)]}'
{"swift/common/middleware/decrypter.py":[{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":149,"context_line":"        # This is setup to do more header modifications in a later version"},{"line_number":150,"context_line":"        mod_hdr_keys \u003d []"},{"line_number":151,"context_line":"        mod_hdr_pairs \u003d []"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"        hkey \u003d \u0027Etag\u0027"},{"line_number":154,"context_line":"        try:"},{"line_number":155,"context_line":"            cm_e_hdr \u003d \"%scrypto-meta-etag\" % \\"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_00396ad8","line":152,"updated":"2015-07-30 15:16:33.000000000","message":"The logic that follows is good but repetitive, just trying to see if there\u0027s any way we can encapsulate some of the logic, its tricky because the etag / ct are handled slightly different for the container and object.  At a minimum I think we can combine the container handling which is identical for both the etag / ct ?","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":149,"context_line":"        # This is setup to do more header modifications in a later version"},{"line_number":150,"context_line":"        mod_hdr_keys \u003d []"},{"line_number":151,"context_line":"        mod_hdr_pairs \u003d []"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"        hkey \u003d \u0027Etag\u0027"},{"line_number":154,"context_line":"        try:"},{"line_number":155,"context_line":"            cm_e_hdr \u003d \"%scrypto-meta-etag\" % \\"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_c017ebeb","line":152,"in_reply_to":"3a50d1a3_00396ad8","updated":"2015-08-18 18:06:15.000000000","message":"it turns out that the etag stuff is a little different than the content-type.  I added comments for etag, and made a method for conent-type, since it is more of normal case - if we do begin to decrypt more headers that are not user-meta","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":191,"context_line":"        mod_hdr_pairs.append((hkey, decrypt_header_val("},{"line_number":192,"context_line":"            self.decrypter.crypto, self.decrypter.logger,"},{"line_number":193,"context_line":"            be_etag_withMeta, keys[\u0027container\u0027], value_has_meta\u003dTrue)))"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"        # process all user metadata"},{"line_number":196,"context_line":"        server_type \u003d \u0027object\u0027"},{"line_number":197,"context_line":"        for hdr, value in self._response_headers:"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_19a49cb7","line":194,"updated":"2015-07-30 15:16:33.000000000","message":"Potentially create a function to encapsulate the logic below like we do on the encryption side ? (process_user_metadata)","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":191,"context_line":"        mod_hdr_pairs.append((hkey, decrypt_header_val("},{"line_number":192,"context_line":"            self.decrypter.crypto, self.decrypter.logger,"},{"line_number":193,"context_line":"            be_etag_withMeta, keys[\u0027container\u0027], value_has_meta\u003dTrue)))"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"        # process all user metadata"},{"line_number":196,"context_line":"        server_type \u003d \u0027object\u0027"},{"line_number":197,"context_line":"        for hdr, value in self._response_headers:"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_20b027dd","line":194,"in_reply_to":"3a50d1a3_19a49cb7","updated":"2015-08-18 18:06:15.000000000","message":"done.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":248,"context_line":""},{"line_number":249,"context_line":""},{"line_number":250,"context_line":"def decrypt_header_val(crypto, logger, value, key, iv\u003dNone,"},{"line_number":251,"context_line":"                       crypto_meta_st\u003dNone, value_has_meta\u003dFalse,"},{"line_number":252,"context_line":"                       decode\u003dTrue):"},{"line_number":253,"context_line":"    \"\"\""},{"line_number":254,"context_line":"    Either iv is given, or a crypto_meta_st must be provided in order to"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_4980fdf7","line":251,"updated":"2015-07-30 15:16:33.000000000","message":"So when crypto_meta_st is supplied I believe it has to already be decoded, add this to the doc ?","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":248,"context_line":""},{"line_number":249,"context_line":""},{"line_number":250,"context_line":"def decrypt_header_val(crypto, logger, value, key, iv\u003dNone,"},{"line_number":251,"context_line":"                       crypto_meta_st\u003dNone, value_has_meta\u003dFalse,"},{"line_number":252,"context_line":"                       decode\u003dTrue):"},{"line_number":253,"context_line":"    \"\"\""},{"line_number":254,"context_line":"    Either iv is given, or a crypto_meta_st must be provided in order to"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_e03f8f23","line":251,"in_reply_to":"3a50d1a3_4980fdf7","updated":"2015-08-18 18:06:15.000000000","message":"done.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":251,"context_line":"                       crypto_meta_st\u003dNone, value_has_meta\u003dFalse,"},{"line_number":252,"context_line":"                       decode\u003dTrue):"},{"line_number":253,"context_line":"    \"\"\""},{"line_number":254,"context_line":"    Either iv is given, or a crypto_meta_st must be provided in order to"},{"line_number":255,"context_line":"    parse for cipher and iv."},{"line_number":256,"context_line":"    if value_has_meta True, then do not supply a crypto_meta_st"},{"line_number":257,"context_line":"    if iv is supplied directly, then don\u0027t supply crypto_meta_st"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_e0d6bef0","line":254,"updated":"2015-07-30 15:16:33.000000000","message":"For clarity I would add \"or a crypto_meta_st must be provided (either directly through crypto_meta or as part of value).","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":251,"context_line":"                       crypto_meta_st\u003dNone, value_has_meta\u003dFalse,"},{"line_number":252,"context_line":"                       decode\u003dTrue):"},{"line_number":253,"context_line":"    \"\"\""},{"line_number":254,"context_line":"    Either iv is given, or a crypto_meta_st must be provided in order to"},{"line_number":255,"context_line":"    parse for cipher and iv."