mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-07-20 15:02:27 +00:00
9ae905e456
* feat(security): hot-reload HTTPS certs for master/volume/filer/webdav/admin S3 and filer already use a refreshing pemfile provider for their HTTPS cert, so rotated certificates (e.g. from k8s cert-manager) are picked up without a restart. Master, volume, webdav, and admin, however, passed cert/key paths straight to ServeTLS/ListenAndServeTLS and loaded once at startup — rotating those certs required a pod restart. Add a small helper NewReloadingServerCertificate in weed/security that wraps pemfile.Provider and returns a tls.Config.GetCertificate closure, then wire it into the four remaining HTTPS entry points. httpdown now also calls ServeTLS when TLSConfig carries a GetCertificate/Certificates but CertFile/KeyFile are empty, so volume server can pre-populate TLSConfig. A unit test exercises the rotation path (write cert, rotate on disk, assert the callback returns the new cert) with a short refresh window. * refactor(security): route filer/s3 HTTPS through the shared cert reloader Before: filer.go and s3.go each kept a *certprovider.Provider on the options struct plus a duplicated GetCertificateWithUpdate method. Both were loading pemfile themselves. Behaviorally they already reloaded, but the logic was duplicated two ways and neither path was shared with the newly-added master/volume/webdav/admin wiring. After: both use security.NewReloadingServerCertificate like the other servers. The per-struct certProvider field and GetCertificateWithUpdate method are removed, along with the now-unused certprovider and pemfile imports. Net: -32 lines, one code path for all HTTPS cert reloading. No behavior change — the refresh window, cache, and handshake contract are identical (the helper wraps the same pemfile.NewProvider). * feat(security): hot-reload HTTPS client certs for mount/backup/upload/etc The HTTP client in weed/util/http/client loaded the mTLS client cert once at startup via tls.LoadX509KeyPair. That left every long-lived HTTPS client process (weed mount, backup, filer.copy, filer→volume, s3→filer/volume) unable to pick up a rotated client cert without a restart — even though the same cert-manager setup was already rotating the server side fine. Swap the client cert loader for a tls.Config.GetClientCertificate callback backed by the same refreshing pemfile provider. New TLS handshakes pick up the rotated cert; in-flight pooled connections keep their old cert and drop as normal transport churn happens. To keep this reusable from both server and client TLS code without an import cycle (weed/security already imports weed/util/http/client for LoadHTTPClientFromFile), extract the pemfile wrapper into a new weed/security/certreload subpackage. weed/security keeps its thin NewReloadingServerCertificate wrapper. The existing unit test moves with the implementation. gRPC mTLS was already handled by security.LoadServerTLS / LoadClientTLS; this PR does not change any gRPC paths. MQ broker, MQ agent, Kafka gateway, and FUSE mount control plane are gRPC-only and therefore already rotate. CA bundles (ClientCAs / RootCAs / grpc.ca) are still loaded once — noted as a known limitation in the wiki. * fix(security): address PR review feedback on cert reloader Bots (gemini-code-assist + coderabbit) flagged three real issues and a couple of nits. Addressing them here: 1. KeyMaterial used context.Background(). The grpc pemfile provider's KeyMaterial blocks until material arrives or the context deadline expires; with Background() a slow disk could hang the TLS handshake indefinitely. Switched both the server and client callbacks to use hello.Context() / cri.Context() so a stuck read is bounded by the handshake timeout. 2. Admin server loaded TLS inside the serve goroutine. If the cert was bad, the goroutine returned but startAdminServer kept blocking on <-ctx.Done() with no listener, making the process look healthy with nothing bound. Moved TLS setup to run before the goroutine starts and propagate errors via fmt.Errorf; also captures the provider and defers Close(). 3. HTTP client discarded the certprovider.Provider from NewClientGetCertificate. That leaked the refresh goroutine, and NewHttpClientWithTLS had a worse case where a CA-file failure after provider creation orphaned the provider entirely. Added a certProvider field and a Close() method on HTTPClient, and made the constructors close the provider on subsequent error paths. 4. Server-side paths (master/volume/filer/s3/webdav/admin) now retain the provider. filer and webdav run ServeTLS synchronously, so a plain defer works. master/volume/s3 dispatch goroutines and return while the server keeps running, so they hook Close() into grace.OnInterrupt. 5. Test: certreload_test now tolerates transient read/parse errors during file rotation (writeSelfSigned rewrites cert before key) and reports the last error only if the deadline expires. No user-visible behavior change for the happy path. * test(tls): add end-to-end HTTPS cert rotation integration test Boots a real `weed master` with HTTPS enabled, captures the leaf cert served at TLS handshake time, atomically rewrites the cert/key files on disk (the same rename-in-place pattern kubelet does when it swaps a cert-manager Secret), and asserts that a subsequent TLS handshake observes the rotated leaf — with no process restart, no SIGHUP, no reloader sidecar. Verifies the full path: on-disk change → pemfile refresh tick → provider.KeyMaterial → tls.Config.GetCertificate → server TLS handshake. Runtime is ~1s by exposing the reloader's refresh window as an env var (WEED_TLS_CERT_REFRESH_INTERVAL) and setting it to 500ms for the test. The same env var is user-facing — documented in the wiki — so operators running short-lived certs (Vault, cert-manager with duration: 24h, etc.) can tighten the rotation-pickup window without a rebuild. Defaults to 5h to preserve prior behavior. security.CredRefreshingInterval is kept for API compatibility but now aliases certreload.DefaultRefreshInterval so the same env controls both gRPC mTLS and HTTPS reload. * ci(tls): wire the TLS rotation integration test into GitHub Actions Mirrors the existing vacuum-integration-tests.yml shape: Ubuntu runner, Go 1.25, build weed, run `go test` in test/tls_rotation, upload master logs on failure. 10-minute job timeout; the test itself finishes in about a second because WEED_TLS_CERT_REFRESH_INTERVAL is set to 500ms inside the test. Runs on every push to master and on every PR to master. * fix(tls): address follow-up PR review comments Three new comments on the integration test + volume shutdown path: 1. Test: peekServerCert was swallowing every dial/handshake error, which meant waitForCert's "last err: <nil>" fatal message lost all diagnostic value. Thread errors back through: peekServerCert now returns (*x509.Certificate, error), and waitForCert records the latest error so a CI flake points at the actual cause (master didn't come up, handshake rejected, CA pool mismatch, etc.). 2. Test: set HOME=<tempdir> on the master subprocess. Viper today registers the literal path "$HOME/.seaweedfs" without env expansion, so a developer's ~/.seaweedfs/security.toml is accidentally invisible — the test was relying on that. Pinning HOME is belt-and-braces against a future viper upgrade that does expand env vars. 3. volume.go: startClusterHttpService's provider close was registered via grace.OnInterrupt, which fires on SIGTERM but NOT on the v.shutdownCtx.Done() path used by mini / integration tests. The pemfile refresh goroutine leaked in that shutdown path. Now the helper returns a close func and the caller invokes it on BOTH shutdown paths for parity. Also add MinVersion: TLS 1.2 to the test's tls.Config to quiet the ast-grep static-analysis nit — zero-risk since the pool only trusts our in-memory CA. Test runs clean 3/3.
401 lines
10 KiB
Go
401 lines
10 KiB
Go
// Package httpdown provides http.ConnState enabled graceful termination of
|
|
// http.Server.
|
|
// based on github.com/facebookarchive/httpdown, who's licence is MIT-licence,
|
|
// we add a feature of supporting for http TLS
|
|
package httpdown
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"fmt"
|
|
"net"
|
|
"net/http"
|
|
"os"
|
|
"os/signal"
|
|
"sync"
|
|
"syscall"
|
|
"time"
|
|
|
|
"github.com/facebookgo/clock"
|
|
"github.com/facebookgo/stats"
|
|
)
|
|
|
|
const (
|
|
defaultStopTimeout = time.Minute
|
|
defaultKillTimeout = time.Minute
|
|
)
|
|
|
|
// A Server allows encapsulates the process of accepting new connections and
|
|
// serving them, and gracefully shutting down the listener without dropping
|
|
// active connections.
|
|
type Server interface {
|
|
// Wait waits for the serving loop to finish. This will happen when Stop is
|
|
// called, at which point it returns no error, or if there is an error in the
|
|
// serving loop. You must call Wait after calling Serve or ListenAndServe.
|
|
Wait() error
|
|
|
|
// Stop stops the listener. It will block until all connections have been
|
|
// closed.
