From f08da34711a2a1da6014cdc96d0ebd12c64a621e Mon Sep 17 00:00:00 2001 From: jonaustin09 Date: Fri, 26 May 2023 19:59:05 +0400 Subject: [PATCH 1/6] feat: IAM config service from backend, created a new interface --- backend/auth/iam.go | 23 +++++++++++++++++++++++ backend/backend.go | 5 ----- 2 files changed, 23 insertions(+), 5 deletions(-) create mode 100644 backend/auth/iam.go diff --git a/backend/auth/iam.go b/backend/auth/iam.go new file mode 100644 index 00000000..0e5bc4f8 --- /dev/null +++ b/backend/auth/iam.go @@ -0,0 +1,23 @@ +package auth + +import "github.com/versity/scoutgw/s3err" + +type IAMConfig struct { + AccessAccounts map[string]string +} + +type IAMService interface { + GetIAMConfig() (*IAMConfig, error) +} + +type IAMServiceUnsupported struct{} + +var _ IAMService = &IAMServiceUnsupported{} + +func New() IAMService { + return &IAMServiceUnsupported{} +} + +func (IAMServiceUnsupported) GetIAMConfig() (*IAMConfig, error) { + return nil, s3err.GetAPIError(s3err.ErrNotImplemented) +} diff --git a/backend/backend.go b/backend/backend.go index c757336a..70db9939 100644 --- a/backend/backend.go +++ b/backend/backend.go @@ -13,7 +13,6 @@ import ( //go:generate moq -out ../s3api/controllers/backend_moq_test.go -pkg controllers . Backend type Backend interface { fmt.Stringer - GetIAMConfig() ([]byte, error) Shutdown() ListBuckets() (*s3.ListBucketsOutput, error) @@ -58,10 +57,6 @@ var _ Backend = &BackendUnsupported{} func New() Backend { return &BackendUnsupported{} } - -func (BackendUnsupported) GetIAMConfig() ([]byte, error) { - return nil, fmt.Errorf("not supported") -} func (BackendUnsupported) Shutdown() {} func (BackendUnsupported) String() string { return "Unsupported" From 510cf6ed573cb2574824cf974596dc97d5b6a707 Mon Sep 17 00:00:00 2001 From: jonaustin09 Date: Wed, 31 May 2023 15:26:19 +0400 Subject: [PATCH 2/6] feat: Added root user flags on application start --- cmd/scoutgw/main.go | 7 +++++-- s3api/middlewares/authentication.go | 12 ++++++++++++ s3api/server.go | 6 +++++- s3api/server_test.go | 17 ++++++++++------- s3api/utils/utils.go | 24 ++++++++++++++++++++++++ 5 files changed, 56 insertions(+), 10 deletions(-) create mode 100644 s3api/middlewares/authentication.go diff --git a/cmd/scoutgw/main.go b/cmd/scoutgw/main.go index 5b42a5db..8b3b1a32 100644 --- a/cmd/scoutgw/main.go +++ b/cmd/scoutgw/main.go @@ -1,16 +1,19 @@ package main import ( + "log" + "github.com/gofiber/fiber/v2" "github.com/versity/scoutgw/backend" "github.com/versity/scoutgw/s3api" - "log" + "github.com/versity/scoutgw/s3api/utils" ) func main() { app := fiber.New(fiber.Config{}) back := backend.New() - if api, err := s3api.New(app, back, ":7070"); err != nil { + rootUser := utils.GetRootUserCreds() + if api, err := s3api.New(app, back, ":7070", rootUser); err != nil { log.Fatalln(err) } else if err = api.Serve(); err != nil { log.Fatalln(err) diff --git a/s3api/middlewares/authentication.go b/s3api/middlewares/authentication.go new file mode 100644 index 00000000..fad57039 --- /dev/null +++ b/s3api/middlewares/authentication.go @@ -0,0 +1,12 @@ +package middlewares + +import ( + "github.com/gofiber/fiber/v2" + "github.com/versity/scoutgw/s3api/utils" +) + +func CheckUserCreds(user utils.RootUser) fiber.Handler { + return func(ctx *fiber.Ctx) error { + return ctx.Next() + } +} diff --git a/s3api/server.go b/s3api/server.go index 7ded07c5..bbecbc44 100644 --- a/s3api/server.go +++ b/s3api/server.go @@ -4,6 +4,8 @@ import ( "github.com/gofiber/fiber/v2" "github.com/gofiber/fiber/v2/middleware/logger" "github.com/versity/scoutgw/backend" + "github.com/versity/scoutgw/s3api/middlewares" + "github.com/versity/scoutgw/s3api/utils" ) type S3ApiServer struct { @@ -13,9 +15,11 @@ type S3ApiServer struct { port string } -func New(app *fiber.App, be backend.Backend, port string) (s3ApiServer *S3ApiServer, err error) { +func New(app *fiber.App, be backend.Backend, port string, rootUser utils.RootUser) (s3ApiServer *S3ApiServer, err error) { s3ApiServer = &S3ApiServer{app, be, new(S3ApiRouter), port} + utils.GetRootUserCreds() + app.Use(middlewares.CheckUserCreds(rootUser)) app.Use(logger.New()) s3ApiServer.router.Init(app, be) return diff --git a/s3api/server_test.go b/s3api/server_test.go index a9dd6867..8d5313e9 100644 --- a/s3api/server_test.go +++ b/s3api/server_test.go @@ -6,13 +6,15 @@ import ( "github.com/gofiber/fiber/v2" "github.com/versity/scoutgw/backend" + "github.com/versity/scoutgw/s3api/utils" ) func TestNew(t *testing.T) { type args struct { - app *fiber.App - be backend.Backend - port string + app *fiber.App + be backend.Backend + port string + rootUser utils.RootUser } app := fiber.New() @@ -29,9 +31,10 @@ func TestNew(t *testing.T) { { name: "Create S3 api server", args: args{ - app: app, - be: be, - port: port, + app: app, + be: be, + port: port, + rootUser: utils.RootUser{}, }, wantS3ApiServer: &S3ApiServer{ app: app, @@ -44,7 +47,7 @@ func TestNew(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - gotS3ApiServer, err := New(tt.args.app, tt.args.be, tt.args.port) + gotS3ApiServer, err := New(tt.args.app, tt.args.be, tt.args.port, tt.args.rootUser) if (err != nil) != tt.wantErr { t.Errorf("New() error = %v, wantErr %v", err, tt.wantErr) return diff --git a/s3api/utils/utils.go b/s3api/utils/utils.go index 216b1994..0d7aebf6 100644 --- a/s3api/utils/utils.go +++ b/s3api/utils/utils.go @@ -1,6 +1,8 @@ package utils import ( + "flag" + "os" "strings" "github.com/valyala/fasthttp" @@ -18,3 +20,25 @@ func GetUserMetaData(headers *fasthttp.RequestHeader) (metadata map[string]strin return } + +type RootUser struct { + Login string + Password string +} + +func GetRootUserCreds() (rootUser RootUser) { + loginPtr := flag.String("login", "", "Root user login") + passwordPtr := flag.String("password", "", "Root user password") + + flag.Parse() + + if *loginPtr == "" || *passwordPtr == "" { + os.Exit(3) + } + + rootUser = RootUser{ + Login: *loginPtr, + Password: *passwordPtr, + } + return +} From ecd28bc2f78bc3c3a432d18d5ebd4d5501bfff70 Mon Sep 17 00:00:00 2001 From: jonaustin09 Date: Wed, 31 May 2023 22:20:58 +0400 Subject: [PATCH 3/6] feat: Completed SigV4 authentication for the root user --- go.mod | 2 +- s3api/controllers/base.go | 52 ++++++++++---------- s3api/controllers/base_test.go | 2 +- s3api/middlewares/authentication.go | 75 ++++++++++++++++++++++++++++- s3api/server.go | 3 +- s3api/utils/utils.go | 29 +++++++++++ 6 files changed, 132 insertions(+), 31 deletions(-) diff --git a/go.mod b/go.mod index 32d30a1c..88c311b8 100644 --- a/go.mod +++ b/go.mod @@ -6,9 +6,9 @@ require ( github.com/aws/aws-sdk-go-v2 v1.18.0 github.com/aws/aws-sdk-go-v2/service/s3 v1.33.1 github.com/gofiber/fiber/v2 v2.45.0 - github.com/valyala/fasthttp v1.47.0 github.com/google/uuid v1.3.0 github.com/pkg/xattr v0.4.9 + github.com/valyala/fasthttp v1.47.0 golang.org/x/sys v0.8.0 ) diff --git a/s3api/controllers/base.go b/s3api/controllers/base.go index 5569e529..601a8020 100644 --- a/s3api/controllers/base.go +++ b/s3api/controllers/base.go @@ -28,7 +28,7 @@ func New(be backend.Backend) S3ApiController { func (c S3ApiController) ListBuckets(ctx *fiber.Ctx) error { res, err := c.be.ListBuckets() - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) GetActions(ctx *fiber.Ctx) error { @@ -49,17 +49,17 @@ func (c S3ApiController) GetActions(ctx *fiber.Ctx) error { } res, err := c.be.ListObjectParts(bucket, "", uploadId, partNumberMarker, maxParts) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if ctx.Request().URI().QueryArgs().Has("acl") { res, err := c.be.GetObjectAcl(bucket, key) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if attrs := ctx.Get("X-Amz-Object-Attributes"); attrs != "" { res, err := c.be.GetObjectAttributes(bucket, key, strings.Split(attrs, ",")) - return responce(ctx, res, err) + return Responce(ctx, res, err) } acceptRange := ctx.Get("Range") @@ -85,27 +85,27 @@ func (c S3ApiController) GetActions(ctx *fiber.Ctx) error { } res, err := c.be.GetObject(bucket, key, acceptRange, int64(startOffset), int64(length), ctx.Response().BodyWriter()) - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) ListActions(ctx *fiber.Ctx) error { if ctx.Request().URI().QueryArgs().Has("acl") { res, err := c.be.GetBucketAcl(ctx.Params("bucket")) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if ctx.Request().URI().QueryArgs().Has("uploads") { res, err := c.be.ListMultipartUploads(&s3.ListMultipartUploadsInput{Bucket: aws.String(ctx.Params("bucket"))}) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if ctx.QueryInt("list-type") == 2 { res, err := c.be.ListObjectsV2(ctx.Params("bucket"), "", "", "", 1) - return responce(ctx, res, err) + return Responce(ctx, res, err) } res, err := c.be.ListObjects(ctx.Params("bucket"), "", "", "", 1) - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) PutBucketActions(ctx *fiber.Ctx) error { @@ -134,11 +134,11 @@ func (c S3ApiController) PutBucketActions(ctx *fiber.Ctx) error { GrantWriteACP: &grantWriteACP, }) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } err := c.be.PutBucket(bucket) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { @@ -197,13 +197,13 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { CopySourceIfUnmodifiedSince: ©SrcUnmodifSinceDate, }) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if uploadId != "" { body := io.ReadSeeker(bytes.NewReader([]byte(ctx.Body()))) res, err := c.be.UploadPart(dstBucket, dstKeyStart, uploadId, body) - return responce(ctx, res, err) + return Responce(ctx, res, err) } if grants != "" || acl != "" { @@ -221,7 +221,7 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { GrantWrite: &granWrite, GrantWriteACP: &grantWriteACP, }) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } if copySource != "" { @@ -229,7 +229,7 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { srcBucket, srcObject := copySourceSplit[0], copySourceSplit[1:] res, err := c.be.CopyObject(srcBucket, strings.Join(srcObject, "/"), dstBucket, dstKeyStart) - return responce(ctx, res, err) + return Responce(ctx, res, err) } contentLength, err := strconv.ParseInt(contentLengthStr, 10, 64) @@ -246,12 +246,12 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { Metadata: metadata, Body: bytes.NewReader(ctx.Request().Body()), }) - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) DeleteBucket(ctx *fiber.Ctx) error { err := c.be.DeleteBucket(ctx.Params("bucket")) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } func (c S3ApiController) DeleteObjects(ctx *fiber.Ctx) error { @@ -261,7 +261,7 @@ func (c S3ApiController) DeleteObjects(ctx *fiber.Ctx) error { } err := c.be.DeleteObjects(ctx.Params("bucket"), &s3.DeleteObjectsInput{Delete: &dObj}) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } func (c S3ApiController) DeleteActions(ctx *fiber.Ctx) error { @@ -281,16 +281,16 @@ func (c S3ApiController) DeleteActions(ctx *fiber.Ctx) error { ExpectedBucketOwner: &expectedBucketOwner, RequestPayer: types.RequestPayer(requestPayer), }) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } err := c.be.DeleteObject(bucket, key) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } func (c S3ApiController) HeadBucket(ctx *fiber.Ctx) error { res, err := c.be.HeadBucket(ctx.Params("bucket")) - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) HeadObject(ctx *fiber.Ctx) error { @@ -300,7 +300,7 @@ func (c S3ApiController) HeadObject(ctx *fiber.Ctx) error { } res, err := c.be.HeadObject(bucket, key, "") - return responce(ctx, res, err) + return Responce(ctx, res, err) } func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error { @@ -313,7 +313,7 @@ func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error { if err := xml.Unmarshal(ctx.Body(), &restoreRequest); err == nil { err := c.be.RestoreObject(bucket, key, &restoreRequest) - return responce[any](ctx, nil, err) + return Responce[any](ctx, nil, err) } if uploadId != "" { @@ -324,13 +324,13 @@ func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error { } res, err := c.be.CompleteMultipartUpload(bucket, "", uploadId, parts) - return responce(ctx, res, err) + return Responce(ctx, res, err) } res, err := c.be.CreateMultipartUpload(&s3.CreateMultipartUploadInput{Bucket: &bucket, Key: &key}) - return responce(ctx, res, err) + return Responce(ctx, res, err) } -func responce[R comparable](ctx *fiber.Ctx, resp R, err error) error { +func Responce[R comparable](ctx *fiber.Ctx, resp R, err error) error { if err != nil { serr, ok := err.(s3err.APIError) if ok { diff --git a/s3api/controllers/base_test.go b/s3api/controllers/base_test.go index d3f1012a..7963d504 100644 --- a/s3api/controllers/base_test.go +++ b/s3api/controllers/base_test.go @@ -701,7 +701,7 @@ func Test_responce(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - if err := responce(tt.args.ctx, tt.args.resp, tt.args.err); (err != nil) != tt.wantErr { + if err := Responce(tt.args.ctx, tt.args.resp, tt.args.err); (err != nil) != tt.wantErr { t.Errorf("responce() error = %v, wantErr %v", err, tt.wantErr) } diff --git a/s3api/middlewares/authentication.go b/s3api/middlewares/authentication.go index fad57039..131a5abc 100644 --- a/s3api/middlewares/authentication.go +++ b/s3api/middlewares/authentication.go @@ -1,12 +1,85 @@ package middlewares import ( + "crypto/sha256" + "encoding/hex" + "strings" + "time" + + "github.com/aws/aws-sdk-go-v2/aws" + v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4" "github.com/gofiber/fiber/v2" + "github.com/versity/scoutgw/s3api/controllers" "github.com/versity/scoutgw/s3api/utils" + "github.com/versity/scoutgw/s3err" ) -func CheckUserCreds(user utils.RootUser) fiber.Handler { +const ( + iso8601Format = "20060102T150405Z" +) + +func VerifyV4Signature(user utils.RootUser) fiber.Handler { return func(ctx *fiber.Ctx) error { + authorization := ctx.Get("Authorization") + if authorization == "" { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrAuthHeaderEmpty)) + } + + // Check the signature version + authParts := strings.Split(authorization, " ") + if authParts[0] != "AWS4-HMAC-SHA256" { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrSignatureVersionNotSupported)) + } + + creds := strings.Split(strings.Split(authParts[1], "=")[1], "/") + + // Check X-Amz-Date header + date := ctx.Get("X-Amz-Date") + if date == "" { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrMissingDateHeader)) + } + + // Parse the date and check the date validity + tdate, err := time.Parse(iso8601Format, date) + if err != nil { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrMalformedDate)) + } + + // Calculate the hash of the request payload + hashedPayload := sha256.Sum256(ctx.Body()) + hexPayload := hex.EncodeToString(hashedPayload[:]) + + hashPayloadHeader := ctx.Get("X-Amz-Content-Sha256") + + // Compare the calculated hash with the hash provided + if hashPayloadHeader != hexPayload { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrContentSHA256Mismatch)) + } + + // Create a new http request instance from fasthttp request + req, err := utils.CreateHttpRequestFromCtx(ctx) + if err != nil { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrAccessDenied)) + } + + signer := v4.NewSigner() + + signErr := signer.SignHTTP(req.Context(), aws.Credentials{ + AccessKeyID: user.Login, + SecretAccessKey: user.Password, + }, req, hexPayload, creds[3], creds[2], tdate) + if signErr != nil { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrAccessDenied)) + } + + parts := strings.Split(req.Header.Get("Authorization"), " ") + calculatedSign := strings.Split(parts[3], "=")[1] + expectedSign := strings.Split(authParts[3], "=")[1] + + if expectedSign != calculatedSign { + return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrSignatureDoesNotMatch)) + } + return ctx.Next() } } diff --git a/s3api/server.go b/s3api/server.go index bbecbc44..fe8d9d6b 100644 --- a/s3api/server.go +++ b/s3api/server.go @@ -17,9 +17,8 @@ type S3ApiServer struct { func New(app *fiber.App, be backend.Backend, port string, rootUser utils.RootUser) (s3ApiServer *S3ApiServer, err error) { s3ApiServer = &S3ApiServer{app, be, new(S3ApiRouter), port} - utils.GetRootUserCreds() - app.Use(middlewares.CheckUserCreds(rootUser)) + app.Use(middlewares.VerifyV4Signature(rootUser)) app.Use(logger.New()) s3ApiServer.router.Init(app, be) return diff --git a/s3api/utils/utils.go b/s3api/utils/utils.go index 0d7aebf6..7e3f3581 100644 --- a/s3api/utils/utils.go +++ b/s3api/utils/utils.go @@ -1,10 +1,14 @@ package utils import ( + "bytes" + "errors" "flag" + "net/http" "os" "strings" + "github.com/gofiber/fiber/v2" "github.com/valyala/fasthttp" ) @@ -42,3 +46,28 @@ func GetRootUserCreds() (rootUser RootUser) { } return } + +func CreateHttpRequestFromCtx(ctx *fiber.Ctx) (*http.Request, error) { + req := ctx.Request() + + httpReq, err := http.NewRequest(string(req.Header.Method()), req.URI().String(), bytes.NewReader(req.Body())) + if err != nil { + return nil, errors.New("error in creating an http request") + } + + // Set the request headers + req.Header.VisitAll(func(key, value []byte) { + keyStr := string(key) + if keyStr == "X-Amz-Date" || keyStr == "X-Amz-Content-Sha256" || keyStr == "Host" { + httpReq.Header.Add(keyStr, string(value)) + } + }) + + // Set the Content-Length header + httpReq.ContentLength = int64(len(req.Body())) + + // Set the Host header + httpReq.Host = string(req.Header.Host()) + + return httpReq, nil +} From 8e86acf20bd269fcccf445ad269022ea4ef9f79d Mon Sep 17 00:00:00 2001 From: jonaustin09 Date: Wed, 31 May 2023 22:49:52 +0400 Subject: [PATCH 4/6] fix: Fixed the dependencie conflict in go.mod --- go.mod | 3 --- 1 file changed, 3 deletions(-) diff --git a/go.mod b/go.mod index bbc91b2c..d79b4f2f 100644 --- a/go.mod +++ b/go.mod @@ -5,9 +5,6 @@ go 1.20 require ( github.com/aws/aws-sdk-go-v2 v1.18.0 github.com/aws/aws-sdk-go-v2/service/s3 v1.33.1 - github.com/gofiber/fiber/v2 v2.45.0 - github.com/google/uuid v1.3.0 - github.com/pkg/xattr v0.4.9 github.com/gofiber/fiber/v2 v2.46.0 github.com/google/uuid v1.3.0 github.com/pkg/xattr v0.4.9 From 04bbe61826b5aaa11ca978138ad6a028e9ddf108 Mon Sep 17 00:00:00 2001 From: jonaustin09 Date: Thu, 1 Jun 2023 00:16:01 +0400 Subject: [PATCH 5/6] fix: Removed root user flags --- cmd/versitygw/main.go | 6 ++---- s3api/middlewares/authentication.go | 11 ++++++++--- s3api/server.go | 5 ++--- s3api/server_test.go | 20 ++++++++++---------- s3api/utils/utils.go | 24 ------------------------ 5 files changed, 22 insertions(+), 44 deletions(-) diff --git a/cmd/versitygw/main.go b/cmd/versitygw/main.go index 9c99d1b1..04f509b2 100644 --- a/cmd/versitygw/main.go +++ b/cmd/versitygw/main.go @@ -24,7 +24,7 @@ import ( "github.com/urfave/cli/v2" "github.com/versity/versitygw/backend" "github.com/versity/versitygw/s3api" - "github.com/versity/versitygw/s3api/utils" + "github.com/versity/versitygw/s3api/middlewares" ) var ( @@ -144,9 +144,7 @@ func runGateway(be backend.Backend) error { opts = append(opts, s3api.WithTLS(cert)) } - rootUser := utils.GetRootUserCreds() - - srv, err := s3api.New(app, be, port, rootUser, opts...) + srv, err := s3api.New(app, be, port, middlewares.AdminUser{AdminAccess: adminAccess, AdminSecret: adminSecret}, opts...) if err != nil { return fmt.Errorf("init gateway: %v", err) } diff --git a/s3api/middlewares/authentication.go b/s3api/middlewares/authentication.go index a69e290e..0cc35f47 100644 --- a/s3api/middlewares/authentication.go +++ b/s3api/middlewares/authentication.go @@ -32,7 +32,12 @@ const ( iso8601Format = "20060102T150405Z" ) -func VerifyV4Signature(user utils.RootUser) fiber.Handler { +type AdminUser struct { + AdminAccess string + AdminSecret string +} + +func VerifyV4Signature(user AdminUser) fiber.Handler { return func(ctx *fiber.Ctx) error { authorization := ctx.Get("Authorization") if authorization == "" { @@ -79,8 +84,8 @@ func VerifyV4Signature(user