[ https://issues.apache.org/jira/browse/CLOUDSTACK-3341?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13698649#comment-13698649 ]
Thomas O'Dowd commented on CLOUDSTACK-3341: ------------------------------------------- The following is the S3 request/response that I sniffed. It is generated by my browser (chrome) when I clicked on the link provided by cloudstack to download the template. Notice that request gets a 403 which means permission denied and fails because the signature used in the S3 Query String Authenicated Request does not match the expected signature given the request. ============ Request ============== GET /template/tmpl/2/201/201-2-f7d6ac8f-9e69-3bf0-b35f-fa7435c36058/tinylinux.vhd?Expires=1372834299&AWSAccessKeyId=AK IAJ6AT5MEKDOU6H7GQ&Signature=1rOfSK7YNr5/RMZrjAjUBeab7bw= HTTP/1.1. Host: wexfordire.s3.amazonaws.com. Connection: keep-alive. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8. User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36. Referer: http://localhost:8080/client/. Accept-Encoding: gzip,deflate,sdch. Accept-Language: en-US,en;q=0.8. . ============ Response ============== # T 207.171.163.162:80 -> 10.181.164.198:39716 [AP] HTTP/1.1 403 Forbidden. x-amz-request-id: B17BEC2FA6C05B8A. x-amz-id-2: +M9fdqEvd1adPdHELXgUpn88OkX/tpiKv8d6W/lToIx9MN4ByoWN9vILTW2adXlS. Content-Type: application/xml. Transfer-Encoding: chunked. Date: Wed, 03 Jul 2013 05:59:44 GMT. Server: AmazonS3. . 3b3. <?xml version="1.0" encoding="UTF-8"?> <Error><Code>SignatureDoesNotMatch</Code><Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message><StringToSignBytes>47 45 54 0a 0a 0a 31 33 37 32 38 33 34 32 39 39 0a 2f 77 65 78 66 6f 72 64 69 72 65 2f 74 65 6d 70 6c 61 74 65 2f 74 6d 70 6c 2f 32 2f 32 30 31 2f 32 30 31 2d 32 2d 66 37 64 36 61 63 38 66 2d 39 65 36 39 2d 33 62 66 30 2d 62 33 35 66 2d 66 61 37 34 33 35 63 33 36 30 35 38 2f 74 69 6e 79 6c 69 6e 75 78 2e 76 68 64</StringToSignBytes><RequestId>B17BEC2FA6C05B8A</RequestId><HostId>+M9fdqEvd1adPdHELXgUpn88OkX/tpiKv8d6W/lToIx9MN4ByoWN9vILTW2adXlS</HostId><SignatureProvided>1rOfSK7YNr5/RMZrjAjUBeab7bw=</SignatureProvided><StringToSign>GET 1372834299 /wexfordire/template/tmpl/2/201/201-2-f7d6ac8f-9e69-3bf0-b35f-fa7435c36058/tinylinux.vhd</StringToSign><AWSAccessKeyId>AKIAJ6AT5MEKDOU6H7GQ</AWSAccessKeyId></Error>. > Object_Store_Refactor - "Download Template" Link gets a 403 from object store. > ------------------------------------------------------------------------------ > > Key: CLOUDSTACK-3341 > URL: https://issues.apache.org/jira/browse/CLOUDSTACK-3341 > Project: CloudStack > Issue Type: Bug > Security Level: Public(Anyone can view this level - this is the > default.) > Affects Versions: 4.2.0 > Environment: chrome on linux > devcloud > Cloudian or Amazon AWS S3 object stores (you'll need an S3 account on either) > Reporter: Thomas O'Dowd > Priority: Critical > Labels: s3 > > 1. Login to a freshly deployed devcloud server. > 2. Click Infrastructure > 3. Click secondary Storage > 4. Remove NFS > 5. Add new S3 Secondary Storage (without https so the S3 traffic is easy to > sniff). > (I used AWS with 300,000 timeouts (just to be sure as s3 errors are not > shown)) > (I used a pre-allocated bucket (as is expected)). > 6. Click on Templates > 7. Register a new template - I used a copy of the tinylinux.vhd image that > comes with devcloud but I uploaded it under a new name - MyTiny. > 8. use s3cmd or other external tool and wait until the template is in the > directory. This can take time as it is uploaded using multipart uploads which > are not visible in the bucket until the upload is complete. > 9. Once available, click again on Templates. > 10. Hover over the QuickView of the MyTiny template. > 11. Click "Download Template" > 12. Confirm you want to download and a pop-up will appear asking you to click > a large link. > 13. Click the large link (this is ugly but less important than the actual > issue). > Expectation: > 14. The template will be downloaded by your browser. > Actual: > 14. An XML error indicating a signature failure and no template downloaded. > I have replicated this issue on both Amazon S3 and Cloudian S3 Object Stores. > I will add more details to this issue shortly. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira