mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-07 05:43:14 +00:00
houseme
cd327c81f5
Addresses security/correctness audit findings in the target-plugin control plane, TLS reload coordinator, and runtime extension registries. control_plane (backlog#977): - Install now preserves the currently installed revision as previous_revision so Rollback actually restores the prior version instead of a no-op. - Split the gate: circuit-breaker and runtime-activation checks apply only to Install/Enable; Disable and Rollback stay available as break-glass remediation while the breaker is open. - Enforce the sidecar runtime protocol version for every external transport (previously skippable by declaring a non-gRPC transport) and validate the plugin api_compatibility_version at planning time. - Download/signature/provenance host allowlisting now matches the full host authority, so an allowlisted host never implicitly authorizes a different host:port. TLS reload coordinator/validate (backlog#981, #970-coordinator): - Compute the fingerprint before building material in register() to remove the TOCTOU that could permanently pin an old certificate; rotation self-heals. - Always start a detection loop when reload is enabled; Watch mode no longer returns success without any loop. - validate_cert_key_pairing now verifies the private key matches the certificate's public key instead of only parsing both files. - Normalize a zero poll interval to a positive minimum to avoid a panic that silently killed the poll loop. - Serialize reload cycles with a per-target mutex; a first-step fingerprint read failure now records last_error and a failure metric. - Duplicate label registration stops and joins the previous loop before publishing the replacement (stop-before-start), preventing orphaned loops. runtime extension points (backlog#983 runtime subset): - ops_profiler/ops_diagnostics authorize before probing the registry so an unauthorized caller cannot learn whether a backend/surface exists. - s3_hooks dispatch_post_auth actually traverses the registered hooks for the point instead of unconditionally returning Continue. - sidecar send_with_timeout redacts errors and uses the configurable failure threshold via policy, and a successful send resets the breaker accounting. Relates to rustfs/backlog#977 Relates to rustfs/backlog#981 Relates to rustfs/backlog#970 Relates to rustfs/backlog#983 Co-authored-by: heihutu <heihutu@gmail.com>
100 lines
4.7 KiB
Rust
100 lines
4.7 KiB
Rust
// Copyright 2024 RustFS Team
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
pub mod arn;
|
|
pub mod catalog;
|
|
mod check;
|
|
pub mod config;
|
|
pub mod control_plane;
|
|
pub mod domain;
|
|
pub mod error;
|
|
pub mod manifest;
|
|
mod net;
|
|
pub mod plugin;
|
|
pub mod runtime;
|
|
pub mod store;
|
|
pub mod sys;
|
|
pub mod target;
|
|
|
|
pub use catalog::extension::{
|
|
OPS_DIAGNOSTICS_EXTENSION_API_VERSION, OPS_PROFILER_EXTENSION_API_VERSION, S3_HOOK_EXTENSION_API_VERSION,
|
|
TARGET_AUDIT_CAPABILITY, TARGET_NOTIFY_CAPABILITY, builtin_extension_schemas, builtin_ops_diagnostics_contract,
|
|
builtin_ops_diagnostics_extension_schema, builtin_ops_profiler_contract, builtin_ops_profiler_extension_schema,
|
|
builtin_s3_hook_contract, builtin_s3_hook_extension_schema, builtin_target_extension_schemas,
|
|
target_marketplace_extension_schema, target_runtime_boundary,
|
|
};
|
|
pub use check::{
|
|
check_amqp_broker_available, check_kafka_broker_available, check_mqtt_broker_available, check_mqtt_broker_available_with_tls,
