chore: Merge latest changes from main into SRA I&A

Sources/ClientRuntime/Networking/HashFunction.swift

@@ -5,17 +5,17 @@
 
 import AwsCommonRuntimeKit
 
-enum HashResult {
+public enum HashResult {
     case data(Data)
     case integer(UInt32)
 }
 
-enum HashError: Error {
+public enum HashError: Error {
     case invalidInput
     case hashingFailed(reason: String)
 }
 
-enum HashFunction {
+public enum HashFunction {
     case crc32, crc32c, sha1, sha256, md5
 
     static func from(string: String) -> HashFunction? {
@@ -29,7 +29,29 @@
         }
     }
 
-    var isSupported: Bool {
+    static func fromList(_ stringArray: [String]) -> [HashFunction] {
+        var hashFunctions = [HashFunction]()
+
+        for string in stringArray {
+            if let hashFunction = HashFunction.from(string: string) {
+                hashFunctions.append(hashFunction)
+            }
+        }
+
+        return hashFunctions
+    }
+
+    func toString() -> String {
+        switch self {
+        case .crc32: return "crc32"
+        case .crc32c: return "crc32c"
+        case .sha1: return "sha1"
+        case .sha256: return "sha256"
+        case .md5: return "md5"
+        }
+    }
+
+    var isFlexibleChecksum: Bool {
         switch self {
         case .crc32, .crc32c, .sha256, .sha1:
             return true
@@ -69,6 +91,41 @@
     }
 }
 
+extension HashFunction: Comparable {
+    /*
+     * Priority-order for validating checksum = [ CRC32C, CRC32, SHA1, SHA256 ]
+     * Order is determined by speed of the algorithm's implementation
+     * MD5 is not supported by list ordering
+     */
+    public static func < (lhs: HashFunction, rhs: HashFunction) -> Bool {
+        let order: [HashFunction] = [.crc32c, .crc32, .sha1, .sha256]
+
+        let lhsIndex = order.firstIndex(of: lhs) ?? Int.max
+        let rhsIndex = order.firstIndex(of: rhs) ?? Int.max
+
+        return lhsIndex < rhsIndex
+    }
+}
+
+extension [HashFunction] {
+    func getPriorityOrderValidationList() -> [HashFunction] {
+        // Filter out .md5 if present and then sort the remaining hash functions
+        return self.filter { $0 != .md5 }.sorted()
+    }
+}
+
+extension UInt32 {
+    func toBase64EncodedString() -> String {
+        // Create a Data instance from the UInt32 value
+        var value = self
+        var bigEndianValue = value.bigEndian
+        var data = Data(bytes: &bigEndianValue, count: MemoryLayout<UInt32>.size)
+
+        // Base64 encode the data
+        return data.base64EncodedString()
+    }
+}
+
 extension HashResult {
 
     // Convert a HashResult to a hexadecimal String
@@ -80,4 +137,14 @@
             return String(format: "%08x", integer)
         }
     }
+
+    // Convert a HashResult to a base64-encoded String
+    func toBase64String() -> String {
+        switch self {
+        case .data(let data):
+            return data.base64EncodedString()
+        case .integer(let integer):
+            return integer.toBase64EncodedString()
+        }
+    }
 }

Sources/ClientRuntime/Networking/Http/Middlewares/ContentMD5Middleware.swift

@@ -18,6 +18,11 @@
     Self.MOutput == H.Output,
     Self.Context == H.Context {
 
+        // Skip MD5 hash if using checksums
+        if (input.headers.exists(name: "x-amz-sdk-checksum-algorithm")) {
+            return try await next.handle(context: context, input: input)
+        }
+
         switch input.body {
         case .data(let data):
             guard let data else {

Sources/ClientRuntime/Networking/Http/Middlewares/FlexibleChecksumsRequestMiddleware.swift

@@ -0,0 +1,87 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0.
+
+public struct FlexibleChecksumsRequestMiddleware<OperationStackInput, OperationStackOutput>: Middleware {
+
+    public let id: String = "FlexibleChecksumsRequestMiddleware"
+
+    let checksumAlgorithm: String?
+
+    public init(checksumAlgorithm: String?) {
+        self.checksumAlgorithm = checksumAlgorithm
+    }
+
+    public func handle<H>(context: Context,
+                          input: SerializeStepInput<OperationStackInput>,
+                          next: H) async throws -> OperationOutput<OperationStackOutput>
+    where H: Handler,
+    Self.MInput == H.Input,
+    Self.MOutput == H.Output,
+    Self.Context == H.Context {
+
+        // Initialize logger
+        guard let logger = context.getLogger() else {
+            throw ClientError.unknownError("No logger found!")
+        }
+
+        guard let checksumString = checksumAlgorithm else {
+            logger.info("No checksum provided! Skipping flexible checksums workflow...")
+            return try await next.handle(context: context, input: input)
+        }
+
+        guard let checksumHashFunction = HashFunction.from(string: checksumString) else {
+            logger.info("Found no supported checksums! Skipping flexible checksums workflow...")
+            return try await next.handle(context: context, input: input)
+        }
+
+        // Determine the header name
+        let headerName = "x-amz-checksum-\(checksumHashFunction)"
+        logger.debug("Resolved checksum header name: \(headerName)")
+
+        // Get the request
+        let request = input.builder
+
+        func handleNormalPayload(_ data: Data?) throws {
+
+            // Check if any checksum header is already provided by the user
+            let checksumHeaderPrefix = "x-amz-checksum-"
+            if request.headers.headers.contains(where: { $0.name.lowercased().starts(with: checksumHeaderPrefix) }) {
+                logger.debug("Checksum header already provided by the user. Skipping calculation.")
+                return
+            }
+
+            guard let data else {
+                throw ClientError.dataNotFound("Cannot calculate checksum of empty body!")
+            }
+
+            if input.builder.headers.value(for: headerName) == nil {
+                logger.debug("Calculating checksum")
+            }
+
+            let checksum = try checksumHashFunction.computeHash(of: data).toBase64String()
+
+            request.updateHeader(name: headerName, value: [checksum])
+        }
+
+        func handleStreamPayload(_ stream: Stream) throws {
+            logger.error("Stream payloads are not yet supported with flexible checksums!")
+            return
+        }
+
+        // Handle body vs handle stream
+        switch request.body {
+        case .data(let data):
+            try handleNormalPayload(data)
+        case .stream(let stream):
+            try handleStreamPayload(stream)
+        case .noStream:
+            throw ClientError.dataNotFound("Cannot calculate the checksum of an empty body!")
+        }
+
+        return try await next.handle(context: context, input: input)
+    }
+
+    public typealias MInput = SerializeStepInput<OperationStackInput>
+    public typealias MOutput = OperationOutput<OperationStackOutput>
+    public typealias Context = HttpContext
+}

