fix: 0 len content-len header missing in signed headers

This fixes the case where clients can include the content-length
header in the signed headers for a 0 length file (like s3cmd).

Since we had to hoist the aws code into versitygw, we can also
remove the hack for the "User-Agent" header in the hard coded
excludes list and just remove it from the excludes list.

s3api/utils/auth-reader.go

@@ -24,9 +24,9 @@ import (
 	"unicode"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
-	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
 	"github.com/aws/smithy-go/logging"
 	"github.com/gofiber/fiber/v2"
+	v4 "github.com/versity/versitygw/aws/signer/v4"
 	"github.com/versity/versitygw/s3err"
 )
 
@@ -131,7 +131,7 @@ func CheckValidSignature(ctx *fiber.Ctx, auth AuthData, secret, checksum string,
 			AccessKeyID:     auth.Access,
 			SecretAccessKey: secret,
 		},
-		req, checksum, service, auth.Region, tdate,
+		req, checksum, service, auth.Region, tdate, signedHdrs,
 		func(options *v4.SignerOptions) {
 			options.DisableURIPathEscaping = true
 			if debug {

s3api/utils/auth_test.go

@@ -6,9 +6,9 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
-	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
 	"github.com/gofiber/fiber/v2"
 	"github.com/valyala/fasthttp/fasthttputil"
+	v4 "github.com/versity/versitygw/aws/signer/v4"
 )
 
 func TestAuthParse(t *testing.T) {
@@ -93,7 +93,7 @@ func Test_Client_UserAgent(t *testing.T) {
 				AccessKeyID:     access,
 				SecretAccessKey: secret,
 			},
-			req, zeroLenSig, service, region, tdate,
+			req, zeroLenSig, service, region, tdate, signedHdrs,
 			func(options *v4.SignerOptions) {
 				options.DisableURIPathEscaping = true
 			})

s3api/utils/sign_hack.go

@@ -1,48 +0,0 @@
-// Copyright 2023 Versity Software
-// This file is licensed under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-package utils
-
-import (
-	"reflect"
-	"unsafe"
-)
-
-// This is a hack to replace the default IgnoredHeaders in the aws-sdk-go-v2
-// internal/v4 package. Some AWS applications
-// (e.g. AWS Java SDK v1, Athena JDBC driver, s3 browser) sign the requests
-// including the User-Agent header. The aws sdk doesn't allow directly
-// modifying the ignored header list. Below is a hack to replace this list
-// with our own.
-
-type Rule interface {
-	IsValid(value string) bool
-}
-type Rules []Rule
-
-//go:linkname __ignoredHeaders github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4.IgnoredHeaders
-var __ignoredHeaders unsafe.Pointer
-
-func init() {
-	// Avoids "go.info.github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4.IgnoredHeaders:
-	// relocation target go.info.github.com/xxx/xxx/xxx.Rules not defined"
-	var ignoredHeaders = (*Rules)(unsafe.Pointer(&__ignoredHeaders))
-
-	// clear the map, and set just the ignored headers we want
-	reflect.ValueOf((*ignoredHeaders)[0]).FieldByName("Rule").Elem().Clear()
-	reflect.ValueOf((*ignoredHeaders)[0]).FieldByName("Rule").Elem().SetMapIndex(
-		reflect.ValueOf("Authorization"), reflect.ValueOf(struct{}{}))
-	reflect.ValueOf((*ignoredHeaders)[0]).FieldByName("Rule").Elem().SetMapIndex(
-		reflect.ValueOf("Expect"), reflect.ValueOf(struct{}{}))
-}