HDDS-15000. Improve S3 audit log stack traces

hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/AuthorizationFilter.java

@@ -71,14 +71,14 @@ public void filter(ContainerRequestContext context) throws
       } else {
         LOG.debug("Unsupported AWS signature version: {}",
             signatureInfo.getVersion());
-        throw S3ErrorTable.newError(S3_AUTHINFO_CREATION_ERROR, String.valueOf(signatureInfo.getVersion()), null);
+        throw S3ErrorTable.newError(S3_AUTHINFO_CREATION_ERROR, String.valueOf(signatureInfo.getVersion()));
       }
 
       String awsAccessId = signatureInfo.getAwsAccessId();
       // ONLY validate aws access id when needed.
       if (awsAccessId == null || awsAccessId.equals("")) {
         LOG.debug("Malformed s3 header. awsAccessID: {}", awsAccessId);
-        throw S3ErrorTable.newError(ACCESS_DENIED, null, null);
+        throw S3ErrorTable.newError(ACCESS_DENIED);
       }
     } catch (OS3Exception ex) {
       LOG.debug("Error during Client Creation: ", ex);
@@ -87,8 +87,7 @@ public void filter(ContainerRequestContext context) throws
       // For any other critical errors during object creation throw Internal
       // error.
       LOG.debug("Error during Client Creation: ", e);
-      throw wrapOS3Exception(
-          S3ErrorTable.newError(INTERNAL_ERROR, null, e));
+      throw wrapOS3Exception(S3ErrorTable.newError(INTERNAL_ERROR, e));
     }
   }
 

hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/BucketEndpoint.java

@@ -23,7 +23,6 @@
 import static org.apache.hadoop.ozone.s3.S3GatewayConfigKeys.OZONE_S3G_LIST_KEYS_SHALLOW_ENABLED_DEFAULT;
 import static org.apache.hadoop.ozone.s3.S3GatewayConfigKeys.OZONE_S3G_LIST_MAX_KEYS_LIMIT;
 import static org.apache.hadoop.ozone.s3.S3GatewayConfigKeys.OZONE_S3G_LIST_MAX_KEYS_LIMIT_DEFAULT;
-import static org.apache.hadoop.ozone.s3.exception.S3ErrorTable.INTERNAL_ERROR;
 import static org.apache.hadoop.ozone.s3.exception.S3ErrorTable.newError;
 import static org.apache.hadoop.ozone.s3.util.S3Consts.ENCODING_TYPE;
 import static org.apache.hadoop.ozone.s3.util.S3Utils.wrapInQuotes;
@@ -99,7 +98,7 @@ public Response get(
     try {
       return handler.handleGetRequest(context, bucketName);
     } catch (OMException ex) {
-      throw newError(translateException(ex), bucketName, ex);
+      throw newError(bucketName, ex);
     }
   }
 
@@ -270,7 +269,7 @@ public Response put(
     try {
       return handler.handlePutRequest(context, bucketName, body);
     } catch (OMException ex) {
-      throw newError(translateException(ex), bucketName, ex);
+      throw newError(bucketName, ex);
     }
   }
 
@@ -298,7 +297,7 @@ public Response head(@PathParam(BUCKET) String bucketName)
       return Response.ok().build();
     } catch (OMException e) {
       auditReadFailure(s3GAction, e);
-      throw newError(translateException(e), bucketName, e);
+      throw newError(bucketName, e);
     } catch (Exception e) {
       auditReadFailure(s3GAction, e);
       throw e;
@@ -318,7 +317,7 @@ public Response delete(@PathParam(BUCKET) String bucketName)
     try {
       return handler.handleDeleteRequest(context, bucketName);
     } catch (OMException ex) {
-      throw newError(translateException(ex), bucketName, ex);
+      throw newError(bucketName, ex);
     }
   }
 
@@ -427,24 +426,4 @@ protected void init() {
         .build();
     handler = new AuditingBucketOperationHandler(chain);
   }
-
-  private static S3ErrorTable translateException(OMException ex) {
-    switch (ex.getResult()) {
-    case ACCESS_DENIED:
-    case INVALID_TOKEN:
-    case PERMISSION_DENIED:
-      return S3ErrorTable.ACCESS_DENIED;
-    case BUCKET_ALREADY_EXISTS:
-      return S3ErrorTable.BUCKET_ALREADY_EXISTS;
-    case BUCKET_NOT_EMPTY:
-      return S3ErrorTable.BUCKET_NOT_EMPTY;
-    case BUCKET_NOT_FOUND:
-    case VOLUME_NOT_FOUND:
-      return S3ErrorTable.NO_SUCH_BUCKET;
-    case INVALID_BUCKET_NAME:
-      return S3ErrorTable.INVALID_BUCKET_NAME;
-    default:
-      return INTERNAL_ERROR;
-    }
-  }
 }

hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/CompleteMultipartUploadRequestUnmarshaller.java

