rgw/lua: allow read access to object data

Signed-off-by: Yuval Lifshitz <ylifshit@redhat.com>

doc/radosgw/lua-scripting.rst

@@ -6,10 +6,18 @@ Lua Scripting
 
 .. contents::
 
-This feature allows users to assign execution context to Lua scripts. The three supported contexts are ``preRequest``" which will execute a script before each
-operation is performed, ``postRequest`` which will execute after each operation is performed, and ``background`` which will execute within a specified time interval.
-A request context script may be constrained to operations belonging to a specific tenant's users.
-The request context script can also access fields in the request and modify some fields. All Lua language features can be used.
+This feature allows users to assign execution context to Lua scripts. The supported contexts are:
+
+ - ``preRequest`` which will execute a script before each operation is performed
+ - ``postRequest`` which will execute after each operation is performed
+ - ``background`` which will execute within a specified time interval
+ - ``getData`` which will execute on objects' data when objects are downloaded
+ - ``putData`` which will execute on objects' data when objects are uploaded
+
+A request (pre or post) or data (get or put) context script may be constrained to operations belonging to a specific tenant's users.
+The request context script can also access fields in the request and modify some fields, as well as the background ``RGW`` table.
+The data context script can access the content of the object as well as the request fields an the background ``RGW`` table. 
+All Lua language features can be used in all contexts.
 
 By default, all lua standard libraries are available in the script, however, in order to allow for other lua modules to be used in the script, we support adding packages to an allowlist:
 
@@ -32,7 +40,7 @@ To upload a script:
 
 ::
    
-   # radosgw-admin script put --infile={lua-file} --context={preRequest|postRequest|background} [--tenant={tenant-name}]
+   # radosgw-admin script put --infile={lua-file} --context={preRequest|postRequest|background|getData|putdata} [--tenant={tenant-name}]
 
 
 * When uploading a script with the ``background`` context, a tenant name may not be specified.
@@ -42,14 +50,14 @@ To print the content of the script to standard output:
 
 ::
    
-   # radosgw-admin script get --context={preRequest|postRequest|background} [--tenant={tenant-name}]
+   # radosgw-admin script get --context={preRequest|postRequest|background|getData} [--tenant={tenant-name}]
 
 
 To remove the script:
 
 ::
    
-   # radosgw-admin script rm --context={preRequest|postRequest|background} [--tenant={tenant-name}]
+   # radosgw-admin script rm --context={preRequest|postRequest|background|putData} [--tenant={tenant-name}]
 
