has_s3_resource_tag
)
5221 rgw_iam_remove_objtags(this, s
, s
->src_object
.get(), has_s3_existing_tag
, has_s3_resource_tag
);
5223 } else if (!src_acl
.verify_permission(this, *s
->auth
.identity
,
5231 RGWAccessControlPolicy
dest_bucket_policy(s
->cct
);
5233 if (src_bucket_name
.compare(dest_bucket_name
) == 0) { /* will only happen if s->local_source
5234 or intra region sync */
5235 dest_bucket
= src_bucket
->clone();
5237 op_ret
= store
->get_bucket(this, s
->user
.get(), dest_tenant_name
, dest_bucket_name
, &dest_bucket
, y
);
5239 if (op_ret
== -ENOENT
) {
5240 ldpp_dout(this, 0) << "ERROR: Destination Bucket not found for user: " << s
->user
->get_id().to_str() << dendl
;
5241 op_ret
= -ERR_NO_SUCH_BUCKET
;
5247 dest_object
= dest_bucket
->get_object(rgw_obj_key(dest_obj_name
));
5248 dest_object
->set_atomic(s
->obj_ctx
);
5250 /* check dest bucket permissions */
5251 op_ret
= read_bucket_policy(this, store
, s
, dest_bucket
->get_info(),
5252 dest_bucket
->get_attrs(),
5253 &dest_bucket_policy
, dest_bucket
->get_key(), y
);
5257 auto dest_iam_policy
= get_iam_policy_from_attr(s
->cct
, dest_bucket
->get_attrs(), dest_bucket
->get_tenant());
5258 /* admin request overrides permission checks */
5259 if (! s
->auth
.identity
->is_admin_of(dest_policy
.get_owner().get_id())){
5260 if (dest_iam_policy
!= boost::none
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
5261 //Add destination bucket tags for authorization
5262 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, dest_iam_policy
, s
->iam_user_policies
, s
->session_policies
);
5263 if (has_s3_resource_tag
)
5264 rgw_iam_add_buckettags(this, s
, dest_bucket
.get());
5266 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-copy-source", copy_source
);
5268 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-metadata-directive",
5271 ARN
obj_arn(dest_object
->get_obj());
5272 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
,
5274 rgw::IAM::s3PutObject
,
5276 if (identity_policy_res
== Effect::Deny
) {
5279 auto e
= Effect::Pass
;
5280 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
5281 if (dest_iam_policy
) {
5282 e
= dest_iam_policy
->eval(s
->env
, *s
->auth
.identity
,
5283 rgw::IAM::s3PutObject
,
5287 if (e
== Effect::Deny
) {
5290 if (!s
->session_policies
.empty()) {
5291 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
, rgw::IAM::s3PutObject
, obj_arn
);
5292 if (session_policy_res
== Effect::Deny
) {
5295 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
5296 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
5297 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) &&
5298 (session_policy_res
!= Effect::Allow
|| e
== Effect::Allow
)) {
5301 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
5302 //Intersection of session policy and identity policy plus bucket policy
5303 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) && e
!= Effect::Allow
) {
5306 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
5307 if (session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) {
5312 if (identity_policy_res
== Effect::Pass
&& e
== Effect::Pass
&&
5313 ! dest_bucket_policy
.verify_permission(this,
5319 } else if (! dest_bucket_policy
.verify_permission(this, *s
->auth
.identity
, s
->perm_mask
,
5326 op_ret
= init_dest_policy();
5335 int RGWCopyObj::init_common()
5338 if (parse_time(if_mod
, &mod_time
) < 0) {
5342 mod_ptr
= &mod_time
;
5346 if (parse_time(if_unmod
, &unmod_time
) < 0) {
5350 unmod_ptr
= &unmod_time
;
5354 dest_policy
.encode(aclbl
);
5355 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
5357 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
);
5361 populate_with_generic_attrs(s
, attrs
);
5366 static void copy_obj_progress_cb(off_t ofs
, void *param
)
5368 RGWCopyObj
*op
= static_cast<RGWCopyObj
*>(param
);
5369 op
->progress_cb(ofs
);
5372 void RGWCopyObj::progress_cb(off_t ofs
)
5374 if (!s
->cct
->_conf
->rgw_copy_obj_progress
)
5377 if (ofs
- last_ofs
<
5378 static_cast<off_t
>(s
->cct
->_conf
->rgw_copy_obj_progress_every_bytes
)) {
5382 send_partial_response(ofs
);
5387 void RGWCopyObj::pre_exec()
5389 rgw_bucket_object_pre_exec(s
);
5392 void RGWCopyObj::execute(optional_yield y
)
5394 if (init_common() < 0)
5397 // make reservation for notification if needed
5398 std::unique_ptr
<rgw::sal::Notification
> res
5399 = store
->get_notification(
5400 s
->object
.get(), s
->src_object
.get(),
5401 s
, rgw::notify::ObjectCreatedCopy
);
5402 op_ret
= res
->publish_reserve(this);
5407 if ( ! version_id
.empty()) {
5408 dest_object
->set_instance(version_id
);
5409 } else if (dest_bucket
->versioning_enabled()) {
5410 dest_object
->gen_rand_obj_instance_name();
5413 s
->src_object
->set_atomic(s
->obj_ctx
);
5414 dest_object
->set_atomic(s
->obj_ctx
);
5416 encode_delete_at_attr(delete_at
, attrs
);
5418 if (obj_retention
) {
5419 bufferlist obj_retention_bl
;
5420 obj_retention
->encode(obj_retention_bl
);
5421 emplace_attr(RGW_ATTR_OBJECT_RETENTION
, std::move(obj_retention_bl
));
5423 if (obj_legal_hold
) {
5424 bufferlist obj_legal_hold_bl
;
5425 obj_legal_hold
->encode(obj_legal_hold_bl
);
5426 emplace_attr(RGW_ATTR_OBJECT_LEGAL_HOLD
, std::move(obj_legal_hold_bl
));
5429 uint64_t obj_size
= 0;
5431 // get src object size (cached in obj_ctx from verify_permission())
5432 RGWObjState
* astate
= nullptr;
5433 op_ret
= s
->src_object
->get_obj_state(this, s
->obj_ctx
, &astate
, s
->yield
, true);
5438 /* Check if the src object is cloud-tiered */
5440 if (astate
->get_attr(RGW_ATTR_MANIFEST
, bl
)) {
5443 if (m
.get_tier_type() == "cloud-s3") {
5444 op_ret
= -ERR_INVALID_OBJECT_STATE
;
5445 ldpp_dout(this, 0) << "ERROR: Cannot copy cloud tiered object. Failing with "
5451 obj_size
= astate
->size
;
5453 if (!s
->system_request
) { // no quota enforcement for system requests
5454 if (astate
->accounted_size
> static_cast<size_t>(s
->cct
->_conf
->rgw_max_put_size
)) {
5455 op_ret
= -ERR_TOO_LARGE
;
5458 // enforce quota against the destination bucket owner
5459 op_ret
= dest_bucket
->check_quota(this, user_quota
, bucket_quota
,
5460 astate
->accounted_size
, y
);
5467 bool high_precision_time
= (s
->system_request
);
5469 /* Handle object versioning of Swift API. In case of copying to remote this
5470 * should fail gently (op_ret == 0) as the dst_obj will not exist here. */
5471 op_ret
= dest_object
->swift_versioning_copy(s
->obj_ctx
, this, s
->yield
);
5476 RGWObjectCtx
& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
5477 op_ret
= s
->src_object
->copy_object(obj_ctx
,
5489 high_precision_time
,
5495 RGWObjCategory::Main
,
5498 (version_id
.empty() ? NULL
: &version_id
),
5499 &s
->req_id
, /* use req_id as tag */
5501 copy_obj_progress_cb
, (void *)this,
5505 // send request to notification manager
5506 int ret
= res
->publish_commit(this, obj_size
, mtime
, etag
, dest_object
->get_instance());
5508 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
5509 // too late to rollback operation, hence op_ret is not set here
5513 int RGWGetACLs::verify_permission(optional_yield y
)
5516 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
5517 if (!rgw::sal::Object::empty(s
->object
.get())) {
5518 auto iam_action
= s
->object
->get_instance().empty() ?
5519 rgw::IAM::s3GetObjectAcl
:
5520 rgw::IAM::s3GetObjectVersionAcl
;
5521 if (has_s3_existing_tag
|| has_s3_resource_tag
)
5522 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
5523 perm
= verify_object_permission(this, s
, iam_action
);
5525 if (!s
->bucket_exists
) {
5526 return -ERR_NO_SUCH_BUCKET
;
5528 if (has_s3_resource_tag
)
5529 rgw_iam_add_buckettags(this, s
);
5530 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketAcl
);
5538 void RGWGetACLs::pre_exec()
5540 rgw_bucket_object_pre_exec(s
);
5543 void RGWGetACLs::execute(optional_yield y
)
5546 RGWAccessControlPolicy
* const acl
= \
5547 (!rgw::sal::Object::empty(s
->object
.get()) ? s
->object_acl
.get() : s
->bucket_acl
.get());
5548 RGWAccessControlPolicy_S3
* const s3policy
= \
5549 static_cast<RGWAccessControlPolicy_S3
*>(acl
);
5550 s3policy
->to_xml(ss
);
5556 int RGWPutACLs::verify_permission(optional_yield y
)
5560 rgw_add_to_iam_environment(s
->env
, "s3:x-amz-acl", s
->canned_acl
);
5562 rgw_add_grant_to_iam_environment(s
->env
, s
);
5563 if (!rgw::sal::Object::empty(s
->object
.get())) {
5564 auto iam_action
= s
->object
->get_instance().empty() ? rgw::IAM::s3PutObjectAcl
: rgw::IAM::s3PutObjectVersionAcl
;
5565 op_ret
= rgw_iam_add_objtags(this, s
, true, true);
5566 perm
= verify_object_permission(this, s
, iam_action
);
5568 op_ret
= rgw_iam_add_buckettags(this, s
);
5569 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketAcl
);
5577 int RGWGetLC::verify_permission(optional_yield y
)
5579 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
5580 if (has_s3_resource_tag
)
5581 rgw_iam_add_buckettags(this, s
);
5584 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3GetLifecycleConfiguration
);
5591 int RGWPutLC::verify_permission(optional_yield y
)
5593 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
5594 if (has_s3_resource_tag
)
5595 rgw_iam_add_buckettags(this, s
);
5598 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3PutLifecycleConfiguration
);
5605 int RGWDeleteLC::verify_permission(optional_yield y
)
5607 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
5608 if (has_s3_resource_tag
)
5609 rgw_iam_add_buckettags(this, s
);
5612 perm
= verify_bucket_permission(this, s
, rgw::IAM::s3PutLifecycleConfiguration
);
5619 void RGWPutACLs::pre_exec()
5621 rgw_bucket_object_pre_exec(s
);
5624 void RGWGetLC::pre_exec()
5626 rgw_bucket_object_pre_exec(s
);
5629 void RGWPutLC::pre_exec()
5631 rgw_bucket_object_pre_exec(s
);
5634 void RGWDeleteLC::pre_exec()
5636 rgw_bucket_object_pre_exec(s
);
5639 void RGWPutACLs::execute(optional_yield y
)
5643 RGWAccessControlPolicy_S3
*policy
= NULL
;
5644 RGWACLXMLParser_S3
parser(s
->cct
);
5645 RGWAccessControlPolicy_S3
new_policy(s
->cct
);
5648 op_ret
= 0; /* XXX redundant? */
5650 if (!parser
.init()) {
5656 RGWAccessControlPolicy
* const existing_policy
= \
5657 (rgw::sal::Object::empty(s
->object
.get()) ? s
->bucket_acl
.get() : s
->object_acl
.get());
5659 owner
= existing_policy
->get_owner();
5661 op_ret
= get_params(y
);
5663 if (op_ret
== -ERANGE
) {
5664 ldpp_dout(this, 4) << "The size of request xml data is larger than the max limitation, data size = "
5665 << s
->length
<< dendl
;
5666 op_ret
= -ERR_MALFORMED_XML
;
5667 s
->err
.message
= "The XML you provided was larger than the maximum " +
5668 std::to_string(s
->cct
->_conf
->rgw_max_put_param_size
) +
5674 char* buf
= data
.c_str();
5675 ldpp_dout(this, 15) << "read len=" << data
.length() << " data=" << (buf
? buf
: "") << dendl
;
5677 if (!s
->canned_acl
.empty() && data
.length() > 0) {
5682 if (!s
->canned_acl
.empty() || s
->has_acl_header
) {
5683 op_ret
= get_policy_from_state(store
, s
, ss
);
5688 data
.append(ss
.str());
5691 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
