Skip to content

Commit 4997233

Browse files
github-actions[bot]simonswine
github-actions[bot]
and
simonswine
authored
fix: Update minio-go to fix bug in AWS STS auth (#4056) (#4059)
* fix: Update minio-go to fix bug in AWS STS auth With the upgrade of objstore libraries from #3954 we introduced bug This fixes the underlying problem and adds a tests to validate that form of auth. * lint * Be more specific about the format (cherry picked from commit 0d4abec) Co-authored-by: Christian Simon <simon@swine.de>
1 parent 1a2ae21 commit 4997233

File tree

4 files changed

+146
-10
lines changed

4 files changed

+146
-10
lines changed

‎go.mod‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ require (
4848
github.com/klauspost/compress v1.17.11
4949
github.com/kubescape/go-git-url v0.0.27
5050
github.com/mattn/go-isatty v0.0.20
51-
github.com/minio/minio-go/v7 v7.0.83
51+
github.com/minio/minio-go/v7 v7.0.88
5252
github.com/mitchellh/go-wordwrap v1.0.1
5353
github.com/oauth2-proxy/oauth2-proxy/v7 v7.5.1
5454
github.com/oklog/ulid v1.3.1
@@ -168,7 +168,7 @@ require (
168168
github.com/go-openapi/validate v0.23.0 // indirect
169169
github.com/go-pdf/fpdf v0.9.0 // indirect
170170
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
171-
github.com/goccy/go-json v0.10.4 // indirect
171+
github.com/goccy/go-json v0.10.5 // indirect
172172
github.com/gogo/googleapis v1.4.1 // indirect
173173
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
174174
github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
@@ -203,6 +203,7 @@ require (
203203
github.com/mattn/go-colorable v0.1.13 // indirect
204204
github.com/mattn/go-runewidth v0.0.15 // indirect
205205
github.com/miekg/dns v1.1.58 // indirect
206+
github.com/minio/crc64nvme v1.0.1 // indirect
206207
github.com/minio/md5-simd v1.1.2 // indirect
207208
github.com/mitchellh/go-homedir v1.1.0 // indirect
208209
github.com/mitchellh/mapstructure v1.5.0 // indirect

‎go.sum‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -304,8 +304,8 @@ github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEe
304304
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
305305
github.com/go-zookeeper/zk v1.0.3 h1:7M2kwOsc//9VeeFiPtf+uSJlVpU66x9Ba5+8XK7/TDg=
306306
github.com/go-zookeeper/zk v1.0.3/go.mod h1:nOB03cncLtlp4t+UAkGSV+9beXP/akpekBwL+UX1Qcw=
307-
github.com/goccy/go-json v0.10.4 h1:JSwxQzIqKfmFX1swYPpUThQZp/Ka4wzJdK0LWVytLPM=
308-
github.com/goccy/go-json v0.10.4/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
307+
github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
308+
github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
309309
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
310310
github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
311311
github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
@@ -579,10 +579,12 @@ github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKju
579579
github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
580580
github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
581581
github.com/miekg/dns v1.1.58/go.mod h1:Ypv+3b/KadlvW9vJfXOTf300O4UqaHFzFCuHz+rPkBY=
582+
github.com/minio/crc64nvme v1.0.1 h1:DHQPrYPdqK7jQG/Ls5CTBZWeex/2FMS3G5XGkycuFrY=
583+
github.com/minio/crc64nvme v1.0.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
582584
github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
583585
github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
584-
github.com/minio/minio-go/v7 v7.0.83 h1:W4Kokksvlz3OKf3OqIlzDNKd4MERlC2oN8YptwJ0+GA=
585-
github.com/minio/minio-go/v7 v7.0.83/go.mod h1:57YXpvc5l3rjPdhqNrDsvVlY0qPI6UTk1bflAe+9doY=
586+
github.com/minio/minio-go/v7 v7.0.88 h1:v8MoIJjwYxOkehp+eiLIuvXk87P2raUtoU5klrAAshs=
587+
github.com/minio/minio-go/v7 v7.0.88/go.mod h1:33+O8h0tO7pCeCWwBVa07RhVVfB/3vS4kEX7rwYKmIg=
586588
github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
587589
github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
588590
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=

‎go.work.sum‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -957,6 +957,8 @@ github.com/gobwas/ws v1.2.1 h1:F2aeBZrm2NDsc7vbovKrWSogd4wvfAxg0FQ89/iqOTk=
957957
github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
958958
github.com/goccy/go-json v0.9.11 h1:/pAaQDLHEoCq/5FFmSKBswWmK6H0e8g4159Kc/X/nqk=
959959
github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
960+
github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
961+
github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
960962
github.com/goccy/go-yaml v1.9.5 h1:Eh/+3uk9kLxG4koCX6lRMAPS1OaMSAi+FJcya0INdB0=
961963
github.com/goccy/go-yaml v1.9.5/go.mod h1:U/jl18uSupI5rdI2jmuCswEA2htH9eXfferR3KfscvA=
962964
github.com/godbus/dbus/v5 v5.0.4 h1:9349emZab16e7zQvpmsbtjc18ykshndd8y2PG3sgJbA=
@@ -1097,8 +1099,12 @@ github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8 h1:AMFGa4R4MiIpsp
10971099
github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8/go.mod h1:mC1jAcsrzbxHt8iiaC+zU4b1ylILSosueou12R++wfY=
10981100
github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3 h1:+n/aFZefKZp7spd8DFdX7uMikMLXX4oubIzJF4kv/wI=
10991101
github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8IeTMnF8JTXieKnO4Z6JCsikNEzj0DwauVzE=
1102+
github.com/minio/crc64nvme v1.0.1 h1:DHQPrYPdqK7jQG/Ls5CTBZWeex/2FMS3G5XGkycuFrY=
1103+
github.com/minio/crc64nvme v1.0.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
11001104
github.com/minio/highwayhash v1.0.2 h1:Aak5U0nElisjDCfPSG79Tgzkn2gl66NxOMspRrKnA/g=
11011105
github.com/minio/highwayhash v1.0.2/go.mod h1:BQskDq+xkJ12lmlUUi7U0M5Swg3EWR+dLTk+kldvVxY=
1106+
github.com/minio/minio-go/v7 v7.0.88 h1:v8MoIJjwYxOkehp+eiLIuvXk87P2raUtoU5klrAAshs=
1107+
github.com/minio/minio-go/v7 v7.0.88/go.mod h1:33+O8h0tO7pCeCWwBVa07RhVVfB/3vS4kEX7rwYKmIg=
11021108
github.com/minio/sha256-simd v1.0.0 h1:v1ta+49hkWZyvaKwrQB8elexRqm6Y0aMLjCNsrYxo6g=
11031109
github.com/minio/sha256-simd v1.0.0/go.mod h1:OuYzVNI5vcoYIAmbIvHPl3N3jUzVedXbKy5RFepssQM=
11041110
github.com/mitchellh/cli v1.1.0 h1:tEElEatulEHDeedTxwckzyYMA5c86fbmNIUL1hBIiTg=
@@ -1361,7 +1367,6 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
13611367
golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
13621368
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
13631369
golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
1364-
golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
13651370
golang.org/x/exp v0.0.0-20230626212559-97b1e661b5df/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
13661371
golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63/go.mod h1:0v4NqG35kSWCMzLaMeX+IQrlSnVE/bqGSyC2cz/9Le8=
13671372
golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
@@ -1396,7 +1401,6 @@ golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbht
13961401
golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
13971402
golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
13981403
golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
1399-
golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
14001404
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
14011405
golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
14021406
golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
@@ -1412,15 +1416,13 @@ golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXct
14121416
golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457 h1:zf5N6UOrA487eEFacMePxjXAJctxKmyjKUsjA11Uzuk=
14131417
golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0=
14141418
golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
1415-
golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
14161419
golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
14171420
golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
14181421
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
14191422
golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
14201423
golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
14211424
golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
14221425
golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
1423-
golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
14241426
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
14251427
golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
14261428
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=

‎pkg/objstore/providers/s3/config_test.go‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,16 @@
66
package s3
77

88
import (
9+
"context"
910
"encoding/base64"
11+
"io"
1012
"net/http"
13+
"net/http/httptest"
14+
"os"
1115
"testing"
16+
"time"
17+
18+
"github.com/go-kit/log"
1219

