Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Accessing s3 bucket using tokio-rustls-tls returns 403 error #291

Closed
ArjunGTX opened this issue Aug 19, 2022 · 16 comments
Closed

Accessing s3 bucket using tokio-rustls-tls returns 403 error #291

ArjunGTX opened this issue Aug 19, 2022 · 16 comments

Comments

@ArjunGTX
Copy link

Describe the bug
When trying to access s3 bucket using the tokio-rustls-tls feature, it is returning 403 (Access denied) as response for head_object() request. The same request succeeded when tokio-native-tls was used.

To Reproduce

  • Include tokio-rustls-tls feature
rust-s3 = { version = "0.32", default-features = false, features = [
  "tokio-native-tls",
  "tags"
] }
  • Create a bucket with appropriate credentials
let bucket = Bucket::new(
		"my_bucket",
		Region::Custom {
			endpoint: "my_endpoint",
			region: "my_region",
		},
		Credentials::new(
			Some("my_key"),
			Some("my_secret"),
			None,
			None,
			None,
		)
		.context("unable to create credentials")?,
	)
	.context("unable to create bucket")?;
  • Invoke the head_object() request
let (head, code) = bucket.head_object(&file).await?;

Expected behavior

  • The expected code was 200 but got 403
  • Same request using tokio-native-tls returned 200 code

Environment

  • Rust version: [e.g. 1.63]
  • lib version [e.g. 0.32]
@Niedzwiedzw
Copy link

it happened to me too

@Niedzwiedzw
Copy link

sadly the environment I'm running my app in isn't required to have SSL installed, so I cannot live without it... can I help solve it somehow?

@durch
Copy link
Owner

durch commented Sep 21, 2022

@Niedzwiedzw there is a no-verify-ssl feature, that might help, it seems that rustls-tls has some issues with certain certs, there is a failing test against Digital Ocean spaces that only fails on rustls-tls.

Can you give me any more specifics on the environment you're running?

Would something like a no-tls feature be helpful?

@Niedzwiedzw
Copy link

Niedzwiedzw commented Sep 21, 2022

it's running on a windows 10 machine I'm setting up for a local CI for my project, the target S3 is digitalocean, as for no-tls feature I'm not sure if it's help, but as far as I can see no-verify-ssl didn't help sadly. if reqwest supports no-tls then yeah why not give it a try, I can build from a branch and give it a quick test

@Niedzwiedzw
Copy link

hmm rustls-tls-native-roots - this feature for reqwest might do the trick, I'll give it a quick spin

@durch
Copy link
Owner

durch commented Sep 21, 2022

It did not work on the digital ocean test, I've tried it :(. That being said if it works on you're end I'd be happy to add another variant

@Niedzwiedzw
Copy link

I've added this as a feature on my branch, gonna test in a minute once it builds

@Niedzwiedzw
Copy link

yeah, no luck sadly... I'm out if ideas then

@Niedzwiedzw
Copy link

I've managed to work around this bo conditionally compiling for windows with nativetld ,and for linux with rustls (I must support a very old linux machine, this was the whole point :D)
if anyone finds it useful here's the config

[target.x86_64-pc-windows-gnu.dependencies]
rust-s3 = {version = "0.32", features = ["with-tokio"] }

[target.x86_64-unknown-linux-gnu.dependencies]
rust-s3 = {version = "0.32", default-features = false, features = ["tokio-rustls-tls", "with-tokio", "no-verify-ssl"] }

@durch
Copy link
Owner

durch commented Sep 21, 2022

Can you check if its only head_object() or if other routes are affected as well?

@Niedzwiedzw
Copy link

Niedzwiedzw commented Sep 21, 2022

actually in my case it was failing when uploading a file

pub async fn put_object_stream<R: AsyncRead + Unpin>(
this line

@durch
Copy link
Owner

durch commented Sep 21, 2022

I've managed to work around this bo conditionally compiling for windows with nativetld ,and for linux with rustls (I must support a very old linux machine, this was the whole point :D) if anyone finds it useful here's the config

[target.x86_64-pc-windows-gnu.dependencies]
rust-s3 = {version = "0.32", features = ["with-tokio"] }

[target.x86_64-unknown-linux-gnu.dependencies]
rust-s3 = {version = "0.32", default-features = false, features = ["tokio-rustls-tls", "with-tokio", "no-verify-ssl"] }

Super happy to hear that :)

@Niedzwiedzw
Copy link

so for future people who encounter this - it only happens on rustls on windows it seems, but let's wait for other people to confirm

@durch
Copy link
Owner

durch commented Sep 24, 2022

There are issues with tokio-rustls-tls, Digital Ocean for example has problems as well, it seems that they're related to how certificates are handled, all in all I hope this is something that gets fixed upstream eventually...

@durch durch pinned this issue Sep 25, 2022
@Eric-Arellano
Copy link
Contributor

Eric-Arellano commented Dec 6, 2022

One issue I had with Rustls is the bucket having periods in its name, which triggered rustls/rustls#184

@Magicloud
Copy link

Magicloud commented Apr 5, 2023

sync-rustls-tls on AlpineLinux fails the same. no-verify-ssl does not help. put_object still got 403.

I do not think my case is because of the permission, same service account (in K8S) is used by other pods to upload files to S3.

Also, the 403 was got after I hacked rust-s3 source. The error was masked and an unparsable Json error was shown.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants