fedora-infrastructure

#6772 Authorization/routing_policy error on bodhi-backend02
Closed: Fixed Opened by bowlofeggs.

Closed: Fixed
Reopen Issue

This weekend, I began receiving lots of error e-mails from bodhi-backend02 like this:

Message

[2018-03-12 15:44:11][fedmsg.crypto.utils ERROR]

Authorization/routing_policy error.  Topic u'org.fedoraproject.prod.pungi.compose.ostree'.  Signer u'releng-bodhi-backend01.phx2.fedoraproject.org'.

Process Details

  • host: bodhi-backend02.phx2.fedoraproject.org
  • PID: 23801
  • name: fedmsg-hub
  • command: /usr/bin/python2 /usr/bin/fedmsg-hub
  • msg_id:

Callstack that lead to the logging statement

  File "/usr/bin/fedmsg-hub", line 11 in <module>
    load_entry_point('fedmsg==1.0.1', 'console_scripts', 'fedmsg-hub')()
  File "/usr/lib/python2.7/site-packages/fedmsg/commands/hub.py", line 122 in hub
    command.execute()
  File "/usr/lib/python2.7/site-packages/fedmsg/commands/__init__.py", line 67 in execute
    return self.run()
  File "/usr/lib/python2.7/site-packages/fedmsg/commands/hub.py", line 100 in run
    framework=False,
  File "/usr/lib/python2.7/site-packages/moksha/hub/__init__.py", line 109 in main
    reactor.run(installSignalHandlers=False)
  File "/usr/lib64/python2.7/site-packages/twisted/internet/base.py", line 1195 in run
    self.mainLoop()
  File "/usr/lib64/python2.7/site-packages/twisted/internet/base.py", line 1207 in mainLoop
    self.doIteration(t)
  File "/usr/lib64/python2.7/site-packages/twisted/internet/epollreactor.py", line 396 in doPoll
    log.callWithLogger(selectable, _drdw, selectable, fd, event)
  File "/usr/lib64/python2.7/site-packages/twisted/python/log.py", line 101 in callWithLogger
    return callWithContext({"system": lp}, func, *args, **kw)
  File "/usr/lib64/python2.7/site-packages/twisted/python/log.py", line 84 in callWithContext
    return context.call({ILogContext: newCtx}, func, *args, **kw)
  File "/usr/lib64/python2.7/site-packages/twisted/python/context.py", line 118 in callWithContext
    return self.currentContext().callWithContext(ctx, func, *args, **kw)
  File "/usr/lib64/python2.7/site-packages/twisted/python/context.py", line 81 in callWithContext
    return func(*args,**kw)
  File "/usr/lib64/python2.7/site-packages/twisted/internet/posixbase.py", line 597 in _doReadOrWrite
    why = selectable.doRead()
  File "/usr/lib/python2.7/site-packages/txzmq/connection.py", line 284 in doRead
    log.callWithLogger(self, self.messageReceived, message)
  File "/usr/lib64/python2.7/site-packages/twisted/python/log.py", line 101 in callWithLogger
    return callWithContext({"system": lp}, func, *args, **kw)
  File "/usr/lib64/python2.7/site-packages/twisted/python/log.py", line 84 in callWithContext
    return context.call({ILogContext: newCtx}, func, *args, **kw)
  File "/usr/lib64/python2.7/site-packages/twisted/python/context.py", line 118 in callWithContext
    return self.currentContext().callWithContext(ctx, func, *args, **kw)
  File "/usr/lib64/python2.7/site-packages/twisted/python/context.py", line 81 in callWithContext
    return func(*args,**kw)
  File "/usr/lib/python2.7/site-packages/txzmq/pubsub.py", line 72 in messageReceived
    self.gotMessage(message[1], message[0])
  File "/usr/lib/python2.7/site-packages/moksha/hub/zeromq/zeromq.py", line 197 in chain_over_moksha_callbacks
    f(_body, _topic)
  File "/usr/lib/python2.7/site-packages/moksha/hub/zeromq/zeromq.py", line 224 in intercept
    return callback(ZMQMessage(_topic, _body))
  File "/usr/lib/python2.7/site-packages/moksha/hub/api/consumer.py", line 167 in _consume_json
    return self._consume(message_as_dict)
  File "/usr/lib/python2.7/site-packages/fedmsg/consumers/__init__.py", line 276 in _consume
    self.validate(message)
  File "/usr/lib/python2.7/site-packages/fedmsg/consumers/__init__.py", line 270 in validate
    if not fedmsg.crypto.validate(message['body'], **self.hub.config):
  File "/usr/lib/python2.7/site-packages/fedmsg/crypto/__init__.py", line 244 in validate
    return backend.validate(message, **cfg)
  File "/usr/lib/python2.7/site-packages/fedmsg/crypto/x509_ng.py", line 218 in validate
    message.get('topic'), common_name.value, routing_policy, nitpicky=nitpicky)
  File "/usr/lib/python2.7/site-packages/fedmsg/crypto/utils.py", line 77 in validate_policy
    "Topic %r.  Signer %r." % (topic, signer))

Yeah, as per https://infrastructure.fedoraproject.org/cgit/ansible.git/tree/inventory/host_vars/bodhi-backend01.phx2.fedoraproject.org#n34 bodhi-backend01 is not allowed to send this via the releng cert.
You'd need to add it to the list of messages it is allowed to send.

So those messages are legitimate? What changed on Friday that caused this to start happening?

From IRC:

<puiterwijk> bowlofeggs: yes, they are legitimate. And I'm not sure that changes on Friday caused it, since this is caused by pungi's ostree stuff

<puiterwijk> bowlofeggs: so, basically, to get rid of this error, you just want to add that topic to the can_send list

Metadata Update from @kevin:
- Issue tagged with: unfreeze

I fixed this after the freeze, let me know if you see more.

:twisted_rightwards_arrows:

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

unfreeze

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.