Add AWS http request signer

source/common/common/logger.h

@@ -22,6 +22,7 @@ namespace Logger {
 // clang-format off
 #define ALL_LOGGER_IDS(FUNCTION) \
   FUNCTION(admin)                \
+  FUNCTION(aws)                  \
   FUNCTION(assert)               \
   FUNCTION(backtrace)            \
   FUNCTION(client)               \

source/common/ssl/BUILD

@@ -118,7 +118,9 @@ envoy_cc_library(
         "ssl",
     ],
     deps = [
+        "//include/envoy/buffer:buffer_interface",
         "//source/common/common:assert_lib",
+        "//source/common/common:stack_array",
         "//source/common/common:utility_lib",
     ],
 )

source/common/ssl/utility.cc

@@ -1,8 +1,12 @@
 #include "common/ssl/utility.h"
 
 #include "common/common/assert.h"
+#include "common/common/stack_array.h"
 
 #include "absl/strings/str_join.h"
+#include "openssl/evp.h"
+#include "openssl/hmac.h"
+#include "openssl/sha.h"
 #include "openssl/x509v3.h"
 
 namespace Envoy {
@@ -101,5 +105,43 @@ SystemTime Utility::getExpirationTime(const X509& cert) {
   return std::chrono::system_clock::from_time_t(days * 24 * 60 * 60 + seconds);
 }
 
+std::vector<uint8_t> Utility::getSha256Digest(const Buffer::Instance& buffer) {
+  std::vector<uint8_t> digest(SHA256_DIGEST_LENGTH);
+  EVP_MD_CTX ctx;
+  auto rc = EVP_DigestInit(&ctx, EVP_sha256());
+  RELEASE_ASSERT(rc == 1, "Failed to init digest context");
+  const auto num_slices = buffer.getRawSlices(nullptr, 0);
+  STACK_ARRAY(slices, Buffer::RawSlice, num_slices);
+  buffer.getRawSlices(slices.begin(), num_slices);
+  for (const auto& slice : slices) {
+    rc = EVP_DigestUpdate(&ctx, slice.mem_, slice.len_);
+    RELEASE_ASSERT(rc == 1, "Failed to update digest");
+  }
+  unsigned int digest_length;
+  rc = EVP_DigestFinal(&ctx, digest.data(), &digest_length);
+  RELEASE_ASSERT(rc == 1, "Failed to finalize digest");
+  RELEASE_ASSERT(digest_length == SHA256_DIGEST_LENGTH, "Digest length mismatch");
+  return digest;
+}
+
+std::vector<uint8_t> Utility::getSha256Hmac(const std::vector<uint8_t>& key,
+                                            absl::string_view string) {
+  std::vector<uint8_t> mac(EVP_MAX_MD_SIZE);
+  HMAC_CTX ctx;
+  RELEASE_ASSERT(key.size() < std::numeric_limits<int>::max(), "HMAC key is too long");
+  HMAC_CTX_init(&ctx);
+  auto rc = HMAC_Init_ex(&ctx, key.data(), static_cast<int>(key.size()), EVP_sha256(), nullptr);
+  RELEASE_ASSERT(rc == 1, "Failed to init HMAC context");
+  rc = HMAC_Update(&ctx, reinterpret_cast<const uint8_t*>(string.data()), string.size());
+  RELEASE_ASSERT(rc == 1, "Failed to update HMAC");
+  unsigned int len;
+  rc = HMAC_Final(&ctx, mac.data(), &len);
+  RELEASE_ASSERT(rc == 1, "Failed to finalize HMAC");
+  RELEASE_ASSERT(len <= EVP_MAX_MD_SIZE, "HMAC length too large");
+  HMAC_CTX_cleanup(&ctx);
+  mac.resize(len);
+  return mac;
+}
+
 } // namespace Ssl
 } // namespace Envoy

source/common/ssl/utility.h

@@ -3,6 +3,8 @@
 #include <string>
 #include <vector>
 
+#include "envoy/buffer/buffer.h"
+
 #include "common/common/utility.h"
 
