mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-31 09:20:50 +01:00
Nguyễn Lộc Phúcandchrislusf
eba2cb926d
* s3tables: refuse a create that a namespace delete can lose DeleteNamespace checks the namespace for children and then deletes its directory recursively in a second filer call. The filer locks each path on its own, so a table created under the namespace between the two is not seen by the check and is removed by the delete, while both requests answer 200. The mirror case loses the table too: a create that passed its namespace check before the delete finished re-created the namespace directory through the filer's parent creation and recorded a table in a namespace that no longer exists. Each side now writes before it reads. DeleteNamespace claims the namespace record with a fresh token before it scans, deletes only while the record still holds that claim, and lifts its own claim when it stops. CreateTable, RegisterTable and CreateView re-read the namespace after writing their record and back out when it is claimed or gone: they remove what they wrote and answer 409 or 404 instead of reporting an entry that does not survive, or 500 when the record could not be removed and may remain. An entry the scan missed was written after the claim, so its create sees the claim; a create and a delete can both fail, but no longer both succeed. A create is also refused up front while a claim is held, but only after its authorization check, so a caller that may not create there does not learn of the delete. A create writes its record marked "create" and lifts the mark once the namespace is confirmed open. Until then GetTable, GetView, UpdateTable and a second create treat the record as absent, so no request is told about a table or view that the first create may still back out. * s3tables: keep a create's unfinished record out of reads and listings * s3tables: refuse catalog writes on a record an operation claimed * s3tables: answer 404 when a create's write path loses the namespace * s3tables: confirm the rename destination's namespace like a create * s3tables: cover unfinished-record reads, claimed-record writes, rename claim * s3tables: lift a leftover claim when a no-token delete clears the record * s3tables: answer 409 when a claimed record turns away a write UpdateView, TagResource, and UntagResource surfaced ErrConcurrentUpdate as a 500, so an expected conflict looked like a server fault to the caller. Map it to Conflict the way UpdateTable and the policy handlers already do. * s3tables: name the lost source when a rename finds it deleted * s3tables: report an entry deleted before its update as not found The filer answers an UpdateEntry on an entry removed since the lookup with codes.NotFound. mutateEntryExtended returned that error unchanged instead of filer_pb.ErrNotFound, so a rename whose source was deleted mid-claim answered 500 instead of NoSuchTable or NoSuchView. MemFiler now answers a missing entry the same way, so the rename tests for tables and views take the real filer's path. * s3tables: unpublish the destination when a rename's source clear fails * s3tables: refuse to delete a record another operation claimed * s3tables: release catalog claims on an uncanceled cleanup context * s3tables: answer 404 when a racing delete already removed the table * s3tables: keep the rename destination marked until the source clears * s3tables: guard the rename rollback against a recreated source and an unfinished destination * s3tables: drop the unfinished destination only once the source is restored * s3tables: re-resolve the purge target on the record a delete claims * s3tables: cover a delete that meets a moved metadata location * s3tables: answer 409 when a create's record changed under it * s3tables: adopt a record still marked by its unfinished create * s3tables: skip unfinished creates in the namespace empty check * s3tables: delete only the record the caller was authorized on DeleteView and DeleteTable check permissions on the record they read first, then read the name again to claim it. A record that took the name in between, such as a table or another owner's view created after a concurrent delete, was claimed and removed on the first record's authorization, and DeleteView never compared the caller's version token with it. The second read now repeats the first one's checks: a record of the other kind or an unfinished create answers 404, and a token that no longer matches answers 409. A delete without a token also compares the record's version token with the authorized one and answers 409 when they differ. * s3tables: re-check the parent after a create lifts its mark A create that passed checkParentOpen and paused before lifting its mark could still confirm while a namespace delete held the claim: the delete scans the still-marked record, skips it, and removes it under a create that already answered success. confirmParent now re-reads the same parent record after the mark clears and backs the confirmed record out when the namespace moved on. * s3tables: mark the rename destination with a claim of its own claimCatalogEntry adopted every create-marked record, including a rename's destination: a create landing after the source cleared could replace the destination before the rename published it, and with the source name reused the restore could leave the table on neither name. The destination now marks with the rename's own claim, which readers still treat as unpublished but a create must refuse, and the commit re-checks the destination namespace after the record goes live. The source keeps its rename claim until the commit lands so a namespace delete scanning the cleared record still refuses. * s3tables: compare the parent's createdAt, not its editable metadata A namespace update rewrites ExtendedKeyMetadata in place, so a create or rename whose second parent read landed across an UpdateNamespace saw a changed blob and reported the still-live namespace as gone: creates backed their record out and answered 404, renames undid their destination. createdAt survives the edit but changes on a delete+recreate, so it still identifies the record. * s3tables: retry lifting the rename's claim off the cleared source The release's only failure mode is a transient filer error — nothing else can write the cleared record — yet a single loss left the claim behind: the old name stayed refused to creates and the namespace counted the record as a child. Retry the release before warning. * s3tables: page the namespace scan before deleting it A page of skippable entries — bare directories or unfinished creates — ended the scan with hasChildren false, so a table on a later page was removed with the namespace. Keep listing with StartFromFileName until a child shows or the listing ends. --------- Co-authored-by: chrislusf <chrislusf@users.noreply.github.com>
353 lines
13 KiB
Go
353 lines
13 KiB
Go
package s3tables
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"path"
|
|
"testing"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
const renameTestBucket = "renamebkt"
|
|
|
|
func mustBucketARN(t *testing.T) string {
|
|
t.Helper()
|
|
arn, err := BuildBucketARN(DefaultRegion, DefaultAccountID, renameTestBucket)
|
|
require.NoError(t, err)
|
|
return arn
|
|
}
|
|
|
|
// startRenameManager seeds a bucket/namespace/table and returns a trusted Manager.
