2020-02-09 22:30:02 +00:00
|
|
|
package s3api
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
2020-12-07 07:16:20 +00:00
|
|
|
"github.com/chrislusf/seaweedfs/weed/filer"
|
2020-12-25 08:38:56 +00:00
|
|
|
"github.com/chrislusf/seaweedfs/weed/s3api/s3_constants"
|
2020-02-09 22:30:02 +00:00
|
|
|
"io/ioutil"
|
|
|
|
"net/http"
|
|
|
|
|
|
|
|
"github.com/chrislusf/seaweedfs/weed/glog"
|
|
|
|
"github.com/chrislusf/seaweedfs/weed/pb/iam_pb"
|
2020-12-07 08:10:29 +00:00
|
|
|
xhttp "github.com/chrislusf/seaweedfs/weed/s3api/http"
|
|
|
|
"github.com/chrislusf/seaweedfs/weed/s3api/s3err"
|
2020-02-09 22:30:02 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
type Action string
|
|
|
|
|
|
|
|
type Iam interface {
|
|
|
|
Check(f http.HandlerFunc, actions ...Action) http.HandlerFunc
|
|
|
|
}
|
|
|
|
|
|
|
|
type IdentityAccessManagement struct {
|
|
|
|
identities []*Identity
|
2020-02-10 00:02:05 +00:00
|
|
|
domain string
|
2020-02-09 22:30:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type Identity struct {
|
|
|
|
Name string
|
|
|
|
Credentials []*Credential
|
|
|
|
Actions []Action
|
|
|
|
}
|
|
|
|
|
|
|
|
type Credential struct {
|
|
|
|
AccessKey string
|
|
|
|
SecretKey string
|
|
|
|
}
|
|
|
|
|
2020-11-03 16:45:56 +00:00
|
|
|
func NewIdentityAccessManagement(option *S3ApiServerOption) *IdentityAccessManagement {
|
2020-02-10 00:02:05 +00:00
|
|
|
iam := &IdentityAccessManagement{
|
2020-11-03 16:45:56 +00:00
|
|
|
domain: option.DomainName,
|
2020-02-10 00:02:05 +00:00
|
|
|
}
|
2020-12-10 08:59:04 +00:00
|
|
|
if option.Config != "" {
|
2020-11-25 20:30:11 +00:00
|
|
|
if err := iam.loadS3ApiConfigurationFromFile(option.Config); err != nil {
|
2020-11-03 16:45:56 +00:00
|
|
|
glog.Fatalf("fail to load config file %s: %v", option.Config, err)
|
|
|
|
}
|
2020-12-10 08:59:04 +00:00
|
|
|
} else {
|
|
|
|
if err := iam.loadS3ApiConfigurationFromFiler(option); err != nil {
|
|
|
|
glog.Warningf("fail to load config: %v", err)
|
|
|
|
}
|
2020-02-09 22:30:02 +00:00
|
|
|
}
|
|
|
|
return iam
|
|
|
|
}
|
|
|
|
|
2020-11-25 20:30:11 +00:00
|
|
|
func (iam *IdentityAccessManagement) loadS3ApiConfigurationFromFiler(option *S3ApiServerOption) error {
|
2020-12-07 07:16:20 +00:00
|
|
|
content, err := filer.ReadContent(option.Filer, filer.IamConfigDirecotry, filer.IamIdentityFile)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("read S3 config: %v", err)
|
|
|
|
}
|
2020-12-10 08:15:22 +00:00
|
|
|
return iam.loadS3ApiConfigurationFromBytes(content)
|
2020-11-25 20:30:11 +00:00
|
|
|
}
|
2020-02-09 22:30:02 +00:00
|
|
|
|
2020-11-25 20:30:11 +00:00
|
|
|
func (iam *IdentityAccessManagement) loadS3ApiConfigurationFromFile(fileName string) error {
|
2020-12-10 08:15:22 +00:00
|
|
|
content, readErr := ioutil.ReadFile(fileName)
|
2020-02-09 22:30:02 +00:00
|
|
|
if readErr != nil {
|
|
|
|
glog.Warningf("fail to read %s : %v", fileName, readErr)
|
|
|
|
return fmt.Errorf("fail to read %s : %v", fileName, readErr)
|
|
|
|
}
|
2020-12-10 08:15:22 +00:00
|
|
|
return iam.loadS3ApiConfigurationFromBytes(content)
|
|
|
|
}
|
2020-02-09 22:30:02 +00:00
|
|
|
|
2020-12-10 08:15:22 +00:00
|
|
|
func (iam *IdentityAccessManagement) loadS3ApiConfigurationFromBytes(content []byte) error {
|
|
|
|
s3ApiConfiguration := &iam_pb.S3ApiConfiguration{}
|
|
|
|
if err := filer.ParseS3ConfigurationFromBytes(content, s3ApiConfiguration); err != nil {
|
2020-02-09 22:30:02 +00:00
|
|
|
glog.Warningf("unmarshal error: %v", err)
|
2020-12-10 08:15:22 +00:00
|
|
|
return fmt.Errorf("unmarshal error: %v", err)
|
2020-02-09 22:30:02 +00:00
|
|
|
}
|
2020-11-25 20:30:11 +00:00
|
|
|
if err := iam.loadS3ApiConfiguration(s3ApiConfiguration); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2020-02-09 22:30:02 +00:00
|
|
|
|
2020-11-25 20:30:11 +00:00
|
|
|
func (iam *IdentityAccessManagement) loadS3ApiConfiguration(config *iam_pb.S3ApiConfiguration) error {
|
2020-12-07 08:10:29 +00:00
|
|
|
var identities []*Identity
|
2020-11-25 20:30:11 +00:00
|
|
|
for _, ident := range config.Identities {
|
2020-02-09 22:30:02 +00:00
|
|
|
t := &Identity{
|
|
|
|
Name: ident.Name,
|
|
|
|
Credentials: nil,
|
|
|
|
Actions: nil,
|
|
|
|
}
|
|
|
|
for _, action := range ident.Actions {
|
|
|
|
t.Actions = append(t.Actions, Action(action))
|
|
|
|
}
|
|
|
|
for _, cred := range ident.Credentials {
|
|
|
|
t.Credentials = append(t.Credentials, &Credential{
|
|
|
|
AccessKey: cred.AccessKey,
|
|
|
|
SecretKey: cred.SecretKey,
|
|
|
|
})
|
|
|
|
}
|
2020-12-07 08:10:29 +00:00
|
|
|
identities = append(identities, t)
|
2020-02-09 22:30:02 +00:00
|
|
|
}
|
2020-12-07 08:10:29 +00:00
|
|
|
|
|
|
|
// atomically switch
|
|
|
|
iam.identities = identities
|
2020-02-09 22:30:02 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-07-11 16:11:15 +00:00
|
|
|
func (iam *IdentityAccessManagement) isEnabled() bool {
|
|
|
|
|
|
|
|
return len(iam.identities) > 0
|
|
|
|
}
|
|
|
|
|
2020-02-09 22:30:02 +00:00
|
|
|
func (iam *IdentityAccessManagement) lookupByAccessKey(accessKey string) (identity *Identity, cred *Credential, found bool) {
|
2020-07-11 16:11:15 +00:00
|
|
|
|
2020-02-09 22:30:02 +00:00
|
|
|
for _, ident := range iam.identities {
|
|
|
|
for _, cred := range ident.Credentials {
|
|
|
|
if cred.AccessKey == accessKey {
|
|
|
|
return ident, cred, true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil, nil, false
|
|
|
|
}
|
|
|
|
|
2020-08-06 10:41:34 +00:00
|
|
|
func (iam *IdentityAccessManagement) lookupAnonymous() (identity *Identity, found bool) {
|
|
|
|
|
|
|
|
for _, ident := range iam.identities {
|
|
|
|
if ident.Name == "anonymous" {
|
|
|
|
return ident, true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil, false
|
|
|
|
}
|
|
|
|
|
2020-02-23 05:34:18 +00:00
|
|
|
func (iam *IdentityAccessManagement) Auth(f http.HandlerFunc, action Action) http.HandlerFunc {
|
2020-02-09 22:30:02 +00:00
|
|
|
|
2020-07-25 09:14:49 +00:00
|
|
|
if !iam.isEnabled() {
|
2020-02-09 22:30:02 +00:00
|
|
|
return f
|
|
|
|
}
|
|
|
|
|
|
