mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-08 15:41:15 +02:00
368 lines
10 KiB
Go
368 lines
10 KiB
Go
package s3api
|
|
|
|
import (
|
|
"net/http"
|
|
"strconv"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
|
|
)
|
|
|
|
func setupTestIAMForV2Auth() *IdentityAccessManagement {
|
|
iam := &IdentityAccessManagement{
|
|
identities: []*Identity{},
|
|
accessKeyIdent: make(map[string]*Identity),
|
|
}
|
|
|
|
testCred := &Credential{
|
|
AccessKey: "AKIAIOSFODNN7EXAMPLE",
|
|
SecretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
|
|
}
|
|
|
|
testIdentity := &Identity{
|
|
Name: "testUser",
|
|
Account: &AccountAdmin,
|
|
Credentials: []*Credential{testCred},
|
|
Actions: []Action{
|
|
s3_constants.ACTION_ADMIN,
|
|
},
|
|
}
|
|
|
|
iam.identities = append(iam.identities, testIdentity)
|
|
iam.accessKeyIdent[testCred.AccessKey] = testIdentity
|
|
|
|
return iam
|
|
}
|
|
|
|
func TestValidateV2AuthHeader(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
authHeader string
|
|
expectedAccessKey string
|
|
expectedError s3err.ErrorCode
|
|
}{
|
|
{
|
|
name: "valid auth header with space",
|
|
authHeader: "AWS AKIAIOSFODNN7EXAMPLE:frJIUN8DYpKDtOLCwo//yllqDzg=",
|
|
expectedAccessKey: "AKIAIOSFODNN7EXAMPLE",
|
|
expectedError: s3err.ErrNone,
|
|
},
|
|
{
|
|
name: "empty auth header",
|
|
authHeader: "",
|
|
expectedError: s3err.ErrAuthHeaderEmpty,
|
|
},
|
|
{
|
|
name: "wrong algorithm prefix",
|
|
authHeader: "HMAC AKIAIOSFODNN7EXAMPLE:signature",
|
|
expectedError: s3err.ErrSignatureVersionNotSupported,
|
|
},
|
|
{
|
|
name: "algorithm prefix without space",
|
|
authHeader: "AWSXAKIAIOSFODNN7EXAMPLE:signature",
|
|
expectedError: s3err.ErrSignatureVersionNotSupported,
|
|
},
|
|
{
|
|
name: "missing colon separator",
|
|
authHeader: "AWS AKIAIOSFODNN7EXAMPLE",
|
|
expectedError: s3err.ErrMissingFields,
|
|
},
|
|
{
|
|
name: "empty access key",
|
|
authHeader: "AWS :signature",
|
|
expectedError: s3err.ErrInvalidAccessKeyID,
|
|
},
|
|
{
|
|
name: "empty signature",
|
|
authHeader: "AWS AKIAIOSFODNN7EXAMPLE:",
|
|
expectedError: s3err.ErrMissingFields,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
accessKey, errCode := validateV2AuthHeader(tt.authHeader)
|
|
|
|
if errCode != tt.expectedError {
|
|
t.Errorf("validateV2AuthHeader() error = %v, want %v", errCode, tt.expectedError)
|
|
}
|
|
|
|
if errCode == s3err.ErrNone && accessKey != tt.expectedAccessKey {
|
|
t.Errorf("validateV2AuthHeader() accessKey = %q, want %q", accessKey, tt.expectedAccessKey)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestSignatureV2Format(t *testing.T) {
|
|
cred := &Credential{
|
|
AccessKey: "AKIAIOSFODNN7EXAMPLE",
|
|
SecretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
|
|
}
|
|
|
|
headers := http.Header{}
|
|
headers.Set("Date", "Mon, 09 Sep 2011 23:36:00 GMT")
|
|
|
|
signature := signatureV2(cred, "GET", "/bucket/object", "", headers)
|
|
|
|
// Verify format: "AWS <AccessKey>:<Signature>" with space after AWS
|
|
expectedPrefix := "AWS " + cred.AccessKey + ":"
|
|
if len(signature) < len(expectedPrefix) {
|
|
t.Fatalf("Signature too short: %s", signature)
|
|
}
|
|
|
|
actualPrefix := signature[:len(expectedPrefix)]
|
|
if actualPrefix != expectedPrefix {
|
|
t.Errorf("Signature prefix = %q, want %q", actualPrefix, expectedPrefix)
|
|
}
|
|
}
|
|
|
|
func TestDoesSignV2Match(t *testing.T) {
|
|
iam := setupTestIAMForV2Auth()
|
|
cred := &Credential{
|
|
AccessKey: "AKIAIOSFODNN7EXAMPLE",
|
|
SecretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
|
|
}
|
|
|
|
tests := []struct {
|
|
name string
|
|
method string
|
|
path string
|
|
query string
|
|
headers map[string]string
|
|
authOverride string
|
|
expectedError s3err.ErrorCode
|
|
expectIdent bool
|
|
}{
|
|
{
|
|
name: "valid GET request",
|
|
method: "GET",
|
|
path: "/bucket/object",
|
|
query: "",
|
|
headers: map[string]string{"Date": "Mon, 09 Sep 2011 23:36:00 GMT"},
|
|
expectedError: s3err.ErrNone,
|
|
expectIdent: true,
|
|
},
|
|
{
|
|
name: "valid PUT request with content headers",
|
|
method: "PUT",
|
|
path: "/bucket/object",
|
|
query: "",
|
|
headers: map[string]string{
|
|
"Date": "Mon, 09 Sep 2011 23:36:00 GMT",
|
|
"Content-Type": "text/plain",
|
|
"Content-Md5": "c8fdb181845a4ca6b8fec737b3581d76",
|
|
},
|
|
expectedError: s3err.ErrNone,
|
|
expectIdent: true,
|
|
},
|
|
{
|
|
name: "request with query parameters",
|
|
method: "GET",
|
|
path: "/bucket/object",
|
|
query: "acl&versionId=123",
|
|
headers: map[string]string{
|
|
"Date": "Mon, 09 Sep 2011 23:36:00 GMT",
|
|
},
|
|
expectedError: s3err.ErrNone,
|
|
expectIdent: true,
|
|
},
|
|
{
|
|
name: "request with x-amz headers",
|
|
method: "PUT",
|
|
path: "/bucket/object",
|
|
query: "",
|
|
headers: map[string]string{
|
|
"Date": "Mon, 09 Sep 2011 23:36:00 GMT",
|
|
"x-amz-storage-class": "REDUCED_REDUNDANCY",
|
|
"x-amz-meta-custom": "value",
|
|
},
|
|
expectedError: s3err.ErrNone,
|
|
expectIdent: true,
|
|
},
|
|
{
|
|
name: "invalid signature",
|
|
method: "GET",
|
|
path: "/bucket/object",
|
|
query: "",
|
|
headers: map[string]string{"Date": "Mon, 09 Sep 2011 23:36:00 GMT"},
|
|
authOverride: "AWS AKIAIOSFODNN7EXAMPLE:invalidSignature123456==",
|
|
expectedError: s3err.ErrSignatureDoesNotMatch,
|
|
expectIdent: false,
|
|
},
|
|
{
|
|
name: "non-existent access key",
|
|
method: "GET",
|
|
path: "/bucket/object",
|
|
query: "",
|
|
headers: map[string]string{"Date": "Mon, 09 Sep 2011 23:36:00 GMT"},
|
|
authOverride: "AWS NONEXISTENTKEY:signature==",
|
|
expectedError: s3err.ErrInvalidAccessKeyID,
|
|
expectIdent: false,
|
|
},
|
|
{
|
|
name: "empty authorization header",
|
|
method: "GET",
|
|
path: "/bucket/object",
|
|
query: "",
|
|
headers: map[string]string{"Date": "Mon, 09 Sep 2011 23:36:00 GMT"},
|
|
authOverride: "",
|
|
expectedError: s3err.ErrAuthHeaderEmpty,
|
|
expectIdent: false,
|
|
},
|
|
{
|
|
name: "malformed auth - missing signature",
|
|
method: "GET",
|
|
path: "/bucket/object",
|
|
query: "",
|
|
headers: map[string]string{"Date": "Mon, 09 Sep 2011 23:36:00 GMT"},
|
|
authOverride: "AWS AKIAIOSFODNN7EXAMPLE",
|
|
expectedError: s3err.ErrMissingFields,
|
|
expectIdent: false,
|
|
},
|
|
{
|
|
name: "malformed auth - wrong prefix",
|
|
method: "GET",
|
|
path: "/bucket/object",
|
|
query: "",
|
|
headers: map[string]string{"Date": "Mon, 09 Sep 2011 23:36:00 GMT"},
|
|
authOverride: "HMAC AKIAIOSFODNN7EXAMPLE:sig",
|
|
expectedError: s3err.ErrSignatureVersionNotSupported,
|
|
expectIdent: false,
|
|
},
|
|
{
|
|
name: "malformed auth - no space after AWS",
|
|
method: "GET",
|
|
path: "/bucket/object",
|
|
query: "",
|
|
headers: map[string]string{"Date": "Mon, 09 Sep 2011 23:36:00 GMT"},
|
|
authOverride: "AWSAKIAIOSFODNN7EXAMPLE:signature==",
|
|
expectedError: s3err.ErrSignatureVersionNotSupported,
|
|
expectIdent: false,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
url := "http://example.com" + tt.path
|
|
if tt.query != "" {
|
|
url += "?" + tt.query
|
|
}
|
|
req, err := http.NewRequest(tt.method, url, nil)
|
|
if err != nil {
|
|
t.Fatalf("Failed to create request: %v", err)
