add rustls

Cargo.lock

@@ -6696,6 +6696,9 @@ dependencies = [
  "query",
  "rmp-serde",
  "rust-embed",
+ "rustls 0.23.23",
+ "rustls-pemfile",
+ "rustls-pki-types",
  "s3s",
  "serde",
  "serde_json",
@@ -6703,6 +6706,7 @@ dependencies = [
  "shadow-rs",
  "time",
  "tokio",
+ "tokio-rustls 0.26.2",
  "tokio-stream",
  "tokio-util",
  "tonic",

Cargo.toml

@@ -78,6 +78,9 @@ rfd = { version = "0.15.2", default-features = false, features = ["xdg-portal",
 rmp = "0.8.14"
 rmp-serde = "1.3.0"
 rust-embed = "8.6.0"
+rustls = { version = "0.23" }
+rustls-pki-types = "1.11.0"
+rustls-pemfile = "2.2.0"
 s3s = { git = "https://github.com/Nugine/s3s.git", rev = "ab139f72fe768fb9d8cecfe36269451da1ca9779", default-features = true, features = [
     "tower",
 ] }
@@ -99,6 +102,7 @@ tokio = { version = "1.43.0", features = ["fs", "rt-multi-thread"] }
 tonic = { version = "0.12.3", features = ["gzip"] }
 tonic-build = "0.12.3"
 tonic-reflection = "0.12"
+tokio-rustls = { version = "0.26", default-features = false }
 tokio-stream = "0.1.17"
 tokio-util = { version = "0.7.13", features = ["io", "compat"] }
 tower = { version = "0.5.2", features = ["timeout"] }

rustfs/Cargo.toml

@@ -43,6 +43,9 @@ prost-types.workspace = true
 protos.workspace = true
 protobuf.workspace = true
 rmp-serde.workspace = true
+rustls.workspace = true
+rustls-pemfile.workspace = true
+rustls-pki-types.workspace = true
 s3s.workspace = true
 serde.workspace = true
 serde_json.workspace = true
@@ -55,6 +58,7 @@ tokio = { workspace = true, features = [
     "net",
     "signal",
 ] }
+tokio-rustls.workspace = true
 lazy_static.workspace = true
 tokio-stream.workspace = true
 tonic = { version = "0.12.3", features = ["gzip"] }

rustfs/src/config/mod.rs

@@ -9,11 +9,11 @@ pub const DEFAULT_SECRET_KEY: &str = "rustfsadmin";
 
 /// Default TLS key for rustfs
 /// This is the default key for TLS.
-pub const RUSTFS_TLS_KEY: &str = "rustfs_tls_key.pem";
+pub(crate) const RUSTFS_TLS_KEY: &str = "rustfs_tls_key.pem";
 
 /// Default TLS cert for rustfs
 /// This is the default cert for TLS.
-pub const RUSTFS_TLS_CERT: &str = "rustfs_tls_cert.pem";
+pub(crate) const RUSTFS_TLS_CERT: &str = "rustfs_tls_cert.pem";
 
 #[allow(clippy::const_is_empty)]
 const SHORT_VERSION: &str = {

rustfs/src/main.rs

@@ -9,13 +9,14 @@ mod utils;
 
 use crate::auth::IAMAuth;
 use crate::console::{init_console_cfg, CONSOLE_CONFIG};
+use crate::utils::error;
 use chrono::Datelike;
 use clap::Parser;
 use common::{
     error::{Error, Result},
     globals::set_global_addr,
 };
-use config::{DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY};
+use config::{DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY, RUSTFS_TLS_CERT, RUSTFS_TLS_KEY};
 use ecstore::heal::background_heal_ops::init_auto_heal;
 use ecstore::utils::net::{self, get_available_port};
 use ecstore::{
@@ -26,6 +27,7 @@ use ecstore::{
     update_erasure_type,
 };
 use ecstore::{global::set_global_rustfs_port, notification_sys::new_global_notification_sys};
+use futures_util::TryFutureExt;
 use grpc::make_server;
 use hyper_util::{
     rt::{TokioExecutor, TokioIo},
@@ -34,10 +36,13 @@ use hyper_util::{
 };
 use iam::init_iam_sys;
 use protos::proto_gen::node_service::node_service_server::NodeServiceServer;
+use rustls::ServerConfig;
 use s3s::{host::MultiDomain, service::S3ServiceBuilder};
 use service::hybrid;
+use std::sync::Arc;
 use std::{io::IsTerminal, net::SocketAddr};
 use tokio::net::TcpListener;
+use tokio_rustls::TlsAcceptor;
 use tonic::{metadata::MetadataValue, Request, Status};
 use tower_http::cors::CorsLayer;
 use tracing::{debug, error, info, warn};
@@ -211,6 +216,22 @@ async fn run(opt: config::Opt) -> Result<()> {
     };
 
     let rpc_service = NodeServiceServer::with_interceptor(make_server(), check_auth);
+    let tls_path = opt.tls_path.clone().unwrap_or_default();
+    let key_path = format!("{}/{}", tls_path, RUSTFS_TLS_KEY);
+    let cert_path = format!("{}/{}", tls_path, RUSTFS_TLS_CERT);
+
+    let has_tls_certs = tokio::try_join!(tokio::fs::metadata(key_path.clone()), tokio::fs::metadata(cert_path.clone())).is_ok();
+
+    if has_tls_certs {
+        let certs = utils::load_certs(cert_path.as_str()).map_err(|e| error(e.to_string()))?;
+        let key = utils::load_private_key(key_path.as_str()).map_err(|e| error(e.to_string()))?;
+        let mut server_config = ServerConfig::builder()
+            .with_no_client_auth()
+            .with_single_cert(certs, key)
+            .map_err(|e| error(e.to_string()))?;
+        server_config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec(), b"http/1.0".to_vec()];
+        let tls_acceptor = TlsAcceptor::from(Arc::new(server_config));
+    };
 
     tokio::spawn(async move {
         let hyper_service = service.into_shared();
@@ -250,10 +271,10 @@ async fn run(opt: config::Opt) -> Result<()> {
 
         tokio::select! {
             () = graceful.shutdown() => {
-                 tracing::debug!("Gracefully shutdown!");
+                 debug!("Gracefully shutdown!");
             },
             () = tokio::time::sleep(std::time::Duration::from_secs(10)) => {
-                 tracing::debug!("Waited 10 seconds for graceful shutdown, aborting...");
+                 debug!("Waited 10 seconds for graceful shutdown, aborting...");
             }
         }
     });
@@ -267,7 +288,7 @@ async fn run(opt: config::Opt) -> Result<()> {
         })?;
 
     ECStore::init(store.clone()).await.map_err(|err| {
-        error!("ECStore init faild {:?}", &err);
+        error!("ECStore init failed {:?}", &err);
         Error::from_string(err.to_string())
     })?;
     debug!("init store success!");
@@ -275,7 +296,7 @@ async fn run(opt: config::Opt) -> Result<()> {
     init_iam_sys(store.clone()).await.unwrap();
 
     new_global_notification_sys(endpoint_pools.clone()).await.map_err(|err| {
-        error!("new_global_notification_sys faild {:?}", &err);
+        error!("new_global_notification_sys failed {:?}", &err);
         Error::from_string(err.to_string())
     })?;
 

rustfs/src/utils.rs

@@ -1,4 +1,7 @@
+use rustls_pemfile::{certs, private_key};
+use rustls_pki_types::{CertificateDer, PrivateKeyDer};
 use std::net::IpAddr;
+use std::{fs, io};
 
 pub(crate) fn get_local_ip() -> Option<std::net::Ipv4Addr> {
     match local_ip_address::local_ip() {
@@ -7,3 +10,27 @@ pub(crate) fn get_local_ip() -> Option<std::net::Ipv4Addr> {
         Ok(IpAddr::V6(_)) => todo!(),
     }
 }
+
+/// Load public certificate from file.
+pub(crate) fn load_certs(filename: &str) -> io::Result<Vec<CertificateDer<'static>>> {
+    // Open certificate file.
+    let cert_file = fs::File::open(filename).map_err(|e| error(format!("failed to open {}: {}", filename, e)))?;
+    let mut reader = io::BufReader::new(cert_file);
+
+    // Load and return certificate.
+    certs(&mut reader).collect()
+}
+
+/// Load private key from file.
+pub(crate) fn load_private_key(filename: &str) -> io::Result<PrivateKeyDer<'static>> {
+    // Open keyfile.
+    let keyfile = fs::File::open(filename).map_err(|e| error(format!("failed to open {}: {}", filename, e)))?;
+    let mut reader = io::BufReader::new(keyfile);
+
+    // Load and return a single private key.
+    private_key(&mut reader).map(|key| key.unwrap())
+}
+
+pub(crate) fn error(err: String) -> io::Error {
+    io::Error::new(io::ErrorKind::Other, err)
+}