From 0ea6447516d7e3d4ef7c5d440b09b092c58b7a88 Mon Sep 17 00:00:00 2001 From: wenjia322 Date: Wed, 8 Jan 2020 18:33:02 +0800 Subject: [PATCH] feature: cache authnode-info in objectnode and check user policy before calling handle function Signed-off-by: wenjia322 --- docker/authnode/run_docker4auth.sh | 8 ++- docker/conf/objectnode.json | 5 +- objectnode/api_handler.go | 22 +++---- objectnode/api_handler_object.go | 4 +- objectnode/auth_signature_v2.go | 8 +-- objectnode/auth_signature_v4.go | 7 +-- objectnode/fs.go | 2 +- objectnode/fs_store_authnode.go | 95 ++++++++++++++++++++++++++---- objectnode/policy.go | 36 ++++++++++- objectnode/router.go | 60 +++++++++---------- objectnode/server.go | 9 ++- 11 files changed, 182 insertions(+), 74 deletions(-) diff --git a/docker/authnode/run_docker4auth.sh b/docker/authnode/run_docker4auth.sh index 260c8d922..92b40bff1 100644 --- a/docker/authnode/run_docker4auth.sh +++ b/docker/authnode/run_docker4auth.sh @@ -32,10 +32,13 @@ sleep 2s ./cfs-authtool api -host=192.168.0.14:8080 -ticketfile=./ticket_admin.json -data=./data_master.json -output=./key_master.json AuthService createkey #create key for client ./cfs-authtool api -host=192.168.0.14:8080 -ticketfile=./ticket_admin.json -data=./data_client.json -output=./key_client.json AuthService createkey +#create key for objectnode +./cfs-authtool api -host=192.168.0.14:8080 -ticketfile=./ticket_admin.json -data=./data_objectnode.json -output=./key_object.json AuthService createkey #write key to json file clientKey=$(sed -n '3p' key_client.json | sed 's/auth_key/clientKey/g') masterKey=$(sed -n '3p' key_master.json | sed 's/auth_key/masterServiceKey/g') +objectKey=$(sed -n '3p' key_object.json | sed 's/auth_key/authKey/g') cd .. cd .. lineClient=`expr $(cat docker/conf/client.json | wc -l) - 1` @@ -44,6 +47,8 @@ lineMaster=`expr $(cat docker/conf/master1.json | wc -l) - 1` sed -i "${lineMaster}i ${masterKey}" docker/conf/master1.json sed -i "${lineMaster}i ${masterKey}" docker/conf/master2.json sed -i "${lineMaster}i ${masterKey}" docker/conf/master3.json +lineObject=`expr $(cat docker/conf/objectnode.json | wc -l) - 1` +sed -i "${lineObject}i ${objectKey}" docker/conf/objectnode.json #delete temp files rm -f ./docker/authnode/authservice.json @@ -52,4 +57,5 @@ rm -f ./docker/authnode/ticket_auth.json rm -f ./docker/authnode/key_admin.json rm -f ./docker/authnode/ticket_admin.json rm -f ./docker/authnode/key_master.json -rm -f ./docker/authnode/key_client.json \ No newline at end of file +rm -f ./docker/authnode/key_client.json +rm -f ./docker/authnode/key_object.json \ No newline at end of file diff --git a/docker/conf/objectnode.json b/docker/conf/objectnode.json index cdb1e5c28..044746919 100644 --- a/docker/conf/objectnode.json +++ b/docker/conf/objectnode.json @@ -8,5 +8,8 @@ "192.168.0.11:17010", "192.168.0.12:17010", "192.168.0.13:17010" - ] + ], + "authNodes": "192.168.0.14:8080,192.168.0.15:8081,192.168.0.16:8082", + "enableHTTPS": "false", + "certFile": "" } diff --git a/objectnode/api_handler.go b/objectnode/api_handler.go index 99ba74df4..56bcdfb35 100644 --- a/objectnode/api_handler.go +++ b/objectnode/api_handler.go @@ -25,16 +25,17 @@ import ( ) type RequestParam struct { - account string - resource string - bucket string - object string - actions []Action - sourceIP string - vol *volume - condVals map[string][]string - isOwner bool - vars map[string]string + account string + resource string + bucket string + object string + actions []Action + sourceIP