fix: reject a ListBuckets bucket-region other than the gateway region

S3 never lists an empty result for another region: a valid region
other than the endpoint's own gets 400 InvalidArgument, "Requests with
bucket-region specified must be made to the corresponding regional
endpoint", with no ArgumentValue. The gateway is a single regional
endpoint, so it now does the same instead of clearing the listing.

Match the region case-insensitively like S3, and check an empty
bucket-region= too by looking for the query argument itself, since an
empty value is not a valid AWS region either.

s3api/utils/utils.go

@@ -1155,11 +1155,17 @@ func ValidateLocationConstraint(constraint *string, region string) error {
 	return nil
 }
 
-// IsValidBucketRegion checks a ListBuckets bucket-region value. The gateway
-// region is valid whatever its name, any other value has to be an AWS region
-// code.
-func IsValidBucketRegion(bucketRegion, region string) bool {
-	return bucketRegion == region || awsRegionRegexp.MatchString(bucketRegion)
+// ValidateBucketRegion checks a ListBuckets bucket-region value. Every bucket
+// lives in the gateway region, so like an S3 regional endpoint the gateway
+// rejects any other region, matching it case-insensitively.
+func ValidateBucketRegion(bucketRegion, region string) error {
+	if strings.EqualFold(bucketRegion, region) {
+		return nil
+	}
+	if !awsRegionRegexp.MatchString(strings.ToLower(bucketRegion)) {
+		return s3err.GetInvalidArgBucketRegion(bucketRegion)
+	}
+	return s3err.GetInvalidArgumentErr(s3err.InvalidArgBucketRegionEndpoint, "")
 }
 
 // AwsChunkedEncoding is the coding a client announces when it frames a body in

s3api/utils/utils_test.go

@@ -1539,27 +1539,30 @@ func TestHasAwsChunkedEncoding(t *testing.T) {
 	}
 }
 
-func TestIsValidBucketRegion(t *testing.T) {
+func TestValidateBucketRegion(t *testing.T) {
+	endpointErr := s3err.GetInvalidArgumentErr(s3err.InvalidArgBucketRegionEndpoint, "")
 	tests := []struct {
 		name         string
 		bucketRegion string
 		region       string
-		want         bool
+		want         error
 	}{
-		{"gateway region", "us-east-1", "us-east-1", true},
-		{"custom gateway region", "my-region", "my-region", true},
-		{"another aws region", "eu-central-1", "us-east-1", true},
-		{"gov cloud region", "us-gov-west-1", "us-east-1", true},
-		{"iso partition region", "us-isob-east-1", "us-east-1", true},
-		{"sovereign cloud region", "eusc-de-east-1", "us-east-1", true},
-		{"gibberish", "abc", "us-east-1", false},
-		{"missing number", "us-east", "us-east-1", false},
-		{"uppercase", "US-EAST-1", "us-east-1", false},
-		{"custom region of another gateway", "my-region", "us-east-1", false},
+		{"gateway region", "us-east-1", "us-east-1", nil},
+		{"gateway region in uppercase", "EU-CENTRAL-1", "eu-central-1", nil},
+		{"custom gateway region", "my-region", "my-region", nil},
+		{"another aws region", "eu-central-1", "us-east-1", endpointErr},
+		{"another aws region in uppercase", "US-EAST-1", "eu-central-1", endpointErr},
+		{"gov cloud region", "us-gov-west-1", "us-east-1", endpointErr},
+		{"iso partition region", "us-isob-east-1", "us-east-1", endpointErr},
+		{"sovereign cloud region", "eusc-de-east-1", "us-east-1", endpointErr},
+		{"gibberish", "abc", "us-east-1", s3err.GetInvalidArgBucketRegion("abc")},
+		{"empty", "", "us-east-1", s3err.GetInvalidArgBucketRegion("")},
+		{"missing number", "us-east", "us-east-1", s3err.GetInvalidArgBucketRegion("us-east")},
+		{"custom region of another gateway", "my-region", "us-east-1", s3err.GetInvalidArgBucketRegion("my-region")},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, IsValidBucketRegion(tt.bucketRegion, tt.region))
+			assert.Equal(t, tt.want, ValidateBucketRegion(tt.bucketRegion, tt.region))
 		})
 	}
 }