356 lines
14 KiB
PHP
356 lines
14 KiB
PHP
<?php
|
|
namespace Aws\S3;
|
|
|
|
use Aws\Api\Service;
|
|
use Aws\Arn\AccessPointArnInterface;
|
|
use Aws\Arn\ArnParser;
|
|
use Aws\Arn\ObjectLambdaAccessPointArn;
|
|
use Aws\Arn\Exception\InvalidArnException;
|
|
use Aws\Arn\AccessPointArn as BaseAccessPointArn;
|
|
use Aws\Arn\S3\OutpostsAccessPointArn;
|
|
use Aws\Arn\S3\MultiRegionAccessPointArn;
|
|
use Aws\Arn\S3\OutpostsArnInterface;
|
|
use Aws\CommandInterface;
|
|
use Aws\Endpoint\PartitionEndpointProvider;
|
|
use Aws\Exception\InvalidRegionException;
|
|
use Aws\Exception\UnresolvedEndpointException;
|
|
use Aws\S3\Exception\S3Exception;
|
|
use InvalidArgumentException;
|
|
use Psr\Http\Message\RequestInterface;
|
|
|
|
/**
|
|
* Checks for access point ARN in members targeting BucketName, modifying
|
|
* endpoint as appropriate
|
|
*
|
|
* @internal
|
|
*/
|
|
class BucketEndpointArnMiddleware
|
|
{
|
|
use EndpointRegionHelperTrait;
|
|
|
|
/** @var callable */
|
|
private $nextHandler;
|
|
|
|
/** @var array */
|
|
private $nonArnableCommands = ['CreateBucket'];
|
|
|
|
/** @var boolean */
|
|
private $isUseEndpointV2;
|
|
|
|
/**
|
|
* Create a middleware wrapper function.
|
|
*
|
|
* @param Service $service
|
|
* @param $region
|
|
* @param array $config
|
|
* @return callable
|
|
*/
|
|
public static function wrap(
|
|
Service $service,
|
|
$region,
|
|
array $config,
|
|
$isUseEndpointV2
|
|
) {
|
|
return function (callable $handler) use ($service, $region, $config, $isUseEndpointV2) {
|
|
return new self($handler, $service, $region, $config, $isUseEndpointV2);
|
|
};
|
|
}
|
|
|
|
public function __construct(
|
|
callable $nextHandler,
|
|
Service $service,
|
|
$region,
|
|
array $config = [],
|
|
$isUseEndpointV2 = false
|
|
) {
|
|
$this->partitionProvider = PartitionEndpointProvider::defaultProvider();
|
|
$this->region = $region;
|
|
$this->service = $service;
|
|
$this->config = $config;
|
|
$this->nextHandler = $nextHandler;
|
|
$this->isUseEndpointV2 = $isUseEndpointV2;
|
|
}
|
|
|
|
public function __invoke(CommandInterface $cmd, RequestInterface $req)
|
|
{
|
|
$nextHandler = $this->nextHandler;
|
|
|
|
$op = $this->service->getOperation($cmd->getName())->toArray();
|
|
if (!empty($op['input']['shape'])) {
|
|
$service = $this->service->toArray();
|
|
if (!empty($input = $service['shapes'][$op['input']['shape']])) {
|
|
foreach ($input['members'] as $key => $member) {
|
|
if ($member['shape'] === 'BucketName') {
|
|
$arnableKey = $key;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!empty($arnableKey) && ArnParser::isArn($cmd[$arnableKey])) {
|
|
|
|
try {
|
|
// Throw for commands that do not support ARN inputs
|
|
if (in_array($cmd->getName(), $this->nonArnableCommands)) {
|
|
throw new S3Exception(
|
|
'ARN values cannot be used in the bucket field for'
|
|
. ' the ' . $cmd->getName() . ' operation.',
|
|
$cmd
|
|
);
|
|
}
|
|
|
|
if (!$this->isUseEndpointV2) {
|
|
$arn = ArnParser::parse($cmd[$arnableKey]);
|
|
$partition = $this->validateArn($arn);
|
|
$host = $this->generateAccessPointHost($arn, $req);
|
|
}
|
|
// Remove encoded bucket string from path
|
|
$path = $req->getUri()->getPath();
|
|
$encoded = rawurlencode($cmd[$arnableKey]);
|
|
$len = strlen($encoded) + 1;
|
|
if (trim(substr($path, 0, $len), '/') === "{$encoded}") {
|
|
$path = substr($path, $len);
|
|
if (substr($path, 0, 1) !== "/") {
|
|
$path = '/' . $path;
|
|
}
|
|
}
|
|
if (empty($path)) {
|
|
$path = '';
|
|
}
|
|
|
|
// Set modified request
|
|
if ($this->isUseEndpointV2) {
|
|
$req = $req->withUri(
|
|
$req->getUri()->withPath($path)
|
|
