rgw: AWS4 auth support when using request params

Fixes: #10333
Signed-off-by: Javier M. Mellid <jmunhoz@igalia.com>

diff --git a/src/rgw/rgw_auth_s3.cc b/src/rgw/rgw_auth_s3.cc
index c132a35482c06d4ad36e4a13b9ef23fe8ff2109b..700695b149614d055a78471499a0ae61fc8c16c5 100644 (file)
--- a/src/rgw/rgw_auth_s3.cc
+++ b/src/rgw/rgw_auth_s3.cc
@@ -266,7 +266,11 @@ void rgw_create_s3_v4_canonical_request(struct req_state *s, const string& canon
 {
   string request_payload_hash;
 
-  rgw_hash_s3_string_sha256(request_payload, request_payload_hash);
+  if (len < 0) {
+    request_payload_hash = "UNSIGNED-PAYLOAD";
+  } else {
+    rgw_hash_s3_string_sha256(data, len, request_payload_hash);
+  }
 
   dout(10) << "payload request hash = " << request_payload_hash << dendl;
 

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index 73e9d6ba6dec97b67ffb3a52cc7ab3ddc52fe2af..640ecfdec761f3ab6b707c555de0e86f0cd17067 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -2710,6 +2710,7 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
   string signature;
   string access_key_id;
   string credential_scope;
+  bool using_qs;
 
   /* v4 requires rados auth */
   if (!store->ctx()->_conf->rgw_s3_auth_use_rados) {
@@ -2724,6 +2725,7 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
 
     /* look for required params */
 
+    using_qs = true;
     credential = s->info.args.get("X-Amz-Credential");
     if (credential.size() == 0) {
       return -EPERM;
@@ -2747,7 +2749,7 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
     /* auth ships in headers ... */
 
     /* ------------------------- handle Credential header */
-
+    using_qs = false;
     credential = s->http_auth;
 
     credential = credential.substr(17, credential.length());
@@ -2765,31 +2767,6 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
 
     credential = credential.substr(pos + 1, credential.length());
 
-    /* AKIAIVKTAZLOCF43WNQD/AAAAMMDD/region/host/aws4_request */
-    dout(10) << "v4 credential format = " << credential << dendl;
-
-    if (std::count(credential.begin(), credential.end(), '/') != 4) {
-      return -EINVAL;
-    }
-
-    /* credential must end with 'aws4_request' */
-    if (credential.find("aws4_request") == std::string::npos) {
-      return -EINVAL;
-    }
-
-    /* grab access key id */
-
-    pos = credential.find("/");
-    access_key_id = credential.substr(0, pos);
-
-    dout(10) << "access key id = " << access_key_id << dendl;
-
-    /* grab credential scope */
-
-    credential_scope = credential.substr(pos + 1, credential.length());
-
-    dout(10) << "credential scope = " << credential_scope << dendl;
-
     /* ------------------------- handle SignedHeaders header */
 
     signedheaders = s->http_auth;
@@ -2854,6 +2831,31 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
 
   }
 
+  /* AKIAIVKTAZLOCF43WNQD/AAAAMMDD/region/host/aws4_request */
+  dout(10) << "v4 credential format = " << credential << dendl;
+
+  if (std::count(credential.begin(), credential.end(), '/') != 4) {
+    return -EINVAL;
+  }
+
+  /* credential must end with 'aws4_request' */
+  if (credential.find("aws4_request") == std::string::npos) {
+    return -EINVAL;
+  }
+
+  /* grab access key id */
+
+  pos = credential.find("/");
+  access_key_id = credential.substr(0, pos);
+
+  dout(10) << "access key id = " << access_key_id << dendl;
+
+  /* grab credential scope */
+
+  credential_scope = credential.substr(pos + 1, credential.length());
+
+  dout(10) << "credential scope = " << credential_scope << dendl;
+
   /* grab user information */
 
   if (rgw_get_user_info_by_access_key(store, access_key_id, s->user) < 0) {
@@ -2898,10 +2900,12 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
       istringstream kv(keyval);
       getline(kv, key, '=');
       getline(kv, val, '=');
-      string key_enc, val_enc;
-      url_encode(key, key_enc);
-      url_encode(val, val_enc);
-      canonical_qs_map[key_enc] = val_enc;
+      if (!using_qs || key != "X-Amz-Signature") {
+       string key_enc, val_enc;
+       url_encode(key, key_enc, true);
+       url_encode(val, val_enc, true);
+       canonical_qs_map[key_enc] = val_enc;
+      }
     }
 
     canonical_qs = "";
@@ -2959,7 +2963,11 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
 
   string request_payload;
 
-  if ((s->content_length > 0) || s->info.env->get("HTTP_TRANSFER_ENCODING")) {
+  if (using_qs) {
+    len = -1;
+  }
+
+  if (!using_qs && ((s->content_length > 0) || s->info.env->get("HTTP_TRANSFER_ENCODING"))) {
 
     /* TODO: read body in request_payload */