Skip to content

Force use of symetric JWT algorithm for internal logs server#49029

Merged
dstandish merged 1 commit into
apache:mainfrom
astronomer:fix-fetch-task-logs-jwk-key
Apr 10, 2025
Merged

Force use of symetric JWT algorithm for internal logs server#49029
dstandish merged 1 commit into
apache:mainfrom
astronomer:fix-fetch-task-logs-jwk-key

Conversation

@ashb

@ashb ashb commented Apr 9, 2025

Copy link
Copy Markdown
Member

Since the logs server was hard-coded to use a secret_key, if a user specified
the api_auth.jwt_algorithm config section it would have interferred and
caused this error:

Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/airflow/utils/log/file_task_handler.py", line 567, in _read_from_logs_server
    response = _fetch_logs_from_service(url, rel_path)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/airflow/utils/log/file_task_handler.py", line 112, in _fetch_logs_from_service
    headers={"Authorization": generator.generate({"filename": log_relative_path})},
                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/airflow/api_fastapi/auth/tokens.py", line 458, in generate
    return jwt.encode(claims, self.signing_arg, algorithm=self.algorithm, headers=headers)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/jwt/api_jwt.py", line 78, in encode
    return api_jws.encode(
           ^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/jwt/api_jws.py", line 170, in encode
    key = alg_obj.prepare_key(key)
          ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/jwt/algorithms.py", line 738, in prepare_key
    raise InvalidKeyError(
jwt.exceptions.InvalidKeyError: Expecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for EdDSA algorithms

The fix is to force a use of HS512 (the same one you would get if you didn't
specify an algorithm and did pass just a secret_key)

Fixes #48759

(See also #49028 though)

Since the logs server was hard-coded to use a secret_key, if a user specified
the `api_auth`.`jwt_algorithm` config section it would have interferred and
caused this error:

```
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/airflow/utils/log/file_task_handler.py", line 567, in _read_from_logs_server
    response = _fetch_logs_from_service(url, rel_path)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/airflow/utils/log/file_task_handler.py", line 112, in _fetch_logs_from_service
    headers={"Authorization": generator.generate({"filename": log_relative_path})},
                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/airflow/api_fastapi/auth/tokens.py", line 458, in generate
    return jwt.encode(claims, self.signing_arg, algorithm=self.algorithm, headers=headers)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/jwt/api_jwt.py", line 78, in encode
    return api_jws.encode(
           ^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/jwt/api_jws.py", line 170, in encode
    key = alg_obj.prepare_key(key)
          ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/jwt/algorithms.py", line 738, in prepare_key
    raise InvalidKeyError(
jwt.exceptions.InvalidKeyError: Expecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for EdDSA algorithms
```

The fix is to force a use of HS512 (the same one you would get if you didn't
specify an algorithm and did pass just a secret_key)

Fixes apache#48759
@dstandish
dstandish merged commit b9ee31c into apache:main Apr 10, 2025
@dstandish
dstandish deleted the fix-fetch-task-logs-jwk-key branch April 10, 2025 02:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Log serving fails for Celery with InvalidKeyError

3 participants