a1f70b106f
This commit adds support for SSE-KMS bucket configurations. Before, the MinIO server did not support SSE-KMS, and therefore, it was not possible to specify an SSE-KMS bucket config. Now, this is possible. For example: ``` mc encrypt set sse-kms some-key <alias>/my-bucket ``` Further, this commit fixes an issue caused by not supporting SSE-KMS bucket configuration and switching to SSE-KMS as default SSE method. Before, the server just checked whether an SSE bucket config was present (not which type of SSE config) and applied the default SSE method (which was switched from SSE-S3 to SSE-KMS). This caused objects to get encrypted with SSE-KMS even though a SSE-S3 bucket config was present. This issue is fixed as a side-effect of this commit. Signed-off-by: Andreas Auernhammer <aead@mail.de>
62 lines
1.9 KiB
Go
62 lines
1.9 KiB
Go
// Copyright (c) 2015-2021 MinIO, Inc.
|
|
//
|
|
// This file is part of MinIO Object Storage stack
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
package cmd
|
|
|
|
import (
|
|
"errors"
|
|
"io"
|
|
|
|
bucketsse "github.com/minio/minio/pkg/bucket/encryption"
|
|
)
|
|
|
|
// BucketSSEConfigSys - in-memory cache of bucket encryption config
|
|
type BucketSSEConfigSys struct{}
|
|
|
|
// NewBucketSSEConfigSys - Creates an empty in-memory bucket encryption configuration cache
|
|
func NewBucketSSEConfigSys() *BucketSSEConfigSys {
|
|
return &BucketSSEConfigSys{}
|
|
}
|
|
|
|
// Get - gets bucket encryption config for the given bucket.
|
|
func (sys *BucketSSEConfigSys) Get(bucket string) (*bucketsse.BucketSSEConfig, error) {
|
|
if globalIsGateway {
|
|
objAPI := newObjectLayerFn()
|
|
if objAPI == nil {
|
|
return nil, errServerNotInitialized
|
|
}
|
|
|
|
return nil, BucketSSEConfigNotFound{Bucket: bucket}
|
|
}
|
|
|
|
return globalBucketMetadataSys.GetSSEConfig(bucket)
|
|
}
|
|
|
|
// validateBucketSSEConfig parses bucket encryption configuration and validates if it is supported by MinIO.
|
|
func validateBucketSSEConfig(r io.Reader) (*bucketsse.BucketSSEConfig, error) {
|
|
encConfig, err := bucketsse.ParseBucketSSEConfig(r)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if len(encConfig.Rules) == 1 {
|
|
return encConfig, nil
|
|
}
|
|
|
|
return nil, errors.New("Unsupported bucket encryption configuration")
|
|
}
|