includes/libs/filebackend/SwiftFileBackend.php

   1 <?php
   2 /**
   3  * OpenStack Swift based file backend.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  * @ingroup FileBackend
  22  * @author Russ Nelson
  23  */
  24
  25 use Wikimedia\AtEase\AtEase;
  26
  27 /**
  28  * @brief Class for an OpenStack Swift (or Ceph RGW) based file backend.
  29  *
  30  * StatusValue messages should avoid mentioning the Swift account name.
  31  * Likewise, error suppression should be used to avoid path disclosure.
  32  *
  33  * @ingroup FileBackend
  34  * @since 1.19
  35  */
  36 class SwiftFileBackend extends FileBackendStore {
  37         /** @var MultiHttpClient */
  38         protected $http;
  39         /** @var int TTL in seconds */
  40         protected $authTTL;
  41         /** @var string Authentication base URL (without version) */
  42         protected $swiftAuthUrl;
  43         /** @var string Override of storage base URL */
  44         protected $swiftStorageUrl;
  45         /** @var string Swift user (account:user) to authenticate as */
  46         protected $swiftUser;
  47         /** @var string Secret key for user */
  48         protected $swiftKey;
  49         /** @var string Shared secret value for making temp URLs */
  50         protected $swiftTempUrlKey;
  51         /** @var string S3 access key (RADOS Gateway) */
  52         protected $rgwS3AccessKey;
  53         /** @var string S3 authentication key (RADOS Gateway) */
  54         protected $rgwS3SecretKey;
  55         /** @var array Additional users (account:user) with read permissions on public containers */
  56         protected $readUsers;
  57         /** @var array Additional users (account:user) with write permissions on public containers */
  58         protected $writeUsers;
  59         /** @var array Additional users (account:user) with read permissions on private containers */
  60         protected $secureReadUsers;
  61         /** @var array Additional users (account:user) with write permissions on private containers */
  62         protected $secureWriteUsers;
  63
  64         /** @var BagOStuff */
  65         protected $srvCache;
  66
  67         /** @var MapCacheLRU Container stat cache */
  68         protected $containerStatCache;
  69
  70         /** @var array */
  71         protected $authCreds;
  72         /** @var int UNIX timestamp */
  73         protected $authSessionTimestamp = 0;
  74         /** @var int UNIX timestamp */
  75         protected $authErrorTimestamp = null;
  76
  77         /** @var bool Whether the server is an Ceph RGW */
  78         protected $isRGW = false;
  79
  80         /**
  81          * @see FileBackendStore::__construct()
  82          * @param array $config Params include:
  83          *   - swiftAuthUrl       : Swift authentication server URL
  84          *   - swiftUser          : Swift user used by MediaWiki (account:username)
  85          *   - swiftKey           : Swift authentication key for the above user
  86          *   - swiftAuthTTL       : Swift authentication TTL (seconds)
  87          *   - swiftTempUrlKey    : Swift "X-Account-Meta-Temp-URL-Key" value on the account.
  88          *                          Do not set this until it has been set in the backend.
  89          *   - swiftStorageUrl    : Swift storage URL (overrides that of the authentication response).
  90          *                          This is useful to set if a TLS proxy is in use.
  91          *   - shardViaHashLevels : Map of container names to sharding config with:
  92          *                             - base   : base of hash characters, 16 or 36
  93          *                             - levels : the number of hash levels (and digits)
  94          *                             - repeat : hash subdirectories are prefixed with all the
  95          *                                        parent hash directory names (e.g. "a/ab/abc")
  96          *   - cacheAuthInfo      : Whether to cache authentication tokens in APC, etc.
  97          *                          If those are not available, then the main cache will be used.
  98          *                          This is probably insecure in shared hosting environments.
  99          *   - rgwS3AccessKey     : Rados Gateway S3 "access key" value on the account.
 100          *                          Do not set this until it has been set in the backend.
 101          *                          This is used for generating expiring pre-authenticated URLs.
 102          *                          Only use this when using rgw and to work around
 103          *                          http://tracker.newdream.net/issues/3454.
 104          *   - rgwS3SecretKey     : Rados Gateway S3 "secret key" value on the account.
 105          *                          Do not set this until it has been set in the backend.
 106          *                          This is used for generating expiring pre-authenticated URLs.
 107          *                          Only use this when using rgw and to work around
 108          *                          http://tracker.newdream.net/issues/3454.
 109          *   - readUsers           : Swift users with read access to public containers (account:username)
 110          *   - writeUsers          : Swift users with write access to public containers (account:username)
 111          *   - secureReadUsers     : Swift users with read access to private containers (account:username)
 112          *   - secureWriteUsers    : Swift users with write access to private containers (account:username)
 113          */
 114         public function __construct( array $config ) {
 115                 parent::__construct( $config );
 116                 // Required settings
 117                 $this->swiftAuthUrl = $config['swiftAuthUrl'];
 118                 $this->swiftUser = $config['swiftUser'];
 119                 $this->swiftKey = $config['swiftKey'];
 120                 // Optional settings
 121                 $this->authTTL = $config['swiftAuthTTL'] ?? 15 * 60; // some sane number
 122                 $this->swiftTempUrlKey = $config['swiftTempUrlKey'] ?? '';
 123                 $this->swiftStorageUrl = $config['swiftStorageUrl'] ?? null;
 124                 $this->shardViaHashLevels = $config['shardViaHashLevels'] ?? '';
 125                 $this->rgwS3AccessKey = $config['rgwS3AccessKey'] ?? '';
 126                 $this->rgwS3SecretKey = $config['rgwS3SecretKey'] ?? '';
 127                 // HTTP helper client
 128                 $this->http = new MultiHttpClient( [] );
 129                 // Cache container information to mask latency
 130                 if ( isset( $config['wanCache'] ) && $config['wanCache'] instanceof WANObjectCache ) {
 131                         $this->memCache = $config['wanCache'];
 132                 }
 133                 // Process cache for container info
 134                 $this->containerStatCache = new MapCacheLRU( 300 );
 135                 // Cache auth token information to avoid RTTs
 136                 if ( !empty( $config['cacheAuthInfo'] ) && isset( $config['srvCache'] ) ) {
 137                         $this->srvCache = $config['srvCache'];
 138                 } else {
 139                         $this->srvCache = new EmptyBagOStuff();
 140                 }
 141                 $this->readUsers = $config['readUsers'] ?? [];
 142                 $this->writeUsers = $config['writeUsers'] ?? [];
 143                 $this->secureReadUsers = $config['secureReadUsers'] ?? [];
 144                 $this->secureWriteUsers = $config['secureWriteUsers'] ?? [];
 145         }
 146
 147         public function getFeatures() {
 148                 return ( FileBackend::ATTR_UNICODE_PATHS |
 149                         FileBackend::ATTR_HEADERS | FileBackend::ATTR_METADATA );
 150         }
 151
 152         protected function resolveContainerPath( $container, $relStoragePath ) {
 153                 if ( !mb_check_encoding( $relStoragePath, 'UTF-8' ) ) {
 154                         return null; // not UTF-8, makes it hard to use CF and the swift HTTP API
 155                 } elseif ( strlen( rawurlencode( $relStoragePath ) ) > 1024 ) {
 156                         return null; // too long for Swift
 157                 }
 158
 159                 return $relStoragePath;
 160         }
 161
 162         public function isPathUsableInternal( $storagePath ) {
 163                 list( $container, $rel ) = $this->resolveStoragePathReal( $storagePath );
 164                 if ( $rel === null ) {
 165                         return false; // invalid
 166                 }
 167
 168                 return is_array( $this->getContainerStat( $container ) );
 169         }
 170
 171         /**
 172          * Sanitize and filter the custom headers from a $params array.
 173          * Only allows certain "standard" Content- and X-Content- headers.
 174          *
 175          * @param array $params
 176          * @return array Sanitized value of 'headers' field in $params
 177          */
 178         protected function sanitizeHdrsStrict( array $params ) {
 179                 if ( !isset( $params['headers'] ) ) {
 180                         return [];
 181                 }
 182
 183                 $headers = $this->getCustomHeaders( $params['headers'] );
 184                 unset( $headers[ 'content-type' ] );
 185
 186                 return $headers;
 187         }
 188
 189         /**
 190          * Sanitize and filter the custom headers from a $params array.
 191          * Only allows certain "standard" Content- and X-Content- headers.
 192          *
 193          * When POSTing data, libcurl adds Content-Type: application/x-www-form-urlencoded
 194          * if Content-Type is not set, which overwrites the stored Content-Type header
 195          * in Swift - therefore for POSTing data do not strip the Content-Type header (the
 196          * previously-stored header that has been already read back from swift is sent)
 197          *
 198          * @param array $params
 199          * @return array Sanitized value of 'headers' field in $params
 200          */
 201         protected function sanitizeHdrs( array $params ) {
 202                 return isset( $params['headers'] )
 203                         ? $this->getCustomHeaders( $params['headers'] )
 204                         : [];
 205         }
 206
 207         /**
 208          * @param array $rawHeaders
 209          * @return array Custom non-metadata HTTP headers
 210          */
 211         protected function getCustomHeaders( array $rawHeaders ) {
 212                 $headers = [];
 213
 214                 // Normalize casing, and strip out illegal headers
 215                 foreach ( $rawHeaders as $name => $value ) {
 216                         $name = strtolower( $name );
 217                         if ( preg_match( '/^content-length$/', $name ) ) {
 218                                 continue; // blacklisted
 219                         } elseif ( preg_match( '/^(x-)?content-/', $name ) ) {
 220                                 $headers[$name] = $value; // allowed
 221                         } elseif ( preg_match( '/^content-(disposition)/', $name ) ) {
 222                                 $headers[$name] = $value; // allowed
 223                         }
 224                 }
 225                 // By default, Swift has annoyingly low maximum header value limits
 226                 if ( isset( $headers['content-disposition'] ) ) {
 227                         $disposition = '';
 228                         // @note: assume FileBackend::makeContentDisposition() already used
 229                         foreach ( explode( ';', $headers['content-disposition'] ) as $part ) {
 230                                 $part = trim( $part );
 231                                 $new = ( $disposition === '' ) ? $part : "{$disposition};{$part}";
 232                                 if ( strlen( $new ) <= 255 ) {
 233                                         $disposition = $new;
 234                                 } else {
 235                                         break; // too long; sigh
 236                                 }
 237                         }
 238                         $headers['content-disposition'] = $disposition;
 239                 }
 240
 241                 return $headers;
 242         }
 243
 244         /**
 245          * @param array $rawHeaders
 246          * @return array Custom metadata headers
 247          */
 248         protected function getMetadataHeaders( array $rawHeaders ) {
 249                 $headers = [];
 250                 foreach ( $rawHeaders as $name => $value ) {
 251                         $name = strtolower( $name );
 252                         if ( strpos( $name, 'x-object-meta-' ) === 0 ) {
 253                                 $headers[$name] = $value;
 254                         }
 255                 }
 256
 257                 return $headers;
 258         }
 259
 260         /**
 261          * @param array $rawHeaders
 262          * @return array Custom metadata headers with prefix removed
 263          */
 264         protected function getMetadata( array $rawHeaders ) {
 265                 $metadata = [];
 266                 foreach ( $this->getMetadataHeaders( $rawHeaders ) as $name => $value ) {
 267                         $metadata[substr( $name, strlen( 'x-object-meta-' ) )] = $value;
 268                 }
 269
 270                 return $metadata;
 271         }
 272
 273         protected function doCreateInternal( array $params ) {
 274                 $status = $this->newStatus();
 275
 276                 list( $dstCont, $dstRel ) = $this->resolveStoragePathReal( $params['dst'] );
 277                 if ( $dstRel === null ) {
 278                         $status->fatal( 'backend-fail-invalidpath', $params['dst'] );
 279
 280                         return $status;
 281                 }
 282
 283                 $sha1Hash = Wikimedia\base_convert( sha1( $params['content'] ), 16, 36, 31 );
 284                 $contentType = $params['headers']['content-type']
 285                         ?? $this->getContentType( $params['dst'], $params['content'], null );
 286
 287                 $reqs = [ [
 288                         'method' => 'PUT',
 289                         'url' => [ $dstCont, $dstRel ],
 290                         'headers' => [
 291                                 'content-length' => strlen( $params['content'] ),
 292                                 'etag' => md5( $params['content'] ),
 293                                 'content-type' => $contentType,
 294                                 'x-object-meta-sha1base36' => $sha1Hash
 295                         ] + $this->sanitizeHdrsStrict( $params ),
 296                         'body' => $params['content']
 297                 ] ];
 298
 299                 $method = __METHOD__;
 300                 $handler = function ( array $request, StatusValue $status ) use ( $method, $params ) {
 301                         list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $request['response'];
 302                         if ( $rcode === 201 || $rcode === 202 ) {
 303                                 // good
 304                         } elseif ( $rcode === 412 ) {
 305                                 $status->fatal( 'backend-fail-contenttype', $params['dst'] );
 306                         } else {
 307                                 $this->onError( $status, $method, $params, $rerr, $rcode, $rdesc );
 308                         }
 309                 };
 310
 311                 $opHandle = new SwiftFileOpHandle( $this, $handler, $reqs );
 312                 if ( !empty( $params['async'] ) ) { // deferred
 313                         $status->value = $opHandle;
 314                 } else { // actually write the object in Swift
 315                         $status->merge( current( $this->executeOpHandlesInternal( [ $opHandle ] ) ) );
 316                 }
 317
 318                 return $status;
 319         }
 320
 321         protected function doStoreInternal( array $params ) {
 322                 $status = $this->newStatus();
 323
 324                 list( $dstCont, $dstRel ) = $this->resolveStoragePathReal( $params['dst'] );
 325                 if ( $dstRel === null ) {
 326                         $status->fatal( 'backend-fail-invalidpath', $params['dst'] );
 327
 328                         return $status;
 329                 }
 330
 331                 AtEase::suppressWarnings();
 332                 $sha1Hash = sha1_file( $params['src'] );
 333                 AtEase::restoreWarnings();
 334                 if ( $sha1Hash === false ) { // source doesn't exist?
 335                         $status->fatal( 'backend-fail-store', $params['src'], $params['dst'] );
 336
 337                         return $status;
 338                 }
 339                 $sha1Hash = Wikimedia\base_convert( $sha1Hash, 16, 36, 31 );
 340                 $contentType = $params['headers']['content-type']
 341                         ?? $this->getContentType( $params['dst'], null, $params['src'] );
 342
 343                 $handle = fopen( $params['src'], 'rb' );
 344                 if ( $handle === false ) { // source doesn't exist?
 345                         $status->fatal( 'backend-fail-store', $params['src'], $params['dst'] );
 346
 347                         return $status;
 348                 }
 349
 350                 $reqs = [ [
 351                         'method' => 'PUT',
 352                         'url' => [ $dstCont, $dstRel ],
 353                         'headers' => [
 354                                 'content-length' => filesize( $params['src'] ),
 355                                 'etag' => md5_file( $params['src'] ),
 356                                 'content-type' => $contentType,
 357                                 'x-object-meta-sha1base36' => $sha1Hash
 358                         ] + $this->sanitizeHdrsStrict( $params ),
 359                         'body' => $handle // resource
 360                 ] ];
 361
 362                 $method = __METHOD__;
 363                 $handler = function ( array $request, StatusValue $status ) use ( $method, $params ) {
 364                         list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $request['response'];
 365                         if ( $rcode === 201 || $rcode === 202 ) {
 366                                 // good
 367                         } elseif ( $rcode === 412 ) {
 368                                 $status->fatal( 'backend-fail-contenttype', $params['dst'] );
 369                         } else {
 370                                 $this->onError( $status, $method, $params, $rerr, $rcode, $rdesc );
 371                         }
 372                 };
 373
 374                 $opHandle = new SwiftFileOpHandle( $this, $handler, $reqs );
 375                 $opHandle->resourcesToClose[] = $handle;
 376
 377                 if ( !empty( $params['async'] ) ) { // deferred
 378                         $status->value = $opHandle;
 379                 } else { // actually write the object in Swift
 380                         $status->merge( current( $this->executeOpHandlesInternal( [ $opHandle ] ) ) );
 381                 }
 382
 383                 return $status;
 384         }
 385
 386         protected function doCopyInternal( array $params ) {
 387                 $status = $this->newStatus();
 388
 389                 list( $srcCont, $srcRel ) = $this->resolveStoragePathReal( $params['src'] );
 390                 if ( $srcRel === null ) {
 391                         $status->fatal( 'backend-fail-invalidpath', $params['src'] );
 392
 393                         return $status;
 394                 }
 395
 396                 list( $dstCont, $dstRel ) = $this->resolveStoragePathReal( $params['dst'] );
 397                 if ( $dstRel === null ) {
 398                         $status->fatal( 'backend-fail-invalidpath', $params['dst'] );
 399
 400                         return $status;
 401                 }
 402
 403                 $reqs = [ [
 404                         'method' => 'PUT',
 405                         'url' => [ $dstCont, $dstRel ],
 406                         'headers' => [
 407                                 'x-copy-from' => '/' . rawurlencode( $srcCont ) .
 408                                         '/' . str_replace( "%2F", "/", rawurlencode( $srcRel ) )
 409                         ] + $this->sanitizeHdrsStrict( $params ), // extra headers merged into object
 410                 ] ];
 411
 412                 $method = __METHOD__;
 413                 $handler = function ( array $request, StatusValue $status ) use ( $method, $params ) {
 414                         list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $request['response'];
 415                         if ( $rcode === 201 ) {
 416                                 // good
 417                         } elseif ( $rcode === 404 ) {
 418                                 $status->fatal( 'backend-fail-copy', $params['src'], $params['dst'] );
 419                         } else {
 420                                 $this->onError( $status, $method, $params, $rerr, $rcode, $rdesc );
 421                         }
 422                 };
 423
 424                 $opHandle = new SwiftFileOpHandle( $this, $handler, $reqs );
 425                 if ( !empty( $params['async'] ) ) { // deferred
 426                         $status->value = $opHandle;
 427                 } else { // actually write the object in Swift
 428                         $status->merge( current( $this->executeOpHandlesInternal( [ $opHandle ] ) ) );
 429                 }
 430
 431                 return $status;
 432         }
 433
 434         protected function doMoveInternal( array $params ) {
 435                 $status = $this->newStatus();
 436
 437                 list( $srcCont, $srcRel ) = $this->resolveStoragePathReal( $params['src'] );
 438                 if ( $srcRel === null ) {
 439                         $status->fatal( 'backend-fail-invalidpath', $params['src'] );
 440
 441                         return $status;
 442                 }
 443
 444                 list( $dstCont, $dstRel ) = $this->resolveStoragePathReal( $params['dst'] );
 445                 if ( $dstRel === null ) {
 446                         $status->fatal( 'backend-fail-invalidpath', $params['dst'] );
 447
 448                         return $status;
 449                 }
 450
 451                 $reqs = [
 452                         [
 453                                 'method' => 'PUT',
 454                                 'url' => [ $dstCont, $dstRel ],
 455                                 'headers' => [
 456                                         'x-copy-from' => '/' . rawurlencode( $srcCont ) .
