Skip to content

Commit 8e554bf

Browse files
cbodleycbodley
authored
Merge pull request ceph#47723 from mdw-at-linuxbox/wip-master-tempurl
rgw: swift: tempurl fixes for ceph Reviewed-by: Casey Bodley <[email protected]>
2 parents 6760aa1 + 5d0477e commit 8e554bf

File tree

6 files changed

+320
-105
lines changed

6 files changed

+320
-105
lines changed

‎qa/suites/rgw/tempest/tasks/tempest.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,6 @@ tasks:
2727
object-storage-feature-enabled:
2828
container_sync: false
2929
discoverability: true
30-
# TODO(tobias-urdin): Use sha256 when supported in RadosGW
31-
tempurl_digest_hashlib: sha1
3230
blocklist:
3331
- .*test_account_quotas_negative.AccountQuotasNegativeTest.test_user_modify_quota
3432
- .*test_container_acl_negative.ObjectACLsNegativeTest.*

‎src/common/ceph_crypto.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
#define CEPH_CRYPTO_SHA1_DIGESTSIZE 20
1515
#define CEPH_CRYPTO_HMACSHA256_DIGESTSIZE 32
1616
#define CEPH_CRYPTO_SHA256_DIGESTSIZE 32
17+
#define CEPH_CRYPTO_HMACSHA512_DIGESTSIZE 64
1718
#define CEPH_CRYPTO_SHA512_DIGESTSIZE 64
1819

1920
#include <openssl/evp.h>
@@ -187,6 +188,12 @@ namespace TOPNSPC::crypto {
187188
: HMAC(EVP_sha256(), key, length) {
188189
}
189190
};
191+
192+
struct HMACSHA512 : public HMAC {
193+
HMACSHA512 (const unsigned char *key, size_t length)
194+
: HMAC(EVP_sha512(), key, length) {
195+
}
196+
};
190197
}
191198

192199

@@ -197,6 +204,7 @@ namespace TOPNSPC::crypto {
197204

198205
using ssl::HMACSHA256;
199206
using ssl::HMACSHA1;
207+
using ssl::HMACSHA512;
200208

201209
template<class Digest>
202210
auto digest(const ceph::buffer::list& bl)

‎src/rgw/rgw_rest_swift.cc‎

Lines changed: 114 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,109 @@
4242

