blobsterix 0.0.34 → 0.0.35

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: de4c7f26e746a8a411576f67e073d959d8ae48dd
-  data.tar.gz: 1adb250fcf9cc7546d6e5acd3ad493c6b14e6629
+  metadata.gz: 549a1162916756237d9df4372dbce37432d2cbb2
+  data.tar.gz: 85b118a8cb57a4140e922dbae3caf6c768b17cd3
 SHA512:
-  metadata.gz: 0e9ba6fe49bf8f777f19f2409c1bec4fa434a108ec1886a62975145e639851cf07b6d1af236418aa06700432165061818f1ec517d4d83f508af569b7b30e55c3
-  data.tar.gz: 48909960b47c5fce517eee45b253fede5eb5583c008017c6293b718da5d68dba0112b15a3e361608a63e476f449679f7de89d57cbd0bc5331c6148b35106ed2f
+  metadata.gz: 00f4d1abc5b5b64469090a20b5f6c6d303ba13d361a723961f606e79723fb23eb56755d8f5ee91d548d51f69466beabeab8fd6f01f4042b6ec718f621714a773
+  data.tar.gz: c79acbb55211463bb151cc0ed731aa85a7673b8c4936842d839a39a28b8cce7656c3efd8e9b6f829daee35897ecf3d9008260cf964b01eb4fab7aaf988dec342

data/lib/blobsterix/s3/s3_auth_v4.rb

@@ -3,30 +3,102 @@ module Blobsterix
     class V4
       include ::Blobsterix::S3UrlHelper
       include ::Blobsterix::UrlHelper
-      
 
       V4_REGEX = /AWS4-HMAC-SHA256 Credential=(\w+\/\d+\/.+\/\w+\/aws4_request),.*SignedHeaders=(.+),.*Signature=(\w+)/
 
       def self.create(env)
-        auth_string = env["HTTP_AUTHORIZATION"]
-        matcher = V4_REGEX.match(auth_string)
+        matcher = V4_REGEX.match(env["HTTP_AUTHORIZATION"])
         matcher ? V4.new(env, matcher[1], matcher[2], matcher[3]) : nil
       end
 
-      attr_reader :env, :credential, :signed_headers, :signature
+      attr_reader :env, :credential, :signed_headers, :signature, :access_key, :scope_date, :scope_region, :scope_service
+
       def initialize(env, credential, signed_headers, signature)
         @env = env
         @credential = credential
         @signed_headers = signed_headers
         @signature = signature
+
+        @access_key, @scope_date, @scope_region, @scope_service = @credential.split("/")
+      end
+
+      def check(secret_key_store)
+        return false if is_expired?
+
+        secret_key = secret_key_store.get_key(@access_key)
+        gen_signature(secret_key) == @signature
+      end
+
+      def gen_signature(secret_key)
+        signing_key = hmac256("AWS4"+secret_key, @scope_date)
+        signing_key = hmac256(signing_key, @scope_region)
+        signing_key = hmac256(signing_key, @scope_service)
+        signing_key = hmac256(signing_key, "aws4_request")
+
+        hmac256(signing_key, string_to_sign).unpack('H*').first
+      end
+
+      def string_to_sign
+        [
+          "AWS4-HMAC-SHA256",
+          header_datetime_iso8601,
+          [@scope_date, @scope_region, @scope_service, "aws4_request"].join("/"),
+          Digest::SHA256.hexdigest(canonical_request)
+        ].join("\n")
+      end
+
+      def canonical_request
+        [
+          @env["REQUEST_METHOD"].to_s.upcase,
+          @env["REQUEST_PATH"],
+          canonical_query,
+          canonical_headers,
+          @signed_headers,
+          @env["HTTP_X_AMZ_CONTENT_SHA256"] || Digest::SHA256.hexdigest("")
+        ].join("\n")
+      end
+
+      def canonical_query
+        @env["QUERY_STRING"].to_s.split("&").sort.map do |param|
+          escaped = param.split("=").map { |k_or_v| escape(k_or_v) }.join("=")
+          escaped["="] ? escaped : "#{escaped}="
+        end.join("&")
+      end
+
+      def canonical_headers
+        canonicalized = @env.select { |key,value| key.is_a?(String) }.inject({}) do |memo, (key,value)|
+          memo[key.gsub("HTTP_","").downcase.gsub("_","-")] = value.to_s.strip
+          memo
+        end
+
+        headers = ""
+
+        @signed_headers.split(";").each do |key|
+          raise StandardError.new("Missing signed header") unless canonicalized.key?(key)
+          headers << key + ":" + canonicalized[key] + "\n"
+        end
+
+        headers
+      end
+
+      def hmac256(key, data)
+        OpenSSL::HMAC.digest(OpenSSL::Digest.new("sha256"), key, data)
+      end
+
+      def header_datetime
+        Time.parse(@env["HTTP_X_AMZ_DATE"] || @env["HTTP_DATE"] || Time.now.to_s)
+      end
+
+      def header_datetime_iso8601
+        header_datetime.utc.strftime('%Y%m%dT%H%M%SZ')
+      end
+
+      def is_expired?
+        ::Blobsterix::S3Auth.current_time > header_datetime+15*60
       end
-      def getSignatureKey(key, dateStamp, regionName, serviceName)
-        kDate    = OpenSSL::HMAC.digest('sha256', "AWS4" + key, dateStamp)
-        kRegion  = OpenSSL::HMAC.digest('sha256', kDate, regionName)
-        kService = OpenSSL::HMAC.digest('sha256', kRegion, serviceName)
-        kSigning = OpenSSL::HMAC.digest('sha256', kService, "aws4_request")
 
