Bug: Invalid signature during record creation on OVH with mode: api #182

New Issue

Closed

opened 2025-11-20 04:21:14 -05:00 by saavagebueno · 7 comments

saavagebueno commented 2025-11-20 04:21:14 -05:00

Owner

Copy Link

Originally created by @P4uLT on GitHub (Mar 13, 2022).

Originally assigned to: @qdm12 on GitHub.

Bad Request: ERROR cannot list records: bad HTTP status: 400 Bad Request: Invalid signature:

1. Is this urgent: Yes

2. DNS provider(s) you use: OVH

3. Program version:

   Running version latest built on 2022-02-26T13:23:18Z (commit b1a69e0)

4. What are you using to run the container: docker-compose

5. Extra information (optional)

Logs:

ddns-updater     | 2022/03/13 17:09:24 INFO Found single setting to update record
ddns-updater     | 2022/03/13 17:09:24 INFO Reading history from database: domain MY_DOMAIN host @
ddns-updater     | 2022/03/13 17:09:24 INFO healthcheck server: listening on 127.0.0.1:9999
ddns-updater     | 2022/03/13 17:09:24 INFO backup: disabled
ddns-updater     | 2022/03/13 17:09:24 INFO http server: listening on :8000
ddns-updater     | 2022/03/13 17:09:24 DEBUG configured to fetch IP: v4 or v6: false, v4: true, v6: false
ddns-updater     | 2022/03/13 17:09:25 DEBUG your public IP address are: v4 or v6: <nil>, v4: MY_PUBLIC_IP, v6: <nil>
ddns-updater     | 2022/03/13 17:09:30 WARN cannot DNS resolve MY_DOMAIN after 5 tries: lookup MY_DOMAIN on MY_PRIVATE_DNS:53: no such host
ddns-updater     | 2022/03/13 17:09:30 INFO IPv4 address of MY_DOMAIN is <nil> and your IPv4 address is MY_PUBLIC_IP
ddns-updater     | 2022/03/13 17:09:30 INFO Updating record [domain: MY_DOMAIN | host: @ | provider: OVH] to use MY_PUBLIC_IP
ddns-updater     | 2022/03/13 17:09:30 DEBUG GET https://eu.api.ovh.com/1.0/auth/time | headers: Accept: application/json;charset=utf-8; X-Ovh-Application: jbOL8kmskRVZq6Da
ddns-updater     | 2022/03/13 17:09:30 DEBUG 200 OK | headers: X-Recruitment: You know how to code? This is a good start, but it may not be enough! We are looking for engineers who LOVE coding. Programming enthusiasts, code aesthetes, CTF winners, ... In short, geeks eager to learn, obstinate, involved. You want to challenge yourself? Join us! http://ovh.jobs; Server: nginx; X-Ovh-Queryid: EU.ext-4.622e254a.636.25e55ce2-f8a5-406a-87db-e9f8beefa509; X-Xss-Protection: 1; mode=block; X-Iplb-Instance: 21903; Access-Control-Allow-Methods: GET; Cache-Control: no-cache, no-store; X-Content-Type-Options: nosniff; Access-Control-Allow-Origin: *; Content-Type: application/json; charset=utf-8; Content-Length: 10; Access-Control-Allow-Headers: X-Ovh-Timestamp, X-Ovh-Consumer, X-Ovh-Application, X-Ovh-Signature, X-Ovh-Session, Authorization, Content-Type, X-Ovh-Apiversion; X-Iplb-Request-Id: 0A0108B8:C46C_0A5DF004:01BB_622E254A_A34765:11F59,0203DA62:9E2E_332611DF:01BB_622E254A_9A71AF:24C5C; X-Frame-Options: DENY; Date: Sun, 13 Mar 2022 17:09:30 GMT | body: 1647191370
ddns-updater     | 2022/03/13 17:09:30 DEBUG GET https://eu.api.ovh.com/1.0/domain/zone/MY_DOMAIN/record?fieldType=A&subDomain= | headers: X-Ovh-Application: jbOL8kmskRVZq6Da; X-Ovh-Timestamp: 1647191370; X-Ovh-Consumer: Z8rRn1T9StcUhyzxQgJuMu8gejpEClyv; X-Ovh-Signature: $1$4d0963c4fc84292dc21ac14a66929725dc4aee5f; Accept: application/json;charset=utf-8
ddns-updater     | 2022/03/13 17:09:30 DEBUG 400 Bad Request | headers: Content-Length: 92; X-Ovh-Queryid: EU.ext-3.622e254a.23859.57791c77-7d02-42e4-9d94-22cd11cde517; X-Iplb-Instance: 21903; Date: Sun, 13 Mar 2022 17:09:30 GMT; Content-Type: application/json; charset=utf-8; X-Xss-Protection: 1; mode=block; X-Content-Type-Options: nosniff; X-Frame-Options: DENY; X-Iplb-Request-Id: 0203DA62:9E2E_332611DF:01BB_622E254A_9A71B2:24C5C; Server: nginx; Cache-Control: no-cache, no-store | body: {"message":"Invalid signature","httpCode":"400 Bad Request","errorCode":"INVALID_SIGNATURE"}
ddns-updater     | 2022/03/13 17:09:30 ERROR cannot list records: bad HTTP status: 400 Bad Request: Invalid signature: for query ID: EU.ext-3.622e254a.23859.57791c77-7d02-42e4-9d94-22cd11cde517

Configuration file (remove your credentials!):

{
    "settings": [
      {
        "provider": "ovh",
        "domain": "MY_DOMAIN",
        "host": "@",
        "mode": "api",
        "api_endpoint": "ovh-eu",
        "app_key": "MY_APP_KEY",
        "app_secret": "MY_APP_SECRET",
        "consumer_key": "MY_CONSUMER_KEY",
        "ip_version": "ipv4",
        "provider_ip": true
      }
    ]
  }

Host OS: Openmediavault running docker.

Originally created by @P4uLT on GitHub (Mar 13, 2022). Originally assigned to: @qdm12 on GitHub. <!-- YOU CAN CHAT THERE EVENTUALLY: https://github.com/qdm12/ddns-updater/discussions --> **Bad Request**: *ERROR cannot list records: bad HTTP status: 400 Bad Request: Invalid signature:* 1. Is this urgent: Yes 2. DNS provider(s) you use: OVH 3. Program version: <!-- See the line at the top of your logs --> `Running version latest built on 2022-02-26T13:23:18Z (commit b1a69e0)` 4. What are you using to run the container: docker-compose 5. Extra information (optional) Logs: ```log ddns-updater | 2022/03/13 17:09:24 INFO Found single setting to update record ddns-updater | 2022/03/13 17:09:24 INFO Reading history from database: domain MY_DOMAIN host @ ddns-updater | 2022/03/13 17:09:24 INFO healthcheck server: listening on 127.0.0.1:9999 ddns-updater | 2022/03/13 17:09:24 INFO backup: disabled ddns-updater | 2022/03/13 17:09:24 INFO http server: listening on :8000 ddns-updater | 2022/03/13 17:09:24 DEBUG configured to fetch IP: v4 or v6: false, v4: true, v6: false ddns-updater | 2022/03/13 17:09:25 DEBUG your public IP address are: v4 or v6: <nil>, v4: MY_PUBLIC_IP, v6: <nil> ddns-updater | 2022/03/13 17:09:30 WARN cannot DNS resolve MY_DOMAIN after 5 tries: lookup MY_DOMAIN on MY_PRIVATE_DNS:53: no such host ddns-updater | 2022/03/13 17:09:30 INFO IPv4 address of MY_DOMAIN is <nil> and your IPv4 address is MY_PUBLIC_IP ddns-updater | 2022/03/13 17:09:30 INFO Updating record [domain: MY_DOMAIN | host: @ | provider: OVH] to use MY_PUBLIC_IP ddns-updater | 2022/03/13 17:09:30 DEBUG GET https://eu.api.ovh.com/1.0/auth/time | headers: Accept: application/json;charset=utf-8; X-Ovh-Application: jbOL8kmskRVZq6Da ddns-updater | 2022/03/13 17:09:30 DEBUG 200 OK | headers: X-Recruitment: You know how to code? This is a good start, but it may not be enough! We are looking for engineers who LOVE