mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-17 18:27:49 +00:00
Zhengchao An
a9691b6797
backlog#1823 step 10, batch 1 of the repo-wide item-allow sweep. 227 bare #[allow(dead_code)] remain across 83 files; this takes the 19 in utils, notify, checksums, policy, keystone and trusted-proxies, which are small enough to verify end to end. Removing all 19 first, before writing any reason, matters: 8 of them suppress nothing. Every allow in utils, one in policy and three in notify sit on items that are publicly reachable, so dead_code never applied to them — the same shape as the swift module and kms's dek.rs. Writing a reason onto a no-op allow would dress noise up as considered judgement, so those are simply deleted. Three items are genuinely dead and go with their allows: notify's new_target_id_set, the AWS metadata fetcher's get_metadata_token, and policy's empty `pub struct Value;`, none of which is referenced anywhere in the tree. The remaining eight keep an allow, now saying why the item survives rather than who calls it. Two are exercised only by their own crate's tests (checksums' MD5_HEADER_NAME, policy's is_match_as_pattern_prefix). Four are fields written but never read back: keystone's verify_ssl, parsed from config after the reqwest client is already built; keystone's client handle, which keeps the Keystone client alive for the mapper's lifetime; the AWS IMDS endpoint, kept beside the client while requests build their own URLs; and notify's rules_map, whose own comment retains it for snapshot-time judgements no code performs. checksums' Md5 needed the most care. Crc32, Sha256 and seven others each have an arm in ChecksumAlgorithm::into_impl, and Md5 has none, which reads like a missing algorithm. It is not: ChecksumAlgorithm has no Md5 variant at all. S3 carries Content-MD5 as its own header, separate from the x-amz-checksum-* family, and this impl exists so both paths share the Checksum trait. The reason records that, so the next reader does not re-derive it. One measurement note for anyone continuing this sweep: cargo does not re-emit warnings for cached compilations, so a per-crate loop of `cargo check -p <crate>` under-reports. checksums showed zero that way while actually carrying three. Touch the sources and check the crates in one invocation, then attribute by path. Verification: the six crates are warning-free under cargo check --tests; clippy --lib --tests -D warnings clean; cargo nextest run 1096 passed; make pre-commit exit 0. Ref rustfs/backlog#1823 (step 10).
91 lines
3.2 KiB
Rust
91 lines
3.2 KiB
Rust
// Copyright 2024 RustFS Team
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
//! Environment variable configuration constants and helpers for the trusted proxy system.
|
|
|
|
use crate::ConfigError;
|
|
use ipnetwork::IpNetwork;
|
|
use rustfs_config::{
|
|
ENV_TRUSTED_PROXY_CHAIN_CONTINUITY_CHECK, ENV_TRUSTED_PROXY_CLOUD_METADATA_ENABLED, ENV_TRUSTED_PROXY_CLOUD_METADATA_TIMEOUT,
|
|
ENV_TRUSTED_PROXY_CLOUDFLARE_IPS_ENABLED, ENV_TRUSTED_PROXY_ENABLE_RFC7239, ENV_TRUSTED_PROXY_ENABLED,
|
|
ENV_TRUSTED_PROXY_EXTRA_PROXIES, ENV_TRUSTED_PROXY_IMPLEMENTATION, ENV_TRUSTED_PROXY_IPS, ENV_TRUSTED_PROXY_MAX_HOPS,
|
|
ENV_TRUSTED_PROXY_PROXIES, ENV_TRUSTED_PROXY_VALIDATION_MODE,
|
|
};
|
|
use std::str::FromStr;
|
|
// ==================== Helper Functions ====================
|
|
|
|
/// Parses a comma-separated list of IP/CIDR strings from an environment variable.
|
|
pub fn parse_ip_list_from_env(key: &str, default: &str) -> Result<Vec<IpNetwork>, ConfigError> {
|
|
let value = std::env::var(key).unwrap_or_else(|_| default.to_string());
|
|
|
|
if value.trim().is_empty() {
|
|
return Ok(Vec::new());
|
|
}
|
|
|
|
let mut networks = Vec::new();
|
|
for item in value.split(',') {
|
|
let item = item.trim();
|
|
if item.is_empty() {
|
|
continue;
|
|
}
|
|
|
|
match IpNetwork::from_str(item) {
|
|
Ok(network) => networks.push(network),
|
|
Err(e) => {
|
|
tracing::warn!("Failed to parse network '{}' from environment variable {}: {}", item, key, e);
|
|
}
|
|
}
|
|
}
|
|
|
|
Ok(networks)
|
|
}
|
|
|
|
/// Parses a comma-separated list of strings from an environment variable.
|
|
pub fn parse_string_list_from_env(key: &str, default: &str) -> Vec<String> {
|
|
let value = std::env::var(key).unwrap_or_else(|_| default.to_string());
|
|
|
|
value
|
|
.split(',')
|
|
.map(|s| s.trim().to_string())
|
|
.filter(|s| !s.is_empty())
|
|
.collect()
|
|
}
|
|
|
|
/// Checks if an environment variable is set.
|
|
pub fn is_env_set(key: &str) -> bool {
|
|
std::env::var(key).is_ok()
|
|
}
|
|
|
|
/// Returns a list of all proxy-related environment variables and their current values.
|
|
pub fn get_all_proxy_env_vars() -> Vec<(String, String)> {
|
|
let vars = [
|
|
ENV_TRUSTED_PROXY_ENABLED,
|
|
ENV_TRUSTED_PROXY_IMPLEMENTATION,
|
|
ENV_TRUSTED_PROXY_VALIDATION_MODE,
|
|
ENV_TRUSTED_PROXY_ENABLE_RFC7239,
|
|
ENV_TRUSTED_PROXY_MAX_HOPS,
|
|
ENV_TRUSTED_PROXY_CHAIN_CONTINUITY_CHECK,
|
|
ENV_TRUSTED_PROXY_PROXIES,
|
|
ENV_TRUSTED_PROXY_EXTRA_PROXIES,
|
|
ENV_TRUSTED_PROXY_IPS,
|
|
ENV_TRUSTED_PROXY_CLOUD_METADATA_ENABLED,
|
|
ENV_TRUSTED_PROXY_CLOUD_METADATA_TIMEOUT,
|
|
ENV_TRUSTED_PROXY_CLOUDFLARE_IPS_ENABLED,
|
|
];
|
|
|
|
vars.iter()
|
|
.filter_map(|&key| std::env::var(key).ok().map(|value| (key.to_string(), value)))
|
|
.collect()
|
|
}
|