|
|
);
|
|
goto next;
|
|
}
|
|
|
|
$req = $req->withUri(
|
|
$req->getUri()->withPath($path)->withHost($host)
|
|
);
|
|
|
|
// Update signing region based on ARN data if configured to do so
|
|
if ($this->config['use_arn_region']->isUseArnRegion()
|
|
&& !$this->config['use_fips_endpoint']->isUseFipsEndpoint()
|
|
) {
|
|
$region = $arn->getRegion();
|
|
} else {
|
|
$region = $this->region;
|
|
}
|
|
$endpointData = $partition([
|
|
'region' => $region,
|
|
'service' => $arn->getService()
|
|
]);
|
|
$cmd['@context']['signing_region'] = $endpointData['signingRegion'];
|
|
|
|
// Update signing service for Outposts and Lambda ARNs
|
|
if ($arn instanceof OutpostsArnInterface
|
|
|| $arn instanceof ObjectLambdaAccessPointArn
|
|
) {
|
|
$cmd['@context']['signing_service'] = $arn->getService();
|
|
}
|
|
} catch (InvalidArnException $e) {
|
|
// Add context to ARN exception
|
|
throw new S3Exception(
|
|
'Bucket parameter parsed as ARN and failed with: '
|
|
. $e->getMessage(),
|
|
$cmd,
|
|
[],
|
|
$e
|
|
);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
next:
|
|
return $nextHandler($cmd, $req);
|
|
}
|
|
|
|
|
|
private function generateAccessPointHost(
|
|
BaseAccessPointArn $arn,
|
|
RequestInterface $req
|
|
) {
|
|
if ($arn instanceof OutpostsAccessPointArn) {
|
|
$accesspointName = $arn->getAccesspointName();
|
|
} else {
|
|
$accesspointName = $arn->getResourceId();
|
|
}
|
|
|
|
if ($arn instanceof MultiRegionAccessPointArn) {
|
|
$partition = $this->partitionProvider->getPartitionByName(
|
|
$arn->getPartition(),
|
|
's3'
|
|
);
|
|
$dnsSuffix = $partition->getDnsSuffix();
|
|
return "{$accesspointName}.accesspoint.s3-global.{$dnsSuffix}";
|
|
}
|
|
|
|
$host = "{$accesspointName}-" . $arn->getAccountId();
|
|
|
|
$useFips = $this->config['use_fips_endpoint']->isUseFipsEndpoint();
|
|
$fipsString = $useFips ? "-fips" : "";
|
|
|
|
if ($arn instanceof OutpostsAccessPointArn) {
|
|
$host .= '.' . $arn->getOutpostId() . '.s3-outposts';
|
|
} else if ($arn instanceof ObjectLambdaAccessPointArn) {
|
|
if (!empty($this->config['endpoint'])) {
|
|
return $host . '.' . $this->config['endpoint'];
|
|
} else {
|
|
$host .= ".s3-object-lambda{$fipsString}";
|
|
}
|
|
} else {
|
|
$host .= ".s3-accesspoint{$fipsString}";
|
|
if (!empty($this->config['dual_stack'])) {
|
|
$host .= '.dualstack';
|
|
}
|
|
}
|
|
|
|
if (!empty($this->config['use_arn_region']->isUseArnRegion())) {
|
|
$region = $arn->getRegion();
|
|
} else {
|
|
$region = $this->region;
|
|
}
|
|
$region = \Aws\strip_fips_pseudo_regions($region);
|
|
$host .= '.' . $region . '.' . $this->getPartitionSuffix($arn, $this->partitionProvider);
|
|
return $host;
|
|
}
|
|
|
|
/**
|
|
* Validates an ARN, returning a partition object corresponding to the ARN
|
|
* if successful
|
|
*
|
|
* @param $arn
|
|
* @return \Aws\Endpoint\Partition
|
|
*/
|
|
private function validateArn($arn)
|
|
{
|
|
if ($arn instanceof AccessPointArnInterface) {
|
|
|
|
// Dualstack is not supported with Outposts access points
|
|
if ($arn instanceof OutpostsAccessPointArn
|
|
&& !empty($this->config['dual_stack'])
|
|
) {
|
|
throw new UnresolvedEndpointException(
|
|
'Dualstack is currently not supported with S3 Outposts access'
|
|
. ' points. Please disable dualstack or do not supply an'
|
|
. ' access point ARN.');
|
|
}
|
|
if ($arn instanceof MultiRegionAccessPointArn) {
|
|
if (!empty($this->config['disable_multiregion_access_points'])) {
|
|
throw new UnresolvedEndpointException(
|
|
'Multi-Region Access Point ARNs are disabled, but one was provided. Please'
|
|
. ' enable them or provide a different ARN.'
