| *** adu has quit IRC | 00:00 | |
| *** adu has joined #openstack-swift | 00:05 | |
| *** rcernin has quit IRC | 00:12 | |
| clayg | oh *yeah* "ValueError: encryption_root_secret option in proxy-server.conf must be a base64 encoding of at least 32 raw bytes" <- what section? | 00:12 |
|---|---|---|
| notmyname | com'on gerrit. tell me the differences between this patch set and the last, but not the stuff that was added in the dependent patch | 00:14 |
| clayg | notmyname: timur says that if gerrit doesn't have the right diff it's the patch authors fault | 00:15 |
| notmyname | yeah, he told me that too. but I don't think he's right in this case | 00:15 |
| clayg | i blame #brexit | 00:16 |
| notmyname | I want to know the differences in patch sets N-1 and N in encryption-M, but not the new things that were added in the latest patch set in encryption-{M-1} | 00:16 |
| notmyname | that's probably already a git command. `git diff --do-what-i-mean` | 00:17 |
| clarkb | seems like we have had this conversation before :) its actually not super trivial to do right but you can interdiff <$(git show patchset1) <$(patchset2) to approximate something that works | 00:17 |
| clarkb | er git show patchset2 | 00:17 |
| notmyname | before? like when EC landed? ;-) | 00:18 |
| notmyname | oh, yeah, that does sound familiar | 00:18 |
| clarkb | basically "pretty close" is easy. "Correct" for some version of "Correct" is harder | 00:18 |
| notmyname | close counts in horseshoes, hand grenades, and git diffs? | 00:19 |
| *** vinsh has quit IRC | 00:20 | |
| *** vinsh has joined #openstack-swift | 00:20 | |
| *** lyrrad has quit IRC | 00:22 | |
| clayg | notmyname: vsaio has a thing like -> command "git clone -b #{node['swift_repo_branch']} #{node['swift_repo']}" | 00:25 |
| clayg | I had been doing export SWIFT_REPO_BRANCH=feature/crypto | 00:25 |
| clayg | is there a thing you can put after the -b when cloning that will give you patch 328209? | 00:25 |
| patchbot | clayg: https://review.openstack.org/#/c/328209/ - swift (feature/crypto-review) - Add encryption overview doc | 00:25 |
| clayg | notmyname: or at a minimum - is it like feature/crypto-review or something now? | 00:25 |
| clarkb | clayg: && git review -d 328209 or fetch and checkout FETCH_HEAD | 00:26 |
| notmyname | I'd been using `git review -d <num>` | 00:26 |
| notmyname | isn't there a syntax that can give you a patch set there? | 00:26 |
| clarkb | yes change,ps | 00:26 |
| clarkb | if you drop the ,ps you get the latest ps | 00:27 |
| clayg | clarkb: notmyname: yeah so... not a branch? oh... | 00:27 |
| *** welldannit has quit IRC | 00:35 | |
| *** daemontool has quit IRC | 00:38 | |
| *** Suyash has quit IRC | 00:45 | |
| kota_ | good morning. | 00:53 |
| *** StraubTW has joined #openstack-swift | 00:57 | |
| clayg | oh good point -> Note These container sync configuration steps will be necessary for container sync probe tests to pass if encryption middleware is included in the proxy pipeline of a test cluster. | 01:00 |
| *** diogogmt has quit IRC | 01:01 | |
| clayg | timburke: why not content-type again? | 01:03 |
| clayg | timburke: are we *sure* we encrypt customer uset metadata names? just the values yeah? | 01:05 |
| clayg | what is this? In [8]: urllib.unquote('%7B%22body_key%22%3A+%7B%22iv%22%3A+%22NUnKj%2BU938ynzc%2F01Y0eFg%3D%3D%22%2C+%22key%22%3A+%224cImIJrB3OljN%2BjbNUppU5bnYapkxNqjzwKetSLr%2FbA%3D%22%7D%2C+%22cipher%22%3A+%22AES_CTR_256%22%2C+%22iv%22%3A+%22yECbKJ5zS2v6Ck91QSS%2BQQ%3D%3D%22%2C+%22key_id%22%3A+%7B%22path%22%3A+%22L0FVVEhfdGVzdC90ZXN0L3Rlc3Q%3D%22%2C+%22v%22%3A+%221%22%7D%7D') | 01:09 |
| clayg | Out[8]: '{"body_key":+{"iv":+"NUnKj+U938ynzc/01Y0eFg==",+"key":+"4cImIJrB3OljN+jbNUppU5bnYapkxNqjzwKetSLr/bA="},+"cipher":+"AES_CTR_256",+"iv":+"yECbKJ5zS2v6Ck91QSS+QQ==",+"key_id":+{"path":+"L0FVVEhfdGVzdC90ZXN0L3Rlc3Q=",+"v":+"1"}}' | 01:09 |
| clayg | i dont' think those +'s are supposed to be there in that json output | 01:09 |
| clayg | er.. json *looking* output | 01:09 |
| clayg | unquote_*plus* !? | 01:12 |
| clayg | noice | 01:12 |
| *** Jeffrey4l has joined #openstack-swift | 01:16 | |
| *** zul has quit IRC | 01:22 | |
| *** zul_ has joined #openstack-swift | 01:22 | |
| *** tqtran has quit IRC | 01:31 | |
| *** Suyash has joined #openstack-swift | 01:32 | |
| *** cebreidian has quit IRC | 01:33 | |
| clayg | it's really not thatbad | 01:51 |
| *** baojg has joined #openstack-swift | 01:54 | |
| jrichli | what's this? clayg is doing crypto! Yay! I have so much scrollback to read! | 02:20 |
| *** tqtran has joined #openstack-swift | 02:29 | |
| *** tqtran has quit IRC | 02:34 | |
| jrichli | clayg: why not encrypt content-type? We decided to de-scope that when there were challenges to implementing multi-range GETs and there were predicted challenges to fast-post changing content-type. | 02:49 |
| jrichli | crypto reviews : don't forget there are some questions for us to answer in the crypto-review questions column of https://trello.com/b/63l5zQhq/swift-encryption | 02:50 |
| *** gyee has quit IRC | 02:51 | |
| jrichli | s/reviews/reviewers/ | 02:52 |
| *** ChubYann has quit IRC | 02:53 | |
| jrichli | acoles notmyname: we will need the gate changes that will allow for a crypto gate when it is no longer in the default proxy pipeline | 02:57 |
| jrichli | I started looking at that with the suggestions acoles had given me. But I have questions. It's on my list. | 02:58 |
| *** StraubTW has quit IRC | 03:18 | |
| *** rcernin has joined #openstack-swift | 03:34 | |
| openstackgerrit | jingtao liang proposed openstack/swift: Make string.letters PY3 compatible https://review.openstack.org/333712 | 03:37 |
| openstackgerrit | zhangguoqing proposed openstack/swift: Fix Python 3 issues https://review.openstack.org/333713 | 03:38 |
| *** jkothari has joined #openstack-swift | 03:44 | |
| *** baojg has quit IRC | 03:50 | |
| *** baojg has joined #openstack-swift | 03:52 | |
| *** klrmn has quit IRC | 04:23 | |
| *** ppai has joined #openstack-swift | 04:30 | |
| *** tqtran has joined #openstack-swift | 04:31 | |
| *** dmorita has quit IRC | 04:34 | |
| *** tqtran has quit IRC | 04:35 | |
| *** dmorita has joined #openstack-swift | 04:36 | |
| *** psachin has joined #openstack-swift | 04:36 | |
| *** links has joined #openstack-swift | 04:37 | |
| *** dmorita has quit IRC | 04:40 | |
| *** SkyRocknRoll has joined #openstack-swift | 04:43 | |
| *** links has quit IRC | 04:50 | |
| *** links has joined #openstack-swift | 04:50 | |
| *** Suyash has quit IRC | 04:51 | |
| *** adu has quit IRC | 05:21 | |
| *** links has quit IRC | 05:25 | |
| *** rcernin has quit IRC | 05:35 | |
| *** links has joined #openstack-swift | 05:39 | |
| *** sheel has quit IRC | 05:45 | |
| *** zaitcev has quit IRC | 05:48 | |
| mahatic_ | timburke: this answer assures (with reference to wikipedia analysis) that aes 256 should be more than good - http://crypto.stackexchange.com/questions/870/how-does-one-scale-encryption-strength-upwards-from-256-bit | 05:49 |
| mahatic_ | notmyname: acoles_: maybe US and UK should borrow some of these https://en.wikipedia.org/wiki/Indian_voting_machines ;) | 05:51 |
| *** baojg has quit IRC | 05:56 | |
| *** geaaru has joined #openstack-swift | 06:02 | |
| *** links has quit IRC | 06:05 | |
| *** rcernin has joined #openstack-swift | 06:11 | |
| *** links has joined #openstack-swift | 06:18 | |
| *** baojg has joined #openstack-swift | 06:18 | |
| *** nadeem has joined #openstack-swift | 06:19 | |
| *** baojg_ has joined #openstack-swift | 06:22 | |
| *** baojg has quit IRC | 06:23 | |
| timburke | mahatic_: my thought was less to do with having a 512-bit key because we want a 512-bit key, and more to do with using sha512 instead of sha256 because Reasons. i'd be hesitant to use sha512 and then throw out half the bits, which means incorporating them somehow | 06:27 |
| openstackgerrit | jingtao liang proposed openstack/swift: Make string.letters PY3 compatible https://review.openstack.org/333712 | 06:27 |
| *** baojg_ has quit IRC | 06:31 | |
| mahatic_ | timburke: oic. sha512 also happens to be faster on 64-bit OS. Someone also has results - http://crypto.stackexchange.com/questions/26336/sha512-faster-than-sha256 | 06:31 |
| timburke | huh. interesting | 06:32 |
| *** tqtran has joined #openstack-swift | 06:32 | |
| mahatic_ | timburke: also, it doesn't look like cryptography package supports 3aes https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/ | 06:32 |
| timburke | mahatic_: hi, by the way! i rarely get to talk to you on account of timezones! | 06:33 |
| mahatic_ | timburke: heh yes, indeed. hello! :) | 06:33 |
| *** baojg has joined #openstack-swift | 06:35 | |
| *** tqtran has quit IRC | 06:37 | |
| mahatic_ | timburke: I've also become less of an insomniac these days, so not so much of hanging around in the midnight (my time) | 06:37 |
| *** links has quit IRC | 06:37 | |
| timburke | meanwhile my wife just left for a trip, so my insomnia's just ramping up :-) | 06:37 |
| mahatic_ | haha. I thought with a toddler insomnia is always lurking around | 06:38 |
| timburke | nah, she sleeps well. occasionally might wake up in the middle of the night, but she'll mostly put herself back to sleep these days | 06:40 |
| *** jmccarthy has quit IRC | 06:43 | |
| mahatic_ | great, that's a well sorted toddler! | 06:44 |
| *** jmccarthy has joined #openstack-swift | 06:44 | |
| *** links has joined #openstack-swift | 06:49 | |
| *** baojg has quit IRC | 06:54 | |
| *** tesseract- has joined #openstack-swift | 06:57 | |
| *** baojg has joined #openstack-swift | 07:07 | |
| *** rledisez has joined #openstack-swift | 07:13 | |
| *** baojg has quit IRC | 07:23 | |
| *** hseipp has joined #openstack-swift | 07:26 | |
| *** ouchkernel has quit IRC | 07:33 | |
| *** ouchkernel has joined #openstack-swift | 07:38 | |
| openstackgerrit | Victor Stinner proposed openstack/swift: Python 3: fix dict.values()[0] https://review.openstack.org/333303 | 07:53 |
| *** rcernin has quit IRC | 07:59 | |
| *** nadeem has quit IRC | 07:59 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/swift: [WIP] Testing latest u-c https://review.openstack.org/318441 | 08:10 |
| openstackgerrit | jingtao liang proposed openstack/swift: Make string.letters PY3 compatible https://review.openstack.org/333712 | 08:12 |
| rfeusi | I need help for a 2 DC swift cluster architecture with minimal node number. Can some give me a hint? | 08:13 |
| openstackgerrit | YaoZheng proposed openstack/swift: make print python3 compatible https://review.openstack.org/333801 | 08:14 |
| *** cbartz has joined #openstack-swift | 08:16 | |
| *** dmk0202 has joined #openstack-swift | 08:17 | |
| *** daemontool has joined #openstack-swift | 08:17 | |
| *** mingyu has joined #openstack-swift | 08:20 | |
| *** acoles_ is now known as acoles | 08:21 | |
| *** mmcardle has joined #openstack-swift | 08:23 | |
| *** baojg has joined #openstack-swift | 08:35 | |
| *** ppai has quit IRC | 08:36 | |
| *** d0ugal has quit IRC | 08:46 | |
| *** d0ugal has joined #openstack-swift | 08:46 | |
| *** d0ugal has quit IRC | 08:46 | |
| *** d0ugal has joined #openstack-swift | 08:46 | |
| *** ppai has joined #openstack-swift | 08:49 | |
| *** baojg has quit IRC | 08:51 | |
| *** SkyRocknRoll_ has joined #openstack-swift | 08:52 | |
| *** SkyRocknRoll_ has quit IRC | 08:52 | |
| *** jordanP has joined #openstack-swift | 08:59 | |
| *** mingyu has quit IRC | 09:02 | |
| *** mingyu has joined #openstack-swift | 09:03 | |
| *** ppai has quit IRC | 09:32 | |
| *** baojg has joined #openstack-swift | 09:34 | |
| *** ppai has joined #openstack-swift | 09:45 | |
| *** kei_yama has quit IRC | 09:51 | |
| *** kei_yama has joined #openstack-swift | 09:53 | |
| *** kei_yama has quit IRC | 09:55 | |
| kota_ | agh, slower reviews than I estimated. | 09:57 |
| kota_ | acoles: sorry, I'm at the beggining of encyption-3 yet but it seems awsome because it saves also swift3 work :) | 09:58 |
| kota_ | acoles: I'm going to dinner and will attend the teleconf since UTC 1:30 pm. | 09:58 |
| acoles | kota_: great | 09:59 |
| acoles | kota_: always good to hear that some work is useful for more than one thing | 09:59 |
| acoles | kota_: that teleconf will be late for you, sorry! | 10:00 |
| kota_ | acoles: not so late actually, proabley similer with your (and Christian's) weekly meeting time :) | 10:01 |
| * kota_ is leaving to go dinner | 10:02 | |
| *** pcaruana has joined #openstack-swift | 10:09 | |
| *** baojg has quit IRC | 10:20 | |
| *** haypo has joined #openstack-swift | 10:27 | |
| *** baojg has joined #openstack-swift | 10:32 | |
| openstackgerrit | YaoZheng proposed openstack/swift: make print python3 compatible https://review.openstack.org/333801 | 10:36 |
| *** baojg has quit IRC | 10:41 | |
| *** tqtran has joined #openstack-swift | 11:34 | |
| *** cdelatte has joined #openstack-swift | 11:35 | |
| *** jordanP has quit IRC | 11:37 | |
| *** tqtran has quit IRC | 11:39 | |
| *** jkothari is now known as janonymous | 12:00 | |
| *** ppai has quit IRC | 12:00 | |
| *** rcernin has joined #openstack-swift | 12:04 | |
| *** ppai has joined #openstack-swift | 12:14 | |
| *** jordanP has joined #openstack-swift | 12:15 | |
| *** ppai has quit IRC | 12:20 | |
| *** psachin has quit IRC | 12:36 | |
| *** psachin has joined #openstack-swift | 12:38 | |
| *** zul_ is now known as zul | 12:44 | |
| *** janonymous has quit IRC | 12:50 | |
| *** vinsh has quit IRC | 12:51 | |
| *** vinsh has joined #openstack-swift | 12:51 | |
| *** silor has joined #openstack-swift | 12:56 | |
| *** links has quit IRC | 13:00 | |
| *** tsg has joined #openstack-swift | 13:02 | |
| notmyname | good morning | 13:07 |
| *** vinsh_ has joined #openstack-swift | 13:07 | |
| *** vinsh has quit IRC | 13:07 | |
| *** StraubTW has joined #openstack-swift | 13:12 | |
| mahatic_ | notmyname: good morning | 13:14 |
| timburke | morning | 13:15 |
| kota_ | good morning notmyname, timburke | 13:17 |
| *** silor1 has joined #openstack-swift | 13:24 | |
| *** SkyRocknRoll has quit IRC | 13:24 | |
| pdardeau | good morning | 13:25 |
| *** silor has quit IRC | 13:25 | |
| *** silor1 is now known as silor | 13:25 | |
| kota_ | pdardeau: \o/ | 13:26 |
| pdardeau | hi kota! | 13:26 |
| notmyname | oh, hi pdardeau | 13:26 |
| pdardeau | hi notmyname. you're here early | 13:27 |
| notmyname | just couldn't stay away ;-) | 13:28 |
| pdardeau | notmyname: is it excitement from brexit or crypto (or both)? | 13:29 |
| notmyname | crypto :-) | 13:29 |
| *** dmk0202 has quit IRC | 13:31 | |
| torgomatic | hooray early stuff :| | 13:35 |
| *** dmorita has joined #openstack-swift | 13:35 | |
| *** dmorita has quit IRC | 13:39 | |
| *** dmellado_ is now known as dmellado | 13:40 | |
| cbartz | https://review.openstack.org/#/c/333331/ anyone quick feedback? | 13:42 |
| patchbot | cbartz: patch 333331 - swift - Preserve query params in tempurl | 13:42 |
| *** jordanP has quit IRC | 13:56 | |
| *** tsg has quit IRC | 13:58 | |
| *** ametts has joined #openstack-swift | 14:00 | |
| *** diogogmt has joined #openstack-swift | 14:06 | |
| acoles | i almost got to say good morning while it was still morning | 14:14 |
| notmyname | :-) | 14:14 |
| acoles | maybe the uk will shift timezones as a symbolic gesture of separation | 14:15 |
| tdasilva | acoles: is the call over? my internet connection dropped at home :( | 14:16 |
| acoles | tdasilva: it is | 14:16 |
| tdasilva | acoles: ok | 14:16 |
| acoles | tda sorry, git you get to hear any of it? | 14:16 |
| acoles | s/git/did/ | 14:16 |
| pdardeau | acoles: splitters | 14:16 |
| acoles | heh | 14:17 |
| tdasilva | yeah, I was there for I think the first 30 min, then lost connection | 14:17 |
| pdardeau | :1 | 14:17 |
| pdardeau | tabfail | 14:17 |
| acoles | tdasilva: we decided (tentatively) that using a MAC would at least be easier to document (since its not violating any best practice) | 14:18 |
| jrichli | using the md5 itself as the iv was a separate idea, right? | 14:19 |
| jrichli | I sorta prefer that one. I will have to think more about the MAC approach. | 14:19 |
| mahatic_ | yeah without the hexdigest i believe | 14:19 |
| openstackgerrit | Alistair Coles proposed openstack/swift: Enable middleware to set metadata on object POST https://review.openstack.org/328206 | 14:20 |
| openstackgerrit | Alistair Coles proposed openstack/swift: Allow middleware to override metadata header checking https://review.openstack.org/328207 | 14:20 |
| openstackgerrit | Alistair Coles proposed openstack/swift: Enable object body and metadata encryption https://review.openstack.org/328208 | 14:20 |
| jrichli | I am on board with encrypting without the hexdigest. | 14:20 |
| openstackgerrit | Alistair Coles proposed openstack/swift: Add encryption overview doc https://review.openstack.org/328209 | 14:20 |
| mahatic_ | although I'm not sure of the cons of using md5 alone for encryption | 14:20 |
| jrichli | but if we have just a MAC of the md5 as the backend-is-at, doesn't that get stored on disk? and then you have a hash of a plaintext md5 on disk. | 14:21 |
| jrichli | am I wrong? | 14:21 |
| mahatic_ | if there aren't any, that seems simpler and more comprehensible (in current context) and less changes maybe (?) | 14:21 |
| jrichli | cca said that it is a "message locked encryption" scheme, so I think that is an accepted thing to do. as he said, the thing is, you have to have the messge in order to unlock. which we do | 14:22 |
| acoles | That is today's update to crypto-review - not a huge amount of change, mostly in patch 328208 where I made the changes to the iv offset calculation | 14:22 |
| patchbot | acoles: https://review.openstack.org/#/c/328208/ - swift (feature/crypto-review) - Enable object body and metadata encryption | 14:22 |
| torgomatic | so, what, HMAC(key + etag, etag) is what gets stored? seems sane to me | 14:22 |
| jrichli | i guess i am just thinking: we are encrypting the md5 hash because we are saying that a hash needs to be protected. | 14:23 |
| jrichli | but we are claiming now that the HMAC in the clear does not reveal info about the message | 14:24 |
| acoles | torgomatic: yes, something like that. store it under x-object-sysmeta-blah, set x-backend-etag-is-at to blah, and then use a random iv to encrypt the value we already store in x-object-sysmeta-crypto-etag | 14:24 |
| torgomatic | acoles: 👍 | 14:25 |
| acoles | torgomatic: where the value of 'blah' is to be determined by commitee ;) | 14:25 |
| torgomatic | sounds good to me before coffee, at least ;) | 14:25 |
| acoles | jrichli: I'll write it in etherpad, then the rest of you can find the flaws | 14:26 |
| mahatic_ | :) | 14:27 |
| jrichli | acoles: ok, thx | 14:28 |
| mahatic_ | acoles: thanks! | 14:29 |
| acoles | jrichli: I'm assuming a cryptograhically strong hash for the HMAC. maybe there is another function that would suffice, idk. | 14:31 |
| *** joeljwright has joined #openstack-swift | 14:32 | |
| *** ChanServ sets mode: +v joeljwright | 14:32 | |
| *** psachin has quit IRC | 14:33 | |
| jrichli | acoles: but it still reveals when two things are equal, right? | 14:33 |
| *** admin6 has quit IRC | 14:40 | |
| *** siva_krish has joined #openstack-swift | 14:42 | |
| acoles | jrichli: Yes that is unavoidable | 14:52 |
| acoles | jrichli: two things on the same path that is. on different path, no - the HMACs would be different due to using object_key | 14:53 |
| jrichli | acoles: ah, right. i guess you'd have the same issue with md5 as iv. | 14:55 |
| *** diogogmt has quit IRC | 14:56 | |
| *** diogogmt has joined #openstack-swift | 14:58 | |
| *** arch-nemesis has joined #openstack-swift | 14:59 | |
| *** diogogmt has quit IRC | 15:00 | |
| acoles | jrichli: yeah, to solve that one you need some varying parameter for same object content, which of course cannot then be deterministic. | 15:02 |
| acoles | jrichli: mahatic_ tdasilva timburke torgomatic notmyname : my notes appended to https://etherpad.openstack.org/p/swift_md5_encryption. I am gone now til Monday, assuming no opposition I'll then code up that approach. | 15:03 |
| tdasilva | acoles: have a good weekend! | 15:03 |
| acoles | Note the list of review "discussion topics" here https://trello.com/b/63l5zQhq/swift-encryption | 15:04 |
| acoles | kota_: ^^ notes on etherpad | 15:05 |
| *** acoles is now known as acoles_ | 15:06 | |
| kota_ | Thx! acoles! Have a good weekend! | 15:06 |
| *** cbartz has left #openstack-swift | 15:06 | |
| *** arch-nemesis has quit IRC | 15:07 | |
| *** tesseract- has quit IRC | 15:12 | |
| *** klrmn has joined #openstack-swift | 15:14 | |
| *** jmccarthy has quit IRC | 15:18 | |
| *** baojg has joined #openstack-swift | 15:19 | |
| *** jmccarthy has joined #openstack-swift | 15:19 | |
| *** arch-nemesis has joined #openstack-swift | 15:20 | |
| *** diogogmt has joined #openstack-swift | 15:21 | |
| *** d0ugal has quit IRC | 15:25 | |
| *** StraubTW has quit IRC | 15:34 | |
| *** chsc has joined #openstack-swift | 15:35 | |
| *** mingyu has quit IRC | 15:35 | |
| *** tqtran has joined #openstack-swift | 15:36 | |
| *** pcaruana has quit IRC | 15:38 | |
| *** rcernin has quit IRC | 15:39 | |
| *** tqtran has quit IRC | 15:40 | |
| *** jmccarthy has quit IRC | 15:41 | |
| *** jmccarthy has joined #openstack-swift | 15:42 | |
| *** zul has quit IRC | 15:47 | |
| *** thumpba has joined #openstack-swift | 15:48 | |
| *** daemontool_ has joined #openstack-swift | 15:52 | |
| *** daemontool has quit IRC | 15:54 | |
| *** Suyash has joined #openstack-swift | 15:54 | |
| notmyname | ok, now back online at a reasonable hour of the morning ;-) | 15:55 |
| tdasilva | lol | 15:57 |
| jrichli | thanks again everyone for attending the meeting - despite some challenging times of the day | 15:58 |
| *** nadeem has joined #openstack-swift | 15:59 | |
| *** lyrrad has joined #openstack-swift | 16:09 | |
| *** ouchkernel has quit IRC | 16:12 | |
| *** ouchkernel has joined #openstack-swift | 16:17 | |
| *** klrmn has quit IRC | 16:21 | |
| *** zul has joined #openstack-swift | 16:23 | |
| *** rledisez has quit IRC | 16:25 | |
| *** baojg has quit IRC | 16:26 | |
| *** dmorita has joined #openstack-swift | 16:34 | |
| *** dmk0202 has joined #openstack-swift | 16:34 | |
| *** mingyu has joined #openstack-swift | 16:35 | |
| timburke | good morning | 16:37 |
| *** mingyu_ has joined #openstack-swift | 16:38 | |
| *** mingyu has quit IRC | 16:39 | |
| *** joeljwright has quit IRC | 16:40 | |
| *** pgbridge has joined #openstack-swift | 16:52 | |
| *** SkyRocknRoll has joined #openstack-swift | 16:53 | |
| *** superflyy has joined #openstack-swift | 17:08 | |
| *** hseipp has quit IRC | 17:09 | |
| *** ouchkernel has quit IRC | 17:10 | |
| timburke | jrichli: acoles_: i like the suggestion in https://trello.com/c/6kiiS8KZ/47-consider-deriving-the-nonce-for-user-metadata - that's basically exactly what i was thinking | 17:13 |
