add x-amz-content-sha256 to all requests
All checks were successful
continuous-integration/drone/push Build is passing
All checks were successful
continuous-integration/drone/push Build is passing
This commit is contained in:
parent
0e46bb04b2
commit
e6d2559b80
|
@ -5,24 +5,32 @@ const date = @import("date.zig");
|
||||||
|
|
||||||
const log = std.log.scoped(.aws_signing);
|
const log = std.log.scoped(.aws_signing);
|
||||||
|
|
||||||
|
// TODO: Remove this?! This is an aws_signing, so we should know a thing
|
||||||
|
// or two about aws. So perhaps the right level of abstraction here
|
||||||
|
// is to have our service signing idiosyncracies dealt with in this
|
||||||
|
// code base. Pretty much all these flags are specific to use with S3
|
||||||
|
// except omit_session_token, which will likely apply to serveral services,
|
||||||
|
// just not sure which one yet. I'll leave this here, commented for now
|
||||||
|
// in case we need to revisit the decision
|
||||||
|
//
|
||||||
// see https://github.com/awslabs/aws-c-auth/blob/ace1311f8ef6ea890b26dd376031bed2721648eb/include/aws/auth/signing_config.h#L186-L207
|
// see https://github.com/awslabs/aws-c-auth/blob/ace1311f8ef6ea890b26dd376031bed2721648eb/include/aws/auth/signing_config.h#L186-L207
|
||||||
pub const ConfigFlags = packed struct {
|
// pub const ConfigFlags = packed struct {
|
||||||
// We assume the uri will be encoded once in preparation for transmission. Certain services
|
// // We assume the uri will be encoded once in preparation for transmission. Certain services
|
||||||
// do not decode before checking signature, requiring us to actually double-encode the uri in the canonical
|
// // do not decode before checking signature, requiring us to actually double-encode the uri in the canonical
|
||||||
// request in order to pass a signature check.
|
// // request in order to pass a signature check.
|
||||||
|
//
|
||||||
use_double_uri_encode: bool = true,
|
// use_double_uri_encode: bool = true,
|
||||||
|
//
|
||||||
// Controls whether or not the uri paths should be normalized when building the canonical request
|
// // Controls whether or not the uri paths should be normalized when building the canonical request
|
||||||
should_normalize_uri_path: bool = true,
|
// should_normalize_uri_path: bool = true,
|
||||||
|
//
|
||||||
// Controls whether "X-Amz-Security-Token" is omitted from the canonical request.
|
// // Controls whether "X-Amz-Security-Token" is omitted from the canonical request.
|
||||||
// "X-Amz-Security-Token" is added during signing, as a header or
|
// // "X-Amz-Security-Token" is added during signing, as a header or
|
||||||
// query param, when credentials have a session token.
|
// // query param, when credentials have a session token.
|
||||||
// If false (the default), this parameter is included in the canonical request.
|
// // If false (the default), this parameter is included in the canonical request.
|
||||||
// If true, this parameter is still added, but omitted from the canonical request.
|
// // If true, this parameter is still added, but omitted from the canonical request.
|
||||||
omit_session_token: bool = true,
|
// omit_session_token: bool = true,
|
||||||
};
|
// };
|
||||||
|
|
||||||
pub const Config = struct {
|
pub const Config = struct {
|
||||||
// These two should be all you need to set most of the time
|
// These two should be all you need to set most of the time
|
||||||
|
@ -66,7 +74,7 @@ pub const Config = struct {
|
||||||
// this parameter has no effect.
|
// this parameter has no effect.