4343
using namespace std;
4444

45+
template <class HASHFLAVOR, rgw::auth::swift::SignatureFlavor SIGNATUREFLAVOR>
46+
class FormPostSignatureT: public rgw::auth::swift::FormatSignature<HASHFLAVOR,SIGNATUREFLAVOR>
47+
{
48+
using UCHARPTR = const unsigned char*;
49+
using base_t = rgw::auth::swift::SignatureHelperT<HASHFLAVOR>;
50+
using format_signature_t = rgw::auth::swift::FormatSignature<HASHFLAVOR,SIGNATUREFLAVOR>;
51+
public:
52+
const char* calc(const std::string& key,
53+
const std::string_view& path_info,
54+
const std::string_view& redirect,
55+
const std::string_view& max_file_size,
56+
const std::string_view& max_file_count,
57+
const std::string_view& expires) {
58+
HASHFLAVOR hmac((UCHARPTR) key.data(), key.size());
59+
60+
hmac.Update((UCHARPTR) path_info.data(), path_info.size());
61+
hmac.Update((UCHARPTR) "\n", 1);
62+
63+
hmac.Update((UCHARPTR) redirect.data(), redirect.size());
64+
hmac.Update((UCHARPTR) "\n", 1);
65+
66+
hmac.Update((UCHARPTR) max_file_size.data(), max_file_size.size());
67+
hmac.Update((UCHARPTR) "\n", 1);
68+
69+
hmac.Update((UCHARPTR) max_file_count.data(), max_file_count.size());
70+
hmac.Update((UCHARPTR) "\n", 1);
71+
72+
hmac.Update((UCHARPTR) expires.data(), expires.size());
73+
74+
hmac.Final(base_t::dest);
75+
76+
return format_signature_t::result();
77+
}
78+
};
79+
class RGWFormPost::SignatureHelper {
80+
public:
81+
virtual ~SignatureHelper() {};
82+
virtual const char* calc(const std::string& key,
83+
const std::string_view& path_info,
84+
const std::string_view& redirect,
85+
const std::string_view& max_file_size,
86+
const std::string_view& max_file_count,
87+
const std::string_view& expires) {
88+
return nullptr;
89+
};
90+
virtual const char* get_signature() const {
91+
return nullptr;
92+
};
93+
virtual bool is_equal_to(const std::string& rhs) {
94+
return false;
95+
};
96+
static std::unique_ptr<SignatureHelper> get_sig_helper(std::string_view x);
97+
};
98+
template<typename HASHFLAVOR, rgw::auth::swift::SignatureFlavor SIGNATUREFLAVOR>
99+
class RGWFormPost::SignatureHelper_x : public RGWFormPost::SignatureHelper
100+
{
101+
friend RGWFormPost;
102+
private:
103+
FormPostSignatureT<HASHFLAVOR,SIGNATUREFLAVOR> d;
104+
public:
105+
~SignatureHelper_x() { };
106+
SignatureHelper_x() {};
107+
virtual const char* calc(const std::string& key,
108+
const std::string_view& path_info,
109+
const std::string_view& redirect,
110+
const std::string_view& max_file_size,
111+
const std::string_view& max_file_count,
112+
const std::string_view& expires) {
113+
return d.calc(key,path_info,redirect,
114+
max_file_size,max_file_count,expires) ;
115+
};
116+
virtual const char* get_signature() const {
117+
return d.get_signature();
118+
};
119+
virtual bool is_equal_to(const std::string& rhs) {
120+
return d.is_equal_to(rhs);
121+
};
122+
};
123+
124+
std::unique_ptr<RGWFormPost::SignatureHelper> RGWFormPost::SignatureHelper::get_sig_helper(std::string_view x) {
125+
size_t pos = x.find(':');
126+
if (pos == x.npos || pos <= 0) {
127+
switch(x.length()) {
128+
case CEPH_CRYPTO_HMACSHA1_DIGESTSIZE*2:
129+
return std::make_unique<SignatureHelper_x<ceph::crypto::HMACSHA1,rgw::auth::swift::SignatureFlavor::BARE_HEX>>();
130+
case CEPH_CRYPTO_HMACSHA256_DIGESTSIZE*2:
131+
return std::make_unique<SignatureHelper_x<ceph::crypto::HMACSHA256,rgw::auth::swift::SignatureFlavor::BARE_HEX>>();
132+
case CEPH_CRYPTO_HMACSHA512_DIGESTSIZE*2:
133+
return std::make_unique<SignatureHelper_x<ceph::crypto::HMACSHA512,rgw::auth::swift::SignatureFlavor::BARE_HEX>>();
134+
}
135+
return std::make_unique<BadSignatureHelper>();
136+
}
137+
std::string_view type { x.substr(0,pos) };
138+
if (type == "sha1") {
139+
return std::make_unique<SignatureHelper_x<ceph::crypto::HMACSHA1,rgw::auth::swift::SignatureFlavor::NAMED_BASE64>>();
140+
} else if (type == "sha256") {
141+
return std::make_unique<SignatureHelper_x<ceph::crypto::HMACSHA256,rgw::auth::swift::SignatureFlavor::NAMED_BASE64>>();
142+
} else if (type == "sha512") {
143+
return std::make_unique<SignatureHelper_x<ceph::crypto::HMACSHA512,rgw::auth::swift::SignatureFlavor::NAMED_BASE64>>();
144+
}
145+
return std::make_unique<BadSignatureHelper>();
146+
};
147+
45148
int RGWListBuckets_ObjStore_SWIFT::get_params(optional_yield y)
46149
{
47150
prefix = s->info.args.get("prefix");
@@ -2034,6 +2137,7 @@ bool RGWFormPost::is_non_expired()
20342137
bool RGWFormPost::is_integral()
20352138
{
20362139
const std::string form_signature = get_part_str(ctrl_parts, "signature");
2140+
bool r = false;
20372141

20382142
try {
20392143
get_owner_info(s, s->user->get_info());
@@ -2051,28 +2155,31 @@ bool RGWFormPost::is_integral()
20512155
continue;
20522156
}
20532157

2054-
SignatureHelper sig_helper;
2055-
sig_helper.calc(temp_url_key,
2158+
auto sig_helper{ RGWFormPost::SignatureHelper::get_sig_helper(form_signature) };
2159+
sig_helper->calc(temp_url_key,
20562160
s->info.request_uri,
20572161
get_part_str(ctrl_parts, "redirect"),
20582162
get_part_str(ctrl_parts, "max_file_size", "0"),
20592163
get_part_str(ctrl_parts, "max_file_count", "0"),
20602164
get_part_str(ctrl_parts, "expires", "0"));
20612165

