mirror of
https://github.com/versity/versitygw.git
synced 2026-08-28 11:56:02 +00:00
niksis02
2147a0c304
Fixes #1327 Fixes #1567 Closes #2264 Wires the S3 gateway up to the standalone IAM service so identity policies, not just bucket policies and ACLs, are enforced on the S3 data plane. The gateway authenticates SigV4 requests by calling new private derive-signing-key and resolve-identity endpoints on the IAM service instead of holding secrets itself, and evaluates identity policy through the same PolicyEvaluator path added to auth.VerifyAccess, combined with the bucket policy using explicit-deny-wins precedence. The private endpoints are served over their own mTLS listener (new iamapi/private package, genmtlscerts.sh to generate test material, and client-cert support in internal/netutil), separate from the public IAM API. As part of this the vendored aws/signer/v4 package is deleted and replaced by a pure-Go SigV4 implementation in internal/sigv4auth, which now reads canonical request data directly off the fiber.Ctx instead of reconstructing an http.Request, and is shared by both the S3 request-signing verification and the new private-endpoint signing. DeleteObjects moves from an all-or-nothing authorization check to true partial success: VerifyObjectsAccess evaluates every object in a batch independently against both the identity policy and any object lock, so a denial or a locked object only removes that key from the batch instead of failing the whole request. It also batches the identity-policy round trip and the bucket-policy fetch once per request rather than once per object, and separates plain deletes from versioned ones since a versioned delete needs s3:DeleteObjectVersion rather than s3:DeleteObject. Object lock handling got a few correctness fixes alongside this: a bypass is now modeled as BypassNone/BypassRequested/BypassOverwrite rather than a single bool, because root's blanket ability to override a GOVERNANCE retention should only apply when the client actually asked to bypass it (DeleteObject/DeleteObjects/PutObjectRetention), not when the gateway is silently replacing a locked object via an overwrite, which needs the permission from everyone including root. Retention changes are now correctly classified as an extension (allowed under plain s3:PutObjectRetention) versus a weakening (date or mode change, which needs the bypass permission), and a COMPLIANCE lock can never be weakened by anyone regardless of permissions, matching AWS. Separately, VerifyObjectCopyAccess had a readonly-mode gap: it returned early for root/admin before ever calling VerifyAccess, so the readonly check inside VerifyAccess never ran for them on CopyObject; access checks are now ordered so the readonly gate always applies before any root/admin bypass, for copy as well as every other write path. Bucket policies also gained Condition block support, via a new shared internal/condition package moved out of the IAM policy package since both bucket and identity policies share the same evaluation semantics. It implements the full AWS operator set — String{Equals,NotEquals,EqualsIgnoreCase,NotEqualsIgnoreCase,Like,NotLike}, Numeric{Equals,NotEquals,LessThan,LessThanEquals,GreaterThan,GreaterThanEquals}, Date{Equals,NotEquals,LessThan,LessThanEquals,GreaterThan,GreaterThanEquals}, Bool, BinaryEquals, Arn{Equals,Like,NotEquals,NotLike}, IpAddress/NotIpAddress, and Null — along with the ForAllValues/ForAnyValue set qualifiers and the IfExists modifier. A new requestConditionContext builds the per-request keys a bucket policy's Condition block can reference — aws:SourceIp, aws:SecureTransport, aws:CurrentTime, aws:EpochTime, aws:UserAgent, aws:Referer, s3:prefix, s3:delimiter, s3:max-keys, s3:x-amz-acl, s3:VersionId — following AWS's own per-action rules for which keys a given S3 operation actually populates. Identity-derived keys such as aws:PrincipalArn and aws:username are deliberately left unwired here, since the gateway has no way to know them; the standalone IAM service fills those in itself when it evaluates an identity policy. Also added new integration test suites for S3-side IAM: s3_iam_access_control.go and s3_iam_session_access_control.go cover identity-policy enforcement and session-credential requests against real S3 operations, alongside expanded OIDC/web-identity coverage and a new runoidctests.sh runner wired into the OIDC GitHub Actions workflow.
335 lines
9.9 KiB
Bash
Executable File
335 lines
9.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# parse options
|
|
USE_SIDECAR=false
|
|
RUN_DATA_INTEGRITY_ETAG_TESTS=true
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--sidecar) USE_SIDECAR=true ;;
|
|
--skip-data-integrity-etag-tests) RUN_DATA_INTEGRITY_ETAG_TESTS=false ;;
|
|
esac
|
|
done
|
|
|
|
# build sidecar flag for versitygw invocations
|
|
SIDECAR_FLAG=""
|
|
SIDECAR_TEST_FLAG=""
|
|
if $USE_SIDECAR; then
|
|
rm -rf /tmp/sidecar
|
|
mkdir /tmp/sidecar
|
|
SIDECAR_FLAG="--sidecar /tmp/sidecar"
|
|
SIDECAR_TEST_FLAG="--sidecar"
|
|
fi
|
|
|
|
# make temp dirs
|
|
rm -rf /tmp/gw
|
|
mkdir /tmp/gw
|
|
rm -rf /tmp/covdata
|
|
mkdir /tmp/covdata
|
|
rm -rf /tmp/https.covdata
|
|
mkdir /tmp/https.covdata
|
|
rm -rf /tmp/versioning.covdata
|
|
mkdir /tmp/versioning.covdata
|
|
rm -rf /tmp/versioning.https.covdata
|
|
mkdir /tmp/versioning.https.covdata
|
|
rm -rf /tmp/noacl.covdata
|
|
mkdir /tmp/noacl.covdata
|
|
|
|
rm -rf /tmp/versioningdir
|
|
mkdir /tmp/versioningdir
|
|
|
|
# setup tls certificate and key
|
|
ECHO "Generating TLS certificate and key in the cert.pem and key.pem files"
|
|
|
|
openssl genpkey -algorithm RSA -out key.pem -pkeyopt rsa_keygen_bits:2048
|
|
openssl req -new -x509 -key key.pem -out cert.pem -days 365 -subj "/C=US/ST=California/L=San Francisco/O=Versity/OU=Software/CN=versity.com"
|
|
|
|
ECHO "Running the sdk test over http"
|
|
# run server in background not versioning-enabled
|
|
# port: 7070(default)
|
|
GOCOVERDIR=/tmp/covdata ./versitygw -a user -s pass --iam-dir /tmp/gw posix $SIDECAR_FLAG /tmp/gw &
|
|
GW_PID=$!
|
|
|
|
sleep 1
|
|
|
|
# check if gateway process is still running
|
|
if ! kill -0 $GW_PID; then
|
|
echo "server no longer running"
|
|
exit 1
|
|
fi
|
|
|
|
# run tests
|
|
# full flow tests
|
|
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7070 full-flow --parallel $SIDECAR_TEST_FLAG; then
|
|
echo "full flow tests failed"
|
|
kill $GW_PID
|
|
exit 1
|
|
fi
|
|
# posix tests
|
|
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7070 posix; then
|
|
echo "posix tests failed"
|
|
kill $GW_PID
|
|
exit 1
|
|
fi
|
|
# gateway iam tests
|
|
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7070 gw-iam; then
|
|
echo "gateway iam tests failed"
|
|
kill $GW_PID
|
|
exit 1
|
|
fi
|
|
|
|
kill $GW_PID
|
|
|
|
ECHO "Running the sdk test over https"
|
|
|
|
# run server in background with TLS certificate
|
|
# port: 7071(default)
|
|
GOCOVERDIR=/tmp/https.covdata ./versitygw --cert "$PWD/cert.pem" --key "$PWD/key.pem" -p :7071 -a user -s pass --iam-dir /tmp/gw posix $SIDECAR_FLAG /tmp/gw &
|
|
GW_HTTPS_PID=$!
|
|
|
|
sleep 1
|
|
|
|
# check if https gateway process is still running
|
|
if ! kill -0 $GW_HTTPS_PID; then
|
|
echo "server no longer running"
|
|
exit 1
|
|
fi
|
|
|
|
# run tests
|
|
# full flow tests
|
|
if ! ./versitygw test --allow-insecure -a user -s pass -e https://127.0.0.1:7071 full-flow --parallel $SIDECAR_TEST_FLAG; then
|
|
echo "full flow tests failed"
|
|
kill $GW_HTTPS_PID
|
|
exit 1
|
|
fi
|
|
# posix tests
|
|
if ! ./versitygw test --allow-insecure -a user -s pass -e https://127.0.0.1:7071 posix; then
|
|
echo "posix tests failed"
|
|
kill $GW_HTTPS_PID
|
|
exit 1
|
|
fi
|
|
# gateway iam tests
|
|
if ! ./versitygw test --allow-insecure -a user -s pass -e https://127.0.0.1:7071 gw-iam; then
|
|
echo "gateway iam tests failed"
|
|
kill $GW_HTTPS_PID
|
|
exit 1
|
|
fi
|
|
|
|
kill $GW_HTTPS_PID
|
|
|
|
ECHO "Running the sdk test over http against the versioning-enabled gateway"
|
|
# run server in background versioning-enabled
|
|
# port: 7072
|
|
GOCOVERDIR=/tmp/versioning.covdata ./versitygw -p :7072 -a user -s pass --iam-dir /tmp/gw posix $SIDECAR_FLAG --versioning-dir /tmp/versioningdir /tmp/gw &
|
|
GW_VS_PID=$!
|
|
|
|
# wait a second for server to start up
|
|
sleep 1
|
|
|
|
# check if versioning-enabled gateway process is still running
|
|
if ! kill -0 $GW_VS_PID; then
|
|
echo "versioning-enabled server no longer running"
|
|
exit 1
|
|
fi
|
|
|
|
# run tests
|
|
# full flow tests
|
|
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7072 full-flow -vs --parallel $SIDECAR_TEST_FLAG; then
|
|
echo "versioning-enabled full-flow tests failed"
|
|
kill $GW_VS_PID
|
|
exit 1
|
|
fi
|
|
# posix tests
|
|
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7072 posix -vs; then
|
|
echo "versiongin-enabled posix tests failed"
|
|
kill $GW_VS_PID
|
|
exit 1
|
|
fi
|
|
|
|
# kill off server
|
|
kill $GW_VS_PID
|
|
|
|
ECHO "Running the sdk test over https against the versioning-enabled gateway"
|
|
# run server in background versioning-enabled
|
|
# port: 7073
|
|
GOCOVERDIR=/tmp/versioning.https.covdata ./versitygw --cert "$PWD/cert.pem" --key "$PWD/key.pem" -p :7073 -a user -s pass --iam-dir /tmp/gw posix $SIDECAR_FLAG --versioning-dir /tmp/versioningdir /tmp/gw &
|
|
GW_VS_HTTPS_PID=$!
|
|
|
|
# wait a second for server to start up
|
|
sleep 1
|
|
|
|
# check if versioning-enabled gateway process is still running
|
|
if ! kill -0 $GW_VS_HTTPS_PID; then
|
|
echo "versioning-enabled server no longer running"
|
|
exit 1
|
|
fi
|
|
|
|
# run tests
|
|
# full flow tests
|
|
if ! ./versitygw test --allow-insecure -a user -s pass -e https://127.0.0.1:7073 full-flow -vs --parallel $SIDECAR_TEST_FLAG; then
|
|
echo "versioning-enabled full-flow tests failed"
|
|
kill $GW_VS_HTTPS_PID
|
|
exit 1
|
|
fi
|
|
# posix tests
|
|
if ! ./versitygw test --allow-insecure -a user -s pass -e https://127.0.0.1:7073 posix -vs; then
|
|
echo "versiongin-enabled posix tests failed"
|
|
kill $GW_VS_HTTPS_PID
|
|
exit 1
|
|
fi
|
|
|
|
# kill off server
|
|
kill $GW_VS_HTTPS_PID
|
|
|
|
if $RUN_DATA_INTEGRITY_ETAG_TESTS; then
|
|
ECHO "Running data-integrity-etag integration tests"
|
|
# run server in background with data-integrity-etag enabled
|
|
# port: 7075
|
|
GOCOVERDIR=/tmp/covdata ./versitygw -p :7075 -a user -s pass --iam-dir /tmp/gw posix $SIDECAR_FLAG --data-integrity-etag /tmp/gw &
|
|
GW_DI_ETAG_PID=$!
|
|
|
|
# wait a second for server to start up
|
|
sleep 1
|
|
|
|
# check if data-integrity-etag gateway process is still running
|
|
if ! kill -0 $GW_DI_ETAG_PID; then
|
|
echo "data-integrity-etag server no longer running"
|
|
exit 1
|
|
fi
|
|
|
|
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7075 data-integrity-etag; then
|
|
echo "data-integrity-etag tests failed"
|
|
kill $GW_DI_ETAG_PID
|
|
exit 1
|
|
fi
|
|
|
|
kill $GW_DI_ETAG_PID
|
|
fi
|
|
|
|
ECHO "Running No ACL integration tests"
|
|
# run server in background versioning-enabled
|
|
# port: 7073
|
|
GOCOVERDIR=/tmp/noacl.covdata ./versitygw -p :7074 -a user -s pass -noacl --iam-dir /tmp/gw posix $SIDECAR_FLAG /tmp/gw &
|
|
GW_NO_ACL_PID=$!
|
|
|
|
# wait a second for server to start up
|
|
sleep 1
|
|
|
|
# check if noacl gateway process is still running
|
|
if ! kill -0 $GW_NO_ACL_PID; then
|
|
echo "noacl server no longer running"
|
|
exit 1
|
|
fi
|
|
|
|
if ! ./versitygw test --allow-insecure -a user -s pass -e http://127.0.0.1:7074 noacl; then
|
|
echo "No ACL integration tests failed"
|
|
kill $GW_NO_ACL_PID
|
|
exit 1
|
|
fi
|
|
|
|
# kill off server
|
|
kill $GW_NO_ACL_PID
|
|
|
|
ECHO "Running the s3 + standalone IAM access control tests"
|
|
# This stage is the only one that runs two versitygw processes at once: a
|
|
# standalone IAM service holding every user, policy and secret, and an s3
|
|
# gateway that reaches it over mTLS for signing keys and policy decisions.
|
|
# ports: 7080 IAM control plane, 7081 IAM private endpoint, 7082 s3 gateway
|
|
rm -rf /tmp/s3iam /tmp/s3iamgw /tmp/s3iamcerts /tmp/s3iam.covdata /tmp/s3iamgw.covdata
|
|
mkdir -p /tmp/s3iam /tmp/s3iamgw /tmp/s3iam.covdata /tmp/s3iamgw.covdata
|
|
|
|
# The gateway verifies the IAM service's certificate normally, with no
|
|
# hostname override, so the server certificate needs an IP SAN matching the
|
|
# --iam-standalone-endpoint host.
|
|
./genmtlscerts.sh /tmp/s3iamcerts 127.0.0.1
|
|
|
|
GOCOVERDIR=/tmp/s3iam.covdata ./versitygw --health /healthz -p :7080 -a user -s pass iam \
|
|
--dir /tmp/s3iam \
|
|
--private-ports 127.0.0.1:7081 \
|
|
--private-cert /tmp/s3iamcerts/iam-server.pem \
|
|
--private-cert-key /tmp/s3iamcerts/iam-server.key \
|
|
--private-client-ca /tmp/s3iamcerts/ca.pem &
|
|
IAM_PID=$!