| timburke | sorting shouldn't be too bad; there won't be very many values. (fwiw, we do similar things in swift3 as part of the request-signing process) | 17:14 |
| timburke | i'm not sure i understand the length-limit concern, though; won't CTR handle all of the incrementing for us? | 17:14 |
| timburke | fwiw, i was thinking of something like https://gist.github.com/tipabu/82256be1136ca0446b73189eec5b5e26 -- i can try to turn that into a real patch later today | 17:14 |
| *** dmk0202 has quit IRC | 17:15 | |
| *** ouchkernel has joined #openstack-swift | 17:16 | |
| *** klrmn has joined #openstack-swift | 17:16 | |
| timburke | (minor edit there: first version was using X-Object-Sysmeta-Crypto-Meta-Meta instead of X-Object-Transient-Sysmeta-Crypto-Meta-Meta) | 17:16 |
| *** catintheroof has joined #openstack-swift | 17:16 | |
| *** dmk0202 has joined #openstack-swift | 17:16 | |
| *** zaitcev has joined #openstack-swift | 17:18 | |
| *** ChanServ sets mode: +v zaitcev | 17:18 | |
| *** superflyy has quit IRC | 17:20 | |
| *** nadeem has quit IRC | 17:26 | |
| *** tqtran has joined #openstack-swift | 17:30 | |
| *** siva_krish has quit IRC | 17:34 | |
| *** daemontool_ has quit IRC | 17:34 | |
| *** dmk0202 has quit IRC | 17:35 | |
| *** dmk0202 has joined #openstack-swift | 17:39 | |
| *** thumpba_ has joined #openstack-swift | 17:46 | |
| *** thumpba has quit IRC | 17:48 | |
| *** zul has quit IRC | 18:02 | |
| *** openstackgerrit has quit IRC | 18:03 | |
| *** openstackgerrit has joined #openstack-swift | 18:03 | |
| *** manous has joined #openstack-swift | 18:08 | |
| *** mingyu_ has quit IRC | 18:09 | |
| *** SkyRocknRoll has quit IRC | 18:11 | |
| clayg | ah, yeah the passing of the bytes in the SLO's and stuff - updating content-type hrmm... | 18:17 |
| *** zul has joined #openstack-swift | 18:25 | |
| *** SkyRocknRoll has joined #openstack-swift | 18:26 | |
| clayg | what's the qs or header to tell an object request to look at the manifest instead of the thing represented by the manifest? | 18:35 |
| clayg | ?multipart-manifest=get | 18:36 |
| clayg | http://docs.openstack.org/developer/swift/overview_large_objects.html | 18:36 |
| timburke | yeah, that | 18:36 |
| *** openstackstatus has quit IRC | 18:40 | |
| *** openstack has joined #openstack-swift | 18:43 | |
| *** Lickitysplitted_ has joined #openstack-swift | 18:53 | |
| *** Lickitysplitted has quit IRC | 18:53 | |
| *** cdelatte has quit IRC | 19:01 | |
| *** hk_ has joined #openstack-swift | 19:08 | |
| *** hk_ has quit IRC | 19:10 | |
| *** hk_ has joined #openstack-swift | 19:11 | |
| hk_ | hi al | 19:11 |
| *** siva_krish has joined #openstack-swift | 19:13 | |
| hk_ | hi all, I'm new on openstack-proxy. may you help me to fix swift proxy? | 19:18 |
| notmyname | hk_: depends on what your problem is | 19:18 |
| timburke | acoles_: jrichli: fyi, i've got a WIP patch to start using hmac for conditional-request etags at http://paste.openstack.org/show/522027/ - functests seem to still pass; still sorting out what's going on in some of the unittests | 19:19 |
| timburke | will drop attach a better patch to 328208 once i've got that sorted out | 19:20 |
| hk_ | When i check service status, it shows failed to start swift-proxy service | 19:20 |
| notmyname | hk_: why does it say it failed to start? any messages printed out? anything in the logs? | 19:20 |
| hk_ | yes | 19:20 |
| jrichli | timburke: nice. i'll take look | 19:21 |
| hk_ | same message i see on lots of question on ask.openstack.org | 19:21 |
| notmyname | hk_: feel free to use paste.openstack.org to share what you're seeing | 19:21 |
| hk_ | but did not give anyone ans | 19:21 |
| hk_ | wait | 19:21 |
| hk_ | http://paste.openstack.org/show/522028/ | 19:23 |
| hk_ | it smy log, i have config it as official doc | 19:23 |
| *** cdelatte has joined #openstack-swift | 19:23 | |
| hk_ | i have 2 swift node | 19:23 |
| hk_ | hey notmyname | 19:25 |
| notmyname | hk_: I've not seen that error before. I don't know what "Unit openstack-swift-proxy.service entered failed state." means. normally I'd expect a message printed to stdout/stderr or in syslog | 19:25 |
| hk_ | what i paste is i seen when i fire command "systemctl status openstack-swift-proxy" | 19:26 |
| *** ametts has quit IRC | 19:31 | |
| *** Jeffrey4l_ has joined #openstack-swift | 19:31 | |
| hk_ | hi | 19:32 |
| hk_ | hello notmyname | 19:32 |
| *** SkyRocknRoll has quit IRC | 19:33 | |
| *** Jeffrey4l has quit IRC | 19:34 | |
| hk_ | i could attach more ref from internet which is same as my question, but still no one could able | 19:34 |
| zaitcev | notmyname: It's what happens when someone tries to start services with systemctl start openstack-swift-proxy and the proxy tracebacks. The traceback is too long for systemd to capture. | 19:38 |
| zaitcev | hk_: set SElinux to permissive (at least temporarily) and start with swift-init proxy-server start. That should allow you to see the traceback. Something is typoed in your proxy-server.conf or maybe some module is missing that's specified in the pipeline. | 19:39 |
| clayg | weee crypto is fun | 19:44 |
| notmyname | clayg: when I write stuff to a cluster with crypto, I can't read the on-disk data. so it's good, right? :-) | 19:45 |
| zaitcev | maybe you can if you have a supercomputer and right algorithms | 19:46 |
| hk_ | ahahah supercomputer, it's too much far as quatum computer | 19:48 |
| *** haypo has left #openstack-swift | 19:53 | |
| *** nadeem has joined #openstack-swift | 19:54 | |
| *** nadeem has quit IRC | 19:59 | |
| clayg | how *did* all that insanity with quotes on etags happen? | 20:02 |
| clayg | notmyname: EC sorta works like that too? | 20:02 |
| notmyname | which particular insanity? | 20:03 |
| clayg | well, mainly swob._resp_etag_property | 20:03 |
| clayg | it's like what the how? | 20:03 |
| *** hk__ has joined #openstack-swift | 20:04 | |
| clayg | was it just something webob used to do? | 20:04 |
| *** hk_ has quit IRC | 20:04 | |
| notmyname | the lack of quotes might have started with webob. I don't remember. | 20:05 |
| timburke | clayg: from the spec, etags are supposed to have quotes. historically, we didn't. at one point we tried changing that, broke a bunch of clients, and went back to no-quotes | 20:06 |
| timburke | (at least, that's how i recall it being communicated to me) | 20:06 |
| notmyname | timburke: yeah, but I don't know the reason for "historically we didnt" | 20:06 |
| notmyname | maybe webob. maybe just because that's something that happened with twisted's web server in NAST (the thing that came before swift) | 20:07 |
| *** ChubYann has joined #openstack-swift | 20:07 | |
| notmyname | clayg: I feel like I missed the point of your question | 20:09 |
| timburke | i suppose we'd *really* run into trouble if we tried to support "weak validator" markings. i've occasionally considered doing it for DLOs with more than a single container listing's worth of segments, but always stop when i consider how many places might need to know how to handle it | 20:10 |
| hk__ | @zaitcev, thanks. I did not enable [filter:authtoken] in /etc/swift/proxy-server.conf. now its working fine. | 20:10 |
| *** hk__ has quit IRC | 20:11 | |
| *** ouchkernel has quit IRC | 20:13 | |
| *** dmorita has quit IRC | 20:13 | |
| *** dmorita has joined #openstack-swift | 20:13 | |
| *** cdelatte has quit IRC | 20:14 | |
| *** ouchkernel has joined #openstack-swift | 20:18 | |
| clayg | wow, so X-Static-Large-Object: True is always stored unencrypted - so even if you try to read a SLO from an encrypted manifest w/o the encryption middleware - it gets picked up by the slo middleware | 20:25 |
| *** silor has quit IRC | 20:25 | |
| *** manous has quit IRC | 20:25 | |
| clayg | the interesting thing is that the slo middlware is kinda "cool" with garbage coming back in the maifest | 20:26 |
| clayg | try: segments = json.loads() except ValueError: segments = [] | 20:28 |
| clayg | ^ you're welcome | 20:28 |
| timburke | clayg: i'm guessing the lack of encryption there is at least in part because we'd have swift_bytes in the content-type, which is a dead give-away | 20:28 |
| clayg | timburke: sure | 20:29 |
| clayg | still sorta surprised maybe that it hasn't been an issue for us before -> https://github.com/openstack/swift/blob/c0217a4845e2ea780dc4dcb61877e604bc488729/swift/common/middleware/slo.py#L657 | 20:31 |
| clayg | the silent passing of the error doing the thing that is obviously not going to be correct in order to not have to blow up and return an error | 20:31 |
| clayg | hell, there's not even any logging | 20:31 |
| *** Suyash has quit IRC | 20:31 | |
| *** Suyash has joined #openstack-swift | 20:32 | |
| *** Suyash has quit IRC | 20:32 | |
| *** Suyash has joined #openstack-swift | 20:32 | |
| notmyname | timburke: running node directly worked on my machine for those tests you asked about | 20:34 |
| timburke | notmyname: i figured out what happened. try running the tests twice -- something like `./.unittests common/middleware/test_encrypter_decrypter.py common/middleware/test_encrypter_decrypter.py` | 20:35 |
| timburke | (i'd used a * which brought in the pyc files, too) | 20:36 |
| notmyname | oh, weird | 20:36 |
| notmyname | I've never tried that before. I think I shall not try it again | 20:37 |
| timburke | haha | 20:37 |
| notmyname | however, it doesn't seem right | 20:37 |
| timburke | it's actually really really useful when you're trying to hit one of those occasionally-failing tests. i have nose run just that one test like 5000 times | 20:38 |
| openstackgerrit | Merged openstack/swift: Make string.letters PY3 compatible https://review.openstack.org/333712 | 20:39 |
| *** manous has joined #openstack-swift | 20:39 | |
| *** siva_krish has quit IRC | 20:41 | |
| timburke | jrichli: acoles_: i think http://paste.openstack.org/show/522038/ ought to do it. also added a link to it on the relevant patch | 20:46 |
| *** dmk0202 has quit IRC | 20:46 | |
| *** manous has quit IRC | 20:46 | |
| clayg | maybe I glad I hadn't really grokked iv_base yet | 20:51 |
| *** siva_krish has joined #openstack-swift | 21:00 | |
| *** siva_krish has quit IRC | 21:09 | |
| clayg | X-Object-Transient-Sysmeta-Crypto-Meta-Mtime <- winning | 21:13 |
| *** dmorita has quit IRC | 21:27 | |
| *** dmorita has joined #openstack-swift | 21:28 | |
| *** dmorita has quit IRC | 21:30 | |
| *** geaaru has quit IRC | 21:35 | |
| *** dmorita has joined #openstack-swift | 21:43 | |
| *** vinsh_ has quit IRC | 22:12 | |
| *** dmorita has quit IRC | 22:17 | |
| clayg | so we going to merge these always random iv goodness? | 22:17 |
| *** dmorita has joined #openstack-swift | 22:17 | |
| notmyname | clayg: I'm testing timburke's patch diff now | 22:17 |
| notmyname | but it's up to acoles_ to handle getting it into the patch chain | 22:18 |
| notmyname | as far as the idea goes, though, yeah. i'm totally for it. sounds a lot better than the current proposal | 22:18 |
| *** catintheroof has quit IRC | 22:18 | |
| *** thumpba_ has quit IRC | 22:24 | |
| *** thumpba has joined #openstack-swift | 22:24 | |
| *** thumpba has quit IRC | 22:24 | |
| *** thumpba has joined #openstack-swift | 22:25 | |
| *** thumpba has quit IRC | 22:25 | |
| *** thumpba has joined #openstack-swift | 22:25 | |
| *** thumpba has quit IRC | 22:26 | |
| *** thumpba has joined #openstack-swift | 22:26 | |
| *** thumpba has quit IRC | 22:27 | |
| *** dmorita has quit IRC | 22:27 | |
| *** thumpba has joined #openstack-swift | 22:27 | |
| *** thumpba has quit IRC | 22:27 | |
| *** thumpba has joined #openstack-swift | 22:28 | |
| *** thumpba has quit IRC | 22:28 | |
| *** thumpba has joined #openstack-swift | 22:28 | |
| *** ManojK has joined #openstack-swift | 22:29 | |
| *** thumpba has quit IRC | 22:29 | |
| *** thumpba has joined #openstack-swift | 22:29 | |
| *** thumpba has quit IRC | 22:30 | |
| *** thumpba_ has joined #openstack-swift | 22:30 | |
| *** thumpba_ has quit IRC | 22:30 | |
| *** dmorita has joined #openstack-swift | 22:31 | |
| *** dmorita has quit IRC | 22:36 | |
| *** dmorita has joined #openstack-swift | 22:37 | |
| *** nadeem has joined #openstack-swift | 22:40 | |
| clayg | have any cryptanalysis types weighted in on the idea of using the object key in a second context like an HMAC? | 22:41 |
| *** arch-nemesis has quit IRC | 22:42 | |
| clayg | the concatination of the key with the provided etag makes me feel like we think it's not safe to use the object key as the secret in an hmac without an iv (so we're adding on the user provided if-match etag) | 22:43 |
| clayg | also using the body of hmac as part of the secret seems weird | 22:43 |
| *** thumpba has joined #openstack-swift | 22:45 | |
| *** thumpba has quit IRC | 22:45 | |
| *** ManojK has quit IRC | 22:58 | |
| *** ouchkernel has quit IRC | 23:00 | |
| *** thumpba has joined #openstack-swift | 23:06 | |
| *** thumpba has quit IRC | 23:06 | |
| *** ouchkernel has joined #openstack-swift | 23:06 | |
| *** itlinux has quit IRC | 23:09 | |
| *** pgbridge has quit IRC | 23:20 | |
| *** nadeem has quit IRC | 23:20 | |
| *** nadeem has joined #openstack-swift | 23:21 | |
| *** chsc has quit IRC | 23:23 | |
| *** ManojK has joined #openstack-swift | 23:24 | |
| clayg | timburke: does the key_id == path in the crypto_meta dict go away too? | 23:27 |
| clayg | yeah it seems unfair that the *container* etag gets to use a random iv | 23:29 |
| *** dmorita has quit IRC | 23:57 | |
| *** ManojK has quit IRC | 23:58 | |
| *** thumpba has joined #openstack-swift | 23:59 | |
| *** thumpba has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!