RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-02-21 01:47:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

rgw/auth: move http options v4 logic to get_v4_canonical_method()

Browse Source 
Signed-off-by: Tobias Urdin <tobias.urdin@binero.com>
This commit is contained in:
Tobias Urdin 2023-08-17 11:45:06 +00:00
parent 814cae52ba
commit dbc0a4ed2d
3 changed files with 34 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/rgw/rgw_auth_s3.cc
View File

@ -659,6 +659,35 @@ std::string gen_v4_canonical_qs(const req_info& info, bool is_non_s3_op)
return canonical_qs;
}
std::string get_v4_canonical_method(const req_state* s)
{
/* If this is a OPTIONS request we need to compute the v4 signature for the
* intended HTTP method and not the OPTIONS request itself. */
if (s->op_type == RGW_OP_OPTIONS_CORS) {
const char *cors_method = s->info.env->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
if (cors_method) {
/* Validate request method passed in access-control-request-method is valid. */
auto cors_flags = get_cors_method_flags(cors_method);
if (!cors_flags) {
ldpp_dout(s, 1) << "invalid access-control-request-method header = "
<< cors_method << dendl;
throw -EINVAL;
}
ldpp_dout(s, 10) << "canonical req method = " << cors_method
<< ", due to access-control-request-method header" << dendl;
return cors_method;
} else {
ldpp_dout(s, 1) << "invalid http options req missing "
<< "access-control-request-method header" << dendl;
throw -EINVAL;
}
}
return s->info.method;
}
boost::optional<std::string>
get_v4_canonical_headers(const req_info& info,
const std::string_view& signedheaders,

2
src/rgw/rgw_auth_s3.h
View File

@ -602,6 +602,8 @@ std::string get_v4_canonical_qs(const req_info& info, bool using_qs);
std::string gen_v4_canonical_qs(const req_info& info, bool is_non_s3_op);
std::string get_v4_canonical_method(const req_state* s);
boost::optional<std::string>
get_v4_canonical_headers(const req_info& info,
const std::string_view& signedheaders,

30
src/rgw/rgw_rest_s3.cc
View File

@ -5771,37 +5771,13 @@ AWSGeneralAbstractor::get_auth_data_v4(const req_state* const s,
/* Craft canonical query string. std::moving later so non-const here. */
auto canonical_qs = rgw::auth::s3::get_v4_canonical_qs(s->info, using_qs);
const char *req_meth = s->info.method;
/* If this is a OPTIONS request we need to compute the v4 signature for the
* intended HTTP method and not the OPTIONS request itself. */
if (s->op_type == RGW_OP_OPTIONS_CORS) {
/* Validate signature for CORS header if set otherwise use HTTP request method. */
const char *cors_method = s->info.env->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
if (cors_method) {
/* Validate request method passed in access-control-request-method is valid. */
auto cors_flags = get_cors_method_flags(cors_method);
if (!cors_flags) {
ldpp_dout(s, 1) << "invalid access-control-request-method header = "
<< cors_method << dendl;
throw -EINVAL;
}
req_meth = cors_method;
ldpp_dout(s, 10) << "setting canonical req method = " << cors_method
<< ", due to access-control-request-method header" << dendl;
} else {
ldpp_dout(s, 1) << "invalid http options req missing "
<< "access-control-request-method header" << dendl;
throw -EINVAL;
}
}
/* Craft canonical method. */
auto canonical_method = rgw::auth::s3::get_v4_canonical_method(s);
/* Craft canonical request. */
auto canonical_req_hash = \
rgw::auth::s3::get_v4_canon_req_hash(s->cct,
req_meth,
std::move(canonical_method),
std::move(canonical_uri),
std::move(canonical_qs),
std::move(*canonical_headers),