|
|
Stop() error
|
|
}
|
|
|
|
// HTTP defines the configuration for serving a http.Server. Multiple calls to
|
|
// Serve or ListenAndServe can be made on the same HTTP instance. The default
|
|
// timeouts of 1 minute each result in a maximum of 2 minutes before a Stop()
|
|
// returns.
|
|
type HTTP struct {
|
|
// StopTimeout is the duration before we begin force closing connections.
|
|
// Defaults to 1 minute.
|
|
StopTimeout time.Duration
|
|
|
|
// KillTimeout is the duration before which we completely give up and abort
|
|
// even though we still have connected clients. This is useful when a large
|
|
// number of client connections exist and closing them can take a long time.
|
|
// Note, this is in addition to the StopTimeout. Defaults to 1 minute.
|
|
KillTimeout time.Duration
|
|
|
|
// Stats is optional. If provided, it will be used to record various metrics.
|
|
Stats stats.Client
|
|
|
|
// Clock allows for testing timing related functionality. Do not specify this
|
|
// in production code.
|
|
Clock clock.Clock
|
|
|
|
// when set CertFile and KeyFile, the httpDown will start a http with TLS.
|
|
// Files containing a certificate and matching private key for the
|
|
// server must be provided if neither the Server's
|
|
// TLSConfig.Certificates nor TLSConfig.GetCertificate are populated.
|
|
// If the certificate is signed by a certificate authority, the
|
|
// certFile should be the concatenation of the server's certificate,
|
|
// any intermediates, and the CA's certificate.
|
|
CertFile, KeyFile string
|
|
}
|
|
|
|
// Serve provides the low-level API which is useful if you're creating your own
|
|
// net.Listener.
|
|
func (h HTTP) Serve(s *http.Server, l net.Listener) Server {
|
|
stopTimeout := h.StopTimeout
|
|
if stopTimeout == 0 {
|
|
stopTimeout = defaultStopTimeout
|
|
}
|
|
killTimeout := h.KillTimeout
|
|
if killTimeout == 0 {
|
|
killTimeout = defaultKillTimeout
|
|
}
|
|
klock := h.Clock
|
|
if klock == nil {
|
|
klock = clock.New()
|
|
}
|
|
|
|
ss := &server{
|
|
stopTimeout: stopTimeout,
|
|
killTimeout: killTimeout,
|
|
stats: h.Stats,
|
|
clock: klock,
|
|
oldConnState: s.ConnState,
|
|
listener: l,
|
|
server: s,
|
|
serveDone: make(chan struct{}),
|
|
serveErr: make(chan error, 1),
|
|
new: make(chan net.Conn),
|
|
active: make(chan net.Conn),
|
|
idle: make(chan net.Conn),
|
|
closed: make(chan net.Conn),
|
|
stop: make(chan chan struct{}),
|
|
kill: make(chan chan struct{}),
|
|
certFile: h.CertFile,
|
|
keyFile: h.KeyFile,
|
|
}
|
|
s.ConnState = ss.connState
|
|
go ss.manage()
|
|
go ss.serve()
|
|
return ss
|
|
}
|
|
|
|
// ListenAndServe returns a Server for the given http.Server. It is equivalent
|
|
// to ListenAndServe from the standard library, but returns immediately.
|
|
// Requests will be accepted in a background goroutine. If the http.Server has
|
|
// a non-nil TLSConfig, a TLS enabled listener will be setup.
|
|
func (h HTTP) ListenAndServe(s *http.Server) (Server, error) {
|
|
addr := s.Addr
|
|
if addr == "" {
|
|
if s.TLSConfig == nil {
|
|
addr = ":http"
|
|
} else {
|
|
addr = ":https"
|
|
}
|
|
}
|
|
l, err := net.Listen("tcp", addr)
|
|
if err != nil {
|
|
stats.BumpSum(h.Stats, "listen.error", 1)
|
|
return nil, err
|
|
}
|
|
if s.TLSConfig != nil {
|
|
l = tls.NewListener(l, s.TLSConfig)
|
|
}
|
|
return h.Serve(s, l), nil
|
|
}
|
|
|
|
// server manages the serving process and allows for gracefully stopping it.
