ceph/src/rgw/rgw_swift_auth.cc

   1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
   2 // vim: ts=8 sw=2 smarttab
   3
   4 #include <array>
   5
   6 #include <boost/utility/string_view.hpp>
   7 #include <boost/container/static_vector.hpp>
   8 #include <boost/algorithm/string/predicate.hpp>
   9 #include <boost/algorithm/string.hpp>
  10
  11 #include "rgw_swift_auth.h"
  12 #include "rgw_rest.h"
  13
  14 #include "common/ceph_crypto.h"
  15 #include "common/Clock.h"
  16
  17 #include "include/random.h"
  18
  19 #include "rgw_client_io.h"
  20 #include "rgw_http_client.h"
  21 #include "include/str_list.h"
  22
  23 #define dout_context g_ceph_context
  24 #define dout_subsys ceph_subsys_rgw
  25
  26 #define DEFAULT_SWIFT_PREFIX "/swift"
  27
  28 using namespace ceph::crypto;
  29
  30
  31 namespace rgw {
  32 namespace auth {
  33 namespace swift {
  34
  35 /* TempURL: applier */
  36 void TempURLApplier::modify_request_state(const DoutPrefixProvider* dpp, req_state* s) const       /* in/out */
  37 {
  38   bool inline_exists = false;
  39   const std::string& filename = s->info.args.get("filename");
  40
  41   s->info.args.get("inline", &inline_exists);
  42   if (inline_exists) {
  43     s->content_disp.override = "inline";
  44   } else if (!filename.empty()) {
  45     std::string fenc;
  46     url_encode(filename, fenc);
  47     s->content_disp.override = "attachment; filename=\"" + fenc + "\"";
  48   } else {
  49     std::string fenc;
  50     url_encode(s->object.name, fenc);
  51     s->content_disp.fallback = "attachment; filename=\"" + fenc + "\"";
  52   }
  53
  54   ldpp_dout(dpp, 20) << "finished applying changes to req_state for TempURL: "
  55                     << " content_disp override " << s->content_disp.override
  56                     << " content_disp fallback " << s->content_disp.fallback
  57                     << dendl;
  58
  59 }
  60
  61 /* TempURL: engine */
  62 bool TempURLEngine::is_applicable(const req_state* const s) const noexcept
  63 {
  64   return s->info.args.exists("temp_url_sig") ||
  65          s->info.args.exists("temp_url_expires");
  66 }
  67
  68 void TempURLEngine::get_owner_info(const DoutPrefixProvider* dpp, const req_state* const s,
  69                                    RGWUserInfo& owner_info) const
  70 {
  71   /* We cannot use req_state::bucket_name because it isn't available
  72    * now. It will be initialized in RGWHandler_REST_SWIFT::postauth_init(). */
  73   const string& bucket_name = s->init_state.url_bucket;
  74
  75   /* TempURL requires that bucket and object names are specified. */
  76   if (bucket_name.empty() || s->object.empty()) {
  77     throw -EPERM;
  78   }
  79
  80   /* TempURL case is completely different than the Keystone auth - you may
  81    * get account name only through extraction from URL. In turn, knowledge
  82    * about account is neccessary to obtain its bucket tenant. Without that,
  83    * the access would be limited to accounts with empty tenant. */
  84   string bucket_tenant;
  85   if (!s->account_name.empty()) {
  86     RGWUserInfo uinfo;
  87     bool found = false;
  88
  89     const rgw_user uid(s->account_name);
  90     if (uid.tenant.empty()) {
  91       const rgw_user tenanted_uid(uid.id, uid.id);
  92
  93       if (rgw_get_user_info_by_uid(store, tenanted_uid, uinfo) >= 0) {
  94         /* Succeeded. */
  95         bucket_tenant = uinfo.user_id.tenant;
  96         found = true;
  97       }
  98     }
  99
 100     if (!found && rgw_get_user_info_by_uid(store, uid, uinfo) < 0) {
 101       throw -EPERM;
 102     } else {
 103       bucket_tenant = uinfo.user_id.tenant;
 104     }
 105   }
 106
 107   /* Need to get user info of bucket owner. */
 108   RGWBucketInfo bucket_info;
 109   int ret = store->get_bucket_info(*s->sysobj_ctx,
 110                                    bucket_tenant, bucket_name,
 111                                    bucket_info, nullptr);
 112   if (ret < 0) {
 113     throw ret;
 114   }
 115
 116   ldpp_dout(dpp, 20) << "temp url user (bucket owner): " << bucket_info.owner
 117                  << dendl;
 118
 119   if (rgw_get_user_info_by_uid(store, bucket_info.owner, owner_info) < 0) {
 120     throw -EPERM;
 121   }
 122 }
 123
 124 std::string TempURLEngine::convert_from_iso8601(std::string expires) const
 125 {
 126   /* Swift's TempURL allows clients to send the expiration as ISO8601-
 127    * compatible strings. Though, only plain UNIX timestamp are taken
 128    * for the HMAC calculations. We need to make the conversion. */
 129   struct tm date_t;
 130   if (!parse_iso8601(expires.c_str(), &date_t, nullptr, true)) {
 131     return std::move(expires);
 132   } else {
 133     return std::to_string(internal_timegm(&date_t));
 134   }
 135 }
 136
 137 bool TempURLEngine::is_expired(const std::string& expires) const
 138 {
 139   string err;
 140   const utime_t now = ceph_clock_now();
 141   const uint64_t expiration = (uint64_t)strict_strtoll(expires.c_str(),
 142                                                        10, &err);
 143   if (!err.empty()) {
 144     dout(5) << "failed to parse temp_url_expires: " << err << dendl;
 145     return true;
 146   }
 147
 148   if (expiration <= (uint64_t)now.sec()) {
 149     dout(5) << "temp url expired: " << expiration << " <= " << now.sec() << dendl;
 150     return true;
 151   }
 152
 153   return false;
 154 }
 155
 156 std::string extract_swift_subuser(const std::string& swift_user_name) {
 157   size_t pos = swift_user_name.find(':');
 158   if (std::string::npos == pos) {
 159     return swift_user_name;
 160   } else {
 161     return swift_user_name.substr(pos + 1);
 162   }
 163 }
 164
 165 class TempURLEngine::SignatureHelper
 166 {
 167 private:
 168   static constexpr uint32_t output_size =
 169     CEPH_CRYPTO_HMACSHA1_DIGESTSIZE * 2 + 1;
 170
 171   unsigned char dest[CEPH_CRYPTO_HMACSHA1_DIGESTSIZE]; // 20
 172   char dest_str[output_size];
 173
 174 public:
 175   SignatureHelper() = default;
 176
 177   const char* calc(const std::string& key,
 178                    const boost::string_view& method,
 179                    const boost::string_view& path,
 180                    const std::string& expires) {
 181
 182     using ceph::crypto::HMACSHA1;
 183     using UCHARPTR = const unsigned char*;
 184
 185     HMACSHA1 hmac((UCHARPTR) key.c_str(), key.size());
 186     hmac.Update((UCHARPTR) method.data(), method.size());
 187     hmac.Update((UCHARPTR) "\n", 1);
 188     hmac.Update((UCHARPTR) expires.c_str(), expires.size());
 189     hmac.Update((UCHARPTR) "\n", 1);
 190     hmac.Update((UCHARPTR) path.data(), path.size());
 191     hmac.Final(dest);
 192
 193     buf_to_hex((UCHARPTR) dest, sizeof(dest), dest_str);
 194
 195     return dest_str;
 196   }
 197
 198   bool is_equal_to(const std::string& rhs) const {
 199     /* never allow out-of-range exception */
 200     if (rhs.size() < (output_size - 1)) {
 201       return false;
 202     }
 203     return rhs.compare(0 /* pos */,  output_size, dest_str) == 0;
 204   }
 205
 206 }; /* TempURLEngine::SignatureHelper */
 207
 208 class TempURLEngine::PrefixableSignatureHelper
 209     : private TempURLEngine::SignatureHelper {
