Merge pull request #2389 from dualfroz/fix-illegal-location-constraint

Return IllegalLocationConstraintException for a mismatched LocationConstraint

s3api/controllers/bucket-put.go

@@ -658,18 +658,19 @@ func (c S3ApiController) CreateBucket(ctx fiber.Ctx) (*Response, error) {
 				},
 			}, s3err.GetAPIError(s3err.ErrMalformedXML)
 		}
+	}
 
-		if body.LocationConstraint != nil {
-			region := utils.ContextKeyRegion.Get(ctx).(string)
-			if *body.LocationConstraint != region || *body.LocationConstraint == "us-east-1" {
-				debuglogger.Logf("invalid location constraint: %s", *body.LocationConstraint)
-				return &Response{
-					MetaOpts: &MetaOptions{
-						BucketOwner: bucketOwner.Access,
-					},
-				}, s3err.GetInvalidLocationConstraintErr(*body.LocationConstraint)
-			}
-		}
+	region, ok := utils.ContextKeyRegion.Get(ctx).(string)
+	if !ok {
+		region = defaultRegion
+	}
+
+	if err := utils.ValidateLocationConstraint(body.LocationConstraint, region); err != nil {
+		return &Response{
+			MetaOpts: &MetaOptions{
+				BucketOwner: bucketOwner.Access,
+			},
+		}, err
 	}
 
 	defACL := auth.ACL{

s3api/controllers/bucket-put_test.go

@@ -726,6 +726,11 @@ func TestS3ApiController_CreateBucket(t *testing.T) {
 	})
 	assert.NoError(t, err)
 
+	euLocConstBody, err := xml.Marshal(s3response.CreateBucketConfiguration{
+		LocationConstraint: utils.GetStringPtr("eu-central-1"),
+	})
+	assert.NoError(t, err)
+
 	tests := []struct {
 		name   string
 		input  testInput
@@ -812,6 +817,59 @@ func TestS3ApiController_CreateBucket(t *testing.T) {
 				err: s3err.GetInvalidLocationConstraintErr("us-west-1"),
 			},
 		},
+		{
+			name: "illegal location constraint",
+			input: testInput{
+				locals: map[utils.ContextKey]any{
+					utils.ContextKeyAccount: adminAcc,
+					utils.ContextKeyRegion:  "us-west-1",
+				},
+				body: euLocConstBody,
+			},
+			output: testOutput{
+				response: &Response{
+					MetaOpts: &MetaOptions{BucketOwner: adminAcc.Access},
+				},
+				err: s3err.GetIllegalLocationConstraintErr("eu-central-1"),
+			},
+		},
+		{
+			name: "missing location constraint",
+			input: testInput{
+				locals: map[utils.ContextKey]any{
+					utils.ContextKeyAccount: adminAcc,
+					utils.ContextKeyRegion:  "us-west-1",
+				},
+			},
+			output: testOutput{
+				response: &Response{
+					MetaOpts: &MetaOptions{BucketOwner: adminAcc.Access},
+				},
+				err: s3err.GetIllegalLocationConstraintErr(""),
+			},
+		},
+		{
+			name: "matching location constraint",
+			input: testInput{
+				locals: map[utils.ContextKey]any{
+					utils.ContextKeyAccount: adminAcc,
+					utils.ContextKeyRegion:  "us-west-1",
+				},
+				bucket: "my-bucket",
+				body:   invLocConstBody,
+			},
+			output: testOutput{
+				response: &Response{
+					MetaOpts: &MetaOptions{
+						BucketOwner: adminAcc.Access,
+					},
+					Headers: map[string]*string{
+						"Location":         utils.GetStringPtr("/my-bucket"),
+						"x-amz-bucket-arn": utils.GetStringPtr("arn:aws:s3:::my-bucket"),
+					},
+				},
+			},
+		},
 		{
 			name: "invalid ownership",
 			input: testInput{

s3api/utils/utils.go

@@ -1086,3 +1086,29 @@ func DetectResourceType(ctx fiber.Ctx) s3err.ResourceType {
 
 	return s3err.ResourceTypeObject
 }
+
+// ValidateLocationConstraint checks a CreateBucket location constraint. The
+// global endpoint serves us-east-1 and takes no constraint; any other
+// region is a region specific endpoint and requires the constraint to name it.
+func ValidateLocationConstraint(constraint *string, region string) error {
+	if region == "us-east-1" {
+		if constraint != nil {
+			debuglogger.Logf("invalid location constraint: %s", *constraint)
+			return s3err.GetInvalidLocationConstraintErr(*constraint)
+		}
+
+		return nil
+	}
+
+	if constraint == nil {
+		debuglogger.Logf("missing location constraint for region %s", region)
+		return s3err.GetIllegalLocationConstraintErr("")
+	}
+
+	if *constraint != region {
+		debuglogger.Logf("illegal location constraint %s for region %s", *constraint, region)
+		return s3err.GetIllegalLocationConstraintErr(*constraint)
+	}
+
+	return nil
+}