mirror of
https://github.com/rustfs/rustfs.git
synced 2026-10-12 07:39:05 +00:00
GatewayJ
46 lines
2.7 KiB
Markdown
46 lines
2.7 KiB
Markdown
# FTPS uploads
|
|
|
|
FTPS `STOR` buffers at most one 16 MiB payload chunk per active upload in the
|
|
protocol driver. It waits for the storage backend to consume each chunk before
|
|
reading the next. Backend, TLS, connection, and allocator overhead are additional;
|
|
this is not a process-wide memory limit. Concurrent uploads each have their own
|
|
buffer.
|
|
|
|
Files smaller than 16 MiB, including empty files, use `PutObject`. Files at or
|
|
above that threshold use sequential S3 multipart uploads, so they can exceed the
|
|
5 GiB single-`PutObject` limit. Multipart ETags differ from single-PUT ETags and
|
|
must not be interpreted as a whole-file MD5 checksum. An upload is successful only
|
|
after the multipart completion succeeds. The fixed part size and S3's 10,000-part
|
|
limit allow up to 156.25 GiB per FTPS upload; a larger input fails and cleanup is
|
|
attempted. Resuming or appending with a nonzero offset remains unsupported.
|
|
|
|
Each write operation requires `s3:PutObject`. Failed or cancelled transfers also
|
|
attempt `s3:AbortMultipartUpload` using the authenticated user's permissions;
|
|
cleanup does not bypass IAM. Grant that permission on the upload prefix to allow
|
|
immediate cleanup. Cancellation cleanup has a bounded task count and timeout.
|
|
Configure an `AbortIncompleteMultipartUpload` bucket lifecycle rule as a fallback
|
|
for denied/failed cleanup, process crashes, or losing the upload ID while upload
|
|
initiation is in flight. Before completion, received parts do not replace an existing completed object.
|
|
A lost or failed completion response may have an ambiguous outcome; clients
|
|
should verify the destination before retrying.
|
|
|
|
## Authorization
|
|
|
|
FTP and FTPS operations use RustFS's S3 IAM and bucket-policy evaluator. An
|
|
applicable bucket-policy Deny blocks an operation even when an identity policy
|
|
allows it. Source-IP conditions use the FTP control connection's peer address;
|
|
concurrent sessions using the same access key retain their own addresses.
|
|
|
|
`aws:SecureTransport` is true when the control connection uses TLS and the
|
|
listener requires TLS for data connections. With optional data-channel TLS,
|
|
the authorization context conservatively reports false because the driver's
|
|
operation interface does not expose the data connection's negotiated state.
|
|
HTTP-only attributes such as `UserAgent` and `Referer` are absent and retain
|
|
normal policy missing-key semantics.
|
|
|
|
Directory listing conditions (`s3:prefix`, `s3:delimiter`, and `s3:max-keys`) use the actual `ListObjectsV2` parameters. Directory prefixes include their trailing `/`. Each listing page checks the current policies.
|
|
|
|
Upgrades enforce restrictions that older protocol listeners could bypass.
|
|
Previously accepted operations can therefore return permission denied. No
|
|
object format or policy migration is required.
|