Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Client should probe for valid server responses when started in online mode #1219

Open
zenmonkeykstop opened this issue Feb 18, 2021 · 0 comments

Comments

@zenmonkeykstop
Copy link
Contributor

In order for submissions to be downloaded and delete from the SecureDrop server, headers and capabilities need to be set correctly in the Apache2 config, as per freedomofpress/securedrop#4023 . If they're not, errors as per below will be observed in `sd-log:~/QubesIncomingLogs/sd-app/syslog.log:

Feb 18 16:52:37 localhost 2021-02-18 16:52:37,684 - securedrop_client.queue:179(process) ERROR: KeyError: 'Etag'
Feb 18 16:52:37 localhost 2021-02-18 16:52:37,687 - securedrop_client.logic:789(on_message_download_failure) ERROR: Could not emit message_download_failed: 'KeyError' object has no attribute 'uuid'

As a mitigation, the client could check to see if:

  • expected headers are set in responses, including the correct ETag value for file transfers, which is a sha256 of the file IIRC
  • expected HTTP methods are available
  • (optional) server application code is up-to-date
  • (optional) API version is compatible with that expected by the client

The specific errors above will no longer be encountered after an instance is migrated to v3 or Focal, as the Apache changes will be applied by either of these processes, so this is not immediately critical. It would be helpful to catch other potential problems, especially as part of a wider rollout or for workstation installs not supported by FPF.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant