| 1 |
<?php |
| 2 |
|
| 3 |
namespace Dudlewebs\WPMCS\s3\Aws\S3; |
| 4 |
|
| 5 |
use Dudlewebs\WPMCS\s3\Aws\Api\Service; |
| 6 |
use Dudlewebs\WPMCS\s3\Aws\Arn\AccessPointArnInterface; |
| 7 |
use Dudlewebs\WPMCS\s3\Aws\Arn\ArnParser; |
| 8 |
use Dudlewebs\WPMCS\s3\Aws\Arn\ObjectLambdaAccessPointArn; |
| 9 |
use Dudlewebs\WPMCS\s3\Aws\Arn\Exception\InvalidArnException; |
| 10 |
use Dudlewebs\WPMCS\s3\Aws\Arn\AccessPointArn as BaseAccessPointArn; |
| 11 |
use Dudlewebs\WPMCS\s3\Aws\Arn\S3\OutpostsAccessPointArn; |
| 12 |
use Dudlewebs\WPMCS\s3\Aws\Arn\S3\MultiRegionAccessPointArn; |
| 13 |
use Dudlewebs\WPMCS\s3\Aws\Arn\S3\OutpostsArnInterface; |
| 14 |
use Dudlewebs\WPMCS\s3\Aws\CommandInterface; |
| 15 |
use Dudlewebs\WPMCS\s3\Aws\Endpoint\PartitionEndpointProvider; |
| 16 |
use Dudlewebs\WPMCS\s3\Aws\Exception\InvalidRegionException; |
| 17 |
use Dudlewebs\WPMCS\s3\Aws\Exception\UnresolvedEndpointException; |
| 18 |
use Dudlewebs\WPMCS\s3\Aws\S3\Exception\S3Exception; |
| 19 |
use InvalidArgumentException; |
| 20 |
use Dudlewebs\WPMCS\s3\Psr\Http\Message\RequestInterface; |
| 21 |
/** |
| 22 |
* Checks for access point ARN in members targeting BucketName, modifying |
| 23 |
* endpoint as appropriate |
| 24 |
* |
| 25 |
* @internal |
| 26 |
*/ |
| 27 |
class BucketEndpointArnMiddleware |
| 28 |
{ |
| 29 |
use EndpointRegionHelperTrait; |
| 30 |
/** @var callable */ |
| 31 |
private $nextHandler; |
| 32 |
/** @var array */ |
| 33 |
private $nonArnableCommands = ['CreateBucket']; |
| 34 |
/** |
| 35 |
* Create a middleware wrapper function. |
| 36 |
* |
| 37 |
* @param Service $service |
| 38 |
* @param $region |
| 39 |
* @param array $config |
| 40 |
* @return callable |
| 41 |
*/ |
| 42 |
public static function wrap(Service $service, $region, array $config) |
| 43 |
{ |
| 44 |
return function (callable $handler) use($service, $region, $config) { |
| 45 |
return new self($handler, $service, $region, $config); |
| 46 |
}; |
| 47 |
} |
| 48 |
public function __construct(callable $nextHandler, Service $service, $region, array $config = []) |
| 49 |
{ |
| 50 |
$this->partitionProvider = PartitionEndpointProvider::defaultProvider(); |
| 51 |
$this->region = $region; |
| 52 |
$this->service = $service; |
| 53 |
$this->config = $config; |
| 54 |
$this->nextHandler = $nextHandler; |
| 55 |
} |
| 56 |
public function __invoke(CommandInterface $cmd, RequestInterface $req) |
| 57 |
{ |
| 58 |
$nextHandler = $this->nextHandler; |
| 59 |
$op = $this->service->getOperation($cmd->getName())->toArray(); |
| 60 |
if (!empty($op['input']['shape'])) { |
| 61 |
$service = $this->service->toArray(); |
| 62 |
if (!empty($input = $service['shapes'][$op['input']['shape']])) { |
| 63 |
foreach ($input['members'] as $key => $member) { |
| 64 |
if ($member['shape'] === 'BucketName') { |
| 65 |
$arnableKey = $key; |
| 66 |
break; |
| 67 |
} |
| 68 |
} |
| 69 |
if (!empty($arnableKey) && ArnParser::isArn($cmd[$arnableKey])) { |
| 70 |
try { |
| 71 |
// Throw for commands that do not support ARN inputs |
| 72 |
if (\in_array($cmd->getName(), $this->nonArnableCommands)) { |
| 73 |
throw new S3Exception('ARN values cannot be used in the bucket field for' . ' the ' . $cmd->getName() . ' operation.', $cmd); |
| 74 |
} |
| 75 |
$arn = ArnParser::parse($cmd[$arnableKey]); |
| 76 |
$partition = $this->validateArn($arn); |
| 77 |
$host = $this->generateAccessPointHost($arn, $req); |
| 78 |
// Remove encoded bucket string from path |
| 79 |
$path = $req->getUri()->getPath(); |
| 80 |
$encoded = \rawurlencode($cmd[$arnableKey]); |
| 81 |
$len = \strlen($encoded) + 1; |
| 82 |
if (\trim(\substr($path, 0, $len), '/') === "{$encoded}") { |
| 83 |
$path = \substr($path, $len); |
| 84 |
if (\substr($path, 0, 1) !== "/") { |
| 85 |
$path = '/' . $path; |
| 86 |
} |
| 87 |
} |
| 88 |
if (empty($path)) { |
| 89 |
$path = ''; |
| 90 |
} |
| 91 |
// Set modified request |
| 92 |