 457                                                 '/' . str_replace( "%2F", "/", rawurlencode( $srcRel ) )
 458                                 ] + $this->sanitizeHdrsStrict( $params ) // extra headers merged into object
 459                         ]
 460                 ];
 461                 if ( "{$srcCont}/{$srcRel}" !== "{$dstCont}/{$dstRel}" ) {
 462                         $reqs[] = [
 463                                 'method' => 'DELETE',
 464                                 'url' => [ $srcCont, $srcRel ],
 465                                 'headers' => []
 466                         ];
 467                 }
 468
 469                 $method = __METHOD__;
 470                 $handler = function ( array $request, StatusValue $status ) use ( $method, $params ) {
 471                         list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $request['response'];
 472                         if ( $request['method'] === 'PUT' && $rcode === 201 ) {
 473                                 // good
 474                         } elseif ( $request['method'] === 'DELETE' && $rcode === 204 ) {
 475                                 // good
 476                         } elseif ( $rcode === 404 ) {
 477                                 $status->fatal( 'backend-fail-move', $params['src'], $params['dst'] );
 478                         } else {
 479                                 $this->onError( $status, $method, $params, $rerr, $rcode, $rdesc );
 480                         }
 481                 };
 482
 483                 $opHandle = new SwiftFileOpHandle( $this, $handler, $reqs );
 484                 if ( !empty( $params['async'] ) ) { // deferred
 485                         $status->value = $opHandle;
 486                 } else { // actually move the object in Swift
 487                         $status->merge( current( $this->executeOpHandlesInternal( [ $opHandle ] ) ) );
 488                 }
 489
 490                 return $status;
 491         }
 492
 493         protected function doDeleteInternal( array $params ) {
 494                 $status = $this->newStatus();
 495
 496                 list( $srcCont, $srcRel ) = $this->resolveStoragePathReal( $params['src'] );
 497                 if ( $srcRel === null ) {
 498                         $status->fatal( 'backend-fail-invalidpath', $params['src'] );
 499
 500                         return $status;
 501                 }
 502
 503                 $reqs = [ [
 504                         'method' => 'DELETE',
 505                         'url' => [ $srcCont, $srcRel ],
 506                         'headers' => []
 507                 ] ];
 508
 509                 $method = __METHOD__;
 510                 $handler = function ( array $request, StatusValue $status ) use ( $method, $params ) {
 511                         list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $request['response'];
 512                         if ( $rcode === 204 ) {
 513                                 // good
 514                         } elseif ( $rcode === 404 ) {
 515                                 if ( empty( $params['ignoreMissingSource'] ) ) {
 516                                         $status->fatal( 'backend-fail-delete', $params['src'] );
 517                                 }
 518                         } else {
 519                                 $this->onError( $status, $method, $params, $rerr, $rcode, $rdesc );
 520                         }
 521                 };
 522
 523                 $opHandle = new SwiftFileOpHandle( $this, $handler, $reqs );
 524                 if ( !empty( $params['async'] ) ) { // deferred
 525                         $status->value = $opHandle;
 526                 } else { // actually delete the object in Swift
 527                         $status->merge( current( $this->executeOpHandlesInternal( [ $opHandle ] ) ) );
 528                 }
 529
 530                 return $status;
 531         }
 532
 533         protected function doDescribeInternal( array $params ) {
 534                 $status = $this->newStatus();
 535
 536                 list( $srcCont, $srcRel ) = $this->resolveStoragePathReal( $params['src'] );
 537                 if ( $srcRel === null ) {
 538                         $status->fatal( 'backend-fail-invalidpath', $params['src'] );
 539
 540                         return $status;
 541                 }
 542
 543                 // Fetch the old object headers/metadata...this should be in stat cache by now
 544                 $stat = $this->getFileStat( [ 'src' => $params['src'], 'latest' => 1 ] );
 545                 if ( $stat && !isset( $stat['xattr'] ) ) { // older cache entry
 546                         $stat = $this->doGetFileStat( [ 'src' => $params['src'], 'latest' => 1 ] );
 547                 }
 548                 if ( !$stat ) {
 549                         $status->fatal( 'backend-fail-describe', $params['src'] );
 550
 551                         return $status;
 552                 }
 553
 554                 // POST clears prior headers, so we need to merge the changes in to the old ones
 555                 $metaHdrs = [];
 556                 foreach ( $stat['xattr']['metadata'] as $name => $value ) {
 557                         $metaHdrs["x-object-meta-$name"] = $value;
 558                 }
 559                 $customHdrs = $this->sanitizeHdrs( $params ) + $stat['xattr']['headers'];
 560
 561                 $reqs = [ [
 562                         'method' => 'POST',
 563                         'url' => [ $srcCont, $srcRel ],
 564                         'headers' => $metaHdrs + $customHdrs
 565                 ] ];
 566
 567                 $method = __METHOD__;
 568                 $handler = function ( array $request, StatusValue $status ) use ( $method, $params ) {
 569                         list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $request['response'];
 570                         if ( $rcode === 202 ) {
 571                                 // good
 572                         } elseif ( $rcode === 404 ) {
 573                                 $status->fatal( 'backend-fail-describe', $params['src'] );
 574                         } else {
 575                                 $this->onError( $status, $method, $params, $rerr, $rcode, $rdesc );
 576                         }
 577                 };
 578
 579                 $opHandle = new SwiftFileOpHandle( $this, $handler, $reqs );
 580                 if ( !empty( $params['async'] ) ) { // deferred
 581                         $status->value = $opHandle;
 582                 } else { // actually change the object in Swift
 583                         $status->merge( current( $this->executeOpHandlesInternal( [ $opHandle ] ) ) );
 584                 }
 585
 586                 return $status;
 587         }
 588
 589         protected function doPrepareInternal( $fullCont, $dir, array $params ) {
 590                 $status = $this->newStatus();
 591
 592                 // (a) Check if container already exists
 593                 $stat = $this->getContainerStat( $fullCont );
 594                 if ( is_array( $stat ) ) {
 595                         return $status; // already there
 596                 } elseif ( $stat === self::UNKNOWN ) {
 597                         $status->fatal( 'backend-fail-internal', $this->name );
 598                         $this->logger->error( __METHOD__ . ': cannot get container stat' );
 599
 600                         return $status;
 601                 }
 602
 603                 // (b) Create container as needed with proper ACLs
 604                 if ( $stat === false ) {
 605                         $params['op'] = 'prepare';
 606                         $status->merge( $this->createContainer( $fullCont, $params ) );
 607                 }
 608
 609                 return $status;
 610         }
 611
 612         protected function doSecureInternal( $fullCont, $dir, array $params ) {
 613                 $status = $this->newStatus();
 614                 if ( empty( $params['noAccess'] ) ) {
 615                         return $status; // nothing to do
 616                 }
 617
 618                 $stat = $this->getContainerStat( $fullCont );
 619                 if ( is_array( $stat ) ) {
 620                         $readUsers = array_merge( $this->secureReadUsers, [ $this->swiftUser ] );
 621                         $writeUsers = array_merge( $this->secureWriteUsers, [ $this->swiftUser ] );
 622                         // Make container private to end-users...
 623                         $status->merge( $this->setContainerAccess(
 624                                 $fullCont,
 625                                 $readUsers,
 626                                 $writeUsers
 627                         ) );
 628                 } elseif ( $stat === false ) {
 629                         $status->fatal( 'backend-fail-usable', $params['dir'] );
 630                 } else {
 631                         $status->fatal( 'backend-fail-internal', $this->name );
 632                         $this->logger->error( __METHOD__ . ': cannot get container stat' );
 633                 }
 634
 635                 return $status;
 636         }
 637
 638         protected function doPublishInternal( $fullCont, $dir, array $params ) {
 639                 $status = $this->newStatus();
 640
 641                 $stat = $this->getContainerStat( $fullCont );
 642                 if ( is_array( $stat ) ) {
 643                         $readUsers = array_merge( $this->readUsers, [ $this->swiftUser, '.r:*' ] );
 644                         $writeUsers = array_merge( $this->writeUsers, [ $this->swiftUser ] );
 645
 646                         // Make container public to end-users...
 647                         $status->merge( $this->setContainerAccess(
 648                                 $fullCont,
 649                                 $readUsers,
 650                                 $writeUsers
 651                         ) );
 652                 } elseif ( $stat === false ) {
 653                         $status->fatal( 'backend-fail-usable', $params['dir'] );
 654                 } else {
 655                         $status->fatal( 'backend-fail-internal', $this->name );
 656                         $this->logger->error( __METHOD__ . ': cannot get container stat' );
 657                 }
 658
 659                 return $status;
 660         }
 661
 662         protected function doCleanInternal( $fullCont, $dir, array $params ) {
 663                 $status = $this->newStatus();
 664
 665                 // Only containers themselves can be removed, all else is virtual
 666                 if ( $dir != '' ) {
 667                         return $status; // nothing to do
 668                 }
 669
 670                 // (a) Check the container
 671                 $stat = $this->getContainerStat( $fullCont, true );
 672                 if ( $stat === false ) {
 673                         return $status; // ok, nothing to do
 674                 } elseif ( !is_array( $stat ) ) {
 675                         $status->fatal( 'backend-fail-internal', $this->name );
 676                         $this->logger->error( __METHOD__ . ': cannot get container stat' );
 677
 678                         return $status;
 679                 }
 680
 681                 // (b) Delete the container if empty
 682                 if ( $stat['count'] == 0 ) {
 683                         $params['op'] = 'clean';
 684                         $status->merge( $this->deleteContainer( $fullCont, $params ) );
 685                 }
 686
 687                 return $status;
 688         }
 689
 690         protected function doGetFileStat( array $params ) {
 691                 $params = [ 'srcs' => [ $params['src'] ], 'concurrency' => 1 ] + $params;
 692                 unset( $params['src'] );
 693                 $stats = $this->doGetFileStatMulti( $params );
 694
 695                 return reset( $stats );
 696         }
 697
 698         /**
 699          * Convert dates like "Tue, 03 Jan 2012 22:01:04 GMT"/"2013-05-11T07:37:27.678360Z".