|
|
check_mysql_server_available, check_nats_server_available, check_postgres_server_available, check_pulsar_broker_available,
|
|
check_redis_server_available,
|
|
};
|
|
pub use config::{
|
|
LegacyTargetInstanceDescriptor, TargetInstanceSourceClass, TargetInstanceSourceHints, TargetPluginInstance,
|
|
TargetPluginInstanceCompatDescriptor, TargetPluginInstanceRecord, normalize_legacy_target_instances,
|
|
normalize_legacy_target_instances_from_env, normalize_target_plugin_instances, normalize_target_plugin_instances_from_env,
|
|
};
|
|
pub use control_plane::{
|
|
TargetPluginEnableState, TargetPluginExternalAction, TargetPluginExternalActionDecision, TargetPluginExternalActionError,
|
|
TargetPluginExternalFlowGate, TargetPluginExternalFlowGateStatus, TargetPluginInstallState, TargetPluginInstallation,
|
|
TargetPluginOperationalState, TargetPluginRevision, TargetPluginRuntimeState, builtin_target_plugin_installation,
|
|
builtin_target_plugin_operational_state, external_target_plugin_installation, plan_external_target_plugin_action,
|
|
rollback_target_plugin_installation, runtime_state_from_status_label,
|
|
};
|
|
pub use domain::TargetDomain;
|
|
pub use error::{StoreError, TargetError};
|
|
pub use manifest::{
|
|
SUPPORTED_PLUGIN_API_COMPATIBILITY_VERSION, TargetPluginArtifactManifest, TargetPluginDistributionManifest,
|
|
TargetPluginEntrypointKind, TargetPluginExternalRuntimeContract, TargetPluginManifest, TargetPluginMarketplaceManifest,
|
|
TargetPluginPackaging, TargetPluginRuntimeTransport, builtin_target_marketplace_manifest,
|
|
installable_target_marketplace_manifest,
|
|
};
|
|
pub use net::*;
|
|
pub use plugin::{
|
|
BuiltinTargetAdminDescriptor, BuiltinTargetDescriptor, PluginEvent, TargetAdminMetadata, TargetPluginDescriptor,
|
|
TargetPluginRegistry, TargetRequestValidator, boxed_target,
|
|
};
|
|
pub use runtime::{
|
|
ReplayEvent, ReplayWorkerManager, RuntimeActivation, RuntimeStatusSnapshot, RuntimeTargetHealthSnapshot,
|
|
RuntimeTargetHealthState, RuntimeTargetSnapshot, SharedTarget, TargetRuntimeManager, activate_targets_with_replay,
|
|
adapter::{BuiltinPluginRuntimeAdapter, PluginRuntimeAdapter},
|
|
init_target_and_optionally_start_replay,
|
|
ops_diagnostics::{
|
|
OpsDiagnosticsAccessDecision, OpsDiagnosticsReadRequest, OpsDiagnosticsRegistration, OpsDiagnosticsRegistry,
|
|
OpsDiagnosticsRegistryError,
|
|
},
|
|
ops_profiler::{
|
|
OpsProfilerAccessDecision, OpsProfilerReadRequest, OpsProfilerRegistration, OpsProfilerRegistry, OpsProfilerRegistryError,
|
|
},
|
|
s3_hooks::{S3HookContext, S3HookDecision, S3HookDispatchOutcome, S3HookRegistration, S3HookRegistry, S3HookRegistryError},
|
|
sidecar::{SidecarPluginRuntime, SidecarRuntimePolicy, SidecarRuntimePolicyError, SidecarRuntimeSafetyChecks},
|
|
sidecar_protocol::{SIDECAR_RUNTIME_PROTOCOL_VERSION, SidecarHandshake, SidecarPluginCapability},
|
|
start_replay_worker,
|
|
};
|
|
pub use rustfs_s3_types::EventName;
|
|
use serde::{Deserialize, Serialize};
|
|
pub use sys::user_agent::*;
|
|
pub use target::{Target, TargetDeliverySnapshot};
|
|
|
|
/// Represents a log of events for sending to targets
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
#[serde(rename_all = "PascalCase")]
|
|
pub struct TargetLog<E> {
|
|
/// The event name
|
|
pub event_name: EventName,
|
|
/// The object key
|
|
pub key: String,
|
|
/// The list of events
|
|
pub records: Vec<E>,
|
|
}
|