gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-09-06 12:09:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(tier): switch outbound URL check to the operator-overridable policy

Browse Source 
The initial fix (routing all warm-tier constructors through
validate_outbound_url) rejected the hermetic reliant::tiering e2e suite's
real hot->cold connection over 127.0.0.1, since two embedded RustFS
servers in that suite talk to each other over loopback by design.

validate_outbound_url has no override; OutboundPolicy (already used by
webhook targets and OIDC discovery URLs) enforces the identical default
restrictions but lets an operator allowlist one exact origin via
RUSTFS_OUTBOUND_ALLOW_ORIGINS -- metadata, link-local, and unspecified
addresses can never be allowlisted, so this does not reopen the SSRF
gap the previous commit closed. Switch every warm-tier constructor
(including S3, which folds Wasabi in via new_with_bucket_lookup) to
this policy through one shared crates/ecstore/src/services/tier/
warm_backend.rs::validate_tier_endpoint_url helper, replacing the nine
scattered validate_outbound_url call sites the previous commit added
and consolidating their error(format!) ratchet accounting into one
file.

Update the e2e suite to set RUSTFS_OUTBOUND_ALLOW_ORIGINS to the cold
node's real origin before starting/restarting hot, via a hot_env_for_tier
helper, and fix the resulting borrow-checker conflict in the one test
that stops cold mid-test by cloning its origin into an owned String
first. Also retarget a WarmBackendRustFS unit test that asserted on a
now-unreachable local host-missing message: the shared policy's
http(s)-only scheme check runs first and is now what actually rejects
that fixture's non-http endpoint.

Impact: operators with an existing self-hosted RustFS/MinIO/etc. tier
whose endpoint is a bare loopback/private/link-local IP literal (not a
hostname) need RUSTFS_OUTBOUND_ALLOW_ORIGINS=<origin> set and the
server restarted to keep that tier working after this change.
This commit is contained in:
overtrue
2026-08-28 08:24:39 +08:00
parent 8386263b7a
commit 9f87867495
12 changed files with 202 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/error-other-format-baseline.txt
+2 -9
View File
@@ -54,15 +54,8 @@
19|crates/ecstore/src/services/rebalance/worker.rs
33|crates/ecstore/src/services/tier/tier.rs
1|crates/ecstore/src/services/tier/tier_config.rs
1|crates/ecstore/src/services/tier/warm_backend_aliyun.rs
1|crates/ecstore/src/services/tier/warm_backend_azure.rs
2|crates/ecstore/src/services/tier/warm_backend_gcs.rs
1|crates/ecstore/src/services/tier/warm_backend_huaweicloud.rs
1|crates/ecstore/src/services/tier/warm_backend_minio.rs
1|crates/ecstore/src/services/tier/warm_backend_r2.rs
1|crates/ecstore/src/services/tier/warm_backend_rustfs.rs
1|crates/ecstore/src/services/tier/warm_backend_s3.rs
1|crates/ecstore/src/services/tier/warm_backend_tencent.rs
2|crates/ecstore/src/services/tier/warm_backend.rs
1|crates/ecstore/src/services/tier/warm_backend_gcs.rs
1|crates/ecstore/src/services/tier/warm_backend_wasabi.rs
7|crates/ecstore/src/set_disk/core/io_primitives.rs
1|crates/ecstore/src/set_disk/mod.rs