|
|
func startRenameManager(t *testing.T) (*s3tablestest.MemFiler, *Manager) {
|
|
t.Helper()
|
|
fs := s3tablestest.Start(t)
|
|
|
|
bucketMeta, _ := json.Marshal(tableBucketMetadata{Name: renameTestBucket, OwnerAccountID: DefaultAccountID})
|
|
fs.Put(TablesPath, renameTestBucket, map[string][]byte{
|
|
ExtendedKeyTableBucket: []byte("{}"),
|
|
ExtendedKeyMetadata: bucketMeta,
|
|
})
|
|
|
|
nsMeta, _ := json.Marshal(namespaceMetadata{Namespace: []string{"ns"}, OwnerAccountID: DefaultAccountID})
|
|
fs.Put(GetTableBucketPath(renameTestBucket), "ns", map[string][]byte{ExtendedKeyMetadata: nsMeta})
|
|
|
|
tableMeta, _ := json.Marshal(tableMetadataInternal{
|
|
Name: "t",
|
|
Namespace: "ns",
|
|
Format: "ICEBERG",
|
|
OwnerAccountID: DefaultAccountID,
|
|
MetadataVersion: 3,
|
|
MetadataLocation: "s3://" + renameTestBucket + "/ns/t/metadata/v3.metadata.json",
|
|
})
|
|
fs.Put(GetNamespacePath(renameTestBucket, "ns"), "t", map[string][]byte{
|
|
ExtendedKeyMetadata: tableMeta,
|
|
ExtendedKeyMetadataVersion: []byte("3"),
|
|
})
|
|
|
|
// Physical metadata.json and data files live under the table directory.
|
|
tablePath := GetTablePath(renameTestBucket, "ns", "t")
|
|
fs.Put(tablePath, "metadata", nil)
|
|
fs.Put(tablePath, "data", nil)
|
|
fs.Put(path.Join(tablePath, "metadata"), "v3.metadata.json", nil)
|
|
|
|
m := NewManager()
|
|
m.SetTrusted(true)
|
|
return fs, m
|
|
}
|
|
|
|
func runRename(t *testing.T, m *Manager, fs *s3tablestest.MemFiler, req *RenameTableRequest) error {
|
|
t.Helper()
|
|
return m.Execute(context.Background(), NewManagerClient(fs.Client), "RenameTable", req, nil, "")
|
|
}
|
|
|
|
func runGetTable(t *testing.T, m *Manager, fs *s3tablestest.MemFiler, namespace, name string) (*GetTableResponse, error) {
|
|
t.Helper()
|
|
resp := &GetTableResponse{}
|
|
err := m.Execute(context.Background(), NewManagerClient(fs.Client), "GetTable", &GetTableRequest{
|
|
TableBucketARN: mustBucketARN(t),
|
|
Namespace: []string{namespace},
|
|
Name: name,
|
|
}, resp, "")
|
|
return resp, err
|
|
}
|
|
|
|
func TestRenameTablePreservesData(t *testing.T) {
|
|
fs, m := startRenameManager(t)
|
|
|
|
req := &RenameTableRequest{
|
|
TableBucketARN: mustBucketARN(t),
|
|
SourceNamespace: []string{"ns"},
|
|
SourceName: "t",
|
|
DestNamespace: []string{"ns"},
|
|
DestName: "t2",
|
|
}
|
|
require.NoError(t, runRename(t, m, fs, req))
|
|
|
|
// The source directory and its metadata.json/data children must survive: rename
|
|
// is catalog-only and the destination still points at the original location.