 #include "openssl/ssl.h"
@@ -56,6 +58,21 @@ SystemTime getValidFrom(const X509& cert);
  */
 SystemTime getExpirationTime(const X509& cert);
 
+/**
+ * Computes the SHA-256 digest of a buffer.
+ * @param buffer the buffer.
+ * @return a vector of bytes for the computed digest.
+ */
+std::vector<uint8_t> getSha256Digest(const Buffer::Instance& buffer);
+
+/**
+ * Computes the SHA-256 HMAC for a given key and data.
+ * @param key the HMAC function key.
+ * @param string string data for the HMAC function.
+ * @return a vector of bytes for the computed HMAC.
+ */
+std::vector<uint8_t> getSha256Hmac(const std::vector<uint8_t>& key, absl::string_view string);
+
 } // namespace Utility
 } // namespace Ssl
 } // namespace Envoy

source/extensions/filters/http/common/aws/BUILD

@@ -0,0 +1,51 @@
+licenses(["notice"])  # Apache 2
+
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_package",
+)
+
+envoy_package()
+
+envoy_cc_library(
+    name = "signer_interface",
+    hdrs = ["signer.h"],
+    deps = [
+        "//include/envoy/http:message_interface",
+    ],
+)
+
+envoy_cc_library(
+    name = "signer_impl_lib",
+    srcs = ["signer_impl.cc"],
+    hdrs = ["signer_impl.h"],
+    deps = [
+        ":credentials_provider_interface",
+        ":signer_interface",
+        ":utility_lib",
+        "//source/common/buffer:buffer_lib",
+        "//source/common/common:hex_lib",
+        "//source/common/common:logger_lib",
+        "//source/common/common:utility_lib",
+        "//source/common/http:headers_lib",
+        "//source/common/singleton:const_singleton",
+        "//source/common/ssl:utility_lib",
+    ],
+)
+
+envoy_cc_library(
+    name = "credentials_provider_interface",
+    hdrs = ["credentials_provider.h"],
+    external_deps = ["abseil_optional"],
+)
+
+envoy_cc_library(
+    name = "utility_lib",
+    srcs = ["utility.cc"],
+    hdrs = ["utility.h"],
+    deps = [
+        "//source/common/common:utility_lib",
+        "//source/common/http:headers_lib",
+    ],
+)

source/extensions/filters/http/common/aws/credentials_provider.h

@@ -0,0 +1,53 @@
+#pragma once
+
+#include <string>
+
+#include "envoy/common/pure.h"
+
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace HttpFilters {
+namespace Common {
+namespace Aws {
+
+class Credentials {
+public:
+  Credentials() = default;
+
+  Credentials(absl::string_view access_key_id, absl::string_view secret_access_key)
+      : access_key_id_(access_key_id), secret_access_key_(secret_access_key) {}
+
+  Credentials(absl::string_view access_key_id, absl::string_view secret_access_key,
+              absl::string_view session_token)
+      : access_key_id_(access_key_id), secret_access_key_(secret_access_key),
+        session_token_(session_token) {}
+
+  const absl::optional<std::string>& accessKeyId() const { return access_key_id_; }
+
+  const absl::optional<std::string>& secretAccessKey() const { return secret_access_key_; }
+
+  const absl::optional<std::string>& sessionToken() const { return session_token_; }
+
+private:
+  absl::optional<std::string> access_key_id_;
+  absl::optional<std::string> secret_access_key_;
+  absl::optional<std::string> session_token_;
+};
+
+class CredentialsProvider {
+public:
+  virtual ~CredentialsProvider() = default;
+
+  virtual Credentials getCredentials() PURE;
+};
+
+typedef std::shared_ptr<CredentialsProvider> CredentialsProviderSharedPtr;
+
+} // namespace Aws
+} // namespace Common
+} // namespace HttpFilters
+} // namespace Extensions
+} // namespace Envoy

