Add support for bucket encryption feature (#8890)
- pkg/bucket/encryption provides support for handling bucket encryption configuration - changes under cmd/ provide support for AES256 algorithm only Co-Authored-By: Poorna <poornas@users.noreply.github.com> Co-authored-by: Harshavardhana <harsha@minio.io>master
Krishnan Parthasarathi
5 years ago
committed by
GitHub
parent
f91c072f61
commit
026265f8f7
@ -0,0 +1,180 @@ |
||||
/* |
||||
* MinIO Cloud Storage, (C) 2020 MinIO, Inc. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package cmd |
||||
|
||||
import ( |
||||
"encoding/xml" |
||||
"io" |
||||
"net/http" |
||||
|
||||
"github.com/gorilla/mux" |
||||
"github.com/minio/minio/cmd/logger" |
||||
bucketsse "github.com/minio/minio/pkg/bucket/encryption" |
||||
"github.com/minio/minio/pkg/bucket/policy" |
||||
) |
||||
|
||||
const ( |
||||
// Bucket Encryption configuration file name.
|
||||
bucketSSEConfig = "bucket-encryption.xml" |
||||
) |
||||
|
||||
// PutBucketEncryptionHandler - Stores given bucket encryption configuration
|
||||
// https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html
|
||||
func (api objectAPIHandlers) PutBucketEncryptionHandler(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "PutBucketEncryption") |
||||
|
||||
defer logger.AuditLog(w, r, "PutBucketEncryption", mustGetClaimsFromToken(r)) |
||||
|
||||
objAPI := api.ObjectAPI() |
||||
if objAPI == nil { |
||||
writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrServerNotInitialized), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
bucket := vars["bucket"] |
||||
|
||||
if s3Error := checkRequestAuthType(ctx, r, policy.PutBucketEncryptionAction, bucket, ""); s3Error != ErrNone { |
||||
writeErrorResponse(ctx, w, errorCodes.ToAPIErr(s3Error), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// Check if bucket exists.
|
||||
if _, err := objAPI.GetBucketInfo(ctx, bucket); err != nil { |
||||
writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// PutBucketEncyrption API requires Content-Md5
|
||||
if _, ok := r.Header["Content-Md5"]; !ok { |
||||
writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrMissingContentMD5), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// Parse bucket encryption xml
|
||||
encConfig, err := validateBucketSSEConfig(io.LimitReader(r.Body, maxBucketSSEConfigSize)) |
||||
if err != nil { |
||||
writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrMalformedXML), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// Return error if KMS is not initialized
|
||||
if GlobalKMS == nil { |
||||
writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrKMSNotConfigured), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// Store the bucket encryption configuration in the object layer
|
||||
if err = objAPI.SetBucketSSEConfig(ctx, bucket, encConfig); err != nil { |
||||
writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// Update the in-memory bucket encryption cache
|
||||
globalBucketSSEConfigSys.Set(bucket, *encConfig) |
||||
|
||||
// Update peer MinIO servers of the updated bucket encryption config
|
||||
globalNotificationSys.SetBucketSSEConfig(ctx, bucket, encConfig) |
||||
|
||||
writeSuccessResponseHeadersOnly(w) |
||||
} |
||||
|
||||
// GetBucketEncryptionHandler - Returns bucket policy configuration
|
||||
// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketEncryption.html
|
||||
func (api objectAPIHandlers) GetBucketEncryptionHandler(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "GetBucketEncryption") |
||||
|
||||
defer logger.AuditLog(w, r, "GetBucketEncryption", mustGetClaimsFromToken(r)) |
||||
|
||||
objAPI := api.ObjectAPI() |
||||
if objAPI == nil { |
||||
writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrServerNotInitialized), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
bucket := vars["bucket"] |
||||
|
||||
if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketEncryptionAction, bucket, ""); s3Error != ErrNone { |
||||
