signature: Use a layered approach for signature verification.

Signature calculation has now moved out from being a package to
top-level as a layered mechanism.

In case of payload calculation with body, go-routines are initiated
to simultaneously write and calculate shasum. Errors are sent
over the writer so that the lower layer removes the temporary files
properly.

pkg/fs/api_suite_test.go

@@ -19,7 +19,6 @@ package fs
 import (
 	"bytes"
 	"crypto/md5"
-	"encoding/base64"
 	"encoding/hex"
 	"encoding/xml"
 	"math/rand"
@@ -61,7 +60,7 @@ func testMultipartObjectCreation(c *check.C, create func() Filesystem) {
 	c.Assert(err, check.IsNil)
 
 	completedParts := CompleteMultipartUpload{}
-	completedParts.Part = make([]CompletePart, 0)
+	//completedParts.Part = make([]CompletePart, 10)
 	for i := 1; i <= 10; i++ {
 		randomPerm := rand.Perm(10)
 		randomString := ""
@@ -71,19 +70,17 @@ func testMultipartObjectCreation(c *check.C, create func() Filesystem) {
 
 		hasher := md5.New()
 		hasher.Write([]byte(randomString))
-		expectedmd5Sum := base64.StdEncoding.EncodeToString(hasher.Sum(nil))
-		expectedmd5Sumhex := hex.EncodeToString(hasher.Sum(nil))
+		expectedMD5Sumhex := hex.EncodeToString(hasher.Sum(nil))
 
-		var calculatedmd5sum string
-		calculatedmd5sum, err = fs.CreateObjectPart("bucket", "key", uploadID, expectedmd5Sum, i, int64(len(randomString)),
-			bytes.NewBufferString(randomString), nil)
+		var calculatedMD5sum string
+		calculatedMD5sum, err = fs.CreateObjectPart("bucket", "key", uploadID, i, int64(len(randomString)), bytes.NewBufferString(randomString), hasher.Sum(nil))
 		c.Assert(err, check.IsNil)
-		c.Assert(calculatedmd5sum, check.Equals, expectedmd5Sumhex)
-		completedParts.Part = append(completedParts.Part, CompletePart{PartNumber: i, ETag: calculatedmd5sum})
+		c.Assert(calculatedMD5sum, check.Equals, expectedMD5Sumhex)
+		completedParts.Part = append(completedParts.Part, CompletePart{PartNumber: i, ETag: calculatedMD5sum})
 	}
 	completedPartsBytes, e := xml.Marshal(completedParts)
 	c.Assert(e, check.IsNil)
-	objectInfo, err := fs.CompleteMultipartUpload("bucket", "key", uploadID, bytes.NewReader(completedPartsBytes), nil)
+	objectInfo, err := fs.CompleteMultipartUpload("bucket", "key", uploadID, completedPartsBytes)
 	c.Assert(err, check.IsNil)
 	c.Assert(objectInfo.MD5Sum, check.Equals, "9b7d6f13ba00e24d0b02de92e814891b-10")
 }
@@ -105,15 +102,13 @@ func testMultipartObjectAbort(c *check.C, create func() Filesystem) {
 
 		hasher := md5.New()
 		hasher.Write([]byte(randomString))
-		expectedmd5Sum := base64.StdEncoding.EncodeToString(hasher.Sum(nil))
-		expectedmd5Sumhex := hex.EncodeToString(hasher.Sum(nil))
+		expectedMD5Sumhex := hex.EncodeToString(hasher.Sum(nil))
 
-		var calculatedmd5sum string
-		calculatedmd5sum, err = fs.CreateObjectPart("bucket", "key", uploadID, expectedmd5Sum, i, int64(len(randomString)),
-			bytes.NewBufferString(randomString), nil)
+		var calculatedMD5sum string
+		calculatedMD5sum, err = fs.CreateObjectPart("bucket", "key", uploadID, i, int64(len(randomString)), bytes.NewBufferString(randomString), hasher.Sum(nil))
 		c.Assert(err, check.IsNil)
-		c.Assert(calculatedmd5sum, check.Equals, expectedmd5Sumhex)
-		parts[i] = calculatedmd5sum
+		c.Assert(calculatedMD5sum, check.Equals, expectedMD5Sumhex)
+		parts[i] = expectedMD5Sumhex
 	}
 	err = fs.AbortMultipartUpload("bucket", "key", uploadID)
 	c.Assert(err, check.IsNil)
@@ -133,14 +128,14 @@ func testMultipleObjectCreation(c *check.C, create func() Filesystem) {
 
 		hasher := md5.New()
 		hasher.Write([]byte(randomString))
-		expectedmd5Sum := base64.StdEncoding.EncodeToString(hasher.Sum(nil))
-		expectedmd5Sumhex := hex.EncodeToString(hasher.Sum(nil))
+		expectedMD5Sumhex := hex.EncodeToString(hasher.Sum(nil))
 
 		key := "obj" + strconv.Itoa(i)
 		objects[key] = []byte(randomString)
-		objectInfo, err := fs.CreateObject("bucket", key, expectedmd5Sum, int64(len(randomString)), bytes.NewBufferString(randomString), nil)
+		var objectInfo ObjectInfo
+		objectInfo, err = fs.CreateObject("bucket", key, int64(len(randomString)), bytes.NewBufferString(randomString), hasher.Sum(nil))
 		c.Assert(err, check.IsNil)
-		c.Assert(objectInfo.MD5Sum, check.Equals, expectedmd5Sumhex)
+		c.Assert(objectInfo.MD5Sum, check.Equals, expectedMD5Sumhex)
 	}
 
 	for key, value := range objects {
@@ -165,7 +160,7 @@ func testPaging(c *check.C, create func() Filesystem) {
 	// check before paging occurs
 	for i := 0; i < 5; i++ {
 		key := "obj" + strconv.Itoa(i)
-		_, err = fs.CreateObject("bucket", key, "", int64(len(key)), bytes.NewBufferString(key), nil)
+		_, err = fs.CreateObject("bucket", key, int64(len(key)), bytes.NewBufferString(key), nil)
 		c.Assert(err, check.IsNil)
 		result, err = fs.ListObjects("bucket", "", "", "", 5)
 		c.Assert(err, check.IsNil)
@@ -175,7 +170,7 @@ func testPaging(c *check.C, create func() Filesystem) {
 	// check after paging occurs pages work
 	for i := 6; i <= 10; i++ {
 		key := "obj" + strconv.Itoa(i)
-		_, err = fs.CreateObject("bucket", key, "", int64(len(key)), bytes.NewBufferString(key), nil)
+		_, err = fs.CreateObject("bucket", key, int64(len(key)), bytes.NewBufferString(key), nil)
 		c.Assert(err, check.IsNil)
 		result, err = fs.ListObjects("bucket", "obj", "", "", 5)
 		c.Assert(err, check.IsNil)
@@ -184,9 +179,9 @@ func testPaging(c *check.C, create func() Filesystem) {
 	}
 	// check paging with prefix at end returns less objects
 	{
-		_, err = fs.CreateObject("bucket", "newPrefix", "", int64(len("prefix1")), bytes.NewBufferString("prefix1"), nil)
+		_, err = fs.CreateObject("bucket", "newPrefix", int64(len("prefix1")), bytes.NewBufferString("prefix1"), nil)
 		c.Assert(err, check.IsNil)
-		_, err = fs.CreateObject("bucket", "newPrefix2", "", int64(len("prefix2")), bytes.NewBufferString("prefix2"), nil)
+		_, err = fs.CreateObject("bucket", "newPrefix2", int64(len("prefix2")), bytes.NewBufferString("prefix2"), nil)
 		c.Assert(err, check.IsNil)
 		result, err = fs.ListObjects("bucket", "new", "", "", 5)
 		c.Assert(err, check.IsNil)
@@ -206,9 +201,9 @@ func testPaging(c *check.C, create func() Filesystem) {
 
 	// check delimited results with delimiter and prefix
 	{
-		_, err = fs.CreateObject("bucket", "this/is/delimited", "", int64(len("prefix1")), bytes.NewBufferString("prefix1"), nil)
+		_, err = fs.CreateObject("bucket", "this/is/delimited", int64(len("prefix1")), bytes.NewBufferString("prefix1"), nil)
 		c.Assert(err, check.IsNil)
-		_, err = fs.CreateObject("bucket", "this/is/also/a/delimited/file", "", int64(len("prefix2")), bytes.NewBufferString("prefix2"), nil)
+		_, err = fs.CreateObject("bucket", "this/is/also/a/delimited/file", int64(len("prefix2")), bytes.NewBufferString("prefix2"), nil)
 		c.Assert(err, check.IsNil)
 		result, err = fs.ListObjects("bucket", "this/is/", "", "/", 10)
 		c.Assert(err, check.IsNil)
@@ -260,18 +255,11 @@ func testObjectOverwriteWorks(c *check.C, create func() Filesystem) {
 	err := fs.MakeBucket("bucket")
 	c.Assert(err, check.IsNil)
 
-	hasher1 := md5.New()
-	hasher1.Write([]byte("one"))
-	md5Sum1 := base64.StdEncoding.EncodeToString(hasher1.Sum(nil))
-	md5Sum1hex := hex.EncodeToString(hasher1.Sum(nil))
-	objectInfo, err := fs.CreateObject("bucket", "object", md5Sum1, int64(len("one")), bytes.NewBufferString("one"), nil)
+	_, err = fs.CreateObject("bucket", "object", int64(len("one")), bytes.NewBufferString("one"), nil)
 	c.Assert(err, check.IsNil)
-	c.Assert(md5Sum1hex, check.Equals, objectInfo.MD5Sum)
+	// c.Assert(md5Sum1hex, check.Equals, objectInfo.MD5Sum)
 
-	hasher2 := md5.New()
-	hasher2.Write([]byte("three"))
-	md5Sum2 := base64.StdEncoding.EncodeToString(hasher2.Sum(nil))
-	_, err = fs.CreateObject("bucket", "object", md5Sum2, int64(len("three")), bytes.NewBufferString("three"), nil)
+	_, err = fs.CreateObject("bucket", "object", int64(len("three")), bytes.NewBufferString("three"), nil)
 	c.Assert(err, check.IsNil)
 
 	var bytesBuffer bytes.Buffer
@@ -283,7 +271,7 @@ func testObjectOverwriteWorks(c *check.C, create func() Filesystem) {
 
 func testNonExistantBucketOperations(c *check.C, create func() Filesystem) {
 	fs := create()
-	_, err := fs.CreateObject("bucket", "object", "", int64(len("one")), bytes.NewBufferString("one"), nil)
+	_, err := fs.CreateObject("bucket", "object", int64(len("one")), bytes.NewBufferString("one"), nil)
 	c.Assert(err, check.Not(check.IsNil))
 }
 
@@ -300,13 +288,8 @@ func testPutObjectInSubdir(c *check.C, create func() Filesystem) {
 	err := fs.MakeBucket("bucket")
 	c.Assert(err, check.IsNil)
 
-	hasher := md5.New()
-	hasher.Write([]byte("hello world"))
-	md5Sum1 := base64.StdEncoding.EncodeToString(hasher.Sum(nil))
-	md5Sum1hex := hex.EncodeToString(hasher.Sum(nil))
-	objectInfo, err := fs.CreateObject("bucket", "dir1/dir2/object", md5Sum1, int64(len("hello world")), bytes.NewBufferString("hello world"), nil)
+	_, err = fs.CreateObject("bucket", "dir1/dir2/object", int64(len("hello world")), bytes.NewBufferString("hello world"), nil)
 	c.Assert(err, check.IsNil)
-	c.Assert(objectInfo.MD5Sum, check.Equals, md5Sum1hex)
 
 	var bytesBuffer bytes.Buffer
 	length, err := fs.GetObject(&bytesBuffer, "bucket", "dir1/dir2/object", 0, 0)
@@ -396,7 +379,7 @@ func testGetDirectoryReturnsObjectNotFound(c *check.C, create func() Filesystem)
 	err := fs.MakeBucket("bucket")
 	c.Assert(err, check.IsNil)
 
-	_, err = fs.CreateObject("bucket", "dir1/dir2/object", "", int64(len("hello world")), bytes.NewBufferString("hello world"), nil)
+	_, err = fs.CreateObject("bucket", "dir1/dir2/object", int64(len("hello world")), bytes.NewBufferString("hello world"), nil)
 	c.Assert(err, check.IsNil)
 
 	var byteBuffer bytes.Buffer
@@ -431,26 +414,9 @@ func testDefaultContentType(c *check.C, create func() Filesystem) {
 	err := fs.MakeBucket("bucket")
 	c.Assert(err, check.IsNil)
 
