mirror of
https://github.com/owncloud/ocis.git
synced 2026-10-23 23:29:02 +03:00
* fix: the public share configuration and fixed graceful shutdown
* fix: [OCISDEV-1433] remove GRPC_MAX_CONNECTION_AGE
The setting closed healthy grpc connections on a timer so that clients would redo
their DNS lookup. It never helped against the failure it was reached for - a
connection whose peer stopped answering - because the age limit is enforced by
the server, the grace period was left at infinity so a request already in flight
was never ended, and any value without a unit suffix silently disabled it again.
Detecting a peer that stops answering is now the job of the grpc clients, which
ping the peer while a request is in flight. The servers here got the matching
enforcement policy so they accept those pings; the client side arrives with the
next reva bump.
* fix: Added the new variable OCDAV_DISABLE_PROPFIND_PUBLIC_LINK_RESOLUTION that disable the resolution of public link shares when answering PROPFIND requests.
* chore: bump reva
* fix: The keepalive added to grpc clinet
* chore: bump reva
* build(deps): bump go 1.26.8, grpc-go dependency
---------
(cherry picked from commit e86eb4d210)
For the 9.0 branch, the reva dependency was pointed at reva's main-branch
merge of PR #748 (commit 373f9509a, pseudo-version
v2.0.0-20261005091647-373f9509a363) instead of the 8.2-targeted
e0beaa380005, since the 8.2 merge predates the VaultMode/UploadSessionFilter.Orphaned
APIs already present on the 9.0 reva lineage.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Conflicts:
# changelog/unreleased/security-bump-grpc.md
# go.mod
# go.sum
# vendor/google.golang.org/grpc/server.go
# vendor/google.golang.org/grpc/stream.go
# vendor/google.golang.org/grpc/version.go
# vendor/modules.txt
145 lines
5.5 KiB
Go
145 lines
5.5 KiB
Go
package command
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"os/signal"
|
|
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/broker"
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/config/configlog"
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/cors"
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/registry"
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/runner"
|
|
ohttp "github.com/owncloud/ocis/v2/ocis-pkg/service/http"
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/tracing"
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/version"
|
|
"github.com/owncloud/ocis/v2/services/ocdav/pkg/config"
|
|
"github.com/owncloud/ocis/v2/services/ocdav/pkg/config/parser"
|
|
"github.com/owncloud/ocis/v2/services/ocdav/pkg/logging"
|
|
"github.com/owncloud/ocis/v2/services/ocdav/pkg/server/debug"
|
|
"github.com/owncloud/reva/v2/pkg/micro/ocdav"
|
|
"github.com/owncloud/reva/v2/pkg/sharedconf"
|
|
"github.com/urfave/cli/v2"
|
|
)
|
|
|
|
// Server is the entry point for the server command.
|
|
func Server(cfg *config.Config) *cli.Command {
|
|
return &cli.Command{
|
|
Name: "server",
|
|
Usage: fmt.Sprintf("start the %s service without runtime (unsupervised mode)", cfg.Service.Name),
|
|
Category: "server",
|
|
Before: func(c *cli.Context) error {
|
|
return configlog.ReturnFatal(parser.ParseConfig(cfg))
|
|
},
|
|
Action: func(c *cli.Context) error {
|
|
logger := logging.Configure(cfg.Service.Name, cfg.Log)
|
|
traceProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
var cancel context.CancelFunc
|
|
if cfg.Context == nil {
|
|
cfg.Context, cancel = signal.NotifyContext(context.Background(), runner.StopSignals...)
|
|
defer cancel()
|
|
}
|
|
ctx := cfg.Context
|
|
|
|
gr := runner.NewGroup()
|
|
|
|
// init reva shared config explicitly as the go-micro based ocdav does not use
|
|
// the reva runtime. But we need e.g. the shared client settings to be initialized
|
|
sc := map[string]interface{}{
|
|
"jwt_secret": cfg.TokenManager.JWTSecret,
|
|
"gatewaysvc": cfg.Reva.Address,
|
|
"skip_user_groups_in_token": cfg.SkipUserGroupsInToken,
|
|
"grpc_client_options": cfg.Reva.GetGRPCClientConfig(),
|
|
}
|
|
if err := sharedconf.Decode(sc); err != nil {
|
|
logger.Error().Err(err).Msg("error decoding shared config for ocdav")
|
|
}
|
|
|
|
corsAllowCredentials := cfg.HTTP.CORS.AllowCredentials
|
|
if corsAllowCredentials && cors.AllowsAnyOrigin(cfg.HTTP.CORS.AllowedOrigins) {
|
|
logger.Warn().
