mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-29 08:27:06 +00:00
@@ -16,19 +16,14 @@ use super::condition::{
|
||||
pub struct ActionSet(HashSet<Action>);
|
||||
|
||||
impl ActionSet {
|
||||
pub fn as_ref(&self) -> &HashSet<Action> {
|
||||
&self.0
|
||||
}
|
||||
pub fn is_match(&self, act: &Action) -> bool {
|
||||
for item in self.0.iter() {
|
||||
if item.is_match(act) {
|
||||
return true;
|
||||
}
|
||||
|
||||
if item == &Action::GetObjectVersion {
|
||||
if act == &Action::GetObjectVersion {
|
||||
return true;
|
||||
}
|
||||
if item == &Action::GetObjectVersion && act == &Action::GetObjectVersion {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -40,6 +35,12 @@ impl ActionSet {
|
||||
}
|
||||
}
|
||||
|
||||
impl AsRef<HashSet<Action>> for ActionSet {
|
||||
fn as_ref(&self) -> &HashSet<Action> {
|
||||
&self.0
|
||||
}
|
||||
}
|
||||
|
||||
// 定义Action枚举类型
|
||||
#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, Default, Hash)]
|
||||
pub enum Action {
|
||||
@@ -212,10 +213,10 @@ impl Action {
|
||||
false
|
||||
}
|
||||
pub fn is_match(&self, a: &Action) -> bool {
|
||||
utils::wildcard::match_pattern(&self.clone().as_str(), &a.clone().as_str())
|
||||
utils::wildcard::match_pattern(self.clone().as_str(), a.clone().as_str())
|
||||
}
|
||||
|
||||
fn as_str(self) -> &'static str {
|
||||
fn as_str(&self) -> &'static str {
|
||||
match self {
|
||||
Action::AbortMultipartUpload => "s3:AbortMultipartUpload",
|
||||
Action::CreateBucket => "s3:CreateBucket",
|
||||
|
||||
@@ -97,13 +97,11 @@ impl BPStatement {
|
||||
self.resources, act
|
||||
)));
|
||||
}
|
||||
} else {
|
||||
if !self.resources.bucket_resource_exists() {
|
||||
return Err(Error::msg(format!(
|
||||
"unsupported bucket Resource found {:?} for action {:?}",
|
||||
self.resources, act
|
||||
)));
|
||||
}
|
||||
} else if !self.resources.bucket_resource_exists() {
|
||||
return Err(Error::msg(format!(
|
||||
"unsupported bucket Resource found {:?} for action {:?}",
|
||||
self.resources, act
|
||||
)));
|
||||
}
|
||||
|
||||
let key_diff = self.conditions.keys().difference(&IAMActionConditionKeyMap.lookup(act));
|
||||
@@ -129,7 +127,7 @@ impl BPStatement {
|
||||
let mut resource = args.bucket_name.clone();
|
||||
if !args.object_name.is_empty() {
|
||||
if !args.object_name.starts_with("/") {
|
||||
resource.push_str("/");
|
||||
resource.push('/');
|
||||
}
|
||||
|
||||
resource.push_str(&args.object_name);
|
||||
@@ -160,10 +158,8 @@ pub struct BucketPolicy {
|
||||
impl BucketPolicy {
|
||||
pub fn is_allowed(&self, args: &BucketPolicyArgs) -> bool {
|
||||
for statement in self.statements.iter() {
|
||||
if statement.effect == Effect::Deny {
|
||||
if !statement.is_allowed(args) {
|
||||
return false;
|
||||
}
|
||||
if statement.effect == Effect::Deny && !statement.is_allowed(args) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -172,10 +168,8 @@ impl BucketPolicy {
|
||||
}
|
||||
|
||||
for statement in self.statements.iter() {
|
||||
if statement.effect == Effect::Allow {
|
||||
if statement.is_allowed(args) {
|
||||
return true;
|
||||
}
|
||||
if statement.effect == Effect::Allow && statement.is_allowed(args) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -196,9 +190,7 @@ impl BucketPolicy {
|
||||
}
|
||||
|
||||
for statement in self.statements.iter() {
|
||||
if let Err(err) = statement.is_valid() {
|
||||
return Err(err);
|
||||
}
|
||||
statement.is_valid()?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
@@ -219,7 +211,7 @@ impl BucketPolicy {
|
||||
}
|
||||
|
||||
pub fn unmarshal(buf: &[u8]) -> Result<Self> {
|
||||
let mut p = serde_json::from_slice::<BucketPolicy>(&buf)?;
|
||||
let mut p = serde_json::from_slice::<BucketPolicy>(buf)?;
|
||||
p.drop_duplicate_statements();
|
||||
Ok(p)
|
||||
|
||||
|
||||
@@ -24,14 +24,6 @@ impl Key {
|
||||
self.name == *name
|
||||
}
|
||||
|
||||
pub fn to_string(&self) -> String {
|
||||
if !self.variable.is_empty() {
|
||||
format!("{}/{}", self.name.as_str(), self.variable)
|
||||
} else {
|
||||
self.name.to_string()
|
||||
}
|
||||
}
|
||||
|
||||
// VarName - returns variable key name, such as "${aws:username}"
|
||||
pub fn var_name(&self) -> String {
|
||||
self.name.var_name()
|
||||
@@ -93,7 +85,11 @@ impl<'de> Deserialize<'de> for Key {
|
||||
|
||||
impl fmt::Display for Key {
|
||||
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
|
||||
write!(f, "{}", self.to_string())
|
||||
if !self.variable.is_empty() {
|
||||
write!(f, "{}/{}", self.name.as_str(), self.variable)
|
||||
} else {
|
||||
write!(f, "{}", self.name)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -16,10 +16,10 @@ impl Principal {
|
||||
}
|
||||
pub fn is_match(&self, parincipal: &str) -> bool {
|
||||
for pattern in self.aws.iter() {
|
||||
if utils::wildcard::match_simple(&pattern, parincipal) {
|
||||
if utils::wildcard::match_simple(pattern, parincipal) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
false
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,6 +3,7 @@ use crate::{
|
||||
bucket::policy::condition::keyname::COMMOM_KEYS,
|
||||
utils::{self, wildcard},
|
||||
};
|
||||
use core::fmt;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::{
|
||||
collections::{HashMap, HashSet},
|
||||
@@ -18,12 +19,12 @@ pub enum ResourceARNType {
|
||||
ResourceARNKMS,
|
||||
}
|
||||
|
||||
impl ResourceARNType {
|
||||
pub fn to_string(&self) -> String {
|
||||
impl fmt::Display for ResourceARNType {
|
||||
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
||||
match self {
|
||||
ResourceARNType::UnknownARN => "".to_string(),
|
||||
ResourceARNType::ResourceARNS3 => RESOURCE_ARN_PREFIX.to_string(),
|
||||
ResourceARNType::ResourceARNKMS => RESOURCE_ARN_KMS_PREFIX.to_string(),
|
||||
ResourceARNType::UnknownARN => write!(f, ""),
|
||||
ResourceARNType::ResourceARNS3 => write!(f, "{}", RESOURCE_ARN_PREFIX),
|
||||
ResourceARNType::ResourceARNKMS => write!(f, "{}", RESOURCE_ARN_KMS_PREFIX),
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -60,15 +61,11 @@ impl Resource {
|
||||
if self.rtype == ResourceARNType::UnknownARN {
|
||||
return false;
|
||||
}
|
||||
if self.is_s3() {
|
||||
if self.pattern.starts_with("/") {
|
||||
return false;
|
||||
}
|
||||
if self.is_s3() && self.pattern.starts_with("/") {
|
||||
return false;
|
||||
}
|
||||
if self.is_kms() {
|
||||
if self.pattern.as_bytes().iter().any(|&v| v == b'/' || v == b'\\' || v == b'.') {
|
||||
return false;
|
||||
}
|
||||
if self.is_kms() && self.pattern.as_bytes().iter().any(|&v| v == b'/' || v == b'\\' || v == b'.') {
|
||||
return false;
|
||||
}
|
||||
|
||||
!self.pattern.is_empty()
|
||||
@@ -90,8 +87,8 @@ impl Resource {
|
||||
if !condition_values.is_empty() {
|
||||
for key in COMMOM_KEYS.iter() {
|
||||
if let Some(vals) = condition_values.get(key.name()) {
|
||||
if let Some(v0) = vals.get(0) {
|
||||
pattern = pattern.replace(key.name(), &v0);
|
||||
if let Some(v0) = vals.first() {
|
||||
pattern = pattern.replace(key.name(), v0);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -105,9 +102,11 @@ impl Resource {
|
||||
|
||||
wildcard::match_pattern(&pattern, res)
|
||||
}
|
||||
}
|
||||
|
||||
pub fn to_string(&self) -> String {
|
||||
format!("{}{}", self.rtype.to_string(), self.pattern)
|
||||
impl fmt::Display for Resource {
|
||||
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
||||
write!(f, "{}{}", self.rtype, self.pattern)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -193,15 +192,11 @@ pub struct ResourceSet(HashSet<Resource>);
|
||||
impl ResourceSet {
|
||||
pub fn validate_bucket(&self, bucket: &str) -> Result<()> {
|
||||
for res in self.0.iter() {
|
||||
if let Err(err) = res.validate_bucket(bucket) {
|
||||
return Err(err);
|
||||
}
|
||||
res.validate_bucket(bucket)?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
pub fn as_ref(&self) -> &HashSet<Resource> {
|
||||
&self.0
|
||||
}
|
||||
|
||||
pub fn is_match(&self, res: &str, condition_values: &HashMap<String, Vec<String>>) -> bool {
|
||||
for item in self.0.iter() {
|
||||
if item.is_match(res, condition_values) {
|
||||
@@ -229,6 +224,12 @@ impl ResourceSet {
|
||||
}
|
||||
}
|
||||
|
||||
impl AsRef<HashSet<Resource>> for ResourceSet {
|
||||
fn as_ref(&self) -> &HashSet<Resource> {
|
||||
&self.0
|
||||
}
|
||||
}
|
||||
|
||||
// impl Serialize for ResourceSet {
|
||||
// fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
|
||||
// where
|
||||
|
||||
Reference in New Issue
Block a user