1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
2 // vim: ts=8 sw=2 smarttab
6 #include <system_error>
11 #include <boost/algorithm/string/predicate.hpp>
12 #include <boost/bind.hpp>
13 #include <boost/optional.hpp>
14 #include <boost/utility/in_place_factory.hpp>
15 #include <boost/utility/string_view.hpp>
17 #include "common/Clock.h"
18 #include "common/armor.h"
19 #include "common/errno.h"
20 #include "common/mime.h"
21 #include "common/utf8.h"
22 #include "common/ceph_json.h"
24 #include "rgw_rados.h"
28 #include "rgw_acl_s3.h"
29 #include "rgw_acl_swift.h"
31 #include "rgw_bucket.h"
33 #include "rgw_multi.h"
34 #include "rgw_multi_del.h"
36 #include "rgw_cors_s3.h"
37 #include "rgw_rest_conn.h"
38 #include "rgw_rest_s3.h"
40 #include "rgw_client_io.h"
41 #include "rgw_compression.h"
43 #include "cls/lock/cls_lock_client.h"
44 #include "cls/rgw/cls_rgw_client.h"
47 #include "include/assert.h"
49 #include "compressor/Compressor.h"
51 #include "rgw_acl_swift.h"
53 #define dout_context g_ceph_context
54 #define dout_subsys ceph_subsys_rgw
57 using namespace librados
;
58 using ceph::crypto::MD5
;
59 using boost::optional
;
63 using rgw::IAM::Effect
;
64 using rgw::IAM::Policy
;
66 using rgw::IAM::Policy
;
68 static string mp_ns
= RGW_OBJ_NS_MULTIPART
;
69 static string shadow_ns
= RGW_OBJ_NS_SHADOW
;
71 static void forward_req_info(CephContext
*cct
, req_info
& info
, const std::string
& bucket_name
);
72 static int forward_request_to_master(struct req_state
*s
, obj_version
*objv
, RGWRados
*store
,
73 bufferlist
& in_data
, JSONParser
*jp
, req_info
*forward_info
= nullptr);
75 static MultipartMetaFilter mp_filter
;
77 static int parse_range(const char *range
, off_t
& ofs
, off_t
& end
, bool *partial_content
)
84 *partial_content
= false;
86 size_t pos
= s
.find("bytes=");
87 if (pos
== string::npos
) {
89 while (isspace(s
[pos
]))
92 while (isalpha(s
[end
]))
94 if (strncasecmp(s
.c_str(), "bytes", end
- pos
) != 0)
96 while (isspace(s
[end
]))
100 s
= s
.substr(end
+ 1);
102 s
= s
.substr(pos
+ 6); /* size of("bytes=") */
105 if (pos
== string::npos
)
108 *partial_content
= true;
110 ofs_str
= s
.substr(0, pos
);
111 end_str
= s
.substr(pos
+ 1);
112 if (end_str
.length()) {
113 end
= atoll(end_str
.c_str());
118 if (ofs_str
.length()) {
119 ofs
= atoll(ofs_str
.c_str());
120 } else { // RFC2616 suffix-byte-range-spec
125 if (end
>= 0 && end
< ofs
)
133 static int decode_policy(CephContext
*cct
,
135 RGWAccessControlPolicy
*policy
)
137 bufferlist::iterator iter
= bl
.begin();
139 policy
->decode(iter
);
140 } catch (buffer::error
& err
) {
141 ldout(cct
, 0) << "ERROR: could not decode policy, caught buffer::error" << dendl
;
144 if (cct
->_conf
->subsys
.should_gather(ceph_subsys_rgw
, 15)) {
145 RGWAccessControlPolicy_S3
*s3policy
= static_cast<RGWAccessControlPolicy_S3
*>(policy
);
146 ldout(cct
, 15) << __func__
<< " Read AccessControlPolicy";
147 s3policy
->to_xml(*_dout
);
154 static int get_user_policy_from_attr(CephContext
* const cct
,
155 RGWRados
* const store
,
156 map
<string
, bufferlist
>& attrs
,
157 RGWAccessControlPolicy
& policy
/* out */)
159 auto aiter
= attrs
.find(RGW_ATTR_ACL
);
160 if (aiter
!= attrs
.end()) {
161 int ret
= decode_policy(cct
, aiter
->second
, &policy
);
172 static int get_bucket_instance_policy_from_attr(CephContext
*cct
,
174 RGWBucketInfo
& bucket_info
,
175 map
<string
, bufferlist
>& bucket_attrs
,
176 RGWAccessControlPolicy
*policy
,
179 map
<string
, bufferlist
>::iterator aiter
= bucket_attrs
.find(RGW_ATTR_ACL
);
181 if (aiter
!= bucket_attrs
.end()) {
182 int ret
= decode_policy(cct
, aiter
->second
, policy
);
186 ldout(cct
, 0) << "WARNING: couldn't find acl header for bucket, generating default" << dendl
;
188 /* object exists, but policy is broken */
189 int r
= rgw_get_user_info_by_uid(store
, bucket_info
.owner
, uinfo
);
193 policy
->create_default(bucket_info
.owner
, uinfo
.display_name
);
198 static int get_obj_policy_from_attr(CephContext
*cct
,
200 RGWObjectCtx
& obj_ctx
,
201 RGWBucketInfo
& bucket_info
,
202 map
<string
, bufferlist
>& bucket_attrs
,
203 RGWAccessControlPolicy
*policy
,
209 RGWRados::Object
op_target(store
, bucket_info
, obj_ctx
, obj
);
210 RGWRados::Object::Read
rop(&op_target
);
212 ret
= rop
.get_attr(RGW_ATTR_ACL
, bl
);
214 ret
= decode_policy(cct
, bl
, policy
);
217 } else if (ret
== -ENODATA
) {
218 /* object exists, but policy is broken */
219 ldout(cct
, 0) << "WARNING: couldn't find acl header for object, generating default" << dendl
;
221 ret
= rgw_get_user_info_by_uid(store
, bucket_info
.owner
, uinfo
);
225 policy
->create_default(bucket_info
.owner
, uinfo
.display_name
);
232 * Get the AccessControlPolicy for an object off of disk.
233 * policy: must point to a valid RGWACL, and will be filled upon return.
234 * bucket: name of the bucket containing the object.
235 * object: name of the object to get the ACL for.
236 * Returns: 0 on success, -ERR# otherwise.
238 static int get_bucket_policy_from_attr(CephContext
*cct
,
240 RGWBucketInfo
& bucket_info
,
241 map
<string
, bufferlist
>& bucket_attrs
,
242 RGWAccessControlPolicy
*policy
)
244 rgw_raw_obj instance_obj
;
245 store
->get_bucket_instance_obj(bucket_info
.bucket
, instance_obj
);
246 return get_bucket_instance_policy_from_attr(cct
, store
, bucket_info
, bucket_attrs
,
247 policy
, instance_obj
);
250 static optional
<Policy
> get_iam_policy_from_attr(CephContext
* cct
,
252 map
<string
, bufferlist
>& attrs
,
253 const string
& tenant
) {
254 auto i
= attrs
.find(RGW_ATTR_IAM_POLICY
);
255 if (i
!= attrs
.end()) {
256 return Policy(cct
, tenant
, i
->second
);
262 static int get_obj_attrs(RGWRados
*store
, struct req_state
*s
, rgw_obj
& obj
, map
<string
, bufferlist
>& attrs
)
264 RGWRados::Object
op_target(store
, s
->bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
265 RGWRados::Object::Read
read_op(&op_target
);
267 read_op
.params
.attrs
= &attrs
;
269 return read_op
.prepare();
272 static int modify_obj_attr(RGWRados
*store
, struct req_state
*s
, rgw_obj
& obj
, const char* attr_name
, bufferlist
& attr_val
)
274 map
<string
, bufferlist
> attrs
;
275 RGWRados::Object
op_target(store
, s
->bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
276 RGWRados::Object::Read
read_op(&op_target
);
278 read_op
.params
.attrs
= &attrs
;
280 int r
= read_op
.prepare();
284 store
->set_atomic(s
->obj_ctx
, read_op
.state
.obj
);
285 attrs
[attr_name
] = attr_val
;
286 return store
->set_attrs(s
->obj_ctx
, s
->bucket_info
, read_op
.state
.obj
, attrs
, NULL
);
289 static int get_system_obj_attrs(RGWRados
*store
, struct req_state
*s
, rgw_raw_obj
& obj
, map
<string
, bufferlist
>& attrs
,
290 uint64_t *obj_size
, RGWObjVersionTracker
*objv_tracker
)
292 RGWRados::SystemObject
src(store
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
293 RGWRados::SystemObject::Read
rop(&src
);
295 rop
.stat_params
.attrs
= &attrs
;
296 rop
.stat_params
.obj_size
= obj_size
;
298 int ret
= rop
.stat(objv_tracker
);
302 static int read_bucket_policy(RGWRados
*store
,
304 RGWBucketInfo
& bucket_info
,
305 map
<string
, bufferlist
>& bucket_attrs
,
306 RGWAccessControlPolicy
*policy
,
309 if (!s
->system_request
&& bucket_info
.flags
& BUCKET_SUSPENDED
) {
310 ldout(s
->cct
, 0) << "NOTICE: bucket " << bucket_info
.bucket
.name
<< " is suspended" << dendl
;
311 return -ERR_USER_SUSPENDED
;
314 if (bucket
.name
.empty()) {
318 int ret
= get_bucket_policy_from_attr(s
->cct
, store
, bucket_info
, bucket_attrs
, policy
);
319 if (ret
== -ENOENT
) {
320 ret
= -ERR_NO_SUCH_BUCKET
;
326 static int read_obj_policy(RGWRados
*store
,
328 RGWBucketInfo
& bucket_info
,
329 map
<string
, bufferlist
>& bucket_attrs
,
330 RGWAccessControlPolicy
* acl
,
331 optional
<Policy
>& policy
,
336 upload_id
= s
->info
.args
.get("uploadId");
339 if (!s
->system_request
&& bucket_info
.flags
& BUCKET_SUSPENDED
) {
340 ldout(s
->cct
, 0) << "NOTICE: bucket " << bucket_info
.bucket
.name
<< " is suspended" << dendl
;
341 return -ERR_USER_SUSPENDED
;
344 if (!upload_id
.empty()) {
345 /* multipart upload */
346 RGWMPObj
mp(object
.name
, upload_id
);
347 string oid
= mp
.get_meta();
348 obj
.init_ns(bucket
, oid
, mp_ns
);
349 obj
.set_in_extra_data(true);
351 obj
= rgw_obj(bucket
, object
);
353 policy
= get_iam_policy_from_attr(s
->cct
, store
, bucket_attrs
, bucket
.tenant
);
355 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
356 int ret
= get_obj_policy_from_attr(s
->cct
, store
, *obj_ctx
,
357 bucket_info
, bucket_attrs
, acl
, obj
);
358 if (ret
== -ENOENT
) {
359 /* object does not exist checking the bucket's ACL to make sure
360 that we send a proper error code */
361 RGWAccessControlPolicy
bucket_policy(s
->cct
);
362 ret
= get_bucket_policy_from_attr(s
->cct
, store
, bucket_info
, bucket_attrs
, &bucket_policy
);
367 const rgw_user
& bucket_owner
= bucket_policy
.get_owner().get_id();
368 if (bucket_owner
.compare(s
->user
->user_id
) != 0 &&
369 ! s
->auth
.identity
->is_admin_of(bucket_owner
) &&
370 ! bucket_policy
.verify_permission(*s
->auth
.identity
, s
->perm_mask
,
382 * Get the AccessControlPolicy for an user, bucket or object off of disk.
383 * s: The req_state to draw information from.
384 * only_bucket: If true, reads the user and bucket ACLs rather than the object ACL.
385 * Returns: 0 on success, -ERR# otherwise.
387 int rgw_build_bucket_policies(RGWRados
* store
, struct req_state
* s
)
391 RGWUserInfo bucket_owner_info
;
392 RGWObjectCtx
obj_ctx(store
);
394 string bi
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"bucket-instance");
396 ret
= rgw_bucket_parse_bucket_instance(bi
, &s
->bucket_instance_id
, &s
->bucket_instance_shard_id
);
402 if(s
->dialect
.compare("s3") == 0) {
403 s
->bucket_acl
= new RGWAccessControlPolicy_S3(s
->cct
);
404 } else if(s
->dialect
.compare("swift") == 0) {
405 /* We aren't allocating the account policy for those operations using
406 * the Swift's infrastructure that don't really need req_state::user.
407 * Typical example here is the implementation of /info. */
408 if (!s
->user
->user_id
.empty()) {
409 s
->user_acl
= std::unique_ptr
<RGWAccessControlPolicy
>(
410 new RGWAccessControlPolicy_SWIFTAcct(s
->cct
));
412 s
->bucket_acl
= new RGWAccessControlPolicy_SWIFT(s
->cct
);
414 s
->bucket_acl
= new RGWAccessControlPolicy(s
->cct
);
417 /* check if copy source is within the current domain */
418 if (!s
->src_bucket_name
.empty()) {
419 RGWBucketInfo source_info
;
421 if (s
->bucket_instance_id
.empty()) {
422 ret
= store
->get_bucket_info(obj_ctx
, s
->src_tenant_name
, s
->src_bucket_name
, source_info
, NULL
);
424 ret
= store
->get_bucket_instance_info(obj_ctx
, s
->bucket_instance_id
, source_info
, NULL
, NULL
);
427 string
& zonegroup
= source_info
.zonegroup
;
428 s
->local_source
= store
->get_zonegroup().equals(zonegroup
);
434 std::string display_name
;
437 s
->user
->display_name
,
440 if (!s
->bucket_name
.empty()) {
441 s
->bucket_exists
= true;
442 if (s
->bucket_instance_id
.empty()) {
443 ret
= store
->get_bucket_info(obj_ctx
, s
->bucket_tenant
, s
->bucket_name
, s
->bucket_info
, NULL
, &s
->bucket_attrs
);
445 ret
= store
->get_bucket_instance_info(obj_ctx
, s
->bucket_instance_id
, s
->bucket_info
, NULL
, &s
->bucket_attrs
);
448 if (ret
!= -ENOENT
) {
450 rgw_make_bucket_entry_name(s
->bucket_tenant
, s
->bucket_name
, bucket_log
);
451 ldout(s
->cct
, 0) << "NOTICE: couldn't get bucket from bucket_name (name=" << bucket_log
<< ")" << dendl
;
454 s
->bucket_exists
= false;
456 s
->bucket
= s
->bucket_info
.bucket
;
458 if (s
->bucket_exists
) {
459 ret
= read_bucket_policy(store
, s
, s
->bucket_info
, s
->bucket_attrs
, s
->bucket_acl
, s
->bucket
);
461 s
->bucket_info
.owner
,
462 s
->bucket_acl
->get_owner().get_display_name(),
465 s
->bucket_acl
->create_default(s
->user
->user_id
, s
->user
->display_name
);
466 ret
= -ERR_NO_SUCH_BUCKET
;
469 s
->bucket_owner
= s
->bucket_acl
->get_owner();
471 RGWZoneGroup zonegroup
;
472 int r
= store
->get_zonegroup(s
->bucket_info
.zonegroup
, zonegroup
);
474 if (!zonegroup
.endpoints
.empty()) {
475 s
->zonegroup_endpoint
= zonegroup
.endpoints
.front();
477 // use zonegroup's master zone endpoints
478 auto z
= zonegroup
.zones
.find(zonegroup
.master_zone
);
479 if (z
!= zonegroup
.zones
.end() && !z
->second
.endpoints
.empty()) {
480 s
->zonegroup_endpoint
= z
->second
.endpoints
.front();
483 s
->zonegroup_name
= zonegroup
.get_name();
485 if (r
< 0 && ret
== 0) {
489 if (s
->bucket_exists
&& !store
->get_zonegroup().equals(s
->bucket_info
.zonegroup
)) {
490 ldout(s
->cct
, 0) << "NOTICE: request for data in a different zonegroup (" << s
->bucket_info
.zonegroup
<< " != " << store
->get_zonegroup().get_id() << ")" << dendl
;
491 /* we now need to make sure that the operation actually requires copy source, that is
492 * it's a copy operation
494 if (store
->get_zonegroup().is_master_zonegroup() && s
->system_request
) {
495 /*If this is the master, don't redirect*/
496 } else if (!s
->local_source
||
497 (s
->op
!= OP_PUT
&& s
->op
!= OP_COPY
) ||
499 return -ERR_PERMANENT_REDIRECT
;
504 /* handle user ACL only for those APIs which support it */
506 map
<string
, bufferlist
> uattrs
;
508 ret
= rgw_get_user_attrs_by_uid(store
, acct_acl_user
.uid
, uattrs
);
510 ret
= get_user_policy_from_attr(s
->cct
, store
, uattrs
, *s
->user_acl
);
512 if (-ENOENT
== ret
) {
513 /* In already existing clusters users won't have ACL. In such case
514 * assuming that only account owner has the rights seems to be
515 * reasonable. That allows to have only one verification logic.
516 * NOTE: there is small compatibility kludge for global, empty tenant:
517 * 1. if we try to reach an existing bucket, its owner is considered
519 * 2. otherwise account owner is identity stored in s->user->user_id. */
520 s
->user_acl
->create_default(acct_acl_user
.uid
,
521 acct_acl_user
.display_name
);
524 ldout(s
->cct
, 0) << "NOTICE: couldn't get user attrs for handling ACL (user_id="
534 s
->iam_policy
= get_iam_policy_from_attr(s
->cct
, store
, s
->bucket_attrs
,
536 } catch (const std::exception
& e
) {
537 // Really this is a can't happen condition. We parse the policy
538 // when it's given to us, so perhaps we should abort or otherwise
539 // raise bloody murder.
540 lderr(s
->cct
) << "Error reading IAM Policy: " << e
.what() << dendl
;
548 * Get the AccessControlPolicy for a bucket or object off of disk.
549 * s: The req_state to draw information from.
550 * only_bucket: If true, reads the bucket ACL rather than the object ACL.
551 * Returns: 0 on success, -ERR# otherwise.
553 int rgw_build_object_policies(RGWRados
*store
, struct req_state
*s
,
558 if (!s
->object
.empty()) {
559 if (!s
->bucket_exists
) {
560 return -ERR_NO_SUCH_BUCKET
;
562 s
->object_acl
= new RGWAccessControlPolicy(s
->cct
);
564 rgw_obj
obj(s
->bucket
, s
->object
);
566 store
->set_atomic(s
->obj_ctx
, obj
);
568 store
->set_prefetch_data(s
->obj_ctx
, obj
);
570 ret
= read_obj_policy(store
, s
, s
->bucket_info
, s
->bucket_attrs
, s
->object_acl
, s
->iam_policy
, s
->bucket
, s
->object
);
576 rgw::IAM::Environment
rgw_build_iam_environment(RGWRados
* store
,
579 rgw::IAM::Environment e
;
580 const auto& m
= s
->info
.env
->get_map();
581 auto t
= ceph::real_clock::now();
582 e
.emplace(std::piecewise_construct
,
583 std::forward_as_tuple("aws:CurrentTime"),
584 std::forward_as_tuple(std::to_string(
585 ceph::real_clock::to_time_t(t
))));
586 e
.emplace(std::piecewise_construct
,
587 std::forward_as_tuple("aws:EpochTime"),
588 std::forward_as_tuple(ceph::to_iso_8601(t
)));
589 // TODO: This is fine for now, but once we have STS we'll need to
590 // look and see. Also this won't work with the IdentityApplier
591 // model, since we need to know the actual credential.
592 e
.emplace(std::piecewise_construct
,
593 std::forward_as_tuple("aws:PrincipalType"),
594 std::forward_as_tuple("User"));
596 auto i
= m
.find("HTTP_REFERER");
598 e
.emplace(std::piecewise_construct
,
599 std::forward_as_tuple("aws:Referer"),
600 std::forward_as_tuple(i
->second
));
603 // These seem to be the semantics, judging from rest_rgw_s3.cc
604 i
= m
.find("SERVER_PORT_SECURE");
606 e
.emplace(std::piecewise_construct
,
607 std::forward_as_tuple("aws:SecureTransport"),
608 std::forward_as_tuple("true"));
611 i
= m
.find("HTTP_HOST");
613 e
.emplace(std::piecewise_construct
,
614 std::forward_as_tuple("aws:SourceIp"),
615 std::forward_as_tuple(i
->second
));
618 i
= m
.find("HTTP_USER_AGENT"); {
620 e
.emplace(std::piecewise_construct
,
621 std::forward_as_tuple("aws:UserAgent"),
622 std::forward_as_tuple(i
->second
));
626 // What to do about aws::userid? One can have multiple access
627 // keys so that isn't really suitable. Do we have a durable
628 // identifier that can persist through name changes?
629 e
.emplace(std::piecewise_construct
,
630 std::forward_as_tuple("aws:username"),
631 std::forward_as_tuple(s
->user
->user_id
.id
));
636 void rgw_bucket_object_pre_exec(struct req_state
*s
)
641 dump_bucket_from_state(s
);
644 int RGWGetObj::verify_permission()
646 obj
= rgw_obj(s
->bucket
, s
->object
);
647 store
->set_atomic(s
->obj_ctx
, obj
);
649 store
->set_prefetch_data(s
->obj_ctx
, obj
);
652 if (torrent
.get_flag()) {
653 if (obj
.key
.instance
.empty()) {
654 action
= rgw::IAM::s3GetObjectTorrent
;
656 action
= rgw::IAM::s3GetObjectVersionTorrent
;
659 if (obj
.key
.instance
.empty()) {
660 action
= rgw::IAM::s3GetObject
;
662 action
= rgw::IAM::s3GetObjectVersion
;
666 if (!verify_object_permission(s
, action
)) {
674 int RGWOp::verify_op_mask()
676 uint32_t required_mask
= op_mask();
678 ldout(s
->cct
, 20) << "required_mask= " << required_mask
679 << " user.op_mask=" << s
->user
->op_mask
<< dendl
;
681 if ((s
->user
->op_mask
& required_mask
) != required_mask
) {
685 if (!s
->system_request
&& (required_mask
& RGW_OP_TYPE_MODIFY
) && !store
->zone_is_writeable()) {
686 ldout(s
->cct
, 5) << "NOTICE: modify request to a read-only zone by a non-system user, permission denied" << dendl
;
693 int RGWOp::do_aws4_auth_completion()
695 ldout(s
->cct
, 5) << "NOTICE: call to do_aws4_auth_completion" << dendl
;
696 if (s
->auth
.completer
) {
697 if (!s
->auth
.completer
->complete()) {
698 return -ERR_AMZ_CONTENT_SHA256_MISMATCH
;
700 dout(10) << "v4 auth ok -- do_aws4_auth_completion" << dendl
;
703 /* TODO(rzarzynski): yes, we're really called twice on PUTs. Only first
704 * call passes, so we disable second one. This is old behaviour, sorry!
705 * Plan for tomorrow: seek and destroy. */
706 s
->auth
.completer
= nullptr;
712 int RGWOp::init_quota()
714 /* no quota enforcement for system requests */
715 if (s
->system_request
)
718 /* init quota related stuff */
719 if (!(s
->user
->op_mask
& RGW_OP_TYPE_MODIFY
)) {
723 /* only interested in object related ops */
724 if (s
->object
.empty()) {
728 RGWUserInfo owner_info
;
731 if (s
->user
->user_id
== s
->bucket_owner
.get_id()) {
734 int r
= rgw_get_user_info_by_uid(store
, s
->bucket_info
.owner
, owner_info
);
740 if (s
->bucket_info
.quota
.enabled
) {
741 bucket_quota
= s
->bucket_info
.quota
;
742 } else if (uinfo
->bucket_quota
.enabled
) {
743 bucket_quota
= uinfo
->bucket_quota
;
745 bucket_quota
= store
->get_bucket_quota();
748 if (uinfo
->user_quota
.enabled
) {
749 user_quota
= uinfo
->user_quota
;
751 user_quota
= store
->get_user_quota();
757 static bool validate_cors_rule_method(RGWCORSRule
*rule
, const char *req_meth
) {
761 dout(5) << "req_meth is null" << dendl
;
765 if (strcmp(req_meth
, "GET") == 0) flags
= RGW_CORS_GET
;
766 else if (strcmp(req_meth
, "POST") == 0) flags
= RGW_CORS_POST
;
767 else if (strcmp(req_meth
, "PUT") == 0) flags
= RGW_CORS_PUT
;
768 else if (strcmp(req_meth
, "DELETE") == 0) flags
= RGW_CORS_DELETE
;
769 else if (strcmp(req_meth
, "HEAD") == 0) flags
= RGW_CORS_HEAD
;
771 if ((rule
->get_allowed_methods() & flags
) == flags
) {
772 dout(10) << "Method " << req_meth
<< " is supported" << dendl
;
774 dout(5) << "Method " << req_meth
<< " is not supported" << dendl
;
781 int RGWOp::read_bucket_cors()
785 map
<string
, bufferlist
>::iterator aiter
= s
->bucket_attrs
.find(RGW_ATTR_CORS
);
786 if (aiter
== s
->bucket_attrs
.end()) {
787 ldout(s
->cct
, 20) << "no CORS configuration attr found" << dendl
;
789 return 0; /* no CORS configuration found */
796 bufferlist::iterator iter
= bl
.begin();
798 bucket_cors
.decode(iter
);
799 } catch (buffer::error
& err
) {
800 ldout(s
->cct
, 0) << "ERROR: could not decode policy, caught buffer::error" << dendl
;
803 if (s
->cct
->_conf
->subsys
.should_gather(ceph_subsys_rgw
, 15)) {
804 RGWCORSConfiguration_S3
*s3cors
= static_cast<RGWCORSConfiguration_S3
*>(&bucket_cors
);
805 ldout(s
->cct
, 15) << "Read RGWCORSConfiguration";
806 s3cors
->to_xml(*_dout
);
813 * If any of the header field-names is not a ASCII case-insensitive match for
814 * any of the values in list of headers do not set any additional headers and
815 * terminate this set of steps.
