)]}'
{"swift/common/middleware/s3api/s3token.py":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"c414f9e89cb4a86ecfc20069dd2ead50368e33c2","unresolved":false,"context_lines":[{"line_number":182,"context_line":"            except Exception as e:"},{"line_number":183,"context_line":"                self._logger.warning(\"Unable to load keystone auth_plugin. \""},{"line_number":184,"context_line":"                                     \"Secret caching will be unavailable. \""},{"line_number":185,"context_line":"                                     \"Error: %s\", e)"},{"line_number":186,"context_line":"                self.keystoneclient \u003d None"},{"line_number":187,"context_line":"                self._secret_cache_duration \u003d 0"},{"line_number":188,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_cc1d7363","line":185,"range":{"start_line":185,"start_character":37,"end_line":185,"end_character":51},"updated":"2018-09-25 00:13:27.000000000","message":"Since we don\u0027t have any context on what the error might be, I\u0027d be OK with passing exc_info\u003dTrue here instead.","commit_id":"545c9f61969f1e4b59433e33bade3775c7b1398d"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"0f6af2ca1e4d8c5aa5813966d25e308be13f2d7c","unresolved":false,"context_lines":[{"line_number":287,"context_line":"            cached_auth_data \u003d memcache_client.get(memcache_token_key)"},{"line_number":288,"context_line":"            if cached_auth_data:"},{"line_number":289,"context_line":"                headers, token_id, tenant, secret \u003d cached_auth_data"},{"line_number":290,"context_line":"                if s3_auth_details[\u0027check_signature\u0027](str(secret)):"},{"line_number":291,"context_line":"                    self._logger.debug(\"Cached creds valid\")"},{"line_number":292,"context_line":"                else:"},{"line_number":293,"context_line":"                    self._logger.debug(\"Cached creds invalid\")"}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_bc4cc975","line":290,"updated":"2018-09-26 02:39:51.000000000","message":"I\u0027m going to put my foot down on this str(). It applies to something that was stored in memcache, and previously it was cred_ref.secret. Are you sure that thing cannot be bytes? I do suspect it\u0027s bytes. And if so, str() produces b\u0027xxx\u0027.","commit_id":"545c9f61969f1e4b59433e33bade3775c7b1398d"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"c414f9e89cb4a86ecfc20069dd2ead50368e33c2","unresolved":false,"context_lines":[{"line_number":335,"context_line":"                    user_id \u003d headers.get(\u0027X-User-Id\u0027)"},{"line_number":336,"context_line":"                    if not user_id:"},{"line_number":337,"context_line":"                        raise ValueError"},{"line_number":338,"context_line":"                    cred_ref \u003d self.keystoneclient.ec2.get("},{"line_number":339,"context_line":"                        user_id\u003duser_id,"},{"line_number":340,"context_line":"                        access\u003daccess)"},{"line_number":341,"context_line":"                    memcache_client.set("},{"line_number":342,"context_line":"                        memcache_token_key,"},{"line_number":343,"context_line":"                        (headers, token_id, tenant, cred_ref.secret),"}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_4cb40337","line":340,"range":{"start_line":338,"start_character":31,"end_line":340,"end_character":38},"updated":"2018-09-25 00:13:27.000000000","message":"I worry about this call failing, either because of a lack of permissions or some transient failure. In that case, I\u0027d rather continue servicing the request -- we\u0027ve got enough information in hand to do so.\n\nI think we\u0027d probably 500 otherwise, because some exception escapes clear out to catch_errors (haven\u0027t actually tested it yet, though).","commit_id":"545c9f61969f1e4b59433e33bade3775c7b1398d"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"0f6af2ca1e4d8c5aa5813966d25e308be13f2d7c","unresolved":false,"context_lines":[{"line_number":335,"context_line":"                    user_id \u003d headers.get(\u0027X-User-Id\u0027)"},{"line_number":336,"context_line":"                    if not user_id:"},{"line_number":337,"context_line":"                        raise ValueError"},{"line_number":338,"context_line":"                    cred_ref \u003d self.keystoneclient.ec2.get("},{"line_number":339,"context_line":"                        user_id\u003duser_id,"},{"line_number":340,"context_line":"                        access\u003daccess)"},{"line_number":341,"context_line":"                    memcache_client.set("},{"line_number":342,"context_line":"                        memcache_token_key,"},{"line_number":343,"context_line":"                        (headers, token_id, tenant, cred_ref.secret),"}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_5c6c95cf","line":340,"range":{"start_line":338,"start_character":31,"end_line":340,"end_character":38},"in_reply_to":"3f79a3b5_4cb40337","updated":"2018-09-26 02:39:51.000000000","message":"I agree.","commit_id":"545c9f61969f1e4b59433e33bade3775c7b1398d"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"4954cd17227ca54caa440c4e5385439871c7c701","unresolved":false,"context_lines":[{"line_number":287,"context_line":"            cached_auth_data \u003d memcache_client.get(memcache_token_key)"},{"line_number":288,"context_line":"            if cached_auth_data:"},{"line_number":289,"context_line":"                headers, token_id, tenant, secret \u003d cached_auth_data"},{"line_number":290,"context_line":"                if s3_auth_details[\u0027check_signature\u0027](str(secret)):"},{"line_number":291,"context_line":"                    self._logger.debug(\"Cached creds valid\")"},{"line_number":292,"context_line":"                else:"},{"line_number":293,"context_line":"                    self._logger.debug(\"Cached creds invalid\")"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_bcd12959","line":290,"updated":"2018-09-26 02:41:02.000000000","message":"My comment about the str() got lost. Is it possible to get rid of it?","commit_id":"e3f0081cb9e7bc0583003a84008200420dd63044"},{"author":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"change_message_id":"04c18e18776598f6b88df9bbcc4e84c79b4abe81","unresolved":false,"context_lines":[{"line_number":287,"context_line":"            cached_auth_data \u003d memcache_client.get(memcache_token_key)"},{"line_number":288,"context_line":"            if cached_auth_data:"},{"line_number":289,"context_line":"                headers, token_id, tenant, secret \u003d cached_auth_data"},{"line_number":290,"context_line":"                if s3_auth_details[\u0027check_signature\u0027](str(secret)):"},{"line_number":291,"context_line":"                    self._logger.debug(\"Cached creds valid\")"},{"line_number":292,"context_line":"                else:"},{"line_number":293,"context_line":"                    self._logger.debug(\"Cached creds invalid\")"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_d81df8be","line":290,"in_reply_to":"3f79a3b5_351c357a","updated":"2018-09-27 01:51:42.000000000","message":"Yeah sounds good to me","commit_id":"e3f0081cb9e7bc0583003a84008200420dd63044"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"fcee913a5a300eafbf58dce73c31990681d5e572","unresolved":false,"context_lines":[{"line_number":287,"context_line":"            cached_auth_data \u003d memcache_client.get(memcache_token_key)"},{"line_number":288,"context_line":"            if cached_auth_data:"},{"line_number":289,"context_line":"                headers, token_id, tenant, secret \u003d cached_auth_data"},{"line_number":290,"context_line":"                if s3_auth_details[\u0027check_signature\u0027](str(secret)):"},{"line_number":291,"context_line":"                    self._logger.debug(\"Cached creds