rados gateway computes wrong AWS4 signature if canonical request contains the tilde (~) character
I have been debugging a IBM client not able to use the rados gateway, because the AWS4 signature was never verified correctly.
Looking at the requests from the client, in the requests parameter I have something with the tilde (~)
But when I look into the radosgw debug log I see:
The Rados gateway is doing something wrong with the specification:
Do not URI-encode any of the unreserved characters that RFC 3986 defines: A-Z, a-z, 0-9, hyphen ( - ), underscore ( _ ), period ( . ), and tilde ( ~ ).
To reproduce this problem you can use this sample code:
From the debug log of the radosgw extract all the strings you need to use them in python code.
If you print the "signature" variable, using ~ or %7E in the string "canonical_querystring" you can see the exact match, you will get 1 time the value calculated by the client and 1 time the value calculated by the rados gateway.
#4 Updated by Matt Benjamin almost 2 years ago
- Status changed from Triaged to Need Test
Could you please review the comments for http://tracker.ceph.com/issues/22731, which may overlap? A candidate fix for the issue I did reproduce against v10.2.10 has a candidate backport PR.