Golang set.CreateStringSet函數代碼示例

// ConditionKeyMap.Remove() is called and the result is validated.
func TestConditionKeyMapRemove(t *testing.T) {
	condKeyMap := make(ConditionKeyMap)
	condKeyMap.Add("s3:prefix", set.CreateStringSet("hello", "world"))

	testCases := []struct {
		key            string
		value          set.StringSet
		expectedResult string
	}{
		// Remove non-existent key and value.
		{"s3:myprefix", set.CreateStringSet("hello"), `{"s3:prefix":["hello","world"]}`},
		// Remove existing key and value.
		{"s3:prefix", set.CreateStringSet("hello"), `{"s3:prefix":["world"]}`},
		// Remove existing key to make the key also removed.
		{"s3:prefix", set.CreateStringSet("world"), `{}`},
	}

	for _, testCase := range testCases {
		condKeyMap.Remove(testCase.key, testCase.value)
		if data, err := json.Marshal(condKeyMap); err != nil {
			t.Fatalf("Unable to marshal ConditionKeyMap to JSON, %s", err)
		} else {
			if string(data) != testCase.expectedResult {
				t.Fatalf("case: %+v: expected: %s, got: %s", testCase, testCase.expectedResult, string(data))
			}
		}
	}
}

// ConditionMap.Add() is called and the result is validated.
func TestConditionMapAdd(t *testing.T) {
	condMap := make(ConditionMap)

	condKeyMap1 := make(ConditionKeyMap)
	condKeyMap1.Add("s3:prefix", set.CreateStringSet("hello"))

	condKeyMap2 := make(ConditionKeyMap)
	condKeyMap2.Add("s3:prefix", set.CreateStringSet("hello", "world"))

	testCases := []struct {
		key            string
		value          ConditionKeyMap
		expectedResult string
	}{
		// Add new key and value.
		{"StringEquals", condKeyMap1, `{"StringEquals":{"s3:prefix":["hello"]}}`},
		// Add existing key and value.
		{"StringEquals", condKeyMap1, `{"StringEquals":{"s3:prefix":["hello"]}}`},
		// Add existing key and not value.
		{"StringEquals", condKeyMap2, `{"StringEquals":{"s3:prefix":["hello","world"]}}`},
	}

	for _, testCase := range testCases {
		condMap.Add(testCase.key, testCase.value)
		if data, err := json.Marshal(condMap); err != nil {
			t.Fatalf("Unable to marshal ConditionKeyMap to JSON, %s", err)
		} else {
			if string(data) != testCase.expectedResult {
				t.Fatalf("case: %+v: expected: %s, got: %s", testCase, testCase.expectedResult, string(data))
			}
		}
	}
}

// Obtain object statements for write only bucketPolicy.
func getWriteOnlyObjectStatement(bucketName, objectPrefix string) policyStatement {
	objectResourceStatement := policyStatement{}
	objectResourceStatement.Effect = "Allow"
	objectResourceStatement.Principal.AWS = set.CreateStringSet([]string{"*"}...)
	objectResourceStatement.Resources = set.CreateStringSet([]string{fmt.Sprintf("%s%s", AWSResourcePrefix, bucketName+"/"+objectPrefix+"*")}...)
	objectResourceStatement.Actions = set.CreateStringSet(writeOnlyObjectActions...)
	return objectResourceStatement
}

// Obtain object statement for read-write bucketPolicy.
func getReadWriteBucketStatement(bucketName, objectPrefix string) policyStatement {
	bucketResourceStatement := policyStatement{}
	bucketResourceStatement.Effect = "Allow"
	bucketResourceStatement.Principal.AWS = set.CreateStringSet([]string{"*"}...)
	bucketResourceStatement.Resources = set.CreateStringSet([]string{fmt.Sprintf("%s%s", AWSResourcePrefix, bucketName)}...)
	bucketResourceStatement.Actions = set.CreateStringSet(readWriteBucketActions...)
	return bucketResourceStatement
}

