romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 03:33:30 +03:00
Code Issues Projects Releases Packages Wiki Activity

aws_sigv4: consult x-%s-content-sha256 for payload hash

Browse source 
`Curl_output_aws_sigv4()` doesn't always have the whole payload in
memory to generate a real payload hash. this commit allows the user to
pass in a header like `x-amz-content-sha256` to provide their desired
payload hash

some services like s3 require this header, and may support other values
like s3's `UNSIGNED-PAYLOAD` and `STREAMING-AWS4-HMAC-SHA256-PAYLOAD`
with special semantics. servers use this header's value as the payload
hash during signature validation, so it must match what the client uses
to generate the signature

CURLOPT_AWS_SIGV4.3 now describes the content-sha256 interaction

Signed-off-by: Casey Bodley <cbodley@redhat.com>

Closes #9804
This commit is contained in:
Casey Bodley 2022-10-25 18:46:58 -04:00 • committed by Daniel Stenberg
parent 4c61a8e8f4
commit 7f8e6da6dc
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 61 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/libcurl/opts/CURLOPT_AWS_SIGV4.3
View file

@ -53,7 +53,7 @@ Calling \fICURLOPT_HTTPAUTH(3)\fP with CURLAUTH_AWS_SIGV4 is the same
as calling this with \fB"aws:amz"\fP in parameter.
.PP
Example with "Test:Try", when curl will do the algorithm, it will generate
\fB"TEST-HMAC-SHA256"\đP for "Algorithm", \fB"x-try-date"\fP and
\fB"TEST-HMAC-SHA256"\fP for "Algorithm", \fB"x-try-date"\fP and
\fB"X-Try-Date"\fP for "date", \fB"test4_request"\fP for "request type",
\fB"SignedHeaders=content-type;host;x-try-date"\fP for "signed headers"
.PP
@ -95,5 +95,11 @@ Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
This option overrides the other auth types you might have set in
\fICURLOPT_HTTPAUTH(3)\fP which should be highlighted as this makes this auth
method special. This method cannot be combined with other auth types.
.PP
A sha256 checksum of the request payload is used as input to the signature
calculation. For POST requests, this is a checksum of the provided
\fICURLOPT_POSTFIELDS(3)\fP. Otherwise, it's the checksum of an empty buffer.
For requests like PUT, you can provide your own checksum in a HTTP header named
\fBx-provider2-content-sha256\fP.
.SH "SEE ALSO"
.BR CURLOPT_HEADEROPT "(3), " CURLOPT_HTTPHEADER "(3), "