Merge pull request #48 from versity/authentication-sigv4

Authentication sigv4

backend/auth/iam.go

@@ -0,0 +1,37 @@
+// Copyright 2023 Versity Software
+// This file is licensed under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package auth
+
+import "github.com/versity/versitygw/s3err"
+
+type IAMConfig struct {
+	AccessAccounts map[string]string
+}
+
+type IAMService interface {
+	GetIAMConfig() (*IAMConfig, error)
+}
+
+type IAMServiceUnsupported struct{}
+
+var _ IAMService = &IAMServiceUnsupported{}
+
+func New() IAMService {
+	return &IAMServiceUnsupported{}
+}
+
+func (IAMServiceUnsupported) GetIAMConfig() (*IAMConfig, error) {
+	return nil, s3err.GetAPIError(s3err.ErrNotImplemented)
+}

backend/backend.go

@@ -27,7 +27,6 @@ import (
 //go:generate moq -out ../s3api/controllers/backend_moq_test.go -pkg controllers . Backend
 type Backend interface {
 	fmt.Stringer
-	GetIAMConfig() ([]byte, error)
 	Shutdown()
 
 	ListBuckets() (*s3.ListBucketsOutput, error)
@@ -72,10 +71,6 @@ var _ Backend = &BackendUnsupported{}
 func New() Backend {
 	return &BackendUnsupported{}
 }
-
-func (BackendUnsupported) GetIAMConfig() ([]byte, error) {
-	return nil, fmt.Errorf("not supported")
-}
 func (BackendUnsupported) Shutdown() {}
 func (BackendUnsupported) String() string {
 	return "Unsupported"

cmd/versitygw/main.go

@@ -24,6 +24,7 @@ import (
 	"github.com/urfave/cli/v2"
 	"github.com/versity/versitygw/backend"
 	"github.com/versity/versitygw/s3api"
+	"github.com/versity/versitygw/s3api/middlewares"
 )
 
 var (
@@ -143,7 +144,7 @@ func runGateway(be backend.Backend) error {
 		opts = append(opts, s3api.WithTLS(cert))
 	}
 
-	srv, err := s3api.New(app, be, port, opts...)
+	srv, err := s3api.New(app, be, port, middlewares.AdminConfig{AdminAccess: adminAccess, AdminSecret: adminSecret, Region: region}, opts...)
 	if err != nil {
 		return fmt.Errorf("init gateway: %v", err)
 	}

s3api/controllers/base.go

@@ -42,7 +42,7 @@ func New(be backend.Backend) S3ApiController {
 
 func (c S3ApiController) ListBuckets(ctx *fiber.Ctx) error {
 	res, err := c.be.ListBuckets()
-	return responce(ctx, res, err)
+	return Responce(ctx, res, err)
 }
 
 func (c S3ApiController) GetActions(ctx *fiber.Ctx) error {
@@ -63,17 +63,17 @@ func (c S3ApiController) GetActions(ctx *fiber.Ctx) error {
 		}
 
 		res, err := c.be.ListObjectParts(bucket, "", uploadId, partNumberMarker, maxParts)
-		return responce(ctx, res, err)
+		return Responce(ctx, res, err)
 	}
 
 	if ctx.Request().URI().QueryArgs().Has("acl") {
 		res, err := c.be.GetObjectAcl(bucket, key)
-		return responce(ctx, res, err)
+		return Responce(ctx, res, err)
 	}
 
 	if attrs := ctx.Get("X-Amz-Object-Attributes"); attrs != "" {
 		res, err := c.be.GetObjectAttributes(bucket, key, strings.Split(attrs, ","))
-		return responce(ctx, res, err)
+		return Responce(ctx, res, err)
 	}
 
 	acceptRange := ctx.Get("Range")
@@ -99,27 +99,27 @@ func (c S3ApiController) GetActions(ctx *fiber.Ctx) error {
 	}
 
 	res, err := c.be.GetObject(bucket, key, acceptRange, int64(startOffset), int64(length), ctx.Response().BodyWriter())
-	return responce(ctx, res, err)
+	return Responce(ctx, res, err)
 }
 
 func (c S3ApiController) ListActions(ctx *fiber.Ctx) error {
 	if ctx.Request().URI().QueryArgs().Has("acl") {
 		res, err := c.be.GetBucketAcl(ctx.Params("bucket"))
-		return responce(ctx, res, err)
+		return Responce(ctx, res, err)
 	}
 
