)]}'
{"swift/common/middleware/crypto/decrypter.py":[{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"b85da72eec55dee20abeaa69ac483de05ab5825d","unresolved":false,"context_lines":[{"line_number":351,"context_line":"                crypto_meta \u003d self.get_crypto_meta("},{"line_number":352,"context_line":"                    \u0027X-Object-Sysmeta-Crypto-Body-Meta\u0027)"},{"line_number":353,"context_line":"            except EncryptionException:"},{"line_number":354,"context_line":"                crypto_meta \u003d None  # Treat bad-crypto as no-crypto"},{"line_number":355,"context_line":"            if crypto_meta:"},{"line_number":356,"context_line":"                mod_resp_headers.append("},{"line_number":357,"context_line":"                    (\u0027X-Backend-Encryption-Body-Is-Encrypted\u0027, \u0027true\u0027))"}],"source_content_type":"text/x-python","patch_set":7,"id":"3a71b18c_59934e4f","line":354,"updated":"2016-12-05 21:04:26.000000000","message":"Great to have the comment here, thanks.","commit_id":"b79e9c6e90334bdb53d6d51665fb3e4a3f383da3"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"b85da72eec55dee20abeaa69ac483de05ab5825d","unresolved":false,"context_lines":[{"line_number":466,"context_line":"            elif req.method in (\u0027HEAD\u0027, \u0027POST\u0027):"},{"line_number":467,"context_line":"                handler \u003d ctx.handle_head_or_post"},{"line_number":468,"context_line":"            else:"},{"line_number":469,"context_line":"                return self.app(env, start_response)"},{"line_number":470,"context_line":"        elif parts[2] and req.method \u003d\u003d \u0027GET\u0027:"},{"line_number":471,"context_line":"            handler \u003d DecrypterContContext(self, self.logger).handle_get"},{"line_number":472,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":7,"id":"3a71b18c_39de9211","line":469,"updated":"2016-12-05 21:04:26.000000000","message":"Nice addition of the else here.","commit_id":"b79e9c6e90334bdb53d6d51665fb3e4a3f383da3"}],"swift/common/middleware/crypto/encrypter.py":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"3268116741c8a740350fd2f6f054636bd19f1794","unresolved":false,"context_lines":[{"line_number":243,"context_line":"        req.environ[\u0027wsgi.input\u0027] \u003d enc_input_proxy"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"        resp \u003d self._app_call(req.environ)"},{"line_number":246,"context_line":"        self._response_headers.append("},{"line_number":247,"context_line":"            (\u0027X-Backend-Encryption-Meta-Is-Encrypted\u0027, \u0027true\u0027))"},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"        # If an etag is in the response headers and a plaintext etag was"}],"source_content_type":"text/x-python","patch_set":1,"id":"bacf61ea_e1d6ecef","line":246,"updated":"2016-07-29 16:13:35.000000000","message":"We should check that there were headers to encrypt before appending this, to make it consistent with the GET/HEAD behavior.","commit_id":"43538b92283c0e883230a5c9ed866d02a991ccdf"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"b85da72eec55dee20abeaa69ac483de05ab5825d","unresolved":false,"context_lines":[{"line_number":281,"context_line":"        keys \u003d self.get_keys(req.environ)"},{"line_number":282,"context_line":"        encrypted_user_meta \u003d self.encrypt_user_metadata(req, keys)"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"        resp \u003d self._app_call(req.environ)"},{"line_number":285,"context_line":"        if encrypted_user_meta:"},{"line_number":286,"context_line":"            self._response_headers.append("},{"line_number":287,"context_line":"                (\u0027X-Backend-Encryption-Meta-Is-Encrypted\u0027, \u0027true\u0027))"}],"source_content_type":"text/x-python","patch_set":7,"id":"3a71b18c_cc3e9ad9","line":284,"updated":"2016-12-05 21:04:26.000000000","message":"Let me see if I have this right: \nThe resp here could be checked for the body crypto_meta as it is in decrypter, but if encryption is disabled, then this logic is not reached.  