Files
seaweedfs/weed/server/volume_grpc_tier_download.go
T
Chris Lu c7d0477117 volume: widen the gRPC admin gate and stop it drifting (#10443)
* volume: gate the admin RPCs that only shell and workers call

checkGrpcAdminAuth covered 19 of the 48 VolumeServer RPCs, so an operator who
sets -whiteList expecting it to cover the gRPC surface gets partial coverage.

Extend it to ten that mutate state and are only ever called by the shell or a
worker: SetState, VolumeCopy, the EC generate/rebuild/copy/unmount/to-volume
pair, both tier moves, and VolumeTailReceiver. That is safe because the same
callers already reach gated RPCs today -- VolumeMarkReadonly, VacuumVolume*,
VolumeEcShardsDelete, VolumeDelete -- so a whitelist deployment already lists
those hosts. Nothing here is on a master or peer path, which is what made the
earlier fail-closed gate break multi-host clusters.

The split is by caller rather than by blast radius: the guard matches a peer IP
against the whitelist, and a whitelist holds masters, shell hosts and workers,
not every peer volume server. Gating a call one volume server makes to another
would break replication, EC and tiering, so those stay open.

Two test fakes embedded a nil grpc.ServerStream and only implemented Send;
they now implement Context, which the streaming RPCs read to authorize.

* volume: fail the build when a gRPC method skips the admin gate

The admin gate is an opt-in list in a 48-method service, which is how it
drifted down to covering 19 of them: nothing tied adding an RPC to deciding
whether it needed the gate.

Parse volume_server.proto, walk the AST of every *VolumeServer method, and
require each RPC to either call checkGrpcAdminAuth or appear in
ungatedVolumeServerRPCs with the reason it stays open. A stale entry naming an
RPC that no longer exists fails too, so the list can't quietly stop exempting
anything.

The exemptions are the cluster-internal calls -- replica sync, EC shard
distribution, vacuum reads, backup, tailing -- plus the read-only and liveness
RPCs. Closing the cluster-internal ones needs a peer identity rather than an
IP whitelist; recording them here makes that a visible decision instead of an
omission.

The AST walk also corrects the count: a line-window scan credits
VacuumVolumeCheck and VolumeServerStatus with a neighbouring function's guard.
2026-07-25 23:53:29 -07:00

