mirror of
https://github.com/rustfs/rustfs.git
synced 2026-10-12 23:52:45 +00:00
Hauser
1266d4c270
* feat(tls): reload external certificate snapshots coherently Pin projected certificate generations, validate complete TLS material, coordinate server consumers, and invalidate outbound RPC caches coherently. Add externally managed TLS Secret support and rotation guidance. Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * feat(tls): publish server certificates through a fenced admin API Add opt-in server-leaf publication with dedicated IAM actions, actual TLS transport checks, immutable generations, durable captured-token CAS and idempotent receipts. Preserve independent trust and client identity sources and distinguish visible publication state from the full serving chain. Validate 64 TLS tests, 41 TLS-runtime tests, the focused IAM policy test, and eight live local API scenarios including least privilege and restart. Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * fix(admin): route certificate handler types through S3 facade Use the existing admin S3 facade to keep direct s3s imports within the footprint ratchet. Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * test(admin): include TLS certificate routes in route matrix Account for the registered certificate-state GET and certificate publication POST without changing route behavior or weakening matrix assertions. Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * fix(tls): reconcile startup trust before skipping reloads Compare the initialized listener bundle with coherently published outbound material, retain startup trust and client identity when sources disappear, and cover independent startup rotations through real reload passes. Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * refactor(tls): reuse pinned generations and prepared listener state Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * fix(tls): preserve startup trust source requirements --------- Co-authored-by: heihutu <heihutu@gmail.com> Co-authored-by: zhi22915 <qiuzgang@gmail.com> Co-authored-by: overtrue <anzhengchao@gmail.com>
65 lines
2.4 KiB
Rust
65 lines
2.4 KiB
Rust
// Copyright 2024 RustFS Team
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
use std::path::PathBuf;
|
|
use thiserror::Error;
|
|
|
|
#[derive(Debug, Error)]
|
|
pub enum TlsRuntimeError {
|
|
#[error("TLS source path is empty")]
|
|
EmptySourcePath,
|
|
#[error("TLS directory does not exist: {path}")]
|
|
DirectoryNotFound { path: PathBuf },
|
|
#[error("TLS path is not a directory: {path}")]
|
|
NotADirectory { path: PathBuf },
|
|
#[error("TLS source I/O error at {path}: {source}")]
|
|
SourceIo {
|
|
path: PathBuf,
|
|
#[source]
|
|
source: std::io::Error,
|
|
},
|
|
#[error("incomplete TLS certificate/private key pair for {name}")]
|
|
IncompleteIdentity { name: String },
|
|
#[error("invalid TLS certificate material for {name}: {reason}")]
|
|
InvalidCertificate { name: String, reason: String },
|
|
#[error("invalid TLS private key for {name}: {reason}")]
|
|
InvalidPrivateKey { name: String, reason: String },
|
|
#[error("TLS certificate/private key validation failed for {name}: {source}")]
|
|
InvalidCertifiedKey {
|
|
name: String,
|
|
#[source]
|
|
source: rustls::Error,
|
|
},
|
|
#[error("invalid TLS trust anchor in {name}: {source}")]
|
|
InvalidTrustAnchor {
|
|
name: String,
|
|
#[source]
|
|
source: rustls::Error,
|
|
},
|
|
#[error("TLS certificate for {name} is outside its validity interval")]
|
|
CertificateValidity { name: String },
|
|
#[error("TLS certificate for {name} does not permit server authentication")]
|
|
InvalidServerEku { name: String },
|
|
#[error("TLS certificate for {name} does not permit client authentication")]
|
|
InvalidClientEku { name: String },
|
|
#[error("TLS source loading task failed: {0}")]
|
|
SourceTaskJoin(#[from] tokio::task::JoinError),
|
|
#[error("TLS material error: {0}")]
|
|
Material(String),
|
|
#[error("TLS publication error: {0}")]
|
|
Publication(String),
|
|
#[error("I/O error: {0}")]
|
|
Io(#[from] std::io::Error),
|
|
}
|