string + vol *volume + condVals map[string][]string + isOwner bool + vars map[string]string + accessKey string } func (o *ObjectNode) parseRequestParam(r *http.Request) (*RequestParam, error) { @@ -62,6 +63,7 @@ func (o *ObjectNode) parseRequestParam(r *http.Request) (*RequestParam, error) { if auth.accessKey == accessKey { p.isOwner = true } + p.accessKey = auth.accessKey } return p, nil diff --git a/objectnode/api_handler_object.go b/objectnode/api_handler_object.go index 938ef9d6e..7df170d32 100644 --- a/objectnode/api_handler_object.go +++ b/objectnode/api_handler_object.go @@ -466,8 +466,8 @@ func (o *ObjectNode) getBucketV1Handler(w http.ResponseWriter, r *http.Request) } // get owner - aceesKey, _ := vl.OSSSecure() - bucketOwner := NewBucketOwner(aceesKey) + accessKey, _ := vl.OSSSecure() + bucketOwner := NewBucketOwner(accessKey) var contents = make([]*Content, 0) if len(fsFileInfos) > 0 { for _, fsFileInfo := range fsFileInfos { diff --git a/objectnode/auth_signature_v2.go b/objectnode/auth_signature_v2.go index 1c17f8406..10765fb33 100644 --- a/objectnode/auth_signature_v2.go +++ b/objectnode/auth_signature_v2.go @@ -26,7 +26,6 @@ import ( "strings" "time" - "github.com/chubaofs/chubaofs/proto" "github.com/chubaofs/chubaofs/util" "github.com/chubaofs/chubaofs/util/keystore" "github.com/chubaofs/chubaofs/util/log" @@ -176,12 +175,10 @@ func (o *ObjectNode) checkSignatureV2(r *http.Request) (bool, error) { } var akCaps *keystore.AccessKeyCaps - akCaps, err = o.authClient.API().OSSGetCaps(proto.ObjectServiceID, o.authKey, authInfo.accessKeyId) - if err != nil { + if akCaps, err = o.authStore.GetAkCaps(authInfo.accessKeyId); err != nil { log.LogInfof("get secretKey from authnode error: accessKey(%v), err(%v)", authInfo.accessKeyId, err) return false, err } - //volAccessKey, volSecret := v.OSSSecure() // 2. calculate new signature newSignature, err1 := calculateSignatureV2(authInfo, akCaps.SecretKey, o.domains) @@ -263,8 +260,7 @@ func (o *ObjectNode) checkPresignedSignatureV2(r *http.Request) (bool, error) { //check access key var akCaps *keystore.AccessKeyCaps - akCaps, err = o.authClient.API().OSSGetCaps(proto.ObjectServiceID, o.authKey, accessKey) - if err != nil { + if akCaps, err = o.authStore.GetAkCaps(accessKey); err != nil { log.LogInfof("get secretKey from authnode error: accessKey(%v), err(%v)", accessKey, err) return false, err } diff --git a/objectnode/auth_signature_v4.go b/objectnode/auth_signature_v4.go index b60a1bf42..297c86cc9 100644 --- a/objectnode/auth_signature_v4.go +++ b/objectnode/auth_signature_v4.go @@ -24,7 +24,6 @@ import ( "strings" "time" - "github.com/chubaofs/chubaofs/proto" "github.com/chubaofs/chubaofs/util" "github.com/chubaofs/chubaofs/util/keystore" "github.com/chubaofs/chubaofs/util/log" @@ -110,8 +109,7 @@ func (o *ObjectNode) checkSignatureV4(r *http.Request) (bool, error) { return false, err } var akCaps *keystore.AccessKeyCaps - akCaps, err = o.authClient.API().OSSGetCaps(proto.ObjectServiceID, o.authKey, req.Credential.AccessKey) - if err != nil { + if akCaps, err = o.authStore.GetAkCaps(req.Credential.AccessKey); err != nil { log.LogInfof("get secretKey from authnode error: accessKey(%v), err(%v)", req.Credential.AccessKey, err) return false, err } @@ -151,8 +149,7 @@ func (o *ObjectNode) checkPresignedSignatureV4(r *http.Request) (pass bool, err // check accessKey valid var akCaps *keystore.AccessKeyCaps - akCaps, err = o.authClient.API().OSSGetCaps(proto.ObjectServiceID, o.authKey, req.Credential.AccessKey) - if