152 lines
5.5 KiB
Go

package weed_server
import (
"fmt"
"os"
"path/filepath"
"runtime"
"time"
"github.com/seaweedfs/seaweedfs/weed/glog"
"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
"github.com/seaweedfs/seaweedfs/weed/storage"
"github.com/seaweedfs/seaweedfs/weed/storage/backend"
"github.com/seaweedfs/seaweedfs/weed/storage/needle"
)
// VolumeTierMoveDatFromRemote copy dat file from a remote tier to local volume server
func (vs *VolumeServer) VolumeTierMoveDatFromRemote(req *volume_server_pb.VolumeTierMoveDatFromRemoteRequest, stream volume_server_pb.VolumeServer_VolumeTierMoveDatFromRemoteServer) error {
if err := vs.checkGrpcAdminAuth(stream.Context()); err != nil {
return err
}
// find existing volume
v := vs.store.GetVolume(needle.VolumeId(req.VolumeId))
if v == nil {
return fmt.Errorf("volume %d not found", req.VolumeId)
}
// verify the collection
if v.Collection != req.Collection {
return fmt.Errorf("existing collection:%v unexpected input: %v", v.Collection, req.Collection)
}
// locate the disk file
storageName, storageKey := v.RemoteStorageNameKey()
if storageName == "" || storageKey == "" {
return fmt.Errorf("volume %d is already on local disk", req.VolumeId)
}
remoteFileModifiedTime := v.GetVolumeInfo().GetFiles()[0].GetModifiedTime()
// check whether the local .dat already exists
_, ok := v.DataBackend.(*backend.DiskFile)
if ok {
return fmt.Errorf("volume %d is already on local disk", req.VolumeId)
}
// check valid storage backend type
backendStorage, found := backend.BackendStorages[storageName]
if !found {
var keys []string
for key := range backend.BackendStorages {
keys = append(keys, key)
}
return fmt.Errorf("remote storage %s not found from supported: %v", storageName, keys)
}
startTime := time.Now()
fn := func(progressed int64, percentage float32) error {
now := time.Now()
if now.Sub(startTime) < time.Second {
return nil
}
startTime = now
return stream.Send(&volume_server_pb.VolumeTierMoveDatFromRemoteResponse{
Processed: progressed,
ProcessedPercentage: percentage,
})
}
// copy the data file (DownloadFile opens, fsyncs, and closes the .dat internally)
datFileName := v.FileName(".dat")
_, err := backendStorage.DownloadFile(datFileName, storageKey, fn)
if err != nil {
return fmt.Errorf("backend %s copy file %s: %v", storageName, datFileName, err)
}
if remoteFileModifiedTime > 0 {
modifiedTime := time.Unix(int64(remoteFileModifiedTime), 0)
// best-effort: a cosmetic mtime failure should not abort an otherwise
// complete tier-down, matching the EC copy path
if err := os.Chtimes(v.FileName(".dat"), modifiedTime, modifiedTime); err != nil {
glog.Warningf("volume %d restore data file %s modified time: %v", v.Id, v.FileName(".dat"), err)
}
}
// fsync the containing directory so the new .dat and the about-to-be-rewritten
// .vif are durably linked before we touch the shared remote object.
if err := fsyncDir(filepath.Dir(datFileName)); err != nil {
return fmt.Errorf("volume %d fsync dir for %s: %v", v.Id, datFileName, err)
}
// Trim the remote file reference and persist the .vif (util.WriteFile fsyncs it)
// BEFORE deleting the remote object. After this the .vif no longer references the
// remote object, so a crash before DeleteFile merely leaks the remote object while
// the volume reloads its local .dat as non-remote. The volume must NEVER be left
// with a .vif referencing the remote object while that object is deleted.
v.GetVolumeInfo().Files = v.GetVolumeInfo().Files[1:]
if err := v.SaveVolumeInfo(); err != nil {
return fmt.Errorf("volume %d failed to save remote file info: %v", v.Id, err)
}
// fsync the directory again so the rewritten .vif is durable.
if err := fsyncDir(filepath.Dir(datFileName)); err != nil {
return fmt.Errorf("volume %d fsync dir after saving volume info: %v", v.Id, err)
}
// Swap the data backend from the remote storage to the now-local .dat on BOTH
// paths, so a KeepRemoteDatFile=true download still leaves the replica serving
// from local disk (hasRemoteFile=false) rather than the shared remote object.
if err := swapToLocalDatBackend(v, datFileName); err != nil {
return fmt.Errorf("volume %d failed to open local dat file %s: %v", v.Id, datFileName, err)
}
if req.KeepRemoteDatFile {
// Surviving replicas still reference this object; keep it intact.
return nil
}
// remove remote file: only the last replica to download deletes the shared object.
if err := backendStorage.DeleteFile(storageKey); err != nil {
return fmt.Errorf("volume %d failed to delete remote file %s: %v", v.Id, storageKey, err)
}
return nil
}
// swapToLocalDatBackend closes the remote data backend and opens the downloaded
// local .dat as a DiskFile so reads are served from local disk.
func swapToLocalDatBackend(v *storage.Volume, datFileName string) error {
dataFile, err := os.OpenFile(datFileName, os.O_RDWR, 0644)
if err != nil {
return err
}
// Swap under the volume's data lock so concurrent reads never see a closed
// or half-swapped backend, clearing hasRemoteFile in the same step since the
// volume now serves from the local .dat.
v.SwapDataBackend(backend.NewDiskFile(dataFile), false)
return nil
}
// fsyncDir flushes a directory entry so renamed/created files within it survive
// a crash. Directory fsync is unsupported on Windows, so it is skipped there.
func fsyncDir(dir string) error {
if runtime.GOOS == "windows" {
return nil
}
d, err := os.Open(dir)
if err != nil {
return err
}
defer d.Close()
return d.Sync()
}