Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Forbidden put-object in Wasabi's benchmark #137

Closed
masterSplinter01 opened this issue Jul 6, 2021 · 1 comment
Closed

Forbidden put-object in Wasabi's benchmark #137

masterSplinter01 opened this issue Jul 6, 2021 · 1 comment
Assignees

Comments

@masterSplinter01
Copy link
Contributor

masterSplinter01 commented Jul 6, 2021

Put-object via AWS CLI:

aws s3api put-object --bucket test5  --key obj2   --body ~/Downloads/aw.jpg

puts objects successfully and has a header:

AWS4-HMAC-SHA256 Credential=BbfMqjgvqatXfVgicifhnBLmRRpkeC9dsS4nEiwegtP_3HjPqhzQM62hyZR35gz9WkfaGt2dHimzPmXtih8rWhpj/20210706/ru/s3/aws4_request, SignedHeaders=content-md5;host;x-amz-content-sha256;x-amz-date, Signature=0182d74943398b840b4f6fb44b902da2d11c3c43d1546b88aada532fe9fcfb57

At the same time, Wasabi's benchmark (#102) with the same credentials:

 ./s3-benchmark -a BbfMqjgvqatXfVgicifhnBLmRRpkeC9dsS4nEiwegtP_3HjPqhzQM62hyZR35gz9WkfaGt2dHimzPmXtih8rWhpj  -s  e4afc0723b1c885c7b498c08a966838a834134e121f1dd507b6e90e56edf16ca

continues not to work because of wrong authHeaderField[0] on api/auth/center.go:

AWS BbfMqjgvqatXfVgicifhnBLmRRpkeC9dsS4nEiwegtP_3HjPqhzQM62hyZR35gz9WkfaGt2dHimzPmXtih8rWhpj:I/wvd87AEOui0l2ILPZm+tg9o2o=

Logs with the error:

2021-07-06T12:37:33.333+0300    info    handler/put.go:129      bucket is created       {"container_id": "C9V7nbDGTFjheYaRWL5hfwgXoCLQzE7fkyWEmt72Rsz8"}
2021-07-06T12:37:33.333+0300    info    api/router.go:153       call method     {"status": 200, "request_id": "7dabae6e-1f9c-4647-8e77-d04d4442f50e", "method": "CreateBucket", "description": "OK"}
2021-07-06T12:37:38.109+0300    info    api/router.go:153       call method     {"status": 200, "request_id": "6fc9276b-4567-4438-b9b8-9ea788572986", "method": "ListBucketVersions", "description": "OK"}
2021-07-06T12:37:39.952+0300    error   api/user-auth.go:29     failed to pass authentication   {"error": "bad Authorization header field"}
2021-07-06T12:37:39.953+0300    error   api/router.go:144       something went wrong    {"status": 403, "request_id": "b334ad26-724b-4238-921d-b3b1da6ce1df", "method": "PutObject", "description": "Forbidden"}

Response:

Upload status 403 Forbidden: resp: &{Status:403 Forbidden StatusCode:403 Proto:HTTP/1.1 ProtoMajor:1 ProtoMinor:1 Header:map[Date:[Tue, 06 Jul 2021 09:37:39 GMT] Accept-Ranges:[bytes] Content-Length:[345] Content-Type:[application/xml] Server:[NeoFS-S3-GW/dev] X-Amz-Request-Id:[b334ad26-724b-4238-921d-b3b1da6ce1df]] Body:0xc4200d0e80 ContentLength:345 TransferEncoding:[] Close:true Uncompressed:false Trailer:map[] Request:0xc420386000 TLS:0xc4201c1080}
Body: <?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied.</Message><Key>Object-1</Key><BucketName>wasabi-benchmark-bucket</BucketName><Resource>/wasabi-benchmark-bucket/Object-1</Resource><RequestId>b334ad26-724b-4238-921d-b3b1da6ce1df</RequestId><HostId>a14b365d-7860-4b9e-b4d0-05308d40fc84</HostId></Error>
@masterSplinter01
Copy link
Contributor Author

masterSplinter01 commented Jul 14, 2021

Wasabi's benchmark uses old Signature Version 2.

Headers of requests which Wasabi benchmark creates, seems like the example of header here:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/RESTAuthentication.html

This version is deprecated:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingAWSSDK.html#UsingAWSSDK-sig2-deprecation

The gateway receives headers of Signature Version 4:
https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html

Also Wasabi's benchmark looks abandoned.
For example, I couldn't build the project without fixes because of problems with imports. Relevant fixes were made in: wasabi-tech/s3-benchmark#8 , but the PR still not be merged since 2018.

That's why we decided to look at the fork of this benchmark -- https://github.com/chinglinwen/s3-benchmark -- it uses the new version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant