nspcc-dev / s3-tests

Compatibility tests for S3 clones
MIT License
3 stars 3 forks source link

PostObject tests: fix policy form generation #46

Open evgeniiz321 opened 9 months ago

evgeniiz321 commented 9 months ago

Currently PostObject tests that include authentication fails due to invalid policy generation. (e.g.: test_post_object_authenticated_request). The problem is in the malformed policy form. But it is not obvious what is exactly wrong -

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AuthorizationQueryParametersError</Code><Message>Error parsing the X-Amz-Credential parameter; the Credential is mal-formed; expecting &#34;&lt;YOUR-AKID&gt;/YYYYMMDD/REGION/SERVICE/aws4_request&#34;.</Message><BucketName>yournamehere-ns24t1094wwfebma-1</BucketName><Resource>/yournamehere-ns24t1094wwfebma-1</Resource><RequestId>178DD0B3BB5250D0</RequestId><HostId>f25fd5b4-787e-4670-97d2-f1bed82c70ab</HostId></Error>

Adding X-Amz-Credential doesn't fix tests, so there should be more errors, need to investigate it deeply.

There is probably an error during signature generation, there should be something like:

    hmac_date = hmac.new(bytes(f"AWS4{aws_secret_access_key}", "utf-8"), bytes(current_date.strftime('%Y%m%d'), 'utf-8'), hashlib.sha256).digest()
    hmac_region = hmac.new(hmac_date, bytes(f"us-east-1", "utf-8"), hashlib.sha256).digest()
    hmac_service = hmac.new(hmac_region, bytes(f"s3", "utf-8"), hashlib.sha256).digest()
    creds = hmac.new(hmac_service, bytes(f"aws4_request", "utf-8"), hashlib.sha256).digest()

    signature = base64.b64encode(hmac.new(creds, policy, hashlib.sha256).digest())

But the above thing doesn't work as well. Maybe it is better to try to do this request via boto3 and then compare request/headers