mirror of
https://github.com/cubefs/cubefs.git
synced 2026-08-02 02:00:56 +00:00
feature: cache authnode-info in objectnode and check user policy before calling handle function
Signed-off-by: wenjia322 <buaa1214wwj@126.com>
This commit is contained in:
wenjia322
parent
f7b65b36fb
commit
0ea6447516
@ -32,10 +32,13 @@ sleep 2s
|
||||
./cfs-authtool api -host=192.168.0.14:8080 -ticketfile=./ticket_admin.json -data=./data_master.json -output=./key_master.json AuthService createkey
|
||||
#create key for client
|
||||
./cfs-authtool api -host=192.168.0.14:8080 -ticketfile=./ticket_admin.json -data=./data_client.json -output=./key_client.json AuthService createkey
|
||||
#create key for objectnode
|
||||
./cfs-authtool api -host=192.168.0.14:8080 -ticketfile=./ticket_admin.json -data=./data_objectnode.json -output=./key_object.json AuthService createkey
|
||||
|
||||
#write key to json file
|
||||
clientKey=$(sed -n '3p' key_client.json | sed 's/auth_key/clientKey/g')
|
||||
masterKey=$(sed -n '3p' key_master.json | sed 's/auth_key/masterServiceKey/g')
|
||||
objectKey=$(sed -n '3p' key_object.json | sed 's/auth_key/authKey/g')
|
||||
cd ..
|
||||
cd ..
|
||||
lineClient=`expr $(cat docker/conf/client.json | wc -l) - 1`
|
||||
@ -44,6 +47,8 @@ lineMaster=`expr $(cat docker/conf/master1.json | wc -l) - 1`
|
||||
sed -i "${lineMaster}i ${masterKey}" docker/conf/master1.json
|
||||
sed -i "${lineMaster}i ${masterKey}" docker/conf/master2.json
|
||||
sed -i "${lineMaster}i ${masterKey}" docker/conf/master3.json
|
||||
lineObject=`expr $(cat docker/conf/objectnode.json | wc -l) - 1`
|
||||
sed -i "${lineObject}i ${objectKey}" docker/conf/objectnode.json
|
||||
|
||||
#delete temp files
|
||||
rm -f ./docker/authnode/authservice.json
|
||||
@ -52,4 +57,5 @@ rm -f ./docker/authnode/ticket_auth.json
|
||||
rm -f ./docker/authnode/key_admin.json
|
||||
rm -f ./docker/authnode/ticket_admin.json
|
||||
rm -f ./docker/authnode/key_master.json
|
||||
rm -f ./docker/authnode/key_client.json
|
||||
rm -f ./docker/authnode/key_client.json
|
||||
rm -f ./docker/authnode/key_object.json
|
||||
@ -8,5 +8,8 @@
|
||||
"192.168.0.11:17010",
|
||||
"192.168.0.12:17010",
|
||||
"192.168.0.13:17010"
|
||||
]
|
||||
],
|
||||
"authNodes": "192.168.0.14:8080,192.168.0.15:8081,192.168.0.16:8082",
|
||||
"enableHTTPS": "false",
|
||||
"certFile": ""
|
||||
}
|
||||
|
||||
@ -25,16 +25,17 @@ import (
|
||||
)
|
||||
|
||||
type RequestParam struct {
|
||||
account string
|
||||
resource string
|
||||
bucket string
|
||||
object string
|
||||
actions []Action
|
||||
sourceIP string
|
||||
vol *volume
|
||||
condVals map[string][]string
|
||||
isOwner bool
|
||||
vars map[string]string
|
||||
account string
|
||||
resource string
|
||||
bucket string
|
||||
object string
|
||||
actions []Action
|
||||
sourceIP string
|
||||
vol *volume
|
||||
condVals map[string][]string
|
||||
isOwner bool
|
||||
vars map[string]string
|
||||
accessKey string
|
||||
}
|
||||
|
||||
func (o *ObjectNode) parseRequestParam(r *http.Request) (*RequestParam, error) {
|
||||
@ -62,6 +63,7 @@ func (o *ObjectNode) parseRequestParam(r *http.Request) (*RequestParam, error) {
|
||||
if auth.accessKey == accessKey {
|
||||
p.isOwner = true
|
||||
}
|
||||
p.accessKey = auth.accessKey
|
||||
}
|
||||
|
||||
return p, nil
|
||||
|
||||
@ -466,8 +466,8 @@ func (o *ObjectNode) getBucketV1Handler(w http.ResponseWriter, r *http.Request)
|
||||
}
|
||||
|
||||
