Skip to content

Commit aef075b

Browse files
waahm7waahm7
authored
S3Express CreateSession Allowlist Headers (#492)
1 parent 8feda6e commit aef075b

19 files changed

+327
-40
lines changed

‎.github/workflows/ci.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ concurrency:
1111
cancel-in-progress: true
1212

1313
env:
14-
BUILDER_VERSION: v0.9.72
14+
BUILDER_VERSION: v0.9.74
1515
BUILDER_SOURCE: releases
1616
BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net
1717
PACKAGE_NAME: aws-c-s3

‎.github/workflows/codecov.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ on:
55

66

77
env:
8-
BUILDER_VERSION: v0.9.72
8+
BUILDER_VERSION: v0.9.74
99
BUILDER_SOURCE: releases
1010
BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net
1111
PACKAGE_NAME: aws-c-s3
@@ -30,4 +30,4 @@ jobs:
3030
run: |
3131
python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')"
3232
chmod a+x builder
33-
./builder build -p ${{ env.PACKAGE_NAME }} --compiler=gcc-12 --cmake-extra=-DASSERT_LOCK_HELD=ON --coverage --coverage-exclude=source/s3_copy_object.c
33+
./builder build -p ${{ env.PACKAGE_NAME }} --compiler=gcc --cmake-extra=-DASSERT_LOCK_HELD=ON --coverage --coverage-exclude=source/s3_copy_object.c

‎include/aws/s3/private/s3_request_messages.h

+6
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,12 @@ extern const size_t g_s3_complete_multipart_upload_excluded_headers_count;
167167
AWS_S3_API
168168
extern const struct aws_byte_cursor g_s3_abort_multipart_upload_excluded_headers[];
169169

170+
AWS_S3_API
171+
extern const size_t g_s3_create_session_allowed_headers_count;
172+
173+
AWS_S3_API
174+
extern const struct aws_byte_cursor g_s3_create_session_allowed_headers[];
175+
170176
AWS_S3_API
171177
extern const size_t g_s3_abort_multipart_upload_excluded_headers_count;
172178

‎include/aws/s3/private/s3express_credentials_provider_impl.h

+10-3
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ struct aws_s3express_session {
2626
/* The region and host of the session */
2727
struct aws_string *region;
2828
struct aws_string *host;
29+
30+
struct aws_http_headers *headers;
2931
bool inactive;
3032

3133
/* Only used for mock tests */
@@ -105,14 +107,19 @@ struct aws_s3express_credentials_provider *aws_s3express_credentials_provider_ne
105107
const struct aws_s3express_credentials_provider_default_options *options);
106108

107109
/**
108-
* Encode the hash key to be [host_value][hash_of_credentials]
109-
* hash_of_credentials is the sha256 of [access_key][secret_access_key]
110+
* Encodes the hash key in the format: [host_value][hash_of_credentials_and_headers]
111+
*
112+
* The hash_of_credentials_and_headers is calculated as follows:
113+
* 1. Concatenate: [access_key][secret_access_key][headers]
114+
* where headers = ",header_name1:header_value1,header_name2:header_value2..."
115+
* 2. Generates SHA256 hash of the concatenated string
110116
*/
111117
AWS_S3_API
112118
struct aws_string *aws_encode_s3express_hash_key_new(
113119
struct aws_allocator *allocator,
114120
const struct aws_credentials *original_credentials,
115-
struct aws_byte_cursor host_value);
121+
struct aws_byte_cursor host_value,
122+
struct aws_http_headers *headers);
116123

117124
AWS_EXTERN_C_END
118125
#endif /* AWS_S3EXPRESS_CREDENTIALS_PROVIDER_IMPL_H */

‎include/aws/s3/s3_client.h

+4
Original file line numberDiff line numberDiff line change
@@ -552,6 +552,10 @@ struct aws_s3_client_config {
552552
* If set, client will invoke the factory to get the provider to use, when needed.
553553
*
554554
* If not set, client will create a default S3 Express provider under the hood.
555+
*
556+
* NOTE: THE FOLLOWING BEHAVIOR IS EXPERIMENTAL AND UNSTABLE
557+
* Default S3 Express provider will pass the headers allowed in `g_s3_create_session_allowed_headers` to the
558+
* CreateSession call.
555559
*/
556560
aws_s3express_provider_factory_fn *s3express_provider_override_factory;
557561
void *factory_user_data;

‎include/aws/s3/s3express_credentials_provider.h

+2
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ struct aws_credentials_properties_s3express {
2727
* If empty, the region of the S3 client will be used.
2828
*/
2929
struct aws_byte_cursor region;
30+
31+
struct aws_http_headers *headers;
3032
};
3133

3234
struct aws_s3express_credentials_provider_vtable {

‎source/s3_client.c

+1
Original file line numberDiff line numberDiff line change
@@ -1030,6 +1030,7 @@ struct aws_s3_meta_request *aws_s3_client_make_meta_request(
10301030
}
10311031

10321032
endpoint_host_name = aws_string_new_from_cursor(client->allocator, aws_uri_host_name(&host_uri));
1033+
port = aws_uri_port(&host_uri);
10331034
aws_uri_clean_up(&host_uri);
10341035
}
10351036

‎source/s3_meta_request.c

+1
Original file line numberDiff line numberDiff line change
@@ -968,6 +968,7 @@ void aws_s3_meta_request_sign_request_default_impl(
968968
context->user_data = user_data;
969969
context->properties.host = aws_byte_cursor_from_string(meta_request->s3express_session_host);
970970
context->properties.region = signing_config.region;
971+
context->properties.headers = aws_http_message_get_headers(meta_request->initial_request_message);
971972

972973
if (signing_config.credentials) {
973974
context->original_credentials = signing_config.credentials;

‎source/s3_request_messages.c

+17
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ const struct aws_byte_cursor g_s3_create_multipart_upload_excluded_headers[] = {
2727
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-checksum-sha1"),
2828
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-checksum-sha256"),
2929
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("if-none-match"),
30+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-create-session-mode"),
3031
};
3132

3233
const size_t g_s3_create_multipart_upload_excluded_headers_count =
@@ -62,6 +63,7 @@ const struct aws_byte_cursor g_s3_upload_part_excluded_headers[] = {
6263
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-checksum-sha1"),
6364
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-checksum-sha256"),
6465
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("if-none-match"),
66+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-create-session-mode"),
6567
};
6668

6769
const size_t g_s3_upload_part_excluded_headers_count = AWS_ARRAY_SIZE(g_s3_upload_part_excluded_headers);
@@ -96,6 +98,7 @@ const struct aws_byte_cursor g_s3_complete_multipart_upload_excluded_headers[] =
9698
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-copy-source"),
9799
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-copy-source-range"),
98100
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-mp-object-size"),
101+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-create-session-mode"),
99102
};
100103

101104
const size_t g_s3_complete_multipart_upload_excluded_headers_count =
@@ -131,6 +134,7 @@ const struct aws_byte_cursor g_s3_complete_multipart_upload_with_checksum_exclud
131134
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-copy-source-range"),
132135
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-sdk-checksum-algorithm"),
133136
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-mp-object-size"),
137+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-create-session-mode"),
134138
};
135139

136140
const struct aws_byte_cursor g_s3_list_parts_excluded_headers[] = {
@@ -162,6 +166,7 @@ const struct aws_byte_cursor g_s3_list_parts_excluded_headers[] = {
162166
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-object-lock-legal-hold"),
163167
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-copy-source"),
164168
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-copy-source-range"),
169+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-create-session-mode"),
165170
};
166171

167172
const size_t g_s3_list_parts_excluded_headers_count = AWS_ARRAY_SIZE(g_s3_list_parts_excluded_headers);
@@ -192,6 +197,7 @@ const struct aws_byte_cursor g_s3_list_parts_with_checksum_excluded_headers[] =
192197
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-object-lock-legal-hold"),
193198
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-copy-source"),
194199
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-copy-source-range"),
200+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-create-session-mode"),
195201
};
196202

197203
const size_t g_s3_list_parts_with_checksum_excluded_headers_count =
@@ -227,8 +233,19 @@ const struct aws_byte_cursor g_s3_abort_multipart_upload_excluded_headers[] = {
227233
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-copy-source"),
228234
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-copy-source-range"),
229235
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("if-none-match"),
236+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-create-session-mode"),
230237
};
231238

239+
const struct aws_byte_cursor g_s3_create_session_allowed_headers[] = {
240+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-create-session-mode"),
241+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-server-side-encryption"),
242+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-server-side-encryption-aws-kms-key-id"),
243+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-server-side-encryption-context"),
244+
AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-server-side-encryption-bucket-key-enabled"),
245+
};
246+
247+
const size_t g_s3_create_session_allowed_headers_count = AWS_ARRAY_SIZE(g_s3_create_session_allowed_headers);
248+
232249
static const struct aws_byte_cursor s_x_amz_meta_prefix = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("x-amz-meta-");
233250

234251
static const struct aws_byte_cursor s_checksum_type_header =

0 commit comments

Comments
 (0)