)]}'
{"id":"openstack%2Fswift~689883","triplet_id":"openstack%2Fswift~stable%2Frocky~I61eb12455c37376be4d739eee55a5f439216f0e9","project":"openstack/swift","branch":"stable/rocky","topic":"bug/1765834","hashtags":[],"change_id":"I61eb12455c37376be4d739eee55a5f439216f0e9","subject":"Verify client input for v4 signatures","status":"MERGED","created":"2019-10-21 21:59:15.000000000","updated":"2019-10-23 17:43:54.000000000","submitted":"2019-10-23 17:43:54.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"689883-1571852634756-d71617f4","meta_rev_id":"df9fba27cbc640d3dc632f36a65a1978028feea9","_number":689883,"virtual_id_number":689883,"owner":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2019-10-23 17:43:54.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2019-10-23 15:08:55.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2019-10-23 15:08:55.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2019-10-23 17:43:54.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"79ca81a7903c619d369e221c030539e2b27c7984","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2019-10-21 21:59:15.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"69763d1bef8a425f70ed964dfb604d6b723e0310","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-10-21 23:47:47.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttp://docs.openstack.org/infra/manual/developers.html#automated-testing\n\n\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/60d5dfdbe3ee41ec8fd4ff0da2aa52c2 : SUCCESS in 4m 36s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/aa0f1233d8044642a8444caf1d699375 : SUCCESS in 9m 14s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/e65a34eb902f4f51910ef307d349581b : SUCCESS in 4m 29s\n- swift-tox-func https://zuul.opendev.org/t/openstack/build/bab63abd8dae4028bf0485ea37644594 : SUCCESS in 8m 17s\n- swift-tox-func-encryption https://zuul.opendev.org/t/openstack/build/a07fcd903f8c43ffb356cbd5c80b6275 : SUCCESS in 8m 38s\n- swift-tox-func-domain-remap-staticweb https://zuul.opendev.org/t/openstack/build/6eb077ceb70d4bfdb88ecce69105a880 : SUCCESS in 9m 22s\n- swift-tox-func-ec https://zuul.opendev.org/t/openstack/build/eaf250172f594adea526a786af2ff507 : SUCCESS in 8m 44s\n- swift-tox-func-s3api https://zuul.opendev.org/t/openstack/build/b4da021ab05b4f7bb326e7e921bb76de : SUCCESS in 11m 34s\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/d2a623d3def14eb2b134a327e9b2cc82 : SUCCESS in 30m 53s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/933519ea0360441288a49a045a44a115 : SUCCESS in 10m 52s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/7ff4bc78e18b4050be4cef6ad4c0d7b5 : FAILURE in 5m 57s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/347f32bed038469f9ba27e177fd45f6a : SUCCESS in 32m 44s\n- legacy-tempest-dsvm-neutron-full https://zuul.opendev.org/t/openstack/build/7dbdd0c7ce8847ab8a13a961c738d51c : SUCCESS in 1h 35m 40s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/fed22c61b3e34841bf0bf9e1b185b09c : SUCCESS in 1h 07m 35s","accounts_in_message":[],"_revision_number":1},{"id":"4da3d9b2587f7b78c3f0f0a7a5d14f5eb1caa3b3","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2019-10-22 14:55:16.000000000","message":"Patch Set 2: Published edit on patch set 1.","accounts_in_message":[],"_revision_number":2},{"id":"daff610334eb7864676ed7b7b0e4af1710da3175","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-10-22 16:18:18.