},{"line_number":256,"context_line":"    if value_has_meta True, then do not supply a crypto_meta_st"},{"line_number":257,"context_line":"    if iv is supplied directly, then don\u0027t supply crypto_meta_st"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_40119bab","line":254,"in_reply_to":"3a50d1a3_e0d6bef0","updated":"2015-08-18 18:06:15.000000000","message":"done.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":260,"context_line":"        return \u0027\u0027"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    enc_val \u003d value"},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"    if not iv and not crypto_meta_st:"},{"line_number":265,"context_line":"        if value_has_meta:"},{"line_number":266,"context_line":"            if decode:"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_00240ac4","line":263,"updated":"2015-07-30 15:16:33.000000000","message":"Should we check the precondition (i.e. IF value_has_meta \u003d\u003e !crypto_meta_st) i.e. to make sure they\u0027re not both set.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":260,"context_line":"        return \u0027\u0027"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    enc_val \u003d value"},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"    if not iv and not crypto_meta_st:"},{"line_number":265,"context_line":"        if value_has_meta:"},{"line_number":266,"context_line":"            if decode:"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_4088bbe7","line":263,"in_reply_to":"3a50d1a3_00240ac4","updated":"2015-08-18 18:06:15.000000000","message":"Removed check on iv or crypto_meta_st so that if they are both set, then value_has_meta will be used.  This would seem to be the strongest binding that a value would have to its crypto_meta, so I think it is ok to go with that one.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":268,"context_line":"                    enc_val \u003d base64.b64decode(value)"},{"line_number":269,"context_line":"                    decode \u003d False"},{"line_number":270,"context_line":"                except TypeError:"},{"line_number":271,"context_line":"                    # TODO - determine if falling here is ever acceptable"},{"line_number":272,"context_line":"                    logger.debug(\"Couldn\u0027t decode %s.  Will not decrypt.\" %"},{"line_number":273,"context_line":"                                 value)"},{"line_number":274,"context_line":"                    return value"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_83c5840b","line":271,"updated":"2015-07-30 15:16:33.000000000","message":"hmm this doesn\u0027t look safe as is ? (i.e. to catch the error and return the original value), probably better to just raise this exception ?  I can\u0027t think of a case where this wouldn\u0027t cause a problem namely because wouldn\u0027t be able to differentiate the case where the decryption worked and when it didn\u0027t.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":268,"context_line":"                    enc_val \u003d base64.b64decode(value)"},{"line_number":269,"context_line":"                    decode \u003d False"},{"line_number":270,"context_line":"                except TypeError:"},{"line_number":271,"context_line":"                    # TODO - determine if falling here is ever acceptable"},{"line_number":272,"context_line":"                    logger.debug(\"Couldn\u0027t decode %s.  Will not decrypt.\" %"},{"line_number":273,"context_line":"                                 value)"},{"line_number":274,"context_line":"                    return value"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_0c0ae021","line":271,"in_reply_to":"3a50d1a3_83c5840b","updated":"2015-08-18 18:06:15.000000000","message":"This is a work-around that needs to be looked into.  There are functional tests that fall into this case because the content-type is not encrypted.  There is a trello card for this work: \"Address error handling for the content_type not being encrypted/encoded, and address related functests\"","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":287,"context_line":""},{"line_number":288,"context_line":"    if crypto_meta_st:"},{"line_number":289,"context_line":"        # TODO - ok to use ast.literal_eval?  If not, what else to use?"},{"line_number":290,"context_line":"        crypto_meta \u003d ast.literal_eval(crypto_meta_st)"},{"line_number":291,"context_line":""},{"line_number":292,"context_line":"        if crypto_meta:"},{"line_number":293,"context_line":"            iv \u003d crypto_meta[\u0027iv\u0027]"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_d41b4072","line":290,"updated":"2015-07-30 15:16:33.000000000","message":"The other option just being \u0027eval\u0027, it seems literal_eval may throw an exception if there is invalid txt, but still looking into that.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":287,"context_line":""},{"line_number":288,"context_line":"    if crypto_meta_st:"},{"line_number":289,"context_line":"        # TODO - ok to use ast.literal_eval?  If not, what else to use?"},{"line_number":290,"context_line":"        crypto_meta \u003d ast.literal_eval(crypto_meta_st)"},{"line_number":291,"context_line":""},{"line_number":292,"context_line":"        if crypto_meta:"},{"line_number":293,"context_line":"            iv \u003d crypto_meta[\u0027iv\u0027]"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_73bfdbd0","line":290,"in_reply_to":"3a50d1a3_d41b4072","updated":"2015-08-18 18:06:15.000000000","message":"Well, I think I will stick with literal_eval given that people have said eval is \"evil\".","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":304,"context_line":""},{"line_number":305,"context_line":"            if \u0027tail\u0027 in crypto_meta:"},{"line_number":306,"context_line":"                # Then glue together the hdr val with the tail for whole val"},{"line_number":307,"context_line":"                second_part \u003d crypto_meta.get(\u0027tail\u0027, \u0027\u0027)"},{"line_number":308,"context_line":"                enc_val \u003d base64.b64decode(enc_val + second_part)"},{"line_number":309,"context_line":"            else:"},{"line_number":310,"context_line":"                if decode:"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_8fd12532","line":307,"updated":"2015-07-30 15:16:33.000000000","message":"For the decode below why no try block (like there is when tail isn\u0027t included) ?","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":304,"context_line":""},{"line_number":305,"context_line":"            if \u0027tail\u0027 in crypto_meta:"},{"line_number":306,"context_line":"                # Then glue together the hdr val with the tail for whole val"},{"line_number":307,"context_line":"                second_part \u003d crypto_meta.get(\u0027tail\u0027, \u0027\u0027)"},{"line_number":308,"context_line":"                enc_val \u003d base64.b64decode(enc_val + second_part)"},{"line_number":309,"context_line":"            else:"},{"line_number":310,"context_line":"                if decode:"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_339e4357","line":307,"in_reply_to":"3a50d1a3_8fd12532","updated":"2015-08-18 18:06:15.000000000","message":"because I dont think we should be getting a TypeError in any case.  