mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-29 08:27:06 +00:00
Sinan Eldem
b93e7b2355
* feat(madmin): add account and two-factor wire contract Defines the self-service account and MFA API shapes in one place so the console and the `rc` CLI decode identical payloads instead of each carrying its own copy of the contract. `AccountMutability` is part of the contract on purpose: a client needs to know whether the server will accept a password change for this identity before offering the control, rather than discovering it from a rejected request. * feat(s3-types): add IAM identity audit events Adds `iam:Identity:CredentialChanged` and `iam:Identity:AuthChallenge` so account and authentication activity reaches the audit pipeline in its own namespace, the way the KMS events already do. Neither is reachable from a bucket notification config. Two variants for the whole surface rather than one per operation: `mask()` gives every variant its own bit in a `u64`, and the budget is nearly spent (63 of 64 used after this). The per-operation detail lives in `AuditEntry::api.name` and the `iamOperation` tag, which is what a SIEM filters on anyway. Splitting these further needs `mask()` widened first. * feat(iam): add two-factor authentication primitives Implements the state machine behind TOTP enrollment and verification in the IAM domain, so the admin handlers stay HTTP plumbing and the console and CLI drive identical logic. * `totp`: RFC 6238 over the workspace's existing hmac/sha1, pinned to the published Appendix B vectors. SHA-1, 6 digits, 30s: the parameters every mainstream authenticator app implements. Verification returns the matched time step so the caller can burn it. * `recovery`: ten single-use codes, 100 bits each, in a Crockford base32 alphabet without I/L/O/U. Stored as domain-separated SHA-256 digests — a password KDF would have to run once per stored code on every attempt, turning each guess into an attacker-controlled cost, and with uniform 100-bit input there is no dictionary for it to defend against. * `challenge`: stateless HMAC tokens. A TTL cache would be node-local, so a cluster without session affinity would issue on one node and verify on another; nothing here needs replicating. * `record`: two-phase enrollment, replay high-water mark, and lockout. Pending enrollment never gates a login, so a mis-scanned QR cannot lock an operator out, and re-configuring keeps the old factor working until the new one is confirmed. * `store`: one object per identity under `config/mfa/`, a sibling of `config/iam/` so the IAM cache loader's startup walk does not sweep it up. Optimistic `If-Match` writes; deliberately uncached, because a cache would need cluster-wide invalidation to keep the replay mark and the lockout counter honest. * `qr`: server-side rendering, so neither client needs a QR encoder. Enrollment is refused without `RUSTFS_IAM_MASTER_KEY`. A TOTP secret is credential-equivalent, and one written in plaintext could be lifted off a disk — worse than no second factor, because the user believes they have one. IAM identities tolerate a missing master key for backward compatibility; a new feature has no such history to honour. Also adds `IamSys::revoke_sts_sessions_for_parent`, so a credential rotation can invalidate the sessions minted under the old secret. * feat(admin): add self-service account endpoints and the two-factor login gate Adds the account surface (`/v3/account/*`), the second-factor endpoints, the administrative reset (`/v3/user/mfa`), and `PUT /v3/set-user-secret-key`, plus the gate on `AssumeRole`. What the gate covers, and what it deliberately does not: * `AssumeRole` is the only interactive login RustFS has, so it is where a second factor can be enforced. With one enrolled it requires `TokenCode`; without an enrollment the code path is unchanged, so existing deployments are untouched. * A request signed directly with a long-term access key stays ungated. Gating it would break every script and CLI the moment a human enabled 2FA on their own account, and would add no protection: whoever holds the secret key already has full access without presenting a code. This is the division AWS draws; making 2FA meaningful for API access needs an `aws:MultiFactorAuthPresent` policy condition, tracked separately. `SerialNumber`/`TokenCode` are STS's own parameters, so an SDK or script authenticates the same way the console does. `caller_identity` resolves who a request acts as. The console signs with a short-lived STS session, so "the caller" is almost never the key that signed. It reports two separate capabilities: root cannot rotate its secret (a process-wide `OnceLock` that also derives the internode RPC secret) but *can* enroll a second factor — conflating the two would leave the default deployment's console login unprotectable. The self-service routes carry no admin action. Giving them one would be wrong in both directions: it would stop an ordinary user from changing their own password, and let any holder of that action change someone else's. They gate on possession of the credential plus, for the mutations, knowledge of the current secret — a signature only proves a credential was used, so without that a hijacked tab could rewrite the account's credentials or strip its second factor. `set-user-secret-key` exists because the only prior way to change a password was to re-POST the whole user through `add-user`, which rewrote `status` and dropped the policy field — a password reset that silently re-enabled a disabled account. Wrong, replayed and malformed codes are indistinguishable on the wire; the distinction survives only in the audit trail, where no submitted value, secret or code is ever recorded. * test(e2e): cover the two-factor lifecycle and its regressions Unit tests cover the state machine at its edges; only an end-to-end test proves the pieces are wired together and that the existing authentication paths still behave. Asserts, against a real server: enrollment is refused without a master key; the full enroll/activate flow works with a genuine RFC 6238 code; `AssumeRole` refuses without a factor and accepts a valid one; a recovery code works exactly once; a direct SigV4 admin request keeps working with a factor enrolled; `AssumeRole` for an unenrolled identity is unchanged; and a password rotation invalidates the old secret. The test computes TOTP codes itself rather than calling the server's implementation — a shared helper could agree with a bug on both sides. This suite caught a real defect during development: enrollment was refused for root because its *password* is immutable, which would have left the default deployment — an administrator signing into the console as root — unable to protect the one login the feature exists for. * docs(operations): document the two-factor authentication model Records what the second factor protects and what it deliberately does not, because several of the boundaries look like gaps until the alternative is spelled out: why direct SigV4 access stays ungated, why root credentials cannot be rotated at runtime, why secret keys cannot be hashed in an S3 server, and why at-rest protection is mandatory for a TOTP secret but optional for an IAM identity. Also states the limitations plainly, including that GHSA-m77q-r63m-pj89 is unaffected: a holder of the root secret can still forge a session token, 2FA claim included. Placed alongside the other authentication and KMS security documents rather than under a new `docs/security/`, which `.gitignore` excludes. * fix(admin): route the new account handlers through the admin s3 facade Two of the guardrails in the CI "Quick Checks" job rejected the previous commits, so the required check would have gone red as soon as a maintainer approved the workflow run. `check_architecture_migration_rules.sh` requires everything under `rustfs/src/admin` to reach `ECStore` through a domain module rather than the root of `storage_api`. The MFA handler and the two `AssumeRole` signatures now use `storage_api::runtime::ECStore`, which is where the other ten admin handlers already take it from. `check_s3s_footprint.sh` ratchets two counters that new code may not grow: files referencing `s3s` and error-macro invocation lines. This branch added four files and thirty-two lines to them. The ratchet is lower-only and its header forbids raising a baseline to get green, so the construction moves behind the facade instead: `storage_api::s3` now re-exports the request and body types these handlers need and gains an `error` constructor over `S3Error::with_message`. That is the same constructor the macro expands to and the one `handlers/mod.rs`, `rebalance_internal_error` and `invalid_object_lock_configuration` already call, so this is the existing practice rather than a new one, and it keeps the `s3s` dependency in the boundary file the s3gate migration replaces. Every error code and message is carried over unchanged. In `sts.rs` only the call site this branch added is converted; the sixteen that predate it are left alone, because rewriting them would put unrelated churn in a feature PR and push the counter below the baseline it is meant to hold.
357 lines
10 KiB
Rust
357 lines
10 KiB
Rust
// Copyright 2024 RustFS Team
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
mod reliant;
|
|
mod storage_api;
|
|
|
|
// Common utilities for all E2E tests
|
|
#[cfg(test)]
|
|
pub mod common;
|
|
|
|
// In-process fault-injection primitives (disk offline/replacement, shard corruption)
|
|
#[cfg(test)]
|
|
pub mod chaos;
|
|
|
|
// Programmable S3 target for replication failure-path tests (backlog#1147 repl-8).
|
|
#[cfg(test)]
|
|
pub mod fake_s3_target;
|
|
|
|
// Socket-level network fault-injection proxy for black-box cluster tests
|
|
// (backlog#1325 network fault-injection block): latency / blackhole / one-way
|
|
// partition on the wire between nodes. Serves #1312/#1319 (lock-plane one-way
|
|
// partition, accept-then-blackhole peer) and #1327 (cross-process replay/tamper
|
|
// seam); cluster-harness wiring is a follow-up (rustfs#4937).
