mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-26 06:50:45 +01:00
fix(s3): stop S3 Tables routes from swallowing buckets named "buckets" or "get-table" (#9566)
* fix(s3): stop S3 Tables routes from swallowing buckets named "buckets" or "get-table"
The S3 Tables REST endpoints share top-level paths with the regular S3
API (/buckets for ListTableBuckets/CreateTableBucket, /get-table for
GetTable). They are registered first on the same router as the bucket
subrouter, so a path-style request such as GET /buckets?list-type=2 on
a bucket actually named "buckets" matched ListTableBuckets and returned
JSON. AWS SDK V2 (and Hadoop s3a / Spark) then failed XML parsing with
"Unexpected character '{' (code 123) in prolog".
Disambiguate by requiring the AWS V4 credential scope to name the
s3tables service on the colliding routes. Regular S3 SDKs sign with
service=s3, S3 Tables SDKs sign with service=s3tables, and the scope is
present in both the Authorization header and the X-Amz-Credential query
parameter for presigned URLs, so the matcher works for both flavors.
ARN-bearing S3 Tables routes (/buckets/<arn>, /namespaces/<arn>, etc.)
already cannot collide because colons are not valid in bucket names, so
they are left untouched.
* fix(s3): accept AWS JSON RPC content type as S3 Tables intent signal
The Iceberg catalog integration tests send unsigned PUT /buckets with
Content-Type: application/x-amz-json-1.1 to create table buckets. With
only the credential-scope check, those requests fell through to the
regular S3 CreateBucket handler and the suite went red on this branch.
Extend the matcher so a request is recognized as S3 Tables when either:
- its AWS V4 credential scope names SERVICE=s3tables; or
- it carries the canonical AWS JSON RPC 1.1 content type and is
unsigned (a request explicitly signed for SERVICE=s3 still wins).
The regular S3 SDKs do not send application/x-amz-json-1.1, so the
signal is safe for the colliding paths (/buckets, /get-table).
Also add an AWS SDK V2 for Go integration test under
test/s3/sdk_v2_routing/ that drives the SDK's own XML deserializer
against a bucket literally named "buckets" and "get-table" — the SDK
errors before the test asserts if the server returns the wrong body
shape. Wired up via .github/workflows/s3-sdk-v2-routing-tests.yml,
mirroring the etag/acl workflow.
* s3api: extend service matcher to all S3 Tables routes; simplify scope check
- Apply serviceMatcher to every S3 Tables route, not just the bare-path
ones. ARN-bearing paths could otherwise be hit by an S3 object key
that starts with arn:aws:s3tables:..., inside a bucket named
"buckets", "namespaces", "tables", or "tag". One matcher everywhere
closes both collision classes.
- Replace strings.Split + index lookup with strings.Contains for the
credential-scope check. The scope shape is fixed at
AK/DATE/REGION/SERVICE/aws4_request, slashes only delimit components,
and access keys are alphanumeric — so /s3tables/ matches iff SERVICE
is exactly s3tables. Existing unit cases (including the
access-key-substring case) still pass.
- Read the GetObject body in the SDK v2 routing test with io.ReadAll;
the single Read could return short and make the equality check flaky.
* s3api: drop content-type fallback; sign s3 tables harness traffic instead
The content-type fallback in isS3TablesSignedRequest let an anonymous
regular-S3 request whose body type is application/x-amz-json-1.1 hit
an S3 Tables route when the path-style object key happened to be
shaped like an S3 Tables ARN (e.g. PutObject on bucket "buckets"
with key arn:aws:s3tables:.../bucket/foo/policy). Narrow the matcher
back to the AWS V4 credential scope so only requests signed for
SERVICE=s3tables match the S3 Tables routes.
Update the Iceberg catalog test harness — the only caller still
sending unsigned PUT /buckets — to sign with SERVICE=s3tables. The
mini instance runs in default-allow mode, so the signature itself is
not verified; only the credential scope matters for the route match.
Drop the stale unit cases for the JSON-RPC content-type signal and
the routing test that exercised unsigned harness traffic.
