rgw: Perm mask.

Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>

diff --git a/src/rgw/rgw_auth.cc b/src/rgw/rgw_auth.cc
index b678ff6449f9952161adfe98951c24c411e278a0..2520e6e7262ad9f6667cc128a13694e9db316d5a 100644 (file)
--- a/src/rgw/rgw_auth.cc
+++ b/src/rgw/rgw_auth.cc
@@ -556,7 +556,7 @@ rgw::auth::AnonymousEngine::authenticate(const req_state* const s) const
     auto apl = \
       apl_factory->create_apl_local(cct, s, user_info,
                                     rgw::auth::LocalApplier::NO_SUBUSER,
-                                    boost::none);
+                                    boost::none, boost::none);
     return result_t::grant(std::move(apl));
   }
 }

diff --git a/src/rgw/rgw_auth.h b/src/rgw/rgw_auth.h
index d1ab958e2ab12da5a6cf77570716c4c4dbe760be..4fe791f95ba7f0ec44ddfd204085f24509c5f584 100644 (file)
--- a/src/rgw/rgw_auth.h
+++ b/src/rgw/rgw_auth.h
@@ -455,6 +455,7 @@ protected:
   const RGWUserInfo user_info;
   const std::string subuser;
   vector<std::string> role_policies;
+  uint32_t perm_mask;
 
   uint32_t get_perm_mask(const std::string& subuser_name,
                          const RGWUserInfo &uinfo) const;
@@ -465,12 +466,18 @@ public:
   LocalApplier(CephContext* const cct,
                const RGWUserInfo& user_info,
                std::string subuser,
-               const boost::optional<vector<std::string> >& role_policies)
+               const boost::optional<vector<std::string> >& role_policies,
+               const boost::optional<uint32_t>& perm_mask)
     : user_info(user_info),
-      subuser(std::move(subuser)){
+      subuser(std::move(subuser)) {
     if (role_policies) {
       this->role_policies = role_policies.get();
     }
+    if (perm_mask) {
+      this->perm_mask = perm_mask.get();
+    } else {
+      this->perm_mask = RGW_PERM_INVALID;
+    }
   }
 
 
@@ -479,7 +486,11 @@ public:
   bool is_owner_of(const rgw_user& uid) const override;
   bool is_identity(const idset_t& ids) const override;
   uint32_t get_perm_mask() const override {
-    return get_perm_mask(subuser, user_info);
+    if (this->perm_mask == RGW_PERM_INVALID) {
+      return get_perm_mask(subuser, user_info);
+    } else {
+      return this->perm_mask;
+    }
   }
   void to_str(std::ostream& out) const override;
   void load_acct_info(RGWUserInfo& user_info) const override; /* out */
@@ -493,7 +504,8 @@ public:
                                       const req_state* s,
                                       const RGWUserInfo& user_info,
                                       const std::string& subuser,
-                                      const boost::optional<vector<std::string> >& role_policies) const = 0;
+                                      const boost::optional<vector<std::string> >& role_policies,
+                                      const boost::optional<uint32_t>& perm_mask) const = 0;
     };
 };
 

diff --git a/src/rgw/rgw_auth_s3.h b/src/rgw/rgw_auth_s3.h
index ffa845ea02fd0a0d5d40a375a833df58f6bbcd1e..68e4057491d2a7a04b060fee00c8efb62089ee11 100644 (file)
--- a/src/rgw/rgw_auth_s3.h
+++ b/src/rgw/rgw_auth_s3.h
@@ -55,9 +55,10 @@ class STSAuthStrategy : public rgw::auth::Strategy,
                             const req_state* const s,
                             const RGWUserInfo& user_info,
                             const std::string& subuser,
-                            const boost::optional<vector<std::string> >& role_policies) const override {
+                            const boost::optional<vector<std::string> >& role_policies,
+                            const boost::optional<uint32_t>& perm_mask) const override {
     auto apl = rgw::auth::add_sysreq(cct, store, s,
-      rgw::auth::LocalApplier(cct, user_info, subuser, role_policies));
+      rgw::auth::LocalApplier(cct, user_info, subuser, role_policies, perm_mask));
     return aplptr_t(new decltype(apl)(std::move(apl)));
   }
 
@@ -156,9 +157,10 @@ class AWSAuthStrategy : public rgw::auth::Strategy,
                             const req_state* const s,
                             const RGWUserInfo& user_info,
                             const std::string& subuser,
-                            const boost::optional<vector<std::string> >& role_policies) const override {
+                            const boost::optional<vector<std::string> >& role_policies,
+                            const boost::optional<uint32_t>& perm_mask) const override {
     auto apl = rgw::auth::add_sysreq(cct, store, s,
-      rgw::auth::LocalApplier(cct, user_info, subuser, role_policies));
+      rgw::auth::LocalApplier(cct, user_info, subuser, role_policies, perm_mask));
     /* TODO(rzarzynski): replace with static_ptr. */
     return aplptr_t(new decltype(apl)(std::move(apl)));
   }