|
|
#[cfg(test)]
|
|
pub mod fault_proxy;
|
|
|
|
// Reliability tests built on the fault-injection harness
|
|
#[cfg(test)]
|
|
mod reliability_disk_fault_test;
|
|
|
|
// Privileged Linux-only 3x4 replacement rebuild proof for rustfs#5869/#1791.
|
|
#[cfg(all(test, target_os = "linux"))]
|
|
mod replacement_privileged_e2e_test;
|
|
|
|
// dist-13 (backlog#1150/#1155): e2e regression net proving a large-object
|
|
// degraded EC read never returns a silently truncated body (rustfs#4594/#4560/#4585).
|
|
#[cfg(test)]
|
|
mod degraded_read_eof_regression_test;
|
|
|
|
// rustfs#4784: a mid-stream GET failure must be reportable from the source
|
|
// server's log alone — naming the object, at the default log level.
|
|
#[cfg(test)]
|
|
mod get_stream_failure_observability_test;
|
|
|
|
// backlog#1183: GET codec-streaming fast path must be byte/header identical to
|
|
// the legacy duplex path before its rollout gates can be flipped on by default.
|
|
#[cfg(test)]
|
|
mod get_codec_streaming_compat_test;
|
|
|
|
#[cfg(test)]
|
|
mod version_id_regression_test;
|
|
|
|
// Pinned previous-release -> current-build on-disk compatibility.
|
|
#[cfg(test)]
|
|
mod upgrade_compatibility_test;
|
|
|
|
// Receiver-side replication LWW (rustfs/backlog#1953): stale inbound
|
|
// replication metadata must not overwrite a newer local category state.
|
|
#[cfg(test)]
|
|
mod replication_lww_receiver_test;
|
|
|
|
// Data usage regression tests
|
|
#[cfg(test)]
|
|
mod data_usage_test;
|
|
|
|
// KMS-specific test modules
|
|
#[cfg(test)]
|
|
mod kms;
|
|
|
|
// Regression test for issue #1797
|
|
#[cfg(test)]
|
|
mod list_objects_duplicates_test;
|
|
|
|
// Quota tests
|
|
#[cfg(test)]
|
|
mod quota_test;
|
|
|
|
// Harness regression tests: console port isolation + fail-fast startup
|
|
#[cfg(test)]
|
|
mod server_startup_failfast_test;
|
|
|
|
#[cfg(test)]
|
|
mod bucket_policy_check_test;
|
|
|
|
// Security boundary tests: DoS limits, SSRF prevention, concurrent-write integrity
|
|
#[cfg(test)]
|
|
mod security_boundary_test;
|
|
|
|
// Cross-process replay/tamper acceptance for the internode NodeService v2 RPC
|
|
// signature (backlog#1327): method-path transplant, nonce replay, body tampering
|
|
// and the two strict rollout flips, all against a real spawned server.
|
|
#[cfg(test)]
|
|
mod internode_rpc_signature_e2e_test;
|
|
|
|
// Opt-in per-client S3 API rate limiting (backlog#1191)
|
|
#[cfg(test)]
|
|
mod api_rate_limit_test;
|
|
|
|
// Opt-in global connection cap on the main listener (backlog#1191 follow-up)
|
|
#[cfg(test)]
|
|
mod connection_cap_test;
|
|
|
|
// Admin authorization gate: non-admin denial + root-credential lifecycle (backlog#1151 sec-4)
|
|
#[cfg(test)]
|
|
mod admin_auth_test;
|
|
|
|
/// IAM / bucket / STS session policy with `s3:ExistingObjectTag` conditions (E2E).
|
|
#[cfg(test)]
|
|
mod existing_object_tag_policy_test;
|
|
|
|
#[cfg(test)]
|
|
mod sts_query_compat_test;
|
|
|
|
// Regression tests for Issue #2036: anonymous access with PublicAccessBlock
|
|
#[cfg(test)]
|
|
mod anonymous_access_test;
|
|
|
|
// Special characters in path test modules
|
|
#[cfg(test)]
|
|
mod special_chars_test;
|
|
|
|
// Leading/duplicate slash key normalization tests (Issue #2427)
|
|
#[cfg(test)]
|
|
mod leading_slash_key_test;
|
|
|
|
// Content-Encoding header preservation test
|
|
#[cfg(test)]
|
|
mod content_encoding_test;
|
|
|
|
#[cfg(test)]
|
|
mod archive_download_integrity_test;
|
|
|
|
// ListObjectsV2 pagination test (Issue #1596)
|
|
#[cfg(test)]
|
|
mod list_objects_v2_pagination_test;
|
|
|
|
// Regression test for Issue #3107: mc mirror small-bucket listing must not time out.
