mirror of https://github.com/minio/minio.git
871b450dbd
This commit refactors the SSE implementation and add
S3-compatible SSE-KMS context handling.
SSE-KMS differs from SSE-S3 in two main aspects:
1. The client can request a particular key and
specify a KMS context as part of the request.
2. The ETag of an SSE-KMS encrypted object is not
the MD5 sum of the object content.
This commit only focuses on the 1st aspect.
A client can send an optional SSE context when using
SSE-KMS. This context is remembered by the S3 server
such that the client does not have to specify the
context again (during multipart PUT / GET / HEAD ...).
The crypto. context also includes the bucket/object
name to prevent renaming objects at the backend.
Now, AWS S3 behaves as following:
- If the user does not provide a SSE-KMS context
it does not store one - resp. does not include
the SSE-KMS context header in the response (e.g. HEAD).
- If the user specifies a SSE-KMS context without
the bucket/object name then AWS stores the exact
context the client provided but adds the bucket/object
name internally. The response contains the KMS context
without the bucket/object name.
- If the user specifies a SSE-KMS context with
the bucket/object name then AWS again stores the exact
context provided by the client. The response contains
the KMS context with the bucket/object name.
This commit implements this behavior w.r.t. SSE-KMS.
However, as of now, no such object can be created since
the server rejects SSE-KMS encryption requests.
This commit is one stepping stone for SSE-KMS support.
Co-authored-by: Harshavardhana <harsha@minio.io>
|
||
|---|---|---|
| .. | ||
| config.go | ||
| doc.go | ||
| error.go | ||
| header.go | ||
| header_test.go | ||
| help.go | ||
| json.go | ||
| kes.go | ||
| key.go | ||
| key_test.go | ||
| kms.go | ||
| kms_test.go | ||
| legacy.go | ||
| metadata.go | ||
| metadata_test.go | ||
| parse.go | ||
| parse_test.go | ||
| retry.go | ||
| sse-c.go | ||
| sse-kms.go | ||
| sse-s3.go | ||
| sse.go | ||
| sse_test.go | ||
| vault.go | ||
| vault_test.go | ||