 700          * Dates might also come in like "2013-05-11T07:37:27.678360" from Swift listings,
 701          * missing the timezone suffix (though Ceph RGW does not appear to have this bug).
 702          *
 703          * @param string $ts
 704          * @param int $format Output format (TS_* constant)
 705          * @return string
 706          * @throws FileBackendError
 707          */
 708         protected function convertSwiftDate( $ts, $format = TS_MW ) {
 709                 try {
 710                         $timestamp = new MWTimestamp( $ts );
 711
 712                         return $timestamp->getTimestamp( $format );
 713                 } catch ( Exception $e ) {
 714                         throw new FileBackendError( $e->getMessage() );
 715                 }
 716         }
 717
 718         /**
 719          * Fill in any missing object metadata and save it to Swift
 720          *
 721          * @param array $objHdrs Object response headers
 722          * @param string $path Storage path to object
 723          * @return array New headers
 724          */
 725         protected function addMissingHashMetadata( array $objHdrs, $path ) {
 726                 if ( isset( $objHdrs['x-object-meta-sha1base36'] ) ) {
 727                         return $objHdrs; // nothing to do
 728                 }
 729
 730                 /** @noinspection PhpUnusedLocalVariableInspection */
 731                 $ps = $this->scopedProfileSection( __METHOD__ . "-{$this->name}" );
 732                 $this->logger->error( __METHOD__ . ": {path} was not stored with SHA-1 metadata.",
 733                         [ 'path' => $path ] );
 734
 735                 $objHdrs['x-object-meta-sha1base36'] = false;
 736
 737                 $auth = $this->getAuthentication();
 738                 if ( !$auth ) {
 739                         return $objHdrs; // failed
 740                 }
 741
 742                 // Find prior custom HTTP headers
 743                 $postHeaders = $this->getCustomHeaders( $objHdrs );
 744                 // Find prior metadata headers
 745                 $postHeaders += $this->getMetadataHeaders( $objHdrs );
 746
 747                 $status = $this->newStatus();
 748                 /** @noinspection PhpUnusedLocalVariableInspection */
 749                 $scopeLockS = $this->getScopedFileLocks( [ $path ], LockManager::LOCK_UW, $status );
 750                 if ( $status->isOK() ) {
 751                         $tmpFile = $this->getLocalCopy( [ 'src' => $path, 'latest' => 1 ] );
 752                         if ( $tmpFile ) {
 753                                 $hash = $tmpFile->getSha1Base36();
 754                                 if ( $hash !== false ) {
 755                                         $objHdrs['x-object-meta-sha1base36'] = $hash;
 756                                         // Merge new SHA1 header into the old ones
 757                                         $postHeaders['x-object-meta-sha1base36'] = $hash;
 758                                         list( $srcCont, $srcRel ) = $this->resolveStoragePathReal( $path );
 759                                         list( $rcode ) = $this->http->run( [
 760                                                 'method' => 'POST',
 761                                                 'url' => $this->storageUrl( $auth, $srcCont, $srcRel ),
 762                                                 'headers' => $this->authTokenHeaders( $auth ) + $postHeaders
 763                                         ] );
 764                                         if ( $rcode >= 200 && $rcode <= 299 ) {
 765                                                 $this->deleteFileCache( $path );
 766
 767                                                 return $objHdrs; // success
 768                                         }
 769                                 }
 770                         }
 771                 }
 772
 773                 $this->logger->error( __METHOD__ . ': unable to set SHA-1 metadata for {path}',
 774                         [ 'path' => $path ] );
 775
 776                 return $objHdrs; // failed
 777         }
 778
 779         protected function doGetFileContentsMulti( array $params ) {
 780                 $contents = [];
 781
 782                 $auth = $this->getAuthentication();
 783
 784                 $ep = array_diff_key( $params, [ 'srcs' => 1 ] ); // for error logging
 785                 // Blindly create tmp files and stream to them, catching any exception
 786                 // if the file does not exist. Do not waste time doing file stats here.
 787                 $reqs = []; // (path => op)
 788
 789                 foreach ( $params['srcs'] as $path ) { // each path in this concurrent batch
 790                         list( $srcCont, $srcRel ) = $this->resolveStoragePathReal( $path );
 791                         if ( $srcRel === null || !$auth ) {
 792                                 $contents[$path] = false;
 793                                 continue;
 794                         }
 795                         // Create a new temporary memory file...
 796                         $handle = fopen( 'php://temp', 'wb' );
 797                         if ( $handle ) {
 798                                 $reqs[$path] = [
 799                                         'method'  => 'GET',
 800                                         'url'     => $this->storageUrl( $auth, $srcCont, $srcRel ),
 801                                         'headers' => $this->authTokenHeaders( $auth )
 802                                                 + $this->headersFromParams( $params ),
 803                                         'stream'  => $handle,
 804                                 ];
 805                         }
 806                         $contents[$path] = false;
 807                 }
 808
 809                 $opts = [ 'maxConnsPerHost' => $params['concurrency'] ];
 810                 $reqs = $this->http->runMulti( $reqs, $opts );
 811                 foreach ( $reqs as $path => $op ) {
 812                         list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $op['response'];
 813                         if ( $rcode >= 200 && $rcode <= 299 ) {
 814                                 rewind( $op['stream'] ); // start from the beginning
 815                                 $contents[$path] = stream_get_contents( $op['stream'] );
 816                         } elseif ( $rcode === 404 ) {
 817                                 $contents[$path] = false;
 818                         } else {
 819                                 $this->onError( null, __METHOD__,
 820                                         [ 'src' => $path ] + $ep, $rerr, $rcode, $rdesc );
 821                         }
 822                         fclose( $op['stream'] ); // close open handle
 823                 }
 824
 825                 return $contents;
 826         }
 827
 828         protected function doDirectoryExists( $fullCont, $dir, array $params ) {
 829                 $prefix = ( $dir == '' ) ? null : "{$dir}/";
 830                 $status = $this->objectListing( $fullCont, 'names', 1, null, $prefix );
 831                 if ( $status->isOK() ) {
 832                         return ( count( $status->value ) ) > 0;
 833                 }
 834
 835                 return self::UNKNOWN; // error
 836         }
 837
 838         /**
 839          * @see FileBackendStore::getDirectoryListInternal()
 840          * @param string $fullCont
 841          * @param string $dir
 842          * @param array $params
 843          * @return SwiftFileBackendDirList
 844          */
 845         public function getDirectoryListInternal( $fullCont, $dir, array $params ) {
 846                 return new SwiftFileBackendDirList( $this, $fullCont, $dir, $params );
 847         }
 848
 849         /**
 850          * @see FileBackendStore::getFileListInternal()
 851          * @param string $fullCont
 852          * @param string $dir
 853          * @param array $params
 854          * @return SwiftFileBackendFileList
 855          */
 856         public function getFileListInternal( $fullCont, $dir, array $params ) {
 857                 return new SwiftFileBackendFileList( $this, $fullCont, $dir, $params );
 858         }
 859
 860         /**
 861          * Do not call this function outside of SwiftFileBackendFileList
 862          *
 863          * @param string $fullCont Resolved container name
 864          * @param string $dir Resolved storage directory with no trailing slash
 865          * @param string|null &$after Resolved container relative path to list items after
 866          * @param int $limit Max number of items to list
 867          * @param array $params Parameters for getDirectoryList()
 868          * @return array List of container relative resolved paths of directories directly under $dir
 869          * @throws FileBackendError
 870          */
 871         public function getDirListPageInternal( $fullCont, $dir, &$after, $limit, array $params ) {
 872                 $dirs = [];
 873                 if ( $after === INF ) {
 874                         return $dirs; // nothing more
 875                 }
 876
 877                 $ps = $this->scopedProfileSection( __METHOD__ . "-{$this->name}" );
 878
 879                 $prefix = ( $dir == '' ) ? null : "{$dir}/";
 880                 // Non-recursive: only list dirs right under $dir
 881                 if ( !empty( $params['topOnly'] ) ) {
 882                         $status = $this->objectListing( $fullCont, 'names', $limit, $after, $prefix, '/' );
 883                         if ( !$status->isOK() ) {
 884                                 throw new FileBackendError( "Iterator page I/O error." );
 885                         }
 886                         $objects = $status->value;
 887                         // @phan-suppress-next-line PhanTypeSuspiciousNonTraversableForeach
 888                         foreach ( $objects as $object ) { // files and directories
 889                                 if ( substr( $object, -1 ) === '/' ) {
 890                                         $dirs[] = $object; // directories end in '/'
 891                                 }
 892                         }
 893                 } else {
 894                         // Recursive: list all dirs under $dir and its subdirs
 895                         $getParentDir = function ( $path ) {
 896                                 return ( strpos( $path, '/' ) !== false ) ? dirname( $path ) : false;
 897                         };
 898
 899                         // Get directory from last item of prior page
 900                         $lastDir = $getParentDir( $after ); // must be first page
 901                         $status = $this->objectListing( $fullCont, 'names', $limit, $after, $prefix );
 902
 903                         if ( !$status->isOK() ) {
 904                                 throw new FileBackendError( "Iterator page I/O error." );
 905                         }
 906
 907                         $objects = $status->value;
 908
 909                         // @phan-suppress-next-line PhanTypeSuspiciousNonTraversableForeach
 910                         foreach ( $objects as $object ) { // files
 911                                 $objectDir = $getParentDir( $object ); // directory of object
 912
 913                                 if ( $objectDir !== false && $objectDir !== $dir ) {
 914                                         // Swift stores paths in UTF-8, using binary sorting.
 915                                         // See function "create_container_table" in common/db.py.
 916                                         // If a directory is not "greater" than the last one,
 917                                         // then it was already listed by the calling iterator.
 918                                         if ( strcmp( $objectDir, $lastDir ) > 0 ) {
 919                                                 $pDir = $objectDir;
 920                                                 do { // add dir and all its parent dirs
 921                                                         $dirs[] = "{$pDir}/";
 922                                                         $pDir = $getParentDir( $pDir );
 923                                                 } while ( $pDir !== false // sanity
 924                                                         && strcmp( $pDir, $lastDir ) > 0 // not done already
 925                                                         && strlen( $pDir ) > strlen( $dir ) // within $dir
 926                                                 );
 927                                         }
 928                                         $lastDir = $objectDir;
 929                                 }
 930                         }
 931                 }
 932                 // Page on the unfiltered directory listing (what is returned may be filtered)
 933                 if ( count( $objects ) < $limit ) {
 934                         $after = INF; // avoid a second RTT
 935                 } else {
 936                         $after = end( $objects ); // update last item
 937                 }
 938
 939                 return $dirs;
 940         }
 941
 942         /**
 943          * Do not call this function outside of SwiftFileBackendFileList
 944          *
 945          * @param string $fullCont Resolved container name
 946          * @param string $dir Resolved storage directory with no trailing slash
 947          * @param string|null &$after Resolved container relative path of file to list items after
 948          * @param int $limit Max number of items to list
 949          * @param array $params Parameters for getDirectoryList()
 950          * @return array List of resolved container relative paths of files under $dir
 951          * @throws FileBackendError
 952          */
 953         public function getFileListPageInternal( $fullCont, $dir, &$after, $limit, array $params ) {
 954                 $files = []; // list of (path, stat array or null) entries
 955                 if ( $after === INF ) {
 956                         return $files; // nothing more
 957                 }
 958
 959                 $ps = $this->scopedProfileSection( __METHOD__ . "-{$this->name}" );
 960
 961                 $prefix = ( $dir == '' ) ? null : "{$dir}/";
 962                 // $objects will contain a list of unfiltered names or CF_Object items
 963                 // Non-recursive: only list files right under $dir
 964                 if ( !empty( $params['topOnly'] ) ) {
 965                         if ( !empty( $params['adviseStat'] ) ) {
 966                                 $status = $this->objectListing( $fullCont, 'info', $limit, $after, $prefix, '/' );
 967                         } else {
 968                                 $status = $this->objectListing( $fullCont, 'names', $limit, $after, $prefix, '/' );
 969                         }
 970                 } else {
 971                         // Recursive: list all files under $dir and its subdirs
 972                         if ( !empty( $params['adviseStat'] ) ) {
 973                                 $status = $this->objectListing( $fullCont, 'info', $limit, $after, $prefix );
 974                         } else {
 975                                 $status = $this->objectListing( $fullCont, 'names', $limit, $after, $prefix );
 976                         }
 977                 }
 978
 979                 // Reformat this list into a list of (name, stat array or null) entries
 980                 if ( !$status->isOK() ) {
 981                         throw new FileBackendError( "Iterator page I/O error." );
 982                 }
 983
 984                 $objects = $status->value;
 985                 $files = $this->buildFileObjectListing( $params, $dir, $objects );
 986
 987                 // Page on the unfiltered object listing (what is returned may be filtered)
 988                 if ( count( $objects ) < $limit ) {
 989                         $after = INF; // avoid a second RTT
 990                 } else {
 991                         $after = end( $objects ); // update last item
 992                         $after = is_object( $after ) ? $after->name : $after;
 993                 }
 994
 995                 return $files;
 996         }
 997
 998         /**
 999          * Build a list of file objects, filtering out any directories
1000          * and extracting any stat info if provided in $objects (for CF_Objects)
1001          *
1002          * @param array $params Parameters for getDirectoryList()
1003          * @param string $dir Resolved container directory path
1004          * @param array $objects List of CF_Object items or object names
1005          * @return array List of (names,stat array or null) entries
1006          */
1007         private function buildFileObjectListing( array $params, $dir, array $objects ) {
1008                 $names = [];
1009                 foreach ( $objects as $object ) {
1010                         if ( is_object( $object ) ) {
1011                                 if ( isset( $object->subdir ) || !isset( $object->name ) ) {
1012                                         continue; // virtual directory entry; ignore
1013                                 }
1014                                 $stat = [
1015                                         // Convert various random Swift dates to TS_MW
1016                                         'mtime'  => $this->convertSwiftDate( $object->last_modified, TS_MW ),
1017                                         'size'   => (int)$object->bytes,
1018                                         'sha1'   => null,
1019                                         // Note: manifiest ETags are not an MD5 of the file
1020                                         'md5'    => ctype_xdigit( $object->hash ) ? $object->hash : null,
1021                                         'latest' => false // eventually consistent
1022                                 ];
1023                                 $names[] = [ $object->name, $stat ];
1024                         } elseif ( substr( $object, -1 ) !== '/' ) {
1025                                 // Omit directories, which end in '/' in listings
1026                                 $names[] = [ $object, null ];
1027                         }
1028                 }
1029
1030                 return $names;
1031         }
1032
1033         /**
1034          * Do not call this function outside of SwiftFileBackendFileList
1035          *
1036          * @param string $path Storage path
1037          * @param array $val Stat value
1038          */
1039         public function loadListingStatInternal( $path, array $val ) {
1040                 $this->cheapCache->setField( $path, 'stat', $val );
1041         }
1042
1043         protected function doGetFileXAttributes( array $params ) {
1044                 $stat = $this->getFileStat( $params );
1045                 if ( $stat ) {
1046                         if ( !isset( $stat['xattr'] ) ) {
1047                                 // Stat entries filled by file listings don't include metadata/headers
1048                                 $this->clearCache( [ $params['src'] ] );
1049                                 $stat = $this->getFileStat( $params );
1050                         }
1051
1052                         // @phan-suppress-next-line PhanTypeArraySuspiciousNullable
1053                         return $stat['xattr'];
1054                 } else {
1055                         return false;
1056                 }
1057         }
1058
1059         protected function doGetFileSha1base36( array $params ) {
1060                 // Avoid using stat entries from file listings, which never include the SHA-1 hash.
1061                 // Also, recompute the hash if it's not part of the metadata headers for some reason.
1062                 $params['requireSHA1'] = true;
1063
1064                 $stat = $this->getFileStat( $params );
1065                 if ( $stat ) {
1066                         return $stat['sha1'];
1067                 } else {
1068                         return false;
1069                 }
1070         }
1071
1072         protected function doStreamFile( array $params ) {
1073                 $status = $this->newStatus();
1074
1075                 $flags = !empty( $params['headless'] ) ? StreamFile::STREAM_HEADLESS : 0;
1076
1077                 list( $srcCont, $srcRel ) = $this->resolveStoragePathReal( $params['src'] );
1078                 if ( $srcRel === null ) {
1079                         StreamFile::send404Message( $params['src'], $flags );
1080                         $status->fatal( 'backend-fail-invalidpath', $params['src'] );
1081
1082                         return $status;
1083                 }
1084
1085                 $auth = $this->getAuthentication();
1086                 if ( !$auth || !is_array( $this->getContainerStat( $srcCont ) ) ) {
1087                         StreamFile::send404Message( $params['src'], $flags );
1088                         $status->fatal( 'backend-fail-stream', $params['src'] );
1089
1090                         return $status;
1091                 }
1092
1093                 // If "headers" is set, we only want to send them if the file is there.
1094                 // Do not bother checking if the file exists if headers are not set though.
1095                 if ( $params['headers'] && !$this->fileExists( $params ) ) {
1096                         StreamFile::send404Message( $params['src'], $flags );
1097                         $status->fatal( 'backend-fail-stream', $params['src'] );
1098
1099                         return $status;
1100                 }
1101
1102                 // Send the requested additional headers
1103                 foreach ( $params['headers'] as $header ) {
1104                         header( $header ); // aways send
1105                 }
1106
1107                 if ( empty( $params['allowOB'] ) ) {
1108                         // Cancel output buffering and gzipping if set
1109                         ( $this->obResetFunc )();
1110                 }
1111
1112                 $handle = fopen( 'php://output', 'wb' );
1113                 list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $this->http->run( [
1114                         'method' => 'GET',
1115                         'url' => $this->storageUrl( $auth, $srcCont, $srcRel ),
1116                         'headers' => $this->authTokenHeaders( $auth )
1117                                 + $this->headersFromParams( $params ) + $params['options'],
1118                         'stream' => $handle,
1119                         'flags'  => [ 'relayResponseHeaders' => empty( $params['headless'] ) ]
1120                 ] );
1121
1122                 if ( $rcode >= 200 && $rcode <= 299 ) {
1123                         // good
1124                 } elseif ( $rcode === 404 ) {
1125                         $status->fatal( 'backend-fail-stream', $params['src'] );
1126                         // Per T43113, nasty things can happen if bad cache entries get
1127                         // stuck in cache. It's also possible that this error can come up
1128                         // with simple race conditions. Clear out the stat cache to be safe.
