You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "fmorg-git (via GitHub)" <gi...@apache.org> on 2026/08/14 06:09:22 UTC
[PR] HDDS-16187. [STS] Fix Latent S3 DeleteObjects Issue [ozone]
fmorg-git opened a new pull request, #11019:
URL: https://github.com/apache/ozone/pull/11019
Please describe your PR in detail:
* DeleteObjects returns HTTP 500 instead of AccessDenied when the user doesn't have the proper access. Because the latent S3 API has this defect, then when using STS tokens, the same issue appears. This ticket addresses the issue.
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-16187
## How was this patch tested?
smoke tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16187. [STS] Fix Latent S3 DeleteObjects Issue [ozone]
Posted by "fmorg-git (via GitHub)" <gi...@apache.org>.
fmorg-git commented on code in PR #11019:
URL: https://github.com/apache/ozone/pull/11019#discussion_r3791456649
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/BucketEndpoint.java:
##########
@@ -380,8 +388,12 @@ public MultiDeleteResponse multiDelete(
}
getMetrics().updateDeleteKeySuccessStats(startNanos);
} catch (IOException ex) {
- LOG.error("Delete key failed: {}", ex.getMessage());
getMetrics().updateDeleteKeyFailureStats(startNanos);
+ final OMException omEx = (OMException) HddsClientUtils.containsException(ex, OMException.class);
Review Comment:
updated - fc80f776333ee1ffde301a47fc7b748e1fb1e892
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/BucketEndpoint.java:
##########
@@ -380,8 +388,12 @@ public MultiDeleteResponse multiDelete(
}
getMetrics().updateDeleteKeySuccessStats(startNanos);
} catch (IOException ex) {
- LOG.error("Delete key failed: {}", ex.getMessage());
getMetrics().updateDeleteKeyFailureStats(startNanos);
+ final OMException omEx = (OMException) HddsClientUtils.containsException(ex, OMException.class);
+ if (omEx != null && S3ErrorTable.translateResultCode(omEx) == S3ErrorTable.ACCESS_DENIED) {
+ throw newError(S3ErrorTable.ACCESS_DENIED, bucketName, omEx);
Review Comment:
updated - fc80f776333ee1ffde301a47fc7b748e1fb1e892
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16187. [STS] Fix Latent S3 DeleteObjects Issue [ozone]
Posted by "fmorg-git (via GitHub)" <gi...@apache.org>.
fmorg-git commented on PR #11019:
URL: https://github.com/apache/ozone/pull/11019#issuecomment-5306811601
> Thanks for the patch! @fmorg-git The `AccessDenied` translation looks correct.
>
> I left a few inline comments, mostly around the cases the new handling doesn't cover yet and the audit record on the throw path.
>
> Also, could we add a unit test alongside the smoke test? `TestPermissionCheck#testDeleteKeys` already has the mocks needed.
Updated to add unit tests - fc80f776333ee1ffde301a47fc7b748e1fb1e892
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16187. [STS] Fix Latent S3 DeleteObjects Issue [ozone]
Posted by "chihsuan (via GitHub)" <gi...@apache.org>.
chihsuan commented on code in PR #11019:
URL: https://github.com/apache/ozone/pull/11019#discussion_r3788522475
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/BucketEndpoint.java:
##########
@@ -380,8 +388,12 @@ public MultiDeleteResponse multiDelete(
}
getMetrics().updateDeleteKeySuccessStats(startNanos);
} catch (IOException ex) {
- LOG.error("Delete key failed: {}", ex.getMessage());
getMetrics().updateDeleteKeyFailureStats(startNanos);
+ final OMException omEx = (OMException) HddsClientUtils.containsException(ex, OMException.class);
Review Comment:
Currently, we only handle ACCESS_DENIED, and non-ACCESS_DENIED OM errors still return HTTP 200 with ALL/InternalError. Should we translate every contained OMException here so that errors like `TOKEN_EXPIRED` and `BUCKET_NOT_FOUND` retain their S3 response?
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/BucketEndpoint.java:
##########
@@ -380,8 +388,12 @@ public MultiDeleteResponse multiDelete(
}
getMetrics().updateDeleteKeySuccessStats(startNanos);
} catch (IOException ex) {
- LOG.error("Delete key failed: {}", ex.getMessage());
getMetrics().updateDeleteKeyFailureStats(startNanos);
+ final OMException omEx = (OMException) HddsClientUtils.containsException(ex, OMException.class);
+ if (omEx != null && S3ErrorTable.translateResultCode(omEx) == S3ErrorTable.ACCESS_DENIED) {
+ throw newError(S3ErrorTable.ACCESS_DENIED, bucketName, omEx);
Review Comment:
This throw skips the audit block below, so rejected multi-delete requests leave no failure audit record. I wonder if we should audit the failure before propagating it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16187. [STS] Fix Latent S3 DeleteObjects Issue [ozone]
Posted by "fmorg-git (via GitHub)" <gi...@apache.org>.
fmorg-git commented on PR #11019:
URL: https://github.com/apache/ozone/pull/11019#issuecomment-5318996176
Thanks for the review and merge.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16187. [STS] Fix Latent S3 DeleteObjects Issue [ozone]
Posted by "ChenSammi (via GitHub)" <gi...@apache.org>.
ChenSammi merged PR #11019:
URL: https://github.com/apache/ozone/pull/11019
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org