|
|
srcPath := GetTablePath(renameTestBucket, "ns", "t")
|
|
assert.NotNil(t, fs.Get(srcPath, "metadata"), "source metadata dir must survive")
|
|
assert.NotNil(t, fs.Get(srcPath, "data"), "source data dir must survive")
|
|
assert.NotNil(t, fs.Get(path.Join(srcPath, "metadata"), "v3.metadata.json"), "metadata.json must survive")
|
|
|
|
// Source catalog xattrs are dropped so the name stops resolving.
|
|
src := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
|
|
require.NotNil(t, src, "source directory must remain to hold the data children")
|
|
_, hasMeta := src.Extended[ExtendedKeyMetadata]
|
|
assert.False(t, hasMeta, "source table-metadata xattr must be removed")
|
|
|
|
_, err := runGetTable(t, m, fs, "ns", "t")
|
|
require.Error(t, err)
|
|
var s3Err *S3TablesError
|
|
require.ErrorAs(t, err, &s3Err)
|
|
assert.Equal(t, ErrCodeNoSuchTable, s3Err.Type)
|
|
|
|
// The destination resolves to the preserved (original) MetadataLocation.
|
|
got, err := runGetTable(t, m, fs, "ns", "t2")
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "t2", got.Name)
|
|
assert.Equal(t, "s3://"+renameTestBucket+"/ns/t/metadata/v3.metadata.json", got.MetadataLocation)
|
|
|
|
dest := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t2")
|
|
require.NotNil(t, dest)
|
|
assert.Equal(t, []byte("3"), dest.Extended[ExtendedKeyMetadataVersion])
|
|
}
|
|
|
|
func TestRenameTableSourceMissing(t *testing.T) {
|
|
fs, m := startRenameManager(t)
|
|
err := runRename(t, m, fs, &RenameTableRequest{
|
|
TableBucketARN: mustBucketARN(t),
|
|
SourceNamespace: []string{"ns"},
|
|
SourceName: "ghost",
|
|
DestNamespace: []string{"ns"},
|
|
DestName: "t2",
|
|
})
|
|
require.Error(t, err)
|
|
var s3Err *S3TablesError
|
|
require.ErrorAs(t, err, &s3Err)
|
|
assert.Equal(t, ErrCodeNoSuchTable, s3Err.Type)
|
|
}
|
|
|
|
func TestRenameTableDestExists(t *testing.T) {
|
|
fs, m := startRenameManager(t)
|
|
existing, _ := json.Marshal(tableMetadataInternal{Name: "t2", Namespace: "ns", OwnerAccountID: DefaultAccountID})
|
|
fs.Put(GetNamespacePath(renameTestBucket, "ns"), "t2", map[string][]byte{ExtendedKeyMetadata: existing})
|
|
|
|
err := runRename(t, m, fs, &RenameTableRequest{
|
|
TableBucketARN: mustBucketARN(t),
|
|
SourceNamespace: []string{"ns"},
|
|
SourceName: "t",
|
|
DestNamespace: []string{"ns"},
|
|
DestName: "t2",
|
|
})
|
|
require.Error(t, err)
|
|
var s3Err *S3TablesError
|
|
require.ErrorAs(t, err, &s3Err)
|
|
assert.Equal(t, ErrCodeTableAlreadyExists, s3Err.Type)
|
|
assert.NotNil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t"), "source must be untouched on conflict")
|
|
}
|
|
|
|
func TestRenameTableDestNamespaceMissing(t *testing.T) {
|
|
fs, m := startRenameManager(t)
|
|
err := runRename(t, m, fs, &RenameTableRequest{
|
|
TableBucketARN: mustBucketARN(t),
|
|
SourceNamespace: []string{"ns"},
|
|
SourceName: "t",
|
|
DestNamespace: []string{"other"},
|
|
DestName: "t2",
|
|
})
|
|
require.Error(t, err)
|
|
var s3Err *S3TablesError
|
|
require.ErrorAs(t, err, &s3Err)
|
|
assert.Equal(t, ErrCodeNoSuchNamespace, s3Err.Type)
|
|
assert.NotNil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t"), "source must be untouched")
|
|
}
|
|
|
|
// A delete that purges the source between the rename's read and its claim loses
|
|
// the source, not the destination namespace — the answer must name the table.