1320
"github.com/grafana/dskit/flagext"
1421
"github.com/stretchr/testify/assert"
@@ -158,3 +165,127 @@ func TestConfig_Validate(t *testing.T) {
158165
})
159166
}
160167
}
168+
169+
type testRoundTripper struct {
170+
roundTrip func(r *http.Request) (*http.Response, error)
171+
}
172+
173+
func (t *testRoundTripper) RoundTrip(r *http.Request) (*http.Response, error) {
174+
return t.roundTrip(r)
175+
}
176+
177+
func handleSTSRequest(t *testing.T, r *http.Request, w http.ResponseWriter) {
178+
body, err := io.ReadAll(r.Body)
179+
require.NoError(t, err)
180+
181+
require.Contains(t, string(body), "RoleArn=arn%3Ahello-world")
182+
require.Contains(t, string(body), "WebIdentityToken=my-web-token")
183+
require.Contains(t, string(body), "Action=AssumeRoleWithWebIdentity")
184+
185+
w.WriteHeader(200)
186+
_, err = w.Write([]byte(`<?xml version="1.0" encoding="UTF-8"?>
187+
<AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
188+
<AssumeRoleWithWebIdentityResult>
189+
<Credentials>
190+
<AccessKeyId>test-key</AccessKeyId>
191+
<SecretAccessKey>test-secret</SecretAccessKey>
192+
<SessionToken>test-token</SessionToken>
193+
<Expiration>` + time.Now().Add(time.Hour).Format(time.RFC3339) + `</Expiration>
194+
</Credentials>
195+
</AssumeRoleWithWebIdentityResult>
196+
<ResponseMetadata>
197+
<RequestId>test-request-id</RequestId>
198+
</ResponseMetadata>
199+
</AssumeRoleWithWebIdentityResponse>`))
200+
require.NoError(t, err)
201+
202+
}
203+
204+
func overrideEnv(t testing.TB, kv ...string) {
205+
old := make([]string, len(kv))
206+
for i := 0; i < len(kv); i += 2 {
207+
k := kv[i]
208+
v := kv[i+1]
209+
old[i] = k
210+
old[i+1] = os.Getenv(k)
211+
os.Setenv(k, v)
212+
}
213+
t.Cleanup(func() {
214+
for i := 0; i < len(old); i += 2 {
215+
os.Setenv(old[i], old[i+1])
216+
}
217+
})
218+
}
219+
220+
func TestAWSSTSWebIdentity(t *testing.T) {
221+
logger := log.NewNopLogger()
222+
tmpDir := t.TempDir()
223+
224+
// override env variables, will be cleaned up by t.Cleanup
225+
overrideEnv(t,
226+
"AWS_WEB_IDENTITY_TOKEN_FILE", tmpDir+"/token",
227+
"AWS_ROLE_ARN", "arn:hello-world",
228+
"AWS_DEFAULT_REGION", "eu-central-1",
229+
"AWS_CONFIG_FILE", "/dev/null", // dont accidentally use real config
230+
"AWS_ACCESS_KEY_ID", "", // dont use real credentials
231+
"AWS_SECRET_ACCESS_KEY", "", // dont use real credentials
232+
)
233+
234+
rt := &testRoundTripper{
235+
roundTrip: func(r *http.Request) (*http.Response, error) {
236+
w := httptest.NewRecorder()
237+
if r.Body != nil {
238+
defer r.Body.Close()
239+
}
240+
switch r.URL.String() {
241+
case "https://sts.amazonaws.com":
242+
handleSTSRequest(t, r, w)
243+
case "https://eu-central-1.amazonaws.com/pyroscope-test-bucket/test":
244+
assert.Equal(t, "GET", r.Method)
245+
assert.Contains(t, r.Header.Get("Authorization"), "AWS4-HMAC-SHA256 Credential=test-key")
246+
w.Header().Set("Last-Modified", time.Now().Format("Mon, 2 Jan 2006 15:04:05 GMT"))
247+
w.WriteHeader(200)
248+
_, err := w.Write([]byte("test"))
249+
require.NoError(t, err)
250+
default:
251+
w.WriteHeader(404)
252+
_, err := w.Write([]byte("unexpected"))
253+
require.NoError(t, err)
254+
t.Errorf("unexpected request: %s", r.URL.Host)
255+
t.FailNow()
256+
}
257+
return w.Result(), nil
258+
},
259+
}
260+
oldDefaultTransport := http.DefaultTransport
261+
oldDefaultClient := http.DefaultClient
262+
http.DefaultTransport = rt
263+
http.DefaultClient = &http.Client{
264+
Transport: rt,
265+
}
266+
// restore default transport and client
267+
t.Cleanup(func() {
268+
http.DefaultTransport = oldDefaultTransport
269+
http.DefaultClient = oldDefaultClient
270+
})
271+
272+
// mock a web token
273+
err := os.WriteFile(tmpDir+"/token", []byte("my-web-token"), 0644)
274+
require.NoError(t, err)
275+
276+
cfg := Config{
277+
SignatureVersion: SignatureVersionV4,
278+
BucketName: "pyroscope-test-bucket",
279+
Region: "eu-central-1",
280+
Endpoint: "eu-central-1.amazonaws.com",
281+
BucketLookupType: AutoLookup,
282+
}
283+
284+
cfg.HTTP.Transport = rt
285+
r, err := NewBucketClient(cfg, "test", logger)
286+
require.NoError(t, err)
287+
288+
_, err = r.Get(context.Background(), "test")
289+
require.NoError(t, err)
290+
291+
}

0 commit comments

Comments
 (0)