$req = $req->withUri($req->getUri()->withPath($path)->withHost($host)); |
| 93 |
// Update signing region based on ARN data if configured to do so |
| 94 |
if ($this->config['use_arn_region']->isUseArnRegion() && !$this->config['use_fips_endpoint']->isUseFipsEndpoint()) { |
| 95 |
$region = $arn->getRegion(); |
| 96 |
} else { |
| 97 |
$region = $this->region; |
| 98 |
} |
| 99 |
$endpointData = $partition(['region' => $region, 'service' => $arn->getService()]); |
| 100 |
$cmd['@context']['signing_region'] = $endpointData['signingRegion']; |
| 101 |
// Update signing service for Outposts and Lambda ARNs |
| 102 |
if ($arn instanceof OutpostsArnInterface || $arn instanceof ObjectLambdaAccessPointArn) { |
| 103 |
$cmd['@context']['signing_service'] = $arn->getService(); |
| 104 |
} |
| 105 |
} catch (InvalidArnException $e) { |
| 106 |
// Add context to ARN exception |
| 107 |
throw new S3Exception('Bucket parameter parsed as ARN and failed with: ' . $e->getMessage(), $cmd, [], $e); |
| 108 |
} |
| 109 |
} |
| 110 |
} |
| 111 |
} |
| 112 |
return $nextHandler($cmd, $req); |
| 113 |
} |
| 114 |
private function generateAccessPointHost(BaseAccessPointArn $arn, RequestInterface $req) |
| 115 |
{ |
| 116 |
if ($arn instanceof OutpostsAccessPointArn) { |
| 117 |
$accesspointName = $arn->getAccesspointName(); |
| 118 |
} else { |
| 119 |
$accesspointName = $arn->getResourceId(); |
| 120 |
} |
| 121 |
if ($arn instanceof MultiRegionAccessPointArn) { |
| 122 |
$partition = $this->partitionProvider->getPartitionByName($arn->getPartition(), 's3'); |
| 123 |
$dnsSuffix = $partition->getDnsSuffix(); |
| 124 |
return "{$accesspointName}.accesspoint.s3-global.{$dnsSuffix}"; |
| 125 |
} |
| 126 |
$host = "{$accesspointName}-" . $arn->getAccountId(); |
| 127 |
$useFips = $this->config['use_fips_endpoint']->isUseFipsEndpoint(); |
| 128 |
$fipsString = $useFips ? "-fips" : ""; |
| 129 |
if ($arn instanceof OutpostsAccessPointArn) { |
| 130 |
$host .= '.' . $arn->getOutpostId() . '.s3-outposts'; |
| 131 |
} else { |
| 132 |
if ($arn instanceof ObjectLambdaAccessPointArn) { |
| 133 |
if (!empty($this->config['endpoint'])) { |
| 134 |
return $host . '.' . $this->config['endpoint']; |
| 135 |
} else { |
| 136 |
$host .= ".s3-object-lambda{$fipsString}"; |
| 137 |
} |
| 138 |
} else { |
| 139 |
$host .= ".s3-accesspoint{$fipsString}"; |
| 140 |
if (!empty($this->config['dual_stack'])) { |
| 141 |
$host .= '.dualstack'; |
| 142 |
} |
| 143 |
} |
| 144 |
} |
| 145 |
if (!empty($this->config['use_arn_region']->isUseArnRegion())) { |
| 146 |
$region = $arn->getRegion(); |
| 147 |
} else { |
| 148 |
$region = $this->region; |
| 149 |
} |
| 150 |
$region = \Dudlewebs\WPMCS\s3\Aws\strip_fips_pseudo_regions($region); |
| 151 |
$host .= '.' . $region . '.' . $this->getPartitionSuffix($arn, $this->partitionProvider); |
| 152 |
return $host; |
| 153 |
} |
| 154 |
/** |
| 155 |
* Validates an ARN, returning a partition object corresponding to the ARN |
| 156 |
* if successful |
| 157 |
* |
| 158 |
* @param $arn |
| 159 |
* @return \Aws\Endpoint\Partition |
| 160 |
*/ |
| 161 |
private function validateArn($arn) |
| 162 |
{ |
| 163 |
if ($arn instanceof AccessPointArnInterface) { |
| 164 |
// Dualstack is not supported with Outposts access points |
| 165 |
if ($arn instanceof OutpostsAccessPointArn && !empty($this->config['dual_stack'])) { |
| 166 |
throw new UnresolvedEndpointException('Dualstack is currently not supported with S3 Outposts access' . ' points. Please disable dualstack or do not supply an' . ' access point ARN.'); |
| 167 |
} |
| 168 |
if ($arn instanceof MultiRegionAccessPointArn) { |
| 169 |
if (!empty($this->config['disable_multiregion_access_points'])) { |
| 170 |
throw new UnresolvedEndpointException('Multi-Region Access Point ARNs are disabled, but one was provided. Please' . ' enable them or provide a different ARN.'); |
| 171 |
} |
| 172 |
if (!empty($this->config['dual_stack'])) { |
| 173 |