And that is the only reason that the decrypter needed to add logic to handle the post response.","commit_id":"b79e9c6e90334bdb53d6d51665fb3e4a3f383da3"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"772baf94ff86b2689fa25097059b1dd6b7f9732d","unresolved":false,"context_lines":[{"line_number":281,"context_line":"        keys \u003d self.get_keys(req.environ)"},{"line_number":282,"context_line":"        encrypted_user_meta \u003d self.encrypt_user_metadata(req, keys)"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"        resp \u003d self._app_call(req.environ)"},{"line_number":285,"context_line":"        if encrypted_user_meta:"},{"line_number":286,"context_line":"            self._response_headers.append("},{"line_number":287,"context_line":"                (\u0027X-Backend-Encryption-Meta-Is-Encrypted\u0027, \u0027true\u0027))"}],"source_content_type":"text/x-python","patch_set":7,"id":"5a3905b3_ed79e630","line":284,"in_reply_to":"3a71b18c_cc3e9ad9","updated":"2017-01-26 22:49:04.000000000","message":"Correct; all of this is bypassed when disable_encryption\u003dtrue.","commit_id":"b79e9c6e90334bdb53d6d51665fb3e4a3f383da3"}],"test/unit/common/middleware/crypto/test_encrypter.py":[{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"227dae428428e9e62e50492860bd7c99130dd192","unresolved":false,"context_lines":[{"line_number":548,"context_line":"        self.assertEqual(\u0027202 Accepted\u0027, resp.status)"},{"line_number":549,"context_line":"        self.assertNotIn(\u0027Etag\u0027, resp.headers)"},{"line_number":550,"context_line":"        self.assertNotIn(\u0027X-Backend-Encryption-Body-Is-Encrypted\u0027,"},{"line_number":551,"context_line":"                         resp.headers)"},{"line_number":552,"context_line":"        header \u003d \u0027X-Backend-Encryption-Meta-Is-Encrypted\u0027"},{"line_number":553,"context_line":"        self.assertIn(header, resp.headers)"},{"line_number":554,"context_line":"        self.assertEqual(resp.headers[header], \u0027true\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"bacf61ea_12e9f0e6","line":551,"updated":"2016-07-29 04:46:33.000000000","message":"When using fast-post and performing a POST to an object with an encrypted body, the consuming middleware does not get the Body-is-encrypted flag.  But when using post-as-copy in the same situation, the consuming middleware does see the Body-is-encrypted flag (since the decrypter GET is invoked).\n\nIs it okay to have this difference in behavior?  If so, it should be made clear to the developers of any consuming middleware.  Developer docs might be helpful.  (consider docs for this on the other patch when these are exposed to the client as well)\n\nAlso, it would be nice to have a test for these two cases.  Maybe there is a way to add these tests in test_encryption - especially if the keymaster runs with the \"expose to user\" flag from the other patch.","commit_id":"43538b92283c0e883230a5c9ed866d02a991ccdf"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"3268116741c8a740350fd2f6f054636bd19f1794","unresolved":false,"context_lines":[{"line_number":548,"context_line":"        self.assertEqual(\u0027202 Accepted\u0027, resp.status)"},{"line_number":549,"context_line":"        self.assertNotIn(\u0027Etag\u0027, resp.headers)"},{"line_number":550,"context_line":"        self.assertNotIn(\u0027X-Backend-Encryption-Body-Is-Encrypted\u0027,"},{"line_number":551,"context_line":"                         resp.headers)"},{"line_number":552,"context_line":"        header \u003d \u0027X-Backend-Encryption-Meta-Is-Encrypted\u0027"},{"line_number":553,"context_line":"        self.assertIn(header, resp.headers)"},{"line_number":554,"context_line":"        self.assertEqual(resp.headers[header], \u0027true\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"bacf61ea_81b29004","line":551,"in_reply_to":"bacf61ea_12e9f0e6","updated":"2016-07-29 16:13:35.000000000","message":"With post-as-copy, that body status is coming from the PUT behavior of the encrypter. You can verify this by disabling encryption; GETs/HEADs still report the object is encrypted, but POSTs (and GETs/HEADs following any POSTs) do not.\n\nWe\u0027ll definitely want *some* difference in behavior between post-as-copy and fast-post -- one of those will encrypt unencrypted bodies while the other won\u0027t. It would be nice, though, if we could report the body status even for fast-post. Something like the plan for symlinks is probably in order; see https://review.openstack.org/#/c/232162/33/swift/obj/server.py@625\n\n(Actually, at that point I think we could drop the POST changes to encrypter entirely, and just make sure the POST path for decrypter is rather similar to [or even the same as?] the GET path.)