5695 policy
= static_cast<RGWAccessControlPolicy_S3
*>(parser
.find_first("AccessControlPolicy"));
5701 const RGWAccessControlList
& req_acl
= policy
->get_acl();
5702 const multimap
<string
, ACLGrant
>& req_grant_map
= req_acl
.get_grant_map();
5703 #define ACL_GRANTS_MAX_NUM 100
5704 int max_num
= s
->cct
->_conf
->rgw_acl_grants_max_num
;
5706 max_num
= ACL_GRANTS_MAX_NUM
;
5709 int grants_num
= req_grant_map
.size();
5710 if (grants_num
> max_num
) {
5711 ldpp_dout(this, 4) << "An acl can have up to " << max_num
5712 << " grants, request acl grants num: " << grants_num
<< dendl
;
5713 op_ret
= -ERR_LIMIT_EXCEEDED
;
5714 s
->err
.message
= "The request is rejected, because the acl grants number you requested is larger than the maximum "
5715 + std::to_string(max_num
)
5716 + " grants allowed in an acl.";
5720 // forward bucket acl requests to meta master zone
5721 if ((rgw::sal::Object::empty(s
->object
.get()))) {
5723 // include acl data unless it was generated from a canned_acl
5724 if (s
->canned_acl
.empty()) {
5725 in_data
.append(data
);
5727 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
5729 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5734 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
5735 ldpp_dout(this, 15) << "Old AccessControlPolicy";
5736 policy
->to_xml(*_dout
);
5740 op_ret
= policy
->rebuild(this, store
, &owner
, new_policy
, s
->err
.message
);
5744 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
5745 ldpp_dout(this, 15) << "New AccessControlPolicy:";
5746 new_policy
.to_xml(*_dout
);
5750 if (s
->bucket_access_conf
&&
5751 s
->bucket_access_conf
->block_public_acls() &&
5752 new_policy
.is_public(this)) {
5756 new_policy
.encode(bl
);
5757 map
<string
, bufferlist
> attrs
;
5759 if (!rgw::sal::Object::empty(s
->object
.get())) {
5760 s
->object
->set_atomic(s
->obj_ctx
);
5761 //if instance is empty, we should modify the latest object
5762 op_ret
= s
->object
->modify_obj_attrs(s
->obj_ctx
, RGW_ATTR_ACL
, bl
, s
->yield
, this);
5764 map
<string
,bufferlist
> attrs
= s
->bucket_attrs
;
5765 attrs
[RGW_ATTR_ACL
] = bl
;
5766 op_ret
= s
->bucket
->merge_and_store_attrs(this, attrs
, y
);
5768 if (op_ret
== -ECANCELED
) {
5769 op_ret
= 0; /* lost a race, but it's ok because acls are immutable */
5773 void RGWPutLC::execute(optional_yield y
)
5777 RGWLifecycleConfiguration_S3
config(s
->cct
);
5778 RGWXMLParser parser
;
5779 RGWLifecycleConfiguration_S3
new_config(s
->cct
);
5781 content_md5
= s
->info
.env
->get("HTTP_CONTENT_MD5");
5782 if (content_md5
== nullptr) {
5783 op_ret
= -ERR_INVALID_REQUEST
;
5784 s
->err
.message
= "Missing required header for this request: Content-MD5";
5785 ldpp_dout(this, 5) << s
->err
.message
<< dendl
;
5789 std::string content_md5_bin
;
5791 content_md5_bin
= rgw::from_base64(std::string_view(content_md5
));
5793 s
->err
.message
= "Request header Content-MD5 contains character "
5794 "that is not base64 encoded.";
5795 ldpp_dout(this, 5) << s
->err
.message
<< dendl
;
5796 op_ret
= -ERR_BAD_DIGEST
;
5800 if (!parser
.init()) {
5805 op_ret
= get_params(y
);
5809 char* buf
= data
.c_str();
5810 ldpp_dout(this, 15) << "read len=" << data
.length() << " data=" << (buf
? buf
: "") << dendl
;
5813 // Allow use of MD5 digest in FIPS mode for non-cryptographic purposes
5814 data_hash
.SetFlags(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
);
5815 unsigned char data_hash_res
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
5816 data_hash
.Update(reinterpret_cast<const unsigned char*>(buf
), data
.length());
5817 data_hash
.Final(data_hash_res
);
5819 if (memcmp(data_hash_res
, content_md5_bin
.c_str(), CEPH_CRYPTO_MD5_DIGESTSIZE
) != 0) {
5820 op_ret
= -ERR_BAD_DIGEST
;
5821 s
->err
.message
= "The Content-MD5 you specified did not match what we received.";
5822 ldpp_dout(this, 5) << s
->err
.message
5823 << " Specified content md5: " << content_md5
5824 << ", calculated content md5: " << data_hash_res
5829 if (!parser
.parse(buf
, data
.length(), 1)) {
5830 op_ret
= -ERR_MALFORMED_XML
;
5835 RGWXMLDecoder::decode_xml("LifecycleConfiguration", config
, &parser
);
5836 } catch (RGWXMLDecoder::err
& err
) {
5837 ldpp_dout(this, 5) << "Bad lifecycle configuration: " << err
<< dendl
;
5838 op_ret
= -ERR_MALFORMED_XML
;
5842 op_ret
= config
.rebuild(new_config
);
5846 if (s
->cct
->_conf
->subsys
.should_gather
<ceph_subsys_rgw
, 15>()) {
5848 new_config
.dump_xml(&xf
);
5851 ldpp_dout(this, 15) << "New LifecycleConfiguration:" << ss
.str() << dendl
;
5854 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
5856 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5860 op_ret
= store
->get_rgwlc()->set_bucket_config(s
->bucket
.get(), s
->bucket_attrs
, &new_config
);
5867 void RGWDeleteLC::execute(optional_yield y
)
5870 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
5872 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5876 op_ret
= store
->get_rgwlc()->remove_bucket_config(s
->bucket
.get(), s
->bucket_attrs
);
5883 int RGWGetCORS::verify_permission(optional_yield y
)
5885 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
5886 if (has_s3_resource_tag
)
5887 rgw_iam_add_buckettags(this, s
);
5889 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketCORS
);
5892 void RGWGetCORS::execute(optional_yield y
)
5894 op_ret
= read_bucket_cors();
5899 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
5900 op_ret
= -ERR_NO_CORS_FOUND
;
5905 int RGWPutCORS::verify_permission(optional_yield y
)
5907 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
5908 if (has_s3_resource_tag
)
5909 rgw_iam_add_buckettags(this, s
);
5911 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketCORS
);
5914 void RGWPutCORS::execute(optional_yield y
)
5918 op_ret
= get_params(y
);
5922 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
5924 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5928 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
5929 rgw::sal::Attrs
attrs(s
->bucket_attrs
);
5930 attrs
[RGW_ATTR_CORS
] = cors_bl
;
5931 return s
->bucket
->merge_and_store_attrs(this, attrs
, s
->yield
);
5935 int RGWDeleteCORS::verify_permission(optional_yield y
)
5937 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
5938 if (has_s3_resource_tag
)
5939 rgw_iam_add_buckettags(this, s
);
5941 // No separate delete permission
5942 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketCORS
);
5945 void RGWDeleteCORS::execute(optional_yield y
)
5948 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
5950 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
5954 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
5955 op_ret
= read_bucket_cors();
5960 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
5965 rgw::sal::Attrs
attrs(s
->bucket_attrs
);
5966 attrs
.erase(RGW_ATTR_CORS
);
5967 op_ret
= s
->bucket
->merge_and_store_attrs(this, attrs
, s
->yield
);
5969 ldpp_dout(this, 0) << "RGWLC::RGWDeleteCORS() failed to set attrs on bucket=" << s
->bucket
->get_name()
5970 << " returned err=" << op_ret
<< dendl
;
5976 void RGWOptionsCORS::get_response_params(string
& hdrs
, string
& exp_hdrs
, unsigned *max_age
) {
5977 get_cors_response_headers(this, rule
, req_hdrs
, hdrs
, exp_hdrs
, max_age
);
5980 int RGWOptionsCORS::validate_cors_request(RGWCORSConfiguration
*cc
) {
5981 rule
= cc
->host_name_rule(origin
);
5983 ldpp_dout(this, 10) << "There is no cors rule present for " << origin
<< dendl
;
5987 if (!validate_cors_rule_method(this, rule
, req_meth
)) {
5991 if (!validate_cors_rule_header(this, rule
, req_hdrs
)) {
5998 void RGWOptionsCORS::execute(optional_yield y
)
6000 op_ret
= read_bucket_cors();
6004 origin
= s
->info
.env
->get("HTTP_ORIGIN");
6006 ldpp_dout(this, 0) << "Missing mandatory Origin header" << dendl
;
6010 req_meth
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
6012 ldpp_dout(this, 0) << "Missing mandatory Access-control-request-method header" << dendl
;
6017 ldpp_dout(this, 2) << "No CORS configuration set yet for this bucket" << dendl
;
6021 req_hdrs
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
6022 op_ret
= validate_cors_request(&bucket_cors
);
6024 origin
= req_meth
= NULL
;
6030 int RGWGetRequestPayment::verify_permission(optional_yield y
)
6032 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
6033 if (has_s3_resource_tag
)
6034 rgw_iam_add_buckettags(this, s
);
6036 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketRequestPayment
);
6039 void RGWGetRequestPayment::pre_exec()
6041 rgw_bucket_object_pre_exec(s
);
6044 void RGWGetRequestPayment::execute(optional_yield y
)
6046 requester_pays
= s
->bucket
->get_info().requester_pays
;
6049 int RGWSetRequestPayment::verify_permission(optional_yield y
)
6051 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
6052 if (has_s3_resource_tag
)
6053 rgw_iam_add_buckettags(this, s
);
6055 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketRequestPayment
);
6058 void RGWSetRequestPayment::pre_exec()
6060 rgw_bucket_object_pre_exec(s
);
6063 void RGWSetRequestPayment::execute(optional_yield y
)
6066 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, in_data
, nullptr, s
->info
, y
);
6068 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
6072 op_ret
= get_params(y
);
6077 s
->bucket
->get_info().requester_pays
= requester_pays
;
6078 op_ret
= s
->bucket
->put_info(this, false, real_time());
6080 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
->get_name()
6081 << " returned err=" << op_ret
<< dendl
;
6084 s
->bucket_attrs
= s
->bucket
->get_attrs();
6087 int RGWInitMultipart::verify_permission(optional_yield y
)
6089 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
6090 if (has_s3_existing_tag
|| has_s3_resource_tag
)
6091 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
6093 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
6094 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
6095 rgw::IAM::s3PutObject
,
6096 s
->object
->get_obj());
6097 if (identity_policy_res
== Effect::Deny
) {
6101 rgw::IAM::Effect e
= Effect::Pass
;
6102 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
6103 ARN
obj_arn(s
->object
->get_obj());
6104 if (s
->iam_policy
) {
6105 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
6106 rgw::IAM::s3PutObject
,
6110 if (e
== Effect::Deny
) {
6114 if (!s
->session_policies
.empty()) {
6115 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
6116 rgw::IAM::s3PutObject
,
6117 s
->object
->get_obj());
6118 if (session_policy_res
== Effect::Deny
) {
6121 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
6122 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
6123 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
6124 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
)) {
6127 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
6128 //Intersection of session policy and identity policy plus bucket policy
6129 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
) {
6132 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
6133 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
6139 if (e
== Effect::Allow
|| identity_policy_res
== Effect::Allow
) {
6144 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
6151 void RGWInitMultipart::pre_exec()
6153 rgw_bucket_object_pre_exec(s
);
6156 void RGWInitMultipart::execute(optional_yield y
)
6158 bufferlist aclbl
, tracebl
;
6159 rgw::sal::Attrs attrs
;
6161 if (get_params(y
) < 0)
6164 if (rgw::sal::Object::empty(s
->object
.get()))
6167 if (multipart_trace
) {
6168 tracing::encode(multipart_trace
->GetContext(), tracebl
);
6169 attrs
[RGW_ATTR_TRACE
] = tracebl
;
6172 policy
.encode(aclbl
);
6173 attrs
[RGW_ATTR_ACL
] = aclbl
;
6175 populate_with_generic_attrs(s
, attrs
);
6177 /* select encryption mode */
6178 op_ret
= prepare_encryption(attrs
);
6182 op_ret
= rgw_get_request_metadata(this, s
->cct
, s
->info
, attrs
);
6187 std::unique_ptr
<rgw::sal::MultipartUpload
> upload
;
6188 upload
= s
->bucket
->get_multipart_upload(s
->object
->get_name(),
6190 op_ret
= upload
->init(this, s
->yield
, s
->obj_ctx
, s
->owner
, s
->dest_placement
, attrs
);
6193 upload_id
= upload
->get_upload_id();
6195 s
->trace
->SetAttribute(tracing::rgw::UPLOAD_ID
, upload_id
);
6196 multipart_trace
->UpdateName(tracing::rgw::MULTIPART
+ upload_id
);
6200 int RGWCompleteMultipart::verify_permission(optional_yield y
)
6202 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
6203 if (has_s3_existing_tag
|| has_s3_resource_tag
)
6204 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
6206 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || ! s
->session_policies
.empty()) {
6207 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
6208 rgw::IAM::s3PutObject
,
6209 s
->object
->get_obj());
6210 if (identity_policy_res
== Effect::Deny
) {
6214 rgw::IAM::Effect e
= Effect::Pass
;
6215 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
6216 rgw::ARN
obj_arn(s
->object
->get_obj());
6217 if (s
->iam_policy
) {
6218 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
6219 rgw::IAM::s3PutObject
,
6223 if (e
== Effect::Deny
) {
6227 if (!s
->session_policies
.empty()) {
6228 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
6229 rgw::IAM::s3PutObject
,
6230 s
->object
->get_obj());
6231 if (session_policy_res
== Effect::Deny
) {
6234 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
6235 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
6236 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
6237 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
)) {
6240 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
6241 //Intersection of session policy and identity policy plus bucket policy
6242 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
) {
6245 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
6246 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
6252 if (e
== Effect::Allow
|| identity_policy_res
== Effect::Allow
) {
6257 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
6264 void RGWCompleteMultipart::pre_exec()
6266 rgw_bucket_object_pre_exec(s
);
6269 void RGWCompleteMultipart::execute(optional_yield y
)
6271 RGWMultiCompleteUpload
*parts
;
6272 RGWMultiXMLParser parser
;
6273 std::unique_ptr
<rgw::sal::MultipartUpload
> upload
;
6275 std::unique_ptr
<rgw::sal::Object
> meta_obj
;
6276 std::unique_ptr
<rgw::sal::Object
> target_obj
;
6277 uint64_t olh_epoch
= 0;
6279 op_ret
= get_params(y
);
6282 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
6287 if (!data
.length()) {
6288 op_ret
= -ERR_MALFORMED_XML
;
6292 if (!parser
.init()) {
6297 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
6298 op_ret
= -ERR_MALFORMED_XML
;
6302 parts
= static_cast<RGWMultiCompleteUpload
*>(parser
.find_first("CompleteMultipartUpload"));
6303 if (!parts
|| parts
->parts
.empty()) {
6304 // CompletedMultipartUpload is incorrect but some versions of some libraries use it, see PR #41700
6305 parts
= static_cast<RGWMultiCompleteUpload
*>(parser
.find_first("CompletedMultipartUpload"));
6308 if (!parts
|| parts
->parts
.empty()) {
6309 op_ret
= -ERR_MALFORMED_XML
;
6314 if ((int)parts
->parts
.size() >
6315 s
->cct
->_conf
->rgw_multipart_part_upload_limit
) {
6320 upload
= s
->bucket
->get_multipart_upload(s
->object
->get_name(), upload_id
);
6322 RGWCompressionInfo cs_info
;
6323 bool compressed
= false;
6324 uint64_t accounted_size
= 0;
6326 list
<rgw_obj_index_key
> remove_objs
; /* objects to be removed from index listing */
6328 meta_obj
= upload
->get_meta_obj();
6329 meta_obj
->set_in_extra_data(true);
6330 meta_obj
->set_hash_source(s
->object
->get_name());
6332 /*take a cls lock on meta_obj to prevent racing completions (or retries)
6333 from deleting the parts*/
6334 int max_lock_secs_mp
=
6335 s
->cct
->_conf
.get_val
<int64_t>("rgw_mp_lock_max_time");
6336 utime_t
dur(max_lock_secs_mp
, 0);
6338 serializer
= meta_obj
->get_serializer(this, "RGWCompleteMultipart");
6339 op_ret
= serializer
->try_lock(this, dur
, y
);
6341 ldpp_dout(this, 0) << "failed to acquire lock" << dendl
;
6342 if (op_ret
== -ENOENT
&& check_previously_completed(parts
)) {
6343 ldpp_dout(this, 1) << "NOTICE: This multipart completion is already completed" << dendl
;
6347 op_ret
= -ERR_INTERNAL_ERROR
;
6348 s
->err
.message
= "This multipart completion is already in progress";
6352 op_ret
= meta_obj
->get_obj_attrs(s
->obj_ctx
, s
->yield
, this);
6354 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << meta_obj
6355 << " ret=" << op_ret
<< dendl
;
6358 s
->trace
->SetAttribute(tracing::rgw::UPLOAD_ID
, upload_id
);
6359 jspan_context
trace_ctx(false, false);
6360 extract_span_context(meta_obj
->get_attrs(), trace_ctx
);
6361 multipart_trace
= tracing::rgw::tracer
.add_span(name(), trace_ctx
);
6364 // make reservation for notification if needed
6365 std::unique_ptr
<rgw::sal::Notification
> res
6366 = store
->get_notification(meta_obj
.get(), nullptr, s
, rgw::notify::ObjectCreatedCompleteMultipartUpload
, &s
->object
->get_name());
6367 op_ret
= res
->publish_reserve(this);
6372 target_obj
= s
->bucket
->get_object(rgw_obj_key(s
->object
->get_name()));
6373 if (s
->bucket
->versioning_enabled()) {
6374 if (!version_id
.empty()) {
6375 target_obj
->set_instance(version_id
);
6377 target_obj
->gen_rand_obj_instance_name();
6378 version_id
= target_obj
->get_instance();
6381 target_obj
->set_attrs(meta_obj
->get_attrs());
6383 op_ret
= upload
->complete(this, y
, s
->cct
, parts
->parts
, remove_objs
, accounted_size
, compressed
, cs_info
, ofs
, s
->req_id
, s
->owner
, olh_epoch
, target_obj
.get(), s
->obj_ctx
);
6385 ldpp_dout(this, 0) << "ERROR: upload complete failed ret=" << op_ret
<< dendl
;
6389 // remove the upload meta object ; the meta object is not versioned
6390 // when the bucket is, as that would add an unneeded delete marker
6391 int r
= meta_obj
->delete_object(this, s
->obj_ctx
, y
, true /* prevent versioning */);
6393 /* serializer's exclusive lock is released */
6394 serializer
->clear_locked();
6396 ldpp_dout(this, 0) << "WARNING: failed to remove object " << meta_obj
<< dendl
;
6399 // send request to notification manager
6400 int ret
= res
->publish_commit(this, ofs
, target_obj
->get_mtime(), etag
, target_obj
->get_instance());
6402 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
6403 // too late to rollback operation, hence op_ret is not set here
6405 } // RGWCompleteMultipart::execute
6407 bool RGWCompleteMultipart::check_previously_completed(const RGWMultiCompleteUpload
* parts
)
6409 // re-calculate the etag from the parts and compare to the existing object
6410 int ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, this);
6412 ldpp_dout(this, 0) << __func__
<< "() ERROR: get_obj_attrs() returned ret=" << ret
<< dendl
;
6415 rgw::sal::Attrs sattrs
= s
->object
->get_attrs();
6416 string oetag
= sattrs
[RGW_ATTR_ETAG
].to_str();
6419 // Allow use of MD5 digest in FIPS mode for non-cryptographic purposes
6420 hash
.SetFlags(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
);
6421 for (const auto& [index
, part
] : parts
->parts
) {
6422 std::string partetag
= rgw_string_unquote(part
);
6423 char petag
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
6424 hex_to_buf(partetag
.c_str(), petag
, CEPH_CRYPTO_MD5_DIGESTSIZE
);
6425 hash
.Update((const unsigned char *)petag
, sizeof(petag
));
6426 ldpp_dout(this, 20) << __func__
<< "() re-calculating multipart etag: part: "
6427 << index
<< ", etag: " << partetag
<< dendl
;
6430 unsigned char final_etag
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
6431 char final_etag_str
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 16];
6432 hash
.Final(final_etag
);
6433 buf_to_hex(final_etag
, CEPH_CRYPTO_MD5_DIGESTSIZE
, final_etag_str
);
6434 snprintf(&final_etag_str
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2], sizeof(final_etag_str
) - CEPH_CRYPTO_MD5_DIGESTSIZE
* 2,
6435 "-%lld", (long long)parts
->parts
.size());
6437 if (oetag
.compare(final_etag_str
) != 0) {
6438 ldpp_dout(this, 1) << __func__
<< "() NOTICE: etag mismatch: object etag:"
6439 << oetag
<< ", re-calculated etag:" << final_etag_str
<< dendl
;
6442 ldpp_dout(this, 5) << __func__
<< "() object etag and re-calculated etag match, etag: " << oetag
<< dendl
;
6446 void RGWCompleteMultipart::complete()
6448 /* release exclusive lock iff not already */
6449 if (unlikely(serializer
&& serializer
->locked
)) {
6450 int r
= serializer
->unlock();
6452 ldpp_dout(this, 0) << "WARNING: failed to unlock " << serializer
->oid
<< dendl
;
6458 int RGWAbortMultipart::verify_permission(optional_yield y
)
6460 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
6461 if (has_s3_existing_tag
|| has_s3_resource_tag
)
6462 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
6464 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
6465 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
6466 rgw::IAM::s3AbortMultipartUpload
,
6467 s
->object
->get_obj());
6468 if (identity_policy_res
== Effect::Deny
) {
6472 rgw::IAM::Effect e
= Effect::Pass
;
6473 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
6474 ARN
obj_arn(s
->object
->get_obj());
6475 if (s
->iam_policy
) {
6476 e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
6477 rgw::IAM::s3AbortMultipartUpload
,
6478 obj_arn
, princ_type
);
6481 if (e
== Effect::Deny
) {
6485 if (!s
->session_policies
.empty()) {
6486 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
6487 rgw::IAM::s3PutObject
,
6488 s
->object
->get_obj());
6489 if (session_policy_res
== Effect::Deny
) {
6492 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
6493 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
6494 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
6495 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
)) {
6498 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
6499 //Intersection of session policy and identity policy plus bucket policy
6500 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
) {
6503 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
