Files
seaweedfs/weed/util/net_timeout.go
T
Chris LuandDevin 88b91cccba command: no extra localhost listener when -ip.bind is specified (#12055)
* util: add listenOnLocalhost parameter to NewIpAndLocalListeners

Nil keeps the current behavior of also binding localhost when the host
is a specific address; all callers pass nil for now.

* command: add -ip.bind.localhost flag to opt out of the extra localhost listener

Binding a command to a specific -ip.bind address also opened a second
listener on localhost for every port, with no way to turn it off. Each
command that calls NewIpAndLocalListeners (master, master.follower,
filer, s3, iam, volume, sftp, mq.broker, mq.agent) now accepts
-ip.bind.localhost=false to bind only the requested address. Embedded
services get prefixed flags (s3.ip.bind.localhost, sftp.ip.bind.localhost,
iam.ip.bind.localhost), and the command-level flag also disables them so
a single switch turns off every extra listener the command opens.

* mini: only require all-interface port availability while the loopback listener is on

With -ip.bind.localhost=false each service binds just -ip.bind, so a port
held on another address no longer collides; the all-interface precheck
would reject or relocate usable ports. WebDAV, the Admin UI, and the
Admin worker gRPC (which binds -admin.worker.ip, not -ip.bind) never open
a loopback companion listener, so their checks now use the address they
actually bind.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* mq.broker: bind the gRPC listener to -ip.bind instead of all interfaces

The listener used an empty host so -ip was ignored for binding and the
localhost companion was never created, leaving -ip.bind.localhost with
nothing to control. Give the broker the same -ip/-ip.bind pair the other
servers use; embedded mode binds to -ip.bind like its peers.

* server: add -sftp.ip.bind.localhost and -iam.ip.bind.localhost switches

weed filer already exposes the prefixed opt-outs for its embedded sftp
and iam; give weed server the same pair so each extra listener can be
disabled individually while -ip.bind.localhost=false still turns them
all off.

* mq.broker: keep the default all-interface bind unless localhost is off

An unset -ip.bind used to mean the standalone broker listened on every
interface; defaulting it to -ip silently cut off multi-homed clients. Only
fall back to -ip when -ip.bind.localhost=false, where a specific bind is
needed for the opt-out to take effect.

* mini: validate the Admin HTTP port on the address it will bind

The port check always used -ip.bind while startMiniAdminWithWorker falls
back to loopback when Admin has no credential, so a loopback-held port
passed validation and killed the admin at startup.

* mq.broker: keep the all-interface default bind when -ip.bind is unset

-ip only becomes the fallback once -ip.bind.localhost=false needs a
specific address for the listener.

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* mini: validate the Admin HTTP port on its effective bind IP

When the Admin listener falls back to loopback (no credential or mTLS
configured), the pre-flight port check now probes that same address
instead of -ip.bind.

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* util: keep NewIpAndLocalListeners source-compatible for 3-arg callers

* command: drop the -ip.bind.localhost flag; an explicit -ip.bind drops the extra listener

Instead of an opt-out flag, the loopback companion listener now simply
follows whether the bind address was chosen: it is created only while
-ip.bind is unset and the bind address falls back to -ip. Passing
-ip.bind=<addr> binds each port to exactly that address.

Each service options struct carries a listenOnLocalhost *bool that
embedders (weed server, weed mini, embedded s3/sftp/iam in weed filer)
set from the parent's -ip.bind state, captured before the bind flag is
repointed or filled in by the -ip fallback; standalone commands derive
it from their own flag before the fallback runs.

iam and mq.agent gain a real -ip.bind flag so they have a way to pin a
single address. mq.broker keeps its new -ip.bind flag but drops the
-ip.bind.localhost fallback hack: empty still listens on all interfaces.

* server: default embedded mq.agent brokers to the broker's bind address

With an explicit -ip.bind the embedded broker no longer listens on
localhost, so an unset -mq.agent.brokers defaulting to localhost:17777
could not reach it. Default to <serverBindIp>:<mq.broker.port> (the
address the embedded broker binds), falling back to localhost when the
bind address is a wildcard. An explicit -mq.agent.brokers still wins.

Also fix the NewIpAndLocalListeners skip message to say localhost.

* server: bind embedded mq.agent to serverBindIp

The embedded agent's ipBind was never set, so startQueueAgent fell back
to the advertised -ip address and an explicit -ip.bind did not pin the
agent listener.

