mirror of
https://github.com/rustfs/rustfs.git
synced 2026-09-06 03:59:14 +00:00
overtrue
9f87867495
The initial fix (routing all warm-tier constructors through validate_outbound_url) rejected the hermetic reliant::tiering e2e suite's real hot->cold connection over 127.0.0.1, since two embedded RustFS servers in that suite talk to each other over loopback by design. validate_outbound_url has no override; OutboundPolicy (already used by webhook targets and OIDC discovery URLs) enforces the identical default restrictions but lets an operator allowlist one exact origin via RUSTFS_OUTBOUND_ALLOW_ORIGINS -- metadata, link-local, and unspecified addresses can never be allowlisted, so this does not reopen the SSRF gap the previous commit closed. Switch every warm-tier constructor (including S3, which folds Wasabi in via new_with_bucket_lookup) to this policy through one shared crates/ecstore/src/services/tier/ warm_backend.rs::validate_tier_endpoint_url helper, replacing the nine scattered validate_outbound_url call sites the previous commit added and consolidating their error(format!) ratchet accounting into one file. Update the e2e suite to set RUSTFS_OUTBOUND_ALLOW_ORIGINS to the cold node's real origin before starting/restarting hot, via a hot_env_for_tier helper, and fix the resulting borrow-checker conflict in the one test that stops cold mid-test by cloning its origin into an owned String first. Also retarget a WarmBackendRustFS unit test that asserted on a now-unreachable local host-missing message: the shared policy's http(s)-only scheme check runs first and is now what actually rejects that fixture's non-http endpoint. Impact: operators with an existing self-hosted RustFS/MinIO/etc. tier whose endpoint is a bare loopback/private/link-local IP literal (not a hostname) need RUSTFS_OUTBOUND_ALLOW_ORIGINS=<origin> set and the server restarted to keep that tier working after this change.
74 lines
3.5 KiB
Plaintext
74 lines
3.5 KiB
Plaintext
# `::other(format!` ratchet baseline for crates/ecstore/src (backlog#1845 PR2).
|
|
#
|
|
# SHRINK-ONLY: entries are `count|file`. A PR may lower a count or drop a file
|
|
# (after replacing the call sites with typed variants) by re-running
|
|
# scripts/check_error_other_format_ratchet.sh --update-baseline. A PR that
|
|
# raises a count or adds a file is introducing a new quorum-bucketing hazard
|
|
# and must carry an explicit exemption rationale in its description.
|
|
2|crates/ecstore/src/bucket/bucket_target_sys.rs
|
|
4|crates/ecstore/src/bucket/lifecycle/bucket_lifecycle_ops.rs
|
|
3|crates/ecstore/src/bucket/lifecycle/durable_namespace.rs
|
|
2|crates/ecstore/src/bucket/lifecycle/metadata_boundary.rs
|
|
4|crates/ecstore/src/bucket/lifecycle/tier_delete_journal.rs
|
|
1|crates/ecstore/src/bucket/lifecycle/transition_transaction.rs
|
|
27|crates/ecstore/src/bucket/metadata.rs
|
|
22|crates/ecstore/src/bucket/metadata_sys.rs
|
|
3|crates/ecstore/src/bucket/msgp_decode.rs
|
|
1|crates/ecstore/src/bucket/object_lock/objectlock_sys.rs
|
|
3|crates/ecstore/src/bucket/quota/reservation.rs
|
|
1|crates/ecstore/src/bucket/replication/replication_object_config.rs
|
|
2|crates/ecstore/src/bucket/replication/replication_pool.rs
|
|
2|crates/ecstore/src/bucket/replication/replication_target_boundary.rs
|
|
3|crates/ecstore/src/cluster/rpc/http_auth.rs
|
|
2|crates/ecstore/src/cluster/rpc/internode_data_transport.rs
|
|
11|crates/ecstore/src/cluster/rpc/peer_rest_client.rs
|
|
10|crates/ecstore/src/cluster/rpc/peer_s3_client.rs
|
|
10|crates/ecstore/src/cluster/rpc/remote_disk.rs
|
|
6|crates/ecstore/src/config/com.rs
|
|
14|crates/ecstore/src/config/storageclass.rs
|
|
185|crates/ecstore/src/core/pools.rs
|
|
8|crates/ecstore/src/data_movement/mod.rs
|
|
2|crates/ecstore/src/data_usage/local_snapshot.rs
|
|
12|crates/ecstore/src/data_usage/mod.rs
|
|
5|crates/ecstore/src/disk/local.rs
|
|
1|crates/ecstore/src/disk/mod.rs
|
|
5|crates/ecstore/src/erasure/codec/bridge.rs
|
|
1|crates/ecstore/src/erasure/coding/decode_reader.rs
|
|
10|crates/ecstore/src/erasure/coding/encode.rs
|
|
25|crates/ecstore/src/erasure/coding/erasure.rs
|
|
4|crates/ecstore/src/layout/disks_layout.rs
|
|
2|crates/ecstore/src/layout/endpoint.rs
|
|
17|crates/ecstore/src/layout/endpoints.rs
|
|
1|crates/ecstore/src/layout/format.rs
|
|
1|crates/ecstore/src/layout/pool_space.rs
|
|
1|crates/ecstore/src/layout/set_layout.rs
|
|
19|crates/ecstore/src/object_api/readers.rs
|
|
1|crates/ecstore/src/object_api/types.rs
|
|
3|crates/ecstore/src/runtime/sources.rs
|
|
4|crates/ecstore/src/services/batch_processor.rs
|
|
14|crates/ecstore/src/services/notification_sys.rs
|
|
16|crates/ecstore/src/services/rebalance/control.rs
|
|
1|crates/ecstore/src/services/rebalance/entry.rs
|
|
8|crates/ecstore/src/services/rebalance/meta.rs
|
|
8|crates/ecstore/src/services/rebalance/runtime.rs
|
|
19|crates/ecstore/src/services/rebalance/worker.rs
|
|
33|crates/ecstore/src/services/tier/tier.rs
|
|
1|crates/ecstore/src/services/tier/tier_config.rs
|
|
2|crates/ecstore/src/services/tier/warm_backend.rs
|
|
1|crates/ecstore/src/services/tier/warm_backend_gcs.rs
|
|
1|crates/ecstore/src/services/tier/warm_backend_wasabi.rs
|
|
7|crates/ecstore/src/set_disk/core/io_primitives.rs
|
|
1|crates/ecstore/src/set_disk/mod.rs
|
|
3|crates/ecstore/src/set_disk/ops/bitrot_self_verify.rs
|
|
2|crates/ecstore/src/set_disk/ops/heal.rs
|
|
8|crates/ecstore/src/set_disk/ops/multipart.rs
|
|
2|crates/ecstore/src/set_disk/ops/object.rs
|
|
3|crates/ecstore/src/set_disk/read.rs
|
|
5|crates/ecstore/src/store/bucket.rs
|
|
1|crates/ecstore/src/store/heal_walk.rs
|
|
12|crates/ecstore/src/store/init.rs
|
|
2|crates/ecstore/src/store/init_format.rs
|
|
3|crates/ecstore/src/store/multipart.rs
|
|
8|crates/ecstore/src/store/object.rs
|
|
5|crates/ecstore/src/store/rebalance/support.rs
|