Mc: "Cabeçalhos extras" no cliente mc mais recente

talvez o nginx tenha adicionado algo suculento aos cabeçalhos e depois o Minio reclamar?

@zllovesuki você tem proxy Nginx entre Minio? você pode apontar diretamente para o Minio e ver se funciona?

@harshavardhana bem, ele está sendo executado no Kubernetes, então o Ingress está sempre lá. Não acho que o nginx seja o problema porque as versões anteriores de mc funcionam bem com o Nginx entre o usuário e o Minio.

@harshavardhana bem, ele está sendo executado no Kubernetes, então o Ingress está sempre lá. Não acho que o nginx seja o problema porque as versões anteriores do mc funcionam bem com o Nginx entre o usuário e o Minio.

Então, talvez eu precise reproduzir isso localmente, talvez as alterações recentes na assinatura v4 estejam causando o problema. @zllovesuki

Ainda quebrado na versão atual do homebrew.

Rachels-MacBook:~ rachel$ mc version
Version: 2018-09-10T23:39:12Z
Release-tag: RELEASE.2018-09-10T23-39-12Z
Commit-id: c352cadd4be2c6bed64884c78d1e8a8ac6efaf3f

Ainda quebrado na versão atual do homebrew.

Pelo que posso ver, isso tem a ver com seu proxy nginx, não tenho certeza do que ele está tentando fazer com os cabeçalhos. Não consigo reproduzi-lo.

Ainda quebrado para mim também, reproduzível com Minio atrás do nginx e mc no MacOS.

mc version Version: 2018-09-26T00:42:43Z Release-tag: RELEASE.2018-09-26T00-42-43Z Commit-id: 87f7e65c4c837c8886bf2dd8800c445983b36187

As versões anteriores de mc funcionaram bem. A interface web do Minio também funciona bem.

@zllovesuki Você encontrou uma solução?

Minha configuração nginx:

`` `
minio_servers upstream {
servidor 127.0.0.1:9001;
servidor 127.0.0.1:9002;
servidor 127.0.0.1:9003;
servidor 127.0.0.1:9004;
}

servidor {
server_name my.minio.server;
client_max_body_size 512M;

location / {
    proxy_set_header Host $http_host;
    proxy_pass       http://minio_servers;
}

listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/my.minio.server/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/my.minio.server/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

Encontrou o problema!

Este é o cabeçalho extra que é adicionado apenas para arquivos com um atributo xattr personalizado no MacOS: X-Amz-Meta-Com.apple.quarantine: 0082;5bbe2ec5;Keka;

Verifique os atributos existentes com: xattr file.zip
Você pode se livrar dos atributos (aqui: com.apple.quarantine ) por:
xattr -d com.apple.quarantine file.zip

Depois disso, o upload com mc funciona perfeitamente.

Interessante, verificarei meu computador mais tarde.

Pode confirmar.

Rachels-MacBook:~ rachel$ xattr -d com.apple.quarantine ~/Downloads/ezgif.com-optimize.gif 
Rachels-MacBook:~ rachel$ mc --debug cp ~/Downloads/ezgif.com-optimize.gif rachel/dist/hue.gif
mc: <DEBUG> GET /dist/?location= HTTP/1.1
Host: rachel.objectstore.co
User-Agent: Minio (darwin; amd64) minio-go/v6.0.6 mc/2018-09-10T23:39:12Z
Authorization: AWS4-HMAC-SHA256 Credential=rachel/20181013/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=**REDACTED**
X-Amz-Content-Sha256: UNSIGNED-PAYLOAD
X-Amz-Date: 20181013T010120Z
Accept-Encoding: gzip

mc: <DEBUG> HTTP/1.1 200 OK
Transfer-Encoding: chunked
Accept-Ranges: bytes
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
Content-Type: application/xml
Date: Sat, 13 Oct 2018 01:01:21 GMT
Strict-Transport-Security: max-age=15724800; includeSubDomains
Vary: Accept-Encoding
Vary: Origin
X-Amz-Request-Id: 155D054E3C2F83F1
X-Xss-Protection: 1; mode=block

mc: <DEBUG> Response Time:  411.104274ms

mc: <DEBUG> GET /dist/?delimiter=%2F&max-keys=1000&prefix=hue.gif HTTP/1.1
Host: rachel.objectstore.co
User-Agent: Minio (darwin; amd64) minio-go/v6.0.6 mc/2018-09-10T23:39:12Z
Authorization: AWS4-HMAC-SHA256 Credential=rachel/20181013/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=**REDACTED**
X-Amz-Content-Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Date: 20181013T010121Z
Accept-Encoding: gzip