817 static void get_cors_response_headers(RGWCORSRule
*rule
, const char *req_hdrs
, string
& hdrs
, string
& exp_hdrs
, unsigned *max_age
) {
820 get_str_list(req_hdrs
, hl
);
821 for(list
<string
>::iterator it
= hl
.begin(); it
!= hl
.end(); ++it
) {
822 if (!rule
->is_header_allowed((*it
).c_str(), (*it
).length())) {
823 dout(5) << "Header " << (*it
) << " is not registered in this rule" << dendl
;
825 if (hdrs
.length() > 0) hdrs
.append(",");
830 rule
->format_exp_headers(exp_hdrs
);
831 *max_age
= rule
->get_max_age();
835 * Generate the CORS header response
837 * This is described in the CORS standard, section 6.2.
839 bool RGWOp::generate_cors_headers(string
& origin
, string
& method
, string
& headers
, string
& exp_headers
, unsigned *max_age
)
842 const char *orig
= s
->info
.env
->get("HTTP_ORIGIN");
849 op_ret
= read_bucket_cors();
855 dout(2) << "No CORS configuration set yet for this bucket" << dendl
;
860 RGWCORSRule
*rule
= bucket_cors
.host_name_rule(orig
);
865 * Set the Allowed-Origin header to a asterisk if this is allowed in the rule
866 * and no Authorization was send by the client
868 * The origin parameter specifies a URI that may access the resource. The browser must enforce this.
869 * For requests without credentials, the server may specify "*" as a wildcard,
870 * thereby allowing any origin to access the resource.
872 const char *authorization
= s
->info
.env
->get("HTTP_AUTHORIZATION");
873 if (!authorization
&& rule
->has_wildcard_origin())
877 const char *req_meth
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
879 req_meth
= s
->info
.method
;
885 if (!validate_cors_rule_method(rule
, req_meth
)) {
891 const char *req_hdrs
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
894 get_cors_response_headers(rule
, req_hdrs
, headers
, exp_headers
, max_age
);
899 int RGWGetObj::read_user_manifest_part(rgw_bucket
& bucket
,
900 const rgw_bucket_dir_entry
& ent
,
901 RGWAccessControlPolicy
* const bucket_acl
,
902 const optional
<Policy
>& bucket_policy
,
903 const off_t start_ofs
,
906 ldout(s
->cct
, 20) << "user manifest obj=" << ent
.key
.name
<< "[" << ent
.key
.instance
<< "]" << dendl
;
907 RGWGetObj_CB
cb(this);
908 RGWGetDataCB
* filter
= &cb
;
909 boost::optional
<RGWGetObj_Decompress
> decompress
;
911 int64_t cur_ofs
= start_ofs
;
912 int64_t cur_end
= end_ofs
;
914 rgw_obj
part(bucket
, ent
.key
);
916 map
<string
, bufferlist
> attrs
;
919 RGWObjectCtx
obj_ctx(store
);
920 RGWAccessControlPolicy
obj_policy(s
->cct
);
922 ldout(s
->cct
, 20) << "reading obj=" << part
<< " ofs=" << cur_ofs
<< " end=" << cur_end
<< dendl
;
924 obj_ctx
.obj
.set_atomic(part
);
925 store
->set_prefetch_data(&obj_ctx
, part
);
927 RGWRados::Object
op_target(store
, s
->bucket_info
, obj_ctx
, part
);
928 RGWRados::Object::Read
read_op(&op_target
);
930 read_op
.conds
.if_match
= ent
.meta
.etag
.c_str();
931 read_op
.params
.attrs
= &attrs
;
932 read_op
.params
.obj_size
= &obj_size
;
934 op_ret
= read_op
.prepare();
937 op_ret
= read_op
.range_to_ofs(obj_size
, cur_ofs
, cur_end
);
940 bool need_decompress
;
941 op_ret
= rgw_compression_info_from_attrset(attrs
, need_decompress
, cs_info
);
943 lderr(s
->cct
) << "ERROR: failed to decode compression info, cannot decompress" << dendl
;
949 if (cs_info
.orig_size
!= ent
.meta
.size
) {
950 // hmm.. something wrong, object not as expected, abort!
951 ldout(s
->cct
, 0) << "ERROR: expected cs_info.orig_size=" << cs_info
.orig_size
<<
952 ", actual read size=" << ent
.meta
.size
<< dendl
;
955 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
956 filter
= &*decompress
;
960 if (obj_size
!= ent
.meta
.size
) {
961 // hmm.. something wrong, object not as expected, abort!
962 ldout(s
->cct
, 0) << "ERROR: expected obj_size=" << obj_size
<< ", actual read size=" << ent
.meta
.size
<< dendl
;
967 op_ret
= rgw_policy_from_attrset(s
->cct
, attrs
, &obj_policy
);
971 /* We can use global user_acl because LOs cannot have segments
972 * stored inside different accounts. */
973 if (s
->system_request
) {
974 ldout(s
->cct
, 2) << "overriding permissions due to system operation" << dendl
;
975 } else if (s
->auth
.identity
->is_admin_of(s
->user
->user_id
)) {
976 ldout(s
->cct
, 2) << "overriding permissions due to admin operation" << dendl
;
977 } else if (!verify_object_permission(s
, part
, s
->user_acl
.get(), bucket_acl
,
978 &obj_policy
, bucket_policy
, action
)) {
982 if (ent
.meta
.size
== 0) {
986 perfcounter
->inc(l_rgw_get_b
, cur_end
- cur_ofs
);
987 filter
->fixup_range(cur_ofs
, cur_end
);
988 op_ret
= read_op
.iterate(cur_ofs
, cur_end
, filter
);
990 op_ret
= filter
->flush();
994 static int iterate_user_manifest_parts(CephContext
* const cct
,
995 RGWRados
* const store
,
998 RGWBucketInfo
*pbucket_info
,
999 const string
& obj_prefix
,
1000 RGWAccessControlPolicy
* const bucket_acl
,
1001 const optional
<Policy
>& bucket_policy
,
1002 uint64_t * const ptotal_len
,
1003 uint64_t * const pobj_size
,
1004 string
* const pobj_sum
,
1005 int (*cb
)(rgw_bucket
& bucket
,
1006 const rgw_bucket_dir_entry
& ent
,
1007 RGWAccessControlPolicy
* const bucket_acl
,
1008 const optional
<Policy
>& bucket_policy
,
1012 void * const cb_param
)
1014 rgw_bucket
& bucket
= pbucket_info
->bucket
;
1015 uint64_t obj_ofs
= 0, len_count
= 0;
1016 bool found_start
= false, found_end
= false, handled_end
= false;
1019 vector
<rgw_bucket_dir_entry
> objs
;
1021 utime_t start_time
= ceph_clock_now();
1023 RGWRados::Bucket
target(store
, *pbucket_info
);
1024 RGWRados::Bucket::List
list_op(&target
);
1026 list_op
.params
.prefix
= obj_prefix
;
1027 list_op
.params
.delim
= delim
;
1031 #define MAX_LIST_OBJS 100
1032 int r
= list_op
.list_objects(MAX_LIST_OBJS
, &objs
, NULL
, &is_truncated
);
1037 for (rgw_bucket_dir_entry
& ent
: objs
) {
1038 uint64_t cur_total_len
= obj_ofs
;
1039 uint64_t start_ofs
= 0, end_ofs
= ent
.meta
.size
;
1041 if ((ptotal_len
|| cb
) && !found_start
&& cur_total_len
+ ent
.meta
.size
> (uint64_t)ofs
) {
1042 start_ofs
= ofs
- obj_ofs
;
1046 obj_ofs
+= ent
.meta
.size
;
1048 etag_sum
.Update((const byte
*)ent
.meta
.etag
.c_str(),
1049 ent
.meta
.etag
.length());
1052 if ((ptotal_len
|| cb
) && !found_end
&& obj_ofs
> (uint64_t)end
) {
1053 end_ofs
= end
- cur_total_len
+ 1;
1057 perfcounter
->tinc(l_rgw_get_lat
,
1058 (ceph_clock_now() - start_time
));
1060 if (found_start
&& !handled_end
) {
1061 len_count
+= end_ofs
- start_ofs
;
1064 r
= cb(bucket
, ent
, bucket_acl
, bucket_policy
, start_ofs
, end_ofs
, cb_param
);
1071 handled_end
= found_end
;
1072 start_time
= ceph_clock_now();
1074 } while (is_truncated
);
1077 *ptotal_len
= len_count
;
1080 *pobj_size
= obj_ofs
;
1083 complete_etag(etag_sum
, pobj_sum
);
1089 struct rgw_slo_part
{
1090 RGWAccessControlPolicy
*bucket_acl
= nullptr;
1091 Policy
* bucket_policy
= nullptr;
1098 static int iterate_slo_parts(CephContext
*cct
,
1102 map
<uint64_t, rgw_slo_part
>& slo_parts
,
1103 int (*cb
)(rgw_bucket
& bucket
,
1104 const rgw_bucket_dir_entry
& ent
,
1105 RGWAccessControlPolicy
*bucket_acl
,
1106 const optional
<Policy
>& bucket_policy
,
1112 bool found_start
= false, found_end
= false;
1114 if (slo_parts
.empty()) {
1118 utime_t start_time
= ceph_clock_now();
1120 map
<uint64_t, rgw_slo_part
>::iterator iter
= slo_parts
.upper_bound(ofs
);
1121 if (iter
!= slo_parts
.begin()) {
1125 uint64_t obj_ofs
= iter
->first
;
1127 for (; iter
!= slo_parts
.end() && !found_end
; ++iter
) {
1128 rgw_slo_part
& part
= iter
->second
;
1129 rgw_bucket_dir_entry ent
;
1131 ent
.key
.name
= part
.obj_name
;
1132 ent
.meta
.size
= part
.size
;
1133 ent
.meta
.etag
= part
.etag
;
1135 uint64_t cur_total_len
= obj_ofs
;
1136 uint64_t start_ofs
= 0, end_ofs
= ent
.meta
.size
;
1138 if (!found_start
&& cur_total_len
+ ent
.meta
.size
> (uint64_t)ofs
) {
1139 start_ofs
= ofs
- obj_ofs
;
1143 obj_ofs
+= ent
.meta
.size
;
1145 if (!found_end
&& obj_ofs
> (uint64_t)end
) {
1146 end_ofs
= end
- cur_total_len
+ 1;
1150 perfcounter
->tinc(l_rgw_get_lat
,
1151 (ceph_clock_now() - start_time
));
1155 // SLO is a Swift thing, and Swift has no knowledge of S3 Policies.
1156 int r
= cb(part
.bucket
, ent
, part
.bucket_acl
,
1157 (part
.bucket_policy
?
1158 optional
<Policy
>(*part
.bucket_policy
) : none
),
1159 start_ofs
, end_ofs
, cb_param
);
1165 start_time
= ceph_clock_now();
1171 static int get_obj_user_manifest_iterate_cb(rgw_bucket
& bucket
,
1172 const rgw_bucket_dir_entry
& ent
,
1173 RGWAccessControlPolicy
* const bucket_acl
,
1174 const optional
<Policy
>& bucket_policy
,
1175 const off_t start_ofs
,
1176 const off_t end_ofs
,
1179 RGWGetObj
*op
= static_cast<RGWGetObj
*>(param
);
1180 return op
->read_user_manifest_part(bucket
, ent
, bucket_acl
, bucket_policy
, start_ofs
, end_ofs
);
1183 int RGWGetObj::handle_user_manifest(const char *prefix
)
1185 const boost::string_view
prefix_view(prefix
);
1186 ldout(s
->cct
, 2) << "RGWGetObj::handle_user_manifest() prefix="
1187 << prefix_view
<< dendl
;
1189 const size_t pos
= prefix_view
.find('/');
1190 if (pos
== string::npos
) {
1194 const std::string bucket_name
= url_decode(prefix_view
.substr(0, pos
));
1195 const std::string obj_prefix
= url_decode(prefix_view
.substr(pos
+ 1));
1199 RGWAccessControlPolicy
_bucket_acl(s
->cct
);
1200 RGWAccessControlPolicy
*bucket_acl
;
1201 optional
<Policy
> _bucket_policy
;
1202 optional
<Policy
>* bucket_policy
;
1203 RGWBucketInfo bucket_info
;
1204 RGWBucketInfo
*pbucket_info
;
1206 if (bucket_name
.compare(s
->bucket
.name
) != 0) {
1207 map
<string
, bufferlist
> bucket_attrs
;
1208 RGWObjectCtx
obj_ctx(store
);
1209 int r
= store
->get_bucket_info(obj_ctx
, s
->user
->user_id
.tenant
,
1210 bucket_name
, bucket_info
, NULL
,
1213 ldout(s
->cct
, 0) << "could not get bucket info for bucket="
1214 << bucket_name
<< dendl
;
1217 bucket
= bucket_info
.bucket
;
1218 pbucket_info
= &bucket_info
;
1219 bucket_acl
= &_bucket_acl
;
1220 r
= read_bucket_policy(store
, s
, bucket_info
, bucket_attrs
, bucket_acl
, bucket
);
1222 ldout(s
->cct
, 0) << "failed to read bucket policy" << dendl
;
1225 _bucket_policy
= get_iam_policy_from_attr(s
->cct
, store
, bucket_attrs
,
1226 bucket_info
.bucket
.tenant
);
1227 bucket_policy
= &_bucket_policy
;
1230 pbucket_info
= &s
->bucket_info
;
1231 bucket_acl
= s
->bucket_acl
;
1232 bucket_policy
= &s
->iam_policy
;
1235 /* dry run to find out:
1236 * - total length (of the parts we are going to send to client),
1237 * - overall DLO's content size,
1238 * - md5 sum of overall DLO's content (for etag of Swift API). */
1239 int r
= iterate_user_manifest_parts(s
->cct
, store
, ofs
, end
,
1240 pbucket_info
, obj_prefix
, bucket_acl
, *bucket_policy
,
1241 nullptr, &s
->obj_size
, &lo_etag
,
1242 nullptr /* cb */, nullptr /* cb arg */);
1247 r
= RGWRados::Object::Read::range_to_ofs(s
->obj_size
, ofs
, end
);
1252 r
= iterate_user_manifest_parts(s
->cct
, store
, ofs
, end
,
1253 pbucket_info
, obj_prefix
, bucket_acl
, *bucket_policy
,
1254 &total_len
, nullptr, nullptr,
1262 send_response_data(bl
, 0, 0);
1266 r
= iterate_user_manifest_parts(s
->cct
, store
, ofs
, end
,
1267 pbucket_info
, obj_prefix
, bucket_acl
, *bucket_policy
,
1268 nullptr, nullptr, nullptr,
1269 get_obj_user_manifest_iterate_cb
, (void *)this);
1276 send_response_data(bl
, 0, 0);
1282 int RGWGetObj::handle_slo_manifest(bufferlist
& bl
)
1284 RGWSLOInfo slo_info
;
1285 bufferlist::iterator bliter
= bl
.begin();
1287 ::decode(slo_info
, bliter
);
1288 } catch (buffer::error
& err
) {
1289 ldout(s
->cct
, 0) << "ERROR: failed to decode slo manifest" << dendl
;
1292 ldout(s
->cct
, 2) << "RGWGetObj::handle_slo_manifest()" << dendl
;
1294 vector
<RGWAccessControlPolicy
> allocated_acls
;
1295 map
<string
, pair
<RGWAccessControlPolicy
*, optional
<Policy
>>> policies
;
1296 map
<string
, rgw_bucket
> buckets
;
1298 map
<uint64_t, rgw_slo_part
> slo_parts
;
1303 for (const auto& entry
: slo_info
.entries
) {
1304 const string
& path
= entry
.path
;
1306 /* If the path starts with slashes, strip them all. */
1307 const size_t pos_init
= path
.find_first_not_of('/');
1308 /* According to the documentation of std::string::find following check
1309 * is not necessary as we should get the std::string::npos propagation
1310 * here. This might be true with the accuracy to implementation's bugs.
1311 * See following question on SO:
1312 * http://stackoverflow.com/questions/1011790/why-does-stdstring-findtext-stdstringnpos-not-return-npos
1314 if (pos_init
== string::npos
) {
1318 const size_t pos_sep
= path
.find('/', pos_init
);
1319 if (pos_sep
== string::npos
) {
1323 string bucket_name
= path
.substr(pos_init
, pos_sep
- pos_init
);
1324 string obj_name
= path
.substr(pos_sep
+ 1);
1327 RGWAccessControlPolicy
*bucket_acl
;
1328 Policy
* bucket_policy
;
1330 if (bucket_name
.compare(s
->bucket
.name
) != 0) {
1331 const auto& piter
= policies
.find(bucket_name
);
1332 if (piter
!= policies
.end()) {
1333 bucket_acl
= piter
->second
.first
;
1334 bucket_policy
= piter
->second
.second
.get_ptr();
1335 bucket
= buckets
[bucket_name
];
1337 allocated_acls
.push_back(RGWAccessControlPolicy(s
->cct
));
1338 RGWAccessControlPolicy
& _bucket_acl
= allocated_acls
.back();
1340 RGWBucketInfo bucket_info
;
1341 map
<string
, bufferlist
> bucket_attrs
;
1342 RGWObjectCtx
obj_ctx(store
);
1343 int r
= store
->get_bucket_info(obj_ctx
, s
->user
->user_id
.tenant
,
1344 bucket_name
, bucket_info
, nullptr,
1347 ldout(s
->cct
, 0) << "could not get bucket info for bucket="
1348 << bucket_name
<< dendl
;
1351 bucket
= bucket_info
.bucket
;
1352 bucket_acl
= &_bucket_acl
;
1353 r
= read_bucket_policy(store
, s
, bucket_info
, bucket_attrs
, bucket_acl
,
1356 ldout(s
->cct
, 0) << "failed to read bucket ACL for bucket "
1360 auto _bucket_policy
= get_iam_policy_from_attr(
1361 s
->cct
, store
, bucket_attrs
, bucket_info
.bucket
.tenant
);
1362 bucket_policy
= _bucket_policy
.get_ptr();
1363 buckets
[bucket_name
] = bucket
;
1364 policies
[bucket_name
] = make_pair(bucket_acl
, _bucket_policy
);
1368 bucket_acl
= s
->bucket_acl
;
1369 bucket_policy
= s
->iam_policy
.get_ptr();
1373 part
.bucket_acl
= bucket_acl
;
1374 part
.bucket_policy
= bucket_policy
;
1375 part
.bucket
= bucket
;
1376 part
.obj_name
= obj_name
;
1377 part
.size
= entry
.size_bytes
;
1378 part
.etag
= entry
.etag
;
1379 ldout(s
->cct
, 20) << "slo_part: ofs=" << ofs
1380 << " bucket=" << part
.bucket
1381 << " obj=" << part
.obj_name
1382 << " size=" << part
.size
1383 << " etag=" << part
.etag
1386 etag_sum
.Update((const byte
*)entry
.etag
.c_str(),
1387 entry
.etag
.length());
1389 slo_parts
[total_len
] = part
;
1390 total_len
+= part
.size
;
1393 complete_etag(etag_sum
, &lo_etag
);
1395 s
->obj_size
= slo_info
.total_size
;
1396 ldout(s
->cct
, 20) << "s->obj_size=" << s
->obj_size
<< dendl
;
1398 int r
= RGWRados::Object::Read::range_to_ofs(total_len
, ofs
, end
);
1403 total_len
= end
- ofs
+ 1;
1405 r
= iterate_slo_parts(s
->cct
, store
, ofs
, end
, slo_parts
,
1406 get_obj_user_manifest_iterate_cb
, (void *)this);
1414 int RGWGetObj::get_data_cb(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
)
1416 /* garbage collection related handling */
1417 utime_t start_time
= ceph_clock_now();
1418 if (start_time
> gc_invalidate_time
) {
1419 int r
= store
->defer_gc(s
->obj_ctx
, s
->bucket_info
, obj
);
1421 dout(0) << "WARNING: could not defer gc entry for obj" << dendl
;
1423 gc_invalidate_time
= start_time
;
1424 gc_invalidate_time
+= (s
->cct
->_conf
->rgw_gc_obj_min_wait
/ 2);
1426 return send_response_data(bl
, bl_ofs
, bl_len
);
1429 bool RGWGetObj::prefetch_data()
1431 /* HEAD request, stop prefetch*/
1436 bool prefetch_first_chunk
= true;
1437 range_str
= s
->info
.env
->get("HTTP_RANGE");
1440 int r
= parse_range(range_str
, ofs
, end
, &partial_content
);
1441 /* error on parsing the range, stop prefetch and will fail in execte() */
1443 range_parsed
= false;
1446 range_parsed
= true;
1448 /* range get goes to shadown objects, stop prefetch */
1449 if (ofs
>= s
->cct
->_conf
->rgw_max_chunk_size
) {
1450 prefetch_first_chunk
= false;
1454 return get_data
&& prefetch_first_chunk
;
1456 void RGWGetObj::pre_exec()
1458 rgw_bucket_object_pre_exec(s
);
1461 static bool object_is_expired(map
<string
, bufferlist
>& attrs
) {
1462 map
<string
, bufferlist
>::iterator iter
= attrs
.find(RGW_ATTR_DELETE_AT
);
1463 if (iter
!= attrs
.end()) {
1466 ::decode(delete_at
, iter
->second
);
1467 } catch (buffer::error
& err
) {
1468 dout(0) << "ERROR: " << __func__
<< ": failed to decode " RGW_ATTR_DELETE_AT
" attr" << dendl
;
1472 if (delete_at
<= ceph_clock_now() && !delete_at
.is_zero()) {
1480 void RGWGetObj::execute()
1482 utime_t start_time
= s
->time
;
1484 gc_invalidate_time
= ceph_clock_now();
1485 gc_invalidate_time
+= (s
->cct
->_conf
->rgw_gc_obj_min_wait
/ 2);
1487 bool need_decompress
;
1488 int64_t ofs_x
, end_x
;
1490 RGWGetObj_CB
cb(this);
1491 RGWGetDataCB
* filter
= (RGWGetDataCB
*)&cb
;
1492 boost::optional
<RGWGetObj_Decompress
> decompress
;
1493 std::unique_ptr
<RGWGetDataCB
> decrypt
;
1494 map
<string
, bufferlist
>::iterator attr_iter
;
1496 perfcounter
->inc(l_rgw_get
);
1498 RGWRados::Object
op_target(store
, s
->bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
1499 RGWRados::Object::Read
read_op(&op_target
);
1501 op_ret
= get_params();
1505 op_ret
= init_common();
1509 read_op
.conds
.mod_ptr
= mod_ptr
;
1510 read_op
.conds
.unmod_ptr
= unmod_ptr
;
1511 read_op
.conds
.high_precision_time
= s
->system_request
; /* system request need to use high precision time */
1512 read_op
.conds
.mod_zone_id
= mod_zone_id
;
1513 read_op
.conds
.mod_pg_ver
= mod_pg_ver
;
1514 read_op
.conds
.if_match
= if_match
;
1515 read_op
.conds
.if_nomatch
= if_nomatch
;
1516 read_op
.params
.attrs
= &attrs
;
1517 read_op
.params
.lastmod
= &lastmod
;
1518 read_op
.params
.obj_size
= &s
->obj_size
;
1520 op_ret
= read_op
.prepare();
1523 version_id
= read_op
.state
.obj
.key
.instance
;
1525 /* STAT ops don't need data, and do no i/o */
1526 if (get_type() == RGW_OP_STAT_OBJ
) {
1530 /* start gettorrent */
1531 if (torrent
.get_flag())
1533 torrent
.init(s
, store
);
1534 torrent
.get_torrent_file(op_ret
, read_op
, total_len
, bl
, obj
);
1537 ldout(s
->cct
, 0) << "ERROR: failed to get_torrent_file ret= " << op_ret
1541 op_ret
= send_response_data(bl
, 0, total_len
);
1544 ldout(s
->cct
, 0) << "ERROR: failed to send_response_data ret= " << op_ret
1550 /* end gettorrent */
1552 op_ret
= rgw_compression_info_from_attrset(attrs
, need_decompress
, cs_info
);
1554 lderr(s
->cct
) << "ERROR: failed to decode compression info, cannot decompress" << dendl
;
1557 if (need_decompress
) {
1558 s
->obj_size
= cs_info
.orig_size
;
1559 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
1560 filter
= &*decompress
;
1563 attr_iter
= attrs
.find(RGW_ATTR_USER_MANIFEST
);
1564 if (attr_iter
!= attrs
.end() && !skip_manifest
) {
1565 op_ret
= handle_user_manifest(attr_iter
->second
.c_str());
1567 ldout(s
->cct
, 0) << "ERROR: failed to handle user manifest ret="
1574 attr_iter
= attrs
.find(RGW_ATTR_SLO_MANIFEST
);
1575 if (attr_iter
!= attrs
.end() && !skip_manifest
) {
1577 op_ret
= handle_slo_manifest(attr_iter
->second
);
1579 ldout(s
->cct
, 0) << "ERROR: failed to handle slo manifest ret=" << op_ret
1586 // for range requests with obj size 0
1587 if (range_str
&& !(s
->obj_size
)) {
1593 op_ret
= read_op
.range_to_ofs(s
->obj_size
, ofs
, end
);
1596 total_len
= (ofs
<= end
? end
+ 1 - ofs
: 0);
1598 /* Check whether the object has expired. Swift API documentation
1599 * stands that we should return 404 Not Found in such case. */
1600 if (need_object_expiration() && object_is_expired(attrs
)) {
1607 /* STAT ops don't need data, and do no i/o */
1608 if (get_type() == RGW_OP_STAT_OBJ
) {
1612 attr_iter
= attrs
.find(RGW_ATTR_MANIFEST
);
1613 op_ret
= this->get_decrypt_filter(&decrypt
, filter
,
1614 attr_iter
!= attrs
.end() ? &(attr_iter
->second
) : nullptr);
1615 if (decrypt
!= nullptr) {
1616 filter
= decrypt
.get();
1622 if (!get_data
|| ofs
> end
) {
1623 send_response_data(bl
, 0, 0);
1627 perfcounter
->inc(l_rgw_get_b
, end
- ofs
);
1631 filter
->fixup_range(ofs_x
, end_x
);
1632 op_ret
= read_op
.iterate(ofs_x
, end_x
, filter
);
1635 op_ret
= filter
->flush();
1637 perfcounter
->tinc(l_rgw_get_lat
,
1638 (ceph_clock_now() - start_time
));
1643 op_ret
= send_response_data(bl
, 0, 0);
1650 send_response_data_error();
1653 int RGWGetObj::init_common()
1656 /* range parsed error when prefetch*/
1657 if (!range_parsed
) {
1658 int r
= parse_range(range_str
, ofs
, end
, &partial_content
);
1664 if (parse_time(if_mod
, &mod_time
) < 0)
1666 mod_ptr
= &mod_time
;
1670 if (parse_time(if_unmod
, &unmod_time
) < 0)
1672 unmod_ptr
= &unmod_time
;
1678 int RGWListBuckets::verify_permission()
1680 if (!verify_user_permission(s
, RGW_PERM_READ
)) {
1687 int RGWGetUsage::verify_permission()
1689 if (s
->auth
.identity
->is_anonymous()) {
1696 void RGWListBuckets::execute()
1699 bool started
= false;
1700 uint64_t total_count
= 0;
1702 uint64_t max_buckets
= s
->cct
->_conf
->rgw_list_buckets_max_chunk
;
1704 op_ret
= get_params();
1709 if (supports_account_metadata()) {
1710 op_ret
= rgw_get_user_attrs_by_uid(store
, s
