mirror of
https://github.com/versity/versitygw.git
synced 2026-09-04 07:06:59 +00:00
feat: add AWS-compatible standalone IAM service
Closes #1640 Add a standalone AWS IAM Query API implementation for managing IAM users through standard AWS SDKs and the AWS CLI. Server usage Start the IAM server with internal file-backed storage: mkdir -p /tmp/versitygw-iam ./versitygw --port 127.0.0.1:7070 --access user --secret pass iam --dir /tmp/versitygw-iam Start the IAM server with Vault KV v2 storage using AppRole: VGW_IAM_VAULT_ROLE_SECRET=<role-secret> ./versitygw --port 127.0.0.1:7070 --access user --secret pass iam --vault-endpoint-url http://127.0.0.1:8200 --vault-auth-method approle --vault-role-id <role-id> --vault-mount-path kv --vault-secret-storage-path iam Vault authentication also supports root tokens, separate authentication and secret-storage namespaces, custom mount paths, server certificate validation, and mutual TLS client certificates. Configure the AWS CLI credentials used by the IAM server: export AWS_ACCESS_KEY_ID=user export AWS_SECRET_ACCESS_KEY=pass export AWS_DEFAULT_REGION=us-east-1 Implemented IAM actions CreateUser creates an IAM user with an AWS-compatible ARN, generated AIDA user ID, creation timestamp, optional path, and tags. It validates usernames, paths, tag limits, reserved tag prefixes, duplicate tag keys, and existing users. aws --endpoint-url http://127.0.0.1:7070 iam create-user --user-name bob aws --endpoint-url http://127.0.0.1:7070 iam create-user --user-name bob --path /engineering/ --tags Key=team,Value=storage GetUser returns a stored user or the root identity when requested without a username through the IAM Query API. aws --endpoint-url http://127.0.0.1:7070 iam get-user --user-name bob ListUsers returns users in deterministic username order and supports path filtering, marker-based pagination, and MaxItems limits. aws --endpoint-url http://127.0.0.1:7070 iam list-users aws --endpoint-url http://127.0.0.1:7070 iam list-users --path-prefix /engineering/ --max-items 100 UpdateUser updates the username and/or path, recalculates the user ARN, and rejects conflicts with existing users. aws --endpoint-url http://127.0.0.1:7070 iam update-user --user-name bob --new-user-name robert --new-path /platform/ DeleteUser permanently removes an IAM user and returns AWS-compatible errors for missing users. aws --endpoint-url http://127.0.0.1:7070 iam delete-user --user-name robert IAM protocol and authentication - Support the AWS IAM Query protocol version 2010-05-08 over GET and POST form requests. - Return AWS-compatible XML responses, error documents, status codes, request IDs, user metadata, and pagination fields. - Authenticate root credentials with AWS Signature Version 4 for the IAM service in us-east-1. - Support both Authorization-header and query-string SigV4 authentication. - Validate credential scope, signed headers, timestamps, clock skew, content length, signatures, and unsupported signature or session-token modes. - Add IAM-specific validation and error mapping for malformed requests, invalid actions, duplicate entities, missing users, throttling, and internal failures. Storage implementations - Add an internal JSON-backed store using iam.json and iam.json.backup with atomic temporary-file replacement, concurrent access protection, stable ordering, pagination, and persistence across restarts. - Add a Vault KV v2 store with one secret per user, CAS-based duplicate protection, permanent deletion, AppRole reauthentication, namespace support, configurable authentication and KV mounts, root-token authentication, and TLS/mTLS configuration. - Introduce a common Storer interface and require exactly one storage backend to be configured. Server and embedding support - Register the new `versitygw iam` command with environment-variable and CLI configuration for both storage backends. - Add `embedgw.RunIAMAPI` and `IAMConfig` for embedding the IAM service in Go applications. Gateway-level internal packages - Add `internal/iamstore` as a reusable generic file-backed IAM persistence engine and migrate the existing gateway internal IAM service to it. - Add `internal/sigv4auth` for shared SigV4 header and presigned-query parsing, canonical request generation, signature verification, and structured authentication errors. - Refactor the S3 authentication paths to use the shared SigV4 implementation while preserving S3-specific error responses. - Add `internal/httpctx` for shared Fiber context keys and AWS-style request ID handling. - Add `internal/routekit` for shared query, form, and header route matchers. - Add `internal/netutil` for reusable certificate storage, hostname-aware listeners, multi-address serving, TLS listeners, and UNIX socket handling. - Update the custom SigV4 signer to honor an explicitly supplied signed-header list so unrelated headers do not alter IAM signatures. Testing and CI - Add AWS IAM SDK-based integration coverage for all supported user actions, header authentication, query authentication, validation, errors, filtering, and pagination. - Split standalone IAM tests into `versitygw test iam` and retain existing gateway IAM tests under `versitygw test gw-iam`. - Add unit coverage for controllers, authentication, routing, storage, embedding, listeners, request matching, persistence, and signing behavior. - Add `runiamtests.sh` to exercise internal storage over HTTP and HTTPS plus Vault storage through AppRole. - Add a dedicated IAM functional-test workflow with a Vault service and merged runtime coverage reporting. - Include the IAM test runner in shellcheck and add the AWS IAM SDK dependency.