 	if ctx.Request().URI().QueryArgs().Has("uploads") {
 		res, err := c.be.ListMultipartUploads(&s3.ListMultipartUploadsInput{Bucket: aws.String(ctx.Params("bucket"))})
-		return responce(ctx, res, err)
+		return Responce(ctx, res, err)
 	}
 
 	if ctx.QueryInt("list-type") == 2 {
 		res, err := c.be.ListObjectsV2(ctx.Params("bucket"), "", "", "", 1)
-		return responce(ctx, res, err)
+		return Responce(ctx, res, err)
 	}
 
 	res, err := c.be.ListObjects(ctx.Params("bucket"), "", "", "", 1)
-	return responce(ctx, res, err)
+	return Responce(ctx, res, err)
 }
 
 func (c S3ApiController) PutBucketActions(ctx *fiber.Ctx) error {
@@ -148,11 +148,11 @@ func (c S3ApiController) PutBucketActions(ctx *fiber.Ctx) error {
 			GrantWriteACP:    &grantWriteACP,
 		})
 
-		return responce[any](ctx, nil, err)
+		return Responce[any](ctx, nil, err)
 	}
 
 	err := c.be.PutBucket(bucket)
-	return responce[any](ctx, nil, err)
+	return Responce[any](ctx, nil, err)
 }
 
 func (c S3ApiController) PutActions(ctx *fiber.Ctx) error {
@@ -211,13 +211,13 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error {
 			CopySourceIfUnmodifiedSince: &copySrcUnmodifSinceDate,
 		})
 
-		return responce(ctx, res, err)
+		return Responce(ctx, res, err)
 	}
 
 	if uploadId != "" {
 		body := io.ReadSeeker(bytes.NewReader([]byte(ctx.Body())))
 		res, err := c.be.UploadPart(dstBucket, dstKeyStart, uploadId, body)
-		return responce(ctx, res, err)
+		return Responce(ctx, res, err)
 	}
 
 	if grants != "" || acl != "" {
@@ -235,7 +235,7 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error {
 			GrantWrite:       &granWrite,
 			GrantWriteACP:    &grantWriteACP,
 		})
-		return responce[any](ctx, nil, err)
+		return Responce[any](ctx, nil, err)
 	}
 
 	if copySource != "" {
@@ -243,7 +243,7 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error {
 		srcBucket, srcObject := copySourceSplit[0], copySourceSplit[1:]
 
 		res, err := c.be.CopyObject(srcBucket, strings.Join(srcObject, "/"), dstBucket, dstKeyStart)
-		return responce(ctx, res, err)
+		return Responce(ctx, res, err)
 	}
 
 	contentLength, err := strconv.ParseInt(contentLengthStr, 10, 64)
@@ -260,12 +260,12 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error {
 		Metadata:      metadata,
 		Body:          bytes.NewReader(ctx.Request().Body()),
 	})
-	return responce(ctx, res, err)
+	return Responce(ctx, res, err)
 }
 
 func (c S3ApiController) DeleteBucket(ctx *fiber.Ctx) error {
 	err := c.be.DeleteBucket(ctx.Params("bucket"))
-	return responce[any](ctx, nil, err)
+	return Responce[any](ctx, nil, err)
 }
 
 func (c S3ApiController) DeleteObjects(ctx *fiber.Ctx) error {
@@ -275,7 +275,7 @@ func (c S3ApiController) DeleteObjects(ctx *fiber.Ctx) error {
 	}
 
 	err := c.be.DeleteObjects(ctx.Params("bucket"), &s3.DeleteObjectsInput{Delete: &dObj})
-	return responce[any](ctx, nil, err)
+	return Responce[any](ctx, nil, err)
 }
 
 func (c S3ApiController) DeleteActions(ctx *fiber.Ctx) error {
@@ -295,16 +295,16 @@ func (c S3ApiController) DeleteActions(ctx *fiber.Ctx) error {
 			ExpectedBucketOwner: &expectedBucketOwner,
 			RequestPayer:        types.RequestPayer(requestPayer),
 		})
-		return responce[any](ctx, nil, err)
+		return Responce[any](ctx, nil, err)
 	}
 
 	err := c.be.DeleteObject(bucket, key)
-	return responce[any](ctx, nil, err)
+	return Responce[any](ctx, nil, err)
 }
 
 func (c S3ApiController) HeadBucket(ctx *fiber.Ctx) error {
 	res, err := c.be.HeadBucket(ctx.Params("bucket"))
-	return responce(ctx, res, err)
+	return Responce(ctx, res, err)
 }
 
 func (c S3ApiController) HeadObject(ctx *fiber.Ctx) error {
@@ -314,7 +314,7 @@ func (c S3ApiController) HeadObject(ctx *fiber.Ctx) error {
 	}
 
 	res, err := c.be.HeadObject(bucket, key)
-	return responce(ctx, res, err)
+	return Responce(ctx, res, err)
 }
 
 func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error {
@@ -327,7 +327,7 @@ func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error {
 
 	if err := xml.Unmarshal(ctx.Body(), &restoreRequest); err == nil {
 		err := c.be.RestoreObject(bucket, key, &restoreRequest)
-		return responce[any](ctx, nil, err)
+		return Responce[any](ctx, nil, err)
 	}
 
 	if uploadId != "" {
@@ -338,13 +338,13 @@ func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error {
 		}
 
 		res, err := c.be.CompleteMultipartUpload(bucket, "", uploadId, parts)
-		return responce(ctx, res, err)
+		return Responce(ctx, res, err)
 	}
 	res, err := c.be.CreateMultipartUpload(&s3.CreateMultipartUploadInput{Bucket: &bucket, Key: &key})
-	return responce(ctx, res, err)
+	return Responce(ctx, res, err)
 }
 
-func responce[R comparable](ctx *fiber.Ctx, resp R, err error) error {
+func Responce[R comparable](ctx *fiber.Ctx, resp R, err error) error {
 	if err != nil {
 		serr, ok := err.(s3err.APIError)
 		if ok {

s3api/controllers/base_test.go

@@ -715,7 +715,7 @@ func Test_responce(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := responce(tt.args.ctx, tt.args.resp, tt.args.err); (err != nil) != tt.wantErr {
+			if err := Responce(tt.args.ctx, tt.args.resp, tt.args.err); (err != nil) != tt.wantErr {
 				t.Errorf("responce() error = %v, wantErr %v", err, tt.wantErr)
 			}
 

s3api/middlewares/authentication.go

@@ -0,0 +1,105 @@
+// Copyright 2023 Versity Software
+// This file is licensed under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package middlewares
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
+	"github.com/gofiber/fiber/v2"
+	"github.com/versity/versitygw/s3api/controllers"
+	"github.com/versity/versitygw/s3api/utils"
+	"github.com/versity/versitygw/s3err"
+)
+
+const (
+	iso8601Format = "20060102T150405Z"
+)
+
+type AdminConfig struct {
+	AdminAccess string
+	AdminSecret string
+	Region      string
+}
+
+func VerifyV4Signature(config AdminConfig) fiber.Handler {
+	return func(ctx *fiber.Ctx) error {
+		authorization := ctx.Get("Authorization")
+		if authorization == "" {
+			return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrAuthHeaderEmpty))
+		}
+
+		// Check the signature version
+		authParts := strings.Split(authorization, " ")
+		if authParts[0] != "AWS4-HMAC-SHA256" {
+			return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrSignatureVersionNotSupported))
+		}
+
+		creds := strings.Split(strings.Split(authParts[1], "=")[1], "/")
+
+		// Check X-Amz-Date header
+		date := ctx.Get("X-Amz-Date")
+		if date == "" {
+			return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrMissingDateHeader))
+		}
+
+		// Parse the date and check the date validity
+		tdate, err := time.Parse(iso8601Format, date)
+		if err != nil {
+			return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrMalformedDate))
+		}
+
+		// Calculate the hash of the request payload
+		hashedPayload := sha256.Sum256(ctx.Body())
+		hexPayload := hex.EncodeToString(hashedPayload[:])
+
+		hashPayloadHeader := ctx.Get("X-Amz-Content-Sha256")
+
+		// Compare the calculated hash with the hash provided
+		if hashPayloadHeader != hexPayload {
+			return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrContentSHA256Mismatch))
+		}
+
+		// Create a new http request instance from fasthttp request
+		req, err := utils.CreateHttpRequestFromCtx(ctx)
+		if err != nil {
+			return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrAccessDenied))
+		}
+
+		signer := v4.NewSigner()
+
+		signErr := signer.SignHTTP(req.Context(), aws.Credentials{
+			AccessKeyID:     config.AdminAccess,
+			SecretAccessKey: config.AdminSecret,
+		}, req, hexPayload, creds[3], config.Region, tdate)
+		if signErr != nil {
+			return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrAccessDenied))
+		}
+
+		parts := strings.Split(req.Header.Get("Authorization"), " ")
+		calculatedSign := strings.Split(parts[3], "=")[1]
+		expectedSign := strings.Split(authParts[3], "=")[1]
+
+		if expectedSign != calculatedSign {
+			return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrSignatureDoesNotMatch))
+		}
+
+		return ctx.Next()
+	}
+}

s3api/server.go

@@ -20,6 +20,7 @@ import (
 	"github.com/gofiber/fiber/v2"
 	"github.com/gofiber/fiber/v2/middleware/logger"
 	"github.com/versity/versitygw/backend"
+	"github.com/versity/versitygw/s3api/middlewares"
 )
 
 type S3ApiServer struct {
@@ -30,7 +31,7 @@ type S3ApiServer struct {
 	cert    *tls.Certificate
 }
 
-func New(app *fiber.App, be backend.Backend, port string, opts ...Option) (*S3ApiServer, error) {
+func New(app *fiber.App, be backend.Backend, port string, adminUser middlewares.AdminConfig, opts ...Option) (*S3ApiServer, error) {
 	server := &S3ApiServer{
 		app:     app,
 		backend: be,
@@ -42,6 +43,7 @@ func New(app *fiber.App, be backend.Backend, port string, opts ...Option) (*S3Ap
 		opt(server)
 	}
 
+	app.Use(middlewares.VerifyV4Signature(adminUser))
 	app.Use(logger.New())
 	server.router.Init(app, be)
 	return server, nil

s3api/server_test.go

@@ -20,13 +20,15 @@ import (
 
 	"github.com/gofiber/fiber/v2"
 	"github.com/versity/versitygw/backend"
+	"github.com/versity/versitygw/s3api/middlewares"
 )
 
 func TestNew(t *testing.T) {
 	type args struct {
-		app  *fiber.App
-		be   backend.Backend
-		port string
+		app       *fiber.App
+		be        backend.Backend
+		port      string
+		adminUser middlewares.AdminConfig
 	}
 
 	app := fiber.New()
@@ -43,9 +45,10 @@ func TestNew(t *testing.T) {
 		{
 			name: "Create S3 api server",
 			args: args{
-				app:  app,
-				be:   be,
-				port: port,
+				app:       app,
+				be:        be,
+				port:      port,
+				adminUser: middlewares.AdminConfig{},
 			},
 			wantS3ApiServer: &S3ApiServer{
 				app:     app,
@@ -58,7 +61,7 @@ func TestNew(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			gotS3ApiServer, err := New(tt.args.app, tt.args.be, tt.args.port)
+			gotS3ApiServer, err := New(tt.args.app, tt.args.be, tt.args.port, tt.args.adminUser)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("New() error = %v, wantErr %v", err, tt.wantErr)
 				return

s3api/utils/utils.go

@@ -15,8 +15,12 @@
 package utils
 
 import (
+	"bytes"
+	"errors"
+	"net/http"
 	"strings"
 
+	"github.com/gofiber/fiber/v2"
 	"github.com/valyala/fasthttp"
 )
 
@@ -32,3 +36,28 @@ func GetUserMetaData(headers *fasthttp.RequestHeader) (metadata map[string]strin
 
 	return
 }
+
+func CreateHttpRequestFromCtx(ctx *fiber.Ctx) (*http.Request, error) {
+	req := ctx.Request()
+
+	httpReq, err := http.NewRequest(string(req.Header.Method()), req.URI().String(), bytes.NewReader(req.Body()))
+	if err != nil {
+		return nil, errors.New("error in creating an http request")
+	}
+
+	// Set the request headers
+	req.Header.VisitAll(func(key, value []byte) {
+		keyStr := string(key)
+		if keyStr == "X-Amz-Date" || keyStr == "X-Amz-Content-Sha256" || keyStr == "Host" {
+			httpReq.Header.Add(keyStr, string(value))
+		}
+	})
+
+	// Set the Content-Length header
+	httpReq.ContentLength = int64(len(req.Body()))
+
+	// Set the Host header
+	httpReq.Host = string(req.Header.Host())
+
+	return httpReq, nil
+}