From 75c6fc4f02cbf7ba028f8d5df1cb526e96656b6c Mon Sep 17 00:00:00 2001 From: Harshavardhana Date: Mon, 5 Jun 2023 13:08:51 -0700 Subject: [PATCH] only allow decryption of etag for only sse-s3 (#17335) --- .github/workflows/mint/minio-compress-encrypt.yaml | 5 +++-- .github/workflows/mint/minio-erasure.yaml | 2 -- cmd/encryption-v1.go | 12 ++++++------ cmd/erasure-multipart.go | 2 +- cmd/object-multipart-handlers.go | 4 ++-- 5 files changed, 12 insertions(+), 13 deletions(-) diff --git a/.github/workflows/mint/minio-compress-encrypt.yaml b/.github/workflows/mint/minio-compress-encrypt.yaml index 024067a2c..9176df5a7 100644 --- a/.github/workflows/mint/minio-compress-encrypt.yaml +++ b/.github/workflows/mint/minio-compress-encrypt.yaml @@ -11,8 +11,9 @@ x-minio-common: &minio-common MINIO_CI_CD: "on" MINIO_ROOT_USER: "minio" MINIO_ROOT_PASSWORD: "minio123" - MINIO_COMPRESS: "true" - MINIO_COMPRESS_MIMETYPES: "*" + MINIO_COMPRESSION_ENABLE: "on" + MINIO_COMPRESSION_MIME_TYPES: "*" + MINIO_COMPRESSION_ALLOW_ENCRYPTION: "on" MINIO_KMS_SECRET_KEY: "my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=" healthcheck: test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"] diff --git a/.github/workflows/mint/minio-erasure.yaml b/.github/workflows/mint/minio-erasure.yaml index dd4d34147..725eb20b1 100644 --- a/.github/workflows/mint/minio-erasure.yaml +++ b/.github/workflows/mint/minio-erasure.yaml @@ -11,8 +11,6 @@ x-minio-common: &minio-common MINIO_CI_CD: "on" MINIO_ROOT_USER: "minio" MINIO_ROOT_PASSWORD: "minio123" - MINIO_COMPRESS: "true" - MINIO_COMPRESS_MIMETYPES: "*" MINIO_KMS_SECRET_KEY: "my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=" healthcheck: test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"] diff --git a/cmd/encryption-v1.go b/cmd/encryption-v1.go index ecc35a9c0..885cc0257 100644 --- a/cmd/encryption-v1.go +++ b/cmd/encryption-v1.go @@ -818,8 +818,8 @@ func getDecryptedETag(headers http.Header, objInfo ObjectInfo, copySource bool) // As per AWS S3 Spec, ETag for SSE-C encrypted objects need not be MD5Sum of the data. // Since server side copy with same source and dest just replaces the ETag, we save - // encrypted content MD5Sum as ETag for both SSE-C and SSE-S3, we standardize the ETag - // encryption across SSE-C and SSE-S3, and only return last 32 bytes for SSE-C + // encrypted content MD5Sum as ETag for both SSE-C and SSE-KMS, we standardize the ETag + // encryption across SSE-C and SSE-KMS, and only return last 32 bytes for SSE-C if (crypto.SSEC.IsEncrypted(objInfo.UserDefined) || crypto.S3KMS.IsEncrypted(objInfo.UserDefined)) && !copySource { return objInfo.ETag[len(objInfo.ETag)-32:] } @@ -828,15 +828,15 @@ func getDecryptedETag(headers http.Header, objInfo ObjectInfo, copySource bool) if err != nil { return objInfo.ETag } - return tryDecryptETag(objectEncryptionKey, objInfo.ETag, false) + return tryDecryptETag(objectEncryptionKey, objInfo.ETag, true) } // helper to decrypt Etag given object encryption key and encrypted ETag -func tryDecryptETag(key []byte, encryptedETag string, ssec bool) string { - // ETag for SSE-C encrypted objects need not be content MD5Sum.While encrypted +func tryDecryptETag(key []byte, encryptedETag string, sses3 bool) string { + // ETag for SSE-C or SSE-KMS encrypted objects need not be content MD5Sum.While encrypted // md5sum is stored internally, return just the last 32 bytes of hex-encoded and // encrypted md5sum string for SSE-C - if ssec { + if !sses3 { return encryptedETag[len(encryptedETag)-32:] } var objectKey crypto.ObjectKey diff --git a/cmd/erasure-multipart.go b/cmd/erasure-multipart.go index b940673a3..75a7c8cbc 100644 --- a/cmd/erasure-multipart.go +++ b/cmd/erasure-multipart.go @@ -1094,7 +1094,7 @@ func (er erasureObjects) CompleteMultipartUpload(ctx context.Context, bucket str // ensure that part ETag is canonicalized to strip off extraneous quotes part.ETag = canonicalizeETag(part.ETag) - expETag := tryDecryptETag(objectEncryptionKey, expPart.ETag, kind != crypto.S3) + expETag := tryDecryptETag(objectEncryptionKey, expPart.ETag, kind == crypto.S3) if expETag != part.ETag { invp := InvalidPart{ PartNumber: part.PartNumber, diff --git a/cmd/object-multipart-handlers.go b/cmd/object-multipart-handlers.go index 7f9e366ab..76c28cd19 100644 --- a/cmd/object-multipart-handlers.go +++ b/cmd/object-multipart-handlers.go @@ -543,7 +543,7 @@ func (api objectAPIHandlers) CopyObjectPartHandler(w http.ResponseWriter, r *htt } if isEncrypted { - partInfo.ETag = tryDecryptETag(objectEncryptionKey[:], partInfo.ETag, crypto.SSEC.IsRequested(r.Header)) + partInfo.ETag = tryDecryptETag(objectEncryptionKey[:], partInfo.ETag, crypto.S3.IsRequested(r.Header)) } response := generateCopyObjectPartResponse(partInfo.ETag, partInfo.LastModified) @@ -1165,7 +1165,7 @@ func (api objectAPIHandlers) ListObjectPartsHandler(w http.ResponseWriter, r *ht } } for i, p := range listPartsInfo.Parts { - listPartsInfo.Parts[i].ETag = tryDecryptETag(objectEncryptionKey, p.ETag, kind != crypto.S3) + listPartsInfo.Parts[i].ETag = tryDecryptETag(objectEncryptionKey, p.ETag, kind == crypto.S3) listPartsInfo.Parts[i].Size = p.ActualSize } }