\n\nGood call on updating test_encryption -- I was being too lazy.","commit_id":"43538b92283c0e883230a5c9ed866d02a991ccdf"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"40c9bf074910eda6c434d902bcb701236b92c731","unresolved":false,"context_lines":[{"line_number":548,"context_line":"        self.assertEqual(\u0027202 Accepted\u0027, resp.status)"},{"line_number":549,"context_line":"        self.assertNotIn(\u0027Etag\u0027, resp.headers)"},{"line_number":550,"context_line":"        self.assertNotIn(\u0027X-Backend-Encryption-Body-Is-Encrypted\u0027,"},{"line_number":551,"context_line":"                         resp.headers)"},{"line_number":552,"context_line":"        header \u003d \u0027X-Backend-Encryption-Meta-Is-Encrypted\u0027"},{"line_number":553,"context_line":"        self.assertIn(header, resp.headers)"},{"line_number":554,"context_line":"        self.assertEqual(resp.headers[header], \u0027true\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"bacf61ea_dabc3f08","line":551,"in_reply_to":"bacf61ea_81b29004","updated":"2016-08-01 06:43:34.000000000","message":"I followed you until symlinks ref. But when you say we could drop POST changes to encrypter entirely, did you mean POST changes in this patchset or POST changes altogether? Because if it\u0027s the latter, I don\u0027t see why there wouldn\u0027t be a need to encrypt new user_meta in POST (thereby removing it from what you said)?","commit_id":"43538b92283c0e883230a5c9ed866d02a991ccdf"}],"test/unit/common/middleware/crypto/test_encryption.py":[{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"b85da72eec55dee20abeaa69ac483de05ab5825d","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        header \u003d \u0027X-Backend-Encryption-Body-Is-Encrypted\u0027"},{"line_number":112,"context_line":"        if body_encrypted:"},{"line_number":113,"context_line":"            self.assertIn(header, resp.headers)"},{"line_number":114,"context_line":"            self.assertEqual(resp.headers[header], \u0027true\u0027)"},{"line_number":115,"context_line":"        else:"},{"line_number":116,"context_line":"            self.assertNotIn(header, resp.headers)"}],"source_content_type":"text/x-python","patch_set":7,"id":"3a71b18c_23df0d6a","line":113,"updated":"2016-12-05 21:04:26.000000000","message":"I was wondering if we should verify that the body flag was only there once, but maybe that would be overkill, if not unnecessary.\n\nI looked at what would happen if somebody added the body flag to the resp in the encrypter POST method as well.  Indeed, the body flag is present twice in mod_resp_headers at https://review.openstack.org/#/c/348603/7/swift/common/middleware/crypto/decrypter.py@360.  But something down the pipeline must remove duplicates before it hits the client, because I couldn\u0027t see the duplicates in the client response when testing by hand in this case.","commit_id":"b79e9c6e90334bdb53d6d51665fb3e4a3f383da3"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"772baf94ff86b2689fa25097059b1dd6b7f9732d","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        header \u003d \u0027X-Backend-Encryption-Body-Is-Encrypted\u0027"},{"line_number":112,"context_line":"        if body_encrypted:"},{"line_number":113,"context_line":"            self.assertIn(header, resp.headers)"},{"line_number":114,"context_line":"            self.assertEqual(resp.headers[header], \u0027true\u0027)"},{"line_number":115,"context_line":"        else:"},{"line_number":116,"context_line":"            self.assertNotIn(header, resp.headers)"}],"source_content_type":"text/x-python","patch_set":7,"id":"5a3905b3_cd542a56","line":113,"in_reply_to":"3a71b18c_23df0d6a","updated":"2017-01-26 22:49:04.000000000","message":"I\u0027m willing to bet it\u0027s a call to swob.Request.get_response -- https://github.com/openstack/swift/blob/2.12.0/swift/common/swob.py#L1011 will prevent duplicate keys; whichever one was last in the list should be the only value.","commit_id":"b79e9c6e90334bdb53d6d51665fb3e4a3f383da3"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"b85da72eec55dee20abeaa69ac483de05ab5825d","unresolved":false,"context_lines":[{"line_number":142,"context_line":"        self._check_crypto_status(resp, ("},{"line_number":143,"context_line":"            self._encryption_is_enabled(app)"},{"line_number":144,"context_line":"            if self._post_as_copy_is_enabled(app) else body_was_encrypted,"},{"line_number":145,"context_line":"            self._encryption_is_enabled(app)))"},{"line_number":146,"context_line":"        return resp"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"    def _copy_object(self, app, destination):"}],"source_content_type":"text/x-python","patch_set":7,"id":"3a71b18c_79e9ea7f","line":145,"updated":"2016-12-05 21:04:26.000000000","message":"It might be worth having a comment here so the test can be maintained properly.  