MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-02-26 21:09:15 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix: handle copyObjectPart encryption properly (#17530)

Browse Source 
- look for requested encryption while compressing
  not just via HTTP Headers, but also via multipart
  metadata

- look for SSE-S3 etag decryption not just via HTTP
  Headers, but also via multipart metadata

fixes #17519
This commit is contained in:
Harshavardhana 2023-06-28 09:43:50 -07:00 committed by GitHub
parent d2f5c3621f
commit 73de721a63
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
cmd/object-multipart-handlers.go
View File

@ -1,4 +1,4 @@
// Copyright (c) 2015-2022 MinIO, Inc. // Copyright (c) 2015-2023 MinIO, Inc.
// //
// This file is part of MinIO Object Storage stack // This file is part of MinIO Object Storage stack
// //
@ -459,12 +459,14 @@ func (api objectAPIHandlers) CopyObjectPartHandler(w http.ResponseWriter, r *htt
return return
} }
_, isEncrypted := crypto.IsEncrypted(mi.UserDefined)
// Read compression metadata preserved in the init multipart for the decision. // Read compression metadata preserved in the init multipart for the decision.
_, isCompressed := mi.UserDefined[ReservedMetadataPrefix+"compression"] _, isCompressed := mi.UserDefined[ReservedMetadataPrefix+"compression"]
// Compress only if the compression is enabled during initial multipart. // Compress only if the compression is enabled during initial multipart.
var idxCb func() []byte var idxCb func() []byte
if isCompressed { if isCompressed {
wantEncryption := crypto.Requested(r.Header) wantEncryption := crypto.Requested(r.Header) || isEncrypted
s2c, cb := newS2CompressReader(reader, actualPartSize, wantEncryption) s2c, cb := newS2CompressReader(reader, actualPartSize, wantEncryption)
idxCb = cb idxCb = cb
defer s2c.Close() defer s2c.Close()
@ -488,7 +490,6 @@ func (api objectAPIHandlers) CopyObjectPartHandler(w http.ResponseWriter, r *htt
rawReader := srcInfo.Reader rawReader := srcInfo.Reader
pReader := NewPutObjReader(rawReader) pReader := NewPutObjReader(rawReader)
_, isEncrypted := crypto.IsEncrypted(mi.UserDefined)
var objectEncryptionKey crypto.ObjectKey var objectEncryptionKey crypto.ObjectKey
if isEncrypted { if isEncrypted {
if !crypto.SSEC.IsRequested(r.Header) && crypto.SSEC.IsEncrypted(mi.UserDefined) { if !crypto.SSEC.IsRequested(r.Header) && crypto.SSEC.IsEncrypted(mi.UserDefined) {
@ -558,7 +559,8 @@ func (api objectAPIHandlers) CopyObjectPartHandler(w http.ResponseWriter, r *htt
} }
if isEncrypted { if isEncrypted {
partInfo.ETag = tryDecryptETag(objectEncryptionKey[:], partInfo.ETag, crypto.S3.IsRequested(r.Header)) sseS3 := crypto.S3.IsRequested(r.Header) || crypto.S3.IsEncrypted(mi.UserDefined)
partInfo.ETag = tryDecryptETag(objectEncryptionKey[:], partInfo.ETag, sseS3)
} }
response := generateCopyObjectPartResponse(partInfo.ETag, partInfo.LastModified) response := generateCopyObjectPartResponse(partInfo.ETag, partInfo.LastModified)