s3api: actually execute check_pipeline in real world

Code Issues Proposed changes

Previously, S3ApiMiddleware.check_pipeline would always exit early
because the __file__ attribute of the Config instance passed to
check_pipeline was never set. The __file__ key is typically passed to
the S3ApiMiddleware constructor in the wsgi config dict, so this dict
is now passed to check_pipeline() for it to test for the existence of
__file__.
Also, the use of a Config object is replaced with a dict where it
mimics the wsgi conf object in the unit tests setup.
UpgradeImpact
=============
The bug prevented the pipeline order checks described in
proxy-server.conf-sample being made on the proxy-server pipeline when
s3api middleware was included. With this change, these checks will now
be made and an invalid pipeline configuration will result in a
ValueError being raised during proxy-server startup.
A valid pipeline has another middleware (presumed to be an auth
middleware) between s3api and the proxy-server app. If keystoneauth is
found, then a further check is made that s3token is configured after
s3api and before keystoneauth.
The pipeline order checks can be disabled by setting the s3api
auth_pipeline_check option to False in proxy-server.conf. This
mitigation is recommended if previously operating with what will now
be considered an invalid pipeline.
The bug also prevented a check for slo middleware being in the
pipeline between s3api and the proxy-server app. If the slo middleware
is not found then multipart uploads will now not be supported,
regardless of the value of the allow_multipart_uploads option
described in proxy-server.conf-sample. In this case a warning will be
logged during startup but no exception is raised.
Closes-Bug: #1912391
Change-Id: I357537492733b97e5afab4a7b8e6a5c527c650e4

This commit is contained in:

Alistair Coles

2021年01月19日 14:25:09 +00:00

parent 4ee05c5ddc

commit 6896f1f54b

6 changed files with 74 additions and 51 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

4
etc/proxy-server.conf-sample

View File

@@ -583,7 +583,9 @@ use = egg:swift#s3api

# Enable multi-part uploads. (default: true)

# This is required to store files larger than Swift's max_file_size (by

# default, 5GiB). Note that has performance implications when deleting objects,

# as we now have to check for whether there are also segments to delete.

# as we now have to check for whether there are also segments to delete. The

# SLO middleware must be in the pipeline after s3api for this option to have

# effect.

# allow_multipart_uploads = True

#

# Set the maximum number of parts for Upload Part operation.(default: 1000)

s3api: actually execute check_pipeline in real world

4 etc/proxy-server.conf-sample Unescape Escape View File

4
etc/proxy-server.conf-sample

View File