diff --git a/internal/sigv4auth/auth.go b/internal/sigv4auth/auth.go index e57a16d9..f47a55ec 100644 --- a/internal/sigv4auth/auth.go +++ b/internal/sigv4auth/auth.go @@ -144,7 +144,7 @@ func ParseAuthorization(authorization, expectedService string) (AuthData, error) return a, &ParseError{Kind: ErrUnsupportedAuthorizationVersion, Value: algo} } if algo != AlgorithmHMACSHA256 { - return a, &ParseError{Kind: ErrInvalidAuthorizationType, Value: algo} + return a, &ParseError{Kind: ErrInvalidAuthorizationType, Input: authorization, Value: algo} } kvPairs := strings.Split(authParts[1], ",") diff --git a/s3api/utils/auth-reader.go b/s3api/utils/auth-reader.go index 8161b5e0..c17061e3 100644 --- a/s3api/utils/auth-reader.go +++ b/s3api/utils/auth-reader.go @@ -128,7 +128,7 @@ func mapAuthParseError(err *sigv4auth.ParseError) error { case sigv4auth.ErrUnsupportedAuthorizationVersion: return s3err.GetAPIError(s3err.ErrUnsupportedAuthorizationMechanism) case sigv4auth.ErrInvalidAuthorizationType: - return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Value) + return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Input) case sigv4auth.ErrMissingComponents: return s3err.MalformedAuth.MissingComponents() case sigv4auth.ErrMissingCredential: diff --git a/s3api/utils/auth_test.go b/s3api/utils/auth_test.go index af1f97a2..d7136e6f 100644 --- a/s3api/utils/auth_test.go +++ b/s3api/utils/auth_test.go @@ -16,6 +16,7 @@ package utils import ( "net" + "reflect" "strings" "testing" "time" @@ -24,6 +25,7 @@ import ( "github.com/valyala/fasthttp" "github.com/valyala/fasthttp/fasthttputil" "github.com/versity/versitygw/internal/sigv4auth" + "github.com/versity/versitygw/s3err" ) func TestAuthParse(t *testing.T) { @@ -69,6 +71,19 @@ func TestAuthParse(t *testing.T) { } } +func TestAuthParseUnsupportedType(t *testing.T) { + for _, authstr := range []string{ + "AWS-HMAC-SHA25 Credential=user/20261007/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=4a2a292c73c80d2fe4a4b9e506fe0d1a8209f92dd2dfd32c27c30402e42b473d", + "AWS2-HMAC-SHA1 Credential=x, SignedHeaders=y, Signature=z", + } { + _, err := ParseAuthorization(authstr) + expected := s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, authstr) + if !reflect.DeepEqual(err, expected) { + t.Errorf("got %#v, expected %#v", err, expected) + } + } +} + // 2024/02/06 21:03:28 Request headers: // 2024/02/06 21:03:28 Host: 172.21.0.160:11000 // 2024/02/06 21:03:28 User-Agent: S3 Browser/11.5.7 (https://s3browser.com) diff --git a/s3err/invalid-argument.go b/s3err/invalid-argument.go index 27f992f8..243027ce 100644 --- a/s3err/invalid-argument.go +++ b/s3err/invalid-argument.go @@ -123,7 +123,7 @@ var invalidArgErrResponses = map[InvalidArgErrorCode]InvalidArgumentError{ ArgumentName: "x-amz-tagging", }, InvalidArgAuthHeader: { - Description: "Authorization header is invalid -- one and only one ' ' (space) required.", + Description: "Authorization header is invalid -- one and only one ' ' (space) required", ArgumentName: "Authorization", }, InvalidArgAuthorizationType: { diff --git a/tests/integration/sigv4_auth.go b/tests/integration/sigv4_auth.go index 551b43f0..95e9b62e 100644 --- a/tests/integration/sigv4_auth.go +++ b/tests/integration/sigv4_auth.go @@ -65,7 +65,7 @@ func Authentication_unsupported_signature_version(s *S3Conf) error { return err } - return checkHTTPResponseApiErr(resp, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, "AWS2-HMAC-SHA1")) + return checkHTTPResponseApiErr(resp, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, authHdr)) }) } diff --git a/tests/test_rest_list_buckets.sh b/tests/test_rest_list_buckets.sh index d5480d35..b2a736f1 100755 --- a/tests/test_rest_list_buckets.sh +++ b/tests/test_rest_list_buckets.sh @@ -54,9 +54,6 @@ export RUN_USERS=true # tags: curl,ListBuckets,required-headers,Authorization,invalid-header @test "REST - invalid authorization scheme" { - if [ "$DIRECT" != "true" ]; then - skip "https://github.com/versity/versitygw/issues/2489" - fi run list_buckets_check_authorization_scheme_error assert_success }