This commit is contained in:
niksis02
+97
-181
@@ -18,97 +18,42 @@ import (
|
||||
"crypto/hmac"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
"errors"
|
||||
"time"
|
||||
"unicode"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
"github.com/aws/smithy-go/logging"
|
||||
"github.com/gofiber/fiber/v3"
|
||||
v4 "github.com/versity/versitygw/aws/signer/v4"
|
||||
"github.com/versity/versitygw/debuglogger"
|
||||
"github.com/versity/versitygw/internal/sigv4auth"
|
||||
"github.com/versity/versitygw/s3err"
|
||||
)
|
||||
|
||||
const (
|
||||
iso8601Format = "20060102T150405Z"
|
||||
yyyymmdd = "20060102"
|
||||
iso8601Format = sigv4auth.ISO8601Format
|
||||
yyyymmdd = sigv4auth.YYYYMMDD
|
||||
)
|
||||
|
||||
func HexBytes(s string) string {
|
||||
b := []byte(s) // raw UTF-8 bytes
|
||||
|
||||
parts := make([]string, len(b))
|
||||
for i, v := range b {
|
||||
parts[i] = fmt.Sprintf("%02x", v)
|
||||
}
|
||||
|
||||
return strings.Join(parts, " ")
|
||||
return sigv4auth.HexBytes(s)
|
||||
}
|
||||
|
||||
const (
|
||||
service = "s3"
|
||||
service = sigv4auth.ServiceS3
|
||||
)
|
||||
|
||||
// CheckValidSignature validates the ctx v4 auth signature
|
||||
func CheckValidSignature(ctx fiber.Ctx, auth AuthData, secret, checksum string, tdate time.Time, contentLen int64) (string, error) {
|
||||
signedHdrs := strings.Split(auth.SignedHeaders, ";")
|
||||
|
||||
// Create a new http request instance from fasthttp request
|
||||
req, err := createHttpRequestFromCtx(ctx, signedHdrs, contentLen)
|
||||
result, err := sigv4auth.CheckSignature(ctx, auth, secret, checksum, tdate, contentLen, sigv4auth.CheckOptions{
|
||||
Service: service,
|
||||
DisableURIPathEscaping: true,
|
||||
})
|
||||
if err != nil {
|
||||
return "", err
|
||||
return "", mapSigV4Error(err)
|
||||
}
|
||||
|
||||
signer := v4.NewSigner()
|
||||
|
||||
signMeta, err := signer.SignHTTP(req.Context(),
|
||||
aws.Credentials{
|
||||
AccessKeyID: auth.Access,
|
||||
SecretAccessKey: secret,
|
||||
},
|
||||
req, checksum, service, auth.Region, tdate, signedHdrs,
|
||||
func(options *v4.SignerOptions) {
|
||||
options.DisableURIPathEscaping = true
|
||||
if debuglogger.IsDebugEnabled() {
|
||||
options.LogSigning = true
|
||||
options.Logger = logging.NewStandardLogger(os.Stderr)
|
||||
}
|
||||
})
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("sign generated http request: %w", err)
|
||||
}
|
||||
|
||||
genAuth, err := ParseAuthorization(req.Header.Get("Authorization"))
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
if auth.Signature != genAuth.Signature {
|
||||
return "", s3err.GetSignatureDoesNotMatchErr(
|
||||
auth.Access,
|
||||
signMeta.StringToSign,
|
||||
auth.Signature,
|
||||
HexBytes(signMeta.StringToSign),
|
||||
signMeta.CanonicalString,
|
||||
HexBytes(signMeta.CanonicalString),
|
||||
)
|
||||
}
|
||||
|
||||
return signMeta.CanonicalString, nil
|
||||
return result.CanonicalString, nil
|
||||
}
|
||||
|
||||
// AuthData is the parsed authorization data from the header
|
||||
type AuthData struct {
|
||||
Algorithm string
|
||||
Access string
|
||||
Region string
|
||||
SignedHeaders string
|
||||
Signature string
|
||||
Date string
|
||||
}
|
||||
// AuthData is the parsed authorization data from the header.