// get owner
|
||||
aceesKey, _ := vl.OSSSecure()
|
||||
bucketOwner := NewBucketOwner(aceesKey)
|
||||
accessKey, _ := vl.OSSSecure()
|
||||
bucketOwner := NewBucketOwner(accessKey)
|
||||
var contents = make([]*Content, 0)
|
||||
if len(fsFileInfos) > 0 {
|
||||
for _, fsFileInfo := range fsFileInfos {
|
||||
|
||||
@ -26,7 +26,6 @@ import (
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/chubaofs/chubaofs/proto"
|
||||
"github.com/chubaofs/chubaofs/util"
|
||||
"github.com/chubaofs/chubaofs/util/keystore"
|
||||
"github.com/chubaofs/chubaofs/util/log"
|
||||
@ -176,12 +175,10 @@ func (o *ObjectNode) checkSignatureV2(r *http.Request) (bool, error) {
|
||||
}
|
||||
|
||||
var akCaps *keystore.AccessKeyCaps
|
||||
akCaps, err = o.authClient.API().OSSGetCaps(proto.ObjectServiceID, o.authKey, authInfo.accessKeyId)
|
||||
if err != nil {
|
||||
if akCaps, err = o.authStore.GetAkCaps(authInfo.accessKeyId); err != nil {
|
||||
log.LogInfof("get secretKey from authnode error: accessKey(%v), err(%v)", authInfo.accessKeyId, err)
|
||||
return false, err
|
||||
}
|
||||
//volAccessKey, volSecret := v.OSSSecure()
|
||||
|
||||
// 2. calculate new signature
|
||||
newSignature, err1 := calculateSignatureV2(authInfo, akCaps.SecretKey, o.domains)
|
||||
@ -263,8 +260,7 @@ func (o *ObjectNode) checkPresignedSignatureV2(r *http.Request) (bool, error) {
|
||||
|
||||
//check access key
|
||||
var akCaps *keystore.AccessKeyCaps
|
||||
akCaps, err = o.authClient.API().OSSGetCaps(proto.ObjectServiceID, o.authKey, accessKey)
|
||||
if err != nil {
|
||||
if akCaps, err = o.authStore.GetAkCaps(accessKey); err != nil {
|
||||
log.LogInfof("get secretKey from authnode error: accessKey(%v), err(%v)", accessKey, err)
|
||||
return false, err
|
||||
}
|
||||
|
||||
@ -24,7 +24,6 @@ import (
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/chubaofs/chubaofs/proto"
|
||||
"github.com/chubaofs/chubaofs/util"
|
||||
"github.com/chubaofs/chubaofs/util/keystore"
|
||||
"github.com/chubaofs/chubaofs/util/log"
|
||||
@ -110,8 +109,7 @@ func (o *ObjectNode) checkSignatureV4(r *http.Request) (bool, error) {
|
||||
return false, err
|
||||
}
|
||||
var akCaps *keystore.AccessKeyCaps
|
||||
akCaps, err = o.authClient.API().OSSGetCaps(proto.ObjectServiceID, o.authKey, req.Credential.AccessKey)
|
||||
if err != nil {
|
||||
if akCaps, err = o.authStore.GetAkCaps(req.Credential.AccessKey); err != nil {
|
||||
log.LogInfof("get secretKey from authnode error: accessKey(%v), err(%v)", req.Credential.AccessKey, err)
|
||||
return false, err
|
||||
}
|
||||
@ -151,8 +149,7 @@ func (o *ObjectNode) checkPresignedSignatureV4(r *http.Request) (pass bool, err
|
||||
|
||||
// check accessKey valid
|
||||
var akCaps *keystore.AccessKeyCaps
|
||||
akCaps, err = o.authClient.API().OSSGetCaps(proto.ObjectServiceID, o.authKey, req.Credential.AccessKey)
|
||||
if err != nil {
|
||||
if akCaps, err = o.authStore.GetAkCaps(req.Credential.AccessKey); err != nil {
|
||||
log.LogInfof("get secretKey from authnode error: accessKey(%v), err(%v)", req.Credential.AccessKey, err)
|
||||
return false, err
|
||||
}
|
||||
|
||||
@ -72,7 +72,7 @@ type FSPart struct {
|
||||
}
|
||||
|
||||
type Volume interface {
|
||||
OSSSecure() (accessKey, secretKey string)
|
||||
OSSSecure() (accessKey, secretKey string) //todo delete
|
||||
OSSMeta() *OSSMeta
|
||||
|
||||
// ListFiles return an FileInfo slice of specified volume, like read dir for hole volume.