valid\")"},{"line_number":292,"context_line":"                else:"},{"line_number":293,"context_line":"                    self._logger.debug(\"Cached creds invalid\")"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_351c357a","line":290,"in_reply_to":"3f79a3b5_63b8bae7","updated":"2018-09-27 00:44:34.000000000","message":"So (Sam \u0026 Tim), how about moving the cast inside the check_signature, like this:\n\n     def check_signature(self, secret):\n         user_signature \u003d self.signature\n-        derived_secret \u003d \u0027AWS4\u0027 + secret\n+        derived_secret \u003d (\u0027AWS4\u0027 + secret).encode(\u0027ascii\u0027)\n         for scope_piece in self.scope:\n\nDoes that look right to you?\n\nBasically I\u0027m up to just about anything reasonable, as long as it avoids str().","commit_id":"e3f0081cb9e7bc0583003a84008200420dd63044"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"afea1bcfffa921e50b7c0ae6e7293915d8ce5e50","unresolved":false,"context_lines":[{"line_number":287,"context_line":"            cached_auth_data \u003d memcache_client.get(memcache_token_key)"},{"line_number":288,"context_line":"            if cached_auth_data:"},{"line_number":289,"context_line":"                headers, token_id, tenant, secret \u003d cached_auth_data"},{"line_number":290,"context_line":"                if s3_auth_details[\u0027check_signature\u0027](str(secret)):"},{"line_number":291,"context_line":"                    self._logger.debug(\"Cached creds valid\")"},{"line_number":292,"context_line":"                else:"},{"line_number":293,"context_line":"                    self._logger.debug(\"Cached creds invalid\")"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_b144e0b9","line":290,"in_reply_to":"3f79a3b5_826f26c3","updated":"2018-09-26 17:05:25.000000000","message":"I can tell Pete\u0027s been thinking about py3 a lot lately :-)\n\nThe trick is that secret got deserialized from JSON, so it\u0027s unicode, right? What encoding would we expect it to need? I think just str() will assume ASCII -- how about we make that explicit, like\n\n if s3_auth_details[\u0027check_signature\u0027](secret.encode(\u0027ascii\u0027)):\n\nThen this will (should?) work just fine on py2 and py3, because we\u0027ll make sure secret is always bytes.\n\nOh... except memcache_serialization_support is still a thing... maybe if we load from pickle it\u0027ll already be bytes? See also: https://github.com/openstack/swift/commit/e1ff51c\n\nUgh.","commit_id":"e3f0081cb9e7bc0583003a84008200420dd63044"},{"author":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"change_message_id":"ff5e1b114be43ab2161918c82b6d841f92a46a60","unresolved":false,"context_lines":[{"line_number":287,"context_line":"            cached_auth_data \u003d memcache_client.get(memcache_token_key)"},{"line_number":288,"context_line":"            if cached_auth_data:"},{"line_number":289,"context_line":"                headers, token_id, tenant, secret \u003d cached_auth_data"},{"line_number":290,"context_line":"                if s3_auth_details[\u0027check_signature\u0027](str(secret)):"},{"line_number":291,"context_line":"                    self._logger.debug(\"Cached creds valid\")"},{"line_number":292,"context_line":"                else:"},{"line_number":293,"context_line":"                    self._logger.debug(\"Cached creds invalid\")"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_63b8bae7","line":290,"in_reply_to":"3f79a3b5_9430b208","updated":"2018-09-26 22:31:33.000000000","message":"secret is a unicode object. So should a change be made to check_signature to accept unicode?