mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-27 07:20:44 +01:00
* filer: format ChunkView without its cipher key readChunkSliceAt logs a failed chunk fetch with %+v, which printed the per-chunk AES-256-GCM key into error-level logs on every failed read. Give ChunkView a String() that omits CipherKey so %v and %+v stay safe. * pb: scrub cipher keys when an entry must be logged whole ScrubCipherKeys clones an Entry with chunk CipherKey fields cleared, so a warning that needs the full entry still cannot leak the keys. * log entry identifiers instead of whole metadata messages Several log lines formatted whole protobuf messages — SubscribeMetadataResponse, EventNotification, Entry-carrying requests — whose chunks include cipher_key under -encryptVolumeData, so the keys escaped into logs (some at default verbosity). Log the directory, entry name and event timestamp instead; where a chunk list was printed, print file ids via FileIdsString. * log queue: unwrap SubscribeMetadataResponse and never print raw protos The fallback printed any message with %+v, so a SubscribeMetadataResponse carrying entries would still put cipher keys in the log. Unwrap its event notifications (batched events included) and reduce unknown messages to their type name. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * remote sync logs: name the event's real path Rename targets logged under resp.Directory while the entry lives under NewParentPath; route them through MetadataEventTargetDirectory. Sync failure logs printed only the directory, so same-dir failures shared an identifier — log the source and destination paths instead. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * log queue: log the entry's destination path on moves A cross-directory rename printed "file" -> "file" under the source path, hiding where the entry landed. Use NewParentPath so the log shows the destination directory next to the new name. * admin: install the go.mod-pinned templ, not @latest install-templ fetched templ@latest, which now emits templruntime.NewAttributeExpression - a symbol absent from the runtime pinned in go.mod - so every fresh 'make' regenerated uncompilable _templ.go files. Install the go.mod version and reinstall when the binary on PATH reports a different one. * admin: drop stray Makefile change belonging to the templ pin PR Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * notification: join the move destination path in log queue output A NewParentPath of "/" printed //name for moves into the root; path.Join keeps a single leading slash. * log queue: skip a nil event notification instead of logging an empty move Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * pb: tolerate nil chunk entries while scrubbing cipher keys for logs Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * subscription and backup failure logs name the event's file The process/marshal failure logs printed only the event directory and timestamp, so a failed sync left operators guessing which file failed. Use MetadataEventSourceFullPath/MetadataEventTargetFullPath so each failure names the source and target paths without printing the entries. * replication: identify entry-less events without printing the proto Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * s3: scrub cipher keys from the bucket-metadata debug dump buildBucketMetadata marshals the whole filer entry to JSON for a V(3) log line; a chunked entry would emit each chunk's cipher_key base64. Marshal the scrubbed copy instead. --------- Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
188 lines
6.4 KiB
Go
188 lines
6.4 KiB
Go
package replication
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/filer"
|
|
"github.com/seaweedfs/seaweedfs/weed/glog"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
|
|
"github.com/seaweedfs/seaweedfs/weed/replication/repl_util"
|
|
"github.com/seaweedfs/seaweedfs/weed/replication/sink"
|
|
"github.com/seaweedfs/seaweedfs/weed/replication/source"
|
|
"github.com/seaweedfs/seaweedfs/weed/util"
|
|
"google.golang.org/grpc"
|
|
)
|
|
|
|
type Replicator struct {
|
|
sink sink.ReplicationSink
|
|
source *source.FilerSource
|
|
excludeDirs []string
|
|
}
|
|
|
|
func NewReplicator(sourceConfig util.Configuration, configPrefix string, dataSink sink.ReplicationSink) *Replicator {
|
|
|
|
source := &source.FilerSource{}
|
|
source.Initialize(sourceConfig, configPrefix)
|
|
|
|
if err := repl_util.InitializeSSEForReplication(source); err != nil {
|
|
glog.Warningf("SSE initialization failed: %v (encrypted objects may fail to replicate)", err)
|
|
}
|
|
|
|
dataSink.SetSourceFiler(source)
|
|
|
|
return &Replicator{
|
|
sink: dataSink,
|
|
source: source,
|
|
excludeDirs: sourceConfig.GetStringSlice(configPrefix + "excludeDirectories"),
|
|
}
|
|
}
|
|
|
|
func (r *Replicator) Replicate(ctx context.Context, key string, message *filer_pb.EventNotification) error {
|
|
if message.IsFromOtherCluster && r.sink.GetName() == "filer" {
|
|
return nil
|
|
}
|
|
|
|
oldEntry := message.OldEntry
|
|
newEntry := message.NewEntry
|
|
newParentPath := message.NewParentPath
|
|
|
|
oldInSource := util.IsEqualOrUnder(key, r.source.Dir) && !r.isExcluded(key)
|
|
|
|
// For rename events (both old and new entry present), check both paths
|
|
// against the source directory. Convert cross-boundary renames to
|
|
// create or delete so the sink stays consistent.
|
|
if oldEntry != nil && newEntry != nil {
|
|
newFullPath, targetParent := metadataEventTarget(key, newEntry, newParentPath)
|
|
newInSource := util.IsEqualOrUnder(newFullPath, r.source.Dir) && !r.isExcluded(newFullPath)
|
|
|
|
if !oldInSource && !newInSource {
|
|
return nil
|
|
}
|
|
if !oldInSource {
|
|
// Rename into watched directory: treat as create
|
|
oldEntry = nil
|
|
key = newFullPath
|
|
newParentPath = targetParent
|
|
} else if !newInSource {
|
|
// Rename out of watched directory: treat as delete
|
|
newEntry = nil
|
|
newParentPath = ""
|
|
}
|
|
} else if !oldInSource {
|
|
glog.V(4).Infof("skipping %v outside of %v", key, r.source.Dir)
|
|
return nil
|
|
}
|
|
|
|
var dateKey string
|
|
if r.sink.IsIncremental() {
|
|
var mTime int64
|
|
if newEntry != nil {
|
|
mTime = newEntry.Attributes.Mtime
|
|
} else if oldEntry != nil {
|
|
mTime = oldEntry.Attributes.Mtime
|
|
}
|
|
dateKey = time.Unix(mTime, 0).Format("2006-01-02")
|
|
}
|
|
oldSinkKey := r.sourceToSinkKey(key, dateKey)
|
|
glog.V(3).Infof("replicate %s => %s", key, oldSinkKey)
|
|
|
|
newSinkKey := oldSinkKey
|
|
newSinkParentPath := newParentPath
|
|
if oldEntry != nil && newEntry != nil {
|
|
targetSourceKey, targetSourceParent := metadataEventTarget(key, newEntry, newParentPath)
|
|
newSinkKey = r.sourceToSinkKey(targetSourceKey, dateKey)
|
|
newSinkParentPath = r.sourceToSinkPath(targetSourceParent, dateKey)
|
|
} else if newParentPath != "" && util.IsEqualOrUnder(newParentPath, r.source.Dir) {
|
|
newSinkParentPath = r.sourceToSinkPath(newParentPath, dateKey)
|
|
}
|
|
|
|
if oldEntry != nil && newEntry == nil {
|
|
glog.V(4).Infof("deleting %v", oldSinkKey)
|
|
return sink.DeleteEntry(r.sink, oldSinkKey, oldEntry.IsDirectory, message.DeleteChunks, filer.IsMetadataOnlyDelete(oldEntry), message.Signatures)
|
|
}
|
|
if oldEntry == nil && newEntry != nil {
|
|
glog.V(4).Infof("creating %v", oldSinkKey)
|
|
return r.sink.CreateEntry(oldSinkKey, newEntry, message.Signatures)
|
|
}
|
|
if oldEntry == nil && newEntry == nil {
|
|
glog.V(0).Infof("weird message %v: no old or new entry", key)
|
|
return nil
|
|
}
|
|
|
|
if oldSinkKey != newSinkKey {
|
|
// A real move: the path changed. UpdateEntry cannot move an entry.
