Tempauth Fails with Authorization Header

Bug #1434465 reported by Kota Tsuyuzaki
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Object Storage (swift)
Fix Released
Undecided
Unassigned

Bug Description

When using tempauth, whole requests with Authorization Header (e.g. using S3 API) will always go to fail as 500 InternalError because tempauch calls _get_user_groups method with insufficient arguments.

This has been occurred since 89397c5b679c2ad20f96fc81d8de6b1bf86482a6 (Swift 2.2.2 series)

CVE References

Revision history for this message
Alistair Coles (alistair-coles) wrote :
Changed in swift:
status: New → Confirmed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (master)

Reviewed: https://review.openstack.org/166129
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=9ae0a0702c4a32407b1d00e93bd1be01e2ec26bc
Submitter: Jenkins
Branch: master

commit 9ae0a0702c4a32407b1d00e93bd1be01e2ec26bc
Author: Kota Tsuyuzaki <email address hidden>
Date: Fri Mar 20 00:59:15 2015 -0700

    Fix a lack of method arguments at tempauth

    This fixes a kind of trivial issue with TypeError caused by a lack
    of method argument at calling.

    When using 'Authorization' header with tempauth, tempauth calls
    _get_user_groups with 3 arguments (includes self) on current code
    but the method requires 4 arguments so it will go to fail with 500.

    This patch fixes to take correct arguments and adds an unit test
    for the case.

    Closes-Bug:1434465

    Change-Id: Ibf00c41fa8e5cfdaf49bc4d571e575d7f229ebfe

Changed in swift:
status: Confirmed → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (feature/ec)

Fix proposed to branch: feature/ec
Review: https://review.openstack.org/166558

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on swift (feature/ec)

Change abandoned by paul luse (<email address hidden>) on branch: feature/ec
Review: https://review.openstack.org/166558

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (feature/ec)

Fix proposed to branch: feature/ec
Review: https://review.openstack.org/166606

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on swift (feature/ec)

Change abandoned by paul luse (<email address hidden>) on branch: feature/ec
Review: https://review.openstack.org/166606

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (feature/ec)

Fix proposed to branch: feature/ec
Review: https://review.openstack.org/167004

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on swift (feature/ec)

Change abandoned by John Dickinson (<email address hidden>) on branch: feature/ec
Review: https://review.openstack.org/167004
Reason: bah! didn't work

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (feature/ec)

Fix proposed to branch: feature/ec
Review: https://review.openstack.org/167429

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on swift (feature/ec)

Change abandoned by paul luse (<email address hidden>) on branch: feature/ec
Review: https://review.openstack.org/166558
Reason: in favor of a newer one

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (feature/ec)
Download full text (9.5 KiB)

Reviewed: https://review.openstack.org/167429
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=5b11780a108b6024310efa1b8520b62ca1b318ef
Submitter: Jenkins
Branch: feature/ec

commit a288d05ca5d4c66dab36df40b4216e2ed87e5a91
Author: OpenStack Proposal Bot <email address hidden>
Date: Tue Mar 24 06:06:33 2015 +0000

    Imported Translations from Transifex

    For more information about this automatic import see:
    https://wiki.openstack.org/wiki/Translations/Infrastructure

    Change-Id: I6ae0dd0c34ac1d7173acacdd0dd4896619592e0c

commit 0a467936621009418a9c94f636b33bfb6d947a89
Author: Lorcan <email address hidden>
Date: Thu Mar 12 15:40:39 2015 +0000

    Add swift-recon feature to track swift-drive-audit error count

    This is a follow-on from a previous commit which added recon info
    for swift-drive-audit (https://review.openstack.org/#/c/122468/).

    Here, the "--drievaudit" option is added to swift-recon tool. This
    feature gives the statistics for the system-wide drive errors flagged
    by swift-drive-audit. An example of the output is as follows:
    (verbose mode)

    swift-recon --driveaudit -v
    ===============================================================================
    --> Starting reconnaissance on 5 hosts
    ===============================================================================
    [2015-03-11 17:13:39] Checking drive-audit errors
    -> http://1.2.3.4:6000/recon/driveaudit: {'drive_audit_errors': 14}
    -> http://1.2.3.5:6000/recon/driveaudit: {'drive_audit_errors': 0}
    -> http://1.2.3.6:6000/recon/driveaudit: {'drive_audit_errors': 37}
    -> http://1.2.3.7:6000/recon/driveaudit: {'drive_audit_errors': 101}
    -> http://1.2.3.8:6000/recon/driveaudit: {'drive_audit_errors': 0}
    [drive_audit_errors] low: 0, high: 101, avg: 30.4, total: 152, Failed: 0.0%, no_result: 0, reported: 5
    ===============================================================================

    Change-Id: Ia16c52a9d613eeb3de1a5a428d88dd1233631912

commit 23d0842dec250905f68df601926ba8228392b322
Author: Thiago da Silva <email address hidden>
Date: Tue Feb 17 16:55:34 2015 -0500

    Refactoring the PUT method

    Extracting large chunks of the PUT method into smaller
    methods to improve maintainability and reuse of code.

    Based on the work that Clay Gerrard started:
    https://review.openstack.org/#/c/77812/

    Co-Authored-By: Clay Gerrard <email address hidden>

    Change-Id: Id479fc5b159a2782361ac4a6e4a6d8bbaee4fe85
    Signed-off-by: Thiago da Silva <email address hidden>

commit c3d2602c60d8a218409c9f95bef252e4811cbd29
Author: Mitsuhiro SHIGEMATSU <email address hidden>
Date: Sat Mar 21 08:42:23 2015 +0900

    Fix typo in swift/test/unit/account/test_backend.py

    Change-Id: I6cab110599019471b4005f1584fc26fa2a85d02e

commit 7e64c811fe9ecae738474239a9f73e3c6f95ddea
Author: Alistair Coles <email address hidden>
Date: Wed Feb 25 17:33:44 2015 +0000

    Enable in-process functional test policy to be configured

    Currently the in-process tests build a 2 replica, 4 partition,
    2 device object...

Read more...

Thierry Carrez (ttx)
Changed in swift:
milestone: none → 2.3.0-rc1
status: Fix Committed → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (feature/crypto)

Fix proposed to branch: feature/crypto
Review: https://review.openstack.org/175866

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (feature/crypto)
Download full text (39.4 KiB)

Reviewed: https://review.openstack.org/175866
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=5bb7c286ebb4a54e4d2bd5a02845644d1c651183
Submitter: Jenkins
Branch: feature/crypto

commit e440d6aed8a40848584767ed36811bf09c738838
Author: Kota Tsuyuzaki <email address hidden>
Date: Wed Apr 15 11:25:13 2015 -0700

    Fix best response to return correct status

    Current best response could return "503 Internal Server Error".
    However, "503" means "Service Unavailable". (The status int of
    Internal Server Error is 500)

    This patch fixes the response status as "503 Service Unavailable"

    Change-Id: I88b8c52c26b19e9e76ba3375f1e16ced555ed54c

commit 57011d5699d49a47ae89073ff27b39140ab4d652
Author: Ricardo Ferreira <email address hidden>
Date: Thu Mar 12 23:18:33 2015 +0000

    More user-friendly output for object metadata

    Split out system, user and other metadata in swift-object-info. Print
    every position line by line instead of raw dict representation, so it
    would be easier to parse with tools such as grep.

    Co-Authored-By: Ricardo Ferreira <email address hidden>
    Co-Authored-By: Kamil Rykowski <email address hidden>

    Change-Id: Ia78da518c18f7e26016700aee87efb534fbd2040
    Closes-Bug: #1428866

commit a162c2bdd7be12daa29dd07230f84efcaf1cab37
Author: OpenStack Proposal Bot <email address hidden>
Date: Thu Apr 16 06:06:35 2015 +0000

    Imported Translations from Transifex

    For more information about this automatic import see:
    https://wiki.openstack.org/wiki/Translations/Infrastructure

    Change-Id: I48ba06f4801ff2d7856d67e74d2b1f76c550fcf4

commit 52b102163e48dc04a6a492a3430efa1f7778d7ec
Author: Clay Gerrard <email address hidden>
Date: Wed Apr 15 15:31:06 2015 -0700

    Don't apply the wrong Etag validation to rebuilt fragments

    Because of the object-server's interaction with ssync sender's
    X-Backend-Replication-Headers when a object (or fragment archive) is
    pushed unmodified to another node it's ETag value is duped into the
    recieving ends metadata as Etag. This interacts poorly with the
    reconstructor's RebuildingECDiskFileStream which can not know ahead of
    time the ETag of the fragment archive being rebuilt.

    Don't send the Etag from the local source fragment archive being used as
    the basis for the rebuilt fragent archive's metadata along to ssync.

    Change-Id: Ie59ad93a67a7f439c9a84cd9cff31540f97f334a

commit 46bd6716ffae28aef53f15af170fd2df01b49843
Author: Kota Tsuyuzaki <email address hidden>
Date: Tue Apr 14 23:22:14 2015 -0700

    Small minor refactor on ec diskfile

    To be more helpful, add an inline comment and remove
    unnecessary assignment.

    Change-Id: Ia9c6993dfa03c238736955de8b0f5c1a7d5d1b65

commit 193fe9a5f906a2344bb5d328ad55b881e4086caa
Author: Lorcan <email address hidden>
Date: Wed Apr 15 11:32:32 2015 +0100

    Update swift-recon doc with more options

    The swit-recon tool has had several functional additions
    added recently but not all of these have been added to the docs.

    This change add...

Thierry Carrez (ttx)
Changed in swift:
milestone: 2.3.0-rc1 → 2.3.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.