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-25 06:52:16 -07:00

199 lines
5.4 KiB
Go

package util
import (
"net"
"sync"
"time"
"github.com/seaweedfs/seaweedfs/weed/glog"
"github.com/seaweedfs/seaweedfs/weed/stats"
)
// Listener wraps a net.Listener, and gives a place to store the timeout
// parameters. On Accept, it will wrap the net.Conn with our own Conn for us.
type Listener struct {
net.Listener
Timeout time.Duration
}
func (l *Listener) Accept() (net.Conn, error) {
c, err := l.Listener.Accept()
if err != nil {
return nil, err
}
stats.ConnectionOpen()
tc := &Conn{
Conn: c,
Timeout: l.Timeout,
}
return tc, nil
}
// Conn wraps a net.Conn and implements a "no activity timeout".
// Any activity (read or write) resets the deadline, so the connection
// only times out when there's no activity in either direction.
//
// Callers may also set deadlines directly — net/http's server does this
// to interrupt a blocked read (abortPendingRead sets a deadline in the
// past) and to enforce its own Read/Write timeouts. The activity
// extension must never overwrite such an externally-set deadline, or the
// interrupt is lost and the read stays blocked until the activity
// timeout fires (wedging connection drain on shutdown for up to the full
// idle timeout). mu serializes deadline updates, and while an external
// deadline is in force on a direction the activity extension for that
// direction is suspended; it resumes once the caller clears the deadline
// (sets the zero time).
type Conn struct {
net.Conn
Timeout time.Duration
isClosed bool
mu sync.Mutex
externalReadDeadline bool
externalWriteDeadline bool
}
func (c *Conn) SetDeadline(t time.Time) error {
c.mu.Lock()
defer c.mu.Unlock()
c.externalReadDeadline = !t.IsZero()
c.externalWriteDeadline = !t.IsZero()
return c.Conn.SetDeadline(t)
}
func (c *Conn) SetReadDeadline(t time.Time) error {
c.mu.Lock()
defer c.mu.Unlock()
c.externalReadDeadline = !t.IsZero()
return c.Conn.SetReadDeadline(t)
}
func (c *Conn) SetWriteDeadline(t time.Time) error {
c.mu.Lock()
defer c.mu.Unlock()
c.externalWriteDeadline = !t.IsZero()
return c.Conn.SetWriteDeadline(t)
}
// extendDeadline extends the connection deadline from now.
// This implements "no activity timeout" - any activity keeps the
// connection alive in both directions (a long write-only response must
// keep the read deadline alive too, or net/http's background read would
// time out and cancel the in-flight request). Each direction is extended
// independently: an externally-managed deadline on one side (e.g. a
// server WriteTimeout) must not leave the other side's deadline stale.
func (c *Conn) extendDeadline() error {
c.mu.Lock()
defer c.mu.Unlock()
if c.Timeout <= 0 {
return nil
}
if !c.externalReadDeadline && !c.externalWriteDeadline {
return c.Conn.SetDeadline(time.Now().Add(c.Timeout))
}
if !c.externalReadDeadline {
if err := c.Conn.SetReadDeadline(time.Now().Add(c.Timeout)); err != nil {
return err
}
}
if !c.externalWriteDeadline {
if err := c.Conn.SetWriteDeadline(time.Now().Add(c.Timeout)); err != nil {
return err
}
}
return nil
}
func (c *Conn) Read(b []byte) (count int, e error) {
// Extend deadline before reading - any activity keeps connection alive
if err := c.extendDeadline(); err != nil {
return 0, err
}
count, e = c.Conn.Read(b)
if e == nil {
stats.BytesIn(int64(count))
}
return
}
func (c *Conn) Write(b []byte) (count int, e error) {
// Extend deadline before writing - any activity keeps connection alive
if err := c.extendDeadline(); err != nil {
return 0, err
}
count, e = c.Conn.Write(b)
if e == nil {
stats.BytesOut(int64(count))
}
return
}
func (c *Conn) Close() error {
err := c.Conn.Close()
if err == nil {
if !c.isClosed {
stats.ConnectionClose()
c.isClosed = true
}
}
return err
}
func NewListener(addr string, timeout time.Duration) (ipListener net.Listener, err error) {
listener, err := net.Listen("tcp", addr)
if err != nil {
return
}
ipListener = &Listener{
Listener: listener,
Timeout: timeout,
}
return
}
// IsLoopbackOrWildcardAddress reports whether host already covers loopback
// traffic — empty (all interfaces), a wildcard address, or a loopback address —
// in which case a separate localhost listener is unnecessary.
func IsLoopbackOrWildcardAddress(host string) bool {
switch host {
case "", "localhost", "0.0.0.0", "127.0.0.1", "[::]", "[::1]":
return true
}
return false
}
// NewIpAndLocalListeners binds host:port and, unless listenOnLocalhost is given
// as false, a second listener on localhost:port so that local clients still
// reach the service when it binds a specific address. Callers pass false when
// the user explicitly chose the bind address (e.g. -ip.bind), honoring exactly
// that address.
func NewIpAndLocalListeners(host string, port int, timeout time.Duration, listenOnLocalhost ...bool) (ipListener net.Listener, localListener net.Listener, err error) {
listener, err := net.Listen("tcp", JoinHostPort(host, port))
if err != nil {
return
}
ipListener = &Listener{
Listener: listener,
Timeout: timeout,
}
if (len(listenOnLocalhost) == 0 || listenOnLocalhost[0]) && !IsLoopbackOrWildcardAddress(host) {
listener, err = net.Listen("tcp", JoinHostPort("localhost", port))
if err != nil {
glog.V(0).Infof("skip starting localhost listener on :%d: %v", port, err)
return ipListener, nil, nil
}
localListener = &Listener{
Listener: listener,
Timeout: timeout,
}
}
return
}