Line data    Source code

       1             : #include "source/extensions/common/aws/sigv4_signer_impl.h"
       2             : 
       3             : #include <openssl/ssl.h>
       4             : 
       5             : #include <cstddef>
       6             : 
       7             : #include "envoy/common/exception.h"
       8             : 
       9             : #include "source/common/buffer/buffer_impl.h"
      10             : #include "source/common/common/fmt.h"
      11             : #include "source/common/common/hex.h"
      12             : #include "source/common/crypto/utility.h"
      13             : #include "source/common/http/headers.h"
      14             : #include "source/extensions/common/aws/utility.h"
      15             : 
      16             : #include "absl/strings/str_join.h"
      17             : 
      18             : namespace Envoy {
      19             : namespace Extensions {
      20             : namespace Common {
      21             : namespace Aws {
      22             : 
      23             : std::string SigV4SignerImpl::createCredentialScope(absl::string_view short_date,
      24           0 :                                                    absl::string_view override_region) const {
      25           0 :   return fmt::format(fmt::runtime(SigV4SignatureConstants::get().SigV4CredentialScopeFormat),
      26           0 :                      short_date, override_region.empty() ? region_ : override_region,
      27           0 :                      service_name_);
      28           0 : }
      29             : 
      30             : std::string SigV4SignerImpl::createStringToSign(absl::string_view canonical_request,
      31             :                                                 absl::string_view long_date,
      32           0 :                                                 absl::string_view credential_scope) const {
      33           0 :   auto& crypto_util = Envoy::Common::Crypto::UtilitySingleton::get();
      34           0 :   return fmt::format(
      35           0 :       fmt::runtime(SigV4SignatureConstants::get().SigV4StringToSignFormat), long_date,
      36           0 :       credential_scope,
      37           0 :       Hex::encode(crypto_util.getSha256Digest(Buffer::OwnedImpl(canonical_request))));
      38           0 : }
      39             : 
      40             : std::string SigV4SignerImpl::createSignature(
      41             :     ABSL_ATTRIBUTE_UNUSED const absl::string_view access_key_id,
      42             :     const absl::string_view secret_access_key, const absl::string_view short_date,
      43           0 :     const absl::string_view string_to_sign, const absl::string_view override_region) const {
      44             : 
      45           0 :   auto& crypto_util = Envoy::Common::Crypto::UtilitySingleton::get();
      46           0 :   const auto secret_key =
      47           0 :       absl::StrCat(SigV4SignatureConstants::get().SigV4SignatureVersion, secret_access_key);
      48           0 :   const auto date_key = crypto_util.getSha256Hmac(
      49           0 :       std::vector<uint8_t>(secret_key.begin(), secret_key.end()), short_date);
      50           0 :   const auto region_key =
      51           0 :       crypto_util.getSha256Hmac(date_key, override_region.empty() ? region_ : override_region);
      52           0 :   const auto service_key = crypto_util.getSha256Hmac(region_key, service_name_);
      53           0 :   const auto signing_key =
      54           0 :       crypto_util.getSha256Hmac(service_key, SigV4SignatureConstants::get().Aws4Request);
      55           0 :   return Hex::encode(crypto_util.getSha256Hmac(signing_key, string_to_sign));
      56           0 : }
      57             : 
      58             : std::string SigV4SignerImpl::createAuthorizationHeader(
      59             :     absl::string_view access_key_id, absl::string_view credential_scope,
      60             :     const std::map<std::string, std::string>& canonical_headers,
      61           0 :     absl::string_view signature) const {
      62           0 :   const auto signed_headers = Utility::joinCanonicalHeaderNames(canonical_headers);
      63           0 :   return fmt::format(fmt::runtime(SigV4SignatureConstants::get().SigV4AuthorizationHeaderFormat),
      64           0 :                      access_key_id, credential_scope, signed_headers, signature);
      65           0 : }
      66             : 
      67             : } // namespace Aws
      68             : } // namespace Common
      69             : } // namespace Extensions
      70             : } // namespace Envoy