6504 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
6510 if (e
== Effect::Allow
|| identity_policy_res
== Effect::Allow
) {
6515 if (!verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
6522 void RGWAbortMultipart::pre_exec()
6524 rgw_bucket_object_pre_exec(s
);
6527 void RGWAbortMultipart::execute(optional_yield y
)
6531 upload_id
= s
->info
.args
.get("uploadId");
6532 std::unique_ptr
<rgw::sal::Object
> meta_obj
;
6533 std::unique_ptr
<rgw::sal::MultipartUpload
> upload
;
6535 if (upload_id
.empty() || rgw::sal::Object::empty(s
->object
.get()))
6538 upload
= s
->bucket
->get_multipart_upload(s
->object
->get_name(), upload_id
);
6539 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
6541 jspan_context
trace_ctx(false, false);
6542 if (tracing::rgw::tracer
.is_enabled()) {
6543 // read meta object attributes for trace info
6544 meta_obj
= upload
->get_meta_obj();
6545 meta_obj
->set_in_extra_data(true);
6546 meta_obj
->get_obj_attrs(obj_ctx
, s
->yield
, this);
6547 extract_span_context(meta_obj
->get_attrs(), trace_ctx
);
6549 multipart_trace
= tracing::rgw::tracer
.add_span(name(), trace_ctx
);
6551 op_ret
= upload
->abort(this, s
->cct
, obj_ctx
);
6554 int RGWListMultipart::verify_permission(optional_yield y
)
6556 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
6557 if (has_s3_existing_tag
|| has_s3_resource_tag
)
6558 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
6560 if (!verify_object_permission(this, s
, rgw::IAM::s3ListMultipartUploadParts
))
6566 void RGWListMultipart::pre_exec()
6568 rgw_bucket_object_pre_exec(s
);
6571 void RGWListMultipart::execute(optional_yield y
)
6573 op_ret
= get_params(y
);
6577 upload
= s
->bucket
->get_multipart_upload(s
->object
->get_name(), upload_id
);
6579 rgw::sal::Attrs attrs
;
6580 op_ret
= upload
->get_info(this, s
->yield
, s
->obj_ctx
, &placement
, &attrs
);
6582 map
<string
, bufferlist
>::iterator iter
= attrs
.find(RGW_ATTR_ACL
);
6583 if (iter
!= attrs
.end()) {
6584 auto bliter
= iter
->second
.cbegin();
6586 policy
.decode(bliter
);
6587 } catch (buffer::error
& err
) {
6588 ldpp_dout(this, 0) << "ERROR: could not decode policy, caught buffer::error" << dendl
;
6595 op_ret
= upload
->list_parts(this, s
->cct
, max_parts
, marker
, NULL
, &truncated
);
6598 int RGWListBucketMultiparts::verify_permission(optional_yield y
)
6600 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
6601 if (has_s3_resource_tag
)
6602 rgw_iam_add_buckettags(this, s
);
6604 if (!verify_bucket_permission(this,
6606 rgw::IAM::s3ListBucketMultipartUploads
))
6612 void RGWListBucketMultiparts::pre_exec()
6614 rgw_bucket_object_pre_exec(s
);
6617 void RGWListBucketMultiparts::execute(optional_yield y
)
6619 op_ret
= get_params(y
);
6623 if (s
->prot_flags
& RGW_REST_SWIFT
) {
6625 path_args
= s
->info
.args
.get("path");
6626 if (!path_args
.empty()) {
6627 if (!delimiter
.empty() || !prefix
.empty()) {
6636 op_ret
= s
->bucket
->list_multiparts(this, prefix
, marker_meta
,
6637 delimiter
, max_uploads
, uploads
,
6638 &common_prefixes
, &is_truncated
);
6643 if (!uploads
.empty()) {
6644 next_marker_key
= uploads
.back()->get_key();
6645 next_marker_upload_id
= uploads
.back()->get_upload_id();
6649 void RGWGetHealthCheck::execute(optional_yield y
)
6651 if (!g_conf()->rgw_healthcheck_disabling_path
.empty() &&
6652 (::access(g_conf()->rgw_healthcheck_disabling_path
.c_str(), F_OK
) == 0)) {
6653 /* Disabling path specified & existent in the filesystem. */
6654 op_ret
= -ERR_SERVICE_UNAVAILABLE
; /* 503 */
6656 op_ret
= 0; /* 200 OK */
6660 int RGWDeleteMultiObj::verify_permission(optional_yield y
)
6662 int op_ret
= get_params(y
);
6667 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
6668 if (has_s3_existing_tag
|| has_s3_resource_tag
)
6669 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
6671 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || ! s
->session_policies
.empty()) {
6672 if (s
->bucket
->get_info().obj_lock_enabled() && bypass_governance_mode
) {
6673 ARN
bucket_arn(s
->bucket
->get_key());
6674 auto r
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
6675 rgw::IAM::s3BypassGovernanceRetention
, ARN(s
->bucket
->get_key()));
6676 if (r
== Effect::Deny
) {
6677 bypass_perm
= false;
6678 } else if (r
== Effect::Pass
&& s
->iam_policy
) {
6679 r
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
, rgw::IAM::s3BypassGovernanceRetention
,
6681 if (r
== Effect::Deny
) {
6682 bypass_perm
= false;
6684 } else if (r
== Effect::Pass
&& !s
->session_policies
.empty()) {
6685 r
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
6686 rgw::IAM::s3BypassGovernanceRetention
, ARN(s
->bucket
->get_key()));
6687 if (r
== Effect::Deny
) {
6688 bypass_perm
= false;
6693 bool not_versioned
= rgw::sal::Object::empty(s
->object
.get()) || s
->object
->get_instance().empty();
6695 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
6697 rgw::IAM::s3DeleteObject
:
6698 rgw::IAM::s3DeleteObjectVersion
,
6699 ARN(s
->bucket
->get_key()));
6700 if (identity_policy_res
== Effect::Deny
) {
6704 rgw::IAM::Effect r
= Effect::Pass
;
6705 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
6706 rgw::ARN
bucket_arn(s
->bucket
->get_key());
6707 if (s
->iam_policy
) {
6708 r
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
6710 rgw::IAM::s3DeleteObject
:
6711 rgw::IAM::s3DeleteObjectVersion
,
6715 if (r
== Effect::Deny
)
6718 if (!s
->session_policies
.empty()) {
6719 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
6721 rgw::IAM::s3DeleteObject
:
6722 rgw::IAM::s3DeleteObjectVersion
,
6723 ARN(s
->bucket
->get_key()));
6724 if (session_policy_res
== Effect::Deny
) {
6727 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
6728 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
6729 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
6730 (session_policy_res
== Effect::Allow
&& r
== Effect::Allow
)) {
6733 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
6734 //Intersection of session policy and identity policy plus bucket policy
6735 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || r
== Effect::Allow
) {
6738 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
6739 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
6745 if (r
== Effect::Allow
|| identity_policy_res
== Effect::Allow
)
6749 acl_allowed
= verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
);
6756 void RGWDeleteMultiObj::pre_exec()
6758 rgw_bucket_object_pre_exec(s
);
6761 void RGWDeleteMultiObj::execute(optional_yield y
)
6763 RGWMultiDelDelete
*multi_delete
;
6764 vector
<rgw_obj_key
>::iterator iter
;
6765 RGWMultiDelXMLParser parser
;
6766 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
6775 if (!parser
.init()) {
6780 if (!parser
.parse(buf
, data
.length(), 1)) {
6785 multi_delete
= static_cast<RGWMultiDelDelete
*>(parser
.find_first("Delete"));
6786 if (!multi_delete
) {
6790 #define DELETE_MULTI_OBJ_MAX_NUM 1000
6791 int max_num
= s
->cct
->_conf
->rgw_delete_multi_obj_max_num
;
6793 max_num
= DELETE_MULTI_OBJ_MAX_NUM
;
6795 int multi_delete_object_num
= multi_delete
->objects
.size();
6796 if (multi_delete_object_num
> max_num
) {
6797 op_ret
= -ERR_MALFORMED_XML
;
6802 if (multi_delete
->is_quiet())
6805 if (s
->bucket
->get_info().mfa_enabled()) {
6806 bool has_versioned
= false;
6807 for (auto i
: multi_delete
->objects
) {
6808 if (!i
.instance
.empty()) {
6809 has_versioned
= true;
6813 if (has_versioned
&& !s
->mfa_verified
) {
6814 ldpp_dout(this, 5) << "NOTICE: multi-object delete request with a versioned object, mfa auth not provided" << dendl
;
6815 op_ret
= -ERR_MFA_REQUIRED
;
6821 if (multi_delete
->objects
.empty()) {
6825 for (iter
= multi_delete
->objects
.begin();
6826 iter
!= multi_delete
->objects
.end();
6828 std::string version_id
;
6829 std::unique_ptr
<rgw::sal::Object
> obj
= bucket
->get_object(*iter
);
6830 if (s
->iam_policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
6831 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
6832 iter
->instance
.empty() ?
6833 rgw::IAM::s3DeleteObject
:
6834 rgw::IAM::s3DeleteObjectVersion
,
6835 ARN(obj
->get_obj()));
6836 if (identity_policy_res
== Effect::Deny
) {
6837 send_partial_response(*iter
, false, "", -EACCES
);
6841 rgw::IAM::Effect e
= Effect::Pass
;
6842 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
6843 if (s
->iam_policy
) {
6844 ARN
obj_arn(obj
->get_obj());
6845 e
= s
->iam_policy
->eval(s
->env
,
6847 iter
->instance
.empty() ?
6848 rgw::IAM::s3DeleteObject
:
6849 rgw::IAM::s3DeleteObjectVersion
,
6853 if (e
== Effect::Deny
) {
6854 send_partial_response(*iter
, false, "", -EACCES
);
6858 if (!s
->session_policies
.empty()) {
6859 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
6860 iter
->instance
.empty() ?
6861 rgw::IAM::s3DeleteObject
:
6862 rgw::IAM::s3DeleteObjectVersion
,
6863 ARN(obj
->get_obj()));
6864 if (session_policy_res
== Effect::Deny
) {
6865 send_partial_response(*iter
, false, "", -EACCES
);
6868 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
6869 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
6870 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) &&
6871 (session_policy_res
!= Effect::Allow
|| e
!= Effect::Allow
)) {
6872 send_partial_response(*iter
, false, "", -EACCES
);
6875 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
6876 //Intersection of session policy and identity policy plus bucket policy
6877 if ((session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) && e
!= Effect::Allow
) {
6878 send_partial_response(*iter
, false, "", -EACCES
);
6881 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
6882 if (session_policy_res
!= Effect::Allow
|| identity_policy_res
!= Effect::Allow
) {
6883 send_partial_response(*iter
, false, "", -EACCES
);
6887 send_partial_response(*iter
, false, "", -EACCES
);
6891 if ((identity_policy_res
== Effect::Pass
&& e
== Effect::Pass
&& !acl_allowed
)) {
6892 send_partial_response(*iter
, false, "", -EACCES
);
6897 uint64_t obj_size
= 0;
6900 if (!rgw::sal::Object::empty(obj
.get())) {
6901 RGWObjState
* astate
= nullptr;
6902 bool check_obj_lock
= obj
->have_instance() && bucket
->get_info().obj_lock_enabled();
6903 const auto ret
= obj
->get_obj_state(this, obj_ctx
, &astate
, s
->yield
, true);
6906 if (ret
== -ENOENT
) {
6907 // object maybe delete_marker, skip check_obj_lock
6908 check_obj_lock
= false;
6910 // Something went wrong.
6911 send_partial_response(*iter
, false, "", ret
);
6915 obj_size
= astate
->size
;
6916 etag
= astate
->attrset
[RGW_ATTR_ETAG
].to_str();
6919 if (check_obj_lock
) {
6920 ceph_assert(astate
);
6921 int object_lock_response
= verify_object_lock(this, astate
->attrset
, bypass_perm
, bypass_governance_mode
);
6922 if (object_lock_response
!= 0) {
6923 send_partial_response(*iter
, false, "", object_lock_response
);
6929 // make reservation for notification if needed
6930 const auto versioned_object
= s
->bucket
->versioning_enabled();
6931 const auto event_type
= versioned_object
&& obj
->get_instance().empty() ?