-	// test empty
-	_, err = fs.CreateObject("bucket", "one", "", int64(len("one")), bytes.NewBufferString("one"), nil)
+	// Test empty
+	_, err = fs.CreateObject("bucket", "one", int64(len("one")), bytes.NewBufferString("one"), nil)
 	metadata, err := fs.GetObjectInfo("bucket", "one")
 	c.Assert(err, check.IsNil)
 	c.Assert(metadata.ContentType, check.Equals, "application/octet-stream")
 }
-
-func testContentMD5Set(c *check.C, create func() Filesystem) {
-	fs := create()
-	err := fs.MakeBucket("bucket")
-	c.Assert(err, check.IsNil)
-
-	// test md5 invalid
-	badmd5Sum := "NWJiZjVhNTIzMjhlNzQzOWFlNmU3MTlkZmU3MTIyMDA"
-	calculatedmd5sum, err := fs.CreateObject("bucket", "one", badmd5Sum, int64(len("one")), bytes.NewBufferString("one"), nil)
-	c.Assert(err, check.Not(check.IsNil))
-	c.Assert(calculatedmd5sum, check.Not(check.Equals), badmd5Sum)
-
-	goodmd5sum := "NWJiZjVhNTIzMjhlNzQzOWFlNmU3MTlkZmU3MTIyMDA="
-	calculatedmd5sum, err = fs.CreateObject("bucket", "two", goodmd5sum, int64(len("one")), bytes.NewBufferString("one"), nil)
-	c.Assert(err, check.IsNil)
-	c.Assert(calculatedmd5sum, check.Equals, goodmd5sum)
-}

pkg/fs/fs-bucket-listobjects_test.go

@@ -27,7 +27,6 @@ import (
 )
 
 func TestListObjects(t *testing.T) {
-
 	// Make a temporary directory to use as the filesystem.
 	directory, e := ioutil.TempDir("", "minio-list-object-test")
 	if e != nil {
@@ -58,36 +57,36 @@ func TestListObjects(t *testing.T) {
 	}
 	defer os.Remove(tmpfile.Name()) // clean up
 
-	_, err = fs.CreateObject("test-bucket-list-object", "Asia-maps", "", int64(len("asia-maps")), bytes.NewBufferString("asia-maps"), nil)
+	_, err = fs.CreateObject("test-bucket-list-object", "Asia-maps", int64(len("asia-maps")), bytes.NewBufferString("asia-maps"), nil)
 	if err != nil {
 		t.Fatal(e)
 	}
 
-	_, err = fs.CreateObject("test-bucket-list-object", "Asia/India/India-summer-photos-1", "", int64(len("contentstring")), bytes.NewBufferString("contentstring"), nil)
+	_, err = fs.CreateObject("test-bucket-list-object", "Asia/India/India-summer-photos-1", int64(len("contentstring")), bytes.NewBufferString("contentstring"), nil)
 	if err != nil {
 		t.Fatal(e)
 	}
 
-	_, err = fs.CreateObject("test-bucket-list-object", "Asia/India/Karnataka/Bangalore/Koramangala/pics", "", int64(len("contentstring")), bytes.NewBufferString("contentstring"), nil)
+	_, err = fs.CreateObject("test-bucket-list-object", "Asia/India/Karnataka/Bangalore/Koramangala/pics", int64(len("contentstring")), bytes.NewBufferString("contentstring"), nil)
 	if err != nil {
 		t.Fatal(e)
 	}
 
 	for i := 0; i < 2; i++ {
 		key := "newPrefix" + strconv.Itoa(i)
-		_, err = fs.CreateObject("test-bucket-list-object", key, "", int64(len(key)), bytes.NewBufferString(key), nil)
+		_, err = fs.CreateObject("test-bucket-list-object", key, int64(len(key)), bytes.NewBufferString(key), nil)
 		if err != nil {
 			t.Fatal(err)
 		}
 	}
-	_, err = fs.CreateObject("test-bucket-list-object", "newzen/zen/recurse/again/again/again/pics", "", int64(len("recurse")), bytes.NewBufferString("recurse"), nil)
+	_, err = fs.CreateObject("test-bucket-list-object", "newzen/zen/recurse/again/again/again/pics", int64(len("recurse")), bytes.NewBufferString("recurse"), nil)
 	if err != nil {
 		t.Fatal(e)
 	}
 
 	for i := 0; i < 3; i++ {
 		key := "obj" + strconv.Itoa(i)
-		_, err = fs.CreateObject("test-bucket-list-object", key, "", int64(len(key)), bytes.NewBufferString(key), nil)
+		_, err = fs.CreateObject("test-bucket-list-object", key, int64(len(key)), bytes.NewBufferString(key), nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -592,7 +591,7 @@ func BenchmarkListObjects(b *testing.B) {
 
 	for i := 0; i < 20000; i++ {
 		key := "obj" + strconv.Itoa(i)
-		_, err = filesystem.CreateObject("ls-benchmark-bucket", key, "", int64(len(key)), bytes.NewBufferString(key), nil)
+		_, err = filesystem.CreateObject("ls-benchmark-bucket", key, int64(len(key)), bytes.NewBufferString(key), nil)
 		if err != nil {
 			b.Fatal(err)
 		}

pkg/fs/fs-errors.go

@@ -18,13 +18,6 @@ package fs
 
 import "fmt"
 