This commit is contained in:
Chris Lu authored and GitHub committed
1 parent
cfc08fbf6c
commit
f72983c1fd
6 files changed
+616
-24
No files matched your search
+74
-21
@@ -84,54 +84,64 @@ func (s3a *S3ApiServer) registerS3TablesRoutes(router *mux.Router) {
|
||||
targetMatcher := func(r *http.Request, rm *mux.RouteMatch) bool {
|
||||
return strings.HasPrefix(r.Header.Get("X-Amz-Target"), "S3Tables.")
|
||||
}
|
||||
// serviceMatcher gates every S3 Tables route so it only matches when the
|
||||
// request is genuinely targeting the s3tables service. The bare paths
|
||||
// (/buckets, /get-table) collide with regular S3 buckets of the same
|
||||
// name; the ARN-bearing paths (/buckets/<arn>, /namespaces/<arn>, ...)
|
||||
// could collide with object keys that look like S3 Tables ARNs inside a
|
||||
// bucket named "buckets", "namespaces", "tables", or "tag". A single
|
||||
// matcher applied to every route closes both classes of collision.
|
||||
serviceMatcher := func(r *http.Request, rm *mux.RouteMatch) bool {
|
||||
return isS3TablesSignedRequest(r)
|
||||
}
|
||||
router.Methods(http.MethodPost).Path("/").MatcherFunc(targetMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.S3TablesHandler), "S3Tables-Target"))
|
||||
router.Methods(http.MethodPut).Path("/buckets").
|
||||
router.Methods(http.MethodPut).Path("/buckets").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("CreateTableBucket", buildCreateTableBucketRequest)), "S3Tables-CreateTableBucket"))
|
||||
router.Methods(http.MethodGet).Path("/buckets").
|
||||
router.Methods(http.MethodGet).Path("/buckets").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("ListTableBuckets", buildListTableBucketsRequest)), "S3Tables-ListTableBuckets"))
|
||||
router.Methods(http.MethodGet).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}").
|
||||
router.Methods(http.MethodGet).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("GetTableBucket", buildTableBucketArnRequest)), "S3Tables-GetTableBucket"))
|
||||
router.Methods(http.MethodDelete).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}").
|
||||
router.Methods(http.MethodDelete).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("DeleteTableBucket", buildDeleteTableBucketRequest)), "S3Tables-DeleteTableBucket"))
|
||||
router.Methods(http.MethodPut).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}/policy").
|
||||
router.Methods(http.MethodPut).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}/policy").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("PutTableBucketPolicy", buildPutTableBucketPolicyRequest)), "S3Tables-PutTableBucketPolicy"))
|
||||
router.Methods(http.MethodGet).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}/policy").
|
||||
router.Methods(http.MethodGet).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}/policy").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("GetTableBucketPolicy", buildGetTableBucketPolicyRequest)), "S3Tables-GetTableBucketPolicy"))
|
||||
router.Methods(http.MethodDelete).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}/policy").
|
||||
router.Methods(http.MethodDelete).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}/policy").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("DeleteTableBucketPolicy", buildDeleteTableBucketPolicyRequest)), "S3Tables-DeleteTableBucketPolicy"))
|
||||
|
||||
router.Methods(http.MethodPut).Path("/namespaces/{tableBucketARN:" + tableBucketARNRegex + "}").
|
||||
router.Methods(http.MethodPut).Path("/namespaces/{tableBucketARN:" + tableBucketARNRegex + "}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("CreateNamespace", buildCreateNamespaceRequest)), "S3Tables-CreateNamespace"))
|
||||
router.Methods(http.MethodGet).Path("/namespaces/{tableBucketARN:" + tableBucketARNRegex + "}").
|
||||
router.Methods(http.MethodGet).Path("/namespaces/{tableBucketARN:" + tableBucketARNRegex + "}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("ListNamespaces", buildListNamespacesRequest)), "S3Tables-ListNamespaces"))
|
||||
router.Methods(http.MethodGet).Path("/namespaces/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}").
|
||||
router.Methods(http.MethodGet).Path("/namespaces/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("GetNamespace", buildGetNamespaceRequest)), "S3Tables-GetNamespace"))
|
||||
router.Methods(http.MethodDelete).Path("/namespaces/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}").
|
||||
router.Methods(http.MethodDelete).Path("/namespaces/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("DeleteNamespace", buildDeleteNamespaceRequest)), "S3Tables-DeleteNamespace"))
|
||||
|
||||
router.Methods(http.MethodPut).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}").
|
||||
router.Methods(http.MethodPut).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("CreateTable", buildCreateTableRequest)), "S3Tables-CreateTable"))
|
||||
router.Methods(http.MethodGet).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}").