|
|
func TestRenameTableSourceDeletedMidRename(t *testing.T) {
|
|
fs, m := startRenameManager(t)
|
|
|
|
nsPath := GetNamespacePath(renameTestBucket, "ns")
|
|
fs.BeforeUpdate = func() {
|
|
_, _ = fs.Client.DeleteEntry(context.Background(), &filer_pb.DeleteEntryRequest{
|
|
Directory: nsPath,
|
|
Name: "t",
|
|
IsRecursive: true,
|
|
IsDeleteData: true,
|
|
})
|
|
}
|
|
|
|
err := runRename(t, m, fs, &RenameTableRequest{
|
|
TableBucketARN: mustBucketARN(t),
|
|
SourceNamespace: []string{"ns"},
|
|
SourceName: "t",
|
|
DestNamespace: []string{"ns"},
|
|
DestName: "t2",
|
|
})
|
|
require.Error(t, err)
|
|
var s3Err *S3TablesError
|
|
require.ErrorAs(t, err, &s3Err)
|
|
assert.Equal(t, ErrCodeNoSuchTable, s3Err.Type)
|
|
assert.Nil(t, fs.Get(nsPath, "t2"), "a failed rename must not publish the destination")
|
|
}
|
|
|
|
// A source that vanishes after the destination is claimed must not leave the
|
|
// destination behind: the failed rename removes the marked record on the way
|
|
// out, before it is ever published.
|
|
func TestRenameTableBacksOutConfirmedDest(t *testing.T) {
|
|
fs, m := startRenameManager(t)
|
|
|
|
nsPath := GetNamespacePath(renameTestBucket, "ns")
|
|
fs.OnUpdate = func(dir, name string) {
|
|
if dir == nsPath && name == "t2" {
|
|
_, _ = fs.Client.DeleteEntry(context.Background(), &filer_pb.DeleteEntryRequest{
|
|
Directory: nsPath,
|
|
Name: "t",
|
|
IsRecursive: true,
|
|
IsDeleteData: true,
|
|
})
|
|
}
|
|
}
|
|
|
|
err := runRename(t, m, fs, &RenameTableRequest{
|
|
TableBucketARN: mustBucketARN(t),
|
|
SourceNamespace: []string{"ns"},
|
|
SourceName: "t",
|
|
DestNamespace: []string{"ns"},
|
|
DestName: "t2",
|
|
})
|
|
require.Error(t, err)
|
|
var s3Err *S3TablesError
|
|
require.ErrorAs(t, err, &s3Err)
|
|
assert.Equal(t, ErrCodeNoSuchTable, s3Err.Type)
|
|
assert.Nil(t, fs.Get(nsPath, "t2"), "a failed rename must not leave the claimed destination behind")
|
|
}
|
|
|
|
// A principal allowed to rename the source must still be denied when it cannot
|
|
// create a table in the destination namespace. The denial reports the same
|
|
// not-found as a missing destination namespace so the caller cannot probe for
|
|
// namespaces it may not touch.
|
|
func TestRenameTableDestNamespaceUnauthorized(t *testing.T) {
|
|
fs, m := startRenameManager(t)
|
|
m.SetTrusted(false)
|
|
m.SetDefaultAllow(false)
|
|
|
|
// "mover" may rename the source table but holds no rights on "dest".
|
|
srcPolicy, _ := json.Marshal(map[string]interface{}{
|
|
"Version": "2012-10-17",
|
|
"Statement": []map[string]interface{}{{
|
|
"Effect": "Allow",
|
|
"Principal": "mover",
|
|
"Action": "s3tables:RenameTable",
|
|
"Resource": "*",
|
|
}},
|
|
})
|
|
srcEntry := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
|
|
require.NotNil(t, srcEntry)
|
|
srcEntry.Extended[ExtendedKeyPolicy] = srcPolicy
|
|
|
|
destNsMeta, _ := json.Marshal(namespaceMetadata{Namespace: []string{"dest"}, OwnerAccountID: DefaultAccountID})
|
|
fs.Put(GetTableBucketPath(renameTestBucket), "dest", map[string][]byte{ExtendedKeyMetadata: destNsMeta})
|
|
|
|
mover := &testIdentity{Name: "mover", Account: &testIdentityAccount{Id: "mover"}}
|
|
ctx := s3_constants.SetIdentityInContext(context.Background(), mover)
|
|
err := m.Execute(ctx, NewManagerClient(fs.Client), "RenameTable", &RenameTableRequest{
|
|
TableBucketARN: mustBucketARN(t),
|
|
SourceNamespace: []string{"ns"},
|
|
SourceName: "t",
|
|
DestNamespace: []string{"dest"},
|
|
DestName: "t2",
|
|
}, nil, "mover")
|
|
require.Error(t, err)
|
|
var s3Err *S3TablesError
|
|
require.ErrorAs(t, err, &s3Err)
|
|
assert.Equal(t, ErrCodeNoSuchNamespace, s3Err.Type)
|
|
|
|
assert.NotNil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t"), "source must be untouched")
|
|
assert.Nil(t, fs.Get(GetNamespacePath(renameTestBucket, "dest"), "t2"), "destination must not be written")
|
|
}
|
|
|
|
func TestRenameTableInvalidName(t *testing.T) {
|
|
fs, m := startRenameManager(t)
|
|
err := runRename(t, m, fs, &RenameTableRequest{
|
|
TableBucketARN: mustBucketARN(t),
|
|
SourceNamespace: []string{"ns"},
|
|
SourceName: "t",
|
|
DestNamespace: []string{"ns"},
|
|
DestName: "Bad/Name",
|
|
})
|
|
require.Error(t, err)
|
|
var s3Err *S3TablesError
|
|
require.ErrorAs(t, err, &s3Err)
|
|
assert.Equal(t, ErrCodeInvalidRequest, s3Err.Type)
|
|
}
|
|
|
|
// A disabled maintenance configuration has to move with the table. Leaving it
|
|
// behind re-enables maintenance under the new name, and leaks the old settings
|
|
// onto whatever is created at the old one.
