mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-16 03:20:50 +02:00
* fix(mount): sanitize non-UTF-8 filenames; keep marshal errors per-request (#9139) A single file with invalid-UTF-8 bytes in its name (e.g. a GNOME Trash "partial" like \x10\x98=\\\x8a\x7f.trashinfo.9a51454f.partial) made every FUSE-initiated filer RPC fail with: rpc error: code = Internal desc = grpc: error while marshaling: string field contains invalid UTF-8 and then produced an avalanche of "connection is closing" errors on unrelated LookupEntry / ReadDirAll / UpdateEntry calls, causing the volume-server QPS dips reported in #9139. Root cause is twofold: 1. Proto3 `string` fields require valid UTF-8, but the FUSE kernel passes raw name bytes. Create/Mknod/Mkdir/Unlink/Rmdir/Rename/Lookup/Link/ Symlink all forwarded those bytes directly into CreateEntryRequest.Name, DeleteEntryRequest.Name, StreamRenameEntryRequest.{Old,New}Name and Entry.Name. saveDataAsChunk also copied the FullPath into AssignVolumeRequest.Path unchecked. 2. When the marshal failed, shouldInvalidateConnection treated the resulting codes.Internal as a connection problem and dropped the shared cached ClientConn — canceling every other in-flight RPC on it. Fix: - Add sanitizeFuseName (strings.ToValidUTF8 with '?' replacement, matching util.FullPath.DirAndName) and make checkName return the sanitized name. Apply at every FUSE entry point that passes a name to the filer RPC, including Unlink/Rmdir (which did not previously call checkName) and both oldName/newName in Rename. Add a backstop scrub for AssignVolumeRequest.Path so async flush paths cannot reintroduce invalid bytes from a pre-sanitization cached FullPath. - In weed/pb.shouldInvalidateConnection, detect client-side marshal errors via the gRPC library's "error while marshaling" prefix and return false: the connection is healthy, only the request is bad. Refs: https://github.com/seaweedfs/seaweedfs/issues/9139#issuecomment-4301184231 * fix(mount,util): use '_' for invalid-UTF-8 replacement (URL-safe) Sanitized filenames flow downstream into HTTP URLs (volume-server uploads, filer HTTP API, S3/WebDAV gateways). '?' is the URL query-string delimiter and would split the path the first time the name lands in one, so swap every invalid-UTF-8 replacement to '_'. This covers the two pre-existing sites in weed/util/fullpath.go as well, keeping all paths sanitized the same way. * refactor(pb): detect client-side marshal errors via errors.As, not substring Replace the raw `strings.Contains(err.Error(), ...)` check with a type-based carve-out: use errors.As against the `GRPCStatus() *Status` interface to pull the original Status out of any fmt.Errorf("...: %w") wrapping, then match the library-owned "grpc:" prefix on that Status's Message. Why not errors.Is against a proto-level sentinel: gRPC's encode() collapses the inner proto error with "%v" (stringification) before wrapping it in a Status, so the original error type does not survive into the caller. The Status itself is the structural signal that does survive. Why not status.FromError: when the caller wraps the Status error with fmt.Errorf("...: %w", ...), status.FromError rewrites Status.Message with the full err.Error() of the outermost wrapper, which defeats a prefix check on the library-owned message. errors.As gives us the original Status whose Message is still verbatim from the gRPC library. A new test asserts that a plain errors.New("grpc: error while marshaling: …") — i.e. the same text attached to something that is NOT a gRPC status — does not short-circuit invalidation, so we never silently keep a cached connection alive based on a coincidental substring match. * refactor(util): centralize UTF-8 sanitization; add FullPath.Sanitized Addresses review feedback on PR #9207. Nitpick: every invalid-UTF-8 replacement across the codebase (DirAndName, Name, mount.sanitizeFuseName, the weedfs_write.go backstop) now goes through a single util.SanitizeUTF8Name helper, so the replacement char ('_' — URL-safe) is chosen in one place. Outside-diff: three proto fields took raw FullPath strings that could break marshaling if an entry ever carried invalid UTF-8 (CreateEntryRequest.Directory in Mkdir, DeleteEntryRequest.Directory in Unlink, AssignVolumeRequest.Path in command_fs_merge_volumes). The reviewer's suggested fix — using DirAndName() — would have silently changed Directory from parent to grandparent, because DirAndName sanitizes only the trailing component. Added FullPath.Sanitized(), which scrubs every component, and applied it at the three sites. Exposure is narrow in practice (FUSE-boundary sanitization and the gRPC-side isClientSideMarshalError carve-out already cover the #9139 cascade), but the defense-in-depth is cheap and consistent with the existing AssignVolume backstop. New tests in weed/util/fullpath_test.go document: - SanitizeUTF8Name: valid UTF-8 passes through unchanged; invalid bytes become '_' (not '?', which is URL-special). - FullPath.Sanitized: scrubs bytes in any component, not just the last. - FullPath.DirAndName: dir remains raw on purpose — callers needing a clean full path must use Sanitized(). The test pins this behavior so it is not accidentally "fixed" in a way that changes the (dir, name) semantics callers depend on.
241 lines
8.4 KiB
Go
241 lines
8.4 KiB
Go
package mount
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"syscall"
|
|
"time"
|
|
|
|
"github.com/seaweedfs/go-fuse/v2/fuse"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/filer"
|
|
"github.com/seaweedfs/seaweedfs/weed/glog"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
|
|
"github.com/seaweedfs/seaweedfs/weed/util"
|
|
)
|
|
|
|
/*
|
|
What is an inode?
|
|
If the file is an hardlinked file:
|
|
use the hardlink id as inode
|
|
Otherwise:
|
|
use the file path as inode
|
|
|
|
When creating a link:
|
|
use the original file inode
|
|
*/
|
|
|
|
/** Create a hard link to a file */
|
|
func (wfs *WFS) Link(cancel <-chan struct{}, in *fuse.LinkIn, name string, out *fuse.EntryOut) (code fuse.Status) {
|
|
if wfs.IsOverQuotaWithUncommitted() {
|
|
return fuse.Status(syscall.ENOSPC)
|
|
}
|
|
|
|
var s fuse.Status
|
|
if name, s = checkName(name); s != fuse.OK {
|
|
return s
|
|
}
|
|
|
|
newParentPath, code := wfs.inodeToPath.GetPath(in.NodeId)
|
|
if code != fuse.OK {
|
|
return
|
|
}
|
|
oldEntryPath, code := wfs.inodeToPath.GetPath(in.Oldnodeid)
|
|
if code != fuse.OK {
|
|
return
|
|
}
|
|
oldParentPath, _ := oldEntryPath.DirAndName()
|
|
|
|
oldEntry, status := wfs.maybeLoadEntry(oldEntryPath)
|
|
if status != fuse.OK {
|
|
return status
|
|
}
|
|
|
|
// hardlink is not allowed in WORM mode
|
|
if wormEnforced, _ := wfs.wormEnforcedForEntry(oldEntryPath, oldEntry); wormEnforced {
|
|
return fuse.EPERM
|
|
}
|
|
|
|
// If the source is already a hard link, serialize on its HardLinkId
|
|
// so concurrent Link/Unlink operations on different siblings cannot
|
|
// both compute a new counter from a stale base. Re-load the entry
|
|
// under the lock to pick up any prior holder's sibling update.
|
|
if len(oldEntry.HardLinkId) > 0 {
|
|
hlKey := string(oldEntry.HardLinkId)
|
|
lock := wfs.hardLinkLockTable.AcquireLock("link", hlKey, util.ExclusiveLock)
|
|
defer wfs.hardLinkLockTable.ReleaseLock(hlKey, lock)
|
|
// Under the lock, re-resolve the source alias from the inode.
|
|
// A concurrent Unlink that held this same lock may have removed
|
|
// the specific alias we picked pre-lock even though other
|
|
// sibling hard links for the same inode are still around;
|
|
// GetPath(Oldnodeid) returns whichever alias is still active.
|
|
refreshedPath, refreshedStatus := wfs.inodeToPath.GetPath(in.Oldnodeid)
|
|
if refreshedStatus != fuse.OK {
|
|
return refreshedStatus
|
|
}
|
|
oldEntryPath = refreshedPath
|
|
oldParentPath, _ = oldEntryPath.DirAndName()
|
|
// Do not fall back to the pre-lock snapshot: if every alias
|
|
// was deleted while we waited, abort instead of deriving the
|
|
// next counter from a stale entry.
|
|
fresh, freshStatus := wfs.maybeLoadEntry(oldEntryPath)
|
|
if freshStatus != fuse.OK {
|
|
return freshStatus
|
|
}
|
|
oldEntry = fresh
|
|
}
|
|
|
|
// update old file to hardlink mode
|
|
origHardLinkId := oldEntry.HardLinkId
|
|
origHardLinkCounter := oldEntry.HardLinkCounter
|
|
if len(oldEntry.HardLinkId) == 0 {
|
|
oldEntry.HardLinkId = filer.NewHardLinkId()
|
|
oldEntry.HardLinkCounter = 1
|
|
glog.V(4).Infof("Link: new HardLinkId %x for %s", oldEntry.HardLinkId, oldEntryPath)
|
|
}
|
|
oldEntry.HardLinkCounter++
|
|
glog.V(4).Infof("Link: %s -> %s/%s HardLinkId %x counter=%d",
|
|
oldEntryPath, newParentPath, name, oldEntry.HardLinkId, oldEntry.HardLinkCounter)
|
|
updateOldEntryRequest := &filer_pb.UpdateEntryRequest{
|
|
Directory: oldParentPath,
|
|
Entry: oldEntry,
|
|
Signatures: []int32{wfs.signature},
|
|
}
|
|
|
|
// CreateLink 1.2 : update new file to hardlink mode
|
|
linkNow := time.Now()
|
|
oldEntry.Attributes.Mtime = linkNow.Unix()
|
|
oldEntry.Attributes.MtimeNs = int32(linkNow.Nanosecond())
|
|
oldEntry.Attributes.Ctime = linkNow.Unix()
|
|
oldEntry.Attributes.CtimeNs = int32(linkNow.Nanosecond())
|
|
request := &filer_pb.CreateEntryRequest{
|
|
Directory: string(newParentPath),
|
|
Entry: &filer_pb.Entry{
|
|
Name: name,
|
|
IsDirectory: false,
|
|
Attributes: oldEntry.Attributes,
|
|
Chunks: oldEntry.GetChunks(),
|
|
Extended: oldEntry.Extended,
|
|
HardLinkId: oldEntry.HardLinkId,
|
|
HardLinkCounter: oldEntry.HardLinkCounter,
|
|
},
|
|
Signatures: []int32{wfs.signature},
|
|
SkipCheckParentDirectory: true,
|
|
}
|
|
|
|
// apply changes to the filer, and also apply to local metaCache
|
|
wfs.mapPbIdFromLocalToFiler(request.Entry)
|
|
|
|
ctx := context.Background()
|
|
updateResp, err := wfs.streamUpdateEntry(ctx, updateOldEntryRequest)
|
|
if err == nil {
|
|
updateEvent := updateResp.GetMetadataEvent()
|
|
if updateEvent == nil {
|
|
updateEvent = metadataUpdateEvent(oldParentPath, updateOldEntryRequest.Entry)
|
|
}
|
|
if applyErr := wfs.applyLocalMetadataEvent(ctx, updateEvent); applyErr != nil {
|
|
glog.Warningf("link %s: best-effort metadata apply failed: %v", oldEntryPath, applyErr)
|
|
wfs.inodeToPath.InvalidateChildrenCache(util.FullPath(oldParentPath))
|
|
}
|
|
}
|
|
if err == nil {
|
|
var createResp *filer_pb.CreateEntryResponse
|
|
createResp, err = wfs.streamCreateEntry(ctx, request)
|
|
if err != nil {
|
|
// Rollback: restore original HardLinkId/Counter on the source entry
|
|
oldEntry.HardLinkId = origHardLinkId
|
|
oldEntry.HardLinkCounter = origHardLinkCounter
|
|
rollbackReq := &filer_pb.UpdateEntryRequest{
|
|
Directory: oldParentPath,
|
|
Entry: oldEntry,
|
|
Signatures: []int32{wfs.signature},
|
|
}
|
|
if _, rollbackErr := wfs.streamUpdateEntry(ctx, rollbackReq); rollbackErr != nil {
|
|
glog.Warningf("link rollback %s: %v", oldEntryPath, rollbackErr)
|
|
}
|
|
} else {
|
|
createEvent := createResp.GetMetadataEvent()
|
|
if createEvent == nil {
|
|
createEvent = metadataCreateEvent(string(newParentPath), request.Entry)
|
|
}
|
|
if applyErr := wfs.applyLocalMetadataEvent(ctx, createEvent); applyErr != nil {
|
|
glog.Warningf("link %s: best-effort metadata apply failed: %v", newParentPath.Child(name), applyErr)
|
|
wfs.inodeToPath.InvalidateChildrenCache(newParentPath)
|
|
}
|
|
wfs.touchDirMtimeCtimeBest(newParentPath)
|
|
}
|
|
}
|
|
|
|
newEntryPath := newParentPath.Child(name)
|
|
|
|
// Map back to local uid/gid before writing attributes to the kernel.