|
|
if mover, ok := r.sink.(sink.EntryMover); ok {
|
|
glog.V(4).Infof("moving %v => %v", oldSinkKey, newSinkKey)
|
|
return mover.MoveEntry(oldSinkKey, newSinkKey, newEntry, message.Signatures)
|
|
}
|
|
// Sinks without a native move: create at the new key first, then delete the
|
|
// old, so a crash between the two leaves the entry visible under both names
|
|
// rather than gone.
|
|
glog.V(4).Infof("creating renamed %v", newSinkKey)
|
|
if err := r.sink.CreateEntry(newSinkKey, newEntry, message.Signatures); err != nil {
|
|
return fmt.Errorf("create renamed entry %v: %w", newSinkKey, err)
|
|
}
|
|
return r.sink.DeleteEntry(oldSinkKey, oldEntry.IsDirectory, false, message.Signatures)
|
|
}
|
|
|
|
// oldSinkKey == newSinkKey: pure in-place update (same path, content/attrs changed).
|
|
foundExisting, err := r.sink.UpdateEntry(oldSinkKey, oldEntry, newSinkParentPath, newEntry, message.DeleteChunks, message.Signatures)
|
|
if foundExisting {
|
|
glog.V(4).Infof("updated %v", oldSinkKey)
|
|
return err
|
|
}
|
|
err = r.sink.DeleteEntry(oldSinkKey, oldEntry.IsDirectory, false, message.Signatures)
|
|
if err != nil {
|
|
return fmt.Errorf("delete old entry %v: %w", oldSinkKey, err)
|
|
}
|
|
glog.V(4).Infof("creating missing %v", newSinkKey)
|
|
return r.sink.CreateEntry(newSinkKey, newEntry, message.Signatures)
|
|
}
|
|
|
|
func (r *Replicator) isExcluded(path string) bool {
|
|
for _, excludeDir := range r.excludeDirs {
|
|
if util.IsEqualOrUnder(path, excludeDir) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func (r *Replicator) sourceToSinkKey(sourceKey, dateKey string) string {
|
|
return util.Join(r.sink.GetSinkToDirectory(), dateKey, sourceKey[len(r.source.Dir):])
|
|
}
|
|
|
|
func (r *Replicator) sourceToSinkPath(sourcePath, dateKey string) string {
|
|
return util.Join(r.sink.GetSinkToDirectory(), dateKey, sourcePath[len(r.source.Dir):])
|
|
}
|
|
|
|
func metadataEventTarget(key string, newEntry *filer_pb.Entry, newParentPath string) (targetKey, targetParent string) {
|
|
if newEntry == nil {
|
|
return "", ""
|
|
}
|
|
|
|
targetParent = newParentPath
|
|
if targetParent == "" {
|
|
targetParent, _ = util.FullPath(key).DirAndName()
|
|
}
|
|
|
|
return util.Join(targetParent, newEntry.Name), targetParent
|
|
}
|
|
|
|
func ReadFilerSignature(grpcDialOption grpc.DialOption, filer pb.ServerAddress) (filerSignature int32, readErr error) {
|
|
if readErr = pb.WithFilerClient(false, 0, filer, grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
|
|
if resp, err := client.GetFilerConfiguration(context.Background(), &filer_pb.GetFilerConfigurationRequest{}); err != nil {
|
|
return fmt.Errorf("GetFilerConfiguration %s: %v", filer, err)
|
|
} else {
|
|
filerSignature = resp.Signature
|
|
}
|
|
return nil
|
|
}); readErr != nil {
|
|
return 0, readErr
|
|
}
|
|
return filerSignature, nil
|
|
}
|