Sources/ClientRuntime/Networking/Http/Middlewares/FlexibleChecksumsResponseMiddleware.swift

@@ -0,0 +1,115 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0.
+
+public struct FlexibleChecksumsResponseMiddleware<OperationStackOutput>: Middleware {
+
+    public let id: String = "FlexibleChecksumsResponseMiddleware"
+
+    // The priority to validate response checksums, if multiple are present
+    let CHECKSUM_HEADER_VALIDATION_PRIORITY_LIST: [String] = [
+        HashFunction.crc32c,
+        .crc32,
+        .sha1,
+        .sha256
+    ].map { $0.toString() }
+
+    let validationMode: Bool
+
+    public init(validationMode: Bool) {
+        self.validationMode = validationMode
+    }
+
+    public func handle<H>(context: Context,
+                          input: SdkHttpRequest,
+                          next: H) async throws -> OperationOutput<OperationStackOutput>
+    where H: Handler,
+    Self.MInput == H.Input,
+    Self.MOutput == H.Output,
+    Self.Context == H.Context {
+
+        // The name of the checksum header which was validated. If `null`, validation was not performed.
+        context.attributes.set(key: AttributeKey<String>(name: "ChecksumHeaderValidated"), value: nil)
+
+        // Initialize logger
+        guard let logger = context.getLogger() else {
+            throw ClientError.unknownError("No logger found!")
+        }
+
+        // Exit if validation should not be performed
+        if !validationMode {
+            logger.info("Checksum validation should not be performed! Skipping workflow...")
+            return try await next.handle(context: context, input: input)
+        }
+
+        // Get the response
+        let response = try await next.handle(context: context, input: input)
+        let httpResponse = response.httpResponse
+
+        // Determine if any checksum headers are present
+        logger.debug("HEADERS: \(httpResponse.headers)")
+        let _checksumHeader = CHECKSUM_HEADER_VALIDATION_PRIORITY_LIST.first {
+            httpResponse.headers.value(for: "x-amz-checksum-\($0)") != nil
+        }
+        guard let checksumHeader = _checksumHeader else {
+            logger.warn(
+                "User requested checksum validation, but the response headers did not contain any valid checksums"
+            )
+            return try await next.handle(context: context, input: input)
+        }
+
+        let fullChecksumHeader = "x-amz-checksum-" + checksumHeader
+
+        // let the user know which checksum will be validated
+        logger.debug("Validating checksum from \(fullChecksumHeader)")
+        context.attributes.set(key: AttributeKey<String>(name: "ChecksumHeaderValidated"), value: fullChecksumHeader)
+
+        let checksumString = checksumHeader.removePrefix("x-amz-checksum-")
+        guard let responseChecksum = HashFunction.from(string: checksumString) else {
+            throw ClientError.dataNotFound("Checksum found in header is not supported!")
+        }
+        guard let expectedChecksum = httpResponse.headers.value(for: fullChecksumHeader) else {
+            throw ClientError.dataNotFound("Could not determine the expected checksum!")
+        }
+
+        func handleNormalPayload(_ data: Data?) throws {
+
+            guard let data else {
+                throw ClientError.dataNotFound("Cannot calculate checksum of empty body!")
+            }
+
+            let calculatedChecksum = try responseChecksum.computeHash(of: data)
+
+            let actualChecksum = calculatedChecksum.toBase64String()
+
+            if expectedChecksum != actualChecksum {
+                throw ChecksumMismatchException.message(
+                    "Checksum mismatch. Expected \(expectedChecksum) but was \(actualChecksum)"
+                )
+            }
+        }
+
+        func handleStreamPayload(_ stream: Stream) throws {
+            return
+        }
+
+        // Handle body vs handle stream
+        switch response.httpResponse.body {
+        case .data(let data):
+            try handleNormalPayload(data)
+        case .stream(let stream):
+            try handleStreamPayload(stream)
+        case .noStream:
+            throw ClientError.dataNotFound("Cannot calculate the checksum of an empty body!")
+        }
+
+        return try await next.handle(context: context, input: input)
+    }
+
+    public typealias MInput = SdkHttpRequest
+    public typealias MOutput = OperationOutput<OperationStackOutput>
+    public typealias Context = HttpContext
+}
+
+enum ChecksumMismatchException: Error {
+    case message(String)
+}