diff options
author | blizzz <blizzz@arthur-schiwon.de> | 2022-07-23 00:55:19 +0300 |
---|---|---|
committer | GitHub <noreply@github.com> | 2022-07-23 00:55:19 +0300 |
commit | 82bb1fd2417786c7f352614d0bdc9c63c6994493 (patch) | |
tree | f709089134a1f754d1c76c349cc72b2fbeddc4ed | |
parent | 77d767872ad5393bcec12e76f101761d1515a973 (diff) | |
parent | 87b7f2683f4c45d3fc320c01b3af16665f45d1a2 (diff) |
Merge pull request #33253 from nextcloud/backport/32963/stable23
[stable23] also use nextcloud certificate bundle when downloading from s3
-rw-r--r-- | lib/private/Files/ObjectStore/S3ConnectionTrait.php | 31 | ||||
-rw-r--r-- | lib/private/Files/ObjectStore/S3ObjectTrait.php | 5 |
2 files changed, 24 insertions, 12 deletions
diff --git a/lib/private/Files/ObjectStore/S3ConnectionTrait.php b/lib/private/Files/ObjectStore/S3ConnectionTrait.php index 03166ab1d7e..088e9aa8d3f 100644 --- a/lib/private/Files/ObjectStore/S3ConnectionTrait.php +++ b/lib/private/Files/ObjectStore/S3ConnectionTrait.php @@ -28,6 +28,7 @@ * along with this program. If not, see <http://www.gnu.org/licenses/>. * */ + namespace OC\Files\ObjectStore; use Aws\ClientResolver; @@ -122,15 +123,6 @@ trait S3ConnectionTrait { ) ); - // since we store the certificate bundles on the primary storage, we can't get the bundle while setting up the primary storage - if (!isset($this->params['primary_storage'])) { - /** @var ICertificateManager $certManager */ - $certManager = \OC::$server->get(ICertificateManager::class); - $certPath = $certManager->getAbsoluteBundlePath(); - } else { - $certPath = \OC::$SERVERROOT . '/resources/config/ca-bundle.crt'; - } - $options = [ 'version' => isset($this->params['version']) ? $this->params['version'] : 'latest', 'credentials' => $provider, @@ -140,7 +132,7 @@ trait S3ConnectionTrait { 'signature_provider' => \Aws\or_chain([self::class, 'legacySignatureProvider'], ClientResolver::_default_signature_provider()), 'csm' => false, 'use_arn_region' => false, - 'http' => ['verify' => $certPath], + 'http' => ['verify' => $this->getCertificateBundlePath()], ]; if ($this->getProxy()) { $options['http']['proxy'] = $this->getProxy(); @@ -153,7 +145,7 @@ trait S3ConnectionTrait { if (!$this->connection::isBucketDnsCompatible($this->bucket)) { $logger = \OC::$server->getLogger(); $logger->debug('Bucket "' . $this->bucket . '" This bucket name is not dns compatible, it may contain invalid characters.', - ['app' => 'objectstore']); + ['app' => 'objectstore']); } if ($this->params['verify_bucket_exists'] && !$this->connection->doesBucketExist($this->bucket)) { @@ -205,7 +197,7 @@ trait S3ConnectionTrait { /** * This function creates a credential provider based on user parameter file */ - protected function paramCredentialProvider() : callable { + protected function paramCredentialProvider(): callable { return function () { $key = empty($this->params['key']) ? null : $this->params['key']; $secret = empty($this->params['secret']) ? null : $this->params['secret']; @@ -220,4 +212,19 @@ trait S3ConnectionTrait { return new RejectedPromise(new CredentialsException($msg)); }; } + + protected function getCertificateBundlePath(): ?string { + if ((int)($this->params['use_nextcloud_bundle'] ?? "0")) { + // since we store the certificate bundles on the primary storage, we can't get the bundle while setting up the primary storage + if (!isset($this->params['primary_storage'])) { + /** @var ICertificateManager $certManager */ + $certManager = \OC::$server->get(ICertificateManager::class); + return $certManager->getAbsoluteBundlePath(); + } else { + return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt'; + } + } else { + return null; + } + } } diff --git a/lib/private/Files/ObjectStore/S3ObjectTrait.php b/lib/private/Files/ObjectStore/S3ObjectTrait.php index cdaa202dbe8..a92c5c139ea 100644 --- a/lib/private/Files/ObjectStore/S3ObjectTrait.php +++ b/lib/private/Files/ObjectStore/S3ObjectTrait.php @@ -43,6 +43,8 @@ trait S3ObjectTrait { */ abstract protected function getConnection(); + abstract protected function getCertificateBundlePath(): ?string; + /** * @param string $urn the unified resource name used to identify the object * @return resource stream with the read data @@ -68,6 +70,9 @@ trait S3ObjectTrait { 'protocol_version' => $request->getProtocolVersion(), 'header' => $headers, ], + 'ssl' => [ + 'cafile' => $this->getCertificateBundlePath() + ] ]; if ($this->getProxy()) { |