You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
358 lines
12 KiB
358 lines
12 KiB
/*
|
|
* Minio Cloud Storage, (C) 2015, 2016 Minio, Inc.
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
// Package cmd This file implements AWS Access Policy Language parser in
|
|
// accordance with http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
|
|
package cmd
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"sort"
|
|
"strings"
|
|
|
|
"github.com/minio/minio-go/pkg/set"
|
|
)
|
|
|
|
var conditionKeyActionMap = map[string]set.StringSet{
|
|
"s3:prefix": set.CreateStringSet("s3:ListBucket"),
|
|
"s3:max-keys": set.CreateStringSet("s3:ListBucket"),
|
|
}
|
|
|
|
// supportedActionMap - lists all the actions supported by minio.
|
|
var supportedActionMap = set.CreateStringSet("*", "s3:*", "s3:GetObject",
|
|
"s3:ListBucket", "s3:PutObject", "s3:GetBucketLocation", "s3:DeleteObject",
|
|
"s3:AbortMultipartUpload", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts")
|
|
|
|
// supported Conditions type.
|
|
var supportedConditionsType = set.CreateStringSet("StringEquals", "StringNotEquals", "StringLike", "StringNotLike")
|
|
|
|
// Validate s3:prefix, s3:max-keys are present if not
|
|
// supported keys for the conditions.
|
|
var supportedConditionsKey = set.CreateStringSet("s3:prefix", "s3:max-keys", "aws:Referer")
|
|
|
|
// supportedEffectMap - supported effects.
|
|
var supportedEffectMap = set.CreateStringSet("Allow", "Deny")
|
|
|
|
// Statement - minio policy statement
|
|
type policyStatement struct {
|
|
Actions set.StringSet `json:"Action"`
|
|
Conditions map[string]map[string]set.StringSet `json:"Condition,omitempty"`
|
|
Effect string
|
|
Principal interface{} `json:"Principal"`
|
|
Resources set.StringSet `json:"Resource"`
|
|
Sid string
|
|
}
|
|
|
|
// bucketPolicy - collection of various bucket policy statements.
|
|
type bucketPolicy struct {
|
|
Version string // date in YYYY-MM-DD format
|
|
Statements []policyStatement `json:"Statement"`
|
|
}
|
|
|
|
// Stringer implementation for the bucket policies.
|
|
func (b bucketPolicy) String() string {
|
|
bbytes, err := json.Marshal(&b)
|
|
if err != nil {
|
|
errorIf(err, "Unable to marshal bucket policy into JSON %#v", b)
|
|
return ""
|
|
}
|
|
return string(bbytes)
|
|
}
|
|
|
|
// isValidActions - are actions valid.
|
|
func isValidActions(actions set.StringSet) (err error) {
|
|
// Statement actions cannot be empty.
|
|
if len(actions) == 0 {
|
|
err = errors.New("Action list cannot be empty")
|
|
return err
|
|
}
|
|
if unsupportedActions := actions.Difference(supportedActionMap); !unsupportedActions.IsEmpty() {
|
|
err = fmt.Errorf("Unsupported actions found: ‘%#v’, please validate your policy document", unsupportedActions)
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// isValidEffect - is effect valid.
|
|
func isValidEffect(effect string) (err error) {
|
|
// Statement effect cannot be empty.
|
|
if effect == "" {
|
|
err = errors.New("Policy effect cannot be empty")
|
|
return err
|
|
}
|
|
if !supportedEffectMap.Contains(effect) {
|
|
err = errors.New("Unsupported Effect found: ‘" + effect + "’, please validate your policy document")
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// isValidResources - are valid resources.
|
|
func isValidResources(resources set.StringSet) (err error) {
|
|
// Statement resources cannot be empty.
|
|
if len(resources) == 0 {
|
|
err = errors.New("Resource list cannot be empty")
|
|
return err
|
|
}
|
|
for resource := range resources {
|
|
if !hasPrefix(resource, bucketARNPrefix) {
|
|
err = errors.New("Unsupported resource style found: ‘" + resource + "’, please validate your policy document")
|
|
return err
|
|
}
|
|
resourceSuffix := strings.SplitAfter(resource, bucketARNPrefix)[1]
|
|
if len(resourceSuffix) == 0 || hasPrefix(resourceSuffix, "/") {
|
|
err = errors.New("Invalid resource style found: ‘" + resource + "’, please validate your policy document")
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Parse principals parses a incoming json. Handles cases for
|
|
// these three combinations.
|
|
// - "Principal": "*",
|
|
// - "Principal": { "AWS" : "*" }
|
|
// - "Principal": { "AWS" : [ "*" ]}
|
|
func parsePrincipals(principal interface{}) set.StringSet {
|
|
principals, ok := principal.(map[string]interface{})
|
|
if !ok {
|
|
var principalStr string
|
|
principalStr, ok = principal.(string)
|
|
if ok {
|
|
return set.CreateStringSet(principalStr)
|
|
}
|
|
} // else {
|
|
var principalStrs []string
|
|
for _, p := range principals {
|
|
principalStr, isStr := p.(string)
|
|
if !isStr {
|
|
principalsAdd, isInterface := p.([]interface{})
|
|
if !isInterface {
|
|
principalStrsAddr, isStrs := p.([]string)
|
|
if !isStrs {
|
|
continue
|
|
}
|
|
principalStrs = append(principalStrs, principalStrsAddr...)
|
|
} else {
|
|
for _, pa := range principalsAdd {
|
|
var pstr string
|
|
pstr, isStr = pa.(string)
|
|
if !isStr {
|
|
continue
|
|
}
|
|
principalStrs = append(principalStrs, pstr)
|
|
}
|
|
}
|
|
continue
|
|
} // else {
|
|
principalStrs = append(principalStrs, principalStr)
|
|
}
|
|
return set.CreateStringSet(principalStrs...)
|
|
}
|
|
|
|
// isValidPrincipals - are valid principals.
|
|
func isValidPrincipals(principal interface{}) (err error) {
|
|
principals := parsePrincipals(principal)
|
|
// Statement principal should have a value.
|
|
if len(principals) == 0 {
|
|
err = errors.New("Principal cannot be empty")
|
|
return err
|
|
}
|
|
if unsuppPrincipals := principals.Difference(set.CreateStringSet([]string{"*"}...)); !unsuppPrincipals.IsEmpty() {
|
|
// Minio does not support or implement IAM, "*" is the only valid value.
|
|
// Amazon s3 doc on principals: http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Principal
|
|
err = fmt.Errorf("Unsupported principals found: ‘%#v’, please validate your policy document", unsuppPrincipals)
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// isValidConditions - returns nil if the given conditions valid and
|
|
// corresponding error otherwise.
|
|
func isValidConditions(actions set.StringSet, conditions map[string]map[string]set.StringSet) (err error) {
|
|
// Verify conditions should be valid. Validate if only
|
|
// supported condition keys are present and return error
|
|
// otherwise.
|
|
conditionKeyVal := make(map[string]set.StringSet)
|
|
for conditionType := range conditions {
|
|
if !supportedConditionsType.Contains(conditionType) {
|
|
err = fmt.Errorf("Unsupported condition type '%s', please validate your policy document", conditionType)
|
|
return err
|
|
}
|
|
for key, value := range conditions[conditionType] {
|
|
if !supportedConditionsKey.Contains(key) {
|
|
err = fmt.Errorf("Unsupported condition key '%s', please validate your policy document", conditionType)
|
|
return err
|
|
}
|
|
|
|
compatibleActions := conditionKeyActionMap[key]
|
|
if !compatibleActions.IsEmpty() &&
|
|
compatibleActions.Intersection(actions).IsEmpty() {
|
|
err = fmt.Errorf("Unsupported condition key %s for the given actions %s, "+
|
|
"please validate your policy document", key, actions)
|
|
return err
|
|
}
|
|
|
|
conditionVal, ok := conditionKeyVal[key]
|
|
if ok && !value.Intersection(conditionVal).IsEmpty() {
|
|
err = fmt.Errorf("Ambigious condition values for key '%s', please validate your policy document", key)
|
|
return err
|
|
}
|
|
conditionKeyVal[key] = value
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// List of actions for which prefixes are not allowed.
|
|
var invalidPrefixActions = set.StringSet{
|
|
"s3:GetBucketLocation": {},
|
|
"s3:ListBucket": {},
|
|
"s3:ListBucketMultipartUploads": {},
|
|
// Add actions which do not honor prefixes.
|
|
}
|
|
|
|
// resourcePrefix - provides the prefix removing any wildcards.
|
|
func resourcePrefix(resource string) string {
|
|
if strings.HasSuffix(resource, "*") {
|
|
resource = strings.TrimSuffix(resource, "*")
|
|
}
|
|
return resource
|
|
}
|
|
|
|
// checkBucketPolicyResources validates Resources in unmarshalled bucket policy structure.