source/extensions/filters/http/common/aws/signer.h

@@ -0,0 +1,30 @@
+#pragma once
+
+#include "envoy/common/pure.h"
+#include "envoy/http/message.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace HttpFilters {
+namespace Common {
+namespace Aws {
+
+// TODO(lavignes): Move this interface to include/envoy if this is needed elsewhere
+class Signer {
+public:
+  virtual ~Signer() = default;
+
+  /**
+   * Sign an AWS request.
+   * @param message an AWS API request message.
+   */
+  virtual void sign(Http::Message& message) PURE;
+};
+
+typedef std::unique_ptr<Signer> SignerPtr;
+
+} // namespace Aws
+} // namespace Common
+} // namespace HttpFilters
+} // namespace Extensions
+} // namespace Envoy

source/extensions/filters/http/common/aws/signer_impl.cc

@@ -0,0 +1,145 @@
+#include "extensions/filters/http/common/aws/signer_impl.h"
+
+#include "envoy/common/exception.h"
+
+#include "common/buffer/buffer_impl.h"
+#include "common/common/fmt.h"
+#include "common/common/hex.h"
+#include "common/http/headers.h"
+#include "common/ssl/utility.h"
+
+#include "extensions/filters/http/common/aws/utility.h"
+
+#include "absl/strings/str_join.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace HttpFilters {
+namespace Common {
+namespace Aws {
+
+void SignerImpl::sign(Http::Message& message) {
+  const auto& credentials = credentials_provider_->getCredentials();
+  if (!credentials.accessKeyId() || !credentials.secretAccessKey()) {
+    // Empty or "anonymous" credentials are a valid use-case for non-production environments.
+    // This behavior matches what the AWS SDK would do.
+    return;
+  }
+  auto& headers = message.headers();
+  if (credentials.sessionToken()) {
+    headers.addCopy(SignatureHeaders::get().SecurityToken, credentials.sessionToken().value());
+  }
+  const auto long_date = long_date_formatter_.now(time_source_);
+  const auto short_date = short_date_formatter_.now(time_source_);
+  headers.addCopy(SignatureHeaders::get().Date, long_date);
+  const auto content_hash = createContentHash(message);
+  headers.addCopy(SignatureHeaders::get().ContentSha256, content_hash);
+  // Phase 1: Create a canonical request
+  const auto canonical_headers = Utility::canonicalizeHeaders(headers);
+  const auto signing_headers = createSigningHeaders(canonical_headers);
+  const auto canonical_request =
+      createCanonicalRequest(message, canonical_headers, signing_headers, content_hash);
+  ENVOY_LOG(debug, "Canonical request:\n{}", canonical_request);
+  // Phase 2: Create a string to sign
+  const auto credential_scope = createCredentialScope(short_date);
+  const auto string_to_sign = createStringToSign(canonical_request, long_date, credential_scope);
+  ENVOY_LOG(debug, "String to sign:\n{}", string_to_sign);
+  // Phase 3: Create a signature
+  const auto signature =
+      createSignature(credentials.secretAccessKey().value(), short_date, string_to_sign);
+  // Phase 4: Sign request
+  const auto authorization_header = createAuthorizationHeader(
+      credentials.accessKeyId().value(), credential_scope, signing_headers, signature);
+  ENVOY_LOG(debug, "Signing request with: {}", authorization_header);
+  headers.addCopy(Http::Headers::get().Authorization, authorization_header);
+}
+
+std::string SignerImpl::createContentHash(Http::Message& message) const {
+  if (!message.body()) {
+    return SignatureConstants::get().HashedEmptyString;
+  }
+  return Hex::encode(Ssl::Utility::getSha256Digest(*message.body()));
+}
+
+std::string SignerImpl::createCanonicalRequest(
+    Http::Message& message, const std::map<std::string, std::string>& canonical_headers,
+    absl::string_view signing_headers, absl::string_view content_hash) const {
+  std::vector<absl::string_view> parts;
