mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-22 22:11:39 +02:00
74da88fc29
* s3, iceberg: record the access key a request was signed with Several access keys can belong to one identity, but nothing downstream of authentication says which one signed a request: the audit log carries the identity name only, and every table credential the Iceberg catalog vends for that identity gets the same session name. When an identity is shared (one key per person or per service), the log cannot tell the holders apart. The verifier that matched a credential now records that credential's access key id in the request's identity holder (verifyV4Signature for header, presigned, streaming and STS requests; both SigV2 verifiers). Nothing re-reads the request for a key, so a second, unverified key elsewhere in the request (a junk X-Amz-Credential on a SigV2 request, a junk SigV4 header on a SigV2 presigned URL) is never recorded. - s3err.AccessLog gains access_key_id (omitempty): a static key's id, or an STS session's temporary key id. Every other field is unchanged. - The Iceberg and Lance catalogs install the holder before authenticating a SigV4 request; a Bearer token records the key it was minted from (the token is verified with a key derived from it); a Lance x-api-key records its key. - VendTableCredentials ends the session name with "-k" and the first 12 hex digits of SHA-256 of the key id (the table part gives way within the 64-character limit; the tag is never cut), and carries the key id in the session token (src_ak, SessionInfo.SourceAccessKeyId). Tests: auth_access_key_attribution_test.go and auth_access_key_shapes_test.go (two keys on one identity, the deny path, SigV2 and presigned SigV2 with a junk key elsewhere, streaming seed, STS session, failed signatures record nothing), s3api_iceberg_session_name_test.go, iceberg and lance Auth tests, sts source_access_key_test.go. * s3: record the access key of a verified POST-policy form and of a retargeted signature Two verified signatures left access_key_id empty in the audit log: - A browser POST upload is verified in PostPolicyBucketHandler from its form fields by doesPolicySignatureV2Match / doesPolicySignatureV4Match, which did not record the key. Both now take the request context and record the credential's key once its signature verifies; a form that fails verification records nothing. - verifyV4Signature refuses a signature that verified for one virtual-hosted bucket but was routed to another. The key was recorded only after that check, so the refusal carried none. It is now recorded as soon as a host candidate verifies. Test: TestPostPolicyUploadRecordsTheSigningKey (SigV4 and SigV2 forms, and a form with a wrong signature) and TestSignedVirtualHostRetargetRecordsTheSigningKey; both fail before this change. * s3: test VendTableCredentials end to end for the caller's access key TestVendTableCredentialsRecordsTheCallersKey mints sessions through VendTableCredentials with a configured STS service, the key recorded the way the catalog's authentication records it, then validates each session token: SourceAccessKeyId and the session name's key tag match the key, and a caller without a key gets an untagged session. It fails if the vendor stops passing either field. --------- Co-authored-by: Javier de la Torre <jatorre@lakehousebox.com> Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
70 lines
2.4 KiB
Go
70 lines
2.4 KiB
Go
package lance
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
|
|
)
|
|
|
|
// keyedS3Authenticator accepts every request as one identity and records the
|
|
// key that verified into the request's holder, as S3ApiServer's verifiers do.
|
|
type keyedS3Authenticator struct {
|
|
mockS3Authenticator
|
|
accessKey string
|
|
}
|
|
|
|
func (k *keyedS3Authenticator) AuthenticateRequest(r *http.Request) (string, interface{}, s3err.ErrorCode) {
|
|
s3_constants.RecordAccessKeyId(r.Context(), k.accessKey)
|
|
return "s3user", nil, s3err.ErrNone
|
|
}
|
|
|
|
func accessKeySeenByHandler(t *testing.T, s *Server, req *http.Request) string {
|
|
t.Helper()
|
|
gotKey := "unset"
|
|
handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
|
|
gotKey = s3_constants.GetAccessKeyIdFromContext(r)
|
|
w.WriteHeader(http.StatusOK)
|
|
})
|
|
rec := httptest.NewRecorder()
|
|
handler(rec, req)
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200", rec.Code)
|
|
}
|
|
return gotKey
|
|
}
|
|
|
|
// Each way a Lance client authenticates leaves the access key it used in the
|
|
// request context, so the credentials it vends can name that key.
|
|
func TestAuthRecordsTheCallersAccessKey(t *testing.T) {
|
|
now := time.Now()
|
|
|
|
s := newTestServerWithOAuth()
|
|
req := httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
|
|
req.Header.Set("Authorization", "Bearer "+mintTestToken(t, "AKID123", "secret456", now, now.Add(time.Hour)))
|
|
if got := accessKeySeenByHandler(t, s, req); got != "AKID123" {
|
|
t.Errorf("Bearer: access key in context = %q, want AKID123", got)
|
|
}
|
|
|
|
req = httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
|
|
req.Header.Set("x-api-key", "AKID123:secret456")
|
|
if got := accessKeySeenByHandler(t, s, req); got != "AKID123" {
|
|
t.Errorf("x-api-key: access key in context = %q, want AKID123", got)
|
|
}
|
|
|
|
s.authenticator = &keyedS3Authenticator{accessKey: "AKIDSIGV4"}
|
|
req = httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
|
|
if got := accessKeySeenByHandler(t, s, req); got != "AKIDSIGV4" {
|
|
t.Errorf("SigV4: access key in context = %q, want AKIDSIGV4", got)
|
|
}
|
|
|
|
s.authenticator = &mockS3Authenticator{}
|
|
req = httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
|
|
if got := accessKeySeenByHandler(t, s, req); got != "" {
|
|
t.Errorf("authenticator without a key: access key in context = %q, want none", got)
|
|
}
|
|
}
|