|
||||
|
||||
@ -14,33 +14,106 @@
|
||||
|
||||
package objectnode
|
||||
|
||||
import (
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/chubaofs/chubaofs/proto"
|
||||
authSDK "github.com/chubaofs/chubaofs/sdk/auth"
|
||||
"github.com/chubaofs/chubaofs/util/keystore"
|
||||
"github.com/chubaofs/chubaofs/util/log"
|
||||
)
|
||||
|
||||
const (
|
||||
RefreshAuthStoreInterval = time.Minute * 1
|
||||
)
|
||||
|
||||
type authnodeStore struct {
|
||||
vm *volumeManager //vol *volume
|
||||
authKey string
|
||||
authClient *authSDK.AuthClient
|
||||
akCapsStore map[string]*keystore.AccessKeyCaps
|
||||
capsMu sync.RWMutex
|
||||
closeCh chan struct{}
|
||||
closeOnce sync.Once
|
||||
}
|
||||
|
||||
func (s *authnodeStore) Init(vm *volumeManager) {
|
||||
s.vm = vm
|
||||
//TODO: init authnode store
|
||||
func newAuthStore(authKey, authNodes, certFile string, enableHTTPS bool) *authnodeStore {
|
||||
authClient := authSDK.NewAuthClient(authNodes, enableHTTPS, certFile)
|
||||
as := &authnodeStore{
|
||||
authKey: authKey,
|
||||
authClient: authClient,
|
||||
akCapsStore: make(map[string]*keystore.AccessKeyCaps),
|
||||
closeCh: make(chan struct{}, 1),
|
||||
}
|
||||
|
||||
go as.refresh()
|
||||
return as
|
||||
}
|
||||
|
||||
func (s *authnodeStore) Get(vol, path, key string) (val []byte, err error) {
|
||||
//TODO where call close?
|
||||
func (as *authnodeStore) Close() {
|
||||
as.capsMu.Lock()
|
||||
defer as.capsMu.Unlock()
|
||||
as.closeOnce.Do(func() {
|
||||
close(as.closeCh)
|
||||
})
|
||||
}
|
||||
|
||||
func (as *authnodeStore) Get(accessKey string) (akCaps *keystore.AccessKeyCaps, exit bool) {
|
||||
as.capsMu.RLock()
|
||||
defer as.capsMu.RUnlock()
|
||||
akCaps, exit = as.akCapsStore[accessKey]
|
||||
return
|
||||
}
|
||||
|
||||
func (s *authnodeStore) Put(vol, path, key string, data []byte) (err error) {
|
||||
//TODO: implement authonode store put method
|
||||
|
||||
return nil
|
||||
func (as *authnodeStore) Put(accessKey string, cap *keystore.AccessKeyCaps) {
|
||||
as.capsMu.Lock()
|
||||
defer as.capsMu.Unlock()
|
||||
as.akCapsStore[accessKey] = cap
|
||||
return
|
||||
}
|
||||
|
||||
func (s *authnodeStore) Delete(vol, path, key string) (err error) {
|
||||
func (as *authnodeStore) refresh() {
|
||||
t := time.NewTicker(RefreshAuthStoreInterval)
|
||||
defer t.Stop()
|
||||
for {
|
||||
select {
|
||||
case <-t.C:
|
||||
as.capsMu.Lock()
|
||||
for ak := range as.akCapsStore {
|
||||
akCaps, err := as.authClient.API().OSSGetCaps(proto.ObjectServiceID, as.authKey, ak)
|
||||
if err != nil {
|
||||
log.LogInfof("update user policy failed: accessKey(%v), err(%v)", ak, err)
|
||||
continue
|
||||
}
|
||||
as.akCapsStore[ak] = akCaps
|
||||
}
|
||||
as.capsMu.Unlock()
|
||||
case <-as.closeCh:
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (as *authnodeStore) GetAkCaps(accessKey string) (akCaps *keystore.AccessKeyCaps, err error) {
|
||||
akCaps, exit := as.Get(accessKey)
|
||||
if !exit {
|
||||
if akCaps, err = as.authClient.API().OSSGetCaps(proto.ObjectServiceID, as.authKey, accessKey); err != nil {
|
||||
log.LogInfof("load user policy err: %v", err)
|
||||
return
|
||||
}
|
||||
as.Put(accessKey, akCaps)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
func (as *authnodeStore) Delete(vol, path, key string) (err error) {
|
||||
//TODO: implement authonode store put method