6932 rgw::notify::ObjectRemovedDeleteMarkerCreated
:
6933 rgw::notify::ObjectRemovedDelete
;
6934 std::unique_ptr
<rgw::sal::Notification
> res
6935 = store
->get_notification(obj
.get(), s
->src_object
.get(), s
, event_type
);
6936 op_ret
= res
->publish_reserve(this);
6938 send_partial_response(*iter
, false, "", op_ret
);
6942 obj
->set_atomic(obj_ctx
);
6944 std::unique_ptr
<rgw::sal::Object::DeleteOp
> del_op
= obj
->get_delete_op(obj_ctx
);
6945 del_op
->params
.versioning_status
= obj
->get_bucket()->get_info().versioning_status();
6946 del_op
->params
.obj_owner
= s
->owner
;
6947 del_op
->params
.bucket_owner
= s
->bucket_owner
;
6948 del_op
->params
.marker_version_id
= version_id
;
6950 op_ret
= del_op
->delete_obj(this, y
);
6951 if (op_ret
== -ENOENT
) {
6955 send_partial_response(*iter
, obj
->get_delete_marker(), del_op
->result
.version_id
, op_ret
);
6957 // send request to notification manager
6958 int ret
= res
->publish_commit(this, obj_size
, ceph::real_clock::now(), etag
, version_id
);
6960 ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret
<< dendl
;
6961 // too late to rollback operation, hence op_ret is not set here
6965 /* set the return code to zero, errors at this point will be
6966 dumped to the response */
6970 // will likely segfault if begin_response() has not been called
6980 bool RGWBulkDelete::Deleter::verify_permission(RGWBucketInfo
& binfo
,
6981 map
<string
, bufferlist
>& battrs
,
6982 ACLOwner
& bucket_owner
/* out */,
6985 RGWAccessControlPolicy
bacl(store
->ctx());
6986 int ret
= read_bucket_policy(dpp
, store
, s
, binfo
, battrs
, &bacl
, binfo
.bucket
, y
);
6991 auto policy
= get_iam_policy_from_attr(s
->cct
, battrs
, binfo
.bucket
.tenant
);
6993 bucket_owner
= bacl
.get_owner();
6995 /* We can use global user_acl because each BulkDelete request is allowed
6996 * to work on entities from a single account only. */
6997 return verify_bucket_permission(dpp
, s
, binfo
.bucket
, s
->user_acl
.get(),
6998 &bacl
, policy
, s
->iam_user_policies
, s
->session_policies
, rgw::IAM::s3DeleteBucket
);
7001 bool RGWBulkDelete::Deleter::delete_single(const acct_path_t
& path
, optional_yield y
)
7003 std::unique_ptr
<rgw::sal::Bucket
> bucket
;
7005 RGWObjVersionTracker ot
;
7007 int ret
= store
->get_bucket(dpp
, s
->user
.get(), s
->user
->get_tenant(), path
.bucket_name
, &bucket
, y
);
7012 ret
= bucket
->load_bucket(dpp
, s
->yield
);
7017 if (!verify_permission(bucket
->get_info(), bucket
->get_attrs(), bowner
, y
)) {
7022 if (!path
.obj_key
.empty()) {
7023 ACLOwner bucket_owner
;
7025 bucket_owner
.set_id(bucket
->get_info().owner
);
7026 std::unique_ptr
<rgw::sal::Object
> obj
= bucket
->get_object(path
.obj_key
);
7027 obj
->set_atomic(s
->obj_ctx
);
7029 std::unique_ptr
<rgw::sal::Object::DeleteOp
> del_op
= obj
->get_delete_op(s
->obj_ctx
);
7030 del_op
->params
.versioning_status
= obj
->get_bucket()->get_info().versioning_status();
7031 del_op
->params
.obj_owner
= bowner
;
7032 del_op
->params
.bucket_owner
= bucket_owner
;
7034 ret
= del_op
->delete_obj(dpp
, y
);
7039 ret
= bucket
->remove_bucket(dpp
, false, true, &s
->info
, s
->yield
);
7049 if (-ENOENT
== ret
) {
7050 ldpp_dout(dpp
, 20) << "cannot find bucket = " << path
.bucket_name
<< dendl
;
7053 ldpp_dout(dpp
, 20) << "cannot get bucket info, ret = " << ret
<< dendl
;
7055 fail_desc_t failed_item
= {
7059 failures
.push_back(failed_item
);
7064 ldpp_dout(dpp
, 20) << "wrong auth for " << path
<< dendl
;
7066 fail_desc_t failed_item
= {
7070 failures
.push_back(failed_item
);
7075 if (-ENOENT
== ret
) {
7076 ldpp_dout(dpp
, 20) << "cannot find entry " << path
<< dendl
;
7079 fail_desc_t failed_item
= {
7083 failures
.push_back(failed_item
);
7088 bool RGWBulkDelete::Deleter::delete_chunk(const std::list
<acct_path_t
>& paths
, optional_yield y
)
7090 ldpp_dout(dpp
, 20) << "in delete_chunk" << dendl
;
7091 for (auto path
: paths
) {
7092 ldpp_dout(dpp
, 20) << "bulk deleting path: " << path
<< dendl
;
7093 delete_single(path
, y
);
7099 int RGWBulkDelete::verify_permission(optional_yield y
)
7104 void RGWBulkDelete::pre_exec()
7106 rgw_bucket_object_pre_exec(s
);
7109 void RGWBulkDelete::execute(optional_yield y
)
7111 deleter
= std::unique_ptr
<Deleter
>(new Deleter(this, store
, s
));
7113 bool is_truncated
= false;
7115 list
<RGWBulkDelete::acct_path_t
> items
;
7117 int ret
= get_data(items
, &is_truncated
);
7122 ret
= deleter
->delete_chunk(items
, y
);
7123 } while (!op_ret
&& is_truncated
);
7129 constexpr std::array
<int, 2> RGWBulkUploadOp::terminal_errors
;
7131 int RGWBulkUploadOp::verify_permission(optional_yield y
)
7133 if (s
->auth
.identity
->is_anonymous()) {
7137 if (! verify_user_permission_no_policy(this, s
, RGW_PERM_WRITE
)) {
7141 if (s
->user
->get_tenant() != s
->bucket_tenant
) {
7142 ldpp_dout(this, 10) << "user cannot create a bucket in a different tenant"
7143 << " (user_id.tenant=" << s
->user
->get_tenant()
7144 << " requested=" << s
->bucket_tenant
<< ")" << dendl
;
7148 if (s
->user
->get_max_buckets() < 0) {
7155 void RGWBulkUploadOp::pre_exec()
7157 rgw_bucket_object_pre_exec(s
);
7160 boost::optional
<std::pair
<std::string
, rgw_obj_key
>>
7161 RGWBulkUploadOp::parse_path(const std::string_view
& path
)
7163 /* We need to skip all slashes at the beginning in order to preserve
7164 * compliance with Swift. */
7165 const size_t start_pos
= path
.find_first_not_of('/');
7167 if (std::string_view::npos
!= start_pos
) {
7168 /* Seperator is the first slash after the leading ones. */
7169 const size_t sep_pos
= path
.substr(start_pos
).find('/');
7171 if (std::string_view::npos
!= sep_pos
) {
7172 const auto bucket_name
= path
.substr(start_pos
, sep_pos
- start_pos
);
7173 const auto obj_name
= path
.substr(sep_pos
+ 1);
7175 return std::make_pair(std::string(bucket_name
),
7176 rgw_obj_key(std::string(obj_name
)));
7178 /* It's guaranteed here that bucket name is at least one character
7179 * long and is different than slash. */
7180 return std::make_pair(std::string(path
.substr(start_pos
)),
7188 std::pair
<std::string
, std::string
>
7189 RGWBulkUploadOp::handle_upload_path(struct req_state
*s
)
7191 std::string bucket_path
, file_prefix
;
7192 if (! s
->init_state
.url_bucket
.empty()) {
7193 file_prefix
= bucket_path
= s
->init_state
.url_bucket
+ "/";
7194 if (!rgw::sal::Object::empty(s
->object
.get())) {
7195 const std::string
& object_name
= s
->object
->get_name();
7197 /* As rgw_obj_key::empty() already verified emptiness of s->object->get_name(),
7198 * we can safely examine its last element. */
7199 if (object_name
.back() == '/') {
7200 file_prefix
.append(object_name
);
7202 file_prefix
.append(object_name
).append("/");
7206 return std::make_pair(bucket_path
, file_prefix
);
7209 int RGWBulkUploadOp::handle_dir_verify_permission(optional_yield y
)
7211 if (s
->user
->get_max_buckets() > 0) {
7212 rgw::sal::BucketList buckets
;
7214 op_ret
= s
->user
->list_buckets(this, marker
, std::string(), s
->user
->get_max_buckets(),
7220 if (buckets
.count() >= static_cast<size_t>(s
->user
->get_max_buckets())) {
7221 return -ERR_TOO_MANY_BUCKETS
;
7228 static void forward_req_info(const DoutPrefixProvider
*dpp
, CephContext
*cct
, req_info
& info
, const std::string
& bucket_name
)
7230 /* the request of container or object level will contain bucket name.
7231 * only at account level need to append the bucket name */
7232 if (info
.script_uri
.find(bucket_name
) != std::string::npos
) {
7236 ldpp_dout(dpp
, 20) << "append the bucket: "<< bucket_name
<< " to req_info" << dendl
;
7237 info
.script_uri
.append("/").append(bucket_name
);
7238 info
.request_uri_aws4
= info
.request_uri
= info
.script_uri
;
7239 info
.effective_uri
= "/" + bucket_name
;
7242 void RGWBulkUploadOp::init(rgw::sal::Store
* const store
,
7243 struct req_state
* const s
,
7244 RGWHandler
* const h
)
7246 RGWOp::init(store
, s
, h
);
7249 int RGWBulkUploadOp::handle_dir(const std::string_view path
, optional_yield y
)
7251 ldpp_dout(this, 20) << "got directory=" << path
<< dendl
;
7253 op_ret
= handle_dir_verify_permission(y
);
7258 std::string bucket_name
;
7259 rgw_obj_key object_junk
;
7260 std::tie(bucket_name
, object_junk
) = *parse_path(path
);
7262 rgw_raw_obj
obj(store
->get_zone()->get_params().domain_root
,
7263 rgw_make_bucket_entry_name(s
->bucket_tenant
, bucket_name
));
7265 /* we need to make sure we read bucket info, it's not read before for this
7266 * specific request */
7267 std::unique_ptr
<rgw::sal::Bucket
> bucket
;
7269 /* Create metadata: ACLs. */
7270 std::map
<std::string
, ceph::bufferlist
> attrs
;
7271 RGWAccessControlPolicy policy
;
7272 policy
.create_default(s
->user
->get_id(), s
->user
->get_display_name());
7273 ceph::bufferlist aclbl
;
7274 policy
.encode(aclbl
);
7275 attrs
.emplace(RGW_ATTR_ACL
, std::move(aclbl
));
7277 obj_version objv
, ep_objv
;
7279 RGWQuotaInfo quota_info
;
7280 const RGWQuotaInfo
* pquota_info
= nullptr;
7281 RGWBucketInfo out_info
;
7282 string swift_ver_location
;
7283 rgw_bucket new_bucket
;
7284 req_info info
= s
->info
;
7285 new_bucket
.tenant
= s
->bucket_tenant
; /* ignored if bucket exists */
7286 new_bucket
.name
= bucket_name
;
7287 rgw_placement_rule placement_rule
;
7288 placement_rule
.storage_class
= s
->info
.storage_class
;
7289 forward_req_info(this, s
->cct
, info
, bucket_name
);
7291 op_ret
= s
->user
->create_bucket(this, new_bucket
,
7292 store
->get_zone()->get_zonegroup().get_id(),
7293 placement_rule
, swift_ver_location
,
7294 pquota_info
, policy
, attrs
,
7296 true, false, &bucket_exists
,
7298 /* continue if EEXIST and create_bucket will fail below. this way we can
7299 * recover from a partial create by retrying it. */
7300 ldpp_dout(this, 20) << "rgw_create_bucket returned ret=" << op_ret
7301 << ", bucket=" << bucket
<< dendl
;
7307 bool RGWBulkUploadOp::handle_file_verify_permission(RGWBucketInfo
& binfo
,
7309 std::map
<std::string
, ceph::bufferlist
>& battrs
,
7310 ACLOwner
& bucket_owner
/* out */,
7313 RGWAccessControlPolicy
bacl(store
->ctx());
7314 op_ret
= read_bucket_policy(this, store
, s
, binfo
, battrs
, &bacl
, binfo
.bucket
, y
);
7316 ldpp_dout(this, 20) << "cannot read_policy() for bucket" << dendl
;
7320 auto policy
= get_iam_policy_from_attr(s
->cct
, battrs
, binfo
.bucket
.tenant
);
7322 bucket_owner
= bacl
.get_owner();
7323 if (policy
|| ! s
->iam_user_policies
.empty() || !s
->session_policies
.empty()) {
7324 auto identity_policy_res
= eval_identity_or_session_policies(s
->iam_user_policies
, s
->env
,
7325 rgw::IAM::s3PutObject
, obj
);
7326 if (identity_policy_res
== Effect::Deny
) {
7330 rgw::IAM::PolicyPrincipal princ_type
= rgw::IAM::PolicyPrincipal::Other
;
7332 auto e
= policy
->eval(s
->env
, *s
->auth
.identity
,
7333 rgw::IAM::s3PutObject
, obj_arn
, princ_type
);
7334 if (e
== Effect::Deny
) {
7338 if (!s
->session_policies
.empty()) {
7339 auto session_policy_res
= eval_identity_or_session_policies(s
->session_policies
, s
->env
,
7340 rgw::IAM::s3PutObject
, obj
);
7341 if (session_policy_res
== Effect::Deny
) {
7344 if (princ_type
== rgw::IAM::PolicyPrincipal::Role
) {
7345 //Intersection of session policy and identity policy plus intersection of session policy and bucket policy
7346 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) ||
7347 (session_policy_res
== Effect::Allow
&& e
== Effect::Allow
)) {
7350 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Session
) {
7351 //Intersection of session policy and identity policy plus bucket policy
7352 if ((session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) || e
== Effect::Allow
) {
7355 } else if (princ_type
== rgw::IAM::PolicyPrincipal::Other
) {// there was no match in the bucket policy
7356 if (session_policy_res
== Effect::Allow
&& identity_policy_res
== Effect::Allow
) {
7362 if (e
== Effect::Allow
|| identity_policy_res
== Effect::Allow
) {
7367 return verify_bucket_permission_no_policy(this, s
, s
->user_acl
.get(),
7368 &bacl
, RGW_PERM_WRITE
);
7371 int RGWBulkUploadOp::handle_file(const std::string_view path
,
7373 AlignedStreamGetter
& body
, optional_yield y
)
7376 ldpp_dout(this, 20) << "got file=" << path
<< ", size=" << size
<< dendl
;
7378 if (size
> static_cast<size_t>(s
->cct
->_conf
->rgw_max_put_size
)) {
7379 op_ret
= -ERR_TOO_LARGE
;
7383 std::string bucket_name
;
7385 std::tie(bucket_name
, object
) = *parse_path(path
);
7387 auto& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
7388 std::unique_ptr
<rgw::sal::Bucket
> bucket
;
7391 op_ret
= store
->get_bucket(this, s
->user
.get(), rgw_bucket(rgw_bucket_key(s
->user
->get_tenant(), bucket_name
)), &bucket
, y
);
7393 if (op_ret
== -ENOENT
) {
7394 ldpp_dout(this, 20) << "non existent directory=" << bucket_name
<< dendl
;
7399 std::unique_ptr
<rgw::sal::Object
> obj
= bucket
->get_object(object
);
7401 if (! handle_file_verify_permission(bucket
->get_info(),
7403 bucket
->get_attrs(), bowner
, y
)) {
7404 ldpp_dout(this, 20) << "object creation unauthorized" << dendl
;
7409 op_ret
= bucket
->check_quota(this, user_quota
, bucket_quota
, size
, y
);
7414 if (bucket
->versioning_enabled()) {
7415 obj
->gen_rand_obj_instance_name();
7418 rgw_placement_rule dest_placement
= s
->dest_placement
;
7419 dest_placement
.inherit_from(bucket
->get_placement_rule());
7421 std::unique_ptr
<rgw::sal::Writer
> processor
;
7422 processor
= store
->get_atomic_writer(this, s
->yield
, std::move(obj
),
7423 bowner
.get_id(), obj_ctx
,
7424 &s
->dest_placement
, 0, s
->req_id
);
7425 op_ret
= processor
->prepare(s
->yield
);
7427 ldpp_dout(this, 20) << "cannot prepare processor due to ret=" << op_ret
<< dendl
;
7431 /* No filters by default. */
7432 rgw::sal::DataProcessor
*filter
= processor
.get();
7434 const auto& compression_type
= store
->get_zone()->get_params().get_compression_type(
7436 CompressorRef plugin
;
7437 boost::optional
<RGWPutObj_Compress
> compressor
;
7438 if (compression_type
!= "none") {
7439 plugin
= Compressor::create(s
->cct
, compression_type
);
7441 ldpp_dout(this, 1) << "Cannot load plugin for rgw_compression_type "
7442 << compression_type
<< dendl
;
7444 compressor
.emplace(s
->cct
, plugin
, filter
);
7445 filter
= &*compressor
;
7449 /* Upload file content. */
7453 // Allow use of MD5 digest in FIPS mode for non-cryptographic purposes
7454 hash
.SetFlags(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
);
7456 ceph::bufferlist data
;
7457 len
= body
.get_at_most(s
->cct
->_conf
->rgw_max_chunk_size
, data
);
7459 ldpp_dout(this, 20) << "body=" << data
.c_str() << dendl
;
7463 } else if (len
> 0) {
7464 hash
.Update((const unsigned char *)data
.c_str(), data
.length());
7465 op_ret
= filter
->process(std::move(data
), ofs
);
7467 ldpp_dout(this, 20) << "filter->process() returned ret=" << op_ret
<< dendl
;
7477 op_ret
= filter
->process({}, ofs
);
7483 ldpp_dout(this, 10) << "real file size different from declared" << dendl
;
7488 op_ret
= bucket
->check_quota(this, user_quota
, bucket_quota
, size
, y
);
7490 ldpp_dout(this, 20) << "quota exceeded for path=" << path
<< dendl
;
7494 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
7495 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
7497 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
7499 /* Create metadata: ETAG. */
7500 std::map
<std::string
, ceph::bufferlist
> attrs
;
7501 std::string etag
= calc_md5
;
7502 ceph::bufferlist etag_bl
;
7503 etag_bl
.append(etag
.c_str(), etag
.size() + 1);
7504 attrs
.emplace(RGW_ATTR_ETAG
, std::move(etag_bl
));
7506 /* Create metadata: ACLs. */
7507 RGWAccessControlPolicy policy
;
7508 policy
.create_default(s
->user
->get_id(), s
->user
->get_display_name());
7509 ceph::bufferlist aclbl
;
7510 policy
.encode(aclbl
);
7511 attrs
.emplace(RGW_ATTR_ACL
, std::move(aclbl
));
7513 /* Create metadata: compression info. */
7514 if (compressor
&& compressor
->is_compressed()) {
7515 ceph::bufferlist tmp
;
7516 RGWCompressionInfo cs_info
;
7517 cs_info
.compression_type
= plugin
->get_type_name();
7518 cs_info
.orig_size
= size
;
7519 cs_info
.compressor_message
= compressor
->get_compressor_message();
7520 cs_info
.blocks
= std::move(compressor
->get_compression_blocks());
7521 encode(cs_info
, tmp
);
7522 attrs
.emplace(RGW_ATTR_COMPRESSION
, std::move(tmp
));
7525 /* Complete the transaction. */
7526 op_ret
= processor
->complete(size
, etag
, nullptr, ceph::real_time(),
7527 attrs
, ceph::real_time() /* delete_at */,
7528 nullptr, nullptr, nullptr, nullptr, nullptr,
7531 ldpp_dout(this, 20) << "processor::complete returned op_ret=" << op_ret
<< dendl
;
7537 void RGWBulkUploadOp::execute(optional_yield y
)
7539 ceph::bufferlist
buffer(64 * 1024);
7541 ldpp_dout(this, 20) << "start" << dendl
;
7543 /* Create an instance of stream-abstracting class. Having this indirection
7544 * allows for easy introduction of decompressors like gzip and bzip2. */
7545 auto stream
= create_stream();
7550 /* Handling the $UPLOAD_PATH accordingly to the Swift's Bulk middleware. See:
7551 * https://github.com/openstack/swift/blob/2.13.0/swift/common/middleware/bulk.py#L31-L41 */
7552 std::string bucket_path
, file_prefix
;
7553 std::tie(bucket_path
, file_prefix
) = handle_upload_path(s
);
7555 auto status
= rgw::tar::StatusIndicator::create();
7557 op_ret
= stream
->get_exactly(rgw::tar::BLOCK_SIZE
, buffer
);
7559 ldpp_dout(this, 2) << "cannot read header" << dendl
;
7563 /* We need to re-interpret the buffer as a TAR block. Exactly two blocks
7564 * must be tracked to detect out end-of-archive. It occurs when both of
7565 * them are empty (zeroed). Tracing this particular inter-block dependency
7566 * is responsibility of the rgw::tar::StatusIndicator class. */
7567 boost::optional
<rgw::tar::HeaderView
> header
;
7568 std::tie(status
, header
) = rgw::tar::interpret_block(status
, buffer
);
7570 if (! status
.empty() && header
) {
7571 /* This specific block isn't empty (entirely zeroed), so we can parse
7572 * it as a TAR header and dispatch. At the moment we do support only
7573 * regular files and directories. Everything else (symlinks, devices)
7574 * will be ignored but won't cease the whole upload. */
7575 switch (header
->get_filetype()) {
7576 case rgw::tar::FileType::NORMAL_FILE
: {
7577 ldpp_dout(this, 2) << "handling regular file" << dendl
;
7579 std::string_view filename
;
7580 if (bucket_path
.empty())
7581 filename
= header
->get_filename();
7583 filename
= file_prefix
+ std::string(header
->get_filename());
7584 auto body
= AlignedStreamGetter(0, header
->get_filesize(),
7585 rgw::tar::BLOCK_SIZE
, *stream
);
7586 op_ret
= handle_file(filename
,
7587 header
->get_filesize(),
7590 /* Only regular files counts. */
7593 failures
.emplace_back(op_ret
, std::string(filename
));
7597 case rgw::tar::FileType::DIRECTORY
: {
7598 ldpp_dout(this, 2) << "handling regular directory" << dendl
;
7600 std::string_view dirname
= bucket_path
.empty() ? header
->get_filename() : bucket_path
;
7601 op_ret
= handle_dir(dirname
, y
);
7602 if (op_ret
< 0 && op_ret
!= -ERR_BUCKET_EXISTS
) {
7603 failures
.emplace_back(op_ret
, std::string(dirname
));
7608 /* Not recognized. Skip. */
7614 /* In case of any problems with sub-request authorization Swift simply
7615 * terminates whole upload immediately. */
7616 if (boost::algorithm::contains(std::initializer_list
<int>{ op_ret
},
7618 ldpp_dout(this, 2) << "terminating due to ret=" << op_ret
<< dendl
;
7622 ldpp_dout(this, 2) << "an empty block" << dendl
;
7627 } while (! status
.eof());
7632 RGWBulkUploadOp::AlignedStreamGetter::~AlignedStreamGetter()
7634 const size_t aligned_legnth
= length
+ (-length
% alignment
);
7635 ceph::bufferlist junk
;
7637 DecoratedStreamGetter::get_exactly(aligned_legnth
- position
, junk
);
7640 ssize_t
RGWBulkUploadOp::AlignedStreamGetter::get_at_most(const size_t want
,
7641 ceph::bufferlist
& dst
)
7643 const size_t max_to_read
= std::min(want
, length
- position
);
7644 const auto len
= DecoratedStreamGetter::get_at_most(max_to_read
, dst
);
7651 ssize_t
RGWBulkUploadOp::AlignedStreamGetter::get_exactly(const size_t want
,
7652 ceph::bufferlist
& dst
)
7654 const auto len
= DecoratedStreamGetter::get_exactly(want
, dst
);
7661 int RGWGetAttrs::verify_permission(optional_yield y
)
7663 s
->object
->set_atomic(s
->obj_ctx
);
7665 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
7666 if (has_s3_existing_tag
|| has_s3_resource_tag
)
7667 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
7669 auto iam_action
= s
->object
->get_instance().empty() ?
7670 rgw::IAM::s3GetObject
:
7671 rgw::IAM::s3GetObjectVersion
;
7673 if (!verify_object_permission(this, s
, iam_action
)) {
7680 void RGWGetAttrs::pre_exec()
7682 rgw_bucket_object_pre_exec(s
);
7685 void RGWGetAttrs::execute(optional_yield y
)
7687 op_ret
= get_params();
7691 s
->object
->set_atomic(s
->obj_ctx
);
7693 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, this);
7695 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << s
->object
7696 << " ret=" << op_ret
<< dendl
;
7700 /* XXX RGWObject::get_obj_attrs() does not support filtering (yet) */
7701 auto& obj_attrs
= s
->object
->get_attrs();
7702 if (attrs
.size() != 0) {
7703 /* return only attrs requested */
7704 for (auto& att
: attrs
) {
7705 auto iter
= obj_attrs
.find(att
.first
);
7706 if (iter
!= obj_attrs
.end()) {
7707 att
.second
= iter
->second
;
7711 /* return all attrs */
7712 for (auto& att
: obj_attrs
) {
7713 attrs
.insert(get_attrs_t::value_type(att
.first
, att
.second
));;
7720 int RGWRMAttrs::verify_permission(optional_yield y
)
7722 // This looks to be part of the RGW-NFS machinery and has no S3 or
7723 // Swift equivalent.
7725 if (!rgw::sal::Object::empty(s
->object
.get())) {
7726 perm
= verify_object_permission_no_policy(this, s
, RGW_PERM_WRITE
);
7728 perm
= verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
);
7736 void RGWRMAttrs::pre_exec()
7738 rgw_bucket_object_pre_exec(s
);
7741 void RGWRMAttrs::execute(optional_yield y
)
7743 op_ret
= get_params();
7747 s
->object
->set_atomic(s
->obj_ctx
);
7749 op_ret
= s
->object
->set_obj_attrs(this, s
->obj_ctx
, nullptr, &attrs
, y
);
7751 ldpp_dout(this, 0) << "ERROR: failed to delete obj attrs, obj=" << s
->object
7752 << " ret=" << op_ret
<< dendl
;
7757 int RGWSetAttrs::verify_permission(optional_yield y
)
7759 // This looks to be part of the RGW-NFS machinery and has no S3 or
7760 // Swift equivalent.
7762 if (!rgw::sal::Object::empty(s
->object
.get())) {
7763 perm
= verify_object_permission_no_policy(this, s
, RGW_PERM_WRITE
);
7765 perm
= verify_bucket_permission_no_policy(this, s
, RGW_PERM_WRITE
);
7773 void RGWSetAttrs::pre_exec()
7775 rgw_bucket_object_pre_exec(s
);
7778 void RGWSetAttrs::execute(optional_yield y
)
7780 op_ret
= get_params(y
);
7784 if (!rgw::sal::Object::empty(s
->object
.get())) {
7785 rgw::sal::Attrs
a(attrs
);
7786 op_ret
= s
->object
->set_obj_attrs(this, s
->obj_ctx
, &a
, nullptr, y
);
7788 op_ret
= s
->bucket
->merge_and_store_attrs(this, attrs
, y
);
7791 } /* RGWSetAttrs::execute() */
7793 void RGWGetObjLayout::pre_exec()
7795 rgw_bucket_object_pre_exec(s
);
7798 void RGWGetObjLayout::execute(optional_yield y
)
7803 int RGWConfigBucketMetaSearch::verify_permission(optional_yield y
)
7805 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
7812 void RGWConfigBucketMetaSearch::pre_exec()
7814 rgw_bucket_object_pre_exec(s
);
7817 void RGWConfigBucketMetaSearch::execute(optional_yield y
)
7819 op_ret
= get_params(y
);
7821 ldpp_dout(this, 20) << "NOTICE: get_params() returned ret=" << op_ret
<< dendl
;
7825 s
->bucket
->get_info().mdsearch_config
= mdsearch_config
;
7827 op_ret
= s
->bucket
->put_info(this, false, real_time());
7829 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
->get_name()
7830 << " returned err=" << op_ret
<< dendl
;
7833 s
->bucket_attrs
= s
->bucket
->get_attrs();
7836 int RGWGetBucketMetaSearch::verify_permission(optional_yield y
)
7838 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
7845 void RGWGetBucketMetaSearch::pre_exec()
7847 rgw_bucket_object_pre_exec(s
);
7850 int RGWDelBucketMetaSearch::verify_permission(optional_yield y
)
7852 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
7859 void RGWDelBucketMetaSearch::pre_exec()
7861 rgw_bucket_object_pre_exec(s
);
7864 void RGWDelBucketMetaSearch::execute(optional_yield y
)
7866 s
->bucket
->get_info().mdsearch_config
.clear();
7868 op_ret
= s
->bucket
->put_info(this, false, real_time());
7870 ldpp_dout(this, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
->get_name()
7871 << " returned err=" << op_ret
<< dendl
;
7874 s
->bucket_attrs
= s
->bucket
->get_attrs();
7878 RGWHandler::~RGWHandler()
7882 int RGWHandler::init(rgw::sal::Store
* _store
,
7883 struct req_state
*_s
,
7884 rgw::io::BasicClient
*cio
)
7892 int RGWHandler::do_init_permissions(const DoutPrefixProvider
*dpp
, optional_yield y
)
7894 int ret
= rgw_build_bucket_policies(dpp
, store
, s
, y
);
7896 ldpp_dout(dpp
, 10) << "init_permissions on " << s
->bucket
7897 << " failed, ret=" << ret
<< dendl
;
7898 return ret
==-ENODATA
? -EACCES
: ret
;
7901 rgw_build_iam_environment(store
, s
);
7905 int RGWHandler::do_read_permissions(RGWOp
*op
, bool only_bucket
, optional_yield y
)
7908 /* already read bucket info */
7911 int ret
= rgw_build_object_policies(op
, store
, s
, op
->prefetch_data(), y
);
7914 ldpp_dout(op
, 10) << "read_permissions on " << s
->bucket
<< ":"
7915 << s
->object
<< " only_bucket=" << only_bucket
7916 << " ret=" << ret
<< dendl
;
7917 if (ret
== -ENODATA
)
7919 if (s
->auth
.identity
->is_anonymous() && ret
== -EACCES
)
7926 int RGWOp::error_handler(int err_no
, string
*error_content
, optional_yield y
) {
7927 return dialect_handler
->error_handler(err_no
, error_content
, y
);
7930 int RGWHandler::error_handler(int err_no
, string
*error_content
, optional_yield
) {
7931 // This is the do-nothing error handler
7935 std::ostream
& RGWOp::gen_prefix(std::ostream
& out
) const
7937 // append <dialect>:<op name> to the prefix
7938 return s
->gen_prefix(out
) << s
->dialect
<< ':' << name() << ' ';
7941 void RGWDefaultResponseOp::send_response() {
7943 set_req_state_err(s
, op_ret
);
7949 void RGWPutBucketPolicy::send_response()
7952 /* A successful Put Bucket Policy should return a 204 on success */
7953 op_ret
= STATUS_NO_CONTENT
;
7956 set_req_state_err(s
, op_ret
);
7962 int RGWPutBucketPolicy::verify_permission(optional_yield y
)
7964 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
7965 if (has_s3_resource_tag
)
7966 rgw_iam_add_buckettags(this, s
);
7968 if (!verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketPolicy
)) {
7975 int RGWPutBucketPolicy::get_params(optional_yield y
)
7977 const auto max_size
= s
->cct
->_conf
->rgw_max_put_param_size
;
7978 // At some point when I have more time I want to make a version of
7979 // rgw_rest_read_all_input that doesn't use malloc.
7980 std::tie(op_ret
, data
) = read_all_input(s
, max_size
, false);
7982 // And throws exceptions.
7986 void RGWPutBucketPolicy::execute(optional_yield y
)
7988 op_ret
= get_params(y
);
7993 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
7995 ldpp_dout(this, 20) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
8000 const Policy
p(s
->cct
, s
->bucket_tenant
, data
);
8001 rgw::sal::Attrs
attrs(s
->bucket_attrs
);
8002 if (s
->bucket_access_conf
&&
8003 s
->bucket_access_conf
->block_public_policy() &&
8004 rgw::IAM::is_public(p
)) {
8009 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [&p
, this, &attrs
] {
8010 attrs
[RGW_ATTR_IAM_POLICY
].clear();
8011 attrs
[RGW_ATTR_IAM_POLICY
].append(p
.text
);
8012 op_ret
= s
->bucket
->merge_and_store_attrs(this, attrs
, s
->yield
);
8015 } catch (rgw::IAM::PolicyParseException
& e
) {
8016 ldpp_dout(this, 20) << "failed to parse policy: " << e
.what() << dendl
;
8021 void RGWGetBucketPolicy::send_response()
8024 set_req_state_err(s
, op_ret
);
8027 end_header(s
, this, "application/json");
8028 dump_body(s
, policy
);
8031 int RGWGetBucketPolicy::verify_permission(optional_yield y
)
8033 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
8034 if (has_s3_resource_tag
)
8035 rgw_iam_add_buckettags(this, s
);
8037 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketPolicy
)) {
8044 void RGWGetBucketPolicy::execute(optional_yield y
)
8046 rgw::sal::Attrs
attrs(s
->bucket_attrs
);
8047 auto aiter
= attrs
.find(RGW_ATTR_IAM_POLICY
);
8048 if (aiter
== attrs
.end()) {
8049 ldpp_dout(this, 0) << "can't find bucket IAM POLICY attr bucket_name = "
8050 << s
->bucket_name
<< dendl
;
8051 op_ret
= -ERR_NO_SUCH_BUCKET_POLICY
;
8052 s
->err
.message
= "The bucket policy does not exist";
8055 policy
= attrs
[RGW_ATTR_IAM_POLICY
];
8057 if (policy
.length() == 0) {
8058 ldpp_dout(this, 10) << "The bucket policy does not exist, bucket: "
8059 << s
->bucket_name
<< dendl
;
8060 op_ret
= -ERR_NO_SUCH_BUCKET_POLICY
;
8061 s
->err
.message
= "The bucket policy does not exist";
8067 void RGWDeleteBucketPolicy::send_response()
8070 set_req_state_err(s
, op_ret
);
8076 int RGWDeleteBucketPolicy::verify_permission(optional_yield y
)
8078 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
8079 if (has_s3_resource_tag
)
8080 rgw_iam_add_buckettags(this, s
);
8082 if (!verify_bucket_permission(this, s
, rgw::IAM::s3DeleteBucketPolicy
)) {
8089 void RGWDeleteBucketPolicy::execute(optional_yield y
)
8092 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
8094 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
8098 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
8099 rgw::sal::Attrs
attrs(s
->bucket_attrs
);
8100 attrs
.erase(RGW_ATTR_IAM_POLICY
);
8101 op_ret
= s
->bucket
->merge_and_store_attrs(this, attrs
, s
->yield
);
8106 void RGWPutBucketObjectLock::pre_exec()
8108 rgw_bucket_object_pre_exec(s
);
8111 int RGWPutBucketObjectLock::verify_permission(optional_yield y
)
8113 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
8114 if (has_s3_resource_tag
)
8115 rgw_iam_add_buckettags(this, s
);
8117 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3PutBucketObjectLockConfiguration
);
8120 void RGWPutBucketObjectLock::execute(optional_yield y
)
8122 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8123 s
->err
.message
= "object lock configuration can't be set if bucket object lock not enabled";
8124 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8125 op_ret
= -ERR_INVALID_BUCKET_STATE
;
8129 RGWXMLDecoder::XMLParser parser
;
8130 if (!parser
.init()) {
8131 ldpp_dout(this, 0) << "ERROR: failed to initialize parser" << dendl
;
8135 op_ret
= get_params(y
);
8139 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
8140 op_ret
= -ERR_MALFORMED_XML
;
8145 RGWXMLDecoder::decode_xml("ObjectLockConfiguration", obj_lock
, &parser
, true);
8146 } catch (RGWXMLDecoder::err
& err
) {
8147 ldpp_dout(this, 5) << "unexpected xml:" << err
<< dendl
;
8148 op_ret
= -ERR_MALFORMED_XML
;
8151 if (obj_lock
.has_rule() && !obj_lock
.retention_period_valid()) {
8152 s
->err
.message
= "retention period must be a positive integer value";
8153 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8154 op_ret
= -ERR_INVALID_RETENTION_PERIOD
;
8158 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
8160 ldpp_dout(this, 20) << __func__
<< "forward_request_to_master returned ret=" << op_ret
<< dendl
;
8164 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
8165 s
->bucket
->get_info().obj_lock
= obj_lock
;
8166 op_ret
= s
->bucket
->put_info(this, false, real_time());
8172 void RGWGetBucketObjectLock::pre_exec()
8174 rgw_bucket_object_pre_exec(s
);
8177 int RGWGetBucketObjectLock::verify_permission(optional_yield y
)
8179 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
8180 if (has_s3_resource_tag
)
8181 rgw_iam_add_buckettags(this, s
);
8183 return verify_bucket_owner_or_policy(s
, rgw::IAM::s3GetBucketObjectLockConfiguration
);
8186 void RGWGetBucketObjectLock::execute(optional_yield y
)
8188 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8189 op_ret
= -ERR_NO_SUCH_OBJECT_LOCK_CONFIGURATION
;
8194 int RGWPutObjRetention::verify_permission(optional_yield y
)
8196 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
8197 if (has_s3_existing_tag
|| has_s3_resource_tag
)
8198 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
8200 if (!verify_object_permission(this, s
, rgw::IAM::s3PutObjectRetention
)) {
8203 op_ret
= get_params(y
);
8207 if (bypass_governance_mode
) {
8208 bypass_perm
= verify_object_permission(this, s
, rgw::IAM::s3BypassGovernanceRetention
);
8213 void RGWPutObjRetention::pre_exec()
8215 rgw_bucket_object_pre_exec(s
);
8218 void RGWPutObjRetention::execute(optional_yield y
)
8220 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8221 s
->err
.message
= "object retention can't be set if bucket object lock not configured";
8222 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8223 op_ret
= -ERR_INVALID_REQUEST
;
8227 RGWXMLDecoder::XMLParser parser
;
8228 if (!parser
.init()) {
8229 ldpp_dout(this, 0) << "ERROR: failed to initialize parser" << dendl
;
8234 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
8235 op_ret
= -ERR_MALFORMED_XML
;
8240 RGWXMLDecoder::decode_xml("Retention", obj_retention
, &parser
, true);
8241 } catch (RGWXMLDecoder::err
& err
) {
8242 ldpp_dout(this, 5) << "unexpected xml:" << err
<< dendl
;
8243 op_ret
= -ERR_MALFORMED_XML
;
8247 if (ceph::real_clock::to_time_t(obj_retention
.get_retain_until_date()) < ceph_clock_now()) {
8248 s
->err
.message
= "the retain-until date must be in the future";
8249 ldpp_dout(this, 0) << "ERROR: " << s
->err
.message
<< dendl
;
8254 obj_retention
.encode(bl
);
8256 //check old retention
8257 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, this);
8259 ldpp_dout(this, 0) << "ERROR: get obj attr error"<< dendl
;
8262 rgw::sal::Attrs attrs
= s
->object
->get_attrs();
8263 auto aiter
= attrs
.find(RGW_ATTR_OBJECT_RETENTION
);
8264 if (aiter
!= attrs
.end()) {
8265 RGWObjectRetention old_obj_retention
;
8267 decode(old_obj_retention
, aiter
->second
);
8268 } catch (buffer::error
& err
) {
8269 ldpp_dout(this, 0) << "ERROR: failed to decode RGWObjectRetention" << dendl
;
8273 if (ceph::real_clock::to_time_t(obj_retention
.get_retain_until_date()) < ceph::real_clock::to_time_t(old_obj_retention
.get_retain_until_date())) {
8274 if (old_obj_retention
.get_mode().compare("GOVERNANCE") != 0 || !bypass_perm
|| !bypass_governance_mode
) {
8275 s
->err
.message
= "proposed retain-until date shortens an existing retention period and governance bypass check failed";
8279 } else if (old_obj_retention
.get_mode() == obj_retention