// Obtain bucket statement for read-write bucketPolicy.
func getReadWriteObjectStatement(bucketName, objectPrefix string) policyStatement {
	objectResourceStatement := policyStatement{}
	objectResourceStatement.Effect = "Allow"
	objectResourceStatement.Principal = map[string]interface{}{
		"AWS": "*",
	}
	objectResourceStatement.Resources = set.CreateStringSet([]string{fmt.Sprintf("%s%s", AWSResourcePrefix, bucketName+"/"+objectPrefix+"*")}...)
	objectResourceStatement.Actions = set.CreateStringSet(readWriteObjectActions...)
	return objectResourceStatement
}

// Obtain bucket statement for read only bucketPolicy.
func getReadOnlyBucketStatement(bucketName, objectPrefix string) policyStatement {
	bucketResourceStatement := policyStatement{}
	bucketResourceStatement.Effect = "Allow"
	bucketResourceStatement.Principal = map[string]interface{}{
		"AWS": "*",
	}
	bucketResourceStatement.Resources = set.CreateStringSet([]string{fmt.Sprintf("%s%s", AWSResourcePrefix, bucketName)}...)
	bucketResourceStatement.Actions = set.CreateStringSet(readOnlyBucketActions...)
	return bucketResourceStatement
}

// Returns new statements with bucket actions for given policy.
func newBucketStatement(policy BucketPolicy, bucketName string, prefix string) (statements []Statement) {
	statements = []Statement{}
	if policy == BucketPolicyNone || bucketName == "" {
		return statements
	}

	bucketResource := set.CreateStringSet(awsResourcePrefix + bucketName)

	statement := Statement{
		Actions:   commonBucketActions,
		Effect:    "Allow",
		Principal: User{AWS: set.CreateStringSet("*")},
		Resources: bucketResource,
		Sid:       "",
	}
	statements = append(statements, statement)

	if policy == BucketPolicyReadOnly || policy == BucketPolicyReadWrite {
		statement = Statement{
			Actions:   readOnlyBucketActions,
			Effect:    "Allow",
			Principal: User{AWS: set.CreateStringSet("*")},
			Resources: bucketResource,
			Sid:       "",
		}
		if prefix != "" {
			condKeyMap := make(ConditionKeyMap)
			condKeyMap.Add("s3:prefix", set.CreateStringSet(prefix))
			condMap := make(ConditionMap)
			condMap.Add("StringEquals", condKeyMap)
			statement.Conditions = condMap
		}
		statements = append(statements, statement)
	}

	if policy == BucketPolicyWriteOnly || policy == BucketPolicyReadWrite {
		statement = Statement{
			Actions:   writeOnlyBucketActions,
			Effect:    "Allow",
			Principal: User{AWS: set.CreateStringSet("*")},
			Resources: bucketResource,
			Sid:       "",
		}
		statements = append(statements, statement)
	}

	return statements
}

// CopyConditionKeyMap() is called and the result is validated.
func TestCopyConditionKeyMap(t *testing.T) {
	emptyCondKeyMap := make(ConditionKeyMap)
	nonEmptyCondKeyMap := make(ConditionKeyMap)
	nonEmptyCondKeyMap.Add("s3:prefix", set.CreateStringSet("hello", "world"))

	testCases := []struct {
		condKeyMap     ConditionKeyMap
		expectedResult string
	}{
		// To test empty ConditionKeyMap.
		{emptyCondKeyMap, `{}`},
		// To test non-empty ConditionKeyMap.
		{nonEmptyCondKeyMap, `{"s3:prefix":["hello","world"]}`},
	}

	for _, testCase := range testCases {
		condKeyMap := CopyConditionKeyMap(testCase.condKeyMap)
		if data, err := json.Marshal(condKeyMap); err != nil {
			t.Fatalf("Unable to marshal ConditionKeyMap to JSON, %s", err)
		} else {
			if string(data) != testCase.expectedResult {
				t.Fatalf("case: %+v: expected: %s, got: %s", testCase, testCase.expectedResult, string(data))
			}
		}
	}
}

