This commit refactors the SSE implementation and add S3-compatible SSE-KMS context handling. SSE-KMS differs from SSE-S3 in two main aspects: 1. The client can request a particular key and specify a KMS context as part of the request. 2. The ETag of an SSE-KMS encrypted object is not the MD5 sum of the object content. This commit only focuses on the 1st aspect. A client can send an optional SSE context when using SSE-KMS. This context is remembered by the S3 server such that the client does not have to specify the context again (during multipart PUT / GET / HEAD ...). The crypto. context also includes the bucket/object name to prevent renaming objects at the backend. Now, AWS S3 behaves as following: - If the user does not provide a SSE-KMS context it does not store one - resp. does not include the SSE-KMS context header in the response (e.g. HEAD). - If the user specifies a SSE-KMS context without the bucket/object name then AWS stores the exact context the client provided but adds the bucket/object name internally. The response contains the KMS context without the bucket/object name. - If the user specifies a SSE-KMS context with the bucket/object name then AWS again stores the exact context provided by the client. The response contains the KMS context with the bucket/object name. This commit implements this behavior w.r.t. SSE-KMS. However, as of now, no such object can be created since the server rejects SSE-KMS encryption requests. This commit is one stepping stone for SSE-KMS support. Co-authored-by: Harshavardhana <harsha@minio.io> |
||
---|---|---|
.. | ||
config.go | ||
doc.go | ||
error.go | ||
header.go | ||
header_test.go | ||
help.go | ||
json.go | ||
kes.go | ||
key.go | ||
key_test.go | ||
kms.go | ||
kms_test.go | ||
legacy.go | ||
metadata.go | ||
metadata_test.go | ||
parse.go | ||
parse_test.go | ||
retry.go | ||
sse-c.go | ||
sse-kms.go | ||
sse-s3.go | ||
sse.go | ||
sse_test.go | ||
vault.go | ||
vault_test.go |