.get_mode()) {
8280 // ok if retention mode doesn't change
8281 } else if (obj_retention
.get_mode() == "GOVERNANCE") {
8282 s
->err
.message
= "can't change retention mode from COMPLIANCE to GOVERNANCE";
8285 } else if (!bypass_perm
|| !bypass_governance_mode
) {
8286 s
->err
.message
= "can't change retention mode from GOVERNANCE without governance bypass";
8292 op_ret
= s
->object
->modify_obj_attrs(s
->obj_ctx
, RGW_ATTR_OBJECT_RETENTION
, bl
, s
->yield
, this);
8297 int RGWGetObjRetention::verify_permission(optional_yield y
)
8299 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
8300 if (has_s3_existing_tag
|| has_s3_resource_tag
)
8301 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
8303 if (!verify_object_permission(this, s
, rgw::IAM::s3GetObjectRetention
)) {
8309 void RGWGetObjRetention::pre_exec()
8311 rgw_bucket_object_pre_exec(s
);
8314 void RGWGetObjRetention::execute(optional_yield y
)
8316 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8317 s
->err
.message
= "bucket object lock not configured";
8318 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8319 op_ret
= -ERR_INVALID_REQUEST
;
8322 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, this);
8324 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << s
->object
8325 << " ret=" << op_ret
<< dendl
;
8328 rgw::sal::Attrs attrs
= s
->object
->get_attrs();
8329 auto aiter
= attrs
.find(RGW_ATTR_OBJECT_RETENTION
);
8330 if (aiter
== attrs
.end()) {
8331 op_ret
= -ERR_NO_SUCH_OBJECT_LOCK_CONFIGURATION
;
8335 bufferlist::const_iterator iter
{&aiter
->second
};
8337 obj_retention
.decode(iter
);
8338 } catch (const buffer::error
& e
) {
8339 ldpp_dout(this, 0) << __func__
<< "decode object retention config failed" << dendl
;
8346 int RGWPutObjLegalHold::verify_permission(optional_yield y
)
8348 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
8349 if (has_s3_existing_tag
|| has_s3_resource_tag
)
8350 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
8352 if (!verify_object_permission(this, s
, rgw::IAM::s3PutObjectLegalHold
)) {
8358 void RGWPutObjLegalHold::pre_exec()
8360 rgw_bucket_object_pre_exec(s
);
8363 void RGWPutObjLegalHold::execute(optional_yield y
) {
8364 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8365 s
->err
.message
= "object legal hold can't be set if bucket object lock not enabled";
8366 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8367 op_ret
= -ERR_INVALID_REQUEST
;
8371 RGWXMLDecoder::XMLParser parser
;
8372 if (!parser
.init()) {
8373 ldpp_dout(this, 0) << "ERROR: failed to initialize parser" << dendl
;
8378 op_ret
= get_params(y
);
8382 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
8383 op_ret
= -ERR_MALFORMED_XML
;
8388 RGWXMLDecoder::decode_xml("LegalHold", obj_legal_hold
, &parser
, true);
8389 } catch (RGWXMLDecoder::err
&err
) {
8390 ldpp_dout(this, 5) << "unexpected xml:" << err
<< dendl
;
8391 op_ret
= -ERR_MALFORMED_XML
;
8395 obj_legal_hold
.encode(bl
);
8396 //if instance is empty, we should modify the latest object
8397 op_ret
= s
->object
->modify_obj_attrs(s
->obj_ctx
, RGW_ATTR_OBJECT_LEGAL_HOLD
, bl
, s
->yield
, this);
8401 int RGWGetObjLegalHold::verify_permission(optional_yield y
)
8403 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
);
8404 if (has_s3_existing_tag
|| has_s3_resource_tag
)
8405 rgw_iam_add_objtags(this, s
, has_s3_existing_tag
, has_s3_resource_tag
);
8407 if (!verify_object_permission(this, s
, rgw::IAM::s3GetObjectLegalHold
)) {
8413 void RGWGetObjLegalHold::pre_exec()
8415 rgw_bucket_object_pre_exec(s
);
8418 void RGWGetObjLegalHold::execute(optional_yield y
)
8420 if (!s
->bucket
->get_info().obj_lock_enabled()) {
8421 s
->err
.message
= "bucket object lock not configured";
8422 ldpp_dout(this, 4) << "ERROR: " << s
->err
.message
<< dendl
;
8423 op_ret
= -ERR_INVALID_REQUEST
;
8426 map
<string
, bufferlist
> attrs
;
8427 op_ret
= s
->object
->get_obj_attrs(s
->obj_ctx
, s
->yield
, this);
8429 ldpp_dout(this, 0) << "ERROR: failed to get obj attrs, obj=" << s
->object
8430 << " ret=" << op_ret
<< dendl
;
8433 auto aiter
= s
->object
->get_attrs().find(RGW_ATTR_OBJECT_LEGAL_HOLD
);
8434 if (aiter
== s
->object
->get_attrs().end()) {
8435 op_ret
= -ERR_NO_SUCH_OBJECT_LOCK_CONFIGURATION
;
8439 bufferlist::const_iterator iter
{&aiter
->second
};
8441 obj_legal_hold
.decode(iter
);
8442 } catch (const buffer::error
& e
) {
8443 ldpp_dout(this, 0) << __func__
<< "decode object legal hold config failed" << dendl
;
8450 void RGWGetClusterStat::execute(optional_yield y
)
8452 op_ret
= store
->cluster_stat(stats_op
);
8455 int RGWGetBucketPolicyStatus::verify_permission(optional_yield y
)
8457 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
8458 if (has_s3_resource_tag
)
8459 rgw_iam_add_buckettags(this, s
);
8461 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketPolicyStatus
)) {
8468 void RGWGetBucketPolicyStatus::execute(optional_yield y
)
8470 isPublic
= (s
->iam_policy
&& rgw::IAM::is_public(*s
->iam_policy
)) || s
->bucket_acl
->is_public(this);
8473 int RGWPutBucketPublicAccessBlock::verify_permission(optional_yield y
)
8475 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
8476 if (has_s3_resource_tag
)
8477 rgw_iam_add_buckettags(this, s
);
8479 if (!verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketPublicAccessBlock
)) {
8486 int RGWPutBucketPublicAccessBlock::get_params(optional_yield y
)
8488 const auto max_size
= s
->cct
->_conf
->rgw_max_put_param_size
;
8489 std::tie(op_ret
, data
) = read_all_input(s
, max_size
, false);
8493 void RGWPutBucketPublicAccessBlock::execute(optional_yield y
)
8495 RGWXMLDecoder::XMLParser parser
;
8496 if (!parser
.init()) {
8497 ldpp_dout(this, 0) << "ERROR: failed to initialize parser" << dendl
;
8502 op_ret
= get_params(y
);
8506 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
8507 ldpp_dout(this, 0) << "ERROR: malformed XML" << dendl
;
8508 op_ret
= -ERR_MALFORMED_XML
;
8513 RGWXMLDecoder::decode_xml("PublicAccessBlockConfiguration", access_conf
, &parser
, true);
8514 } catch (RGWXMLDecoder::err
&err
) {
8515 ldpp_dout(this, 5) << "unexpected xml:" << err
<< dendl
;
8516 op_ret
= -ERR_MALFORMED_XML
;
8520 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
8522 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
8527 access_conf
.encode(bl
);
8528 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this, &bl
] {
8529 rgw::sal::Attrs
attrs(s
->bucket_attrs
);
8530 attrs
[RGW_ATTR_PUBLIC_ACCESS
] = bl
;
8531 return s
->bucket
->merge_and_store_attrs(this, attrs
, s
->yield
);
8536 int RGWGetBucketPublicAccessBlock::verify_permission(optional_yield y
)
8538 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
8539 if (has_s3_resource_tag
)
8540 rgw_iam_add_buckettags(this, s
);
8542 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketPolicy
)) {
8549 void RGWGetBucketPublicAccessBlock::execute(optional_yield y
)
8551 auto attrs
= s
->bucket_attrs
;
8552 if (auto aiter
= attrs
.find(RGW_ATTR_PUBLIC_ACCESS
);
8553 aiter
== attrs
.end()) {
8554 ldpp_dout(this, 0) << "can't find bucket IAM POLICY attr bucket_name = "
8555 << s
->bucket_name
<< dendl
;
8556 // return the default;
8559 bufferlist::const_iterator iter
{&aiter
->second
};
8561 access_conf
.decode(iter
);
8562 } catch (const buffer::error
& e
) {
8563 ldpp_dout(this, 0) << __func__
<< "decode access_conf failed" << dendl
;
8571 void RGWDeleteBucketPublicAccessBlock::send_response()
8574 set_req_state_err(s
, op_ret
);
8580 int RGWDeleteBucketPublicAccessBlock::verify_permission(optional_yield y
)
8582 auto [has_s3_existing_tag
, has_s3_resource_tag
] = rgw_check_policy_condition(this, s
, false);
8583 if (has_s3_resource_tag
)
8584 rgw_iam_add_buckettags(this, s
);
8586 if (!verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketPublicAccessBlock
)) {
8593 void RGWDeleteBucketPublicAccessBlock::execute(optional_yield y
)
8596 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
8598 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
8602 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this] {
8603 rgw::sal::Attrs
attrs(s
->bucket_attrs
);
8604 attrs
.erase(RGW_ATTR_PUBLIC_ACCESS
);
8605 op_ret
= s
->bucket
->merge_and_store_attrs(this, attrs
, s
->yield
);
8610 int RGWPutBucketEncryption::get_params(optional_yield y
)
8612 const auto max_size
= s
->cct
->_conf
->rgw_max_put_param_size
;
8613 std::tie(op_ret
, data
) = read_all_input(s
, max_size
, false);
8617 int RGWPutBucketEncryption::verify_permission(optional_yield y
)
8619 if (!verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketEncryption
)) {
8625 void RGWPutBucketEncryption::execute(optional_yield y
)
8627 RGWXMLDecoder::XMLParser parser
;
8628 if (!parser
.init()) {
8629 ldpp_dout(this, 0) << "ERROR: failed to initialize parser" << dendl
;
8633 op_ret
= get_params(y
);
8637 if (!parser
.parse(data
.c_str(), data
.length(), 1)) {
8638 ldpp_dout(this, 0) << "ERROR: malformed XML" << dendl
;
8639 op_ret
= -ERR_MALFORMED_XML
;
8644 RGWXMLDecoder::decode_xml("ServerSideEncryptionConfiguration", bucket_encryption_conf
, &parser
, true);
8645 } catch (RGWXMLDecoder::err
& err
) {
8646 ldpp_dout(this, 5) << "unexpected xml:" << err
<< dendl
;
8647 op_ret
= -ERR_MALFORMED_XML
;
8651 if(bucket_encryption_conf
.kms_master_key_id().compare("") != 0) {
8652 ldpp_dout(this, 5) << "encryption not supported with sse-kms" << dendl
;
8653 op_ret
= -ERR_NOT_IMPLEMENTED
;
8654 s
->err
.message
= "SSE-KMS support is not provided";
8658 if(bucket_encryption_conf
.sse_algorithm().compare("AES256") != 0) {
8659 ldpp_dout(this, 5) << "only aes256 algorithm is supported for encryption" << dendl
;
8660 op_ret
= -ERR_NOT_IMPLEMENTED
;
8661 s
->err
.message
= "Encryption is supported only with AES256 algorithm";
8665 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
8667 ldpp_dout(this, 20) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
8671 bufferlist key_id_bl
;
8672 string bucket_owner_id
= s
->bucket
->get_info().owner
.id
;
8673 key_id_bl
.append(bucket_owner_id
.c_str(), bucket_owner_id
.size() + 1);
8676 bucket_encryption_conf
.encode(conf_bl
);
8677 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this, y
, &conf_bl
, &key_id_bl
] {
8678 rgw::sal::Attrs attrs
= s
->bucket
->get_attrs();
8679 attrs
[RGW_ATTR_BUCKET_ENCRYPTION_POLICY
] = conf_bl
;
8680 attrs
[RGW_ATTR_BUCKET_ENCRYPTION_KEY_ID
] = key_id_bl
;
8681 return s
->bucket
->merge_and_store_attrs(this, attrs
, y
);
8685 int RGWGetBucketEncryption::verify_permission(optional_yield y
)
8687 if (!verify_bucket_permission(this, s
, rgw::IAM::s3GetBucketEncryption
)) {
8693 void RGWGetBucketEncryption::execute(optional_yield y
)
8695 const auto& attrs
= s
->bucket_attrs
;
8696 if (auto aiter
= attrs
.find(RGW_ATTR_BUCKET_ENCRYPTION_POLICY
);
8697 aiter
== attrs
.end()) {
8698 ldpp_dout(this, 0) << "can't find BUCKET ENCRYPTION attr for bucket_name = " << s
->bucket_name
<< dendl
;
8700 s
->err
.message
= "The server side encryption configuration was not found";
8703 bufferlist::const_iterator iter
{&aiter
->second
};
8705 bucket_encryption_conf
.decode(iter
);
8706 } catch (const buffer::error
& e
) {
8707 ldpp_dout(this, 0) << __func__
<< "decode bucket_encryption_conf failed" << dendl
;
8714 int RGWDeleteBucketEncryption::verify_permission(optional_yield y
)
8716 if (!verify_bucket_permission(this, s
, rgw::IAM::s3PutBucketEncryption
)) {
8722 void RGWDeleteBucketEncryption::execute(optional_yield y
)
8725 op_ret
= store
->forward_request_to_master(this, s
->user
.get(), nullptr, data
, nullptr, s
->info
, y
);
8727 ldpp_dout(this, 0) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
8731 op_ret
= retry_raced_bucket_write(this, s
->bucket
.get(), [this, y
] {
8732 rgw::sal::Attrs attrs
= s
->bucket
->get_attrs();
8733 attrs
.erase(RGW_ATTR_BUCKET_ENCRYPTION_POLICY
);
8734 attrs
.erase(RGW_ATTR_BUCKET_ENCRYPTION_KEY_ID
);
8735 op_ret
= s
->bucket
->merge_and_store_attrs(this, attrs
, y
);
8740 void rgw_slo_entry::decode_json(JSONObj
*obj
)
8742 JSONDecoder::decode_json("path", path
, obj
);
8743 JSONDecoder::decode_json("etag", etag
, obj
);
8744 JSONDecoder::decode_json("size_bytes", size_bytes
, obj
);