mirror of
https://github.com/versity/versitygw.git
synced 2026-09-01 05:36:55 +00:00
niksis02andBen McClelland
96c4c3e2d6
This implementation introduces **public buckets**, which are accessible without signature-based authentication.
There are two ways to grant public access to a bucket:
* **Bucket ACLs**
* **Bucket Policies**
Only `Get` and `List` operations are permitted on public buckets. All **write operations** require authentication, regardless of whether public access is granted through an ACL or a policy.
The implementation includes an `AuthorizePublicBucketAccess` middleware, which checks if public access has been granted to the bucket. If so, authentication middlewares are skipped. For unauthenticated requests, appropriate errors are returned based on the specific S3 action.
---
**1. Bucket-Level Operations:**
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::test"
}
]
}
```
**2. Object-Level Operations:**
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::test/*"
}
]
}
```
**3. Both Bucket and Object-Level Operations:**
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::test"
},
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::test/*"
}
]
}
```
---
```sh
aws s3api create-bucket --bucket test --object-ownership BucketOwnerPreferred
aws s3api put-bucket-acl --bucket test --acl public-read
```
88 lines
2.9 KiB
Go
88 lines
2.9 KiB
Go
// Copyright 2023 Versity Software
|
|
// This file is licensed under the Apache License, Version 2.0
|
|
// (the "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package middlewares
|
|
|
|
import (
|
|
"net/http"
|
|
"regexp"
|
|
"strings"
|
|
|
|
"github.com/aws/aws-sdk-go-v2/service/s3"
|
|
"github.com/gofiber/fiber/v2"
|
|
"github.com/versity/versitygw/auth"
|
|
"github.com/versity/versitygw/backend"
|
|
"github.com/versity/versitygw/s3api/controllers"
|
|
"github.com/versity/versitygw/s3api/utils"
|
|
"github.com/versity/versitygw/s3err"
|
|
"github.com/versity/versitygw/s3log"
|
|
)
|
|
|
|
var (
|
|
singlePath = regexp.MustCompile(`^/[^/]+/?$`)
|
|
)
|
|
|
|
func AclParser(be backend.Backend, logger s3log.AuditLogger, readonly bool) fiber.Handler {
|
|
return func(ctx *fiber.Ctx) error {
|
|
path := ctx.Path()
|
|
pathParts := strings.Split(path, "/")
|
|
bucket := pathParts[1]
|
|
if path == "/" && ctx.Method() == http.MethodGet {
|
|
return ctx.Next()
|
|
}
|
|
if ctx.Method() == http.MethodPatch {
|
|
return ctx.Next()
|
|
}
|
|
if singlePath.MatchString(path) &&
|
|
ctx.Method() == http.MethodPut &&
|
|
!ctx.Request().URI().QueryArgs().Has("acl") &&
|
|
!ctx.Request().URI().QueryArgs().Has("tagging") &&
|
|
!ctx.Request().URI().QueryArgs().Has("versioning") &&
|
|
!ctx.Request().URI().QueryArgs().Has("policy") &&
|
|
!ctx.Request().URI().QueryArgs().Has("object-lock") &&
|
|
!ctx.Request().URI().QueryArgs().Has("ownershipControls") &&
|
|
!ctx.Request().URI().QueryArgs().Has("cors") {
|
|
isRoot, acct := utils.ContextKeyIsRoot.Get(ctx).(bool), utils.ContextKeyAccount.Get(ctx).(auth.Account)
|
|
if err := auth.MayCreateBucket(acct, isRoot); err != nil {
|
|
return controllers.SendXMLResponse(ctx, nil, err, &controllers.MetaOpts{Logger: logger, Action: "CreateBucket"})
|
|
}
|
|
if readonly {
|
|
return controllers.SendXMLResponse(ctx, nil, s3err.GetAPIError(s3err.ErrAccessDenied),
|
|
&controllers.MetaOpts{
|
|
Logger: logger,
|
|
Action: "CreateBucket",
|
|
})
|
|
}
|
|
return ctx.Next()
|
|
}
|
|
data, err := be.GetBucketAcl(ctx.Context(), &s3.GetBucketAclInput{Bucket: &bucket})
|
|
if err != nil {
|
|
return controllers.SendResponse(ctx, err, &controllers.MetaOpts{Logger: logger})
|
|
}
|
|
|
|
parsedAcl, err := auth.ParseACL(data)
|
|
if err != nil {
|
|
return controllers.SendResponse(ctx, err, &controllers.MetaOpts{Logger: logger})
|
|
}
|
|
|
|
// if owner is not set, set default owner to root account
|
|
if parsedAcl.Owner == "" {
|
|
parsedAcl.Owner = utils.ContextKeyRootAccessKey.Get(ctx).(string)
|
|
}
|
|
|
|
utils.ContextKeyParsedAcl.Set(ctx, parsedAcl)
|
|
return ctx.Next()
|
|
}
|
|
}
|