From 0af5d22286e69e3cb9bc00286226188070287b01 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Mon, 7 Sep 2026 13:31:05 +0800 Subject: [PATCH 1/2] fix: restore embedded Console proxy and WebSocket configuration Signed-off-by: Feng Ruohang --- cmd/common-main.go | 24 +++++++++++- cmd/common-main_test.go | 83 +++++++++++++++++++++++++++++++++++++++++ go.mod | 2 +- go.sum | 4 +- 4 files changed, 108 insertions(+), 5 deletions(-) diff --git a/cmd/common-main.go b/cmd/common-main.go index e4c96c149..7ffe22202 100644 --- a/cmd/common-main.go +++ b/cmd/common-main.go @@ -257,11 +257,31 @@ func buildOpenIDConsoleConfig() consoleoauth2.OpenIDPCfg { return m } -func initConsoleServer() (*consoleapi.Server, error) { - // unset all console_ environment variables. +// resetConsoleEnvironment preserves the embedded Console's supported resource +// settings verbatim. Server derives all other Console settings itself. +func resetConsoleEnvironment() { for _, cenv := range env.List(consolePrefix) { + switch cenv { + case consoleapi.ConsoleWSMaxConnections, + consoleapi.ConsoleWSMaxConnectionsPerClient, + consoleapi.ConsoleWSMaxAnonymousConnections, + consoleapi.ConsoleWSMaxAnonymousConnectionsPerClient: + continue + } os.Unsetenv(cenv) } +} + +func initConsoleServer() (*consoleapi.Server, error) { + resetConsoleEnvironment() + // Validate explicitly: ConfigureAPI logs errors, but embedded Console logs + // are normally silenced. Return configuration failures to Server startup. + if err := consoleapi.ConfigureEmbeddedSourceIPTrust(); err != nil { + return nil, err + } + if err := consoleapi.ConfigureWebSocketLimits(); err != nil { + return nil, err + } // enable all console environment variables minioConfigToConsoleFeatures() diff --git a/cmd/common-main_test.go b/cmd/common-main_test.go index 7a5c43656..624c42c92 100644 --- a/cmd/common-main_test.go +++ b/cmd/common-main_test.go @@ -26,6 +26,7 @@ import ( "strings" "testing" + consoleapi "github.com/minio/console/api" "github.com/minio/minio/internal/config" ) @@ -425,3 +426,85 @@ func TestConsoleMinIOServerEnv(t *testing.T) { }) } } + +// The startup path clears process environment, so preserve all existing Console +// variables, including ones unrelated to this test, before exercising it. +func preserveConsoleEnvironment(t *testing.T) { + t.Helper() + for _, entry := range os.Environ() { + if strings.HasPrefix(entry, consolePrefix) { + name, value, _ := strings.Cut(entry, "=") + t.Setenv(name, value) + } + } +} + +func TestResetConsoleEnvironment(t *testing.T) { + preserveConsoleEnvironment(t) + settings := map[string]string{ + consoleapi.ConsoleWSMaxConnections: "2048", + consoleapi.ConsoleWSMaxConnectionsPerClient: "512", + consoleapi.ConsoleWSMaxAnonymousConnections: "128", + consoleapi.ConsoleWSMaxAnonymousConnectionsPerClient: "16", + } + for key, value := range settings { + t.Setenv(key, value) + } + decoys := []string{"CONSOLE_MINIO_SERVER_TLS_SKIP_VERIFY", "CONSOLE_MINIO_SERVER", "CONSOLE_PBKDF_SALT", "CONSOLE_TRUSTED_PROXIES", "CONSOLE_WS_MAX_UNKNOWN"} + for _, key := range decoys { + t.Setenv(key, "operator-value") + } + resetConsoleEnvironment() + for key, want := range settings { + if got, present := os.LookupEnv(key); !present || got != want { + t.Errorf("%s = %q, present = %v; want %q", key, got, present, want) + } + } + for _, key := range decoys { + if _, present := os.LookupEnv(key); present { + t.Errorf("unsupported override %s survived", key) + } + } + for _, raw := range []string{"", " 16 ", "env://missing-limit"} { + t.Setenv(consoleapi.ConsoleWSMaxAnonymousConnectionsPerClient, raw) + resetConsoleEnvironment() + if got, present := os.LookupEnv(consoleapi.ConsoleWSMaxAnonymousConnectionsPerClient); !present || got != raw { + t.Fatalf("raw value %q was changed to %q (present = %v)", raw, got, present) + } + } + os.Unsetenv(consoleapi.ConsoleWSMaxAnonymousConnectionsPerClient) + resetConsoleEnvironment() + if _, present := os.LookupEnv(consoleapi.ConsoleWSMaxAnonymousConnectionsPerClient); present { + t.Fatal("unset setting became present") + } +} + +func TestInitConsoleServerConfigurationErrors(t *testing.T) { + for _, tt := range []struct { + name, proxy, limit, want string + }{ + {"proxy error precedes limit error", "proxy.internal", "bad", "MINIO_API_TRUSTED_PROXIES"}, + {"blank limit", "", "", "CONSOLE_WS_MAX_ANONYMOUS_CONNECTIONS_PER_CLIENT"}, + {"non-integer limit", "", "bad", "CONSOLE_WS_MAX_ANONYMOUS_CONNECTIONS_PER_CLIENT"}, + {"out-of-range limit", "", "0", "CONSOLE_WS_MAX_ANONYMOUS_CONNECTIONS_PER_CLIENT"}, + {"inconsistent limits", "", "256", "must be less than"}, + } { + t.Run(tt.name, func(t *testing.T) { + // Restore the process-wide library configuration after environment cleanup. + t.Cleanup(func() { + _ = consoleapi.ConfigureEmbeddedSourceIPTrust() + _ = consoleapi.ConfigureWebSocketLimits() + }) + preserveConsoleEnvironment(t) + t.Setenv(consoleapi.EnvMinIOTrustedProxies, tt.proxy) + t.Setenv(consoleapi.ConsoleWSMaxConnections, "1024") + t.Setenv(consoleapi.ConsoleWSMaxConnectionsPerClient, "256") + t.Setenv(consoleapi.ConsoleWSMaxAnonymousConnections, "64") + t.Setenv(consoleapi.ConsoleWSMaxAnonymousConnectionsPerClient, tt.limit) + server, err := initConsoleServer() + if err == nil || !strings.Contains(err.Error(), tt.want) || server != nil { + t.Fatalf("initConsoleServer() = %v, %v; want nil server and %q error", server, err, tt.want) + } + }) + } +} diff --git a/go.mod b/go.mod index cbd5e23c2..44899bd65 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.27.1 // Console and MC retain their historical module paths for best-effort upstream // compatibility. Pin the maintained PGSTY implementations used by SILO. -replace github.com/minio/console => github.com/pgsty/silo-console v0.0.0-20260903111932-464a59d73ada +replace github.com/minio/console => github.com/pgsty/silo-console v0.0.0-20260907052338-a0e609cbc61a replace github.com/minio/mc => github.com/pgsty/mc v0.0.0-20260903063637-a2ef95c035d9 diff --git a/go.sum b/go.sum index 8b7f48705..4ec7bf47f 100644 --- a/go.sum +++ b/go.sum @@ -547,8 +547,8 @@ github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwp github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic= github.com/pgsty/mc v0.0.0-20260903063637-a2ef95c035d9 h1:kJkqK0hJrmvdTOPiI98HoPmET0SHYI9+ytaTRzQdGAs= github.com/pgsty/mc v0.0.0-20260903063637-a2ef95c035d9/go.mod h1:+j12ENu7ggWIaBY4nakGABVmkjfJgogzijHIbaJFSOk= -github.com/pgsty/silo-console v0.0.0-20260903111932-464a59d73ada h1:vJkxm7GTLL0AvIGIt+JxMfhjMO5+msmj4rLeFueTaG8= -github.com/pgsty/silo-console v0.0.0-20260903111932-464a59d73ada/go.mod h1:lInRIXU5jctVcagYHkvDuFRUYm/eCOJ1VNt1tciTHso= +github.com/pgsty/silo-console v0.0.0-20260907052338-a0e609cbc61a h1:cjrffMJfZlwvDOM+0qk+QwuV6MY/I5+d8ztZ4UWVzrM= +github.com/pgsty/silo-console v0.0.0-20260907052338-a0e609cbc61a/go.mod h1:lInRIXU5jctVcagYHkvDuFRUYm/eCOJ1VNt1tciTHso= github.com/pgsty/silo-pkg/v3 v3.13.2 h1:Clw11c/J54Tx6pijNCWtXiC7e0fwP/f5Tgeb6fsXg2w= github.com/pgsty/silo-pkg/v3 v3.13.2/go.mod h1:0GmaDA0ArQ8bkAI/obiSNTBQzdgBu6W0e0olDCbyXXo= github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM= From 9c6c9805deedb7e4b50bf97725b44391a4c2c256 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Tue, 8 Sep 2026 10:00:45 +0800 Subject: [PATCH 2/2] fix: select the validated Console mainline for embedding Signed-off-by: Feng Ruohang --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 44899bd65..ea9743f5f 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.27.1 // Console and MC retain their historical module paths for best-effort upstream // compatibility. Pin the maintained PGSTY implementations used by SILO. -replace github.com/minio/console => github.com/pgsty/silo-console v0.0.0-20260907052338-a0e609cbc61a +replace github.com/minio/console => github.com/pgsty/silo-console v0.0.0-20260908011343-b39a84ada5e8 replace github.com/minio/mc => github.com/pgsty/mc v0.0.0-20260903063637-a2ef95c035d9 diff --git a/go.sum b/go.sum index 4ec7bf47f..b6dc012d4 100644 --- a/go.sum +++ b/go.sum @@ -547,8 +547,8 @@ github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwp github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic= github.com/pgsty/mc v0.0.0-20260903063637-a2ef95c035d9 h1:kJkqK0hJrmvdTOPiI98HoPmET0SHYI9+ytaTRzQdGAs= github.com/pgsty/mc v0.0.0-20260903063637-a2ef95c035d9/go.mod h1:+j12ENu7ggWIaBY4nakGABVmkjfJgogzijHIbaJFSOk= -github.com/pgsty/silo-console v0.0.0-20260907052338-a0e609cbc61a h1:cjrffMJfZlwvDOM+0qk+QwuV6MY/I5+d8ztZ4UWVzrM= -github.com/pgsty/silo-console v0.0.0-20260907052338-a0e609cbc61a/go.mod h1:lInRIXU5jctVcagYHkvDuFRUYm/eCOJ1VNt1tciTHso= +github.com/pgsty/silo-console v0.0.0-20260908011343-b39a84ada5e8 h1:B270uCa2FLThDqTIJ+TzKksOWAfjmik5mcugwZFVn4s= +github.com/pgsty/silo-console v0.0.0-20260908011343-b39a84ada5e8/go.mod h1:lInRIXU5jctVcagYHkvDuFRUYm/eCOJ1VNt1tciTHso= github.com/pgsty/silo-pkg/v3 v3.13.2 h1:Clw11c/J54Tx6pijNCWtXiC7e0fwP/f5Tgeb6fsXg2w= github.com/pgsty/silo-pkg/v3 v3.13.2/go.mod h1:0GmaDA0ArQ8bkAI/obiSNTBQzdgBu6W0e0olDCbyXXo= github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=