|
|
func TestRenameTableCarriesMaintenanceConfiguration(t *testing.T) {
|
|
fs, m := startRenameManager(t)
|
|
|
|
src := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
|
|
require.NotNil(t, src)
|
|
config := []byte(`{"icebergSnapshotManagement":{"status":"disabled"}}`)
|
|
status := []byte(`{"icebergCompaction":{"status":"Successful"}}`)
|
|
src.Extended[ExtendedKeyMaintenance] = config
|
|
src.Extended[ExtendedKeyMaintenanceStatus] = status
|
|
|
|
require.NoError(t, runRename(t, m, fs, &RenameTableRequest{
|
|
TableBucketARN: mustBucketARN(t),
|
|
SourceNamespace: []string{"ns"},
|
|
SourceName: "t",
|
|
DestNamespace: []string{"ns"},
|
|
DestName: "t2",
|
|
}))
|
|
|
|
dest := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t2")
|
|
require.NotNil(t, dest)
|
|
assert.Equal(t, config, dest.Extended[ExtendedKeyMaintenance], "the disable must move with the table")
|
|
assert.Equal(t, status, dest.Extended[ExtendedKeyMaintenanceStatus])
|
|
|
|
// And must not linger on the old name, where a reused name would inherit it.
|
|
moved := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
|
|
require.NotNil(t, moved)
|
|
_, hasConfig := moved.Extended[ExtendedKeyMaintenance]
|
|
assert.False(t, hasConfig, "source maintenance configuration must be cleared")
|
|
_, hasStatus := moved.Extended[ExtendedKeyMaintenanceStatus]
|
|
assert.False(t, hasStatus, "source maintenance status must be cleared")
|
|
}
|
|
|
|
// A maintenance configuration written after the rename copied the source must
|
|
// not be deleted by the source cleanup: it would vanish without ever reaching
|
|
// the destination.
|
|
func TestRenameTableRejectsConcurrentMaintenanceWrite(t *testing.T) {
|
|
fs, _ := startRenameManager(t)
|
|
|
|
src := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
|
|
require.NotNil(t, src)
|
|
copied := []byte(`{"icebergCompaction":{"status":"enabled"}}`)
|
|
src.Extended[ExtendedKeyMaintenance] = copied
|
|
|
|
// Stand in for the Put that lands between the copy and the cleanup.
|
|
landedLate := []byte(`{"icebergSnapshotManagement":{"status":"disabled"}}`)
|
|
expected := map[string][]byte{ExtendedKeyMaintenance: copied}
|
|
|
|
src.Extended[ExtendedKeyMaintenance] = landedLate
|
|
|
|
h := NewS3TablesHandler()
|
|
err := NewManagerClient(fs.Client).WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
|
|
return h.removeExtendedAttributesIf(context.Background(),
|
|
client, GetTablePath(renameTestBucket, "ns", "t"), expected, renamedTableAttributes...)
|
|
})
|
|
|
|
require.Error(t, err, "cleanup must refuse to delete a configuration written after the copy")
|
|
assert.ErrorIs(t, err, ErrConcurrentUpdate)
|
|
assert.Equal(t, landedLate, src.Extended[ExtendedKeyMaintenance], "the late write must survive")
|
|
}
|