-// SignDoesNotMatch - signature does not match.
-type SignDoesNotMatch struct{}
-
-func (e SignDoesNotMatch) Error() string {
-	return "Signature does not match."
-}
-
 // InvalidArgument invalid argument
 type InvalidArgument struct{}
 
@@ -131,15 +124,14 @@ func (e InvalidDisksArgument) Error() string {
 	return "Invalid number of disks per node"
 }
 
-// BadDigest bad md5sum
+// BadDigest - Content-MD5 you specified did not match what we received.
 type BadDigest struct {
-	MD5    string
-	Bucket string
-	Object string
+	ExpectedMD5   string
+	CalculatedMD5 string
 }
 
 func (e BadDigest) Error() string {
-	return "Bad digest"
+	return "Bad digest expected " + e.ExpectedMD5 + " is not valid with what we calculated " + e.CalculatedMD5
 }
 
 // InternalError - generic internal error
@@ -183,13 +175,6 @@ type ImplementationError struct {
 	Err    error
 }
 
-// DigestError - Generic MD5 error
-type DigestError struct {
-	Bucket string
-	Key    string
-	MD5    string
-}
-
 /// Bucket related errors
 
 // BucketNameInvalid - bucketname provided is invalid
@@ -200,9 +185,6 @@ type BucketNameInvalid GenericBucketError
 // ObjectNameInvalid - object name provided is invalid
 type ObjectNameInvalid GenericObjectError
 
-// InvalidDigest - md5 in request header invalid
-type InvalidDigest DigestError
-
 // Return string an error formatted as the given text
 func (e ImplementationError) Error() string {
 	error := ""
@@ -258,11 +240,6 @@ func (e BackendCorrupted) Error() string {
 	return "Backend corrupted: " + e.Path
 }
 
-// Return string an error formatted as the given text
-func (e InvalidDigest) Error() string {
-	return "MD5 provided " + e.MD5 + " is invalid"
-}
-
 // OperationNotPermitted - operation not permitted
 type OperationNotPermitted struct {
 	Op     string

pkg/fs/fs-multipart.go

@@ -24,7 +24,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"os"
 	"path/filepath"
@@ -34,12 +33,10 @@ import (
 	"time"
 
 	"github.com/minio/minio/pkg/atomic"
-	"github.com/minio/minio/pkg/crypto/sha256"
 	"github.com/minio/minio/pkg/crypto/sha512"
 	"github.com/minio/minio/pkg/disk"
 	"github.com/minio/minio/pkg/mimedb"
 	"github.com/minio/minio/pkg/probe"
-	"github.com/minio/minio/pkg/s3/signature4"
 )
 
 // isValidUploadID - is upload id.
@@ -322,7 +319,7 @@ func (a partNumber) Swap(i, j int)      { a[i], a[j] = a[j], a[i] }
 func (a partNumber) Less(i, j int) bool { return a[i].PartNumber < a[j].PartNumber }
 
 // CreateObjectPart - create a part in a multipart session
-func (fs Filesystem) CreateObjectPart(bucket, object, uploadID, expectedMD5Sum string, partID int, size int64, data io.Reader, signature *signature4.Sign) (string, *probe.Error) {
+func (fs Filesystem) CreateObjectPart(bucket, object, uploadID string, partID int, size int64, data io.Reader, md5Bytes []byte) (string, *probe.Error) {
 	di, err := disk.GetInfo(fs.path)
 	if err != nil {
 		return "", probe.NewError(err)
@@ -355,71 +352,58 @@ func (fs Filesystem) CreateObjectPart(bucket, object, uploadID, expectedMD5Sum s
 		return "", probe.NewError(InvalidUploadID{UploadID: uploadID})
 	}
 