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
func (s *authnodeStore) List(vol, path string) (data [][]byte, err error) {
|
||||
func (as *authnodeStore) List(vol, path string) (data [][]byte, err error) {
|
||||
//TODO: implement authonode store list method
|
||||
|
||||
return
|
||||
|
||||
@ -23,14 +23,26 @@ import (
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"github.com/chubaofs/chubaofs/proto"
|
||||
"github.com/chubaofs/chubaofs/util/caps"
|
||||
"github.com/chubaofs/chubaofs/util/keystore"
|
||||
"github.com/chubaofs/chubaofs/util/log"
|
||||
)
|
||||
|
||||
type ActionType string
|
||||
|
||||
const (
|
||||
Read ActionType = "r"
|
||||
Write ActionType = "w"
|
||||
ReadWrite ActionType = "rw"
|
||||
)
|
||||
|
||||
// https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html
|
||||
const (
|
||||
PolicyDefaultVersion = "2012-10-17"
|
||||
BucketPolicyLimitSize = 20 * 1024 //Bucket policies are limited to 20KB
|
||||
ArnSplitToken = ":"
|
||||
S3Flag = "S3"
|
||||
)
|
||||
|
||||
//https://docs.aws.amazon.com/zh_cn/AmazonS3/latest/dev/example-bucket-policies.html
|
||||
@ -180,7 +192,7 @@ func (p *Policy) IsAllowed(params *RequestParam) bool {
|
||||
return false
|
||||
}
|
||||
|
||||
func (o *ObjectNode) policyCheck(f http.HandlerFunc, actions []Action) http.HandlerFunc {
|
||||
func (o *ObjectNode) policyCheck(f http.HandlerFunc, actions []Action, actionType ActionType) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
var (
|
||||
err error
|
||||
@ -231,6 +243,26 @@ func (o *ObjectNode) policyCheck(f http.HandlerFunc, actions []Action) http.Hand
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
//check user policy
|
||||
var akCaps *keystore.AccessKeyCaps
|
||||
if akCaps, err = o.authStore.GetAkCaps(param.accessKey); err != nil {
|
||||
log.LogInfof("get user policy from authnode error: accessKey(%v), err(%v)", param.accessKey, err)
|
||||
return
|
||||
}
|
||||
cap := new(caps.Caps)
|
||||
if err = cap.Init(akCaps.Caps); err != nil {
|
||||
log.LogInfof("load user caps err: %v", err)
|
||||
return
|
||||
}
|
||||
curCap := S3Flag + ArnSplitToken + param.bucket + ArnSplitToken + string(actionType)
|
||||
rwCap := S3Flag + ArnSplitToken + param.bucket + ArnSplitToken + string(ReadWrite)
|
||||
var userAllowed bool
|
||||
//TODO owner need check？
|
||||
userAllowed = cap.ContainCaps(proto.OwnerVOLRsc, curCap) || cap.ContainCaps(proto.OwnerVOLRsc, rwCap) ||
|
||||
cap.ContainCaps(proto.NoneOwnerVOLRsc, curCap) || cap.ContainCaps(proto.NoneOwnerVOLRsc, rwCap)
|
||||
if !userAllowed {
|
||||
log.LogWarnf("user policy not allowed %v", param)
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -37,14 +37,14 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) {
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListParts.html
|
||||
r.Methods(http.MethodGet).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.listPartsHandler, []Action{ListMultipartUploadPartsAction})).
|
||||
HandlerFunc(o.policyCheck(o.listPartsHandler, []Action{ListMultipartUploadPartsAction}, Read)).
|
||||
Queries("uploadId", "{uploadId:.*}")
|
||||
|
||||
// Get object with presgined auth signature v2
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html
|
||||
r.Methods(http.MethodGet).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{ListBucketAction})).
|
||||
HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{ListBucketAction}, Read)).
|
||||
Queries("AWSAccessKeyId", "{accessKey:.+}",
|
||||
"Expires", "{expires:[0-9]+}", "Signature", "{signature:.+}")
|
||||
|
||||
@ -52,7 +52,7 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) {
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html
|
||||
r.Methods(http.MethodGet).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{ListBucketAction})).
|
||||
HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{ListBucketAction}, Read)).
|
||||
Queries("X-Amz-Credential", "{creadential:.+}",
|
||||
"X-Amz-Algorithm", "{algorithm:.+}", "X-Amz-Signature", "{signature:.+}",
|
||||
"X-Amz-Date", "{date:.+}", "X-Amz-SignedHeaders", "{signedHeaders:.+}",
|
||||
@ -62,27 +62,27 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) {
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html
|
||||
r.Methods(http.MethodGet).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{GetObjectAction}))
|
||||
HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{GetObjectAction}, Read))
|
||||
|
||||
// Create multipart upload
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateMultipartUpload.html
|
||||
r.Methods(http.MethodPost).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.createMultipleUploadHandler, []Action{PutObjectAction})).
|
||||
HandlerFunc(o.policyCheck(o.createMultipleUploadHandler, []Action{PutObjectAction}, Write)).
|
||||
Queries("uploads", "")
|
||||
|
||||
// Complete multipart
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_CompleteMultipartUpload.html
|
||||
r.Methods(http.MethodPost).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.completeMultipartUploadHandler, []Action{PutObjectAction})).
|
||||
HandlerFunc(o.policyCheck(o.completeMultipartUploadHandler, []Action{PutObjectAction}, Write)).
|
||||
Queries("uploadId", "{uploadId:.*}")
|
||||
|
||||
// Upload part
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPart.html .
|
||||
r.Methods(http.MethodPut).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.uploadPartHandler, []Action{PutObjectAction})).
|
||||
HandlerFunc(o.policyCheck(o.uploadPartHandler, []Action{PutObjectAction}, Write)).
|
||||
Queries("partNumber", "{partNumber:[0-9]+}", "uploadId", "{uploadId:.*}")
|
||||
|
||||
// Copy object
|
||||
@ -90,46 +90,46 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) {
|
||||
r.Methods(http.MethodPut).
|
||||
Path("/{object:.+}").
|
||||
HeadersRegexp(HeaderNameCopySource, ".*?(\\/|%2F).*?").
|
||||
HandlerFunc(o.policyCheck(o.copyObjectHandler, []Action{PutObjectAction}))
|
||||
HandlerFunc(o.policyCheck(o.copyObjectHandler, []Action{PutObjectAction}, Write))
|
||||
|
||||
// Put object
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html
|
||||
r.Methods(http.MethodPut).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.putObjectHandler, []Action{PutObjectAction}))
|
||||
HandlerFunc(o.policyCheck(o.putObjectHandler, []Action{PutObjectAction}, Write))
|
||||
|
||||
// Abort multipart
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_AbortMultipartUpload.html .
|
||||
r.Methods(http.MethodDelete).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.abortMultipartUploadHandler, []Action{AbortMultipartUploadAction})).
|
||||
HandlerFunc(o.policyCheck(o.abortMultipartUploadHandler, []Action{AbortMultipartUploadAction}, Write)).
|
||||
Queries("uploadId", "{uploadId:.*}")
|
||||
|
||||
// Head object
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html
|
||||
r.Methods(http.MethodHead).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.headObjectHandler, []Action{GetObjectAction}))
|
||||
HandlerFunc(o.policyCheck(o.headObjectHandler, []Action{GetObjectAction}, Read))
|
||||
|
||||
// Get object tagging
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTagging.html
|
||||
r.Methods(http.MethodGet).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.getObjectTagging, []Action{GetBucketPolicyAction})).
|
||||
HandlerFunc(o.policyCheck(o.getObjectTagging, []Action{GetBucketPolicyAction}, Read)).
|
||||
Queries("tagging", "")
|
||||
|
||||
// Put object tagging
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html
|
||||
r.Methods(http.MethodPut).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.putObjectTagging, []Action{PutBucketPolicyAction})).
|
||||
HandlerFunc(o.policyCheck(o.putObjectTagging, []Action{PutBucketPolicyAction}, Write)).
|
||||
Queries("tagging", "")
|
||||
|
||||
// Delete object tagging
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html
|
||||
r.Methods(http.MethodDelete).
