mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-31 17:30:42 +01:00
* security: fail closed on misconfigured gRPC TLS LoadServerTLS/LoadClientTLS returned plaintext credentials on every error path once TLS was configured: a typo in tls.min_version or tls.cipher_suites, cert and key in different directories, or cert/key set without grpc.ca all left the component serving or dialing plaintext. A partially configured TLS setup now stops the process at startup instead; leaving cert/key unset still means no TLS, as before. The loaders also stat cert/key/ca files up front since the pemfile providers read lazily and would otherwise only fail at handshake time. Mirrored in the Rust volume server: partial grpc.volume cert/key, a missing grpc.ca, or a rustls build failure now abort startup rather than warn-and-continue on plaintext. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * security: optional server-identity allowlist for gRPC clients The mTLS client accepts any certificate the configured CA signs, so a per-workload CA lets one component stand in for any other: a filer identity can answer as the master. The server side already screens callers via allowed_commonNames and allowed_wildcard_domain; nothing screened the server. LoadClientTLS now wires AdditionalPeerVerification when the caller configures a server allowlist: grpc.<component>.allowed_server_commonNames (falling back to a shared grpc.allowed_server_commonNames) matched against the peer cert's subject CN, DNS SANs, or URI SANs such as a SPIFFE id, plus a grpc.allowed_server_wildcard_domain suffix match. Leaving them unset keeps the previous behavior. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * security: URI SANs are exact-match only in the server identity allowlist A URI identity whose path happens to end in the wildcard domain would otherwise pass the DNS suffix check. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * security: tighten gRPC TLS fail-closed and server-identity paths - URI SANs match the server-identity allowlist exactly; the wildcard domain suffix check applies only to CN and DNS SANs. - A partially set client_cert/client_key pair is an error when the cert/key fallback is empty, instead of dialing plaintext. - Cert/key/ca files are loaded and parsed at startup (LoadX509KeyPair and CA PEM validation) since pemfile providers read lazily. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * rust volume: error on a partial grpc client_cert/client_key pair Mirror the Go loadClientTLS path: when client_cert or client_key is set without its mate and the cert/key fallback is empty, fail instead of dialing plaintext. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * security: wildcard domain match requires a valid hostname A CA-signed identity like ".example.com" satisfied the bare suffix check for wildcard ".example.com" despite not being a hostname. Require a real subdomain: non-empty label before the suffix, a '.' boundary when the configured wildcard has no leading dot, and DNS-name syntax. A leading "*." label still matches so wildcard certs keep working. Applied to both the Go server/client authenticators and the Rust volume's client-cert verifier. * security: ignore a trailing root dot in wildcard domain matching * tls: reject a partial dedicated client cert/key pair instead of falling back When exactly one of component.client_cert/client_key is set, warn-and- fallback silently dialed with the serving identity. Fail closed like the other TLS misconfigurations in this change; mirrored in the Rust loader. Regression tests cover a partial pair with a valid fallback. * rust volume: harden partial client cert pair test with real pem files * security: verify dialed server identity per target kind on the filer The filer reused one grpc.filer-verifying dial option for master, volume, filer and s3 targets, so a broad allowlist accepted the wrong component at the wrong port and a narrow one rejected legitimate peers. Outbound calls now pick grpc.<target>.allowed_server_commonNames (falling back to the client component's and the global list) while still presenting the grpc.filer client identity. * security: scope per-target server allowlists under the client component The filer read grpc.volume.allowed_server_commonNames when dialing a volume, but that key already denotes the volume's own outbound allowlist (e.g. the master identity). A deployment restricting volume->master calls would make the filer reject real volume servers. Per-target policy now lives under the client component: grpc.filer.volume_* falls back to grpc.filer.* then grpc.*. --------- Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
170 lines
5.8 KiB
Go
170 lines
5.8 KiB
Go
package weed_server
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/cluster"
|
|
"github.com/seaweedfs/seaweedfs/weed/glog"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
|
|
"github.com/seaweedfs/seaweedfs/weed/util/version"
|
|
)
|
|
|
|
func (fs *FilerServer) Statistics(ctx context.Context, req *filer_pb.StatisticsRequest) (resp *filer_pb.StatisticsResponse, err error) {
|
|
|
|
var output *master_pb.StatisticsResponse
|
|
|
|
err = fs.filer.MasterClient.WithClient(ctx, false, func(masterClient master_pb.SeaweedClient) error {
|
|
grpcResponse, grpcErr := masterClient.Statistics(ctx, &master_pb.StatisticsRequest{
|
|
Replication: fs.statisticsReplication(req.Replication),
|
|
Collection: req.Collection,
|
|
Ttl: req.Ttl,
|
|
DiskType: req.DiskType,
|
|
})
|
|
if grpcErr != nil {
|
|
return grpcErr
|
|
}
|
|
|
|
output = grpcResponse
|
|
return nil
|
|
})
|
|
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &filer_pb.StatisticsResponse{
|
|
TotalSize: output.TotalSize,
|
|
UsedSize: output.UsedSize,
|
|
FileCount: output.FileCount,
|
|
LogicalTotalSize: output.LogicalTotalSize,
|
|
LogicalUsedSize: output.LogicalUsedSize,
|
|
}, nil
|
|
}
|
|
|
|
// statisticsReplication names the replication the caller's writes will use, so
|
|
// the master sizes free space by the right number of copies. Writes through
|
|
// this filer follow its default, not the master's, so fill that in when the
|
|
// request leaves the choice open.
|
|
func (fs *FilerServer) statisticsReplication(requested string) string {
|
|
if requested != "" {
|
|
return requested
|
|
}
|
|
return fs.option.DefaultReplication
|
|
}
|
|
|
|
// isKnownPingTarget reports whether target is a peer the filer has learned
|
|
// about from its master subscription (other filers, volume servers) or from
|
|
// its own master list. Restricting Ping prevents the RPC from being used as
|
|
// an arbitrary outbound dialer. All lookups are O(1) so the gate adds no
|
|
// noticeable overhead even in large clusters.
|
|
func (fs *FilerServer) isKnownPingTarget(ctx context.Context, target string, targetType string) bool {
|
|
addr := pb.ServerAddress(target)
|
|
switch targetType {
|
|
case cluster.FilerType:
|
|
if fs.filer != nil && fs.filer.MetaAggregator != nil && fs.filer.MetaAggregator.HasPeer(addr) {
|
|
return true
|
|
}
|
|
return false
|
|
case cluster.VolumeServerType:
|
|
if fs.filer != nil && fs.filer.MasterClient != nil {
|
|
return fs.filer.MasterClient.HasVolumeServer(addr)
|
|
}
|
|
return false
|
|
case cluster.MasterType:
|
|
key := addr.ToHttpAddress()
|
|
if fs.option != nil && fs.option.Masters != nil {
|
|
if _, ok := fs.option.Masters.GetInstancesAsMap()[string(addr)]; ok {
|
|
return true
|
|
}
|
|
// Fall back to a port-tolerant compare for callers that supply
|
|
// the http form when masters were registered with grpc suffix.
|
|
for _, master := range fs.option.Masters.GetInstances() {
|
|
if master.ToHttpAddress() == key {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
if fs.filer != nil && fs.filer.MasterClient != nil {
|
|
if _, ok := fs.filer.MasterClient.ListMasterSet()[key]; ok {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
return false
|
|
}
|
|
|
|
func (fs *FilerServer) Ping(ctx context.Context, req *filer_pb.PingRequest) (resp *filer_pb.PingResponse, pingErr error) {
|
|
resp = &filer_pb.PingResponse{
|
|
StartTimeNs: time.Now().UnixNano(),
|
|
}
|
|
// Empty target is a self-liveness probe and stays unauthenticated.
|
|
if req.Target != "" && !fs.isKnownPingTarget(ctx, req.Target, req.TargetType) {
|
|
resp.StopTimeNs = time.Now().UnixNano()
|
|
return resp, status.Errorf(codes.InvalidArgument, "unknown ping target %s of type %s", req.Target, req.TargetType)
|
|
}
|
|
if req.TargetType == cluster.FilerType {
|
|
pingErr = pb.WithFilerClient(false, 0, pb.ServerAddress(req.Target), fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
|
|
pingResp, err := client.Ping(ctx, &filer_pb.PingRequest{})
|
|
if pingResp != nil {
|
|
resp.RemoteTimeNs = pingResp.StartTimeNs
|
|
}
|
|
return err
|
|
})
|
|
}
|
|
if req.TargetType == cluster.VolumeServerType {
|
|
pingErr = pb.WithVolumeServerClient(false, pb.ServerAddress(req.Target), fs.volumeGrpcDialOption(), func(client volume_server_pb.VolumeServerClient) error {
|
|
pingResp, err := client.Ping(ctx, &volume_server_pb.PingRequest{})
|
|
if pingResp != nil {
|
|
resp.RemoteTimeNs = pingResp.StartTimeNs
|
|
}
|
|
return err
|
|
})
|
|
}
|
|
if req.TargetType == cluster.MasterType {
|
|
pingErr = pb.WithMasterClient(context.Background(), false, pb.ServerAddress(req.Target), fs.masterGrpcDialOption(), false, func(client master_pb.SeaweedClient) error {
|
|
pingResp, err := client.Ping(ctx, &master_pb.PingRequest{})
|
|
if pingResp != nil {
|
|
resp.RemoteTimeNs = pingResp.StartTimeNs
|
|
}
|
|
return err
|
|
})
|
|
}
|
|
if pingErr != nil {
|
|
pingErr = fmt.Errorf("ping %s %s: %v", req.TargetType, req.Target, pingErr)
|
|
}
|
|
resp.StopTimeNs = time.Now().UnixNano()
|
|
return
|
|
}
|
|
|
|
func (fs *FilerServer) GetFilerConfiguration(ctx context.Context, req *filer_pb.GetFilerConfigurationRequest) (resp *filer_pb.GetFilerConfigurationResponse, err error) {
|
|
|
|
t := &filer_pb.GetFilerConfigurationResponse{
|
|
Masters: fs.option.Masters.GetInstancesAsStrings(),
|
|
Collection: fs.option.Collection,
|
|
Replication: fs.option.DefaultReplication,
|
|
MaxMb: uint32(fs.option.MaxMB),
|
|
DirBuckets: fs.filer.DirBucketsPath,
|
|
Cipher: fs.filer.Cipher,
|
|
Signature: fs.filer.Signature,
|
|
MetricsAddress: fs.metricsAddress,
|
|
MetricsIntervalSec: int32(fs.metricsIntervalSec),
|
|
Version: version.Version(),
|
|
FilerGroup: fs.option.FilerGroup,
|
|
MajorVersion: version.MAJOR_VERSION,
|
|
MinorVersion: version.MINOR_VERSION,
|
|
}
|
|
|
|
glog.V(4).InfofCtx(ctx, "GetFilerConfiguration: %v", t)
|
|
|
|
return t, nil
|
|
}
|