|
||||||
expiration_in_seconds: u64 = 0,
|
expiration_in_seconds: u64 = 0,
|
||||||
|
|
||||||
flags: ConfigFlags = .{},
|
// flags: ConfigFlags = .{},
|
||||||
};
|
};
|
||||||
|
|
||||||
pub const SignatureType = enum { sha256, none };
|
pub const SignatureType = enum { sha256, none };
|
||||||
|
@ -155,27 +163,38 @@ pub fn signRequest(allocator: std.mem.Allocator, request: base.Request, config:
|
||||||
);
|
);
|
||||||
errdefer freeSignedRequest(allocator, &rc, config);
|
errdefer freeSignedRequest(allocator, &rc, config);
|
||||||
|
|
||||||
var additional_header_count: u2 = 2;
|
var additional_header_count: u3 = 3;
|
||||||
if (config.credentials.session_token != null)
|
if (config.credentials.session_token != null)
|
||||||
additional_header_count += 1;
|
additional_header_count += 1;
|
||||||
const newheaders = try allocator.alloc(base.Header, rc.headers.len + additional_header_count);
|
const newheaders = try allocator.alloc(base.Header, rc.headers.len + additional_header_count);
|
||||||
errdefer allocator.free(newheaders);
|
errdefer allocator.free(newheaders);
|
||||||
const oldheaders = rc.headers;
|
const oldheaders = rc.headers;
|
||||||
if (config.credentials.session_token) |t| {
|
if (config.credentials.session_token) |t| {
|
||||||
newheaders[newheaders.len - 3] = base.Header{
|
newheaders[newheaders.len - 4] = base.Header{
|
||||||
.name = "X-Amz-Security-Token",
|
.name = "X-Amz-Security-Token",
|
||||||
.value = try allocator.dupe(u8, t),
|
.value = try allocator.dupe(u8, t),
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
errdefer freeSignedRequest(allocator, &rc, config);
|
errdefer freeSignedRequest(allocator, &rc, config);
|
||||||
std.mem.copy(base.Header, newheaders, oldheaders);
|
std.mem.copy(base.Header, newheaders, oldheaders);
|
||||||
newheaders[newheaders.len - 2] = base.Header{
|
newheaders[newheaders.len - 3] = base.Header{
|
||||||
.name = "X-Amz-Date",
|
.name = "X-Amz-Date",
|
||||||
.value = signing_iso8601,
|
.value = signing_iso8601,
|
||||||
};
|
};
|
||||||
|
// From the AWS nitro enclaves SDK, it appears that there is no reason
|
||||||
|
// to avoid *ALWAYS* adding the x-amz-content-sha256 header
|
||||||
|
// https://github.com/aws/aws-nitro-enclaves-sdk-c/blob/9ecb83d07fe953636e3c0b861d6dac0a15d00f82/source/rest.c#L464
|
||||||
|
const payload_hash = try hash(allocator, request.body, config.signed_body_header);
|
||||||
|
// This will be freed in freeSignedRequest
|
||||||
|
// defer allocator.free(payload_hash);
|
||||||
|
newheaders[newheaders.len - 2] = base.Header{
|
||||||
|
.name = "x-amz-content-sha256",
|
||||||
|
.value = payload_hash,
|
||||||
|
};
|
||||||
|
|
||||||
rc.headers = newheaders[0 .. newheaders.len - 1];
|
rc.headers = newheaders[0 .. newheaders.len - 1];
|
||||||
log.debug("Signing with access key: {s}", .{config.credentials.access_key});
|
log.debug("Signing with access key: {s}", .{config.credentials.access_key});
|
||||||
const canonical_request = try createCanonicalRequest(allocator, rc, config);
|
const canonical_request = try createCanonicalRequest(allocator, rc, payload_hash, config);
|
||||||
defer {
|
defer {
|
||||||
allocator.free(canonical_request.arr);
|
allocator.free(canonical_request.arr);
|
||||||
allocator.free(canonical_request.hash);
|
allocator.free(canonical_request.hash);
|
||||||
|
@ -252,11 +271,12 @@ pub fn freeSignedRequest(allocator: std.mem.Allocator, request: *base.Request, c
|
||||||
return;
|
return;
|
||||||
};
|
};
|
||||||
|
|
||||||
var remove_len: u2 = 0;
|
var remove_len: u3 = 0;
|
||||||
for (request.headers) |h| {
|
for (request.headers) |h| {
|
||||||
if (std.ascii.eqlIgnoreCase(h.name, "X-Amz-Date") or
|
if (std.ascii.eqlIgnoreCase(h.name, "X-Amz-Date") or
|
||||||
std.ascii.eqlIgnoreCase(h.name, "Authorization") or
|
std.ascii.eqlIgnoreCase(h.name, "Authorization") or
|
||||||
std.ascii.eqlIgnoreCase(h.name, "X-Amz-Security-Token"))
|
std.ascii.eqlIgnoreCase(h.name, "X-Amz-Security-Token") or
|
||||||
|
std.ascii.eqlIgnoreCase(h.name, "x-amz-content-sha256"))
|
||||||
{
|
{
|
||||||
allocator.free(h.value);
|