writeErrorResponse(ctx, w, errorCodes.ToAPIErr(s3Error), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// Check if bucket exists
|
||||
var err error |
||||
if _, err = objAPI.GetBucketInfo(ctx, bucket); err != nil { |
||||
writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// Fetch bucket encryption configuration from object layer
|
||||
var encConfig *bucketsse.BucketSSEConfig |
||||
if encConfig, err = objAPI.GetBucketSSEConfig(ctx, bucket); err != nil { |
||||
writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
var encConfigData []byte |
||||
if encConfigData, err = xml.Marshal(encConfig); err != nil { |
||||
writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// Write bucket encryption configuration to client
|
||||
writeSuccessResponseXML(w, encConfigData) |
||||
} |
||||
|
||||
// DeleteBucketEncryptionHandler - Removes bucket encryption configuration
|
||||
func (api objectAPIHandlers) DeleteBucketEncryptionHandler(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "DeleteBucketEncryption") |
||||
|
||||
defer logger.AuditLog(w, r, "DeleteBucketEncryption", mustGetClaimsFromToken(r)) |
||||
|
||||
objAPI := api.ObjectAPI() |
||||
if objAPI == nil { |
||||
writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrServerNotInitialized), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
bucket := vars["bucket"] |
||||
|
||||
if s3Error := checkRequestAuthType(ctx, r, policy.PutBucketEncryptionAction, bucket, ""); s3Error != ErrNone { |
||||
writeErrorResponse(ctx, w, errorCodes.ToAPIErr(s3Error), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// Check if bucket exists
|
||||
var err error |
||||
if _, err = objAPI.GetBucketInfo(ctx, bucket); err != nil { |
||||
writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// Delete bucket encryption config from object layer
|
||||
if err = objAPI.DeleteBucketSSEConfig(ctx, bucket); err != nil { |
||||
writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL, guessIsBrowserReq(r)) |
||||
return |
||||
} |
||||
|
||||
// Remove entry from the in-memory bucket encryption cache
|
||||
globalBucketSSEConfigSys.Remove(bucket) |
||||
// Update peer MinIO servers of the updated bucket encryption config
|
||||
globalNotificationSys.RemoveBucketSSEConfig(ctx, bucket) |
||||
|
||||
writeSuccessNoContent(w) |
||||
} |
||||
@ -0,0 +1,169 @@ |
||||
/* |
||||
* MinIO Cloud Storage, (C) 2020 MinIO, Inc. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package cmd |
||||
|
||||
import ( |
||||
"bytes" |
||||
"context" |
||||
"encoding/xml" |
||||
"errors" |
||||
"io" |
||||
"path" |
||||
"sync" |
||||
|
||||
bucketsse "github.com/minio/minio/pkg/bucket/encryption" |
||||
) |
||||
|
||||
// BucketSSEConfigSys - in-memory cache of bucket encryption config
|
||||
type BucketSSEConfigSys struct { |
||||
sync.RWMutex |
||||
bucketSSEConfigMap map[string]bucketsse.BucketSSEConfig |
||||
} |
||||
|
||||
// NewBucketSSEConfigSys - Creates an empty in-memory bucket encryption configuration cache
|
||||
func NewBucketSSEConfigSys() *BucketSSEConfigSys { |
||||
return &BucketSSEConfigSys{ |
||||
bucketSSEConfigMap: make(map[string]bucketsse.BucketSSEConfig), |
||||
} |
||||
} |
||||
|
||||
// load - Loads the bucket encryption configuration for the given list of buckets
|
||||
func (sys *BucketSSEConfigSys) load(buckets []BucketInfo, objAPI ObjectLayer) error { |
||||
for _, bucket := range buckets { |
||||
config, err := objAPI.GetBucketSSEConfig(context.Background(), bucket.Name) |
||||
if err != nil { |
||||
if _, ok := err.(BucketSSEConfigNotFound); ok { |
||||
sys.Remove(bucket.Name) |
||||
} |
||||
continue |
||||
} |
||||
sys.Set(bucket.Name, *config) |
||||
} |
||||
|
||||
return nil |
||||
} |
||||
|
||||
// Init - Initializes in-memory bucket encryption config cache for the given list of buckets
|
||||
func (sys *BucketSSEConfigSys) Init(buckets []BucketInfo, objAPI ObjectLayer) error { |
||||
if objAPI == nil { |
||||
return errServerNotInitialized |
||||
} |
||||
|
||||
// We don't cache bucket encryption config in gateway mode, nothing to do.
|
||||
if globalIsGateway { |
||||
return nil |
||||
} |
||||
|
||||
// Load bucket encryption config cache once during boot.
|
||||
return sys.load(buckets, objAPI) |
||||
} |
||||
|
||||
// Get - gets bucket encryption config for the given bucket.
|
||||
func (sys *BucketSSEConfigSys) Get(bucket string) (config bucketsse.BucketSSEConfig, ok bool) { |
||||
// We don't cache bucket encryption config in gateway mode.
|
||||
if globalIsGateway { |
||||
objAPI := newObjectLayerWithoutSafeModeFn() |
||||
if objAPI == nil { |
||||
return |
||||
} |
||||
|
||||
cfg, err := objAPI.GetBucketSSEConfig(context.Background(), bucket) |
||||
if err != nil { |
||||
return |
||||
} |
||||
return *cfg, true |
||||
} |
||||
|
||||
sys.Lock() |
||||
defer sys.Unlock() |
||||
config, ok = sys.bucketSSEConfigMap[bucket] |
||||
return |
||||
} |
||||
|
||||
// Set - sets bucket encryption config to given bucket name.
|
||||
func (sys *BucketSSEConfigSys) Set(bucket string, config bucketsse.BucketSSEConfig) { |
||||
// We don't cache bucket encryption config in gateway mode.
|
||||
if globalIsGateway { |
||||
return |
||||
} |
||||
|
||||
sys.Lock() |
||||
defer sys.Unlock() |
||||
sys.bucketSSEConfigMap[bucket] = config |
||||
} |
||||
|
||||
// Remove - removes bucket encryption config for given bucket.
|
||||
func (sys *BucketSSEConfigSys) Remove(bucket string) { |
||||
sys.Lock() |
||||
defer sys.Unlock() |
||||
|
||||
delete(sys.bucketSSEConfigMap, bucket) |
||||
} |
||||
|
||||
// saveBucketSSEConfig - save bucket encryption config for given bucket.
|
||||
func saveBucketSSEConfig(ctx context.Context, objAPI ObjectLayer, bucket string, config *bucketsse.BucketSSEConfig) error { |
||||
data, err := xml.Marshal(config) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
|
||||
// Path to store bucket encryption config for the given bucket.
|
||||
configFile := path.Join(bucketConfigPrefix, bucket, bucketSSEConfig) |
||||
return saveConfig(ctx, objAPI, configFile, data) |
||||
} |
||||
|
||||
// getBucketSSEConfig - get bucket encryption config for given bucket.
|
||||
func getBucketSSEConfig(objAPI ObjectLayer, bucket string) (*bucketsse.BucketSSEConfig, error) { |
||||
// Path to bucket-encryption.xml for the given bucket.
|
||||
configFile := path.Join(bucketConfigPrefix, bucket, bucketSSEConfig) |
||||
configData, err := readConfig(context.Background(), objAPI, configFile) |
||||
if err != nil { |
||||
if err == errConfigNotFound { |
||||
err = BucketSSEConfigNotFound{Bucket: bucket} |
||||
} |
||||
return nil, err |
||||
} |
||||
|
||||
return bucketsse.ParseBucketSSEConfig(bytes.NewReader(configData)) |
||||
} |
||||
|
||||
// removeBucketSSEConfig - removes bucket encryption config for given bucket.
|
||||
func removeBucketSSEConfig(ctx context.Context, objAPI ObjectLayer, bucket string) error { |
||||
// Path to bucket-encryption.xml for the given bucket.
|
||||
configFile := path.Join(bucketConfigPrefix, bucket, bucketSSEConfig) |
||||
|
||||
if err := objAPI.DeleteObject(ctx, minioMetaBucket, configFile); err != nil { |
||||
if _, ok := err.(ObjectNotFound); ok { |
||||
return BucketSSEConfigNotFound{Bucket: bucket} |
||||
} |
||||
return err |
||||
} |
||||
return nil |
||||
} |
||||
|
||||
// validateBucketSSEConfig parses bucket encryption configuration and validates if it is supported by MinIO.
|
||||
func validateBucketSSEConfig(r io.Reader) (*bucketsse.BucketSSEConfig, error) { |
||||
encConfig, err := bucketsse.ParseBucketSSEConfig(r) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
if len(encConfig.Rules) == 1 && encConfig.Rules[0].DefaultEncryptionAction.Algorithm == bucketsse.AES256 { |
||||
return encConfig, nil |
||||
} |
||||
return nil, errors.New("Unsupported bucket encryption configuration") |
||||
} |
||||
@ -0,0 +1,70 @@ |
||||
/* |
||||
* MinIO Cloud Storage, (C) 2020 MinIO, Inc. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package cmd |
||||
|
||||
import ( |
||||
"bytes" |
||||
"errors" |
||||
"testing" |
||||
) |
||||
|
||||
func TestValidateBucketSSEConfig(t *testing.T) { |
||||
testCases := []struct { |
||||
inputXML string |
||||
expectedErr error |
||||
shouldPass bool |
||||
}{ |
||||
// MinIO supported XML
|
||||
{ |
||||
inputXML: `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> |
||||
<Rule> |
||||
<ApplyServerSideEncryptionByDefault> |
||||
<SSEAlgorithm>AES256</SSEAlgorithm> |
||||
</ApplyServerSideEncryptionByDefault> |
||||
</Rule> |
||||
</ServerSideEncryptionConfiguration>`, |
||||
expectedErr: nil, |
||||
shouldPass: true, |
||||
}, |
||||
// Unsupported XML
|
||||
{ |
||||
inputXML: `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> |
||||
<Rule> |
||||
<ApplyServerSideEncryptionByDefault> |
||||
<SSEAlgorithm>aws:kms</SSEAlgorithm> |
||||
<KMSMasterKeyID>arn:aws:kms:us-east-1:1234/5678example</KMSMasterKeyID> |
||||
</ApplyServerSideEncryptionByDefault> |
||||
</Rule> |
||||
</ServerSideEncryptionConfiguration>`, |
||||
expectedErr: errors.New("Unsupported bucket encryption configuration"), |
||||
shouldPass: false, |
||||
}, |
||||
} |
||||
|
||||
for i, tc := range testCases { |
||||
_, err := validateBucketSSEConfig(bytes.NewReader([]byte(tc.inputXML))) |
||||
if tc.shouldPass && err != nil { |
||||
t.Fatalf("Test case %d: Expected to succeed but got %s", i+1, err) |
||||
} |
||||
|
||||
if !tc.shouldPass { |
||||
if err == nil || err != nil && err.Error() != tc.expectedErr.Error() { |
||||
t.Fatalf("Test case %d: Expected %s but got %s", i+1, tc.expectedErr, err) |
||||
} |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,103 @@ |
||||
/* |
||||
* MinIO Cloud Storage, (C) 2020 MinIO, Inc. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package cmd |
||||
|
||||
import ( |
||||
"encoding/xml" |
||||
"errors" |
||||
"io" |
||||
) |
||||
|
||||
const ( |
||||
// AES256 is used with SSE-S3
|
||||
AES256 SSEAlgorithm = "AES256" |
||||
// AWSKms is used with SSE-KMS
|
||||
AWSKms SSEAlgorithm = "aws:kms" |
||||
) |
||||
|
||||
// SSEAlgorithm - represents valid SSE algorithms supported; currently only AES256 is supported
|
||||
type SSEAlgorithm string |
||||
|
||||
// UnmarshalXML - Unmarshals XML tag to valid SSE algorithm
|
||||
func (alg *SSEAlgorithm) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error { |
||||
var s string |
||||
if err := d.DecodeElement(&s, &start); err != nil { |
||||
return err |
||||
} |
||||
|
||||
switch s { |
||||
case string(AES256): |
||||
*alg = AES256 |
||||
case string(AWSKms): |
||||
*alg = AWSKms |
||||
default: |
||||
return errors.New("Unknown SSE algorithm") |
||||
} |
||||
|
||||
return nil |
||||
} |
||||
|
||||
// MarshalXML - Marshals given SSE algorithm to valid XML
|
||||
func (alg *SSEAlgorithm) MarshalXML(e *xml.Encoder, start xml.StartElement) error { |
||||
return e.EncodeElement(string(*alg), start) |
||||
} |
||||
|
||||
// EncryptionAction - for ApplyServerSideEncryptionByDefault XML tag
|
||||
type EncryptionAction struct { |
||||
Algorithm SSEAlgorithm `xml:"SSEAlgorithm"` |
||||
MasterKeyID string `xml:"KMSMasterKeyID"` |
||||
} |
||||
|
||||
// SSERule - for ServerSideEncryptionConfiguration XML tag
|
||||
type SSERule struct { |
||||
DefaultEncryptionAction EncryptionAction `xml:"ApplyServerSideEncryptionByDefault"` |
||||
} |
||||
|
||||
// BucketSSEConfig - represents default bucket encryption configuration
|
||||
type BucketSSEConfig struct { |
||||
XMLName xml.Name `xml:"ServerSideEncryptionConfiguration"` |
||||
Rules []SSERule `xml:"Rule"` |
||||
} |
||||
|
||||
// ParseBucketSSEConfig - Decodes given XML to a valid default bucket encryption config
|
||||
func ParseBucketSSEConfig(r io.Reader) (*BucketSSEConfig, error) { |
||||
var config BucketSSEConfig |
||||
err := xml.NewDecoder(r).Decode(&config) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
// Validates server-side encryption config rules
|
||||
// Only one rule is allowed on AWS S3
|
||||
if len(config.Rules) != 1 { |
||||
return nil, errors.New("Only one server-side encryption rule is allowed") |
||||
} |
||||
|
||||
for _, rule := range config.Rules { |
||||
switch rule.DefaultEncryptionAction.Algorithm { |
||||
case AES256: |
||||
if rule.DefaultEncryptionAction.MasterKeyID != "" { |
||||
return nil, errors.New("MasterKeyID is allowed with aws:kms only") |
||||
} |
||||
case AWSKms: |
||||
if rule.DefaultEncryptionAction.MasterKeyID == "" { |
||||
return nil, errors.New("MasterKeyID is missing") |
||||
} |
||||
} |
||||
} |
||||
return &config, nil |
||||
} |
||||
@ -0,0 +1,159 @@ |
||||
/* |
||||
* MinIO Cloud Storage, (C) 2020 MinIO, Inc. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package cmd |
||||
|
||||
import ( |
||||
"bytes" |
||||
"encoding/xml" |
||||
"errors" |
||||
"testing" |
||||
) |
||||
|
||||
// TestParseBucketSSEConfig performs basic sanity tests on ParseBucketSSEConfig
|
||||
func TestParseBucketSSEConfig(t *testing.T) { |
||||
testCases := []struct { |
||||
inputXML string |
||||
expectedErr error |
||||
shouldPass bool |
||||
}{ |
||||
// 1. Valid XML SSE-S3
|
||||
{ |
||||
inputXML: `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> |
||||
<Rule> |
||||
<ApplyServerSideEncryptionByDefault> |
||||
<SSEAlgorithm>AES256</SSEAlgorithm> |
||||
</ApplyServerSideEncryptionByDefault> |
||||
</Rule> |
||||
</ServerSideEncryptionConfiguration>`, |
||||
expectedErr: nil, |
||||
shouldPass: true, |
||||
}, |
||||
// 2. Valid XML SSE-KMS
|
||||
{ |
||||
inputXML: `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> |
||||
<Rule> |
||||
<ApplyServerSideEncryptionByDefault> |
||||
<SSEAlgorithm>aws:kms</SSEAlgorithm> |
||||
<KMSMasterKeyID>arn:aws:kms:us-east-1:1234/5678example</KMSMasterKeyID> |
||||
</ApplyServerSideEncryptionByDefault> |
||||
</Rule> |
||||
</ServerSideEncryptionConfiguration>`, |
||||
expectedErr: nil, |
||||
shouldPass: true, |
||||
}, |
||||
// 3. Invalid - more than one rule
|
||||
{ |
||||
inputXML: `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> |
||||
<Rule> |
||||
