RiakCS large file uploads fail with 403/AccessDenied and 400/InvalidDigest

Niels O nielsoo at gmail.com
Tue Mar 10 07:16:20 EDT 2015


Hello Shino,

I was uploading this http://we.tl/RQkKk1G7ly file to riakCS so the correct
MD5 digest should be calculatable

I don't know how to generate a pcap formatted file from linux, but I made
an ngrep which might also do the job? ...

the ngrep below:

interface: eth0 (172.16.0.0/255.255.248.0)
filter: (ip or ip6) and ( host 172.16.3.21 )
####
T 172.16.2.99:35151 -> 172.16.3.21:8080 [AP]
  PUT http://testje.s3.amazonaws.com:443/4096k HTTP/1.1..User-Agent:
aws-sdk-nodejs/2.1.8 linux/v0.10.20..Content-Type:
application/octet-stream..Content-MD5:
0BsQLab2tMEzr8IWoS2m5w==..Content-Length: 4194304..Host: testje.s3.
  amazonaws.com..Expect: 100-continue..X-Amz-Date: Tue, 10 Mar 2015
10:16:36 GMT..Authorization: AWS
GHSEZVCH4NYD359IZUEX:E2Ur8OR+po687h1c6/PUBx6gYzQ=..Connection: close....
##
T 172.16.2.99:35151 -> 172.16.3.21:8080 [AP]
  PUT http://testje.s3.amazonaws.com:443/4096k HTTP/1.1..User-Agent:
aws-sdk-nodejs/2.1.8 linux/v0.10.20..Content-Type:
application/octet-stream..Content-MD5:
0BsQLab2tMEzr8IWoS2m5w==..Content-Length: 4194304..Host: testje.s3.
  amazonaws.com..Expect: 100-continue..X-Amz-Date: Tue, 10 Mar 2015
10:16:36 GMT..Authorization: AWS
GHSEZVCH4NYD359IZUEX:E2Ur8OR+po687h1c6/PUBx6gYzQ=..Connection: close....
##
T 172.16.3.21:8080 -> 172.16.2.99:35151 [AP]
  HTTP/1.1 100 Continue....
##
T 172.16.2.99:35151 -> 172.16.3.21:8080 [A]

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.
##


<SNIP>


T 172.16.2.99:35151 -> 172.16.3.21:8080 [A]

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.
#####
T 172.16.3.21:8080 -> 172.16.2.99:35151 [AP]
  HTTP/1.1 400 Bad Request..Server: Riak CS..Date: Tue, 10 Mar 2015
10:16:37 GMT..Content-Type: application/xml..Content-Length: 215....
#
T 172.16.3.21:8080 -> 172.16.2.99:35151 [AP]
  <?xml version="1.0"
encoding="UTF-8"?><Error><Code>InvalidDigest</Code><Message>The Content-MD5
you specified was
invalid.</Message><Content-MD5>0BsQLab2tMEzr8IWoS2m5w==</Content-MD5><HostId>host-id</HostId></Error>

On Tue, Mar 10, 2015 at 4:15 AM, Shunichi Shinohara <shino at basho.com> wrote:

> Hi Niels,
>
> Thank you for your interest on Riak CS.
>
> Some questions about 400 - InvalidDigest:
>
> - Can you confirm which MD5 was correct for the log
>   2015-02-11 16:34:17.854 [debug]
> <0.23568.18>@riak_cs_put_fsm:is_digest_valid:326
>      Calculated = <<"pIFX5fpeo7+sPPNjtSBWBg==">>,
>      Reported = "0BsQLab2tMEzr8IWoS2m5w=="
> - What was the transfer-encoding? I want to confirm chunked encoding
> was NOT used.
> - Hopefully, packet capture (e.g. by pcap format) will be helpful to debug
>
> Thanks,
> Shino
>
> On Tue, Mar 10, 2015 at 10:25 AM, Kota Uenishi <kota at basho.com> wrote:
> > Sorry, being late. I thought I've replied to you, but it was a very
> > close one where I think you're hitting the same problem as this:
> >
> >
> http://lists.basho.com/pipermail/riak-users_lists.basho.com/2015-February/016845.html
> >
> > Riak CS often includes `=' in uploadId of multipart uploads while S3
> > doesn't (where no specs described in official documents).
> >
> > On Thu, Feb 12, 2015 at 12:41 AM, Niels O <nielsoo at gmail.com> wrote:
> >> Hello everyone,
> >>
> >> I have just installed riakcs and have the s3cmd and nodejs (the official
> >> amazon) plugin working.
> >>
> >> with the same credentials (accesskey&secret) I CAN upload big files with
> >> S3CMD but I CANNOT with the AWS/S3 nodejs plugin? (downloading very big
> >> files is no problem b.t.w.)
> >>
> >>
> >> with the nodejs plugin
> >>
> >> - until 992k, (I tested with 32 KiB increases) everything works
> >> - starting at 1024 KiB I get [400 InvalidDigest: The Content-MD5 you
> >> specified was invalid.]
> >> - from 8192 KiB and beyond I get [403 AccessDenied] back from riakcs.
> >>
> >> this while -again- with s3cmd I am able to upload files of over 1 GiB
> size
> >> easily  .. same machine, same creds
> >>
> >> any ideas?
> >>
> >>
> >>
> >>
> >>
> >> (below some riakcs debug logging from both the 400 and 403)  ...
> >>
> >>
> >> 400 - InvalidDigest:
> >>
> >> 2015-02-11 16:34:16.911 [debug]
> >> <0.17889.18>@riak_cs_s3_auth:calculate_signature:129 STS:
> >>
> ["PUT","\n","0BsQLab2tMEzr8IWoS2m5w==","\n","application/octet-stream","\n","\n",[["x-amz-date",":",<<"Wed,
> >> 11 Feb 2015 15:34:16 GMT">>,"\n"]],["/testje/4096k",[]]]
> >> 2015-02-11 16:34:17.854 [debug]
> >> <0.23568.18>@riak_cs_put_fsm:is_digest_valid:326 Calculated =
> >> <<"pIFX5fpeo7+sPPNjtSBWBg==">>, Reported = "0BsQLab2tMEzr8IWoS2m5w=="
> >> 2015-02-11 16:34:17.860 [debug] <0.23568.18>@riak_cs_put_fsm:done:303
> >> Invalid digest in the PUT FSM
> >>
> >>
> >> 403 - AccessDenied
> >>
> >> 2015-02-11 16:36:00.448 [debug]
> >> <0.22889.18>@riak_cs_s3_auth:calculate_signature:129 STS:
> >>
> ["POST","\n",[],"\n","application/octet-stream","\n","\n",[["x-amz-date",":",<<"Wed,
> >> 11 Feb 2015 15:36:00 GMT">>,"\n"]],["/testje/8192k","?uploads"]]
> >> 2015-02-11 16:36:00.484 [debug]
> >> <0.23539.18>@riak_cs_s3_auth:calculate_signature:129 STS:
> >>
> ["PUT","\n","sq5d2PIhC7I1xxT8Rp9cVg==","\n","application/octet-stream","\n","\n",[["x-amz-date",":",<<"Wed,
> >> 11 Feb 2015 15:36:00
> >>
> GMT">>,"\n"]],["/testje/8192k","?partNumber=1&uploadId=TXR2AuCeRDWwc2bviLPcOg=="]]
> >> 2015-02-11 16:36:00.484 [debug]
> >> <0.23539.18>@riak_cs_wm_common:post_authentication:471 bad_auth
> >> 2015-02-11 16:36:00.494 [debug]
> >> <0.23543.18>@riak_cs_s3_auth:calculate_signature:129 STS:
> >>
> ["DELETE","\n",[],"\n","application/octet-stream","\n","\n",[["x-amz-date",":",<<"Wed,
> >> 11 Feb 2015 15:36:00
> >> GMT">>,"\n"]],["/testje/8192k","?uploadId=TXR2AuCeRDWwc2bviLPcOg=="]]
> >> 2015-02-11 16:36:00.494 [debug]
> >> <0.23543.18>@riak_cs_wm_common:post_authentication:471 bad_auth
> >>
> >>
> >> _______________________________________________
> >> riak-users mailing list
> >> riak-users at lists.basho.com
> >> http://lists.basho.com/mailman/listinfo/riak-users_lists.basho.com
> >>
> >
> >
> >
> > --
> > Kota UENISHI / @kuenishi
> > Basho Japan KK
> >
> > _______________________________________________
> > riak-users mailing list
> > riak-users at lists.basho.com
> > http://lists.basho.com/mailman/listinfo/riak-users_lists.basho.com
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.basho.com/pipermail/riak-users_lists.basho.com/attachments/20150310/ac436ab4/attachment-0002.html>


More information about the riak-users mailing list