Дерево: e2e17ae879

add-ec-vacuum

add-foundation-db

add_fasthttp_client

add_remote_storage

adding-message-queue-integration-tests

avoid_releasing_temp_file_on_write

changing-to-zap

clean-up

collect-public-metrics

create-table-snapshot-api-design

data_query_pushdown

dependabot/github_actions/actions/checkout-5

dependabot/github_actions/actions/setup-go-6

dependabot/go_modules/github.com/klauspost/compress-1.18.1

dependabot/go_modules/github.com/redis/go-redis/v9-9.14.1

dependabot/go_modules/github.com/seaweedfs/raft-1.1.5

dependabot/go_modules/golang.org/x/crypto-0.43.0

dependabot/go_modules/golang.org/x/image-0.32.0

dependabot/maven/other/java/client/com.google.protobuf-protobuf-java-3.25.5

dependabot/maven/other/java/examples/org.apache.hadoop-hadoop-common-3.4.0

detect-and-plan-ec-tasks

do-not-retry-if-error-is-NotFound

fasthttp

filer1_maintenance_branch

fix-GetObjectLockConfigurationHandler

fix-versioning-listing-only

ftp

gh-pages

improve-fuse-mount

improve-fuse-mount2

logrus

master

message_send

mount2

mq-subscribe

mq2

original_weed_mount

random_access_file

refactor-needle-read-operations

refactor-volume-write

remote_overlay

revert-5134-patch-1

revert-5819-patch-1

revert-6434-bugfix-missing-s3-audit

s3-select

sub

tcp_read

test-reverting-lock-table

test_udp

testing

testing-sdx-generation

tikv

track-mount-e2e

volume_buffered_writes

worker-execute-ec-tasks

0.72

0.72.release

0.73

0.74

0.75

0.76

0.77

0.90

0.91

0.92

0.93

0.94

0.95

0.96

0.97

0.98

0.99

1.00

1.01

1.02

1.03

1.04

1.05

1.06

1.07

1.08

1.09

1.10

1.11

1.12

1.14

1.15

1.16

1.17

1.18

1.19

1.20

1.21

1.22

1.23

1.24

1.25

1.26

1.27

1.28

1.29

1.30

1.31

1.32

1.33

1.34

1.35

1.36

1.37

1.38

1.40

1.41

1.42

1.43

1.44

1.45

1.46

1.47

1.48

1.49

1.50

1.51

1.52

1.53

1.54

1.55

1.56

1.57

1.58

1.59

1.60

1.61

1.61RC

1.62

1.63

1.64

1.65

1.66

1.67

1.68

1.69

1.70

1.71

1.72

1.73

1.74

1.75

1.76

1.77

1.78

1.79

1.80

1.81

1.82

1.83

1.84

1.85

1.86

1.87

1.88

1.90

1.91

1.92

1.93

1.94

1.95

1.96

1.97

1.98

1.99

1;70

2.00

2.01

2.02

2.03

2.04

2.05

2.06

2.07

2.08

2.09

2.10

2.11

2.12

2.13

2.14

2.15

2.16

2.17

2.18

2.19

2.20

2.21

2.22

2.23

2.24

2.25

2.26

2.27

2.28

2.29

2.30

2.31

2.32

2.33

2.34

2.35

2.36

2.37

2.38

2.39

2.40

2.41

2.42

2.43

2.47

2.48

2.49

2.50

2.51

2.52

2.53

2.54

2.55

2.56

2.57

2.58

2.59

2.60

2.61

2.62

2.63

2.64

2.65

2.66

2.67

2.68

2.69

2.70

2.71

2.72

2.73

2.74

2.75

2.76

2.77

2.78

2.79

2.80

2.81

2.82

2.83

2.84

2.85

2.86

2.87

2.88

2.89

2.90

2.91

2.92

2.93

2.94

2.95

2.96

2.97

2.98

2.99

3.00

3.01

3.02

3.03

3.04

3.05

3.06

3.07

3.08

3.09

3.10

3.11

3.12

3.13

3.14

3.15

3.16

3.18

3.19

3.20

3.21

3.22

3.23

3.24

3.25

3.26

3.27

3.28

3.29

3.30

3.31

3.32

3.33

3.34

3.35

3.36

3.37

3.38

3.39

3.40

3.41

3.42

3.43

3.44

3.45

3.46

3.47

3.48

3.50

3.51

3.52

3.53

3.54

3.55

3.56

3.57

3.58

3.59

3.60

3.61

3.62

3.63

3.64

3.65

3.66

3.67

3.68

3.69

3.71

3.72

3.73

3.74

3.75

3.76

3.77

3.78

3.79

3.80

3.81

3.82

3.83

3.84

3.85

3.86

3.87

3.88

3.89

3.90

3.91

3.92

3.93

3.94

3.95

3.96

3.97

dev

helm-3.65.1

v0.69

v0.70beta

v3.33

Ветки Теги

${ item.name }

Создать тег ${ searchTerm }

Создать ветку ${ searchTerm }

из 'e2e17ae879'

${ noResults }

Граф коммитов

41 Коммитов (e2e17ae879f0db9d561d28d2fc79a44307ab482d)

