2023-01-29 01:16:04 +00:00
|
|
|
use std::collections::HashMap;
|
2022-05-24 10:16:39 +00:00
|
|
|
use std::sync::Arc;
|
|
|
|
|
|
2024-02-29 09:57:07 +00:00
|
|
|
use argon2::password_hash::PasswordHash;
|
2022-05-24 10:16:39 +00:00
|
|
|
use async_trait::async_trait;
|
|
|
|
|
|
|
|
|
|
use futures::future::Future;
|
2022-09-03 22:43:48 +00:00
|
|
|
use http::header::{ACCESS_CONTROL_ALLOW_METHODS, ACCESS_CONTROL_ALLOW_ORIGIN, ALLOW};
|
2022-10-16 17:46:15 +00:00
|
|
|
use hyper::{Body, Request, Response, StatusCode};
|
2022-05-24 10:16:39 +00:00
|
|
|
|
2022-09-03 22:43:48 +00:00
|
|
|
use opentelemetry::trace::SpanRef;
|
|
|
|
|
|
|
|
|
|
#[cfg(feature = "metrics")]
|
2022-05-24 10:16:39 +00:00
|
|
|
use opentelemetry_prometheus::PrometheusExporter;
|
2022-09-03 22:43:48 +00:00
|
|
|
#[cfg(feature = "metrics")]
|
2022-05-24 10:16:39 +00:00
|
|
|
use prometheus::{Encoder, TextEncoder};
|
|
|
|
|
|
|
|
|
|
use garage_model::garage::Garage;
|
2022-12-05 14:28:57 +00:00
|
|
|
use garage_rpc::system::ClusterHealthStatus;
|
2022-05-24 10:16:39 +00:00
|
|
|
use garage_util::error::Error as GarageError;
|
2023-09-29 16:41:00 +00:00
|
|
|
use garage_util::socket_address::UnixOrTCPSocketAddress;
|
2022-05-24 10:16:39 +00:00
|
|
|
|
|
|
|
|
use crate::generic_server::*;
|
|
|
|
|
|
|
|
|
|
use crate::admin::bucket::*;
|
|
|
|
|
use crate::admin::cluster::*;
|
|
|
|
|
use crate::admin::error::*;
|
|
|
|
|
use crate::admin::key::*;
|
|
|
|
|
use crate::admin::router::{Authorization, Endpoint};
|
2023-08-08 09:05:42 +00:00
|
|
|
use crate::helpers::host_to_bucket;
|
2022-05-24 10:16:39 +00:00
|
|
|
|
|
|
|
|
pub struct AdminApiServer {
|
|
|
|
|
garage: Arc<Garage>,
|
2022-09-03 22:43:48 +00:00
|
|
|
#[cfg(feature = "metrics")]
|
2022-05-24 10:16:39 +00:00
|
|
|
exporter: PrometheusExporter,
|
|
|
|
|
metrics_token: Option<String>,
|
|
|
|
|
admin_token: Option<String>,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
impl AdminApiServer {
|
2022-09-20 15:45:18 +00:00
|
|
|
pub fn new(
|
|
|
|
|
garage: Arc<Garage>,
|
|
|
|
|
#[cfg(feature = "metrics")] exporter: PrometheusExporter,
|
|
|
|
|
) -> Self {
|
2022-05-24 10:16:39 +00:00
|
|
|
let cfg = &garage.config.admin;
|
2024-02-29 09:57:07 +00:00
|
|
|
let metrics_token = cfg.metrics_token.as_deref().map(hash_bearer_token);
|
|
|
|
|
let admin_token = cfg.admin_token.as_deref().map(hash_bearer_token);
|
2022-05-24 10:16:39 +00:00
|
|
|
Self {
|
|
|
|
|
garage,
|
2022-09-03 22:43:48 +00:00
|
|
|
#[cfg(feature = "metrics")]
|
2022-09-20 15:45:18 +00:00
|
|
|
exporter,
|
2022-05-24 10:16:39 +00:00
|
|
|
metrics_token,
|
|
|
|
|
admin_token,
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2022-09-07 15:54:16 +00:00
|
|
|
pub async fn run(
|
|
|
|
|
self,
|
2023-09-29 16:41:00 +00:00
|
|
|
bind_addr: UnixOrTCPSocketAddress,
|
2022-09-07 15:54:16 +00:00
|
|
|
shutdown_signal: impl Future<Output = ()>,
|
|
|
|
|
) -> Result<(), GarageError> {
|
|
|
|
|
let region = self.garage.config.s3_api.s3_region.clone();
|
|
|
|
|
ApiServer::new(region, self)
|
2023-10-03 15:31:40 +00:00
|
|
|
.run_server(bind_addr, Some(0o220), shutdown_signal)
|
2022-09-07 15:54:16 +00:00
|
|
|
.await
|
2022-05-24 10:16:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
fn handle_options(&self, _req: &Request<Body>) -> Result<Response<Body>, Error> {
|
|
|
|
|
Ok(Response::builder()
|
2022-10-16 17:46:15 +00:00
|
|
|
.status(StatusCode::NO_CONTENT)
|
2022-05-24 10:16:39 +00:00
|
|
|
.header(ALLOW, "OPTIONS, GET, POST")
|
|
|
|
|
.header(ACCESS_CONTROL_ALLOW_METHODS, "OPTIONS, GET, POST")
|
|
|
|
|
.header(ACCESS_CONTROL_ALLOW_ORIGIN, "*")
|
|
|
|
|
.body(Body::empty())?)
|
|
|
|
|
}
|
|
|
|
|
|
2023-08-08 09:05:42 +00:00
|
|
|
async fn handle_check_domain(&self, req: Request<Body>) -> Result<Response<Body>, Error> {
|
2023-01-29 01:16:04 +00:00
|
|
|
let query_params: HashMap<String, String> = req
|
|
|
|
|
.uri()
|
|
|
|
|
.query()
|
|
|
|
|
.map(|v| {
|
|
|
|
|
url::form_urlencoded::parse(v.as_bytes())
|
|
|
|
|
.into_owned()
|
|
|
|
|
.collect()
|
|
|
|
|
})
|
|
|
|
|
.unwrap_or_else(HashMap::new);
|
|
|
|
|
|
|
|
|
|
let has_domain_key = query_params.contains_key("domain");
|
|
|
|
|
|
|
|
|
|
if !has_domain_key {
|
|
|
|
|
return Err(Error::bad_request("No domain query string found"));
|
2023-01-12 13:35:14 +00:00
|
|
|
}
|
|
|
|
|
|
2023-01-29 01:16:04 +00:00
|
|
|
let domain = query_params
|
2023-01-12 13:35:14 +00:00
|
|
|
.get("domain")
|
2023-01-29 01:16:04 +00:00
|
|
|
.ok_or_internal_error("Could not parse domain query string")?;
|
2023-01-12 13:35:14 +00:00
|
|
|
|
2023-08-28 10:16:44 +00:00
|
|
|
if self.check_domain(domain).await? {
|
|
|
|
|
Ok(Response::builder()
|
|
|
|
|
.status(StatusCode::OK)
|
|
|
|
|
.body(Body::from(format!(
|
|
|
|
|
"Domain '{domain}' is managed by Garage"
|
|
|
|
|
)))?)
|
|
|
|
|
} else {
|
|
|
|
|
Err(Error::bad_request(format!(
|
|
|
|
|
"Domain '{domain}' is not managed by Garage"
|
|
|
|
|
)))
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
async fn check_domain(&self, domain: &str) -> Result<bool, Error> {
|
2023-08-08 09:05:42 +00:00
|
|
|
// Resolve bucket from domain name, inferring if the website must be activated for the
|
|
|
|
|
// domain to be valid.
|
|
|
|
|
let (bucket_name, must_check_website) = if let Some(bname) = self
|
|
|
|
|
.garage
|
|
|
|
|
.config
|
|
|
|
|
.s3_api
|
|
|
|
|
.root_domain
|
|
|
|
|
.as_ref()
|
|
|
|
|
.and_then(|rd| host_to_bucket(domain, rd))
|
|
|
|
|
{
|
|
|
|
|
(bname.to_string(), false)
|
|
|
|
|
} else if let Some(bname) = self
|
|
|
|
|
.garage
|
|
|
|
|
.config
|
|
|
|
|
.s3_web
|
|
|
|
|
.as_ref()
|
|
|
|
|
.and_then(|sw| host_to_bucket(domain, sw.root_domain.as_str()))
|
|
|
|
|
{
|
|
|
|
|
(bname.to_string(), true)
|
|
|
|
|
} else {
|
|
|
|
|
(domain.to_string(), true)
|
|
|
|
|
};
|
|
|
|
|
|
2023-08-28 10:16:44 +00:00
|
|
|
let bucket_id = match self
|
2023-01-12 13:35:14 +00:00
|
|
|
.garage
|
|
|
|
|
.bucket_helper()
|
2023-08-08 09:05:42 +00:00
|
|
|
.resolve_global_bucket_name(&bucket_name)
|
2023-01-12 13:35:14 +00:00
|
|
|
.await?
|
2023-08-28 10:16:44 +00:00
|
|
|
{
|
|
|
|
|
Some(bucket_id) => bucket_id,
|
|
|
|
|
None => return Ok(false),
|
|
|
|
|
};
|
2023-08-08 09:05:42 +00:00
|
|
|
|
|
|
|
|
if !must_check_website {
|
2023-08-28 10:16:44 +00:00
|
|
|
return Ok(true);
|
2023-08-08 09:05:42 +00:00
|
|
|
}
|
2023-01-12 13:35:14 +00:00
|
|
|
|
|
|
|
|
let bucket = self
|
|
|
|
|
.garage
|
|
|
|
|
.bucket_helper()
|
|
|
|
|
.get_existing_bucket(bucket_id)
|
|
|
|
|
.await?;
|
|
|
|
|
|
|
|
|
|
let bucket_state = bucket.state.as_option().unwrap();
|
|
|
|
|
let bucket_website_config = bucket_state.website_config.get();
|
|
|
|
|
|
|
|
|
|
match bucket_website_config {
|
2023-08-28 10:16:44 +00:00
|
|
|
Some(_v) => Ok(true),
|
|
|
|
|
None => Ok(false),
|
2023-01-12 13:35:14 +00:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2022-12-05 14:38:32 +00:00
|
|
|
fn handle_health(&self) -> Result<Response<Body>, Error> {
|
2022-12-05 14:28:57 +00:00
|
|
|
let health = self.garage.system.health();
|
|
|
|
|
|
|
|
|
|
let (status, status_str) = match health.status {
|
|
|
|
|
ClusterHealthStatus::Healthy => (StatusCode::OK, "Garage is fully operational"),
|
|
|
|
|
ClusterHealthStatus::Degraded => (
|
2022-12-05 13:59:15 +00:00
|
|
|
StatusCode::OK,
|
|
|
|
|
"Garage is operational but some storage nodes are unavailable",
|
2022-12-05 14:28:57 +00:00
|
|
|
),
|
|
|
|
|
ClusterHealthStatus::Unavailable => (
|
2022-12-05 13:59:15 +00:00
|
|
|
StatusCode::SERVICE_UNAVAILABLE,
|
|
|
|
|
"Quorum is not available for some/all partitions, reads and writes will fail",
|
2022-12-05 14:28:57 +00:00
|
|
|
),
|
2022-12-05 13:59:15 +00:00
|
|
|
};
|
2022-12-05 14:38:32 +00:00
|
|
|
let status_str = format!(
|
|
|
|
|
"{}\nConsult the full health check API endpoint at /v0/health for more details\n",
|
|
|
|
|
status_str
|
|
|
|
|
);
|
2022-12-05 13:59:15 +00:00
|
|
|
|
2022-12-05 14:38:32 +00:00
|
|
|
Ok(Response::builder()
|
|
|
|
|
.status(status)
|
|
|
|
|
.header(http::header::CONTENT_TYPE, "text/plain")
|
|
|
|
|
.body(Body::from(status_str))?)
|
2022-12-05 13:59:15 +00:00
|
|
|
}
|
|
|
|
|
|
2022-05-24 10:16:39 +00:00
|
|
|
fn handle_metrics(&self) -> Result<Response<Body>, Error> {
|
2022-09-03 22:43:48 +00:00
|
|
|
#[cfg(feature = "metrics")]
|
|
|
|
|
{
|
|
|
|
|
use opentelemetry::trace::Tracer;
|
|
|
|
|
|
|
|
|
|
let mut buffer = vec![];
|
|
|
|
|
let encoder = TextEncoder::new();
|
|
|
|
|
|
|
|
|
|
let tracer = opentelemetry::global::tracer("garage");
|
|
|
|
|
let metric_families = tracer.in_span("admin/gather_metrics", |_| {
|
|
|
|
|
self.exporter.registry().gather()
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
encoder
|
|
|
|
|
.encode(&metric_families, &mut buffer)
|
|
|
|
|
.ok_or_internal_error("Could not serialize metrics")?;
|
|
|
|
|
|
|
|
|
|
Ok(Response::builder()
|
2022-10-16 17:46:15 +00:00
|
|
|
.status(StatusCode::OK)
|
2022-09-03 22:43:48 +00:00
|
|
|
.header(http::header::CONTENT_TYPE, encoder.format_type())
|
|
|
|
|
.body(Body::from(buffer))?)
|
|
|
|
|
}
|
|
|
|
|
#[cfg(not(feature = "metrics"))]
|
|
|
|
|
Err(Error::bad_request(
|
|
|
|
|
"Garage was built without the metrics feature".to_string(),
|
|
|
|
|
))
|
2022-05-24 10:16:39 +00:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[async_trait]
|
|
|
|
|
impl ApiHandler for AdminApiServer {
|
|
|
|
|
const API_NAME: &'static str = "admin";
|
|
|
|
|
const API_NAME_DISPLAY: &'static str = "Admin";
|
|
|
|
|
|
|
|
|
|
type Endpoint = Endpoint;
|
|
|
|
|
type Error = Error;
|
|
|
|
|
|
|
|
|
|
fn parse_endpoint(&self, req: &Request<Body>) -> Result<Endpoint, Error> {
|
|
|
|
|
Endpoint::from_request(req)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
async fn handle(
|
|
|
|
|
&self,
|
|
|
|
|
req: Request<Body>,
|
|
|
|
|
endpoint: Endpoint,
|
|
|
|
|
) -> Result<Response<Body>, Error> {
|
2024-02-29 09:57:07 +00:00
|
|
|
let required_auth_hash =
|
2022-05-24 10:16:39 +00:00
|
|
|
match endpoint.authorization_type() {
|
2022-12-05 13:59:15 +00:00
|
|
|
Authorization::None => None,
|
2024-02-29 09:57:07 +00:00
|
|
|
Authorization::MetricsToken => self.metrics_token.as_deref(),
|
|
|
|
|
Authorization::AdminToken => match self.admin_token.as_deref() {
|
2022-05-24 10:16:39 +00:00
|
|
|
None => return Err(Error::forbidden(
|
|
|
|
|
"Admin token isn't configured, admin API access is disabled for security.",
|
|
|
|
|
)),
|
|
|
|
|
Some(t) => Some(t),
|
|
|
|
|
},
|
|
|
|
|
};
|
|
|
|
|
|
2024-02-29 09:57:07 +00:00
|
|
|
if let Some(password_hash) = required_auth_hash {
|
2022-05-24 10:16:39 +00:00
|
|
|
match req.headers().get("Authorization") {
|
|
|
|
|
None => return Err(Error::forbidden("Authorization token must be provided")),
|
2024-02-29 09:57:07 +00:00
|
|
|
Some(authorization) => {
|
|
|
|
|
verify_bearer_token(&authorization, password_hash)?;
|
2022-05-24 10:16:39 +00:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
match endpoint {
|
|
|
|
|
Endpoint::Options => self.handle_options(&req),
|
2023-08-08 09:05:42 +00:00
|
|
|
Endpoint::CheckDomain => self.handle_check_domain(req).await,
|
2022-12-05 14:38:32 +00:00
|
|
|
Endpoint::Health => self.handle_health(),
|
2022-05-24 10:16:39 +00:00
|
|
|
Endpoint::Metrics => self.handle_metrics(),
|
|
|
|
|
Endpoint::GetClusterStatus => handle_get_cluster_status(&self.garage).await,
|
2022-12-05 14:38:32 +00:00
|
|
|
Endpoint::GetClusterHealth => handle_get_cluster_health(&self.garage).await,
|
2022-05-24 10:16:39 +00:00
|
|
|
Endpoint::ConnectClusterNodes => handle_connect_cluster_nodes(&self.garage, req).await,
|
|
|
|
|
// Layout
|
|
|
|
|
Endpoint::GetClusterLayout => handle_get_cluster_layout(&self.garage).await,
|
|
|
|
|
Endpoint::UpdateClusterLayout => handle_update_cluster_layout(&self.garage, req).await,
|
|
|
|
|
Endpoint::ApplyClusterLayout => handle_apply_cluster_layout(&self.garage, req).await,
|
|
|
|
|
Endpoint::RevertClusterLayout => handle_revert_cluster_layout(&self.garage, req).await,
|
|
|
|
|
// Keys
|
|
|
|
|
Endpoint::ListKeys => handle_list_keys(&self.garage).await,
|
|
|
|
|
Endpoint::GetKeyInfo { id, search } => {
|
|
|
|
|
handle_get_key_info(&self.garage, id, search).await
|
|
|
|
|
}
|
|
|
|
|
Endpoint::CreateKey => handle_create_key(&self.garage, req).await,
