diff --git a/backend/auth/iam.go b/backend/auth/iam.go new file mode 100644 index 00000000..835f11ec --- /dev/null +++ b/backend/auth/iam.go @@ -0,0 +1,37 @@ +// Copyright 2023 Versity Software +// This file is licensed under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package auth + +import "github.com/versity/versitygw/s3err" + +type IAMConfig struct { + AccessAccounts map[string]string +} + +type IAMService interface { + GetIAMConfig() (*IAMConfig, error) +} + +type IAMServiceUnsupported struct{} + +var _ IAMService = &IAMServiceUnsupported{} + +func New() IAMService { + return &IAMServiceUnsupported{} +} + +func (IAMServiceUnsupported) GetIAMConfig() (*IAMConfig, error) { + return nil, s3err.GetAPIError(s3err.ErrNotImplemented) +} diff --git a/backend/backend.go b/backend/backend.go index 3c0d8c94..002d5cb3 100644 --- a/backend/backend.go +++ b/backend/backend.go @@ -27,7 +27,6 @@ import ( //go:generate moq -out ../s3api/controllers/backend_moq_test.go -pkg controllers . Backend type Backend interface { fmt.Stringer - GetIAMConfig() ([]byte, error) Shutdown() ListBuckets() (*s3.ListBucketsOutput, error) @@ -72,10 +71,6 @@ var _ Backend = &BackendUnsupported{} func New() Backend { return &BackendUnsupported{} } - -func (BackendUnsupported) GetIAMConfig() ([]byte, error) { - return nil, fmt.Errorf("not supported") -} func (BackendUnsupported) Shutdown() {} func (BackendUnsupported) String() string { return "Unsupported" diff --git a/cmd/versitygw/main.go b/cmd/versitygw/main.go index b881ee3b..ab0cb0a3 100644 --- a/cmd/versitygw/main.go +++ b/cmd/versitygw/main.go @@ -24,6 +24,7 @@ import ( "github.com/urfave/cli/v2" "github.com/versity/versitygw/backend" "github.com/versity/versitygw/s3api" + "github.com/versity/versitygw/s3api/middlewares" ) var ( @@ -143,7 +144,7 @@ func runGateway(be backend.Backend) error { opts = append(opts, s3api.WithTLS(cert)) } - srv, err := s3api.New(app, be, port, opts...) + srv, err := s3api.New(app, be, port, middlewares.AdminConfig{AdminAccess: adminAccess, AdminSecret: adminSecret, Region: region}, opts...) if err != nil { return fmt.Errorf("init gateway: %v", err) } diff --git a/s3api/controllers/base.go b/s3api/controllers/base.go index 05f5b31c..222b7ad1 100644 --- a/s3api/controllers/base.go +++ b/s3api/controllers/base.go @@ -42,7 +42,7 @@ func New(be backend.Backend) S3ApiController { func (c S3ApiController) ListBuckets(ctx *fiber.Ctx) error { res, err := c.be.ListBuckets() - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) GetActions(ctx *fiber.Ctx) error { @@ -63,17 +63,17 @@ func (c S3ApiController) GetActions(ctx *fiber.Ctx) error { } res, err := c.be.ListObjectParts(bucket, "", uploadId, partNumberMarker, maxParts) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if ctx.Request().URI().QueryArgs().Has("acl") { res, err := c.be.GetObjectAcl(bucket, key) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if attrs := ctx.Get("X-Amz-Object-Attributes"); attrs != "" { res, err := c.be.GetObjectAttributes(bucket, key, strings.Split(attrs, ",")) - return responce(ctx, res, err) + return Responce(ctx, res, err) } acceptRange := ctx.Get("Range") @@ -99,27 +99,27 @@ func (c S3ApiController) GetActions(ctx *fiber.Ctx) error { } res, err := c.be.GetObject(bucket, key, acceptRange, int64(startOffset), int64(length), ctx.Response().BodyWriter()) - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) ListActions(ctx *fiber.Ctx) error { if ctx.Request().URI().QueryArgs().Has("acl") { res, err := c.be.GetBucketAcl(ctx.Params("bucket")) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if ctx.Request().URI().QueryArgs().Has("uploads") { res, err := c.be.ListMultipartUploads(&s3.ListMultipartUploadsInput{Bucket: aws.String(ctx.Params("bucket"))}) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if ctx.QueryInt("list-type") == 2 { res, err := c.be.ListObjectsV2(ctx.Params("bucket"), "", "", "", 1) - return responce(ctx, res, err) + return Responce(ctx, res, err) } res, err := c.be.ListObjects(ctx.Params("bucket"), "", "", "", 1) - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) PutBucketActions(ctx *fiber.Ctx) error { @@ -148,11 +148,11 @@ func (c S3ApiController) PutBucketActions(ctx *fiber.Ctx) error { GrantWriteACP: &grantWriteACP, }) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } err := c.be.PutBucket(bucket) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { @@ -211,13 +211,13 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { CopySourceIfUnmodifiedSince: ©SrcUnmodifSinceDate, }) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if uploadId != "" { body := io.ReadSeeker(bytes.NewReader([]byte(ctx.Body()))) res, err := c.be.UploadPart(dstBucket, dstKeyStart, uploadId, body) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if grants != "" || acl != "" { @@ -235,7 +235,7 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { GrantWrite: &granWrite, GrantWriteACP: &grantWriteACP, }) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } if copySource != "" { @@ -243,7 +243,7 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { srcBucket, srcObject := copySourceSplit[0], copySourceSplit[1:] res, err := c.be.CopyObject(srcBucket, strings.Join(srcObject, "/"), dstBucket, dstKeyStart) - return responce(ctx, res, err) + return Responce(ctx, res, err) } contentLength, err := strconv.ParseInt(contentLengthStr, 10, 64) @@ -260,12 +260,12 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { Metadata: metadata, Body: bytes.NewReader(ctx.Request().Body()), }) - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) DeleteBucket(ctx *fiber.Ctx) error { err := c.be.DeleteBucket(ctx.Params("bucket")) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } func (c S3ApiController) DeleteObjects(ctx *fiber.Ctx) error { @@ -275,7 +275,7 @@ func (c S3ApiController) DeleteObjects(ctx *fiber.Ctx) error { } err := c.be.DeleteObjects(ctx.Params("bucket"), &s3.DeleteObjectsInput{Delete: &dObj}) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } func (c S3ApiController) DeleteActions(ctx *fiber.Ctx) error { @@ -295,16 +295,16 @@ func (c S3ApiController) DeleteActions(ctx *fiber.Ctx) error { ExpectedBucketOwner: &expectedBucketOwner, RequestPayer: types.RequestPayer(requestPayer), }) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } err := c.be.DeleteObject(bucket, key) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } func (c S3ApiController) HeadBucket(ctx *fiber.Ctx) error { res, err := c.be.HeadBucket(ctx.Params("bucket")) - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) HeadObject(ctx *fiber.Ctx) error { @@ -314,7 +314,7 @@ func (c S3ApiController) HeadObject(ctx *fiber.Ctx) error { } res, err := c.be.HeadObject(bucket, key) - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error { @@ -327,7 +327,7 @@ func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error { if err := xml.Unmarshal(ctx.Body(), &restoreRequest); err == nil { err := c.be.RestoreObject(bucket, key, &restoreRequest) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } if uploadId != "" { @@ -338,13 +338,13 @@ func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error { } res, err := c.be.CompleteMultipartUpload(bucket, "", uploadId, parts) - return responce(ctx, res, err) + return Responce(ctx, res, err) } res, err := c.be.CreateMultipartUpload(&s3.CreateMultipartUploadInput{Bucket: &bucket, Key: &key}) - return responce(ctx, res, err) + return Responce(ctx, res, err) } -func responce[R comparable](ctx *fiber.Ctx, resp R, err error) error { +func Responce[R comparable](ctx *fiber.Ctx, resp R, err error) error { if err != nil { serr, ok := err.(s3err.APIError) if ok { diff --git a/s3api/controllers/base_test.go b/s3api/controllers/base_test.go index d096d960..310ffdbe 100644 --- a/s3api/controllers/base_test.go +++ b/s3api/controllers/base_test.go @@ -715,7 +715,7 @@ func Test_responce(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - if err := responce(tt.args.ctx, tt.args.resp, tt.args.err); (err != nil) != tt.wantErr { + if err := Responce(tt.args.ctx, tt.args.resp, tt.args.err); (err != nil) != tt.wantErr { t.Errorf("responce() error = %v, wantErr %v", err, tt.wantErr) } diff --git a/s3api/middlewares/authentication.go b/s3api/middlewares/authentication.go new file mode 100644 index 00000000..fe52e39d --- /dev/null +++ b/s3api/middlewares/authentication.go @@ -0,0 +1,105 @@ +// Copyright 2023 Versity Software +// This file is licensed under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package middlewares + +import ( + "crypto/sha256" + "encoding/hex" + "strings" + "time" + + "github.com/aws/aws-sdk-go-v2/aws" + v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4" + "github.com/gofiber/fiber/v2" + "github.com/versity/versitygw/s3api/controllers" + "github.com/versity/versitygw/s3api/utils" + "github.com/versity/versitygw/s3err" +) + +const ( + iso8601Format = "20060102T150405Z" +) + +type AdminConfig struct { + AdminAccess string + AdminSecret string + Region string +} + +func VerifyV4Signature(config AdminConfig) fiber.Handler { + return func(ctx *fiber.Ctx) error { + authorization := ctx.Get("Authorization") + if authorization == "" { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrAuthHeaderEmpty)) + } + + // Check the signature version + authParts := strings.Split(authorization, " ") + if authParts[0] != "AWS4-HMAC-SHA256" { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrSignatureVersionNotSupported)) + } + + creds := strings.Split(strings.Split(authParts[1], "=")[1], "/") + + // Check X-Amz-Date header + date := ctx.Get("X-Amz-Date") + if date == "" { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrMissingDateHeader)) + } + + // Parse the date and check the date validity + tdate, err := time.Parse(iso8601Format, date) + if err != nil { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrMalformedDate)) + } + + // Calculate the hash of the request payload + hashedPayload := sha256.Sum256(ctx.Body()) + hexPayload := hex.EncodeToString(hashedPayload[:]) + + hashPayloadHeader := ctx.Get("X-Amz-Content-Sha256") + + // Compare the calculated hash with the hash provided + if hashPayloadHeader != hexPayload { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrContentSHA256Mismatch)) + } + + // Create a new http request instance from fasthttp request + req, err := utils.CreateHttpRequestFromCtx(ctx) + if err != nil { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrAccessDenied)) + } + + signer := v4.NewSigner() + + signErr := signer.SignHTTP(req.Context(), aws.Credentials{ + AccessKeyID: config.AdminAccess, + SecretAccessKey: config.AdminSecret, + }, req, hexPayload, creds[3], config.Region, tdate) + if signErr != nil { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrAccessDenied)) + } + + parts := strings.Split(req.Header.Get("Authorization"), " ") + calculatedSign := strings.Split(parts[3], "=")[1] + expectedSign := strings.Split(authParts[3], "=")[1] + + if expectedSign != calculatedSign { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrSignatureDoesNotMatch)) + } + + return ctx.Next() + } +} diff --git a/s3api/server.go b/s3api/server.go index ba4e76f2..51c28b09 100644 --- a/s3api/server.go +++ b/s3api/server.go @@ -20,6 +20,7 @@ import ( "github.com/gofiber/fiber/v2" "github.com/gofiber/fiber/v2/middleware/logger" "github.com/versity/versitygw/backend" + "github.com/versity/versitygw/s3api/middlewares" ) type S3ApiServer struct { @@ -30,7 +31,7 @@ type S3ApiServer struct { cert *tls.Certificate } -func New(app *fiber.App, be backend.Backend, port string, opts ...Option) (*S3ApiServer, error) { +func New(app *fiber.App, be backend.Backend, port string, adminUser middlewares.AdminConfig, opts ...Option) (*S3ApiServer, error) { server := &S3ApiServer{ app: app, backend: be, @@ -42,6 +43,7 @@ func New(app *fiber.App, be backend.Backend, port string, opts ...Option) (*S3Ap opt(server) } + app.Use(middlewares.VerifyV4Signature(adminUser)) app.Use(logger.New()) server.router.Init(app, be) return server, nil diff --git a/s3api/server_test.go b/s3api/server_test.go index 0ec732d2..f34b9784 100644 --- a/s3api/server_test.go +++ b/s3api/server_test.go @@ -20,13 +20,15 @@ import ( "github.com/gofiber/fiber/v2" "github.com/versity/versitygw/backend" + "github.com/versity/versitygw/s3api/middlewares" ) func TestNew(t *testing.T) { type args struct { - app *fiber.App - be backend.Backend - port string + app *fiber.App + be backend.Backend + port string + adminUser middlewares.AdminConfig } app := fiber.New() @@ -43,9 +45,10 @@ func TestNew(t *testing.T) { { name: "Create S3 api server", args: args{ - app: app, - be: be, - port: port, + app: app, + be: be, + port: port, + adminUser: middlewares.AdminConfig{}, }, wantS3ApiServer: &S3ApiServer{ app: app, @@ -58,7 +61,7 @@ func TestNew(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - gotS3ApiServer, err := New(tt.args.app, tt.args.be, tt.args.port) + gotS3ApiServer, err := New(tt.args.app, tt.args.be, tt.args.port, tt.args.adminUser) if (err != nil) != tt.wantErr { t.Errorf("New() error = %v, wantErr %v", err, tt.wantErr) return diff --git a/s3api/utils/utils.go b/s3api/utils/utils.go index 058b1aad..f218edc0 100644 --- a/s3api/utils/utils.go +++ b/s3api/utils/utils.go @@ -15,8 +15,12 @@ package utils import ( + "bytes" + "errors" + "net/http" "strings" + "github.com/gofiber/fiber/v2" "github.com/valyala/fasthttp" ) @@ -32,3 +36,28 @@ func GetUserMetaData(headers *fasthttp.RequestHeader) (metadata map[string]strin return } + +func CreateHttpRequestFromCtx(ctx *fiber.Ctx) (*http.Request, error) { + req := ctx.Request() + + httpReq, err := http.NewRequest(string(req.Header.Method()), req.URI().String(), bytes.NewReader(req.Body())) + if err != nil { + return nil, errors.New("error in creating an http request") + } + + // Set the request headers + req.Header.VisitAll(func(key, value []byte) { + keyStr := string(key) + if keyStr == "X-Amz-Date" || keyStr == "X-Amz-Content-Sha256" || keyStr == "Host" { + httpReq.Header.Add(keyStr, string(value)) + } + }) + + // Set the Content-Length header + httpReq.ContentLength = int64(len(req.Body())) + + // Set the Host header + httpReq.Host = string(req.Header.Host()) + + return httpReq, nil +}