+  const auto* method_header = message.headers().Method();
+  if (method_header == nullptr || method_header->value().empty()) {
+    throw EnvoyException("Message is missing :method header");
+  }
+  parts.emplace_back(method_header->value().getStringView());
+  const auto* path_header = message.headers().Path();
+  if (path_header == nullptr || path_header->value().empty()) {
+    throw EnvoyException("Message is missing :path header");
+  }
+  // don't include the query part of the path
+  const auto path = StringUtil::cropRight(path_header->value().getStringView(), "?");
+  parts.emplace_back(path.empty() ? "/" : path);
+  const auto query = StringUtil::cropLeft(path_header->value().getStringView(), "?");
+  // if query == path, then there is no query
+  parts.emplace_back(query == path ? "" : query);
+  std::vector<std::string> formatted_headers;
+  formatted_headers.reserve(canonical_headers.size());
+  for (const auto& header : canonical_headers) {
+    formatted_headers.emplace_back(fmt::format("{}:{}", header.first, header.second));
+    parts.emplace_back(formatted_headers.back());
+  }
+  // need an extra blank space after the canonical headers
+  parts.emplace_back("");
+  parts.emplace_back(signing_headers);
+  parts.emplace_back(content_hash);
+  return absl::StrJoin(parts, "\n");
+}
+
+std::string SignerImpl::createSigningHeaders(
+    const std::map<std::string, std::string>& canonical_headers) const {
+  std::vector<absl::string_view> keys;
+  keys.reserve(canonical_headers.size());
+  for (const auto& header : canonical_headers) {
+    keys.emplace_back(header.first);
+  }
+  return absl::StrJoin(keys, ";");
+}
+
+std::string SignerImpl::createCredentialScope(absl::string_view short_date) const {
+  return fmt::format(SignatureConstants::get().CredentialScopeFormat, short_date, region_,
+                     service_name_);
+}
+
+std::string SignerImpl::createStringToSign(absl::string_view canonical_request,
+                                           absl::string_view long_date,
+                                           absl::string_view credential_scope) const {
+  return fmt::format(
+      SignatureConstants::get().StringToSignFormat, long_date, credential_scope,
+      Hex::encode(Ssl::Utility::getSha256Digest(Buffer::OwnedImpl(canonical_request))));
+}
+
+std::string SignerImpl::createSignature(absl::string_view secret_access_key,
+                                        absl::string_view short_date,
+                                        absl::string_view string_to_sign) const {
+  const auto secret_key =
+      absl::StrCat(SignatureConstants::get().SignatureVersion, secret_access_key);
+  const auto date_key = Ssl::Utility::getSha256Hmac(
+      std::vector<uint8_t>(secret_key.begin(), secret_key.end()), short_date);
+  const auto region_key = Ssl::Utility::getSha256Hmac(date_key, region_);
+  const auto service_key = Ssl::Utility::getSha256Hmac(region_key, service_name_);
+  const auto signing_key =
+      Ssl::Utility::getSha256Hmac(service_key, SignatureConstants::get().Aws4Request);
+  return Hex::encode(Ssl::Utility::getSha256Hmac(signing_key, string_to_sign));
+}
+
+std::string SignerImpl::createAuthorizationHeader(absl::string_view access_key_id,
+                                                  absl::string_view credential_scope,
+                                                  absl::string_view signing_headers,
+                                                  absl::string_view signature) const {
+  return fmt::format(SignatureConstants::get().AuthorizationHeaderFormat, access_key_id,
+                     credential_scope, signing_headers, signature);
+}
+
+} // namespace Aws
+} // namespace Common
+} // namespace HttpFilters
+} // namespace Extensions
+} // namespace Envoy