|
||||
type AuthData = sigv4auth.AuthData
|
||||
|
||||
// ParseAuthorization returns the parsed fields for the aws v4 auth header
|
||||
// example authorization string from aws docs:
|
||||
@@ -117,93 +62,14 @@ type AuthData struct {
|
||||
// SignedHeaders=host;range;x-amz-date,
|
||||
// Signature=fe5f80f77d5fa3beca038a248ff027d0445342fe2855ddc963176630326f1024
|
||||
func ParseAuthorization(authorization string) (AuthData, error) {
|
||||
a := AuthData{}
|
||||
|
||||
// authorization must start with:
|
||||
// Authorization: <ALGORITHM>
|
||||
// followed by key=value pairs separated by ","
|
||||
authParts := strings.SplitN(authorization, " ", 2)
|
||||
for i, el := range authParts {
|
||||
if strings.Contains(el, " ") {
|
||||
authParts[i] = removeSpace(el)
|
||||
}
|
||||
authData, err := sigv4auth.ParseAuthorization(authorization, service)
|
||||
if err != nil {
|
||||
return AuthData{}, mapSigV4Error(err)
|
||||
}
|
||||
|
||||
if len(authParts) < 2 {
|
||||
return a, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthHeader, authorization)
|
||||
}
|
||||
|
||||
algo := authParts[0]
|
||||
if algo == "AWS" {
|
||||
// SigV2 authorization is not supported by the gateway
|
||||
return a, s3err.GetAPIError(s3err.ErrUnsupportedAuthorizationMechanism)
|
||||
}
|
||||
if algo != "AWS4-HMAC-SHA256" {
|
||||
return a, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, algo)
|
||||
}
|
||||
|
||||
kvData := authParts[1]
|
||||
kvPairs := strings.Split(kvData, ",")
|
||||
// we are expecting at least Credential, SignedHeaders, and Signature
|
||||
// key value pairs here
|
||||
if len(kvPairs) != 3 {
|
||||
return a, s3err.MalformedAuth.MissingComponents()
|
||||
}
|
||||
|
||||
var access, region, signedHeaders, signature, date string
|
||||
|
||||
for i, kv := range kvPairs {
|
||||
keyValue := strings.Split(kv, "=")
|
||||
if len(keyValue) != 2 {
|
||||
return a, s3err.MalformedAuth.MalformedComponent(kv)
|
||||
}
|
||||
key, value := keyValue[0], keyValue[1]
|
||||
switch i {
|
||||
case 0:
|
||||
if key != "Credential" {
|
||||
return a, s3err.MalformedAuth.MissingCredential()
|
||||
}
|
||||
case 1:
|
||||
if key != "SignedHeaders" {
|
||||
return a, s3err.MalformedAuth.MissingSignedHeaders()
|
||||
}
|
||||
case 2:
|
||||
if key != "Signature" {
|
||||
return a, s3err.MalformedAuth.MissingSignature()
|
||||
}
|
||||
}
|
||||
|
||||
switch key {
|
||||
case "Credential":
|
||||
creds, err := ParseCredentials(value, s3err.MalformedAuth)
|
||||
if err != nil {
|
||||
return a, err
|
||||
}
|
||||
access = creds.Access
|
||||
date = creds.Date
|
||||
region = creds.Region
|
||||
case "SignedHeaders":
|
||||
signedHeaders = value
|
||||
case "Signature":
|
||||
signature = value
|
||||
}
|
||||
}
|
||||
|
||||
return AuthData{
|
||||
Algorithm: algo,
|
||||
Access: access,
|
||||
Region: region,
|
||||
SignedHeaders: signedHeaders,
|
||||
Signature: signature,
|
||||
Date: date,
|
||||
}, nil
|
||||
return authData, nil
|
||||
}
|
||||
|
||||
type CredentialsScope struct {
|
||||
Access string
|
||||
Date string
|
||||
Region string
|
||||
}
|
||||
type CredentialsScope = sigv4auth.CredentialsScope
|
||||
|
||||
type CredsError interface {
|
||||
MalformedCredential(string) s3err.S3Error
|
||||
@@ -213,36 +79,11 @@ type CredsError interface {
|
||||
}
|
||||
|
||||
func ParseCredentials(input string, errHandler CredsError) (*CredentialsScope, error) {
|
||||
creds := strings.Split(input, "/")
|
||||
if len(creds) != 5 {
|
||||
return nil, errHandler.MalformedCredential(input)
|
||||
}
|
||||
if creds[3] != "s3" {
|
||||
return nil, errHandler.IncorrectService(input, creds[3])
|
||||