There is a functest flow that reaches the one place where we cannot decode.  I need to debug that.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":305,"context_line":"            if \u0027tail\u0027 in crypto_meta:"},{"line_number":306,"context_line":"                # Then glue together the hdr val with the tail for whole val"},{"line_number":307,"context_line":"                second_part \u003d crypto_meta.get(\u0027tail\u0027, \u0027\u0027)"},{"line_number":308,"context_line":"                enc_val \u003d base64.b64decode(enc_val + second_part)"},{"line_number":309,"context_line":"            else:"},{"line_number":310,"context_line":"                if decode:"},{"line_number":311,"context_line":"                    try:"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_ef50e9d6","line":308,"updated":"2015-07-30 15:16:33.000000000","message":"hmm, doesn\u0027t the caller decode the entire crypto_meta_st implying the tail will also be decoded at this point.  I agree enc_val needs to be decoded, but what about the second_part (which is from the crypto meta headers) ?\n\nIf I\u0027m wrong (which is probably the case ; - )  Some comments to clarify the details will probably help.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":305,"context_line":"            if \u0027tail\u0027 in crypto_meta:"},{"line_number":306,"context_line":"                # Then glue together the hdr val with the tail for whole val"},{"line_number":307,"context_line":"                second_part \u003d crypto_meta.get(\u0027tail\u0027, \u0027\u0027)"},{"line_number":308,"context_line":"                enc_val \u003d base64.b64decode(enc_val + second_part)"},{"line_number":309,"context_line":"            else:"},{"line_number":310,"context_line":"                if decode:"},{"line_number":311,"context_line":"                    try:"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_93c4ef40","line":308,"in_reply_to":"3a50d1a3_ef50e9d6","updated":"2015-08-18 18:06:15.000000000","message":"it is the encoding of the value to begin with that causes the overflow, and then the crypto-meta around it is just ascii.  I added comments.  Although, the tail part will probably eventually go away anyway, as you know.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":314,"context_line":"                    except TypeError:"},{"line_number":315,"context_line":"                        # TODO - determine if falling here is ever acceptable"},{"line_number":316,"context_line":"                        # it happens in tests.TestFile testMetadataOnPost"},{"line_number":317,"context_line":"                        logger.debug(\"Couldn\u0027t decode %s.  Will not decrypt.\" %"},{"line_number":318,"context_line":"                                     enc_val)"},{"line_number":319,"context_line":"                        return enc_val"},{"line_number":320,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_8fb845ea","line":317,"updated":"2015-07-30 15:16:33.000000000","message":"Same comment as earlier, caller won\u0027t be able to tell the difference between successful decrypt or not.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":314,"context_line":"                    except TypeError:"},{"line_number":315,"context_line":"                        # TODO - determine if falling here is ever acceptable"},{"line_number":316,"context_line":"                        # it happens in tests.TestFile testMetadataOnPost"},{"line_number":317,"context_line":"                        logger.debug(\"Couldn\u0027t decode %s.  Will not decrypt.\" %"},{"line_number":318,"context_line":"                                     enc_val)"},{"line_number":319,"context_line":"                        return enc_val"},{"line_number":320,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_8cc5903d","line":317,"in_reply_to":"3a50d1a3_8fb845ea","updated":"2015-08-18 18:06:15.000000000","message":"I changed the comment to mention there is a trello card to look into this","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"edf9b68e14cfd83b7f69883658ee3aebee61e326","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    :param crypto_meta_st: already decoded crypto-meta string"},{"line_number":54,"context_line":"    :param value_has_meta: true if the value string includes crypto_meta"},{"line_number":55,"context_line":"    :param decode: whether or not to decode the value"},{"line_number":56,"context_line":"    \"\"\""},{"line_number":57,"context_line":"    if not value:"},{"line_number":58,"context_line":"        return \u0027\u0027"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"fa80f949_31dcf8e3","line":56,"updated":"2015-11-04 16:13:50.000000000","message":"param doc strings need to reflect the current parameters. There are only 4  in this updated version.","commit_id":"fe21e58f32ef17973f926c6054df8e416012ab41"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"fe0ee9edd62b2fef6a6d76b05c37ade8293e9f57","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    :param crypto_meta_st: already decoded crypto-meta string"},{"line_number":54,"context_line":"    :param value_has_meta: true if the value string includes crypto_meta"},{"line_number":55,"context_line":"    :param decode: whether or not to decode the value"},{"line_number":56,"context_line":"    \"\"\""},{"line_number":57,"context_line":"    if not value:"},{"line_number":58,"context_line":"        return \u0027\u0027"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"fa80f949_93cb5e53","line":56,"in_reply_to":"fa80f949_31dcf8e3","updated":"2015-11-04 17:12:51.000000000","message":"Done","commit_id":"fe21e58f32ef17973f926c6054df8e416012ab41"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"edf9b68e14cfd83b7f69883658ee3aebee61e326","unresolved":false,"context_lines":[{"line_number":152,"context_line":"            # TODO: figure out how to make this decrypt conditional on"},{"line_number":153,"context_line":"            # content-type itself being encrypted, and independent of the etag"},{"line_number":154,"context_line":"            # crypto_meta condition, e.g. by making decrypt_header_val return"},{"line_number":155,"context_line":"            # original value of no crypto_meta can be found appended to value"},{"line_number":156,"context_line":"            try:"},{"line_number":157,"context_line":"                mod_hdr_pairs.append((\u0027Content-Type\u0027, decrypt_header_val("},{"line_number":158,"context_line":"                    self.crypto, ctype, keys[self.server_type], None)))"}],"source_content_type":"text/x-python","patch_set":19,"id":"fa80f949_7917c651","line":155,"updated":"2015-11-04 16:13:50.000000000","message":"Content-type will always be encrypted I suppose? In that case, can we move this out of etag crypto_meta condition?","commit_id":"fe21e58f32ef17973f926c6054df8e416012ab41"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"fe0ee9edd62b2fef6a6d76b05c37ade8293e9f57","unresolved":false,"context_lines":[{"line_number":152,"context_line":"            # TODO: figure out how to make this decrypt conditional on"},{"line_number":153,"context_line":"            # content-type itself being encrypted, and independent of the etag"},{"line_number":154,"context_line":"            # crypto_meta condition, e.g. by making decrypt_header_val return"},{"line_number":155,"context_line":"            # original value of no crypto_meta can be found appended to value"},{"line_number":156,"context_line":"            try:"},{"line_number":157,"context_line":"                mod_hdr_pairs.append((\u0027Content-Type\u0027, decrypt_header_val("},{"line_number":158,"context_line":"                    self.crypto, ctype, keys[self.server_type], None)))"}],"source_content_type":"text/x-python","patch_set":19,"id":"fa80f949_93559e51","line":155,"in_reply_to":"fa80f949_7917c651","updated":"2015-11-04 17:12:51.000000000","message":"Well...right now content-type is not always encrypted, for example when no content-type is included with a PUT then the proxy will insert one AFTER encryption. This is fixed here https://review.openstack.org/232572\n\nAlso, in future it may be possible to modify content-type on a POST, and the POST may not get encrypted if the crypto middleware is missing at that moment in time.\n\nBut I cleaned this up somewhat in next version.","commit_id":"fe21e58f32ef17973f926c6054df8e416012ab41"}],"swift/common/middleware/encrypter.py":[{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":108,"context_line":"        req \u003d Request(env)"},{"line_number":109,"context_line":"        server_type \u003d \u0027object\u0027"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        # encode body crypto-meta because of the IV"},{"line_number":112,"context_line":"        cm_hdr \u003d \"%scrypto-meta\" % get_obj_persisted_sysmeta_prefix()"},{"line_number":113,"context_line":"        req.headers[cm_hdr] \u003d \\"},{"line_number":114,"context_line":"            base64.b64encode(str(body_crypto_meta))"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_4fbd8baf","line":111,"updated":"2015-07-30 15:16:33.000000000","message":"Maybe be a bit more specific here (i.e. all metadata must be UTF-8 strings and the IV is not at this point).","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":108,"context_line":"        req \u003d Request(env)"},{"line_number":109,"context_line":"        server_type \u003d \u0027object\u0027"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        # encode body crypto-meta because of the IV"},{"line_number":112,"context_line":"        cm_hdr \u003d \"%scrypto-meta\" % get_obj_persisted_sysmeta_prefix()"},{"line_number":113,"context_line":"        req.headers[cm_hdr] \u003d \\"},{"line_number":114,"context_line":"            base64.b64encode(str(body_crypto_meta))"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_02cb87a6","line":111,"in_reply_to":"3a50d1a3_4fbd8baf","updated":"2015-08-18 18:06:15.000000000","message":"Done","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        # encode body crypto-meta because of the IV"},{"line_number":112,"context_line":"        cm_hdr \u003d \"%scrypto-meta\" % get_obj_persisted_sysmeta_prefix()"},{"line_number":113,"context_line":"        req.headers[cm_hdr] \u003d \\"},{"line_number":114,"context_line":"            base64.b64encode(str(body_crypto_meta))"},{"line_number":115,"context_line":"        ct \u003d req.headers[\u0027Content-Type\u0027]"},{"line_number":116,"context_line":"        if ct:"},{"line_number":117,"context_line":"            ct_iv \u003d self.encrypter.crypto.create_iv()"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_24bce104","line":114,"updated":"2015-07-30 15:16:33.000000000","message":"Given we do this in several places I wonder if we should create our own encode / decode wrapper to encapsulate this ?","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        # encode body crypto-meta because of the IV"},{"line_number":112,"context_line":"        cm_hdr \u003d \"%scrypto-meta\" % get_obj_persisted_sysmeta_prefix()"},{"line_number":113,"context_line":"        req.headers[cm_hdr] \u003d \\"},{"line_number":114,"context_line":"            base64.b64encode(str(body_crypto_meta))"},{"line_number":115,"context_line":"        ct \u003d req.headers[\u0027Content-Type\u0027]"},{"line_number":116,"context_line":"        if ct:"},{"line_number":117,"context_line":"            ct_iv \u003d self.encrypter.crypto.create_iv()"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_225c8bec","line":114,"in_reply_to":"3a50d1a3_24bce104","updated":"2015-08-18 18:06:15.000000000","message":"to encapsulate encode(str(val))?","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":119,"context_line":"                ct_iv, self.encrypter.crypto.get_cipher())"},{"line_number":120,"context_line":"            req.headers[\u0027Content-Type\u0027], junk \u003d encrypt_header_val("},{"line_number":121,"context_line":"                self.encrypter.crypto, ct,"},{"line_number":122,"context_line":"                keys[server_type], ct_crypto_meta, restrict_length\u003dFalse,"},{"line_number":123,"context_line":"                append_crypto_meta\u003dFalse)"},{"line_number":124,"context_line":"            cm_ct_hdr \u003d \"%scrypto-meta-ct\" % get_obj_persisted_sysmeta_prefix()"},{"line_number":125,"context_line":"            req.headers[cm_ct_hdr] \u003d \\"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_173235f2","line":122,"updated":"2015-07-30 15:16:33.000000000","message":"Curious so with this approach is there any way to user different keys for the metadata ?  I think it needs to match the object as is ?","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":119,"context_line":"                ct_iv, self.encrypter.crypto.get_cipher())"},{"line_number":120,"context_line":"            req.headers[\u0027Content-Type\u0027], junk \u003d encrypt_header_val("},{"line_number":121,"context_line":"                self.encrypter.crypto, ct,"},{"line_number":122,"context_line":"                keys[server_type], ct_crypto_meta, restrict_length\u003dFalse,"},{"line_number":123,"context_line":"                append_crypto_meta\u003dFalse)"},{"line_number":124,"context_line":"            cm_ct_hdr \u003d \"%scrypto-meta-ct\" % get_obj_persisted_sysmeta_prefix()"},{"line_number":125,"context_line":"            req.headers[cm_ct_hdr] \u003d \\"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_422dff44","line":122,"in_reply_to":"3a50d1a3_173235f2","updated":"2015-08-18 18:06:15.000000000","message":"correct, the interface with the keymaster does not allow for specifying body versus headers at this point.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                append_crypto_meta\u003dFalse)"},{"line_number":124,"context_line":"            cm_ct_hdr \u003d \"%scrypto-meta-ct\" % get_obj_persisted_sysmeta_prefix()"},{"line_number":125,"context_line":"            req.headers[cm_ct_hdr] \u003d \\"},{"line_number":126,"context_line":"                base64.b64encode(str(ct_crypto_meta))"},{"line_number":127,"context_line":"            self.logger.debug(\"encrypted Content-Type: %s\" %"},{"line_number":128,"context_line":"                              req.headers[\u0027Content-Type\u0027])"},{"line_number":129,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_5a746466","line":126,"updated":"2015-07-30 15:16:33.000000000","message":"This can fit on one line ; )","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                append_crypto_meta\u003dFalse)"},{"line_number":124,"context_line":"            cm_ct_hdr \u003d \"%scrypto-meta-ct\" % get_obj_persisted_sysmeta_prefix()"},{"line_number":125,"context_line":"            req.headers[cm_ct_hdr] \u003d \\"},{"line_number":126,"context_line":"                base64.b64encode(str(ct_crypto_meta))"},{"line_number":127,"context_line":"            self.logger.debug(\"encrypted Content-Type: %s\" %"},{"line_number":128,"context_line":"                              req.headers[\u0027Content-Type\u0027])"},{"line_number":129,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_42d41f1f","line":126,"in_reply_to":"3a50d1a3_5a746466","updated":"2015-08-18 18:06:15.000000000","message":"Done","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":127,"context_line":"            self.logger.debug(\"encrypted Content-Type: %s\" %"},{"line_number":128,"context_line":"                              req.headers[\u0027Content-Type\u0027])"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"            be_ct_key \u003d \u0027X-Backend-Container-Update-Override-Content-Type\u0027"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"            if \u0027container\u0027 not in keys:"},{"line_number":133,"context_line":"                self.logger.error(\u0027Error: no container key to encrypt\u0027)"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_950cfdec","line":130,"updated":"2015-07-30 15:16:33.000000000","message":"I think a small comment explaining why we encrypt the CT with the container key here would help and how the X-Backend-Container... header is used on the object server side (i.e. to update the container CT / and the container\u0027s encr metadata headers to decrypt).","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":127,"context_line":"            self.logger.debug(\"encrypted Content-Type: %s\" %"},{"line_number":128,"context_line":"                              req.headers[\u0027Content-Type\u0027])"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"            be_ct_key \u003d \u0027X-Backend-Container-Update-Override-Content-Type\u0027"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"            if \u0027container\u0027 not in keys:"},{"line_number":133,"context_line":"                self.logger.error(\u0027Error: no container key to encrypt\u0027)"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_38483e87","line":130,"in_reply_to":"3a50d1a3_950cfdec","updated":"2015-08-18 18:06:15.000000000","message":"Done","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":139,"context_line":"                ct_crypto_meta, restrict_length\u003dFalse,"},{"line_number":140,"context_line":"                append_crypto_meta\u003dTrue)"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"            self.logger.debug(\"encrypted %s: %s\" %"},{"line_number":143,"context_line":"                              (be_ct_key, req.headers[be_ct_key]))"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"        # process all user metadata"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_109d5b65","line":142,"updated":"2015-07-30 15:16:33.000000000","message":"May help to add encrypted with cont (and for the debug msg above encrypted with obj) just for clarity : )","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":139,"context_line":"                ct_crypto_meta, restrict_length\u003dFalse,"},{"line_number":140,"context_line":"                append_crypto_meta\u003dTrue)"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"            self.logger.debug(\"encrypted %s: %s\" %"},{"line_number":143,"context_line":"                              (be_ct_key, req.headers[be_ct_key]))"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"        # process all user metadata"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_1813fa67","line":142,"in_reply_to":"3a50d1a3_109d5b65","updated":"2015-08-18 18:06:15.000000000","message":"Done","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"def encrypt_header_val(crypto, value, key, crypto_meta,"},{"line_number":202,"context_line":"                       restrict_length\u003dTrue, append_crypto_meta\u003dFalse):"},{"line_number":203,"context_line":"    \"\"\""},{"line_number":204,"context_line":"    encrypt, add crypto meta if supplied, encode."},{"line_number":205,"context_line":"    append_crypto_meta True: append the crypto_meta to the value."}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_31041217","line":202,"updated":"2015-07-30 15:16:33.000000000","message":"I was debating suggesting breaking this into 2 functions, one for encrpytion and one for encoding but not sure that gets us much.