mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-28 19:24:58 +08:00
Zhengchao An
db57fabcbd
WarmBackendS3::new already rejects loopback, private, link-local, and cloud metadata-service endpoints via validate_outbound_url, but the Aliyun, Azure, Huaweicloud, Tencent, MinIO, R2, RustFS, and GCS warm backend constructors built their transition clients directly from conf.endpoint without the same check. The endpoint comes from the AddTier admin API, gated only by SetTierAction, which can be a narrower IAM grant than root. Any principal holding it could point one of these eight tier types at an internal address (loopback, RFC1918, link-local, or a cloud metadata IP) and have the server issue authenticated outbound requests to it, a server-side SSRF vector that the S3 and Wasabi tier types were already closed against. Apply the same validate_outbound_url check at construction time for all eight providers, before any credentials or network client are built, mirroring the existing WarmBackendS3 pattern. GCS keeps its default-endpoint behavior when conf.endpoint is empty and only validates an explicitly configured endpoint. Add a regression test per provider asserting that a loopback endpoint is rejected before any backend/network setup, matching the existing WarmBackendS3 coverage. Update the error(format!) ratchet baseline: these are one-shot admin tier-configuration validation errors returned once per AddTier call, not per-disk I/O errors that flow through reduce_errs quorum aggregation (backlog#1845), so the new ::other(format!) call sites do not introduce a quorum-bucketing hazard. They mirror the pre-existing, already-baselined warm_backend_s3.rs call site.
81 lines
3.9 KiB
Plaintext
81 lines
3.9 KiB
Plaintext
# `::other(format!` ratchet baseline for crates/ecstore/src (backlog#1845 PR2).
|
|
#
|
|
# SHRINK-ONLY: entries are `count|file`. A PR may lower a count or drop a file
|
|
# (after replacing the call sites with typed variants) by re-running
|
|
# scripts/check_error_other_format_ratchet.sh --update-baseline. A PR that
|
|
# raises a count or adds a file is introducing a new quorum-bucketing hazard
|
|
# and must carry an explicit exemption rationale in its description.
|
|
2|crates/ecstore/src/bucket/bucket_target_sys.rs
|
|
4|crates/ecstore/src/bucket/lifecycle/bucket_lifecycle_ops.rs
|
|
3|crates/ecstore/src/bucket/lifecycle/durable_namespace.rs
|
|
2|crates/ecstore/src/bucket/lifecycle/metadata_boundary.rs
|
|
4|crates/ecstore/src/bucket/lifecycle/tier_delete_journal.rs
|
|
1|crates/ecstore/src/bucket/lifecycle/transition_transaction.rs
|
|
27|crates/ecstore/src/bucket/metadata.rs
|
|
22|crates/ecstore/src/bucket/metadata_sys.rs
|
|
3|crates/ecstore/src/bucket/msgp_decode.rs
|
|
1|crates/ecstore/src/bucket/object_lock/objectlock_sys.rs
|
|
3|crates/ecstore/src/bucket/quota/reservation.rs
|
|
1|crates/ecstore/src/bucket/replication/replication_object_config.rs
|
|
2|crates/ecstore/src/bucket/replication/replication_pool.rs
|
|
2|crates/ecstore/src/bucket/replication/replication_target_boundary.rs
|
|
3|crates/ecstore/src/cluster/rpc/http_auth.rs
|
|
2|crates/ecstore/src/cluster/rpc/internode_data_transport.rs
|
|
11|crates/ecstore/src/cluster/rpc/peer_rest_client.rs
|
|
10|crates/ecstore/src/cluster/rpc/peer_s3_client.rs
|
|
10|crates/ecstore/src/cluster/rpc/remote_disk.rs
|
|
6|crates/ecstore/src/config/com.rs
|
|
14|crates/ecstore/src/config/storageclass.rs
|
|
185|crates/ecstore/src/core/pools.rs
|
|
8|crates/ecstore/src/data_movement/mod.rs
|
|
2|crates/ecstore/src/data_usage/local_snapshot.rs
|
|
12|crates/ecstore/src/data_usage/mod.rs
|
|
5|crates/ecstore/src/disk/local.rs
|
|
1|crates/ecstore/src/disk/mod.rs
|
|
5|crates/ecstore/src/erasure/codec/bridge.rs
|
|
1|crates/ecstore/src/erasure/coding/decode_reader.rs
|
|
10|crates/ecstore/src/erasure/coding/encode.rs
|
|
25|crates/ecstore/src/erasure/coding/erasure.rs
|
|
4|crates/ecstore/src/layout/disks_layout.rs
|
|
2|crates/ecstore/src/layout/endpoint.rs
|
|
17|crates/ecstore/src/layout/endpoints.rs
|
|
1|crates/ecstore/src/layout/format.rs
|
|
1|crates/ecstore/src/layout/pool_space.rs
|
|
1|crates/ecstore/src/layout/set_layout.rs
|
|
19|crates/ecstore/src/object_api/readers.rs
|
|
1|crates/ecstore/src/object_api/types.rs
|
|
3|crates/ecstore/src/runtime/sources.rs
|
|
4|crates/ecstore/src/services/batch_processor.rs
|
|
14|crates/ecstore/src/services/notification_sys.rs
|
|
16|crates/ecstore/src/services/rebalance/control.rs
|
|
1|crates/ecstore/src/services/rebalance/entry.rs
|
|
8|crates/ecstore/src/services/rebalance/meta.rs
|
|
8|crates/ecstore/src/services/rebalance/runtime.rs
|
|
19|crates/ecstore/src/services/rebalance/worker.rs
|
|
33|crates/ecstore/src/services/tier/tier.rs
|
|
1|crates/ecstore/src/services/tier/tier_config.rs
|
|
1|crates/ecstore/src/services/tier/warm_backend_aliyun.rs
|
|
1|crates/ecstore/src/services/tier/warm_backend_azure.rs
|
|
2|crates/ecstore/src/services/tier/warm_backend_gcs.rs
|
|
1|crates/ecstore/src/services/tier/warm_backend_huaweicloud.rs
|
|
1|crates/ecstore/src/services/tier/warm_backend_minio.rs
|
|
1|crates/ecstore/src/services/tier/warm_backend_r2.rs
|
|
1|crates/ecstore/src/services/tier/warm_backend_rustfs.rs
|
|
1|crates/ecstore/src/services/tier/warm_backend_s3.rs
|
|
1|crates/ecstore/src/services/tier/warm_backend_tencent.rs
|
|
1|crates/ecstore/src/services/tier/warm_backend_wasabi.rs
|
|
7|crates/ecstore/src/set_disk/core/io_primitives.rs
|
|
1|crates/ecstore/src/set_disk/mod.rs
|
|
3|crates/ecstore/src/set_disk/ops/bitrot_self_verify.rs
|
|
2|crates/ecstore/src/set_disk/ops/heal.rs
|
|
8|crates/ecstore/src/set_disk/ops/multipart.rs
|
|
2|crates/ecstore/src/set_disk/ops/object.rs
|
|
3|crates/ecstore/src/set_disk/read.rs
|
|
5|crates/ecstore/src/store/bucket.rs
|
|
1|crates/ecstore/src/store/heal_walk.rs
|
|
12|crates/ecstore/src/store/init.rs
|
|
2|crates/ecstore/src/store/init_format.rs
|
|
3|crates/ecstore/src/store/multipart.rs
|
|
8|crates/ecstore/src/store/object.rs
|
|
5|crates/ecstore/src/store/rebalance/support.rs
|