}
|
||||
if creds[4] != "aws4_request" {
|
||||
return nil, errHandler.IncorrectTerminal(input, creds[4])
|
||||
}
|
||||
_, err := time.Parse(yyyymmdd, creds[1])
|
||||
creds, err := sigv4auth.ParseCredentials(input, service)
|
||||
if err != nil {
|
||||
return nil, errHandler.InvalidDateFormat(input, creds[1])
|
||||
return nil, mapCredentialsError(input, err, errHandler)
|
||||
}
|
||||
return &CredentialsScope{
|
||||
Access: creds[0],
|
||||
Date: creds[1],
|
||||
Region: creds[2],
|
||||
}, nil
|
||||
}
|
||||
|
||||
func removeSpace(str string) string {
|
||||
var b strings.Builder
|
||||
b.Grow(len(str))
|
||||
for _, ch := range str {
|
||||
if !unicode.IsSpace(ch) {
|
||||
b.WriteRune(ch)
|
||||
}
|
||||
}
|
||||
return b.String()
|
||||
return creds, nil
|
||||
}
|
||||
|
||||
func SignPostPolicy(base64Policy, yyyymmdd, region, secretKey string) (string, error) {
|
||||
@@ -264,3 +105,78 @@ func hmacSHA256(key, data []byte) []byte {
|
||||
h.Write(data)
|
||||
return h.Sum(nil)
|
||||
}
|
||||
|
||||
func mapSigV4Error(err error) error {
|
||||
var parseErr *sigv4auth.ParseError
|
||||
if errors.As(err, &parseErr) {
|
||||
return mapAuthParseError(parseErr)
|
||||
}
|
||||
|
||||
var headersErr *sigv4auth.HeadersNotSignedError
|
||||
if errors.As(err, &headersErr) {
|
||||
return s3err.GetHeadersNotSignedErr(headersErr.Headers)
|
||||
}
|
||||
|
||||
var sigErr *sigv4auth.SignatureMismatchError
|
||||
if errors.As(err, &sigErr) {
|
||||
return s3err.GetSignatureDoesNotMatchErr(
|
||||
sigErr.AccessKeyID,
|
||||
sigErr.StringToSign,
|
||||
sigErr.SignatureProvided,
|
||||
sigErr.StringToSignBytes,
|
||||
sigErr.CanonicalRequest,
|
||||
sigErr.CanonicalRequestBytes,
|
||||
)
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
func mapAuthParseError(err *sigv4auth.ParseError) error {
|
||||
switch err.Kind {
|
||||
case sigv4auth.ErrInvalidAuthorizationHeader:
|
||||
return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthHeader, err.Input)
|
||||
case sigv4auth.ErrUnsupportedAuthorizationVersion:
|
||||
return s3err.GetAPIError(s3err.ErrUnsupportedAuthorizationMechanism)
|
||||
case sigv4auth.ErrInvalidAuthorizationType:
|
||||
return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Value)
|
||||
case sigv4auth.ErrMissingComponents:
|
||||
return s3err.MalformedAuth.MissingComponents()
|
||||
case sigv4auth.ErrMissingCredential:
|
||||
return s3err.MalformedAuth.MissingCredential()
|
||||
case sigv4auth.ErrMissingSignedHeaders:
|
||||
return s3err.MalformedAuth.MissingSignedHeaders()
|
||||
case sigv4auth.ErrMissingSignature:
|
||||
return s3err.MalformedAuth.MissingSignature()
|
||||
case sigv4auth.ErrMalformedComponent:
|
||||
return s3err.MalformedAuth.MalformedComponent(err.Value)
|
||||
default:
|
||||
return mapCredentialsParseError(err, s3err.MalformedAuth)
|
||||
}
|
||||
}
|
||||
|
||||
func mapCredentialsError(input string, err error, errHandler CredsError) error {
|
||||
var parseErr *sigv4auth.ParseError
|
||||
if !errors.As(err, &parseErr) {
|
||||
return err
|
||||
}
|
||||
if parseErr.Input == "" {
|
||||
parseErr.Input = input
|
||||
}
|
||||
return mapCredentialsParseError(parseErr, errHandler)
|
||||
}
|
||||
|
||||
func mapCredentialsParseError(err *sigv4auth.ParseError, errHandler CredsError) error {
|
||||
switch err.Kind {
|
||||
case sigv4auth.ErrMalformedCredential:
|
||||
return errHandler.MalformedCredential(err.Input)
|
||||
case sigv4auth.ErrIncorrectService:
|
||||
return errHandler.IncorrectService(err.Input, err.Actual)
|
||||
case sigv4auth.ErrIncorrectTerminal:
|
||||
return errHandler.IncorrectTerminal(err.Input, err.Actual)
|
||||
case sigv4auth.ErrInvalidDateFormat:
|
||||
return errHandler.InvalidDateFormat(err.Input, err.Value)
|
||||
default:
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
+19
-38
@@ -14,48 +14,29 @@
|
||||
|
||||
package utils
|
||||
|
||||
import (
|
||||
"github.com/gofiber/fiber/v3"
|
||||
)
|
||||
import "github.com/versity/versitygw/internal/httpctx"
|
||||
|
||||
// Region, StartTime, IsRoot, Account, AccessKey context locals
|
||||
// are set to default values in middlewares.SetDefaultValues
|
||||
// to avoid the nil interface conversions
|
||||
type ContextKey string
|
||||
type ContextKey = httpctx.ContextKey
|
||||
|
||||
const (
|
||||
ContextKeyRegion ContextKey = "region"
|
||||
ContextKeyStartTime ContextKey = "start-time"
|
||||
ContextKeyIsRoot ContextKey = "is-root"
|
||||
ContextKeyRootAccessKey ContextKey = "root-access-key"
|
||||
ContextKeyAccount ContextKey = "account"
|
||||
ContextKeyAuthenticated ContextKey = "authenticated"
|
||||
ContextKeyPublicBucket ContextKey = "public-bucket"
|
||||
ContextKeyParsedAcl ContextKey = "parsed-acl"
|
||||
ContextKeySkipResBodyLog ContextKey = "skip-res-body-log"
|
||||
ContextKeyBodyReader ContextKey = "body-reader"
|
||||
ContextKeySkip ContextKey = "__skip"
|
||||
ContextKeyStack ContextKey = "stack"
|
||||
ContextKeyBucketOwner ContextKey = "bucket-owner"
|
||||
ContextKeyObjectPostResult ContextKey = "object-post-result"
|
||||
ContextKeyRequestID ContextKey = "request-id"
|
||||
ContextKeyHostID ContextKey = "host-id"
|
||||
ContextKeyWebsiteConfig ContextKey = "website-config"
|
||||
ContextKeyRegion = httpctx.ContextKeyRegion
|
||||
ContextKeyStartTime = httpctx.ContextKeyStartTime
|
||||
ContextKeyIsRoot = httpctx.ContextKeyIsRoot
|
||||
ContextKeyRootAccessKey = httpctx.ContextKeyRootAccessKey
|
||||
ContextKeyAccount = httpctx.ContextKeyAccount
|
||||
ContextKeyAuthenticated = httpctx.ContextKeyAuthenticated
|
||||
ContextKeyPublicBucket = httpctx.ContextKeyPublicBucket
|
||||
ContextKeyParsedAcl = httpctx.ContextKeyParsedAcl
|
||||
ContextKeySkipResBodyLog = httpctx.ContextKeySkipResBodyLog
|
||||
ContextKeyBodyReader = httpctx.ContextKeyBodyReader
|
||||
ContextKeySkip = httpctx.ContextKeySkip
|
||||
ContextKeyStack = httpctx.ContextKeyStack
|
||||
ContextKeyBucketOwner = httpctx.ContextKeyBucketOwner
|
||||
ContextKeyObjectPostResult = httpctx.ContextKeyObjectPostResult
|
||||
ContextKeyRequestID = httpctx.ContextKeyRequestID
|
||||
ContextKeyHostID = httpctx.ContextKeyHostID
|
||||
ContextKeyWebsiteConfig = httpctx.ContextKeyWebsiteConfig
|
||||
)
|
||||
|
||||
func (ck ContextKey) Set(ctx fiber.Ctx, val any) {
|
||||
ctx.Locals(string(ck), val)
|
||||
}
|
||||
|
||||
func (ck ContextKey) IsSet(ctx fiber.Ctx) bool {
|
||||
val := ctx.Locals(string(ck))
|
||||
return val != nil
|
||||
}
|
||||
|
||||
func (ck ContextKey) Delete(ctx fiber.Ctx) {
|
||||
ctx.Locals(string(ck), nil)
|
||||
}
|
||||
|
||||
func (ck ContextKey) Get(ctx fiber.Ctx) any {
|
||||
return ctx.Locals(string(ck))
|
||||
}
|
||||
|
||||
@@ -15,32 +15,21 @@
|
||||
package utils
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/url"
|
||||
"os"
|
||||
"errors"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
"github.com/aws/smithy-go/logging"
|
||||
"github.com/gofiber/fiber/v3"
|
||||
v4 "github.com/versity/versitygw/aws/signer/v4"
|
||||
"github.com/versity/versitygw/debuglogger"
|
||||
"github.com/versity/versitygw/internal/sigv4auth"
|
||||
"github.com/versity/versitygw/s3err"
|
||||
)
|
||||
|
||||
const (
|
||||
unsignedPayload string = "UNSIGNED-PAYLOAD"
|
||||
|
||||
algoHMAC string = "AWS4-HMAC-SHA256"
|
||||
algoECDSA string = "AWS4-ECDSA-P256-SHA256"
|
||||
)
|
||||
|
||||
// CheckPresignedSignature validates presigned request signature
|
||||
func CheckPresignedSignature(ctx fiber.Ctx, auth AuthData, secret string) error {
|
||||
signedHdrs := strings.Split(auth.SignedHeaders, ";")
|
||||
|
||||
var contentLength int64
|
||||
var err error
|
||||
contentLengthStr := ctx.Get("Content-Length")
|
||||
@@ -51,44 +40,14 @@ func CheckPresignedSignature(ctx fiber.Ctx, auth AuthData, secret string) error
|
||||
}
|
||||
}
|
||||
|
||||
// Create a new http request instance from fasthttp request
|
||||
req, err := createPresignedHttpRequestFromCtx(ctx, signedHdrs, contentLength)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
date, _ := time.Parse(iso8601Format, auth.Date)
|
||||
|
||||
signer := v4.NewSigner()
|
||||
uri, _, signMeta, signErr := signer.PresignHTTP(ctx.RequestCtx(), aws.Credentials{
|
||||
AccessKeyID: auth.Access,
|
||||
SecretAccessKey: secret,
|
||||
}, req, unsignedPayload, service, auth.Region, date, signedHdrs, func(options *v4.SignerOptions) {
|
||||
options.DisableURIPathEscaping = true
|
||||
if debuglogger.IsDebugEnabled() {
|
||||
options.LogSigning = true
|
||||
options.Logger = logging.NewStandardLogger(os.Stderr)
|
||||
}
|
||||
_, err = sigv4auth.CheckQuerySignature(ctx, auth, secret, unsignedPayload, date, contentLength, sigv4auth.CheckOptions{
|
||||
Service: service,
|
||||
DisableURIPathEscaping: true,
|
||||
})
|
||||
if signErr != nil {
|
||||
return fmt.Errorf("presign generated http request: %w", err)
|
||||
}
|
||||
|
||||
urlParts, err := url.Parse(uri)
|
||||
if err != nil {
|
||||
return fmt.Errorf("parse presigned url: %w", err)
|
||||
}
|
||||
|
||||
signature := urlParts.Query().Get("X-Amz-Signature")
|
||||
if signature != auth.Signature {
|
||||
return s3err.GetSignatureDoesNotMatchErr(
|
||||
auth.Access,
|
||||
signMeta.StringToSign,
|
||||
auth.Signature,
|
||||
HexBytes(signMeta.StringToSign),
|
||||
signMeta.CanonicalString,
|
||||
HexBytes(signMeta.CanonicalString),
|
||||
)
|
||||
return mapSigV4Error(err)
|
||||
}
|
||||
|
||||
return nil
|
||||
@@ -105,157 +64,83 @@ func CheckPresignedSignature(ctx fiber.Ctx, auth AuthData, secret string) error
|
||||
// &X-Amz-SignedHeaders=host
|
||||
// &X-Amz-Signature=1e68ad45c1db540284a4a1eca3884c293ba1a0ff63ab9db9a15b5b29dfa02cd8
|
||||
func ParsePresignedURIParts(ctx fiber.Ctx, region string) (AuthData, error) {
|
||||
a := AuthData{}
|
||||
|
||||
// Get and verify algorithm query parameter
|
||||
algo := ctx.Query("X-Amz-Algorithm")
|
||||
err := validateAlgorithm(algo)
|
||||
auth, _, err := sigv4auth.ParseQueryAuthorization(ctx, sigv4auth.QueryAuthOptions{
|
||||
Service: service,
|
||||
Region: region,
|
||||
RequireExpiration: true,
|
||||
})
|
||||
if err != nil {
|
||||
return a, err
|
||||
return AuthData{}, mapQueryAuthError(err)
|
||||
}
|
||||
|
||||
// Parse and validate credentials query parameter
|
||||
credsQuery := ctx.Query("X-Amz-Credential")
|
||||
if credsQuery == "" {
|
||||
return a, s3err.QueryAuthErrors.MissingRequiredParams()
|
||||
}
|
||||
|
||||
creds, err := ParseCredentials(credsQuery, s3err.QueryAuthErrors)
|
||||
if err != nil {
|
||||
return a, err
|
||||
}
|
||||
|
||||
// validate the region
|
||||
if creds.Region != region {
|
||||
return a, s3err.QueryAuthErrors.IncorrectRegion(region, creds.Region)
|
||||
}
|
||||
|
||||
// Parse and validate Date query param
|
||||
date := ctx.Query("X-Amz-Date")
|
||||
if date == "" {
|
||||
return a, s3err.QueryAuthErrors.MissingRequiredParams()
|
||||
}
|
||||
|
||||
tdate, err := time.Parse(iso8601Format, date)
|
||||
if err != nil {
|
||||
