also use nextcloud certificate bundle when downloading from s3

Signed-off-by: Robin Appelman <robin@icewind.nl>

diff --git a/lib/private/Files/ObjectStore/S3ConnectionTrait.php b/lib/private/Files/ObjectStore/S3ConnectionTrait.php
index 03166ab1d7e0fde10ee7d25b1c5ba20ae1ec45f2..d38f553fdf67cc4f44201e11cd96213307db76f6 100644 (file)
--- a/lib/private/Files/ObjectStore/S3ConnectionTrait.php
+++ b/lib/private/Files/ObjectStore/S3ConnectionTrait.php
@@ -122,15 +122,6 @@ trait S3ConnectionTrait {
                        )
                );
 
-               // since we store the certificate bundles on the primary storage, we can't get the bundle while setting up the primary storage
-               if (!isset($this->params['primary_storage'])) {
-                       /** @var ICertificateManager $certManager */
-                       $certManager = \OC::$server->get(ICertificateManager::class);
-                       $certPath = $certManager->getAbsoluteBundlePath();
-               } else {
-                       $certPath = \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
-               }
-
                $options = [
                        'version' => isset($this->params['version']) ? $this->params['version'] : 'latest',
                        'credentials' => $provider,
@@ -140,7 +131,7 @@ trait S3ConnectionTrait {
                        'signature_provider' => \Aws\or_chain([self::class, 'legacySignatureProvider'], ClientResolver::_default_signature_provider()),
                        'csm' => false,
                        'use_arn_region' => false,
-                       'http' => ['verify' => $certPath],
+                       'http' => ['verify' => $this->getCertificateBundlePath()],
                ];
                if ($this->getProxy()) {
                        $options['http']['proxy'] = $this->getProxy();
@@ -220,4 +211,15 @@ trait S3ConnectionTrait {
                        return new RejectedPromise(new CredentialsException($msg));
                };
        }
+
+       protected function getCertificateBundlePath(): string {
+               // since we store the certificate bundles on the primary storage, we can't get the bundle while setting up the primary storage
+               if (!isset($this->params['primary_storage'])) {
+                       /** @var ICertificateManager $certManager */
+                       $certManager = \OC::$server->get(ICertificateManager::class);
+                       return $certManager->getAbsoluteBundlePath();
+               } else {
+                       return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
+               }
+       }
 }

diff --git a/lib/private/Files/ObjectStore/S3ObjectTrait.php b/lib/private/Files/ObjectStore/S3ObjectTrait.php
index cdaa202dbe8c307e32849c07a4a0e179f1f6785b..9a2f5b2c6df55b9680fda1d88e03dc0afcdbd4e3 100644 (file)
--- a/lib/private/Files/ObjectStore/S3ObjectTrait.php
+++ b/lib/private/Files/ObjectStore/S3ObjectTrait.php
@@ -43,6 +43,8 @@ trait S3ObjectTrait {
         */
        abstract protected function getConnection();
 
+       abstract protected function getCertificateBundlePath(): string;
+
        /**
         * @param string $urn the unified resource name used to identify the object
         * @return resource stream with the read data
@@ -68,6 +70,9 @@ trait S3ObjectTrait {
                                        'protocol_version' => $request->getProtocolVersion(),
                                        'header' => $headers,
                                ],
+                               'ssl' => [
+                                       'cafile' => $this->getCertificateBundlePath()
+                               ]
                        ];
 
                        if ($this->getProxy()) {