Chris LuandGitHub 69da20bdae volume: gate FetchAndWriteNeedle behind admin auth and refuse internal endpoints (#9441) ...

volume: require admin auth and refuse loopback endpoints in FetchAndWriteNeedle

Gate the RPC behind checkGrpcAdminAuth for parity with the rest of the
destructive volume-server RPCs, and reject cluster-internal remote S3
endpoints (loopback / link-local / IMDS / RFC 1918 / CGNAT) before
dialing. Pin the validated address against DNS rebinding by routing the
AWS SDK through an HTTP transport whose DialContext re-resolves the host
and re-applies the deny list on every dial, so an endpoint that resolves
to a public IP at validate-time and then flips to 127.0.0.1 at connect
time is refused. Operators that legitimately fetch from private hosts
can opt out with -volume.allowUntrustedRemoteEndpoints.

2026-05-12 10:11:20 -07:00

..

scaffold

filer: require admin-signed JWT on the IAM gRPC service (#9442)

2026-05-12 10:11:08 -07:00

admin.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

autocomplete.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

backup.go

fix(balance): don't move remote-tiered volumes; don't fatal on missing .idx (#9335)

2026-05-06 15:19:43 -07:00

benchmark.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

command.go

feat(filer.sync): add -verifySync mode to filer.sync for cross-cluster file comparison (#9284)

2026-04-29 12:33:53 -07:00

compact.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

download.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

export.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

filer_backup_test.go

feat(filer.backup): -initialSnapshot seeds destination from live tree (#9126)

2026-04-17 21:21:32 -07:00

filer_backup.go

fix(weed/command) address unhandled errors (#9208)

2026-04-23 22:15:05 -07:00

filer_cat.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

filer_copy.go

fix(mount): remove fid pool to stop master over-allocating volumes (#9111)

2026-04-16 15:51:13 -07:00

filer_meta_backup.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

filer_meta_tail_elastic.go

fix(filer.meta.tail): include extended metadata in Elasticsearch docs (#9200)

2026-04-23 11:54:08 -07:00

filer_meta_tail_non_elastic.go

fix(filer.meta.tail): fail fast when -es is used without elastic build tag (#9191)

2026-04-22 09:44:43 -07:00

filer_meta_tail.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

filer_remote_gateway_buckets.go

Adjust rename events metadata format (#8854)

2026-03-30 18:25:11 -07:00

filer_remote_gateway.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

filer_remote_sync_dir_test.go

fix(remote_gateway): prevent double-versioning when syncing to versioned central bucket (#8710)

2026-03-19 21:18:52 -07:00

filer_remote_sync_dir.go

Adjust rename events metadata format (#8854)

2026-03-30 18:25:11 -07:00

filer_remote_sync.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

filer_replication.go

Added loadSecurityConfigOnce (#5792)

2024-07-16 09:15:55 -07:00

filer_sync_jobs_test.go

perf(filer.sync): don't serialize descendants behind dir attribute updates (#9079)

2026-04-14 18:34:05 -07:00

filer_sync_jobs.go

perf(filer.sync): don't serialize descendants behind dir attribute updates (#9079)

2026-04-14 18:34:05 -07:00

filer_sync_process_test.go

Adjust rename events metadata format (#8854)

2026-03-30 18:25:11 -07:00

filer_sync_std.go

go fix

2026-02-20 18:42:00 -08:00

filer_sync_subscription_test.go

filer.sync: pipelined subscription with adaptive batching for faster catch-up (#8791)

2026-03-26 23:55:42 -07:00

filer_sync_verify_test.go

feat(filer.sync): add -verifySync mode to filer.sync for cross-cluster file comparison (#9284)

2026-04-29 12:33:53 -07:00

filer_sync_verify.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

filer_sync_windows.go

filer.backup: escape colon from path on windows

2021-05-29 06:45:27 -07:00

filer_sync.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

filer.go

filer: require admin-signed JWT on the IAM gRPC service (#9442)

2026-05-12 10:11:08 -07:00

fix.go

fix(weed/command) address unhandled errors (#9208)

2026-04-23 22:15:05 -07:00

fuse_notsupported.go

go fix

2026-02-20 18:42:00 -08:00

fuse_std.go

fix(weed/command) address unhandled errors (#9208)

