Skip to content

HDDS-14861. [STS] Fix Latent S3 API issue when ListBuckets Missing a Required Permission #9949

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fmorg-git wants to merge 1 commit into
base: HDDS-13323-sts
Choose a base branch
from
+71 −17
Open

HDDS-14861. [STS] Fix Latent S3 API issue when ListBuckets Missing a Required Permission #9949

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 26 additions & 17 deletions hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/EndpointBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -379,24 +379,33 @@ private Iterator<? extends OzoneBucket> iterateBuckets(
OzoneVolume volume = getVolume();
ownerSetter.accept(volume);
return query.apply(volume);
} catch (OMException e) {
if (e.getResult() == ResultCodes.VOLUME_NOT_FOUND) {
return Collections.emptyIterator();
} else if (e.getResult() == ResultCodes.PERMISSION_DENIED) {
throw newError(S3ErrorTable.ACCESS_DENIED,
"listBuckets", e);
} else if (isExpiredToken(e)) {
throw newError(S3ErrorTable.EXPIRED_TOKEN, s3Auth.getAccessID(), e);
} else if (e.getResult() == ResultCodes.INVALID_TOKEN) {
throw newError(S3ErrorTable.ACCESS_DENIED,
s3Auth.getAccessID(), e);
} else if (e.getResult() == ResultCodes.TIMEOUT ||
e.getResult() == ResultCodes.INTERNAL_ERROR) {
throw newError(S3ErrorTable.INTERNAL_ERROR,
"listBuckets", e);
} else {
throw e;
} catch (RuntimeException e) {
if (e.getCause() instanceof OMException) {
return handleOMException((OMException) e.getCause());
}
throw e;
} catch (OMException e) {
return handleOMException(e);
}
}

private Iterator<OzoneBucket> handleOMException(OMException e) throws OMException {
if (e.getResult() == ResultCodes.VOLUME_NOT_FOUND) {
return Collections.emptyIterator();
} else if (e.getResult() == ResultCodes.PERMISSION_DENIED) {
throw newError(S3ErrorTable.ACCESS_DENIED,
"listBuckets", e);
} else if (isExpiredToken(e)) {
throw newError(S3ErrorTable.EXPIRED_TOKEN, s3Auth.getAccessID(), e);
} else if (e.getResult() == ResultCodes.INVALID_TOKEN) {
throw newError(S3ErrorTable.ACCESS_DENIED,
s3Auth.getAccessID(), e);
} else if (e.getResult() == ResultCodes.TIMEOUT ||
e.getResult() == ResultCodes.INTERNAL_ERROR) {
throw newError(S3ErrorTable.INTERNAL_ERROR,
"listBuckets", e);
} else {
throw e;
}
}

Expand Down
45 changes: 45 additions & 0 deletions ...p-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3/endpoint/TestEndpointBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,13 +24,17 @@
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.mockito.ArgumentMatchers.anyString;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;

import java.nio.charset.StandardCharsets;
import java.util.Locale;
import java.util.Map;
import javax.ws.rs.core.MultivaluedHashMap;
import javax.ws.rs.core.MultivaluedMap;
import org.apache.hadoop.ozone.OzoneConsts;
import org.apache.hadoop.ozone.client.OzoneVolume;
import org.apache.hadoop.ozone.om.exceptions.OMException;
import org.apache.hadoop.ozone.s3.exception.OS3Exception;
import org.junit.jupiter.api.Test;
Expand Down Expand Up @@ -137,4 +141,45 @@ public void init() { }
assertFalse(endpointBase.isExpiredToken(new OMException(ResultCodes.INVALID_TOKEN)));
}

@Test
public void testListS3BucketsHandlesRuntimeExceptionWrappingOMException() throws Exception {
final EndpointBase endpointBase = new EndpointBase() {
@Override
public void init() { }

@Override
protected OzoneVolume getVolume() {
final OzoneVolume volume = mock(OzoneVolume.class);
when(volume.listBuckets(anyString())).thenThrow(
new RuntimeException(new OMException("Permission Denied", ResultCodes.PERMISSION_DENIED)));
return volume;
}
};

final OS3Exception e = assertThrows(
OS3Exception.class, () -> endpointBase.listS3Buckets(
"prefix", volume -> { }), "listS3Buckets should fail.");

// Ensure we get the correct code
assertEquals("AccessDenied", e.getCode());
}

@Test
public void testListS3BucketsHandlesRuntimeExceptionWrappingOMExceptionVolumeNotFound() throws Exception {
final EndpointBase endpointBase = new EndpointBase() {
@Override
public void init() { }

@Override
protected OzoneVolume getVolume() {
final OzoneVolume volume = mock(OzoneVolume.class);
when(volume.listBuckets(anyString())).thenThrow(
new RuntimeException(new OMException("Volume Not Found", ResultCodes.VOLUME_NOT_FOUND)));
return volume;
}
};

// Ensure we get an empty iterator
assertFalse(endpointBase.listS3Buckets("prefix", volume -> { }).hasNext());
}
}