\n\nI\u0027d add that restrict_length adds extra data to a new key \u0027tail\u0027 in the returned crypto_meta.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"def encrypt_header_val(crypto, value, key, crypto_meta,"},{"line_number":202,"context_line":"                       restrict_length\u003dTrue, append_crypto_meta\u003dFalse):"},{"line_number":203,"context_line":"    \"\"\""},{"line_number":204,"context_line":"    encrypt, add crypto meta if supplied, encode."},{"line_number":205,"context_line":"    append_crypto_meta True: append the crypto_meta to the value."}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_b319cf7b","line":202,"in_reply_to":"3a50d1a3_31041217","updated":"2015-08-18 18:06:15.000000000","message":"Done","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":223,"context_line":"        # Note: don\u0027t use this method if the value\u0027s length will be restricted"},{"line_number":224,"context_line":"        enc_val \u003d \u0027%s; meta\u003d%s\u0027 % (enc_val, crypto_meta)"},{"line_number":225,"context_line":"        enc_val \u003d base64.b64encode(enc_val)"},{"line_number":226,"context_line":"    elif restrict_length:"},{"line_number":227,"context_line":"        enc_val \u003d base64.b64encode(enc_val)"},{"line_number":228,"context_line":"        full_crypto_meta \u003d crypto_meta.copy()"},{"line_number":229,"context_line":"        # Set a sysmeta crypto-meta hdr"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_518e7ed1","line":226,"updated":"2015-07-30 15:16:33.000000000","message":"I think it may help to explain this section in a comment (and potentially update the function docstring):  The encryption process (being AES CTR) will not change the input size, but encoding can, and what we\u0027re trying to do is if the result of the encoding \u003e original cipher text \u003d\u003d plain text, store excess in a new crypto meta \u0027tail\u0027 key.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":223,"context_line":"        # Note: don\u0027t use this method if the value\u0027s length will be restricted"},{"line_number":224,"context_line":"        enc_val \u003d \u0027%s; meta\u003d%s\u0027 % (enc_val, crypto_meta)"},{"line_number":225,"context_line":"        enc_val \u003d base64.b64encode(enc_val)"},{"line_number":226,"context_line":"    elif restrict_length:"},{"line_number":227,"context_line":"        enc_val \u003d base64.b64encode(enc_val)"},{"line_number":228,"context_line":"        full_crypto_meta \u003d crypto_meta.copy()"},{"line_number":229,"context_line":"        # Set a sysmeta crypto-meta hdr"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_33729fae","line":226,"in_reply_to":"3a50d1a3_518e7ed1","updated":"2015-08-18 18:06:15.000000000","message":"Done","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":260,"context_line":"                iv, crypto.get_cipher())"},{"line_number":261,"context_line":"            req.headers[hdr], full_crypto_meta \u003d encrypt_header_val("},{"line_number":262,"context_line":"                crypto, req.headers[hdr], keys[server_type],"},{"line_number":263,"context_line":"                crypto_meta)"},{"line_number":264,"context_line":"            short_name \u003d strip_user_meta_prefix(server_type, hdr)"},{"line_number":265,"context_line":"            req.headers[prefix + short_name] \u003d \\"},{"line_number":266,"context_line":"                base64.b64encode(str(full_crypto_meta))"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_032aed2f","line":263,"updated":"2015-07-30 15:16:33.000000000","message":"Add a small comment here (i.e. we\u0027re extracting the user specified portion of the header key and appending it to the caller supplied user encryption metadata header).","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":260,"context_line":"                iv, crypto.get_cipher())"},{"line_number":261,"context_line":"            req.headers[hdr], full_crypto_meta \u003d encrypt_header_val("},{"line_number":262,"context_line":"                crypto, req.headers[hdr], keys[server_type],"},{"line_number":263,"context_line":"                crypto_meta)"},{"line_number":264,"context_line":"            short_name \u003d strip_user_meta_prefix(server_type, hdr)"},{"line_number":265,"context_line":"            req.headers[prefix + short_name] \u003d \\"},{"line_number":266,"context_line":"                base64.b64encode(str(full_crypto_meta))"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_7330179f","line":263,"in_reply_to":"3a50d1a3_032aed2f","updated":"2015-08-18 18:06:15.000000000","message":"Done","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":318,"context_line":""},{"line_number":319,"context_line":"            # Encrypt the plaintext etag using the object key"},{"line_number":320,"context_line":"            # and save-off that crypto-meta"},{"line_number":321,"context_line":"            plaintext_etag_oek, junk \u003d encrypt_header_val("},{"line_number":322,"context_line":"                self.crypto, self.plaintext_etag, self.keys[\u0027object\u0027],"},{"line_number":323,"context_line":"                etag_crypto_meta, restrict_length\u003dFalse,"},{"line_number":324,"context_line":"                append_crypto_meta\u003dFalse)"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_e39b4165","line":321,"updated":"2015-07-30 15:16:33.000000000","message":"I think oek will confuse folks, maybe just be verbose (obj_key).","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":318,"context_line":""},{"line_number":319,"context_line":"            # Encrypt the plaintext etag using the object key"},{"line_number":320,"context_line":"            # and save-off that crypto-meta"},{"line_number":321,"context_line":"            plaintext_etag_oek, junk \u003d encrypt_header_val("},{"line_number":322,"context_line":"                self.crypto, self.plaintext_etag, self.keys[\u0027object\u0027],"},{"line_number":323,"context_line":"                etag_crypto_meta, restrict_length\u003dFalse,"},{"line_number":324,"context_line":"                append_crypto_meta\u003dFalse)"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_f31c2715","line":321,"in_reply_to":"3a50d1a3_e39b4165","updated":"2015-08-18 18:06:15.000000000","message":"idk, that would make for a very long name.  