|
|
#[cfg(test)]
|
|
mod mc_mirror_small_bucket_test;
|
|
|
|
// Policy variables tests
|
|
#[cfg(test)]
|
|
mod policy;
|
|
|
|
#[cfg(test)]
|
|
mod compression_test;
|
|
|
|
// Regression test for Issue #1878: DeleteMarkers not visible immediately after delete_objects
|
|
#[cfg(test)]
|
|
mod delete_objects_versioning_test;
|
|
|
|
// Regression test for signed DELETE Object?versionId requests without Content-Length.
|
|
#[cfg(test)]
|
|
mod delete_object_no_content_length_test;
|
|
|
|
// Delete-marker visibility baseline for data-movement migration proof.
|
|
#[cfg(test)]
|
|
mod delete_marker_migration_semantics_test;
|
|
|
|
// Regression test for Issue #2252: ListObjectVersions misses newest version after put -> delete -> put
|
|
#[cfg(test)]
|
|
mod list_object_versions_regression_test;
|
|
|
|
// versions&metadata=true extension regression test
|
|
#[cfg(test)]
|
|
mod list_object_versions_metadata_extension_test;
|
|
|
|
// list-type=2&metadata=true extension regression test
|
|
#[cfg(test)]
|
|
mod list_objects_v2_metadata_extension_test;
|
|
|
|
#[cfg(test)]
|
|
mod protocols;
|
|
|
|
// Object Lock tests
|
|
#[cfg(test)]
|
|
mod object_lock;
|
|
|
|
#[cfg(test)]
|
|
mod cluster_concurrency_test;
|
|
|
|
// Multi-drive (drivesPerNode) and 2-pool cluster harness smoke tests
|
|
#[cfg(test)]
|
|
mod cluster_multidrive_pool_test;
|
|
|
|
// backlog#1433: real 4-node EC boundary gate for inline storage and GET paths.
|
|
#[cfg(test)]
|
|
mod inline_fast_path_cluster_test;
|
|
|
|
// PutObject / MultipartUpload with checksum (Content-MD5, x-amz-checksum-*)
|
|
#[cfg(test)]
|
|
mod checksum_upload_test;
|
|
|
|
// Group deletion tests
|
|
#[cfg(test)]
|
|
mod group_delete_test;
|
|
|
|
#[cfg(test)]
|
|
mod head_object_range_test;
|
|
|
|
#[cfg(test)]
|
|
mod head_object_consistency_test;
|
|
|
|
#[cfg(test)]
|
|
mod heal_erasure_disk_rebuild_test;
|
|
|
|
#[cfg(test)]
|
|
mod copy_object_metadata_test;
|
|
|
|
#[cfg(test)]
|
|
mod copy_object_tagging_test;
|
|
|
|
#[cfg(test)]
|
|
mod copy_object_version_restore_test;
|
|
|
|
#[cfg(test)]
|
|
mod copy_object_checksum_test;
|
|
|
|
#[cfg(test)]
|
|
mod ssec_copy_test;
|
|
|
|
#[cfg(test)]
|
|
mod multipart_storage_class_test;
|
|
|
|
#[cfg(test)]
|
|
mod storage_class_capability_test;
|
|
|
|
// S3 dummy-compat bucket API tests
|
|
#[cfg(test)]
|
|
mod bucket_logging_test;
|
|
|
|
// Multipart control API auth regression tests
|
|
#[cfg(test)]
|
|
mod multipart_auth_test;
|
|
|
|
// Negative presigned-URL (query-string SigV4) regression suite (backlog#1151
|
|
// sec-2): expired, tampered signature, wrong secret, tampered target.
|
|
#[cfg(test)]
|
|
mod presigned_negative_test;
|
|
|
|
// Negative header-SigV4 regression suite (backlog#1151 sec-1): tampered
|
|
// signature, wrong secret, skewed date, malformed Authorization.
|
|
#[cfg(test)]
|
|
mod negative_sigv4_test;
|
|
|
|
#[cfg(test)]
|
|
mod stale_multipart_cleanup_cluster_test;
|
|
|
|
// Object lambda end-to-end regression tests
|
|
#[cfg(test)]
|
|
mod object_lambda_test;
|
|
|
|
// S3 event-notification webhook delivery end-to-end (backlog#1154 peri-1):
|
|
// configure webhook target -> PutBucketNotificationConfiguration -> object
|
|
// operation -> event delivered, plus filter negatives and store-queue redelivery.