|
|
// - Resources are validated against the given set of Actions.
|
|
// -
|
|
func checkBucketPolicyResources(bucket string, bucketPolicy *bucketPolicy) APIErrorCode {
|
|
// Validate statements for special actions and collect resources
|
|
// for others to validate nesting.
|
|
var resourceMap = set.NewStringSet()
|
|
for _, statement := range bucketPolicy.Statements {
|
|
for action := range statement.Actions {
|
|
for resource := range statement.Resources {
|
|
resourcePrefix := strings.SplitAfter(resource, bucketARNPrefix)[1]
|
|
if _, ok := invalidPrefixActions[action]; ok {
|
|
// Resource prefix is not equal to bucket for
|
|
// prefix invalid actions, reject them.
|
|
if resourcePrefix != bucket {
|
|
return ErrMalformedPolicy
|
|
}
|
|
} else {
|
|
// For all other actions validate if resourcePrefix begins
|
|
// with bucket name, if not reject them.
|
|
if strings.Split(resourcePrefix, "/")[0] != bucket {
|
|
return ErrMalformedPolicy
|
|
}
|
|
// All valid resources collect them separately to verify nesting.
|
|
resourceMap.Add(resourcePrefix)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
var resources []string
|
|
for resource := range resourceMap {
|
|
resources = append(resources, resourcePrefix(resource))
|
|
}
|
|
|
|
// Sort strings as shorter first.
|
|
sort.Strings(resources)
|
|
|
|
for len(resources) > 1 {
|
|
var resource string
|
|
resource, resources = resources[0], resources[1:]
|
|
// Loop through all resources, if one of them matches with
|
|
// previous shorter one, it means we have detected
|
|
// nesting. Reject such rules.
|
|
for _, otherResource := range resources {
|
|
// Common prefix reject such rules.
|
|
if hasPrefix(otherResource, resource) {
|
|
return ErrPolicyNesting
|
|
}
|
|
}
|
|
}
|
|
|
|
// No errors found.
|
|
return ErrNone
|
|
}
|
|
|
|
// parseBucketPolicy - parses and validates if bucket policy is of
|
|
// proper JSON and follows allowed restrictions with policy standards.
|
|
func parseBucketPolicy(bucketPolicyReader io.Reader, policy *bucketPolicy) (err error) {
|
|
// Parse bucket policy reader.
|
|
decoder := json.NewDecoder(bucketPolicyReader)
|
|
if err = decoder.Decode(&policy); err != nil {
|
|
return err
|
|
}
|
|
|
|
// Policy version cannot be empty.
|
|
if len(policy.Version) == 0 {
|
|
err = errors.New("Policy version cannot be empty")
|
|
return err
|
|
}
|
|
|
|
// Policy statements cannot be empty.
|
|
if len(policy.Statements) == 0 {
|
|
err = errors.New("Policy statement cannot be empty")
|
|
return err
|
|
}
|
|
|
|
// Loop through all policy statements and validate entries.
|
|
for _, statement := range policy.Statements {
|
|
// Statement effect should be valid.
|
|
if err := isValidEffect(statement.Effect); err != nil {
|
|
return err
|
|
}
|
|
// Statement principal should be supported format.
|
|
if err := isValidPrincipals(statement.Principal); err != nil {
|
|
return err
|
|
}
|
|
// Statement actions should be valid.
|
|
if err := isValidActions(statement.Actions); err != nil {
|
|
return err
|
|
}
|
|
// Statement resources should be valid.
|
|
if err := isValidResources(statement.Resources); err != nil {
|
|
return err
|
|
}
|
|
// Statement conditions should be valid.
|
|
if err := isValidConditions(statement.Actions, statement.Conditions); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
// Separate deny and allow statements, so that we can apply deny
|
|
// statements in the beginning followed by Allow statements.
|
|
var denyStatements []policyStatement
|
|
var allowStatements []policyStatement
|
|
for _, statement := range policy.Statements {
|
|
if statement.Effect == "Deny" {
|
|
denyStatements = append(denyStatements, statement)
|
|
continue
|
|
}
|
|
// else if statement.Effect == "Allow"
|
|
allowStatements = append(allowStatements, statement)
|
|
}
|
|
|
|
// Deny statements are enforced first once matched.
|
|
policy.Statements = append(denyStatements, allowStatements...)
|
|
|
|
// Return successfully parsed policy structure.
|
|
return nil
|
|
}
|
|
|