Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CloudFront] Add exception when signature generation fails #2590

Merged

Conversation

DocLM
Copy link
Contributor

@DocLM DocLM commented Dec 5, 2022

See #2608

Description of changes:
On recent RHEL/RockyLinux/Alma 9 the default system security policies disable SHA-1 in OpenSSL.

This cause CloudFrontClient to silently fail signature generation in getSignedUrl and generate an URL with empty signature.
I've added a check for empty signature and an exception with OpenSSL errors to help to identify the issue.
I'd like to add a test but I'm struggling to find a way to dynamically disable the algorithm during unit tests, any suggestion is welcome.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@DocLM DocLM force-pushed the enhancement/cloudfront-sha1-openssl branch 2 times, most recently from ce21d37 to 7d537d3 Compare December 5, 2022 21:33
@DocLM DocLM force-pushed the enhancement/cloudfront-sha1-openssl branch from 7d537d3 to 7174662 Compare December 16, 2022 20:38
@DocLM DocLM force-pushed the enhancement/cloudfront-sha1-openssl branch from 7174662 to 728ce05 Compare December 25, 2022 17:05
@DocLM DocLM force-pushed the enhancement/cloudfront-sha1-openssl branch from 728ce05 to 202795e Compare March 13, 2023 21:22
@DocLM DocLM force-pushed the enhancement/cloudfront-sha1-openssl branch from 202795e to 217d065 Compare August 9, 2023 19:50
Copy link
Contributor

@yenfryherrerafeliz yenfryherrerafeliz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks good. Can you just please add a new line in between line 122 and 123?

Thanks!

@DocLM DocLM force-pushed the enhancement/cloudfront-sha1-openssl branch from 217d065 to a65c76f Compare January 8, 2024 07:21
@DocLM
Copy link
Contributor Author

DocLM commented Jan 8, 2024

@yenfryherrerafeliz refactored and rebased code, ready to go when you are ready!

@DocLM DocLM force-pushed the enhancement/cloudfront-sha1-openssl branch from a65c76f to 55c8fad Compare January 8, 2024 07:26
@yenfryherrerafeliz
Copy link
Contributor

Hi @DocLM, one last thing. Could you please add a generic error message for when $errorMessages is empty. Just to be safe.
For example:

$exceptionMessage = implode("\n",$errorMessages);
if (count($errorMessages) == 0) {
    $exceptionMessage = "An error has occurred when signing the policy";
}

throw new \RuntimeException($exceptionMessage);

Thanks!

@DocLM DocLM force-pushed the enhancement/cloudfront-sha1-openssl branch from 55c8fad to 4189548 Compare January 10, 2024 21:22
@DocLM
Copy link
Contributor Author

DocLM commented Jan 10, 2024

@yenfryherrerafeliz Fallback error message now available!

Copy link
Member

@stobrien89 stobrien89 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution @DocLM!

@yenfryherrerafeliz yenfryherrerafeliz merged commit 46ac1da into aws:master Jan 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants