snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/security/certreload/certreload.go

@@ -0,0 +1,120 @@
+// Package certreload wraps grpc's pemfile.Provider so both TLS servers
+// (weed/security) and TLS clients (weed/util/http/client) can share one
+// reloading cert implementation without an import cycle between them.
+//
+// Lives in its own subpackage because weed/security already imports
+// weed/util/http/client (for LoadHTTPClientFromFile).
+package certreload
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"os"
+	"time"
+
+	"google.golang.org/grpc/credentials/tls/certprovider"
+	"google.golang.org/grpc/credentials/tls/certprovider/pemfile"
+)
+
+// RefreshIntervalEnv names an environment variable that overrides the
+// refresh cadence. Accepts any time.ParseDuration value (e.g. "30m",
+// "500ms"). Primarily a hook for integration tests that need rotation
+// to complete in seconds, but also useful in production when paired
+// with short-lived certs (e.g. Vault-issued).
+const RefreshIntervalEnv = "WEED_TLS_CERT_REFRESH_INTERVAL"
+
+// DefaultRefreshInterval is the cadence at which the pemfile provider
+// stats cert/key files on disk. It re-parses only when mtime/contents
+// change, so the hot path (KeyMaterial() on each TLS handshake) stays
+// cheap.
+//
+// 5 hours matches the prior constant used for gRPC mTLS. Resolved once
+// at process start from RefreshIntervalEnv if set.
+var DefaultRefreshInterval = resolveRefreshInterval(5 * time.Hour)
+
+func resolveRefreshInterval(fallback time.Duration) time.Duration {
+	if s := os.Getenv(RefreshIntervalEnv); s != "" {
+		if d, err := time.ParseDuration(s); err == nil && d > 0 {
+			return d
+		}
+	}
+	return fallback
+}
+
+// NewServerGetCertificate returns a callback suitable for
+// tls.Config.GetCertificate. It reloads certFile and keyFile from disk
+// on each refresh tick so rotated certs (e.g. from k8s cert-manager)
+// are picked up without a restart. Caller should Close() the returned
+// provider at shutdown.
+func NewServerGetCertificate(certFile, keyFile string) (func(*tls.ClientHelloInfo) (*tls.Certificate, error), certprovider.Provider, error) {
+	return newServerGetCertificate(certFile, keyFile, DefaultRefreshInterval)
+}
+
+func newServerGetCertificate(certFile, keyFile string, refresh time.Duration) (func(*tls.ClientHelloInfo) (*tls.Certificate, error), certprovider.Provider, error) {
+	provider, err := newProvider(certFile, keyFile, refresh)
+	if err != nil {
+		return nil, nil, err
+	}
+	get := func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
+		// KeyMaterial blocks until the pemfile provider has read the files
+		// for the first time. Use the handshake context so a stuck read
+		// bounds the handshake instead of hanging it forever.
+		ctx := context.Background()
+		if hello != nil {
+			ctx = hello.Context()
+		}
+		return current(ctx, provider, certFile)
+	}
+	return get, provider, nil
+}
+
+// NewClientGetCertificate returns a callback suitable for
+// tls.Config.GetClientCertificate. Fires per TLS handshake, so long-lived
+// HTTPS clients (FUSE mount, backup, filer→volume, etc.) pick up rotated
+// client mTLS certs as pooled connections recycle.
+func NewClientGetCertificate(certFile, keyFile string) (func(*tls.CertificateRequestInfo) (*tls.Certificate, error), certprovider.Provider, error) {
+	return newClientGetCertificate(certFile, keyFile, DefaultRefreshInterval)
+}
+
+func newClientGetCertificate(certFile, keyFile string, refresh time.Duration) (func(*tls.CertificateRequestInfo) (*tls.Certificate, error), certprovider.Provider, error) {
+	provider, err := newProvider(certFile, keyFile, refresh)
+	if err != nil {
+		return nil, nil, err
+	}
+	get := func(cri *tls.CertificateRequestInfo) (*tls.Certificate, error) {
+		ctx := context.Background()
+		if cri != nil {
+			ctx = cri.Context()
+		}
+		return current(ctx, provider, certFile)
+	}
+	return get, provider, nil
+}
+
+func newProvider(certFile, keyFile string, refresh time.Duration) (certprovider.Provider, error) {
+	if certFile == "" || keyFile == "" {
+		return nil, fmt.Errorf("both certFile and keyFile are required")
+	}
+	provider, err := pemfile.NewProvider(pemfile.Options{
+		CertFile:        certFile,
+		KeyFile:         keyFile,
+		RefreshDuration: refresh,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("pemfile.NewProvider: %w", err)
+	}
+	return provider, nil
+}
+
+func current(ctx context.Context, provider certprovider.Provider, certFile string) (*tls.Certificate, error) {
+	km, err := provider.KeyMaterial(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if km == nil || len(km.Certs) == 0 {
+		return nil, fmt.Errorf("no TLS key material available for %s", certFile)
+	}
+	cert := km.Certs[0]
+	return &cert, nil
+}

weed/security/certreload/certreload_test.go

@@ -0,0 +1,122 @@
+package certreload
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// TestServerGetCertificatePicksUpNewFile writes an initial cert/key
+// pair, starts the reloader, then overwrites the files with a new pair
+// and asserts that the callback eventually returns the new certificate.
+func TestServerGetCertificatePicksUpNewFile(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+
+	if err := writeSelfSigned(certPath, keyPath, "first"); err != nil {
+		t.Fatalf("write first cert: %v", err)
+	}
+
+	// Use a short refresh window so the test doesn't wait 5h.
+	getCert, provider, err := newServerGetCertificate(certPath, keyPath, 100*time.Millisecond)
+	if err != nil {
+		t.Fatalf("newServerGetCertificate: %v", err)
+	}
+	defer provider.Close()
+
+	c1, err := getCert(nil)
+	if err != nil {
+		t.Fatalf("initial getCert: %v", err)
+	}
+	first, err := x509.ParseCertificate(c1.Certificate[0])
+	if err != nil {
+		t.Fatalf("parse first cert: %v", err)
+	}
+	if first.Subject.CommonName != "first" {
+		t.Fatalf("want CN=first, got %q", first.Subject.CommonName)
+	}
+
+	// Rotate the files. pemfile watches mtime; sleep so the new files have
+	// a later mtime even on filesystems with 1s granularity.
+	time.Sleep(1100 * time.Millisecond)
+	if err := writeSelfSigned(certPath, keyPath, "second"); err != nil {
+		t.Fatalf("write second cert: %v", err)
+	}
+
+	// The pemfile poller can briefly observe a mismatched cert/key pair
+	// during rotation (cert written before key). Tolerate transient errors
+	// and only fail at the deadline; keep the last error for diagnostics.
+	var lastErr error
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		c2, err := getCert(nil)
+		if err != nil {
+			lastErr = err
+			time.Sleep(100 * time.Millisecond)
+			continue
+		}
+		parsed, err := x509.ParseCertificate(c2.Certificate[0])
+		if err != nil {
+			lastErr = err
+			time.Sleep(100 * time.Millisecond)
+			continue
+		}
+		if parsed.Subject.CommonName == "second" {
+			return
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	t.Fatalf("reloader did not pick up rotated cert within timeout; last error: %v", lastErr)
+}
+
+func writeSelfSigned(certPath, keyPath, commonName string) error {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return err
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(time.Now().UnixNano()),
+		Subject:      pkix.Name{CommonName: commonName},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		return err
+	}
+	certOut, err := os.Create(certPath)
+	if err != nil {
+		return err
+	}
+	if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: der}); err != nil {
+		certOut.Close()
+		return err
+	}
+	if err := certOut.Close(); err != nil {
+		return err
+	}
+	keyDER, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return err
+	}
+	keyOut, err := os.Create(keyPath)
+	if err != nil {
+		return err
+	}
+	if err := pem.Encode(keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}); err != nil {
+		keyOut.Close()
+		return err
+	}
+	return keyOut.Close()
+}