-	if expectedMD5Sum != "" {
-		var expectedMD5SumBytes []byte
-		expectedMD5SumBytes, err = base64.StdEncoding.DecodeString(expectedMD5Sum)
-		if err != nil {
-			// Pro-actively close the connection
-			return "", probe.NewError(InvalidDigest{MD5: expectedMD5Sum})
-		}
-		expectedMD5Sum = hex.EncodeToString(expectedMD5SumBytes)
-	}
-
 	bucket = fs.denormalizeBucket(bucket)
 	bucketPath := filepath.Join(fs.path, bucket)
-	if _, err = os.Stat(bucketPath); err != nil {
+	if _, e := os.Stat(bucketPath); e != nil {
 		// Check bucket exists.
-		if os.IsNotExist(err) {
+		if os.IsNotExist(e) {
 			return "", probe.NewError(BucketNotFound{Bucket: bucket})
 		}
-		return "", probe.NewError(err)
+		return "", probe.NewError(e)
+	}
+
+	// md5Hex representation.
+	var md5Hex string
+	if len(md5Bytes) != 0 {
+		md5Hex = hex.EncodeToString(md5Bytes)
 	}
 
 	objectPath := filepath.Join(bucketPath, object)
 	partPathPrefix := objectPath + uploadID
-	partPath := partPathPrefix + expectedMD5Sum + fmt.Sprintf("$%d-$multiparts", partID)
+	partPath := partPathPrefix + md5Hex + fmt.Sprintf("$%d-$multiparts", partID)
 	partFile, e := atomic.FileCreateWithPrefix(partPath, "$multiparts")
 	if e != nil {
 		return "", probe.NewError(e)
 	}
+	defer partFile.Close()
 
-	md5Hasher := md5.New()
-	sha256Hasher := sha256.New()
-	partWriter := io.MultiWriter(partFile, md5Hasher, sha256Hasher)
-	if _, e = io.CopyN(partWriter, data, size); e != nil {
+	// Initialize md5 writer.
+	md5Writer := md5.New()
+
+	// Create a multiwriter.
+	multiWriter := io.MultiWriter(md5Writer, partFile)
+
+	if _, e = io.CopyN(multiWriter, data, size); e != nil {
 		partFile.CloseAndPurge()
 		return "", probe.NewError(e)
 	}
 
-	md5sum := hex.EncodeToString(md5Hasher.Sum(nil))
-	// Verify if the written object is equal to what is expected, only
-	// if it is requested as such.
-	if expectedMD5Sum != "" {
-		if !isMD5SumEqual(expectedMD5Sum, md5sum) {
-			partFile.CloseAndPurge()
-			return "", probe.NewError(BadDigest{MD5: expectedMD5Sum, Bucket: bucket, Object: object})
+	// Finalize new md5.
+	newMD5Hex := hex.EncodeToString(md5Writer.Sum(nil))
+	if len(md5Bytes) != 0 {
+		if newMD5Hex != md5Hex {
+			return "", probe.NewError(BadDigest{md5Hex, newMD5Hex})
 		}
 	}
-	if signature != nil {
-		ok, err := signature.DoesSignatureMatch(hex.EncodeToString(sha256Hasher.Sum(nil)))
-		if err != nil {
-			partFile.CloseAndPurge()
-			return "", err.Trace()
-		}
-		if !ok {
-			partFile.CloseAndPurge()
-			return "", probe.NewError(SignDoesNotMatch{})
-		}
-	}
-	partFile.Close()
 
-	fi, e := os.Stat(partPath)
+	// Stat the file to get the latest information.
+	fi, e := os.Stat(partFile.Name())
 	if e != nil {
 		return "", probe.NewError(e)
 	}
 	partMetadata := PartMetadata{}
-	partMetadata.ETag = md5sum
 	partMetadata.PartNumber = partID
+	partMetadata.ETag = newMD5Hex
 	partMetadata.Size = fi.Size()
 	partMetadata.LastModified = fi.ModTime()
 
@@ -450,13 +434,11 @@ func (fs Filesystem) CreateObjectPart(bucket, object, uploadID, expectedMD5Sum s
 	if err := saveMultipartsSession(*fs.multiparts); err != nil {
 		return "", err.Trace(partPathPrefix)
 	}
-
-	// Return etag.
-	return partMetadata.ETag, nil
+	return newMD5Hex, nil
 }
 
 // CompleteMultipartUpload - complete a multipart upload and persist the data
-func (fs Filesystem) CompleteMultipartUpload(bucket, object, uploadID string, data io.Reader, signature *signature4.Sign) (ObjectInfo, *probe.Error) {
+func (fs Filesystem) CompleteMultipartUpload(bucket string, object string, uploadID string, completeMultipartBytes []byte) (ObjectInfo, *probe.Error) {
 	// Check bucket name is valid.
 	if !IsValidBucketName(bucket) {
 		return ObjectInfo{}, probe.NewError(BucketNameInvalid{Bucket: bucket})
@@ -488,26 +470,8 @@ func (fs Filesystem) CompleteMultipartUpload(bucket, object, uploadID string, da
 		return ObjectInfo{}, probe.NewError(e)
 	}
 
