RadosGW strange behavior when using a presigned url generated by SDK PHP
Hi, I tried to generate a presigned url using SDK PHP, but it doesn't work. (I also tried to use boto3 with the same configures and the url works normally) Here is my php code: <?php require 'aws-autoloader.php'; use Aws\S3\S3Client; use Aws\Exception\AwsException; $s3Client = new Aws\S3\S3Client([ 'version' => '2006-03-01', 'region' => 'us-east-1', 'signature_version' => 'v4', 'use_path_style_endpoint' => true, 'endpoint' => 'http://hn.ss.bfcplatform.vn', 'credentials' => [ 'key' => 'DNMZAFE6G2PP8H9P05UU', 'secret' => 'XXX', ] ]); $cmd = $s3Client->getCommand('PutObject', [ 'Bucket' => 'huynnp-testbucket1', 'Key' => 'testfile.txt', ]); $request = $s3Client->createPresignedRequest($cmd, '+60 minutes'); // Set the expiration time as desired $presignedUrl = (string)$request->getUri(); echo "$presignedUrl"; ?> and then: curl -X PUT -T testfile.txt `php s3.php` <?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><RequestId>tx00000b7bb3b2deb6a6ef2-00649d5ebd-d1d50041-hn-1</RequestId><HostId>d1d50041-hn-1-hn</HostId></Error> I enable the debug_rgw and what I can see is really strange. the domain has been added :8084, so it make "canonical request hash" and "signature" between client and server unmatched. I can't explain why does this happens 2023-06-29T17:10:46.880+0700 7f26014b0700 10 v4 credential format = DNMZAFE6G2PP8H9P05UU/20230629/us-east-1/s3/aws4_request 2023-06-29T17:10:46.880+0700 7f26014b0700 10 access key id = DNMZAFE6G2PP8H9P05UU 2023-06-29T17:10:46.880+0700 7f26014b0700 10 credential scope = 20230629/us-east-1/s3/aws4_request 2023-06-29T17:10:46.880+0700 7f26014b0700 10 req 15647562574720867919 1000005ns canonical headers format = host:hn.ss.bfcplatform.vn:8084 2023-06-29T17:10:46.880+0700 7f26014b0700 10 payload request hash = UNSIGNED-PAYLOAD 2023-06-29T17:10:46.880+0700 7f26014b0700 10 canonical request = PUT /huynnp-testbucket1/testfile.txt X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=DNMZAFE6G2PP8H9P05UU%2F20230629%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230629T101046Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host host:hn.ss.bfcplatform.vn:8084 host UNSIGNED-PAYLOAD 2023-06-29T17:10:46.880+0700 7f26014b0700 10 canonical request hash = d28e6c3104aff99e9928f902892627d2b284a29d489fbb034ed5c90aa21c566a 2023-06-29T17:10:46.880+0700 7f26014b0700 10 string to sign = AWS4-HMAC-SHA256 20230629T101046Z 20230629/us-east-1/s3/aws4_request d28e6c3104aff99e9928f902892627d2b284a29d489fbb034ed5c90aa21c566a
On Thu, Jun 29, 2023 at 10:46:16AM -0000, Huy Nguyen wrote:
Hi, I tried to generate a presigned url using SDK PHP, but it doesn't work. (I also tried to use boto3 with the same configures and the url works normally) Do you have some sort of load-balancer in the setup? Either HAProxy, Nginx, or something else.
If the port number isn't in the PHP script's output, by deduction it must be coming from somewhere else. As a bug or misconfiguration. -- Robin Hugh Johnson Gentoo Linux: Dev, Infra Lead, Foundation Treasurer E-Mail : robbat2@gentoo.org GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85 GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136
Thanks for your reply, Yes, my setup is like the following: RGWs (port 8084) -> Nginx (80, 443) So this why it make me confuse when :8084 appear with the domain. And this behavior only occurs with PHP's generated url, not in Boto3
Thanks for your reply, Yes, my setup is like the following: RGWs (port 8084) -> Nginx (80, 443)
So this why it make me confuse when :8084 appear with the domain.
And this behavior only occurs with PHP's generated url, not in Boto3 Put tcpdump or something else between nginx & RGW and capture the
On Fri, Jun 30, 2023 at 01:21:57AM -0000, Huy Nguyen wrote: transaction when using Boto3 vs PHP. I'm relatively sure it's nginx adding it for you. -- Robin Hugh Johnson Gentoo Linux: Dev, Infra Lead, Foundation Treasurer E-Mail : robbat2@gentoo.org GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85 GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136
Thanks for your support, Using tcpdump and wireshark, I can see both boto3 and PHP transactions have this field: Host: hn.ss.bfcplatform.vn\r\n Which does not contain 8084, so I'm still confused about how it appeared =) But anyway, this configuration in nginx was solved the problem: proxy_set_header X-Forwarded-Port 443;
participants (2)
-
Huy Nguyen
-
Robin H. Johnson