|
||||
Path("/{object:.+").
|
||||
HandlerFunc(o.policyCheck(o.deleteObjectTagging, []Action{PutBucketPolicyAction})).
|
||||
HandlerFunc(o.policyCheck(o.deleteObjectTagging, []Action{PutBucketPolicyAction}, Write)).
|
||||
Queries("tagging", "")
|
||||
|
||||
// Put object xattrs
|
||||
@ -162,91 +162,91 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) {
|
||||
// List objects version 2
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html
|
||||
r.Methods(http.MethodGet).
|
||||
HandlerFunc(o.policyCheck(o.getBucketV2Handler, []Action{ListBucketAction})).
|
||||
HandlerFunc(o.policyCheck(o.getBucketV2Handler, []Action{ListBucketAction}, Read)).
|
||||
Queries("list-type", "2")
|
||||
|
||||
// List multipart uploads
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListMultipartUploads.html
|
||||
r.Methods(http.MethodGet).
|
||||
HandlerFunc(o.policyCheck(o.listMultipartUploadsHandler, []Action{ListMultipartUploadPartsAction})).
|
||||
HandlerFunc(o.policyCheck(o.listMultipartUploadsHandler, []Action{ListMultipartUploadPartsAction}, Read)).
|
||||
Queries("uploads", "")
|
||||
|
||||
// List parts
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListParts.html
|
||||
r.Methods(http.MethodGet).
|
||||
HandlerFunc(o.policyCheck(o.listPartsHandler, []Action{ListMultipartUploadPartsAction})).
|
||||
HandlerFunc(o.policyCheck(o.listPartsHandler, []Action{ListMultipartUploadPartsAction}, Read)).
|
||||
Queries("uploadId", "{uploadId:.*}")
|
||||
|
||||
// Delete objects (multiple objects)
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjects.html
|
||||
r.Methods(http.MethodPost).
|
||||
HandlerFunc(o.policyCheck(o.deleteObjectsHandler, []Action{DeleteObjectAction})).
|
||||
HandlerFunc(o.policyCheck(o.deleteObjectsHandler, []Action{DeleteObjectAction}, Write)).
|
||||
Queries("delete", "")
|
||||
|
||||
// List objects version 1
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjects.html
|
||||
r.Methods(http.MethodGet).
|
||||
HandlerFunc(o.policyCheck(o.getBucketV1Handler, []Action{ListBucketAction}))
|
||||
HandlerFunc(o.policyCheck(o.getBucketV1Handler, []Action{ListBucketAction}, Read))
|
||||
|
||||
// Head bucket
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html
|
||||
r.Methods(http.MethodHead).
|
||||
HandlerFunc(o.policyCheck(o.headBucketHandler, []Action{ListBucketAction}))
|
||||
HandlerFunc(o.policyCheck(o.headBucketHandler, []Action{ListBucketAction}, Read))
|
||||
|
||||
// Get bucket location
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html
|
||||
r.Methods(http.MethodGet).
|
||||
HandlerFunc(o.policyCheck(o.getBucketLocation, []Action{GetBucketLocationAction})).
|
||||
HandlerFunc(o.policyCheck(o.getBucketLocation, []Action{GetBucketLocationAction}, Read)).
|
||||
Queries("location", "")
|
||||
|
||||
// Get bucket policy
|
||||
// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicy.html
|
||||
r.Methods(http.MethodGet).
|
||||
HandlerFunc(o.policyCheck(o.getBucketPolicyHandler, []Action{GetBucketPolicyAction})).
|
||||
HandlerFunc(o.policyCheck(o.getBucketPolicyHandler, []Action{GetBucketPolicyAction}, Read)).
|
||||
Queries("policy", "")
|
||||
|
||||
// Put bucket policy
|
||||
// https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html
|
||||
r.Methods(http.MethodPut).
|
||||
HandlerFunc(o.policyCheck(o.putBucketPolicyHandler, []Action{PutBucketPolicyAction})).
|
||||
HandlerFunc(o.policyCheck(o.putBucketPolicyHandler, []Action{PutBucketPolicyAction}, Write)).
|
||||
Queries("policy", "")
|
||||
|
||||
// Delete bucket policy
|
||||
// https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html
|
||||
r.Methods(http.MethodDelete).
|
||||
HandlerFunc(o.policyCheck(o.deleteBucketPolicyHandler, []Action{DeleteBucketPolicyAction})).
|
||||
HandlerFunc(o.policyCheck(o.deleteBucketPolicyHandler, []Action{DeleteBucketPolicyAction}, Write)).
|
||||
Queries("policy", "")
|
||||
|
||||
// Delete object
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html .
|
||||
r.Methods(http.MethodDelete).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.deleteObjectHandler, []Action{DeleteObjectAction}))
|
||||
HandlerFunc(o.policyCheck(o.deleteObjectHandler, []Action{DeleteObjectAction}, Write))
|
||||
|
||||
// Get bucket acl
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html
|
||||
r.Methods(http.MethodGet).
|
||||
HandlerFunc(o.policyCheck(o.getBucketACLHandler, []Action{GetBucketAclAction})).
|
||||
HandlerFunc(o.policyCheck(o.getBucketACLHandler, []Action{GetBucketAclAction}, Read)).
|
||||
Queries("acl", "")
|
||||
|
||||
// Put bucket acl
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAcl.html
|
||||
r.Methods(http.MethodPut).
|
||||
HandlerFunc(o.policyCheck(o.putBucketACLHandler, []Action{PutBucketAclAction})).
|
||||
HandlerFunc(o.policyCheck(o.putBucketACLHandler, []Action{PutBucketAclAction}, Write)).
|
||||
Queries("acl", "")
|
||||
|
||||
// Get object acl
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAcl.html
|
||||
r.Methods(http.MethodGet).
|
||||
Path("/{objject:.+}").
|
||||
HandlerFunc(o.policyCheck(o.getObjectACLHandler, []Action{GetObjectAclAction})).
|
||||
HandlerFunc(o.policyCheck(o.getObjectACLHandler, []Action{GetObjectAclAction}, Read)).
|
||||
Queries("acl", "")
|
||||
|
||||
// Put object acl
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAcl.html
|
||||
r.Methods(http.MethodPut).
|
||||
Path("/{object:.+}").
|
||||
HandlerFunc(o.policyCheck(o.putObjectACLHandler, []Action{PutObjectAclAction})).
|
||||
HandlerFunc(o.policyCheck(o.putObjectACLHandler, []Action{PutObjectAclAction}, Write)).
|
||||
Queries("acl", "")
|
||||
|
||||
}
|
||||
@ -254,7 +254,7 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) {
|
||||
// List buckets
|
||||
// API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListBuckets.html
|
||||
router.Methods(http.MethodGet).
|
||||
HandlerFunc(o.policyCheck(o.listBucketsHandler, []Action{ListBucketAction}))
|
||||
HandlerFunc(o.policyCheck(o.listBucketsHandler, []Action{ListBucketAction}, Read))
|
||||
|
||||
// Unsupported operation
|
||||
router.NotFoundHandler = http.HandlerFunc(o.unsupportedOperationHandler)
|
||||
|
||||
@ -21,7 +21,6 @@ import (
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
|
||||
authSDK "github.com/chubaofs/chubaofs/sdk/auth"
|
||||
"github.com/chubaofs/chubaofs/util/config"
|
||||
"github.com/chubaofs/chubaofs/util/errors"
|
||||
"github.com/chubaofs/chubaofs/util/log"
|
||||
@ -67,8 +66,7 @@ type ObjectNode struct {
|
||||
vm VolumeManager
|
||||
state uint32
|
||||
wg sync.WaitGroup
|
||||
authKey string
|
||||
authClient *authSDK.AuthClient
|
||||
authStore *authnodeStore
|
||||
}
|
||||
|
||||
func (o *ObjectNode) Start(cfg *config.Config) (err error) {
|
||||
@ -142,8 +140,9 @@ func (o *ObjectNode) parseConfig(cfg *config.Config) (err error) {
|
||||
authNodes := cfg.GetString(configAuthnodes)
|
||||
enableHTTPS := cfg.GetBool(configEnableHTTPS)
|
||||
certFile := cfg.GetString(configCertFile)
|
||||
o.authKey = cfg.GetString(configAuthkey)
|
||||
o.authClient = authSDK.NewAuthClient(authNodes, enableHTTPS, certFile)
|
||||
authKey := cfg.GetString(configAuthkey)
|
||||
o.authStore = newAuthStore(authKey, authNodes, certFile, enableHTTPS)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user
