mirror of
https://github.com/rustfs/rustfs.git
synced 2026-09-06 03:59:14 +00:00
overtrue
9f87867495
The initial fix (routing all warm-tier constructors through validate_outbound_url) rejected the hermetic reliant::tiering e2e suite's real hot->cold connection over 127.0.0.1, since two embedded RustFS servers in that suite talk to each other over loopback by design. validate_outbound_url has no override; OutboundPolicy (already used by webhook targets and OIDC discovery URLs) enforces the identical default restrictions but lets an operator allowlist one exact origin via RUSTFS_OUTBOUND_ALLOW_ORIGINS -- metadata, link-local, and unspecified addresses can never be allowlisted, so this does not reopen the SSRF gap the previous commit closed. Switch every warm-tier constructor (including S3, which folds Wasabi in via new_with_bucket_lookup) to this policy through one shared crates/ecstore/src/services/tier/ warm_backend.rs::validate_tier_endpoint_url helper, replacing the nine scattered validate_outbound_url call sites the previous commit added and consolidating their error(format!) ratchet accounting into one file. Update the e2e suite to set RUSTFS_OUTBOUND_ALLOW_ORIGINS to the cold node's real origin before starting/restarting hot, via a hot_env_for_tier helper, and fix the resulting borrow-checker conflict in the one test that stops cold mid-test by cloning its origin into an owned String first. Also retarget a WarmBackendRustFS unit test that asserted on a now-unreachable local host-missing message: the shared policy's http(s)-only scheme check runs first and is now what actually rejects that fixture's non-http endpoint. Impact: operators with an existing self-hosted RustFS/MinIO/etc. tier whose endpoint is a bare loopback/private/link-local IP literal (not a hostname) need RUSTFS_OUTBOUND_ALLOW_ORIGINS=<origin> set and the server restarted to keep that tier working after this change.