2026-04-23 22:15:05 -07:00

fuse.go

Fix the issue where fuse command on a node cannot specify multiple configuration directory paths (#7874)

2025-12-25 11:36:38 -08:00

iam.go

Embed IAM API into S3 server (#7740)

2025-12-14 16:02:06 -08:00

imports.go

migrate IAM policies to multi-file storage (#8114)

2026-01-26 11:28:23 -08:00

maintenance_capabilities.go

Refactor plugin system and migrate worker runtime (#8369)

2026-02-18 13:42:41 -08:00

master_follower.go

fix: use consistent telemetryUrl default in master.follower (#7809)

2025-12-17 12:27:43 -08:00

master_test.go

fix: improve raft leader election reliability and failover speed (#8692)

2026-03-18 23:28:07 -07:00

master.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

metadata_event_scope_test.go

Adjust rename events metadata format (#8854)

2026-03-30 18:25:11 -07:00

metadata_event_scope.go

Adjust rename events metadata format (#8854)

2026-03-30 18:25:11 -07:00

mini_bucket_test.go

feat(mini): add -bucket flag to pre-create an S3 bucket on startup (#9302)

2026-05-02 21:02:21 -07:00

mini_plugin_test.go

refactor(s3api): strip back-stamp from PutBucketLifecycleConfiguration (Phase 4) (#9367)

2026-05-08 11:03:03 -07:00

mini.go

volume: gate FetchAndWriteNeedle behind admin auth and refuse internal endpoints (#9441)

2026-05-12 10:11:20 -07:00

mount_darwin.go

Make weed-fuse compatible with systemd-based mount (#6814)

2026-03-18 12:18:40 -07:00

mount_freebsd.go

Make weed-fuse compatible with systemd-based mount (#6814)

2026-03-18 12:18:40 -07:00

mount_linux.go

Make weed-fuse compatible with systemd-based mount (#6814)

2026-03-18 12:18:40 -07:00

mount_notsupported.go

go fix

2026-02-20 18:42:00 -08:00

mount_std_test.go

go fix

2026-02-20 18:42:00 -08:00

mount_std.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

mount.go

mount: expose -fuse.maxBackground and -fuse.congestionThreshold flags (closes #9258) (#9268)

2026-04-28 13:42:58 -07:00

mq_agent.go

fix(weed/command) address unhandled errors (#9208)

2026-04-23 22:15:05 -07:00

mq_broker.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

mq_kafka_gateway.go

Add Kafka Gateway (#7231)

2025-10-13 18:05:17 -07:00

nfs.go

feat(nfs): UDP MOUNT v3 responder + real-Linux e2e mount harness (#9267)

2026-04-28 14:06:35 -07:00

plugin_worker_test.go

refactor(worker): co-locate plugin handlers with their task packages (#9301)

2026-05-02 18:03:13 -07:00

s3_iceberg_endpoint_test.go

fix(iceberg): route catalog clients to the right bucket and vend S3 endpoint (#9109)

2026-04-16 15:51:43 -07:00

s3.go

feat(s3): register SeaweedS3LifecycleInternal gRPC service (#9359)

2026-05-07 18:19:42 -07:00

scaffold_test.go

fix test

2019-11-28 18:44:27 -08:00

scaffold.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

server.go

volume: gate FetchAndWriteNeedle behind admin auth and refuse internal endpoints (#9441)

2026-05-12 10:11:20 -07:00

sftp.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

shell.go

go fmt

2026-04-10 17:31:14 -07:00

update_full.go

go fix

2026-02-20 18:42:00 -08:00

update.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

upload.go

merge current message queue code changes (#6201)

2024-11-04 12:08:25 -08:00

version.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

volume_test.go

move to https://github.com/seaweedfs/seaweedfs

2022-07-29 00:17:28 -07:00

volume.go

volume: gate FetchAndWriteNeedle behind admin auth and refuse internal endpoints (#9441)

2026-05-12 10:11:20 -07:00

webdav.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

worker_runtime.go

plugin worker: support job type categories (all, default, heavy) (#8547)

2026-03-07 18:30:58 -08:00

worker_test.go

fix(s3tests): wire lifecycle worker for expiration suite (#9374)

2026-05-08 17:29:47 -07:00

worker.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00