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
2020-11-11 08:20:59 +00:00
|
|
|
identity, errCode := iam.authRequest(r, action)
|
2020-09-19 21:09:58 +00:00
|
|
|
if errCode == s3err.ErrNone {
|
2020-11-11 08:20:59 +00:00
|
|
|
if identity != nil && identity.Name != "" {
|
|
|
|
r.Header.Set(xhttp.AmzIdentityId, identity.Name)
|
2020-11-12 21:57:54 +00:00
|
|
|
if identity.isAdmin() {
|
|
|
|
r.Header.Set(xhttp.AmzIsAdmin, "true")
|
|
|
|
}
|
2020-11-11 08:20:59 +00:00
|
|
|
}
|
2020-02-09 22:30:02 +00:00
|
|
|
f(w, r)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
writeErrorResponse(w, errCode, r.URL)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// check whether the request has valid access keys
|
2020-11-11 08:20:59 +00:00
|
|
|
func (iam *IdentityAccessManagement) authRequest(r *http.Request, action Action) (*Identity, s3err.ErrorCode) {
|
2020-12-25 08:38:56 +00:00
|
|
|
identity, s3Err := iam.authUser(r)
|
|
|
|
if s3Err != s3err.ErrNone {
|
|
|
|
return identity, s3Err
|
|
|
|
}
|
|
|
|
|
|
|
|
glog.V(3).Infof("user name: %v actions: %v", identity.Name, identity.Actions)
|
|
|
|
|
|
|
|
bucket, _ := getBucketAndObject(r)
|
|
|
|
|
|
|
|
if !identity.canDo(action, bucket) {
|
|
|
|
return identity, s3err.ErrAccessDenied
|
|
|
|
}
|
|
|
|
|
|
|
|
return identity, s3err.ErrNone
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
func (iam *IdentityAccessManagement) authUser(r *http.Request) (*Identity, s3err.ErrorCode) {
|
2020-02-09 22:30:02 +00:00
|
|
|
var identity *Identity
|
2020-09-19 21:09:58 +00:00
|
|
|
var s3Err s3err.ErrorCode
|
2020-08-06 10:41:34 +00:00
|
|
|
var found bool
|
2020-02-09 22:30:02 +00:00
|
|
|
switch getRequestAuthType(r) {
|
2020-02-10 00:02:05 +00:00
|
|
|
case authTypeStreamingSigned:
|
2020-11-11 08:20:59 +00:00
|
|
|
return identity, s3err.ErrNone
|
2020-02-10 00:02:05 +00:00
|
|
|
case authTypeUnknown:
|
|
|
|
glog.V(3).Infof("unknown auth type")
|
2020-11-11 08:20:59 +00:00
|
|
|
return identity, s3err.ErrAccessDenied
|
2020-02-09 22:30:02 +00:00
|
|
|
case authTypePresignedV2, authTypeSignedV2:
|
2020-02-10 00:02:05 +00:00
|
|
|
glog.V(3).Infof("v2 auth type")
|
|
|
|
identity, s3Err = iam.isReqAuthenticatedV2(r)
|
2020-02-09 22:30:02 +00:00
|
|
|
case authTypeSigned, authTypePresigned:
|
2020-02-10 00:02:05 +00:00
|
|
|
glog.V(3).Infof("v4 auth type")
|
2020-02-09 22:30:02 +00:00
|
|
|
identity, s3Err = iam.reqSignatureV4Verify(r)
|
add unhandled request auth type
fix
2020-02-18 11:43:57.396699 I | http: panic serving 172.28.0.43:50658: runtime error: invalid memory address or nil pointer dereference
goroutine 595 [running]:
net/http.(*conn).serve.func1(0xc0001fe3c0)
/usr/lib/go/src/net/http/server.go:1767 +0x13b
panic(0x55c4e35f3820, 0x55c4e48b3c40)
/usr/lib/go/src/runtime/panic.go:679 +0x1b6
github.com/chrislusf/seaweedfs/weed/s3api.(*IdentityAccessManagement).authRequest(0xc0004b84e0, 0xc000115900, 0xc0000bb650, 0x1, 0x1, 0x55c4e399d740)
/go/src/github.com/chrislusf/seaweedfs/weed/s3api/auth_credentials.go:143 +0x11c
github.com/chrislusf/seaweedfs/weed/s3api.(*IdentityAccessManagement).Auth.func1(0x55c4e3994c40, 0xc0007808c0, 0xc000115900)
/go/src/github.com/chrislusf/seaweedfs/weed/s3api/auth_credentials.go:111 +0x5e
net/http.HandlerFunc.ServeHTTP(0xc0004b87e0, 0x55c4e3994c40, 0xc0007808c0, 0xc000115900)
/usr/lib/go/src/net/http/server.go:2007 +0x46
github.com/gorilla/mux.(*Router).ServeHTTP(0xc0004ba000, 0x55c4e3994c40, 0xc0007808c0, 0xc000115700)
/root/go/pkg/mod/github.com/gorilla/mux@v1.7.3/mux.go:212 +0xe4
net/http.serverHandler.ServeHTTP(0xc00011e0e0, 0x55c4e3994c40, 0xc0007808c0, 0xc000115700)
/usr/lib/go/src/net/http/server.go:2802 +0xa6
net/http.(*conn).serve(0xc0001fe3c0, 0x55c4e399d680, 0xc000894180)
/usr/lib/go/src/net/http/server.go:1890 +0x877
created by net/http.(*Server).Serve
/usr/lib/go/src/net/http/server.go:2927 +0x390
2020-02-18 17:16:04 +00:00
|
|
|
case authTypePostPolicy:
|
2020-02-22 22:01:04 +00:00
|
|
|
glog.V(3).Infof("post policy auth type")
|
2020-11-11 08:20:59 +00:00
|
|
|
return identity, s3err.ErrNone
|
add unhandled request auth type
fix
2020-02-18 11:43:57.396699 I | http: panic serving 172.28.0.43:50658: runtime error: invalid memory address or nil pointer dereference
goroutine 595 [running]:
net/http.(*conn).serve.func1(0xc0001fe3c0)
/usr/lib/go/src/net/http/server.go:1767 +0x13b
panic(0x55c4e35f3820, 0x55c4e48b3c40)
/usr/lib/go/src/runtime/panic.go:679 +0x1b6
github.com/chrislusf/seaweedfs/weed/s3api.(*IdentityAccessManagement).authRequest(0xc0004b84e0, 0xc000115900, 0xc0000bb650, 0x1, 0x1, 0x55c4e399d740)
/go/src/github.com/chrislusf/seaweedfs/weed/s3api/auth_credentials.go:143 +0x11c
github.com/chrislusf/seaweedfs/weed/s3api.(*IdentityAccessManagement).Auth.func1(0x55c4e3994c40, 0xc0007808c0, 0xc000115900)
/go/src/github.com/chrislusf/seaweedfs/weed/s3api/auth_credentials.go:111 +0x5e
net/http.HandlerFunc.ServeHTTP(0xc0004b87e0, 0x55c4e3994c40, 0xc0007808c0, 0xc000115900)
/usr/lib/go/src/net/http/server.go:2007 +0x46
github.com/gorilla/mux.(*Router).ServeHTTP(0xc0004ba000, 0x55c4e3994c40, 0xc0007808c0, 0xc000115700)
/root/go/pkg/mod/github.com/gorilla/mux@v1.7.3/mux.go:212 +0xe4
net/http.serverHandler.ServeHTTP(0xc00011e0e0, 0x55c4e3994c40, 0xc0007808c0, 0xc000115700)
/usr/lib/go/src/net/http/server.go:2802 +0xa6
net/http.(*conn).serve(0xc0001fe3c0, 0x55c4e399d680, 0xc000894180)
/usr/lib/go/src/net/http/server.go:1890 +0x877
created by net/http.(*Server).Serve
/usr/lib/go/src/net/http/server.go:2927 +0x390
2020-02-18 17:16:04 +00:00
|
|
|
case authTypeJWT:
|
2020-02-22 22:01:04 +00:00
|
|
|
glog.V(3).Infof("jwt auth type")
|
2020-11-11 08:20:59 +00:00
|
|
|
return identity, s3err.ErrNotImplemented
|
add unhandled request auth type
fix
2020-02-18 11:43:57.396699 I | http: panic serving 172.28.0.43:50658: runtime error: invalid memory address or nil pointer dereference
goroutine 595 [running]:
net/http.(*conn).serve.func1(0xc0001fe3c0)
/usr/lib/go/src/net/http/server.go:1767 +0x13b
panic(0x55c4e35f3820, 0x55c4e48b3c40)
/usr/lib/go/src/runtime/panic.go:679 +0x1b6
github.com/chrislusf/seaweedfs/weed/s3api.(*IdentityAccessManagement).authRequest(0xc0004b84e0, 0xc000115900, 0xc0000bb650, 0x1, 0x1, 0x55c4e399d740)
/go/src/github.com/chrislusf/seaweedfs/weed/s3api/auth_credentials.go:143 +0x11c
github.com/chrislusf/seaweedfs/weed/s3api.(*IdentityAccessManagement).Auth.func1(0x55c4e3994c40, 0xc0007808c0, 0xc000115900)
/go/src/github.com/chrislusf/seaweedfs/weed/s3api/auth_credentials.go:111 +0x5e
net/http.HandlerFunc.ServeHTTP(0xc0004b87e0, 0x55c4e3994c40, 0xc0007808c0, 0xc000115900)
/usr/lib/go/src/net/http/server.go:2007 +0x46
github.com/gorilla/mux.(*Router).ServeHTTP(0xc0004ba000, 0x55c4e3994c40, 0xc0007808c0, 0xc000115700)
/root/go/pkg/mod/github.com/gorilla/mux@v1.7.3/mux.go:212 +0xe4
net/http.serverHandler.ServeHTTP(0xc00011e0e0, 0x55c4e3994c40, 0xc0007808c0, 0xc000115700)
/usr/lib/go/src/net/http/server.go:2802 +0xa6
net/http.(*conn).serve(0xc0001fe3c0, 0x55c4e399d680, 0xc000894180)
/usr/lib/go/src/net/http/server.go:1890 +0x877
created by net/http.(*Server).Serve
/usr/lib/go/src/net/http/server.go:2927 +0x390
2020-02-18 17:16:04 +00:00
|
|
|
case authTypeAnonymous:
|
2020-08-06 10:41:34 +00:00
|
|
|
identity, found = iam.lookupAnonymous()
|
|
|
|
if !found {
|
2020-11-11 08:20:59 +00:00
|
|
|
return identity, s3err.ErrAccessDenied
|
2020-08-06 10:41:34 +00:00
|
|
|
}
|
2020-02-22 22:01:04 +00:00
|
|
|
default:
|
2020-11-11 08:20:59 +00:00
|
|
|
return identity, s3err.ErrNotImplemented
|
2020-02-09 22:30:02 +00:00
|
|
|
}
|
|
|
|
|
2020-02-10 00:02:05 +00:00
|
|
|
glog.V(3).Infof("auth error: %v", s3Err)
|
2020-09-19 21:09:58 +00:00
|
|
|
if s3Err != s3err.ErrNone {
|
2020-11-11 08:20:59 +00:00
|
|
|
return identity, s3Err
|
2020-02-10 00:02:05 +00:00
|
|
|
}
|
2020-11-11 08:20:59 +00:00
|
|
|
return identity, s3err.ErrNone
|
2020-02-09 22:30:02 +00:00
|
|
|
}
|
|
|
|
|
2020-02-23 05:34:18 +00:00
|
|
|
func (identity *Identity) canDo(action Action, bucket string) bool {
|
2020-11-12 21:57:54 +00:00
|
|
|
if identity.isAdmin() {
|
|
|
|
return true
|
2020-02-23 05:34:18 +00:00
|
|
|
}
|
|
|
|
for _, a := range identity.Actions {
|
|
|
|
if a == action {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if bucket == "" {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
limitedByBucket := string(action) + ":" + bucket
|
2020-12-25 08:38:56 +00:00
|
|
|
adminLimitedByBucket := s3_constants.ACTION_ADMIN + ":" + bucket
|
2020-02-23 05:34:18 +00:00
|
|
|
for _, a := range identity.Actions {
|
|
|
|
if string(a) == limitedByBucket {
|
|
|
|
return true
|
2020-02-09 22:30:02 +00:00
|
|
|
}
|
2020-12-25 08:38:56 +00:00
|
|
|
if string(a) == adminLimitedByBucket {
|
|
|
|
return true
|
|
|
|
}
|
2020-02-09 22:30:02 +00:00
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
2020-11-12 21:57:54 +00:00
|
|
|
|
|
|
|
func (identity *Identity) isAdmin() bool {
|
|
|
|
for _, a := range identity.Actions {
|
|
|
|
if a == "Admin" {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|