|
|
#[cfg(test)]
|
|
mod notification_webhook_test;
|
|
|
|
// TLS certificate hot-reload live-listener e2e (backlog#1154 peri-5): swap
|
|
// certificates without a restart, existing sessions survive, bad material is
|
|
// fail-safe (old certificate keeps serving, failure is logged).
|
|
#[cfg(test)]
|
|
mod tls_hot_reload_test;
|
|
|
|
// Console listener over-the-wire smoke (backlog#1154 peri-4): public console
|
|
// endpoints answer without credentials or leaks, the SPA prefix never falls
|
|
// through to the S3 API, and the protected surface stays authenticated.
|
|
#[cfg(test)]
|
|
mod console_smoke_test;
|
|
|
|
// Admin IAM management CRUD e2e (backlog#1154 peri-2): user / canned-policy /
|
|
// service-account lifecycle over signed HTTP with data-plane effect assertions,
|
|
// plus non-admin 403 probes per endpoint (sec-4 pattern).
|
|
#[cfg(test)]
|
|
mod admin_iam_crud_test;
|
|
mod admin_mfa_test;
|
|
|
|
#[cfg(test)]
|
|
mod admin_pools_test;
|
|
|
|
// Replication extension end-to-end regression tests
|
|
#[cfg(test)]
|
|
mod replication_extension_test;
|
|
|
|
#[cfg(test)]
|
|
mod snowball_auto_extract_test;
|
|
|
|
#[cfg(test)]
|
|
mod namespace_lock_quorum_test;
|
|
|
|
#[cfg(test)]
|
|
mod admin_timeout_regression_test;
|
|
|
|
#[cfg(test)]
|
|
mod overwrite_cleanup_regression_test;
|
|
|
|
// Regression test for backlog#601: `GET //` ListBuckets browser compatibility.
|
|
#[cfg(test)]
|
|
mod list_buckets_double_slash_test;
|
|
|
|
// Regression coverage for bucket-scoped ListBuckets authorization fallback.
|
|
#[cfg(test)]
|
|
mod list_buckets_auth_test;
|
|
|
|
// ListBuckets visibility follows IAM authorization, not bucket policy.
|
|
#[cfg(test)]
|
|
mod list_buckets_iam_filter_test;
|
|
|
|
// Regression test for backlog#629(b): region-aware CreateBucket SigV4.
|
|
#[cfg(test)]
|
|
mod create_bucket_region_test;
|
|
|
|
// Regression coverage for backlog#618 item 8: copy-source invalid-date header.
|
|
#[cfg(test)]
|
|
mod copy_source_invalid_date_test;
|
|
|
|
// P0 regression: event notification startup race (rustfs#5387, #5681, #5401, #5183, #5115, #4796)
|
|
#[cfg(test)]
|
|
mod notification_startup_regression_test;
|
|
|
|
// P0 regression: lifecycle/ILM object expiration (rustfs#5407, #5167, #4963, #5615, #4879)
|
|
#[cfg(test)]
|
|
mod lifecycle_regression_test;
|
|
|
|
// P0 regression: delete operations consistency (rustfs#5375, #5349, #5339, #5029, #4978, #760)
|
|
#[cfg(test)]
|
|
mod delete_regression_test;
|
|
|
|
// P1 regression: listing/metacache completeness (rustfs#5166, #5156, #5051, #4810, #4648, #3191)
|
|
#[cfg(test)]
|
|
mod listing_regression_test;
|
|
|
|
// P1 regression: bucket statistics accuracy (rustfs#5615, #5008, #5116, #5055, #3898, #1012)
|
|
#[cfg(test)]
|
|
mod bucket_stats_regression_test;
|
|
|
|
// P1 regression: distributed startup/quorum (rustfs#5416, #2945, #2794, #2601, #4040, #5655)
|
|
#[cfg(test)]
|
|
mod distributed_startup_regression_test;
|
|
|
|
// P1 regression: tier/ILM transition (rustfs#5218, #5130, #5011, #4826, #5024)
|
|
#[cfg(test)]
|
|
mod tier_transition_regression_test;
|
|
|
|
pub mod tls_gen;
|