gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-07-28 09:08:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: harden site replication control plane (#3842)

Browse Source
This commit is contained in:
cxymds
2026-06-27 08:35:49 +08:00
committed by GitHub
parent ae4aa4f5d4
commit 080363f10f
9 changed files with 2420 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rustfs/src/admin/handlers/bucket_meta.rs
+2 -2
View File
@@ -360,8 +360,8 @@ impl Operation for ExportBucketMetadata {
}
};
let config_json =
serde_json::to_vec(&config).map_err(|e| s3_error!(InternalError, "serialize config failed: {e}"))?;
let config_json = serde_json::to_vec(&config.redacted_credentials())
.map_err(|e| s3_error!(InternalError, "serialize config failed: {e}"))?;
zip_writer
.start_file(conf_path, SimpleFileOptions::default())
rustfs/src/admin/handlers/replication.rs
+1
View File
@@ -367,6 +367,7 @@ impl Operation for ListRemoteTargetHandler {
let sys = BucketTargetSys::get();
let targets = sys.list_targets(bucket, "").await;
let targets: Vec<_> = targets.iter().map(|target| target.redacted_credentials()).collect();
let json_targets = serde_json::to_vec(&targets).map_err(|e| {
error!("Serialization error: {}", e);
S3Error::with_message(S3ErrorCode::InternalError, "Failed to serialize targets".to_string())
rustfs/src/admin/handlers/site_replication.rs
+1781 -71
View File
File diff suppressed because it is too large Load Diff
rustfs/src/admin/route_policy.rs
+35 -2
View File
@@ -449,13 +449,13 @@ pub const ADMIN_ROUTE_POLICY_SPECS: &[AdminRouteSpec] = &[
admin(
HttpMethod::Post,
"/rustfs/admin/v3/site-replication/devnull",
SITE_REPLICATION_INFO,
SITE_REPLICATION_OPERATION,
RouteRiskLevel::High,
),
admin(
HttpMethod::Post,
"/rustfs/admin/v3/site-replication/netperf",
SITE_REPLICATION_INFO,
SITE_REPLICATION_OPERATION,
RouteRiskLevel::High,
),
admin(
@@ -464,6 +464,12 @@ pub const ADMIN_ROUTE_POLICY_SPECS: &[AdminRouteSpec] = &[
SITE_REPLICATION_OPERATION,
RouteRiskLevel::Sensitive,
),
admin(
HttpMethod::Put,
"/rustfs/admin/v3/site-replication/join",
SITE_REPLICATION_ADD,
RouteRiskLevel::High,
),
admin(
HttpMethod::Put,
"/rustfs/admin/v3/site-replication/peer/join",
@@ -524,6 +530,12 @@ pub const ADMIN_ROUTE_POLICY_SPECS: &[AdminRouteSpec] = &[
SITE_REPLICATION_OPERATION,
RouteRiskLevel::High,
),
admin(
HttpMethod::Put,
"/rustfs/admin/v3/site-replication/repair",
SITE_REPLICATION_OPERATION,
RouteRiskLevel::High,
),
admin(HttpMethod::Get, "/rustfs/admin/debug/pprof/profile", PROFILING, RouteRiskLevel::High),
admin(HttpMethod::Get, "/rustfs/admin/debug/pprof/status", PROFILING, RouteRiskLevel::High),
admin(HttpMethod::Get, "/rustfs/admin/debug/tls/status", PROFILING, RouteRiskLevel::High),
@@ -1523,6 +1535,27 @@ mod tests {
assert_action(HttpMethod::Get, "/rustfs/admin/v3/metrics", GET_METRICS);
}
#[test]
fn route_policy_requires_operation_for_site_replication_diagnostics() {
for path in [
"/rustfs/admin/v3/site-replication/devnull",
"/rustfs/admin/v3/site-replication/netperf",
] {
assert_action(HttpMethod::Post, path, SITE_REPLICATION_OPERATION);
assert_not_action(HttpMethod::Post, path, SITE_REPLICATION_INFO);
}
}
#[test]
fn route_policy_accepts_minio_style_site_replication_join_alias() {
assert_action(HttpMethod::Put, "/rustfs/admin/v3/site-replication/join", SITE_REPLICATION_ADD);
}
#[test]
fn route_policy_requires_operation_for_site_replication_repair() {
assert_action(HttpMethod::Put, "/rustfs/admin/v3/site-replication/repair", SITE_REPLICATION_OPERATION);
}
fn route_policy_inventory_keys() -> BTreeSet<String> {
ADMIN_ROUTE_POLICY_SPECS
.iter()
rustfs/src/admin/route_registration_test.rs
+4
View File
@@ -252,6 +252,7 @@ fn expected_admin_route_matrix() -> Vec<RouteMatrixEntry> {
admin_route(Method::POST, "/v3/site-replication/devnull"),
admin_route(Method::POST, "/v3/site-replication/netperf"),
admin_route(Method::POST, "/v3/site-replication/rotate-svc-acct"),
admin_route(Method::PUT, "/v3/site-replication/join"),
admin_route(Method::PUT, "/v3/site-replication/peer/join"),
admin_route(Method::PUT, "/v3/site-replication/peer/bucket-ops"),
admin_route(Method::PUT, "/v3/site-replication/peer/iam-item"),
@@ -262,6 +263,7 @@ fn expected_admin_route_matrix() -> Vec<RouteMatrixEntry> {
admin_route(Method::PUT, "/v3/site-replication/peer/remove"),
admin_route(Method::PUT, "/v3/site-replication/resync/op"),
admin_route(Method::PUT, "/v3/site-replication/state/edit"),
admin_route(Method::PUT, "/v3/site-replication/repair"),
admin_route(Method::GET, "/debug/pprof/profile"),
admin_route(Method::GET, "/debug/pprof/status"),
admin_route(Method::GET, "/debug/tls/status"),
@@ -1069,6 +1071,7 @@ fn test_register_routes_cover_representative_admin_paths() {
assert_route(&router, Method::POST, &admin_path("/v3/site-replication/devnull"));
assert_route(&router, Method::POST, &admin_path("/v3/site-replication/netperf"));
assert_route(&router, Method::POST, &admin_path("/v3/site-replication/rotate-svc-acct"));
assert_route(&router, Method::PUT, &admin_path("/v3/site-replication/join"));
assert_route(&router, Method::PUT, &admin_path("/v3/site-replication/peer/join"));
assert_route(&router, Method::PUT, &admin_path("/v3/site-replication/peer/bucket-ops"));
assert_route(&router, Method::PUT, &admin_path("/v3/site-replication/peer/iam-item"));
@@ -1079,6 +1082,7 @@ fn test_register_routes_cover_representative_admin_paths() {
assert_route(&router, Method::PUT, &admin_path("/v3/site-replication/peer/remove"));
assert_route(&router, Method::PUT, &admin_path("/v3/site-replication/resync/op"));
assert_route(&router, Method::PUT, &admin_path("/v3/site-replication/state/edit"));
assert_route(&router, Method::PUT, &admin_path("/v3/site-replication/repair"));
assert_route(&router, Method::GET, &admin_path("/debug/pprof/profile"));
assert_route(&router, Method::GET, &admin_path("/debug/tls/status"));