diff --git a/internal/sigv4auth/auth.go b/internal/sigv4auth/auth.go index e57a16d..f47a55e 100644 --- a/internal/sigv4auth/auth.go +++ b/internal/sigv4auth/auth.go @@ -144,7 +144,7 @@ func ParseAuthorization(authorization, expectedService string) (AuthData, error) return a, &ParseError{Kind: ErrUnsupportedAuthorizationVersion, Value: algo} } if algo != AlgorithmHMACSHA256 { - return a, &ParseError{Kind: ErrInvalidAuthorizationType, Value: algo} + return a, &ParseError{Kind: ErrInvalidAuthorizationType, Input: authorization, Value: algo} } kvPairs := strings.Split(authParts[1], ",") diff --git a/s3api/utils/auth-reader.go b/s3api/utils/auth-reader.go index 8161b5e..c17061e 100644 --- a/s3api/utils/auth-reader.go +++ b/s3api/utils/auth-reader.go @@ -128,7 +128,7 @@ func mapAuthParseError(err *sigv4auth.ParseError) error { case sigv4auth.ErrUnsupportedAuthorizationVersion: return s3err.GetAPIError(s3err.ErrUnsupportedAuthorizationMechanism) case sigv4auth.ErrInvalidAuthorizationType: - return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Value) + return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Input) case sigv4auth.ErrMissingComponents: return s3err.MalformedAuth.MissingComponents() case sigv4auth.ErrMissingCredential: diff --git a/s3api/utils/auth_test.go b/s3api/utils/auth_test.go index af1f97a..2fa1b84 100644 --- a/s3api/utils/auth_test.go +++ b/s3api/utils/auth_test.go @@ -15,6 +15,7 @@ package utils import ( + "errors" "net" "strings" "testing" @@ -24,6 +25,7 @@ import ( "github.com/valyala/fasthttp" "github.com/valyala/fasthttp/fasthttputil" "github.com/versity/versitygw/internal/sigv4auth" + "github.com/versity/versitygw/s3err" ) func TestAuthParse(t *testing.T) { @@ -69,6 +71,32 @@ func TestAuthParse(t *testing.T) { } } +func TestAuthParseUnsupportedType(t *testing.T) { + vectors := []struct { + name string + authstr string + }{ + { + name: "misspelled algorithm", + authstr: "AWS-HMAC-SHA25 Credential=user/20261007/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=4a2a292c73c80d2fe4a4b9e506fe0d1a8209f92dd2dfd32c27c30402e42b473d", + }, + { + name: "spaces between components", + authstr: "AWS2-HMAC-SHA1 Credential=user/20261007/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-date, Signature=4a2a292c73c80d2fe4a4b9e506fe0d1a8209f92dd2dfd32c27c30402e42b473d", + }, + } + + for _, v := range vectors { + t.Run(v.name, func(t *testing.T) { + _, err := ParseAuthorization(v.authstr) + want := s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, v.authstr) + if !errors.Is(err, want) { + t.Errorf("err got %v, expected %v", err, want) + } + }) + } +} + // 2024/02/06 21:03:28 Request headers: // 2024/02/06 21:03:28 Host: 172.21.0.160:11000 // 2024/02/06 21:03:28 User-Agent: S3 Browser/11.5.7 (https://s3browser.com) diff --git a/tests/integration/sigv4_auth.go b/tests/integration/sigv4_auth.go index 551b43f..95e9b62 100644 --- a/tests/integration/sigv4_auth.go +++ b/tests/integration/sigv4_auth.go @@ -65,7 +65,7 @@ func Authentication_unsupported_signature_version(s *S3Conf) error { return err } - return checkHTTPResponseApiErr(resp, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, "AWS2-HMAC-SHA1")) + return checkHTTPResponseApiErr(resp, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, authHdr)) }) } diff --git a/tests/test_rest_list_buckets.sh b/tests/test_rest_list_buckets.sh index 128cf1c..0e384fb 100644 --- a/tests/test_rest_list_buckets.sh +++ b/tests/test_rest_list_buckets.sh @@ -54,9 +54,6 @@ export RUN_USERS=true # tags: curl,ListBuckets,required-headers,Authorization,invalid-header @test "REST - invalid authorization scheme" { - if [ "$DIRECT" != "true" ]; then - skip "https://github.com/versity/versitygw/issues/1705" - fi run list_buckets_check_authorization_scheme_error assert_success }