coding. Programming enthusiasts, code aesthetes, CTF winners, ... In short, geeks eager to learn, obstinate, involved. You want to challenge yourself? Join us! http://ovh.jobs; Server: nginx; X-Ovh-Queryid: EU.ext-4.622e254a.636.25e55ce2-f8a5-406a-87db-e9f8beefa509; X-Xss-Protection: 1; mode=block; X-Iplb-Instance: 21903; Access-Control-Allow-Methods: GET; Cache-Control: no-cache, no-store; X-Content-Type-Options: nosniff; Access-Control-Allow-Origin: *; Content-Type: application/json; charset=utf-8; Content-Length: 10; Access-Control-Allow-Headers: X-Ovh-Timestamp, X-Ovh-Consumer, X-Ovh-Application, X-Ovh-Signature, X-Ovh-Session, Authorization, Content-Type, X-Ovh-Apiversion; X-Iplb-Request-Id: 0A0108B8:C46C_0A5DF004:01BB_622E254A_A34765:11F59,0203DA62:9E2E_332611DF:01BB_622E254A_9A71AF:24C5C; X-Frame-Options: DENY; Date: Sun, 13 Mar 2022 17:09:30 GMT | body: 1647191370 ddns-updater | 2022/03/13 17:09:30 DEBUG GET https://eu.api.ovh.com/1.0/domain/zone/MY_DOMAIN/record?fieldType=A&subDomain= | headers: X-Ovh-Application: jbOL8kmskRVZq6Da; X-Ovh-Timestamp: 1647191370; X-Ovh-Consumer: Z8rRn1T9StcUhyzxQgJuMu8gejpEClyv; X-Ovh-Signature: $1$4d0963c4fc84292dc21ac14a66929725dc4aee5f; Accept: application/json;charset=utf-8 ddns-updater | 2022/03/13 17:09:30 DEBUG 400 Bad Request | headers: Content-Length: 92; X-Ovh-Queryid: EU.ext-3.622e254a.23859.57791c77-7d02-42e4-9d94-22cd11cde517; X-Iplb-Instance: 21903; Date: Sun, 13 Mar 2022 17:09:30 GMT; Content-Type: application/json; charset=utf-8; X-Xss-Protection: 1; mode=block; X-Content-Type-Options: nosniff; X-Frame-Options: DENY; X-Iplb-Request-Id: 0203DA62:9E2E_332611DF:01BB_622E254A_9A71B2:24C5C; Server: nginx; Cache-Control: no-cache, no-store | body: {"message":"Invalid signature","httpCode":"400 Bad Request","errorCode":"INVALID_SIGNATURE"} ddns-updater | 2022/03/13 17:09:30 ERROR cannot list records: bad HTTP status: 400 Bad Request: Invalid signature: for query ID: EU.ext-3.622e254a.23859.57791c77-7d02-42e4-9d94-22cd11cde517 ``` Configuration file (**remove your credentials!**): ```json { "settings": [ { "provider": "ovh", "domain": "MY_DOMAIN", "host": "@", "mode": "api", "api_endpoint": "ovh-eu", "app_key": "MY_APP_KEY", "app_secret": "MY_APP_SECRET", "consumer_key": "MY_CONSUMER_KEY", "ip_version": "ipv4", "provider_ip": true } ] } ``` Host OS: Openmediavault running docker.