allocator.free(h.value);
|
||||||
remove_len += 1;
|
remove_len += 1;
|
||||||
|
@ -303,10 +323,7 @@ fn validateConfig(config: Config) SigningError!void {
|
||||||
if (config.signature_type != .headers or
|
if (config.signature_type != .headers or
|
||||||
config.signed_body_header != .sha256 or
|
config.signed_body_header != .sha256 or
|
||||||
config.expiration_in_seconds != 0 or
|
config.expiration_in_seconds != 0 or
|
||||||
config.algorithm != .v4 or
|
config.algorithm != .v4)
|
||||||
!config.flags.omit_session_token or
|
|
||||||
!config.flags.should_normalize_uri_path or
|
|
||||||
!config.flags.use_double_uri_encode)
|
|
||||||
return SigningError.NotImplemented;
|
return SigningError.NotImplemented;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -321,7 +338,7 @@ const Hashed = struct {
|
||||||
headers: CanonicalHeaders,
|
headers: CanonicalHeaders,
|
||||||
};
|
};
|
||||||
|
|
||||||
fn createCanonicalRequest(allocator: std.mem.Allocator, request: base.Request, config: Config) !Hashed {
|
fn createCanonicalRequest(allocator: std.mem.Allocator, request: base.Request, payload_hash: []const u8, config: Config) !Hashed {
|
||||||
// CanonicalRequest =
|
// CanonicalRequest =
|
||||||
// HTTPRequestMethod + '\n' +
|
// HTTPRequestMethod + '\n' +
|
||||||
// CanonicalURI + '\n' +
|
// CanonicalURI + '\n' +
|
||||||
|
@ -340,15 +357,13 @@ fn createCanonicalRequest(allocator: std.mem.Allocator, request: base.Request, c
|
||||||
|
|
||||||
// TODO: This is all better as a writer - less allocations/copying
|
// TODO: This is all better as a writer - less allocations/copying
|
||||||
const canonical_method = canonicalRequestMethod(request.method);
|
const canonical_method = canonicalRequestMethod(request.method);
|
||||||
const canonical_url = try canonicalUri(allocator, request.path, config.flags.use_double_uri_encode);
|
const canonical_url = try canonicalUri(allocator, request.path, true); // TODO: set false for s3
|
||||||
defer allocator.free(canonical_url);
|
defer allocator.free(canonical_url);
|
||||||
log.debug("final uri: {s}", .{canonical_url});
|
log.debug("final uri: {s}", .{canonical_url});
|
||||||
const canonical_query = try canonicalQueryString(allocator, request.query);
|
const canonical_query = try canonicalQueryString(allocator, request.query);
|
||||||
defer allocator.free(canonical_query);
|
defer allocator.free(canonical_query);
|
||||||
log.debug("canonical query: {s}", .{canonical_query});
|
log.debug("canonical query: {s}", .{canonical_query});
|
||||||
const canonical_headers = try canonicalHeaders(allocator, request.headers, config.flags);
|
const canonical_headers = try canonicalHeaders(allocator, request.headers, config.service);
|
||||||
const payload_hash = try hash(allocator, request.body, config.signed_body_header);
|
|
||||||
defer allocator.free(payload_hash);
|
|
||||||
|
|
||||||
const canonical_request = try std.fmt.allocPrint(allocator, fmt, .{
|
const canonical_request = try std.fmt.allocPrint(allocator, fmt, .{
|
||||||
canonical_method,
|
canonical_method,
|
||||||
|
@ -572,7 +587,7 @@ const CanonicalHeaders = struct {
|
||||||
str: []const u8,
|
str: []const u8,
|
||||||
signed_headers: []const u8,
|
signed_headers: []const u8,
|
||||||
};
|
};
|
||||||
fn canonicalHeaders(allocator: std.mem.Allocator, headers: []base.Header, flags: ConfigFlags) !CanonicalHeaders {
|
fn canonicalHeaders(allocator: std.mem.Allocator, headers: []base.Header, service: []const u8) !CanonicalHeaders {
|
||||||
//
|
//
|
||||||
// Doc example. Original:
|
// Doc example. Original:
|
||||||
//
|
//
|
||||||
|
@ -613,9 +628,8 @@ fn canonicalHeaders(allocator: std.mem.Allocator, headers: []base.Header, flags:
|
||||||
// canonical (signed) request. For other services, you add this
|
// canonical (signed) request. For other services, you add this
|
||||||
// parameter at the end, after you calculate the signature. For
|
// parameter at the end, after you calculate the signature. For
|
||||||
// details, see the API reference documentation for that service.
|
// details, see the API reference documentation for that service.
|
||||||
if (flags.omit_session_token and std.ascii.eqlIgnoreCase(h.name, "X-Amz-Security-Token")) {
|
if (!std.mem.eql(u8, service, "s3") and std.ascii.eqlIgnoreCase(h.name, "X-Amz-Security-Token")) {
|
||||||
skip = true;
|
skip = true;
|
||||||
break;
|
|
||||||
}
|
}
|
||||||
if (skip) continue;
|
if (skip) continue;
|
||||||
|
|
||||||
|
@ -743,7 +757,7 @@ test "canonical headers" {
|
||||||
\\x-amz-date:20150830T123600Z
|
\\x-amz-date:20150830T123600Z
|
||||||
\\
|
\\
|
||||||
;
|
;
|
||||||
const actual = try canonicalHeaders(allocator, headers.items, .{});
|
const actual = try canonicalHeaders(allocator, headers.items, "dummy");
|
||||||
defer allocator.free(actual.str);
|
defer allocator.free(actual.str);
|
||||||
defer allocator.free(actual.signed_headers);
|
defer allocator.free(actual.signed_headers);
|
||||||
try std.testing.expectEqualStrings(expected, actual.str);
|
try std.testing.expectEqualStrings(expected, actual.str);
|
||||||
|
@ -768,7 +782,7 @@ test "canonical request" {
|
||||||
const secret_key = try allocator.dupe(u8, "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY");
|
const secret_key = try allocator.dupe(u8, "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY");
|
||||||
const credential = auth.Credentials.init(allocator, access_key, secret_key, null);
|
const credential = auth.Credentials.init(allocator, access_key, secret_key, null);
|
||||||
defer credential.deinit();
|
defer credential.deinit();
|
||||||
const request = try createCanonicalRequest(allocator, req, .{
|
const request = try createCanonicalRequest(allocator, req, "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", .{
|
||||||
.region = "us-west-2", // us-east-1
|
.region = "us-west-2", // us-east-1
|
||||||
.service = "sts", // service
|
.service = "sts", // service
|
||||||
.credentials = credential,
|
.credentials = credential,
|
||||||
|
@ -846,12 +860,15 @@ test "can sign" {
|
||||||
var signed_req = try signRequest(allocator, req, config);
|
var signed_req = try signRequest(allocator, req, config);
|
||||||
|
|
||||||
defer freeSignedRequest(allocator, &signed_req, config);
|
defer freeSignedRequest(allocator, &signed_req, config);
|
||||||
try std.testing.expectEqualStrings("X-Amz-Date", signed_req.headers[signed_req.headers.len - 2].name);
|
try std.testing.expectEqualStrings("X-Amz-Date", signed_req.headers[signed_req.headers.len - 3].name);
|
||||||
try std.testing.expectEqualStrings("20150830T123600Z", signed_req.headers[signed_req.headers.len - 2].value);
|
try std.testing.expectEqualStrings("20150830T123600Z", signed_req.headers[signed_req.headers.len - 3].value);
|
||||||
|
|
||||||
|
try std.testing.expectEqualStrings("x-amz-content-sha256", signed_req.headers[signed_req.headers.len - 2].name);
|
||||||
|
try std.testing.expectEqualStrings("9095672bbd1f56dfc5b65f3e153adc8731a4a654192329106275f4c7b24d0b6e", signed_req.headers[signed_req.headers.len - 2].value);
|
||||||
|
|
||||||
// c_aws_auth tests don't seem to have valid data. Live endpoint is
|
// c_aws_auth tests don't seem to have valid data. Live endpoint is
|
||||||
// accepting what we're doing
|
// accepting what we're doing
|
||||||
const expected_auth = "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date, Signature=2b9566917226a17022b710430a367d343cbff33af7ee50b0ff8f44d75a4a46d8";
|
const expected_auth = "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-content-sha256;x-amz-date, Signature=328d1b9eaadca9f5818ef05e8392801e091653bafec24fcab71e7344e7f51422";
|
||||||
|
|
||||||
try std.testing.expectEqualStrings("Authorization", signed_req.headers[signed_req.headers.len - 1].name);
|
try std.testing.expectEqualStrings("Authorization", signed_req.headers[signed_req.headers.len - 1].name);
|
||||||
try std.testing.expectEqualStrings(expected_auth, signed_req.headers[signed_req.headers.len - 1].value);
|
try std.testing.expectEqualStrings(expected_auth, signed_req.headers[signed_req.headers.len - 1].value);
|
||||||
|
|
Loading…
Reference in New Issue
Block a user