-        kSigning
+      def escape(string)
+        string.gsub(/([^a-zA-Z0-9_.\-~]+)/) { "%" + $1.unpack("H2" * $1.bytesize).join("%").upcase }
       end
     end
   end

data/lib/blobsterix/version.rb

@@ -1,3 +1,3 @@
 module Blobsterix
-  VERSION = "0.0.34"
+  VERSION = "0.0.35"
 end

data/spec/lib/s3/s3_auth_spec.rb

@@ -63,7 +63,7 @@ describe Blobsterix::S3Auth do
       :path=>"/photos/puppy.jpg",
       :query=>"AWSAccessKeyId=AKIAIOSFODNN7EXAMPLE&Signature=NpgCjnDzrM%2BWFzoENXmpNDUsSn8%3D&Expires=1175139620",
       :head => {
-        "host"=>"johnsmith.s3.amazonaws.com"              
+        "host"=>"johnsmith.s3.amazonaws.com"
       }
     }
   }
@@ -97,12 +97,12 @@ describe Blobsterix::S3Auth do
       "HTTP_PROXY_CONNECTION"=>"Keep-Alive",
       "HTTP_DATE"=>"Fri, 24 May 2013 00:00:00 GMT",
       "HTTP_AUTHORIZATION"=>"AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/s3/aws4_request,SignedHeaders=host;range;x-amz-content-sha256;x-amz-date,Signature=f0e8bdb87c964420e857bd35b5d6ed310bd44f0170aba48dd91039c6036bdb41",
-      "HTTP_HOST"=>"examplebucket.s3.amazonaws.com:80",
+      "HTTP_HOST"=>"examplebucket.s3.amazonaws.com",
       "HTTP_TE"=>"trailers, deflate, gzip",
       "HTTP_CONNECTION"=>"TE, close",
       "CONTENT_LENGTH"=>"0",
       "REQUEST_METHOD"=>"GET",
-      "REQUEST_URI"=>"http://examplebucket.s3.amazonaws.com:80/test.txt",
+      "REQUEST_URI"=>"http://examplebucket.s3.amazonaws.com/test.txt",
       "QUERY_STRING"=>nil,
       "HTTP_VERSION"=>"1.1",
       "SCRIPT_NAME"=>"",
@@ -117,6 +117,42 @@ describe Blobsterix::S3Auth do
     }
   }
 