|
||||
router.Methods(http.MethodGet).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("ListTables", buildListTablesRequest)), "S3Tables-ListTables"))
|
||||
router.Methods(http.MethodDelete).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}").
|
||||
router.Methods(http.MethodDelete).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("DeleteTable", buildDeleteTableRequest)), "S3Tables-DeleteTable"))
|
||||
|
||||
router.Methods(http.MethodPut).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}/policy").
|
||||
router.Methods(http.MethodPut).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}/policy").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("PutTablePolicy", buildPutTablePolicyRequest)), "S3Tables-PutTablePolicy"))
|
||||
router.Methods(http.MethodGet).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}/policy").
|
||||
router.Methods(http.MethodGet).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}/policy").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("GetTablePolicy", buildGetTablePolicyRequest)), "S3Tables-GetTablePolicy"))
|
||||
router.Methods(http.MethodDelete).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}/policy").
|
||||
router.Methods(http.MethodDelete).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}/policy").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("DeleteTablePolicy", buildDeleteTablePolicyRequest)), "S3Tables-DeleteTablePolicy"))
|
||||
|
||||
router.Methods(http.MethodPost).Path("/tag/{resourceArn:arn:aws:s3tables:.*}").
|
||||
router.Methods(http.MethodPost).Path("/tag/{resourceArn:arn:aws:s3tables:.*}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("TagResource", buildTagResourceRequest)), "S3Tables-TagResource"))
|
||||
router.Methods(http.MethodGet).Path("/tag/{resourceArn:arn:aws:s3tables:.*}").
|
||||
router.Methods(http.MethodGet).Path("/tag/{resourceArn:arn:aws:s3tables:.*}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("ListTagsForResource", buildListTagsForResourceRequest)), "S3Tables-ListTagsForResource"))
|
||||
router.Methods(http.MethodDelete).Path("/tag/{resourceArn:arn:aws:s3tables:.*}").
|
||||
router.Methods(http.MethodDelete).Path("/tag/{resourceArn:arn:aws:s3tables:.*}").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("UntagResource", buildUntagResourceRequest)), "S3Tables-UntagResource"))
|
||||
|
||||
router.Methods(http.MethodGet).Path("/get-table").
|
||||
router.Methods(http.MethodGet).Path("/get-table").MatcherFunc(serviceMatcher).
|
||||
HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("GetTable", buildGetTableRequest)), "S3Tables-GetTable"))
|
||||
|
||||
glog.V(1).Infof("S3 Tables API enabled")
|
||||
@@ -623,6 +633,49 @@ func buildUntagResourceRequest(r *http.Request) (interface{}, error) {
|
||||
}, nil
|
||||
}
|
||||
|
||||
// isS3TablesSignedRequest reports whether the request is targeting the
|
||||
// S3 Tables service. The signal is the AWS V4 credential scope, which
|
||||
// names SERVICE=s3tables for S3 Tables SDKs and SERVICE=s3 for regular
|
||||
// S3 SDKs. The credential scope appears in the Authorization header
|
||||
// (Credential=AK/DATE/REGION/SERVICE/aws4_request) for signed requests
|
||||
// and in the X-Amz-Credential query parameter for presigned requests.
|
||||
//
|
||||
// The credential scope is the only acceptable signal: a content-type-
|
||||
// based fallback would let an anonymous regular-S3 request (e.g. a
|
||||
// PutObject with body type application/x-amz-json-1.1) sneak through
|
||||
// to an S3 Tables route whenever the object key is shaped like an
|
||||
// S3 Tables ARN. Clients that genuinely target S3 Tables — including
|
||||
// internal test harnesses running against a default-allow server —
|
||||
// must sign with SERVICE=s3tables.
|
||||
func isS3TablesSignedRequest(r *http.Request) bool {
|
||||
scope := extractCredentialScope(r)
|
||||
// Credential scope is AK/DATE/REGION/SERVICE/aws4_request. Slashes
|
||||
// do not appear inside any other component (access keys are
|
||||
// alphanumeric), so /s3tables/ matches iff SERVICE is exactly
|
||||
// s3tables.
|
||||
return scope != "" && strings.Contains(scope, "/s3tables/")
|
||||
}
|
||||
|
||||
// extractCredentialScope returns the raw credential value from either the
|
||||
// Authorization header or the X-Amz-Credential query parameter, without the
|
||||
// "Credential=" prefix. Returns the empty string when neither is present.
|
||||
func extractCredentialScope(r *http.Request) string {
|
||||
if auth := r.Header.Get("Authorization"); auth != "" {
|
||||
idx := strings.Index(auth, "Credential=")
|
||||
if idx >= 0 {
|
||||
tail := auth[idx+len("Credential="):]
|
||||
if comma := strings.IndexByte(tail, ','); comma >= 0 {
|
||||
tail = tail[:comma]
|
||||
}
|
||||
return strings.TrimSpace(tail)
|
||||
}
|
||||
}
|
||||
if cred := r.URL.Query().Get("X-Amz-Credential"); cred != "" {
|
||||
return cred
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// authenticateS3Tables wraps the handler with IAM authentication using AuthSignatureOnly
|
||||
// This authenticates the request but delegates authorization to the S3 Tables handler
|
||||
// which performs granular permission checks based on the specific operation.
|
||||
|
||||
@@ -0,0 +1,158 @@
|
||||
package s3api
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
|
||||
"github.com/gorilla/mux"
|
||||
)
|
||||
|
||||
// TestIsS3TablesSignedRequest covers the credential-scope parser used to
|
||||
// disambiguate S3 Tables REST requests from regular S3 requests on paths
|
||||
// the two APIs share (e.g. /buckets, /get-table).
|
||||
func TestIsS3TablesSignedRequest(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
auth string
|
||||
cred string
|
||||
want bool
|
||||
}{
|
||||
{
|
||||
name: "regular S3 auth header",
|
||||
auth: "AWS4-HMAC-SHA256 Credential=AKIA/20260101/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-date, Signature=deadbeef",
|
||||
want: false,
|
||||
},
|
||||
{
|
||||
name: "S3 Tables auth header",
|
||||
auth: "AWS4-HMAC-SHA256 Credential=AKIA/20260101/us-east-1/s3tables/aws4_request, SignedHeaders=host;x-amz-date, Signature=deadbeef",
|
||||
want: true,
|
||||
},
|
||||
{
|
||||
name: "S3 Tables presigned query",
|
||||
cred: "AKIA/20260101/us-east-1/s3tables/aws4_request",
|
||||
want: true,
|
||||
},
|
||||
{
|
||||
name: "regular S3 presigned query",
|
||||
cred: "AKIA/20260101/us-east-1/s3/aws4_request",
|
||||
want: false,
|
||||
},
|
||||
{
|
||||
name: "unsigned request",
|
||||
want: false,
|
||||
},
|
||||
{
|
||||
name: "malformed credential",
|
||||
auth: "AWS4-HMAC-SHA256 Credential=AKIA, Signature=zzz",
|
||||
want: false,
|
||||
},
|
||||
{
|
||||
name: "service substring in access key must not match",
|
||||
auth: "AWS4-HMAC-SHA256 Credential=s3tablesAKIA/20260101/us-east-1/s3/aws4_request, Signature=zzz",
|
||||
want: false,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
req := httptest.NewRequest(http.MethodGet, "/buckets", nil)
|
||||
if tc.auth != "" {
|
||||
req.Header.Set("Authorization", tc.auth)
|
||||
}
|
||||
if tc.cred != "" {
|
||||
q := req.URL.Query()
|
||||
q.Set("X-Amz-Credential", tc.cred)
|
||||
req.URL.RawQuery = q.Encode()
|
||||
}
|
||||
if got := isS3TablesSignedRequest(req); got != tc.want {
|
||||
t.Fatalf("isS3TablesSignedRequest=%v, want %v", got, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestRouting_ListObjectsV2OnBucketNamedBuckets covers the route collision
|
||||
// between regular S3 listObjectsV2 on a bucket named "buckets" and the
|
||||
// S3 Tables ListTableBuckets endpoint, both of which use the path /buckets.
|
||||
// The credential scope on a regular S3 request is /s3/aws4_request, so the
|
||||
// S3 Tables route must reject it and let the bucket subrouter take it,
|
||||
// otherwise AWS SDK V2 / s3a clients receive a JSON body in place of the
|
||||
// expected XML and fail to parse the response.
