Deuxfleurs/garage
42
39
Fork 56
Code Issues 75 Pull requests 8 Releases 29 Wiki Activity

verify date of presigned urls properly

Browse source
This commit is contained in:
Trinity Pointard 2022-01-17 19:39:50 +01:00
parent 178e35f868
commit 94348831bc
1 changed files with 40 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

54
src/api/signature/payload.rs
View file

@ -38,20 +38,9 @@ pub async fn check_payload_signature(
parse_query_authorization(&headers)? parse_query_authorization(&headers)?
}; };
let date = headers
.get("x-amz-date")
.ok_or_bad_request("Missing X-Amz-Date field")?;
let date: NaiveDateTime =
NaiveDateTime::parse_from_str(date, LONG_DATETIME).ok_or_bad_request("Invalid date")?;
let date: DateTime<Utc> = DateTime::from_utc(date, Utc);
if Utc::now() - date > Duration::hours(24) {
return Err(Error::BadRequest("Date is too old".to_string()));
}
let scope = format!( let scope = format!(
"{}/{}/s3/aws4_request", "{}/{}/s3/aws4_request",
date.format(SHORT_DATE), authorization.date.format(SHORT_DATE),
garage.config.s3_api.s3_region garage.config.s3_api.s3_region
); );
if authorization.scope != scope { if authorization.scope != scope {
@ -74,10 +63,10 @@ pub async fn check_payload_signature(
&authorization.signed_headers, &authorization.signed_headers,
&authorization.content_sha256, &authorization.content_sha256,
); );
let string_to_sign = string_to_sign(&date, &scope, &canonical_request); let string_to_sign = string_to_sign(&authorization.date, &scope, &canonical_request);
let mut hmac = signing_hmac( let mut hmac = signing_hmac(
&date, &authorization.date,
&key_p.secret_key, &key_p.secret_key,
&garage.config.s3_api.s3_region, &garage.config.s3_api.s3_region,
"s3", "s3",
@ -113,6 +102,7 @@ struct Authorization {
signed_headers: String, signed_headers: String,
signature: String, signature: String,
content_sha256: String, content_sha256: String,
date: DateTime<Utc>,
} }
fn parse_authorization( fn parse_authorization(
@ -147,6 +137,17 @@ fn parse_authorization(
.get("x-amz-content-sha256") .get("x-amz-content-sha256")
.ok_or_bad_request("Missing X-Amz-Content-Sha256 field")?; .ok_or_bad_request("Missing X-Amz-Content-Sha256 field")?;
let date = headers
.get("x-amz-date")
.ok_or_bad_request("Missing X-Amz-Date field")?;
let date: NaiveDateTime =
NaiveDateTime::parse_from_str(date, LONG_DATETIME).ok_or_bad_request("Invalid date")?;
let date: DateTime<Utc> = DateTime::from_utc(date, Utc);
if Utc::now() - date > Duration::hours(24) {
return Err(Error::BadRequest("Date is too old".to_string()));
}
let auth = Authorization { let auth = Authorization {
key_id, key_id,
scope, scope,
@ -159,6 +160,7 @@ fn parse_authorization(
.ok_or_bad_request("Could not find Signature in Authorization field")? .ok_or_bad_request("Could not find Signature in Authorization field")?
.to_string(), .to_string(),
content_sha256: content_sha256.to_string(), content_sha256: content_sha256.to_string(),
date,
}; };
Ok(auth) Ok(auth)
} }
@ -188,12 +190,36 @@ fn parse_query_authorization(headers: &HashMap<String, String>) -> Result<Author
.map(|x| x.as_str()) .map(|x| x.as_str())
.unwrap_or("UNSIGNED-PAYLOAD"); .unwrap_or("UNSIGNED-PAYLOAD");
let duration = headers
.get("x-amz-expires")
.ok_or_bad_request("X-Amz-Expires not found in query parameters")?
.parse()
.map_err(|_| Error::BadRequest("X-Amz-Expires is not a number".to_string()))?;
if duration > 7 * 24 * 3600 {
return Err(Error::BadRequest(
"X-Amz-Exprires may not exceed a week".to_string(),
));
}
let date = headers
.get("x-amz-date")
.ok_or_bad_request("Missing X-Amz-Date field")?;
let date: NaiveDateTime =
NaiveDateTime::parse_from_str(date, LONG_DATETIME).ok_or_bad_request("Invalid date")?;
let date: DateTime<Utc> = DateTime::from_utc(date, Utc);
if Utc::now() - date > Duration::seconds(duration) {
return Err(Error::BadRequest("Date is too old".to_string()));
}
Ok(Authorization { Ok(Authorization {
key_id, key_id,
scope, scope,
signed_headers: signed_headers.to_string(), signed_headers: signed_headers.to_string(),
signature: signature.to_string(), signature: signature.to_string(),
content_sha256: content_sha256.to_string(), content_sha256: content_sha256.to_string(),
date,
}) })
} }