mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-22 22:11:39 +02:00
* s3: resolve versionId ACL requests to the version ACL actions A request for an object's ACL carrying versionId acted on the historical version but authorized against the current-object action (s3:GetObjectAcl/s3:PutObjectAcl), because the acl block in resolveFromQueryParameters returned before versionId was considered - the same gap closed for tagging. An identity granted only current-object ACL access - or explicitly denied s3:*ObjectVersionAcl - could still read and modify ACLs on noncurrent versions. ?acl&versionId=<id> on an object now resolves to s3:GetObjectVersionAcl/s3:PutObjectVersionAcl; ?acl alone keeps the current-object actions and bucket ACL is unaffected. s3:PutObjectVersionAcl is mapped onto the WriteAcp identity action so policies can name it. * s3: resolve versionId attributes requests to the version attributes action GET /bucket/key?attributes&versionId=<id> fetched the historical version's attributes but authorized against s3:GetObjectAttributes, so a grant limited to the current-object attributes action could reach noncurrent versions. The request now resolves to s3:GetObjectVersionAttributes, and both attributes actions map onto the Read identity action so policies can name them (s3:GetObjectAttributes was previously rejected as an unmapped action). * s3api: recheck the version action on versioned ACL/attributes requests The phase-2 policy recheck inside GetObjectAclHandler, PutObjectAclHandler, and GetObjectAttributesHandler passed the current-object action even when the request carried versionId and phase 1 had resolved the version action. A Deny scoped to s3:*VersionAcl or s3:GetObjectVersionAttributes could never fire in the recheck, and an Allow limited to the version action went unevaluated. Select the action the same way the resolver does — versioned whenever versionId is present. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * s3api: recheck the version action on versioned tagging requests The same phase-2 gap exists in the tagging handlers left by the earlier version-tagging resolution change: versioned GetObjectTagging / PutObjectTagging / DeleteObjectTagging rechecks evaluated the current-object tagging action, so a Deny on s3:*VersionTagging could not fire. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * s3api: resolve HEAD ?acl as the head-object action, not an ACL action No HEAD acl route exists, so HEAD /bucket/key?acl lands on HeadObjectHandler — which serves object headers, not the ACL. Resolving it to an ACL action denied readers who hold only GetObject(Version) and let ACL grants reach a head-object read. Dropping HEAD from the acl branch lets the request fall through to GetObject/GetObjectVersion, matching how the tagging branch already treats HEAD. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * s3api: require the version read grant for versioned attributes AWS asks for s3:GetObjectVersion alongside s3:GetObjectVersionAttributes when a GetObjectAttributes request names a versionId; the resolved version-scoped action on its own left a lone s3:GetObjectVersion Deny unable to cover the attributes read. Check the version read grant too: the identity side through VerifyActionPermission, the bucket-policy side through the same recheck that evaluates the scoped action. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * s3api: check the version read grant on a synthesized versioned GET The versioned attributes check passed the literal s3:GetObjectVersion action, but both policy paths re-resolve the action from the request, so the attributes query parameter mapped it back to s3:GetObjectVersionAttributes and a lone version-read Deny never fired. The literal action also reached the legacy CanDo path, where a plain Read grant no longer matched. Evaluate the grant on a request shaped like a plain versioned GET instead. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * s3api: reject a named versionId on buckets without versioning Tagging, ACL, and attributes handlers answered versionId requests on never-versioned buckets as the current object while evaluating the version-scoped action, so a grant limited to the version action could authorize changes to the live entry. Reject the request up front through the existing checkVersionIdConfigured gate. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * s3api: carry presign params onto synthesized policy requests objectKeyPolicyRequest rebuilt the query with only versionId and the STS token, so a presigned request's s3:authType condition value silently changed from REST-QUERY-STRING to unset during phase-2 rechecks (version read grant, copy source, delete keys, post-policy writes). A policy conditioned on s3:authType would then deny a request it already allowed. Carry the SigV2/SigV4 presign keys through; none of them steer ResolveS3Action. --------- Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
366 lines
11 KiB
Go
366 lines
11 KiB
Go
package s3api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"encoding/xml"
|
|
"errors"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/glog"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
|
|
)
|
|
|
|
const maxPartsListDefault = 1000
|
|
|
|
// GetObjectAttributesResponse is the XML response for GetObjectAttributes.
|
|
type GetObjectAttributesResponse struct {
|
|
XMLName xml.Name `xml:"GetObjectAttributesResponse"`
|
|
ETag string `xml:"ETag,omitempty"`
|
|
Checksum *ObjectAttributesChecksum `xml:"Checksum,omitempty"`
|
|
ObjectParts *ObjectAttributesParts `xml:"ObjectParts,omitempty"`
|
|
StorageClass string `xml:"StorageClass,omitempty"`
|
|
ObjectSize *int64 `xml:"ObjectSize,omitempty"`
|
|
}
|
|
|
|
// ObjectAttributesChecksum holds checksum info for GetObjectAttributes.
|
|
type ObjectAttributesChecksum struct {
|
|
ChecksumResult
|
|
ChecksumType string `xml:"ChecksumType,omitempty"`
|
|
}
|
|
|
|
// ObjectAttributesParts holds parts info for GetObjectAttributes.
|
|
type ObjectAttributesParts struct {
|
|
IsTruncated bool `xml:"IsTruncated"`
|
|
MaxParts int `xml:"MaxParts"`
|
|
NextPartNumberMarker int `xml:"NextPartNumberMarker"`
|
|
PartNumberMarker int `xml:"PartNumberMarker"`
|
|
TotalPartsCount int `xml:"PartsCount"`
|
|
Parts []*ObjectAttributesPart `xml:"Part"`
|
|
}
|
|
|
|
// ObjectAttributesPart holds info for a single part.
|
|
type ObjectAttributesPart struct {
|
|
PartNumber int `xml:"PartNumber"`
|
|
Size int64 `xml:"Size"`
|
|
}
|
|
|
|
// parseObjectAttributes parses the X-Amz-Object-Attributes header.
|
|
func parseObjectAttributes(h http.Header) map[string]struct{} {
|
|
attrs := make(map[string]struct{})
|
|
for _, headerVal := range h.Values(s3_constants.AmzObjectAttributes) {
|
|
for _, v := range strings.Split(strings.TrimSpace(headerVal), ",") {
|
|
v = strings.TrimSpace(v)
|
|
if v != "" {
|
|
attrs[v] = struct{}{}
|
|
}
|
|
}
|
|
}
|
|
return attrs
|
|
}
|
|
|
|
// validateObjectAttributes checks that all requested attributes are valid.
|
|
func validateObjectAttributes(attrs map[string]struct{}) bool {
|
|
for attr := range attrs {
|
|
switch attr {
|
|
case "ETag", "Checksum", "StorageClass", "ObjectSize", "ObjectParts":
|
|
default:
|
|
return false
|
|
}
|
|
}
|
|
return true
|
|
}
|
|
|
|
// objectAttributesChecksum returns the additional checksum that PutObject or
|
|
// CompleteMultipartUpload stored with the object, or nil if it has none.
|
|
func objectAttributesChecksum(entry *filer_pb.Entry) *ObjectAttributesChecksum {
|
|
if entry == nil || entry.Extended == nil {
|
|
return nil
|
|
}
|
|
value := string(entry.Extended[s3_constants.ExtChecksumValue])
|
|
if value == "" {
|
|
return nil
|
|
}
|
|
checksum := &ObjectAttributesChecksum{ChecksumType: string(entry.Extended[s3_constants.ExtChecksumType])}
|
|
checksum.SetChecksum(string(entry.Extended[s3_constants.ExtChecksumAlgorithm]), value)
|
|
if checksum.ChecksumResult == (ChecksumResult{}) {
|
|
return nil
|
|
}
|
|
return checksum
|
|
}
|
|
|
|
func (s3a *S3ApiServer) GetObjectAttributesHandler(w http.ResponseWriter, r *http.Request) {
|
|
bucket, object := s3_constants.GetBucketAndObject(r)
|
|
glog.V(3).Infof("GetObjectAttributesHandler %s %s", bucket, object)
|
|
|
|
// Parse and validate requested attributes
|
|
requestedAttrs := parseObjectAttributes(r.Header)
|
|
if len(requestedAttrs) == 0 || !validateObjectAttributes(requestedAttrs) {
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrInvalidAttributeName)
|
|
return
|
|
}
|
|
|
|
// Parse optional pagination headers for ObjectParts
|
|
maxParts := maxPartsListDefault
|
|
if v := r.Header.Get(s3_constants.AmzMaxParts); v != "" {
|
|
parsed, err := strconv.Atoi(v)
|
|
if err != nil || parsed < 0 {
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrInvalidMaxParts)
|
|
return
|
|
}
|
|
maxParts = parsed
|
|
if maxParts > maxPartsListDefault {
|
|
maxParts = maxPartsListDefault
|
|
}
|
|
}
|
|
partNumberMarker := 0
|
|
if v := r.Header.Get(s3_constants.AmzPartNumberMarker); v != "" {
|
|
parsed, err := strconv.Atoi(v)
|
|
if err != nil || parsed < 0 {
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrInvalidPartNumberMarker)
|
|
return
|
|
}
|
|
partNumberMarker = parsed
|
|
}
|
|
|
|
// Check for specific version ID
|
|
versionId := r.URL.Query().Get("versionId")
|
|
if errCode := s3a.checkVersionIdConfigured(bucket, versionId); errCode != s3err.ErrNone {
|
|
s3err.WriteErrorResponse(w, r, errCode)
|
|
return
|
|
}
|
|
|
|
var (
|
|
entry *filer_pb.Entry
|
|
err error
|
|
)
|
|
|
|
versioningConfigured, err := s3a.isVersioningConfigured(bucket)
|
|
if err != nil {
|
|
if err == filer_pb.ErrNotFound {
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchBucket)
|
|
return
|
|
}
|
|
glog.Errorf("Error checking versioning for bucket %s: %v", bucket, err)
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
|
|
return
|
|
}
|
|
|
|
if versioningConfigured {
|
|
var targetVersionId string
|
|
|
|
if versionId != "" {
|
|
entry, err = s3a.getSpecificObjectVersion(bucket, object, versionId)
|
|
if err != nil {
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
|
|
return
|
|
}
|
|
targetVersionId = versionId
|
|
} else {
|
|
bucketDir := s3a.bucketDir(bucket)
|
|
normalizedObject := s3_constants.NormalizeObjectKey(object)
|
|
versionsDir := normalizedObject + s3_constants.VersionsFolder
|
|
|
|
versionsEntry, versionsErr := s3a.getEntry(bucketDir, versionsDir)
|
|
if versionsErr == nil && versionsEntry != nil {
|
|
entry, err = s3a.getLatestObjectVersion(bucket, object)
|
|
if err != nil {
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
|
|
return
|
|
}
|
|
} else if errors.Is(versionsErr, filer_pb.ErrNotFound) {
|
|
regularEntry, regularErr := s3a.getEntry(bucketDir, normalizedObject)
|
|
if regularErr == nil && regularEntry != nil {
|
|
entry = regularEntry
|
|
targetVersionId = "null"
|
|
} else {
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
|
|
return
|
|
}
|
|
} else {
|
|
entry, err = s3a.getLatestObjectVersion(bucket, object)
|
|
if err != nil {
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
|
|
return
|
|
}
|
|
}
|
|
|
|
if targetVersionId == "" {
|
|
if entry.Extended != nil {
|
|
if versionIdBytes, exists := entry.Extended[s3_constants.ExtVersionIdKey]; exists {
|
|
targetVersionId = string(versionIdBytes)
|
|
}
|
|
}
|
|
if targetVersionId == "" {
|
|
targetVersionId = "null"
|
|
}
|
|
}
|
|
}
|
|
|
|
// Check for delete marker
|
|
if entry.Extended != nil {
|
|
if deleteMarker, exists := entry.Extended[s3_constants.ExtDeleteMarkerKey]; exists && string(deleteMarker) == "true" {
|
|
w.Header().Set(s3_constants.AmzDeleteMarker, "true")
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
|
|
return
|
|
}
|
|
}
|
|
|
|
w.Header().Set("x-amz-version-id", targetVersionId)
|
|
} else {
|
|
entry, err = s3a.fetchObjectEntry(bucket, object)
|
|
if err != nil {
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
|
|
return
|
|
}
|
|
if entry == nil {
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
|
|
return
|
|
}
|
|
}
|
|
|
|
action := s3_constants.S3_ACTION_GET_OBJECT_ATTRIBUTES
|
|
if versionId != "" {
|
|
action = s3_constants.S3_ACTION_GET_OBJECT_VERSION_ATTRIBUTES
|
|
}
|
|
if errCode := s3a.recheckPolicyWithObjectEntry(r, bucket, object, action, entry.Extended, "GetObjectAttributesHandler"); errCode != s3err.ErrNone {
|
|
s3err.WriteErrorResponse(w, r, errCode)
|
|
return
|
|
}
|
|
|
|
// AWS also asks for the version read grant on a versioned attributes
|
|
// request: s3:GetObjectVersionAttributes alone is not sufficient.
|
|
if versionId != "" {
|
|
if errCode := s3a.checkVersionReadGrant(r, bucket, object, versionId, entry.Extended); errCode != s3err.ErrNone {
|
|
s3err.WriteErrorResponse(w, r, errCode)
|
|
return
|
|
}
|
|
}
|
|
|
|
// Evaluate conditional headers against the resolved entry (after version resolution)
|
|
// This ensures conditions are checked against the correct version, not always the latest
|
|
if s3a.hasConditionalHeaders(r) {
|
|
headers, errCode := parseConditionalHeaders(r)
|
|
if errCode != s3err.ErrNone {
|
|
s3err.WriteErrorResponse(w, r, errCode)
|
|
return
|
|
}
|
|
result := s3a.validateConditionalHeadersForReads(r, headers, entry, bucket, object)
|
|
if result.ErrorCode != s3err.ErrNone {
|
|
glog.V(3).Infof("GetObjectAttributesHandler: Conditional header check failed for %s/%s with error %v", bucket, object, result.ErrorCode)
|
|
if result.ErrorCode == s3err.ErrNotModified && result.ETag != "" {
|
|
w.Header().Set("ETag", result.ETag)
|
|
}
|
|
s3err.WriteErrorResponse(w, r, result.ErrorCode)
|
|
return
|
|
}
|
|
}
|
|
|
|
if entry == nil {
|
|
s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
|
|
return
|
|
}
|
|
|
|
// Build response with only requested attributes
|
|
resp := &GetObjectAttributesResponse{}
|
|
|
|
if _, ok := requestedAttrs["ETag"]; ok {
|
|
etag := s3a.getObjectETag(entry)
|
|
resp.ETag = strings.Trim(etag, `"`)
|
|
}
|
|
|
|
if _, ok := requestedAttrs["StorageClass"]; ok {
|
|
storageClass := "STANDARD"
|
|
if entry.Extended != nil {
|
|
if sc, exists := entry.Extended[s3_constants.AmzStorageClass]; exists && len(sc) > 0 {
|
|
storageClass = string(sc)
|
|
}
|
|
}
|
|
resp.StorageClass = storageClass
|
|
}
|
|
|
|
if _, ok := requestedAttrs["Checksum"]; ok {
|
|
resp.Checksum = objectAttributesChecksum(entry)
|
|
}
|
|
|
|
if _, ok := requestedAttrs["ObjectSize"]; ok {
|
|
var size int64
|
|
if entry.Attributes != nil {
|
|
size = int64(entry.Attributes.FileSize)
|
|
}
|
|
resp.ObjectSize = &size
|
|
}
|
|
|
|
if _, ok := requestedAttrs["ObjectParts"]; ok {
|
|
resp.ObjectParts = s3a.buildObjectAttributesParts(entry, maxParts, partNumberMarker)
|
|
}
|
|
|
|
// Set Last-Modified, remove Content-Type
|
|
if entry.Attributes != nil && entry.Attributes.Mtime > 0 {
|
|
w.Header().Set("Last-Modified", time.Unix(entry.Attributes.Mtime, 0).UTC().Format(http.TimeFormat))
|
|
}
|
|
w.Header().Del("Content-Type")
|
|
|
|
writeSuccessResponseXML(w, r, resp)
|
|
}
|
|
|
|
// buildObjectAttributesParts builds the ObjectParts section from multipart metadata.
|
|
func (s3a *S3ApiServer) buildObjectAttributesParts(entry *filer_pb.Entry, maxParts, partNumberMarker int) *ObjectAttributesParts {
|
|
if entry.Extended == nil {
|
|
return nil
|
|
}
|
|
|
|
boundariesJSON, exists := entry.Extended[s3_constants.SeaweedFSMultipartPartBoundaries]
|
|
if !exists {
|
|
return nil
|
|
}
|
|
|
|
var boundaries []PartBoundaryInfo
|
|
if err := json.Unmarshal(boundariesJSON, &boundaries); err != nil {
|
|
glog.Warningf("GetObjectAttributes: failed to unmarshal part boundaries: %v", err)
|
|
return nil
|
|
}
|
|
|
|
if len(boundaries) == 0 {
|
|
return nil
|
|
}
|
|
|
|
parts := &ObjectAttributesParts{
|
|
PartNumberMarker: partNumberMarker,
|
|
MaxParts: maxParts,
|
|
TotalPartsCount: len(boundaries),
|
|
}
|
|
|
|
chunks := entry.GetChunks()
|
|
for _, b := range boundaries {
|
|
if b.PartNumber <= partNumberMarker {
|
|
continue
|
|
}
|
|
if len(parts.Parts) >= maxParts {
|
|
parts.IsTruncated = true
|
|
break
|
|
}
|
|
|
|
var partSize int64
|
|
if b.EndOffset > b.StartOffset {
|
|
partSize = b.EndOffset - b.StartOffset
|
|
} else if b.StartChunk >= 0 && b.EndChunk >= 0 && b.StartChunk < len(chunks) && b.EndChunk <= len(chunks) && b.StartChunk < b.EndChunk {
|
|
for ci := b.StartChunk; ci < b.EndChunk; ci++ {
|
|
partSize += int64(chunks[ci].Size)
|
|
}
|
|
}
|
|
|
|
parts.NextPartNumberMarker = b.PartNumber
|
|
parts.Parts = append(parts.Parts, &ObjectAttributesPart{
|
|
PartNumber: b.PartNumber,
|
|
Size: partSize,
|
|
})
|
|
}
|
|
|
|
return parts
|
|
}
|