 210   using base_t = SignatureHelper;
 211
 212   const boost::string_view decoded_uri;
 213   const boost::string_view object_name;
 214   boost::string_view no_obj_uri;
 215
 216   const boost::optional<const std::string&> prefix;
 217
 218 public:
 219   PrefixableSignatureHelper(const std::string& _decoded_uri,
 220                             const std::string& object_name,
 221                             const boost::optional<const std::string&> prefix)
 222     : decoded_uri(_decoded_uri),
 223       object_name(object_name),
 224       prefix(prefix) {
 225     /* Transform: v1/acct/cont/obj - > v1/acct/cont/
 226      *
 227      * NOTE(rzarzynski): we really want to substr() on boost::string_view,
 228      * not std::string. Otherwise we would end with no_obj_uri referencing
 229      * a temporary. */
 230     no_obj_uri = \
 231       decoded_uri.substr(0, decoded_uri.length() - object_name.length());
 232   }
 233
 234   const char* calc(const std::string& key,
 235                    const boost::string_view& method,
 236                    const boost::string_view& path,
 237                    const std::string& expires) {
 238     if (!prefix) {
 239       return base_t::calc(key, method, path, expires);
 240     } else {
 241       const auto prefixed_path = \
 242         string_cat_reserve("prefix:", no_obj_uri, *prefix);
 243       return base_t::calc(key, method, prefixed_path, expires);
 244     }
 245   }
 246
 247   bool is_equal_to(const std::string& rhs) const {
 248     bool is_auth_ok = base_t::is_equal_to(rhs);
 249
 250     if (prefix && is_auth_ok) {
 251       const auto prefix_uri = string_cat_reserve(no_obj_uri, *prefix);
 252       is_auth_ok = boost::algorithm::starts_with(decoded_uri, prefix_uri);
 253     }
 254
 255     return is_auth_ok;
 256   }
 257 }; /* TempURLEngine::PrefixableSignatureHelper */
 258
 259 TempURLEngine::result_t
 260 TempURLEngine::authenticate(const DoutPrefixProvider* dpp, const req_state* const s) const
 261 {
 262   if (! is_applicable(s)) {
 263     return result_t::deny();
 264   }
 265
 266   /* NOTE(rzarzynski): RGWHTTPArgs::get(), in contrast to RGWEnv::get(),
 267    * never returns nullptr. If the requested parameter is absent, we will
 268    * get the empty string. */
 269   const std::string& temp_url_sig = s->info.args.get("temp_url_sig");
 270   const std::string& temp_url_expires = \
 271     convert_from_iso8601(s->info.args.get("temp_url_expires"));
 272
 273   if (temp_url_sig.empty() || temp_url_expires.empty()) {
 274     return result_t::deny();
 275   }
 276
 277   /* Though, for prefixed tempurls we need to differentiate between empty
 278    * prefix and lack of prefix. Empty prefix means allowance for whole
 279    * container. */
 280   const boost::optional<const std::string&> temp_url_prefix = \
 281     s->info.args.get_optional("temp_url_prefix");
 282
 283   RGWUserInfo owner_info;
 284   try {
 285     get_owner_info(dpp, s, owner_info);
 286   } catch (...) {
 287     ldpp_dout(dpp, 5) << "cannot get user_info of account's owner" << dendl;
 288     return result_t::reject();
 289   }
 290
 291   if (owner_info.temp_url_keys.empty()) {
 292     ldpp_dout(dpp, 5) << "user does not have temp url key set, aborting" << dendl;
 293     return result_t::reject();
 294   }
 295
 296   if (is_expired(temp_url_expires)) {
 297     ldpp_dout(dpp, 5) << "temp url link expired" << dendl;
 298     return result_t::reject(-EPERM);
 299   }
 300
 301   /* We need to verify two paths because of compliance with Swift, Tempest
 302    * and old versions of RadosGW. The second item will have the prefix
