diff options
| author | Konstantin Lebedev <9497591+kmlebedev@users.noreply.github.com> | 2024-12-02 23:38:10 +0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-12-02 10:38:10 -0800 |
| commit | b65eb2ec4569891495ae184bf6090e0e500961e3 (patch) | |
| tree | 92b75ea55a544a066f657e12fc9745a78f26baa5 /weed/server/filer_server.go | |
| parent | b2ba7d7408500bb450884a288327a1fb53e67fae (diff) | |
| download | seaweedfs-b65eb2ec4569891495ae184bf6090e0e500961e3.tar.xz seaweedfs-b65eb2ec4569891495ae184bf6090e0e500961e3.zip | |
[security] reload whiteList on http seerver (#6302)
* reload whiteList
* white_list add to scaffold
Diffstat (limited to 'weed/server/filer_server.go')
| -rw-r--r-- | weed/server/filer_server.go | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/weed/server/filer_server.go b/weed/server/filer_server.go index ee052579c..6855a4745 100644 --- a/weed/server/filer_server.go +++ b/weed/server/filer_server.go @@ -152,8 +152,8 @@ func NewFilerServer(defaultMux, readonlyMux *http.ServeMux, option *FilerOption) } }) fs.filer.Cipher = option.Cipher - // we do not support IP whitelist right now - fs.filerGuard = security.NewGuard([]string{}, signingKey, expiresAfterSec, readSigningKey, readExpiresAfterSec) + whiteList := util.StringSplit(v.GetString("guard.white_list"), ",") + fs.filerGuard = security.NewGuard(whiteList, signingKey, expiresAfterSec, readSigningKey, readExpiresAfterSec) fs.volumeGuard = security.NewGuard([]string{}, volumeSigningKey, volumeExpiresAfterSec, volumeReadSigningKey, volumeReadExpiresAfterSec) fs.checkWithMaster() @@ -187,12 +187,12 @@ func NewFilerServer(defaultMux, readonlyMux *http.ServeMux, option *FilerOption) handleStaticResources(defaultMux) if !option.DisableHttp { defaultMux.HandleFunc("/healthz", fs.filerHealthzHandler) - defaultMux.HandleFunc("/", fs.filerHandler) + defaultMux.HandleFunc("/", fs.filerGuard.WhiteList(fs.filerHandler)) } if defaultMux != readonlyMux { handleStaticResources(readonlyMux) readonlyMux.HandleFunc("/healthz", fs.filerHealthzHandler) - readonlyMux.HandleFunc("/", fs.readonlyFilerHandler) + readonlyMux.HandleFunc("/", fs.filerGuard.WhiteList(fs.readonlyFilerHandler)) } existingNodes := fs.filer.ListExistingPeerUpdates(context.Background()) @@ -209,6 +209,7 @@ func NewFilerServer(defaultMux, readonlyMux *http.ServeMux, option *FilerOption) fs.filer.LoadRemoteStorageConfAndMapping() + grace.OnReload(fs.Reload) grace.OnInterrupt(func() { fs.filer.Shutdown() }) @@ -239,5 +240,12 @@ func (fs *FilerServer) checkWithMaster() { } } } +} + +func (fs *FilerServer) Reload() { + glog.V(0).Infoln("Reload filer server...") + util.LoadConfiguration("security", false) + v := util.GetViper() + fs.filerGuard.UpdateWhiteList(util.StringSplit(v.GetString("guard.white_list"), ",")) } |