// http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
// Enforces bucket policies for a bucket for a given tatusaction.
func enforceBucketPolicy(bucket string, action string, reqURL *url.URL) (s3Error APIErrorCode) {
	if !IsValidBucketName(bucket) {
		return ErrInvalidBucketName
	}
	// Fetch bucket policy, if policy is not set return access denied.
	policy := globalBucketPolicies.GetBucketPolicy(bucket)
	if policy == nil {
		return ErrAccessDenied
	}

	// Construct resource in 'arn:aws:s3:::examplebucket/object' format.
	resource := AWSResourcePrefix + strings.TrimSuffix(strings.TrimPrefix(reqURL.Path, "/"), "/")

	// Get conditions for policy verification.
	conditionKeyMap := make(map[string]set.StringSet)
	for queryParam := range reqURL.Query() {
		conditionKeyMap[queryParam] = set.CreateStringSet(reqURL.Query().Get(queryParam))
	}

	// Validate action, resource and conditions with current policy statements.
	if !bucketPolicyEvalStatements(action, resource, conditionKeyMap, policy.Statements) {
		return ErrAccessDenied
	}
	return ErrNone
}

// mergeConditionMap() is called and the result is validated.
func TestMergeConditionMap(t *testing.T) {
	condKeyMap1 := make(ConditionKeyMap)
	condKeyMap1.Add("s3:prefix", set.CreateStringSet("hello"))
	condMap1 := make(ConditionMap)
	condMap1.Add("StringEquals", condKeyMap1)

	condKeyMap2 := make(ConditionKeyMap)
	condKeyMap2.Add("s3:prefix", set.CreateStringSet("world"))
	condMap2 := make(ConditionMap)
	condMap2.Add("StringEquals", condKeyMap2)

	condMap3 := make(ConditionMap)
	condMap3.Add("StringNotEquals", condKeyMap2)

	testCases := []struct {
		condMap1       ConditionMap
		condMap2       ConditionMap
		expectedResult string
	}{
		// Both arguments are empty.
		{make(ConditionMap), make(ConditionMap), `{}`},
		// First argument is empty.
		{make(ConditionMap), condMap1, `{"StringEquals":{"s3:prefix":["hello"]}}`},
		// Second argument is empty.
		{condMap1, make(ConditionMap), `{"StringEquals":{"s3:prefix":["hello"]}}`},
		// Both arguments are same value.
		{condMap1, condMap1, `{"StringEquals":{"s3:prefix":["hello"]}}`},
		// Value of second argument will be merged.
		{condMap1, condMap2, `{"StringEquals":{"s3:prefix":["hello","world"]}}`},
		// second argument will be added.
		{condMap1, condMap3, `{"StringEquals":{"s3:prefix":["hello"]},"StringNotEquals":{"s3:prefix":["world"]}}`},
	}

	for _, testCase := range testCases {
		condMap := mergeConditionMap(testCase.condMap1, testCase.condMap2)
		if data, err := json.Marshal(condMap); err != nil {
			t.Fatalf("Unable to marshal ConditionKeyMap to JSON, %s", err)
		} else {
			if string(data) != testCase.expectedResult {
				t.Fatalf("case: %+v: expected: %s, got: %s", testCase, testCase.expectedResult, string(data))
			}
		}
	}
}

// Tests validate Bucket policy resource matcher.
func TestBucketPolicyResourceMatch(t *testing.T) {

	// generates statement with given resource..
	generateStatement := func(resource string) policyStatement {
		statement := policyStatement{}
		statement.Resources = set.CreateStringSet([]string{resource}...)
		return statement
	}

	// generates resource prefix.
	generateResource := func(bucketName, objectName string) string {
		return AWSResourcePrefix + bucketName + "/" + objectName
	}

	testCases := []struct {
		resourceToMatch       string
		statement             policyStatement
		expectedResourceMatch bool
	}{
		// Test case 1-4.
		// Policy with resource ending with bucket/* allows access to all objects inside the given bucket.
		{generateResource("minio-bucket", ""), generateStatement(fmt.Sprintf("%s%s", AWSResourcePrefix, "minio-bucket"+"/*")), true},
		{generateResource("minio-bucket", ""), generateStatement(fmt.Sprintf("%s%s", AWSResourcePrefix, "minio-bucket"+"/*")), true},
		{generateResource("minio-bucket", ""), generateStatement(fmt.Sprintf("%s%s", AWSResourcePrefix, "minio-bucket"+"/*")), true},
		{generateResource("minio-bucket", ""), generateStatement(fmt.Sprintf("%s%s", AWSResourcePrefix, "minio-bucket"+"/*")), true},
		// Test case - 5.
		// Policy with resource ending with bucket/oo* should not allow access to bucket/output.txt.
		{generateResource("minio-bucket", "output.txt"), generateStatement(fmt.Sprintf("%s%s", AWSResourcePrefix, "minio-bucket"+"/oo*")), false},
		// Test case - 6.
		// Policy with resource ending with bucket/oo* should allow access to bucket/ootput.txt.
		{generateResource("minio-bucket", "ootput.txt"), generateStatement(fmt.Sprintf("%s%s", AWSResourcePrefix, "minio-bucket"+"/oo*")), true},
		// Test case - 7.
		// Policy with resource ending with bucket/oo* allows access to all sub-dirs starting with "oo" inside given bucket.
		{generateResource("minio-bucket", "oop-bucket/my-file"), generateStatement(fmt.Sprintf("%s%s", AWSResourcePrefix, "minio-bucket"+"/oo*")), true},
		// Test case - 8.
		{generateResource("minio-bucket", "Asia/India/1.pjg"), generateStatement(fmt.Sprintf("%s%s", AWSResourcePrefix, "minio-bucket"+"/Asia/Japan/*")), false},
		// Test case - 9.
		{generateResource("minio-bucket", "Asia/India/1.pjg"), generateStatement(fmt.Sprintf("%s%s", AWSResourcePrefix, "minio-bucket"+"/Asia/Japan/*")), false},
		// Test case - 10.
		// Proves that the name space is flat.
		{generateResource("minio-bucket", "Africa/Bihar/India/design_info.doc/Bihar"), generateStatement(fmt.Sprintf("%s%s", AWSResourcePrefix,
			"minio-bucket"+"/*/India/*/Bihar")), true},
		// Test case - 11.
		// Proves that the name space is flat.
		{generateResource("minio-bucket", "Asia/China/India/States/Bihar/output.txt"), generateStatement(fmt.Sprintf("%s%s", AWSResourcePrefix,
			"minio-bucket"+"/*/India/*/Bihar/*")), true},
	}
	for i, testCase := range testCases {
		actualResourceMatch := bucketPolicyResourceMatch(testCase.resourceToMatch, testCase.statement)
		if testCase.expectedResourceMatch != actualResourceMatch {
			t.Errorf("Test %d: Expected Resource match to be `%v`, but instead found it to be `%v`", i+1, testCase.expectedResourceMatch, actualResourceMatch)
		}
	}
}