\n\nWhat if who change it to bytes later?","commit_id":"e3f0081cb9e7bc0583003a84008200420dd63044"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"51f36645f37522d46be7ac23e048202615f1fac3","unresolved":false,"context_lines":[{"line_number":287,"context_line":"            cached_auth_data \u003d memcache_client.get(memcache_token_key)"},{"line_number":288,"context_line":"            if cached_auth_data:"},{"line_number":289,"context_line":"                headers, token_id, tenant, secret \u003d cached_auth_data"},{"line_number":290,"context_line":"                if s3_auth_details[\u0027check_signature\u0027](str(secret)):"},{"line_number":291,"context_line":"                    self._logger.debug(\"Cached creds valid\")"},{"line_number":292,"context_line":"                else:"},{"line_number":293,"context_line":"                    self._logger.debug(\"Cached creds invalid\")"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_9430b208","line":290,"in_reply_to":"3f79a3b5_b144e0b9","updated":"2018-09-26 18:01:03.000000000","message":"Sam omitted the most intersting part of the traceback, which is the last one and might include the type. So it\u0027s a shot n the dark. But either way, a naked str() is not acceptable. What if they change it to bytes later?\n\nWe can add coercing to check_signature(), where it\u0027s logical.","commit_id":"e3f0081cb9e7bc0583003a84008200420dd63044"},{"author":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"change_message_id":"7b16798b418848e708e4eec8bc1f0ae47733d605","unresolved":false,"context_lines":[{"line_number":287,"context_line":"            cached_auth_data \u003d memcache_client.get(memcache_token_key)"},{"line_number":288,"context_line":"            if cached_auth_data:"},{"line_number":289,"context_line":"                headers, token_id, tenant, secret \u003d cached_auth_data"},{"line_number":290,"context_line":"                if s3_auth_details[\u0027check_signature\u0027](str(secret)):"},{"line_number":291,"context_line":"                    self._logger.debug(\"Cached creds valid\")"},{"line_number":292,"context_line":"                else:"},{"line_number":293,"context_line":"                    self._logger.debug(\"Cached creds invalid\")"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_826f26c3","line":290,"in_reply_to":"3f79a3b5_bcd12959","updated":"2018-09-26 05:12:09.000000000","message":"It does not work without this. I get this error without:\n\n  File \"/opt/swift/swift/common/middleware/s3api/s3token.py\", line 290, in __call__\n    if s3_auth_details[\u0027check_signature\u0027](secret):\n  File \"/opt/swift/swift/common/middleware/s3api/s3request.py\", line 463, in check_signature\n    secret, self.string_to_sign, sha1).digest()).strip()\n  File \"/usr/lib/python2.7/hmac.py\", line 136, in new\n    return HMAC(key, msg, digestmod)\n  File \"/usr/lib/python2.7/hmac.py\", line 75, in __init__\n    self.outer.update(key.translate(trans_5C))","commit_id":"e3f0081cb9e7bc0583003a84008200420dd63044"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"b9a4a265a95cffdc82e99e59763977e0721a7363","unresolved":false,"context_lines":[{"line_number":287,"context_line":"            cached_auth_data \u003d memcache_client.get(memcache_token_key)"},{"line_number":288,"context_line":"            if cached_auth_data:"},{"line_number":289,"context_line":"                headers, token_id, tenant, secret \u003d cached_auth_data"},{"line_number":290,"context_line":"                if s3_auth_details[\u0027check_signature\u0027](str(secret)):"},{"line_number":291,"context_line":"                    self._logger.debug(\"Cached creds valid\")"},{"line_number":292,"context_line":"                else:"},{"line_number":293,"context_line":"                    self._logger.debug(\"Cached creds invalid\")"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_110ed78b","line":290,"in_reply_to":"3f79a3b5_d81df8be","updated":"2018-09-27 18:41:19.000000000","message":"OK, so you guys have nerd-sniped me to finally get a setup wherein I can test https://review.openstack.org/#/c/580122/ :-)\n\nTIL you can create your own EC2 cred with non-ascii bits:\n\n openstack credential create --type ec2 --project test tester \u0027{\"access\": \"††daggers††\", \"secret\": \"∞infinity∞\"}\u0027\n\nKeystone seems to