|
|
);
|
|
}
|
|
if (!empty($this->config['dual_stack'])) {
|
|
throw new UnresolvedEndpointException(
|
|
'Multi-Region Access Point ARNs do not currently support dual stack. Please'
|
|
. ' disable dual stack or provide a different ARN.'
|
|
);
|
|
}
|
|
}
|
|
// Accelerate is not supported with access points
|
|
if (!empty($this->config['accelerate'])) {
|
|
throw new UnresolvedEndpointException(
|
|
'Accelerate is currently not supported with access points.'
|
|
. ' Please disable accelerate or do not supply an access'
|
|
. ' point ARN.');
|
|
}
|
|
|
|
// Path-style is not supported with access points
|
|
if (!empty($this->config['path_style'])) {
|
|
throw new UnresolvedEndpointException(
|
|
'Path-style addressing is currently not supported with'
|
|
. ' access points. Please disable path-style or do not'
|
|
. ' supply an access point ARN.');
|
|
}
|
|
|
|
// Custom endpoint is not supported with access points
|
|
if (!is_null($this->config['endpoint'])
|
|
&& !$arn instanceof ObjectLambdaAccessPointArn
|
|
) {
|
|
throw new UnresolvedEndpointException(
|
|
'A custom endpoint has been supplied along with an access'
|
|
. ' point ARN, and these are not compatible with each other.'
|
|
. ' Please only use one or the other.');
|
|
}
|
|
|
|
// Dualstack is not supported with object lambda access points
|
|
if ($arn instanceof ObjectLambdaAccessPointArn
|
|
&& !empty($this->config['dual_stack'])
|
|
) {
|
|
throw new UnresolvedEndpointException(
|
|
'Dualstack is currently not supported with Object Lambda access'
|
|
. ' points. Please disable dualstack or do not supply an'
|
|
. ' access point ARN.');
|
|
}
|
|
// Global endpoints do not support cross-region requests
|
|
if ($this->isGlobal($this->region)
|
|
&& $this->config['use_arn_region']->isUseArnRegion() == false
|
|
&& $arn->getRegion() != $this->region
|
|
&& !$arn instanceof MultiRegionAccessPointArn
|
|
) {
|
|
throw new UnresolvedEndpointException(
|
|
'Global endpoints do not support cross region requests.'
|
|
. ' Please enable use_arn_region or do not supply a global region'
|
|
. ' with a different region in the ARN.');
|
|
}
|
|
|
|
// Get partitions for ARN and client region
|
|
$arnPart = $this->partitionProvider->getPartition(
|
|
$arn->getRegion(),
|
|
's3'
|
|
);
|
|
$clientPart = $this->partitionProvider->getPartition(
|
|
$this->region,
|
|
's3'
|
|
);
|
|
|
|
// If client partition not found, try removing pseudo-region qualifiers
|
|
if (!($clientPart->isRegionMatch($this->region, 's3'))) {
|
|
$clientPart = $this->partitionProvider->getPartition(
|
|
\Aws\strip_fips_pseudo_regions($this->region),
|
|
's3'
|
|
);
|
|
}
|
|
if (!$arn instanceof MultiRegionAccessPointArn) {
|
|
// Verify that the partition matches for supplied partition and region
|
|
if ($arn->getPartition() !== $clientPart->getName()) {
|
|
throw new InvalidRegionException('The supplied ARN partition'
|
|
. " does not match the client's partition.");
|
|
}
|
|
if ($clientPart->getName() !== $arnPart->getName()) {
|
|
throw new InvalidRegionException('The corresponding partition'
|
|
. ' for the supplied ARN region does not match the'
|
|
. " client's partition.");
|
|
}
|
|
|
|
// Ensure ARN region matches client region unless
|
|
// configured for using ARN region over client region
|
|
$this->validateMatchingRegion($arn);
|
|
|
|
// Ensure it is not resolved to fips pseudo-region for S3 Outposts
|
|
$this->validateFipsConfigurations($arn);
|
|
}
|
|
|
|
return $arnPart;
|
|
}
|
|
|
|
throw new InvalidArnException('Provided ARN was not a valid S3 access'
|
|
. ' point ARN or S3 Outposts access point ARN.');
|
|
}
|
|
|
|
/**
|
|
* Checks if a region is global
|
|
*
|
|
* @param $region
|
|
* @return bool
|
|
*/
|
|
private function isGlobal($region)
|
|
{
|
|
return $region == 's3-external-1' || $region == 'aws-global';
|
|
}
|
|
}
|