mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-05-14 05:41:29 +00:00
3f1eaf9724
* fix(s3/audit): emit audit log for successful GET/HEAD Successful GET/HEAD object requests never produced a fluent audit entry because those handlers write the response directly (streaming for GET, WriteHeader for HEAD) and never reach a PostLog call site. The wiki advertises GET as an audited verb, so the asymmetry surprises operators who rely on the log for read-access auditing. Move the safety net into the track() middleware: tag each request with an audit-tracking flag, let PostLog/PostAccessLog (delete path) mark it, and emit a single fallback entry after the handler returns when nothing fired. The recorder's status flows into the fallback so the audit row still reflects 200/206 vs 404 etc. No double logging for handlers that already emit (write helpers, error paths, bulk delete). Refs #9463 * fix(s3/audit): defensive nil checks on audit-tracking helpers Address PR review: guard against nil request and nil *atomic.Bool stored under the audit-tracking key. The conditions are unreachable today (the key is private and we only ever store new(atomic.Bool)), but the checks are free and keep the helpers safe if a future caller misbehaves. * test(s3/audit): track() audit fallback coverage + stale comment cleanup (#9469) test(s3/audit): cover track() fallback wiring + cleanup Adds two unit tests in weed/s3api/stats_test.go that exercise the audit-tracking flag set up by track(): one verifies the fallback path fires when a handler writes the response directly (the GET/HEAD object regression in #9463), the other verifies the flag is set when a handler emits PostLog itself so the fallback is skipped. To make the wiring observable without standing up fluent, PostLog now marks the audit flag before short-circuiting on a nil Logger; production behavior is unchanged (no logger, no posting) but the flag stays consistent. Also drops two stale comments in s3api_object_handlers.go that still referenced proxyToFiler — that helper was removed when GET/HEAD started streaming from volume servers directly. Stacks on #9467.
59 lines
2.2 KiB
Go
59 lines
2.2 KiB
Go
package s3api
|
|
|
|
import (
|
|
"net/http"
|
|
"strconv"
|
|
"time"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/util/version"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
|
|
stats_collect "github.com/seaweedfs/seaweedfs/weed/stats"
|
|
)
|
|
|
|
func track(f http.HandlerFunc, action string) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
inFlightGauge := stats_collect.S3InFlightRequestsGauge.WithLabelValues(action)
|
|
inFlightGauge.Inc()
|
|
defer inFlightGauge.Dec()
|
|
|
|
bucket, _ := s3_constants.GetBucketAndObject(r)
|
|
w.Header().Set("Server", "SeaweedFS "+version.VERSION)
|
|
recorder := stats_collect.NewStatusResponseWriter(w)
|
|
// Attach an audit-tracking flag to the request so handlers that call
|
|
// PostLog directly mark it; we emit a fallback entry afterward for
|
|
// handlers (e.g. successful GET/HEAD object) that don't.
|
|
r = s3err.EnsureAuditTracking(r)
|
|
start := time.Now()
|
|
f(recorder, r)
|
|
if recorder.Status == http.StatusForbidden {
|
|
bucket = ""
|
|
}
|
|
stats_collect.S3RequestHistogram.WithLabelValues(action, bucket).Observe(time.Since(start).Seconds())
|
|
stats_collect.S3RequestCounter.WithLabelValues(action, strconv.Itoa(recorder.Status), bucket).Inc()
|
|
stats_collect.RecordBucketActiveTime(bucket)
|
|
if !s3err.AuditAlreadyLogged(r) {
|
|
s3err.PostLog(r, recorder.Status, s3err.ErrNone)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TimeToFirstByte(action string, start time.Time, r *http.Request) {
|
|
bucket, _ := s3_constants.GetBucketAndObject(r)
|
|
stats_collect.S3TimeToFirstByteHistogram.WithLabelValues(action, bucket).Observe(float64(time.Since(start).Milliseconds()))
|
|
stats_collect.RecordBucketActiveTime(bucket)
|
|
}
|
|
|
|
func BucketTrafficReceived(bytesReceived int64, r *http.Request) {
|
|
bucket, _ := s3_constants.GetBucketAndObject(r)
|
|
stats_collect.RecordBucketActiveTime(bucket)
|
|
stats_collect.S3BucketTrafficReceivedBytesCounter.WithLabelValues(bucket).Add(float64(bytesReceived))
|
|
}
|
|
|
|
func BucketTrafficSent(bytesTransferred int64, r *http.Request) {
|
|
bucket, _ := s3_constants.GetBucketAndObject(r)
|
|
stats_collect.RecordBucketActiveTime(bucket)
|
|
stats_collect.S3BucketTrafficSentBytesCounter.WithLabelValues(bucket).Add(float64(bytesTransferred))
|
|
}
|