Is it possible for an attacker can fill a disk with old tombstones, slowing down object servers in the least with DELETE requests? I am not entirely sure I understand all of the DELETE behavior.
See the following patch which is a unit test which details the behavior (this currently fails on the last check because no metadata is pulled from the tombstone, so the container update is always performed).
diff --git a/test/unit/obj/test_server.py b/test/unit/obj/test_server.py
index e3f24d6..27f75d9 100755
--- a/test/unit/obj/test_server.py
+++ b/test/unit/obj/test_server.py
@@ -1410,6 +1410,115 @@ class TestObjectController(unittest.TestCase):
timestamp + '.ts')
self.assert_(os.path.isfile(objfile))
+ def test_DELETE_container_updates(self):
+ # Test swift.object_server.ObjectController.DELETE and container
+ # updates, making sure container update is called in the correct
+ # state.
+ timestamp = normalize_timestamp(time())
+ req = Request.blank('/sda1/p/a/c/o', environ={'REQUEST_METHOD': 'PUT'},
+ headers={
+ 'X-Timestamp': timestamp,
+ 'Content-Type': 'application/octet-stream',
+ 'Content-Length': '4',
+ })
+ req.body = 'test'
+ resp = self.object_controller.PUT(req)
+ self.assertEquals(resp.status_int, 201)
+
+ calls_made = [0]
+
+ def our_container_update(*args, **kwargs):
+ calls_made[0] += 1
+
+ orig_cu = self.object_controller.container_update
+ self.object_controller.container_update = our_container_update
+ try:
+ # The following request should return 204, but the object won't be
+ # truly deleted (container update is not performed) because the
+ # timestamp is old. A tombstone file should have been created with
+ # this timestamp.
+ #
+ # FIXME - When we know a newer file exists, should this not return
+ # HTTPConflict, and a tombstone not be created?
+ timestamp = normalize_timestamp(float(timestamp) - 1)
+ req = Request.blank('/sda1/p/a/c/o',
+ environ={'REQUEST_METHOD': 'DELETE'},
+ headers={'X-Timestamp': timestamp})
+ resp = self.object_controller.DELETE(req)
+ self.assertEquals(resp.status_int, 204)
+ objfile = os.path.join(self.testdir, 'sda1',
+ storage_directory(object_server.DATADIR, 'p',
+ hash_path('a', 'c', 'o')),
+ timestamp + '.ts')
+ self.assert_(os.path.isfile(objfile))
+ self.assertEquals(0, calls_made[0])
+
+ # The following request should return 204, and the object should
+ # be truly deleted (container update is performed) because this
+ # timestamp is newer. A tombstone file should have been created
+ # with this timestamp.
+ sleep(.00001)
+ timestamp = normalize_timestamp(time())
+ req = Request.blank('/sda1/p/a/c/o',
+ environ={'REQUEST_METHOD': 'DELETE'},
+ headers={'X-Timestamp': timestamp})
+ resp = self.object_controller.DELETE(req)
+ self.assertEquals(resp.status_int, 204)
+ objfile = os.path.join(self.testdir, 'sda1',
+ storage_directory(object_server.DATADIR, 'p',
+ hash_path('a', 'c', 'o')),
+ timestamp + '.ts')
+ self.assert_(os.path.isfile(objfile))
+ self.assertEquals(1, calls_made[0])
+
+ # The following request should return a 404, as the object should
+ # already have been deleted, but it should have also performed a
+ # container update because the timestamp is newer, and a tombstone
+ # file should also exist for this timestamp.
+ #
+ # FIXME - A malicious client can cause a set of object servers to
+ # update containers and fill the volume with .ts files as the code
+ # stands: if the file is already deleted, should this not just
+ # return a 404 and avoid all the updates and tombstones?
+ sleep(.00001)
+ timestamp = normalize_timestamp(time())
+ req = Request.blank('/sda1/p/a/c/o',
+ environ={'REQUEST_METHOD': 'DELETE'},
+ headers={'X-Timestamp': timestamp})
+ resp = self.object_controller.DELETE(req)
+ self.assertEquals(resp.status_int, 404)
+ objfile = os.path.join(self.testdir, 'sda1',
+ storage_directory(object_server.DATADIR, 'p',
+ hash_path('a', 'c', 'o')),
+ timestamp + '.ts')
+ self.assert_(os.path.isfile(objfile))
+ self.assertEquals(2, calls_made[0])
+
+
+ # The following request should return a 404, as the object should
+ # already have been deleted, and it should not have performed a
+ # container update because the timestamp is oler, though a
+ # tombstone file should also have been created with this
+ # timestamp.
+ #
+ # FIXME - A malicious client can cause an object server to fill up
+ # the volume with .ts files as the code stands: should we not
+ # allow new tombstone files to be create without older timestamps?
+ timestamp = normalize_timestamp(float(timestamp) - 1)
+ req = Request.blank('/sda1/p/a/c/o',
+ environ={'REQUEST_METHOD': 'DELETE'},
+ headers={'X-Timestamp': timestamp})
+ resp = self.object_controller.DELETE(req)
+ self.assertEquals(resp.status_int, 404)
+ objfile = os.path.join(self.testdir, 'sda1',
+ storage_directory(object_server.DATADIR, 'p',
+ hash_path('a', 'c', 'o')),
+ timestamp + '.ts')
+ self.assert_(os.path.isfile(objfile))
+ self.assertEquals(2, calls_made[0])
+ finally:
+ self.object_controller.container_update = orig_cu
+
def test_call(self):
""" Test swift.object_server.ObjectController.__call__ """
inbuf = StringIO()
Here is a stab at a patch. I can run this through gerrit if appropriate.