throw new UnresolvedEndpointException('Multi-Region Access Point ARNs do not currently support dual stack. Please' . ' disable dual stack or provide a different ARN.'); |
| 174 |
} |
| 175 |
} |
| 176 |
// Accelerate is not supported with access points |
| 177 |
if (!empty($this->config['accelerate'])) { |
| 178 |
throw new UnresolvedEndpointException('Accelerate is currently not supported with access points.' . ' Please disable accelerate or do not supply an access' . ' point ARN.'); |
| 179 |
} |
| 180 |
// Path-style is not supported with access points |
| 181 |
if (!empty($this->config['path_style'])) { |
| 182 |
throw new UnresolvedEndpointException('Path-style addressing is currently not supported with' . ' access points. Please disable path-style or do not' . ' supply an access point ARN.'); |
| 183 |
} |
| 184 |
// Custom endpoint is not supported with access points |
| 185 |
if (!\is_null($this->config['endpoint']) && !$arn instanceof ObjectLambdaAccessPointArn) { |
| 186 |
throw new UnresolvedEndpointException('A custom endpoint has been supplied along with an access' . ' point ARN, and these are not compatible with each other.' . ' Please only use one or the other.'); |
| 187 |
} |
| 188 |
// Dualstack is not supported with object lambda access points |
| 189 |
if ($arn instanceof ObjectLambdaAccessPointArn && !empty($this->config['dual_stack'])) { |
| 190 |
throw new UnresolvedEndpointException('Dualstack is currently not supported with Object Lambda access' . ' points. Please disable dualstack or do not supply an' . ' access point ARN.'); |
| 191 |
} |
| 192 |
// Global endpoints do not support cross-region requests |
| 193 |
if ($this->isGlobal($this->region) && $this->config['use_arn_region']->isUseArnRegion() == \false && $arn->getRegion() != $this->region && !$arn instanceof MultiRegionAccessPointArn) { |
| 194 |
throw new UnresolvedEndpointException('Global endpoints do not support cross region requests.' . ' Please enable use_arn_region or do not supply a global region' . ' with a different region in the ARN.'); |
| 195 |
} |
| 196 |
// Get partitions for ARN and client region |
| 197 |
$arnPart = $this->partitionProvider->getPartition($arn->getRegion(), 's3'); |
| 198 |
$clientPart = $this->partitionProvider->getPartition($this->region, 's3'); |
| 199 |
// If client partition not found, try removing pseudo-region qualifiers |
| 200 |
if (!$clientPart->isRegionMatch($this->region, 's3')) { |
| 201 |
$clientPart = $this->partitionProvider->getPartition(\Dudlewebs\WPMCS\s3\Aws\strip_fips_pseudo_regions($this->region), 's3'); |
| 202 |
} |
| 203 |
if (!$arn instanceof MultiRegionAccessPointArn) { |
| 204 |
// Verify that the partition matches for supplied partition and region |
| 205 |
if ($arn->getPartition() !== $clientPart->getName()) { |
| 206 |
throw new InvalidRegionException('The supplied ARN partition' . " does not match the client's partition."); |
| 207 |
} |
| 208 |
if ($clientPart->getName() !== $arnPart->getName()) { |
| 209 |
throw new InvalidRegionException('The corresponding partition' . ' for the supplied ARN region does not match the' . " client's partition."); |
| 210 |
} |
| 211 |
// Ensure ARN region matches client region unless |
| 212 |
// configured for using ARN region over client region |
| 213 |
$this->validateMatchingRegion($arn); |
| 214 |
// Ensure it is not resolved to fips pseudo-region for S3 Outposts |
| 215 |
$this->validateFipsConfigurations($arn); |
| 216 |
} |
| 217 |
return $arnPart; |
| 218 |
} |
| 219 |
throw new InvalidArnException('Provided ARN was not a valid S3 access' . ' point ARN or S3 Outposts access point ARN.'); |
| 220 |
} |
| 221 |
/** |
| 222 |
* Checks if a region is global |
| 223 |
* |
| 224 |
* @param $region |
| 225 |
* @return bool |
| 226 |
*/ |
| 227 |
private function isGlobal($region) |
| 228 |
{ |
| 229 |
return $region == 's3-external-1' || $region == 'aws-global'; |
| 230 |
} |
| 231 |
} |
| 232 |
|