expect to work with secrets in UTF-8:\n\n- https://github.com/openstack/keystone/blob/14.0.0/keystone/contrib/s3/core.py#L77\n- https://github.com/openstack/keystone/blob/14.0.0/keystone/contrib/s3/core.py#L104\n\nSo, let\u0027s compute some dummy requests like what s3token should generate. v2 signature is easy to get:\n\n \u003e\u003e\u003e import hmac, hashlib\n \u003e\u003e\u003e secret_bytes \u003d u\u0027∞infinity∞\u0027.encode(\u0027utf8\u0027)\n \u003e\u003e\u003e hmac.new(secret_bytes, \u0027\u0027, hashlib.sha1).digest().encode(\u0027base64\u0027)\n \u0027RM6/6HPaFf3NZejAAslpcNG2mfo\u003d\\n\u0027\n\nv4 is more complicated:\n\n \u003e\u003e\u003e scope \u003d (\u0027day\u0027, \u0027region\u0027, \u0027s3\u0027, \u0027aws4_request\u0027)\n \u003e\u003e\u003e string_to_sign \u003d \u0027AWS4-HMAC-SHA256\\ntimestamp\\n%s\\ncanonical-request-hash\u0027 % \u0027/\u0027.join(scope)\n \u003e\u003e\u003e derived_secret \u003d \u0027AWS4\u0027 + secret_bytes\n \u003e\u003e\u003e for scope_piece in scope:\n ...     derived_secret \u003d hmac.new(derived_secret, scope_piece, hashlib.sha256).digest()\n ...\n \u003e\u003e\u003e hmac.new(derived_secret, string_to_sign, hashlib.sha256).hexdigest()\n \u002772047f7a7e4b8deec0c76bce19e29251c7f49beaaa1e81bb19f2e3058b11e2f8\u0027\n \u003e\u003e\u003e string_to_sign.encode(\u0027base64\u0027)\n \u0027QVdTNC1ITUFDLVNIQTI1Ngp0aW1lc3RhbXAKZGF5L3JlZ2lvbi9zMy9hd3M0X3JlcXVlc3QKY2Fu\\nb25pY2FsLXJlcXVlc3QtaGFzaA\u003d\u003d\\n\u0027\n\nIt even works for v4 signatures!\n\n $ curl -v http://saio:8000/v3/s3tokens -X POST -d \u0027{\"credentials\": {\"access\": \"††daggers††\", \"token\": \"QVdTNC1ITUFDLVNIQTI1Ngp0aW1lc3RhbXAKZGF5L3JlZ2lvbi9zMy9hd3M0X3JlcXVlc3QKY2Fu\\nb25pY2FsLXJlcXVlc3QtaGFzaA\u003d\u003d\", \"signature\": \"72047f7a7e4b8deec0c76bce19e29251c7f49beaaa1e81bb19f2e3058b11e2f8\"}}\u0027 -H Content-Type:application/json\n Note: Unnecessary use of -X or --request, POST is already inferred.\n *   Trying 127.0.1.1...\n * TCP_NODELAY set\n * Connected to saio (127.0.1.1) port 8000 (#0)\n \u003e POST /v3/s3tokens HTTP/1.1\n \u003e Host: saio:8000\n \u003e User-Agent: curl/7.58.0\n \u003e Accept: application/json, text/*;q\u003d0.9, */*;q\u003d0.8\n \u003e Content-Type:application/json\n \u003e Content-Length: 250\n \u003e\n * upload completely sent off: 250 out of 250 bytes\n * HTTP 1.0, assume close after body\n \u003c HTTP/1.0 200 OK\n \u003c Date: Thu, 27 Sep 2018 17:53:50 GMT\n \u003c Server: WSGIServer/0.1 Python/2.7.15rc1\n \u003c Vary: X-Auth-Token\n \u003c Content-Type: application/json\n \u003c Content-Length: 1170\n \u003c x-openstack-request-id: req-159491da-d79c-4f60-9584-7baaa99e7322\n \u003c\n {\"token\": {\"is_domain\": false, \"methods\": [\"ec2credential\"], \"roles\": [{\"id\": \"0eb17fcad2ee4d7a9e69c8a246f67f8f\", \"name\": \"admin\"}], \"expires_at\": \"2018-09-27T18:53:50.000000Z\", \"project\": {\"domain\": {\"id\": \"default\", \"name\": \"Default\"}, \"id\": \"786ded81447942ad922165d1e623b673\", \"name\": \"test\"}, \"catalog\": [{\"endpoints\": [{\"region_id\": null, \"url\": \"http://saio:8000\", \"region\": null, \"interface\": \"public\", \"id\": \"bb0a1fa274924d3188881899027977b0\"}, {\"region_id\": null, \"url\": \"http://saio:8000\", \"region\": null, \"interface\": \"admin\", \"id\": \"590fca76fc7047589141a38cdb2e67f1\"}], \"type\": \"identity\", \"id\": \"827c8b7c6d294bbd8f13fd884f39fc7d\", \"name\": \"keystone\"}, {\"endpoints\": [{\"region_id\": null, \"url\": \"https://swift.ssdev/v1/KEY_786ded81447942ad922165d1e623b673\", \"region\": null, \"interface\": \"public\", \"id\": \"b8531a72585c469ba331ef0cb2ba35b3\"}], \"type\": \"object-store\", \"id\": \"3ebbc1d337ab47679f6bc8931ef39693\", \"name\": \"swift\"}], \"user\": {\"password_expires_at\": null, \"domain\": {\"id\": \"default\", \"name\": \"Default\"}, * Closing connection 0\n \"id\": \"e204d3e151a7486888b15863496b55ec\", \"name\": \"tester\"}, \"audit_ids\": [\"4kkfHk97QHeSRf53d1IFPQ\"], \"issued_at\": \"2018-09-27T17:53:50.000000Z\"}}\n\n\n... but v2 is busted:\n\n $ curl -v http://saio:8000/v3/s3tokens -X POST -d \u0027{\"credentials\": {\"access\": \"††daggers††\", \"token\": \"\", \"signature\": \"RM6/6HPaFf3NZejAAslpcNG2mfo\u003d\"}}\u0027 -H Content-Type:application/json\n Note: Unnecessary use of -X or --request, POST is already inferred.