|
|
}
|
|
|
|
for key, value := range tt.headers {
|
|
req.Header.Set(key, value)
|
|
}
|
|
|
|
var authHeader string
|
|
if tt.authOverride != "" {
|
|
authHeader = tt.authOverride
|
|
} else {
|
|
authHeader = signatureV2(cred, req.Method, req.URL.Path, req.URL.Query().Encode(), req.Header)
|
|
}
|
|
if tt.name != "empty authorization header" {
|
|
req.Header.Set("Authorization", authHeader)
|
|
}
|
|
|
|
identity, errCode := iam.doesSignV2Match(req)
|
|
|
|
if errCode != tt.expectedError {
|
|
t.Errorf("doesSignV2Match() error = %v, want %v", errCode, tt.expectedError)
|
|
}
|
|
|
|
if tt.expectIdent && identity == nil {
|
|
t.Error("Expected non-nil identity")
|
|
}
|
|
|
|
if !tt.expectIdent && identity != nil {
|
|
t.Error("Expected nil identity")
|
|
}
|
|
|
|
if identity != nil && identity.Name != "testUser" {
|
|
t.Errorf("Identity name = %q, want %q", identity.Name, "testUser")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestDoesSignV2MatchUnicodePath(t *testing.T) {
|
|
iam := setupTestIAMForV2Auth()
|
|
cred := &Credential{
|
|
AccessKey: "AKIAIOSFODNN7EXAMPLE",
|
|
SecretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
|
|
}
|
|
|
|
tests := []struct {
|
|
name string
|
|
path string
|
|
}{
|
|
{
|
|
name: "CJK conversation key from ai-dial-core",
|
|
path: "/dialcore/core/Users/test-user/conversations/qwen3.5-35b-a3b__%E5%A4%9A%E7%9D%87%E3%80%82",
|
|
},
|
|
{
|
|
name: "Japanese filename from issue 8598",
|
|
path: "/voyage-dev1/public/1773200112088-998898991/%E3%81%9F%E3%81%82%E3%81%84%E3%81%BEd%C2%B7.jpg",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
req, err := http.NewRequest(http.MethodGet, "http://example.com"+tt.path, nil)
|
|
if err != nil {
|
|
t.Fatalf("Failed to create request: %v", err)
|
|
}
|
|
req.Header.Set("Date", "Mon, 09 Sep 2011 23:36:00 GMT")
|
|
|
|
// Clients (jclouds, AWS SDK) sign percent-encoded paths, not decoded Path.
|
|
authHeader := signatureV2(cred, req.Method, tt.path, req.URL.Query().Encode(), req.Header)
|
|
req.Header.Set("Authorization", authHeader)
|
|
|
|
identity, errCode := iam.doesSignV2Match(req)
|
|
if errCode != s3err.ErrNone {
|
|
t.Fatalf("doesSignV2Match() error = %v, want %v; path=%q escaped=%q",
|
|
errCode, s3err.ErrNone, req.URL.Path, req.URL.EscapedPath())
|
|
}
|
|
if identity == nil {
|
|
t.Fatal("Expected non-nil identity")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestDoesPresignV2MatchUnicodePath(t *testing.T) {
|
|
iam := setupTestIAMForV2Auth()
|
|
cred := &Credential{
|
|
AccessKey: "AKIAIOSFODNN7EXAMPLE",
|
|
SecretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
|
|
}
|
|
|
|
path := "/dialcore/core/Users/test-user/conversations/qwen3.5-35b-a3b__%E5%A4%9A%E7%9D%87%E3%80%82"
|
|
expires := strconv.FormatInt(time.Now().Add(time.Hour).Unix(), 10)
|
|
|
|
req, err := http.NewRequest(http.MethodGet, "http://example.com"+path, nil)
|
|
if err != nil {
|
|
t.Fatalf("Failed to create request: %v", err)
|
|
}
|
|
|
|
query := req.URL.Query()
|
|
query.Set("AWSAccessKeyId", cred.AccessKey)
|
|
query.Set("Expires", expires)
|
|
query.Set("Signature", preSignatureV2(cred, req.Method, path, query.Encode(), req.Header, expires))
|
|
req.URL.RawQuery = query.Encode()
|
|
|
|
identity, errCode := iam.doesPresignV2SignatureMatch(req)
|
|
if errCode != s3err.ErrNone {
|
|
t.Fatalf("doesPresignV2SignatureMatch() error = %v, want %v; path=%q escaped=%q",
|
|
errCode, s3err.ErrNone, req.URL.Path, req.URL.EscapedPath())
|
|
}
|
|
if identity == nil {
|
|
t.Fatal("Expected non-nil identity")
|
|
}
|
|
}
|