mirror of
https://github.com/owncloud/ocis.git
synced 2026-10-23 23:29:02 +03:00
9143307b70
* fix: the public share configuration and fixed graceful shutdown
* fix: [OCISDEV-1433] remove GRPC_MAX_CONNECTION_AGE
The setting closed healthy grpc connections on a timer so that clients would redo
their DNS lookup. It never helped against the failure it was reached for - a
connection whose peer stopped answering - because the age limit is enforced by
the server, the grace period was left at infinity so a request already in flight
was never ended, and any value without a unit suffix silently disabled it again.
Detecting a peer that stops answering is now the job of the grpc clients, which
ping the peer while a request is in flight. The servers here got the matching
enforcement policy so they accept those pings; the client side arrives with the
next reva bump.
* fix: Added the new variable OCDAV_DISABLE_PROPFIND_PUBLIC_LINK_RESOLUTION that disable the resolution of public link shares when answering PROPFIND requests.
* chore: bump reva
* fix: The keepalive added to grpc clinet
* chore: bump reva
* build(deps): bump go 1.26.8, grpc-go dependency
---------
(cherry picked from commit e86eb4d210)
For the 9.0 branch, the reva dependency was pointed at reva's main-branch
merge of PR #748 (commit 373f9509a, pseudo-version
v2.0.0-20261005091647-373f9509a363) instead of the 8.2-targeted
e0beaa380005, since the 8.2 merge predates the VaultMode/UploadSessionFilter.Orphaned
APIs already present on the 9.0 reva lineage.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Conflicts:
# changelog/unreleased/security-bump-grpc.md
# go.mod
# go.sum
# vendor/google.golang.org/grpc/server.go
# vendor/google.golang.org/grpc/stream.go
# vendor/google.golang.org/grpc/version.go
# vendor/modules.txt
72 lines
1.9 KiB
Go
72 lines
1.9 KiB
Go
package parser
|
|
|
|
import (
|
|
"errors"
|
|
|
|
ociscfg "github.com/owncloud/ocis/v2/ocis-pkg/config"
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/shared"
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/structs"
|
|
"github.com/owncloud/ocis/v2/services/frontend/pkg/config"
|
|
"github.com/owncloud/ocis/v2/services/frontend/pkg/config/defaults"
|
|
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/config/envdecode"
|
|
)
|
|
|
|
// ParseConfig loads configuration from known paths.
|
|
func ParseConfig(cfg *config.Config) error {
|
|
err := ociscfg.BindSourcesToStructs(cfg.Service.Name, cfg)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
defaults.EnsureDefaults(cfg)
|
|
|
|
// load all env variables relevant to the config in the current context.
|
|
if err := envdecode.Decode(cfg); err != nil {
|
|
// no environment variable set for this config is an expected "error"
|
|
if !errors.Is(err, envdecode.ErrNoTargetFieldsAreSet) {
|
|
return err
|
|
}
|
|
}
|
|
|
|
defaults.Sanitize(cfg)
|
|
|
|
return Validate(cfg)
|
|
}
|
|
|
|
func Validate(cfg *config.Config) error {
|
|
if cfg.TokenManager.JWTSecret == "" {
|
|
return shared.MissingJWTTokenError(cfg.Service.Name)
|
|
}
|
|
|
|
if cfg.TransferSecret == "" {
|
|
return shared.MissingRevaTransferSecretError(cfg.Service.Name)
|
|
}
|
|
|
|
if cfg.MachineAuthAPIKey == "" {
|
|
return shared.MissingMachineAuthApiKeyError(cfg.Service.Name)
|
|
}
|
|
|
|
if cfg.GRPCClientTLS == nil && cfg.Commons != nil {
|
|
cfg.GRPCClientTLS = structs.CopyOrZeroValue(cfg.Commons.GRPCClientTLS)
|
|
}
|
|
|
|
if cfg.GRPCClientOptions == nil && cfg.Commons != nil {
|
|
cfg.GRPCClientOptions = structs.CopyOrZeroValue(cfg.Commons.GRPCClientOptions)
|
|
}
|
|
|
|
// Set password enforcement on all public links when config is set
|
|
if cfg.OCS.PublicShareMustHavePassword {
|
|
cfg.OCS.WriteablePublicShareMustHavePassword = true
|
|
}
|
|
|
|
if cfg.ServiceAccount.ServiceAccountID == "" {
|
|
return shared.MissingServiceAccountID(cfg.Service.Name)
|
|
}
|
|
if cfg.ServiceAccount.ServiceAccountSecret == "" {
|
|
return shared.MissingServiceAccountSecret(cfg.Service.Name)
|
|
}
|
|
|
|
return nil
|
|
}
|