rgw: extend Version2ndEngine::Extractor to handle AWSv4 as well.

Signed-off-by: Radoslaw Zarzynski <rzarzynski@mirantis.com>

diff --git a/src/rgw/rgw_auth_s3.h b/src/rgw/rgw_auth_s3.h
index 2902c1d97e02b79fd824527cc5bc39d0d4a40abb..262906f079ffa36e16d2044b7efb83b72bc04a9d 100644 (file)
--- a/src/rgw/rgw_auth_s3.h
+++ b/src/rgw/rgw_auth_s3.h
@@ -152,9 +152,9 @@ rgw_create_s3_canonical_header(const req_info& info, const bool qsr) {
   return std::make_tuple(ok, dest, header_time);
 }
 
-int rgw_get_s3_header_digest(const string& auth_hdr, const string& key,
-                            string& dest);
-int rgw_get_s3_header_digest(const string& auth_hdr, const string& key, string& dest);
+int rgw_get_s3_header_digest(const std::string& auth_hdr,
+                             const std::string& key,
+                             std::string& dest);
 
 namespace rgw {
 namespace auth {
@@ -215,6 +215,21 @@ get_v4_signing_key(CephContext* const cct,
 std::string get_v4_signature(CephContext* cct,
                              const std::array<unsigned char, CEPH_CRYPTO_HMACSHA256_DIGESTSIZE>& signing_key,
                              const std::string& string_to_sign);
+
+static inline
+std::string get_v2_signature(CephContext*,
+                             const std::string& secret_key,
+                             const std::string& string_to_sign) {
+  std::string signature_dest;
+  const int ret = rgw_get_s3_header_digest(string_to_sign, secret_key,
+                                           signature_dest);
+  if (ret < 0) {
+    throw ret;
+  } else {
+    return signature_dest;
+  }
+}
+
 } /* namespace s3 */
 } /* namespace auth */
 } /* namespace rgw */

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index b905ebec091685e2cf362dc35372e846e5fe0427..25fb01687a1ef700bb29d746c78dd3e0cf897fb9 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -4062,9 +4062,17 @@ bool rgw::auth::s3::RGWS3V2Extractor::is_time_skew_ok(const utime_t& header_time
   }
 }
 
+
+static rgw::auth::Completer::cmplptr_t null_completer_factory()
+{
+  return nullptr;
+}
+
 std::tuple<Version2ndEngine::Extractor::access_key_id_t,
            Version2ndEngine::Extractor::signature_t,
-           Version2ndEngine::Extractor::string_to_sign_t>
+           Version2ndEngine::Extractor::string_to_sign_t,
+           Version2ndEngine::Extractor::signature_factory_t,
+           Version2ndEngine::Extractor::completer_factory_t>
 rgw::auth::s3::RGWS3V2Extractor::get_auth_data(const req_state* const s) const
 {
   std::string access_key_id;
@@ -4118,7 +4126,23 @@ rgw::auth::s3::RGWS3V2Extractor::get_auth_data(const req_state* const s) const
 
   return std::make_tuple(std::move(access_key_id),
                          std::move(signature),
-                         std::move(string_to_sign));
+                         std::move(string_to_sign),
+                         rgw::auth::s3::get_v2_signature,
+                         null_completer_factory);
+}
+
+std::tuple<Version2ndEngine::Extractor::access_key_id_t,
+           Version2ndEngine::Extractor::signature_t,
+           Version2ndEngine::Extractor::string_to_sign_t,
+           Version2ndEngine::Extractor::signature_factory_t,
+           Version2ndEngine::Extractor::completer_factory_t>
+RGWGetPolicyV2Extractor::get_auth_data(const req_state* const s) const
+{
+  return std::make_tuple(s->auth.s3_postobj_creds.access_key,
+                         s->auth.s3_postobj_creds.signature,
+                         to_string(s->auth.s3_postobj_creds.encoded_policy),
+                         rgw::auth::s3::get_v2_signature,
+                         null_completer_factory);
 }
 
 } /* namespace s3 */

diff --git a/src/rgw/rgw_rest_s3.h b/src/rgw/rgw_rest_s3.h
index d426b3d40caac8f5eb59f37f4062ec368606a93e..5c4b6777aecbb799df172824a1aaa909d9025065 100644 (file)
--- a/src/rgw/rgw_rest_s3.h
+++ b/src/rgw/rgw_rest_s3.h
@@ -680,9 +680,24 @@ public:
     using signature_t = std::string;
     using string_to_sign_t = std::string;
 
+    /* Transformation for crafting the AWS signature at server side which is
+     * used later to compare with the user-provided one. The methodology for
+     * doing that depends on AWS auth version. */
+    using signature_factory_t = \
+      std::function<std::string(CephContext* cct,
+                                const std::string& secret_key,
+                                const std::string& string_to_sign)>;
+
+    /* Return an instance of Completer for verifying the payload's fingerprint
+     * if necessary. Otherwise caller gets nullptr. */
+    using completer_factory_t = \
+      std::function<rgw::auth::Completer::cmplptr_t(void)>;
+
     virtual std::tuple<access_key_id_t,
                        signature_t,
-                       string_to_sign_t>
+                       string_to_sign_t,
+                       signature_factory_t,
+                       completer_factory_t>
     get_auth_data(const req_state* s) const = 0;
   };
 
@@ -708,9 +723,15 @@ public:
     std::string signature;
     std::string string_to_sign;
 
+    Extractor::signature_factory_t signing_key_factory;
+    Extractor::completer_factory_t completer_factory;
+
     /* Small reminder: an extractor is allowed to throw! */
-    std::tie(access_key_id, signature, string_to_sign) = \
-      extractor.get_auth_data(s);
+    std::tie(access_key_id,
+             signature,
+             string_to_sign,
+             signing_key_factory,
+             completer_factory) = extractor.get_auth_data(s);
 
     if (access_key_id.empty() || signature.empty()) {
       return result_t::deny(-EINVAL);
@@ -733,7 +754,9 @@ public:
 
   std::tuple<access_key_id_t,
              signature_t,
-             string_to_sign_t>
+             string_to_sign_t,
+             signature_factory_t,
+             completer_factory_t>
   get_auth_data(const req_state* s) const override;
 };
 
@@ -750,12 +773,10 @@ public:
 
   std::tuple<access_key_id_t,
              signature_t,
-             string_to_sign_t>
-  get_auth_data(const req_state* s) const override {
-    return std::make_tuple(s->auth.s3_postobj_creds.access_key,
-                           s->auth.s3_postobj_creds.signature,
-                           to_string(s->auth.s3_postobj_creds.encoded_policy));
-  }
+             string_to_sign_t,
+             signature_factory_t,
+             completer_factory_t>
+  get_auth_data(const req_state* s) const override;
 };