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index 38c00944be681d415f4ee45cfe6195c1a0d20ac1..d5a1bed14c5d77ad6766f27ed1a08781d926db4a 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -4341,7 +4341,7 @@ rgw::auth::s3::LocalEngine::authenticate(
     return result_t::deny(-ERR_SIGNATURE_NO_MATCH);
   }
 
-  auto apl = apl_factory->create_apl_local(cct, s, user_info, k.subuser, boost::none);
+  auto apl = apl_factory->create_apl_local(cct, s, user_info, k.subuser, boost::none, boost::none);
   return result_t::grant(std::move(apl), completer_factory(k.key));
 }
 
@@ -4480,7 +4480,7 @@ rgw::auth::s3::STSEngine::authenticate(
     return result_t::grant(std::move(apl), completer_factory(boost::none));
   } else {
     string subuser;
-    auto apl = local_apl_factory->create_apl_local(cct, s, user_info, subuser, role_policies);
+    auto apl = local_apl_factory->create_apl_local(cct, s, user_info, subuser, role_policies, token.perm_mask);
     return result_t::grant(std::move(apl), completer_factory(token.secret_access_key));
   }
 }

diff --git a/src/rgw/rgw_rest_s3.h b/src/rgw/rgw_rest_s3.h
index 25827beb673f0f2dd4bbf1023041afed2b1b4e96..97181b291857e8d48c75ed5b5e42aecd2e314cc5 100644 (file)
--- a/src/rgw/rgw_rest_s3.h
+++ b/src/rgw/rgw_rest_s3.h
@@ -956,9 +956,10 @@ public:
                             const req_state* const s,
                             const RGWUserInfo& user_info,
                             const std::string& subuser,
-                            const boost::optional<vector<std::string> >& role_policies) const override {
+                            const boost::optional<vector<std::string> >& role_policies,
+                            const boost::optional<uint32_t>& perm_mask) const override {
       return aplptr_t(
-        new rgw::auth::LocalApplier(cct, user_info, subuser, role_policies));
+        new rgw::auth::LocalApplier(cct, user_info, subuser, role_policies, perm_mask));
   }
 };
 

diff --git a/src/rgw/rgw_swift_auth.cc b/src/rgw/rgw_swift_auth.cc
index 45c3b00d7fe75a3cbc2a77f9b034cad32c4b049c..4fd2d37196d9a5342fd658c1cf46953f4a16f167 100644 (file)
--- a/src/rgw/rgw_swift_auth.cc
+++ b/src/rgw/rgw_swift_auth.cc
@@ -419,7 +419,7 @@ ExternalTokenEngine::authenticate(const std::string& token,
 
   auto apl = apl_factory->create_apl_local(cct, s, tmp_uinfo,
                                            extract_swift_subuser(swift_user),
-                                           boost::none);
+                                           boost::none, boost::none);
   return result_t::grant(std::move(apl));
 }
 
@@ -569,7 +569,7 @@ SignedTokenEngine::authenticate(const std::string& token,
 
   auto apl = apl_factory->create_apl_local(cct, s, user_info,
                                            extract_swift_subuser(swift_user),
-                                           boost::none);
+                                           boost::none, boost::none);
   return result_t::grant(std::move(apl));
 }
 

diff --git a/src/rgw/rgw_swift_auth.h b/src/rgw/rgw_swift_auth.h
index 2102c2fa95b1985084aa65f60091ba008be61edd..008366b4ef2a241a74ef6bbcd3591e0110b1bea5 100644 (file)
--- a/src/rgw/rgw_swift_auth.h
+++ b/src/rgw/rgw_swift_auth.h
@@ -21,7 +21,7 @@ class TempURLApplier : public rgw::auth::LocalApplier {
 public:
   TempURLApplier(CephContext* const cct,
                  const RGWUserInfo& user_info)
-    : LocalApplier(cct, user_info, LocalApplier::NO_SUBUSER, boost::none) {
+    : LocalApplier(cct, user_info, LocalApplier::NO_SUBUSER, boost::none, boost::none) {
   };
 
   void modify_request_state(req_state * s) const override; /* in/out */
@@ -201,11 +201,12 @@ class DefaultStrategy : public rgw::auth::Strategy,
                             const req_state* const s,
                             const RGWUserInfo& user_info,
                             const std::string& subuser,
-                            const boost::optional<vector<std::string> >& role_policies) const override {
+                            const boost::optional<vector<std::string> >& role_policies,
+                            const boost::optional<uint32_t>& perm_mask) const override {
     auto apl = \
       rgw::auth::add_3rdparty(store, s->account_name,
         rgw::auth::add_sysreq(cct, store, s,
-          rgw::auth::LocalApplier(cct, user_info, subuser, boost::none)));
+          rgw::auth::LocalApplier(cct, user_info, subuser, role_policies, perm_mask)));
     /* TODO(rzarzynski): replace with static_ptr. */
     return aplptr_t(new decltype(apl)(std::move(apl)));
   }