1129                         $this->clearCache( [ $params['src'] ] );
1130                         $this->deleteFileCache( $params['src'] );
1131                 } else {
1132                         $this->onError( $status, __METHOD__, $params, $rerr, $rcode, $rdesc );
1133                 }
1134
1135                 return $status;
1136         }
1137
1138         protected function doGetLocalCopyMulti( array $params ) {
1139                 /** @var TempFSFile[] $tmpFiles */
1140                 $tmpFiles = [];
1141
1142                 $auth = $this->getAuthentication();
1143
1144                 $ep = array_diff_key( $params, [ 'srcs' => 1 ] ); // for error logging
1145                 // Blindly create tmp files and stream to them, catching any exception
1146                 // if the file does not exist. Do not waste time doing file stats here.
1147                 $reqs = []; // (path => op)
1148
1149                 foreach ( $params['srcs'] as $path ) { // each path in this concurrent batch
1150                         list( $srcCont, $srcRel ) = $this->resolveStoragePathReal( $path );
1151                         if ( $srcRel === null || !$auth ) {
1152                                 $tmpFiles[$path] = null;
1153                                 continue;
1154                         }
1155                         // Get source file extension
1156                         $ext = FileBackend::extensionFromPath( $path );
1157                         // Create a new temporary file...
1158                         $tmpFile = $this->tmpFileFactory->newTempFSFile( 'localcopy_', $ext );
1159                         if ( $tmpFile ) {
1160                                 $handle = fopen( $tmpFile->getPath(), 'wb' );
1161                                 if ( $handle ) {
1162                                         $reqs[$path] = [
1163                                                 'method'  => 'GET',
1164                                                 'url'     => $this->storageUrl( $auth, $srcCont, $srcRel ),
1165                                                 'headers' => $this->authTokenHeaders( $auth )
1166                                                         + $this->headersFromParams( $params ),
1167                                                 'stream'  => $handle,
1168                                         ];
1169                                 } else {
1170                                         $tmpFile = null;
1171                                 }
1172                         }
1173                         $tmpFiles[$path] = $tmpFile;
1174                 }
1175
1176                 $isLatest = ( $this->isRGW || !empty( $params['latest'] ) );
1177                 $opts = [ 'maxConnsPerHost' => $params['concurrency'] ];
1178                 $reqs = $this->http->runMulti( $reqs, $opts );
1179                 foreach ( $reqs as $path => $op ) {
1180                         list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $op['response'];
1181                         fclose( $op['stream'] ); // close open handle
1182                         if ( $rcode >= 200 && $rcode <= 299 ) {
1183                                 $size = $tmpFiles[$path] ? $tmpFiles[$path]->getSize() : 0;
1184                                 // Double check that the disk is not full/broken
1185                                 if ( $size != $rhdrs['content-length'] ) {
1186                                         $tmpFiles[$path] = null;
1187                                         $rerr = "Got {$size}/{$rhdrs['content-length']} bytes";
1188                                         $this->onError( null, __METHOD__,
1189                                                 [ 'src' => $path ] + $ep, $rerr, $rcode, $rdesc );
1190                                 }
1191                                 // Set the file stat process cache in passing
1192                                 $stat = $this->getStatFromHeaders( $rhdrs );
1193                                 $stat['latest'] = $isLatest;
1194                                 $this->cheapCache->setField( $path, 'stat', $stat );
1195                         } elseif ( $rcode === 404 ) {
1196                                 $tmpFiles[$path] = false;
1197                         } else {
1198                                 $tmpFiles[$path] = null;
1199                                 $this->onError( null, __METHOD__,
1200                                         [ 'src' => $path ] + $ep, $rerr, $rcode, $rdesc );
1201                         }
1202                 }
1203
1204                 return $tmpFiles;
1205         }
1206
1207         public function getFileHttpUrl( array $params ) {
1208                 if ( $this->swiftTempUrlKey != '' ||
1209                         ( $this->rgwS3AccessKey != '' && $this->rgwS3SecretKey != '' )
1210                 ) {
1211                         list( $srcCont, $srcRel ) = $this->resolveStoragePathReal( $params['src'] );
1212                         if ( $srcRel === null ) {
1213                                 return null; // invalid path
1214                         }
1215
1216                         $auth = $this->getAuthentication();
1217                         if ( !$auth ) {
1218                                 return null;
1219                         }
1220
1221                         $ttl = $params['ttl'] ?? 86400;
1222                         $expires = time() + $ttl;
1223
1224                         if ( $this->swiftTempUrlKey != '' ) {
1225                                 $url = $this->storageUrl( $auth, $srcCont, $srcRel );
1226                                 // Swift wants the signature based on the unencoded object name
1227                                 $contPath = parse_url( $this->storageUrl( $auth, $srcCont ), PHP_URL_PATH );
1228                                 $signature = hash_hmac( 'sha1',
1229                                         "GET\n{$expires}\n{$contPath}/{$srcRel}",
1230                                         $this->swiftTempUrlKey
1231                                 );
1232
1233                                 return "{$url}?temp_url_sig={$signature}&temp_url_expires={$expires}";
1234                         } else { // give S3 API URL for rgw
1235                                 // Path for signature starts with the bucket
1236                                 $spath = '/' . rawurlencode( $srcCont ) . '/' .
1237                                         str_replace( '%2F', '/', rawurlencode( $srcRel ) );
1238                                 // Calculate the hash
1239                                 $signature = base64_encode( hash_hmac(
1240                                         'sha1',
1241                                         "GET\n\n\n{$expires}\n{$spath}",
1242                                         $this->rgwS3SecretKey,
1243                                         true // raw
1244                                 ) );
1245                                 // See https://s3.amazonaws.com/doc/s3-developer-guide/RESTAuthentication.html.
1246                                 // Note: adding a newline for empty CanonicalizedAmzHeaders does not work.
1247                                 // Note: S3 API is the rgw default; remove the /swift/ URL bit.
1248                                 return str_replace( '/swift/v1', '', $this->storageUrl( $auth ) . $spath ) .
1249                                         '?' .
1250                                         http_build_query( [
1251                                                 'Signature' => $signature,
1252                                                 'Expires' => $expires,
1253                                                 'AWSAccessKeyId' => $this->rgwS3AccessKey
1254                                         ] );
1255                         }
1256                 }
1257
1258                 return null;
1259         }
1260
1261         protected function directoriesAreVirtual() {
1262                 return true;
1263         }
1264
1265         /**
1266          * Get headers to send to Swift when reading a file based
1267          * on a FileBackend params array, e.g. that of getLocalCopy().
1268          * $params is currently only checked for a 'latest' flag.
1269          *
1270          * @param array $params
1271          * @return array
1272          */
1273         protected function headersFromParams( array $params ) {
1274                 $hdrs = [];
1275                 if ( !empty( $params['latest'] ) ) {
1276                         $hdrs['x-newest'] = 'true';
1277                 }
1278
1279                 return $hdrs;
1280         }
1281
1282         /**
1283          * @param FileBackendStoreOpHandle[] $fileOpHandles
1284          *
1285          * @return StatusValue[]
1286          */
1287         protected function doExecuteOpHandlesInternal( array $fileOpHandles ) {
1288                 /** @var StatusValue[] $statuses */
1289                 $statuses = [];
1290
1291                 $auth = $this->getAuthentication();
1292                 if ( !$auth ) {
1293                         foreach ( $fileOpHandles as $index => $fileOpHandle ) {
1294                                 $statuses[$index] = $this->newStatus( 'backend-fail-connect', $this->name );
1295                         }
1296
1297                         return $statuses;
1298                 }
1299
1300                 // Split the HTTP requests into stages that can be done concurrently
1301                 $httpReqsByStage = []; // map of (stage => index => HTTP request)
1302                 foreach ( $fileOpHandles as $index => $fileOpHandle ) {
1303                         /** @var SwiftFileOpHandle $fileOpHandle */
1304                         $reqs = $fileOpHandle->httpOp;
1305                         // Convert the 'url' parameter to an actual URL using $auth
1306                         foreach ( $reqs as $stage => &$req ) {
1307                                 list( $container, $relPath ) = $req['url'];
1308                                 $req['url'] = $this->storageUrl( $auth, $container, $relPath );
1309                                 $req['headers'] = $req['headers'] ?? [];
1310                                 $req['headers'] = $this->authTokenHeaders( $auth ) + $req['headers'];
1311                                 $httpReqsByStage[$stage][$index] = $req;
1312                         }
1313                         $statuses[$index] = $this->newStatus();
1314                 }
1315
1316                 // Run all requests for the first stage, then the next, and so on
1317                 $reqCount = count( $httpReqsByStage );
1318                 for ( $stage = 0; $stage < $reqCount; ++$stage ) {
1319                         $httpReqs = $this->http->runMulti( $httpReqsByStage[$stage] );
1320                         foreach ( $httpReqs as $index => $httpReq ) {
1321                                 // Run the callback for each request of this operation
1322                                 $callback = $fileOpHandles[$index]->callback;
1323                                 $callback( $httpReq, $statuses[$index] );
1324                                 // On failure, abort all remaining requests for this operation
1325                                 // (e.g. abort the DELETE request if the COPY request fails for a move)
1326                                 if ( !$statuses[$index]->isOK() ) {
1327                                         $stages = count( $fileOpHandles[$index]->httpOp );
1328                                         for ( $s = ( $stage + 1 ); $s < $stages; ++$s ) {
1329                                                 unset( $httpReqsByStage[$s][$index] );
1330                                         }
1331                                 }
1332                         }
1333                 }
1334
1335                 return $statuses;
1336         }
1337
1338         /**
1339          * Set read/write permissions for a Swift container.
