Bug 1018642 - Failed to delete the ssh key with name "."
Summary: Failed to delete the ssh key with name "."
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Master
Version: 1.2.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: ---
Assignee: Luke Meyer
QA Contact: libra bugs
URL:
Whiteboard:
Depends On: 980306
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-10-14 03:38 UTC by Tian Feng
Modified: 2017-03-08 17:35 UTC (History)
10 users (show)

Fixed In Version: rubygem-openshift-origin-controller-1.9.16.3-1.el6op
Doc Type: Bug Fix
Doc Text:
Cause: Keys with name "." or ".." were misinterpreted by the REST API. Consequence: Such keys could not be deleted. Fix: Disallow the creation of keys with names beginning with "." Result: Keys starting with "." can't be added, so there is no need to delete them.
Clone Of: 980306
Environment:
Last Closed: 2014-06-04 00:39:27 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2014:0598 0 normal SHIPPED_LIVE Red Hat OpenShift Enterprise 1.2.8 bug fix and enhancement update 2014-06-04 04:39:15 UTC

Description Tian Feng 2013-10-14 03:38:19 UTC
+++ This bug was initially created as a clone of Bug #980306 +++

Description of problem:
Failed to delete a ssh key with name with "." against RESTAPI

Version-Release number of selected component (if applicable):

devenv_3434 and STG 

How reproducible:

always

Steps to Reproduce:

1.Add a ssh key with name "."
2.Delete it
3.

Actual results:

It will return to /app/console/key, and the page not found.

Expected results:

Delete it successfully.

Additional info:

--- Additional comment from Tian Feng on 2013-07-02 01:04:57 EDT ---

Also happen on REST API

client:
[sunwei@dhcp-8-229 ~]$ rhc sshkey remove .
Removing the key '. ... Password: ******
The server did not respond correctly. This may be an issue with the server configuration or with your connection to the server (such as a Web proxy or firewall).
Please verify that you can access the OpenShift server https://ec2-67-202-36-189.compute-1.amazonaws.com/broker/rest/user/keys/
[sunwei@dhcp-8-229 ~]$ rhc sshkey remove . -d
DEBUG: Using config file /home/sunwei/.openshift/express.conf
Removing the key '. ... DEBUG: Authenticating with RHC::Auth::Basic
DEBUG: Connecting to https://ec2-67-202-36-189.compute-1.amazonaws.com/broker/rest/api
DEBUG: Deleting key '.'
DEBUG: Finding key .
DEBUG: Getting user info
DEBUG: Client supports API versions 1.1, 1.2, 1.3, 1.4, 1.5
DEBUG: Request GET https://ec2-67-202-36-189.compute-1.amazonaws.com/broker/rest/api
DEBUG: SSL Verification failed -- Using self signed cert
DEBUG:    code 200 1111 ms
DEBUG: Server supports API versions 1.0, 1.1, 1.2, 1.3, 1.4, 1.5
Password: *
DEBUG: Request GET https://ec2-67-202-36-189.compute-1.amazonaws.com/broker/rest/user
DEBUG:    code 200 1066 ms
DEBUG: Getting all keys for user wsun+3
DEBUG: Request GET https://ec2-67-202-36-189.compute-1.amazonaws.com/broker/rest/user/keys
DEBUG:    code 200  550 ms
DEBUG: Deleting key .
DEBUG: Request DELETE https://ec2-67-202-36-189.compute-1.amazonaws.com/broker/rest/user/keys/
DEBUG:    code 404  279 ms
DEBUG: Response did not include a message from server: invalid character at "<!DOCTYPE "
The server did not respond correctly. This may be an issue with the server configuration or with your connection to the server (such as a Web proxy or firewall).
Please verify that you can access the OpenShift server https://ec2-67-202-36-189.compute-1.amazonaws.com/broker/rest/user/keys/

--- Additional comment from Jordan Liggitt on 2013-07-02 08:43:22 EDT ---

The links generated for a key whose name is "." are incorrect.

The '.' needs to be encoded, or it will be normalized to point to the parent path segment, like this:

    "DELETE": {
        "href": "https://openshift.redhat.com/broker/rest/user/keys/",
        "method": "DELETE",
        "optional_params": [ ],
        "rel": "Delete SSH key",
        "required_params": [ ]
    }


A similar issue probably exists for a key named ".."

--- Additional comment from Lili Nader on 2013-10-01 21:52:23 EDT ---

Added code to prevent keys with names starting with "."

https://github.com/openshift/origin-server/pull/3757

There isn't much that can be done for any existing keys that start with "." other than a manual delete by OPS team.

--- Additional comment from Clayton Coleman on 2013-10-02 16:08:11 EDT ---

How many users have keys of this form?

--- Additional comment from Clayton Coleman on 2013-10-02 16:11:19 EDT ---

Also - why is starting with '.' important?  This bug sounds like it's more about '.' and '..', not keys of the form '.<something>'.  Being more restrictive doesn't help much here.

--- Additional comment from openshift-github-bot on 2013-10-02 20:41:48 EDT ---

Commit pushed to master at https://github.com/openshift/origin-server

https://github.com/openshift/origin-server/commit/8bef57b441cd60187cbcbeea219c7a7045140b6b
Bug 980306

--- Additional comment from Peter Ruan on 2013-10-03 03:05:23 EDT ---

tested with devenv_3854, still fail to delete the sshkey named '.'

[peter@unused-16-138 <DEV> ~]# rhc sshkey delete . -d
DEBUG: Using config file /home/peter/.openshift/express.conf
Warning: This command is deprecated. Please use 'rhc sshkey-remove' instead.

Removing the key '. ... DEBUG: Authenticating with RHC::Auth::Token
DEBUG: Connecting to https://ec2-54-224-126-19.compute-1.amazonaws.com/broker/rest/api
DEBUG: Deleting key '.'
DEBUG: Finding key .
DEBUG: Getting user info
DEBUG: Client supports API versions 1.1, 1.2, 1.3, 1.4, 1.5
DEBUG: Using token authentication
DEBUG: Created new httpclient
DEBUG: Request GET https://ec2-54-224-126-19.compute-1.amazonaws.com/broker/rest/api
DEBUG: SSL Verification failed -- Using self signed cert
DEBUG:    code 200  603 ms
DEBUG: Server supports API versions 1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6
DEBUG:    Using API version 1.5
DEBUG: Client API version 1.5 is not current. Refetching API
DEBUG: Using token authentication
DEBUG: Request GET https://ec2-54-224-126-19.compute-1.amazonaws.com/broker/rest/api
DEBUG:    code 200  142 ms
DEBUG: Using token authentication
DEBUG: Request GET https://ec2-54-224-126-19.compute-1.amazonaws.com/broker/rest/user
DEBUG:    code 200  214 ms
DEBUG: Getting all keys for user pruan
DEBUG: Using token authentication
DEBUG: Request GET https://ec2-54-224-126-19.compute-1.amazonaws.com/broker/rest/user/keys
DEBUG:    code 200  138 ms
DEBUG: Deleting key .
DEBUG: Using token authentication
DEBUG: Request DELETE https://ec2-54-224-126-19.compute-1.amazonaws.com/broker/rest/user/keys/
DEBUG:    code 404  137 ms
DEBUG: Response did not include a message from server: invalid character at "<!DOCTYPE "

The server did not respond correctly. This may be an issue with the server configuration or with your connection to the server (such as a Web proxy or
firewall). Please verify that you can access the OpenShift server https://ec2-54-224-126-19.compute-1.amazonaws.com/broker/rest/user/keys/

--- Additional comment from Lili Nader on 2013-10-03 12:05:36 EDT ---

Please see comment 3 - Existing keys starting with . cannot be deleted though the API

--- Additional comment from Peter Ruan on 2013-10-03 12:09:33 EDT ---

When I tested it, I added the sshkey from scratch so it's not existing...looks like the code to prevent user from added '.' as the key name is not being hit.

--- Additional comment from Peter Ruan on 2013-10-03 15:17:43 EDT ---

verfiied with devenv_3958

[peter@unused-16-138 <DEV> .openshift]# rhc sshkey add . ~/.ssh/id_rsa.pub.old 
Invalid key name. Name cannot start with "."
[peter@unused-16-138 <DEV> .openshift]#

Comment 1 Tian Feng 2013-10-14 03:39:41 UTC
Sorry for the wrong version, it's ose-1.2.4.

Comment 4 Luke Meyer 2014-01-03 15:07:29 UTC
Patch applied.

https://github.com/openshift/enterprise-server/pull/183
Cherry-picked from origin-server:
    commit 8bef57b441cd60187cbcbeea219c7a7045140b6b
    Author: Lili Nader <lnader>
    Date:   Tue Oct 1 14:18:42 2013 -0700

Comment 5 Luke Meyer 2014-01-08 13:37:59 UTC
Just need to rebuild controller.

Comment 8 Yanping Zhang 2014-05-21 05:50:15 UTC
Verified on puddle 1-2-RHSCL11-2014-05-20

Verify steps:
#rhc sshkey add . ~/.ssh/newid_rsa.pub
#rhc sshkey add .. ~/.ssh/newid_rsa.pub
#rhc sshkey add .newkey ~/.ssh/newid_rsa.pub

actual results:
all display this info:
Invalid key name. Name cannot start with "."

additional info:
Also verified with rest API,web console method, have right prompt info:Invalid key name. Name cannot start with ".".

Comment 10 errata-xmlrpc 2014-06-04 00:39:27 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-0598.html


Note You need to log in before you can comment on or make changes to this bug.