Line data    Source code

       1             : #pragma once
       2             : 
       3             : #include <utility>
       4             : 
       5             : #include "source/common/common/logger.h"
       6             : #include "source/common/common/matchers.h"
       7             : #include "source/common/common/utility.h"
       8             : #include "source/common/http/headers.h"
       9             : #include "source/common/singleton/const_singleton.h"
      10             : #include "source/extensions/common/aws/credentials_provider.h"
      11             : #include "source/extensions/common/aws/signer.h"
      12             : #include "source/extensions/common/aws/signer_base_impl.h"
      13             : 
      14             : namespace Envoy {
      15             : namespace Extensions {
      16             : namespace Common {
      17             : namespace Aws {
      18             : 
      19             : class SigV4ASignatureHeaderValues : public SignatureHeaderValues {
      20             : public:
      21             :   const Http::LowerCaseString RegionSet{"x-amz-region-set"};
      22             : };
      23             : 
      24             : using SigV4ASignatureHeaders = ConstSingleton<SigV4ASignatureHeaderValues>;
      25             : 
      26             : class SigV4ASignatureConstantValues : public SignatureConstantValues {
      27             : public:
      28             :   const std::string SigV4AAuthorizationHeaderFormat{
      29             :       "AWS4-ECDSA-P256-SHA256 Credential={}/{}, SignedHeaders={}, Signature={}"};
      30             :   const std::string SigV4ACredentialScopeFormat{"{}/{}/aws4_request"};
      31             :   const std::string HashedEmptyString{
      32             :       "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"};
      33             :   const std::string SigV4ASignatureVersion{"AWS4A"};
      34             :   const std::string SigV4AStringToSignFormat{"AWS4-ECDSA-P256-SHA256\n{}\n{}\n{}"};
      35             :   const std::string SigV4ALabel = "AWS4-ECDSA-P256-SHA256";
      36             : };
      37             : 
      38             : enum SigV4AKeyDerivationResult {
      39             :   AkdrSuccess,
      40             :   AkdrNextCounter,
      41             :   AkdrFailure,
      42             : };
      43             : 
      44             : using SigV4ASignatureConstants = ConstSingleton<SigV4ASignatureConstantValues>;
      45             : 
      46             : using AwsSigningHeaderExclusionVector = std::vector<envoy::type::matcher::v3::StringMatcher>;
      47             : 
      48             : /**
      49             :  * Implementation of the Signature V4A signing process.
      50             :  * See https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
      51             :  */
      52             : 
      53             : class SigV4ASignerImpl : public SignerBaseImpl {
      54             : public:
      55             :   SigV4ASignerImpl(absl::string_view service_name, absl::string_view region,
      56             :                    const CredentialsProviderSharedPtr& credentials_provider,
      57             :                    TimeSource& time_source, const AwsSigningHeaderExclusionVector& matcher_config)
      58           0 :       : SignerBaseImpl(service_name, region, credentials_provider, time_source, matcher_config) {}
      59             : 
      60             : private:
      61             :   void addRegionHeader(Http::RequestHeaderMap& headers,
      62             :                        const absl::string_view override_region) const override;
      63             : 
      64             :   std::string createCredentialScope(const absl::string_view short_date,
      65             :                                     const absl::string_view override_region) const override;
      66             : 
      67             :   std::string createStringToSign(const absl::string_view canonical_request,
      68             :                                  const absl::string_view long_date,
      69             :                                  const absl::string_view credential_scope) const override;
      70             : 
      71             :   std::string
      72             :   createSignature(const absl::string_view access_key_id, const absl::string_view secret_access_key,
      73             :                   ABSL_ATTRIBUTE_UNUSED const absl::string_view short_date,
      74             :                   const absl::string_view string_to_sign,
      75             :                   ABSL_ATTRIBUTE_UNUSED const absl::string_view override_region) const override;
      76             : 
      77             :   std::string createAuthorizationHeader(const absl::string_view access_key_id,
      78             :                                         const absl::string_view credential_scope,
      79             :                                         const std::map<std::string, std::string>& canonical_headers,
      80             :                                         const absl::string_view signature) const override;
      81             : };
      82             : 
      83             : } // namespace Aws
      84             : } // namespace Common
      85             : } // namespace Extensions
      86             : } // namespace Envoy