Автор	SHA1	Сообщение	Дата
Konstantin Lebedev	a0931be0c0	S3 TLS credentials Refreshing (#4506) * S3 TLS credentials Refreshing * fix: logging --------- Co-authored-by: Konstantin Lebedev <9497591+kmlebedev@users.noreply.github.co>	2 лет назад
Zachary Walters	ef2f741823	Updated the deprecated ioutil dependency (#4239)	3 лет назад
chrislu	21c0587900	go fmt	3 лет назад
chrislu	13b9a52f80	fix deprecated functions	3 лет назад
chrislu	26dbc6c905	move to https://github.com/seaweedfs/seaweedfs	3 лет назад
Konstantin Lebedev	6c20a3b622	avoid set currentMaster k8s svc.local discoveruy service domains https://github.com/chrislusf/seaweedfs/issues/2589	3 лет назад
Konstantin Lebedev	2e782dfdcb	rm defer comments	3 лет назад
Konstantin Lebedev	7efaafb0ee	fix Authenticate	3 лет назад
Konstantin Lebedev	b0aa51d7ef	enable require client cert	3 лет назад
Konstantin Lebedev	ea7cdb8b0e	seperate option	3 лет назад
Konstantin Lebedev	5b388ed6c1	initial advancedtls	3 лет назад
Berck Nash	9b14f0c81a	Add mTLS support for both master and volume http server.	4 лет назад
Sebastian Kurfuerst	10404c4275	FEATURE: add JWT to HTTP endpoints of Filer and use them in S3 Client - one JWT for reading and one for writing, analogous to how the JWT between Master and Volume Server works - I did not implement IP `whiteList` parameter on the filer Additionally, because http_util.DownloadFile now sets the JWT, the `download` command should now work when `jwt.signing.read` is configured. By looking at the code, I think this case did not work before. ## Docs to be adjusted after a release Page `Amazon-S3-API`: ``` # Authentication with Filer You can use mTLS for the gRPC connection between S3-API-Proxy and the filer, as explained in [Security-Configuration](Security-Configuration) - controlled by the `grpc.*` configuration in `security.toml`. Starting with version XX, it is also possible to authenticate the HTTP operations between the S3-API-Proxy and the Filer (especially uploading new files). This is configured by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. With both configurations (gRPC and JWT), it is possible to have Filer and S3 communicate in fully authenticated fashion; so Filer will reject any unauthenticated communication. ``` Page `Security Overview`: ``` The following items are not covered, yet: - master server http REST services Starting with version XX, the Filer HTTP REST services can be secured with a JWT, by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. ... Before version XX: "weed filer -disableHttp", disable http operations, only gRPC operations are allowed. This works with "weed mount" by FUSE. It does **not work** with the [S3 Gateway](Amazon S3 API), as this does HTTP calls to the Filer. Starting with version XX: secured by JWT, by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. **This now works with the [S3 Gateway](Amazon S3 API).** ... # Securing Filer HTTP with JWT To enable JWT-based access control for the Filer, 1. generate `security.toml` file by `weed scaffold -config=security` 2. set `filer_jwt.signing.key` to a secret string - and optionally filer_jwt.signing.read.key` as well to a secret string 3. copy the same `security.toml` file to the filers and all S3 proxies. If `filer_jwt.signing.key` is configured: When sending upload/update/delete HTTP operations to a filer server, the request header `Authorization` should be the JWT string (`Authorization: Bearer [JwtToken]`). The operation is authorized after the filer validates the JWT with `filer_jwt.signing.key`. If `filer_jwt.signing.read.key` is configured: When sending GET or HEAD requests to a filer server, the request header `Authorization` should be the JWT string (`Authorization: Bearer [JwtToken]`). The operation is authorized after the filer validates the JWT with `filer_jwt.signing.read.key`. The S3 API Gateway reads the above JWT keys and sends authenticated HTTP requests to the filer. ``` Page `Security Configuration`: ``` (update scaffold file) ... [filer_jwt.signing] key = "blahblahblahblah" [filer_jwt.signing.read] key = "blahblahblahblah" ``` Resolves: #158	4 лет назад
Sebastian Kurfuerst	fcc09cef6f	Refactor: pass in claim type into security.DecodeJwt	4 лет назад
Sebastian Kurfuerst	d156d410ef	rename security.GenJwt to security.GenJwtForVolumeServer	4 лет назад
Sebastian Kurfuerst	eda4c43a08	fix typo in error message	4 лет назад
Eng Zer Jun	a23bcbb7ec	refactor: move from io/ioutil to io and os package The io/ioutil package has been deprecated as of Go 1.16, see https://golang.org/doc/go1.16#ioutil. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	4 лет назад
Chris Lu	60f5c0a2f5	fix security alert on github.com/dgrijalva/jwt-go resolve https://github.com/chrislusf/seaweedfs/security/dependabot/go.mod/github.com%2Fdgrijalva%2Fjwt-go/open	4 лет назад
Konstantin Lebedev	348e21a08c	add comments	5 лет назад
Konstantin Lebedev	831953c55c	allowed wildcard domain	5 лет назад
Konstantin Lebedev	0e02f7e258	comma-separated SSL certificate common names	5 лет назад
Konstantin Lebedev	190fada1ef	TLS allowed commonNames	5 лет назад
Konstantin Lebedev	c6d3735605	permitCommonNames https://github.com/chrislusf/seaweedfs/issues/1841 https://jbrandhorst.com/post/grpc-auth/	5 лет назад
Chris Lu	cfb9342a15	avoid concurrent map updates to viper	5 лет назад
limd	e8296104fc	fix tls grpc ca path	5 лет назад
Chris Lu	c2faab23b6	refactor	5 лет назад
Chris Lu	d013d09a9b	adjust logging	5 лет назад
bingoohuang	ecdeef8c66	simplify func(w http.ResponseWriter, r *http.Request) to http.HandlerFunc	5 лет назад
Chris Lu	e83bfd0a35	adjust log level	6 лет назад
Chris Lu	d335f04de6	support env variables to overwrite toml file	6 лет назад
j.laycock	6fc6322c90	Change joeslay paths to chrislusf paths	6 лет назад
j.laycock	595a1beff0	Swap imports to use joeslay	6 лет назад
Chris Lu	50aa769554	jwt for read access control	6 лет назад
Chris Lu	3f9ecee40f	working with reading remote intervals	6 лет назад
Chris Lu	25941e0500	master: add jwt expires_after_seconds	7 лет назад
Chris Lu	77b9af531d	adding grpc mutual tls	7 лет назад
Chris Lu	74fb237727	benchmark can work in secure mode	7 лет назад
Chris Lu	215cd27b37	add authorizing fileId write access need to secure upload/update/delete for benchmark/filer/mount need to add secure grpc	7 лет назад
Chris Lu	4ff4a147b2	cleanup security.Secret	7 лет назад
Sergey	aa5ccff6d2	fixing of typos	7 лет назад
Mike Tolman	ce99bb927d	Revert "Adding HTTP verb whitelisting options." This reverts commit 34837afc7a.	9 лет назад
Mike Tolman	34837afc7a	Adding HTTP verb whitelisting options.	9 лет назад
Chris Lu	d0dbf6d2ea	adjust logging	9 лет назад
Chris Lu	356b8048c5	fix compilation problem due to API changes	9 лет назад
Chris Lu	5ce6bbf076	directory structure change to work with glide glide has its own requirements. My previous workaround caused me some code checkin errors. Need to fix this.	10 лет назад