->user
->user_id
, attrs
);
1716 is_truncated
= false;
1718 RGWUserBuckets buckets
;
1719 uint64_t read_count
;
1721 read_count
= min(limit
- total_count
, (uint64_t)max_buckets
);
1723 read_count
= max_buckets
;
1726 op_ret
= rgw_read_user_buckets(store
, s
->user
->user_id
, buckets
,
1727 marker
, end_marker
, read_count
,
1728 should_get_stats(), &is_truncated
,
1731 /* hmm.. something wrong here.. the user was authenticated, so it
1733 ldout(s
->cct
, 10) << "WARNING: failed on rgw_get_user_buckets uid="
1734 << s
->user
->user_id
<< dendl
;
1737 map
<string
, RGWBucketEnt
>& m
= buckets
.get_buckets();
1738 map
<string
, RGWBucketEnt
>::iterator iter
;
1739 for (iter
= m
.begin(); iter
!= m
.end(); ++iter
) {
1740 RGWBucketEnt
& bucket
= iter
->second
;
1741 buckets_size
+= bucket
.size
;
1742 buckets_size_rounded
+= bucket
.size_rounded
;
1743 buckets_objcount
+= bucket
.count
;
1745 buckets_count
+= m
.size();
1746 total_count
+= m
.size();
1748 done
= (m
.size() < read_count
|| (limit
>= 0 && total_count
>= (uint64_t)limit
));
1751 send_response_begin(buckets
.count() > 0);
1756 send_response_data(buckets
);
1758 map
<string
, RGWBucketEnt
>::reverse_iterator riter
= m
.rbegin();
1759 marker
= riter
->first
;
1761 } while (is_truncated
&& !done
);
1765 send_response_begin(false);
1767 send_response_end();
1770 void RGWGetUsage::execute()
1772 uint64_t start_epoch
= 0;
1773 uint64_t end_epoch
= (uint64_t)-1;
1774 op_ret
= get_params();
1778 if (!start_date
.empty()) {
1779 op_ret
= utime_t::parse_date(start_date
, &start_epoch
, NULL
);
1781 ldout(store
->ctx(), 0) << "ERROR: failed to parse start date" << dendl
;
1786 if (!end_date
.empty()) {
1787 op_ret
= utime_t::parse_date(end_date
, &end_epoch
, NULL
);
1789 ldout(store
->ctx(), 0) << "ERROR: failed to parse end date" << dendl
;
1794 uint32_t max_entries
= 1000;
1796 bool is_truncated
= true;
1798 RGWUsageIter usage_iter
;
1800 while (is_truncated
) {
1801 op_ret
= store
->read_usage(s
->user
->user_id
, start_epoch
, end_epoch
, max_entries
,
1802 &is_truncated
, usage_iter
, usage
);
1804 if (op_ret
== -ENOENT
) {
1806 is_truncated
= false;
1814 op_ret
= rgw_user_sync_all_stats(store
, s
->user
->user_id
);
1816 ldout(store
->ctx(), 0) << "ERROR: failed to sync user stats: " << dendl
;
1820 string user_str
= s
->user
->user_id
.to_str();
1821 op_ret
= store
->cls_user_get_header(user_str
, &header
);
1823 ldout(store
->ctx(), 0) << "ERROR: can't read user header: " << dendl
;
1830 int RGWStatAccount::verify_permission()
1832 if (!verify_user_permission(s
, RGW_PERM_READ
)) {
1839 void RGWStatAccount::execute()
1842 bool is_truncated
= false;
1843 uint64_t max_buckets
= s
->cct
->_conf
->rgw_list_buckets_max_chunk
;
1846 RGWUserBuckets buckets
;
1848 op_ret
= rgw_read_user_buckets(store
, s
->user
->user_id
, buckets
, marker
,
1849 string(), max_buckets
, true, &is_truncated
);
1851 /* hmm.. something wrong here.. the user was authenticated, so it
1853 ldout(s
->cct
, 10) << "WARNING: failed on rgw_get_user_buckets uid="
1854 << s
->user
->user_id
<< dendl
;
1857 map
<string
, RGWBucketEnt
>& m
= buckets
.get_buckets();
1858 map
<string
, RGWBucketEnt
>::iterator iter
;
1859 for (iter
= m
.begin(); iter
!= m
.end(); ++iter
) {
1860 RGWBucketEnt
& bucket
= iter
->second
;
1861 buckets_size
+= bucket
.size
;
1862 buckets_size_rounded
+= bucket
.size_rounded
;
1863 buckets_objcount
+= bucket
.count
;
1865 marker
= iter
->first
;
1867 buckets_count
+= m
.size();
1870 } while (is_truncated
);
1873 int RGWGetBucketVersioning::verify_permission()
1875 if (false == s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
1882 void RGWGetBucketVersioning::pre_exec()
1884 rgw_bucket_object_pre_exec(s
);
1887 void RGWGetBucketVersioning::execute()
1889 versioned
= s
->bucket_info
.versioned();
1890 versioning_enabled
= s
->bucket_info
.versioning_enabled();
1893 int RGWSetBucketVersioning::verify_permission()
1895 if (false == s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
1902 void RGWSetBucketVersioning::pre_exec()
1904 rgw_bucket_object_pre_exec(s
);
1907 void RGWSetBucketVersioning::execute()
1909 op_ret
= get_params();
1913 if (!store
->is_meta_master()) {
1914 op_ret
= forward_request_to_master(s
, NULL
, store
, in_data
, nullptr);
1916 ldout(s
->cct
, 20) << __func__
<< "forward_request_to_master returned ret=" << op_ret
<< dendl
;
1921 if (enable_versioning
) {
1922 s
->bucket_info
.flags
|= BUCKET_VERSIONED
;
1923 s
->bucket_info
.flags
&= ~BUCKET_VERSIONS_SUSPENDED
;
1925 s
->bucket_info
.flags
|= (BUCKET_VERSIONED
| BUCKET_VERSIONS_SUSPENDED
);
1928 op_ret
= store
->put_bucket_instance_info(s
->bucket_info
, false, real_time(),
1931 ldout(s
->cct
, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
1932 << " returned err=" << op_ret
<< dendl
;
1937 int RGWGetBucketWebsite::verify_permission()
1939 if (s
->user
->user_id
.compare(s
->bucket_owner
.get_id()) != 0)
1945 void RGWGetBucketWebsite::pre_exec()
1947 rgw_bucket_object_pre_exec(s
);
1950 void RGWGetBucketWebsite::execute()
1952 if (!s
->bucket_info
.has_website
) {
1957 int RGWSetBucketWebsite::verify_permission()
1959 if (s
->user
->user_id
.compare(s
->bucket_owner
.get_id()) != 0)
1965 void RGWSetBucketWebsite::pre_exec()
1967 rgw_bucket_object_pre_exec(s
);
1970 void RGWSetBucketWebsite::execute()
1972 op_ret
= get_params();
1977 if (!store
->is_meta_master()) {
1978 op_ret
= forward_request_to_master(s
, NULL
, store
, in_data
, nullptr);
1980 ldout(s
->cct
, 20) << __func__
<< " forward_request_to_master returned ret=" << op_ret
<< dendl
;
1985 s
->bucket_info
.has_website
= true;
1986 s
->bucket_info
.website_conf
= website_conf
;
1988 op_ret
= store
->put_bucket_instance_info(s
->bucket_info
, false, real_time(), &s
->bucket_attrs
);
1990 ldout(s
->cct
, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
<< " returned err=" << op_ret
<< dendl
;
1995 int RGWDeleteBucketWebsite::verify_permission()
1997 if (s
->user
->user_id
.compare(s
->bucket_owner
.get_id()) != 0)
2003 void RGWDeleteBucketWebsite::pre_exec()
2005 rgw_bucket_object_pre_exec(s
);
2008 void RGWDeleteBucketWebsite::execute()
2010 s
->bucket_info
.has_website
= false;
2011 s
->bucket_info
.website_conf
= RGWBucketWebsiteConf();
2013 op_ret
= store
->put_bucket_instance_info(s
->bucket_info
, false, real_time(), &s
->bucket_attrs
);
2015 ldout(s
->cct
, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
<< " returned err=" << op_ret
<< dendl
;
2020 int RGWStatBucket::verify_permission()
2022 // This (a HEAD request on a bucket) is governed by the s3:ListBucket permission.
2023 if (!verify_bucket_permission(s
, rgw::IAM::s3ListBucket
)) {
2030 void RGWStatBucket::pre_exec()
2032 rgw_bucket_object_pre_exec(s
);
2035 void RGWStatBucket::execute()
2037 if (!s
->bucket_exists
) {
2038 op_ret
= -ERR_NO_SUCH_BUCKET
;
2042 RGWUserBuckets buckets
;
2043 bucket
.bucket
= s
->bucket
;
2044 buckets
.add(bucket
);
2045 map
<string
, RGWBucketEnt
>& m
= buckets
.get_buckets();
2046 op_ret
= store
->update_containers_stats(m
);
2051 map
<string
, RGWBucketEnt
>::iterator iter
= m
.find(bucket
.bucket
.name
);
2052 if (iter
!= m
.end()) {
2053 bucket
= iter
->second
;
2060 int RGWListBucket::verify_permission()
2062 op_ret
= get_params();
2067 if (!verify_bucket_permission(s
,
2069 rgw::IAM::s3ListBucketVersions
:
2070 rgw::IAM::s3ListBucket
)) {
2077 int RGWListBucket::parse_max_keys()
2079 if (!max_keys
.empty()) {
2081 max
= strtol(max_keys
.c_str(), &endptr
, 10);
2083 while (*endptr
&& isspace(*endptr
)) // ignore white space
2096 void RGWListBucket::pre_exec()
2098 rgw_bucket_object_pre_exec(s
);
2101 void RGWListBucket::execute()
2103 if (!s
->bucket_exists
) {
2104 op_ret
= -ERR_NO_SUCH_BUCKET
;
2108 if (need_container_stats()) {
2109 map
<string
, RGWBucketEnt
> m
;
2110 m
[s
->bucket
.name
] = RGWBucketEnt();
2111 m
.begin()->second
.bucket
= s
->bucket
;
2112 op_ret
= store
->update_containers_stats(m
);
2114 bucket
= m
.begin()->second
;
2118 RGWRados::Bucket
target(store
, s
->bucket_info
);
2119 if (shard_id
>= 0) {
2120 target
.set_shard_id(shard_id
);
2122 RGWRados::Bucket::List
list_op(&target
);
2124 list_op
.params
.prefix
= prefix
;
2125 list_op
.params
.delim
= delimiter
;
2126 list_op
.params
.marker
= marker
;
2127 list_op
.params
.end_marker
= end_marker
;
2128 list_op
.params
.list_versions
= list_versions
;
2130 op_ret
= list_op
.list_objects(max
, &objs
, &common_prefixes
, &is_truncated
);
2132 next_marker
= list_op
.get_next_marker();
2136 int RGWGetBucketLogging::verify_permission()
2138 if (false == s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
2145 int RGWGetBucketLocation::verify_permission()
2147 if (false == s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
2154 int RGWCreateBucket::verify_permission()
2156 /* This check is mostly needed for S3 that doesn't support account ACL.
2157 * Swift doesn't allow to delegate any permission to an anonymous user,
2158 * so it will become an early exit in such case. */
2159 if (s
->auth
.identity
->is_anonymous()) {
2163 if (!verify_user_permission(s
, RGW_PERM_WRITE
)) {
2167 if (s
->user
->user_id
.tenant
!= s
->bucket_tenant
) {
2168 ldout(s
->cct
, 10) << "user cannot create a bucket in a different tenant"
2169 << " (user_id.tenant=" << s
->user
->user_id
.tenant
2170 << " requested=" << s
->bucket_tenant
<< ")"
2174 if (s
->user
->max_buckets
< 0) {
2178 if (s
->user
->max_buckets
) {
2179 RGWUserBuckets buckets
;
2181 bool is_truncated
= false;
2182 op_ret
= rgw_read_user_buckets(store
, s
->user
->user_id
, buckets
,
2183 marker
, string(), s
->user
->max_buckets
,
2184 false, &is_truncated
);
2189 if ((int)buckets
.count() >= s
->user
->max_buckets
) {
2190 return -ERR_TOO_MANY_BUCKETS
;
2197 static int forward_request_to_master(struct req_state
*s
, obj_version
*objv
,
2198 RGWRados
*store
, bufferlist
& in_data
,
2199 JSONParser
*jp
, req_info
*forward_info
)
2201 if (!store
->rest_master_conn
) {
2202 ldout(s
->cct
, 0) << "rest connection is invalid" << dendl
;
2205 ldout(s
->cct
, 0) << "sending request to master zonegroup" << dendl
;
2206 bufferlist response
;
2207 string uid_str
= s
->user
->user_id
.to_str();
2208 #define MAX_REST_RESPONSE (128 * 1024) // we expect a very small response
2209 int ret
= store
->rest_master_conn
->forward(uid_str
, (forward_info
? *forward_info
: s
->info
),
2210 objv
, MAX_REST_RESPONSE
, &in_data
, &response
);
2214 ldout(s
->cct
, 20) << "response: " << response
.c_str() << dendl
;
2215 if (jp
&& !jp
->parse(response
.c_str(), response
.length())) {
2216 ldout(s
->cct
, 0) << "failed parsing response from master zonegroup" << dendl
;
2223 void RGWCreateBucket::pre_exec()
2225 rgw_bucket_object_pre_exec(s
);
2228 static void prepare_add_del_attrs(const map
<string
, bufferlist
>& orig_attrs
,
2229 map
<string
, bufferlist
>& out_attrs
,
2230 map
<string
, bufferlist
>& out_rmattrs
)
2232 for (const auto& kv
: orig_attrs
) {
2233 const string
& name
= kv
.first
;
2235 /* Check if the attr is user-defined metadata item. */
2236 if (name
.compare(0, sizeof(RGW_ATTR_META_PREFIX
) - 1,
2237 RGW_ATTR_META_PREFIX
) == 0) {
2238 /* For the objects all existing meta attrs have to be removed. */
2239 out_rmattrs
[name
] = kv
.second
;
2240 } else if (out_attrs
.find(name
) == std::end(out_attrs
)) {
2241 out_attrs
[name
] = kv
.second
;
2246 /* Fuse resource metadata basing on original attributes in @orig_attrs, set
2247 * of _custom_ attribute names to remove in @rmattr_names and attributes in
2248 * @out_attrs. Place results in @out_attrs.
2250 * NOTE: it's supposed that all special attrs already present in @out_attrs
2251 * will be preserved without any change. Special attributes are those which
2252 * names start with RGW_ATTR_META_PREFIX. They're complement to custom ones
2253 * used for X-Account-Meta-*, X-Container-Meta-*, X-Amz-Meta and so on. */
2254 static void prepare_add_del_attrs(const map
<string
, bufferlist
>& orig_attrs
,
2255 const set
<string
>& rmattr_names
,
2256 map
<string
, bufferlist
>& out_attrs
)
2258 for (const auto& kv
: orig_attrs
) {
2259 const string
& name
= kv
.first
;
2261 /* Check if the attr is user-defined metadata item. */
2262 if (name
.compare(0, strlen(RGW_ATTR_META_PREFIX
),
2263 RGW_ATTR_META_PREFIX
) == 0) {
2264 /* For the buckets all existing meta attrs are preserved,
2265 except those that are listed in rmattr_names. */
2266 if (rmattr_names
.find(name
) != std::end(rmattr_names
)) {
2267 const auto aiter
= out_attrs
.find(name
);
2269 if (aiter
!= std::end(out_attrs
)) {
2270 out_attrs
.erase(aiter
);
2273 /* emplace() won't alter the map if the key is already present.
2274 * This behaviour is fully intensional here. */
2275 out_attrs
.emplace(kv
);
2277 } else if (out_attrs
.find(name
) == std::end(out_attrs
)) {
2278 out_attrs
[name
] = kv
.second
;
2284 static void populate_with_generic_attrs(const req_state
* const s
,
2285 map
<string
, bufferlist
>& out_attrs
)
2287 for (const auto& kv
: s
->generic_attrs
) {
2288 bufferlist
& attrbl
= out_attrs
[kv
.first
];
2289 const string
& val
= kv
.second
;
2291 attrbl
.append(val
.c_str(), val
.size() + 1);
2296 static int filter_out_quota_info(std::map
<std::string
, bufferlist
>& add_attrs
,
2297 const std::set
<std::string
>& rmattr_names
,
2298 RGWQuotaInfo
& quota
,
2299 bool * quota_extracted
= nullptr)
2301 bool extracted
= false;
2303 /* Put new limit on max objects. */
2304 auto iter
= add_attrs
.find(RGW_ATTR_QUOTA_NOBJS
);
2306 if (std::end(add_attrs
) != iter
) {
2308 static_cast<int64_t>(strict_strtoll(iter
->second
.c_str(), 10, &err
));
2312 add_attrs
.erase(iter
);
2316 /* Put new limit on bucket (container) size. */
2317 iter
= add_attrs
.find(RGW_ATTR_QUOTA_MSIZE
);
2318 if (iter
!= add_attrs
.end()) {
2320 static_cast<int64_t>(strict_strtoll(iter
->second
.c_str(), 10, &err
));
2324 add_attrs
.erase(iter
);
2328 for (const auto& name
: rmattr_names
) {
2329 /* Remove limit on max objects. */
2330 if (name
.compare(RGW_ATTR_QUOTA_NOBJS
) == 0) {
2331 quota
.max_objects
= -1;
2335 /* Remove limit on max bucket size. */
2336 if (name
.compare(RGW_ATTR_QUOTA_MSIZE
) == 0) {
2337 quota
.max_size
= -1;
2342 /* Swift requries checking on raw usage instead of the 4 KiB rounded one. */
2343 quota
.check_on_raw
= true;
2344 quota
.enabled
= quota
.max_size
> 0 || quota
.max_objects
> 0;
2346 if (quota_extracted
) {
2347 *quota_extracted
= extracted
;
2354 static void filter_out_website(std::map
<std::string
, ceph::bufferlist
>& add_attrs
,
2355 const std::set
<std::string
>& rmattr_names
,
2356 RGWBucketWebsiteConf
& ws_conf
)
2360 /* Let's define a mapping between each custom attribute and the memory where
2361 * attribute's value should be stored. The memory location is expressed by
2362 * a non-const reference. */
2363 const auto mapping
= {
2364 std::make_pair(RGW_ATTR_WEB_INDEX
, std::ref(ws_conf
.index_doc_suffix
)),
2365 std::make_pair(RGW_ATTR_WEB_ERROR
, std::ref(ws_conf
.error_doc
)),
2366 std::make_pair(RGW_ATTR_WEB_LISTINGS
, std::ref(lstval
)),
2367 std::make_pair(RGW_ATTR_WEB_LIST_CSS
, std::ref(ws_conf
.listing_css_doc
)),
2368 std::make_pair(RGW_ATTR_SUBDIR_MARKER
, std::ref(ws_conf
.subdir_marker
))
2371 for (const auto& kv
: mapping
) {
2372 const char * const key
= kv
.first
;
2373 auto& target
= kv
.second
;
2375 auto iter
= add_attrs
.find(key
);
2377 if (std::end(add_attrs
) != iter
) {
2378 /* The "target" is a reference to ws_conf. */
2379 target
= iter
->second
.c_str();
2380 add_attrs
.erase(iter
);
2383 if (rmattr_names
.count(key
)) {
2384 target
= std::string();
2388 if (! lstval
.empty()) {
2389 ws_conf
.listing_enabled
= boost::algorithm::iequals(lstval
, "true");
2394 void RGWCreateBucket::execute()
2396 RGWAccessControlPolicy
old_policy(s
->cct
);
2398 buffer::list corsbl
;
2401 rgw_make_bucket_entry_name(s
->bucket_tenant
, s
->bucket_name
, bucket_name
);
2402 rgw_raw_obj
obj(store
->get_zone_params().domain_root
, bucket_name
);
2403 obj_version objv
, *pobjv
= NULL
;
2405 op_ret
= get_params();
2409 if (!location_constraint
.empty() &&
2410 !store
->has_zonegroup_api(location_constraint
)) {
2411 ldout(s
->cct
, 0) << "location constraint (" << location_constraint
<< ")"
2412 << " can't be found." << dendl
;
2413 op_ret
= -ERR_INVALID_LOCATION_CONSTRAINT
;
2414 s
->err
.message
= "The specified location-constraint is not valid";
2418 if (!store
->get_zonegroup().is_master_zonegroup() &&
2419 store
->get_zonegroup().api_name
!= location_constraint
) {
2420 ldout(s
->cct
, 0) << "location constraint (" << location_constraint
<< ")"
2421 << " doesn't match zonegroup" << " (" << store
->get_zonegroup().api_name
<< ")"
2423 op_ret
= -ERR_INVALID_LOCATION_CONSTRAINT
;
2424 s
->err
.message
= "The specified location-constraint is not valid";
2428 /* we need to make sure we read bucket info, it's not read before for this
2429 * specific request */
2430 RGWObjectCtx
& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
2431 op_ret
= store
->get_bucket_info(obj_ctx
, s
->bucket_tenant
, s
->bucket_name
,
2432 s
->bucket_info
, NULL
, &s
->bucket_attrs
);
2433 if (op_ret
< 0 && op_ret
!= -ENOENT
)
2435 s
->bucket_exists
= (op_ret
!= -ENOENT
);
2437 s
->bucket_owner
.set_id(s
->user
->user_id
);
2438 s
->bucket_owner
.set_name(s
->user
->display_name
);
2439 if (s
->bucket_exists
) {
2440 int r
= get_bucket_policy_from_attr(s
->cct
, store
, s
->bucket_info
,
2441 s
->bucket_attrs
, &old_policy
);
2443 if (old_policy
.get_owner().get_id().compare(s
->user
->user_id
) != 0) {
2450 RGWBucketInfo master_info
;
2451 rgw_bucket
*pmaster_bucket
;
2452 uint32_t *pmaster_num_shards
;
2453 real_time creation_time
;
2455 if (!store
->is_meta_master()) {
2457 op_ret
= forward_request_to_master(s
, NULL
, store
, in_data
, &jp
);
2462 JSONDecoder::decode_json("entry_point_object_ver", ep_objv
, &jp
);
2463 JSONDecoder::decode_json("object_ver", objv
, &jp
);
2464 JSONDecoder::decode_json("bucket_info", master_info
, &jp
);
2465 ldout(s
->cct
, 20) << "parsed: objv.tag=" << objv
.tag
<< " objv.ver=" << objv
.ver
<< dendl
;
2466 ldout(s
->cct
, 20) << "got creation time: << " << master_info
.creation_time
<< dendl
;
2467 pmaster_bucket
= &master_info
.bucket
;
2468 creation_time
= master_info
.creation_time
;
2469 pmaster_num_shards
= &master_info
.num_shards
;
2472 pmaster_bucket
= NULL
;
2473 pmaster_num_shards
= NULL
;
2476 string zonegroup_id
;
2478 if (s
->system_request
) {
2479 zonegroup_id
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"zonegroup");
2480 if (zonegroup_id
.empty()) {
2481 zonegroup_id
= store
->get_zonegroup().get_id();
2484 zonegroup_id
= store
->get_zonegroup().get_id();
2487 if (s
->bucket_exists
) {
2488 string selected_placement_rule
;
2490 bucket
.tenant
= s
->bucket_tenant
;
2491 bucket
.name
= s
->bucket_name
;
2492 op_ret
= store
->select_bucket_placement(*(s
->user
), zonegroup_id
,
2494 &selected_placement_rule
, nullptr);
2495 if (selected_placement_rule
!= s
->bucket_info
.placement_rule
) {
2501 /* Encode special metadata first as we're using std::map::emplace under
2502 * the hood. This method will add the new items only if the map doesn't
2503 * contain such keys yet. */
2504 policy
.encode(aclbl
);
2505 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
2508 cors_config
.encode(corsbl
);
2509 emplace_attr(RGW_ATTR_CORS
, std::move(corsbl
));
2512 RGWQuotaInfo quota_info
;
2513 const RGWQuotaInfo
* pquota_info
= nullptr;
2514 if (need_metadata_upload()) {
2515 /* It's supposed that following functions WILL NOT change any special
2516 * attributes (like RGW_ATTR_ACL) if they are already present in attrs. */
2517 rgw_get_request_metadata(s
->cct
, s
->info
, attrs
, false);
2518 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
2519 populate_with_generic_attrs(s
, attrs
);
2521 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, quota_info
);
2525 pquota_info
= "a_info
;
2528 /* Web site of Swift API. */
2529 filter_out_website(attrs
, rmattr_names
, s
->bucket_info
.website_conf
);
2530 s
->bucket_info
.has_website
= !s
->bucket_info
.website_conf
.is_empty();
2533 s
->bucket
.tenant
= s
->bucket_tenant
; /* ignored if bucket exists */
2534 s
->bucket
.name
= s
->bucket_name
;
2536 /* Handle updates of the metadata for Swift's object versioning. */
2537 if (swift_ver_location
) {
2538 s
->bucket_info
.swift_ver_location
= *swift_ver_location
;
2539 s
->bucket_info
.swift_versioning
= (! swift_ver_location
->empty());
2542 op_ret
= store
->create_bucket(*(s
->user
), s
->bucket
, zonegroup_id
,
2543 placement_rule
, s
->bucket_info
.swift_ver_location
,
2545 info
, pobjv
, &ep_objv
, creation_time
,
2546 pmaster_bucket
, pmaster_num_shards
, true);
2547 /* continue if EEXIST and create_bucket will fail below. this way we can
2548 * recover from a partial create by retrying it. */
2549 ldout(s
->cct
, 20) << "rgw_create_bucket returned ret=" << op_ret
<< " bucket=" << s
->bucket
<< dendl
;
2551 if (op_ret
&& op_ret
!= -EEXIST
)
2554 existed
= (op_ret
== -EEXIST
);
2557 /* bucket already existed, might have raced with another bucket creation, or
2558 * might be partial bucket creation that never completed. Read existing bucket
2559 * info, verify that the reported bucket owner is the current user.