 303    * of Swift API entry point removed. */
 304
 305   /* XXX can we search this ONCE? */
 306   const size_t pos = g_conf()->rgw_swift_url_prefix.find_last_not_of('/') + 1;
 307   const boost::string_view ref_uri = s->decoded_uri;
 308   const std::array<boost::string_view, 2> allowed_paths = {
 309     ref_uri,
 310     ref_uri.substr(pos + 1)
 311   };
 312
 313   /* Account owner calculates the signature also against a HTTP method. */
 314   boost::container::static_vector<boost::string_view, 3> allowed_methods;
 315   if (strcmp("HEAD", s->info.method) == 0) {
 316     /* HEAD requests are specially handled. */
 317     /* TODO: after getting a newer boost (with static_vector supporting
 318      * initializers lists), get back to the good notation:
 319      *   allowed_methods = {"HEAD", "GET", "PUT" };
 320      * Just for now let's use emplace_back to construct the vector. */
 321     allowed_methods.emplace_back("HEAD");
 322     allowed_methods.emplace_back("GET");
 323     allowed_methods.emplace_back("PUT");
 324   } else if (strlen(s->info.method) > 0) {
 325     allowed_methods.emplace_back(s->info.method);
 326   }
 327
 328   /* Need to try each combination of keys, allowed path and methods. */
 329   PrefixableSignatureHelper sig_helper {
 330     s->decoded_uri,
 331     s->object.name,
 332     temp_url_prefix
 333   };
 334
 335   for (const auto& kv : owner_info.temp_url_keys) {
 336     const int temp_url_key_num = kv.first;
 337     const string& temp_url_key = kv.second;
 338
 339     if (temp_url_key.empty()) {
 340       continue;
 341     }
 342
 343     for (const auto& path : allowed_paths) {
 344       for (const auto& method : allowed_methods) {
 345         const char* const local_sig = sig_helper.calc(temp_url_key, method,
 346                                                       path, temp_url_expires);
 347
 348         ldpp_dout(dpp, 20) << "temp url signature [" << temp_url_key_num
 349                           << "] (calculated): " << local_sig
 350                           << dendl;
 351
 352         if (sig_helper.is_equal_to(temp_url_sig)) {
 353           auto apl = apl_factory->create_apl_turl(cct, s, owner_info);
 354           return result_t::grant(std::move(apl));
 355         } else {
 356           ldpp_dout(dpp,  5) << "temp url signature mismatch: " << local_sig
 357                             << " != " << temp_url_sig  << dendl;
 358         }
 359       }
 360     }
 361   }
 362
 363   return result_t::reject();
 364 }
 365
 366
 367 /* External token */
 368 bool ExternalTokenEngine::is_applicable(const std::string& token) const noexcept
 369 {
 370   if (token.empty()) {
 371     return false;
 372   } else if (g_conf()->rgw_swift_auth_url.empty()) {
 373     return false;
 374   } else {
 375     return true;
 376   }
 377 }
 378
 379 ExternalTokenEngine::result_t
 380 ExternalTokenEngine::authenticate(const DoutPrefixProvider* dpp,
 381                                   const std::string& token,
 382                                   const req_state* const s) const
 383 {
 384   if (! is_applicable(token)) {
 385     return result_t::deny();
 386   }
 387
 388   std::string auth_url = g_conf()->rgw_swift_auth_url;
 389   if (auth_url.back() != '/') {
 390     auth_url.append("/");
 391   }
 392
 393   auth_url.append("token");
 394   char url_buf[auth_url.size() + 1 + token.length() + 1];
 395   sprintf(url_buf, "%s/%s", auth_url.c_str(), token.c_str());
 396
 397   RGWHTTPHeadersCollector validator(cct, "GET", url_buf, { "X-Auth-Groups", "X-Auth-Ttl" });
 398
 399   ldpp_dout(dpp, 10) << "rgw_swift_validate_token url=" << url_buf << dendl;
