mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-31 09:20:50 +01:00
* security: fail closed on misconfigured gRPC TLS LoadServerTLS/LoadClientTLS returned plaintext credentials on every error path once TLS was configured: a typo in tls.min_version or tls.cipher_suites, cert and key in different directories, or cert/key set without grpc.ca all left the component serving or dialing plaintext. A partially configured TLS setup now stops the process at startup instead; leaving cert/key unset still means no TLS, as before. The loaders also stat cert/key/ca files up front since the pemfile providers read lazily and would otherwise only fail at handshake time. Mirrored in the Rust volume server: partial grpc.volume cert/key, a missing grpc.ca, or a rustls build failure now abort startup rather than warn-and-continue on plaintext. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * security: optional server-identity allowlist for gRPC clients The mTLS client accepts any certificate the configured CA signs, so a per-workload CA lets one component stand in for any other: a filer identity can answer as the master. The server side already screens callers via allowed_commonNames and allowed_wildcard_domain; nothing screened the server. LoadClientTLS now wires AdditionalPeerVerification when the caller configures a server allowlist: grpc.<component>.allowed_server_commonNames (falling back to a shared grpc.allowed_server_commonNames) matched against the peer cert's subject CN, DNS SANs, or URI SANs such as a SPIFFE id, plus a grpc.allowed_server_wildcard_domain suffix match. Leaving them unset keeps the previous behavior. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * security: URI SANs are exact-match only in the server identity allowlist A URI identity whose path happens to end in the wildcard domain would otherwise pass the DNS suffix check. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * security: tighten gRPC TLS fail-closed and server-identity paths - URI SANs match the server-identity allowlist exactly; the wildcard domain suffix check applies only to CN and DNS SANs. - A partially set client_cert/client_key pair is an error when the cert/key fallback is empty, instead of dialing plaintext. - Cert/key/ca files are loaded and parsed at startup (LoadX509KeyPair and CA PEM validation) since pemfile providers read lazily. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * rust volume: error on a partial grpc client_cert/client_key pair Mirror the Go loadClientTLS path: when client_cert or client_key is set without its mate and the cert/key fallback is empty, fail instead of dialing plaintext. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * security: wildcard domain match requires a valid hostname A CA-signed identity like ".example.com" satisfied the bare suffix check for wildcard ".example.com" despite not being a hostname. Require a real subdomain: non-empty label before the suffix, a '.' boundary when the configured wildcard has no leading dot, and DNS-name syntax. A leading "*." label still matches so wildcard certs keep working. Applied to both the Go server/client authenticators and the Rust volume's client-cert verifier. * security: ignore a trailing root dot in wildcard domain matching * tls: reject a partial dedicated client cert/key pair instead of falling back When exactly one of component.client_cert/client_key is set, warn-and- fallback silently dialed with the serving identity. Fail closed like the other TLS misconfigurations in this change; mirrored in the Rust loader. Regression tests cover a partial pair with a valid fallback. * rust volume: harden partial client cert pair test with real pem files * security: verify dialed server identity per target kind on the filer The filer reused one grpc.filer-verifying dial option for master, volume, filer and s3 targets, so a broad allowlist accepted the wrong component at the wrong port and a narrow one rejected legitimate peers. Outbound calls now pick grpc.<target>.allowed_server_commonNames (falling back to the client component's and the global list) while still presenting the grpc.filer client identity. * security: scope per-target server allowlists under the client component The filer read grpc.volume.allowed_server_commonNames when dialing a volume, but that key already denotes the volume's own outbound allowlist (e.g. the master identity). A deployment restricting volume->master calls would make the filer reject real volume servers. Per-target policy now lives under the client component: grpc.filer.volume_* falls back to grpc.filer.* then grpc.*. --------- Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
374 lines
12 KiB
Go
374 lines
12 KiB
Go
package weed_server
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"os"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/filer"
|
|
"github.com/seaweedfs/seaweedfs/weed/glog"
|
|
"github.com/seaweedfs/seaweedfs/weed/operation"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
|
|
"github.com/seaweedfs/seaweedfs/weed/security"
|
|
"github.com/seaweedfs/seaweedfs/weed/stats"
|
|
"github.com/seaweedfs/seaweedfs/weed/storage/needle"
|
|
"github.com/seaweedfs/seaweedfs/weed/util"
|
|
"github.com/seaweedfs/seaweedfs/weed/util/constants"
|
|
util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
|
|
)
|
|
|
|
var (
|
|
OS_UID = uint32(os.Getuid())
|
|
OS_GID = uint32(os.Getgid())
|
|
|
|
// ErrReadOnly is filer_pb.ErrReadOnly so errors.Is matches on either side
|
|
// of the gRPC boundary.
|
|
ErrReadOnly = filer_pb.ErrReadOnly
|
|
)
|
|
|
|
type FilerPostResult struct {
|
|
Name string `json:"name,omitempty"`
|
|
Size int64 `json:"size,omitempty"`
|
|
Error string `json:"error,omitempty"`
|
|
}
|
|
|
|
func (fs *FilerServer) assignNewFileInfo(ctx context.Context, so *operation.StorageOption, expectedDataSize uint64) (fileId, urlLocation string, auth security.EncodedJwt, err error) {
|
|
|
|
stats.FilerHandlerCounter.WithLabelValues(stats.ChunkAssign).Inc()
|
|
start := time.Now()
|
|
defer func() {
|
|
stats.FilerRequestHistogram.WithLabelValues(stats.ChunkAssign).Observe(time.Since(start).Seconds())
|
|
}()
|
|
|
|
ar, altRequest := so.ToAssignRequests(1)
|
|
ar.ExpectedDataSize = expectedDataSize
|
|
if altRequest != nil {
|
|
altRequest.ExpectedDataSize = expectedDataSize
|
|
}
|
|
|
|
// Use a context that ignores cancellation from the request context
|
|
assignCtx := context.WithoutCancel(ctx)
|
|
|
|
assignResult, ae := operation.Assign(assignCtx, fs.filer.GetMaster, fs.masterGrpcDialOption(), ar, altRequest)
|
|
if ae != nil {
|
|
glog.ErrorfCtx(ctx, "failing to assign a file id: %v", ae)
|
|
err = ae
|
|
return
|
|
}
|
|
fileId = assignResult.Fid
|
|
assignUrl := assignResult.Url
|
|
// Prefer same data center
|
|
if fs.option.DataCenter != "" {
|
|
for _, repl := range assignResult.Replicas {
|
|
if repl.DataCenter == fs.option.DataCenter {
|
|
assignUrl = repl.Url
|
|
break
|
|
}
|
|
}
|
|
}
|
|
urlLocation = "http://" + assignUrl + "/" + assignResult.Fid
|
|
if so.Fsync {
|
|
urlLocation += "?fsync=true"
|
|
}
|
|
auth = assignResult.Auth
|
|
return
|
|
}
|
|
|
|
func (fs *FilerServer) PostHandler(w http.ResponseWriter, r *http.Request, contentLength int64) {
|
|
ctx := r.Context()
|
|
|
|
// Match storage rules on the decoded path the entry is written to. The raw
|
|
// request-target is percent-encoded on the wire, so a rule on "/只读/" would
|
|
// never see "/%E5%8F%AA%E8%AF%BB/".
|
|
destination := r.URL.Path
|
|
headerDestination := r.Header.Get(s3_constants.SeaweedStorageDestinationHeader)
|
|
if headerDestination != "" {
|
|
destination = headerDestination
|
|
}
|
|
|
|
// The destination header picks storage rules for a logical destination, but
|
|
// the entry is written at r.URL.Path. Enforce the read-only/quota rule on the
|
|
// actual write path too, so the header cannot route a write into a read-only
|
|
// location.
|
|
if headerDestination != "" && fs.filer.FilerConf.MatchStorageRule(r.URL.Path).ReadOnly {
|
|
writeJsonError(w, r, http.StatusInsufficientStorage, ErrReadOnly)
|
|
return
|
|
}
|
|
|
|
query := r.URL.Query()
|
|
so, err := fs.detectStorageOption0(ctx, destination,
|
|
query.Get("collection"),
|
|
query.Get("replication"),
|
|
query.Get("ttl"),
|
|
query.Get("disk"),
|
|
query.Get("fsync"),
|
|
query.Get("dataCenter"),
|
|
query.Get("rack"),
|
|
query.Get("dataNode"),
|
|
query.Get("saveInside"),
|
|
)
|
|
if err != nil {
|
|
if errors.Is(err, ErrReadOnly) {
|
|
writeJsonError(w, r, http.StatusInsufficientStorage, err)
|
|
} else {
|
|
glog.V(1).InfolnCtx(ctx, "post", r.RequestURI, ":", err.Error())
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
}
|
|
return
|
|
}
|
|
|
|
if so.Fsync {
|
|
ctx = filer.WithSyncWrite(ctx)
|
|
}
|
|
|
|
if util.FullPath(r.URL.Path).IsLongerFileName(so.MaxFileNameLength) {
|
|
glog.V(1).InfolnCtx(ctx, "post", r.RequestURI, ": ", "entry name too long")
|
|
w.WriteHeader(http.StatusRequestURITooLong)
|
|
return
|
|
}
|
|
|
|
// When DiskType is empty,use filer's -disk
|
|
if so.DiskType == "" {
|
|
so.DiskType = fs.option.DiskType
|
|
}
|
|
|
|
if strings.HasPrefix(r.URL.Path, "/etc") {
|
|
so.SaveInside = true
|
|
}
|
|
|
|
if query.Has("mv.from") {
|
|
fs.move(ctx, w, r, so)
|
|
} else if query.Has("cp.from") {
|
|
fs.copy(ctx, w, r, so)
|
|
} else if isExtractZip(r) {
|
|
fs.extractZipArchive(ctx, w, r)
|
|
} else {
|
|
fs.autoChunk(ctx, w, r, contentLength, so)
|
|
}
|
|
|
|
util_http.CloseRequest(r)
|
|
|
|
}
|
|
|
|
func (fs *FilerServer) move(ctx context.Context, w http.ResponseWriter, r *http.Request, so *operation.StorageOption) {
|
|
src := r.URL.Query().Get("mv.from")
|
|
dst := r.URL.Path
|
|
|
|
glog.V(2).InfofCtx(ctx, "FilerServer.move %v to %v", src, dst)
|
|
|
|
var err error
|
|
if src, err = clearName(src); err != nil {
|
|
writeJsonError(w, r, http.StatusBadRequest, err)
|
|
return
|
|
}
|
|
if dst, err = clearName(dst); err != nil {
|
|
writeJsonError(w, r, http.StatusBadRequest, err)
|
|
return
|
|
}
|
|
src = strings.TrimRight(src, "/")
|
|
if src == "" {
|
|
err = fmt.Errorf("invalid source '/'")
|
|
writeJsonError(w, r, http.StatusBadRequest, err)
|
|
return
|
|
}
|
|
|
|
srcPath := util.FullPath(src)
|
|
dstPath := util.FullPath(dst)
|
|
if dstPath.IsLongerFileName(so.MaxFileNameLength) {
|
|
err = fmt.Errorf("dst name to long")
|
|
writeJsonError(w, r, http.StatusBadRequest, err)
|
|
return
|
|
}
|
|
srcEntry, err := fs.filer.FindEntry(ctx, srcPath)
|
|
if err != nil {
|
|
err = fmt.Errorf("failed to get src entry '%s', err: %s", src, err)
|
|
writeJsonError(w, r, http.StatusBadRequest, err)
|
|
return
|
|
}
|
|
|
|
wormEnforced, err := fs.wormEnforcedForEntry(ctx, src)
|
|
if err != nil {
|
|
writeJsonError(w, r, http.StatusInternalServerError, err)
|
|
return
|
|
} else if wormEnforced {
|
|
// you cannot move a worm file or directory
|
|
err = fmt.Errorf("cannot move write-once entry from '%s' to '%s': %s", src, dst, constants.ErrMsgOperationNotPermitted)
|
|
writeJsonError(w, r, http.StatusForbidden, err)
|
|
return
|
|
}
|
|
|
|
oldDir, oldName := srcPath.DirAndName()
|
|
newDir, newName := dstPath.DirAndName()
|
|
newName = util.Nvl(newName, oldName)
|
|
|
|
dstEntry, err := fs.filer.FindEntry(ctx, util.FullPath(strings.TrimRight(dst, "/")))
|
|
if err != nil && err != filer_pb.ErrNotFound {
|
|
err = fmt.Errorf("failed to get dst entry '%s', err: %s", dst, err)
|
|
writeJsonError(w, r, http.StatusInternalServerError, err)
|
|
return
|
|
}
|
|
if err == nil && !dstEntry.IsDirectory() && srcEntry.IsDirectory() {
|
|
err = fmt.Errorf("move: cannot overwrite non-directory '%s' with directory '%s'", dst, src)
|
|
writeJsonError(w, r, http.StatusBadRequest, err)
|
|
return
|
|
}
|
|
|
|
_, err = fs.AtomicRenameEntry(ctx, &filer_pb.AtomicRenameEntryRequest{
|
|
OldDirectory: oldDir,
|
|
OldName: oldName,
|
|
NewDirectory: newDir,
|
|
NewName: newName,
|
|
})
|
|
if err != nil {
|
|
err = fmt.Errorf("failed to move entry from '%s' to '%s', err: %s", src, dst, err)
|
|
writeJsonError(w, r, http.StatusBadRequest, err)
|
|
return
|
|
}
|
|
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}
|
|
|
|
// curl -X DELETE http://localhost:8888/path/to
|
|
// curl -X DELETE http://localhost:8888/path/to?recursive=true
|
|
// curl -X DELETE http://localhost:8888/path/to?recursive=true&ignoreRecursiveError=true
|
|
// curl -X DELETE http://localhost:8888/path/to?recursive=true&skipChunkDeletion=true
|
|
func (fs *FilerServer) DeleteHandler(w http.ResponseWriter, r *http.Request) {
|
|
isRecursive := r.FormValue("recursive") == "true"
|
|
if !isRecursive && fs.option.recursiveDelete {
|
|
if r.FormValue("recursive") != "false" {
|
|
isRecursive = true
|
|
}
|
|
}
|
|
ignoreRecursiveError := r.FormValue("ignoreRecursiveError") == "true"
|
|
skipChunkDeletion := r.FormValue("skipChunkDeletion") == "true"
|
|
|
|
objectPath := r.URL.Path
|
|
if len(r.URL.Path) > 1 && strings.HasSuffix(objectPath, "/") {
|
|
objectPath = objectPath[0 : len(objectPath)-1]
|
|
}
|
|
|
|
wormEnforced, err := fs.wormEnforcedForEntry(context.TODO(), objectPath)
|
|
if err != nil {
|
|
writeJsonError(w, r, http.StatusInternalServerError, err)
|
|
return
|
|
} else if wormEnforced {
|
|
writeJsonError(w, r, http.StatusForbidden, errors.New(constants.ErrMsgOperationNotPermitted))
|
|
return
|
|
}
|
|
|
|
// The delete and the commit record it emits must serialize with peer
|
|
// replay of this path, same as the gRPC DeleteEntry handler.
|
|
fullPath := util.FullPath(objectPath)
|
|
if fs.entryLockTable != nil {
|
|
pathLock := fs.entryLockTable.AcquireLock("DeleteHandler", fullPath, util.ExclusiveLock)
|
|
defer fs.entryLockTable.ReleaseLock(fullPath, pathLock)
|
|
}
|
|
|
|
err = fs.filer.DeleteEntryMetaAndData(context.Background(), fullPath, isRecursive, ignoreRecursiveError, !skipChunkDeletion, false, nil, time.Time{})
|
|
if err != nil && err != filer_pb.ErrNotFound {
|
|
glog.V(1).Infoln("deleting", objectPath, ":", err.Error())
|
|
writeJsonError(w, r, http.StatusInternalServerError, err)
|
|
return
|
|
}
|
|
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}
|
|
|
|
func (fs *FilerServer) detectStorageOption(ctx context.Context, requestURI, qCollection, qReplication string, ttlSeconds int32, diskType, dataCenter, rack, dataNode string) (*operation.StorageOption, error) {
|
|
|
|
rule := fs.filer.FilerConf.MatchStorageRule(requestURI)
|
|
|
|
if rule.ReadOnly {
|
|
// Name the read-only prefix so the caller knows which path is locked and why.
|
|
// MatchStorageRule leaves LocationPrefix empty when several rules merge; fall back to the request path.
