Merge remote-tracking branch 'origin/rel/7.4' into fwd/7.4-master

scality · Feb 11, 2018 · 31e9350 · 31e9350
2 parents 4193394 + b6c051d
commit 31e9350
Show file tree

Hide file tree

Showing 5 changed files with 63 additions and 6 deletions.
diff --git a/circle.yml b/circle.yml
@@ -2,7 +2,7 @@
 general:
   branches:
     ignore:
-      - /^ultron\/.*/ # Ignore ultron/* branches
+      - /^ultron\/.*/  # Ignore ultron/* branches
 
 machine:
   node:
@@ -13,7 +13,9 @@ machine:
     CXX: g++-4.9
 
 dependencies:
-  pre:
+  override:
+    - rm -rf node_modules
+    - npm install
     - sudo pip install yamllint
 
 test:

diff --git a/lib/auth/v4/awsURIencode.js b/lib/auth/v4/awsURIencode.js
@@ -32,7 +32,7 @@ function _toHexUTF8(char) {
     return res;
 }
 
-function awsURIencode(input, encodeSlash) {
+function awsURIencode(input, encodeSlash, noEncodeStar) {
     const encSlash = encodeSlash === undefined ? true : encodeSlash;
     let encoded = '';
     for (let i = 0; i < input.length; i++) {
@@ -47,6 +47,8 @@ function awsURIencode(input, encodeSlash) {
             encoded = encoded.concat('%20');
         } else if (ch === '/') {
             encoded = encoded.concat(encSlash ? '%2F' : ch);
+        } else if (ch === '*') {
+            encoded = encoded.concat(noEncodeStar ? '*' : '%2A');
         } else {
             encoded = encoded.concat(_toHexUTF8(ch));
         }

diff --git a/lib/auth/v4/createCanonicalRequest.js b/lib/auth/v4/createCanonicalRequest.js
@@ -27,8 +27,16 @@ function createCanonicalRequest(params) {
             payloadChecksum = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b' +
                 '934ca495991b7852b855';
         } else if (pHttpVerb === 'POST') {
+            let notEncodeStar = false;
+            // The java sdk does not encode the '*' parameter to compute the
+            // signature, if the user-agent is recognized, we need to keep
+            // the plain '*' as well.
+            if (/aws-sdk-java\/[0-9.]+/.test(pHeaders['user-agent'])) {
+                notEncodeStar = true;
+            }
             let payload = queryString.stringify(pQuery, null, null, {
-                encodeURIComponent: awsURIencode,
+                encodeURIComponent: input => awsURIencode(input, false,
+                    notEncodeStar),
             });
             payload = payload.replace(/%20/g, '+');
             payloadChecksum = crypto.createHash('sha256')

diff --git a/lib/executables/pensieveCreds/package.json b/lib/executables/pensieveCreds/package.json
@@ -7,8 +7,8 @@
     "test": "mocha --recursive --timeout 5500 tests/unit"
   },
   "dependencies": {
+    "mocha": "2.5.3",
     "async": "^2.6.0",
     "node-forge": "^0.7.1"
   }
 }
-
diff --git a/tests/unit/auth/v4/createCanonicalRequest.js b/tests/unit/auth/v4/createCanonicalRequest.js
@@ -1,7 +1,8 @@
 'use strict'; // eslint-disable-line strict
 
 const assert = require('assert');
-
+const awsURIencode =
+    require('../../../../lib/auth/v4/awsURIencode');
 const createCanonicalRequest =
     require('../../../../lib/auth/v4/createCanonicalRequest');
 
@@ -45,6 +46,50 @@ describe('createCanonicalRequest function', () => {
         assert.strictEqual(actualOutput, expectedOutput);
     });
 
+    const msg = 'S3C-820: aws java sdk should not encode * ' +
+        'character for signature';
+    it(msg, () => {
+        const doc = JSON.stringify({
+            Statement: [{
+                Action: 's3:*',
+            }],
+        });
+        const params = {
+            pHttpVerb: 'POST',
+            pResource: '/',
+            pQuery: {
+                PolicyDocument: doc,
+            },
+            pHeaders: {
+                'host': 'examplebucket.s3.amazonaws.com',
+                'x-amz-date': '20130524T000000Z',
+                'user-agent': 'aws-sdk-java/1.11',
+                'authorization': 'AWS4-HMAC-SHA256 Credential' +
+                    '=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/' +
+                    's3/aws4_request,SignedHeaders=host;user-agent' +
+                    'x-amz-content-sha256;x-amz-date,Signature=' +
+                    'f0e8bdb87c964420e857bd35b5d6ed310bd44f' +
+                    '0170aba48dd91039c6036bdb41',
+                'x-amz-content-sha256': 'e3b0c44298fc1c149afbf4c' +
+                    '8996fb92427ae41e4649b934ca495991b7852b855',
+            },
+            pSignedHeaders: 'host;user-agent;x-amz-content-sha256;x-amz-date',
+        };
+        const expectedOutput = 'POST\n' +
+            '/\n' +
+            `PolicyDocument=${awsURIencode(doc)}\n` +
+            'host:examplebucket.s3.amazonaws.com\n' +
+            'user-agent:aws-sdk-java/1.11\n' +
+            'x-amz-content-sha256:e3b0c44298fc1c149afbf4c' +
+            '8996fb92427ae41e4649b934ca495991b7852b855\n' +
+            'x-amz-date:20130524T000000Z\n\n' +
+            'host;user-agent;x-amz-content-sha256;x-amz-date\n' +
+            '25775fcf6b536b361aadce0c5f1afb46eb945dbdd6c3a7723b18300234a89588';
+        const actualOutput = createCanonicalRequest(params);
+        assert.strictEqual(actualOutput, expectedOutput);
+    });
+
+
     // Example taken from: http://docs.aws.amazon.com/AmazonS3/
     // latest/API/sig-v4-header-based-auth.html
     it('should construct a canonical request in accordance ' +