 400
 401   int ret = validator.process();
 402   if (ret < 0) {
 403     throw ret;
 404   }
 405
 406   std::string swift_user;
 407   try {
 408     std::vector<std::string> swift_groups;
 409     get_str_vec(validator.get_header_value("X-Auth-Groups"),
 410                 ",", swift_groups);
 411
 412     if (0 == swift_groups.size()) {
 413       return result_t::deny(-EPERM);
 414     } else {
 415       swift_user = std::move(swift_groups[0]);
 416     }
 417   } catch (const std::out_of_range&) {
 418     /* The X-Auth-Groups header isn't present in the response. */
 419     return result_t::deny(-EPERM);
 420   }
 421
 422   if (swift_user.empty()) {
 423     return result_t::deny(-EPERM);
 424   }
 425
 426   ldpp_dout(dpp, 10) << "swift user=" << swift_user << dendl;
 427
 428   RGWUserInfo tmp_uinfo;
 429   ret = rgw_get_user_info_by_swift(store, swift_user, tmp_uinfo);
 430   if (ret < 0) {
 431     ldpp_dout(dpp, 0) << "NOTICE: couldn't map swift user" << dendl;
 432     throw ret;
 433   }
 434
 435   auto apl = apl_factory->create_apl_local(cct, s, tmp_uinfo,
 436                                            extract_swift_subuser(swift_user),
 437                                            boost::none);
 438   return result_t::grant(std::move(apl));
 439 }
 440
 441 static int build_token(const string& swift_user,
 442                        const string& key,
 443                        const uint64_t nonce,
 444                        const utime_t& expiration,
 445                        bufferlist& bl)
 446 {
 447   using ceph::encode;
 448   encode(swift_user, bl);
 449   encode(nonce, bl);
 450   encode(expiration, bl);
 451
 452   bufferptr p(CEPH_CRYPTO_HMACSHA1_DIGESTSIZE);
 453
 454   char buf[bl.length() * 2 + 1];
 455   buf_to_hex((const unsigned char *)bl.c_str(), bl.length(), buf);
 456   dout(20) << "build_token token=" << buf << dendl;
 457
 458   char k[CEPH_CRYPTO_HMACSHA1_DIGESTSIZE];
 459   memset(k, 0, sizeof(k));
 460   const char *s = key.c_str();
 461   for (int i = 0; i < (int)key.length(); i++, s++) {
 462     k[i % CEPH_CRYPTO_HMACSHA1_DIGESTSIZE] |= *s;
 463   }
 464   calc_hmac_sha1(k, sizeof(k), bl.c_str(), bl.length(), p.c_str());
 465
 466   bl.append(p);
 467
 468   return 0;
 469
 470 }
 471
 472 static int encode_token(CephContext *cct, string& swift_user, string& key,
 473                         bufferlist& bl)
 474 {
 475   const auto nonce = ceph::util::generate_random_number<uint64_t>();
 476
 477   utime_t expiration = ceph_clock_now();
 478   expiration += cct->_conf->rgw_swift_token_expiration;
 479
 480   return build_token(swift_user, key, nonce, expiration, bl);
 481 }
 482
 483
 484 /* AUTH_rgwtk (signed token): engine */
 485 bool SignedTokenEngine::is_applicable(const std::string& token) const noexcept
 486 {
 487   if (token.empty()) {
 488     return false;
 489   } else {
 490     return token.compare(0, 10, "AUTH_rgwtk") == 0;
 491   }
 492 }
 493
 494 SignedTokenEngine::result_t
 495 SignedTokenEngine::authenticate(const DoutPrefixProvider* dpp,
 496                                 const std::string& token,
 497                                 const req_state* const s) const
 498 {
 499   if (! is_applicable(token)) {
 500     return result_t::deny(-EPERM);
 501   }
 502
 503   /* Effective token string is the part after the prefix. */
 504   const std::string etoken = token.substr(strlen("AUTH_rgwtk"));
 505   const size_t etoken_len = etoken.length();
 506
 507   if (etoken_len & 1) {
 508     ldpp_dout(dpp, 0) << "NOTICE: failed to verify token: odd token length="
 509                   << etoken_len << dendl;
 510     throw -EINVAL;
 511   }
 512
 513   ceph::bufferptr p(etoken_len/2);
 514   int ret = hex_to_buf(etoken.c_str(), p.c_str(), etoken_len);
 515   if (ret < 0) {
 516     throw ret;
 517   }
 518
 519   ceph::bufferlist tok_bl;
 520   tok_bl.append(p);
 521
 522   uint64_t nonce;
 523   utime_t expiration;
 524   std::string swift_user;
 525
 526   try {
 527     auto iter = tok_bl.cbegin();
 528
 529     using ceph::decode;
 530     decode(swift_user, iter);
 531     decode(nonce, iter);
 532     decode(expiration, iter);
 533   } catch (buffer::error& err) {
 534     ldpp_dout(dpp, 0) << "NOTICE: failed to decode token" << dendl;
 535     throw -EINVAL;
 536   }
 537
 538   const utime_t now = ceph_clock_now();
 539   if (expiration < now) {
 540     ldpp_dout(dpp, 0) << "NOTICE: old timed out token was used now=" << now
 541                   << " token.expiration=" << expiration
 542                   << dendl;
 543     return result_t::deny(-EPERM);
 544   }
 545
 546   RGWUserInfo user_info;
 547   ret = rgw_get_user_info_by_swift(store, swift_user, user_info);
 548   if (ret < 0) {
 549     throw ret;
 550   }
 551
 552   ldpp_dout(dpp, 10) << "swift_user=" << swift_user << dendl;
 553
 554   const auto siter = user_info.swift_keys.find(swift_user);
 555   if (siter == std::end(user_info.swift_keys)) {
 556     return result_t::deny(-EPERM);
 557   }
 558
 559   const auto swift_key = siter->second;
 560
 561   bufferlist local_tok_bl;
 562   ret = build_token(swift_user, swift_key.key, nonce, expiration, local_tok_bl);
 563   if (ret < 0) {
 564     throw ret;
 565   }
 566
 567   if (local_tok_bl.length() != tok_bl.length()) {
 568     ldpp_dout(dpp, 0) << "NOTICE: tokens length mismatch:"
 569                   << " tok_bl.length()=" << tok_bl.length()
 570                   << " local_tok_bl.length()=" << local_tok_bl.length()
 571                   << dendl;
 572     return result_t::deny(-EPERM);
 573   }
 574
 575   if (memcmp(local_tok_bl.c_str(), tok_bl.c_str(),
 576              local_tok_bl.length()) != 0) {
 577     char buf[local_tok_bl.length() * 2 + 1];
 578
 579     buf_to_hex(reinterpret_cast<const unsigned char *>(local_tok_bl.c_str()),
 580                local_tok_bl.length(), buf);
 581
 582     ldpp_dout(dpp, 0) << "NOTICE: tokens mismatch tok=" << buf << dendl;
 583     return result_t::deny(-EPERM);
 584   }
 585
 586   auto apl = apl_factory->create_apl_local(cct, s, user_info,
 587                                            extract_swift_subuser(swift_user),
 588                                            boost::none);
 589   return result_t::grant(std::move(apl));
 590 }
 591
 592 } /* namespace swift */
 593 } /* namespace auth */
 594 } /* namespace rgw */
 595
 596
 597 void RGW_SWIFT_Auth_Get::execute()
 598 {
 599   int ret = -EPERM;
 600
 601   const char *key = s->info.env->get("HTTP_X_AUTH_KEY");
 602   const char *user = s->info.env->get("HTTP_X_AUTH_USER");
 603
 604   s->prot_flags |= RGW_REST_SWIFT;
 605
 606   string user_str;
 607   RGWUserInfo info;
 608   bufferlist bl;
 609   RGWAccessKey *swift_key;
 610   map<string, RGWAccessKey>::iterator siter;
 611
 612   string swift_url = g_conf()->rgw_swift_url;
 613   string swift_prefix = g_conf()->rgw_swift_url_prefix;
 614   string tenant_path;
 615
 616   /*
 617    * We did not allow an empty Swift prefix before, but we want it now.
 618    * So, we take rgw_swift_url_prefix = "/" to yield the empty prefix.
 619    * The rgw_swift_url_prefix = "" is the default and yields "/swift"
 620    * in a backwards-compatible way.