|
|
prefix := rule.LocationPrefix
|
|
if prefix == "" {
|
|
prefix = requestURI
|
|
}
|
|
return nil, fmt.Errorf("%w: %s (e.g. bucket over quota)", ErrReadOnly, prefix)
|
|
}
|
|
|
|
// Use local variable instead of mutating shared rule
|
|
maxFileNameLength := rule.MaxFileNameLength
|
|
if maxFileNameLength == 0 {
|
|
maxFileNameLength = fs.filer.MaxFilenameLength
|
|
}
|
|
|
|
// required by buckets folder
|
|
bucketDefaultCollection := ""
|
|
if strings.HasPrefix(requestURI, fs.filer.DirBucketsPath+"/") {
|
|
bucketDefaultCollection = fs.filer.DetectBucket(util.FullPath(requestURI))
|
|
}
|
|
|
|
if ttlSeconds == 0 {
|
|
ttl, err := needle.ReadTTL(rule.GetTtl())
|
|
if err != nil {
|
|
glog.ErrorfCtx(ctx, "fail to parse %s ttl setting %s: %v", rule.LocationPrefix, rule.Ttl, err)
|
|
}
|
|
ttlSeconds = int32(ttl.Minutes()) * 60
|
|
}
|
|
|
|
collection := util.Nvl(qCollection, rule.Collection, bucketDefaultCollection, fs.option.Collection)
|
|
|
|
// A placement overlay steers a bound collection's new volumes onto a tier.
|
|
// It sits between the explicit request and the filer.conf rule: it overrides
|
|
// the rule but yields to a value the caller asked for outright. Only a
|
|
// steered collection contributes values; an unsteered one clears them so it
|
|
// falls straight through to the rule.
|
|
overlayDisk, overlayReplication, overlayDataCenter, overlaySteered := fs.filer.ResolvePlacement(collection)
|
|
if !overlaySteered {
|
|
overlayDisk, overlayReplication, overlayDataCenter = "", "", ""
|
|
} else {
|
|
glog.V(4).InfofCtx(ctx, "placement overlay steers collection %s: disk=%q replication=%q dataCenter=%q",
|
|
collection, overlayDisk, overlayReplication, overlayDataCenter)
|
|
}
|
|
|
|
return &operation.StorageOption{
|
|
Replication: util.Nvl(qReplication, overlayReplication, rule.Replication, fs.option.DefaultReplication),
|
|
Collection: collection,
|
|
DataCenter: util.Nvl(dataCenter, overlayDataCenter, rule.DataCenter, fs.option.DataCenter),
|
|
Rack: util.Nvl(rack, rule.Rack, fs.option.Rack),
|
|
DataNode: util.Nvl(dataNode, rule.DataNode, fs.option.DataNode),
|
|
TtlSeconds: ttlSeconds,
|
|
DiskType: util.Nvl(diskType, overlayDisk, rule.DiskType),
|
|
Fsync: rule.GetFsync(),
|
|
VolumeGrowthCount: rule.VolumeGrowthCount,
|
|
MaxFileNameLength: maxFileNameLength,
|
|
// A location that survives from a request parameter, a placement
|
|
// overlay, or the path rule is a contract; only a bare filer default
|
|
// is a preference that may still be widened.
|
|
EnforceLocation: dataCenter != "" || overlayDataCenter != "" || rule.DataCenter != "" ||
|
|
rack != "" || rule.Rack != "" || dataNode != "" || rule.DataNode != "",
|
|
}, nil
|
|
}
|
|
|
|
func (fs *FilerServer) detectStorageOption0(ctx context.Context, requestURI, qCollection, qReplication string, qTtl string, diskType string, fsync string, dataCenter, rack, dataNode, saveInside string) (*operation.StorageOption, error) {
|
|
|
|
ttl, err := needle.ReadTTL(qTtl)
|
|
if err != nil {
|
|
glog.ErrorfCtx(ctx, "fail to parse ttl %s: %v", qTtl, err)
|
|
}
|
|
|
|
so, err := fs.detectStorageOption(ctx, requestURI, qCollection, qReplication, int32(ttl.Minutes())*60, diskType, dataCenter, rack, dataNode)
|
|
if so != nil {
|
|
if fsync == "false" {
|
|
so.Fsync = false
|
|
} else if fsync == "true" {
|
|
so.Fsync = true
|
|
}
|
|
if saveInside == "true" {
|
|
so.SaveInside = true
|
|
} else {
|
|
so.SaveInside = false
|
|
}
|
|
}
|
|
|
|
return so, err
|
|
}
|