saavagebueno closed this issue 2025-11-20 04:21:14 -05:00

saavagebueno commented 2025-11-20 04:21:15 -05:00

Author

Owner

Copy Link

@cthybert commented on GitHub (Oct 20, 2022):

same issue here

@cthybert commented on GitHub (Oct 20, 2022): same issue here

saavagebueno commented 2025-11-20 04:21:15 -05:00

Author

Owner

Copy Link

@edaubert commented on GitHub (Dec 28, 2022):

Same issue here and it seems the same as https://github.com/qdm12/ddns-updater/issues/244

I use
Running version latest built on 2022-12-14T20:23:40Z (commit 3fd82ab)

Here is the log I have

2022-12-28T18:06:46Z DEBUG GET https://eu.api.ovh.com/1.0/domain/zone/faineantos.fr/record?fieldType=A&subDomain=theogal | headers: Accept: application/json;charset=utf-8; X-Ovh-Application: YSmG4nKWXpRSTCmd; X-Ovh-Timestamp: 1672250806; X-Ovh-Consumer: adENqVKrGztxxR7CAMhXbt7XZQ68wC9C; X-Ovh-Signature: $1$45820dd19d2b3d4180b0aeb225981de548f4a38c
2022-12-28T18:06:46Z DEBUG 400 Bad Request | headers: Content-Length: 92; Access-Control-Allow-Headers: X-Ovh-Timestamp, X-Ovh-Consumer, X-Ovh-Application, X-Ovh-Signature, X-Ovh-Session, Authorization, Content-Type; X-Frame-Options: DENY; Access-Control-Allow-Methods: GET, POST; X-Xss-Protection: 1; mode=block; X-Iplb-Instance: 43155; Server: nginx; Date: Wed, 28 Dec 2022 18:06:46 GMT; Access-Control-Allow-Origin: *; Cache-Control: no-cache, no-store; X-Iplb-Request-Id: 25411637:5648_332611DF:01BB_63AC85B6_101E51:2240D; Content-Type: application/json; charset=utf-8; X-Ovh-Queryid: EU.ext-3.63ac85b6.10528.27b4f1fc-7be3-4da2-bdd0-ce044c421e61; X-Content-Type-Options: nosniff | body: {"message":"Invalid signature","httpCode":"400 Bad Request","errorCode":"INVALID_SIGNATURE"}
2022-12-28T18:06:46Z ERROR cannot list records: bad HTTP status: 400 Bad Request: Invalid signature: for query ID: EU.ext-3.63ac85b6.10528.27b4f1fc-7be3-4da2-bdd0-ce044c421e61

I try to reproduce this request using https://eu.api.ovh.com/console/#/domain/zone/%7BzoneName%7D/record~GET
Everything seems to be OK.

@edaubert commented on GitHub (Dec 28, 2022): Same issue here and it seems the same as https://github.com/qdm12/ddns-updater/issues/244 I use `Running version latest built on 2022-12-14T20:23:40Z (commit 3fd82ab)` Here is the log I have ``` 2022-12-28T18:06:46Z DEBUG GET https://eu.api.ovh.com/1.0/domain/zone/faineantos.fr/record?fieldType=A&subDomain=theogal | headers: Accept: application/json;charset=utf-8; X-Ovh-Application: YSmG4nKWXpRSTCmd; X-Ovh-Timestamp: 1672250806; X-Ovh-Consumer: adENqVKrGztxxR7CAMhXbt7XZQ68wC9C; X-Ovh-Signature: $1$45820dd19d2b3d4180b0aeb225981de548f4a38c 2022-12-28T18:06:46Z DEBUG 400 Bad Request | headers: Content-Length: 92; Access-Control-Allow-Headers: X-Ovh-Timestamp, X-Ovh-Consumer, X-Ovh-Application, X-Ovh-Signature, X-Ovh-Session, Authorization, Content-Type; X-Frame-Options: DENY; Access-Control-Allow-Methods: GET, POST; X-Xss-Protection: 1; mode=block; X-Iplb-Instance: 43155; Server: nginx; Date: Wed, 28 Dec 2022 18:06:46 GMT; Access-Control-Allow-Origin: *; Cache-Control: no-cache, no-store; X-Iplb-Request-Id: 25411637:5648_332611DF:01BB_63AC85B6_101E51:2240D; Content-Type: application/json; charset=utf-8; X-Ovh-Queryid: EU.ext-3.63ac85b6.10528.27b4f1fc-7be3-4da2-bdd0-ce044c421e61; X-Content-Type-Options: nosniff | body: {"message":"Invalid signature","httpCode":"400 Bad Request","errorCode":"INVALID_SIGNATURE"} 2022-12-28T18:06:46Z ERROR cannot list records: bad HTTP status: 400 Bad Request: Invalid signature: for query ID: EU.ext-3.63ac85b6.10528.27b4f1fc-7be3-4da2-bdd0-ce044c421e61 ``` I try to reproduce this request using https://eu.api.ovh.com/console/#/domain/zone/%7BzoneName%7D/record~GET Everything seems to be OK.

saavagebueno commented 2025-11-20 04:21:15 -05:00

Author

Owner

Copy Link

@edaubert commented on GitHub (Jan 4, 2023):

According to https://docs.ovh.com/gb/en/api/first-steps-with-ovh-api/

X-Ovh-Signature: should be defined according to "$1$" + SHA1_HEX(AS+"+"+CK+"+"+METHOD+"+"+QUERY+"+"+BODY+"+"+TSTAMP)

When I look on 89711cd76d/internal/settings/providers/ovh/headers.go (L22)
It seems to me that it is not the same implementation

I see p.appSecret + "+" + p.consumerKey + "+" + httpMethod + "+" + p.apiURL.String() + "+" + url.Path + "+" + string(body) + "+" + strconv.Itoa(int(timestamp)),

I have an interrogation about p.apiURL.String() + "+" + url.Path
If apiURL and url.Path should be concatenate, it doesn't need to have "+".

Am I wrong ?

@edaubert commented on GitHub (Jan 4, 2023): According to https://docs.ovh.com/gb/en/api/first-steps-with-ovh-api/ `X-Ovh-Signature: ` should be defined according to `"$1$" + SHA1_HEX(AS+"+"+CK+"+"+METHOD+"+"+QUERY+"+"+BODY+"+"+TSTAMP)` When I look on https://github.com/qdm12/ddns-updater/blob/89711cd76d16278cc801e71c18d3901f1781692c/internal/settings/providers/ovh/headers.go#L22 It seems to me that it is not the same implementation I see `p.appSecret + "+" + p.consumerKey + "+" + httpMethod + "+" + p.apiURL.String() + "+" + url.Path + "+" + string(body) + "+" + strconv.Itoa(int(timestamp)),` I have an interrogation about `p.apiURL.String() + "+" + url.Path` If apiURL and url.Path should be concatenate, it doesn't need to have `"+"`. Am I wrong ?

saavagebueno commented 2025-11-20 04:21:15 -05:00

Author

Owner

Copy Link

@edaubert commented on GitHub (Jan 10, 2023):

Ok so after some atempts, I finally found the issue.

p.apiURL.String() + "+" + url.Path give us something like https://eu.api.ovh.com/1.0/1.0/domain/zone/<domain>/record
The issue here is 1.0/1.0/, we should only have one time the API version.

This is due to the way the URL is built on the different request because p.apiURL is already used to build the path of the complete url we want to call.

Additionnally, we need to specify the query parameters.

So we should set something like https://eu.api.ovh.com/1.0/domain/zone/<domain>/record?fieldType=A&subDomain=<subdomain>.

I am going to build a PR about this.