|
|
|
|
|
Endpoint::ImportKey => handle_import_key(&self.garage, req).await,
|
|
|
|
|
Endpoint::UpdateKey { id } => handle_update_key(&self.garage, id, req).await,
|
|
|
|
|
Endpoint::DeleteKey { id } => handle_delete_key(&self.garage, id).await,
|
|
|
|
|
// Buckets
|
|
|
|
|
Endpoint::ListBuckets => handle_list_buckets(&self.garage).await,
|
|
|
|
|
Endpoint::GetBucketInfo { id, global_alias } => {
|
|
|
|
|
handle_get_bucket_info(&self.garage, id, global_alias).await
|
|
|
|
|
}
|
|
|
|
|
Endpoint::CreateBucket => handle_create_bucket(&self.garage, req).await,
|
|
|
|
|
Endpoint::DeleteBucket { id } => handle_delete_bucket(&self.garage, id).await,
|
2022-06-15 18:20:28 +00:00
|
|
|
Endpoint::UpdateBucket { id } => handle_update_bucket(&self.garage, id, req).await,
|
2022-05-24 10:16:39 +00:00
|
|
|
// Bucket-key permissions
|
|
|
|
|
Endpoint::BucketAllowKey => {
|
|
|
|
|
handle_bucket_change_key_perm(&self.garage, req, true).await
|
|
|
|
|
}
|
|
|
|
|
Endpoint::BucketDenyKey => {
|
|
|
|
|
handle_bucket_change_key_perm(&self.garage, req, false).await
|
|
|
|
|
}
|
|
|
|
|
// Bucket aliasing
|
|
|
|
|
Endpoint::GlobalAliasBucket { id, alias } => {
|
|
|
|
|
handle_global_alias_bucket(&self.garage, id, alias).await
|
|
|
|
|
}
|
|
|
|
|
Endpoint::GlobalUnaliasBucket { id, alias } => {
|
|
|
|
|
handle_global_unalias_bucket(&self.garage, id, alias).await
|
|
|
|
|
}
|
|
|
|
|
Endpoint::LocalAliasBucket {
|
|
|
|
|
id,
|
|
|
|
|
access_key_id,
|
|
|
|
|
alias,
|
|
|
|
|
} => handle_local_alias_bucket(&self.garage, id, access_key_id, alias).await,
|
|
|
|
|
Endpoint::LocalUnaliasBucket {
|
|
|
|
|
id,
|
|
|
|
|
access_key_id,
|
|
|
|
|
alias,
|
|
|
|
|
} => handle_local_unalias_bucket(&self.garage, id, access_key_id, alias).await,
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
impl ApiEndpoint for Endpoint {
|
|
|
|
|
fn name(&self) -> &'static str {
|
|
|
|
|
Endpoint::name(self)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
fn add_span_attributes(&self, _span: SpanRef<'_>) {}
|
|
|
|
|
}
|
2024-02-29 09:57:07 +00:00
|
|
|
|
|
|
|
|
fn hash_bearer_token(token: &str) -> String {
|
|
|
|
|
use argon2::{
|
|
|
|
|
password_hash::{rand_core::OsRng, PasswordHasher, SaltString},
|
|
|
|
|
Argon2,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
let salt = SaltString::generate(&mut OsRng);
|
|
|
|
|
let argon2 = Argon2::default();
|
|
|
|
|
argon2
|
|
|
|
|
.hash_password(token.trim().as_bytes(), &salt)
|
|
|
|
|
.expect("could not hash API token")
|
|
|
|
|
.to_string()
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
fn verify_bearer_token(token: &hyper::http::HeaderValue, password_hash: &str) -> Result<(), Error> {
|
|
|
|
|
use argon2::{password_hash::PasswordVerifier, Argon2};
|
|
|
|
|
|
|
|
|
|
let parsed_hash = PasswordHash::new(&password_hash).unwrap();
|
|
|
|
|
|
|
|
|
|
token
|
|
|
|
|
.to_str()
|
|
|
|
|
.ok()
|
|
|
|
|
.and_then(|header| header.strip_prefix("Bearer "))
|
|
|
|
|
.and_then(|token| {
|
|
|
|
|
Argon2::default()
|
|
|
|
|
.verify_password(token.trim().as_bytes(), &parsed_hash)
|
|
|
|
|
.ok()
|
|
|
|
|
})
|
|
|
|
|
.ok_or_else(|| Error::forbidden("Invalid authorization token"))?;
|
|
|
|
|
|
|
|
|
|
Ok(())
|
|
|
|
|
}
|