|
|
wfs.mapPbIdFromFilerToLocal(request.Entry)
|
|
|
|
if err != nil {
|
|
glog.V(0).Infof("Link %v -> %s: %v", oldEntryPath, newEntryPath, err)
|
|
return fuse.EIO
|
|
}
|
|
|
|
wfs.inodeToPath.AddPath(oldEntry.Attributes.Inode, newEntryPath)
|
|
|
|
// Propagate the new HardLinkCounter to sibling cache entries and
|
|
// invalidate the kernel's inode attr cache. Without this, `stat` on any
|
|
// existing sibling link (other than the source we just wrote) returns
|
|
// the old nlink from the local metacache — pjdfstest link/00.t catches
|
|
// this after `link n1 n2` when it stats n0.
|
|
wfs.syncHardLinkSiblings(oldEntry.Attributes.Inode, oldEntry, oldEntryPath, newEntryPath)
|
|
|
|
wfs.outputPbEntry(out, oldEntry.Attributes.Inode, request.Entry)
|
|
|
|
return fuse.OK
|
|
}
|
|
|
|
// syncHardLinkSiblings rewrites the cached HardLinkCounter (and ctime) on
|
|
// every sibling link of the given inode, and invalidates the kernel's inode
|
|
// attr cache. `authoritativeEntry` carries the counter/ctime that should be
|
|
// propagated. `skipPaths` are the link paths already updated by the caller
|
|
// (typically the source and/or the newly created/removed link).
|
|
func (wfs *WFS) syncHardLinkSiblings(inode uint64, authoritativeEntry *filer_pb.Entry, skipPaths ...util.FullPath) {
|
|
if authoritativeEntry == nil || len(authoritativeEntry.HardLinkId) == 0 {
|
|
return
|
|
}
|
|
paths := wfs.inodeToPath.GetAllPaths(inode)
|
|
if len(paths) == 0 {
|
|
return
|
|
}
|
|
skip := make(map[util.FullPath]struct{}, len(skipPaths))
|
|
for _, p := range skipPaths {
|
|
skip[p] = struct{}{}
|
|
}
|
|
ctx := context.Background()
|
|
for _, p := range paths {
|
|
if _, skipped := skip[p]; skipped {
|
|
continue
|
|
}
|
|
sibling, err := wfs.metaCache.FindEntry(ctx, p)
|
|
if err != nil || sibling == nil {
|
|
continue
|
|
}
|
|
// Only touch siblings that genuinely share the same hard-link id.
|
|
// inodeToPath's shared-inode invariant should already guarantee
|
|
// this, but a mismatch can occur transiently (e.g. a rename
|
|
// replaced one of the paths), and blindly stamping an unrelated
|
|
// entry's counter would corrupt it.
|
|
if !bytes.Equal(sibling.HardLinkId, authoritativeEntry.HardLinkId) {
|
|
continue
|
|
}
|
|
sibling.HardLinkCounter = authoritativeEntry.HardLinkCounter
|
|
if authoritativeEntry.Attributes != nil {
|
|
sibling.Attr.Ctime = time.Unix(authoritativeEntry.Attributes.Ctime, int64(authoritativeEntry.Attributes.CtimeNs))
|
|
}
|
|
if err := wfs.metaCache.UpdateEntry(ctx, sibling); err != nil {
|
|
glog.V(4).Infof("syncHardLinkSiblings update %s: %v", p, err)
|
|
}
|
|
}
|
|
// Note: we deliberately do NOT call fuseServer.InodeNotify here. That
|
|
// call would be made from the FUSE Link request handler goroutine, and
|
|
// writes onto the same /dev/fuse fd that the kernel is still waiting to
|
|
// read the Link reply from — causing a self-notify deadlock. The kernel
|
|
// will re-stat siblings once its attr-cache TTL expires.
|
|
}
|