mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-06 05:17:42 +00:00
Zhengchao An
eb02486574
security(swift): remove placeholder SSE module (backlog#646)
The Swift `encryption` module was a non-functional stub: `encrypt_data`
returned the plaintext unchanged while labeling it AES-256-GCM in the
object metadata, and `generate_iv` derived the IV from a timestamp
rather than a CSPRNG. It had no production caller (only a `pub mod`
declaration and one integration test), so wiring it in as-is would have
silently shipped plaintext advertised as ciphertext.
We are not supporting Swift server-side encryption for now, so remove
the module outright rather than keep a dangerous stub around:
- delete crates/protocols/src/swift/encryption.rs
- drop `pub mod encryption;` from swift/mod.rs
- remove the encryption case (and unused import) from the swift
integration test
The module reached main dubiously: it was introduced together with the
whole Swift API in commit 86e93624 ("fix(heal): canonicalize scanner
object-dir repairs (#3864)"), a 1665-file squash whose PR description
only covered the heal change and never mentioned Swift or SSE.
Verified: cargo fmt; cargo test -p rustfs-protocols --features swift
--test swift_simple_integration (10 passed); arch guardrail scripts pass.
69 lines
2.2 KiB
Rust
69 lines
2.2 KiB
Rust
// Copyright 2024 RustFS Team
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
//! OpenStack Swift API implementation
|
|
//!
|
|
//! This module provides support for the OpenStack Swift object storage API,
|
|
//! enabling RustFS to serve as a Swift-compatible storage backend while
|
|
//! reusing the existing S3 storage layer.
|
|
//!
|
|
//! # Architecture
|
|
//!
|
|
//! Swift requests follow the pattern: `/v1/{account}/{container}/{object}`
|
|
//! where:
|
|
//! - `account`: Tenant identifier (e.g., `AUTH_{project_id}`)
|
|
//! - `container`: Swift container (maps to S3 bucket)
|
|
//! - `object`: Object key (maps to S3 object key)
|
|
//!
|
|
//! # Authentication
|
|
//!
|
|
//! Swift API uses Keystone token-based authentication via the existing
|
|
//! `KeystoneAuthMiddleware`. The middleware validates X-Auth-Token headers
|
|
//! and stores credentials in task-local storage, which Swift handlers access
|
|
//! to enforce tenant isolation.
|
|
|
|
pub mod account;
|
|
pub mod acl;
|
|
pub mod bulk;
|
|
pub mod container;
|
|
pub mod cors;
|
|
pub mod dlo;
|
|
pub mod errors;
|
|
pub mod expiration;
|
|
pub mod expiration_worker;
|
|
pub mod formpost;
|
|
pub mod handler;
|
|
pub mod object;
|
|
pub mod quota;
|
|
pub mod ratelimit;
|
|
pub mod router;
|
|
pub mod slo;
|
|
pub mod staticweb;
|
|
mod storage_api;
|
|
pub mod symlink;
|
|
pub mod sync;
|
|
pub mod tempurl;
|
|
pub mod types;
|
|
pub mod versioning;
|
|
|
|
pub use errors::{SwiftError, SwiftResult};
|
|
pub use router::{SwiftRoute, SwiftRouter};
|
|
// Note: Container, Object, and SwiftMetadata types used by Swift implementation
|
|
pub use storage_api::public_api::{SwiftGetObjectReader, SwiftObjectInfo, SwiftObjectOptions, SwiftPutObjReader};
|
|
pub(crate) use storage_api::public_api::{
|
|
get_swift_bucket_metadata, resolve_swift_object_store_handle, set_swift_bucket_metadata,
|
|
};
|
|
#[allow(unused_imports)]
|
|
pub use types::{Container, Object, SwiftMetadata};
|