 
 Package Management via CLI
@@ -306,11 +314,29 @@ Operations Log
 ~~~~~~~~~~~~~~
 The ``Request.Log()`` function prints the requests into the operations log. This function has no parameters. It returns 0 for success and an error code if it fails.
 
+Tracing
+~~~~~~~
+Tracing functions can be used only in `postRequest` context.
+
+- ``Request.Trace.SetAttribute()`` - sets the attribute for the request's trace.
+  Takes two arguments. The first is the `key`, which should be a string. The second is the value, which can either be a string or a number.
+  Using the attribute, you can locate specific traces.
+
+- ``Request.Trace.AddEvent()`` - adds an event to the first span of the request's trace
+  An event is defined by event name, event time, and zero or more event attributes.
+  Therefore, the function accepts one or two arguments. A string containing the event name should be the first argument, followed by the event attributes, which is optional for events without attributes.
+  An event's attributes must be a table of strings.
+
 Background Context
 --------------------
 The ``background`` context may be used for purposes that include analytics, monitoring, caching data for other context executions.
 - Background script execution default interval is 5 seconds.
 
+Data Context
+--------------------
+Both ``getData`` and ``putData`` contexts has a single field named ``Data`` which is read only, optional and iterable (byte by byte).
+The ``Request`` fields and the background ``RGW`` table are also available in these contexts.
+
 Global ``RGW`` Table
 --------------------
 The ``RGW`` Lua table is accessible from all contexts and saves data written to it
@@ -330,18 +356,6 @@ to atomically increment and decrement numeric values in it. For that the followi
 - if we try to increment or decrement by non-numeric values, the execution of the script would fail
 
 
-Tracing
-~~~~~~~
-Tracing functions can be used only in `postRequest` context.
-
-- ``Request.Trace.SetAttribute()`` - sets the attribute for the request's trace.
-  Takes two arguments. The first is the `key`, which should be a string. The second is the value, which can either be a string or a number.
-  Using the attribute, you can locate specific traces.
-
-- ``Request.Trace.AddEvent()`` - adds an event to the first span of the request's trace
-  An event is defined by event name, event time, and zero or more event attributes.
-  Therefore, the function accepts one or two arguments. A string containing the event name should be the first argument, followed by the event attributes, which is optional for events without attributes.
-  An event's attributes must be a table of strings.
 
 Lua Code Samples
 ----------------
@@ -511,3 +525,39 @@ in `postRequest` context, we can add attributes and events to the request's trac
 
   Request.Trace.AddEvent("second event", event_attrs)
 
+- Calculate the entropy and size of uploaded objects and print to debug log
+
+in `putData` ccontext, add the following script
+
+.. code-block:: lua
+
+	function object_entropy()
+		local byte_hist = {}
+		local byte_hist_size = 256 
+		for i = 1,byte_hist_size do
+			byte_hist[i] = 0 
+		end 
+		local total = 0 
+
+		for i, c in pairs(Data)  do
+			local byte = c:byte() + 1 
+			byte_hist[byte] = byte_hist[byte] + 1 
+			total = total + 1 
+		end 
+
+		entropy = 0 
+
+		for _, count in ipairs(byte_hist) do
+			if count ~= 0 then
+				local p = 1.0 * count / total
+				entropy = entropy - (p * math.log(p)/math.log(byte_hist_size))
+			end 
+		end 
+
+		return entropy
+	end
+
+	local full_name = Request.Bucket.Name.."\\"..Request.Object.Name
+	RGWDebugLog("entropy of chunk of: " .. full_name .. " is: " .. tostring(object_entropy()))
+	RGWDebugLog("payload size of chunk of: " .. full_name .. " is: " .. #Data)
+

src/rgw/CMakeLists.txt

@@ -161,8 +161,11 @@ set(librgw_common_srcs
   rgw_datalog.cc
   rgw_datalog_notify.cc
   cls_fifo_legacy.cc
+  rgw_log.cc
+  rgw_lua_request.cc
   rgw_lua_utils.cc
   rgw_lua.cc
+  rgw_lua_data_filter.cc
   rgw_bucket_encryption.cc
   rgw_tracer.cc
   rgw_lua_background.cc)
@@ -276,8 +279,6 @@ set(rgw_a_srcs
   rgw_frontend.cc
   rgw_http_client_curl.cc
   rgw_loadgen.cc
-  rgw_log.cc
-  rgw_lua_request.cc
   rgw_period_pusher.cc
   rgw_realm_reloader.cc
   rgw_realm_watcher.cc

src/rgw/rgw_admin.cc

@@ -477,7 +477,7 @@ void usage()
   cout << "   --subscription            pubsub subscription name\n";
