add SSE-C support for HEAD, GET, PUT (#4894)

This change adds server-side-encryption support for HEAD, GET and PUT
operations. This PR only addresses single-part PUTs and GETs without
HTTP ranges.

Further this change adds the concept of reserved object metadata which is required
to make encrypted objects tamper-proof and provide API compatibility to AWS S3.
This PR adds the following reserved metadata entries:
- X-Minio-Internal-Server-Side-Encryption-Iv          ('guarantees' tamper-proof property)
- X-Minio-Internal-Server-Side-Encryption-Kdf         (makes Key-MAC computation negotiable in future)
- X-Minio-Internal-Server-Side-Encryption-Key-Mac     (provides AWS S3 API compatibility)

The prefix `X-Minio_Internal` specifies an internal metadata entry which must not
send to clients. All client requests containing a metadata key starting with `X-Minio-Internal`
must also rejected. This is implemented by a generic-handler.

This PR implements SSE-C separated from client-side-encryption (CSE). This cannot decrypt
server-side-encrypted objects on the client-side. However, clients can encrypted the same object
with CSE and SSE-C.

This PR does not address:
 - SSE-C Copy and Copy part
 - SSE-C GET with HTTP ranges
 - SSE-C multipart PUT
 - SSE-C Gateway

Each point must be addressed in a separate PR.

Added to vendor dir:
 - x/crypto/chacha20poly1305
 - x/crypto/poly1305
 - github.com/minio/sio

pkg/ioutil/ioutil.go

@@ -0,0 +1,61 @@
+/*
+ * Minio Cloud Storage, (C) 2017 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Package ioutil implements some I/O utility functions which are not covered
+// by the standard library.
+package ioutil
+
+import (
+	"io"
+)
+
+// WriteOnCloser implements io.WriteCloser and always
+// exectues at least one write operation if it is closed.
+//
+// This can be useful within the context of HTTP. At least
+// one write operation must happen to send the HTTP headers
+// to the peer.
+type WriteOnCloser struct {
+	io.Writer
+	hasWritten bool
+}
+
+func (w *WriteOnCloser) Write(p []byte) (int, error) {
+	w.hasWritten = true
+	return w.Writer.Write(p)
+}
+
+// Close closes the WriteOnCloser. It behaves like io.Closer.
+func (w *WriteOnCloser) Close() error {
+	if !w.hasWritten {
+		_, err := w.Write(nil)
+		if err != nil {
+			return err
+		}
+	}
+	if closer, ok := w.Writer.(io.Closer); ok {
+		return closer.Close()
+	}
+	return nil
+}
+
+// HasWritten returns true if at least one write operation was performed.
+func (w *WriteOnCloser) HasWritten() bool { return w.hasWritten }
+
+// WriteOnClose takes an io.Writer and returns an ioutil.WriteOnCloser.
+func WriteOnClose(w io.Writer) *WriteOnCloser {
+	return &WriteOnCloser{w, false}
+}

pkg/ioutil/ioutil_test.go

@@ -0,0 +1,39 @@
+/*
+ * Minio Cloud Storage, (C) 2017 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package ioutil
+
+import (
+	goioutil "io/ioutil"
+	"testing"
+)
+
+func TestCloseOnWriter(t *testing.T) {
+	writer := WriteOnClose(goioutil.Discard)
+	if writer.HasWritten() {
+		t.Error("WriteOnCloser must not be marked as HasWritten")
+	}
+	writer.Write(nil)
+	if !writer.HasWritten() {
+		t.Error("WriteOnCloser must be marked as HasWritten")
+	}
+
+	writer = WriteOnClose(goioutil.Discard)
+	writer.Close()
+	if !writer.HasWritten() {
+		t.Error("WriteOnCloser must be marked as HasWritten")
+	}
+}