 621    */
 622   if (swift_prefix.size() == 0) {
 623     swift_prefix = DEFAULT_SWIFT_PREFIX;
 624   } else if (swift_prefix == "/") {
 625     swift_prefix.clear();
 626   } else {
 627     if (swift_prefix[0] != '/') {
 628       swift_prefix.insert(0, "/");
 629     }
 630   }
 631
 632   if (swift_url.size() == 0) {
 633     bool add_port = false;
 634     const char *server_port = s->info.env->get("SERVER_PORT_SECURE");
 635     const char *protocol;
 636     if (server_port) {
 637       add_port = (strcmp(server_port, "443") != 0);
 638       protocol = "https";
 639     } else {
 640       server_port = s->info.env->get("SERVER_PORT");
 641       add_port = (strcmp(server_port, "80") != 0);
 642       protocol = "http";
 643     }
 644     const char *host = s->info.env->get("HTTP_HOST");
 645     if (!host) {
 646       dout(0) << "NOTICE: server is misconfigured, missing rgw_swift_url_prefix or rgw_swift_url, HTTP_HOST is not set" << dendl;
 647       ret = -EINVAL;
 648       goto done;
 649     }
 650     swift_url = protocol;
 651     swift_url.append("://");
 652     swift_url.append(host);
 653     if (add_port && !strchr(host, ':')) {
 654       swift_url.append(":");
 655       swift_url.append(server_port);
 656     }
 657   }
 658
 659   if (!key || !user)
 660     goto done;
 661
 662   user_str = user;
 663
 664   if ((ret = rgw_get_user_info_by_swift(store, user_str, info)) < 0)
 665   {
 666     ret = -EACCES;
 667     goto done;
 668   }
 669
 670   siter = info.swift_keys.find(user_str);
 671   if (siter == info.swift_keys.end()) {
 672     ret = -EPERM;
 673     goto done;
 674   }
 675   swift_key = &siter->second;
 676
 677   if (swift_key->key.compare(key) != 0) {
 678     dout(0) << "NOTICE: RGW_SWIFT_Auth_Get::execute(): bad swift key" << dendl;
 679     ret = -EPERM;
 680     goto done;
 681   }
 682
 683   if (!g_conf()->rgw_swift_tenant_name.empty()) {
 684     tenant_path = "/AUTH_";
 685     tenant_path.append(g_conf()->rgw_swift_tenant_name);
 686   } else if (g_conf()->rgw_swift_account_in_url) {
 687     tenant_path = "/AUTH_";
 688     tenant_path.append(info.user_id.to_str());
 689   }
 690
 691   dump_header(s, "X-Storage-Url", swift_url + swift_prefix + "/v1" +
 692               tenant_path);
 693
 694   using rgw::auth::swift::encode_token;
 695   if ((ret = encode_token(s->cct, swift_key->id, swift_key->key, bl)) < 0)
 696     goto done;
 697
 698   {
 699     static constexpr size_t PREFIX_LEN = sizeof("AUTH_rgwtk") - 1;
 700     char token_val[PREFIX_LEN + bl.length() * 2 + 1];
 701
 702     snprintf(token_val, PREFIX_LEN + 1, "AUTH_rgwtk");
 703     buf_to_hex((const unsigned char *)bl.c_str(), bl.length(),
 704                token_val + PREFIX_LEN);
 705
 706     dump_header(s, "X-Storage-Token", token_val);
 707     dump_header(s, "X-Auth-Token", token_val);
 708   }
 709
 710   ret = STATUS_NO_CONTENT;
 711
 712 done:
 713   set_req_state_err(s, ret);
 714   dump_errno(s);
 715   end_header(s);
 716 }
 717
 718 int RGWHandler_SWIFT_Auth::init(RGWRados *store, struct req_state *state,
 719                                 rgw::io::BasicClient *cio)
 720 {
 721   state->dialect = "swift-auth";
 722   state->formatter = new JSONFormatter;
 723   state->format = RGW_FORMAT_JSON;
 724
 725   return RGWHandler::init(store, state, cio);
 726 }
 727
 728 int RGWHandler_SWIFT_Auth::authorize(const DoutPrefixProvider *dpp)
 729 {
 730   return 0;
 731 }
 732
 733 RGWOp *RGWHandler_SWIFT_Auth::op_get()
 734 {
 735   return new RGW_SWIFT_Auth_Get;
 736 }
 737