versitygw/s3api/utils/chunk-reader.go

// Copyright 2024 Versity Software
// This file is licensed under the Apache License, Version 2.0
// (the "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.

package utils

import (
	"encoding/hex"
	"fmt"
	"io"
	"net/http"
	"strconv"
	"strings"
	"time"

	"github.com/gofiber/fiber/v3"
	"github.com/versity/versitygw/debuglogger"
	"github.com/versity/versitygw/s3err"
)

const (
	maxObjSizeLimit = 5 * 1024 * 1024 * 1024 // 5gb
)

type payloadType string

const (
	payloadTypeUnsigned                 payloadType = "UNSIGNED-PAYLOAD"
	payloadTypeStreamingUnsignedTrailer payloadType = "STREAMING-UNSIGNED-PAYLOAD-TRAILER"
	payloadTypeStreamingSigned          payloadType = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD"
	payloadTypeStreamingSignedTrailer   payloadType = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER"
	payloadTypeStreamingEcdsa           payloadType = "STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD"
	payloadTypeStreamingEcdsaTrailer    payloadType = "STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD-TRAILER"
)

func getPayloadTypeNotSupportedErr(p payloadType) error {
	return s3err.APIError{
		HTTPStatusCode: http.StatusNotImplemented,
		Code:           "NotImplemented",
		Description:    fmt.Sprintf("The chunk encoding algorithm %v is not supported.", p),
	}
}

var (
	specialValues = map[payloadType]bool{
		payloadTypeUnsigned:                 true,
		payloadTypeStreamingUnsignedTrailer: true,
		payloadTypeStreamingSigned:          true,
		payloadTypeStreamingSignedTrailer:   true,
		payloadTypeStreamingEcdsa:           true,
		payloadTypeStreamingEcdsaTrailer:    true,
	}
)

func (pt payloadType) isValid() bool {
	return pt == payloadTypeUnsigned ||
		pt == payloadTypeStreamingUnsignedTrailer ||
		pt == payloadTypeStreamingSigned ||
		pt == payloadTypeStreamingSignedTrailer ||
		pt == payloadTypeStreamingEcdsa ||
		pt == payloadTypeStreamingEcdsaTrailer
}

type checksumType string

const (
	checksumTypeCrc32     checksumType = "x-amz-checksum-crc32"
	checksumTypeCrc32c    checksumType = "x-amz-checksum-crc32c"
	checksumTypeSha1      checksumType = "x-amz-checksum-sha1"
	checksumTypeSha256    checksumType = "x-amz-checksum-sha256"
	checksumTypeCrc64nvme checksumType = "x-amz-checksum-crc64nvme"
	checksumTypeSha512    checksumType = "x-amz-checksum-sha512"
	checksumTypeMd5       checksumType = "x-amz-checksum-md5"
	checksumTypeXxhash64  checksumType = "x-amz-checksum-xxhash64"
	checksumTypeXxhash3   checksumType = "x-amz-checksum-xxhash3"
	checksumTypeXxhash128 checksumType = "x-amz-checksum-xxhash128"
)

func (c checksumType) isValid() bool {
	return c == checksumTypeCrc32 ||
		c == checksumTypeCrc32c ||
		c == checksumTypeSha1 ||
		c == checksumTypeSha256 ||
		c == checksumTypeCrc64nvme ||
		c == checksumTypeSha512 ||
		c == checksumTypeMd5 ||
		c == checksumTypeXxhash64 ||
		c == checksumTypeXxhash3 ||
		c == checksumTypeXxhash128
}

// Extracts and validates the checksum type from the 'X-Amz-Trailer' header
func ExtractChecksumType(ctx fiber.Ctx) (checksumType, error) {
	trailer := ctx.Get("X-Amz-Trailer")
	chType := checksumType(strings.ToLower(trailer))
	if chType != "" && !chType.isValid() {
		debuglogger.Logf("invalid value for 'X-Amz-Trailer': %v", chType)
		return "", s3err.GetAPIError(s3err.ErrTrailerHeaderNotSupported)
	}

	return chType, nil
}

// IsSpecialPayload checks for special authorization types
func IsSpecialPayload(str string) bool {
	return specialValues[payloadType(str)]
}

// IsValidSha256PayloadHeader checks if the provided x-amz-content-sha256
// payload header is valid special payload type or a valid sh256 hash
func IsValidSha256PayloadHeader(value string) bool {
	// empty header is valid
	if value == "" {
		return true
	}
	// special values are valid
	if IsSpecialPayload(value) {
		return true
	}

	// check to be a valid sha256
	if len(value) != 64 {
		return false
	}

	// decode the string as hex
	_, err := hex.DecodeString(value)
	return err == nil
}

// Checks if the provided string is unsigned payload trailer type
func IsUnsignedStreamingPayload(str string) bool {
	return payloadType(str) == payloadTypeStreamingUnsignedTrailer
}

// IsAnonymousPayloadHashSupported returns error if payload hash
// is streaming signed.
// e.g.
// "STREAMING-AWS4-HMAC-SHA256-PAYLOAD", "STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD" ...
func IsAnonymousPayloadHashSupported(hash string) error {
	switch payloadType(hash) {
	case payloadTypeStreamingEcdsa, payloadTypeStreamingEcdsaTrailer, payloadTypeStreamingSigned, payloadTypeStreamingSignedTrailer:
		return s3err.GetAPIError(s3err.ErrUnsupportedAnonymousSignedStreaming)
	}

	return nil
}

// IsUnsignedPaylod checks if the provided payload hash type
// is "UNSIGNED-PAYLOAD"
func IsUnsignedPaylod(hash string) bool {
	return hash == string(payloadTypeUnsigned)
}

// IsStreamingPayload checks for streaming/unsigned authorization types
func IsStreamingPayload(str string) bool {
	pt := payloadType(str)
	return pt == payloadTypeStreamingUnsignedTrailer ||
		pt == payloadTypeStreamingSigned ||
		pt == payloadTypeStreamingSignedTrailer
}

// ParseDecodedContentLength extracts and validates the
// 'x-amz-decoded-content-length' from fiber context
func ParseDecodedContentLength(ctx fiber.Ctx) (int64, error) {
	decContLengthStr := ctx.Get("X-Amz-Decoded-Content-Length")
	if decContLengthStr == "" {
		debuglogger.Logf("missing required header 'X-Amz-Decoded-Content-Length'")
		return 0, s3err.GetAPIError(s3err.ErrMissingContentLength)
	}
	decContLength, err := strconv.ParseInt(decContLengthStr, 10, 64)
	if err != nil {
		debuglogger.Logf("invalid value for 'X-Amz-Decoded-Content-Length': %v", decContLengthStr)
		return 0, s3err.GetAPIError(s3err.ErrMissingContentLength)
	}

	if decContLength > maxObjSizeLimit {
		debuglogger.Logf("the object size exceeds the allowed limit: (size): %v, (limit): %v", decContLength, int64(maxObjSizeLimit))
		return 0, s3err.GetEntityTooLargeErr(decContLength, maxObjSizeLimit)
	}

	return decContLength, nil
}

func NewChunkReader(ctx fiber.Ctx, r io.Reader, authdata AuthData, canonicalString string, derivedKey []byte, date time.Time) (io.Reader, error) {
	cLength, err := ParseDecodedContentLength(ctx)
	if err != nil {
		return nil, err
	}

	contentSha256 := payloadType(ctx.Get("X-Amz-Content-Sha256"))
	if !contentSha256.isValid() {
		//TODO: Add proper APIError
		debuglogger.Logf("invalid value for 'X-Amz-Content-Sha256': %v", contentSha256)
		return nil, fmt.Errorf("invalid x-amz-content-sha256: %v", string(contentSha256))
	}

	checksumType, err := ExtractChecksumType(ctx)
	if err != nil {
		return nil, err
	}

	switch contentSha256 {
	case payloadTypeStreamingUnsignedTrailer:
		return NewUnsignedChunkReader(r, checksumType, cLength)
	case payloadTypeStreamingSignedTrailer:
		return NewSignedChunkReader(r, authdata, canonicalString, derivedKey, date, checksumType, true, cLength)
	case payloadTypeStreamingSigned:
		return NewSignedChunkReader(r, authdata, canonicalString, derivedKey, date, "", false, cLength)
	// return not supported for:
	// - STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD
	// - STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD-TRAILER
	default:
		debuglogger.Logf("unsupported chunk reader algorithm: %v", contentSha256)
		return nil, getPayloadTypeNotSupportedErr(contentSha256)
	}
}