[bug] Media proxy returns 424 Failed Dependency for all requests #526

New Issue

Closed

opened 2023-04-23 12:50:27 +00:00 by creideiki · 1 comment

creideiki commented

2023-04-23 12:50:27 +00:00

Your setup

From source

Extra details

Gentoo Linux

Version

v3.8.0

PostgreSQL version

15.2

What were you trying to do?

After activating the media proxy, all requests to it for images return an HTTP error 424 Failed Dependency after exactly 5 seconds.

A test post demonstrating this error is available at https://akkoma.pikaböl.se/notice/AUwOggNPhamXI484nI

My setup consists of two virtual machines, one running an Apache reverse proxy that terminates TLS and proxies to Akkoma running on the other VM. The Akkoma VM does not have a publicly routable IP address.

What did you expect to happen?

I was expecting the media proxy to serve images.

What actually happened?

I get this HTTP error back:

$ curl -i https://akkoma.pikaböl.se/proxy/preview/1LQYvOkwHq_m6BBILapwBbEgdOo/aHR0cHM6Ly9ha2tvbWEueG4tLXBpa2FibC0weGEuc2UvbWVkaWEvYjVjZmQ5MWY5MDU4MWUyNGVkYjdjMDJlZjUyMjZjMWFlNmNiYmVmNjEzYjk1YjJlMWQ3MzQ4ZmQ4YzcyNTUwMS5KUEc/b5cfd91f90581e24edb7c02ef5226c1ae6cbbef613b95b2e1d7348fd8c725501.JPG
HTTP/1.1 424 Failed Dependency
Date: Sun, 23 Apr 2023 12:39:42 GMT
Server: Cowboy
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key
cache-control: max-age=0, private, must-revalidate
content-length: 25
content-security-policy: upgrade-insecure-requests;style-src 'self' 'nonce-G1aziuMT8usaaXH';font-src 'self';script-src 'self' 'nonce-G1aziuMT8usaaXH' ;connect-src 'self' https://akkoma.xn--pikabl-0xa.se wss://akkoma.xn--pikabl-0xa.se ;media-src 'self' https:;img-src 'self' data: blob: https:;default-src 'none';base-uri 'none';frame-ancestors 'none';manifest-src 'self';
permissions-policy: interest-cohort=()
referrer-policy: same-origin
x-content-type-options: nosniff
x-frame-options: DENY
x-permitted-cross-domain-policies: none
x-request-id: F1iQt2ArUpDgvGIAACzh
x-xss-protection: 0
X-Cache: MISS from akkoma.xn--pikabl-0xa.se
X-Cache-Detail: "s-maxage or max-age zero and no Last-Modified or Etag; not cacheable" from akkoma.xn--pikabl-0xa.se
Content-Type: image/jpeg

Can't fetch HTTP headers.

Looking at the source code, it looks like the only place this error can be generated is at https://akkoma.dev/AkkomaGang/akkoma/src/branch/stable/lib/pleroma/web/media_proxy/media_proxy_controller.ex#L88 if a HEAD request to the full image URL (obtained by Base64 decoding the last part of the request URL) fails. But that URL (https://akkoma.xn--pikabl-0xa.se/media/b5cfd91f90581e24edb7c02ef5226c1ae6cbbef613b95b2e1d7348fd8c725501.JPG) works both from a web browser and from the command line om the VM running my Akkoma server:

akkoma@akkoma ~ $ curl -I https://akkoma.pikaböl.se/media/b5cfd91f90581e24edb7c02ef5226c1ae6cbbef613b95b2e1d7348fd8c725501.JPG
HTTP/1.1 200 OK
Date: Sun, 23 Apr 2023 12:44:07 GMT
Server: Cowboy
accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key
cache-control: public, max-age=1209600
content-length: 6155908
content-security-policy: sandbox
content-type: image/jpeg
etag: "42CBBCD"
permissions-policy: interest-cohort=()
referrer-policy: same-origin
x-content-type-options: nosniff
x-frame-options: DENY
x-permitted-cross-domain-policies: none
x-xss-protection: 0

Logs

Nothing of note is logged, even in debug mode - just that the request comes in, and 5s later that a 424 is returned.

14:25:09.520 request_id=F1iP7SViam24cnoAAA5n [debug] GET /proxy/preview/1LQYvOkwHq_m6BBILapwBbEgdOo/aHR0cHM6Ly9ha2tvbWEueG4tLXBpa2FibC0weGEuc2UvbWVkaWEvYjVjZmQ5MWY5MDU4MWUyNGVkYjdjMDJlZjUyMjZjMWFlNmNiYmVmNjEzYjk1YjJlMWQ3MzQ4ZmQ4YzcyNTUwMS5KUEc/b5cfd91f90581e24edb7c02ef5226c1ae6cbbef613b95b2e1d7348fd8c725501.JPG

14:25:09.520 request_id=F1iP7SViam24cnoAAA5n [debug] Processing with Pleroma.Web.MediaProxy.MediaProxyController.preview/2
  Parameters: %{"filename" => "b5cfd91f90581e24edb7c02ef5226c1ae6cbbef613b95b2e1d7348fd8c725501.JPG", "sig" => "1LQYvOkwHq_m6BBILapwBbEgdOo", "url" => "aHR0cHM6Ly9ha2tvbWEueG4tLXBpa2FibC0weGEuc2UvbWVkaWEvYjVjZmQ5MWY5MDU4MWUyNGVkYjdjMDJlZjUyMjZjMWFlNmNiYmVmNjEzYjk1YjJlMWQ3MzQ4ZmQ4YzcyNTUwMS5KUEc"}
  Pipelines: []

14:25:14.524 request_id=F1iP7SViam24cnoAAA5n [debug] Sent 424 in 5004ms

Severity

I cannot use the software

Have you searched for this issue?

I have double-checked and have not found this issue mentioned anywhere.

### Your setup From source ### Extra details Gentoo Linux ### Version v3.8.0 ### PostgreSQL version 15.2 ### What were you trying to do? After activating the media proxy, all requests to it for images return an HTTP error 424 Failed Dependency after exactly 5 seconds. A test post demonstrating this error is available at https://akkoma.pikaböl.se/notice/AUwOggNPhamXI484nI My setup consists of two virtual machines, one running an Apache reverse proxy that terminates TLS and proxies to Akkoma running on the other VM. The Akkoma VM does not have a publicly routable IP address. ### What did you expect to happen? I was expecting the media proxy to serve images. ### What actually happened? I get this HTTP error back: ``` $ curl -i https://akkoma.pikaböl.se/proxy/preview/1LQYvOkwHq_m6BBILapwBbEgdOo/aHR0cHM6Ly9ha2tvbWEueG4tLXBpa2FibC0weGEuc2UvbWVkaWEvYjVjZmQ5MWY5MDU4MWUyNGVkYjdjMDJlZjUyMjZjMWFlNmNiYmVmNjEzYjk1YjJlMWQ3MzQ4ZmQ4YzcyNTUwMS5KUEc/b5cfd91f90581e24edb7c02ef5226c1ae6cbbef613b95b2e1d7348fd8c725501.JPG HTTP/1.1 424 Failed Dependency Date: Sun, 23 Apr 2023 12:39:42 GMT Server: Cowboy access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key cache-control: max-age=0, private, must-revalidate content-length: 25 content-security-policy: upgrade-insecure-requests;style-src 'self' 'nonce-G1aziuMT8usaaXH';font-src 'self';script-src 'self' 'nonce-G1aziuMT8usaaXH' ;connect-src 'self' https://akkoma.xn--pikabl-0xa.se wss://akkoma.xn--pikabl-0xa.se ;media-src 'self' https:;img-src 'self' data: blob: https:;default-src 'none';base-uri 'none';frame-ancestors 'none';manifest-src 'self'; permissions-policy: interest-cohort=() referrer-policy: same-origin x-content-type-options: nosniff x-frame-options: DENY x-permitted-cross-domain-policies: none x-request-id: F1iQt2ArUpDgvGIAACzh x-xss-protection: 0 X-Cache: MISS from akkoma.xn--pikabl-0xa.se X-Cache-Detail: "s-maxage or max-age zero and no Last-Modified or Etag; not cacheable" from akkoma.xn--pikabl-0xa.se Content-Type: image/jpeg Can't fetch HTTP headers. ``` Looking at the source code, it looks like the only place this error can be generated is at https://akkoma.dev/AkkomaGang/akkoma/src/branch/stable/lib/pleroma/web/media_proxy/media_proxy_controller.ex#L88 if a HEAD request to the full image URL (obtained by Base64 decoding the last part of the request URL) fails. But that URL (https://akkoma.xn--pikabl-0xa.se/media/b5cfd91f90581e24edb7c02ef5226c1ae6cbbef613b95b2e1d7348fd8c725501.JPG) works both from a web browser and from the command line om the VM running my Akkoma server: ``` akkoma@akkoma ~ $ curl -I https://akkoma.pikaböl.se/media/b5cfd91f90581e24edb7c02ef5226c1ae6cbbef613b95b2e1d7348fd8c725501.JPG HTTP/1.1 200 OK Date: Sun, 23 Apr 2023 12:44:07 GMT Server: Cowboy accept-ranges: bytes access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key cache-control: public, max-age=1209600 content-length: 6155908 content-security-policy: sandbox content-type: image/jpeg etag: "42CBBCD" permissions-policy: interest-cohort=() referrer-policy: same-origin x-content-type-options: nosniff x-frame-options: DENY x-permitted-cross-domain-policies: none x-xss-protection: 0 ``` ### Logs ```shell Nothing of note is logged, even in debug mode - just that the request comes in, and 5s later that a 424 is returned. 14:25:09.520 request_id=F1iP7SViam24cnoAAA5n [debug] GET /proxy/preview/1LQYvOkwHq_m6BBILapwBbEgdOo/aHR0cHM6Ly9ha2tvbWEueG4tLXBpa2FibC0weGEuc2UvbWVkaWEvYjVjZmQ5MWY5MDU4MWUyNGVkYjdjMDJlZjUyMjZjMWFlNmNiYmVmNjEzYjk1YjJlMWQ3MzQ4ZmQ4YzcyNTUwMS5KUEc/b5cfd91f90581e24edb7c02ef5226c1ae6cbbef613b95b2e1d7348fd8c725501.JPG 14:25:09.520 request_id=F1iP7SViam24cnoAAA5n [debug] Processing with Pleroma.Web.MediaProxy.MediaProxyController.preview/2 Parameters: %{"filename" => "b5cfd91f90581e24edb7c02ef5226c1ae6cbbef613b95b2e1d7348fd8c725501.JPG", "sig" => "1LQYvOkwHq_m6BBILapwBbEgdOo", "url" => "aHR0cHM6Ly9ha2tvbWEueG4tLXBpa2FibC0weGEuc2UvbWVkaWEvYjVjZmQ5MWY5MDU4MWUyNGVkYjdjMDJlZjUyMjZjMWFlNmNiYmVmNjEzYjk1YjJlMWQ3MzQ4ZmQ4YzcyNTUwMS5KUEc"} Pipelines: [] 14:25:14.524 request_id=F1iP7SViam24cnoAAA5n [debug] Sent 424 in 5004ms ``` ### Severity I cannot use the software ### Have you searched for this issue? - [x] I have double-checked and have not found this issue mentioned anywhere.

creideiki added the

bug

label 2023-04-23 12:50:27 +00:00

creideiki commented

2023-05-14 19:29:50 +00:00

Author

I finally looked deep enough at Wireshark to figure out that this was a bug in my firewall's NAT rules. Akkoma really couldn't connect to itself to fetch the original image from /media/.

I finally looked deep enough at Wireshark to figure out that this was a bug in my firewall's NAT rules. Akkoma really couldn't connect to itself to fetch the original image from `/media/`.

creideiki closed this issue

2023-05-14 19:29:50 +00:00

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: AkkomaGang/akkoma#526

No description provided.