fix: reject a ListBuckets bucket-region other than the gateway region

S3 never lists an empty result for another region: a valid region
other than the endpoint's own gets 400 InvalidArgument, "Requests with
bucket-region specified must be made to the corresponding regional
endpoint", with no ArgumentValue. The gateway is a single regional
endpoint, so it now does the same instead of clearing the listing.

Match the region case-insensitively like S3, and check an empty
bucket-region= too by looking for the query argument itself, since an
empty value is not a valid AWS region either.

s3api/controllers/bucket-list.go

@@ -19,7 +19,6 @@ import (
 	"github.com/versity/versitygw/auth"
 	"github.com/versity/versitygw/debuglogger"
 	"github.com/versity/versitygw/s3api/utils"
-	"github.com/versity/versitygw/s3err"
 	"github.com/versity/versitygw/s3response"
 )
 
@@ -58,11 +57,14 @@ func (c S3ApiController) ListBuckets(ctx fiber.Ctx) (*Response, error) {
 		}, err
 	}
 
-	if bucketRegion != "" && !utils.IsValidBucketRegion(bucketRegion, region) {
-		debuglogger.Logf("invalid bucket region: %s", bucketRegion)
-		return &Response{
-			MetaOpts: &MetaOptions{},
-		}, s3err.GetInvalidArgBucketRegion(bucketRegion)
+	// an empty bucket-region= is checked too, so look for the argument itself
+	if ctx.Request().URI().QueryArgs().Has("bucket-region") {
+		if err := utils.ValidateBucketRegion(bucketRegion, region); err != nil {
+			debuglogger.Logf("invalid bucket region: %q", bucketRegion)
+			return &Response{
+				MetaOpts: &MetaOptions{},
+			}, err
+		}
 	}
 
 	// IsAdmin is the backends' "return every bucket, unfiltered" flag.
@@ -78,13 +80,6 @@ func (c S3ApiController) ListBuckets(ctx fiber.Ctx) (*Response, error) {
 		return &Response{}, err
 	}
 
-	// every bucket lives in the gateway region, so there is nothing
-	// to list for any other region
-	if bucketRegion != "" && bucketRegion != region {
-		res.Buckets.Bucket = nil
-		res.ContinuationToken = ""
-	}
-
 	for i := range res.Buckets.Bucket {
 		res.Buckets.Bucket[i].BucketRegion = region
 	}

s3api/controllers/bucket-list_test.go

@@ -119,25 +119,46 @@ func TestS3ApiController_ListBuckets(t *testing.T) {
 			name: "bucket region of another region",
 			input: testInput{
 				locals: defaultLocals,
-				beRes: s3response.ListAllMyBucketsResult{
-					Owner:   validRes.Owner,
-					Buckets: validRes.Buckets,
-					Prefix:  "te",
-					// a continuation token from the backend must not
-					// leak into the empty listing
-					ContinuationToken: "test",
-				},
+				beRes:  validRes,
 				queries: map[string]string{
 					"bucket-region": "us-west-2",
-					"prefix":        "te",
 				},
 			},
 			output: testOutput{
 				response: &Response{
-					Data: s3response.ListAllMyBucketsResult{
-						Owner:  validRes.Owner,
-						Prefix: "te",
-					},
+					MetaOpts: &MetaOptions{},
+				},
+				err: s3err.GetInvalidArgumentErr(s3err.InvalidArgBucketRegionEndpoint, ""),
+			},
+		},
+		{
+			name: "empty bucket region",
+			input: testInput{
+				locals: defaultLocals,
+				beRes:  validRes,
+				queries: map[string]string{
+					"bucket-region": "",
+				},
+			},
+			output: testOutput{
+				response: &Response{
+					MetaOpts: &MetaOptions{},
+				},
+				err: s3err.GetInvalidArgBucketRegion(""),
+			},
+		},
+		{
+			name: "bucket region of the gateway region in uppercase",
+			input: testInput{
+				locals: defaultLocals,
+				beRes:  validRes,
+				queries: map[string]string{
+					"bucket-region": "US-EAST-1",
+				},
+			},
+			output: testOutput{
+				response: &Response{
+					Data: validRes,
 				},
 			},
 		},

s3api/utils/utils.go

@@ -1155,11 +1155,17 @@ func ValidateLocationConstraint(constraint *string, region string) error {
 	return nil
 }
 