|
|
type server struct {
|
|
stopTimeout time.Duration
|
|
killTimeout time.Duration
|
|
stats stats.Client
|
|
clock clock.Clock
|
|
|
|
oldConnState func(net.Conn, http.ConnState)
|
|
server *http.Server
|
|
serveDone chan struct{}
|
|
serveErr chan error
|
|
listener net.Listener
|
|
|
|
new chan net.Conn
|
|
active chan net.Conn
|
|
idle chan net.Conn
|
|
closed chan net.Conn
|
|
stop chan chan struct{}
|
|
kill chan chan struct{}
|
|
|
|
stopOnce sync.Once
|
|
stopErr error
|
|
|
|
certFile, keyFile string
|
|
}
|
|
|
|
func (s *server) connState(c net.Conn, cs http.ConnState) {
|
|
if s.oldConnState != nil {
|
|
s.oldConnState(c, cs)
|
|
}
|
|
|
|
switch cs {
|
|
case http.StateNew:
|
|
s.new <- c
|
|
case http.StateActive:
|
|
s.active <- c
|
|
case http.StateIdle:
|
|
s.idle <- c
|
|
case http.StateHijacked, http.StateClosed:
|
|
s.closed <- c
|
|
}
|
|
}
|
|
|
|
func (s *server) manage() {
|
|
defer func() {
|
|
close(s.new)
|
|
close(s.active)
|
|
close(s.idle)
|
|
close(s.closed)
|
|
close(s.stop)
|
|
close(s.kill)
|
|
}()
|
|
|
|
var stopDone chan struct{}
|
|
|
|
conns := map[net.Conn]http.ConnState{}
|
|
var countNew, countActive, countIdle float64
|
|
|
|
// decConn decrements the count associated with the current state of the
|
|
// given connection.
|
|
decConn := func(c net.Conn) {
|
|
switch conns[c] {
|
|
default:
|
|
panic(fmt.Errorf("unknown existing connection: %s", c))
|
|
case http.StateNew:
|
|
countNew--
|
|
case http.StateActive:
|
|
countActive--
|
|
case http.StateIdle:
|
|
countIdle--
|
|
}
|
|
}
|
|
|
|
// setup a ticker to report various values every minute. if we don't have a
|
|
// Stats implementation provided, we Stop it so it never ticks.
|
|
statsTicker := s.clock.Ticker(time.Minute)
|
|
if s.stats == nil {
|
|
statsTicker.Stop()
|
|
}
|
|
|
|
for {
|
|
select {
|
|
case <-statsTicker.C:
|
|
// we'll only get here when s.stats is not nil
|
|
s.stats.BumpAvg("http-state.new", countNew)
|
|
s.stats.BumpAvg("http-state.active", countActive)
|
|
s.stats.BumpAvg("http-state.idle", countIdle)
|
|
s.stats.BumpAvg("http-state.total", countNew+countActive+countIdle)
|
|
case c := <-s.new:
|
|
conns[c] = http.StateNew
|
|
countNew++
|
|
case c := <-s.active:
|
|
decConn(c)
|
|
countActive++
|
|
|
|
conns[c] = http.StateActive
|
|
case c := <-s.idle:
|
|
decConn(c)
|
|
countIdle++
|
|
|
|
conns[c] = http.StateIdle
|
|
|
|
// if we're already stopping, close it
|
|
if stopDone != nil {
|
|
c.Close()
|
|
}
|
|
case c := <-s.closed:
|
|
stats.BumpSum(s.stats, "conn.closed", 1)
|
|
decConn(c)
|
|
delete(conns, c)
|
|
|
|
// if we're waiting to stop and are all empty, we just closed the last
|
|
// connection and we're done.
|
|
if stopDone != nil && len(conns) == 0 {
|
|
close(stopDone)
|
|
return
|
|
}
|
|
case stopDone = <-s.stop:
|
|
// if we're already all empty, we're already done
|
|
if len(conns) == 0 {
|
|
close(stopDone)
|
|
return
|
|
}
|
|
|
|
// close current idle connections right away
|
|
for c, cs := range conns {
|
|
if cs == http.StateIdle {
|
|
c.Close()
|
|
}
|
|
}
|
|
|
|
// continue the loop and wait for all the ConnState updates which will
|
|
// eventually close(stopDone) and return from this goroutine.
|
|
|
|
case killDone := <-s.kill:
|
|
// force close all connections
|
|
stats.BumpSum(s.stats, "kill.conn.count", float64(len(conns)))
|
|
for c := range conns {
|
|
c.Close()
|
|
}
|
|
|
|
// don't block the kill.