|
|
|
|
sleep 2
|
|
|
|
if ! kill -0 $IAM_PID; then
|
|
echo "standalone IAM service no longer running"
|
|
exit 1
|
|
fi
|
|
|
|
GOCOVERDIR=/tmp/s3iamgw.covdata ./versitygw -p :7082 -a user -s pass \
|
|
--iam-standalone-endpoint 127.0.0.1:7081 \
|
|
--iam-standalone-client-cert /tmp/s3iamcerts/gw-client.pem \
|
|
--iam-standalone-client-cert-key /tmp/s3iamcerts/gw-client.key \
|
|
--iam-standalone-server-ca /tmp/s3iamcerts/ca.pem \
|
|
posix $SIDECAR_FLAG /tmp/s3iamgw &
|
|
GW_S3IAM_PID=$!
|
|
|
|
sleep 2
|
|
|
|
if ! kill -0 $GW_S3IAM_PID; then
|
|
echo "s3 gateway backed by standalone IAM no longer running"
|
|
kill $IAM_PID
|
|
exit 1
|
|
fi
|
|
|
|
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7082 --iam-endpoint http://127.0.0.1:7080 s3-iam; then
|
|
echo "s3 + standalone IAM access control tests failed"
|
|
kill $GW_S3IAM_PID
|
|
kill $IAM_PID
|
|
exit 1
|
|
fi
|
|
|
|
kill $GW_S3IAM_PID
|
|
kill $IAM_PID
|
|
|
|
exit 0
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Coverage Reports (Go 1.20+ Runtime Coverage)
|
|
#
|
|
# The servers above were started with GOCOVERDIR=<dir>, which causes Go to write
|
|
# raw coverage artifacts into those directories (covmeta + covcounters.* files).
|
|
# These raw files must be processed with "go tool covdata" to generate
|
|
# human-readable coverage reports.
|
|
#
|
|
# You may generate *per-environment* coverage or a *merged full-suite* report.
|
|
#
|
|
# -----------------------------------------------------------------------------
|
|
# 1) INDIVIDUAL COVERAGE REPORTS
|
|
#
|
|
# Example for a single environment (e.g. /tmp/covdata):
|
|
#
|
|
# go tool covdata percent -i=/tmp/covdata
|
|
# go tool covdata textfmt -i=/tmp/covdata -o /tmp/profile.txt
|
|
# go tool cover -html=/tmp/profile.txt
|
|
#
|
|
# Repeat using:
|
|
# /tmp/covdata
|
|
# /tmp/https.covdata
|
|
# /tmp/versioning.covdata
|
|
# /tmp/versioning.https.covdata
|
|
# /tmp/noacl.covdata
|
|
# /tmp/s3iam.covdata (standalone IAM service)
|
|
# /tmp/s3iamgw.covdata (s3 gateway backed by it)
|
|
#
|
|
# This gives you coverage metrics isolated per test suite / server mode.
|
|
#
|
|
# -----------------------------------------------------------------------------
|
|
# 2) MERGED COVERAGE REPORT (RECOMMENDED)
|
|
#
|
|
# If you want a unified report combining all environments:
|
|
#
|
|
# go tool covdata merge \
|
|
# -i=/tmp/covdata,/tmp/https.covdata,/tmp/versioning.covdata,/tmp/versioning.https.covdata,/tmp/noacl.covdata,/tmp/s3iam.covdata,/tmp/s3iamgw.covdata \
|
|
# -o /tmp/allcovdata
|
|
#
|
|
# go tool covdata percent -i=/tmp/allcovdata
|
|
# go tool covdata textfmt -i=/tmp/allcovdata -o /tmp/all_profile.txt
|
|
# go tool cover -html=/tmp/all_profile.txt
|
|
#
|
|
# This produces the full aggregate coverage across all HTTP/HTTPS,
|
|
# versioning-enabled, non-versioning, and no-ACL test runs.
|
|
#
|
|
# -----------------------------------------------------------------------------
|