diff options
| author | Chris Lu <chrislusf@users.noreply.github.com> | 2021-11-09 08:53:48 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-11-09 08:53:48 -0800 |
| commit | a7eee8b14b88c9d0b9698818f793b71decd10946 (patch) | |
| tree | 8d3fa507be237d884ded6f7c0bbc68688c8146ce | |
| parent | 1d4a61af5e34726321c6f7c9e659d0660293edb7 (diff) | |
| parent | c683409e9275d6d059de12e88df3b5275e47cb04 (diff) | |
| download | seaweedfs-a7eee8b14b88c9d0b9698818f793b71decd10946.tar.xz seaweedfs-a7eee8b14b88c9d0b9698818f793b71decd10946.zip | |
Merge pull request #2427 from Bl1tz23/master
Fix: potencial iam identities data race
| -rw-r--r-- | weed/s3api/auth_credentials.go | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/weed/s3api/auth_credentials.go b/weed/s3api/auth_credentials.go index 78b82589e..9e1cd7f86 100644 --- a/weed/s3api/auth_credentials.go +++ b/weed/s3api/auth_credentials.go @@ -5,6 +5,7 @@ import ( "net/http" "os" "strings" + "sync" "github.com/chrislusf/seaweedfs/weed/filer" "github.com/chrislusf/seaweedfs/weed/glog" @@ -23,6 +24,8 @@ type Iam interface { } type IdentityAccessManagement struct { + m sync.RWMutex + identities []*Identity domain string } @@ -131,19 +134,23 @@ func (iam *IdentityAccessManagement) loadS3ApiConfiguration(config *iam_pb.S3Api } identities = append(identities, t) } - + iam.m.Lock() // atomically switch iam.identities = identities + iam.m.Unlock() return nil } func (iam *IdentityAccessManagement) isEnabled() bool { - + iam.m.RLock() + defer iam.m.RUnlock() return len(iam.identities) > 0 } func (iam *IdentityAccessManagement) lookupByAccessKey(accessKey string) (identity *Identity, cred *Credential, found bool) { + iam.m.RLock() + defer iam.m.RUnlock() for _, ident := range iam.identities { for _, cred := range ident.Credentials { // println("checking", ident.Name, cred.AccessKey) @@ -157,7 +164,8 @@ func (iam *IdentityAccessManagement) lookupByAccessKey(accessKey string) (identi } func (iam *IdentityAccessManagement) lookupAnonymous() (identity *Identity, found bool) { - + iam.m.RLock() + defer iam.m.RUnlock() for _, ident := range iam.identities { if ident.Name == "anonymous" { return ident, true |