utils.RootUser) fiber.Handler { signer := v4.NewSigner() signErr := signer.SignHTTP(req.Context(), aws.Credentials{ - AccessKeyID: user.Login, - SecretAccessKey: user.Password, + AccessKeyID: user.AdminAccess, + SecretAccessKey: user.AdminSecret, }, req, hexPayload, creds[3], creds[2], tdate) if signErr != nil { return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrAccessDenied)) diff --git a/s3api/server.go b/s3api/server.go index b78ae796..906d7d1e 100644 --- a/s3api/server.go +++ b/s3api/server.go @@ -21,7 +21,6 @@ import ( "github.com/gofiber/fiber/v2/middleware/logger" "github.com/versity/versitygw/backend" "github.com/versity/versitygw/s3api/middlewares" - "github.com/versity/versitygw/s3api/utils" ) type S3ApiServer struct { @@ -32,7 +31,7 @@ type S3ApiServer struct { cert *tls.Certificate } -func New(app *fiber.App, be backend.Backend, port string, rootUser utils.RootUser, opts ...Option) (*S3ApiServer, error) { +func New(app *fiber.App, be backend.Backend, port string, adminUser middlewares.AdminUser, opts ...Option) (*S3ApiServer, error) { server := &S3ApiServer{ app: app, backend: be, @@ -44,7 +43,7 @@ func New(app *fiber.App, be backend.Backend, port string, rootUser utils.RootUse opt(server) } - app.Use(middlewares.VerifyV4Signature(rootUser)) + app.Use(middlewares.VerifyV4Signature(adminUser)) app.Use(logger.New()) server.router.Init(app, be) return server, nil diff --git a/s3api/server_test.go b/s3api/server_test.go index b4280bfb..2249e05c 100644 --- a/s3api/server_test.go +++ b/s3api/server_test.go @@ -20,15 +20,15 @@ import ( "github.com/gofiber/fiber/v2" "github.com/versity/versitygw/backend" - "github.com/versity/versitygw/s3api/utils" + "github.com/versity/versitygw/s3api/middlewares" ) func TestNew(t *testing.T) { type args struct { - app *fiber.App - be backend.Backend - port string - rootUser utils.RootUser + app *fiber.App + be backend.Backend + port string + adminUser middlewares.AdminUser } app := fiber.New() @@ -45,10 +45,10 @@ func TestNew(t *testing.T) { { name: "Create S3 api server", args: args{ - app: app, - be: be, - port: port, - rootUser: utils.RootUser{}, + app: app, + be: be, + port: port, + adminUser: middlewares.AdminUser{}, }, wantS3ApiServer: &S3ApiServer{ app: app, @@ -61,7 +61,7 @@ func TestNew(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - gotS3ApiServer, err := New(tt.args.app, tt.args.be, tt.args.port, tt.args.rootUser) + gotS3ApiServer, err := New(tt.args.app, tt.args.be, tt.args.port, tt.args.adminUser) if (err != nil) != tt.wantErr { t.Errorf("New() error = %v, wantErr %v", err, tt.wantErr) return diff --git a/s3api/utils/utils.go b/s3api/utils/utils.go index a7ae3e9c..f218edc0 100644 --- a/s3api/utils/utils.go +++ b/s3api/utils/utils.go @@ -17,9 +17,7 @@ package utils import ( "bytes" "errors" - "flag" "net/http" - "os" "strings" "github.com/gofiber/fiber/v2" @@ -39,28 +37,6 @@ func GetUserMetaData(headers *fasthttp.RequestHeader) (metadata map[string]strin return } -type RootUser struct { - Login string - Password string -} - -func GetRootUserCreds() (rootUser RootUser) { - loginPtr := flag.String("login", "", "Root user login") - passwordPtr := flag.String("password", "", "Root user password") - - flag.Parse() - - if *loginPtr == "" || *passwordPtr == "" { - os.Exit(3) - } - - rootUser = RootUser{ - Login: *loginPtr, - Password: *passwordPtr, - } - return -} - func CreateHttpRequestFromCtx(ctx *fiber.Ctx) (*http.Request, error) { req := ctx.Request() From 489bb3e89958a58bb0575d86f02547e6c56286a2 Mon Sep 17 00:00:00 2001 From: jonaustin09 Date: Thu, 1 Jun 2023 00:23:50 +0400 Subject: [PATCH 6/6] feat: Server side region added to AdminConfig, v4 signature calculation implemented with server side region --- cmd/versitygw/main.go | 2 +- s3api/middlewares/authentication.go | 11 ++++++----- s3api/server.go | 2 +- s3api/server_test.go | 4 ++-- 4 files changed, 10 insertions(+), 9 deletions(-) diff --git a/cmd/versitygw/main.go b/cmd/versitygw/main.go index 04f509b2..ab0cb0a3 100644 --- a/cmd/versitygw/main.go +++ b/cmd/versitygw/main.go @@ -144,7 +144,7 @@ func runGateway(be backend.Backend) error { opts = append(opts, s3api.WithTLS(cert)) } - srv, err := s3api.New(app, be, port, middlewares.AdminUser{AdminAccess: adminAccess, AdminSecret: adminSecret}, opts...) + srv, err := s3api.New(app, be, port, middlewares.AdminConfig{AdminAccess: adminAccess, AdminSecret: adminSecret, Region: region}, opts...) if err != nil { return fmt.Errorf("init gateway: %v", err) } diff --git a/s3api/middlewares/authentication.go b/s3api/middlewares/authentication.go index 0cc35f47..fe52e39d 100644 --- a/s3api/middlewares/authentication.go +++ b/s3api/middlewares/authentication.go @@ -32,12 +32,13 @@ const ( iso8601Format = "20060102T150405Z" ) -type AdminUser struct { +type AdminConfig struct { AdminAccess string AdminSecret string + Region string } -func VerifyV4Signature(user AdminUser) fiber.Handler { +func VerifyV4Signature(config AdminConfig) fiber.Handler { return func(ctx *fiber.Ctx) error { authorization := ctx.Get("Authorization") if authorization == "" { @@ -84,9 +85,9 @@ func VerifyV4Signature(user AdminUser) fiber.Handler { signer := v4.NewSigner() signErr := signer.SignHTTP(req.Context(), aws.Credentials{ - AccessKeyID: user.AdminAccess, - SecretAccessKey: user.AdminSecret, - }, req, hexPayload, creds[3], creds[2], tdate) + AccessKeyID: config.AdminAccess, + SecretAccessKey: config.AdminSecret, + }, req, hexPayload, creds[3], config.Region, tdate) if signErr != nil { return controllers.Responce[any](ctx, nil, s3err.GetAPIError(s3err.ErrAccessDenied)) } diff --git a/s3api/server.go b/s3api/server.go index 906d7d1e..51c28b09 100644 --- a/s3api/server.go +++ b/s3api/server.go @@ -31,7 +31,7 @@ type S3ApiServer struct { cert *tls.Certificate } -func New(app *fiber.App, be backend.Backend, port string, adminUser middlewares.AdminUser, opts ...Option) (*S3ApiServer, error) { +func New(app *fiber.App, be backend.Backend, port string, adminUser middlewares.AdminConfig, opts ...Option) (*S3ApiServer, error) { server := &S3ApiServer{ app: app, backend: be, diff --git a/s3api/server_test.go b/s3api/server_test.go index 2249e05c..f34b9784 100644 --- a/s3api/server_test.go +++ b/s3api/server_test.go @@ -28,7 +28,7 @@ func TestNew(t *testing.T) { app *fiber.App be backend.Backend port string - adminUser middlewares.AdminUser + adminUser middlewares.AdminConfig } app := fiber.New() @@ -48,7 +48,7 @@ func TestNew(t *testing.T) { app: app, be: be, port: port, - adminUser: middlewares.AdminUser{}, + adminUser: middlewares.AdminConfig{}, }, wantS3ApiServer: &S3ApiServer{ app: app,