MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-07 21:02:58 -05:00
Code Issues Packages Projects Releases Wiki Activity

allow S3 gateway to support object locked buckets (#13257)

Browse Source 
- Supports object locked buckets that require
  PutObject() to set content-md5 always.
- Use SSE-S3 when S3 gateway is being used instead
  of SSE-KMS for auto-encryption.
This commit is contained in:
Harshavardhana
2021-09-21 09:02:15 -07:00
committed by GitHub
parent 0b55a0423e
commit 50a68a1791
7 changed files with 68 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
internal/bucket/encryption/bucket-sse-config.go
View File

@@ -15,7 +15,7 @@
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see <http://www.gnu.org/licenses/>.
package cmd
package sse
import (
"encoding/xml"
@@ -29,16 +29,16 @@ import (
const (
// AES256 is used with SSE-S3
AES256 SSEAlgorithm = "AES256"
AES256 Algorithm = "AES256"
// AWSKms is used with SSE-KMS
AWSKms SSEAlgorithm = "aws:kms"
AWSKms Algorithm = "aws:kms"
)
// SSEAlgorithm - represents valid SSE algorithms supported; currently only AES256 is supported
type SSEAlgorithm string
// Algorithm - represents valid SSE algorithms supported; currently only AES256 is supported
type Algorithm string
// UnmarshalXML - Unmarshals XML tag to valid SSE algorithm
func (alg *SSEAlgorithm) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
func (alg *Algorithm) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
var s string
if err := d.DecodeElement(&s, &start); err != nil {
return err
@@ -57,18 +57,18 @@ func (alg *SSEAlgorithm) UnmarshalXML(d *xml.Decoder, start xml.StartElement) er
}
// MarshalXML - Marshals given SSE algorithm to valid XML
func (alg *SSEAlgorithm) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
func (alg *Algorithm) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
return e.EncodeElement(string(*alg), start)
}
// EncryptionAction - for ApplyServerSideEncryptionByDefault XML tag
type EncryptionAction struct {
Algorithm SSEAlgorithm `xml:"SSEAlgorithm,omitempty"`
MasterKeyID string `xml:"KMSMasterKeyID,omitempty"`
Algorithm Algorithm `xml:"SSEAlgorithm,omitempty"`
MasterKeyID string `xml:"KMSMasterKeyID,omitempty"`
}
// SSERule - for ServerSideEncryptionConfiguration XML tag
type SSERule struct {
// Rule - for ServerSideEncryptionConfiguration XML tag
type Rule struct {
DefaultEncryptionAction EncryptionAction `xml:"ApplyServerSideEncryptionByDefault"`
}
@@ -76,9 +76,9 @@ const xmlNS = "http://s3.amazonaws.com/doc/2006-03-01/"
// BucketSSEConfig - represents default bucket encryption configuration
type BucketSSEConfig struct {
XMLNS string `xml:"xmlns,attr,omitempty"`
XMLName xml.Name `xml:"ServerSideEncryptionConfiguration"`
Rules []SSERule `xml:"Rule"`
XMLNS string `xml:"xmlns,attr,omitempty"`
XMLName xml.Name `xml:"ServerSideEncryptionConfiguration"`
Rules []Rule `xml:"Rule"`
}
// ParseBucketSSEConfig - Decodes given XML to a valid default bucket encryption config
@@ -114,24 +114,35 @@ func ParseBucketSSEConfig(r io.Reader) (*BucketSSEConfig, error) {
return &config, nil
}
// ApplyOptions ask for specific features to be enabled,
// when bucketSSEConfig is empty.
type ApplyOptions struct {
AutoEncrypt bool
Passthrough bool // Set to 'true' for S3 gateway mode.
}
// Apply applies the SSE bucket configuration on the given HTTP headers and
// sets the specified SSE headers.
//
// Apply does not overwrite any existing SSE headers. Further, it will
// set minimal SSE-KMS headers if autoEncrypt is true and the BucketSSEConfig
// is nil.
func (b *BucketSSEConfig) Apply(headers http.Header, autoEncrypt bool) {
func (b *BucketSSEConfig) Apply(headers http.Header, opts ApplyOptions) {
if _, ok := crypto.IsRequested(headers); ok {
return
}
if b == nil {
if autoEncrypt {
headers.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionKMS)
if opts.AutoEncrypt {
if !opts.Passthrough {
headers.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionKMS)
} else {
headers.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionAES)
}
}
return
}
switch b.Algorithm() {
switch b.Algo() {
case xhttp.AmzEncryptionAES:
headers.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionAES)
case xhttp.AmzEncryptionKMS:
@@ -140,8 +151,8 @@ func (b *BucketSSEConfig) Apply(headers http.Header, autoEncrypt bool) {
}
}
// Algorithm returns the SSE algorithm specified by the SSE configuration.
func (b *BucketSSEConfig) Algorithm() SSEAlgorithm {
// Algo returns the SSE algorithm specified by the SSE configuration.
func (b *BucketSSEConfig) Algo() Algorithm {
for _, rule := range b.Rules {
return rule.DefaultEncryptionAction.Algorithm
}

8
internal/bucket/encryption/bucket-sse-config_test.go
View File

@@ -15,7 +15,7 @@
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see <http://www.gnu.org/licenses/>.
package cmd
package sse
import (
"bytes"
@@ -30,7 +30,7 @@ func TestParseBucketSSEConfig(t *testing.T) {
XMLName: xml.Name{
Local: "ServerSideEncryptionConfiguration",
},
Rules: []SSERule{
Rules: []Rule{
{
DefaultEncryptionAction: EncryptionAction{
Algorithm: AES256,
@@ -44,7 +44,7 @@ func TestParseBucketSSEConfig(t *testing.T) {
XMLName: xml.Name{
Local: "ServerSideEncryptionConfiguration",
},
Rules: []SSERule{
Rules: []Rule{
{
DefaultEncryptionAction: EncryptionAction{
Algorithm: AES256,
@@ -58,7 +58,7 @@ func TestParseBucketSSEConfig(t *testing.T) {
XMLName: xml.Name{
Local: "ServerSideEncryptionConfiguration",
},
Rules: []SSERule{
Rules: []Rule{
{
DefaultEncryptionAction: EncryptionAction{
Algorithm: AWSKms,