|
|
Strs("allowed_origins", cfg.HTTP.CORS.AllowedOrigins).
|
|
Msg("cors: refusing to allow credentials together with a wildcard origin, disabling allow_credentials")
|
|
corsAllowCredentials = false
|
|
}
|
|
opts := []ocdav.Option{
|
|
ocdav.Name(cfg.HTTP.Namespace + "." + cfg.Service.Name),
|
|
ocdav.Version(version.GetString()),
|
|
ocdav.Context(ctx),
|
|
ocdav.Logger(logger.Logger),
|
|
ocdav.Address(cfg.HTTP.Addr),
|
|
ocdav.AllowCredentials(corsAllowCredentials),
|
|
ocdav.AllowedMethods(cfg.HTTP.CORS.AllowedMethods),
|
|
ocdav.AllowedHeaders(cfg.HTTP.CORS.AllowedHeaders),
|
|
ocdav.AllowedOrigins(cfg.HTTP.CORS.AllowedOrigins),
|
|
ocdav.FilesNamespace(cfg.FilesNamespace),
|
|
ocdav.WebdavNamespace(cfg.WebdavNamespace),
|
|
ocdav.OCMNamespace(cfg.OCMNamespace),
|
|
ocdav.AllowDepthInfinity(cfg.AllowPropfindDepthInfinity),
|
|
ocdav.DisablePropfindPublicLinkResolution(cfg.DisablePropfindPublicLinkResolution),
|
|
ocdav.SharesNamespace(cfg.SharesNamespace),
|
|
ocdav.Timeout(cfg.Timeout),
|
|
ocdav.Insecure(cfg.Insecure),
|
|
ocdav.PublicURL(cfg.PublicURL),
|
|
ocdav.Prefix(cfg.HTTP.Prefix),
|
|
ocdav.GatewaySvc(cfg.Reva.Address),
|
|
ocdav.JWTSecret(cfg.TokenManager.JWTSecret),
|
|
ocdav.ProductName(cfg.Status.ProductName),
|
|
ocdav.ProductVersion(cfg.Status.ProductVersion),
|
|
ocdav.Product(cfg.Status.Product),
|
|
ocdav.Version(cfg.Status.Version),
|
|
ocdav.VersionString(cfg.Status.VersionString),
|
|
ocdav.Edition(cfg.Status.Edition),
|
|
ocdav.MachineAuthAPIKey(cfg.MachineAuthAPIKey),
|
|
ocdav.Broker(broker.NoOp{}),
|
|
// ocdav.FavoriteManager() // FIXME needs a proper persistence implementation https://github.com/owncloud/ocis/issues/1228
|
|
// ocdav.LockSystem(), // will default to the CS3 lock system
|
|
// ocdav.TLSConfig() // tls config for the http server
|
|
ocdav.MetricsEnabled(true),
|
|
ocdav.MetricsNamespace("ocis"),
|
|
ocdav.Tracing("Adding these strings is a workaround for ->", "https://github.com/cs3org/reva/issues/4131"),
|
|
ocdav.WithTraceProvider(traceProvider),
|
|
ocdav.RegisterTTL(registry.GetRegisterTTL()),
|
|
ocdav.RegisterInterval(registry.GetRegisterInterval()),
|
|
}
|
|
|
|
s, err := ocdav.Service(opts...)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// creating a runner for a go-micro service is a bit complex, so we'll
|
|
// wrap the go-micro service with an ocis service the same way as
|
|
// ocis-pkg/service/http is doing in order to reuse the factory.
|
|
gr.Add(runner.NewGoMicroHttpServerRunner(cfg.Service.Name+".http", ohttp.Service{Service: s}))
|
|
|
|
debugServer, err := debug.Server(
|
|
debug.Logger(logger),
|
|
debug.Context(ctx),
|
|
debug.Config(cfg),
|
|
)
|
|
|
|
if err != nil {
|
|
logger.Info().Err(err).Str("server", "debug").Msg("Failed to initialize server")
|
|
return err
|
|
}
|
|
|
|
gr.Add(runner.NewGolangHttpServerRunner(cfg.Service.Name+".debug", debugServer))
|
|
|
|
logger.Warn().Msgf("starting service %s", cfg.Service.Name)
|
|
grResults := gr.Run(ctx)
|
|
|
|
if err := runner.ProcessResults(grResults); err != nil {
|
|
logger.Error().Err(err).Msgf("service %s stopped with error", cfg.Service.Name)
|
|
return err
|
|
}
|
|
logger.Warn().Msgf("service %s stopped without error", cfg.Service.Name)
|
|
return nil
|
|
},
|
|
}
|
|
}
|