@edaubert commented on GitHub (Jan 10, 2023): Ok so after some atempts, I finally found the issue. `p.apiURL.String() + "+" + url.Path` give us something like `https://eu.api.ovh.com/1.0/1.0/domain/zone/<domain>/record` The issue here is **`1.0/1.0/`**, we should only have one time the API version. This is due to the way the URL is built on the different request because p.apiURL is already used to build the path of the complete url we want to call. Additionnally, we need to specify the query parameters. So we should set something like `https://eu.api.ovh.com/1.0/domain/zone/<domain>/record?fieldType=A&subDomain=<subdomain>`. I am going to build a PR about this.

saavagebueno commented 2025-11-20 04:21:15 -05:00

Author

Owner

Copy Link

@fredericrous commented on GitHub (Feb 1, 2023):

hey @edaubert , thank you for contributing. I tried to use your PR but it was failing.
I'm having issues with my NAS since 2 weeks already and didn't get time to diagnose, I was hopping this PR was the solution
looking at the code only, the implementation for the signature looks good https://github.com/ovh/go-ovh/blob/master/ovh/ovh.go#L300

@fredericrous commented on GitHub (Feb 1, 2023): hey @edaubert , thank you for contributing. I tried to use your PR but it was failing. I'm having issues with my NAS since 2 weeks already and didn't get time to diagnose, I was hopping this PR was the solution looking at the code only, the implementation for the signature looks good https://github.com/ovh/go-ovh/blob/master/ovh/ovh.go#L300

saavagebueno commented 2025-11-20 04:21:15 -05:00

Author

Owner

Copy Link

@edaubert commented on GitHub (Feb 6, 2023):

Hi @fredericrous,

Sorry I did not apply linters I guess.
I will build another pull request to fix that and try to reproduce the github actions to be sure everything is fine on the verify phase.

@edaubert commented on GitHub (Feb 6, 2023): Hi @fredericrous, Sorry I did not apply linters I guess. I will build another pull request to fix that and try to reproduce the github actions to be sure everything is fine on the verify phase.

saavagebueno commented 2025-11-20 04:21:16 -05:00

Author

Owner

Copy Link

@qdm12 commented on GitHub (Jun 12, 2023):

This should be fixed by #431

@qdm12 commented on GitHub (Jun 12, 2023): This should be fixed by #431

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

dependabot/github_actions/github/codeql-action-4.37.3

dependabot/github_actions/docker/login-action-4.5.2

perf/skip-debug-body-reads

dependabot/go_modules/github.com/breml/rootcerts-0.3.7

dependabot/github_actions/actions/setup-go-7

dependabot/go_modules/golang.org/x/mod-0.38.0

dependabot/go_modules/golang.org/x/net-0.57.0

dependabot/go_modules/github.com/go-chi/chi/v5-5.3.1

dependabot/github_actions/DavidAnson/markdownlint-cli2-action-24

dependabot/github_actions/actions/checkout-7

v2.9

azure

v2.8

v2.7

v2.6

ipv4andv6

branch-v2.4

get-records

alpine

v2.10.0

v2.9.1

v2.9.0

v2.8.2

v2.8.1

v2.8.0

v2.7.1

v2.6.1

v2.7.0

v2.6.0

v2.5.0

v2.4.1

v2.4.0

v2.3.0

v2.2.0

v2.1.0

v2

v1

Labels

Clear labels

Category: Config problem 📝

Category: Database 🗃️

Category: Documentation ✒️

Category: Foolproof settings 👼

Category: Good idea 🎯

Category: Healthcheck 🩺

Category: IP fetching 📥

Category: Label missing ❗

Category: Maintenance ⛓️

Category: Motivated! 🙌

Category: New provider 🆕

Category: Provider update ♻️

Category: Shoutrrr 📢

Category: Web UI 🖱️

Category: Wildcard 🃏

Closed: ⚰️ Inactive

Closed: 👥 Duplicate

Closed: 🗑️ Bad issue

Complexity: ☣️ Hard to do

Complexity: 🟩 Easy to do

Priority: 💤 Low priority

Priority: 🚨 Urgent

pull-request

Mirrored from GitHub Pull Request

Status: 🔒 After next release

Status: 🔴 Blocked

Status: 🗯️ Waiting for feedback

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

saavagebueno

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ddns-updater#182