aboutsummaryrefslogtreecommitdiff
path: root/src/api/signature/payload.rs
diff options
context:
space:
mode:
authorAlex Auvolat <alex@adnab.me>2024-02-27 23:33:26 +0100
committerAlex Auvolat <alex@adnab.me>2024-02-28 12:24:21 +0100
commit4c1d42cc5fcaa69818ec177f19577ad57952a117 (patch)
treec08428281155d411a7fb90439d83fc90714317e0 /src/api/signature/payload.rs
parent2efa9c5a1a568e28e41af790750f224d334d4e3d (diff)
downloadgarage-4c1d42cc5fcaa69818ec177f19577ad57952a117.tar.gz
garage-4c1d42cc5fcaa69818ec177f19577ad57952a117.zip
[fix-presigned] add back anonymous request code path + refactoring
Diffstat (limited to 'src/api/signature/payload.rs')
-rw-r--r--src/api/signature/payload.rs57
1 files changed, 31 insertions, 26 deletions
diff --git a/src/api/signature/payload.rs b/src/api/signature/payload.rs
index 8841a5e5..c88bb144 100644
--- a/src/api/signature/payload.rs
+++ b/src/api/signature/payload.rs
@@ -40,17 +40,26 @@ pub async fn check_payload_signature(
) -> Result<(Option<Key>, Option<Hash>), Error> {
let query = parse_query_map(request.uri())?;
- let res = if query.contains_key(X_AMZ_ALGORITHM.as_str()) {
+ if query.contains_key(X_AMZ_ALGORITHM.as_str()) {
check_presigned_signature(garage, service, request, query).await
- } else {
+ } else if request.headers().contains_key(AUTHORIZATION) {
check_standard_signature(garage, service, request, query).await
- };
-
- if let Err(e) = &res {
- error!("ERROR IN SIGNATURE\n{:?}\n{}", request, e);
+ } else {
+ // Unsigned (anonymous) request
+ let content_sha256 = request
+ .headers()
+ .get("x-amz-content-sha256")
+ .filter(|c| c.as_bytes() != UNSIGNED_PAYLOAD.as_bytes());
+ if let Some(content_sha256) = content_sha256 {
+ let sha256 = hex::decode(content_sha256)
+ .ok()
+ .and_then(|bytes| Hash::try_from(&bytes))
+ .ok_or_bad_request("Invalid content sha256 hash")?;
+ Ok((None, Some(sha256)))
+ } else {
+ Ok((None, None))
+ }
}
-
- res
}
async fn check_standard_signature(
@@ -63,8 +72,11 @@ async fn check_standard_signature(
// Verify that all necessary request headers are signed
let signed_headers = split_signed_headers(&authorization)?;
+ if !signed_headers.contains(&HOST) {
+ return Err(Error::bad_request("Header `Host` should be signed"));
+ }
for (name, _) in request.headers().iter() {
- if name.as_str().starts_with("x-amz-") || name == CONTENT_TYPE {
+ if name == CONTENT_TYPE || name.as_str().starts_with("x-amz-") {
if !signed_headers.contains(name) {
return Err(Error::bad_request(format!(
"Header `{}` should be signed",
@@ -73,9 +85,6 @@ async fn check_standard_signature(
}
}
}
- if !signed_headers.contains(&HOST) {
- return Err(Error::bad_request("Header `Host` should be signed"));
- }
let canonical_request = canonical_request(
service,
@@ -122,6 +131,9 @@ async fn check_presigned_signature(
// Check that all mandatory signed headers are included
let signed_headers = split_signed_headers(&authorization)?;
+ if !signed_headers.contains(&HOST) {
+ return Err(Error::bad_request("Header `Host` should be signed"));
+ }
for (name, _) in request.headers().iter() {
if name.as_str().starts_with("x-amz-") {
if !signed_headers.contains(name) {
@@ -132,9 +144,6 @@ async fn check_presigned_signature(
}
}
}
- if !signed_headers.contains(&HOST) {
- return Err(Error::bad_request("Header `Host` should be signed"));
- }
query.remove(X_AMZ_SIGNATURE.as_str());
let canonical_request = canonical_request(
@@ -254,21 +263,17 @@ pub fn canonical_request(
// Canonical header string calculated from signed headers
signed_headers.sort_by(|h1, h2| h1.as_str().cmp(h2.as_str()));
- let canonical_header_string = {
- let mut items = Vec::with_capacity(signed_headers.len());
- for name in signed_headers.iter() {
+ let canonical_header_string = signed_headers
+ .iter()
+ .map(|name| {
let value = headers
.get(name)
.ok_or_bad_request(format!("signed header `{}` is not present", name))?
.to_str()?;
- items.push((name, value));
- }
- items
- .iter()
- .map(|(key, value)| format!("{}:{}", key.as_str(), value.trim()))
- .collect::<Vec<_>>()
- .join("\n")
- };
+ Ok(format!("{}:{}", name.as_str(), value.trim()))
+ })
+ .collect::<Result<Vec<String>, Error>>()?
+ .join("\n");
let signed_headers = signed_headers.join(";");
let list = [