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttp://docs.openstack.org/infra/manual/developers.html#automated-testing\n\n\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/ab906ff84a93443cae276958a846877a : SUCCESS in 4m 58s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/364c59ad536949948786fb56ed55c94b : SUCCESS in 11m 27s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/8622fd16cf6f42ac8e5537019641a431 : SUCCESS in 4m 03s\n- swift-tox-func https://zuul.opendev.org/t/openstack/build/edcf0e16717546a3962e23c305cd68b4 : SUCCESS in 10m 49s\n- swift-tox-func-encryption https://zuul.opendev.org/t/openstack/build/2a1d677bb97e492ab8de83710329deb0 : SUCCESS in 16m 01s\n- swift-tox-func-domain-remap-staticweb https://zuul.opendev.org/t/openstack/build/5b6bef69584840c29c50ee8ecc5e7c1c : SUCCESS in 15m 07s\n- swift-tox-func-ec https://zuul.opendev.org/t/openstack/build/47e5cce50084487a82c5957eaaaca573 : SUCCESS in 15m 09s\n- swift-tox-func-s3api https://zuul.opendev.org/t/openstack/build/14affb6d7f9e44f4ac1f7a17a3de6fc1 : SUCCESS in 10m 33s\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/64dd5d2febd04870bd5089c58c9e0dd7 : FAILURE in 26m 33s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/1ab0aff98abd4c01a46cf299f6468391 : SUCCESS in 10m 34s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/7d721adb411a4915bc3fa34b55a504a4 : SUCCESS in 5m 08s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/739d2bad216e4607b8540bbc5deea434 : SUCCESS in 24m 47s\n- legacy-tempest-dsvm-neutron-full https://zuul.opendev.org/t/openstack/build/0a5c9a836f79477d928eba80bbff623c : FAILURE in 1h 15m 42s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/6cc46fbdf0d84f3eb7b8a9bcf7affd95 : FAILURE in 58m 10s","accounts_in_message":[],"_revision_number":2},{"id":"50187ba57734dc4a6514bb8a7b0734f3dddd50f2","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2019-10-22 16:50:16.000000000","message":"Patch Set 2:\n\nrecheck","accounts_in_message":[],"_revision_number":2},{"id":"93bb4e8d7a03541b7fcf93cc26650b22b4d383f7","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-10-22 18:37:04.000000000","message":"Patch Set 2:\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttp://docs.openstack.org/infra/manual/developers.html#automated-testing\n\n\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/3a2419e3c4f14132887648a1716ecb0a : SUCCESS in 5m 03s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/79600682b7ff485087274fb62bf84e52 : SUCCESS in 10m 28s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/1207e89ecdb244c19056e36f5c64a47e : SUCCESS in 5m 10s\n- swift-tox-func https://zuul.opendev.org/t/openstack/build/4529f4f739ef48d381e4d9e45c24773d : SUCCESS in 7m 38s\n- swift-tox-func-encryption https://zuul.opendev.org/t/openstack/build/16a445fd1a2849d09825cf65f55bfa69 : SUCCESS in 12m 56s\n- swift-tox-func-domain-remap-staticweb https://zuul.opendev.org/t/openstack/build/209985dff178443bae8aa9a26e5e9fa6 : SUCCESS in 12m 50s\n- swift-tox-func-ec https://zuul.opendev.org/t/openstack/build/38a948552ad44f8eb84448e72e6ee3db : SUCCESS in 13m 41s\n- swift-tox-func-s3api https://zuul.opendev.org/t/openstack/build/b78185adb557499f9c25dab9d15c98a3 : SUCCESS in 10m 58s\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/16505d5c30ca4ea781f955730b6ae806 : FAILURE in 21m 14s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/22e035bd6906419690a74ae0271bdfae : SUCCESS in 10m 11s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f9ee5791bcf44ee597c4e75fe799fc82 : SUCCESS in 5m 48s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/5d7d92d70e1c432bbae605a3f5e5acd1 : SUCCESS in 27m 30s\n- legacy-tempest-dsvm-neutron-full https://zuul.opendev.org/t/openstack/build/bbbda3429cd2444b93b7b0ba1c6a6522 : SUCCESS in 1h 33m 45s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/7d9eec5a8d3b4ce3b0be260ce36a2586 : SUCCESS in 51m 41s","accounts_in_message":[],"_revision_number":2},{"id":"1a81c0f2cd5d9bee0f617fd4107cd4548b811323","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2019-10-22 21:02:53.000000000","message":"Patch Set 2:\n\nrecheck","accounts_in_message":[],"_revision_number":2},{"id":"608756e73116d786f48829c0793796ff3ad491a0","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-10-22 22:31:29.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\n\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/e5bb61d851b5402d949509065c6ac087 : SUCCESS in 4m 49s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/53826c2e5d07434abb8fca6e524bb688 : SUCCESS in 10m 03s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/c3b5cc19aef248f197f10740627f1260 : SUCCESS in 5m 12s\n- swift-tox-func https://zuul.opendev.org/t/openstack/build/2675116556c642e8812330cf33fcb76b : SUCCESS in 8m 30s\n- swift-tox-func-encryption https://zuul.opendev.org/t/openstack/build/2bb4596e8a81476ab57ebd8bc6ff13dd : SUCCESS in 9m 19s\n- swift-tox-func-domain-remap-staticweb https://zuul.opendev.org/t/openstack/build/852e81e26c944ac895d1d7ba83c15414 : SUCCESS in 9m 55s\n- swift-tox-func-ec https://zuul.opendev.org/t/openstack/build/68ce10bc7fc24eaa9f14668934d6106c : SUCCESS in 9m 08s\n- swift-tox-func-s3api https://zuul.opendev.org/t/openstack/build/faee89ddc8b0460d9e818e8b2e798260 : SUCCESS in 9m 43s\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/859732cb2f124dac8a8e17deecda8bc3 : SUCCESS in 31m 32s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/5c6ce74416244b9d89723927b736fe6e : SUCCESS in 7m 48s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/7a07f705fa374affbc33eec918447406 : SUCCESS in 4m 59s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/998089a42f4b45dd89180a6b54bd81e1 : SUCCESS in 26m 53s\n- legacy-tempest-dsvm-neutron-full https://zuul.opendev.org/t/openstack/build/42fcf21488a2459f9965c3e0776755fc : SUCCESS in 1h 22m 52s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/de779c5b9cbe4046bcac26c4c7bf9734 : SUCCESS in 1h 02m 28s","accounts_in_message":[],"_revision_number":2},{"id":"bc6f68ca4b27759e009c569bf0416278ab065f4d","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2019-10-23 15:08:55.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1\n\nFairly clean backport; had to squash into a single commit to ensure we don\u0027t break UNSIGNED-PAYLOAD uploads. Tests pop appropriately with either or both parts of the changes under swift backed out. Closes a security bug.","accounts_in_message":[],"_revision_number":2},{"id":"753baa08056d8b416f16249818bcf2456453bae2","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-10-23 15:09:24.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"ee7254bbb2042816ad43f64d7348f91e16c4ecda","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-10-23 17:43:54.000000000","message":"Change has been successfully merged by Zuul","accounts_in_message":[],"_revision_number":2},{"id":"6f123899b49de452b0b7cb8288828fa19d9628fc","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-10-23 17:43:54.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\n\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/ffefc3eb2e404ff19eb4da607918a5a4 : SUCCESS in 7m 22s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/36724598fb7a420694eb8b7371f92d29 : SUCCESS in 10m 25s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/617ecb7327104b73b9936c7c96d35c80 : SUCCESS in 5m 37s\n- swift-tox-func https://zuul.opendev.org/t/openstack/build/769f7a2115ad444a8aad0315dcc0bed7 : SUCCESS in 13m 21s\n- swift-tox-func-encryption https://zuul.opendev.org/t/openstack/build/a4c87cd38d51439b9265ca2bdb15681d : SUCCESS in 12m 01s\n- swift-tox-func-domain-remap-staticweb https://zuul.opendev.org/t/openstack/build/0c5548da32ba461b8835afbe43eef522 : SUCCESS in 8m 49s\n- swift-tox-func-ec https://zuul.opendev.org/t/openstack/build/df8afb212463404db6478864e36cd9bf : SUCCESS in 11m 16s\n- swift-tox-func-s3api https://zuul.opendev.org/t/openstack/build/e4fe5e57d2354eae8296337cfec70887 : SUCCESS in 14m 29s\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/f9ab1574048442c0afc1e2cfc003c3ca : SUCCESS in 28m 29s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/e04120c9cd0d4a49b558c12af96f8df7 : SUCCESS in 10m 56s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e4f98d5eaed24fb6a4f1c57846a404e9 : SUCCESS in 5m 06s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/a3cab853be3a4a4eaa86c58aab6c7c02 : SUCCESS in 34m 22s\n- legacy-tempest-dsvm-neutron-full https://zuul.opendev.org/t/openstack/build/7f48614c9b584259a083893e92236e47 : SUCCESS in 1h 37m 22s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/045af65110434ff5a42855ff6e13deeb : SUCCESS in 1h 07m 58s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"423f96293b6eb43504b5370e893c280697ed23c9","revisions":{"7acbde9cfd52e69da2336487ad63ef7c50c0445e":{"kind":"REWORK","_number":1,"created":"2019-10-21 21:59:15.000000000","uploader":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"ref":"refs/changes/83/689883/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/83/689883/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/83/689883/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/83/689883/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/83/689883/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/83/689883/1"}}},"commit":{"parents":[{"commit":"c6e2fbb41775e065be7cdab2366d846785b57804","subject":"Merge \"doc: Fix the swift middleware doc needs more info  to set s3 api\" into stable/rocky","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/c6e2fbb41775e065be7cdab2366d846785b57804"}]}],"author":{"name":"Tim Burke","email":"tim.burke@gmail.com","date":"2018-12-11 23:29:35.000000000","tz":-480},"committer":{"name":"Tim Burke","email":"tim.burke@gmail.com","date":"2019-10-21 21:57:08.000000000","tz":-420},"subject":"Verify client input for v4 signatures","message":"Verify client input for v4 signatures\n\nThis is a combination of 2 commits.\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nPreviously, we would use the X-Amz-Content-SHA256 value when calculating\nsignatures, but wouldn\u0027t actually check the content that was sent. This\nwould allow a malicious third party that managed to capture the headers\nfor an object upload to overwrite that with arbitrary content provided\nthey could do so within the 5-minute clock-skew window.\n\nNow, we wrap the wsgi.input that\u0027s sent on to the proxy-server app to\nhash content as it\u0027s read and raise an error if there\u0027s a mismatch. Note\nthat clients using presigned-urls to upload have no defense against a\nsimilar replay attack.\n\nNotwithstanding the above security consideration, this *also* provides\nbetter assurances that the client\u0027s payload was received correctly. Note\nthat this *does not* attempt to send an etag in footers, however, so the\nproxy-to-object-server connection is not guarded against bit-flips.\n\nIn the future, Swift will hopefully grow a way to perform SHA256\nverification on the object-server. This would offer two main benefits:\n\n  - End-to-end message integrity checking.\n  - Move CPU load of calculating the hash from the proxy (which is\n    somewhat CPU-bound) to the object-server (which tends to have CPU to\n    spare).\n\nCloses-Bug: 1765834\n(cherry picked from commit 3a8f5dbf9c49fdf1cf2d0b7ba35b82f25f88e634)\n\n----------\n\ns3api: Allow clients to upload with UNSIGNED-PAYLOAD\n\n(Some versions of?) awscli/boto3 will do v4 signatures but send a\nContent-MD5 for end-to-end validation. Since a X-Amz-Content-SHA256\nis still required to calculate signatures, it uses UNSIGNED-PAYLOAD\nsimilar to how signatures work for pre-signed URLs.\n\nLook for UNSIGNED-PAYLOAD and skip SHA256 validation if set.