Cloudflare's web server (nginx-fl) buffers the entire request before sending it along, so all reques

K

kian•6/30/22, 9:19 PM

Blocks me if I don't include a

content-length

content-length

content-length

content-length header (i.e

GET

GET

) - so will need to add the method in

K

kian•6/30/22, 9:21 PM

(http.host eq "fw-test.kian.org.uk" and http.request.method in { "POST" "PUT" }) and (not any(lower(http.request.headers.names[*])[*] contains "content-length") or any(http.request.headers["content-length"][*] > "4096"))

(http.host eq "fw-test.kian.org.uk" and http.request.method in { "POST" "PUT" }) and (not any(lower(http.request.headers.names[*])[*] contains "content-length") or any(http.request.headers["content-length"][*] > "4096"))

(http.host eq "fw-test.kian.org.uk" and http.request.method in { "POST" "PUT" }) and (not any(lower(http.request.headers.names[*])[*] contains "content-length") or any(http.request.headers["content-length"][*] > "4096"))

(http.host eq "fw-test.kian.org.uk" and http.request.method in { "POST" "PUT" }) and (not any(lower(http.request.headers.names[*])[*] contains "content-length") or any(http.request.headers["content-length"][*] > "4096"))

K

kian•6/30/22, 9:22 PM

Restrict

POST

POST

and

PUT

PUT

PUT

PUT requests on

fw-test.kian.org.uk

fw-test.kian.org.uk

fw-test.kian.org.uk

fw-test.kian.org.uk to a

Content-Length

Content-Length

less than

4096

4096 (and block any that don't include it at all, will accept

for 0-length uploads)

K

kian•6/30/22, 9:23 PM

K

kian•6/30/22, 9:23 PM

Example POST - (domain goes nowhere, expected a 526)

Kkian ``` (http.host eq "fw-test.kian.org.uk" and http.request.method in { "POST" "PUT...

A

aspOP•6/30/22, 9:27 PM

I believe you can just do

any(http.request.headers["content-length"][*] > 4194304)

any(http.request.headers["content-length"][*] > 4194304)

any(http.request.headers["content-length"][*] > 4194304)

any(http.request.headers["content-length"][*] > 4194304). If there is no

Content-Length

Content-Length

header - because the body is empty - the expression will evaluate to false.

Edit: I am confusing myself

K

kian•6/30/22, 9:27 PM

Probably - ruleset engine hurts my brain

Kkian Probably - ruleset engine hurts my brain

A

aspOP•6/30/22, 9:28 PM

Well, yes, don't do ruleset when tired haha

K

kian•6/30/22, 9:29 PM

What’s the worst that’s gonna happen, find another input validation vuln?

K

kian•6/30/22, 9:29 PM

K

kian•6/30/22, 9:34 PM

I wish the firewall rules highlighted which condition you met - but that’s another story

Kkian What’s the worst that’s gonna happen, find another input validation vuln?

A

aspOP•6/30/22, 9:35 PM

Thursday night VULN discovery = Friday afternoon incident. So yes, that might just be the worst thing that can happen

W

Walshy•6/30/22, 9:37 PM

Pls no

C

Cyb3r-Jak3•6/30/22, 9:41 PM

@beelzabub (sorry for the ping) I don't think the S3 terraform is going to work. AWS uses STS for auth. When I try I get

error configuring Terraform AWS Provider: error validating provider credentials: error calling sts:GetCallerIdentity: operation error STS: GetCallerIdentity, https response error StatusCode: 403, RequestID: aec3d1d9-a733-499a-a35f-ab954b462626, api error InvalidClientTokenId: The security token included in the request is invalid.

error configuring Terraform AWS Provider: error validating provider credentials: error calling sts:GetCallerIdentity: operation error STS: GetCallerIdentity, https response error StatusCode: 403, RequestID: aec3d1d9-a733-499a-a35f-ab954b462626, api error InvalidClientTokenId: The security token included in the request is invalid.

error configuring Terraform AWS Provider: error validating provider credentials: error calling sts:GetCallerIdentity: operation error STS: GetCallerIdentity, https response error StatusCode: 403, RequestID: aec3d1d9-a733-499a-a35f-ab954b462626, api error InvalidClientTokenId: The security token included in the request is invalid.

error configuring Terraform AWS Provider: error validating provider credentials: error calling sts:GetCallerIdentity: operation error STS: GetCallerIdentity, https response error StatusCode: 403, RequestID: aec3d1d9-a733-499a-a35f-ab954b462626, api error InvalidClientTokenId: The security token included in the request is invalid.

Kkagitac and IIRC from when I explored this there is a "bug" in the provider (or R2 shoul...