mc: <DEBUG> HTTP/1.1 200 OK
Transfer-Encoding: chunked
Accept-Ranges: bytes
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
Content-Type: application/xml
Date: Sat, 13 Oct 2018 01:01:21 GMT
Strict-Transport-Security: max-age=15724800; includeSubDomains
Vary: Accept-Encoding
Vary: Origin
X-Amz-Request-Id: 155D054E3E630800
X-Xss-Protection: 1; mode=block

mc: <DEBUG> Response Time:  30.125179ms

mc: <DEBUG> HEAD /dist/hue.gif HTTP/1.1
Host: rachel.objectstore.co
User-Agent: Minio (darwin; amd64) minio-go/v6.0.6 mc/2018-09-10T23:39:12Z
Authorization: AWS4-HMAC-SHA256 Credential=rachel/20181013/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=**REDACTED**
X-Amz-Content-Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Date: 20181013T010121Z

mc: <DEBUG> HTTP/1.1 404 Not Found
Connection: close
Accept-Ranges: bytes
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
Date: Sat, 13 Oct 2018 01:01:21 GMT
Strict-Transport-Security: max-age=15724800; includeSubDomains
Vary: Origin
X-Amz-Request-Id: 155D054E4051BC08
X-Xss-Protection: 1; mode=block

mc: <DEBUG> Response Time:  32.376025ms

mc: <DEBUG> GET /dist/?delimiter=%2F&max-keys=1000&prefix=hue.gif HTTP/1.1
Host: rachel.objectstore.co
User-Agent: Minio (darwin; amd64) minio-go/v6.0.6 mc/2018-09-10T23:39:12Z
Authorization: AWS4-HMAC-SHA256 Credential=rachel/20181013/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=**REDACTED**
X-Amz-Content-Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Date: 20181013T010121Z
Accept-Encoding: gzip

mc: <DEBUG> HTTP/1.1 200 OK
Transfer-Encoding: chunked
Accept-Ranges: bytes
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
Content-Type: application/xml
Date: Sat, 13 Oct 2018 01:01:21 GMT
Strict-Transport-Security: max-age=15724800; includeSubDomains
Vary: Accept-Encoding
Vary: Origin
X-Amz-Request-Id: 155D054E424FF8C5
X-Xss-Protection: 1; mode=block

mc: <DEBUG> Response Time:  33.95394ms

mc: <DEBUG> HEAD /dist/hue.gif HTTP/1.1
Host: rachel.objectstore.co
User-Agent: Minio (darwin; amd64) minio-go/v6.0.6 mc/2018-09-10T23:39:12Z
Authorization: AWS4-HMAC-SHA256 Credential=rachel/20181013/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=**REDACTED**
X-Amz-Content-Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Date: 20181013T010121Z

mc: <DEBUG> HTTP/1.1 404 Not Found
Connection: close
Accept-Ranges: bytes
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
Date: Sat, 13 Oct 2018 01:01:21 GMT
Strict-Transport-Security: max-age=15724800; includeSubDomains
Vary: Origin
X-Amz-Request-Id: 155D054E444DEED8
X-Xss-Protection: 1; mode=block

mc: <DEBUG> Response Time:  28.903296ms

...optimize.gif:  1.99 MB / 1.99 MB  ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓  100.00% 3.15 MB/s 0smc: <DEBUG> PUT /dist/hue.gif HTTP/1.1
Host: rachel.objectstore.co
User-Agent: Minio (darwin; amd64) minio-go/v6.0.6 mc/2018-09-10T23:39:12Z
Content-Length: 2083206
Authorization: AWS4-HMAC-SHA256 Credential=rachel/20181013/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=**REDACTED**
Content-Type: image/gif
X-Amz-Content-Sha256: UNSIGNED-PAYLOAD
X-Amz-Date: 20181013T010121Z
Accept-Encoding: gzip

mc: <DEBUG> HTTP/1.1 200 OK
Content-Length: 0
Accept-Ranges: bytes
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
Date: Sat, 13 Oct 2018 01:01:22 GMT
Etag: "c0e09c3ba99d1133c8c848e29fb27430"
Strict-Transport-Security: max-age=15724800; includeSubDomains
Vary: Origin
X-Amz-Request-Id: 155D054E84C7E947
X-Xss-Protection: 1; mode=block

mc: <DEBUG> Response Time:  1.088734018s

...optimize.gif:  1.99 MB / 1.99 MB  ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓  100.00% 1.82 MB/s 1s

É uma boa ideia mc remover esses atributos?

É uma boa ideia mc remover esses atributos?