-	partBytes, e := ioutil.ReadAll(data)
-	if e != nil {
-		objectWriter.CloseAndPurge()
-		return ObjectInfo{}, probe.NewError(e)
-	}
-	if signature != nil {
-		sh := sha256.New()
-		sh.Write(partBytes)
-		ok, err := signature.DoesSignatureMatch(hex.EncodeToString(sh.Sum(nil)))
-		if err != nil {
-			objectWriter.CloseAndPurge()
-			return ObjectInfo{}, err.Trace()
-		}
-		if !ok {
-			objectWriter.CloseAndPurge()
-			return ObjectInfo{}, probe.NewError(SignDoesNotMatch{})
-		}
-	}
 	completeMultipartUpload := &CompleteMultipartUpload{}
-	if e = xml.Unmarshal(partBytes, completeMultipartUpload); e != nil {
+	if e = xml.Unmarshal(completeMultipartBytes, completeMultipartUpload); e != nil {
 		objectWriter.CloseAndPurge()
 		return ObjectInfo{}, probe.NewError(MalformedXML{})
 	}

pkg/fs/fs-object.go

@@ -18,22 +18,19 @@ package fs
 
 import (
 	"bytes"
+	"crypto/md5"
 	"io"
 	"os"
 	"path/filepath"
 	"strings"
 
-	"crypto/md5"
-	"encoding/base64"
 	"encoding/hex"
 	"runtime"
 
 	"github.com/minio/minio/pkg/atomic"
-	"github.com/minio/minio/pkg/crypto/sha256"
 	"github.com/minio/minio/pkg/disk"
 	"github.com/minio/minio/pkg/mimedb"
 	"github.com/minio/minio/pkg/probe"
-	"github.com/minio/minio/pkg/s3/signature4"
 )
 
 /// Object Operations
@@ -200,7 +197,7 @@ func isMD5SumEqual(expectedMD5Sum, actualMD5Sum string) bool {
 }
 
 // CreateObject - create an object.
-func (fs Filesystem) CreateObject(bucket, object, expectedMD5Sum string, size int64, data io.Reader, sig *signature4.Sign) (ObjectInfo, *probe.Error) {
+func (fs Filesystem) CreateObject(bucket string, object string, size int64, data io.Reader, md5Bytes []byte) (ObjectInfo, *probe.Error) {
 	di, e := disk.GetInfo(fs.path)
 	if e != nil {
 		return ObjectInfo{}, probe.NewError(e)
@@ -234,18 +231,15 @@ func (fs Filesystem) CreateObject(bucket, object, expectedMD5Sum string, size in
 
 	// Get object path.
 	objectPath := filepath.Join(bucketPath, object)
-	if expectedMD5Sum != "" {
-		var expectedMD5SumBytes []byte
-		expectedMD5SumBytes, e = base64.StdEncoding.DecodeString(expectedMD5Sum)
-		if e != nil {
-			// Pro-actively close the connection.
-			return ObjectInfo{}, probe.NewError(InvalidDigest{MD5: expectedMD5Sum})
-		}
-		expectedMD5Sum = hex.EncodeToString(expectedMD5SumBytes)
+
+	// md5Hex representation.
+	var md5Hex string
+	if len(md5Bytes) != 0 {
+		md5Hex = hex.EncodeToString(md5Bytes)
 	}
 
 	// Write object.
-	file, e := atomic.FileCreateWithPrefix(objectPath, expectedMD5Sum+"$tmpobject")
+	file, e := atomic.FileCreateWithPrefix(objectPath, md5Hex+"$tmpobject")
 	if e != nil {
 		switch e := e.(type) {
 		case *os.PathError:
@@ -259,52 +253,40 @@ func (fs Filesystem) CreateObject(bucket, object, expectedMD5Sum string, size in
 			return ObjectInfo{}, probe.NewError(e)
 		}
 	}
+	defer file.Close()
+
+	// Initialize md5 writer.
+	md5Writer := md5.New()
+
+	// Instantiate a new multi writer.
+	multiWriter := io.MultiWriter(md5Writer, file)
 
 	// Instantiate checksum hashers and create a multiwriter.
-	md5Hasher := md5.New()
-	sha256Hasher := sha256.New()
-	objectWriter := io.MultiWriter(file, md5Hasher, sha256Hasher)
-
 	if size > 0 {
-		if _, e = io.CopyN(objectWriter, data, size); e != nil {
+		if _, e = io.CopyN(multiWriter, data, size); e != nil {
 			file.CloseAndPurge()
 			return ObjectInfo{}, probe.NewError(e)
 		}
 	} else {
-		if _, e = io.Copy(objectWriter, data); e != nil {
+		if _, e = io.Copy(multiWriter, data); e != nil {
 			file.CloseAndPurge()
 			return ObjectInfo{}, probe.NewError(e)
 		}
 	}
 
-	md5Sum := hex.EncodeToString(md5Hasher.Sum(nil))
-	// Verify if the written object is equal to what is expected, only
-	// if it is requested as such.
-	if expectedMD5Sum != "" {
-		if !isMD5SumEqual(expectedMD5Sum, md5Sum) {
-			file.CloseAndPurge()
-			return ObjectInfo{}, probe.NewError(BadDigest{MD5: expectedMD5Sum, Bucket: bucket, Object: object})
+	newMD5Hex := hex.EncodeToString(md5Writer.Sum(nil))
+	if len(md5Bytes) != 0 {
+		if newMD5Hex != md5Hex {
+			return ObjectInfo{}, probe.NewError(BadDigest{md5Hex, newMD5Hex})
 		}
 	}
-	sha256Sum := hex.EncodeToString(sha256Hasher.Sum(nil))
-	if sig != nil {
-		ok, err := sig.DoesSignatureMatch(sha256Sum)
-		if err != nil {
-			file.CloseAndPurge()
-			return ObjectInfo{}, err.Trace()
-		}
-		if !ok {
-			file.CloseAndPurge()
-			return ObjectInfo{}, probe.NewError(SignDoesNotMatch{})
-		}
-	}
-	file.Close()
 
 	// Set stat again to get the latest metadata.
-	st, e := os.Stat(objectPath)
+	st, e := os.Stat(file.Name())
 	if e != nil {
 		return ObjectInfo{}, probe.NewError(e)
 	}
+
 	contentType := "application/octet-stream"
 	if objectExt := filepath.Ext(objectPath); objectExt != "" {
 		content, ok := mimedb.DB[strings.ToLower(strings.TrimPrefix(objectExt, "."))]
@@ -317,8 +299,8 @@ func (fs Filesystem) CreateObject(bucket, object, expectedMD5Sum string, size in
 		Name:         object,
 		ModifiedTime: st.ModTime(),
 		Size:         st.Size(),
+		MD5Sum:       newMD5Hex,
 		ContentType:  contentType,
-		MD5Sum:       md5Sum,
 	}
 	return newObject, nil
 }

pkg/fs/fs-object_test.go

@@ -19,7 +19,6 @@ package fs
 import (
 	"bytes"
 	"crypto/md5"
-	"encoding/base64"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -47,7 +46,7 @@ func TestGetObjectInfo(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	_, err = fs.CreateObject("test-getobjectinfo", "Asia/asiapics.jpg", "", int64(len("asiapics")), bytes.NewBufferString("asiapics"), nil)
+	_, err = fs.CreateObject("test-getobjectinfo", "Asia/asiapics.jpg", int64(len("asiapics")), bytes.NewBufferString("asiapics"), nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -138,7 +137,7 @@ func TestGetObjectInfoCore(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	_, err = fs.CreateObject("test-getobjinfo", "Asia/asiapics.jpg", "", int64(len("asiapics")), bytes.NewBufferString("asiapics"), nil)
+	_, err = fs.CreateObject("test-getobjinfo", "Asia/asiapics.jpg", int64(len("asiapics")), bytes.NewBufferString("asiapics"), nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -228,16 +227,14 @@ func BenchmarkGetObject(b *testing.B) {
 	text := "Jack and Jill went up the hill / To fetch a pail of water."
 	hasher := md5.New()
 	hasher.Write([]byte(text))
-	sum := base64.StdEncoding.EncodeToString(hasher.Sum(nil))
 	for i := 0; i < 10; i++ {
-		_, err = filesystem.CreateObject("bucket", "object"+strconv.Itoa(i), sum, int64(len(text)), bytes.NewBufferString(text), nil)
+		_, err = filesystem.CreateObject("bucket", "object"+strconv.Itoa(i), int64(len(text)), bytes.NewBufferString(text), hasher.Sum(nil))
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 
 	var w bytes.Buffer
-
 	b.ResetTimer()
 
 	for i := 0; i < b.N; i++ {