Upstream versity/versitygw state of the touched files before 1a2bd1ad85
This commit is contained in:
upstream committed
1 parent
cd3095d5b7
commit
1b64a938ab
4 files changed
+1230
No files matched your search
@@ -0,0 +1,171 @@
|
||||
// Copyright 2023 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package utils
|
||||
|
||||
import (
|
||||
"crypto/hmac"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"time"
|
||||
|
||||
"github.com/gofiber/fiber/v3"
|
||||
"github.com/versity/versitygw/internal/sigv4auth"
|
||||
"github.com/versity/versitygw/s3err"
|
||||
)
|
||||
|
||||
const (
|
||||
iso8601Format = sigv4auth.ISO8601Format
|
||||
yyyymmdd = sigv4auth.YYYYMMDD
|
||||
)
|
||||
|
||||
func HexBytes(s string) string {
|
||||
return sigv4auth.HexBytes(s)
|
||||
}
|
||||
|
||||
const (
|
||||
service = sigv4auth.ServiceS3
|
||||
)
|
||||
|
||||
// CheckValidSignature validates the ctx v4 auth signature against
|
||||
// derivedKey — the request's kSigning value, either derived locally from a
|
||||
// known secret or obtained from a standalone IAM service that never reveals
|
||||
// the secret itself.
|
||||
func CheckValidSignature(ctx fiber.Ctx, auth AuthData, derivedKey []byte, checksum string, tdate time.Time, contentLen int64) (string, error) {
|
||||
result, err := sigv4auth.CheckSignature(ctx, auth, derivedKey, checksum, tdate, contentLen, sigv4auth.CheckOptions{
|
||||
Service: service,
|
||||
})
|
||||
if err != nil {
|
||||
return "", mapSigV4Error(err)
|
||||
}
|
||||
|
||||
return result.CanonicalString, nil
|
||||
}
|
||||
|
||||
// AuthData is the parsed authorization data from the header.
|
||||
type AuthData = sigv4auth.AuthData
|
||||
|
||||
// ParseAuthorization returns the parsed fields for the aws v4 auth header
|
||||
// example authorization string from aws docs:
|
||||
// Authorization: AWS4-HMAC-SHA256
|
||||
// Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/s3/aws4_request,
|
||||
// SignedHeaders=host;range;x-amz-date,
|
||||
// Signature=fe5f80f77d5fa3beca038a248ff027d0445342fe2855ddc963176630326f1024
|
||||
func ParseAuthorization(authorization string) (AuthData, error) {
|
||||
authData, err := sigv4auth.ParseAuthorization(authorization, service)
|
||||
if err != nil {
|
||||
return AuthData{}, mapSigV4Error(err)
|
||||
}
|
||||
return authData, nil
|
||||
}
|
||||
|
||||
type CredentialsScope = sigv4auth.CredentialsScope
|
||||
|
||||
type CredsError interface {
|
||||
MalformedCredential(string) s3err.S3Error
|
||||
IncorrectService(string, string) s3err.S3Error
|
||||
IncorrectTerminal(string, string) s3err.S3Error
|
||||
InvalidDateFormat(string, string) s3err.S3Error
|
||||
}
|
||||
|
||||
func ParseCredentials(input string, errHandler CredsError) (*CredentialsScope, error) {
|
||||
creds, err := sigv4auth.ParseCredentials(input, service)
|
||||
if err != nil {
|
||||
return nil, mapCredentialsError(input, err, errHandler)
|
||||
}
|
||||
return creds, nil
|
||||
}
|
||||
|
||||
// SignPostPolicy signs a POST-policy document with derivedKey
|
||||
func SignPostPolicy(base64Policy string, derivedKey []byte) (string, error) {
|
||||
h := hmac.New(sha256.New, derivedKey)
|
||||
h.Write([]byte(base64Policy))
|
||||
return hex.EncodeToString(h.Sum(nil)), nil
|
||||
}
|
||||
|
||||
func mapSigV4Error(err error) error {
|
||||
var parseErr *sigv4auth.ParseError
|
||||
if errors.As(err, &parseErr) {
|
||||
return mapAuthParseError(parseErr)
|
||||
}
|
||||
|
||||
var headersErr *sigv4auth.HeadersNotSignedError
|
||||
if errors.As(err, &headersErr) {
|
||||
return s3err.GetHeadersNotSignedErr(headersErr.Headers)
|
||||
}
|
||||
|
||||
var sigErr *sigv4auth.SignatureMismatchError
|
||||
if errors.As(err, &sigErr) {
|
||||
return s3err.GetSignatureDoesNotMatchErr(
|
||||
sigErr.AccessKeyID,
|
||||
sigErr.StringToSign,
|
||||
sigErr.SignatureProvided,
|
||||
sigErr.StringToSignBytes,
|
||||
sigErr.CanonicalRequest,
|
||||
sigErr.CanonicalRequestBytes,
|
||||
)
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
func mapAuthParseError(err *sigv4auth.ParseError) error {
|
||||
switch err.Kind {
|
||||
case sigv4auth.ErrInvalidAuthorizationHeader:
|
||||
return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthHeader, err.Input)
|
||||
case sigv4auth.ErrUnsupportedAuthorizationVersion:
|
||||
return s3err.GetAPIError(s3err.ErrUnsupportedAuthorizationMechanism)
|
||||
case sigv4auth.ErrInvalidAuthorizationType:
|
||||
return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Value)
|
||||
case sigv4auth.ErrMissingComponents:
|
||||
return s3err.MalformedAuth.MissingComponents()
|
||||
case sigv4auth.ErrMissingCredential:
|
||||
return s3err.MalformedAuth.MissingCredential()
|
||||
case sigv4auth.ErrMissingSignedHeaders:
|
||||
return s3err.MalformedAuth.MissingSignedHeaders()
|
||||
case sigv4auth.ErrMissingSignature:
|
||||
return s3err.MalformedAuth.MissingSignature()
|
||||
case sigv4auth.ErrMalformedComponent:
|
||||
return s3err.MalformedAuth.MalformedComponent(err.Value)
|
||||
default:
|
||||
return mapCredentialsParseError(err, s3err.MalformedAuth)
|
||||
}
|
||||
}
|
||||
|
||||
func mapCredentialsError(input string, err error, errHandler CredsError) error {
|
||||
var parseErr *sigv4auth.ParseError
|
||||
if !errors.As(err, &parseErr) {
|
||||
return err
|
||||
}
|
||||
if parseErr.Input == "" {
|
||||
parseErr.Input = input
|
||||
}
|
||||
return mapCredentialsParseError(parseErr, errHandler)
|
||||
}
|
||||
|
||||
func mapCredentialsParseError(err *sigv4auth.ParseError, errHandler CredsError) error {
|
||||
switch err.Kind {
|
||||
case sigv4auth.ErrMalformedCredential:
|
||||
return errHandler.MalformedCredential(err.Input)
|
||||
case sigv4auth.ErrIncorrectService:
|
||||
return errHandler.IncorrectService(err.Input, err.Actual)
|
||||
case sigv4auth.ErrIncorrectTerminal:
|
||||
return errHandler.IncorrectTerminal(err.Input, err.Actual)
|
||||
case sigv4auth.ErrInvalidDateFormat:
|
||||
return errHandler.InvalidDateFormat(err.Input, err.Value)
|
||||
default:
|
||||
return err
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,146 @@
|
||||
// Copyright 2023 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package utils
|
||||
|
||||
import (
|
||||
"net"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/gofiber/fiber/v3"
|
||||
"github.com/valyala/fasthttp"
|
||||
"github.com/valyala/fasthttp/fasthttputil"
|
||||
"github.com/versity/versitygw/internal/sigv4auth"
|
||||
)
|
||||
|
||||
func TestAuthParse(t *testing.T) {
|
||||
vectors := []struct {
|
||||
name string // name of test string
|
||||
authstr string // Authorization string
|
||||
algo string
|
||||
sig string
|
||||
}{
|
||||
{
|
||||
name: "restic",
|
||||
authstr: "AWS4-HMAC-SHA256 Credential=user/20240116/us-east-1/s3/aws4_request,SignedHeaders=content-md5;host;x-amz-content-sha256;x-amz-date;x-amz-decoded-content-length,Signature=d5199fc7f3aa35dd3d400427be2ae4c98bfad390785280cbb9eea015b51e12ac",
|
||||
algo: "AWS4-HMAC-SHA256",
|
||||
sig: "d5199fc7f3aa35dd3d400427be2ae4c98bfad390785280cbb9eea015b51e12ac",
|
||||
},
|
||||
{
|
||||
name: "aws eaxample",
|
||||
authstr: "AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/s3/aws4_request, SignedHeaders=host;range;x-amz-date, Signature=fe5f80f77d5fa3beca038a248ff027d0445342fe2855ddc963176630326f1024",
|
||||
algo: "AWS4-HMAC-SHA256",
|
||||
sig: "fe5f80f77d5fa3beca038a248ff027d0445342fe2855ddc963176630326f1024",
|
||||
},
|
||||
{
|
||||
name: "s3browser",
|
||||
authstr: "AWS4-HMAC-SHA256 Credential=access_key/20240206/us-east-1/s3/aws4_request,SignedHeaders=host;user-agent;x-amz-content-sha256;x-amz-date, Signature=37a35d96998d786113ad420c57c22c5433f6aca74f88f26566caa047fc3601c6",
|
||||
algo: "AWS4-HMAC-SHA256",
|
||||
sig: "37a35d96998d786113ad420c57c22c5433f6aca74f88f26566caa047fc3601c6",
|
||||
},
|
||||
}
|
||||
|
||||
for _, v := range vectors {
|
||||
t.Run(v.name, func(t *testing.T) {
|
||||
data, err := ParseAuthorization(v.authstr)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if data.Algorithm != v.algo {
|
||||
t.Errorf("algo got %v, expected %v", data.Algorithm, v.algo)
|
||||
}
|
||||
if data.Signature != v.sig {
|
||||
t.Errorf("signature got %v, expected %v", data.Signature, v.sig)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// 2024/02/06 21:03:28 Request headers:
|
||||
// 2024/02/06 21:03:28 Host: 172.21.0.160:11000
|
||||
// 2024/02/06 21:03:28 User-Agent: S3 Browser/11.5.7 (https://s3browser.com)
|
||||
// 2024/02/06 21:03:28 Authorization: AWS4-HMAC-SHA256 Credential=access_key/20240206/us-east-1/s3/aws4_request,SignedHeaders=host;user-agent;x-amz-content-sha256;x-amz-date, Signature=37a35d96998d786113ad420c57c22c5433f6aca74f88f26566caa047fc3601c6
|
||||
// 2024/02/06 21:03:28 X-Amz-Content-Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
||||
// 2024/02/06 21:03:28 X-Amz-Date: 20240206T210328Z
|
||||
func Test_Client_UserAgent(t *testing.T) {
|
||||
signedHdrs := []string{"host", "user-agent", "x-amz-content-sha256", "x-amz-date"}
|
||||
access := "access_key"
|
||||
secret := "secret_key"
|
||||
region := "us-east-1"
|
||||
host := "172.21.0.160:11000"
|
||||
agent := "S3 Browser/11.5.7 (https://s3browser.com)"
|
||||
expectedSig := "37a35d96998d786113ad420c57c22c5433f6aca74f88f26566caa047fc3601c6"
|
||||
dateStr := "20240206T210328Z"
|
||||
|
||||
app := fiber.New(fiber.Config{})
|
||||
|
||||
tdate, err := time.Parse(iso8601Format, dateStr)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
app.Get("/", func(c fiber.Ctx) error {
|
||||
auth := sigv4auth.AuthData{
|
||||
Access: access,
|
||||
Region: region,
|
||||
Service: service,
|
||||
SignedHeaders: strings.Join(signedHdrs, ";"),
|
||||
Signature: expectedSig,
|
||||
}
|
||||
derivedKey := sigv4auth.DeriveKey(secret, dateStr[:8], region, service)
|
||||
opts := sigv4auth.CheckOptions{DisableURIPathEscaping: true}
|
||||
contentLen := int64(c.Request().Header.ContentLength())
|
||||
|
||||
if _, err := sigv4auth.CheckSignature(c, auth, derivedKey, zeroLenSig, tdate, contentLen, opts); err != nil {
|
||||
t.Errorf("CheckSignature: %v", err)
|
||||
}
|
||||
|
||||
return c.Send(c.Request().Header.UserAgent())
|
||||
})
|
||||
|
||||
ln := fasthttputil.NewInmemoryListener()
|
||||
go func() {
|
||||
err := app.Listener(ln)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
}()
|
||||
|
||||
client := fasthttp.Client{
|
||||
Dial: func(_ string) (net.Conn, error) { return ln.Dial() },
|
||||
}
|
||||
|
||||
req := fasthttp.AcquireRequest()
|
||||
resp := fasthttp.AcquireResponse()
|
||||
defer fasthttp.ReleaseRequest(req)
|
||||
defer fasthttp.ReleaseResponse(resp)
|
||||
|
||||
// Host/User-Agent/X-Amz-Content-Sha256/X-Amz-Date are sent as real
|
||||
// headers, reproducing the captured request verbatim, so CheckSignature
|
||||
// extracts them straight off the live fiber.Ctx like it does for any
|
||||
// real request.
|
||||
req.SetRequestURI("http://" + host + "/")
|
||||
req.Header.SetUserAgent(agent)
|
||||
req.Header.Set("X-Amz-Content-Sha256", zeroLenSig)
|
||||
req.Header.Set("X-Amz-Date", dateStr)
|
||||
if err := client.Do(req, resp); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if got := string(resp.Body()); got != agent {
|
||||
t.Errorf("user-agent got %q, expected %q", got, agent)
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user