\n\n(cherry picked from commit 82e446a8a0c0fd6a81f06717b76ed3d1be26a281)\n(cherry picked from commit 6ed165cf3f65329beaef9977a5fec24ce3ac0b39)\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nChange-Id: I61eb12455c37376be4d739eee55a5f439216f0e9\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/7acbde9cfd52e69da2336487ad63ef7c50c0445e"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/7acbde9cfd52e69da2336487ad63ef7c50c0445e"}]},"branch":"refs/heads/stable/rocky"},"423f96293b6eb43504b5370e893c280697ed23c9":{"kind":"REWORK","_number":2,"created":"2019-10-22 14:55:16.000000000","uploader":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"ref":"refs/changes/83/689883/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/83/689883/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/83/689883/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/83/689883/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/83/689883/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/83/689883/2"}}},"commit":{"parents":[{"commit":"c6e2fbb41775e065be7cdab2366d846785b57804","subject":"Merge \"doc: Fix the swift middleware doc needs more info  to set s3 api\" into stable/rocky","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/c6e2fbb41775e065be7cdab2366d846785b57804"}]}],"author":{"name":"Tim Burke","email":"tim.burke@gmail.com","date":"2018-12-11 23:29:35.000000000","tz":-480},"committer":{"name":"Tim Burke","email":"tim@swiftstack.com","date":"2019-10-22 14:54:31.000000000","tz":0},"subject":"Verify client input for v4 signatures","message":"Verify client input for v4 signatures\n\nThis is a combination of 2 commits.\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nPreviously, we would use the X-Amz-Content-SHA256 value when calculating\nsignatures, but wouldn\u0027t actually check the content that was sent. This\nwould allow a malicious third party that managed to capture the headers\nfor an object upload to overwrite that with arbitrary content provided\nthey could do so within the 5-minute clock-skew window.\n\nNow, we wrap the wsgi.input that\u0027s sent on to the proxy-server app to\nhash content as it\u0027s read and raise an error if there\u0027s a mismatch. Note\nthat clients using presigned-urls to upload have no defense against a\nsimilar replay attack.\n\nNotwithstanding the above security consideration, this *also* provides\nbetter assurances that the client\u0027s payload was received correctly. Note\nthat this *does not* attempt to send an etag in footers, however, so the\nproxy-to-object-server connection is not guarded against bit-flips.\n\nIn the future, Swift will hopefully grow a way to perform SHA256\nverification on the object-server. This would offer two main benefits:\n\n  - End-to-end message integrity checking.\n  - Move CPU load of calculating the hash from the proxy (which is\n    somewhat CPU-bound) to the object-server (which tends to have CPU to\n    spare).\n\nCloses-Bug: 1765834\n(cherry picked from commit 3a8f5dbf9c49fdf1cf2d0b7ba35b82f25f88e634)\n\n----------\n\ns3api: Allow clients to upload with UNSIGNED-PAYLOAD\n\n(Some versions of?) awscli/boto3 will do v4 signatures but send a\nContent-MD5 for end-to-end validation. Since a X-Amz-Content-SHA256\nis still required to calculate signatures, it uses UNSIGNED-PAYLOAD\nsimilar to how signatures work for pre-signed URLs.\n\nLook for UNSIGNED-PAYLOAD and skip SHA256 validation if set.\n\n(cherry picked from commit 82e446a8a0c0fd6a81f06717b76ed3d1be26a281)\n(cherry picked from commit 6ed165cf3f65329beaef9977a5fec24ce3ac0b39)\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nChange-Id: I61eb12455c37376be4d739eee55a5f439216f0e9\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/423f96293b6eb43504b5370e893c280697ed23c9"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/423f96293b6eb43504b5370e893c280697ed23c9"}]},"branch":"refs/heads/stable/rocky"}},"requirements":[],"submit_records":[],"submit_requirements":[]}