This is an automated email from the ASF dual-hosted git repository.
adoroszlai pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/master by this push:
new 4af6aa2e50 HDDS-7750. Incorrect WRITE ACL check (#5042)
4af6aa2e50 is described below
commit 4af6aa2e50ea71f9dee9d4c5f1e4068f06ef7764
Author: Aryan Gupta <[email protected]>
AuthorDate: Tue Jul 11 19:25:43 2023 +0530
HDDS-7750. Incorrect WRITE ACL check (#5042)
---
.../s3/multipart/S3MultipartUploadCommitPartRequest.java | 9 ++++-----
.../ozone/om/request/s3/multipart/TestS3MultipartRequest.java | 11 +++++++++++
2 files changed, 15 insertions(+), 5 deletions(-)
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/s3/multipart/S3MultipartUploadCommitPartRequest.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/s3/multipart/S3MultipartUploadCommitPartRequest.java
index 1769fdbb20..fbd2f4e20e 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/s3/multipart/S3MultipartUploadCommitPartRequest.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/s3/multipart/S3MultipartUploadCommitPartRequest.java
@@ -53,7 +53,6 @@ import
org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos
.OMResponse;
import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.Type;
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
-import org.apache.hadoop.ozone.security.acl.OzoneObj;
import org.apache.hadoop.util.Time;
import org.apache.hadoop.hdds.utils.db.cache.CacheKey;
import org.apache.hadoop.hdds.utils.db.cache.CacheValue;
@@ -133,9 +132,11 @@ public class S3MultipartUploadCommitPartRequest extends
OMKeyRequest {
volumeName = keyArgs.getVolumeName();
bucketName = keyArgs.getBucketName();
+ long clientID = multipartCommitUploadPartRequest.getClientID();
+
// check acl
- checkKeyAcls(ozoneManager, volumeName, bucketName, keyName,
- IAccessAuthorizer.ACLType.WRITE, OzoneObj.ResourceType.KEY);
+ checkKeyAclsInOpenKeyTable(ozoneManager, volumeName, bucketName, keyName,
+ IAccessAuthorizer.ACLType.WRITE, clientID);
acquiredLock = omMetadataManager.getLock().acquireWriteLock(BUCKET_LOCK,
volumeName, bucketName);
@@ -149,8 +150,6 @@ public class S3MultipartUploadCommitPartRequest extends
OMKeyRequest {
multipartKeyInfo = omMetadataManager.getMultipartInfoTable()
.get(multipartKey);
- long clientID = multipartCommitUploadPartRequest.getClientID();
-
openKey = getOpenKey(volumeName, bucketName, keyName, omMetadataManager,
clientID);
diff --git
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/multipart/TestS3MultipartRequest.java
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/multipart/TestS3MultipartRequest.java
index d36ad74d5d..099af69791 100644
---
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/multipart/TestS3MultipartRequest.java
+++
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/multipart/TestS3MultipartRequest.java
@@ -38,6 +38,10 @@ import org.apache.hadoop.ozone.audit.AuditLogger;
import org.apache.hadoop.ozone.audit.AuditMessage;
import org.apache.hadoop.ozone.om.OMConfigKeys;
import org.apache.hadoop.ozone.om.OMMetadataManager;
+import org.apache.hadoop.ozone.om.OmMetadataReader;
+import org.apache.hadoop.ozone.om.IOmMetadataReader;
+import org.apache.hadoop.ozone.om.snapshot.SnapshotCache;
+import org.apache.hadoop.ozone.om.snapshot.ReferenceCounted;
import org.apache.hadoop.ozone.om.OMMetrics;
import org.apache.hadoop.ozone.om.OmMetadataManagerImpl;
import org.apache.hadoop.ozone.om.OzoneManager;
@@ -84,6 +88,13 @@ public class TestS3MultipartRequest {
when(ozoneManager.getMetrics()).thenReturn(omMetrics);
when(ozoneManager.getMetadataManager()).thenReturn(omMetadataManager);
auditLogger = Mockito.mock(AuditLogger.class);
+ ReferenceCounted<IOmMetadataReader, SnapshotCache> rcOmMetadataReader =
+ Mockito.mock(ReferenceCounted.class);
+ when(ozoneManager.getOmMetadataReader()).thenReturn(rcOmMetadataReader);
+ // Init OmMetadataReader to let the test pass
+ OmMetadataReader omMetadataReader = Mockito.mock(OmMetadataReader.class);
+ when(omMetadataReader.isNativeAuthorizerEnabled()).thenReturn(true);
+ when(rcOmMetadataReader.get()).thenReturn(omMetadataReader);
when(ozoneManager.getAuditLogger()).thenReturn(auditLogger);
when(ozoneManager.getDefaultReplicationConfig()).thenReturn(
ReplicationConfig.getDefault(ozoneConfiguration));
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