err != nil { + if akCaps, err = o.authStore.GetAkCaps(req.Credential.AccessKey); err != nil { log.LogInfof("get secretKey from authnode error: accessKey(%v), err(%v)", req.Credential.AccessKey, err) return false, err } diff --git a/objectnode/fs.go b/objectnode/fs.go index 90e1782eb..007257f7b 100644 --- a/objectnode/fs.go +++ b/objectnode/fs.go @@ -72,7 +72,7 @@ type FSPart struct { } type Volume interface { - OSSSecure() (accessKey, secretKey string) + OSSSecure() (accessKey, secretKey string) //todo delete OSSMeta() *OSSMeta // ListFiles return an FileInfo slice of specified volume, like read dir for hole volume. diff --git a/objectnode/fs_store_authnode.go b/objectnode/fs_store_authnode.go index 080e44ae2..46a3c46e7 100644 --- a/objectnode/fs_store_authnode.go +++ b/objectnode/fs_store_authnode.go @@ -14,33 +14,106 @@ package objectnode +import ( + "sync" + "time" + + "github.com/chubaofs/chubaofs/proto" + authSDK "github.com/chubaofs/chubaofs/sdk/auth" + "github.com/chubaofs/chubaofs/util/keystore" + "github.com/chubaofs/chubaofs/util/log" +) + +const ( + RefreshAuthStoreInterval = time.Minute * 1 +) + type authnodeStore struct { - vm *volumeManager //vol *volume + authKey string + authClient *authSDK.AuthClient + akCapsStore map[string]*keystore.AccessKeyCaps + capsMu sync.RWMutex + closeCh chan struct{} + closeOnce sync.Once } -func (s *authnodeStore) Init(vm *volumeManager) { - s.vm = vm - //TODO: init authnode store +func newAuthStore(authKey, authNodes, certFile string, enableHTTPS bool) *authnodeStore { + authClient := authSDK.NewAuthClient(authNodes, enableHTTPS, certFile) + as := &authnodeStore{ + authKey: authKey, + authClient: authClient, + akCapsStore: make(map[string]*keystore.AccessKeyCaps), + closeCh: make(chan struct{}, 1), + } + + go as.refresh() + return as } -func (s *authnodeStore) Get(vol, path, key string) (val []byte, err error) { +//TODO where call close? +func (as *authnodeStore) Close() { + as.capsMu.Lock() + defer as.capsMu.Unlock() + as.closeOnce.Do(func() { + close(as.closeCh) + }) +} +func (as *authnodeStore) Get(accessKey string) (akCaps *keystore.AccessKeyCaps, exit bool) { + as.capsMu.RLock() + defer as.capsMu.RUnlock() + akCaps, exit = as.akCapsStore[accessKey] return } -func (s *authnodeStore) Put(vol, path, key string, data []byte) (err error) { - //TODO: implement authonode store put method - - return nil +func (as *authnodeStore) Put(accessKey string, cap *keystore.AccessKeyCaps) { + as.capsMu.Lock() + defer as.capsMu.Unlock() + as.akCapsStore[accessKey] = cap + return } -func (s *authnodeStore) Delete(vol, path, key string) (err error) { +func (as *authnodeStore) refresh() { + t := time.NewTicker(RefreshAuthStoreInterval) + defer t.Stop() + for { + select { + case <-t.C: + as.capsMu.Lock() + for ak := range as.akCapsStore { + akCaps, err := as.authClient.API().OSSGetCaps(proto.ObjectServiceID, as.authKey, ak) + if err != nil { + log.LogInfof("update user policy failed: accessKey(%v), err(%v)", ak, err) + continue + } + as.akCapsStore[ak] = akCaps + } + as.capsMu.Unlock() + case <-as.closeCh: + return + } + } +} + +func (as *authnodeStore) GetAkCaps(accessKey string) (akCaps *keystore.AccessKeyCaps, err error) { + akCaps, exit := as.Get(accessKey) + if !exit { + if akCaps, err = as.authClient.API().OSSGetCaps(proto.ObjectServiceID, as.authKey, accessKey); err != nil { + log.LogInfof("load user policy err: %v", err) + return + } + as.Put(accessKey, akCaps) + } + return +} + +func (as *authnodeStore) Delete(vol, path, key string) (err error) { //TODO: implement authonode store put method return } -func (s *authnodeStore) List(vol, path string) (data [][]byte, err error) { +func (as *authnodeStore) List(vol, path string) (data [][]byte, err error) { //TODO: implement authonode store list method return diff --git a/objectnode/policy.go b/objectnode/policy.go index 7f2ae3a0b..38f6e0fdb 100644 --- a/objectnode/policy.go +++ b/objectnode/policy.go @@ -23,14 +23,26 @@ import ( "net/http" "strings" + "github.com/chubaofs/chubaofs/proto" + "github.com/chubaofs/chubaofs/util/caps" + "github.com/chubaofs/chubaofs/util/keystore" "github.com/chubaofs/chubaofs/util/log" ) +type ActionType string + +const ( + Read ActionType = "r" + Write ActionType = "w" + ReadWrite ActionType = "rw" +) + // https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html const ( PolicyDefaultVersion = "2012-10-17" BucketPolicyLimitSize = 20 * 1024 //Bucket policies are limited to 20KB ArnSplitToken = ":" + S3Flag = "S3" ) //https://docs.aws.amazon.com/zh_cn/AmazonS3/latest/dev/example-bucket-policies.html @@ -180,7 +192,7 @@ func (p *Policy) IsAllowed(params *RequestParam) bool { return false } -func (o *ObjectNode) policyCheck(f http.HandlerFunc, actions []Action) http.HandlerFunc { +func (o *ObjectNode) policyCheck(f http.HandlerFunc, actions []Action, actionType ActionType) http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { var ( err error @@ -231,6 +243,26 @@ func (o *ObjectNode) policyCheck(f http.HandlerFunc, actions []Action) http.Hand return } } - + //check user policy + var akCaps *keystore.AccessKeyCaps + if akCaps, err = o.authStore.GetAkCaps(param.accessKey); err != nil { + log.LogInfof("get user policy from authnode error: accessKey(%v), err(%v)", param.accessKey, err) + return + } + cap := new(caps.Caps) + if err = cap.Init(akCaps.Caps); err != nil { + log.LogInfof("load user caps err: %v", err) + return + } + curCap := S3Flag + ArnSplitToken + param.bucket + ArnSplitToken + string(actionType) + rwCap := S3Flag + ArnSplitToken + param.bucket + ArnSplitToken + string(ReadWrite) + var userAllowed bool + //TODO owner need check？ + userAllowed = cap.ContainCaps(proto.OwnerVOLRsc, curCap) || cap.ContainCaps(proto.OwnerVOLRsc, rwCap) || + cap.ContainCaps(proto.NoneOwnerVOLRsc, curCap) || cap.ContainCaps(proto.NoneOwnerVOLRsc, rwCap) + if !userAllowed { + log.LogWarnf("user policy not allowed %v", param) + return + } } } diff --git a/objectnode/router.go b/objectnode/router.go index ce42f224e..fea37b76c 100644 --- a/objectnode/router.go +++ b/objectnode/router.go @@ -37,14 +37,14 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) { // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListParts.html r.Methods(http.MethodGet). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.listPartsHandler, []Action{ListMultipartUploadPartsAction})). + HandlerFunc(o.policyCheck(o.listPartsHandler, []Action{ListMultipartUploadPartsAction}, Read)). Queries("uploadId", "{uploadId:.*}") // Get object with presgined auth signature v2 // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html r.Methods(http.MethodGet). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{ListBucketAction})). + HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{ListBucketAction}, Read)). Queries("AWSAccessKeyId", "{accessKey:.+}", "Expires", "{expires:[0-9]+}", "Signature", "{signature:.+}") @@ -52,7 +52,7 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) { // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html r.Methods(http.MethodGet). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{ListBucketAction})). + HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{ListBucketAction}, Read)). Queries("X-Amz-Credential", "{creadential:.+}", "X-Amz-Algorithm", "{algorithm:.+}", "X-Amz-Signature", "{signature:.+}", "X-Amz-Date", "{date:.+}", "X-Amz-SignedHeaders", "{signedHeaders:.+}", @@ -62,27 +62,27 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) { // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html r.Methods(http.MethodGet). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{GetObjectAction})) + HandlerFunc(o.policyCheck(o.getObjectHandler, []Action{GetObjectAction}, Read)) // Create multipart upload // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateMultipartUpload.html r.Methods(http.MethodPost). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.createMultipleUploadHandler, []Action{PutObjectAction})). + HandlerFunc(o.policyCheck(o.createMultipleUploadHandler, []Action{PutObjectAction}, Write)). Queries("uploads", "") // Complete multipart // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_CompleteMultipartUpload.html r.Methods(http.MethodPost). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.completeMultipartUploadHandler, []Action{PutObjectAction})). + HandlerFunc(o.policyCheck(o.completeMultipartUploadHandler, []Action{PutObjectAction}, Write)). Queries("uploadId", "{uploadId:.*}") // Upload part // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPart.html . r.Methods(http.MethodPut). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.uploadPartHandler, []Action{PutObjectAction})). + HandlerFunc(o.policyCheck(o.uploadPartHandler, []Action{PutObjectAction}, Write)). Queries("partNumber", "{partNumber:[0-9]+}", "uploadId", "{uploadId:.*}") // Copy object @@ -90,46 +90,46 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) { r.Methods(http.MethodPut). Path("/{object:.+}"). HeadersRegexp(HeaderNameCopySource, ".*?(\\/|%2F).*?"). - HandlerFunc(o.policyCheck(o.copyObjectHandler, []Action{PutObjectAction})) + HandlerFunc(o.policyCheck(o.copyObjectHandler, []Action{PutObjectAction}, Write)) // Put object // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html r.Methods(http.MethodPut). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.putObjectHandler, []Action{PutObjectAction})) + HandlerFunc(o.policyCheck(o.putObjectHandler, []Action{PutObjectAction}, Write)) // Abort multipart // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_AbortMultipartUpload.html . r.Methods(http.MethodDelete). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.abortMultipartUploadHandler, []Action{AbortMultipartUploadAction})). + HandlerFunc(o.policyCheck(o.abortMultipartUploadHandler, []Action{AbortMultipartUploadAction}, Write)). Queries("uploadId", "{uploadId:.*}") // Head object // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html r.Methods(http.MethodHead). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.headObjectHandler, []Action{GetObjectAction})) + HandlerFunc(o.policyCheck(o.headObjectHandler, []Action{GetObjectAction}, Read)) // Get object tagging // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTagging.html r.Methods(http.MethodGet). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.getObjectTagging, []Action{GetBucketPolicyAction})). + HandlerFunc(o.policyCheck(o.getObjectTagging, []Action{GetBucketPolicyAction}, Read)). Queries("tagging", "") // Put object tagging // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html r.Methods(http.MethodPut). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.putObjectTagging, []Action{PutBucketPolicyAction})). + HandlerFunc(o.policyCheck(o.putObjectTagging, []Action{PutBucketPolicyAction}, Write)). Queries("tagging", "") // Delete object tagging // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html r.Methods(http.MethodDelete). Path("/{object:.+"). - HandlerFunc(o.policyCheck(o.deleteObjectTagging, []Action{PutBucketPolicyAction})). + HandlerFunc(o.policyCheck(o.deleteObjectTagging, []Action{PutBucketPolicyAction}, Write)). Queries("tagging", "") // Put object xattrs @@ -162,91 +162,91 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) { // List objects version 2 // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html r.Methods(http.MethodGet). - HandlerFunc(o.policyCheck(o.getBucketV2Handler, []Action{ListBucketAction})). + HandlerFunc(o.policyCheck(o.getBucketV2Handler, []Action{ListBucketAction}, Read)). Queries("list-type", "2") // List multipart uploads // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListMultipartUploads.html r.Methods(http.MethodGet). - HandlerFunc(o.policyCheck(o.listMultipartUploadsHandler, []Action{ListMultipartUploadPartsAction})). + HandlerFunc(o.policyCheck(o.listMultipartUploadsHandler, []Action{ListMultipartUploadPartsAction}, Read)). Queries("uploads", "") // List parts // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListParts.html r.Methods(http.MethodGet). - HandlerFunc(o.policyCheck(o.listPartsHandler, []Action{ListMultipartUploadPartsAction})). + HandlerFunc(o.policyCheck(o.listPartsHandler, []Action{ListMultipartUploadPartsAction}, Read)). Queries("uploadId", "{uploadId:.*}") // Delete objects (multiple objects) // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjects.html r.Methods(http.MethodPost). - HandlerFunc(o.policyCheck(o.deleteObjectsHandler, []Action{DeleteObjectAction})). + HandlerFunc(o.policyCheck(o.deleteObjectsHandler, []Action{DeleteObjectAction}, Write)). Queries("delete", "") // List objects version 1 // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjects.html r.Methods(http.MethodGet). - HandlerFunc(o.policyCheck(o.getBucketV1Handler, []Action{ListBucketAction})) + HandlerFunc(o.policyCheck(o.getBucketV1Handler, []Action{ListBucketAction}, Read)) // Head bucket // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html r.Methods(http.MethodHead). - HandlerFunc(o.policyCheck(o.headBucketHandler, []Action{ListBucketAction})) + HandlerFunc(o.policyCheck(o.headBucketHandler, []Action{ListBucketAction}, Read)) // Get bucket location // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html r.Methods(http.MethodGet). - HandlerFunc(o.policyCheck(o.getBucketLocation, []Action{GetBucketLocationAction})). + HandlerFunc(o.policyCheck(o.getBucketLocation, []Action{GetBucketLocationAction}, Read)). Queries("location", "") // Get bucket policy // https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicy.html r.Methods(http.MethodGet). - HandlerFunc(o.policyCheck(o.getBucketPolicyHandler, []Action{GetBucketPolicyAction})). + HandlerFunc(o.policyCheck(o.getBucketPolicyHandler, []Action{GetBucketPolicyAction}, Read)). Queries("policy", "") // Put bucket policy // https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html r.Methods(http.MethodPut). - HandlerFunc(o.policyCheck(o.putBucketPolicyHandler, []Action{PutBucketPolicyAction})). + HandlerFunc(o.policyCheck(o.putBucketPolicyHandler, []Action{PutBucketPolicyAction}, Write)). Queries("policy", "") // Delete