C

Cyb3r-Jak3•6/30/22, 11:08 PM

It doesn't like no object lock.

error creating S3 Bucket (my-tf-test-bucket): NotImplemented: Header 'x-amz-bucket-object-lock-enabled' with value 'false' not implemented

error creating S3 Bucket (my-tf-test-bucket): NotImplemented: Header 'x-amz-bucket-object-lock-enabled' with value 'false' not implemented

error creating S3 Bucket (my-tf-test-bucket): NotImplemented: Header 'x-amz-bucket-object-lock-enabled' with value 'false' not implemented

error creating S3 Bucket (my-tf-test-bucket): NotImplemented: Header 'x-amz-bucket-object-lock-enabled' with value 'false' not implemented

B

beelzabub•7/1/22, 12:26 AM

Yeah, we're pretty strict about headers to avoid having to worry about problems as we add features

B

beelzabub•7/1/22, 12:27 AM

Which operation is

x-amz-bucket-object-lock-enabled

x-amz-bucket-object-lock-enabled

on?

B

beelzabub•7/1/22, 12:29 AM

I'll add a carve-out for supporting

false

false

next week

C

Cyb3r-Jak3•7/1/22, 12:29 AM

It was just on trying to create the bucket

B

beelzabub•7/1/22, 12:41 AM

kk. I put up a PR. It's small so it should be merged & included in the next release which will be either Friday or Tuesday

Aasp Cloudflare's web server (nginx-fl) buffers the entire request before sending it ...

B

beelzabub•7/1/22, 12:42 AM

Right. I forgot about that piece. I've been living inside the bubble that is the R2 worker too long :). We'll need to allow people to turn off the buffering at some point so that Workers fronting R2 can handle larger bodies.

A

aspOP•7/1/22, 10:16 AM

@beelzabub are you able to say...

If/when SHA-256 checksums will be supported in S3 CompleteMultipartUpload operations
(https://docs.aws.amazon.com/AmazonS3/latest/API/API_CompleteMultipartUpload.html#API_CompleteMultipartUpload_RequestSyntax)?
If/when SHA-256 checksums will be supported in bindings with
```
env.R2.put(body, {sha256: '<checksum>'})
```
env.R2.put(body, {sha256: '<checksum>'})
```
env.R2.put(body, {sha256: '<checksum>'})
```
env.R2.put(body, {sha256: '<checksum>'})
?

I know the SHA-256 checksum is already calculated for S3 PutObject operations as part of validating the signature (client provides the

X-Amz-Content-Sha256

X-Amz-Content-Sha256

X-Amz-Content-Sha256

X-Amz-Content-Sha256 header), so I assume it would be relatively easy to implement it for bindings as well. I don't think the same can be said for calculating the checksum of multipart uploads though.

E

Erisa•7/1/22, 10:28 AM

Pages indeed doesn't support R2 yet

E

Erisa•7/1/22, 10:32 AM

�

𝖆𝖚𝖙𝖎𝖘𝖙•7/1/22, 4:00 PM

wym @derfrisson ? KEKWiggle

Aasp @beelzabub are you able to say... 1. If/when SHA-256 checksums will be supported...

B

beelzabub•7/1/22, 4:34 PM

I wouldn't hold my breath
No immediate plans but I can add it to the backlog

VVertex Hey all, are there any plans to implement v2 signatures for S3 compatibility?

I

Isaac McFadyen•7/1/22, 7:03 PM

I kinda doubt it? Even S3 has deprecated them as of 2020.

I

Isaac McFadyen•7/1/22, 7:04 PM

But who knows, I don't speak for the R2 team

K

kian•7/1/22, 7:04 PM

SigV2 hasn't been supported on any AWS regions launched after 2013

K

kian•7/1/22, 7:04 PM

I don't think it's on the way personally

Kkian SigV2 hasn't been supported on any AWS regions launched after 2013

I

Isaac McFadyen•7/1/22, 7:04 PM

2013, whew.

K

kian•7/1/22, 7:05 PM

The Europe (Frankfurt), US East (Ohio), Canada (Central), Europe (London), Asia Pacific (Seoul), Asia Pacific (Mumbai), Europe (Paris), China (Ningxia), Europe (Stockholm), Asia Pacific (Osaka Local), AWS GovCloud (US-East), and Asia Pacific (Hong Kong) Regions were launched after 2013, and support SigV4 but not SigV2. If you have code that accesses S3 buckets in that region, it is already making exclusive use of SigV4.

K

kian•7/1/22, 7:05 PM

K

kian•7/1/22, 7:05 PM

It do be oldddddd

I

Isaac McFadyen•7/1/22, 7:05 PM

What about v3? lul

K

kian•7/1/22, 7:06 PM

The HyperText Transfer Protocol (HTTP) 411 Length Required client error response code indicates that the server refuses to accept the request without a defined Content-Length header.

K

kian•7/1/22, 7:06 PM

R2 requires a

Content-Length

Content-Length

header for uploads

K

kian•7/1/22, 7:08 PM

Somewhat - r2

Cloudflare's web server (nginx-fl) buffers the entire request before sending it along, so all reques

Similar Threads

Similar Threads

Similar Threads