dualfroz
b7ff97181d
ListBuckets ignored bucket-region: a value that is not a region was accepted, and a region other than the gateway one still listed every bucket. S3 rejects an invalid value with 400 InvalidArgument, "Argument value abc is not a valid AWS Region", and lists only the buckets of the requested region. Check bucket-region against the AWS region code format, always accepting the gateway region whatever its name, and return an empty list for any other region, since every bucket lives in the gateway region. Enable the REST tests that cover both cases. Fixes #1923 Fixes #1930
96 lines
2.9 KiB
Go
96 lines
2.9 KiB
Go
// Copyright 2023 Versity Software
|
|
// This file is licensed under the Apache License, Version 2.0
|
|
// (the "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package controllers
|
|
|
|
import (
|
|
"github.com/gofiber/fiber/v3"
|
|
"github.com/versity/versitygw/auth"
|
|
"github.com/versity/versitygw/debuglogger"
|
|
"github.com/versity/versitygw/s3api/utils"
|
|
"github.com/versity/versitygw/s3err"
|
|
"github.com/versity/versitygw/s3response"
|
|
)
|
|
|
|
func (c S3ApiController) ListBuckets(ctx fiber.Ctx) (*Response, error) {
|
|
cToken := ctx.Query("continuation-token")
|
|
prefix := ctx.Query("prefix")
|
|
maxBucketsStr := ctx.Query("max-buckets")
|
|
bucketRegion := ctx.Query("bucket-region")
|
|
acct := utils.ContextKeyAccount.Get(ctx).(auth.Account)
|
|
isRoot, _ := utils.ContextKeyIsRoot.Get(ctx).(bool)
|
|
|
|
if err := auth.VerifyListAllMyBucketsAccess(ctx, c.iam, isRoot, acct); err != nil {
|
|
return &Response{
|
|
MetaOpts: &MetaOptions{},
|
|
}, err
|
|
}
|
|
|
|
owner, listAll := acct.Access, acct.Role == auth.RoleAdmin
|
|
// A backend that fixes bucket ownership leaves no per-caller subset to
|
|
// narrow the listing to, so every caller lists every bucket, the way an
|
|
// AWS account's users do. What they may then do with one stays an IAM
|
|
// policy decision, made per request.
|
|
if fixedOwner, fixed := auth.ResolveFixedBucketOwner(c.iam); fixed {
|
|
owner, listAll = fixedOwner.Access, true
|
|
}
|
|
|
|
region, ok := utils.ContextKeyRegion.Get(ctx).(string)
|
|
if !ok {
|
|
region = defaultRegion
|
|
}
|
|
|
|
maxBuckets, err := utils.ParseMaxLimiter(maxBucketsStr, utils.LimiterTypeMaxBuckets)
|
|
if err != nil {
|
|
return &Response{
|
|
MetaOpts: &MetaOptions{},
|
|
}, err
|
|
}
|
|
|
|
if bucketRegion != "" && !utils.IsValidBucketRegion(bucketRegion, region) {
|
|
debuglogger.Logf("invalid bucket region: %s", bucketRegion)
|
|
return &Response{
|
|
MetaOpts: &MetaOptions{},
|
|
}, s3err.GetInvalidArgBucketRegion(bucketRegion)
|
|
}
|
|
|
|
// IsAdmin is the backends' "return every bucket, unfiltered" flag.
|
|
res, err := c.be.ListBuckets(ctx.RequestCtx(),
|
|
s3response.ListBucketsInput{
|
|
Owner: owner,
|
|
IsAdmin: listAll,
|
|
MaxBuckets: maxBuckets,
|
|
ContinuationToken: cToken,
|
|
Prefix: prefix,
|
|
})
|
|
if err != nil {
|
|
return &Response{}, err
|
|
}
|
|
|
|
// every bucket lives in the gateway region, so there is nothing
|
|
// to list for any other region
|
|
if bucketRegion != "" && bucketRegion != region {
|
|
res.Buckets.Bucket = nil
|
|
res.ContinuationToken = ""
|
|
}
|
|
|
|
for i := range res.Buckets.Bucket {
|
|
res.Buckets.Bucket[i].BucketRegion = region
|
|
}
|
|
|
|
return &Response{
|
|
Data: res,
|
|
}, nil
|
|
}
|