1- package mongoaws
1+ package mongoawsv2
22
33import (
44 "bytes"
55 "context"
66 "crypto/rand"
7+ "crypto/sha256"
78 "encoding/base64"
9+ "encoding/hex"
810 "errors"
911 "fmt"
10- "log "
12+ "io "
1113 "net/http"
1214 "strings"
1315 "time"
@@ -141,7 +143,6 @@ func getRegion(host string) (string, error) {
141143// "client-final" payload containing the SigV4-signed STS GetCallerIdentity
142144// request.
143145func (client * awsSdkSaslClient ) Next (ctx context.Context , challenge []byte ) ([]byte , error ) {
144- log .Println ("challenge received" )
145146 if client .state != conversationStateServerFirst {
146147 return nil , fmt .Errorf ("invalid state: %v" , client .state )
147148 }
@@ -157,8 +158,6 @@ func (client *awsSdkSaslClient) Next(ctx context.Context, challenge []byte) ([]b
157158 return nil , err
158159 }
159160
160- log .Printf ("SASL h (sts host): %s" , sm .Host )
161-
162161 // Check nonce prefix
163162 if sm .Nonce .Subtype != 0x00 {
164163 return nil , errors .New ("server reply contained unexpected binary subtype" )
@@ -173,13 +172,14 @@ func (client *awsSdkSaslClient) Next(ctx context.Context, challenge []byte) ([]b
173172 }
174173
175174 currentTime := time .Now ().UTC ()
176- body := "Action=GetCallerIdentity&Version=2011-06-15"
175+ //body := "Action=GetCallerIdentity&Version=2011-06-15"
176+ body := strings .NewReader ("Action=GetCallerIdentity&Version=2011-06-15" )
177177
178178 // Create http.Request
179- req , _ := http .NewRequest ( "POST" , "/" , strings . NewReader ( body ) )
179+ req , _ := http .NewRequestWithContext ( ctx , "POST" , "/" , body )
180180 req .Header .Set ("Content-Type" , "application/x-www-form-urlencoded" )
181181 req .Header .Set ("Content-Length" , "43" )
182- req . URL . Scheme = "https"
182+
183183 req .Host = sm .Host
184184 req .Header .Set ("X-Amz-Date" , currentTime .Format (amzDateFormat ))
185185
@@ -202,25 +202,22 @@ func (client *awsSdkSaslClient) Next(ctx context.Context, challenge []byte) ([]b
202202 return nil , fmt .Errorf ("failed to retrieve AWS credentials: %w" , err )
203203 }
204204
205- log .Printf ("SASL r (region): %s" , region )
205+ h := sha256 .New ()
206+ _ , _ = io .Copy (h , body )
207+ payloadHash := hex .EncodeToString (h .Sum (nil ))
206208
207209 // Create signer with credentials
208- err = client .signer .SignHTTP (ctx , creds , req , body , "sts" , region , currentTime )
210+ err = client .signer .SignHTTP (ctx , creds , req , payloadHash , "sts" , region , currentTime )
209211 if err != nil {
210212 return nil , fmt .Errorf ("failed to sign request: %w" , err )
211213 }
212214
213- for k , v := range req .Header {
214- log .Printf ("Header %q: %s" , k , v )
215- }
216-
217215 // create message
218216 // { a: Authorization, d: X-Amz-Date, t: X-Amz-Security-Token }
219217 idx , msg := bsoncore .AppendDocumentStart (nil )
220218 msg = bsoncore .AppendStringElement (msg , "a" , req .Header .Get ("Authorization" ))
221219 msg = bsoncore .AppendStringElement (msg , "d" , req .Header .Get ("X-Amz-Date" ))
222220 if tok := req .Header .Get ("X-Amz-Security-Token" ); tok != "" {
223- log .Println ("token received" )
224221 msg = bsoncore .AppendStringElement (msg , "t" , tok )
225222 }
226223 msg , _ = bsoncore .AppendDocumentEnd (msg , idx )
0 commit comments