awsapi/src/com/cloud/bridge/util/PolicyParser.java

// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.
package com.cloud.bridge.util;

import java.util.ArrayList;
import java.util.List;

import org.apache.log4j.Logger;
import org.json.simple.parser.ContentHandler;
import org.json.simple.parser.JSONParser;
import org.json.simple.parser.ParseException;

import com.cloud.bridge.service.core.s3.S3BucketPolicy;
import com.cloud.bridge.service.core.s3.S3BucketPolicy.PolicyAccess;
import com.cloud.bridge.service.core.s3.S3ConditionFactory;
import com.cloud.bridge.service.core.s3.S3PolicyAction;
import com.cloud.bridge.service.core.s3.S3PolicyAction.PolicyActions;
import com.cloud.bridge.service.core.s3.S3PolicyCondition;
import com.cloud.bridge.service.core.s3.S3PolicyCondition.ConditionKeys;
import com.cloud.bridge.service.core.s3.S3PolicyConditionBlock;
import com.cloud.bridge.service.core.s3.S3PolicyPrincipal;
import com.cloud.bridge.service.core.s3.S3PolicyStatement;
import com.cloud.bridge.service.exception.PermissionDeniedException;

/**
 * This class uses the JSON simple parser to convert the JSON of a Bucket Policy
 * into internal objects.
 *
 * Another way to implement this by use of a stack to keep track of where the current
 * parsing is being done.   However, since we are only handling a limited JSON sequence
 * here simple counts and flags will do the same as a stack.
 */
public class PolicyParser {
    protected final static Logger logger = Logger.getLogger(PolicyParser.class);

    private S3BucketPolicy bucketPolicy = null;
    private S3PolicyPrincipal principals = null;
    private S3PolicyStatement statement = null;
    private S3PolicyAction actions = null;
    private S3PolicyAction convertActions = new S3PolicyAction();
    private S3PolicyCondition condition = null;
    private S3ConditionFactory condFactory = null;
    private S3PolicyConditionBlock block = null;
    private PolicyActions notAction = PolicyActions.UnknownAction;
    private String id = null;
    private String sid = null;
    private String effect = null;
    private String resource = null;
    private String condKey = null;   // -> the next key in a condition
    private String toUser = null;    // -> text to user of a problem
    private List<String> valueList = new ArrayList<String>();

    private JSONParser jparser = null;
    private int entryNesting = 0;    // -> startObjectEntry() .. nesting count
    private int condNested = 0;      // -> at what level of nesting is the condition defined
    private int keyNested = 0;       // -> at what level of nesting is the condition key defined

    private boolean inId = false;   // -> currently in an "Id" element
    private boolean inSid = false;
    private boolean inAWS = false;
    private boolean inEffect = false;
    private boolean inResource = false;
    private boolean inNotAction = false;
    private boolean inVersion = false;
    private boolean inStatement = false;

    public PolicyParser() {
        jparser = new JSONParser();
        condFactory = new S3ConditionFactory();
    }

    ContentHandler myHandler = new ContentHandler() {
        public boolean endArray() throws ParseException {
            logger.debug("endArray()");
            return true;
        }

        public void endJSON() throws ParseException, PermissionDeniedException {
            logger.debug("endJSON()");

            if (null != statement) {
                //System.out.println( "endJSON() - statement");
                if (null != block) {
                    block.verify();
                    statement.setConditionBlock(block);
                }
                if (null != bucketPolicy) {
                    statement.verify();
                    bucketPolicy.addStatement(statement);
                }
                statement = null;
                block = null;
            }
        }

        public boolean endObject() throws ParseException, PermissionDeniedException {
            logger.debug("endObject(), nesting: " + entryNesting);

            if (null != statement && 1 >= entryNesting) {
                //System.out.println( "endObject() - statement");
                if (null != block) {
                    block.verify();
                    statement.setConditionBlock(block);
                }
                if (null != bucketPolicy) {
                    statement.verify();
                    bucketPolicy.addStatement(statement);
                }
                statement = null;
                block = null;
            }

            if (0 == entryNesting)
                inStatement = false;
            return true;
        }

        public boolean endObjectEntry() throws ParseException, PermissionDeniedException {
            logger.debug("endObjectEntry(), nesting: " + entryNesting);

            if (inSid) {
                if (null != statement)
                    statement.setSid(sid);
                inSid = false;
            } else if (inEffect) {
                if (null != statement) {
                    if (effect.equalsIgnoreCase("Allow"))
                        statement.setEffect(PolicyAccess.ALLOW);
                    else if (effect.equalsIgnoreCase("Deny"))
                        statement.setEffect(PolicyAccess.DENY);
                    else
                        badPolicy("Effect", effect);
                }
                inEffect = false;
            } else if (inResource) {
                if (null != statement && resource.startsWith("arn:aws:s3:::")) {
                    String resourcePath = resource.substring(13);
                    verifySameBucket(resourcePath);
                    statement.setResource(resourcePath);
                }
                inResource = false;
            } else if (inNotAction) {
                if (null != statement)
                    statement.setNotAction(notAction);
                inNotAction = false;
            } else if (inVersion) {
                inVersion = false;
            } else if (inId) {
                if (null != bucketPolicy)
                    bucketPolicy.setId(id);
                inId = false;
            } else if (null != actions) {
                if (null != statement)
                    statement.setActions(actions);
                actions = null;
            } else if (null != principals) {
                if (inAWS && null != statement)
                    statement.setPrincipals(principals);
                principals = null;
            } else if (null != condition) {
                //System.out.println( "in condition: " + condNested + " " + entryNesting + " " + keyNested );
                // -> is it just the current key that is done?
                try {
                    if (keyNested == entryNesting) {
                        String[] values = valueList.toArray(new String[0]);
                        ConditionKeys tempKey = S3PolicyCondition.toConditionKeys(condKey);
                        if (ConditionKeys.UnknownKey == tempKey)
                            badPolicy("Condition Key", condKey);
                        condition.setKey(tempKey, values);
                        valueList.clear();
                        condKey = null;
                    }
                } catch (ParseException e) {
                    logger.error("Policy Parser condition error: ", e);
                    throw e;
                } catch (Exception e) {
                    logger.error("Policy Parser condition error: ", e);
                    badPolicy("Condition Key (" + condKey + ")", e.toString());
                }

                // -> is the condition completely done?
                if (condNested == entryNesting) {
                    condition.verify();
                    block.addCondition(condition);
                    condition = null;
                }
            } else if (null != statement && 1 == entryNesting) {
                if (null != block) {
                    block.verify();
                    statement.setConditionBlock(block);
                }
                if (null != bucketPolicy) {
                    statement.verify();
                    bucketPolicy.addStatement(statement);
                }
                statement = null;
                block = null;
            }

            entryNesting--;
            return true;
        }

        public boolean primitive(Object value) throws ParseException, PermissionDeniedException {
            logger.debug("primitive(): " + value);

            if (inSid) {
                sid = (String)value;
            } else if (inEffect) {
                effect = (String)value;
            } else if (inResource) {
                resource = (String)value;
            } else if (inNotAction) {
                notAction = convertActions.toPolicyActions((String)value);
                if (notAction == PolicyActions.UnknownAction)
                    badPolicy("NotAction", (String)value);
            } else if (inId) {
                id = (String)value;
            } else if (null != actions) {
                PolicyActions tempAction = convertActions.toPolicyActions((String)value);
                if (tempAction == PolicyActions.UnknownAction)
                    badPolicy("Action", (String)value);
                actions.addAction(tempAction);
            } else if (null != principals) {
                principals.addPrincipal((String)value);
            } else if (null != condition) {
                // -> a condition key can have one or more values
                valueList.add((String)value);
            } else if (inVersion) {
                String version = (String)value;
                if (!version.equals("2008-10-17"))
                    badPolicy("Version", (String)value);
            }

            return true;
        }

        public boolean startArray() throws ParseException {
            logger.debug("startArray()");
            return true;
        }

        public void startJSON() throws ParseException {
            logger.debug("startJSON()");
        }

        public boolean startObject() throws ParseException {
            logger.debug("startObject(), nesting: " + entryNesting);

            if (1 == entryNesting && inStatement)
                statement = new S3PolicyStatement();

            return true;
        }

        /**
         * Note: A statement does not have to have a condition block to be valid.
         */
        public boolean startObjectEntry(String key) throws ParseException {
            entryNesting++;
            logger.debug("startObjectEntry(), key: [" + key + "]");

            inSid = false;
            inAWS = false;
            inEffect = false;
            inResource = false;
            inNotAction = false;
            inVersion = false;
            inId = false;

            if (key.equalsIgnoreCase("Statement"))
                inStatement = true;
            else if (key.equalsIgnoreCase("Action"))
                actions = new S3PolicyAction();
            else if (key.equalsIgnoreCase("Principal"))
                principals = new S3PolicyPrincipal();
            else if (key.equalsIgnoreCase("Condition"))
                block = new S3PolicyConditionBlock();
            else if (key.equalsIgnoreCase("AWS") && null != principals)
                inAWS = true;
            else if (key.equalsIgnoreCase("CanonicalUser") && null != principals)
                inAWS = true;
            else if (key.equalsIgnoreCase("Sid"))
                inSid = true;
            else if (key.equalsIgnoreCase("Effect"))
                inEffect = true;
            else if (key.equalsIgnoreCase("Resource"))
                inResource = true;
            else if (key.equalsIgnoreCase("NotAction"))
                inNotAction = true;
            else if (key.equalsIgnoreCase("Version"))
                inVersion = true;
            else if (key.equalsIgnoreCase("Id"))
                inId = true;
            else if (null != condition) {
                condKey = key;
                keyNested = entryNesting;
            } else if (null != block) {
                condition = condFactory.createCondition(key);
                condNested = entryNesting;
                if (null == condition)
                    badPolicy("Condition type", key);
            } else
                logger.debug("startObjectEntry() no match");

            return true;
        }
    };

    public S3BucketPolicy parse(String policy, String bucketName) throws ParseException, PermissionDeniedException {
        bucketPolicy = new S3BucketPolicy();
        bucketPolicy.setBucketName(bucketName);
        jparser.parse(policy, myHandler);
        return bucketPolicy;
    }

    /**
     * From Amazon on S3 Policies:
     * "Each policy must cover only a single bucket and resources within that bucket (when writing a
     * policy, don't include statements that refer to other buckets or resources in other buckets)"
     *
     * @param resourcePath
     */
    private void verifySameBucket(String resourcePath) throws PermissionDeniedException {
        String testBucketName = resourcePath;
        String bucketName = bucketPolicy.getBucketName();

        // -> extract just the bucket name
        int offset = testBucketName.indexOf("/");
        if (-1 != offset)
            testBucketName = testBucketName.substring(0, offset);

        if (!testBucketName.equals(bucketName))
            throw new PermissionDeniedException("The S3 Bucket Policy must only refer to the single bucket: \"" + bucketName +
                "\", but it referres to the following resource: \"" + resourcePath + "\"");
    }

    public static void badPolicy(String place, String badValue) throws ParseException {
        String toUser = new String("S3 Bucket Policy " + place + " of: \"" + badValue + "\" is unknown");
        throw new ParseException(ParseException.ERROR_UNEXPECTED_TOKEN, toUser);
    }
}