// Tests validate Action validator.
func TestIsValidActions(t *testing.T) {
	testCases := []struct {
		// input.
		actions set.StringSet
		// expected output.
		err error
		// flag indicating whether the test should pass.
		shouldPass bool
	}{
		// Inputs with unsupported Action.
		// Test case - 1.
		// "s3:ListObject" is an invalid Action.
		{set.CreateStringSet([]string{"s3:GetObject", "s3:ListObject", "s3:RemoveObject"}...),
			errors.New("Unsupported actions found: ‘set.StringSet{\"s3:RemoveObject\":struct {}{}, \"s3:ListObject\":struct {}{}}’, please validate your policy document."), false},
		// Test case - 2.
		// Empty Actions.
		{set.CreateStringSet([]string{}...), errors.New("Action list cannot be empty."), false},
		// Test case - 3.
		// "s3:DeleteEverything"" is an invalid Action.
		{set.CreateStringSet([]string{"s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:DeleteEverything"}...),
			errors.New("Unsupported actions found: ‘set.StringSet{\"s3:DeleteEverything\":struct {}{}}’, please validate your policy document."), false},
		// Inputs with valid Action.
		// Test Case - 4.
		{set.CreateStringSet([]string{
			"s3:*", "*", "s3:GetObject", "s3:ListBucket",
			"s3:PutObject", "s3:GetBucketLocation", "s3:DeleteObject",
			"s3:AbortMultipartUpload", "s3:ListBucketMultipartUploads",
			"s3:ListMultipartUploadParts"}...), nil, true},
	}
	for i, testCase := range testCases {
		err := isValidActions(testCase.actions)
		if err != nil && testCase.shouldPass {
			t.Errorf("Test %d: Expected to pass, but failed with: <ERROR> %s", i+1, err.Error())
		}
		if err == nil && !testCase.shouldPass {
			t.Errorf("Test %d: Expected to fail with <ERROR> \"%s\", but passed instead", i+1, testCase.err.Error())
		}
	}
}

// isValidPrincipals - are valid principals.
func isValidPrincipals(principals set.StringSet) (err error) {
	// Statement principal should have a value.
	if len(principals) == 0 {
		err = errors.New("Principal cannot be empty.")
		return err
	}
	if unsuppPrincipals := principals.Difference(set.CreateStringSet([]string{"*"}...)); !unsuppPrincipals.IsEmpty() {
		// Minio does not support or implement IAM, "*" is the only valid value.
		// Amazon s3 doc on principals: http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Principal
		err = fmt.Errorf("Unsupported principals found: ‘%#v’, please validate your policy document.", unsuppPrincipals)
		return err
	}
	return nil
}

// Returns new statements contains object actions for given policy.
func newObjectStatement(policy BucketPolicy, bucketName string, prefix string) (statements []Statement) {
	statements = []Statement{}
	if policy == BucketPolicyNone || bucketName == "" {
		return statements
	}

	statement := Statement{
		Effect:    "Allow",
		Principal: User{AWS: set.CreateStringSet("*")},
		Resources: set.CreateStringSet(awsResourcePrefix + bucketName + "/" + prefix + "*"),
		Sid:       "",
	}

	if policy == BucketPolicyReadOnly {
		statement.Actions = readOnlyObjectActions
	} else if policy == BucketPolicyWriteOnly {
		statement.Actions = writeOnlyObjectActions
	} else if policy == BucketPolicyReadWrite {
		statement.Actions = readWriteObjectActions
	}

	statements = append(statements, statement)
	return statements
}

// Parse principals parses a incoming json. Handles cases for
// these three combinations.
// - "Principal": "*",
// - "Principal": { "AWS" : "*" }
// - "Principal": { "AWS" : [ "*" ]}
func parsePrincipals(principal interface{}) set.StringSet {
	principals, ok := principal.(map[string]interface{})
	if !ok {
		var principalStr string
		principalStr, ok = principal.(string)
		if ok {
			return set.CreateStringSet(principalStr)
		}
	} // else {
	var principalStrs []string
	for _, p := range principals {
		principalStr, isStr := p.(string)
		if !isStr {
			principalsAdd, isInterface := p.([]interface{})
			if !isInterface {
				principalStrsAddr, isStrs := p.([]string)
				if !isStrs {
					continue
				}
				principalStrs = append(principalStrs, principalStrsAddr...)
			} else {
				for _, pa := range principalsAdd {
					var pstr string
					pstr, isStr = pa.(string)
					if !isStr {
						continue
					}
					principalStrs = append(principalStrs, pstr)
				}
			}
			continue
		} // else {
		principalStrs = append(principalStrs, principalStr)
	}
	return set.CreateStringSet(principalStrs...)
}