|
|
close(killDone)
|
|
|
|
// continue the loop and we wait for all the ConnState updates and will
|
|
// return from this goroutine when we're all done. otherwise we'll try to
|
|
// send those ConnState updates on closed channels.
|
|
|
|
}
|
|
}
|
|
}
|
|
|
|
func (s *server) serve() {
|
|
stats.BumpSum(s.stats, "serve", 1)
|
|
switch {
|
|
case s.certFile != "" || s.keyFile != "":
|
|
s.serveErr <- s.server.ServeTLS(s.listener, s.certFile, s.keyFile)
|
|
case s.server.TLSConfig != nil && (len(s.server.TLSConfig.Certificates) > 0 || s.server.TLSConfig.GetCertificate != nil):
|
|
// TLSConfig carries the certificate source (e.g. a hot-reloading
|
|
// GetCertificate callback). Pass empty file args so ServeTLS uses it.
|
|
s.serveErr <- s.server.ServeTLS(s.listener, "", "")
|
|
default:
|
|
s.serveErr <- s.server.Serve(s.listener)
|
|
}
|
|
close(s.serveDone)
|
|
close(s.serveErr)
|
|
}
|
|
|
|
func (s *server) Wait() error {
|
|
if err := <-s.serveErr; !isUseOfClosedError(err) {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (s *server) Stop() error {
|
|
s.stopOnce.Do(func() {
|
|
defer stats.BumpTime(s.stats, "stop.time").End()
|
|
stats.BumpSum(s.stats, "stop", 1)
|
|
|
|
// first disable keep-alive for new connections
|
|
s.server.SetKeepAlivesEnabled(false)
|
|
|
|
// then close the listener so new connections can't connect come thru
|
|
closeErr := s.listener.Close()
|
|
<-s.serveDone
|
|
|
|
// then trigger the background goroutine to stop and wait for it
|
|
stopDone := make(chan struct{})
|
|
s.stop <- stopDone
|
|
|
|
// wait for stop
|
|
select {
|
|
case <-stopDone:
|
|
case <-s.clock.After(s.stopTimeout):
|
|
defer stats.BumpTime(s.stats, "kill.time").End()
|
|
stats.BumpSum(s.stats, "kill", 1)
|
|
|
|
// stop timed out, wait for kill
|
|
killDone := make(chan struct{})
|
|
s.kill <- killDone
|
|
select {
|
|
case <-killDone:
|
|
case <-s.clock.After(s.killTimeout):
|
|
// kill timed out, give up
|
|
stats.BumpSum(s.stats, "kill.timeout", 1)
|
|
}
|
|
}
|
|
|
|
if closeErr != nil && !isUseOfClosedError(closeErr) {
|
|
stats.BumpSum(s.stats, "listener.close.error", 1)
|
|
s.stopErr = closeErr
|
|
}
|
|
})
|
|
return s.stopErr
|
|
}
|
|
|
|
func isUseOfClosedError(err error) bool {
|
|
if err == nil {
|
|
return false
|
|
}
|
|
if opErr, ok := err.(*net.OpError); ok {
|
|
err = opErr.Err
|
|
}
|
|
return err.Error() == "use of closed network connection"
|
|
}
|
|
|
|
// ListenAndServe is a convenience function to serve and wait for a SIGTERM
|
|
// or SIGINT before shutting down.
|
|
func ListenAndServe(s *http.Server, hd *HTTP) error {
|
|
if hd == nil {
|
|
hd = &HTTP{}
|
|
}
|
|
hs, err := hd.ListenAndServe(s)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
waiterr := make(chan error, 1)
|
|
go func() {
|
|
defer close(waiterr)
|
|
waiterr <- hs.Wait()
|
|
}()
|
|
|
|
signals := make(chan os.Signal, 10)
|
|
signal.Notify(signals, syscall.SIGTERM, syscall.SIGINT)
|
|
|
|
select {
|
|
case err := <-waiterr:
|
|
if err != nil {
|
|
return err
|
|
}
|
|
case <-signals:
|
|
signal.Stop(signals)
|
|
if err := hs.Stop(); err != nil {
|
|
return err
|
|
}
|
|
if err := <-waiterr; err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|