Metadata with trailing whitespace causes SignatureDoesNotMatch with signature_version s3 #2409
Comments
kdaily
added
investigating
|
Hi @tiandrey, Does this occur for you when using AWS S3 resources and not Ceph? I tried this using a standard S3 endpoint, and I did not receive this error: |
kdaily
added
bug
|
I haven't tried Amazon S3 (in fact, I don't even have an account there), but I also tried local MinIO instance - and it works fine with |
github-actions
bot
removed
the
response-requested
|
Is this still an issue? There hasn't been any activity here in a while. There are quite a few things that could cause the |
tim-finnigan
added
the
response-requested
|
If you didn't change specified (and related) pieces of code then it would still be an issue of course. |
|
I just tested this and it uploaded the file for me (on version 1.34.128): import boto3
from botocore.config import Config
config_hash = {
's3': {
'addressing_style': 'path',
},
'signature_version': 'v4',
}
config = Config(**config_hash)
s3conn = boto3.resource('s3', config=config)
bucket = s3conn.Bucket('test-bucket')
data = b'test data'
key = bucket.Object('test_upload')
metadata = {
'example': 'metadata with trailing space '
}
key.put(Metadata=metadata, Body=data)Here is documentation on configuration values used: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html. As noted there, using If you'd like to us to investigate this further please provide an updated snippet for reproducing the issue. |
tim-finnigan
added
closing-soon
and removed
response-requested
|
Yet still there are some S3-compatible servers that work better with 's3' signature. |
|
Snippet from the OP still gives the same error as before with s3 signature. |
|
Update - I've fixed the problem in our installation exactly by switching to |
|
This issue is now closed. Comments on closed issues are hard for our team to see. |
|
Hi @tiandrey, to be clear, for both SigV4 and SigV2 (the |
|
Hi @nateprewitt, thanks for the info, official documentation is not really clear about trimming trailing whitespace, but referenced RFC states that leading and trailing LWS may be removed without changing the semantics of field value, so it can be assumed that leading and trailing LWS is not a part of field value, so this issue is really caused by our S3 server software (namely ceph) not stripping headers before calculating checksum. I'll check if this is fixed in ceph upstream and open issue there if it's unfixed yet. |
Describe the bug
I've run into this bug when our local pypicloud (that uses botocore and boto3) instance failed to upload specific package into local ceph storage - the error was
botocore.exceptions.ClientError: An error occurred (SignatureDoesNotMatch) when calling the PutObject operation: Unknown. I've investigated this problem and found out that it was caused by trailing whitespace in one of metadata fields: if I remove trailing whitespace, upload works fine. Also changing signature_version from s3 to s3v4 solves the problem, but sometimes s3v4 signature is not supported and we have to use s3 signature.Steps to reproduce
The following minimalistic snippet of code reproduces the bug.
Expected behavior
Upload completes without error.
Suggested solution
It looks like the problem lies in
canonical_custom_headersmethod ofHmacV1Authclass defined in botocore/auth.py:You strip leading and trailing whitespace from headers that are used to create signature, but leave original header values as is, and this leads to failure in signature checking. You should either remove
.strip()from this method (I've checked, it works fine), or change values of original headers too.Debug logs
The text was updated successfully, but these errors were encountered: