[SigV4]Payload optimization

docs/doxygen/include/size_table.md

@@ -9,8 +9,8 @@
     </tr>
     <tr>
         <td>sigv4.c</td>
-        <td><center>4.9K</center></td>
-        <td><center>4.2K</center></td>
+        <td><center>5.1K</center></td>
+        <td><center>4.3K</center></td>
     </tr>
     <tr>
         <td>sigv4_quicksort.c</td>
@@ -19,7 +19,7 @@
     </tr>
     <tr>
         <td><b>Total estimates</b></td>
-        <td><b><center>5.3K</center></b></td>
-        <td><b><center>4.5K</center></b></td>
+        <td><b><center>5.5K</center></b></td>
+        <td><b><center>4.6K</center></b></td>
     </tr>
 </table>

lexicon.txt

@@ -61,6 +61,7 @@ hashblocklen
 hashdigestlen
 hashfinal
 hashinit
+hashpayloadlen
 hashtofail
 hashupdate
 headercount
@@ -156,6 +157,7 @@ pfirstitem
 pfirstval
 pformat
 phashcontext
+phashpayloadloc
 pheaders
 pheadersloc
 phexoutput

source/include/sigv4.h

@@ -110,6 +110,15 @@
  */
 #define SIGV4_HTTP_HEADERS_ARE_CANONICAL_FLAG    0x4U
 
+/**
+ * @ingroup sigv4_canonical_flags
+ * @brief Set this flag to indicate that the HTTP request payload is
+ * already hashed.
+ *
+ * This flag is valid only for #SigV4HttpParameters_t.flags.
+ */
+#define SIGV4_HTTP_PAYLOAD_IS_HASH               0x8U
+
 /**
  * @ingroup sigv4_canonical_flags
  * @brief Set this flag to indicate that the HTTP request path, query, and

source/include/sigv4_internal.h

@@ -205,6 +205,8 @@ typedef struct CanonicalContext
     uint8_t pBufProcessing[ SIGV4_PROCESSING_BUFFER_LENGTH ];       /**< Internal calculation buffer used during canonicalization. */
     char * pBufCur;                                                 /**< pBufProcessing cursor. */
     size_t bufRemaining;                                            /**< pBufProcessing value used during internal calculation. */
+    const char * pHashPayloadLoc;                                   /**< Pointer used to store the location of HTTP request hashed payload. */
+    size_t hashPayloadLen;                                          /**< Length of HTTP request hashed payload. */
 } CanonicalContext_t;
 
 /**

source/sigv4.c

@@ -192,6 +192,18 @@ static SigV4Status_t appendCanonicalizedHeaders( size_t headerCount,
                                                  uint32_t flags,
                                                  CanonicalContext_t * canonicalRequest );
 
+/**
+ * @brief Store the location of HTTP request hashed payload in the HTTP request.
+ *
+ * @param[in] headerIndex Index of request Header in the list of parsed headers.
+ * @param[in] pAmzSHA256Header Literal for x-amz-content-sha256 header in HTTP request.
+ * @param[in,out] canonicalRequest Struct to maintain intermediary buffer
+ * and state of canonicalization.
+ */
+static void storeHashedPayloadLocation( size_t headerIndex,
+                                        const char * pAmzSHA256Header,
+                                        CanonicalContext_t * canonicalRequest );
+
 /**
  * @brief Parse each header key and value pair from HTTP headers.
  *
@@ -350,6 +362,20 @@ static void setQueryParameterValue( size_t currentParameter,
                                     size_t valueLen,
                                     CanonicalContext_t * pCanonicalRequest );
 
+/**
+ * @brief Write the HTTP request payload hash to the canonical request.
+ *
+ * @param[in] pParams The application-defined parameters used for writing
+ * the payload hash.
+ * @param[out] pCanonicalContext The canonical context where the payload
+ * hash should be written.
+ *
+ * @return SigV4InsufficientMemory if the length of the canonical request
+ * buffer cannot write the desired line, #SigV4Success otherwise.
+ */
+static SigV4Status_t writePayloadHashToCanonicalRequest( const SigV4Parameters_t * pParams,
+                                                         CanonicalContext_t * pCanonicalContext );
+
 /**
  * @brief Generates the key for the HMAC operation.
  *
@@ -1583,6 +1609,21 @@ static void generateCredentialScope( const SigV4Parameters_t * pSigV4Params,
     }
 
 /*-----------------------------------------------------------*/
+    static void storeHashedPayloadLocation( size_t headerIndex,
+                                            const char * pAmzSHA256Header,
+                                            CanonicalContext_t * canonicalRequest )
+    {
+        assert( canonicalRequest != NULL );
+
+        const uint8_t * pHeaderData = ( const uint8_t * ) canonicalRequest->pHeadersLoc[ headerIndex ].key.pData;
+        const uint8_t * pHeaderLiteral = ( const uint8_t * ) pAmzSHA256Header;
+
+        if( memcmp( pHeaderData, pHeaderLiteral, canonicalRequest->pHeadersLoc[ headerIndex ].key.dataLen ) == 0 )
+        {
+            canonicalRequest->pHashPayloadLoc = canonicalRequest->pHeadersLoc[ headerIndex ].value.pData;
+            canonicalRequest->hashPayloadLen = canonicalRequest->pHeadersLoc[ headerIndex ].value.dataLen;
+        }
+    }
 
     static SigV4Status_t appendCanonicalizedHeaders( size_t headerCount,
                                                      uint32_t flags,
@@ -1670,6 +1711,10 @@ static void generateCredentialScope( const SigV4Parameters_t * pSigV4Params,
                 dataLen = pCurrLoc - pKeyOrValStartLoc;
                 canonicalRequest->pHeadersLoc[ noOfHeaders ].value.pData = pKeyOrValStartLoc;
                 canonicalRequest->pHeadersLoc[ noOfHeaders ].value.dataLen = ( size_t ) dataLen;
+
+                /* Storing location of hashed request payload */
+                storeHashedPayloadLocation( noOfHeaders, ( const char * ) SIGV4_HTTP_X_AMZ_CONTENT_SHA256_HEADER, canonicalRequest );
+
                 /* Set starting location of the next header key string after the "\r\n". */
                 pKeyOrValStartLoc = pCurrLoc + 2U;
                 keyFlag = true;
@@ -1681,6 +1726,10 @@ static void generateCredentialScope( const SigV4Parameters_t * pSigV4Params,
                 dataLen = pCurrLoc - pKeyOrValStartLoc;
                 canonicalRequest->pHeadersLoc[ noOfHeaders ].value.pData = pKeyOrValStartLoc;
                 canonicalRequest->pHeadersLoc[ noOfHeaders ].value.dataLen = ( size_t ) dataLen;
+
+                /* Storing location of hashed request payload */
+                storeHashedPayloadLocation( noOfHeaders, ( const char * ) SIGV4_HTTP_X_AMZ_CONTENT_SHA256_HEADER, canonicalRequest );
+
                 /* Set starting location of the next header key string after the "\n". */
                 pKeyOrValStartLoc = pCurrLoc + 1U;
                 keyFlag = true;
@@ -2921,6 +2970,39 @@ static SigV4Status_t generateSigningKey( const SigV4Parameters_t * pSigV4Params,
     return returnStatus;
 }
 
+static SigV4Status_t writePayloadHashToCanonicalRequest( const SigV4Parameters_t * pParams,
+                                                         CanonicalContext_t * pCanonicalContext )
+{
+    size_t encodedLen = 0U;
+    SigV4Status_t returnStatus = SigV4Success;
+
+    assert( pParams != NULL );
+    assert( pCanonicalContext != NULL );
+
+    if( FLAG_IS_SET( pParams->pHttpParameters->flags, SIGV4_HTTP_PAYLOAD_IS_HASH ) )
+    {
+        /* Copy the hashed payload data supplied by the user in the headers data list. */
+        returnStatus = copyHeaderStringToCanonicalBuffer( pCanonicalContext->pHashPayloadLoc, pCanonicalContext->hashPayloadLen, pParams->pHttpParameters->flags, '\n', pCanonicalContext );
+        /* Remove new line at the end of the payload. */
+        pCanonicalContext->pBufCur--;
+    }
+    else
+    {
+        encodedLen = pCanonicalContext->bufRemaining;
+        /* Calculate hash of the request payload. */
+        returnStatus = completeHashAndHexEncode( pParams->pHttpParameters->pPayload,
+                                                 pParams->pHttpParameters->payloadLen,
+                                                 pCanonicalContext->pBufCur,
+                                                 &encodedLen,
+                                                 pParams->pCryptoInterface );
+        pCanonicalContext->pBufCur += encodedLen;
+        pCanonicalContext->bufRemaining -= encodedLen;
+    }
+
+    return returnStatus;
+}
+
+
 SigV4Status_t SigV4_AwsIotDateToIso8601( const char * pDate,
                                          size_t dateLen,
                                          char * pDateISO8601,
@@ -3007,7 +3089,7 @@ SigV4Status_t SigV4_GenerateHTTPAuthorization( const SigV4Parameters_t * pParams
     CanonicalContext_t canonicalContext;
     const char * pAlgorithm = NULL;
     char * pSignedHeaders = NULL;
-    size_t encodedLen = 0U, algorithmLen = 0U, signedHeadersLen = 0U, authPrefixLen = 0U;
+    size_t algorithmLen = 0U, signedHeadersLen = 0U, authPrefixLen = 0U;
     HmacContext_t hmacContext = { 0 };
 
     SigV4String_t signingKey;
@@ -3032,12 +3114,8 @@ SigV4Status_t SigV4_GenerateHTTPAuthorization( const SigV4Parameters_t * pParams
     /* Hash and hex-encode the canonical request to the buffer. */
     if( returnStatus == SigV4Success )
     {
-        encodedLen = canonicalContext.bufRemaining;
-        returnStatus = completeHashAndHexEncode( pParams->pHttpParameters->pPayload,
-                                                 pParams->pHttpParameters->payloadLen,
-                                                 canonicalContext.pBufCur,
-                                                 &encodedLen,
-                                                 pParams->pCryptoInterface );
+        /* Write HTTP request payload hash to the canonical request. */
+        returnStatus = writePayloadHashToCanonicalRequest( pParams, &canonicalContext );
     }
 
     /* Write the prefix of the Authorizaton header value. */
@@ -3053,8 +3131,6 @@ SigV4Status_t SigV4_GenerateHTTPAuthorization( const SigV4Parameters_t * pParams
     /* Write string to sign. */
     if( returnStatus == SigV4Success )
     {
-        canonicalContext.pBufCur += encodedLen;
-        canonicalContext.bufRemaining -= encodedLen;
         returnStatus = writeStringToSign( pParams, pAlgorithm, algorithmLen, &canonicalContext );
     }
 

test/unit-test/sigv4_config.h

@@ -76,7 +76,7 @@
  * <b>Default value:</b> `1024`
  */
 #ifndef SIGV4_PROCESSING_BUFFER_LENGTH
-    #define SIGV4_PROCESSING_BUFFER_LENGTH    350
+    #define SIGV4_PROCESSING_BUFFER_LENGTH    428
 #endif
 
 /**

test/unit-test/sigv4_utest.c

@@ -77,6 +77,7 @@
 #define HEADERS                                               "Host: iam.amazonaws.com\r\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\r\nX-Amz-Date: "DATE "\r\n\r\n"
 #define HEADERS_LENGTH                                        ( sizeof( HEADERS ) - 1U )
 #define PRECANON_HEADER                                       "content-type:application/json;\nhost:iam.amazonaws.com\n"
+#define HEADERS_WITH_X_AMZ_CONTENT_SHA256                     "Host: iam.amazonaws.com\r\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\r\nx-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b785\r\nX-Amz-Date: "DATE "\r\n\r\n"
 