bucket policy // https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html r.Methods(http.MethodDelete). - HandlerFunc(o.policyCheck(o.deleteBucketPolicyHandler, []Action{DeleteBucketPolicyAction})). + HandlerFunc(o.policyCheck(o.deleteBucketPolicyHandler, []Action{DeleteBucketPolicyAction}, Write)). Queries("policy", "") // Delete object // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html . r.Methods(http.MethodDelete). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.deleteObjectHandler, []Action{DeleteObjectAction})) + HandlerFunc(o.policyCheck(o.deleteObjectHandler, []Action{DeleteObjectAction}, Write)) // Get bucket acl // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html r.Methods(http.MethodGet). - HandlerFunc(o.policyCheck(o.getBucketACLHandler, []Action{GetBucketAclAction})). + HandlerFunc(o.policyCheck(o.getBucketACLHandler, []Action{GetBucketAclAction}, Read)). Queries("acl", "") // Put bucket acl // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAcl.html r.Methods(http.MethodPut). - HandlerFunc(o.policyCheck(o.putBucketACLHandler, []Action{PutBucketAclAction})). + HandlerFunc(o.policyCheck(o.putBucketACLHandler, []Action{PutBucketAclAction}, Write)). Queries("acl", "") // Get object acl // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAcl.html r.Methods(http.MethodGet). Path("/{objject:.+}"). - HandlerFunc(o.policyCheck(o.getObjectACLHandler, []Action{GetObjectAclAction})). + HandlerFunc(o.policyCheck(o.getObjectACLHandler, []Action{GetObjectAclAction}, Read)). Queries("acl", "") // Put object acl // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAcl.html r.Methods(http.MethodPut). Path("/{object:.+}"). - HandlerFunc(o.policyCheck(o.putObjectACLHandler, []Action{PutObjectAclAction})). + HandlerFunc(o.policyCheck(o.putObjectACLHandler, []Action{PutObjectAclAction}, Write)). Queries("acl", "") } @@ -254,7 +254,7 @@ func (o *ObjectNode) registerApiRouters(router *mux.Router) { // List buckets // API reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListBuckets.html router.Methods(http.MethodGet). - HandlerFunc(o.policyCheck(o.listBucketsHandler, []Action{ListBucketAction})) + HandlerFunc(o.policyCheck(o.listBucketsHandler, []Action{ListBucketAction}, Read)) // Unsupported operation router.NotFoundHandler = http.HandlerFunc(o.unsupportedOperationHandler) diff --git a/objectnode/server.go b/objectnode/server.go index d308d2af2..96d7b37c8 100644 --- a/objectnode/server.go +++ b/objectnode/server.go @@ -21,7 +21,6 @@ import ( "sync" "sync/atomic" - authSDK "github.com/chubaofs/chubaofs/sdk/auth" "github.com/chubaofs/chubaofs/util/config" "github.com/chubaofs/chubaofs/util/errors" "github.com/chubaofs/chubaofs/util/log" @@ -67,8 +66,7 @@ type ObjectNode struct { vm VolumeManager state uint32 wg sync.WaitGroup - authKey string - authClient *authSDK.AuthClient + authStore *authnodeStore } func (o *ObjectNode) Start(cfg *config.Config) (err error) { @@ -142,8 +140,9 @@ func (o *ObjectNode) parseConfig(cfg *config.Config) (err error) { authNodes := cfg.GetString(configAuthnodes) enableHTTPS := cfg.GetBool(configEnableHTTPS) certFile := cfg.GetString(configCertFile) - o.authKey = cfg.GetString(configAuthkey) - o.authClient = authSDK.NewAuthClient(authNodes, enableHTTPS, certFile) + authKey := cfg.GetString(configAuthkey) + o.authStore = newAuthStore(authKey, authNodes, certFile, enableHTTPS) + return }