mirror of
https://github.com/versity/versitygw.git
synced 2026-07-02 16:54:25 +00:00
niksis02
4d391cabc8
Fixes #2180 Fixes #2181 Migrate the gateway from Fiber v2 to Fiber v3.3.0 and update the affected server, middleware, handler, controller, and test code for the new APIs. Replace the deprecated Fiber filesystem middleware used by the WebUI with the Fiber v3 static middleware, serving the embedded WebUI assets from an fs.Sub filesystem. Fix the request header limit handling regression by adding a temporary handler for Fiber v3/fasthttp small-buffer errors so oversized request headers return the expected regulated S3 error response. Fix the debuglogger panic by reworking the boxed key/value formatter used for debug request and response dumps. The formatter now handles long header keys and values without producing invalid wrap widths, negative padding, or out-of-range string slices.
101 lines
3.0 KiB
Go
101 lines
3.0 KiB
Go
// Copyright 2023 Versity Software
|
|
// This file is licensed under the Apache License, Version 2.0
|
|
// (the "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package middlewares
|
|
|
|
import (
|
|
"io"
|
|
"strconv"
|
|
|
|
"github.com/gofiber/fiber/v3"
|
|
"github.com/versity/versitygw/auth"
|
|
"github.com/versity/versitygw/s3api/utils"
|
|
"github.com/versity/versitygw/s3err"
|
|
)
|
|
|
|
func VerifyPresignedV4Signature(root RootUserConfig, iam auth.IAMService, region string, streamBody bool) fiber.Handler {
|
|
acct := accounts{root: root, iam: iam}
|
|
|
|
return func(ctx fiber.Ctx) error {
|
|
// The bucket is public, no need to check this signature
|
|
if utils.ContextKeyPublicBucket.IsSet(ctx) {
|
|
return nil
|
|
}
|
|
if !utils.IsPresignedURLAuth(ctx) {
|
|
return nil
|
|
}
|
|
if utils.IsPresignedURLAuthV2(ctx) {
|
|
// SigV2 authorization is not supported by the gateway
|
|
return s3err.GetAPIError(s3err.ErrUnsupportedAuthorizationMechanism)
|
|
}
|
|
|
|
if ctx.Request().URI().QueryArgs().Has("X-Amz-Security-Token") {
|
|
// OIDC Authorization with X-Amz-Security-Token is not supported
|
|
return s3err.QueryAuthErrors.SecurityTokenNotSupported()
|
|
}
|
|
|
|
// Set in the context the "authenticated" key, in case the authentication succeeds,
|
|
// otherwise the middleware will return the caucht error
|
|
utils.ContextKeyAuthenticated.Set(ctx, true)
|
|
|
|
authData, err := utils.ParsePresignedURIParts(ctx, region)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
utils.ContextKeyIsRoot.Set(ctx, authData.Access == root.Access)
|
|
|
|
account, err := acct.getAccount(authData.Access)
|
|
if err == auth.ErrNoSuchUser {
|
|
return s3err.GetInvalidAccessKeyIdErr(authData.Access)
|
|
}
|
|
if err != nil {
|
|
return err
|
|
}
|
|
utils.ContextKeyAccount.Set(ctx, account)
|
|
|
|
var contentLength int64
|
|
contentLengthStr := ctx.Get("Content-Length")
|
|
if contentLengthStr != "" {
|
|
contentLength, err = strconv.ParseInt(contentLengthStr, 10, 64)
|
|
//TODO: not sure if InvalidRequest should be returned in this case
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
err = utils.CheckPresignedSignature(ctx, authData, account.Secret)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if streamBody {
|
|
wrapBodyReader(ctx, func(r io.Reader) io.Reader {
|
|
return r
|
|
})
|
|
// Content-Length has to be set for data uploads: PutObject, UploadPart
|
|
if contentLengthStr == "" {
|
|
return s3err.GetAPIError(s3err.ErrMissingContentLength)
|
|
}
|
|
// the upload limit for big data actions: PutObject, UploadPart
|
|
// is 5gb. If the size exceeds the limit, return 'EntityTooLarge' err
|
|
if contentLength > maxObjSizeLimit {
|
|
return s3err.GetEntityTooLargeErr(contentLength, maxObjSizeLimit)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
}
|