代码块错误:403 禁止访问被禁止

我最近接管了一个 discourse 服务器的管理,遇到了一些问题。

  1. 在尝试创建或编辑带有代码块的帖子时,我遇到了持续存在的问题。在尝试创建或编辑带有代码块的帖子时
(access node)$ spack list openfoam@2306
...
Variants:
    Name [Default]            When    Allowed values    Description
    ======================    ====    ==============    ==================================================

    build_system [generic]    --      generic           Build systems supported by the package
    int64 [off]               --      on, off           With 64-bit labels
    kahip [off]               --      on, off           With kahip decomposition
    knl [off]                 --      on, off           Use KNL compiler settings
    metis [off]               --      on, off           With metis decomposition
    mgridgen [off]            --      on, off           With mgridgen support
    paraview [off]            --      on, off           Build paraview plugins and runtime post-processing
    precision [dp]            --      sp, dp, spdp      Precision option
    scotch [on]               --      on, off           With scotch/ptscotch decomposition
    source [on]               --      on, off           Install library/application sources and tutorials
    vtk [off]                 --      on, off           With VTK runTimePostProcessing
    zoltan [off]              --      on, off           With zoltan renumbering
...

我收到一个 403 Forbidden 错误。

  1. Markdown 不支持代码高亮,添加任何语法规范都会导致 403 Forbidden 错误。

  2. 内联代码段在某些位置(而非全部位置,相对于其他代码块)也会导致 403 Forbidden 错误。

安装的版本是 3.1.1 ( 0612f0d5b6 )。

这些问题是相关的吗?可能是什么原因导致这种行为?

示例帖子: Compiling OpenFOAM with Spack - 📚 Knowledge nuggets - HPC discourse

预期结果:

在使用 Spack 安装 OpenFOAM of OpenCFD 时出现了一些问题。

按照 UL HPC 教程中的说明,设置了一个环境来管理 Spack 的软件包。简而言之,为 SPACK 软件包定义了以下依赖项:

(access node)$ cat << EOF > $SPACK_ROOT/etc/spack/packages.yaml
packages:
    slurm:
        externals:
        - spec: slurm@22.05.5
          prefix: /usr
        buildable: False
    libevent:
        externals:
        - spec: libevent@2.1.8
          prefix: /usr
        buildable: False
    pmix:
        externals:
        - spec: pmix@4.2.3
          prefix: /usr
        buildable: False
    hwloc:
        externals:
        - spec: hwloc@2.2.0
          prefix: /usr
        buildable: False
EOF

并为构建缓存目录定义了以下选项:

(access)$ cat << EOF > $SPACK_ROOT/etc/spack/config.yaml
config:
    build_stage:
        - /dev/shm/$user/spack-stage
EOF

以使用内存盘文件系统加速编译。在继续安装 OpenFOAM 之前,使用系统编译器安装所需的 Open MPI 版本:

(compute node)$ spack install -j openmpi@4.0.5 +pmi schedulers=slurm ^pmix@4.2.3 ^hwloc@2.2.0

OpenFOAM 发行版也使用系统编译器进行安装。OpenFOAM 的可用组件是:

(access node)$ spack list openfoam@2306
...
Variants:
    Name [Default]            When    Allowed values    Description
    ======================    ====    ==============    ==================================================

    build_system [generic]    --      generic           Build systems supported by the package
    int64 [off]               --      on, off           With 64-bit labels
    kahip [off]               --      on, off           With kahip decomposition
    knl [off]                 --      on, off           Use KNL compiler settings
    metis [off]               --      on, off           With metis decomposition
    mgridgen [off]            --      on, off           With mgridgen support
    paraview [off]            --      on, off           Build paraview plugins and runtime post-processing
    precision [dp]            --      sp, dp, spdp      Precision option
    scotch [on]               --      on, off           With scotch/ptscotch decomposition
    source [on]               --      on, off           Install library/application sources and tutorials
    vtk [off]                 --      on, off           With VTK runTimePostProcessing
    zoltan [off]              --      on, off           With zoltan renumbering
...

OpenFOAM 使用所有可用的分区器(metisscotchzoltankahip)和多网格生成器组件(文档第 6.3.1.4 节)进行安装,命令如下:

(compute node)$ spack install -j openfoam@2306 +source precision=dp +metis +scotch +zoltan +kahip +mgridgen ~knl ~int64 ~paraview ^openmpi@4.0.5

然而,由此产生的安装缺少多个组件。例如,执行 doc/Build.md 中的手动安装后验证:

# Create the user "run" directory:
mkdir -p "$FOAM_RUN"
# Change to the user "run" directory:
run
# Copy tutorial
cp -r "$FOAM_TUTORIALS"/incompressible/simpleFoam/pitzDaily ./
# Run the tutorial
( cd pitzDaily && blockMesh && simpleFoam )

网格生成器 blockMesh 和求解器 simpleFoam 都丢失了。

事实证明,METIS 分区器导致多个组件的安装失败。仅使用 SCOTCH 分区器重新编译:

(compute node)$  spack install openfoam@2306  +source +scotch +mgridgen precision=dp ~int64 ~kahip ~knl ~metis ~paraview ~vtk ~zoltan ^openmpi@4.0.5

解决了这个问题。所有求解器组件都已安装,但仍缺少一些实用程序。

我们使用以下脚本来检测所有缺失的组件:

(access node)$ cat list_spack_openfoam
#!/usr/bin/bash

set -euo pipefail

declare variant="${1}" # e.g. @2306%gcc@8.5.0 @2306+mgridgen
declare type="${2}" # solvers, utilities

find_makefile_directories() {
    local directory="${1}"

    find "${directory}" -type d | grep -E '\/Make$' || true
}

extract_executable_name() {
    local makefile_directory="${1}"

    cat "${makefile_directory}/files" | ( grep -E '^EXE[[:space:]]*=' || true ) | sed 's/^EXE[[:space:]]*=[[:space:]]*\$(FOAM_APPBIN)\///g'
}

main() {
    local variant="${1}"
    local type="${2}"

    local foam_location="$(spack location -i openfoam"${variant}")"

    local pagkage_directory=""
    local executable_name=""
    local installed=""
    local package_makefile_directory=""
    while read -r package_makefile_directory; do
        executable_name=$( extract_executable_name "${package_makefile_directory}" )

        if [ -n "${executable_name}" ]; then
            if [ -x "${foam_location}/platforms/linux64GccDPInt32-spack/bin/${executable_name}" ]; then
                installed="Y"
            else
                installed="N"
            fi
            package_directory="$( echo "${package_makefile_directory}" | xargs -I % dirname % )"

            echo "${installed} : ${executable_name} => ${package_directory#${foam_location}}"
        fi
    done < <( find_makefile_directories "${foam_location}/applications/${type}" )
}

main "${variant}" "${type}"

运行该脚本的简单测试表明,以下实用程序缺失:

(access node)$ ./list_spack_openfoam utilities @2306 | grep -E '^N'
N : addr2line => /applications/utilities/miscellaneous/OSspecific/addr2line
N : foamyHexMeshSurfaceSimplify => /applications/utilities/mesh/generation/foamyMesh/foamyHexMeshSurfaceSimplify
N : foamyHexMeshBackgroundMesh => /applications/utilities/mesh/generation/foamyMesh/foamyHexMeshBackgroundMesh
N : cellSizeAndAlignmentGrid => /applications/utilities/mesh/generation/foamyMesh/cellSizeAndAlignmentGrid
N : foamToCcm => /applications/utilities/mesh/conversion/ccm/foamToCcm
N : ccmToFoam => /applications/utilities/mesh/conversion/ccm/ccmToFoam

很难说,与 Markdown 相关的问题通常不会导致 403 错误,但会向作者提供一些 UI 反馈。我们的 403 错误通常与授权有关,例如在受限类别中发帖或使用受限标签。

我在 Discourse 的原生实例中使用了您的文本块,似乎没有问题。

我是否可以建议您与您的版主核实,看看是否存在此类限制?

4 个赞

在此基础上,我们几乎总是发现,在尝试创建帖子(尤其是带有代码块的帖子!)时出现此类 403 错误,是因为过于激进的Web应用程序防火墙(WAF)认为代码块是 shellcode 或注入攻击。

我注意到所讨论的实例似乎由 WAF 提供服务:

○ → host hpc-discourse.uni.lu
hpc-discourse.uni.lu is an alias for fstc-waf2.uni.lu.

因此,我强烈怀疑 403 错误并非来自 Discourse,而是来自您的 WAF。

检查浏览器中的错误标头应该能够告诉您拒绝的来源。

7 个赞

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.