2560 * If all is ok then update the user's list of buckets.
2561 * Otherwise inform client about a name conflict.
2563 if (info
.owner
.compare(s
->user
->user_id
) != 0) {
2567 s
->bucket
= info
.bucket
;
2570 op_ret
= rgw_link_bucket(store
, s
->user
->user_id
, s
->bucket
,
2571 info
.creation_time
, false);
2572 if (op_ret
&& !existed
&& op_ret
!= -EEXIST
) {
2573 /* if it exists (or previously existed), don't remove it! */
2574 op_ret
= rgw_unlink_bucket(store
, s
->user
->user_id
, s
->bucket
.tenant
,
2577 ldout(s
->cct
, 0) << "WARNING: failed to unlink bucket: ret=" << op_ret
2580 } else if (op_ret
== -EEXIST
|| (op_ret
== 0 && existed
)) {
2581 op_ret
= -ERR_BUCKET_EXISTS
;
2584 if (need_metadata_upload() && existed
) {
2585 /* OK, it looks we lost race with another request. As it's required to
2586 * handle metadata fusion and upload, the whole operation becomes very
2587 * similar in nature to PutMetadataBucket. However, as the attrs may
2588 * changed in the meantime, we have to refresh. */
2591 RGWObjectCtx
& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
2592 RGWBucketInfo binfo
;
2593 map
<string
, bufferlist
> battrs
;
2595 op_ret
= store
->get_bucket_info(obj_ctx
, s
->bucket_tenant
, s
->bucket_name
,
2596 binfo
, nullptr, &battrs
);
2599 } else if (binfo
.owner
.compare(s
->user
->user_id
) != 0) {
2600 /* New bucket doesn't belong to the account we're operating on. */
2604 s
->bucket_info
= binfo
;
2605 s
->bucket_attrs
= battrs
;
2610 rgw_get_request_metadata(s
->cct
, s
->info
, attrs
, false);
2611 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
2612 populate_with_generic_attrs(s
, attrs
);
2613 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, s
->bucket_info
.quota
);
2618 /* Handle updates of the metadata for Swift's object versioning. */
2619 if (swift_ver_location
) {
2620 s
->bucket_info
.swift_ver_location
= *swift_ver_location
;
2621 s
->bucket_info
.swift_versioning
= (! swift_ver_location
->empty());
2624 /* Web site of Swift API. */
2625 filter_out_website(attrs
, rmattr_names
, s
->bucket_info
.website_conf
);
2626 s
->bucket_info
.has_website
= !s
->bucket_info
.website_conf
.is_empty();
2628 /* This will also set the quota on the bucket. */
2629 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
,
2630 &s
->bucket_info
.objv_tracker
);
2631 } while (op_ret
== -ECANCELED
&& tries
++ < 20);
2633 /* Restore the proper return code. */
2635 op_ret
= -ERR_BUCKET_EXISTS
;
2640 int RGWDeleteBucket::verify_permission()
2642 if (!verify_bucket_permission(s
, rgw::IAM::s3DeleteBucket
)) {
2649 void RGWDeleteBucket::pre_exec()
2651 rgw_bucket_object_pre_exec(s
);
2654 void RGWDeleteBucket::execute()
2658 if (s
->bucket_name
.empty())
2661 if (!s
->bucket_exists
) {
2662 ldout(s
->cct
, 0) << "ERROR: bucket " << s
->bucket_name
<< " not found" << dendl
;
2663 op_ret
= -ERR_NO_SUCH_BUCKET
;
2666 RGWObjVersionTracker ot
;
2667 ot
.read_version
= s
->bucket_info
.ep_objv
;
2669 if (s
->system_request
) {
2670 string tag
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"tag");
2671 string ver_str
= s
->info
.args
.get(RGW_SYS_PARAM_PREFIX
"ver");
2673 ot
.read_version
.tag
= tag
;
2676 ver
= strict_strtol(ver_str
.c_str(), 10, &err
);
2678 ldout(s
->cct
, 0) << "failed to parse ver param" << dendl
;
2682 ot
.read_version
.ver
= ver
;
2686 op_ret
= rgw_bucket_sync_user_stats(store
, s
->user
->user_id
, s
->bucket_info
);
2688 ldout(s
->cct
, 1) << "WARNING: failed to sync user stats before bucket delete: op_ret= " << op_ret
<< dendl
;
2691 op_ret
= store
->check_bucket_empty(s
->bucket_info
);
2696 if (!store
->is_meta_master()) {
2698 op_ret
= forward_request_to_master(s
, &ot
.read_version
, store
, in_data
,
2701 if (op_ret
== -ENOENT
) {
2702 /* adjust error, we want to return with NoSuchBucket and not
2704 op_ret
= -ERR_NO_SUCH_BUCKET
;
2710 op_ret
= store
->delete_bucket(s
->bucket_info
, ot
, false);
2712 if (op_ret
== -ECANCELED
) {
2713 // lost a race, either with mdlog sync or another delete bucket operation.
2714 // in either case, we've already called rgw_unlink_bucket()
2720 op_ret
= rgw_unlink_bucket(store
, s
->user
->user_id
, s
->bucket
.tenant
,
2721 s
->bucket
.name
, false);
2723 ldout(s
->cct
, 0) << "WARNING: failed to unlink bucket: ret=" << op_ret
2735 int RGWPutObj::verify_permission()
2739 RGWAccessControlPolicy
cs_acl(s
->cct
);
2740 optional
<Policy
> policy
;
2741 map
<string
, bufferlist
> cs_attrs
;
2742 rgw_bucket
cs_bucket(copy_source_bucket_info
.bucket
);
2743 rgw_obj_key
cs_object(copy_source_object_name
, copy_source_version_id
);
2745 rgw_obj
obj(cs_bucket
, cs_object
);
2746 store
->set_atomic(s
->obj_ctx
, obj
);
2747 store
->set_prefetch_data(s
->obj_ctx
, obj
);
2749 /* check source object permissions */
2750 if (read_obj_policy(store
, s
, copy_source_bucket_info
, cs_attrs
, &cs_acl
, policy
,
2751 cs_bucket
, cs_object
) < 0) {
2755 /* admin request overrides permission checks */
2756 if (! s
->auth
.identity
->is_admin_of(cs_acl
.get_owner().get_id())) {
2758 auto e
= policy
->eval(s
->env
, *s
->auth
.identity
,
2759 cs_object
.instance
.empty() ?
2760 rgw::IAM::s3GetObject
:
2761 rgw::IAM::s3GetObjectVersion
,
2762 rgw::IAM::ARN(obj
));
2763 if (e
== Effect::Deny
) {
2765 } else if (e
== Effect::Pass
&&
2766 !cs_acl
.verify_permission(*s
->auth
.identity
, s
->perm_mask
,
2770 } else if (!cs_acl
.verify_permission(*s
->auth
.identity
, s
->perm_mask
,
2777 if (s
->iam_policy
) {
2778 auto e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
2779 rgw::IAM::s3PutObject
,
2780 rgw_obj(s
->bucket
, s
->object
));
2781 if (e
== Effect::Allow
) {
2783 } else if (e
== Effect::Deny
) {
2788 if (!verify_bucket_permission_no_policy(s
, RGW_PERM_WRITE
)) {
2795 void RGWPutObjProcessor_Multipart::get_mp(RGWMPObj
** _mp
){
2799 int RGWPutObjProcessor_Multipart::prepare(RGWRados
*store
, string
*oid_rand
)
2801 string oid
= obj_str
;
2802 upload_id
= s
->info
.args
.get("uploadId");
2804 mp
.init(oid
, upload_id
);
2806 mp
.init(oid
, upload_id
, *oid_rand
);
2809 part_num
= s
->info
.args
.get("partNumber");
2810 if (part_num
.empty()) {
2811 ldout(s
->cct
, 10) << "part number is empty" << dendl
;
2816 uint64_t num
= (uint64_t)strict_strtol(part_num
.c_str(), 10, &err
);
2819 ldout(s
->cct
, 10) << "bad part number: " << part_num
<< ": " << err
<< dendl
;
2823 string upload_prefix
= oid
+ ".";
2826 upload_prefix
.append(upload_id
);
2828 upload_prefix
.append(*oid_rand
);
2832 target_obj
.init(bucket
, oid
);
2834 manifest
.set_prefix(upload_prefix
);
2836 manifest
.set_multipart_part_rule(store
->ctx()->_conf
->rgw_obj_stripe_size
, num
);
2838 int r
= manifest_gen
.create_begin(store
->ctx(), &manifest
, s
->bucket_info
.placement_rule
, bucket
, target_obj
);
2843 cur_obj
= manifest_gen
.get_cur_obj(store
);
2844 rgw_raw_obj_to_obj(bucket
, cur_obj
, &head_obj
);
2845 head_obj
.index_hash_source
= obj_str
;
2847 r
= prepare_init(store
, NULL
);
2855 int RGWPutObjProcessor_Multipart::do_complete(size_t accounted_size
,
2857 real_time
*mtime
, real_time set_mtime
,
2858 map
<string
, bufferlist
>& attrs
,
2859 real_time delete_at
,
2860 const char *if_match
,
2861 const char *if_nomatch
, const string
*user_data
, rgw_zone_set
*zones_trace
)
2863 complete_writing_data();
2865 RGWRados::Object
op_target(store
, s
->bucket_info
, obj_ctx
, head_obj
);
2866 op_target
.set_versioning_disabled(true);
2867 RGWRados::Object::Write
head_obj_op(&op_target
);
2869 head_obj_op
.meta
.set_mtime
= set_mtime
;
2870 head_obj_op
.meta
.mtime
= mtime
;
2871 head_obj_op
.meta
.owner
= s
->owner
.get_id();
2872 head_obj_op
.meta
.delete_at
= delete_at
;
2873 head_obj_op
.meta
.zones_trace
= zones_trace
;
2875 int r
= head_obj_op
.write_meta(obj_len
, accounted_size
, attrs
);
2880 RGWUploadPartInfo info
;
2882 bool sorted_omap
= is_v2_upload_id(upload_id
);
2886 int part_num_int
= strict_strtol(part_num
.c_str(), 10, &err
);
2888 dout(10) << "bad part number specified: " << part_num
<< dendl
;
2892 snprintf(buf
, sizeof(buf
), "%08d", part_num_int
);
2897 info
.num
= atoi(part_num
.c_str());
2899 info
.size
= obj_len
;
2900 info
.accounted_size
= accounted_size
;
2901 info
.modified
= real_clock::now();
2902 info
.manifest
= manifest
;
2905 r
= rgw_compression_info_from_attrset(attrs
, compressed
, info
.cs_info
);
2907 dout(1) << "cannot get compression info" << dendl
;
2913 string multipart_meta_obj
= mp
.get_meta();
2916 meta_obj
.init_ns(bucket
, multipart_meta_obj
, mp_ns
);
2917 meta_obj
.set_in_extra_data(true);
2919 rgw_raw_obj raw_meta_obj
;
2921 store
->obj_to_raw(s
->bucket_info
.placement_rule
, meta_obj
, &raw_meta_obj
);
2923 r
= store
->omap_set(raw_meta_obj
, p
, bl
);
2928 RGWPutObjProcessor
*RGWPutObj::select_processor(RGWObjectCtx
& obj_ctx
, bool *is_multipart
)
2930 RGWPutObjProcessor
*processor
;
2932 bool multipart
= s
->info
.args
.exists("uploadId");
2934 uint64_t part_size
= s
->cct
->_conf
->rgw_obj_stripe_size
;
2937 processor
= new RGWPutObjProcessor_Atomic(obj_ctx
, s
->bucket_info
, s
->bucket
, s
->object
.name
, part_size
, s
->req_id
, s
->bucket_info
.versioning_enabled());
2938 (static_cast<RGWPutObjProcessor_Atomic
*>(processor
))->set_olh_epoch(olh_epoch
);
2939 (static_cast<RGWPutObjProcessor_Atomic
*>(processor
))->set_version_id(version_id
);
2941 processor
= new RGWPutObjProcessor_Multipart(obj_ctx
, s
->bucket_info
, part_size
, s
);
2945 *is_multipart
= multipart
;
2951 void RGWPutObj::dispose_processor(RGWPutObjDataProcessor
*processor
)
2956 void RGWPutObj::pre_exec()
2958 rgw_bucket_object_pre_exec(s
);
2961 class RGWPutObj_CB
: public RGWGetDataCB
2965 RGWPutObj_CB(RGWPutObj
*_op
) : op(_op
) {}
2966 ~RGWPutObj_CB() override
{}
2968 int handle_data(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
) override
{
2969 return op
->get_data_cb(bl
, bl_ofs
, bl_len
);
2973 int RGWPutObj::get_data_cb(bufferlist
& bl
, off_t bl_ofs
, off_t bl_len
)
2976 bl
.copy(bl_ofs
, bl_len
, bl_tmp
);
2978 bl_aux
.append(bl_tmp
);
2983 int RGWPutObj::get_data(const off_t fst
, const off_t lst
, bufferlist
& bl
)
2985 RGWPutObj_CB
cb(this);
2986 RGWGetDataCB
* filter
= &cb
;
2987 boost::optional
<RGWGetObj_Decompress
> decompress
;
2988 std::unique_ptr
<RGWGetDataCB
> decrypt
;
2989 RGWCompressionInfo cs_info
;
2990 map
<string
, bufferlist
> attrs
;
2991 map
<string
, bufferlist
>::iterator attr_iter
;
2995 int64_t new_ofs
, new_end
;
3000 rgw_obj_key
obj_key(copy_source_object_name
, copy_source_version_id
);
3001 rgw_obj
obj(copy_source_bucket_info
.bucket
, obj_key
);
3003 RGWRados::Object
op_target(store
, copy_source_bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
3004 RGWRados::Object::Read
read_op(&op_target
);
3005 read_op
.params
.obj_size
= &obj_size
;
3006 read_op
.params
.attrs
= &attrs
;
3008 ret
= read_op
.prepare();
3012 bool need_decompress
;
3013 op_ret
= rgw_compression_info_from_attrset(attrs
, need_decompress
, cs_info
);
3015 lderr(s
->cct
) << "ERROR: failed to decode compression info, cannot decompress" << dendl
;
3019 bool partial_content
= true;
3020 if (need_decompress
)
3022 obj_size
= cs_info
.orig_size
;
3023 decompress
.emplace(s
->cct
, &cs_info
, partial_content
, filter
);
3024 filter
= &*decompress
;
3027 attr_iter
= attrs
.find(RGW_ATTR_MANIFEST
);
3028 op_ret
= this->get_decrypt_filter(&decrypt
,
3031 attr_iter
!= attrs
.end() ? &(attr_iter
->second
) : nullptr);
3032 if (decrypt
!= nullptr) {
3033 filter
= decrypt
.get();
3039 ret
= read_op
.range_to_ofs(obj_size
, new_ofs
, new_end
);
3043 filter
->fixup_range(new_ofs
, new_end
);
3044 ret
= read_op
.iterate(new_ofs
, new_end
, filter
);
3047 ret
= filter
->flush();
3049 bl
.claim_append(bl_aux
);
3054 // special handling for compression type = "random" with multipart uploads
3055 static CompressorRef
get_compressor_plugin(const req_state
*s
,
3056 const std::string
& compression_type
)
3058 if (compression_type
!= "random") {
3059 return Compressor::create(s
->cct
, compression_type
);
3062 bool is_multipart
{false};
3063 const auto& upload_id
= s
->info
.args
.get("uploadId", &is_multipart
);
3065 if (!is_multipart
) {
3066 return Compressor::create(s
->cct
, compression_type
);
3069 // use a hash of the multipart upload id so all parts use the same plugin
3070 const auto alg
= std::hash
<std::string
>{}(upload_id
) % Compressor::COMP_ALG_LAST
;
3071 if (alg
== Compressor::COMP_ALG_NONE
) {
3074 return Compressor::create(s
->cct
, alg
);
3077 void RGWPutObj::execute()
3079 RGWPutObjProcessor
*processor
= NULL
;
3080 RGWPutObjDataProcessor
*filter
= nullptr;
3081 std::unique_ptr
<RGWPutObjDataProcessor
> encrypt
;
3082 char supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1];
3083 char supplied_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
3084 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
3085 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
3087 bufferlist bl
, aclbl
, bs
;
3089 map
<string
, string
>::iterator iter
;
3094 const auto& compression_type
= store
->get_zone_params().get_compression_type(
3095 s
->bucket_info
.placement_rule
);
3096 CompressorRef plugin
;
3097 boost::optional
<RGWPutObj_Compress
> compressor
;
3099 bool need_calc_md5
= (dlo_manifest
== NULL
) && (slo_info
== NULL
);
3100 perfcounter
->inc(l_rgw_put
);
3102 if (s
->object
.empty()) {
3106 if (!s
->bucket_exists
) {
3107 op_ret
= -ERR_NO_SUCH_BUCKET
;
3111 op_ret
= get_params();
3113 ldout(s
->cct
, 20) << "get_params() returned ret=" << op_ret
<< dendl
;
3117 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
3119 ldout(s
->cct
, 20) << "get_system_versioning_params() returned ret="
3124 if (supplied_md5_b64
) {
3125 need_calc_md5
= true;
3127 ldout(s
->cct
, 15) << "supplied_md5_b64=" << supplied_md5_b64
<< dendl
;
3128 op_ret
= ceph_unarmor(supplied_md5_bin
, &supplied_md5_bin
[CEPH_CRYPTO_MD5_DIGESTSIZE
+ 1],
3129 supplied_md5_b64
, supplied_md5_b64
+ strlen(supplied_md5_b64
));
3130 ldout(s
->cct
, 15) << "ceph_armor ret=" << op_ret
<< dendl
;
3131 if (op_ret
!= CEPH_CRYPTO_MD5_DIGESTSIZE
) {
3132 op_ret
= -ERR_INVALID_DIGEST
;
3136 buf_to_hex((const unsigned char *)supplied_md5_bin
, CEPH_CRYPTO_MD5_DIGESTSIZE
, supplied_md5
);
3137 ldout(s
->cct
, 15) << "supplied_md5=" << supplied_md5
<< dendl
;
3140 if (!chunked_upload
) { /* with chunked upload we don't know how big is the upload.
3141 we also check sizes at the end anyway */
3142 op_ret
= store
->check_quota(s
->bucket_owner
.get_id(), s
->bucket
,
3143 user_quota
, bucket_quota
, s
->content_length
);
3145 ldout(s
->cct
, 20) << "check_quota() returned ret=" << op_ret
<< dendl
;
3148 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
3150 ldout(s
->cct
, 20) << "check_bucket_shards() returned ret=" << op_ret
<< dendl
;
3155 if (supplied_etag
) {
3156 strncpy(supplied_md5
, supplied_etag
, sizeof(supplied_md5
) - 1);
3157 supplied_md5
[sizeof(supplied_md5
) - 1] = '\0';
3160 processor
= select_processor(*static_cast<RGWObjectCtx
*>(s
->obj_ctx
), &multipart
);
3162 // no filters by default
3165 /* Handle object versioning of Swift API. */
3167 rgw_obj
obj(s
->bucket
, s
->object
);
3168 op_ret
= store
->swift_versioning_copy(*static_cast<RGWObjectCtx
*>(s
->obj_ctx
),
3169 s
->bucket_owner
.get_id(),
3177 op_ret
= processor
->prepare(store
, NULL
);
3179 ldout(s
->cct
, 20) << "processor->prepare() returned ret=" << op_ret
3184 fst
= copy_source_range_fst
;
3185 lst
= copy_source_range_lst
;
3187 op_ret
= get_encrypt_filter(&encrypt
, filter
);
3191 if (encrypt
!= nullptr) {
3192 filter
= encrypt
.get();
3194 //no encryption, we can try compression
3195 if (compression_type
!= "none") {
3196 plugin
= get_compressor_plugin(s
, compression_type
);
3198 ldout(s
->cct
, 1) << "Cannot load plugin for compression type "
3199 << compression_type
<< dendl
;
3201 compressor
.emplace(s
->cct
, plugin
, filter
);
3202 filter
= &*compressor
;
3212 len
= get_data(data
);
3214 uint64_t cur_lst
= min(fst
+ s
->cct
->_conf
->rgw_max_chunk_size
- 1, lst
);
3215 op_ret
= get_data(fst
, cur_lst
, data
);
3218 len
= data
.length();
3219 s
->content_length
+= len
;
3227 if (need_calc_md5
) {
3228 hash
.Update((const byte
*)data
.c_str(), data
.length());
3231 /* update torrrent */
3232 torrent
.update(data
);
3234 /* do we need this operation to be synchronous? if we're dealing with an object with immutable
3235 * head, e.g., multipart object we need to make sure we're the first one writing to this object
3237 bool need_to_wait
= (ofs
== 0) && multipart
;
3239 bufferlist orig_data
;
3245 op_ret
= put_data_and_throttle(filter
, data
, ofs
, need_to_wait
);
3247 if (!need_to_wait
|| op_ret
!= -EEXIST
) {
3248 ldout(s
->cct
, 20) << "processor->thottle_data() returned ret="
3252 /* need_to_wait == true and op_ret == -EEXIST */
3253 ldout(s
->cct
, 5) << "NOTICE: processor->throttle_data() returned -EEXIST, need to restart write" << dendl
;
3255 /* restore original data */
3256 data
.swap(orig_data
);
3258 /* restart processing with different oid suffix */
3260 dispose_processor(processor
);
3261 processor
= select_processor(*static_cast<RGWObjectCtx
*>(s
->obj_ctx
), &multipart
);
3266 gen_rand_alphanumeric(store
->ctx(), buf
, sizeof(buf
) - 1);
3267 oid_rand
.append(buf
);
3269 op_ret
= processor
->prepare(store
, &oid_rand
);
3271 ldout(s
->cct
, 0) << "ERROR: processor->prepare() returned "
3276 op_ret
= get_encrypt_filter(&encrypt
, filter
);
3280 if (encrypt
!= nullptr) {
3281 filter
= encrypt
.get();
3284 compressor
.emplace(s
->cct
, plugin
, filter
);
3285 filter
= &*compressor
;
3288 op_ret
= put_data_and_throttle(filter
, data
, ofs
, false);
3299 op_ret
= put_data_and_throttle(filter
, flush
, ofs
, false);
3305 if (!chunked_upload
&& ofs
!= s
->content_length
) {
3306 op_ret
= -ERR_REQUEST_TIMEOUT
;
3311 perfcounter
->inc(l_rgw_put_b
, s
->obj_size
);
3313 op_ret
= do_aws4_auth_completion();
3318 op_ret
= store
->check_quota(s
->bucket_owner
.get_id(), s
->bucket
,
3319 user_quota
, bucket_quota
, s
->obj_size
);
3321 ldout(s
->cct
, 20) << "second check_quota() returned op_ret=" << op_ret
<< dendl
;
3325 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
3327 ldout(s
->cct
, 20) << "check_bucket_shards() returned ret=" << op_ret
<< dendl
;
3333 if (compressor
&& compressor
->is_compressed()) {
3335 RGWCompressionInfo cs_info
;
3336 cs_info
.compression_type
= plugin
->get_type_name();
3337 cs_info
.orig_size
= s
->obj_size
;
3338 cs_info
.blocks
= move(compressor
->get_compression_blocks());
3339 ::encode(cs_info
, tmp
);
3340 attrs
[RGW_ATTR_COMPRESSION
] = tmp
;
3341 ldout(s
->cct
, 20) << "storing " << RGW_ATTR_COMPRESSION
3342 << " with type=" << cs_info
.compression_type
3343 << ", orig_size=" << cs_info
.orig_size
3344 << ", blocks=" << cs_info
.blocks
.size() << dendl
;
3347 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
3351 if (supplied_md5_b64
&& strcmp(calc_md5
, supplied_md5
)) {
3352 op_ret
= -ERR_BAD_DIGEST
;
3356 policy
.encode(aclbl
);
3357 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
3360 op_ret
= encode_dlo_manifest_attr(dlo_manifest
, attrs
);
3362 ldout(s
->cct
, 0) << "bad user manifest: " << dlo_manifest
<< dendl
;
3365 complete_etag(hash
, &etag
);
3366 ldout(s
->cct
, 10) << __func__
<< ": calculated md5 for user manifest: " << etag
<< dendl
;
3370 bufferlist manifest_bl
;
3371 ::encode(*slo_info
, manifest_bl
);
3372 emplace_attr(RGW_ATTR_SLO_MANIFEST
, std::move(manifest_bl
));
3374 hash
.Update((byte
*)slo_info
->raw_data
, slo_info
->raw_data_len
);
3375 complete_etag(hash
, &etag
);
3376 ldout(s
->cct
, 10) << __func__
<< ": calculated md5 for user manifest: " << etag
<< dendl
;
3379 if (supplied_etag
&& etag
.compare(supplied_etag
) != 0) {
3380 op_ret
= -ERR_UNPROCESSABLE_ENTITY
;
3383 bl
.append(etag
.c_str(), etag
.size() + 1);
3384 emplace_attr(RGW_ATTR_ETAG
, std::move(bl
));
3386 populate_with_generic_attrs(s
, attrs
);
3387 rgw_get_request_metadata(s
->cct
, s
->info
, attrs
);
3388 encode_delete_at_attr(delete_at
, attrs
);
3390 /* Add a custom metadata to expose the information whether an object
3391 * is an SLO or not. Appending the attribute must be performed AFTER
3392 * processing any input from user in order to prohibit overwriting. */
3394 bufferlist slo_userindicator_bl
;
3395 slo_userindicator_bl
.append("True", 4);
3396 emplace_attr(RGW_ATTR_SLO_UINDICATOR
, std::move(slo_userindicator_bl
));
3399 op_ret
= processor
->complete(s
->obj_size
, etag
, &mtime
, real_time(), attrs
,
3400 (delete_at
? *delete_at
: real_time()), if_match
, if_nomatch
,
3401 (user_data
.empty() ? nullptr : &user_data
));
3403 /* produce torrent */
3404 if (s
->cct
->_conf
->rgw_torrent_flag
&& (ofs
== torrent
.get_data_len()))
3406 torrent
.init(s
, store
);
3407 torrent
.set_create_date(mtime
);
3408 op_ret
= torrent
.complete();
3411 ldout(s
->cct
, 0) << "ERROR: torrent.handle_data() returned " << op_ret
<< dendl
;
3417 dispose_processor(processor
);
3418 perfcounter
->tinc(l_rgw_put_lat
,
3419 (ceph_clock_now() - s
->time
));
3422 int RGWPostObj::verify_permission()
3427 RGWPutObjProcessor *RGWPostObj::select_processor(RGWObjectCtx& obj_ctx)
3429 RGWPutObjProcessor *processor;
3431 uint64_t part_size = s->cct->_conf->rgw_obj_stripe_size;
3433 processor = new RGWPutObjProcessor_Atomic(obj_ctx, s->bucket_info, s->bucket, s->object.name, part_size, s->req_id, s->bucket_info.versioning_enabled());
3438 void RGWPostObj::dispose_processor(RGWPutObjDataProcessor *processor)
3443 void RGWPostObj::pre_exec()
3445 rgw_bucket_object_pre_exec(s
);
3448 void RGWPostObj::execute()
3450 RGWPutObjDataProcessor
*filter
= nullptr;
3451 boost::optional
<RGWPutObj_Compress
> compressor
;
3452 CompressorRef plugin
;
3454 /* Read in the data from the POST form. */
3455 op_ret
= get_params();
3460 op_ret
= verify_params();
3465 if (s
->iam_policy
) {
3466 auto e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
3467 rgw::IAM::s3PutObject
,
3468 rgw_obj(s
->bucket
, s
->object
));
3469 if (e
== Effect::Deny
) {
3472 } else if (e
== Effect::Pass
&& !verify_bucket_permission_no_policy(s
, RGW_PERM_WRITE
)) {
3476 } else if (!verify_bucket_permission_no_policy(s
, RGW_PERM_WRITE
)) {
3481 /* Start iteration over data fields. It's necessary as Swift's FormPost
3482 * is capable to handle multiple files in single form. */
3484 std::unique_ptr
<RGWPutObjDataProcessor
> encrypt
;
3485 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
3486 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
3488 ceph::buffer::list bl
, aclbl
;
3491 op_ret
= store
->check_quota(s
->bucket_owner
.get_id(),
3500 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
3505 RGWPutObjProcessor_Atomic
processor(*static_cast<RGWObjectCtx
*>(s
->obj_ctx
),
3508 get_current_filename(),
3510 s
->cct
->_conf
->rgw_obj_stripe_size
,
3512 s
->bucket_info
.versioning_enabled());
3513 /* No filters by default. */
3514 filter
= &processor
;
3516 op_ret
= processor
.prepare(store
, nullptr);
3521 op_ret
= get_encrypt_filter(&encrypt
, filter
);
3525 if (encrypt
!= nullptr) {
3526 filter
= encrypt
.get();
3528 const auto& compression_type
= store
->get_zone_params().get_compression_type(
3529 s
->bucket_info
.placement_rule
);
3530 if (compression_type
!= "none") {
3531 plugin
= Compressor::create(s
->cct
, compression_type
);
3533 ldout(s
->cct
, 1) << "Cannot load plugin for compression type "
3534 << compression_type
<< dendl
;
3536 compressor
.emplace(s
->cct
, plugin
, filter
);
3537 filter
= &*compressor
;
3544 ceph::bufferlist data
;
3545 len
= get_data(data
, again
);
3556 hash
.Update((const byte
*)data
.c_str(), data
.length());
3557 op_ret
= put_data_and_throttle(filter
, data
, ofs
, false);
3561 if (ofs
> max_len
) {
3562 op_ret
= -ERR_TOO_LARGE
;
3569 op_ret
= put_data_and_throttle(filter
, flush
, ofs
, false);
3572 if (len
< min_len
) {
3573 op_ret
= -ERR_TOO_SMALL
;
3579 op_ret
= store
->check_quota(s
->bucket_owner
.get_id(), s
->bucket
,
3580 user_quota
, bucket_quota
, s
->obj_size
);
3585 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
3591 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
3594 bl
.append(etag
.c_str(), etag
.size() + 1);
3595 emplace_attr(RGW_ATTR_ETAG
, std::move(bl
));
3597 policy
.encode(aclbl
);
3598 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
3600 const std::string content_type
= get_current_content_type();
3601 if (! content_type
.empty()) {
3602 ceph::bufferlist ct_bl
;
3603 ct_bl
.append(content_type
.c_str(), content_type
.size() + 1);
3604 emplace_attr(RGW_ATTR_CONTENT_TYPE
, std::move(ct_bl
));
3607 if (compressor
&& compressor
->is_compressed()) {
3608 ceph::bufferlist tmp
;
3609 RGWCompressionInfo cs_info
;
3610 cs_info
.compression_type
= plugin
->get_type_name();
3611 cs_info
.orig_size
= s
->obj_size
;
3612 cs_info
.blocks
= move(compressor
->get_compression_blocks());
3613 ::encode(cs_info
, tmp
);
3614 emplace_attr(RGW_ATTR_COMPRESSION
, std::move(tmp
));
3617 op_ret
= processor
.complete(s
->obj_size
, etag
, nullptr, real_time(),
3618 attrs
, (delete_at
? *delete_at
: real_time()));
3619 } while (is_next_file_to_upload());
3623 void RGWPutMetadataAccount::filter_out_temp_url(map
<string
, bufferlist
>& add_attrs
,
3624 const set
<string
>& rmattr_names
,
3625 map
<int, string
>& temp_url_keys
)
3627 map
<string
, bufferlist
>::iterator iter
;
3629 iter
= add_attrs
.find(RGW_ATTR_TEMPURL_KEY1
);
3630 if (iter
!= add_attrs
.end()) {
3631 temp_url_keys
[0] = iter
->second
.c_str();
3632 add_attrs
.erase(iter
);
3635 iter
= add_attrs
.find(RGW_ATTR_TEMPURL_KEY2
);
3636 if (iter
!= add_attrs
.end()) {
3637 temp_url_keys
[1] = iter
->second
.c_str();
3638 add_attrs
.erase(iter
);
3641 for (const string
& name
: rmattr_names
) {
3642 if (name
.compare(RGW_ATTR_TEMPURL_KEY1
) == 0) {
3643 temp_url_keys
[0] = string();
3645 if (name
.compare(RGW_ATTR_TEMPURL_KEY2
) == 0) {
3646 temp_url_keys
[1] = string();
3651 int RGWPutMetadataAccount::init_processing()
3653 /* First, go to the base class. At the time of writing the method was
3654 * responsible only for initializing the quota. This isn't necessary
3655 * here as we are touching metadata only. I'm putting this call only
3656 * for the future. */
3657 op_ret
= RGWOp::init_processing();
3662 op_ret
= get_params();
3667 op_ret
= rgw_get_user_attrs_by_uid(store
, s
->user
->user_id
, orig_attrs
,
3675 policy
.encode(acl_bl
);
3676 attrs
.emplace(RGW_ATTR_ACL
, std::move(acl_bl
));
3679 rgw_get_request_metadata(s
->cct
, s
->info
, attrs
, false);
3680 prepare_add_del_attrs(orig_attrs
, rmattr_names
, attrs
);
3681 populate_with_generic_attrs(s
, attrs
);
3683 /* Try extract the TempURL-related stuff now to allow verify_permission
3684 * evaluate whether we need FULL_CONTROL or not. */
3685 filter_out_temp_url(attrs
, rmattr_names
, temp_url_keys
);
3687 /* The same with quota except a client needs to be reseller admin. */
3688 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, new_quota
,
3689 &new_quota_extracted
);
3697 int RGWPutMetadataAccount::verify_permission()
3699 if (s
->auth
.identity
->is_anonymous()) {
3703 if (!verify_user_permission(s
, RGW_PERM_WRITE
)) {
3707 /* Altering TempURL keys requires FULL_CONTROL. */
3708 if (!temp_url_keys
.empty() && s
->perm_mask
!= RGW_PERM_FULL_CONTROL
) {
3712 /* We are failing this intensionally to allow system user/reseller admin
3713 * override in rgw_process.cc. This is the way to specify a given RGWOp
3714 * expect extra privileges. */
3715 if (new_quota_extracted
) {
3722 void RGWPutMetadataAccount::execute()
3724 /* Params have been extracted earlier. See init_processing(). */
3725 RGWUserInfo new_uinfo
;
3726 op_ret
= rgw_get_user_info_by_uid(store
, s
->user
->user_id
, new_uinfo
,
3732 /* Handle the TempURL-related stuff. */
3733 if (!temp_url_keys
.empty()) {
3734 for (auto& pair
: temp_url_keys
) {
3735 new_uinfo
.temp_url_keys
[pair
.first
] = std::move(pair
.second
);
3739 /* Handle the quota extracted at the verify_permission step. */
3740 if (new_quota_extracted
) {
3741 new_uinfo
.user_quota
= std::move(new_quota
);
3744 /* We are passing here the current (old) user info to allow the function
3745 * optimize-out some operations. */
3746 op_ret
= rgw_store_user_info(store
, new_uinfo
, s
->user
,
3747 &acct_op_tracker
, real_time(), false, &attrs
);
3750 int RGWPutMetadataBucket::verify_permission()
3752 if (!verify_bucket_permission_no_policy(s
, RGW_PERM_WRITE
)) {
3759 void RGWPutMetadataBucket::pre_exec()
3761 rgw_bucket_object_pre_exec(s
);
3764 void RGWPutMetadataBucket::execute()
3766 op_ret
= get_params();
3771 rgw_get_request_metadata(s
->cct
, s
->info
, attrs
, false);
3773 if (!placement_rule
.empty() &&
3774 placement_rule
!= s
->bucket_info
.placement_rule
) {
3779 /* Encode special metadata first as we're using std::map::emplace under
3780 * the hood. This method will add the new items only if the map doesn't
3781 * contain such keys yet. */
3783 if (s
->dialect
.compare("swift") == 0) {
3784 auto old_policy
= static_cast<RGWAccessControlPolicy_SWIFT
*>(s
->bucket_acl
);
3785 auto new_policy
= static_cast<RGWAccessControlPolicy_SWIFT
*>(&policy
);
3786 new_policy
->filter_merge(policy_rw_mask
, old_policy
);
3787 policy
= *new_policy
;
3791 emplace_attr(RGW_ATTR_ACL
, std::move(bl
));
3796 cors_config
.encode(bl
);
3797 emplace_attr(RGW_ATTR_CORS
, std::move(bl
));
3800 /* It's supposed that following functions WILL NOT change any special
3801 * attributes (like RGW_ATTR_ACL) if they are already present in attrs. */
3802 prepare_add_del_attrs(s
->bucket_attrs
, rmattr_names
, attrs
);
3803 populate_with_generic_attrs(s
, attrs
);
3805 /* According to the Swift's behaviour and its container_quota WSGI middleware
3806 * implementation: anyone with write permissions is able to set the bucket
3807 * quota. This stays in contrast to account quotas that can be set only by
3808 * clients holding reseller admin privileges. */
3809 op_ret
= filter_out_quota_info(attrs
, rmattr_names
, s
->bucket_info
.quota
);
3814 if (swift_ver_location
) {
3815 s
->bucket_info
.swift_ver_location
= *swift_ver_location
;
3816 s
->bucket_info
.swift_versioning
= (! swift_ver_location
->empty());
3819 /* Web site of Swift API. */
3820 filter_out_website(attrs
, rmattr_names
, s
->bucket_info
.website_conf
);
3821 s
->bucket_info
.has_website
= !s
->bucket_info
.website_conf
.is_empty();
3823 /* Setting attributes also stores the provided bucket info. Due to this
3824 * fact, the new quota settings can be serialized with the same call. */
3825 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
,
3826 &s
->bucket_info
.objv_tracker
);
3829 int RGWPutMetadataObject::verify_permission()
3831 // This looks to be something specific to Swift. We could add
3832 // operations like swift:PutMetadataObject to the Policy Engine.
3833 if (!verify_object_permission_no_policy(s
, RGW_PERM_WRITE
)) {
3840 void RGWPutMetadataObject::pre_exec()
3842 rgw_bucket_object_pre_exec(s
);
3845 void RGWPutMetadataObject::execute()
3847 rgw_obj
obj(s
->bucket
, s
->object
);
3848 map
<string
, bufferlist
> attrs
, orig_attrs
, rmattrs
;
3850 store
->set_atomic(s
->obj_ctx
, obj
);
3852 op_ret
= get_params();
3857 rgw_get_request_metadata(s
->cct
, s
->info
, attrs
);
3858 /* check if obj exists, read orig attrs */
3859 op_ret
= get_obj_attrs(store
, s
, obj
, orig_attrs
);
3864 /* Check whether the object has expired. Swift API documentation
3865 * stands that we should return 404 Not Found in such case. */
3866 if (need_object_expiration() && object_is_expired(orig_attrs
)) {
3871 /* Filter currently existing attributes. */
3872 prepare_add_del_attrs(orig_attrs
, attrs
, rmattrs
);
3873 populate_with_generic_attrs(s
, attrs
);
3874 encode_delete_at_attr(delete_at
, attrs
);
3877 op_ret
= encode_dlo_manifest_attr(dlo_manifest
, attrs
);
3879 ldout(s
->cct
, 0) << "bad user manifest: " << dlo_manifest
<< dendl
;
3884 op_ret
= store
->set_attrs(s
->obj_ctx
, s
->bucket_info
, obj
, attrs
, &rmattrs
);
3887 int RGWDeleteObj::handle_slo_manifest(bufferlist
& bl
)
3889 RGWSLOInfo slo_info
;
3890 bufferlist::iterator bliter
= bl
.begin();
3892 ::decode(slo_info
, bliter
);
3893 } catch (buffer::error
& err
) {
3894 ldout(s
->cct
, 0) << "ERROR: failed to decode slo manifest" << dendl
;
3899 deleter
= std::unique_ptr
<RGWBulkDelete::Deleter
>(\
3900 new RGWBulkDelete::Deleter(store
, s
));
3901 } catch (std::bad_alloc
) {
3905 list
<RGWBulkDelete::acct_path_t
> items
;
3906 for (const auto& iter
: slo_info
.entries
) {
3907 const string
& path_str
= iter
.path
;
3909 const size_t sep_pos
= path_str
.find('/', 1 /* skip first slash */);
3910 if (boost::string_view::npos
== sep_pos
) {
3914 RGWBulkDelete::acct_path_t path
;
3916 path
.bucket_name
= url_decode(path_str
.substr(1, sep_pos
- 1));
3917 path
.obj_key
= url_decode(path_str
.substr(sep_pos
+ 1));
3919 items
.push_back(path
);
3922 /* Request removal of the manifest object itself. */
3923 RGWBulkDelete::acct_path_t path
;
3924 path
.bucket_name
= s
->bucket_name
;
3925 path
.obj_key
= s
->object
;
3926 items
.push_back(path
);
3928 int ret
= deleter
->delete_chunk(items
);
3936 int RGWDeleteObj::verify_permission()
3938 if (s
->iam_policy
) {
3939 auto r
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
3940 s
->object
.instance
.empty() ?
3941 rgw::IAM::s3DeleteObject
:
3942 rgw::IAM::s3DeleteObjectVersion
,
3943 ARN(s
->bucket
, s
->object
.name
));
3944 if (r
== Effect::Allow
)
3946 else if (r
== Effect::Deny
)
3950 if (!verify_bucket_permission_no_policy(s
, RGW_PERM_WRITE
)) {
3957 void RGWDeleteObj::pre_exec()
3959 rgw_bucket_object_pre_exec(s
);
3962 void RGWDeleteObj::execute()
3964 if (!s
->bucket_exists
) {
3965 op_ret
= -ERR_NO_SUCH_BUCKET
;
3969 op_ret
= get_params();
3974 rgw_obj
obj(s
->bucket
, s
->object
);
3975 map
<string
, bufferlist
> attrs
;
3978 if (!s
->object
.empty()) {
3979 if (need_object_expiration() || multipart_delete
) {
3980 /* check if obj exists, read orig attrs */
3981 op_ret
= get_obj_attrs(store
, s
, obj
, attrs
);
3987 if (multipart_delete
) {
3988 const auto slo_attr
= attrs
.find(RGW_ATTR_SLO_MANIFEST
);
3990 if (slo_attr
!= attrs
.end()) {
3991 op_ret
= handle_slo_manifest(slo_attr
->second
);
3993 ldout(s
->cct
, 0) << "ERROR: failed to handle slo manifest ret=" << op_ret
<< dendl
;
3996 op_ret
= -ERR_NOT_SLO_MANIFEST
;
4002 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
4003 obj_ctx
->obj
.set_atomic(obj
);
4005 bool ver_restored
= false;
4006 op_ret
= store
->swift_versioning_restore(*obj_ctx
, s
->bucket_owner
.get_id(),
4007 s
->bucket_info
, obj
, ver_restored
);
4012 if (!ver_restored
) {
4013 /* Swift's versioning mechanism hasn't found any previous version of
4014 * the object that could be restored. This means we should proceed
4015 * with the regular delete path. */
4016 RGWRados::Object
del_target(store
, s
->bucket_info
, *obj_ctx
, obj
);
4017 RGWRados::Object::Delete
del_op(&del_target
);
4019 op_ret
= get_system_versioning_params(s
, &del_op
.params
.olh_epoch
,
4020 &del_op
.params
.marker_version_id
);
4025 del_op
.params
.bucket_owner
= s
->bucket_owner
.get_id();
4026 del_op
.params
.versioning_status
= s
->bucket_info
.versioning_status();
4027 del_op
.params
.obj_owner
= s
->owner
;
4028 del_op
.params
.unmod_since
= unmod_since
;
4029 del_op
.params
.high_precision_time
= s
->system_request
; /* system request uses high precision time */
4031 op_ret
= del_op
.delete_obj();
4033 delete_marker
= del_op
.result
.delete_marker
;
4034 version_id
= del_op
.result
.version_id
;
4037 /* Check whether the object has expired. Swift API documentation
4038 * stands that we should return 404 Not Found in such case. */
4039 if (need_object_expiration() && object_is_expired(attrs
)) {
4045 if (op_ret
== -ERR_PRECONDITION_FAILED
&& no_precondition_error
) {
4054 bool RGWCopyObj::parse_copy_location(const string
& url_src
, string
& bucket_name
, rgw_obj_key
& key
)
4059 size_t pos
= url_src
.find('?');
4060 if (pos
== string::npos
) {
4063 name_str
= url_src
.substr(0, pos
);
4064 params_str
= url_src
.substr(pos
+ 1);
4067 std::string dec_src
= url_decode(name_str
);
4068 const char *src
= dec_src
.c_str();
4070 if (*src
== '/') ++src
;
4074 pos
= str
.find('/');
4075 if (pos
==string::npos
)
4078 bucket_name
= str
.substr(0, pos
);
4079 key
.name
= str
.substr(pos
+ 1);
4081 if (key
.name
.empty()) {
4085 if (!params_str
.empty()) {
4087 args
.set(params_str
);
4090 key
.instance
= args
.get("versionId", NULL
);
4096 int RGWCopyObj::verify_permission()
4098 RGWAccessControlPolicy
src_acl(s
->cct
);
4099 optional
<Policy
> src_policy
;
4100 op_ret
= get_params();
4104 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
4108 map
<string
, bufferlist
> src_attrs
;
4110 RGWObjectCtx
& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
4112 if (s
->bucket_instance_id
.empty()) {
4113 op_ret
= store
->get_bucket_info(obj_ctx
, src_tenant_name
, src_bucket_name
, src_bucket_info
, NULL
, &src_attrs
);
4115 /* will only happen in intra region sync where the source and dest bucket is the same */
4116 op_ret
= store
->get_bucket_instance_info(obj_ctx
, s
->bucket_instance_id
, src_bucket_info
, NULL
, &src_attrs
);
4119 if (op_ret
== -ENOENT
) {
4120 op_ret
= -ERR_NO_SUCH_BUCKET
;
4125 src_bucket
= src_bucket_info
.bucket
;
4127 /* get buckets info (source and dest) */
4128 if (s
->local_source
&& source_zone
.empty()) {
4129 rgw_obj
src_obj(src_bucket
, src_object
);
4130 store
->set_atomic(s
->obj_ctx
, src_obj
);
4131 store
->set_prefetch_data(s
->obj_ctx
, src_obj
);
4133 /* check source object permissions */
4134 op_ret
= read_obj_policy(store
, s
, src_bucket_info
, src_attrs
, &src_acl
,
4135 src_policy
, src_bucket
, src_object
);
4140 /* admin request overrides permission checks */
4141 if (!s
->auth
.identity
->is_admin_of(src_acl
.get_owner().get_id())) {
4143 auto e
= src_policy
->eval(s
->env
, *s
->auth
.identity
,
4144 src_object
.instance
.empty() ?
4145 rgw::IAM::s3GetObject
:
4146 rgw::IAM::s3GetObjectVersion
,
4148 if (e
== Effect::Deny
) {
4150 } else if (e
== Effect::Pass
&&
4151 !src_acl
.verify_permission(*s
->auth
.identity
, s
->perm_mask
,
4155 } else if (!src_acl
.verify_permission(*s
->auth
.identity
,
4163 RGWAccessControlPolicy
dest_bucket_policy(s
->cct
);
4164 map
<string
, bufferlist
> dest_attrs
;
4166 if (src_bucket_name
.compare(dest_bucket_name
) == 0) { /* will only happen if s->local_source
4167 or intra region sync */
4168 dest_bucket_info
= src_bucket_info
;
4169 dest_attrs
= src_attrs
;
4171 op_ret
= store
->get_bucket_info(obj_ctx
, dest_tenant_name
, dest_bucket_name
,
4172 dest_bucket_info
, nullptr, &dest_attrs
);
4174 if (op_ret
== -ENOENT
) {
4175 op_ret
= -ERR_NO_SUCH_BUCKET
;
4181 dest_bucket
= dest_bucket_info
.bucket
;
4183 rgw_obj
dest_obj(dest_bucket
, dest_object
);
4184 store
->set_atomic(s
->obj_ctx
, dest_obj
);
4186 /* check dest bucket permissions */
4187 op_ret
= read_bucket_policy(store
, s
, dest_bucket_info
, dest_attrs
,
4188 &dest_bucket_policy
, dest_bucket
);
4193 /* admin request overrides permission checks */
4194 if (! s
->auth
.identity
->is_admin_of(dest_policy
.get_owner().get_id()) &&
4195 ! dest_bucket_policy
.verify_permission(*s
->auth
.identity
, s
->perm_mask
,
4200 op_ret
= init_dest_policy();
4209 int RGWCopyObj::init_common()
4212 if (parse_time(if_mod
, &mod_time
) < 0) {
4216 mod_ptr
= &mod_time
;
4220 if (parse_time(if_unmod
, &unmod_time
) < 0) {
4224 unmod_ptr
= &unmod_time
;
4228 dest_policy
.encode(aclbl
);
4229 emplace_attr(RGW_ATTR_ACL
, std::move(aclbl
));
4231 rgw_get_request_metadata(s
->cct
, s
->info
, attrs
);
4232 populate_with_generic_attrs(s
, attrs
);
4237 static void copy_obj_progress_cb(off_t ofs
, void *param
)
4239 RGWCopyObj
*op
= static_cast<RGWCopyObj
*>(param
);
4240 op
->progress_cb(ofs
);
4243 void RGWCopyObj::progress_cb(off_t ofs
)
4245 if (!s
->cct
->_conf
->rgw_copy_obj_progress
)
4248 if (ofs
- last_ofs
< s
->cct
->_conf
->rgw_copy_obj_progress_every_bytes
)
4251 send_partial_response(ofs
);
4256 void RGWCopyObj::pre_exec()
4258 rgw_bucket_object_pre_exec(s
);
4261 void RGWCopyObj::execute()
4263 if (init_common() < 0)
4266 rgw_obj
src_obj(src_bucket
, src_object
);
4267 rgw_obj
dst_obj(dest_bucket
, dest_object
);
4269 RGWObjectCtx
& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
4270 obj_ctx
.obj
.set_atomic(src_obj
);
4271 obj_ctx
.obj
.set_atomic(dst_obj
);
4273 encode_delete_at_attr(delete_at
, attrs
);
4275 bool high_precision_time
= (s
->system_request
);
4277 /* Handle object versioning of Swift API. In case of copying to remote this
4278 * should fail gently (op_ret == 0) as the dst_obj will not exist here. */
4279 op_ret
= store
->swift_versioning_copy(obj_ctx
,
4280 dest_bucket_info
.owner
,
4287 op_ret
= store
->copy_obj(obj_ctx
,
4301 high_precision_time
,
4306 attrs
, RGW_OBJ_CATEGORY_MAIN
,
4308 (delete_at
? *delete_at
: real_time()),
4309 (version_id
.empty() ? NULL
: &version_id
),
4310 &s
->req_id
, /* use req_id as tag */
4312 copy_obj_progress_cb
, (void *)this
4316 int RGWGetACLs::verify_permission()
4319 if (!s
->object
.empty()) {
4320 perm
= verify_object_permission(s
,
4321 s
->object
.instance
.empty() ?
4322 rgw::IAM::s3GetObjectAcl
:
4323 rgw::IAM::s3GetObjectVersionAcl
);
4325 perm
= verify_bucket_permission(s
, rgw::IAM::s3GetObjectAcl
);
4333 void RGWGetACLs::pre_exec()
4335 rgw_bucket_object_pre_exec(s
);
4338 void RGWGetACLs::execute()
4341 RGWAccessControlPolicy
*acl
= (!s
->object
.empty() ? s
->object_acl
: s
->bucket_acl
);
4342 RGWAccessControlPolicy_S3
*s3policy
= static_cast<RGWAccessControlPolicy_S3
*>(acl
);
4343 s3policy
->to_xml(ss
);
4349 int RGWPutACLs::verify_permission()
4352 if (!s
->object
.empty()) {
4353 perm
= verify_object_permission(s
,
4354 s
->object
.instance
.empty() ?
4355 rgw::IAM::s3PutObjectAcl
:
4356 rgw::IAM::s3PutObjectVersionAcl
);
4358 perm
= verify_bucket_permission(s
, rgw::IAM::s3PutBucketAcl
);
4366 int RGWGetLC::verify_permission()
4369 perm
= verify_bucket_permission(s
, rgw::IAM::s3GetLifecycleConfiguration
);
4376 int RGWPutLC::verify_permission()
4379 perm
= verify_bucket_permission(s
, rgw::IAM::s3PutLifecycleConfiguration
);
4386 int RGWDeleteLC::verify_permission()
4389 perm
= verify_bucket_permission(s
, rgw::IAM::s3PutLifecycleConfiguration
);
4396 void RGWPutACLs::pre_exec()
4398 rgw_bucket_object_pre_exec(s
);
4401 void RGWGetLC::pre_exec()
4403 rgw_bucket_object_pre_exec(s
);
4406 void RGWPutLC::pre_exec()
4408 rgw_bucket_object_pre_exec(s
);
4411 void RGWDeleteLC::pre_exec()
4413 rgw_bucket_object_pre_exec(s
);
4416 void RGWPutACLs::execute()
4420 RGWAccessControlPolicy_S3
*policy
= NULL
;
4421 RGWACLXMLParser_S3
parser(s
->cct
);
4422 RGWAccessControlPolicy_S3
new_policy(s
->cct
);
4424 char *new_data
= NULL
;
4427 op_ret
= 0; /* XXX redundant? */
4429 if (!parser
.init()) {
4435 RGWAccessControlPolicy
*existing_policy
= (s
->object
.empty() ? s
->bucket_acl
: s
->object_acl
);
4437 owner
= existing_policy
->get_owner();
4439 op_ret
= get_params();
4443 ldout(s
->cct
, 15) << "read len=" << len
<< " data=" << (data
? data
: "") << dendl
;
4445 if (!s
->canned_acl
.empty() && len
) {
4450 if (!s
->canned_acl
.empty() || s
->has_acl_header
) {
4451 op_ret
= get_policy_from_state(store
, s
, ss
);
4455 new_data
= strdup(ss
.str().c_str());
4458 len
= ss
.str().size();
4461 if (!parser
.parse(data
, len
, 1)) {
4465 policy
= static_cast<RGWAccessControlPolicy_S3
*>(parser
.find_first("AccessControlPolicy"));
4471 // forward bucket acl requests to meta master zone
4472 if (s
->object
.empty() && !store
->is_meta_master()) {
4474 // include acl data unless it was generated from a canned_acl
4475 if (s
->canned_acl
.empty()) {
4476 in_data
.append(data
, len
);
4478 op_ret
= forward_request_to_master(s
, NULL
, store
, in_data
, NULL
);
4480 ldout(s
->cct
, 20) << __func__
<< "forward_request_to_master returned ret=" << op_ret
<< dendl
;
4485 if (s
->cct
->_conf
->subsys
.should_gather(ceph_subsys_rgw
, 15)) {
4486 ldout(s
->cct
, 15) << "Old AccessControlPolicy";
4487 policy
->to_xml(*_dout
);
4491 op_ret
= policy
->rebuild(store
, &owner
, new_policy
);
4495 if (s
->cct
->_conf
->subsys
.should_gather(ceph_subsys_rgw
, 15)) {
4496 ldout(s
->cct
, 15) << "New AccessControlPolicy:";
4497 new_policy
.to_xml(*_dout
);
4501 new_policy
.encode(bl
);
4502 map
<string
, bufferlist
> attrs
;
4504 if (!s
->object
.empty()) {
4505 obj
= rgw_obj(s
->bucket
, s
->object
);
4506 store
->set_atomic(s
->obj_ctx
, obj
);
4507 //if instance is empty, we should modify the latest object
4508 op_ret
= modify_obj_attr(store
, s
, obj
, RGW_ATTR_ACL
, bl
);
4510 attrs
= s
->bucket_attrs
;
4511 attrs
[RGW_ATTR_ACL
] = bl
;
4512 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
, &s
->bucket_info
.objv_tracker
);
4514 if (op_ret
== -ECANCELED
) {
4515 op_ret
= 0; /* lost a race, but it's ok because acls are immutable */
4519 static void get_lc_oid(struct req_state
*s
, string
& oid
)
4521 string shard_id
= s
->bucket
.name
+ ':' +s
->bucket
.bucket_id
;
4522 int max_objs
= (s
->cct
->_conf
->rgw_lc_max_objs
> HASH_PRIME
)?HASH_PRIME
:s
->cct
->_conf
->rgw_lc_max_objs
;
4523 int index
= ceph_str_hash_linux(shard_id
.c_str(), shard_id
.size()) % HASH_PRIME
% max_objs
;
4524 oid
= lc_oid_prefix
;
4526 snprintf(buf
, 32, ".%d", index
);
4531 void RGWPutLC::execute()
4535 RGWLifecycleConfiguration_S3
*config
= NULL
;
4536 RGWLCXMLParser_S3
parser(s
->cct
);
4537 RGWLifecycleConfiguration_S3
new_config(s
->cct
);
4539 if (!parser
.init()) {
4544 op_ret
= get_params();
4548 ldout(s
->cct
, 15) << "read len=" << len
<< " data=" << (data
? data
: "") << dendl
;
4550 if (!parser
.parse(data
, len
, 1)) {
4551 op_ret
= -ERR_MALFORMED_XML
;
4554 config
= static_cast<RGWLifecycleConfiguration_S3
*>(parser
.find_first("LifecycleConfiguration"));
4556 op_ret
= -ERR_MALFORMED_XML
;
4560 if (s
->cct
->_conf
->subsys
.should_gather(ceph_subsys_rgw
, 15)) {
4561 ldout(s
->cct
, 15) << "Old LifecycleConfiguration:";
4562 config
->to_xml(*_dout
);
4566 op_ret
= config
->rebuild(store
, new_config
);
4570 if (s
->cct
->_conf
->subsys
.should_gather(ceph_subsys_rgw
, 15)) {
4571 ldout(s
->cct
, 15) << "New LifecycleConfiguration:";
4572 new_config
.to_xml(*_dout
);
4576 new_config
.encode(bl
);
4577 map
<string
, bufferlist
> attrs
;
4578 attrs
= s
->bucket_attrs
;
4579 attrs
[RGW_ATTR_LC
] = bl
;
4580 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
, &s
->bucket_info
.objv_tracker
);
4583 string shard_id
= s
->bucket
.tenant
+ ':' + s
->bucket
.name
+ ':' + s
->bucket
.bucket_id
;
4586 pair
<string
, int> entry(shard_id
, lc_uninitial
);
4587 int max_lock_secs
= s
->cct
->_conf
->rgw_lc_lock_max_time
;
4588 rados::cls::lock::Lock
l(lc_index_lock_name
);
4589 utime_t
time(max_lock_secs
, 0);
4590 l
.set_duration(time
);
4591 l
.set_cookie(cookie
);
4592 librados::IoCtx
*ctx
= store
->get_lc_pool_ctx();
4594 op_ret
= l
.lock_exclusive(ctx
, oid
);
4595 if (op_ret
== -EBUSY
) {
4596 dout(0) << "RGWLC::RGWPutLC() failed to acquire lock on, sleep 5, try again" << oid
<< dendl
;
4601 dout(0) << "RGWLC::RGWPutLC() failed to acquire lock " << oid
<< op_ret
<< dendl
;
4604 op_ret
= cls_rgw_lc_set_entry(*ctx
, oid
, entry
);
4606 dout(0) << "RGWLC::RGWPutLC() failed to set entry " << oid
<< op_ret
<< dendl
;
4614 void RGWDeleteLC::execute()
4617 map
<string
, bufferlist
> orig_attrs
, attrs
;
4618 map
<string
, bufferlist
>::iterator iter
;
4620 store
->get_bucket_instance_obj(s
->bucket
, obj
);
4621 store
->set_prefetch_data(s
->obj_ctx
, obj
);
4622 op_ret
= get_system_obj_attrs(store
, s
, obj
, orig_attrs
, NULL
, &s
->bucket_info
.objv_tracker
);
4626 for (iter
= orig_attrs
.begin(); iter
!= orig_attrs
.end(); ++iter
) {
4627 const string
& name
= iter
->first
;
4628 dout(10) << "DeleteLC : attr: " << name
<< dendl
;
4629 if (name
.compare(0, (sizeof(RGW_ATTR_LC
) - 1), RGW_ATTR_LC
) != 0) {
4630 if (attrs
.find(name
) == attrs
.end()) {
4631 attrs
[name
] = iter
->second
;
4635 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
, &s
->bucket_info
.objv_tracker
);
4636 string shard_id
= s
->bucket
.name
+ ':' +s
->bucket
.bucket_id
;
4637 pair
<string
, int> entry(shard_id
, lc_uninitial
);
4640 int max_lock_secs
= s
->cct
->_conf
->rgw_lc_lock_max_time
;
4641 librados::IoCtx
*ctx
= store
->get_lc_pool_ctx();
4642 rados::cls::lock::Lock
l(lc_index_lock_name
);
4643 utime_t
time(max_lock_secs
, 0);
4644 l
.set_duration(time
);
4646 op_ret
= l
.lock_exclusive(ctx
, oid
);
4647 if (op_ret
== -EBUSY
) {
4648 dout(0) << "RGWLC::RGWDeleteLC() failed to acquire lock on, sleep 5, try again" << oid
<< dendl
;
4653 dout(0) << "RGWLC::RGWDeleteLC() failed to acquire lock " << oid
<< op_ret
<< dendl
;
4656 op_ret
= cls_rgw_lc_rm_entry(*ctx
, oid
, entry
);
4658 dout(0) << "RGWLC::RGWDeleteLC() failed to set entry " << oid
<< op_ret
<< dendl
;
4666 int RGWGetCORS::verify_permission()
4668 if (false == s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
4675 void RGWGetCORS::execute()
4677 op_ret
= read_bucket_cors();
4682 dout(2) << "No CORS configuration set yet for this bucket" << dendl
;
4688 int RGWPutCORS::verify_permission()
4690 if (false == s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
4697 void RGWPutCORS::execute()
4701 op_ret
= get_params();
4705 if (!store
->is_meta_master()) {
4706 op_ret
= forward_request_to_master(s
, NULL
, store
, in_data
, nullptr);
4708 ldout(s
->cct
, 20) << __func__
<< "forward_request_to_master returned ret=" << op_ret
<< dendl
;
4713 map
<string
, bufferlist
> attrs
= s
->bucket_attrs
;
4714 attrs
[RGW_ATTR_CORS
] = cors_bl
;
4715 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
, &s
->bucket_info
.objv_tracker
);
4718 int RGWDeleteCORS::verify_permission()
4720 if (false == s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
4727 void RGWDeleteCORS::execute()
4729 op_ret
= read_bucket_cors();
4736 dout(2) << "No CORS configuration set yet for this bucket" << dendl
;
4740 store
->get_bucket_instance_obj(s
->bucket
, obj
);
4741 store
->set_prefetch_data(s
->obj_ctx
, obj
);
4742 map
<string
, bufferlist
> orig_attrs
, attrs
, rmattrs
;
4743 map
<string
, bufferlist
>::iterator iter
;
4745 op_ret
= get_system_obj_attrs(store
, s
, obj
, orig_attrs
, NULL
, &s
->bucket_info
.objv_tracker
);
4749 /* only remove meta attrs */
4750 for (iter
= orig_attrs
.begin(); iter
!= orig_attrs
.end(); ++iter
) {
4751 const string
& name
= iter
->first
;
4752 dout(10) << "DeleteCORS : attr: " << name
<< dendl
;
4753 if (name
.compare(0, (sizeof(RGW_ATTR_CORS
) - 1), RGW_ATTR_CORS
) == 0) {
4754 rmattrs
[name
] = iter
->second
;
4755 } else if (attrs
.find(name
) == attrs
.end()) {
4756 attrs
[name
] = iter
->second
;
4759 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
, &s
->bucket_info
.objv_tracker
);
4762 void RGWOptionsCORS::get_response_params(string
& hdrs
, string
& exp_hdrs
, unsigned *max_age
) {
4763 get_cors_response_headers(rule
, req_hdrs
, hdrs
, exp_hdrs
, max_age
);
4766 int RGWOptionsCORS::validate_cors_request(RGWCORSConfiguration
*cc
) {
4767 rule
= cc
->host_name_rule(origin
);
4769 dout(10) << "There is no cors rule present for " << origin
<< dendl
;
4773 if (!validate_cors_rule_method(rule
, req_meth
)) {
4779 void RGWOptionsCORS::execute()
4781 op_ret
= read_bucket_cors();
4785 origin
= s
->info
.env
->get("HTTP_ORIGIN");
4788 "Preflight request without mandatory Origin header"
4793 req_meth
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
4796 "Preflight request without mandatory Access-control-request-method header"
4802 dout(2) << "No CORS configuration set yet for this bucket" << dendl
;
4806 req_hdrs
= s
->info
.env
->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
4807 op_ret
= validate_cors_request(&bucket_cors
);
4809 origin
= req_meth
= NULL
;
4815 int RGWGetRequestPayment::verify_permission()
4820 void RGWGetRequestPayment::pre_exec()
4822 rgw_bucket_object_pre_exec(s
);
4825 void RGWGetRequestPayment::execute()
4827 requester_pays
= s
->bucket_info
.requester_pays
;
4830 int RGWSetRequestPayment::verify_permission()
4832 if (false == s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
4839 void RGWSetRequestPayment::pre_exec()
4841 rgw_bucket_object_pre_exec(s
);
4844 void RGWSetRequestPayment::execute()
4846 op_ret
= get_params();
4851 s
->bucket_info
.requester_pays
= requester_pays
;
4852 op_ret
= store
->put_bucket_instance_info(s
->bucket_info
, false, real_time(),
4855 ldout(s
->cct
, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
4856 << " returned err=" << op_ret
<< dendl
;
4861 int RGWInitMultipart::verify_permission()
4863 if (s
->iam_policy
) {
4864 auto e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
4865 rgw::IAM::s3PutObject
,
4866 rgw_obj(s
->bucket
, s
->object
));
4867 if (e
== Effect::Allow
) {
4869 } else if (e
== Effect::Deny
) {
4874 if (!verify_bucket_permission_no_policy(s
, RGW_PERM_WRITE
)) {
4881 void RGWInitMultipart::pre_exec()
4883 rgw_bucket_object_pre_exec(s
);
4886 void RGWInitMultipart::execute()
4889 map
<string
, bufferlist
> attrs
;
4892 if (get_params() < 0)
4895 if (s
->object
.empty())
4898 policy
.encode(aclbl
);
4899 attrs
[RGW_ATTR_ACL
] = aclbl
;
4901 populate_with_generic_attrs(s
, attrs
);
4903 /* select encryption mode */
4904 op_ret
= prepare_encryption(attrs
);
4908 rgw_get_request_metadata(s
->cct
, s
->info
, attrs
);
4912 gen_rand_alphanumeric(s
->cct
, buf
, sizeof(buf
) - 1);
4913 upload_id
= MULTIPART_UPLOAD_ID_PREFIX
; /* v2 upload id */
4914 upload_id
.append(buf
);
4916 string tmp_obj_name
;
4917 RGWMPObj
mp(s
->object
.name
, upload_id
);
4918 tmp_obj_name
= mp
.get_meta();
4920 obj
.init_ns(s
->bucket
, tmp_obj_name
, mp_ns
);
4921 // the meta object will be indexed with 0 size, we c
4922 obj
.set_in_extra_data(true);
4923 obj
.index_hash_source
= s
->object
.name
;
4925 RGWRados::Object
op_target(store
, s
->bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), obj
);
4926 op_target
.set_versioning_disabled(true); /* no versioning for multipart meta */
4928 RGWRados::Object::Write
obj_op(&op_target
);
4930 obj_op
.meta
.owner
= s
->owner
.get_id();
4931 obj_op
.meta
.category
= RGW_OBJ_CATEGORY_MULTIMETA
;
4932 obj_op
.meta
.flags
= PUT_OBJ_CREATE_EXCL
;
4934 op_ret
= obj_op
.write_meta(0, 0, attrs
);
4935 } while (op_ret
== -EEXIST
);
4938 static int get_multipart_info(RGWRados
*store
, struct req_state
*s
,
4940 RGWAccessControlPolicy
*policy
,
4941 map
<string
, bufferlist
>& attrs
)
4943 map
<string
, bufferlist
>::iterator iter
;
4947 obj
.init_ns(s
->bucket
, meta_oid
, mp_ns
);
4948 obj
.set_in_extra_data(true);
4950 int op_ret
= get_obj_attrs(store
, s
, obj
, attrs
);
4952 if (op_ret
== -ENOENT
) {
4953 return -ERR_NO_SUCH_UPLOAD
;
4959 for (iter
= attrs
.begin(); iter
!= attrs
.end(); ++iter
) {
4960 string name
= iter
->first
;
4961 if (name
.compare(RGW_ATTR_ACL
) == 0) {
4962 bufferlist
& bl
= iter
->second
;
4963 bufferlist::iterator bli
= bl
.begin();
4965 ::decode(*policy
, bli
);
4966 } catch (buffer::error
& err
) {
4967 ldout(s
->cct
, 0) << "ERROR: could not decode policy, caught buffer::error" << dendl
;
4978 int RGWCompleteMultipart::verify_permission()
4980 if (s
->iam_policy
) {
4981 auto e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
4982 rgw::IAM::s3PutObject
,
4983 rgw_obj(s
->bucket
, s
->object
));
4984 if (e
== Effect::Allow
) {
4986 } else if (e
== Effect::Deny
) {
4991 if (!verify_bucket_permission_no_policy(s
, RGW_PERM_WRITE
)) {
4998 void RGWCompleteMultipart::pre_exec()
5000 rgw_bucket_object_pre_exec(s
);
5003 void RGWCompleteMultipart::execute()
5005 RGWMultiCompleteUpload
*parts
;
5006 map
<int, string
>::iterator iter
;
5007 RGWMultiXMLParser parser
;
5009 map
<uint32_t, RGWUploadPartInfo
> obj_parts
;
5010 map
<uint32_t, RGWUploadPartInfo
>::iterator obj_iter
;
5011 map
<string
, bufferlist
> attrs
;
5014 char final_etag
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
5015 char final_etag_str
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 16];
5020 RGWObjManifest manifest
;
5021 uint64_t olh_epoch
= 0;
5024 op_ret
= get_params();
5027 op_ret
= get_system_versioning_params(s
, &olh_epoch
, &version_id
);
5032 if (!data
|| !len
) {
5033 op_ret
= -ERR_MALFORMED_XML
;
5037 if (!parser
.init()) {
5042 if (!parser
.parse(data
, len
, 1)) {
5043 op_ret
= -ERR_MALFORMED_XML
;
5047 parts
= static_cast<RGWMultiCompleteUpload
*>(parser
.find_first("CompleteMultipartUpload"));
5048 if (!parts
|| parts
->parts
.empty()) {
5049 op_ret
= -ERR_MALFORMED_XML
;
5053 if ((int)parts
->parts
.size() >
5054 s
->cct
->_conf
->rgw_multipart_part_upload_limit
) {
5059 mp
.init(s
->object
.name
, upload_id
);
5060 meta_oid
= mp
.get_meta();
5062 int total_parts
= 0;
5063 int handled_parts
= 0;
5064 int max_parts
= 1000;
5067 RGWCompressionInfo cs_info
;
5068 bool compressed
= false;
5069 uint64_t accounted_size
= 0;
5071 uint64_t min_part_size
= s
->cct
->_conf
->rgw_multipart_min_part_size
;
5073 list
<rgw_obj_index_key
> remove_objs
; /* objects to be removed from index listing */
5075 bool versioned_object
= s
->bucket_info
.versioning_enabled();
5077 iter
= parts
->parts
.begin();
5079 meta_obj
.init_ns(s
->bucket
, meta_oid
, mp_ns
);
5080 meta_obj
.set_in_extra_data(true);
5081 meta_obj
.index_hash_source
= s
->object
.name
;
5083 op_ret
= get_obj_attrs(store
, s
, meta_obj
, attrs
);
5086 ldout(s
->cct
, 0) << "ERROR: failed to get obj attrs, obj=" << meta_obj
5087 << " ret=" << op_ret
<< dendl
;
5092 op_ret
= list_multipart_parts(store
, s
, upload_id
, meta_oid
, max_parts
,
5093 marker
, obj_parts
, &marker
, &truncated
);
5094 if (op_ret
== -ENOENT
) {
5095 op_ret
= -ERR_NO_SUCH_UPLOAD
;
5100 total_parts
+= obj_parts
.size();
5101 if (!truncated
&& total_parts
!= (int)parts
->parts
.size()) {
5102 ldout(s
->cct
, 0) << "NOTICE: total parts mismatch: have: " << total_parts
5103 << " expected: " << parts
->parts
.size() << dendl
;
5104 op_ret
= -ERR_INVALID_PART
;
5108 for (obj_iter
= obj_parts
.begin(); iter
!= parts
->parts
.end() && obj_iter
!= obj_parts
.end(); ++iter
, ++obj_iter
, ++handled_parts
) {
5109 uint64_t part_size
= obj_iter
->second
.accounted_size
;
5110 if (handled_parts
< (int)parts
->parts
.size() - 1 &&
5111 part_size
< min_part_size
) {
5112 op_ret
= -ERR_TOO_SMALL
;
5116 char petag
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
5117 if (iter
->first
!= (int)obj_iter
->first
) {
5118 ldout(s
->cct
, 0) << "NOTICE: parts num mismatch: next requested: "
5119 << iter
->first
<< " next uploaded: "
5120 << obj_iter
->first
<< dendl
;
5121 op_ret
= -ERR_INVALID_PART
;
5124 string part_etag
= rgw_string_unquote(iter
->second
);
5125 if (part_etag
.compare(obj_iter
->second
.etag
) != 0) {
5126 ldout(s
->cct
, 0) << "NOTICE: etag mismatch: part: " << iter
->first
5127 << " etag: " << iter
->second
<< dendl
;
5128 op_ret
= -ERR_INVALID_PART
;
5132 hex_to_buf(obj_iter
->second
.etag
.c_str(), petag
,
5133 CEPH_CRYPTO_MD5_DIGESTSIZE
);
5134 hash
.Update((const byte
*)petag
, sizeof(petag
));
5136 RGWUploadPartInfo
& obj_part
= obj_iter
->second
;
5138 /* update manifest for part */
5139 string oid
= mp
.get_part(obj_iter
->second
.num
);
5141 src_obj
.init_ns(s
->bucket
, oid
, mp_ns
);
5143 if (obj_part
.manifest
.empty()) {
5144 ldout(s
->cct
, 0) << "ERROR: empty manifest for object part: obj="
5145 << src_obj
<< dendl
;
5146 op_ret
= -ERR_INVALID_PART
;
5149 manifest
.append(obj_part
.manifest
, store
);
5152 if (obj_part
.cs_info
.compression_type
!= "none") {
5153 if (compressed
&& cs_info
.compression_type
!= obj_part
.cs_info
.compression_type
) {
5154 ldout(s
->cct
, 0) << "ERROR: compression type was changed during multipart upload ("
5155 << cs_info
.compression_type
<< ">>" << obj_part
.cs_info
.compression_type
<< ")" << dendl
;
5156 op_ret
= -ERR_INVALID_PART
;
5159 int new_ofs
; // offset in compression data for new part
5160 if (cs_info
.blocks
.size() > 0)
5161 new_ofs
= cs_info
.blocks
.back().new_ofs
+ cs_info
.blocks
.back().len
;
5164 for (const auto& block
: obj_part
.cs_info
.blocks
) {
5165 compression_block cb
;
5166 cb
.old_ofs
= block
.old_ofs
+ cs_info
.orig_size
;
5167 cb
.new_ofs
= new_ofs
;
5169 cs_info
.blocks
.push_back(cb
);
5170 new_ofs
= cb
.new_ofs
+ cb
.len
;
5173 cs_info
.compression_type
= obj_part
.cs_info
.compression_type
;
5174 cs_info
.orig_size
+= obj_part
.cs_info
.orig_size
;
5178 rgw_obj_index_key remove_key
;
5179 src_obj
.key
.get_index_key(&remove_key
);
5181 remove_objs
.push_back(remove_key
);
5183 ofs
+= obj_part
.size
;
5184 accounted_size
+= obj_part
.accounted_size
;
5186 } while (truncated
);
5187 hash
.Final((byte
*)final_etag
);
5189 buf_to_hex((unsigned char *)final_etag
, sizeof(final_etag
), final_etag_str
);
5190 snprintf(&final_etag_str
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2], sizeof(final_etag_str
) - CEPH_CRYPTO_MD5_DIGESTSIZE
* 2,
5191 "-%lld", (long long)parts
->parts
.size());
5192 etag
= final_etag_str
;
5193 ldout(s
->cct
, 10) << "calculated etag: " << final_etag_str
<< dendl
;
5195 etag_bl
.append(final_etag_str
, strlen(final_etag_str
) + 1);
5197 attrs
[RGW_ATTR_ETAG
] = etag_bl
;
5200 // write compression attribute to full object
5202 ::encode(cs_info
, tmp
);
5203 attrs
[RGW_ATTR_COMPRESSION
] = tmp
;
5206 target_obj
.init(s
->bucket
, s
->object
.name
);
5207 if (versioned_object
) {
5208 store
->gen_rand_obj_instance_name(&target_obj
);
5211 RGWObjectCtx
& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
5213 obj_ctx
.obj
.set_atomic(target_obj
);
5215 RGWRados::Object
op_target(store
, s
->bucket_info
, *static_cast<RGWObjectCtx
*>(s
->obj_ctx
), target_obj
);
5216 RGWRados::Object::Write
obj_op(&op_target
);
5218 obj_op
.meta
.manifest
= &manifest
;
5219 obj_op
.meta
.remove_objs
= &remove_objs
;
5221 obj_op
.meta
.ptag
= &s
->req_id
; /* use req_id as operation tag */
5222 obj_op
.meta
.owner
= s
->owner
.get_id();
5223 obj_op
.meta
.flags
= PUT_OBJ_CREATE
;
5224 op_ret
= obj_op
.write_meta(ofs
, accounted_size
, attrs
);
5228 // remove the upload obj
5229 int r
= store
->delete_obj(*static_cast<RGWObjectCtx
*>(s
->obj_ctx
),
5230 s
->bucket_info
, meta_obj
, 0);
5232 ldout(store
->ctx(), 0) << "WARNING: failed to remove object " << meta_obj
<< dendl
;
5236 int RGWAbortMultipart::verify_permission()
5238 if (s
->iam_policy
) {
5239 auto e
= s
->iam_policy
->eval(s
->env
, *s
->auth
.identity
,
5240 rgw::IAM::s3AbortMultipartUpload
,
5241 rgw_obj(s
->bucket
, s
->object
));
5242 if (e
== Effect::Allow
) {
5244 } else if (e
== Effect::Deny
) {
5249 if (!verify_bucket_permission_no_policy(s
, RGW_PERM_WRITE
)) {
5256 void RGWAbortMultipart::pre_exec()
5258 rgw_bucket_object_pre_exec(s
);
5261 void RGWAbortMultipart::execute()
5266 upload_id
= s
->info
.args
.get("uploadId");
5267 map
<string
, bufferlist
> attrs
;
5271 if (upload_id
.empty() || s
->object
.empty())
5274 mp
.init(s
->object
.name
, upload_id
);
5275 meta_oid
= mp
.get_meta();
5277 op_ret
= get_multipart_info(store
, s
, meta_oid
, NULL
, attrs
);
5281 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
5282 op_ret
= abort_multipart_upload(store
, s
->cct
, obj_ctx
, s
->bucket_info
, mp
);
5285 int RGWListMultipart::verify_permission()
5287 if (!verify_object_permission(s
, rgw::IAM::s3ListMultipartUploadParts
))
5293 void RGWListMultipart::pre_exec()
5295 rgw_bucket_object_pre_exec(s
);
5298 void RGWListMultipart::execute()
5300 map
<string
, bufferlist
> xattrs
;
5304 op_ret
= get_params();
5308 mp
.init(s
->object
.name
, upload_id
);
5309 meta_oid
= mp
.get_meta();
5311 op_ret
= get_multipart_info(store
, s
, meta_oid
, &policy
, xattrs
);
5315 op_ret
= list_multipart_parts(store
, s
, upload_id
, meta_oid
, max_parts
,
5316 marker
, parts
, NULL
, &truncated
);
5319 int RGWListBucketMultiparts::verify_permission()
5321 if (!verify_bucket_permission(s
,
5322 rgw::IAM::s3ListBucketMultiPartUploads
))
5328 void RGWListBucketMultiparts::pre_exec()
5330 rgw_bucket_object_pre_exec(s
);
5333 void RGWListBucketMultiparts::execute()
5335 vector
<rgw_bucket_dir_entry
> objs
;
5338 op_ret
= get_params();
5342 if (s
->prot_flags
& RGW_REST_SWIFT
) {
5344 path_args
= s
->info
.args
.get("path");
5345 if (!path_args
.empty()) {
5346 if (!delimiter
.empty() || !prefix
.empty()) {
5354 marker_meta
= marker
.get_meta();
5356 RGWRados::Bucket
target(store
, s
->bucket_info
);
5357 RGWRados::Bucket::List
list_op(&target
);
5359 list_op
.params
.prefix
= prefix
;
5360 list_op
.params
.delim
= delimiter
;
5361 list_op
.params
.marker
= marker_meta
;
5362 list_op
.params
.ns
= mp_ns
;
5363 list_op
.params
.filter
= &mp_filter
;
5365 op_ret
= list_op
.list_objects(max_uploads
, &objs
, &common_prefixes
,
5367 if (!objs
.empty()) {
5368 vector
<rgw_bucket_dir_entry
>::iterator iter
;
5369 RGWMultipartUploadEntry entry
;
5370 for (iter
= objs
.begin(); iter
!= objs
.end(); ++iter
) {
5371 rgw_obj_key
key(iter
->key
);
5372 if (!entry
.mp
.from_meta(key
.name
))
5375 uploads
.push_back(entry
);
5377 next_marker
= entry
;
5381 void RGWGetHealthCheck::execute()
5383 if (!g_conf
->rgw_healthcheck_disabling_path
.empty() &&
5384 (::access(g_conf
->rgw_healthcheck_disabling_path
.c_str(), F_OK
) == 0)) {
5385 /* Disabling path specified & existent in the filesystem. */
5386 op_ret
= -ERR_SERVICE_UNAVAILABLE
; /* 503 */
5388 op_ret
= 0; /* 200 OK */
5392 int RGWDeleteMultiObj::verify_permission()
5394 acl_allowed
= verify_bucket_permission_no_policy(s
, RGW_PERM_WRITE
);
5395 if (!acl_allowed
&& !s
->iam_policy
)
5401 void RGWDeleteMultiObj::pre_exec()
5403 rgw_bucket_object_pre_exec(s
);
5406 void RGWDeleteMultiObj::execute()
5408 RGWMultiDelDelete
*multi_delete
;
5409 vector
<rgw_obj_key
>::iterator iter
;
5410 RGWMultiDelXMLParser parser
;
5411 int num_processed
= 0;
5412 RGWObjectCtx
*obj_ctx
= static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
5414 op_ret
= get_params();
5424 if (!parser
.init()) {
5429 if (!parser
.parse(data
, len
, 1)) {
5434 multi_delete
= static_cast<RGWMultiDelDelete
*>(parser
.find_first("Delete"));
5435 if (!multi_delete
) {
5440 if (multi_delete
->is_quiet())
5444 if (multi_delete
->objects
.empty()) {
5448 for (iter
= multi_delete
->objects
.begin();
5449 iter
!= multi_delete
->objects
.end() && num_processed
< max_to_delete
;
5450 ++iter
, num_processed
++) {
5451 rgw_obj
obj(bucket
, *iter
);
5452 if (s
->iam_policy
) {
5453 auto e
= s
->iam_policy
->eval(s
->env
,
5455 iter
->instance
.empty() ?
5456 rgw::IAM::s3DeleteObject
:
5457 rgw::IAM::s3DeleteObjectVersion
,
5459 if ((e
== Effect::Deny
) ||
5460 (e
== Effect::Pass
&& !acl_allowed
)) {
5461 send_partial_response(*iter
, false, "", -EACCES
);
5466 obj_ctx
->obj
.set_atomic(obj
);
5468 RGWRados::Object
del_target(store
, s
->bucket_info
, *obj_ctx
, obj
);
5469 RGWRados::Object::Delete
del_op(&del_target
);
5471 del_op
.params
.bucket_owner
= s
->bucket_owner
.get_id();
5472 del_op
.params
.versioning_status
= s
->bucket_info
.versioning_status();
5473 del_op
.params
.obj_owner
= s
->owner
;
5475 op_ret
= del_op
.delete_obj();
5476 if (op_ret
== -ENOENT
) {
5480 send_partial_response(*iter
, del_op
.result
.delete_marker
,
5481 del_op
.result
.version_id
, op_ret
);
5484 /* set the return code to zero, errors at this point will be
5485 dumped to the response */
5489 // will likely segfault if begin_response() has not been called
5501 bool RGWBulkDelete::Deleter::verify_permission(RGWBucketInfo
& binfo
,
5502 map
<string
, bufferlist
>& battrs
,
5503 ACLOwner
& bucket_owner
/* out */)
5505 RGWAccessControlPolicy
bacl(store
->ctx());
5506 int ret
= read_bucket_policy(store
, s
, binfo
, battrs
, &bacl
, binfo
.bucket
);
5511 auto policy
= get_iam_policy_from_attr(s
->cct
, store
, battrs
, binfo
.bucket
.tenant
);
5513 bucket_owner
= bacl
.get_owner();
5515 /* We can use global user_acl because each BulkDelete request is allowed
5516 * to work on entities from a single account only. */
5517 return verify_bucket_permission(s
, binfo
.bucket
, s
->user_acl
.get(),
5518 &bacl
, policy
, rgw::IAM::s3DeleteBucket
);
5521 bool RGWBulkDelete::Deleter::delete_single(const acct_path_t
& path
)
5523 auto& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
5525 RGWBucketInfo binfo
;
5526 map
<string
, bufferlist
> battrs
;
5529 int ret
= store
->get_bucket_info(obj_ctx
, s
->user
->user_id
.tenant
,
5530 path
.bucket_name
, binfo
, nullptr,
5536 if (!verify_permission(binfo
, battrs
, bowner
)) {
5541 if (!path
.obj_key
.empty()) {
5542 rgw_obj
obj(binfo
.bucket
, path
.obj_key
);
5543 obj_ctx
.obj
.set_atomic(obj
);
5545 RGWRados::Object
del_target(store
, binfo
, obj_ctx
, obj
);
5546 RGWRados::Object::Delete
del_op(&del_target
);
5548 del_op
.params
.bucket_owner
= binfo
.owner
;
5549 del_op
.params
.versioning_status
= binfo
.versioning_status();
5550 del_op
.params
.obj_owner
= bowner
;
5552 ret
= del_op
.delete_obj();
5557 RGWObjVersionTracker ot
;
5558 ot
.read_version
= binfo
.ep_objv
;
5560 ret
= store
->delete_bucket(binfo
, ot
);
5562 ret
= rgw_unlink_bucket(store
, binfo
.owner
, binfo
.bucket
.tenant
,
5563 binfo
.bucket
.name
, false);
5565 ldout(s
->cct
, 0) << "WARNING: failed to unlink bucket: ret=" << ret
5573 if (!store
->get_zonegroup().is_master_zonegroup()) {
5575 ret
= forward_request_to_master(s
, &ot
.read_version
, store
, in_data
,
5578 if (ret
== -ENOENT
) {
5579 /* adjust error, we want to return with NoSuchBucket and not
5581 ret
= -ERR_NO_SUCH_BUCKET
;
5593 if (-ENOENT
== ret
) {
5594 ldout(store
->ctx(), 20) << "cannot find bucket = " << path
.bucket_name
<< dendl
;
5597 ldout(store
->ctx(), 20) << "cannot get bucket info, ret = " << ret
5600 fail_desc_t failed_item
= {
5604 failures
.push_back(failed_item
);
5609 ldout(store
->ctx(), 20) << "wrong auth for " << path
<< dendl
;
5611 fail_desc_t failed_item
= {
5615 failures
.push_back(failed_item
);
5620 if (-ENOENT
== ret
) {
5621 ldout(store
->ctx(), 20) << "cannot find entry " << path
<< dendl
;
5624 fail_desc_t failed_item
= {
5628 failures
.push_back(failed_item
);
5633 bool RGWBulkDelete::Deleter::delete_chunk(const std::list
<acct_path_t
>& paths
)
5635 ldout(store
->ctx(), 20) << "in delete_chunk" << dendl
;
5636 for (auto path
: paths
) {
5637 ldout(store
->ctx(), 20) << "bulk deleting path: " << path
<< dendl
;
5638 delete_single(path
);
5644 int RGWBulkDelete::verify_permission()
5649 void RGWBulkDelete::pre_exec()
5651 rgw_bucket_object_pre_exec(s
);
5654 void RGWBulkDelete::execute()
5656 deleter
= std::unique_ptr
<Deleter
>(new Deleter(store
, s
));
5658 bool is_truncated
= false;
5660 list
<RGWBulkDelete::acct_path_t
> items
;
5662 int ret
= get_data(items
, &is_truncated
);
5667 ret
= deleter
->delete_chunk(items
);
5668 } while (!op_ret
&& is_truncated
);
5674 constexpr std::array
<int, 2> RGWBulkUploadOp::terminal_errors
;
5676 int RGWBulkUploadOp::verify_permission()
5678 if (s
->auth
.identity
->is_anonymous()) {
5682 if (! verify_user_permission(s
, RGW_PERM_WRITE
)) {
5686 if (s
->user
->user_id
.tenant
!= s
->bucket_tenant
) {
5687 ldout(s
->cct
, 10) << "user cannot create a bucket in a different tenant"
5688 << " (user_id.tenant=" << s
->user
->user_id
.tenant
5689 << " requested=" << s
->bucket_tenant
<< ")"
5694 if (s
->user
->max_buckets
< 0) {
5701 void RGWBulkUploadOp::pre_exec()
5703 rgw_bucket_object_pre_exec(s
);
5706 boost::optional
<std::pair
<std::string
, rgw_obj_key
>>
5707 RGWBulkUploadOp::parse_path(const boost::string_ref
& path
)
5709 /* We need to skip all slashes at the beginning in order to preserve
5710 * compliance with Swift. */
5711 const size_t start_pos
= path
.find_first_not_of('/');
5713 if (boost::string_ref::npos
!= start_pos
) {
5714 /* Seperator is the first slash after the leading ones. */
5715 const size_t sep_pos
= path
.substr(start_pos
).find('/');
5717 if (boost::string_ref::npos
!= sep_pos
) {
5718 const auto bucket_name
= path
.substr(start_pos
, sep_pos
- start_pos
);
5719 const auto obj_name
= path
.substr(sep_pos
+ 1);
5721 return std::make_pair(bucket_name
.to_string(),
5722 rgw_obj_key(obj_name
.to_string()));
5724 /* It's guaranteed here that bucket name is at least one character
5725 * long and is different than slash. */
5726 return std::make_pair(path
.substr(start_pos
).to_string(),
5734 std::pair
<std::string
, std::string
>
5735 RGWBulkUploadOp::handle_upload_path(struct req_state
*s
)
5737 std::string bucket_path
, file_prefix
;
5738 if (! s
->init_state
.url_bucket
.empty()) {
5739 file_prefix
= bucket_path
= s
->init_state
.url_bucket
+ "/";
5740 if (! s
->object
.empty()) {
5741 std::string
& object_name
= s
->object
.name
;
5743 /* As rgw_obj_key::empty() already verified emptiness of s->object.name,
5744 * we can safely examine its last element. */
5745 if (object_name
.back() == '/') {
5746 file_prefix
.append(object_name
);
5748 file_prefix
.append(object_name
).append("/");
5752 return std::make_pair(bucket_path
, file_prefix
);
5755 int RGWBulkUploadOp::handle_dir_verify_permission()
5757 if (s
->user
->max_buckets
> 0) {
5758 RGWUserBuckets buckets
;
5760 bool is_truncated
= false;
5761 op_ret
= rgw_read_user_buckets(store
, s
->user
->user_id
, buckets
,
5762 marker
, std::string(), s
->user
->max_buckets
,
5763 false, &is_truncated
);
5768 if (buckets
.count() >= static_cast<size_t>(s
->user
->max_buckets
)) {
5769 return -ERR_TOO_MANY_BUCKETS
;
5776 static void forward_req_info(CephContext
*cct
, req_info
& info
, const std::string
& bucket_name
)
5778 /* the request of container or object level will contain bucket name.
5779 * only at account level need to append the bucket name */
5780 if (info
.script_uri
.find(bucket_name
) != std::string::npos
) {
5784 ldout(cct
, 20) << "append the bucket: "<< bucket_name
<< " to req_info" << dendl
;
5785 info
.script_uri
.append("/").append(bucket_name
);
5786 info
.request_uri_aws4
= info
.request_uri
= info
.script_uri
;
5787 info
.effective_uri
= "/" + bucket_name
;
5790 int RGWBulkUploadOp::handle_dir(const boost::string_ref path
)
5792 ldout(s
->cct
, 20) << "bulk upload: got directory=" << path
<< dendl
;
5794 op_ret
= handle_dir_verify_permission();
5799 std::string bucket_name
;
5800 rgw_obj_key object_junk
;
5801 std::tie(bucket_name
, object_junk
) = *parse_path(path
);
5803 rgw_raw_obj
obj(store
->get_zone_params().domain_root
,
5804 rgw_make_bucket_entry_name(s
->bucket_tenant
, bucket_name
));
5806 /* we need to make sure we read bucket info, it's not read before for this
5807 * specific request */
5808 RGWBucketInfo binfo
;
5809 std::map
<std::string
, ceph::bufferlist
> battrs
;
5810 op_ret
= store
->get_bucket_info(*dir_ctx
, s
->bucket_tenant
, bucket_name
,
5811 binfo
, NULL
, &battrs
);
5812 if (op_ret
< 0 && op_ret
!= -ENOENT
) {
5815 const bool bucket_exists
= (op_ret
!= -ENOENT
);
5817 if (bucket_exists
) {
5818 RGWAccessControlPolicy
old_policy(s
->cct
);
5819 int r
= get_bucket_policy_from_attr(s
->cct
, store
, binfo
,
5820 battrs
, &old_policy
);
5822 if (old_policy
.get_owner().get_id().compare(s
->user
->user_id
) != 0) {
5829 RGWBucketInfo master_info
;
5830 rgw_bucket
*pmaster_bucket
= nullptr;
5831 uint32_t *pmaster_num_shards
= nullptr;
5832 real_time creation_time
;
5833 obj_version objv
, ep_objv
, *pobjv
= nullptr;
5835 if (! store
->is_meta_master()) {
5837 ceph::bufferlist in_data
;
5838 req_info info
= s
->info
;
5839 forward_req_info(s
->cct
, info
, bucket_name
);
5840 op_ret
= forward_request_to_master(s
, nullptr, store
, in_data
, &jp
, &info
);
5845 JSONDecoder::decode_json("entry_point_object_ver", ep_objv
, &jp
);
5846 JSONDecoder::decode_json("object_ver", objv
, &jp
);
5847 JSONDecoder::decode_json("bucket_info", master_info
, &jp
);
5849 ldout(s
->cct
, 20) << "parsed: objv.tag=" << objv
.tag
<< " objv.ver="
5850 << objv
.ver
<< dendl
;
5851 ldout(s
->cct
, 20) << "got creation_time="<< master_info
.creation_time
5854 pmaster_bucket
= &master_info
.bucket
;
5855 creation_time
= master_info
.creation_time
;
5856 pmaster_num_shards
= &master_info
.num_shards
;
5859 pmaster_bucket
= nullptr;
5860 pmaster_num_shards
= nullptr;
5864 std::string placement_rule
;
5865 if (bucket_exists
) {
5866 std::string selected_placement_rule
;
5868 bucket
.tenant
= s
->bucket_tenant
;
5869 bucket
.name
= s
->bucket_name
;
5870 op_ret
= store
->select_bucket_placement(*(s
->user
),
5871 store
->get_zonegroup().get_id(),
5873 &selected_placement_rule
,
5875 if (selected_placement_rule
!= binfo
.placement_rule
) {
5877 ldout(s
->cct
, 20) << "bulk upload: non-coherent placement rule" << dendl
;
5882 /* Create metadata: ACLs. */
5883 std::map
<std::string
, ceph::bufferlist
> attrs
;
5884 RGWAccessControlPolicy policy
;
5885 policy
.create_default(s
->user
->user_id
, s
->user
->display_name
);
5886 ceph::bufferlist aclbl
;
5887 policy
.encode(aclbl
);
5888 attrs
.emplace(RGW_ATTR_ACL
, std::move(aclbl
));
5890 RGWQuotaInfo quota_info
;
5891 const RGWQuotaInfo
* pquota_info
= nullptr;
5894 bucket
.tenant
= s
->bucket_tenant
; /* ignored if bucket exists */
5895 bucket
.name
= bucket_name
;
5898 RGWBucketInfo out_info
;
5899 op_ret
= store
->create_bucket(*(s
->user
),
5901 store
->get_zonegroup().get_id(),
5902 placement_rule
, binfo
.swift_ver_location
,
5904 out_info
, pobjv
, &ep_objv
, creation_time
,
5905 pmaster_bucket
, pmaster_num_shards
, true);
5906 /* continue if EEXIST and create_bucket will fail below. this way we can
5907 * recover from a partial create by retrying it. */
5908 ldout(s
->cct
, 20) << "rgw_create_bucket returned ret=" << op_ret
5909 << ", bucket=" << bucket
<< dendl
;
5911 if (op_ret
&& op_ret
!= -EEXIST
) {
5915 const bool existed
= (op_ret
== -EEXIST
);
5917 /* bucket already existed, might have raced with another bucket creation, or
5918 * might be partial bucket creation that never completed. Read existing bucket
5919 * info, verify that the reported bucket owner is the current user.
5920 * If all is ok then update the user's list of buckets.
5921 * Otherwise inform client about a name conflict.
5923 if (out_info
.owner
.compare(s
->user
->user_id
) != 0) {
5925 ldout(s
->cct
, 20) << "bulk upload: conflicting bucket name" << dendl
;
5928 bucket
= out_info
.bucket
;
5931 op_ret
= rgw_link_bucket(store
, s
->user
->user_id
, bucket
,
5932 out_info
.creation_time
, false);
5933 if (op_ret
&& !existed
&& op_ret
!= -EEXIST
) {
5934 /* if it exists (or previously existed), don't remove it! */
5935 op_ret
= rgw_unlink_bucket(store
, s
->user
->user_id
,
5936 bucket
.tenant
, bucket
.name
);
5938 ldout(s
->cct
, 0) << "bulk upload: WARNING: failed to unlink bucket: ret="
5941 } else if (op_ret
== -EEXIST
|| (op_ret
== 0 && existed
)) {
5942 ldout(s
->cct
, 20) << "bulk upload: containers already exists"
5944 op_ret
= -ERR_BUCKET_EXISTS
;
5951 bool RGWBulkUploadOp::handle_file_verify_permission(RGWBucketInfo
& binfo
,
5953 std::map
<std::string
, ceph::bufferlist
>& battrs
,
5954 ACLOwner
& bucket_owner
/* out */)
5956 RGWAccessControlPolicy
bacl(store
->ctx());
5957 op_ret
= read_bucket_policy(store
, s
, binfo
, battrs
, &bacl
, binfo
.bucket
);
5959 ldout(s
->cct
, 20) << "bulk upload: cannot read_policy() for bucket"
5964 auto policy
= get_iam_policy_from_attr(s
->cct
, store
, battrs
, binfo
.bucket
.tenant
);
5966 bucket_owner
= bacl
.get_owner();
5968 auto e
= policy
->eval(s
->env
, *s
->auth
.identity
,
5969 rgw::IAM::s3PutObject
, obj
);
5970 if (e
== Effect::Allow
) {
5972 } else if (e
== Effect::Deny
) {
5977 return verify_bucket_permission_no_policy(s
, s
->user_acl
.get(),
5978 &bacl
, RGW_PERM_WRITE
);
5981 int RGWBulkUploadOp::handle_file(const boost::string_ref path
,
5983 AlignedStreamGetter
& body
)
5986 ldout(s
->cct
, 20) << "bulk upload: got file=" << path
<< ", size=" << size
5989 RGWPutObjDataProcessor
*filter
= nullptr;
5990 boost::optional
<RGWPutObj_Compress
> compressor
;
5992 if (size
> static_cast<const size_t>(s
->cct
->_conf
->rgw_max_put_size
)) {
5993 op_ret
= -ERR_TOO_LARGE
;
5997 std::string bucket_name
;
5999 std::tie(bucket_name
, object
) = *parse_path(path
);
6001 auto& obj_ctx
= *static_cast<RGWObjectCtx
*>(s
->obj_ctx
);
6002 RGWBucketInfo binfo
;
6003 std::map
<std::string
, ceph::bufferlist
> battrs
;
6005 op_ret
= store
->get_bucket_info(obj_ctx
, s
->user
->user_id
.tenant
,
6006 bucket_name
, binfo
, nullptr, &battrs
);
6007 if (op_ret
== -ENOENT
) {
6008 ldout(s
->cct
, 20) << "bulk upload: non existent directory=" << bucket_name
6010 } else if (op_ret
< 0) {
6014 if (! handle_file_verify_permission(binfo
,
6015 rgw_obj(binfo
.bucket
, object
),
6017 ldout(s
->cct
, 20) << "bulk upload: object creation unauthorized" << dendl
;
6022 op_ret
= store
->check_quota(bowner
.get_id(), binfo
.bucket
,
6023 user_quota
, bucket_quota
, size
);
6028 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
6033 RGWPutObjProcessor_Atomic
processor(obj_ctx
,
6038 s
->cct
->_conf
->rgw_obj_stripe_size
,
6040 binfo
.versioning_enabled());
6042 /* No filters by default. */
6043 filter
= &processor
;
6045 op_ret
= processor
.prepare(store
, nullptr);
6047 ldout(s
->cct
, 20) << "bulk upload: cannot prepare processor due to ret="
6052 const auto& compression_type
= store
->get_zone_params().get_compression_type(
6053 binfo
.placement_rule
);
6054 CompressorRef plugin
;
6055 if (compression_type
!= "none") {
6056 plugin
= Compressor::create(s
->cct
, compression_type
);
6058 ldout(s
->cct
, 1) << "Cannot load plugin for rgw_compression_type "
6059 << compression_type
<< dendl
;
6061 compressor
.emplace(s
->cct
, plugin
, filter
);
6062 filter
= &*compressor
;
6066 /* Upload file content. */
6071 ceph::bufferlist data
;
6072 len
= body
.get_at_most(s
->cct
->_conf
->rgw_max_chunk_size
, data
);
6074 ldout(s
->cct
, 20) << "bulk upload: body=" << data
.c_str() << dendl
;
6078 } else if (len
> 0) {
6079 hash
.Update((const byte
*)data
.c_str(), data
.length());
6080 op_ret
= put_data_and_throttle(filter
, data
, ofs
, false);
6082 ldout(s
->cct
, 20) << "processor->thottle_data() returned ret="
6093 ldout(s
->cct
, 10) << "bulk upload: real file size different from declared"
6098 op_ret
= store
->check_quota(bowner
.get_id(), binfo
.bucket
,
6099 user_quota
, bucket_quota
, size
);
6101 ldout(s
->cct
, 20) << "bulk upload: quota exceeded for path=" << path
6106 op_ret
= store
->check_bucket_shards(s
->bucket_info
, s
->bucket
, bucket_quota
);
6111 char calc_md5
[CEPH_CRYPTO_MD5_DIGESTSIZE
* 2 + 1];
6112 unsigned char m
[CEPH_CRYPTO_MD5_DIGESTSIZE
];
6114 buf_to_hex(m
, CEPH_CRYPTO_MD5_DIGESTSIZE
, calc_md5
);
6116 /* Create metadata: ETAG. */
6117 std::map
<std::string
, ceph::bufferlist
> attrs
;
6118 std::string etag
= calc_md5
;
6119 ceph::bufferlist etag_bl
;
6120 etag_bl
.append(etag
.c_str(), etag
.size() + 1);
6121 attrs
.emplace(RGW_ATTR_ETAG
, std::move(etag_bl
));
6123 /* Create metadata: ACLs. */
6124 RGWAccessControlPolicy policy
;
6125 policy
.create_default(s
->user
->user_id
, s
->user
->display_name
);
6126 ceph::bufferlist aclbl
;
6127 policy
.encode(aclbl
);
6128 attrs
.emplace(RGW_ATTR_ACL
, std::move(aclbl
));
6130 /* Create metadata: compression info. */
6131 if (compressor
&& compressor
->is_compressed()) {
6132 ceph::bufferlist tmp
;
6133 RGWCompressionInfo cs_info
;
6134 cs_info
.compression_type
= plugin
->get_type_name();
6135 cs_info
.orig_size
= s
->obj_size
;
6136 cs_info
.blocks
= std::move(compressor
->get_compression_blocks());
6137 ::encode(cs_info
, tmp
);
6138 attrs
.emplace(RGW_ATTR_COMPRESSION
, std::move(tmp
));
6141 /* Complete the transaction. */
6142 op_ret
= processor
.complete(size
, etag
, nullptr, ceph::real_time(), attrs
,
6143 ceph::real_time() /* delete_at */);
6145 ldout(s
->cct
, 20) << "bulk upload: processor::complete returned op_ret="
6152 void RGWBulkUploadOp::execute()
6154 ceph::bufferlist
buffer(64 * 1024);
6156 ldout(s
->cct
, 20) << "bulk upload: start" << dendl
;
6158 /* Create an instance of stream-abstracting class. Having this indirection
6159 * allows for easy introduction of decompressors like gzip and bzip2. */
6160 auto stream
= create_stream();
6165 /* Handling the $UPLOAD_PATH accordingly to the Swift's Bulk middleware. See:
6166 * https://github.com/openstack/swift/blob/2.13.0/swift/common/middleware/bulk.py#L31-L41 */
6167 std::string bucket_path
, file_prefix
;
6168 std::tie(bucket_path
, file_prefix
) = handle_upload_path(s
);
6170 auto status
= rgw::tar::StatusIndicator::create();
6172 op_ret
= stream
->get_exactly(rgw::tar::BLOCK_SIZE
, buffer
);
6174 ldout(s
->cct
, 2) << "bulk upload: cannot read header" << dendl
;
6178 /* We need to re-interpret the buffer as a TAR block. Exactly two blocks
6179 * must be tracked to detect out end-of-archive. It occurs when both of
6180 * them are empty (zeroed). Tracing this particular inter-block dependency
6181 * is responsibility of the rgw::tar::StatusIndicator class. */
6182 boost::optional
<rgw::tar::HeaderView
> header
;
6183 std::tie(status
, header
) = rgw::tar::interpret_block(status
, buffer
);
6185 if (! status
.empty() && header
) {
6186 /* This specific block isn't empty (entirely zeroed), so we can parse
6187 * it as a TAR header and dispatch. At the moment we do support only
6188 * regular files and directories. Everything else (symlinks, devices)
6189 * will be ignored but won't cease the whole upload. */
6190 switch (header
->get_filetype()) {
6191 case rgw::tar::FileType::NORMAL_FILE
: {
6192 ldout(s
->cct
, 2) << "bulk upload: handling regular file" << dendl
;
6194 boost::string_ref filename
= bucket_path
.empty() ? header
->get_filename() : \
6195 file_prefix
+ header
->get_filename().to_string();
6196 auto body
= AlignedStreamGetter(0, header
->get_filesize(),
6197 rgw::tar::BLOCK_SIZE
, *stream
);
6198 op_ret
= handle_file(filename
,
6199 header
->get_filesize(),
6202 /* Only regular files counts. */
6205 failures
.emplace_back(op_ret
, filename
.to_string());
6209 case rgw::tar::FileType::DIRECTORY
: {
6210 ldout(s
->cct
, 2) << "bulk upload: handling regular directory" << dendl
;
6212 boost::string_ref dirname
= bucket_path
.empty() ? header
->get_filename() : bucket_path
;
6213 op_ret
= handle_dir(dirname
);
6214 if (op_ret
< 0 && op_ret
!= -ERR_BUCKET_EXISTS
) {
6215 failures
.emplace_back(op_ret
, dirname
.to_string());
6220 /* Not recognized. Skip. */
6226 /* In case of any problems with sub-request authorization Swift simply
6227 * terminates whole upload immediately. */
6228 if (boost::algorithm::contains(std::initializer_list
<int>{ op_ret
},
6230 ldout(s
->cct
, 2) << "bulk upload: terminating due to ret=" << op_ret
6235 ldout(s
->cct
, 2) << "bulk upload: an empty block" << dendl
;
6240 } while (! status
.eof());
6245 RGWBulkUploadOp::AlignedStreamGetter::~AlignedStreamGetter()
6247 const size_t aligned_legnth
= length
+ (-length
% alignment
);
6248 ceph::bufferlist junk
;
6250 DecoratedStreamGetter::get_exactly(aligned_legnth
- position
, junk
);
6253 ssize_t
RGWBulkUploadOp::AlignedStreamGetter::get_at_most(const size_t want
,
6254 ceph::bufferlist
& dst
)
6256 const size_t max_to_read
= std::min(want
, length
- position
);
6257 const auto len
= DecoratedStreamGetter::get_at_most(max_to_read
, dst
);
6264 ssize_t
RGWBulkUploadOp::AlignedStreamGetter::get_exactly(const size_t want
,
6265 ceph::bufferlist
& dst
)
6267 const auto len
= DecoratedStreamGetter::get_exactly(want
, dst
);
6274 int RGWSetAttrs::verify_permission()
6276 // This looks to be part of the RGW-NFS machinery and has no S3 or
6277 // Swift equivalent.
6279 if (!s
->object
.empty()) {
6280 perm
= verify_object_permission_no_policy(s
, RGW_PERM_WRITE
);
6282 perm
= verify_bucket_permission_no_policy(s
, RGW_PERM_WRITE
);
6290 void RGWSetAttrs::pre_exec()
6292 rgw_bucket_object_pre_exec(s
);
6295 void RGWSetAttrs::execute()
6297 op_ret
= get_params();
6301 rgw_obj
obj(s
->bucket
, s
->object
);
6303 if (!s
->object
.empty()) {
6304 store
->set_atomic(s
->obj_ctx
, obj
);
6305 op_ret
= store
->set_attrs(s
->obj_ctx
, s
->bucket_info
, obj
, attrs
, nullptr);
6307 for (auto& iter
: attrs
) {
6308 s
->bucket_attrs
[iter
.first
] = std::move(iter
.second
);
6310 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, s
->bucket_attrs
,
6311 &s
->bucket_info
.objv_tracker
);
6315 void RGWGetObjLayout::pre_exec()
6317 rgw_bucket_object_pre_exec(s
);
6320 void RGWGetObjLayout::execute()
6322 rgw_obj
obj(s
->bucket
, s
->object
);
6323 RGWRados::Object
target(store
,
6325 *static_cast<RGWObjectCtx
*>(s
->obj_ctx
),
6326 rgw_obj(s
->bucket
, s
->object
));
6327 RGWRados::Object::Read
stat_op(&target
);
6329 op_ret
= stat_op
.prepare();
6334 head_obj
= stat_op
.state
.head_obj
;
6336 op_ret
= target
.get_manifest(&manifest
);
6340 int RGWConfigBucketMetaSearch::verify_permission()
6342 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
6349 void RGWConfigBucketMetaSearch::pre_exec()
6351 rgw_bucket_object_pre_exec(s
);
6354 void RGWConfigBucketMetaSearch::execute()
6356 op_ret
= get_params();
6358 ldout(s
->cct
, 20) << "NOTICE: get_params() returned ret=" << op_ret
<< dendl
;
6362 s
->bucket_info
.mdsearch_config
= mdsearch_config
;
6364 op_ret
= store
->put_bucket_instance_info(s
->bucket_info
, false, real_time(), &s
->bucket_attrs
);
6366 ldout(s
->cct
, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
<< " returned err=" << op_ret
<< dendl
;
6371 int RGWGetBucketMetaSearch::verify_permission()
6373 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
6380 void RGWGetBucketMetaSearch::pre_exec()
6382 rgw_bucket_object_pre_exec(s
);
6385 int RGWDelBucketMetaSearch::verify_permission()
6387 if (!s
->auth
.identity
->is_owner_of(s
->bucket_owner
.get_id())) {
6394 void RGWDelBucketMetaSearch::pre_exec()
6396 rgw_bucket_object_pre_exec(s
);
6399 void RGWDelBucketMetaSearch::execute()
6401 s
->bucket_info
.mdsearch_config
.clear();
6403 op_ret
= store
->put_bucket_instance_info(s
->bucket_info
, false, real_time(), &s
->bucket_attrs
);
6405 ldout(s
->cct
, 0) << "NOTICE: put_bucket_info on bucket=" << s
->bucket
.name
<< " returned err=" << op_ret
<< dendl
;
6411 RGWHandler::~RGWHandler()
6415 int RGWHandler::init(RGWRados
*_store
,
6416 struct req_state
*_s
,
6417 rgw::io::BasicClient
*cio
)
6425 int RGWHandler::do_init_permissions()
6427 int ret
= rgw_build_bucket_policies(store
, s
);
6428 s
->env
= rgw_build_iam_environment(store
, s
);
6431 ldout(s
->cct
, 10) << "read_permissions on " << s
->bucket
<< " ret=" << ret
<< dendl
;
6432 if (ret
== -ENODATA
)
6439 int RGWHandler::do_read_permissions(RGWOp
*op
, bool only_bucket
)
6442 /* already read bucket info */
6445 int ret
= rgw_build_object_policies(store
, s
, op
->prefetch_data());
6448 ldout(s
->cct
, 10) << "read_permissions on " << s
->bucket
<< ":"
6449 << s
->object
<< " only_bucket=" << only_bucket
6450 << " ret=" << ret
<< dendl
;
6451 if (ret
== -ENODATA
)
6458 int RGWOp::error_handler(int err_no
, string
*error_content
) {
6459 return dialect_handler
->error_handler(err_no
, error_content
);
6462 int RGWHandler::error_handler(int err_no
, string
*error_content
) {
6463 // This is the do-nothing error handler
6468 void RGWPutBucketPolicy::send_response()
6471 set_req_state_err(s
, op_ret
);
6477 int RGWPutBucketPolicy::verify_permission()
6479 if (!verify_bucket_permission(s
, rgw::IAM::s3PutBucketPolicy
)) {
6486 int RGWPutBucketPolicy::get_params()
6488 const auto max_size
= s
->cct
->_conf
->rgw_max_put_param_size
;
6489 // At some point when I have more time I want to make a version of
6490 // rgw_rest_read_all_input that doesn't use malloc.
6491 op_ret
= rgw_rest_read_all_input(s
, &data
, &len
, max_size
, false);
6492 // And throws exceptions.
6496 void RGWPutBucketPolicy::execute()
6498 op_ret
= get_params();
6503 bufferlist in_data
= bufferlist::static_from_mem(data
, len
);
6505 if (!store
->is_meta_master()) {
6506 op_ret
= forward_request_to_master(s
, NULL
, store
, in_data
, nullptr);
6508 ldout(s
->cct
, 20) << "forward_request_to_master returned ret=" << op_ret
<< dendl
;
6514 Policy
p(s
->cct
, s
->bucket_tenant
, in_data
);
6515 auto attrs
= s
->bucket_attrs
;
6516 attrs
[RGW_ATTR_IAM_POLICY
].clear();
6517 attrs
[RGW_ATTR_IAM_POLICY
].append(p
.text
);
6518 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
,
6519 &s
->bucket_info
.objv_tracker
);
6520 if (op_ret
== -ECANCELED
) {
6521 op_ret
= 0; /* lost a race, but it's ok because policies are immutable */
6523 } catch (rgw::IAM::PolicyParseException
& e
) {
6524 ldout(s
->cct
, 20) << "failed to parse policy: " << e
.what() << dendl
;
6529 void RGWGetBucketPolicy::send_response()
6532 set_req_state_err(s
, op_ret
);
6535 end_header(s
, this, "application/json");
6536 dump_body(s
, policy
);
6539 int RGWGetBucketPolicy::verify_permission()
6541 if (!verify_bucket_permission(s
, rgw::IAM::s3GetBucketPolicy
)) {
6548 void RGWGetBucketPolicy::execute()
6550 auto attrs
= s
->bucket_attrs
;
6551 map
<string
, bufferlist
>::iterator aiter
= attrs
.find(RGW_ATTR_IAM_POLICY
);
6552 if (aiter
== attrs
.end()) {
6553 ldout(s
->cct
, 0) << __func__
<< " can't find bucket IAM POLICY attr"
6554 << " bucket_name = " << s
->bucket_name
<< dendl
;
6555 op_ret
= -ERR_NO_SUCH_BUCKET_POLICY
;
6556 s
->err
.message
= "The bucket policy does not exist";
6559 policy
= attrs
[RGW_ATTR_IAM_POLICY
];
6561 if (policy
.length() == 0) {
6562 ldout(s
->cct
, 10) << "The bucket policy does not exist, bucket: " << s
->bucket_name
<< dendl
;
6563 op_ret
= -ERR_NO_SUCH_BUCKET_POLICY
;
6564 s
->err
.message
= "The bucket policy does not exist";
6570 void RGWDeleteBucketPolicy::send_response()
6573 set_req_state_err(s
, op_ret
);
6579 int RGWDeleteBucketPolicy::verify_permission()
6581 if (!verify_bucket_permission(s
, rgw::IAM::s3DeleteBucketPolicy
)) {
6588 void RGWDeleteBucketPolicy::execute()
6590 auto attrs
= s
->bucket_attrs
;
6591 attrs
.erase(RGW_ATTR_IAM_POLICY
);
6592 op_ret
= rgw_bucket_set_attrs(store
, s
->bucket_info
, attrs
,
6593 &s
->bucket_info
.objv_tracker
);
6594 if (op_ret
== -ECANCELED
) {
6595 op_ret
= 0; /* lost a race, but it's ok because policies are immutable */