\n *   Trying 127.0.1.1...\n * TCP_NODELAY set\n * Connected to saio (127.0.1.1) port 8000 (#0)\n \u003e POST /v3/s3tokens HTTP/1.1\n \u003e Host: saio:8000\n \u003e User-Agent: curl/7.58.0\n \u003e Accept: application/json, text/*;q\u003d0.9, */*;q\u003d0.8\n \u003e Content-Type:application/json\n \u003e Content-Length: 108\n \u003e\n * upload completely sent off: 108 out of 108 bytes\n * HTTP 1.0, assume close after body\n \u003c HTTP/1.0 500 Internal Server Error\n \u003c Date: Thu, 27 Sep 2018 17:21:32 GMT\n \u003c Server: WSGIServer/0.1 Python/2.7.15rc1\n \u003c Vary: X-Auth-Token\n \u003c Content-Type: application/json\n \u003c Content-Length: 143\n \u003c x-openstack-request-id: req-cfa5da9d-0cce-4306-ae69-010ec8c502bc\n \u003c\n * Closing connection 0\n {\"error\": {\"message\": \"An unexpected error prevented the server from fulfilling your request.\", \"code\": 500, \"title\": \"Internal Server Error\"}}\n\nKeystone logs say\n\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi [req-cfa5da9d-0cce-4306-ae69-010ec8c502bc - - - - -] \u0027ascii\u0027 codec can\u0027t encode character u\u0027\\u221e\u0027 in position 0: ordinal not in range(128): UnicodeEncodeError: \u0027ascii\u0027 codec can\u0027t encode character u\u0027\\u221e\u0027 in position 0: ordinal not in range(128)\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi Traceback (most recent call last):\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi   File \"/usr/local/lib/python2.7/dist-packages/keystone/common/wsgi.py\", line 228, in __call__\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi     result \u003d method(req, **params)\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi   File \"/usr/local/lib/python2.7/dist-packages/keystone/contrib/ec2/controllers.py\", line 385, in authenticate\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi     credentials\u003dcredentials, ec2credentials\u003dec2Credentials\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi   File \"/usr/local/lib/python2.7/dist-packages/keystone/contrib/ec2/controllers.py\", line 131, in _authenticate\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi     self.check_signature(creds_ref, credentials)\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi   File \"/usr/local/lib/python2.7/dist-packages/keystone/contrib/s3/core.py\", line 76, in check_signature\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi     creds_ref[\u0027secret\u0027])\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi   File \"/usr/local/lib/python2.7/dist-packages/keystone/contrib/s3/core.py\", line 93, in _calculate_signature_v1\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi     key \u003d str(secret_key).encode(\u0027utf-8\u0027)\n 2018-09-27 17:21:32.671 20420 ERROR keystone.common.wsgi UnicodeEncodeError: \u0027ascii\u0027 codec can\u0027t encode character u\u0027\\u221e\u0027 in position 0: ordinal not in range(128)\n\n... which seems to underscore that just using str() definitely won\u0027t do ;-)\n\nAll this is to say, since Keystone is (trying to) use UTF-8, we should probably do UTF-8, too, instead of ASCII. And since that choice is tied to Keystone\u0027s choice of encoding when *it* computes signatures, it should probably happen here in s3token.","commit_id":"e3f0081cb9e7bc0583003a84008200420dd63044"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"7c91220aea3ac1ad29138f10e46f2dcc33ed321a","unresolved":false,"context_lines":[{"line_number":162,"context_line":"            self._verify \u003d None"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"        