<ApplyServerSideEncryptionByDefault> |
||||
<SSEAlgorithm>AES256</SSEAlgorithm> |
||||
</ApplyServerSideEncryptionByDefault> |
||||
</Rule> |
||||
<Rule> |
||||
<ApplyServerSideEncryptionByDefault> |
||||
<SSEAlgorithm>AES256</SSEAlgorithm> |
||||
</ApplyServerSideEncryptionByDefault> |
||||
</Rule> |
||||
</ServerSideEncryptionConfiguration>`, |
||||
expectedErr: errors.New("Only one server-side encryption rule is allowed"), |
||||
shouldPass: false, |
||||
}, |
||||
// 4. Invalid XML - master key ID present in AES256
|
||||
{ |
||||
inputXML: `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> |
||||
<Rule> |
||||
<ApplyServerSideEncryptionByDefault> |
||||
<SSEAlgorithm>AES256</SSEAlgorithm> |
||||
<KMSMasterKeyID>arn:aws:kms:us-east-1:1234/5678example</KMSMasterKeyID> |
||||
</ApplyServerSideEncryptionByDefault> |
||||
</Rule> |
||||
</ServerSideEncryptionConfiguration>`, |
||||
expectedErr: errors.New("MasterKeyID is allowed with aws:kms only"), |
||||
shouldPass: false, |
||||
}, |
||||
// 5. Invalid XML - master key ID not found in aws:kms algorithm
|
||||
{ |
||||
inputXML: `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> |
||||
<Rule> |
||||
<ApplyServerSideEncryptionByDefault> |
||||
<SSEAlgorithm>aws:kms</SSEAlgorithm> |
||||
</ApplyServerSideEncryptionByDefault> |
||||
</Rule> |
||||
</ServerSideEncryptionConfiguration>`, |
||||
expectedErr: errors.New("MasterKeyID is missing"), |
||||
shouldPass: false, |
||||
}, |
||||
// 6. Invalid Algorithm
|
||||
{ |
||||
inputXML: `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> |
||||
<Rule> |
||||
<ApplyServerSideEncryptionByDefault> |
||||
<SSEAlgorithm>InvalidAlgorithm</SSEAlgorithm> |
||||
</ApplyServerSideEncryptionByDefault> |
||||
</Rule> |
||||
</ServerSideEncryptionConfiguration>`, |
||||
expectedErr: errors.New("Unknown SSE algorithm"), |
||||
shouldPass: false, |
||||
}, |
||||
// 7. Allow missing namespace
|
||||
{ |
||||
inputXML: `<ServerSideEncryptionConfiguration> |
||||
<Rule> |
||||
<ApplyServerSideEncryptionByDefault> |
||||
<SSEAlgorithm>AES256</SSEAlgorithm> |
||||
</ApplyServerSideEncryptionByDefault> |
||||
</Rule> |
||||
</ServerSideEncryptionConfiguration>`, |
||||
expectedErr: nil, |
||||
shouldPass: true, |
||||
}, |
||||
} |
||||
|
||||
actualConfig := &BucketSSEConfig{ |
||||
XMLName: xml.Name{ |
||||
Local: "ServerSideEncryptionConfiguration", |
||||
}, |
||||
Rules: []SSERule{ |
||||
{ |
||||
DefaultEncryptionAction: EncryptionAction{ |
||||
Algorithm: AES256, |
||||
}, |
||||
}, |
||||
}, |
||||
} |
||||
|
||||
for i, tc := range testCases { |
||||
_, err := ParseBucketSSEConfig(bytes.NewReader([]byte(tc.inputXML))) |
||||
if tc.shouldPass && err != nil { |
||||
t.Fatalf("Test case %d: Expected to succeed but got %s", i+1, err) |
||||
} |
||||
|
||||
if !tc.shouldPass { |
||||
if err == nil || err != nil && err.Error() != tc.expectedErr.Error() { |
||||
t.Fatalf("Test case %d: Expected %s but got %s", i+1, tc.expectedErr, err) |
||||
} |
||||
} |
||||
|
||||
if !tc.shouldPass { |
||||
continue |
||||
} |
||||
|
||||
if actualXML, err := xml.Marshal(actualConfig); err != nil && bytes.Equal(actualXML, []byte(tc.inputXML)) { |
||||
t.Fatalf("Test case %d: Expected config %s but got %s", i+1, string(actualXML), tc.inputXML) |
||||
} |
||||
} |
||||
} |
||||
Loading…
Reference in new issue