mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-25 14:30:43 +01:00
Chris Lu
5ff49909a0
* fix(s3api/iam): fail config snapshot on empty or malformed IAM files A full IAM reload reads every identity/policy/service-account/group file from the filer. When an external secrets tool rewrites a file, a reload that reads it mid-rewrite sees empty or partially-written content. The identity, policy and service-account loaders silently skipped such files (``continue``), so the snapshot was missing entries that still existed on disk. The atomic swap then installed an incomplete identity set while ``isAuthEnabled`` stayed on, denying unrelated clients mid-reload (#11259). The group loader and the read-error paths already fail the snapshot in this situation (a skipped entry reads as deleted). Apply the same behavior to empty content and unmarshal failures across the identity, policy, service-account and group loaders, so a transient mid-rewrite fails the reload (preserving the last known-good state) instead of silently dropping entries. * fix(s3api/iam): coalesce burst IAM config reloads through the reload queue onIamConfigChange did a full synchronous reload for every identity/policy file change event. When several independently-refreshing credentials rewrite their files within the same second, that produced a burst of dozens of back-to-back full reloads, each reading the whole store and widening the window where a mid-rewrite file is observed (#11259). Route every IAM config change through the existing coalescing reload queue (scheduleReload/reloadRetryLoop) instead. A burst of N events now collapses into a single reload (plus one tail reload for events that arrived while one was in flight). scheduleReload gains a reason argument for the existing log line; the reloadRetryLoop already retries failed reloads, so the per-event failure handoff is no longer needed. Tests that asserted on the synchronous reload now wire up the queue (centralized in newTestS3ApiServerWithMemoryIAM) and poll via waitForIdentity/waitForIdentityGone. Adds TestOnIamConfigChangeCoalescesBurstReloads showing 50 events coalesce into <=3 reloads. * fix(s3api/iam): skip non-JSON auxiliary files before failing IAM snapshot Per review: the multi-file loaders unmarshal every entry in an IAM directory, so a non-JSON auxiliary file (README, .DS_Store, a migration backup such as identity.json.old) would hit the new empty/malformed errors and reject the whole snapshot, blocking all later IAM reloads. Only *.json files are IAM objects (SeaweedFS writes identities, policies, service accounts and groups as <name>.json, and other call sites already gate on the .json suffix). Skip non-.json entries at the top of each loader loop, before reading content, so auxiliary files are ignored while empty/malformed .json files still fail the snapshot. Adds TestLoadConfigurationIgnoresNonJsonAuxiliaryFiles. * fix(s3api/iam): reject IAM files with empty identifiers and skip aux in listing Per review: - ListPolicyNames listed every regular entry in the policies directory as a policy name, including non-JSON auxiliary files, but GetPolicy cannot retrieve them. Apply the same .json suffix filter used by the loader so the list only exposes retrievable policies. - json.Unmarshal accepts `{}` and unknown fields. The identity and group loaders merge by the decoded Name (not the file name), so a `{}` file could install an empty-key record and displace a real one; the service-account loader accepted an empty Id. Validate Identity.Name, Group.Name and ServiceAccount.Id (via validateServiceAccountId) after unmarshal and fail the snapshot on empty identifiers. Adds TestFilerEtcStoreListPolicyNamesSkipsNonJsonAuxiliary and empty-identifier regression tests for identity, group and service-account files.
145 lines
5.6 KiB
Go
145 lines
5.6 KiB
Go
package filer_etc
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/filer"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func putEntry(t *testing.T, server *policyTestFilerServer, dir, name string, content []byte) {
|
|
t.Helper()
|
|
_, err := server.CreateEntry(context.Background(), &filer_pb.CreateEntryRequest{
|
|
Directory: dir,
|
|
Entry: &filer_pb.Entry{Name: name, Content: content},
|
|
})
|
|
require.NoError(t, err)
|
|
}
|
|
|
|
// A mid-rewrite identity file (empty content, as seen while a secrets tool
|
|
// truncates and rewrites the file) must fail the snapshot instead of being
|
|
// silently dropped. Silently dropping it would make a full reload install an
|
|
// incomplete identity set and deny unrelated clients mid-reload.
|
|
func TestLoadConfigurationFailsOnEmptyIdentityFile(t *testing.T) {
|
|
ctx := context.Background()
|
|
store, server := newPolicyTestStoreWithServer(t)
|
|
|
|
identDir := filer.IamConfigDirectory + "/" + IamIdentitiesDirectory
|
|
putEntry(t, server, identDir, "alice.json", []byte(`{"name":"alice","credentials":[{"accessKey":"AK","secretKey":"SK"}]}`))
|
|
putEntry(t, server, identDir, "bob.json", []byte{}) // mid-rewrite: empty
|
|
|
|
_, err := store.LoadConfiguration(ctx)
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "bob.json")
|
|
}
|
|
|
|
// A malformed identity file (partial JSON from a mid-rewrite) must also fail
|
|
// the snapshot rather than being skipped.
|
|
func TestLoadConfigurationFailsOnMalformedIdentityFile(t *testing.T) {
|
|
ctx := context.Background()
|
|
store, server := newPolicyTestStoreWithServer(t)
|
|
|
|
identDir := filer.IamConfigDirectory + "/" + IamIdentitiesDirectory
|
|
putEntry(t, server, identDir, "alice.json", []byte(`{"name":"alice"}`))
|
|
putEntry(t, server, identDir, "bob.json", []byte(`{"name":"bob"`)) // truncated
|
|
|
|
_, err := store.LoadConfiguration(ctx)
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "bob.json")
|
|
}
|
|
|
|
// A mid-rewrite policy file must fail the snapshot rather than be dropped.
|
|
func TestLoadManagedPoliciesFailsOnEmptyPolicyFile(t *testing.T) {
|
|
ctx := context.Background()
|
|
store, server := newPolicyTestStoreWithServer(t)
|
|
|
|
polDir := filer.IamConfigDirectory + "/" + IamPoliciesDirectory
|
|
putEntry(t, server, polDir, "good.json", []byte(`{"Version":"2012-10-17","Statement":[]}`))
|
|
putEntry(t, server, polDir, "bad.json", []byte{}) // mid-rewrite: empty
|
|
|
|
_, err := store.LoadManagedPolicies(ctx)
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "bad.json")
|
|
}
|
|
|
|
// A non-JSON auxiliary file (README, .DS_Store, a migration backup) in an IAM
|
|
// directory must not fail the snapshot: only *.json files are IAM objects.
|
|
func TestLoadConfigurationIgnoresNonJsonAuxiliaryFiles(t *testing.T) {
|
|
ctx := context.Background()
|
|
store, server := newPolicyTestStoreWithServer(t)
|
|
|
|
identDir := filer.IamConfigDirectory + "/" + IamIdentitiesDirectory
|
|
putEntry(t, server, identDir, "alice.json", []byte(`{"name":"alice","credentials":[{"accessKey":"AK","secretKey":"SK"}]}`))
|
|
putEntry(t, server, identDir, "README.txt", []byte(`not an identity`))
|
|
putEntry(t, server, identDir, "alice.json.old", []byte(`{"name":"alice"}`))
|
|
|
|
polDir := filer.IamConfigDirectory + "/" + IamPoliciesDirectory
|
|
putEntry(t, server, polDir, "p.json", []byte(`{"Version":"2012-10-17","Statement":[]}`))
|
|
putEntry(t, server, polDir, "notes.md", []byte(`# policies`))
|
|
|
|
cfg, err := store.LoadConfiguration(ctx)
|
|
require.NoError(t, err)
|
|
require.Len(t, cfg.Identities, 1)
|
|
assert.Equal(t, "alice", cfg.Identities[0].Name)
|
|
}
|
|
|
|
// A valid JSON file with an empty name (e.g. `{}`) would unmarshal cleanly but
|
|
// install a garbage empty-key record that can displace a real one. Reject it.
|
|
func TestLoadConfigurationFailsOnEmptyIdentityName(t *testing.T) {
|
|
ctx := context.Background()
|
|
store, server := newPolicyTestStoreWithServer(t)
|
|
|
|
identDir := filer.IamConfigDirectory + "/" + IamIdentitiesDirectory
|
|
putEntry(t, server, identDir, "alice.json", []byte(`{"name":"alice"}`))
|
|
putEntry(t, server, identDir, "empty.json", []byte(`{}`))
|
|
|
|
_, err := store.LoadConfiguration(ctx)
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "empty.json")
|
|
}
|
|
|
|
func TestLoadConfigurationFailsOnEmptyGroupName(t *testing.T) {
|
|
ctx := context.Background()
|
|
store, server := newPolicyTestStoreWithServer(t)
|
|
|
|
groupDir := filer.IamConfigDirectory + "/" + IamGroupsDirectory
|
|
putEntry(t, server, groupDir, "empty.json", []byte(`{}`))
|
|
|
|
_, err := store.LoadConfiguration(ctx)
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "empty.json")
|
|
}
|
|
|
|
func TestLoadConfigurationFailsOnEmptyServiceAccountId(t *testing.T) {
|
|
ctx := context.Background()
|
|
store, server := newPolicyTestStoreWithServer(t)
|
|
|
|
saDir := filer.IamConfigDirectory + "/" + IamServiceAccountsDirectory
|
|
putEntry(t, server, saDir, "empty.json", []byte(`{}`))
|
|
|
|
_, err := store.LoadConfiguration(ctx)
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "empty.json")
|
|
}
|
|
|
|
// A valid full snapshot loads without error (regression guard).
|
|
func TestLoadConfigurationSucceedsOnValidFiles(t *testing.T) {
|
|
ctx := context.Background()
|
|
store, server := newPolicyTestStoreWithServer(t)
|
|
|
|
identDir := filer.IamConfigDirectory + "/" + IamIdentitiesDirectory
|
|
putEntry(t, server, identDir, "alice.json", []byte(`{"name":"alice","credentials":[{"accessKey":"AK","secretKey":"SK"}]}`))
|
|
putEntry(t, server, identDir, "bob.json", []byte(`{"name":"bob","credentials":[{"accessKey":"BK","secretKey":"SK"}]}`))
|
|
|
|
cfg, err := store.LoadConfiguration(ctx)
|
|
require.NoError(t, err)
|
|
names := make([]string, 0, len(cfg.Identities))
|
|
for _, id := range cfg.Identities {
|
|
names = append(names, id.Name)
|
|
}
|
|
assert.ElementsMatch(t, []string{"alice", "bob"}, names)
|
|
}
|