oyd
/
minio
6
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Support policy variable replacement (#7085)

Browse Source 
This PR supports iam and bucket policies to have
policy variable replacements in resource and
condition key values.

For example
- ${aws:username}
- ${aws:userid}
master
Harshavardhana 6 years ago committed by GitHub
parent 3265112d04
commit 5353edcc38
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
19 changed files with 125 additions and 56 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 8
      cmd/auth-handler.go
  2. 6
      cmd/object-handlers.go
  3. 17
      cmd/policy.go
  4. 28
      cmd/web-handlers.go
  5. 14
      pkg/iam/policy/resource.go
  6. 2
      pkg/iam/policy/resource_test.go
  7. 4
      pkg/iam/policy/resourceset.go
  8. 2
      pkg/iam/policy/resourceset_test.go
  9. 2
      pkg/iam/policy/statement.go
  10. 3
      pkg/policy/condition/binaryequalsfunc.go
  11. 60
      pkg/policy/condition/key.go
  12. 3
      pkg/policy/condition/stringequalsfunc.go
  13. 5
      pkg/policy/condition/stringequalsignorecasefunc.go
  14. 4
      pkg/policy/condition/stringlikefunc.go
  15. 13
      pkg/policy/resource.go
  16. 2
      pkg/policy/resource_test.go
  17. 4
      pkg/policy/resourceset.go
  18. 2
      pkg/policy/resourceset_test.go
  19. 2
      pkg/policy/statement.go

8
cmd/auth-handler.go
Unescape View File

@ -283,7 +283,7 @@ func checkRequestAuthType(ctx context.Context, r *http.Request, action policy.Ac
AccountName: cred.AccessKey,
Action: action,
BucketName: bucketName,
ConditionValues: getConditionValues(r, locationConstraint),
ConditionValues: getConditionValues(r, locationConstraint, ""),
IsOwner: false,
ObjectName: objectName,
}) {
@ -296,7 +296,7 @@ func checkRequestAuthType(ctx context.Context, r *http.Request, action policy.Ac
AccountName: cred.AccessKey,
Action: iampolicy.Action(action),
BucketName: bucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", cred.AccessKey),
ObjectName: objectName,
IsOwner: owner,
Claims: claims,
@ -448,7 +448,7 @@ func isPutAllowed(atype authType, bucketName, objectName string, r *http.Request
AccountName: cred.AccessKey,
Action: policy.PutObjectAction,
BucketName: bucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", ""),
IsOwner: false,
ObjectName: objectName,
}) {
@ -461,7 +461,7 @@ func isPutAllowed(atype authType, bucketName, objectName string, r *http.Request
AccountName: cred.AccessKey,
Action: policy.PutObjectAction,
BucketName: bucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", cred.AccessKey),
ObjectName: objectName,
IsOwner: owner,
Claims: claims,

6
cmd/object-handlers.go
Unescape View File

@ -131,7 +131,7 @@ func (api objectAPIHandlers) SelectObjectContentHandler(w http.ResponseWriter, r
if globalPolicySys.IsAllowed(policy.Args{
Action: policy.ListBucketAction,
BucketName: bucket,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", ""),
IsOwner: false,
}) {
_, err = getObjectInfo(ctx, bucket, object, opts)
@ -281,7 +281,7 @@ func (api objectAPIHandlers) GetObjectHandler(w http.ResponseWriter, r *http.Req
if globalPolicySys.IsAllowed(policy.Args{
Action: policy.ListBucketAction,
BucketName: bucket,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", ""),
IsOwner: false,
}) {
getObjectInfo := objectAPI.GetObjectInfo
@ -463,7 +463,7 @@ func (api objectAPIHandlers) HeadObjectHandler(w http.ResponseWriter, r *http.Re
if globalPolicySys.IsAllowed(policy.Args{
Action: policy.ListBucketAction,
BucketName: bucket,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", ""),
IsOwner: false,
}) {
_, err = getObjectInfo(ctx, bucket, object, opts)

17
cmd/policy.go
Unescape View File

@ -30,6 +30,7 @@ import (
miniogopolicy "github.com/minio/minio-go/pkg/policy"
"github.com/minio/minio-go/pkg/set"
"github.com/minio/minio/cmd/logger"
"github.com/minio/minio/pkg/event"
"github.com/minio/minio/pkg/handlers"
"github.com/minio/minio/pkg/policy"
)
@ -183,12 +184,24 @@ func NewPolicySys() *PolicySys {
}
}
func getConditionValues(request *http.Request, locationConstraint string) map[string][]string {
func getConditionValues(request *http.Request, locationConstraint string, username string) map[string][]string {
currTime := UTCNow()
principalType := func() string {
if username != "" {
return "User"
}
return "Anonymous"
}()
args := map[string][]string{
"SourceIp": {handlers.GetSourceIP(request)},
"CurrenTime": {currTime.Format(event.AMZTimeFormat)},
"EpochTime": {fmt.Sprintf("%d", currTime.Unix())},
"principaltype": {principalType},
"SecureTransport": {fmt.Sprintf("%t", request.TLS != nil)},
"SourceIp": {handlers.GetSourceIP(request)},
"UserAgent": {request.UserAgent()},
"Referer": {request.Referer()},
"userid": {username},
"username": {username},
}
for key, values := range request.Header {

28
cmd/web-handlers.go
Unescape View File

@ -306,7 +306,7 @@ func (web *webAPIHandlers) ListBuckets(r *http.Request, args *WebGenericArgs, re
AccountName: claims.Subject,
Action: iampolicy.ListBucketAction,
BucketName: bucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", claims.Subject),
IsOwner: owner,
ObjectName: "",
}) {
@ -326,7 +326,7 @@ func (web *webAPIHandlers) ListBuckets(r *http.Request, args *WebGenericArgs, re
AccountName: claims.Subject,
Action: iampolicy.ListBucketAction,
BucketName: bucket.Name,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", claims.Subject),
IsOwner: owner,
ObjectName: "",
}) {
@ -432,7 +432,7 @@ func (web *webAPIHandlers) ListObjects(r *http.Request, args *ListObjectsArgs, r
readable := globalPolicySys.IsAllowed(policy.Args{
Action: policy.ListBucketAction,
BucketName: args.BucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", ""),
IsOwner: false,
})
@ -440,7 +440,7 @@ func (web *webAPIHandlers) ListObjects(r *http.Request, args *ListObjectsArgs, r
writable := globalPolicySys.IsAllowed(policy.Args{
Action: policy.PutObjectAction,
BucketName: args.BucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", ""),
IsOwner: false,
ObjectName: args.Prefix + "/",
})
@ -471,7 +471,7 @@ func (web *webAPIHandlers) ListObjects(r *http.Request, args *ListObjectsArgs, r
AccountName: claims.Subject,
Action: iampolicy.ListBucketAction,
BucketName: args.BucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", ""),
IsOwner: owner,
})
@ -479,7 +479,7 @@ func (web *webAPIHandlers) ListObjects(r *http.Request, args *ListObjectsArgs, r
AccountName: claims.Subject,
Action: iampolicy.PutObjectAction,
BucketName: args.BucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", ""),
IsOwner: owner,
ObjectName: args.Prefix + "/",
})
@ -611,7 +611,7 @@ next:
AccountName: claims.Subject,
Action: iampolicy.DeleteObjectAction,
BucketName: args.BucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", claims.Subject),
IsOwner: owner,
ObjectName: objectName,
}) {
@ -628,7 +628,7 @@ next:
AccountName: claims.Subject,
Action: iampolicy.DeleteObjectAction,
BucketName: args.BucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", claims.Subject),
IsOwner: owner,
ObjectName: objectName,
}) {
@ -853,7 +853,7 @@ func (web *webAPIHandlers) Upload(w http.ResponseWriter, r *http.Request) {
if !globalPolicySys.IsAllowed(policy.Args{
Action: policy.PutObjectAction,
BucketName: bucket,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", ""),
IsOwner: false,
ObjectName: object,
}) {
@ -872,7 +872,7 @@ func (web *webAPIHandlers) Upload(w http.ResponseWriter, r *http.Request) {
AccountName: claims.Subject,
Action: iampolicy.PutObjectAction,
BucketName: bucket,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", claims.Subject),
IsOwner: owner,
ObjectName: object,
}) {
@ -1040,7 +1040,7 @@ func (web *webAPIHandlers) Download(w http.ResponseWriter, r *http.Request) {
if !globalPolicySys.IsAllowed(policy.Args{
Action: policy.GetObjectAction,
BucketName: bucket,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", ""),
IsOwner: false,
ObjectName: object,
}) {
@ -1059,7 +1059,7 @@ func (web *webAPIHandlers) Download(w http.ResponseWriter, r *http.Request) {
AccountName: claims.Subject,
Action: iampolicy.GetObjectAction,
BucketName: bucket,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", claims.Subject),
IsOwner: owner,
ObjectName: object,
}) {
@ -1195,7 +1195,7 @@ func (web *webAPIHandlers) DownloadZip(w http.ResponseWriter, r *http.Request) {
if !globalPolicySys.IsAllowed(policy.Args{
Action: policy.GetObjectAction,
BucketName: args.BucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", ""),
IsOwner: false,
ObjectName: pathJoin(args.Prefix, object),
}) {
@ -1216,7 +1216,7 @@ func (web *webAPIHandlers) DownloadZip(w http.ResponseWriter, r *http.Request) {
AccountName: claims.Subject,
Action: iampolicy.GetObjectAction,
BucketName: args.BucketName,
ConditionValues: getConditionValues(r, ""),
ConditionValues: getConditionValues(r, "", claims.Subject),
IsOwner: owner,
ObjectName: pathJoin(args.Prefix, object),
}) {

14
pkg/iam/policy/resource.go
Unescape View File

@ -21,6 +21,7 @@ import (
"fmt"
"strings"
"github.com/minio/minio/pkg/policy/condition"
"github.com/minio/minio/pkg/wildcard"
)
@ -47,11 +48,18 @@ func (r Resource) IsValid() bool {
}
// Match - matches object name with resource pattern.
func (r Resource) Match(resource string) bool {
if strings.HasPrefix(resource, r.Pattern) {
func (r Resource) Match(resource string, conditionValues map[string][]string) bool {
pattern := r.Pattern
for _, key := range condition.CommonKeys {
// Empty values are not supported for policy variables.
if rvalues, ok := conditionValues[key.Name()]; ok && rvalues[0] != "" {
pattern = strings.Replace(pattern, key.VarName(), rvalues[0], -1)
}
}
if strings.HasPrefix(resource, pattern) {
return true
}
return wildcard.Match(r.Pattern, resource)
return wildcard.Match(pattern, resource)
}
// MarshalJSON - encodes Resource to JSON data.

2
pkg/iam/policy/resource_test.go
Unescape View File

@ -124,7 +124,7 @@ func TestResourceMatch(t *testing.T) {
}
for i, testCase := range testCases {
result := testCase.resource.Match(testCase.objectName)
result := testCase.resource.Match(testCase.objectName, nil)
if result != testCase.expectedResult {
t.Fatalf("case %v: expected: %v, got: %v", i+1, testCase.expectedResult, result)

4
pkg/iam/policy/resourceset.go
Unescape View File

@ -81,9 +81,9 @@ func (resourceSet ResourceSet) MarshalJSON() ([]byte, error) {
}
// Match - matches object name with anyone of resource pattern in resource set.
func (resourceSet ResourceSet) Match(resource string) bool {
func (resourceSet ResourceSet) Match(resource string, conditionValues map[string][]string) bool {
for r := range resourceSet {
if r.Match(resource) {
if r.Match(resource, conditionValues) {
return true
}
}

2
pkg/iam/policy/resourceset_test.go
Unescape View File

@ -179,7 +179,7 @@ func TestResourceSetMatch(t *testing.T) {
}
for i, testCase := range testCases {
result := testCase.resourceSet.Match(testCase.resource)
result := testCase.resourceSet.Match(testCase.resource, nil)
if result != testCase.expectedResult {
t.Fatalf("case %v: expected: %v, got: %v", i+1, testCase.expectedResult, result)

2
pkg/iam/policy/statement.go
Unescape View File

@ -52,7 +52,7 @@ func (statement Statement) IsAllowed(args Args) bool {
resource += "/"
}
if !statement.Resources.Match(resource) {
if !statement.Resources.Match(resource, args.ConditionValues) {
return false
}

3
pkg/policy/condition/binaryequalsfunc.go
Unescape View File

@ -51,7 +51,8 @@ func (f binaryEqualsFunc) evaluate(values map[string][]string) bool {
requestValue = values[f.k.Name()]
}
return !f.values.Intersection(set.CreateStringSet(requestValue...)).IsEmpty()
fvalues := f.values.ApplyFunc(substFuncFromValues(values))
return !fvalues.Intersection(set.CreateStringSet(requestValue...)).IsEmpty()
}
// key() - returns condition key which is used by this condition function.

60
pkg/policy/condition/key.go
Unescape View File

@ -33,49 +33,58 @@ const (
// S3XAmzServerSideEncryption - key representing x-amz-server-side-encryption HTTP header applicable
// to PutObject API only.
S3XAmzServerSideEncryption = "s3:x-amz-server-side-encryption"
S3XAmzServerSideEncryption Key = "s3:x-amz-server-side-encryption"
// S3XAmzServerSideEncryptionCustomerAlgorithm - key representing
// x-amz-server-side-encryption-customer-algorithm HTTP header applicable to PutObject API only.
S3XAmzServerSideEncryptionCustomerAlgorithm = "s3:x-amz-server-side-encryption-customer-algorithm"
S3XAmzServerSideEncryptionCustomerAlgorithm Key = "s3:x-amz-server-side-encryption-customer-algorithm"
// S3XAmzMetadataDirective - key representing x-amz-metadata-directive HTTP header applicable to
// PutObject API only.
S3XAmzMetadataDirective = "s3:x-amz-metadata-directive"
S3XAmzMetadataDirective Key = "s3:x-amz-metadata-directive"
// S3XAmzStorageClass - key representing x-amz-storage-class HTTP header applicable to PutObject API
// only.
S3XAmzStorageClass = "s3:x-amz-storage-class"
S3XAmzStorageClass Key = "s3:x-amz-storage-class"
// S3LocationConstraint - key representing LocationConstraint XML tag of CreateBucket API only.
S3LocationConstraint = "s3:LocationConstraint"
S3LocationConstraint Key = "s3:LocationConstraint"
// S3Prefix - key representing prefix query parameter of ListBucket API only.
S3Prefix = "s3:prefix"
S3Prefix Key = "s3:prefix"
// S3Delimiter - key representing delimiter query parameter of ListBucket API only.
S3Delimiter = "s3:delimiter"
S3Delimiter Key = "s3:delimiter"
// S3MaxKeys - key representing max-keys query parameter of ListBucket API only.
S3MaxKeys = "s3:max-keys"
S3MaxKeys Key = "s3:max-keys"
// AWSReferer - key representing Referer header of any API.
AWSReferer = "aws:Referer"
AWSReferer Key = "aws:Referer"
// AWSSourceIP - key representing client's IP address (not intermittent proxies) of any API.
AWSSourceIP = "aws:SourceIp"
AWSSourceIP Key = "aws:SourceIp"
// AWSUserAgent - key representing UserAgent header for any API.
AWSUserAgent = "aws:UserAgent"
AWSUserAgent Key = "aws:UserAgent"
// AWSSecureTransport - key representing if the clients request is authenticated or not.
AWSSecureTransport = "aws:SecureTransport"
AWSSecureTransport Key = "aws:SecureTransport"
// AWSCurrentTime - key representing the current time.
AWSCurrentTime = "aws:CurrentTime"
AWSCurrentTime Key = "aws:CurrentTime"
// AWSEpochTime - key representing the current epoch time.
AWSEpochTime = "aws:EpochTime"
AWSEpochTime Key = "aws:EpochTime"
// AWSPrincipalType - user principal type currently supported values are "User" and "Anonymous".
AWSPrincipalType Key = "aws:principaltype"
// AWSUserID - user unique ID, in Minio this value is same as your user Access Key.
AWSUserID Key = "aws:userid"
// AWSUsername - user friendly name, in Minio this value is same as your user Access Key.
AWSUsername Key = "aws:username"
)
// AllSupportedKeys - is list of all all supported keys.
@ -95,6 +104,9 @@ var AllSupportedKeys = []Key{
AWSSecureTransport,
AWSCurrentTime,
AWSEpochTime,
AWSPrincipalType,
AWSUserID,
AWSUsername,
// Add new supported condition keys.
}
@ -106,6 +118,21 @@ var CommonKeys = []Key{
AWSSecureTransport,
AWSCurrentTime,
AWSEpochTime,
AWSPrincipalType,
AWSUserID,
AWSUsername,
}
func substFuncFromValues(values map[string][]string) func(string) string {
return func(v string) string {
for _, key := range CommonKeys {
// Empty values are not supported for policy variables.
if rvalues, ok := values[key.Name()]; ok && rvalues[0] != "" {
v = strings.Replace(v, key.VarName(), rvalues[0], -1)
}
}
return v
}
}
// IsValid - checks if key is valid or not.
@ -128,6 +155,11 @@ func (key Key) MarshalJSON() ([]byte, error) {
return json.Marshal(string(key))
}
// VarName - returns variable key name, such as "${aws:username}"
func (key Key) VarName() string {
return fmt.Sprintf("${%s}", key)
}
// Name - returns key name which is stripped value of prefixes "aws:" and "s3:"
func (key Key) Name() string {
keyString := string(key)

3
pkg/policy/condition/stringequalsfunc.go
Unescape View File

@ -50,7 +50,8 @@ func (f stringEqualsFunc) evaluate(values map[string][]string) bool {
requestValue = values[f.k.Name()]
}
return !f.values.Intersection(set.CreateStringSet(requestValue...)).IsEmpty()
fvalues := f.values.ApplyFunc(substFuncFromValues(values))
return !fvalues.Intersection(set.CreateStringSet(requestValue...)).IsEmpty()
}
// key() - returns condition key which is used by this condition function.

5
pkg/policy/condition/stringequalsignorecasefunc.go
Unescape View File

@ -50,11 +50,14 @@ func (f stringEqualsIgnoreCaseFunc) evaluate(values map[string][]string) bool {
requestValue = values[f.k.Name()]
}
fvalues := f.values.ApplyFunc(substFuncFromValues(values))
for _, v := range requestValue {
if !f.values.FuncMatch(strings.EqualFold, v).IsEmpty() {
if !fvalues.FuncMatch(strings.EqualFold, v).IsEmpty() {
return true
}
}
return false
}

4
pkg/policy/condition/stringlikefunc.go
Unescape View File

@ -51,8 +51,10 @@ func (f stringLikeFunc) evaluate(values map[string][]string) bool {
requestValue = values[f.k.Name()]
}
fvalues := f.values.ApplyFunc(substFuncFromValues(values))
for _, v := range requestValue {
if !f.values.FuncMatch(wildcard.Match, v).IsEmpty() {
if !fvalues.FuncMatch(wildcard.Match, v).IsEmpty() {
return true
}
}

13
pkg/policy/resource.go
Unescape View File

@ -21,6 +21,7 @@ import (
"fmt"
"strings"
"github.com/minio/minio/pkg/policy/condition"
"github.com/minio/minio/pkg/wildcard"
)
@ -47,8 +48,16 @@ func (r Resource) IsValid() bool {
}
// Match - matches object name with resource pattern.
func (r Resource) Match(resource string) bool {
return wildcard.Match(r.Pattern, resource)
func (r Resource) Match(resource string, conditionValues map[string][]string) bool {
pattern := r.Pattern
for _, key := range condition.CommonKeys {
// Empty values are not supported for policy variables.
if rvalues, ok := conditionValues[key.Name()]; ok && rvalues[0] != "" {
pattern = strings.Replace(pattern, key.VarName(), rvalues[0], -1)
}
}
return wildcard.Match(pattern, resource)
}
// MarshalJSON - encodes Resource to JSON data.

2
pkg/policy/resource_test.go
Unescape View File

@ -124,7 +124,7 @@ func TestResourceMatch(t *testing.T) {
}
for i, testCase := range testCases {
result := testCase.resource.Match(testCase.objectName)
result := testCase.resource.Match(testCase.objectName, nil)
if result != testCase.expectedResult {
t.Fatalf("case %v: expected: %v, got: %v", i+1, testCase.expectedResult, result)

4
pkg/policy/resourceset.go
Unescape View File

@ -81,9 +81,9 @@ func (resourceSet ResourceSet) MarshalJSON() ([]byte, error) {
}
// Match - matches object name with anyone of resource pattern in resource set.
func (resourceSet ResourceSet) Match(resource string) bool {
func (resourceSet ResourceSet) Match(resource string, conditionValues map[string][]string) bool {
for r := range resourceSet {
if r.Match(resource) {
if r.Match(resource, conditionValues) {
return true
}
}

2
pkg/policy/resourceset_test.go
Unescape View File

@ -179,7 +179,7 @@ func TestResourceSetMatch(t *testing.T) {
}
for i, testCase := range testCases {
result := testCase.resourceSet.Match(testCase.resource)
result := testCase.resourceSet.Match(testCase.resource, nil)
if result != testCase.expectedResult {
t.Fatalf("case %v: expected: %v, got: %v", i+1, testCase.expectedResult, result)

2
pkg/policy/statement.go
Unescape View File

@ -54,7 +54,7 @@ func (statement Statement) IsAllowed(args Args) bool {
resource += args.ObjectName
}
if !statement.Resources.Match(resource) {
if !statement.Resources.Match(resource, args.ConditionValues) {
return false
}

Write Preview
Loading…
Cancel
Save