mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-07-26 01:53:02 +00:00
Chris LuandGitHub
69da20bdae
volume: require admin auth and refuse loopback endpoints in FetchAndWriteNeedle Gate the RPC behind checkGrpcAdminAuth for parity with the rest of the destructive volume-server RPCs, and reject cluster-internal remote S3 endpoints (loopback / link-local / IMDS / RFC 1918 / CGNAT) before dialing. Pin the validated address against DNS rebinding by routing the AWS SDK through an HTTP transport whose DialContext re-resolves the host and re-applies the deny list on every dial, so an endpoint that resolves to a public IP at validate-time and then flips to 127.0.0.1 at connect time is refused. Operators that legitimately fetch from private hosts can opt out with -volume.allowUntrustedRemoteEndpoints.
Volume Server Integration Tests
This package contains integration tests for SeaweedFS volume server HTTP and gRPC APIs.
Run Tests
Run tests from repo root:
go test ./test/volume_server/... -v
If a weed binary is not found, the harness will build one automatically.
Optional environment variables
WEED_BINARY: explicit path to theweedexecutable (disables auto-build).VOLUME_SERVER_IT_KEEP_LOGS=1: keep temporary test directories and process logs.
Current scope (Phase 0)
- Shared cluster/framework utilities
- Matrix profile definitions
- Initial HTTP admin endpoint checks
- Initial gRPC state/status checks
More API coverage is tracked in /Users/chris/dev/seaweedfs2/test/volume_server/DEV_PLAN.md.