mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-17 03:50:51 +02:00
Chris Lu
02749c1192
* s3api: add TrustedProxies allowlist helper for aws:SourceIp extraction Introduces a policy_engine.TrustedProxies type that parses a comma-separated list of bare IPs and CIDRs (mirroring Guard.UpdateWhiteList) and extracts the client IP for aws:SourceIp condition evaluation. When the direct TCP peer is in the allowlist, X-Forwarded-For is walked right-to-left skipping trusted hops (then X-Real-Ip); otherwise the direct peer address is returned. This is the building block for restoring configurable forwarded-header trust removed inb88156f(#11231), as proposed in #11302. * s3api: honor trusted-proxy allowlist in bucket/IAM policy engine Make ExtractConditionValuesFromRequest a method on *PolicyEngine so it can use the engine TrustedProxies when resolving aws:SourceIp. With no allowlist configured the behavior is unchanged fromb88156f: the direct TCP peer is used and forwarded headers are ignored. When an allowlist is configured via SetTrustedProxies, requests from a trusted peer honor X-Forwarded-For (right-to-left) then X-Real-Ip. Update the two call sites (auth_credentials.go, s3api_bucket_policy_engine.go) and the engine tests to the method form, and add a regression test for the trusted-proxy path. * s3api: honor trusted-proxy allowlist in IAM role/session policies Make extractRequestContext and extractSourceIP methods on *S3IAMIntegration so they can use the integration TrustedProxies when resolving aws:SourceIp. With no allowlist configured the behavior is unchanged fromb88156f: the direct TCP peer is used and forwarded headers are ignored. When an allowlist is configured via SetTrustedProxies, requests from a trusted peer honor X-Forwarded-For (right-to-left) then X-Real-Ip. Update the call site in isActionExplicitlyDeniedByIAM to type-assert the integration and use the method, and add a regression test for the trusted-proxy path. * s3api: load [s3.trusted_proxies] from security.toml and wire to engines Read s3.trusted_proxies.white_list (comma-separated IPs/CIDRs) from security.toml and propagate the allowlist to the bucket policy engine, the IAM policy engine (persisted across rebuilds via IdentityAccessManagement.SetTrustedProxies), and the IAM integration. Reloaded on SIGHUP alongside the JWT signing keys. Document the new section in the scaffold security.toml. Closes #11302. * s3api: harden TrustedProxies parsing and X-Forwarded-For traversal Canonicalize bare IP entries (via net.ParseIP + String) so non-canonical IPv6 allowlist entries such as 2001:0db8::1 match peers rendered as 2001:db8::1, and log+skip unparseable bare entries instead of storing them inertly. When walking X-Forwarded-For right-to-left, stop at the first malformed (non-empty, unparseable) entry instead of skipping it, and only fall back to the leftmost valid IP when the chain was well-formed. This prevents a malformed hop from masking a forged IP to its left. Addresses review feedback on #11315. * s3api: make TrustedProxies reload race-free via atomic.Pointer Store the trusted-proxy allowlist behind sync/atomic.Pointer in PolicyEngine and S3IAMIntegration so SIGHUP reloads (which swap the allowlist) cannot race with concurrent request handlers reading it. This mirrors the existing Guard guardState pattern. The IdentityAccessManagement copy is already protected by iam.m. Addresses review feedback on #11315.