return a, s3err.QueryAuthErrors.InvalidXAmzDateFormat()
|
||||
}
|
||||
|
||||
if date[:8] != creds.Date {
|
||||
return a, s3err.QueryAuthErrors.DateMismatch(creds.Date, date[:8])
|
||||
}
|
||||
|
||||
signature := ctx.Query("X-Amz-Signature")
|
||||
if signature == "" {
|
||||
return a, s3err.QueryAuthErrors.MissingRequiredParams()
|
||||
}
|
||||
|
||||
signedHdrs := ctx.Query("X-Amz-SignedHeaders")
|
||||
if signedHdrs == "" {
|
||||
return a, s3err.QueryAuthErrors.MissingRequiredParams()
|
||||
}
|
||||
|
||||
// Validate X-Amz-Expires query param and check if request is expired
|
||||
err = validateExpiration(ctx.Query("X-Amz-Expires"), tdate)
|
||||
if err != nil {
|
||||
return a, err
|
||||
}
|
||||
|
||||
a.Signature = signature
|
||||
a.Access = creds.Access
|
||||
a.Algorithm = algo
|
||||
a.Region = creds.Region
|
||||
a.SignedHeaders = signedHdrs
|
||||
a.Date = date
|
||||
|
||||
return a, nil
|
||||
return auth, nil
|
||||
}
|
||||
|
||||
func validateExpiration(str string, date time.Time) error {
|
||||
if str == "" {
|
||||
return s3err.QueryAuthErrors.MissingRequiredParams()
|
||||
}
|
||||
|
||||
exp, err := strconv.Atoi(str)
|
||||
if err != nil {
|
||||
return s3err.QueryAuthErrors.ExpiresNumber()
|
||||
}
|
||||
|
||||
if exp < 0 {
|
||||
return s3err.QueryAuthErrors.ExpiresNegative()
|
||||
}
|
||||
|
||||
if exp > 604800 {
|
||||
return s3err.QueryAuthErrors.ExpiresTooLarge()
|
||||
}
|
||||
|
||||
now := time.Now().UTC()
|
||||
expiresAt := date.Add(time.Duration(exp) * time.Second)
|
||||
|
||||
if expiresAt.Before(now) {
|
||||
return s3err.GetExpiredPresignedURLError(exp, expiresAt.Format(time.RFC3339), now.Format(time.RFC3339))
|
||||
}
|
||||
|
||||
return nil
|
||||
_, err := sigv4auth.ValidateQueryExpiration(str, date, time.Now().UTC())
|
||||
return mapQueryAuthError(err)
|
||||
}
|
||||
|
||||
// validateAlgorithm validates the algorithm
|
||||
// for AWS4-ECDSA-P256-SHA256 it returns a custom non AWS error
|
||||
// currently only AWS4-HMAC-SHA256 algorithm is supported
|
||||
func validateAlgorithm(algo string) error {
|
||||
switch algo {
|
||||
case "":
|
||||
return s3err.QueryAuthErrors.MissingRequiredParams()
|
||||
case algoHMAC:
|
||||
return nil
|
||||
case algoECDSA:
|
||||
return s3err.QueryAuthErrors.OnlyHMACSupported()
|
||||
default:
|
||||
// all other algorithms are considered as invalid
|
||||
return s3err.QueryAuthErrors.UnsupportedAlgorithm()
|
||||
}
|
||||
return mapQueryAuthError(sigv4auth.ValidateQueryAlgorithm(algo))
|
||||
}
|
||||
|
||||
// IsPresignedURLAuth determines if the request is presigned:
|
||||
// which is authorization with query params
|
||||
func IsPresignedURLAuth(ctx fiber.Ctx) bool {
|
||||
algo := ctx.Query("X-Amz-Algorithm")
|
||||
creds := ctx.Query("X-Amz-Credential")
|
||||
signature := ctx.Query("X-Amz-Signature")
|
||||
signedHeaders := ctx.Query("X-Amz-SignedHeaders")
|
||||
expires := ctx.Query("X-Amz-Expires")
|
||||
|
||||
return !allEmpty(algo, creds, signature, signedHeaders, expires) || IsPresignedURLAuthV2(ctx)
|
||||
return sigv4auth.IsQueryAuth(ctx) || ctx.Query(sigv4auth.QueryExpires) != "" || IsPresignedURLAuthV2(ctx)
|
||||
}
|
||||
|
||||
// IsPresignedURLAuthV2 determines if the request is
|
||||
// query-string signed with aws v2 signer
|
||||
func IsPresignedURLAuthV2(ctx fiber.Ctx) bool {
|
||||
expires := ctx.Query("Expires")
|
||||
access := ctx.Query("AWSAccessKeyId")
|
||||
signature := ctx.Query("Signature")
|
||||
|
||||
return anyNonEmpty(expires, access, signature)
|
||||
return sigv4auth.IsQueryAuthV2(ctx)
|
||||
}
|
||||
|
||||
// allEmpty reports whether every given string is empty.
|
||||
func allEmpty(args ...string) bool {
|
||||
for _, a := range args {
|
||||
if a != "" {
|
||||
return false
|
||||
func mapQueryAuthError(err error) error {
|
||||
if err == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
var queryErr *sigv4auth.QueryError
|
||||
if errors.As(err, &queryErr) {
|
||||
switch queryErr.Kind {
|
||||
case sigv4auth.ErrQueryMissingRequiredParams:
|
||||
return s3err.QueryAuthErrors.MissingRequiredParams()
|
||||
case sigv4auth.ErrQueryUnsupportedAlgorithm:
|
||||
return s3err.QueryAuthErrors.UnsupportedAlgorithm()
|
||||
case sigv4auth.ErrQueryUnsupportedECDSA:
|
||||
return s3err.QueryAuthErrors.OnlyHMACSupported()
|
||||
case sigv4auth.ErrQueryInvalidDateFormat:
|
||||
return s3err.QueryAuthErrors.InvalidXAmzDateFormat()
|
||||
case sigv4auth.ErrQueryDateMismatch:
|
||||
return s3err.QueryAuthErrors.DateMismatch(queryErr.Expected, queryErr.Actual)
|
||||
case sigv4auth.ErrQueryIncorrectRegion:
|
||||
return s3err.QueryAuthErrors.IncorrectRegion(queryErr.Expected, queryErr.Actual)
|
||||
case sigv4auth.ErrQueryExpiresNumber:
|
||||
return s3err.QueryAuthErrors.ExpiresNumber()
|
||||
case sigv4auth.ErrQueryExpiresNegative:
|
||||
return s3err.QueryAuthErrors.ExpiresNegative()
|
||||
case sigv4auth.ErrQueryExpiresTooLarge:
|
||||
return s3err.QueryAuthErrors.ExpiresTooLarge()
|
||||
case sigv4auth.ErrQueryExpired:
|
||||
return s3err.GetExpiredPresignedURLError(
|
||||
queryErr.Expires,
|
||||
queryErr.ExpiresAt.Format(time.RFC3339),
|
||||
queryErr.ServerTime.Format(time.RFC3339),
|
||||
)
|
||||
case sigv4auth.ErrQuerySecurityToken:
|
||||
return s3err.QueryAuthErrors.SecurityTokenNotSupported()
|
||||
}
|
||||
}
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
// anyNonEmpty reports whether at least one given string is non-empty.
|
||||
func anyNonEmpty(args ...string) bool {
|
||||
for _, a := range args {
|
||||
if a != "" {
|
||||
return true
|
||||
}
|
||||
var parseErr *sigv4auth.ParseError
|
||||
if errors.As(err, &parseErr) {
|
||||
return mapCredentialsParseError(parseErr, s3err.QueryAuthErrors)
|
||||
}
|
||||
|
||||
return false
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -27,9 +27,8 @@ const (
|
||||
HeaderAmzID2 = "x-amz-id-2"
|
||||
|
||||
s3RequestIDAlphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
|
||||
|
||||
s3RequestIDLength = 16
|
||||
s3HostIDBytes = 65
|
||||
s3RequestIDLength = 16
|
||||
s3HostIDBytes = 65
|
||||
)
|
||||
|
||||
// NewS3RequestID returns a request ID, for example
|
||||
|
||||
@@ -170,57 +170,6 @@ func createHttpRequestFromCtx(ctx fiber.Ctx, signedHdrs []string, contentLength
|
||||
return httpReq, nil
|
||||
}
|
||||
|
||||
var (
|
||||
signedQueryArgs = map[string]bool{
|
||||
"X-Amz-Algorithm": true,
|
||||
"X-Amz-Credential": true,
|
||||
"X-Amz-Date": true,
|
||||
"X-Amz-SignedHeaders": true,
|
||||
"X-Amz-Signature": true,
|
||||
}
|
||||
)
|
||||
|
||||
func createPresignedHttpRequestFromCtx(ctx fiber.Ctx, signedHdrs []string, contentLength int64) (*http.Request, error) {
|
||||
req := ctx.Request()
|
||||
|
||||
uri, _, _ := strings.Cut(ctx.OriginalURL(), "?")
|
||||
isFirst := true
|
||||
|
||||
for key, value := range ctx.Request().URI().QueryArgs().All() {
|
||||
_, ok := signedQueryArgs[string(key)]
|
||||
if !ok {
|
||||
escapeValue := url.QueryEscape(string(value))
|
||||
if isFirst {
|
||||
uri += fmt.Sprintf("?%s=%s", key, escapeValue)
|
||||
isFirst = false
|
||||
} else {
|
||||
uri += fmt.Sprintf("&%s=%s", key, escapeValue)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
httpReq, err := http.NewRequest(string(req.Header.Method()), uri, nil)
|
||||
if err != nil {
|
||||
return nil, errors.New("error in creating an http request")
|
||||
}
|
||||
if err := addRequestHeadersFromCtx(ctx, httpReq, signedHdrs); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Check if Content-Length in signed headers
|
||||
// If content length is non 0, then the header will be included
|
||||
if !includeHeader("Content-Length", signedHdrs) {
|
||||
httpReq.ContentLength = 0
|
||||
} else {
|
||||
httpReq.ContentLength = contentLength
|
||||
}
|
||||
|
||||
// Set the Host header
|
||||
httpReq.Host = string(req.Header.Host())
|
||||
|
||||
return httpReq, nil
|
||||
}
|
||||
|
||||
func SetMetaHeaders(ctx fiber.Ctx, meta map[string]string) {
|
||||
ctx.Response().Header.DisableNormalizing()
|
||||
for key, val := range meta {
|
||||
|
||||
Reference in New Issue
Block a user