-// IsValidBucketRegion checks a ListBuckets bucket-region value. The gateway
-// region is valid whatever its name, any other value has to be an AWS region
-// code.
-func IsValidBucketRegion(bucketRegion, region string) bool {
-	return bucketRegion == region || awsRegionRegexp.MatchString(bucketRegion)
+// ValidateBucketRegion checks a ListBuckets bucket-region value. Every bucket
+// lives in the gateway region, so like an S3 regional endpoint the gateway
+// rejects any other region, matching it case-insensitively.
+func ValidateBucketRegion(bucketRegion, region string) error {
+	if strings.EqualFold(bucketRegion, region) {
+		return nil
+	}
+	if !awsRegionRegexp.MatchString(strings.ToLower(bucketRegion)) {
+		return s3err.GetInvalidArgBucketRegion(bucketRegion)
+	}
+	return s3err.GetInvalidArgumentErr(s3err.InvalidArgBucketRegionEndpoint, "")
 }
 
 // AwsChunkedEncoding is the coding a client announces when it frames a body in

s3api/utils/utils_test.go

@@ -1539,27 +1539,30 @@ func TestHasAwsChunkedEncoding(t *testing.T) {
 	}
 }
 
-func TestIsValidBucketRegion(t *testing.T) {
+func TestValidateBucketRegion(t *testing.T) {
+	endpointErr := s3err.GetInvalidArgumentErr(s3err.InvalidArgBucketRegionEndpoint, "")
 	tests := []struct {
 		name         string
 		bucketRegion string
 		region       string
-		want         bool
+		want         error
 	}{
-		{"gateway region", "us-east-1", "us-east-1", true},
-		{"custom gateway region", "my-region", "my-region", true},
-		{"another aws region", "eu-central-1", "us-east-1", true},
-		{"gov cloud region", "us-gov-west-1", "us-east-1", true},
-		{"iso partition region", "us-isob-east-1", "us-east-1", true},
-		{"sovereign cloud region", "eusc-de-east-1", "us-east-1", true},
-		{"gibberish", "abc", "us-east-1", false},
-		{"missing number", "us-east", "us-east-1", false},
-		{"uppercase", "US-EAST-1", "us-east-1", false},
-		{"custom region of another gateway", "my-region", "us-east-1", false},
+		{"gateway region", "us-east-1", "us-east-1", nil},
+		{"gateway region in uppercase", "EU-CENTRAL-1", "eu-central-1", nil},
+		{"custom gateway region", "my-region", "my-region", nil},
+		{"another aws region", "eu-central-1", "us-east-1", endpointErr},
+		{"another aws region in uppercase", "US-EAST-1", "eu-central-1", endpointErr},
+		{"gov cloud region", "us-gov-west-1", "us-east-1", endpointErr},
+		{"iso partition region", "us-isob-east-1", "us-east-1", endpointErr},
+		{"sovereign cloud region", "eusc-de-east-1", "us-east-1", endpointErr},
+		{"gibberish", "abc", "us-east-1", s3err.GetInvalidArgBucketRegion("abc")},
+		{"empty", "", "us-east-1", s3err.GetInvalidArgBucketRegion("")},
+		{"missing number", "us-east", "us-east-1", s3err.GetInvalidArgBucketRegion("us-east")},
+		{"custom region of another gateway", "my-region", "us-east-1", s3err.GetInvalidArgBucketRegion("my-region")},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, IsValidBucketRegion(tt.bucketRegion, tt.region))
+			assert.Equal(t, tt.want, ValidateBucketRegion(tt.bucketRegion, tt.region))
 		})
 	}
 }