Merge pull request #11691 from ioito/hotfix/qx-account-aksk-err

fix(region): account aksk error

pkg/compute/models/cloudaccounts.go

@@ -362,7 +362,7 @@ func (manager *SCloudaccountManager) ValidateCreateData(
 ) (api.CloudaccountCreateInput, error) {
 	input, err := manager.validateCreateData(ctx, userCred, ownerId, query, input)
 	if err != nil {
-		return input, errors.Wrap(err, "validateCreateData")
+		return input, err
 	}
 
 	input.EnabledStatusInfrasResourceBaseCreateInput, err = manager.SEnabledStatusInfrasResourceBaseManager.ValidateCreateData(ctx, userCred, ownerId, query, input.EnabledStatusInfrasResourceBaseCreateInput)
@@ -505,8 +505,7 @@ func (manager *SCloudaccountManager) validateCreateData(
 		if err == cloudprovider.ErrNoSuchProvder {
 			return input, httperrors.NewResourceNotFoundError("no such provider %s", input.Provider)
 		}
-		//log.Debugf("ValidateCreateData %s", err.Error())
-		return input, httperrors.NewInputParameterError("invalid cloud account info error: %s", err.Error())
+		return input, httperrors.NewGeneralError(err)
 	}
 
 	// check accountId uniqueness

pkg/httperrors/consts.go

@@ -92,6 +92,8 @@ const (
 	ErrUserDisabled                = errors.Error("UserDisabled")
 	ErrWrongPassword               = errors.Error("WrongPassword")
 	ErrIncorrectUsernameOrPassword = errors.Error("IncorrectUsernameOrPassword")
+
+	ErrInvalidAccessKey = errors.Error("InvalidAccessKey")
 )
 
 var (
@@ -172,6 +174,8 @@ var (
 		ErrIncorrectUsernameOrPassword: 401,
 
 		ErrPolicyDefinition: 409,
+
+		ErrInvalidAccessKey: 400,
 	}
 )
 

pkg/multicloud/aliyun/aliyun.go

@@ -33,6 +33,7 @@ import (
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/util/httputils"
 )
 
@@ -142,7 +143,7 @@ func NewAliyunClient(cfg *AliyunClientConfig) (*SAliyunClient, error) {
 	}
 	err := client.fetchRegions()
 	if err != nil {
-		return nil, errors.Wrap(err, "fetchRegions")
+		return nil, err
 	}
 	err = client.fetchBuckets()
 	if err != nil {
@@ -167,8 +168,13 @@ func jsonRequest(client *sdk.Client, domain, apiVersion, apiName string, params
 			if e, ok := errors.Cause(err).(*alierr.ServerError); ok {
 				code := e.ErrorCode()
 				switch code {
-				case "InvalidAccessKeyId.NotFound":
-					return nil, err
+				case "InvalidAccessKeyId.NotFound",
+					"InvalidAccessKeyId",
+					"NoEnabledAccessKey",
+					"InvalidAccessKeyId.Inactive",
+					"Forbidden.AccessKeyDisabled",
+					"Forbidden.AccessKey":
+					return nil, errors.Wrapf(httperrors.ErrInvalidAccessKey, err.Error())
 				case "404 Not Found", "InstanceNotFound":
 					return nil, errors.Wrap(cloudprovider.ErrNotFound, err.Error())
 				case "InvalidInstance.NotSupported",

pkg/multicloud/aws/aws.go

@@ -41,6 +41,7 @@ import (
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
+	"yunion.io/x/onecloud/pkg/httperrors"
 )
 
 const (
@@ -115,7 +116,7 @@ func NewAwsClient(cfg *AwsClientConfig) (*SAwsClient, error) {
 	}
 	_, err := client.fetchRegions()
 	if err != nil {
-		return nil, errors.Wrap(err, "fetchRegions")
+		return nil, err
 	}
 	err = client.fetchOwnerId()
 	if err != nil {
@@ -204,6 +205,9 @@ func (self *SAwsClient) fetchRegions() ([]SRegion, error) {
 		// https://docs.aws.amazon.com/sdk-for-go/api/service/ec2/#EC2.DescribeRegions
 		result, err := svc.DescribeRegions(&ec2.DescribeRegionsInput{})
 		if err != nil {
+			if e, ok := err.(awserr.Error); ok && e.Code() == "AuthFailure" {
+				return nil, errors.Wrap(httperrors.ErrInvalidAccessKey, err.Error())
+			}
 			return nil, errors.Wrap(err, "DescribeRegions")
 		}
 		describeRegionResult[self.accessUrl] = result

pkg/multicloud/azure/azure.go

@@ -1,5 +1,4 @@
 // Copyright 2019 Yunion
-//
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -35,6 +34,7 @@ import (
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/util/httputils"
 )
 
@@ -704,6 +704,9 @@ func _jsonRequest(client *autorest.Client, method, domain, path string, body jso
 	cli := httputils.NewJsonClient(client)
 	header, body, err := cli.Send(context.TODO(), req, &ae, debug)
 	if err != nil {
+		if strings.Contains(err.Error(), "azure.BearerAuthorizer#WithAuthorization") {
+			return nil, errors.Wrapf(httperrors.ErrInvalidAccessKey, err.Error())
+		}
 		return nil, err
 	}
 	locationFunc := func(head http.Header) string {

pkg/multicloud/ecloud/request.go

@@ -22,7 +22,9 @@ import (
 	"time"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/pkg/errors"
 
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/util/httputils"
 )
 
@@ -250,6 +252,9 @@ func (br *SBaseRequest) ForMateResponseBody(jrbody jsonutils.JSONObject) (jsonut
 	default:
 		if jrbody.Contains("errorMessage") {
 			msg, _ := jrbody.GetString("errorMessage")
+			if strings.Contains(msg, "Invalid parameter AccessKey") {
+				return nil, errors.Wrapf(httperrors.ErrInvalidAccessKey, msg)
+			}
 			return nil, &httputils.JSONClientError{Code: 400, Details: msg}
 		}
 		return nil, &httputils.JSONClientError{Code: 400, Details: jrbody.String()}

pkg/multicloud/huawei/client/modules/manager_base.go

@@ -27,6 +27,7 @@ import (
 	"yunion.io/x/pkg/errors"
 
 	"yunion.io/x/onecloud/pkg/cloudprovider"
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/multicloud/huawei/client/auth"
 	"yunion.io/x/onecloud/pkg/multicloud/huawei/client/requests"
 	"yunion.io/x/onecloud/pkg/multicloud/huawei/client/responses"
@@ -166,6 +167,7 @@ type HuaweiClientError struct {
 	Errorcode []string
 	err       error
 	Details   string
+	ErrorCode string
 }
 
 func (ce *HuaweiClientError) Error() string {
@@ -227,7 +229,9 @@ func (self *SBaseManager) jsonRequest(request requests.IRequest) (http.Header, j
 
 		switch err := e.(type) {
 		case *HuaweiClientError:
-			if err.Code == 499 && retry > 0 && request.GetMethod() == "GET" {
+			if err.ErrorCode == "APIGW.0301" {
+				return h, b, errors.Wrapf(httperrors.ErrInvalidAccessKey, e.Error())
+			} else if err.Code == 499 && retry > 0 && request.GetMethod() == "GET" {
 				retry -= 1
 				time.Sleep(3 * time.Second * time.Duration(MAX_RETRY-retry))
 			} else if (err.Code == 404 || strings.Contains(err.Details, "could not be found") || strings.Contains(err.Details, "does not exist")) && request.GetMethod() != "POST" {

pkg/multicloud/huawei/huawei.go

@@ -126,7 +126,7 @@ func NewHuaweiClient(cfg *HuaweiClientConfig) (*SHuaweiClient, error) {
 func (self *SHuaweiClient) init() error {
 	err := self.fetchRegions()
 	if err != nil {
-		return errors.Wrap(err, "fetchRegions")
+		return err
 	}
 	err = self.initSigner()
 	if err != nil {

pkg/multicloud/jdcloud/image.go

@@ -17,14 +17,19 @@ package jdcloud
 import (
 	"context"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/jdcloud-api/jdcloud-sdk-go/services/vm/apis"
 	"github.com/jdcloud-api/jdcloud-sdk-go/services/vm/client"
 	"github.com/jdcloud-api/jdcloud-sdk-go/services/vm/models"
 
+	"yunion.io/x/log"
+	"yunion.io/x/pkg/errors"
+
 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/multicloud"
 )
 
@@ -179,9 +184,13 @@ func (r *SRegion) GetImages(imageIds []string, imageSource string, pageNumber, p
 	client.Logger = Logger{}
 	resp, err := client.DescribeImages(req)
 	if err != nil {
+		log.Errorf("err: %v", err)
 		return nil, 0, err
 	}
 	if resp.Error.Code >= 400 {
+		if strings.Contains(resp.Error.Message, "secret key is nul") || strings.Contains(resp.Error.Message, "sign result is not same") {
+			return nil, 0, errors.Wrapf(httperrors.ErrInvalidAccessKey, resp.Error.Message)
+		}
 		err = fmt.Errorf(resp.Error.Message)
 		return nil, 0, err
 	}

pkg/multicloud/openstack/openstack.go

@@ -29,6 +29,7 @@ import (
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/onecloud/pkg/util/httputils"
 	"yunion.io/x/onecloud/pkg/util/version"
@@ -113,7 +114,7 @@ func NewOpenStackClient(cfg *OpenstackClientConfig) (*SOpenStackClient, error) {
 	}
 	err := cli.fetchToken()
 	if err != nil {
-		return nil, errors.Wrap(err, "fetchToken")
+		return nil, err
 	}
 	return cli, cli.fetchRegions()
 }
@@ -387,7 +388,7 @@ func (cli *SOpenStackClient) fetchToken() error {
 	var err error
 	cli.tokenCredential, err = cli.getDefaultToken()
 	if err != nil {
-		return errors.Wrap(err, "getDefaultToken")
+		return err
 	}
 	return cli.checkEndpointType()
 }
@@ -427,6 +428,11 @@ func (cli *SOpenStackClient) getDefaultToken() (mcclient.TokenCredential, error)
 	client := cli.getDefaultClient()
 	token, err := client.Authenticate(cli.username, cli.password, cli.domainName, cli.project, cli.projectDomain)
 	if err != nil {
+		if e, ok := err.(*httputils.JSONClientError); ok {
+			if e.Class == "Unauthorized" {
+				return nil, errors.Wrapf(httperrors.ErrInvalidAccessKey, err.Error())
+			}
+		}
 		return nil, errors.Wrap(err, "Authenticate")
 	}
 	return token, nil

pkg/multicloud/qcloud/qcloud.go

@@ -40,6 +40,7 @@ import (
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/util/httputils"
 )
 
@@ -497,6 +498,12 @@ func _baseJsonRequest(client *common.Client, req tchttp.Request, resp qcloudResp
 		needRetry := false
 		e, ok := err.(*sdkerrors.TencentCloudSDKError)
 		if ok {
+			if utils.IsInStringArray(e.Code, []string{
+				"AuthFailure.SecretIdNotFound",
+				"AuthFailure.SignatureFailure",
+			}) {
+				return nil, errors.Wrapf(httperrors.ErrInvalidAccessKey, err.Error())
+			}
 			if utils.IsInStringArray(e.Code, []string{
 				"InvalidParameter.RoleNotExist",
 				"ResourceNotFound",

pkg/multicloud/ucloud/client.go

@@ -23,7 +23,9 @@ import (
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
+	"yunion.io/x/pkg/errors"
 
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/util/httputils"
 )
 
@@ -154,7 +156,9 @@ func parseUcloudResponse(params SParams, resp jsonutils.JSONObject) (jsonutils.J
 	err.Action, _ = params.data.GetString("Action")
 
 	if err.RetCode > 0 {
-		log.Debugf("Ucloud json request err %s", params.PrettyString())
+		if err.RetCode == 171 {
+			return nil, errors.Wrapf(httperrors.ErrInvalidAccessKey, err.Error())
+		}
 		return nil, err
 	}
 

pkg/multicloud/zstack/zstack.go

@@ -34,6 +34,7 @@ import (
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/util/httputils"
 )
 
@@ -227,7 +228,12 @@ func (cli *SZStackClient) _list(resource string, start int, limit int, params ur
 	}
 	_, resp, err := httputils.JSONRequest(cli.httpClient, context.Background(), "GET", requestURL, header, nil, cli.debug)
 	if err != nil {
-		return nil, errors.Wrapf(err, fmt.Sprintf("GET %s params: %s", resource, params))
+		if e, ok := err.(*httputils.JSONClientError); ok {
+			if strings.Contains(e.Details, "wrong accessKey signature") || strings.Contains(e.Details, "access key id") {
+				return nil, errors.Wrapf(httperrors.ErrInvalidAccessKey, err.Error())
+			}
+		}
+		return nil, err
 	}
 	return resp, nil
 }

pkg/util/httputils/httputils.go

@@ -30,6 +30,7 @@ import (
 	"os"
 	"strconv"
 	"strings"
+	"syscall"
 	"time"
 
 	"github.com/fatih/color"
@@ -435,6 +436,28 @@ func GetDefaultClient() *http.Client {
 	return GetClient(true, time.Second*15)
 }
 
+func getClientErrorClass(err error) error {
+	cause := errors.Cause(err)
+	if urlErr, ok := cause.(*url.Error); ok {
+		if netErr, ok := urlErr.Err.(*net.OpError); ok {
+			switch t := netErr.Err.(type) {
+			case *net.DNSError:
+				return errors.ErrDNS
+			case *os.SyscallError:
+				if errno, ok := t.Err.(syscall.Errno); ok {
+					switch errno {
+					case syscall.ECONNREFUSED:
+						return errors.ErrConnectRefused
+					case syscall.ETIMEDOUT:
+						return errors.ErrTimeout
+					}
+				}
+			}
+		}
+	}
+	return errors.ErrClient
+}
+
 func Request(client sClient, ctx context.Context, method THttpMethod, urlStr string, header http.Header, body io.Reader, debug bool) (*http.Response, error) {
 	req, resp, err := requestInternal(client, ctx, method, urlStr, header, body, debug)
 	if err != nil {
@@ -448,13 +471,13 @@ func Request(client sClient, ctx context.Context, method THttpMethod, urlStr str
 		}
 		if req == nil {
 			ce := newJsonClientErrorFromRequest2(string(method), urlStr, header, reqBody)
-			ce.Class = string(errors.ErrClient)
+			ce.Class = getClientErrorClass(err).Error()
 			ce.Details = err.Error()
 			ce.Code = 499
 			return nil, ce
 		}
 		ce := newJsonClientErrorFromRequest(req, reqBody)
-		ce.Class = string(errors.ErrClient)
+		ce.Class = getClientErrorClass(err).Error()
 		ce.Details = err.Error()
 		ce.Code = 499
 		return nil, ce