Project

General

Profile

Actions
Copy link

Bug #61783

closed

SwiftAPI Keystone integration - public buckets do not work

Added by Michal Nasiadka 10 months ago. Updated 3 months ago.

Status:
Won't Fix
Priority:
Normal
Assignee:
-
Target version:
-
% Done:

0%

Source:
Tags:
Backport:
Regression:
No
Severity:
2 - major
Reviewed:
Affected Versions:
Ceph - v17.2.6
ceph-qa-suite:
Pull request ID:
Crash signature (v1):
Crash signature (v2):

Description

Bucket 'test' created:
% swift stat -v test
URL: https://object.[obfuscated]/swift/v1/AUTH_9acf6c6ce98947749fce7db3ded3084a/test
Auth Token: [obfuscated]
Account: AUTH_9acf6c6ce98947749fce7db3ded3084a
Container: test
Objects: 1
Bytes: 16
Read ACL: .r:*,.rlistings
Write ACL:
Sync To:
Sync Key:
X-Timestamp: 1687509913.12552
X-Container-Bytes-Used-Actual: 4096
X-Storage-Policy: default-placement
X-Storage-Class: STANDARD
Last-Modified: Fri, 23 Jun 2023 08:45:13 GMT
X-Trans-Id: tx00000bec42f988913de18-006495bdb3-a18516b-akl-1
X-Openstack-Request-Id: tx00000bec42f988913de18-006495bdb3-a18516b-akl-1
Accept-Ranges: bytes
Content-Type: text/plain; charset=utf-8

Anonymous get of an uploaded file returns NoSuchBucket:

% curl -vvv https://object.[obfuscated]/swift/v1/AUTH_9acf6c6ce98947749fce7db3ded3084a/test/test.txt !10080
  • Trying 163.7.176.2:443...
  • Connected to object.[obfuscated] (163.7.176.2) port 443 (#0)
  • ALPN: offers h2,http/1.1
  • (304) (OUT), TLS handshake, Client hello (1):
  • CAfile: /etc/ssl/cert.pem
  • CApath: none
  • (304) (IN), TLS handshake, Server hello (2):
  • (304) (IN), TLS handshake, Unknown (8):
  • (304) (IN), TLS handshake, Certificate (11):
  • (304) (IN), TLS handshake, CERT verify (15):
  • (304) (IN), TLS handshake, Finished (20):
  • (304) (OUT), TLS handshake, Finished (20):
  • SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
  • ALPN: server did not agree on a protocol. Uses default.
  • Server certificate:
  • subject: CN=*.[obfuscated]
  • start date: Sep 29 00:00:00 2022 GMT
  • expire date: Oct 29 23:59:59 2023 GMT
  • subjectAltName: host "object.[obfuscated]" matched cert's "*.[obfuscated]"
  • issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Domain Validation Secure Server CA
  • SSL certificate verify ok.
  • using HTTP/1.x

GET /swift/v1/AUTH_9acf6c6ce98947749fce7db3ded3084a/test/test.txt HTTP/1.1
Host: object.[obfuscated]
User-Agent: curl/7.88.1
Accept: */*

< HTTP/1.1 404 Not Found
< content-length: 12
< x-trans-id: tx00000784d2c09c3d99c88-006495bde0-a18516b-akl-1
< x-openstack-request-id: tx00000784d2c09c3d99c88-006495bde0-a18516b-akl-1
< accept-ranges: bytes
< content-type: text/plain; charset=utf-8
< date: Fri, 23 Jun 2023 15:44:32 GMT
<
  • Connection #0 to host object.[obfuscated] left intact
    NoSuchBucket%

Authenticated get works:

  • Trying 163.7.176.2:443...
  • Connected to object.[obfuscated] (163.7.176.2) port 443 (#0)
  • ALPN: offers h2,http/1.1
  • (304) (OUT), TLS handshake, Client hello (1):
  • CAfile: /etc/ssl/cert.pem
  • CApath: none
  • (304) (IN), TLS handshake, Server hello (2):
  • (304) (IN), TLS handshake, Unknown (8):
  • (304) (IN), TLS handshake, Certificate (11):
  • (304) (IN), TLS handshake, CERT verify (15):
  • (304) (IN), TLS handshake, Finished (20):
  • (304) (OUT), TLS handshake, Finished (20):
  • SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
  • ALPN: server did not agree on a protocol. Uses default.
  • Server certificate:
  • subject: CN=*.[obfuscated]
  • start date: Sep 29 00:00:00 2022 GMT
  • expire date: Oct 29 23:59:59 2023 GMT
  • subjectAltName: host "object.[obfuscated]" matched cert's "*.[obfuscated]"
  • issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Domain Validation Secure Server CA
  • SSL certificate verify ok.
  • using HTTP/1.x

GET /swift/v1/AUTH_9acf6c6ce98947749fce7db3ded3084a/test/test.txt HTTP/1.1
Host: object.[obfuscated]
User-Agent: curl/7.88.1
Accept: */*
X-Auth-Token: gAAAAABklbw25gXkNbGp8oDbgQ4juJjL3SwgXluKWrag4Cb-g2W-IvM8fykUNPWHxTJIIaRH9ybqqd9uuqT_w1_ke_oP9N9dazKyCEdU7260YhGeQe8vF_XqZdIGuqCtJ0sT5NTtFC1ldXOLTUGNJsnq0Zte2jTPN6JHsv3jPD4eP5-3zmK_ZiU

< HTTP/1.1 200 OK
< content-length: 16
< accept-ranges: bytes
< last-modified: Fri, 23 Jun 2023 08:49:55 GMT
< x-timestamp: 1687510195.39287
< etag: ebb83d1996c77e440ccfad81bae70770
< x-object-meta-mtime: 1687510169.373385
< x-trans-id: tx00000ef6a27ab870001c9-006495be0c-a18516b-akl-1
< x-openstack-request-id: tx00000ef6a27ab870001c9-006495be0c-a18516b-akl-1
< content-type: text/plain
< date: Fri, 23 Jun 2023 15:45:16 GMT
<
test_file_swift

RGW logs (debug = 20):

Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 HTTP_ACCEPT=*/*
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 HTTP_HOST=object.[obfuscated]
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 HTTP_USER_AGENT=curl/7.88.1
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 HTTP_VERSION=1.1
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 HTTP_X_FORWARDED_FOR=80.49.32.100
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 HTTP_X_FORWARDED_PROTO=https
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 REMOTE_ADDR=10.66.0.3
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 REQUEST_METHOD=GET
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 REQUEST_URI=/swift/v1/AUTH_9acf6c6ce98947749fce7db3ded3084a/test/test.txt
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 SCRIPT_URI=/swift/v1/AUTH_9acf6c6ce98947749fce7db3ded3084a/test/test.txt
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 SERVER_PORT=8000
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 1 ====== starting new request req=0x7fd4cb1cc710 =====
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 2 req 7088700053492734350 0.000000000s initializing for trans_id = tx0000062601f241fba198e-006495beeb-a18516b-akl-1
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 10 req 7088700053492734350 0.000000000s rgw api priority: s3=4 s3website=-1
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 10 req 7088700053492734350 0.000000000s host=object.[obfuscated]
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s subdomain= domain= in_hosted_domain=0 in_hosted_domain_s3website=0
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s final domain/bucket subdomain= domain= in_hosted_domain=0 in_hosted_domain_s3website=0 s->info.domain= s->info.request_uri=/swift/v1/AUTH_9acf6c6ce98947749fce7db3ded3084a/test/test.txt
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 10 req 7088700053492734350 0.000000000s ver=v1 first=test req=test.txt
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 10 req 7088700053492734350 0.000000000s handler=25RGWHandler_REST_Obj_SWIFT
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 2 req 7088700053492734350 0.000000000s getting op 0
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s get_system_obj_state: rctx=0x7fd4cb1cb790 obj=akl-1.rgw.log:script.prerequest. state=0x563d772fe2e0 s->prefetch_data=0
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 10 req 7088700053492734350 0.000000000s cache get: name=akl-1.rgw.log++script.prerequest. : hit (negative entry)
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 10 req 7088700053492734350 0.000000000s swift:get_obj scheduling with throttler client=2 cost=1
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 10 req 7088700053492734350 0.000000000s swift:get_obj op=24RGWGetObj_ObjStore_SWIFT
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 2 req 7088700053492734350 0.000000000s swift:get_obj verifying requester
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s swift:get_obj rgw::auth::swift::DefaultStrategy: trying rgw::auth::swift::TempURLEngine
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s swift:get_obj rgw::auth::swift::TempURLEngine denied with reason=-13
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s swift:get_obj rgw::auth::swift::DefaultStrategy: trying rgw::auth::swift::SignedTokenEngine
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s swift:get_obj rgw::auth::swift::SignedTokenEngine denied with reason=-1
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s swift:get_obj rgw::auth::swift::DefaultStrategy: trying rgw::auth::keystone::TokenEngine
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s swift:get_obj rgw::auth::keystone::TokenEngine denied with reason=-13
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s swift:get_obj rgw::auth::swift::DefaultStrategy: trying rgw::auth::swift::SwiftAnonymousEngine
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s swift:get_obj rgw::auth::swift::SwiftAnonymousEngine granted access
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 2 req 7088700053492734350 0.000000000s swift:get_obj normalizing buckets and tenants
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 10 req 7088700053492734350 0.000000000s s->object=test.txt s->bucket=9acf6c6ce98947749fce7db3ded3084a/test
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 2 req 7088700053492734350 0.000000000s swift:get_obj init permissions
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s swift:get_obj get_system_obj_state: rctx=0x7fd4cb1cb1a0 obj=akl-1.rgw.meta:root:9acf6c6ce98947749fce7db3ded3084a/test state=0x563d772fe2e0 s->prefetch_data=0
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 10 req 7088700053492734350 0.000000000s swift:get_obj cache get: name=akl-1.rgw.meta+root+9acf6c6ce98947749fce7db3ded3084a/test : hit (negative entry)
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 10 req 7088700053492734350 0.000000000s swift:get_obj init_permissions on <NULL> failed, ret=-2002
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 1 req 7088700053492734350 0.000000000s op->ERRORHANDLER: err_no=-2002 new_err_no=-2002
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 20 req 7088700053492734350 0.000000000s get_system_obj_state: rctx=0x7fd4cb1cb790 obj=akl-1.rgw.log:script.postrequest.9acf6c6ce98947749fce7db3ded3084a state=0x563d772fe2e0 s->prefetch_data=0
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 10 req 7088700053492734350 0.000000000s cache get: name=akl-1.rgw.log++script.postrequest.9acf6c6ce98947749fce7db3ded3084a : hit (negative entry)
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 2 req 7088700053492734350 0.000000000s swift:get_obj op status=0
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 2 req 7088700053492734350 0.000000000s swift:get_obj http status=404
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 1 ====== req done req=0x7fd4cb1cc710 op status=0 http_status=404 latency=0.000000000s ======
Jun 23 15:48:59 a01ss01 bash1338486: debug 2023-06-23T15:48:59.258+0000 7fd53d2b1700 1 beast: 0x7fd4cb1cc710: 10.66.0.3 - 9acf6c6ce98947749fce7db3ded3084a$anonymous [23/Jun/2023:15:48:59.258 +0000] "GET /swift/v1/AUTH_9acf6c6ce98947749fce7db3ded3084a/test/test.txt HTTP/1.1" 404 12 - "curl/7.88.1" - latency=0.000000000s
Jun 23 15:49:02 a01ss01 bash1338486: debug 2023-06-23T15:49:02.096+0000 7fd5d03f8700 20 rgw notify: INFO: next queues processing will happen at: Fri Jun 23 15:49:32 2023

Actions
Copy link
 #1

Updated by Casey Bodley 10 months ago

  • Status changed from New to Need More Info

i'm not a swift or keystone expert, but my understanding is that swift doesn't have a global namespace of buckets like s3 does. instead, bucket names are isolated by 'tenant'. so a bucket created by an authenticated user in one tenant namespace would not be visible to unauthenticated requests, or to users in other tenants

Actions
Copy link
 #2

Updated by Casey Bodley 3 months ago

  • Status changed from Need More Info to Won't Fix
Actions
Copy link

Also available in: Atom PDF