@@ -51,12 +51,12 @@ public CompleteMultipartUploadRequest readFrom(
       InputStream inputStream) throws WebApplicationException {
     try {
       if (inputStream.available() == 0) {
-        throw wrapOS3Exception(newError(INVALID_REQUEST, null, null)
+        throw wrapOS3Exception(newError(INVALID_REQUEST)
             .withMessage("You must specify at least one part"));
       }
       return super.readFrom(aClass, type, annotations, mediaType, multivaluedMap, inputStream);
     } catch (IOException e) {
-      throw wrapOS3Exception(newError(INVALID_REQUEST, null, e)
+      throw wrapOS3Exception(newError(INVALID_REQUEST, e)
           .withMessage(e.getMessage()));
     }
   }

hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/EndpointBase.java

@@ -221,30 +221,6 @@ protected void init() {
     // hook method
   }
 
-  protected OzoneBucket getBucket(String bucketName)
-      throws OS3Exception, IOException {
-    OzoneBucket bucket;
-    try {
-      bucket = client.getObjectStore().getS3Bucket(bucketName);
-    } catch (OMException ex) {
-      if (ex.getResult() == ResultCodes.BUCKET_NOT_FOUND
-          || ex.getResult() == ResultCodes.VOLUME_NOT_FOUND) {
-        throw newError(S3ErrorTable.NO_SUCH_BUCKET, bucketName, ex);
-      } else if (ex.getResult() == ResultCodes.INVALID_TOKEN) {
-        throw newError(S3ErrorTable.ACCESS_DENIED,
-            s3Auth.getAccessID(), ex);
-      } else if (ex.getResult() == ResultCodes.PERMISSION_DENIED) {
-        throw newError(S3ErrorTable.ACCESS_DENIED, bucketName, ex);
-      } else if (ex.getResult() == ResultCodes.TIMEOUT ||
-          ex.getResult() == ResultCodes.INTERNAL_ERROR) {
-        throw newError(S3ErrorTable.INTERNAL_ERROR, bucketName, ex);
-      } else {
-        throw ex;
-      }
-    }
-    return bucket;
-  }
-
   protected OzoneVolume getVolume() throws IOException {
     return client.getObjectStore().getS3Volume();
   }

hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/ListMultipartUploadsHandler.java

@@ -50,8 +50,9 @@ Response handleGetRequest(S3RequestContext context, String bucketName)
     final String uploadIdMarker = queryParams().get(QueryParams.UPLOAD_ID_MARKER);
 
     if (maxUploads < 1) {
-      throw newError(S3ErrorTable.INVALID_ARGUMENT, "max-uploads",
-          new Exception("max-uploads must be positive"));
+      OS3Exception e = newError(S3ErrorTable.INVALID_ARGUMENT, "max-uploads");
+      e.setErrorMessage("max-uploads must be positive");
+      throw e;
     }
 
     long startNanos = context.getStartNanos();

hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/MessageUnmarshaller.java

@@ -82,7 +82,7 @@ public T readFrom(
       filter.parse(new InputSource(inputStream));
       return cls.cast(unmarshallerHandler.getResult());
     } catch (Exception e) {
-      throw wrapOS3Exception(newError(INVALID_REQUEST, null, e).withMessage(e.getMessage()));
+      throw wrapOS3Exception(newError(INVALID_REQUEST, e).withMessage(e.getMessage()));
     }
   }
 

hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/MultipartKeyHandler.java

@@ -105,8 +105,6 @@ private Response abortMultipartUpload(OzoneVolume volume, String bucket,
     } catch (OMException ex) {
       if (ex.getResult() == ResultCodes.NO_SUCH_MULTIPART_UPLOAD_ERROR) {
         throw newError(S3ErrorTable.NO_SUCH_UPLOAD, uploadId, ex);
-      } else if (ex.getResult() == ResultCodes.BUCKET_NOT_FOUND) {
-        throw newError(S3ErrorTable.NO_SUCH_BUCKET, bucket, ex);
       }
       throw ex;
     }

hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/ObjectEndpoint.java

@@ -21,7 +21,6 @@
 import static org.apache.hadoop.ozone.audit.AuditLogger.PerformanceStringBuilder;
 import static org.apache.hadoop.ozone.s3.S3GatewayConfigKeys.OZONE_S3G_FSO_DIRECTORY_CREATION_ENABLED;
 import static org.apache.hadoop.ozone.s3.S3GatewayConfigKeys.OZONE_S3G_FSO_DIRECTORY_CREATION_ENABLED_DEFAULT;
-import static org.apache.hadoop.ozone.s3.exception.S3ErrorTable.ENTITY_TOO_SMALL;
 import static org.apache.hadoop.ozone.s3.exception.S3ErrorTable.INVALID_ARGUMENT;
 import static org.apache.hadoop.ozone.s3.exception.S3ErrorTable.INVALID_REQUEST;
 import static org.apache.hadoop.ozone.s3.exception.S3ErrorTable.NO_SUCH_UPLOAD;
@@ -179,36 +178,13 @@ public Response put(
             " considered as Unix Paths. Path has Violated FS Semantics " +
             "which caused put operation to fail.");
         throw os3Exception;
-      } else if (isAccessDenied(ex)) {
-        throw newError(S3ErrorTable.ACCESS_DENIED, keyPath, ex);
-      } else if (ex.getResult() == ResultCodes.QUOTA_EXCEEDED) {
-        throw newError(S3ErrorTable.QUOTA_EXCEEDED, keyPath, ex);
-      } else if (ex.getResult() == ResultCodes.BUCKET_NOT_FOUND) {
-        throw newError(S3ErrorTable.NO_SUCH_BUCKET, bucketName, ex);
-      } else if (ex.getResult() == ResultCodes.FILE_ALREADY_EXISTS) {
-        throw newError(S3ErrorTable.NO_OVERWRITE, keyPath, ex);
-      } else if (ex.getResult() == ResultCodes.KEY_ALREADY_EXISTS) {
-        throw newError(PRECOND_FAILED, keyPath, ex);
-      } else if (ex.getResult() == ResultCodes.ATOMIC_WRITE_CONFLICT) {
-        throw newError(S3ErrorTable.CONDITIONAL_REQUEST_CONFLICT, keyPath, ex);
-      } else if (ex.getResult() == ResultCodes.ETAG_MISMATCH) {
-        throw newError(PRECOND_FAILED, keyPath, ex);
-      } else if (ex.getResult() == ResultCodes.ETAG_NOT_AVAILABLE) {
-        throw newError(PRECOND_FAILED, keyPath, ex);
-      } else if (ex.getResult() == ResultCodes.INVALID_REQUEST) {
-        throw newError(S3ErrorTable.INVALID_REQUEST, keyPath);
       } else if (ex.getResult() == ResultCodes.KEY_NOT_FOUND
           && getHeaders().getHeaderString(S3Consts.IF_MATCH_HEADER) != null) {
         // If-Match failed because the key doesn't exist
         throw newError(PRECOND_FAILED, keyPath, ex);
-      } else if (ex.getResult() == ResultCodes.KEY_NOT_FOUND) {
-        throw newError(S3ErrorTable.NO_SUCH_KEY, keyPath);
-      } else if (ex.getResult() == ResultCodes.NOT_SUPPORTED_OPERATION) {
-        // e.g. if putObjectTagging operation is applied on FSO directory
-        throw newError(S3ErrorTable.NOT_IMPLEMENTED, keyPath);
       }
 
-      throw ex;
+      throw newError(bucketName, keyPath, ex);
     }
   }
 
@@ -388,15 +364,7 @@ public Response get(
     try {
       return handler.handleGetRequest(context, keyPath);
     } catch (OMException ex) {
-      if (ex.getResult() == ResultCodes.KEY_NOT_FOUND) {
-        throw newError(S3ErrorTable.NO_SUCH_KEY, keyPath, ex);
-      } else if (isAccessDenied(ex)) {
-        throw newError(S3ErrorTable.ACCESS_DENIED, keyPath, ex);
-      } else if (ex.getResult() == ResultCodes.BUCKET_NOT_FOUND) {
-        throw newError(S3ErrorTable.NO_SUCH_BUCKET, bucketName, ex);
-      } else {
-        throw ex;
-      }
+      throw newError(bucketName, keyPath, ex);
     }
   }
 