+  let(:v4_req_env_with_query_param) {
+    {
+      "HTTP_HOST"=>"firefox.s3.amazonaws.com",
+      "HTTP_ACCEPT_ENCODING"=>"identity",
+      "HTTP_X_AMZ_CONTENT_SHA256"=>"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "HTTP_AUTHORIZATION"=>"AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20160217/US/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=10681a4fd1254dce4d80d7c254ae521dd8031b5ef871d77b7ffb28b260ee8372",
+      "HTTP_X_AMZ_DATE"=>"20160217T134245Z",
+      "CONTENT_LENGTH"=>"0",
+      "REQUEST_METHOD"=>"GET",
+      "REQUEST_URI"=>"http://firefox.s3.amazonaws.com/?delimiter=/",
+      "QUERY_STRING"=>"delimiter=/",
+      "HTTP_VERSION"=>"1.1",
+      "SCRIPT_NAME"=>"",
+      "REQUEST_PATH"=>"/",
+      "PATH_INFO"=>"/"
+    }
+  }
+
+  let(:v4_req_env_with_query_param_2) {
+    {
+      "HTTP_HOST"=>"firefox.s3.amazonaws.com",
+      "HTTP_ACCEPT_ENCODING"=>"identity",
+      "HTTP_X_AMZ_CONTENT_SHA256"=>"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "HTTP_AUTHORIZATION"=>"AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20160217/US/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=d8fe8bcca8ada96996626125bec12258ed4ba0462f7c277d7412a8b9c230430d",
+      "HTTP_X_AMZ_DATE"=>"20160217T134245Z",
+      "CONTENT_LENGTH"=>"0",
+      "REQUEST_METHOD"=>"GET",
+      "REQUEST_URI"=>"http://firefox.s3.amazonaws.com/?location",
+      "QUERY_STRING"=>"location",
+      "HTTP_VERSION"=>"1.1",
+      "SCRIPT_NAME"=>"",
+      "REQUEST_PATH"=>"/",
+      "PATH_INFO"=>"/"
+    }
+  }
+
   before :all do
     Blobsterix.secret_key_store = Blobsterix::S3Auth::KeyStore.new(
       "AKIAIOSFODNN7EXAMPLE" => "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
@@ -174,8 +210,28 @@ describe Blobsterix::S3Auth do
     auth.class.should eql Blobsterix::S3Auth::V4
   end
 
+  it "should authenticate v4 request if the signature match and request time is within 15minutes window" do
+    Blobsterix::S3Auth.current_time=lambda{Time.parse("Fri, 24 May 2013 00:14:59 GMT")}
+    Blobsterix::S3Auth.authenticate(v4_req_env).check(Blobsterix.secret_key_store).should be_true
+  end
+
+  it "should not authenticate v4 request if the signature match but request time is older than 15 minutes" do
+    Blobsterix::S3Auth.current_time=lambda{Time.parse("Fri, 24 May 2013 00:15:01 GMT")}
+    Blobsterix::S3Auth.authenticate(v4_req_env).check(Blobsterix.secret_key_store).should be_false
+  end
+
+  it "should authenticate v4 request with query params" do
+    Blobsterix::S3Auth.current_time=lambda{Time.parse("20160217T135245Z")}
+    Blobsterix::S3Auth.authenticate(v4_req_env_with_query_param).check(Blobsterix.secret_key_store).should be_true
+  end
+
+  it "should authenticate v4 request with query param without equal character" do
+    Blobsterix::S3Auth.current_time=lambda{Time.parse("20160217T135245Z")}
+    Blobsterix::S3Auth.authenticate(v4_req_env_with_query_param_2).check(Blobsterix.secret_key_store).should be_true
+  end
+
   it "should at least recognize aws v2" do
     auth = Blobsterix::S3Auth.authenticate(v2_req_env)
     auth.class.should eql Blobsterix::S3Auth::V2
   end
-end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: blobsterix
 version: !ruby/object:Gem::Version
-  version: 0.0.34
+  version: 0.0.35
 platform: ruby
 authors:
 - Daniel Sudmann
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-01-18 00:00:00.000000000 Z
+date: 2016-02-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -317,7 +317,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5.1
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Blobsterix is a transcoding, caching, storage server.