|
||||
func TestRouting_ListObjectsV2OnBucketNamedBuckets(t *testing.T) {
|
||||
router := mux.NewRouter()
|
||||
s3a := setupRoutingTestServer(t)
|
||||
s3a.registerRouter(router)
|
||||
|
||||
req, _ := http.NewRequest(http.MethodGet, "/buckets?list-type=2&prefix=logs%2F", nil)
|
||||
signRoutingTestRequest(t, req, "", "s3")
|
||||
|
||||
var match mux.RouteMatch
|
||||
if !router.Match(req, &match) {
|
||||
t.Fatalf("expected GET /buckets?list-type=2 (signed for s3) to match a route; got no match: %v", match.MatchErr)
|
||||
}
|
||||
if tmpl, _ := match.Route.GetPathTemplate(); tmpl == "/buckets" {
|
||||
t.Fatalf("GET /buckets?list-type=2 signed for service=s3 matched the S3 Tables ListTableBuckets route (Path=%q); it must fall through to the bucket subrouter", tmpl)
|
||||
}
|
||||
}
|
||||
|
||||
// TestRouting_S3TablesListTableBucketsStillReachable verifies the matcher
|
||||
// does not break legitimate S3 Tables traffic: a request signed for the
|
||||
// s3tables service on GET /buckets must still reach ListTableBuckets.
|
||||
func TestRouting_S3TablesListTableBucketsStillReachable(t *testing.T) {
|
||||
router := mux.NewRouter()
|
||||
s3a := setupRoutingTestServer(t)
|
||||
s3a.registerRouter(router)
|
||||
|
||||
req, _ := http.NewRequest(http.MethodGet, "/buckets", nil)
|
||||
signRoutingTestRequest(t, req, "", "s3tables")
|
||||
|
||||
var match mux.RouteMatch
|
||||
if !router.Match(req, &match) {
|
||||
t.Fatalf("expected GET /buckets (signed for s3tables) to match a route; got no match: %v", match.MatchErr)
|
||||
}
|
||||
tmpl, _ := match.Route.GetPathTemplate()
|
||||
if tmpl != "/buckets" {
|
||||
t.Fatalf("GET /buckets signed for service=s3tables matched %q; want the S3 Tables route /buckets", tmpl)
|
||||
}
|
||||
}
|
||||
|
||||
// TestRouting_CreateBucketNamedBuckets covers the PUT collision: a PUT
|
||||
// /buckets signed for s3 is CreateBucket on the regular S3 API, not
|
||||
// CreateTableBucket.
|
||||
func TestRouting_CreateBucketNamedBuckets(t *testing.T) {
|
||||
router := mux.NewRouter()
|
||||
s3a := setupRoutingTestServer(t)
|
||||
s3a.registerRouter(router)
|
||||
|
||||
req, _ := http.NewRequest(http.MethodPut, "/buckets", nil)
|
||||
signRoutingTestRequest(t, req, "", "s3")
|
||||
|
||||
var match mux.RouteMatch
|
||||
if !router.Match(req, &match) {
|
||||
t.Fatalf("expected PUT /buckets (signed for s3) to match a route; got no match: %v", match.MatchErr)
|
||||
}
|
||||
if tmpl, _ := match.Route.GetPathTemplate(); tmpl == "/buckets" {
|
||||
t.Fatalf("PUT /buckets signed for service=s3 matched the S3 Tables CreateTableBucket route (Path=%q); it must fall through to the bucket subrouter", tmpl)
|
||||
}
|
||||
}
|
||||
|
||||
// TestRouting_GetObjectOnBucketNamedGetTable covers the GET /get-table
|
||||
// collision: a regular S3 request on a bucket named "get-table" must
|
||||
// reach the bucket subrouter, not the S3 Tables GetTable handler.
|
||||
func TestRouting_GetObjectOnBucketNamedGetTable(t *testing.T) {
|
||||
router := mux.NewRouter()
|
||||
s3a := setupRoutingTestServer(t)
|
||||
s3a.registerRouter(router)
|
||||
|
||||
req, _ := http.NewRequest(http.MethodGet, "/get-table?list-type=2", nil)
|
||||
signRoutingTestRequest(t, req, "", "s3")
|
||||
|
||||
var match mux.RouteMatch
|
||||
if !router.Match(req, &match) {
|
||||
t.Fatalf("expected GET /get-table?list-type=2 (signed for s3) to match a route; got no match: %v", match.MatchErr)
|
||||
}
|
||||
if tmpl, _ := match.Route.GetPathTemplate(); tmpl == "/get-table" {
|
||||
t.Fatalf("GET /get-table signed for service=s3 matched the S3 Tables GetTable route (Path=%q); it must fall through to the bucket subrouter", tmpl)
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user