TrueCloudLab/frostfs-s3-gw
17
3
Fork 19
Code Issues 28 Pull requests 7 Projects Releases 18 Packages Activity Actions

[#218] Add check content sha256 header #264

Merged
alexvanin merged 1 commit from :feature/218-Add_check_content_hash_header into master 2023-11-22 11:33:54 +00:00
Conversation 0 Commits 1 Files changed 10 +282 -26
r.loginov commented 2023-11-13 08:17:39 +00:00
Member
Copy link

Closes #218

The X-Amz-Content-Sha256 header check is done only for unencrypted payload.

More information here.

Signed-off-by: Roman Loginov r.loginov@yadro.com

Closes #218 The X-Amz-Content-Sha256 header check is done only for unencrypted payload. More information [here](https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/issues/218#issuecomment-25955). Signed-off-by: Roman Loginov <r.loginov@yadro.com>
r.loginov self-assigned this 2023-11-13 08:17:39 +00:00
r.loginov requested review from storage-services-committers 2023-11-13 08:23:27 +00:00
r.loginov requested review from storage-services-developers 2023-11-13 08:23:27 +00:00
dkirillov reviewed 2023-11-13 15:04:44 +00:00
dkirillov left a comment
Member
Copy link

Please update changelog

Please update changelog
👍 1
api/auth/center.go Outdated
@ -215,1 +241,4 @@
func checkFormatHashContentSHA256(hash string) error {
if !IsStandardContentSHA256(hash) {
re := regexp.MustCompile(`^(?:[0-9a-fA-F]{64})?$`)
dkirillov commented 2023-11-13 14:55:51 +00:00
Member
Copy link

It's better to compile regexp once rather than on every request.

By the way, it seems we can use hex.DecodeString and check length after successful decoding (as alternative to regexp)

It's better to compile regexp once rather than on every request. By the way, it seems we can use `hex.DecodeString` and check length after successful decoding (as alternative to regexp)
👍 1
dkirillov marked this conversation as resolved
api/handler/put.go Outdated
@ -249,0 +246,4 @@
Header: metadata,
Encryption: encryptionParams,
ContentMD5: r.Header.Get(api.ContentMD5),
ContentSHA256Hash: r.Header.Get(api.AmzContentSha256),
dkirillov commented 2023-11-13 15:04:34 +00:00
Member
Copy link

Shouldn't we use the same check also for UploadPart (and maybe some other methods where this hash be for general body rather than just payload? or it's invalid scenario?)

Shouldn't we use the same check also for `UploadPart` (and maybe some other methods where this hash be for general body rather than just payload? or it's invalid scenario?)
dkirillov marked this conversation as resolved
r.loginov force-pushed feature/218-Add_check_content_hash_header from 95290b2445 to 3a7eee90d9 2023-11-17 10:24:22 +00:00 Compare
r.loginov force-pushed feature/218-Add_check_content_hash_header from 3a7eee90d9 to 2653f8fc0a 2023-11-17 10:31:35 +00:00 Compare
dkirillov reviewed 2023-11-17 12:48:56 +00:00
api/auth/center.go Outdated
@ -216,0 +244,4 @@
if _, err := hex.DecodeString(hash); err != nil {
return apiErrors.GetAPIError(apiErrors.ErrContentSHA256Mismatch)
}
if len(hash) != 64 && len(hash) != 0 {
dkirillov commented 2023-11-17 12:48:56 +00:00
Member
Copy link

Actually sha256 size is 32 (not 64). And it's better to use standard constant sha256.Size

Actually sha256 size is `32` (not `64`). And it's better to use standard constant `sha256.Size`
r.loginov commented 2023-11-17 13:15:52 +00:00
Author
Member
Copy link

Yes, but in this case, I am checking the hash length in string representation in 16-bit format, and the number of characters should be 64 for 32 bytes, so it works correctly. But it may be worth checking the length of the slice of bytes received before decoding at this point?

Yes, but in this case, I am checking the hash length in string representation in 16-bit format, and the number of characters should be 64 for 32 bytes, so it works correctly. But it may be worth checking the length of the slice of bytes received before decoding at this point?
dkirillov commented 2023-11-17 14:16:55 +00:00
Member
Copy link

Oh, sorry. Yes, I thought we check length of decoded slice of bytes.

Oh, sorry. Yes, I thought we check length of decoded slice of bytes.
dkirillov commented 2023-11-17 14:21:33 +00:00
Member
Copy link

I would suggest to check for length of decoded slice of bytes instead of length of hex-encoded string (though the last approach can be faster in case of invalid hash format)

I would suggest to check for length of decoded slice of bytes instead of length of hex-encoded string (though the last approach can be faster in case of invalid hash format)
👍 1
dkirillov marked this conversation as resolved
r.loginov force-pushed feature/218-Add_check_content_hash_header from 2653f8fc0a to 8662b12fdc 2023-11-17 14:24:46 +00:00 Compare
dkirillov approved these changes 2023-11-20 06:33:26 +00:00
mbiryukova approved these changes 2023-11-21 15:31:47 +00:00
alexvanin approved these changes 2023-11-22 11:33:46 +00:00
alexvanin merged commit 861454e499 into master 2023-11-22 11:33:54 +00:00
alexvanin deleted branch feature/218-Add_check_content_hash_header 2023-11-22 11:33:55 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
dkirillov
mbiryukova
alexvanin
Labels
Clear labels   
P0

Highest

  
P1

High

  
P2

Medium

  
P3

Low

  
good first issue

Good for newcomers

  
Infrastructure

Infrastructure, Automation, CI/CD or DevOps related stuff

  
blocked

The issue or PR is blocked by something

  
bug

Something is not working

  
config

Configuration format update or breaking change

  
discussion

Talking about something in order to reach a decision or to exchange ideas

  
documentation

Documentation related

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
go

Language features adoption

  
help wanted

Extra attention is needed

  
internal

   
invalid

Something is wrong

  
kludge

This is a kludge and we know it

  
observability

Related to metrics, tracing and logs

  
perfomance

Perfomance related

  
question

More information is needed

  
refactoring

Refactoring

  
wontfix

This won't be fixed

No labels
P0
P1
P2
P3
good first issue
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
r.loginov
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/frostfs-s3-gw#264
No description provided.
Delete branch ":feature/218-Add_check_content_hash_header"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?