[Grub-dev] C# Grubng 0.1 and few questions

seth seth at untethered.org
Mon Jan 28 06:55:23 UTC 2008


>
> The first script that accepted .arc.gz files from users was written
> very quickly.  All the script did was store these files to disk; later
> we were going to parse out the content, verify hashes, stuff like
> that.  So really all a 200 response from PUTing told you was: our
> disks worked :)

Since it was hinted at and admitted that we weren't yet checking the  
hash value at upload I decided it might be a good idea to plug that  
hole.  Spent the last few hours digging around on our various servers  
and found jer's scripts that generate the work units.  The script that  
accepts the completed work units is now checking the hash values and  
will not accept the file unless they correct.  I was hoping that Jer  
would write this code as I don't trust my code well enough to properly  
identify real work vs somebody trying to upload unwanted data, but the  
other option was to leave open a potential security hole.

So, if your client starts getting 401 errors after posting the file  
this is because your hash values don't check out.  Make sure that your  
client is returning the URLs in the arc file in the same order they  
were given to you in the work unit and that you are not modifying the  
URLs or hostnames.  Oh, and they have to be uploaded by the same user  
who downloaded them.

If you're really sure that you're doing all the above correctly and  
still getting 401 errors.  Ping me or find me in the chat room and  
I'll see if I can help.

The script has also been updated so that most errors related to  
loading data into hbase will return a 202 return code (vs the normal  
200) and an error message describing the the arc file was saved but  
not fully processed.

seth



More information about the Grub-dev mailing list