Podemos apoiar @zllovesuki - deve ser um bug.

parece que está funcionando bem quando eu uso o Minio diretamente

mc: <DEBUG> POST /sjm-airlines/rhel-server-7.4-x86_64-dvd.iso?uploads= HTTP/1.1
Host: localhost:9000
User-Agent: Minio (linux; amd64) minio-go/v6.0.8 mc/2018-10-11T22:45:56Z
Content-Length: 0
Authorization: AWS4-HMAC-SHA256 Credential=minio/20181013/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-meta-user.xdg.origin.url, Signature=**REDACTED**
Content-Type: application/x-iso9660-image
X-Amz-Content-Sha256: UNSIGNED-PAYLOAD
X-Amz-Date: 20181013T010537Z
X-Amz-Meta-User.xdg.origin.url: https://access.cdn.redhat.com//content/origin/files/sha256/43/431a58c8c0351803a608ffa56948c5a7861876f78ccbe784724dd8c987ff7000/rhel-server-7.4-x86_64-dvd.iso?_auth_=1520282889_258e1e3f3dc397397d0dace5891c60aa
Accept-Encoding: gzip

O problema parece estar vindo do nginx tentando fazer algo com esses cabeçalhos, você pode habilitar MINIO_HTTP_TRACE = / dev / stdout para ver o que o nginx está enviando para o Minio?

@zllovesuki ^^

@harshavardhana stdout vai explodir se eu fizer TRACE no servidor prod. Talvez você possa consultar a configuração de @tholu ?

@harshavardhana stdout vai explodir se eu fizer TRACE no servidor prod. Talvez você possa consultar a configuração de @tholu ?

@zllovesuki você pode até escrever em um arquivo @zllovesuki ? MINIO_HTTP_TRACE = trace.log

Finalmente tenho tempo para sentar ...

Aqui está o arquivo de rastreamento. minio-trace.txt

Para referência, este é o yaml para minio de teste:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: minio-test
  namespace: objectstore
spec:
  rules:
  - host: test.objectstore.co
    http:
      paths:
      - backend:
          serviceName: minio-test
          servicePort: 9000
        path: /
  tls:
  - hosts:
    - test.objectstore.co
    secretName: objectstore-tls-gs
---
apiVersion: v1
kind: Service
metadata:
  name: minio-test
  namespace: objectstore
spec:
  ports:
  - port: 9000
    protocol: TCP
    targetPort: 9000
  selector:
    app: minio-test
  sessionAffinity: None
  type: ClusterIP
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    app: minio-test
  name: minio-test
  namespace: objectstore
spec:
  replicas: 1
  selector:
    matchLabels:
      app: minio-test
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: minio-test
    spec:
      containers:
      - args:
        - server
        - /storage
        command:
        - minio
        env:
        - name: MINIO_ACCESS_KEY
          value: test
        - name: MINIO_SECRET_KEY
          value: testtest123
        - name: MINIO_BROWSER
          value: "off"
        - name: _MINIO_CACHE
          value: "off"
        - name: MINIO_HTTP_TRACE
          value: "/dev/stdout"
        image: minio/minio:RELEASE.2018-07-13T00-09-07Z
        imagePullPolicy: IfNotPresent
        name: minio
        ports:
        - containerPort: 9000
          protocol: TCP
        volumeMounts:
        - mountPath: /storage
          name: storage
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      volumes:
      - name: storage
        emptyDir: {}

Controlador de entrada em: https://github.com/kubernetes/ingress-nginx. Imagem de execução quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.19.0 , com a seguinte configuração:

apiVersion: v1
data:
  disable-access-log: "true"
  enable-dynamic-tls-records: "true"
  enable-modsecurity: "false"
  enable-owasp-modsecurity-crs: "false"
  enable-vts-status: "true"
  error-log-level: warn
  keep-alive: "60"
  load-balance: ip_hash
  max-worker-connections: "20480"
  proxy-body-size: 2g
  proxy-buffer-size: 64k
  proxy-connect-timeout: "5"
  proxy-read-timeout: "3600"
  proxy-send-timeout: "3600"
  proxy-stream-timeout: "604800"
  server-name-hash-max-size: "512"
  server-tokens: "false"
  ssl-ciphers: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
  ssl-dh-param: default/nginx-dhparam-4096
  ssl-ecdh-curve: prime256v1:secp384r1:secp521r1
  ssl-protocols: TLSv1 TLSv1.1 TLSv1.2
  ssl-session-tickets: "false"
  worker-processes: "4"
kind: ConfigMap
metadata:
  name: nginx-conf
  namespace: default

@zllovesuki encontramos a solução https://github.com/minio/mc/issues/2569 e, na verdade, seu problema Nginx

para pessoas pesquisando: defina ignore-invalid-headers para false em seu configmap

Este tópico foi bloqueado automaticamente, pois não houve nenhuma atividade recente depois que ele foi fechado. Abra um novo problema para bugs relacionados.