From 841b3d61a4206e8b84350d6a3f4efae0b7f6a054 Mon Sep 17 00:00:00 2001 From: Luke McCrone Date: Fri, 26 Dec 2025 10:42:58 -0300 Subject: [PATCH] test: policy status, policy command updates --- .github/workflows/system.yml | 14 ++++ tests/commands/put_bucket_policy.sh | 17 ++++- .../get_bucket_policy_status_rest.sh | 41 ++++++++++++ .../put_bucket_policy/put_bucket_policy.sh | 31 +++++++++ .../put_bucket_policy_rest.sh | 54 +++++++++++++++ tests/rest_scripts/put_bucket_policy.sh | 2 +- tests/run.sh | 8 ++- tests/test_rest_get_bucket_policy_status.sh | 65 +++++++++++++++++++ tests/test_rest_put_bucket_policy.sh | 34 ++++++++++ tests/test_s3api_policy_object.sh | 1 + tests/util/util_policy.sh | 19 +----- tests/util/util_public_access_block.sh | 2 +- 12 files changed, 267 insertions(+), 21 deletions(-) create mode 100644 tests/drivers/get_bucket_policy_status/get_bucket_policy_status_rest.sh create mode 100644 tests/drivers/put_bucket_policy/put_bucket_policy.sh create mode 100644 tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh create mode 100755 tests/test_rest_get_bucket_policy_status.sh create mode 100755 tests/test_rest_put_bucket_policy.sh diff --git a/.github/workflows/system.yml b/.github/workflows/system.yml index 99e416bf..fcbea4e4 100644 --- a/.github/workflows/system.yml +++ b/.github/workflows/system.yml @@ -79,6 +79,20 @@ jobs: DELETE_BUCKETS_AFTER_TEST: "true" BACKEND: "posix" AWS_REGION: "us-west-1" + - set: "REST, posix, static, rest-get-bucket-policy-status, folder IAM" + IAM_TYPE: folder + RUN_SET: "rest-get-bucket-policy-status" + RECREATE_BUCKETS: "false" + DELETE_BUCKETS_AFTER_TEST: "false" + BACKEND: "posix" + AWS_REGION: "us-east-1" + - set: "REST, posix, non-static, rest-get-bucket-policy-status, folder IAM" + IAM_TYPE: folder + RUN_SET: "rest-put-bucket-tagging,rest-get-bucket-location,rest-put-object-tagging,rest-get-object-tagging,rest-list-object-versions" + RECREATE_BUCKETS: "true" + DELETE_BUCKETS_AFTER_TEST: "true" + BACKEND: "posix" + AWS_REGION: "us-west-1" - set: "s3, posix, non-file count, non-static, folder IAM" IAM_TYPE: folder RUN_SET: "s3-non-file-count" diff --git a/tests/commands/put_bucket_policy.sh b/tests/commands/put_bucket_policy.sh index 6084d0ed..dedf7266 100644 --- a/tests/commands/put_bucket_policy.sh +++ b/tests/commands/put_bucket_policy.sh @@ -30,7 +30,7 @@ put_bucket_policy() { elif [[ $1 == 'mc' ]]; then policy=$(send_command mc --insecure anonymous set-json "$3" "$MC_ALIAS/$2" 2>&1) || put_policy_result=$? elif [ "$1" == 'rest' ]; then - put_bucket_policy_rest "$2" "$3" || put_policy_result=$? + put_bucket_policy_rest_200_or_204 "$2" "$3" || put_policy_result=$? return $put_policy_result else log 2 "command 'put bucket policy' not implemented for '$1'" @@ -77,3 +77,18 @@ put_bucket_policy_rest() { fi return 0 } + +put_bucket_policy_rest_200_or_204() { + if ! check_param_count "put_bucket_policy_rest" "bucket, policy file" 2 $#; then + return 1 + fi + if ! result=$(COMMAND_LOG="$COMMAND_LOG" BUCKET_NAME="$1" POLICY_FILE="$2" OUTPUT_FILE="$TEST_FILE_FOLDER/result.txt" ./tests/rest_scripts/put_bucket_policy.sh); then + log 2 "error putting bucket policy: $result" + return 1 + fi + if [ "$result" != "200" ] && [ "$result" != "204" ]; then + log 2 "expected '200' or '204', was '$result' ($(cat "$TEST_FILE_FOLDER/result.txt"))" + return 1 + fi + return 0 +} diff --git a/tests/drivers/get_bucket_policy_status/get_bucket_policy_status_rest.sh b/tests/drivers/get_bucket_policy_status/get_bucket_policy_status_rest.sh new file mode 100644 index 00000000..4234a97b --- /dev/null +++ b/tests/drivers/get_bucket_policy_status/get_bucket_policy_status_rest.sh @@ -0,0 +1,41 @@ +#!/usr/bin/env bats + +# Copyright 2025 Versity Software +# This file is licensed under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http:#www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +source ./tests/drivers/xml.sh + +check_policy_status() { + if ! check_param_count_v2 "data file" 1 $#; then + return 1 + fi + log 5 "data: $(cat "$1")" + if ! check_xml_element "$1" "$expected_policy_status" "PolicyStatus" "IsPublic"; then + log 2 "error checking policy status" + return 1 + fi + return 0 +} + +get_and_check_policy_status() { + if ! check_param_count_v2 "bucket, expected status" 2 $#; then + return 1 + fi + expected_policy_status="$2" + if ! send_rest_go_command_callback "200" "check_policy_status" "-bucketName" "$1" "-query" "policyStatus="; then + log 2 "error sending REST go command or checking callback" + return 1 + fi + return 0 +} \ No newline at end of file diff --git a/tests/drivers/put_bucket_policy/put_bucket_policy.sh b/tests/drivers/put_bucket_policy/put_bucket_policy.sh new file mode 100644 index 00000000..acc3d495 --- /dev/null +++ b/tests/drivers/put_bucket_policy/put_bucket_policy.sh @@ -0,0 +1,31 @@ +#!/usr/bin/env bats + +# Copyright 2025 Versity Software +# This file is licensed under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http:#www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +put_and_check_for_malformed_policy() { + if ! check_param_count "put_and_check_for_malformed_policy" "bucket, policy file" 2 $#; then + return 1 + fi + if put_bucket_policy "s3api" "$1" "$2"; then + log 2 "put succeeded despite malformed policy" + return 1 + fi + # shellcheck disable=SC2154 + if [[ "$put_bucket_policy_error" != *"MalformedPolicy"*"invalid action"* ]]; then + log 2 "invalid policy error: $put_bucket_policy_error" + return 1 + fi + return 0 +} \ No newline at end of file diff --git a/tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh b/tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh new file mode 100644 index 00000000..0767d7e7 --- /dev/null +++ b/tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh @@ -0,0 +1,54 @@ +#!/usr/bin/env bats + +# Copyright 2025 Versity Software +# This file is licensed under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http:#www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +put_simple_bucket_policy() { + if ! check_param_count_v2 "bucket" 1 $#; then + return 1 + fi + if [ "$DIRECT" == "true" ]; then + user_id="$DIRECT_S3_ROOT_ACCOUNT_NAME" + else + user_id="$AWS_ACCESS_KEY_ID" + fi + + if ! setup_policy_with_single_statement "$TEST_FILE_FOLDER/policy_file" "2012-10-17" "Allow" "$user_id" "s3:*" "arn:aws:s3:::$1"; then + log 2 "error setting up policy" + return 1 + fi + log 5 "policy: $TEST_FILE_FOLDER/policy_file" + if ! put_bucket_policy_rest "$1" "$TEST_FILE_FOLDER/policy_file"; then + log 2 "error putting policy" + return 1 + fi + return 0 +} + +put_public_bucket_policy() { + if ! check_param_count_v2 "bucket" 1 $#; then + return 1 + fi + + if ! setup_policy_with_single_statement "$TEST_FILE_FOLDER/policy_file" "2012-10-17" "Allow" "*" "s3:*" "arn:aws:s3:::$1"; then + log 2 "error setting up policy" + return 1 + fi + + if ! put_bucket_policy_rest "$1" "$TEST_FILE_FOLDER/policy_file"; then + log 2 "error putting policy" + return 1 + fi + return 0 +} \ No newline at end of file diff --git a/tests/rest_scripts/put_bucket_policy.sh b/tests/rest_scripts/put_bucket_policy.sh index 300f1207..eb190e0f 100755 --- a/tests/rest_scripts/put_bucket_policy.sh +++ b/tests/rest_scripts/put_bucket_policy.sh @@ -41,7 +41,7 @@ $payload_hash" # shellcheck disable=SC2119 create_canonical_hash_sts_and_signature -curl_command+=(curl -ks -w "\"%{http_code}\"" -X PUT "$AWS_ENDPOINT_URL/$bucket_name?policy=" +curl_command+=(curl -iks -w "\"%{http_code}\"" -X PUT "$AWS_ENDPOINT_URL/$bucket_name?policy=" -H "\"Authorization: AWS4-HMAC-SHA256 Credential=$aws_access_key_id/$year_month_day/$aws_region/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=$signature\"" -H "\"x-amz-content-sha256: $payload_hash\"" -H "\"x-amz-date: $current_date_time\"" diff --git a/tests/run.sh b/tests/run.sh index d78a1fde..36750b09 100755 --- a/tests/run.sh +++ b/tests/run.sh @@ -67,7 +67,7 @@ handle_param() { rest-create-bucket|rest-head-bucket|rest-list-buckets|rest-not-implemented|\ rest-put-object|rest-versioning|rest-bucket|rest-multipart|rest-delete-bucket-ownership-controls|\ rest-delete-bucket-tagging|setup-remove-static|rest-put-bucket-tagging|rest-get-bucket-location|\ - rest-put-object-tagging|rest-get-object-tagging|rest-list-object-versions) + rest-put-object-tagging|rest-get-object-tagging|rest-list-object-versions|rest-get-bucket-policy-status) run_suite "$1" ;; *) # Handle unrecognized options or positional arguments @@ -180,6 +180,8 @@ run_suite() { exit_code=1 elif ! "$HOME"/bin/bats ./tests/test_rest_get_bucket_location.sh; then exit_code=1 + elif ! "$HOME"/bin/bats ./tests/test_rest_get_bucket_policy_status.sh; then + exit_code=1 elif ! "$HOME"/bin/bats ./tests/test_rest_get_object_tagging.sh; then exit_code=1 elif ! "$HOME"/bin/bats ./tests/test_rest_head_bucket.sh; then @@ -240,6 +242,10 @@ run_suite() { echo "Running REST get bucket location tests ..." "$HOME"/bin/bats ./tests/test_rest_get_bucket_location.sh || exit_code=$? ;; + rest-get-bucket-policy-status) + echo "Running REST get bucket policy status tests ..." + "$HOME"/bin/bats ./tests/test_rest_get_bucket_policy_status.sh || exit_code=$? + ;; rest-get-object-tagging) echo "Running REST get object tagging tests ..." "$HOME"/bin/bats ./tests/test_rest_get_object_tagging.sh || exit_code=$? diff --git a/tests/test_rest_get_bucket_policy_status.sh b/tests/test_rest_get_bucket_policy_status.sh new file mode 100755 index 00000000..010f65a5 --- /dev/null +++ b/tests/test_rest_get_bucket_policy_status.sh @@ -0,0 +1,65 @@ +#!/usr/bin/env bats + +# Copyright 2025 Versity Software +# This file is licensed under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http:#www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +load ./bats-support/load +load ./bats-assert/load + +source ./tests/drivers/create_bucket/create_bucket_rest.sh +source ./tests/drivers/get_bucket_policy_status/get_bucket_policy_status_rest.sh +source ./tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh +source ./tests/util/util_public_access_block.sh +source ./tests/setup.sh + +@test "REST - GetBucketPolicyStatus" { + if [ "$DIRECT" != "true" ]; then + skip "https://github.com/versity/versitygw/issues/1712" + fi + run get_bucket_name "$BUCKET_ONE_NAME" + assert_success + bucket_name="$output" + + run setup_bucket_v2 "$bucket_name" + assert_success + + run put_simple_bucket_policy "$bucket_name" + assert_success + + run get_and_check_policy_status "$bucket_name" "false" + assert_success +} + +@test "REST - GetBucketPolicyStatus true" { + if [ "$DIRECT" != "true" ]; then + skip "https://github.com/versity/versitygw/issues/1712" + fi + run get_bucket_name "$BUCKET_ONE_NAME" + assert_success + bucket_name="$output" + + run setup_bucket_v2 "$bucket_name" + assert_success + + if [ "$DIRECT" == "true" ]; then + run allow_public_access "$bucket_name" + assert_success + fi + + run put_public_bucket_policy "$bucket_name" + assert_success + + run get_and_check_policy_status "$bucket_name" "true" + assert_success +} \ No newline at end of file diff --git a/tests/test_rest_put_bucket_policy.sh b/tests/test_rest_put_bucket_policy.sh new file mode 100755 index 00000000..7741c7ed --- /dev/null +++ b/tests/test_rest_put_bucket_policy.sh @@ -0,0 +1,34 @@ +#!/usr/bin/env bats + +# Copyright 2025 Versity Software +# This file is licensed under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http:#www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +load ./bats-support/load +load ./bats-assert/load + +source ./tests/drivers/create_bucket/create_bucket_rest.sh +source ./tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh +source ./tests/setup.sh + +@test "PutBucketPolicy - success returns 204" { + run get_bucket_name "$BUCKET_ONE_NAME" + assert_success + bucket_name="$output" + + run setup_bucket_v2 "$bucket_name" + assert_success + + run put_simple_bucket_policy "$bucket_name" + assert_success +} \ No newline at end of file diff --git a/tests/test_s3api_policy_object.sh b/tests/test_s3api_policy_object.sh index 8e29b0e3..1eb80963 100644 --- a/tests/test_s3api_policy_object.sh +++ b/tests/test_s3api_policy_object.sh @@ -14,6 +14,7 @@ # specific language governing permissions and limitations # under the License. +source ./tests/drivers/put_bucket_policy/put_bucket_policy.sh source ./tests/util/util_delete_object.sh test_s3api_policy_allow_deny() { diff --git a/tests/util/util_policy.sh b/tests/util/util_policy.sh index 2d59d1e6..5c7528f2 100644 --- a/tests/util/util_policy.sh +++ b/tests/util/util_policy.sh @@ -43,7 +43,8 @@ check_for_empty_policy() { add_direct_user_to_principal() { if [ "${principals[$idx]}" == "*" ]; then - modified_principal+="\"arn:aws:iam::$DIRECT_AWS_USER_ID:user/$DIRECT_S3_ROOT_ACCOUNT_NAME\"" + #modified_principal+="\"arn:aws:iam::$DIRECT_AWS_USER_ID:user/$DIRECT_S3_ROOT_ACCOUNT_NAME\"" + modified_principal+="\"*\"" else modified_principal+="\"arn:aws:iam::$DIRECT_AWS_USER_ID:user/${principals[$idx]}\"" fi @@ -238,22 +239,6 @@ check_policy() { return 0 } -put_and_check_for_malformed_policy() { - if ! check_param_count "put_and_check_for_malformed_policy" "bucket, policy file" 2 $#; then - return 1 - fi - if put_bucket_policy "s3api" "$1" "$2"; then - log 2 "put succeeded despite malformed policy" - return 1 - fi - # shellcheck disable=SC2154 - if [[ "$put_bucket_policy_error" != *"MalformedPolicy"*"invalid action"* ]]; then - log 2 "invalid policy error: $put_bucket_policy_error" - return 1 - fi - return 0 -} - get_and_check_no_policy_error() { if ! check_param_count "get_and_check_no_policy_error" "bucket" 1 $#; then return 1 diff --git a/tests/util/util_public_access_block.sh b/tests/util/util_public_access_block.sh index 473a6d98..c2fe4cb0 100644 --- a/tests/util/util_public_access_block.sh +++ b/tests/util/util_public_access_block.sh @@ -18,7 +18,7 @@ allow_public_access() { if ! check_param_count_v2 "bucket name" 1 $#; then return 1 fi - if ! result=$(COMMAND_LOG="$COMMAND_LOG" BUCKET_NAME="$1" BLOCK_PUBLIC_ACLS="FALSE" IGNORE_PUBLIC_ACLS="FALSE" RESTRICT_PUBLIC_BUCKETS="FALSE" OUTPUT_FILE="$TEST_FILE_FOLDER/response.txt" ./tests/rest_scripts/put_public_access_block.sh 2>&1); then + if ! result=$(COMMAND_LOG="$COMMAND_LOG" BUCKET_NAME="$1" BLOCK_PUBLIC_ACLS="FALSE" BLOCK_PUBLIC_POLICY="FALSE" IGNORE_PUBLIC_ACLS="FALSE" RESTRICT_PUBLIC_BUCKETS="FALSE" OUTPUT_FILE="$TEST_FILE_FOLDER/response.txt" ./tests/rest_scripts/put_public_access_block.sh 2>&1); then log 2 "error getting public access block: $result" return 1 fi