I added a comment instead.","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":17156,"name":"Hamdi Roumani","email":"roumani@ca.ibm.com","username":"hroumani"},"change_message_id":"80ba3e5804206b441d9495bd951042036e095e69","unresolved":false,"context_lines":[{"line_number":331,"context_line":""},{"line_number":332,"context_line":"            # Encrypt the plaintext etag using the container key"},{"line_number":333,"context_line":"            # and save crypto-meta - ok to re-use iv because its a diff key"},{"line_number":334,"context_line":"            plaintext_etag_cek, junk \u003d encrypt_header_val("},{"line_number":335,"context_line":"                self.crypto, self.plaintext_etag, self.keys[\u0027container\u0027],"},{"line_number":336,"context_line":"                etag_crypto_meta, restrict_length\u003dFalse,"},{"line_number":337,"context_line":"                append_crypto_meta\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a50d1a3_a3cc5962","line":334,"updated":"2015-07-30 15:16:33.000000000","message":"...etag_cont_key","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"bb8c2b4542645998f3f16dc71d315277f8fbaf5f","unresolved":false,"context_lines":[{"line_number":331,"context_line":""},{"line_number":332,"context_line":"            # Encrypt the plaintext etag using the container key"},{"line_number":333,"context_line":"            # and save crypto-meta - ok to re-use iv because its a diff key"},{"line_number":334,"context_line":"            plaintext_etag_cek, junk \u003d encrypt_header_val("},{"line_number":335,"context_line":"                self.crypto, self.plaintext_etag, self.keys[\u0027container\u0027],"},{"line_number":336,"context_line":"                etag_crypto_meta, restrict_length\u003dFalse,"},{"line_number":337,"context_line":"                append_crypto_meta\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":6,"id":"fa1b9901_d3e803e5","line":334,"in_reply_to":"3a50d1a3_a3cc5962","updated":"2015-08-18 18:06:15.000000000","message":"Done","commit_id":"be1be230fd1b8336cee10312a1cb185d8e5f575c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"d7bacecb19d8083923b5a627dd1c1f8415f4299b","unresolved":false,"context_lines":[{"line_number":257,"context_line":"                    hdr.lower().startswith("},{"line_number":258,"context_line":"                        \u0027X-Backend-Container-Update-Override-\u0027):"},{"line_number":259,"context_line":"                req.headers.pop(hdr, None)"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"        # If override is set in env, then just pass along"},{"line_number":262,"context_line":"        # If not PUT or POST, then just pass along"},{"line_number":263,"context_line":"        if config_true_value(env.get(\u0027swift.crypto.override\u0027)) or \\"}],"source_content_type":"text/x-python","patch_set":13,"id":"ba15a1d1_cac64549","line":260,"updated":"2015-09-20 02:09:05.000000000","message":"oops - I need to lower case the backend hdr","commit_id":"b0b69126853e31d7751773226293a4ac412c287c"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"48b9aaa70a90c9edb3c83e8fffce5ee078245029","unresolved":false,"context_lines":[{"line_number":162,"context_line":"                    self.crypto, val, keys[self.server_type])"},{"line_number":163,"context_line":"                # short_name is extracted in order to use it for"},{"line_number":164,"context_line":"                # naming the corresponding crypto-meta"},{"line_number":165,"context_line":"                # TODO this will clash with e.g. X-Object-Meta-Content-Type"},{"line_number":166,"context_line":"                short_name \u003d strip_user_meta_prefix(self.server_type, name)"},{"line_number":167,"context_line":"                req.headers[prefix + short_name] \u003d full_crypto_meta"},{"line_number":168,"context_line":"                self.logger.debug(\"encrypted user meta %s: %s\""}],"source_content_type":"text/x-python","patch_set":19,"id":"fa80f949_70683088","line":165,"updated":"2015-11-05 03:20:12.000000000","message":"ok, note to self: check to see if the etag crypto-meta follows the same naming convention (content-type wont be storing crypto-meta any longer)","commit_id":"fe21e58f32ef17973f926c6054df8e416012ab41"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"100410ec57b99774ccf80cd663f4d71301dc7638","unresolved":false,"context_lines":[{"line_number":162,"context_line":"                    self.crypto, val, keys[self.server_type])"},{"line_number":163,"context_line":"                # short_name is extracted in order to use it for"},{"line_number":164,"context_line":"                # naming the corresponding crypto-meta"},{"line_number":165,"context_line":"                # TODO this will clash with e.g. X-Object-Meta-Content-Type"},{"line_number":166,"context_line":"                short_name \u003d strip_user_meta_prefix(self.server_type, name)"},{"line_number":167,"context_line":"                req.headers[prefix + short_name] \u003d full_crypto_meta"},{"line_number":168,"context_line":"                self.logger.debug(\"encrypted user meta %s: %s\""}],"source_content_type":"text/x-python","patch_set":19,"id":"fa80f949_c9ea7cac","line":165,"in_reply_to":"fa80f949_70683088","updated":"2015-11-05 09:32:09.000000000","message":"I think it has the same problem - revised the comment in next version.\n\nI ended up thinking we should do the same thing for the etag and content-type for object sysmeta as we do for the container update, ie do the append trick. That avoids any naming conflicts.","commit_id":"fe21e58f32ef17973f926c6054df8e416012ab41"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"48b9aaa70a90c9edb3c83e8fffce5ee078245029","unresolved":false,"context_lines":[{"line_number":172,"context_line":"        content_type \u003d req.headers.get(\u0027Content-Type\u0027)"},{"line_number":173,"context_line":"        if content_type:"},{"line_number":174,"context_line":"            if \u0027container\u0027 not in keys:"},{"line_number":175,"context_line":"                # TODO fail somewhere else, earlier, or not at all"},{"line_number":176,"context_line":"                self.logger.error(\u0027Error: no container key to encrypt\u0027)"},{"line_number":177,"context_line":"                raise HTTPUnprocessableEntity(request\u003dreq)"},{"line_number":178,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"fa80f949_1899e66e","line":175,"updated":"2015-11-05 03:20:12.000000000","message":"I tend to like only failing if the container key is really needed.  If we put it somewhere apart from this logic, it might be a maintenance issue if this is ever changed to not require a container key.  \n\nAlthough, isn\u0027t the container key needed for an etag as well?  Maybe in this case, it would make sense to have one check earlier.","commit_id":"fe21e58f32ef17973f926c6054df8e416012ab41"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"48b9aaa70a90c9edb3c83e8fffce5ee078245029","unresolved":false,"context_lines":[{"line_number":221,"context_line":"                                      self._response_headers)"},{"line_number":222,"context_line":"            mod_resp_headers.append((\u0027etag\u0027, enc_input_proxy.plaintext_etag))"},{"line_number":223,"context_line":"        else:"},{"line_number":224,"context_line":"            # TODO: can this ever be true? If not, remove the if clause"},{"line_number":225,"context_line":"            pass"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        start_response(self._response_status, mod_resp_headers,"}],"source_content_type":"text/x-python","patch_set":19,"id":"fa80f949_b89c5a6a","line":224,"updated":"2015-11-05 03:20:12.000000000","message":"weird, I thought this check had been removed.  i will take a peek to see if maybe there was a bad merge.  or maybe it was removed in another spot ...","commit_id":"fe21e58f32ef17973f926c6054df8e416012ab41"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"100410ec57b99774ccf80cd663f4d71301dc7638","unresolved":false,"context_lines":[{"line_number":221,"context_line":"                                      self._response_headers)"},{"line_number":222,"context_line":"            mod_resp_headers.append((\u0027etag\u0027, enc_input_proxy.plaintext_etag))"},{"line_number":223,"context_line":"        else:"},{"line_number":224,"context_line":"            # TODO: can this ever be true? If not, remove the if clause"},{"line_number":225,"context_line":"            pass"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        start_response(self._response_status, mod_resp_headers,"}],"source_content_type":"text/x-python","patch_set":19,"id":"fa80f949_e98f4021","line":224,"in_reply_to":"fa80f949_b89c5a6a","updated":"2015-11-05 09:32:09.000000000","message":"ok, well the TODO will act as a reminder to clarify this.","commit_id":"fe21e58f32ef17973f926c6054df8e416012ab41"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"50b88dcb0df5e6f8823a1f4ae36c6d94351c83d5","unresolved":false,"context_lines":[{"line_number":202,"context_line":"            # key and use it to override the container update value, with the"},{"line_number":203,"context_line":"            # crypto parameters appended."},{"line_number":204,"context_line":"            # val, _ \u003d encrypt_header_val("},{"line_number":205,"context_line":"            #     self.crypto, ct, keys[\u0027container\u0027], append_crypto_meta\u003dTrue)"},{"line_number":206,"context_line":"            val \u003d content_type"},{"line_number":207,"context_line":"            name \u003d \u0027X-Backend-Container-Update-Override-Content-Type\u0027"},{"line_number":208,"context_line":"            req.headers[name] \u003d val"}],"source_content_type":"text/x-python","patch_set":20,"id":"fa80f949_c7882e25","line":205,"updated":"2015-11-05 03:21:16.000000000","message":"I see, it makes sense to only do this part in the container listing patch, right?","commit_id":"acc2754d09e60629c993b9fc949e12e609e8ee4e"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"2988b01c25990544f13dbd7085cdd6ba74a0f704","unresolved":false,"context_lines":[{"line_number":202,"context_line":"            # key and use it to override the container update value, with the"},{"line_number":203,"context_line":"            # crypto parameters appended."},{"line_number":204,"context_line":"            # val, _ \u003d encrypt_header_val("},{"line_number":205,"context_line":"            #     self.crypto, ct, keys[\u0027container\u0027], append_crypto_meta\u003dTrue)"},{"line_number":206,"context_line":"            val \u003d content_type"},{"line_number":207,"context_line":"            name \u003d \u0027X-Backend-Container-Update-Override-Content-Type\u0027"},{"line_number":208,"context_line":"            req.headers[name] \u003d val"}],"source_content_type":"text/x-python","patch_set":20,"id":"fa80f949_e92c204c","line":205,"in_reply_to":"fa80f949_c7882e25","updated":"2015-11-05 09:26:23.000000000","message":"yes. if this was on master i would insist on deleting rather than the TODO, but we know we are going to need this.\n\nAnd it may have cleared up some of the test failures???","commit_id":"acc2754d09e60629c993b9fc949e12e609e8ee4e"}],"test/unit/common/middleware/test_decrypter.py":[{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"50b88dcb0df5e6f8823a1f4ae36c6d94351c83d5","unresolved":false,"context_lines":[{"line_number":186,"context_line":"        # check that content_type is not decrypted if it does not have crypto"},{"line_number":187,"context_line":"        # meta (testing for future cases where content_type may be updated"},{"line_number":188,"context_line":"        # as part of an unencrypted POST)."},{"line_number":189,"context_line":"        env \u003d {\u0027REQUEST_METHOD\u0027: method,"},{"line_number":190,"context_line":"               \u0027swift.crypto.fetch_crypto_keys\u0027: fetch_crypto_keys}"},{"line_number":191,"context_line":"        req \u003d Request.blank(\u0027/v1/a/c/o\u0027, environ\u003denv)"},{"line_number":192,"context_line":"        body \u003d \u0027FAKE APP\u0027"}],"source_content_type":"text/x-python","patch_set":20,"id":"fa80f949_72d90283","line":189,"updated":"2015-11-05 03:21:16.000000000","message":"thanks for these new tests!","commit_id":"acc2754d09e60629c993b9fc949e12e609e8ee4e"}],"test/unit/common/middleware/test_encrypter.py":[{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"d7bacecb19d8083923b5a627dd1c1f8415f4299b","unresolved":false,"context_lines":[{"line_number":339,"context_line":"        for h, v in headers:"},{"line_number":340,"context_line":"            if h.lower().startswith(cm_hdr) or \\"},{"line_number":341,"context_line":"                    h.lower().startswith("},{"line_number":342,"context_line":"                        \u0027X-Backend-Container-Update-Override-\u0027):"},{"line_number":343,"context_line":"                self.fail(\"Crypto headers should have been removed\")"},{"line_number":344,"context_line":""},{"line_number":345,"context_line":"    def test_multiseg_no_client_etag(self, fake_get_crpyto):"}],"source_content_type":"text/x-python","patch_set":13,"id":"ba15a1d1_0aebddb1","line":342,"updated":"2015-09-20 02:09:05.000000000","message":"will be changing this to lower case","commit_id":"b0b69126853e31d7751773226293a4ac412c287c"}]}