Bug 2008125
| Summary: | graph-builder's www-authenticate parsing is case sensitive, while RFC 7235 calls for case-insensitive auth-schemes | |||
|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | oarribas <oarribas> | |
| Component: | OpenShift Update Service | Assignee: | Over the Air Updates <aos-team-ota> | |
| OpenShift Update Service sub component: | operand | QA Contact: | Yang Yang <yanyang> | |
| Status: | CLOSED ERRATA | Docs Contact: | Kathryn Alexander <kalexand> | |
| Severity: | high | |||
| Priority: | high | CC: | bleanhar, lmohanty, mfiedler, ndabhi, oarribas, openshift-bugs-escalate, pmahajan, vrutkovs, wking | |
| Version: | 4.6 | |||
| Target Milestone: | --- | |||
| Target Release: | 4.10.0 | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: |
Cause: OSUS was using case-sensitive header parsing
Consequence: Nexus registry could not be used as a source for OSUS image
Fix: OSUS is using case-insentive parsing of authentication header
Result: Nexus registry headers are correctly parsed and can be used as source of openshift release images for OSUS
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 2030533 (view as bug list) | Environment: | ||
| Last Closed: | 2023-03-09 11:30:44 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2030533 | |||
|
Description
oarribas
2021-09-27 11:12:32 UTC
> WWW-Authenticate: BASIC realm="..." From [1]: * The scheme name is "Basic". * The authentication parameter 'realm' is REQUIRED ([RFC7235], Section 2.2). ... Note that both scheme and parameter names are matched case-insensitively. So your header looks legal to me. The library we vendor for parsing uses a regexp [2]. The "'method' field missing" error is from WwwHeaderParseError [3], which is called here [4]. So the issue seems to be [2]: (?P<method>[A-Z][a-z]+) matching 'Basic', but not your 'BASIC', despite [1] calling for case-insensitive matching. Case-insensitive method matching is also covered in [5]. So we need to make dkregistry more flexible, and then bump the version Cincinnati is vendoring. [1]: https://datatracker.ietf.org/doc/html/rfc7617#section-2 [2]: https://github.com/camallo/dkregistry-rs/blob/854d0da53bef5dd85b5e901123e85d43af97c74e/src/v2/auth.rs#L100 [3]: https://github.com/camallo/dkregistry-rs/blob/854d0da53bef5dd85b5e901123e85d43af97c74e/src/v2/auth.rs#L116 [4]: https://github.com/camallo/dkregistry-rs/blob/854d0da53bef5dd85b5e901123e85d43af97c74e/src/v2/auth.rs#L133-L134 [5]: https://datatracker.ietf.org/doc/html/rfc7235#section-2.1 This bug is not applicable to OCP releases as OSUS (OpenShift update service) releases done through CPaaS which is independent from OCP releases. Also this bug is does not impact the public instance of OSUS (run by Red Hat). Hence removing blocker + flag. Moving it to verified as full functional test on OSUSv5.0.1 passed Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (RHEA: OSUS Enhancement Update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2023:1161 |