realloc/frostfs-s3-gw
1
0
Fork 0
forked from TrueCloudLab/frostfs-s3-gw
Code Issues Pull requests Projects Releases Packages Wiki Activity

[#360] Use 'c' prefix for bucket policies instead of 'n'

Browse source 
With 'c' prefix, acl chains become shorter, thus gateway
receives shorter results and avoids sessions to neo-go.

There is still issue with many IAM rules.

Signed-off-by: Alex Vanin <a.vanin@yadro.com>
This commit is contained in:
Alexey Vanin 2024-04-10 15:53:36 +03:00
parent 3ea3f971e1
commit 6da1acc554
8 changed files with 49 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

53
api/middleware/policy.go
View file

@ -72,15 +72,34 @@ func policyCheck(r *http.Request, cfg PolicyConfig) error {
return err
}
reqInfo := GetReqInfo(r.Context())
target := engine.NewRequestTargetWithNamespace(reqInfo.Namespace)
st, found, err := cfg.Storage.IsAllowed(chain.S3, target, req)
if err != nil {
return err
var bktInfo *data.BucketInfo
if reqType != noneType && !strings.HasSuffix(req.Operation(), CreateBucketOperation) {
bktInfo, err = cfg.BucketResolver(r.Context(), bktName)
if err != nil {
return err
}
}
if !found {
st = chain.NoRuleFound
reqInfo := GetReqInfo(r.Context())
targets := []engine.RequestTarget{
engine.NewRequestTargetWithNamespace(reqInfo.Namespace),
}
if bktInfo != nil {
targets = append(targets, engine.NewRequestTargetWithContainer(bktInfo.CID.EncodeToString()))
}
st := chain.NoRuleFound
for _, target := range targets {
status, found, err := cfg.Storage.IsAllowed(chain.S3, target, req)
if err != nil {
return err
}
if found {
st = status
if status != chain.Allow {
break
}
}
}
switch {
@ -90,9 +109,9 @@ func policyCheck(r *http.Request, cfg PolicyConfig) error {
return apiErr.GetAPIErrorWithError(apiErr.ErrAccessDenied, fmt.Errorf("policy check: %s", st.String()))
}
isAPE, err := isAPEBehavior(r.Context(), req, cfg, reqType, bktName)
if err != nil {
return err
isAPE := !cfg.Settings.ACLEnabled()
if bktInfo != nil {
isAPE = bktInfo.APEEnabled
}
if isAPE && cfg.Settings.PolicyDenyByDefault() {
@ -102,20 +121,6 @@ func policyCheck(r *http.Request, cfg PolicyConfig) error {
return nil
}
func isAPEBehavior(ctx context.Context, req *testutil.Request, cfg PolicyConfig, reqType ReqType, bktName string) (bool, error) {
if reqType == noneType ||
strings.HasSuffix(req.Operation(), CreateBucketOperation) {
return !cfg.Settings.ACLEnabled(), nil
}
bktInfo, err := cfg.BucketResolver(ctx, bktName) // we cannot use reqInfo.BucketName because it hasn't been set yet
if err != nil {
return false, err
}
return bktInfo.APEEnabled, nil
}
func getPolicyRequest(r *http.Request, frostfsid FrostFSIDInformer, reqType ReqType, bktName string, objName string, log *zap.Logger) (*testutil.Request, error) {
var (
owner string