Maybe something like \"for fast-post, the body won\u0027t change in a post, so use whether or not the body was already encrypted.\"","commit_id":"b79e9c6e90334bdb53d6d51665fb3e4a3f383da3"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"772baf94ff86b2689fa25097059b1dd6b7f9732d","unresolved":false,"context_lines":[{"line_number":142,"context_line":"        self._check_crypto_status(resp, ("},{"line_number":143,"context_line":"            self._encryption_is_enabled(app)"},{"line_number":144,"context_line":"            if self._post_as_copy_is_enabled(app) else body_was_encrypted,"},{"line_number":145,"context_line":"            self._encryption_is_enabled(app)))"},{"line_number":146,"context_line":"        return resp"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"    def _copy_object(self, app, destination):"}],"source_content_type":"text/x-python","patch_set":7,"id":"5a3905b3_ed7486d0","line":145,"in_reply_to":"3a71b18c_79e9ea7f","updated":"2017-01-26 22:49:04.000000000","message":"Done","commit_id":"b79e9c6e90334bdb53d6d51665fb3e4a3f383da3"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"b85da72eec55dee20abeaa69ac483de05ab5825d","unresolved":false,"context_lines":[{"line_number":398,"context_line":"        # turn on disable_encryption config option"},{"line_number":399,"context_line":"        self._setup_crypto_app(disable_encryption\u003dTrue)"},{"line_number":400,"context_line":"        # GET and HEAD of encrypted objects should still work"},{"line_number":401,"context_line":"        self._check_GET_and_HEAD(self.crypto_app, True)"},{"line_number":402,"context_line":"        self._check_listing(self.crypto_app, expect_mismatch\u003dFalse)"},{"line_number":403,"context_line":"        self._check_match_requests(\u0027GET\u0027, self.crypto_app)"},{"line_number":404,"context_line":"        self._check_match_requests(\u0027HEAD\u0027, self.crypto_app)"}],"source_content_type":"text/x-python","patch_set":7,"id":"3a71b18c_4b018d37","line":401,"updated":"2016-12-05 21:04:26.000000000","message":"Need to add a test here for POST.  Currently, if I move the body flag logic out of decrypter and into encrypter, then no tests fail.  However, under this modification to the code, running this test by hand with fast-post shows that the resulting POST when encryption is disabled will not include the body flag on the response when it should. \n\nWhen running this same test by hand using your code, the body flag is indeed in the POST response.  so the code is behaving correctly - just need a test to assert that.  Especially since it sort of seems to be the only reason that the POST response body flag belongs in the decrypter.","commit_id":"b79e9c6e90334bdb53d6d51665fb3e4a3f383da3"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"772baf94ff86b2689fa25097059b1dd6b7f9732d","unresolved":false,"context_lines":[{"line_number":398,"context_line":"        # turn on disable_encryption config option"},{"line_number":399,"context_line":"        self._setup_crypto_app(disable_encryption\u003dTrue)"},{"line_number":400,"context_line":"        # GET and HEAD of encrypted objects should still work"},{"line_number":401,"context_line":"        self._check_GET_and_HEAD(self.crypto_app, True)"},{"line_number":402,"context_line":"        self._check_listing(self.crypto_app, expect_mismatch\u003dFalse)"},{"line_number":403,"context_line":"        self._check_match_requests(\u0027GET\u0027, self.crypto_app)"},{"line_number":404,"context_line":"        self._check_match_requests(\u0027HEAD\u0027, self.crypto_app)"}],"source_content_type":"text/x-python","patch_set":7,"id":"5a3905b3_85c91a7b","line":401,"in_reply_to":"3a71b18c_4b018d37","updated":"2017-01-26 22:49:04.000000000","message":"Done","commit_id":"b79e9c6e90334bdb53d6d51665fb3e4a3f383da3"}]}