Add managed SigV4a signer. #3923
Conversation
Now that the signer is managed, we create it at static initialization.
sdk/src/Core/Amazon.Runtime/Credentials/ImmutableCredentials.cs
Outdated
Show resolved
Hide resolved
| #if NET7_0_OR_GREATER | ||
| return key.SignData(data, HashAlgorithmName.SHA256, DSASignatureFormat.Rfc3279DerSequence); | ||
| #else | ||
| return ConvertToRfc3279DerSequence(key.SignData(data, HashAlgorithmName.SHA256)); | ||
| #endif | ||
| } | ||
|
|
||
| #if !NET7_0_OR_GREATER | ||
| private static byte[] ConvertToRfc3279DerSequence(byte[] signature) | ||
| { | ||
| var writer = new AsnWriter(AsnEncodingRules.DER); | ||
| writer.PushSequence(); | ||
| writer.WriteIntegerUnsigned(signature.AsSpan(0, signature.Length / 2)); // R value | ||
| writer.WriteIntegerUnsigned(signature.AsSpan(signature.Length / 2)); // S value | ||
| writer.PopSequence(); | ||
| return writer.Encode(); | ||
| } | ||
| #endif |
There was a problem hiding this comment.
The fact that we format the signature in ASN.1 is not documented anywhere, and stumped me for some days. I sent feedback to update the documentation.
| @@ -99,6 +120,7 @@ public string RegionSet | |||
| /// <summary> | |||
| /// Returns the full presigned Uri | |||
| /// </summary> | |||
| [Obsolete("This property is always empty in objects returned by AWS4aSigner. Use the ForQueryParameters property instead, to get the query parameters for a presigned URL.")] | |||
There was a problem hiding this comment.
There is a difference in how the SigV4 and SigV4a signing result types return presigned URLs. I think that obsoleting this SigV4a-only property and unifying with SigV4 is the better choice; for reference, there are zero usages of this property outside of the S3 library, which will need the Core bump from the replacement of AWS4aSignerCRTWrapper either way.
| /// <summary> | ||
| /// AWS4a protocol signer for Amazon S3 presigned urls. | ||
| /// </summary> | ||
| public static class AWS4aPreSignedUrlSigner |
There was a problem hiding this comment.
I had the idea of making this a static class, unlike the SigV4 counterpart, which mostly has static members and an overriden method that always throws.
There was a problem hiding this comment.
This might need to be updated to account for the fact that the S3 library needs a newer Core version. How to write this?
The logic is moved to a separate function, and we guard from temporary resource leaks if multiple threads try to populate the cache.
Description
This PR adds a managed implementation of the AWS SigV4a algorithm, contained in the newly added
Amazon.Runtime.Internal.Auth.AWS4aSignerclass. All uses of the old signer that forward to the CRT were replaced. The CRT signer and related APIs were deprecated, but were left otherwise untouched.Motivation and Context
Fixes #3881.
Testing
extensions.Screenshots (if appropriate)
Types of changes
Checklist
License