diff options
| author | Alex <alex@adnab.me> | 2024-03-01 12:49:43 +0000 |
|---|---|---|
| committer | Alex <alex@adnab.me> | 2024-03-01 12:49:43 +0000 |
| commit | 34086531a842199d6d998bd85d8f65429c4a351d (patch) | |
| tree | 7bb4a770514e683db047434c0b6908f91b981f19 /src/api/signature/mod.rs | |
| parent | f01883794e475f5dae3d2d4f621b020e1134fa47 (diff) | |
| parent | 430d0be48c2c4bc789d0f1fd8ef35a34c88a300a (diff) | |
| download | garage-34086531a842199d6d998bd85d8f65429c4a351d.tar.gz garage-34086531a842199d6d998bd85d8f65429c4a351d.zip | |
Merge pull request 'Backport AWS signature verification refactoring and fixes to v0.8.x' (#744) from backport-735-v0.8.x into main-0.8.x
Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/744
Diffstat (limited to 'src/api/signature/mod.rs')
| -rw-r--r-- | src/api/signature/mod.rs | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/src/api/signature/mod.rs b/src/api/signature/mod.rs index 4b8b990f..e189aeca 100644 --- a/src/api/signature/mod.rs +++ b/src/api/signature/mod.rs @@ -2,6 +2,10 @@ use chrono::{DateTime, Utc}; use hmac::{Hmac, Mac}; use sha2::Sha256; +use hyper::{body::Body, Request}; + +use garage_model::garage::Garage; +use garage_model::key_table::Key; use garage_util::data::{sha256sum, Hash}; pub mod error; @@ -15,6 +19,27 @@ pub const LONG_DATETIME: &str = "%Y%m%dT%H%M%SZ"; type HmacSha256 = Hmac<Sha256>; +pub async fn verify_request( + garage: &Garage, + mut req: Request<Body>, + service: &'static str, +) -> Result<(Request<Body>, Key, Option<Hash>), Error> { + let (api_key, mut content_sha256) = + payload::check_payload_signature(&garage, &mut req, service).await?; + let api_key = + api_key.ok_or_else(|| Error::forbidden("Garage does not support anonymous access yet"))?; + + let req = streaming::parse_streaming_body( + &api_key, + req, + &mut content_sha256, + &garage.config.s3_api.s3_region, + service, + )?; + + Ok((req, api_key, content_sha256)) +} + pub fn verify_signed_content(expected_sha256: Hash, body: &[u8]) -> Result<(), Error> { if expected_sha256 != sha256sum(body) { return Err(Error::bad_request( |