2062-
const auto local_sig = sig_helper.get_signature();
2166+
const char* local_sig = sig_helper->get_signature();
2167+
if (!local_sig) local_sig = "???";
20632168

20642169
ldpp_dout(this, 20) << "FormPost signature [" << temp_url_key_num << "]"
20652170
<< " (calculated): " << local_sig << dendl;
20662171

2067-
if (sig_helper.is_equal_to(form_signature)) {
2068-
return true;
2069-
} else {
2172+
r = sig_helper->is_equal_to(form_signature);
2173+
if (!r) {
20702174
ldpp_dout(this, 5) << "FormPost's signature mismatch: "
20712175
<< local_sig << " != " << form_signature << dendl;
20722176
}
2177+
if (r) {
2178+
break;
2179+
}
20732180
}
20742181

2075-
return false;
2182+
return r;
20762183
}
20772184

20782185
void RGWFormPost::get_owner_info(const req_state* const s,

‎src/rgw/rgw_rest_swift.h‎

Lines changed: 2 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -263,6 +263,8 @@ class RGWFormPost : public RGWPostObj_ObjStore {
263263
bool stream_done = false;
264264

265265
class SignatureHelper;
266+
using BadSignatureHelper = SignatureHelper;
267+
template<typename HASHFLAVOR, rgw::auth::swift::SignatureFlavor SIGNATUREFLAVOR> class SignatureHelper_x;
266268
public:
267269
RGWFormPost() = default;
268270
~RGWFormPost() = default;
@@ -278,64 +280,6 @@ class RGWFormPost : public RGWPostObj_ObjStore {
278280
static bool is_formpost_req(req_state* const s);
279281
};
280282

281-
class RGWFormPost::SignatureHelper
282-
{
283-
private:
284-
static constexpr uint32_t output_size =
285-
CEPH_CRYPTO_HMACSHA1_DIGESTSIZE * 2 + 1;
286-
287-
unsigned char dest[CEPH_CRYPTO_HMACSHA1_DIGESTSIZE]; // 20
288-
char dest_str[output_size];
289-
290-
public:
291-
SignatureHelper() = default;
292-
293-
const char* calc(const std::string& key,
294-
const std::string_view& path_info,
295-
const std::string_view& redirect,
296-
const std::string_view& max_file_size,
297-
const std::string_view& max_file_count,
298-
const std::string_view& expires) {
299-
using ceph::crypto::HMACSHA1;
300-
using UCHARPTR = const unsigned char*;
301-
302-
HMACSHA1 hmac((UCHARPTR) key.data(), key.size());
303-
304-
hmac.Update((UCHARPTR) path_info.data(), path_info.size());
305-
hmac.Update((UCHARPTR) "\n", 1);
306-
307-
hmac.Update((UCHARPTR) redirect.data(), redirect.size());
308-
hmac.Update((UCHARPTR) "\n", 1);
309-
310-
hmac.Update((UCHARPTR) max_file_size.data(), max_file_size.size());
311-
hmac.Update((UCHARPTR) "\n", 1);
312-
313-
hmac.Update((UCHARPTR) max_file_count.data(), max_file_count.size());
314-
hmac.Update((UCHARPTR) "\n", 1);
315-
316-
hmac.Update((UCHARPTR) expires.data(), expires.size());
317-
318-
hmac.Final(dest);
319-
320-
buf_to_hex((UCHARPTR) dest, sizeof(dest), dest_str);
321-
322-
return dest_str;
323-
}
324-
325-
const char* get_signature() const {
326-
return dest_str;
327-
}
328-
329-
bool is_equal_to(const std::string& rhs) const {
330-
/* never allow out-of-range exception */
331-
if (rhs.size() < (output_size - 1)) {
332-
return false;
333-
}
334-
return rhs.compare(0 /* pos */, output_size, dest_str) == 0;
335-
}
336-
337-
}; /* RGWFormPost::SignatureHelper */
338-
339283

340284
class RGWSwiftWebsiteHandler {
341285
rgw::sal::Driver* const driver;

0 commit comments

Comments
 (0)