self._secret_cache_duration \u003d int(conf.get(\u0027secret_cache_duration\u0027, 0))"},{"line_number":165,"context_line":"        if self._secret_cache_duration \u003e 0:"},{"line_number":166,"context_line":"            try:"},{"line_number":167,"context_line":"                auth_plugin \u003d keystone_loading.get_plugin_loader("},{"line_number":168,"context_line":"                    conf.get(\u0027auth_type\u0027))"}],"source_content_type":"text/x-python","patch_set":10,"id":"3f79a3b5_245ebee1","line":165,"updated":"2018-12-10 20:09:12.000000000","message":"nit: I\u0027d even be willing to error out if somebody tries to configure\n\n secret_cache_duration \u003d -60\n\nor something...","commit_id":"e93142b763b9d4e70409835e290732febd0e6839"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"7c91220aea3ac1ad29138f10e46f2dcc33ed321a","unresolved":false,"context_lines":[{"line_number":182,"context_line":"            except Exception:"},{"line_number":183,"context_line":"                self._logger.warning(\"Unable to load keystone auth_plugin. \""},{"line_number":184,"context_line":"                                     \"Secret caching will be unavailable.\","},{"line_number":185,"context_line":"                                     exc_info\u003dTrue)"},{"line_number":186,"context_line":"                self.keystoneclient \u003d None"},{"line_number":187,"context_line":"                self._secret_cache_duration \u003d 0"},{"line_number":188,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"3f79a3b5_441bba1b","line":185,"updated":"2018-12-10 20:09:12.000000000","message":"Huh. Not exactly the error I was expecting...\n\nDec 10 19:22:46 saio proxy-server: Unable to load keystone auth_plugin. Secret caching will be unavailable.\nTraceback (most recent call last):\n  File \"/vagrant/swift/swift/common/middleware/s3api/s3token.py\", line 168, in __init__\n    conf.get(\u0027auth_type\u0027))\n  File \"/usr/local/lib/python2.7/dist-packages/keystoneauth1/loading/base.py\", line 81, in get_plugin_loader\n    name\u003dname)\n  File \"/usr/local/lib/python2.7/dist-packages/stevedore/driver.py\", line 61, in __init__\n    warn_on_missing_entrypoint\u003dwarn_on_missing_entrypoint\n  File \"/usr/local/lib/python2.7/dist-packages/stevedore/named.py\", line 88, in __init__\n    \u0027, \u0027.join(self._missing_names))\nTypeError: sequence item 0: expected string, NoneType found\n\nMaybe we\u0027ll want some sane default for auth_type, like password? Then configuring secret_cache_duration but nothing else produces\n\nDec 10 19:24:55 saio proxy-server: Unable to load keystone auth_plugin. Secret caching will be unavailable.\nTraceback (most recent call last):\n  File \"/vagrant/swift/swift/common/middleware/s3api/s3token.py\", line 177, in __init__\n    auth \u003d auth_plugin.load_from_options(**auth_options)\n  File \"/usr/local/lib/python2.7/dist-packages/keystoneauth1/loading/base.py\", line 162, in load_from_options\n    raise exceptions.MissingRequiredOptions(missing_required)\nMissingRequiredOptions: Auth plugin requires parameters which were not given: auth_url\n\ninstead, which seems way more actionable.","commit_id":"e93142b763b9d4e70409835e290732febd0e6839"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"7c91220aea3ac1ad29138f10e46f2dcc33ed321a","unresolved":false,"context_lines":[{"line_number":286,"context_line":"        if memcache_client:"},{"line_number":287,"context_line":"            cached_auth_data \u003d memcache_client.get(memcache_token_key)"},{"line_number":288,"context_line":"            if cached_auth_data:"},{"line_number":289,"context_line":"                headers, token_id, tenant, secret \u003d cached_auth_data"},{"line_number":290,"context_line":"                if s3_auth_details[\u0027check_signature\u0027](secret):"},{"line_number":291,"context_line":"                    self._logger.debug(\"Cached creds valid\")"},{"line_number":292,"context_line":"                else:"}],"source_content_type":"text/x-python","patch_set":10,"id":"3f79a3b5_e45e8676","line":289,"updated":"2018-12-10 20:09:12.000000000","message":"Might want to guard this a bit to defend against a poisoned cache. In particular, I\u0027m a little worried about future-us wanting to add some more values to what we cache (or remove values, as in https://review.openstack.org/#/c/609168/), and it\u0027d be nice if an old proxy reading the new format would fail gracefully (i.e., treat the cache as invalid and attempt a fresh validation against Keystone).","commit_id":"e93142b763b9d4e70409835e290732febd0e6839"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"7c91220aea3ac1ad29138f10e46f2dcc33ed321a","unresolved":false,"context_lines":[{"line_number":334,"context_line":"                if memcache_client:"},{"line_number":335,"context_line":"                    user_id \u003d headers.get(\u0027X-User-Id\u0027)"},{"line_number":336,"context_line":"                    if not user_id:"},{"line_number":337,"context_line":"                        raise ValueError"},{"line_number":338,"context_line":"                    try:"},{"line_number":339,"context_line":"                        cred_ref \u003d self.keystoneclient.ec2.get("},{"line_number":340,"context_line":"                            user_id\u003duser_id,"}],"source_content_type":"text/x-python","patch_set":10,"id":"3f79a3b5_047622d7","line":337,"updated":"2018-12-10 20:09:12.000000000","message":"Interesting that we now have a bit of validation going on here... and if the header *isn\u0027t* present, we reject the request, even though Keystone gave us a 200.\n\nBut, looking at parse_v2_response/parse_v3_response, that\u0027s basically what was going to happen anyway, so... *shrug*","commit_id":"e93142b763b9d4e70409835e290732febd0e6839"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"7c91220aea3ac1ad29138f10e46f2dcc33ed321a","unresolved":false,"context_lines":[{"line_number":345,"context_line":"                            time\u003dself._secret_cache_duration)"},{"line_number":346,"context_line":"                        self._logger.debug(\"Cached keystone credentials\")"},{"line_number":347,"context_line":"                    except Exception:"},{"line_number":348,"context_line":"                        self._logger.warning(\"Unable to cache secret\","},{"line_number":349,"context_line":"                                             exc_info\u003dTrue)"},{"line_number":350,"context_line":""},{"line_number":351,"context_line":"                # Populate the environment similar to auth_token,"}],"source_content_type":"text/x-python","patch_set":10,"id":"3f79a3b5_046dc266","line":348,"updated":"2018-12-10 20:09:12.000000000","message":"Should we cache (some types of?) negative responses here? If we get back\n\n Forbidden: You are not authorized to perform the requested action: identity:ec2_get_credential. (HTTP 403)\n\ndo we really expect that the next attempt might succeed? We wouldn\u0027t necessarily want it in memcache (since other proxies may be configured *correctly*), but at least in-process?","commit_id":"e93142b763b9d4e70409835e290732febd0e6839"}],"test/unit/common/middleware/s3api/test_s3token.py":[{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"0f6af2ca1e4d8c5aa5813966d25e308be13f2d7c","unresolved":false,"context_lines":[{"line_number":30,"context_line":"from swift.common.swob import Request, Response"},{"line_number":31,"context_line":"from swift.common.wsgi import ConfigFileError"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"GOOD_RESPONSE_V2 \u003d {\u0027access\u0027: {"},{"line_number":35,"context_line":"    \u0027user\u0027: {"},{"line_number":36,"context_line":"        \u0027username\u0027: \u0027S3_USER\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_dce2e530","line":33,"updated":"2018-09-26 02:39:51.000000000","message":"what is this empty line for?","commit_id":"545c9f61969f1e4b59433e33bade3775c7b1398d"}]}