1340          *
1341          * @see http://docs.openstack.org/developer/swift/misc.html#acls
1342          *
1343          * In general, we don't allow listings to end-users. It's not useful, isn't well-defined
1344          * (lists are truncated to 10000 item with no way to page), and is just a performance risk.
1345          *
1346          * @param string $container Resolved Swift container
1347          * @param array $readUsers List of the possible criteria for a request to have
1348          * access to read a container. Each item is one of the following formats:
1349          *   - account:user        : Grants access if the request is by the given user
1350          *   - ".r:<regex>"        : Grants access if the request is from a referrer host that
1351          *                           matches the expression and the request is not for a listing.
1352          *                           Setting this to '*' effectively makes a container public.
1353          *   -".rlistings:<regex>" : Grants access if the request is from a referrer host that
1354          *                           matches the expression and the request is for a listing.
1355          * @param array $writeUsers A list of the possible criteria for a request to have
1356          * access to write to a container. Each item is of the following format:
1357          *   - account:user       : Grants access if the request is by the given user
1358          * @return StatusValue
1359          */
1360         protected function setContainerAccess( $container, array $readUsers, array $writeUsers ) {
1361                 $status = $this->newStatus();
1362                 $auth = $this->getAuthentication();
1363
1364                 if ( !$auth ) {
1365                         $status->fatal( 'backend-fail-connect', $this->name );
1366
1367                         return $status;
1368                 }
1369
1370                 list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $this->http->run( [
1371                         'method' => 'POST',
1372                         'url' => $this->storageUrl( $auth, $container ),
1373                         'headers' => $this->authTokenHeaders( $auth ) + [
1374                                 'x-container-read' => implode( ',', $readUsers ),
1375                                 'x-container-write' => implode( ',', $writeUsers )
1376                         ]
1377                 ] );
1378
1379                 if ( $rcode != 204 && $rcode !== 202 ) {
1380                         $status->fatal( 'backend-fail-internal', $this->name );
1381                         $this->logger->error( __METHOD__ . ': unexpected rcode value ({rcode})',
1382                                 [ 'rcode' => $rcode ] );
1383                 }
1384
1385                 return $status;
1386         }
1387
1388         /**
1389          * Get a Swift container stat array, possibly from process cache.
1390          * Use $reCache if the file count or byte count is needed.
1391          *
1392          * @param string $container Container name
1393          * @param bool $bypassCache Bypass all caches and load from Swift
1394          * @return array|bool|null False on 404, null on failure
1395          */
1396         protected function getContainerStat( $container, $bypassCache = false ) {
1397                 $ps = $this->scopedProfileSection( __METHOD__ . "-{$this->name}" );
1398
1399                 if ( $bypassCache ) { // purge cache
1400                         $this->containerStatCache->clear( $container );
1401                 } elseif ( !$this->containerStatCache->hasField( $container, 'stat' ) ) {
1402                         $this->primeContainerCache( [ $container ] ); // check persistent cache
1403                 }
1404                 if ( !$this->containerStatCache->hasField( $container, 'stat' ) ) {
1405                         $auth = $this->getAuthentication();
1406                         if ( !$auth ) {
1407                                 return self::UNKNOWN;
1408                         }
1409
1410                         list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $this->http->run( [
1411                                 'method' => 'HEAD',
1412                                 'url' => $this->storageUrl( $auth, $container ),
1413                                 'headers' => $this->authTokenHeaders( $auth )
1414                         ] );
1415
1416                         if ( $rcode === 204 ) {
1417                                 $stat = [
1418                                         'count' => $rhdrs['x-container-object-count'],
1419                                         'bytes' => $rhdrs['x-container-bytes-used']
1420                                 ];
1421                                 if ( $bypassCache ) {
1422                                         return $stat;
1423                                 } else {
1424                                         $this->containerStatCache->setField( $container, 'stat', $stat ); // cache it
1425                                         $this->setContainerCache( $container, $stat ); // update persistent cache
1426                                 }
1427                         } elseif ( $rcode === 404 ) {
1428                                 return false;
1429                         } else {
1430                                 $this->onError( null, __METHOD__,
1431                                         [ 'cont' => $container ], $rerr, $rcode, $rdesc );
1432
1433                                 return self::UNKNOWN;
1434                         }
1435                 }
1436
1437                 return $this->containerStatCache->getField( $container, 'stat' );
1438         }
1439
1440         /**
1441          * Create a Swift container
1442          *
1443          * @param string $container Container name
1444          * @param array $params
1445          * @return StatusValue
1446          */
1447         protected function createContainer( $container, array $params ) {
1448                 $status = $this->newStatus();
1449
1450                 $auth = $this->getAuthentication();
1451                 if ( !$auth ) {
1452                         $status->fatal( 'backend-fail-connect', $this->name );
1453
1454                         return $status;
1455                 }
1456
1457                 // @see SwiftFileBackend::setContainerAccess()
1458                 if ( empty( $params['noAccess'] ) ) {
1459                         // public
1460                         $readUsers = array_merge( $this->readUsers, [ '.r:*', $this->swiftUser ] );
1461                         $writeUsers = array_merge( $this->writeUsers, [ $this->swiftUser ] );
1462                 } else {
1463                         // private
1464                         $readUsers = array_merge( $this->secureReadUsers, [ $this->swiftUser ] );
1465                         $writeUsers = array_merge( $this->secureWriteUsers, [ $this->swiftUser ] );
1466                 }
1467
1468                 list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $this->http->run( [
1469                         'method' => 'PUT',
1470                         'url' => $this->storageUrl( $auth, $container ),
1471                         'headers' => $this->authTokenHeaders( $auth ) + [
1472                                 'x-container-read' => implode( ',', $readUsers ),
1473                                 'x-container-write' => implode( ',', $writeUsers )
1474                         ]
1475                 ] );
1476
1477                 if ( $rcode === 201 ) { // new
1478                         // good
1479                 } elseif ( $rcode === 202 ) { // already there
1480                         // this shouldn't really happen, but is OK
1481                 } else {
1482                         $this->onError( $status, __METHOD__, $params, $rerr, $rcode, $rdesc );
1483                 }
1484
1485                 return $status;
1486         }
1487
1488         /**
1489          * Delete a Swift container
1490          *
1491          * @param string $container Container name
1492          * @param array $params
1493          * @return StatusValue
1494          */
1495         protected function deleteContainer( $container, array $params ) {
1496                 $status = $this->newStatus();
1497
1498                 $auth = $this->getAuthentication();
1499                 if ( !$auth ) {
1500                         $status->fatal( 'backend-fail-connect', $this->name );
1501
1502                         return $status;
1503                 }
1504
1505                 list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $this->http->run( [
1506                         'method' => 'DELETE',
1507                         'url' => $this->storageUrl( $auth, $container ),
1508                         'headers' => $this->authTokenHeaders( $auth )
1509                 ] );
1510
1511                 if ( $rcode >= 200 && $rcode <= 299 ) { // deleted
1512                         $this->containerStatCache->clear( $container ); // purge
1513                 } elseif ( $rcode === 404 ) { // not there
1514                         // this shouldn't really happen, but is OK
1515                 } elseif ( $rcode === 409 ) { // not empty
1516                         $this->onError( $status, __METHOD__, $params, $rerr, $rcode, $rdesc ); // race?
1517                 } else {
1518                         $this->onError( $status, __METHOD__, $params, $rerr, $rcode, $rdesc );
1519                 }
1520
1521                 return $status;
1522         }
1523
1524         /**
1525          * Get a list of objects under a container.
1526          * Either just the names or a list of stdClass objects with details can be returned.
1527          *
1528          * @param string $fullCont
1529          * @param string $type ('info' for a list of object detail maps, 'names' for names only)
1530          * @param int $limit
1531          * @param string|null $after
1532          * @param string|null $prefix
1533          * @param string|null $delim
1534          * @return StatusValue With the list as value
1535          */
1536         private function objectListing(
1537                 $fullCont, $type, $limit, $after = null, $prefix = null, $delim = null
1538         ) {
1539                 $status = $this->newStatus();
1540
1541                 $auth = $this->getAuthentication();
1542                 if ( !$auth ) {
1543                         $status->fatal( 'backend-fail-connect', $this->name );
1544
1545                         return $status;
1546                 }
1547
1548                 $query = [ 'limit' => $limit ];
1549                 if ( $type === 'info' ) {
1550                         $query['format'] = 'json';
1551                 }
1552                 if ( $after !== null ) {
1553                         $query['marker'] = $after;
1554                 }
1555                 if ( $prefix !== null ) {
1556                         $query['prefix'] = $prefix;
1557                 }
1558                 if ( $delim !== null ) {
1559                         $query['delimiter'] = $delim;
1560                 }
1561
1562                 list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $this->http->run( [
1563                         'method' => 'GET',
1564                         'url' => $this->storageUrl( $auth, $fullCont ),
1565                         'query' => $query,
1566                         'headers' => $this->authTokenHeaders( $auth )
1567                 ] );
1568
1569                 $params = [ 'cont' => $fullCont, 'prefix' => $prefix, 'delim' => $delim ];
1570                 if ( $rcode === 200 ) { // good
1571                         if ( $type === 'info' ) {
1572                                 $status->value = FormatJson::decode( trim( $rbody ) );
1573                         } else {
1574                                 $status->value = explode( "\n", trim( $rbody ) );
1575                         }
1576                 } elseif ( $rcode === 204 ) {
1577                         $status->value = []; // empty container
1578                 } elseif ( $rcode === 404 ) {
1579                         $status->value = []; // no container
1580                 } else {
1581                         $this->onError( $status, __METHOD__, $params, $rerr, $rcode, $rdesc );
1582                 }
1583
1584                 return $status;
1585         }
1586
1587         protected function doPrimeContainerCache( array $containerInfo ) {
1588                 foreach ( $containerInfo as $container => $info ) {
1589                         $this->containerStatCache->setField( $container, 'stat', $info );
1590                 }
1591         }
1592
1593         protected function doGetFileStatMulti( array $params ) {
1594                 $stats = [];
1595
1596                 $auth = $this->getAuthentication();
1597
1598                 $reqs = [];
1599                 foreach ( $params['srcs'] as $path ) {
1600                         list( $srcCont, $srcRel ) = $this->resolveStoragePathReal( $path );
1601                         if ( $srcRel === null ) {
1602                                 $stats[$path] = false;
1603                                 continue; // invalid storage path
1604                         } elseif ( !$auth ) {
1605                                 $stats[$path] = self::UNKNOWN;
1606                                 continue;
1607                         }
1608
1609                         // (a) Check the container
1610                         $cstat = $this->getContainerStat( $srcCont );
1611                         if ( $cstat === false ) {
1612                                 $stats[$path] = false;
1613                                 continue; // ok, nothing to do
1614                         } elseif ( !is_array( $cstat ) ) {
1615                                 $stats[$path] = self::UNKNOWN;
1616                                 continue;
1617                         }
1618
1619                         $reqs[$path] = [
1620                                 'method'  => 'HEAD',
1621                                 'url'     => $this->storageUrl( $auth, $srcCont, $srcRel ),
1622                                 'headers' => $this->authTokenHeaders( $auth ) + $this->headersFromParams( $params )
1623                         ];
1624                 }
1625
1626                 $opts = [ 'maxConnsPerHost' => $params['concurrency'] ];
1627                 $reqs = $this->http->runMulti( $reqs, $opts );
1628
1629                 foreach ( $params['srcs'] as $path ) {
1630                         if ( array_key_exists( $path, $stats ) ) {
1631                                 continue; // some sort of failure above
1632                         }
1633                         // (b) Check the file
1634                         list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $reqs[$path]['response'];
1635                         if ( $rcode === 200 || $rcode === 204 ) {
1636                                 // Update the object if it is missing some headers
1637                                 if ( !empty( $params['requireSHA1'] ) ) {
1638                                         $rhdrs = $this->addMissingHashMetadata( $rhdrs, $path );
1639                                 }
1640                                 // Load the stat array from the headers
1641                                 $stat = $this->getStatFromHeaders( $rhdrs );
1642                                 if ( $this->isRGW ) {
1643                                         $stat['latest'] = true; // strong consistency
1644                                 }
1645                         } elseif ( $rcode === 404 ) {
1646                                 $stat = false;
1647                         } else {
1648                                 $stat = self::UNKNOWN;
1649                                 $this->onError( null, __METHOD__, $params, $rerr, $rcode, $rdesc );
1650                         }
1651                         $stats[$path] = $stat;
1652                 }
1653
1654                 return $stats;
1655         }
1656
1657         /**
1658          * @param array $rhdrs
1659          * @return array
1660          */
1661         protected function getStatFromHeaders( array $rhdrs ) {
1662                 // Fetch all of the custom metadata headers
1663                 $metadata = $this->getMetadata( $rhdrs );
1664                 // Fetch all of the custom raw HTTP headers
1665                 $headers = $this->sanitizeHdrs( [ 'headers' => $rhdrs ] );
1666
1667                 return [
1668                         // Convert various random Swift dates to TS_MW
1669                         'mtime' => $this->convertSwiftDate( $rhdrs['last-modified'], TS_MW ),
1670                         // Empty objects actually return no content-length header in Ceph
1671                         'size'  => isset( $rhdrs['content-length'] ) ? (int)$rhdrs['content-length'] : 0,
1672                         'sha1'  => $metadata['sha1base36'] ?? null,
1673                         // Note: manifiest ETags are not an MD5 of the file
1674                         'md5'   => ctype_xdigit( $rhdrs['etag'] ) ? $rhdrs['etag'] : null,
1675                         'xattr' => [ 'metadata' => $metadata, 'headers' => $headers ]
1676                 ];
1677         }
1678
1679         /**
1680          * @return array|null Credential map
1681          */
1682         protected function getAuthentication() {
1683                 if ( $this->authErrorTimestamp !== null ) {
1684                         if ( ( time() - $this->authErrorTimestamp ) < 60 ) {
1685                                 return null; // failed last attempt; don't bother
1686                         } else { // actually retry this time
1687                                 $this->authErrorTimestamp = null;
1688                         }
1689                 }
1690                 // Session keys expire after a while, so we renew them periodically
1691                 $reAuth = ( ( time() - $this->authSessionTimestamp ) > $this->authTTL );
1692                 // Authenticate with proxy and get a session key...
1693                 if ( !$this->authCreds || $reAuth ) {
1694                         $this->authSessionTimestamp = 0;
1695                         $cacheKey = $this->getCredsCacheKey( $this->swiftUser );
1696                         $creds = $this->srvCache->get( $cacheKey ); // credentials
1697                         // Try to use the credential cache
1698                         if ( isset( $creds['auth_token'] ) && isset( $creds['storage_url'] ) ) {
1699                                 $this->authCreds = $creds;
1700                                 // Skew the timestamp for worst case to avoid using stale credentials
1701                                 $this->authSessionTimestamp = time() - ceil( $this->authTTL / 2 );
1702                         } else { // cache miss
1703                                 list( $rcode, $rdesc, $rhdrs, $rbody, $rerr ) = $this->http->run( [
1704                                         'method' => 'GET',
1705                                         'url' => "{$this->swiftAuthUrl}/v1.0",
1706                                         'headers' => [
1707                                                 'x-auth-user' => $this->swiftUser,
1708                                                 'x-auth-key' => $this->swiftKey
1709                                         ]
1710                                 ] );
1711
1712                                 if ( $rcode >= 200 && $rcode <= 299 ) { // OK
1713                                         $this->authCreds = [
1714                                                 'auth_token' => $rhdrs['x-auth-token'],
1715                                                 'storage_url' => $this->swiftStorageUrl ?? $rhdrs['x-storage-url']
1716                                         ];
1717
1718                                         $this->srvCache->set( $cacheKey, $this->authCreds, ceil( $this->authTTL / 2 ) );
1719                                         $this->authSessionTimestamp = time();
1720                                 } elseif ( $rcode === 401 ) {
1721                                         $this->onError( null, __METHOD__, [], "Authentication failed.", $rcode );
1722                                         $this->authErrorTimestamp = time();
1723
1724                                         return null;
1725                                 } else {
1726                                         $this->onError( null, __METHOD__, [], "HTTP return code: $rcode", $rcode );
1727                                         $this->authErrorTimestamp = time();
1728
1729                                         return null;
1730                                 }
1731                         }
1732                         // Ceph RGW does not use <account> in URLs (OpenStack Swift uses "/v1/<account>")
1733                         if ( substr( $this->authCreds['storage_url'], -3 ) === '/v1' ) {
1734                                 $this->isRGW = true; // take advantage of strong consistency in Ceph
1735                         }
1736                 }
1737
1738                 return $this->authCreds;
1739         }
1740
1741         /**
1742          * @param array $creds From getAuthentication()
1743          * @param string|null $container
1744          * @param string|null $object
1745          * @return string
1746          */
1747         protected function storageUrl( array $creds, $container = null, $object = null ) {
1748                 $parts = [ $creds['storage_url'] ];
1749                 if ( strlen( $container ) ) {
1750                         $parts[] = rawurlencode( $container );
1751                 }
1752                 if ( strlen( $object ) ) {
1753                         $parts[] = str_replace( "%2F", "/", rawurlencode( $object ) );
1754                 }
1755
1756                 return implode( '/', $parts );
1757         }
1758
1759         /**
1760          * @param array $creds From getAuthentication()
1761          * @return array
1762          */
1763         protected function authTokenHeaders( array $creds ) {
1764                 return [ 'x-auth-token' => $creds['auth_token'] ];
1765         }
1766
1767         /**
1768          * Get the cache key for a container
1769          *
1770          * @param string $username
1771          * @return string
1772          */
1773         private function getCredsCacheKey( $username ) {
1774                 return 'swiftcredentials:' . md5( $username . ':' . $this->swiftAuthUrl );
1775         }
1776
1777         /**
1778          * Log an unexpected exception for this backend.
1779          * This also sets the StatusValue object to have a fatal error.
1780          *
1781          * @param StatusValue|null $status
1782          * @param string $func
1783          * @param array $params
1784          * @param string $err Error string
1785          * @param int $code HTTP status
1786          * @param string $desc HTTP StatusValue description
1787          */
1788         public function onError( $status, $func, array $params, $err = '', $code = 0, $desc = '' ) {
1789                 if ( $status instanceof StatusValue ) {
1790                         $status->fatal( 'backend-fail-internal', $this->name );
1791                 }
1792                 if ( $code == 401 ) { // possibly a stale token
1793                         $this->srvCache->delete( $this->getCredsCacheKey( $this->swiftUser ) );
1794                 }
1795                 $msg = "HTTP {code} ({desc}) in '{func}' (given '{req_params}')";
1796                 $msgParams = [
1797                         'code'   => $code,
1798                         'desc'   => $desc,
1799                         'func'   => $func,
1800                         'req_params' => FormatJson::encode( $params ),
1801                 ];
1802                 if ( $err ) {
1803                         $msg .= ': {err}';
1804                         $msgParams['err'] = $err;
1805                 }
1806                 $this->logger->error( $msg, $msgParams );
1807         }
1808 }