 /* Header data containing leading, trailing and sequential trimmable spaces. */
 #define HEADERS_WITH_TRIMMABLE_SPACES                         "  Header-1 :  Value \t - \t 1  \r\n"
@@ -120,9 +121,11 @@
 #define PATH_FIRST_ENCODE_AND_LF_OOM                                                    \
     "/path-to-victory-will-soon-come-to-a-close-and-then-we-can-finally-eat-our-errors" \
     "-even-though-this-is-not-a-good-practice-at-all-so-obviously-this-is-just-a-joke-" \
-    "so-why-are-you-still-reading-this-i-mean-im-crazy-enough-to-type-this-very-"       \
-    "long-string-instead-of-using-a-lorem-ipsum-website-maybe-i-should-be-a-comedian-"  \
-    "instead-be-a-programmer-reall"
+    "so-why-are-you-still-reading-this-i-mean-im-crazy-enough-to-type-this-very-xchjsd" \
+    "chjdsvchjdvhjcdhjsckhdsvchdks-sfdghfdfahgsdhfgjsgfjkgfsdgkdgfdjkgdggdjfsjkgjksgkj" \
+    "sdgfdfgdshfgsjdhfdhfkhdkfhjdgfgdfgdfg-sdvfdvfhdvfhvdhfvdsfdsgfgdsjfgjdsfqwertyuio" \
+    "pasdfghwsshasdfghjk"
+
 /* HTTP method + this URI-encoded variant of this string + double-encoded variant must be greater than SIGV4_PROCESSING_BUFFER_LENGTH. */
 #define PATH_SECOND_ENCODE_OOM    "/path-to-victory-will-soon-come-to-a-close-and-then-we-can-finally-eat-our-errors-even-though-this-is-not-a-good-practice-at-all-so-obviously-this-is-just-a-joke-so-why-are-you-still-reading-this-i-mean-im-crazy-enough-to-type-this-very-long-string-instead-of-using-a-lorem-ipsum-website-maybe-i-should-be-a-comedian-instead"
 
@@ -132,7 +135,8 @@
     "-even-though-this-is-not-a-good-practice-at-all-so-obviously-this-is-just-a-joke-" \
     "so-why-are-you-still-&m=reading-this-i-mean-im-crazy-enough-to-type-this-very-"    \
     "long-string-instead-of-using-a-lorem-ipsum-website-maybe-i-should-be-a-comedian-"  \
-    "instead-be-a-programmer-reall&y=3"
+    "instead-be-a-programmer-reall&ymxchykldfghiwbdcjhjdddkkgddsdhshdkshdhsskgfkjgfggc" \
+    "gjfhjxgxghsgfdwfdfdfdffhfdhdhfhdfhd=3"
 
 /* '=' before query string value in canonicalized query string causes OOM. */
 #define QUERY_EQUAL_BEFORE_VALUE_OOM                                                      \
@@ -645,6 +649,7 @@ void test_SigV4_GenerateHTTPAuthorization_Happy_Paths()
     /* Test case when the first step of the Signing Key generation HMAC operation encounters a key that is
      * less than hash block in length. */
     char secretKeyGeneratingBlockLenHMACKey[ SIGV4_HASH_MAX_BLOCK_LENGTH - strlen( SIGV4_HMAC_SIGNING_KEY_PREFIX ) ];
+
     memset( secretKeyGeneratingBlockLenHMACKey, ( int ) 'K', sizeof( secretKeyGeneratingBlockLenHMACKey ) );
     creds.pSecretAccessKey = secretKeyGeneratingBlockLenHMACKey;
     creds.secretAccessKeyLen = sizeof( secretKeyGeneratingBlockLenHMACKey );
@@ -847,6 +852,7 @@ void test_SigV4_GenerateHTTPAuthorization_InsufficientMemory()
      * Method data in the processing buffer. This case is created by using a method string
      * longer than the processing buffer length. */
     char * pMethodData = malloc( SIGV4_PROCESSING_BUFFER_LENGTH );
+
     memset( pMethodData, ( int ) 'M', SIGV4_PROCESSING_BUFFER_LENGTH );
     params.pHttpParameters->pHttpMethod = pMethodData;
     params.pHttpParameters->httpMethodLen = SIGV4_PROCESSING_BUFFER_LENGTH;
@@ -923,6 +929,7 @@ void test_SigV4_GenerateHTTPAuthorization_InsufficientMemory()
     /* Test case of insufficient memory when "String to Sign" cannot be stored in processing buffer.
      * This scenario is produced by using a long AWS Region string (which is one of the parameters of String To Sign). */
     char * longRegion = malloc( SIGV4_PROCESSING_BUFFER_LENGTH );
+
     /* Fill gibberish string data in the buffer for region. */
     memset( longRegion, 'x', SIGV4_PROCESSING_BUFFER_LENGTH );
     resetInputParams();
@@ -937,6 +944,7 @@ void test_SigV4_GenerateHTTPAuthorization_InsufficientMemory()
      * hash in the processing buffer. */
     size_t headersLen = SIGV4_PROCESSING_BUFFER_LENGTH - ( SIGV4_HASH_MAX_DIGEST_LENGTH * 2 );
     char * longPrecanonHeader = malloc( headersLen );
+
     TEST_ASSERT_NOT_NULL( longPrecanonHeader );
     longPrecanonHeader[ 0 ] = 'H';
     longPrecanonHeader[ 1 ] = ':';
@@ -960,6 +968,7 @@ void test_SigV4_GenerateHTTPAuthorization_InsufficientMemory()
      * character for which there doesn't exist space in the processing buffer. */
     size_t longPathLen = SIGV4_PROCESSING_BUFFER_LENGTH - httpParams.httpMethodLen - LINEFEED_CHAR_LEN;
     char specialCharAtEndOfLongPath[ longPathLen ];
+
     specialCharAtEndOfLongPath[ 0 ] = '/';
     memset( specialCharAtEndOfLongPath + 1, ( int ) '-', longPathLen );
     specialCharAtEndOfLongPath[ longPathLen - 1 ] = '*';
@@ -975,6 +984,7 @@ void test_SigV4_GenerateHTTPAuthorization_InsufficientMemory()
     size_t longQueryLen = SIGV4_PROCESSING_BUFFER_LENGTH - httpParams.httpMethodLen -
                           LINEFEED_CHAR_LEN - HTTP_EMPTY_PATH_LEN - LINEFEED_CHAR_LEN;
     char * longQuery = malloc( longQueryLen );
+
     TEST_ASSERT_NOT_NULL( longQuery );
     longQuery[ 0 ] = 'P';
     longQuery[ 1 ] = '=';
@@ -1002,6 +1012,7 @@ void test_SigV4_GenerateHTTPAuthorization_InsufficientMemory()
                   * empty value and newline character. */
                  4U;
     char * longHeader = malloc( headersLen );
+
     TEST_ASSERT_NOT_NULL( longHeader );
     /* Set gibberish header key data. */
     memset( longHeader, ( int ) 'H', headersLen - 4 );
@@ -1142,6 +1153,7 @@ void test_SigV4_GenerateHTTPAuthorization_InsufficientMemory()
      * to crowd out space for the Signing Key. */
     size_t lenOfStringToSignWithoutRegion = ( STRING_TO_SIGN_LEN_WITH_DEFAULT_REGION ) -strlen( REGION );
     size_t longRegionLen = SIGV4_PROCESSING_BUFFER_LENGTH - lenOfStringToSignWithoutRegion;
+
     /*size_t longRegionLen = SIGV4_PROCESSING_BUFFER_LENGTH - 4 * SIGV4_HASH_MAX_DIGEST_LENGTH; */
     longRegion = malloc( longRegionLen );
     /* Fill gibberish in the long region name. */
@@ -1271,3 +1283,15 @@ void test_SigV4_GenerateAuthorization_Sorting_Algorithm_Coverage()
     TEST_ASSERT_EQUAL( SigV4Success, SigV4_GenerateHTTPAuthorization(
                            &params, authBuf, &authBufLen, &signature, &signatureLen ) );
 }
+
+/* Test that the library does not calculate the hash of the request payload if it is already hashed by the application. */
+void test_SigV4_GenerateAuthorization_Headers_With_X_Amz_Content_Sha256_Header()
+{
+    params.pHttpParameters->pHeaders = HEADERS_WITH_X_AMZ_CONTENT_SHA256;
+    params.pHttpParameters->headersLen = strlen( HEADERS_WITH_X_AMZ_CONTENT_SHA256 );
+
+    params.pHttpParameters->flags = SIGV4_HTTP_PAYLOAD_IS_HASH;
+
+    TEST_ASSERT_EQUAL( SigV4Success, SigV4_GenerateHTTPAuthorization(
+                           &params, authBuf, &authBufLen, &signature, &signatureLen ) );
+}