@@ -573,7 +541,7 @@ public Response head(
     OzoneKey key;
     try {
       if (S3Owner.hasBucketOwnershipVerificationConditions(getHeaders())) {
-        OzoneBucket bucket = getBucket(bucketName);
+        OzoneBucket bucket = getVolume().getBucket(bucketName);
         S3Owner.verifyBucketOwnerCondition(getHeaders(), bucketName, bucket.getOwner());
       }
       key = getClientProtocol().headS3Object(bucketName, keyPath);
@@ -593,12 +561,8 @@ public Response head(
       if (ex.getResult() == ResultCodes.KEY_NOT_FOUND) {
         // Just return 404 with no content
         return Response.status(Status.NOT_FOUND).build();
-      } else if (isAccessDenied(ex)) {
-        throw newError(S3ErrorTable.ACCESS_DENIED, keyPath, ex);
-      } else if (ex.getResult() == ResultCodes.BUCKET_NOT_FOUND) {
-        throw newError(S3ErrorTable.NO_SUCH_BUCKET, bucketName, ex);
       } else {
-        throw ex;
+        throw newError(bucketName, keyPath, ex);
       }
     } catch (Exception ex) {
       auditReadFailure(s3GAction, ex);
@@ -647,7 +611,6 @@ Example of such app is Trino (through Hive connector).
    * for more details.
    */
   @DELETE
-  @SuppressWarnings("emptyblock")
   public Response delete(
       @PathParam(BUCKET) String bucketName,
       @PathParam(PATH) String keyPath
@@ -656,26 +619,7 @@ public Response delete(
     try {
       return handler.handleDeleteRequest(context, keyPath);
     } catch (OMException ex) {
-      if (ex.getResult() == ResultCodes.BUCKET_NOT_FOUND) {
-        throw newError(S3ErrorTable.NO_SUCH_BUCKET, bucketName, ex);
-      } else if (ex.getResult() == ResultCodes.KEY_NOT_FOUND) {
-        //NOT_FOUND is not a problem, AWS doesn't throw exception for missing
-        // keys. Just return 204
-        return Response.status(Status.NO_CONTENT).build();
-      } else if (ex.getResult() == ResultCodes.DIRECTORY_NOT_EMPTY) {
-        // With PREFIX metadata layout, a dir deletion without recursive flag
-        // to true will throw DIRECTORY_NOT_EMPTY error for a non-empty dir.
-        // NOT_FOUND is not a problem, AWS doesn't throw exception for missing
-        // keys. Just return 204
-        return Response.status(Status.NO_CONTENT).build();
-      } else if (isAccessDenied(ex)) {
-        throw newError(S3ErrorTable.ACCESS_DENIED, keyPath, ex);
-      } else if (ex.getResult() == ResultCodes.NOT_SUPPORTED_OPERATION) {
-        // When deleteObjectTagging operation is applied on FSO directory
-        throw S3ErrorTable.newError(S3ErrorTable.NOT_IMPLEMENTED, keyPath);
-      } else {
-        throw ex;
-      }
+      throw newError(bucketName, keyPath, ex);
     }
   }
 
@@ -692,7 +636,20 @@ Response handleDeleteRequest(ObjectRequestContext context, String keyPath)
 
       getMetrics().updateDeleteKeySuccessStats(startNanos);
       return Response.status(Status.NO_CONTENT).build();
-
+    } catch (OMException ex) {
+      getMetrics().updateDeleteKeyFailureStats(startNanos);
+      if (ex.getResult() == ResultCodes.KEY_NOT_FOUND) {
+        //NOT_FOUND is not a problem, AWS doesn't throw exception for missing
+        // keys. Just return 204
+        return Response.status(Status.NO_CONTENT).build();
+      } else if (ex.getResult() == ResultCodes.DIRECTORY_NOT_EMPTY) {
+        // With PREFIX metadata layout, a dir deletion without recursive flag
+        // to true will throw DIRECTORY_NOT_EMPTY error for a non-empty dir.
+        // NOT_FOUND is not a problem, AWS doesn't throw exception for missing
+        // keys. Just return 204
+        return Response.status(Status.NO_CONTENT).build();
+      }
+      throw newError(context.getBucketName(), keyPath, ex);
     } catch (Exception ex) {
       getMetrics().updateDeleteKeyFailureStats(startNanos);
       throw ex;
@@ -715,7 +672,7 @@ public Response initializeMultipartUpload(
     S3GAction s3GAction = S3GAction.INIT_MULTIPART_UPLOAD;
 
     try {
-      OzoneBucket ozoneBucket = getBucket(bucket);
+      OzoneBucket ozoneBucket = getVolume().getBucket(bucket);
       S3Owner.verifyBucketOwnerCondition(getHeaders(), bucket, ozoneBucket.getOwner());
 
       Map<String, String> customMetadata =
@@ -742,10 +699,7 @@ public Response initializeMultipartUpload(
     } catch (OMException ex) {
       auditWriteFailure(s3GAction, ex);
       getMetrics().updateInitMultipartUploadFailureStats(startNanos);
-      if (isAccessDenied(ex)) {
-        throw newError(S3ErrorTable.ACCESS_DENIED, key, ex);
-      }
-      throw ex;
+      throw newError(bucket, key, ex);
     } catch (Exception ex) {
       auditWriteFailure(s3GAction, ex);
       getMetrics().updateInitMultipartUploadFailureStats(startNanos);
@@ -800,14 +754,8 @@ public Response completeMultipartUpload(
     } catch (OMException ex) {
       auditWriteFailure(s3GAction, ex);
       getMetrics().updateCompleteMultipartUploadFailureStats(startNanos);
-      if (ex.getResult() == ResultCodes.INVALID_PART) {
-        throw newError(S3ErrorTable.INVALID_PART, key, ex);
-      } else if (ex.getResult() == ResultCodes.INVALID_PART_ORDER) {
-        throw newError(S3ErrorTable.INVALID_PART_ORDER, key, ex);
-      } else if (ex.getResult() == ResultCodes.NO_SUCH_MULTIPART_UPLOAD_ERROR) {
+      if (ex.getResult() == ResultCodes.NO_SUCH_MULTIPART_UPLOAD_ERROR) {
         throw newError(NO_SUCH_UPLOAD, uploadID, ex);
-      } else if (ex.getResult() == ResultCodes.ENTITY_TOO_SMALL) {
-        throw newError(ENTITY_TOO_SMALL, key, ex);
       } else if (ex.getResult() == ResultCodes.INVALID_REQUEST) {
         OS3Exception os3Exception = newError(INVALID_REQUEST, key, ex);
         os3Exception.setErrorMessage("An error occurred (InvalidRequest) " +
@@ -822,12 +770,11 @@ public Response completeMultipartUpload(
             "considered as Unix Paths. A directory already exists with a " +
             "given KeyName caused failure for MPU");
         throw os3Exception;
-      } else if (ex.getResult() == ResultCodes.BUCKET_NOT_FOUND) {
-        throw newError(S3ErrorTable.NO_SUCH_BUCKET, bucket, ex);
       }
-      throw ex;
+      throw newError(bucket, key, ex);
     } catch (Exception ex) {
       auditWriteFailure(s3GAction, ex);
+      getMetrics().updateCompleteMultipartUploadFailureStats(startNanos);
       throw ex;
     }
   }
@@ -988,15 +935,13 @@ private Response createMultipartKey(OzoneVolume volume, OzoneBucket ozoneBucket,
       }
       if (ex.getResult() == ResultCodes.NO_SUCH_MULTIPART_UPLOAD_ERROR) {
         throw newError(NO_SUCH_UPLOAD, uploadID, ex);
-      } else if (isAccessDenied(ex)) {
-        throw newError(S3ErrorTable.ACCESS_DENIED, bucketName + "/" + key, ex);
       } else if (ex.getResult() == ResultCodes.INVALID_PART) {
         OS3Exception os3Exception = newError(
             S3ErrorTable.INVALID_ARGUMENT, String.valueOf(partNumber), ex);
         os3Exception.setErrorMessage(ex.getMessage());
         throw os3Exception;
       }
-      throw ex;
+      throw newError(bucketName, key, ex);
     } finally {
       // Reset the thread-local message digest instance in case of exception
       // and MessageDigest#digest is never called
@@ -1143,11 +1088,8 @@ private CopyObjectResponse copyObject(OzoneVolume volume,
         throw newError(S3ErrorTable.NO_SUCH_KEY, sourceKey, ex);
       } else if (ex.getResult() == ResultCodes.BUCKET_NOT_FOUND) {
         throw newError(S3ErrorTable.NO_SUCH_BUCKET, sourceBucket, ex);
-      } else if (isAccessDenied(ex)) {
-        throw newError(S3ErrorTable.ACCESS_DENIED,
-            destBucket + "/" + destkey, ex);
       }
-      throw ex;
+      throw newError(destBucket + "/" + destkey, ex);
     } finally {
       // Reset the thread-local message digest instance in case of exception
       // and MessageDigest#digest is never called