   cout << "   --event-id                event id in a pubsub subscription\n";
   cout << "\nScript options:\n";
-  cout << "   --context                 context in which the script runs. one of: preRequest, postRequest, background\n";
+  cout << "   --context                 context in which the script runs. one of: preRequest, postRequest, background, getData, putData\n";
   cout << "   --package                 name of the lua package that should be added/removed to/from the allowlist\n";
   cout << "   --allow-compilation       package is allowed to compile C code as part of its installation\n";
   cout << "\nradoslist options:\n";
@@ -10377,7 +10377,7 @@ int main(int argc, const char **argv)
     }
     const rgw::lua::context script_ctx = rgw::lua::to_context(*str_script_ctx);
     if (script_ctx == rgw::lua::context::none) {
-      cerr << "ERROR: invalid script context: " << *str_script_ctx << ". must be one of: preRequest, postRequest, background" << std::endl;
+      cerr << "ERROR: invalid script context: " << *str_script_ctx << ". must be one of: preRequest, postRequest, background, getData, putData" << std::endl;
       return EINVAL;
     }
     if (script_ctx == rgw::lua::context::background && !tenant.empty()) {
@@ -10398,7 +10398,7 @@ int main(int argc, const char **argv)
     }
     const rgw::lua::context script_ctx = rgw::lua::to_context(*str_script_ctx);
     if (script_ctx == rgw::lua::context::none) {
-      cerr << "ERROR: invalid script context: " << *str_script_ctx << ". must be one of: preRequest, postRequest, background" << std::endl;
+      cerr << "ERROR: invalid script context: " << *str_script_ctx << ". must be one of: preRequest, postRequest, background, getData, putData" << std::endl;
       return EINVAL;
     }
     std::string script;
@@ -10421,7 +10421,7 @@ int main(int argc, const char **argv)
     }
     const rgw::lua::context script_ctx = rgw::lua::to_context(*str_script_ctx);
     if (script_ctx == rgw::lua::context::none) {
-      cerr << "ERROR: invalid script context: " << *str_script_ctx << ". must be one of: preRequest, postRequest, background" << std::endl;
+      cerr << "ERROR: invalid script context: " << *str_script_ctx << ". must be one of: preRequest, postRequest, background, getData, putData" << std::endl;
       return EINVAL;
     }
     const auto rc = rgw::lua::delete_script(dpp(), store, tenant, null_yield, script_ctx);

src/rgw/rgw_common.h

@@ -51,6 +51,10 @@ namespace rgw::sal {
   using Attrs = std::map<std::string, ceph::buffer::list>;
 }
 
+namespace rgw::lua {
+  class Background;
+}
+
 using ceph::crypto::MD5;
 
 #define RGW_ATTR_PREFIX  "user.rgw."
@@ -1697,6 +1701,8 @@ struct req_state : DoutPrefixProvider {
   //Principal tags that come in as part of AssumeRoleWithWebIdentity
   std::vector<std::pair<std::string, std::string>> principal_tags;
 
+  rgw::lua::Background* lua_background = nullptr;
+
   req_state(CephContext* _cct, RGWEnv* e, uint64_t id);
   ~req_state();
 

src/rgw/rgw_lua.cc

@@ -26,6 +26,12 @@ context to_context(const std::string& s)
   if (strcasecmp(s.c_str(), "background") == 0) {
     return context::background;
   }
+  if (strcasecmp(s.c_str(), "getData") == 0) {
+    return context::getData;
+  }
+  if (strcasecmp(s.c_str(), "putData") == 0) {
+    return context::putData;
+  }
   return context::none;
 }
 
@@ -38,6 +44,10 @@ std::string to_string(context ctx)
       return "postrequest";
     case context::background:
       return "background";
+    case context::getData:
+      return "getdata";
+    case context::putData:
+      return "putdata";
     case context::none:
       break;
   }

src/rgw/rgw_lua.h

@@ -4,6 +4,7 @@
 #include "common/async/yield_context.h"
 #include "rgw_sal_fwd.h"
 
+class DoutPrefixProvider;
 class lua_State;
 class rgw_user;
 namespace rgw::sal {
@@ -16,6 +17,8 @@ enum class context {
   preRequest,
   postRequest,
   background,
+  getData,
+  putData,
   none
 };
 

src/rgw/rgw_lua_background.cc

@@ -176,5 +176,5 @@ void Background::create_background_metatable(lua_State* L) {
   create_metatable<rgw::lua::RGWTable>(L, true, &rgw_map, &table_mutex);
 }
 
-} //namespace lua
+} //namespace rgw::lua
 

src/rgw/rgw_lua_background.h

@@ -223,5 +223,5 @@ class Background : public RGWRealmReloader::Pauser {
     void resume(rgw::sal::Store* _store) override;
 };
 
-} //namepsace lua
+} //namepsace rgw::lua