opensource/rustfs
3
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-09-19 10:03:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(connect): accept KMS report upload authorization (#7828)

Browse Source
This commit is contained in:
Chris
2026-09-14 12:18:58 +08:00
committed by GitHub
parent 174948bd2a
commit f8f2cb05fb
1 changed files with 28 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rustfs/src/connect/report_upload.rs
+28 -4
View File
@@ -430,14 +430,22 @@ fn validate_headers(raw: HashMap<String, String>, archive: &PreparedArchive) ->
headers.insert(name, value);
}
let expected_length = archive.size.to_string();
let encryption_authorized = match headers
.get("x-amz-server-side-encryption")
.and_then(|value| value.to_str().ok())
{
Some("AES256") => true,
Some("aws:kms") => headers
.get("x-amz-server-side-encryption-aws-kms-key-id")
.and_then(|value| value.to_str().ok())
.is_some_and(|value| !value.trim().is_empty()),
_ => false,
};
if headers.get(header::CONTENT_TYPE).and_then(|value| value.to_str().ok()) != Some(CONTENT_TYPE)
|| headers.get(header::CONTENT_LENGTH).and_then(|value| value.to_str().ok()) != Some(expected_length.as_str())
|| headers.get(header::IF_NONE_MATCH).and_then(|value| value.to_str().ok()) != Some("*")
|| headers.get("x-amz-checksum-sha256").and_then(|value| value.to_str().ok()) != Some(archive.checksum_base64.as_str())
|| headers
.get("x-amz-server-side-encryption")
.and_then(|value| value.to_str().ok())
!= Some("AES256")
|| !encryption_authorized
{
return Err(ReportUploadError::UploadAuthorization);
}
@@ -666,6 +674,22 @@ mod tests {
decode_reservation(&serde_json::to_vec(&response).expect("response JSON"), &name, &bundle_uid, &archive)
.expect("valid reservation");
let mut kms_response = response.clone();
kms_response["uploadAuthorization"]["headers"]["x-amz-server-side-encryption"] = json!("aws:kms");
kms_response["uploadAuthorization"]["headers"]["x-amz-server-side-encryption-aws-kms-key-id"] =
json!("connect-support-bundles");
decode_reservation(&serde_json::to_vec(&kms_response).expect("response JSON"), &name, &bundle_uid, &archive)
.expect("valid KMS reservation");
kms_response["uploadAuthorization"]["headers"]
.as_object_mut()
.expect("headers object")
.remove("x-amz-server-side-encryption-aws-kms-key-id");
assert!(matches!(
decode_reservation(&serde_json::to_vec(&kms_response).expect("response JSON"), &name, &bundle_uid, &archive,),
Err(ReportUploadError::UploadAuthorization)
));
let mut wrong_target = response.clone();
wrong_target["supportBundle"]["name"] = json!(format!("organizations/o/clusters/other/supportBundles/{bundle_uid}"));
assert!(matches!(