Ceph » rgw

rgw: AWS4 authentication minimal support

Amazon S3 supports Signature Version 4. This patch contains the minimal
implementation supporting AWS4 in RGW. It implements AWS4 authentication
on http methods without body content and vars not shipping in the
request query string.

Fixes: #10333

Signed-off-by: Javier M. Mellid <jmunhoz@igalia.com>

rgw: add proper AWSv4 and AWSv2 auth detection

Adds a new authorize function to identify/handle AWSv4 and AWSv2 auth
properly, handling common code, etc.

Fixes: #10333

Signed-off-by: Javier M. Mellid <jmunhoz@igalia.com>

rgw: avoid re-encoding already encoded query strings in AWS4 auth

When computing V4 signature, we need to encode the query string. But it
could come already encoded, at least partially.

So do not encode the entities that are already encoded.

Fixes: #10333

Signed-off-by: Javier M. Mellid <jmunhoz@igalia.com>

rgw: AWS4 auth support for positive content-length

Handle AWS4 auth on requests with positive content-length. It splits the
auth process along several steps to process the body content on the fly
instead of reading the whole body in memory. After that, it completes
the delayed AWS4 auth properly.

Requests with content-length <= 0 are validated as usual. They don't
require any kind of completion.

Requests with content-length > 0 use a streaming approach together with
a completion step.

Fixes: #10333

Signed-off-by: Javier M. Mellid <jmunhoz@igalia.com>

rgw: verify Content-MD5 is a valid base64 value

Fixes: #10333

Signed-off-by: Javier M. Mellid <jmunhoz@igalia.com>

rgw: validate x-amz-sha256

Verify content's sha256 sum matches the expected value.

Fixes: #10333

Signed-off-by: Javier M. Mellid <jmunhoz@igalia.com>