yandrey321 opened a new pull request, #11788:
URL: https://github.com/apache/ozone/pull/11788
## What changes were proposed in this pull request?
**Problem.** The S3 Gateway ignored the server-side encryption (SSE)
headers. A `PutObject` with
`x-amz-server-side-encryption: AES256`, `aws:kms`, or an SSE-C customer key
returned 200 and stored the object as
written: unencrypted, unless the bucket was an encrypted (TDE) bucket. A
client that asked for encryption at rest
could not tell that the request was not honoured. An SSE-C key was
discarded, and the object could later be read
without it.
**Implementation idea.** A new helper, `ServerSideEncryption`, checks the
SSE headers at every entry point that
writes an object or reads one with a customer key:
- **Writes** (`PutObject`, `CopyObject`, `UploadPart`, `UploadPartCopy`,
`CreateMultipartUpload`):
- SSE-S3 (`AES256`) and SSE-KMS (`aws:kms`) are accepted in an encrypted
bucket. Its data is encrypted at rest
with the bucket's KMS key anyway. The response returns
`x-amz-server-side-encryption`, and for `aws:kms` also the
bucket's key as `x-amz-server-side-encryption-aws-kms-key-id`.
- In any other bucket, they fail with `NotImplemented` and nothing is
written.
- **Always `NotImplemented`:**
- SSE-C (`x-amz-server-side-encryption-customer-*`,
`x-amz-copy-source-server-side-encryption-customer-*`), on
writes and on `GetObject`, `HeadObject` and `GetObjectAttributes`;
- an encryption context;
- `aws:kms:dsse`;
- an `aws:kms` key id other than the bucket's encryption key.
- **`InvalidArgument`, as AWS returns:** an unknown algorithm, or a KMS key
id or encryption context without
`aws:kms`.
**Key decisions.**
- **Honour SSE-S3 and SSE-KMS on encrypted buckets instead of rejecting them
everywhere.** The request's intent,
"encrypt this object at rest", is met there, and clients such as S3A
configured with an encryption algorithm keep
working against encrypted buckets.
- **No setting to restore the old behaviour.** Storing plaintext after a
request for encryption was the bug. A client
that fails now was never getting encryption, and can drop the header or
use an encrypted bucket.
- **`NotImplemented`**, the error the gateway already returns for other
unsupported features (for example
`?encryption`), for requests that are valid S3 but can't be honoured.
`InvalidArgument` only for requests that are
invalid in S3 too.
**Side effects.**
- Clients that send SSE headers to regular buckets now get `NotImplemented`
(501) instead of a silently unencrypted
object.
- `GetObject` and `HeadObject` responses still don't return
`x-amz-server-side-encryption` for objects in encrypted
buckets. That is left to a follow-up.
Generated-by: Claude Code (Claude Opus 5.5)
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-17498
## How was this patch tested?
- **New `TestServerSideEncryption`**, 27 tests on a regular and an encrypted
bucket. The stub now keeps a bucket's
encryption key.
- `AES256` and `aws:kms`, with and without the bucket's key id: accepted
on the encrypted bucket with the matching
response headers, and rejected with `NotImplemented` on the regular one
without writing a key.
- Another KMS key, an encryption context, `aws:kms:dsse`:
`NotImplemented`. An unknown algorithm, and a key id
without `aws:kms`: `InvalidArgument`.
- Each of the 6 SSE-C headers: `NotImplemented` for `PutObject` in both
buckets, and for `GetObject`, `HeadObject`
and `GetObjectAttributes`.
- `CopyObject`, `CreateMultipartUpload` and `UploadPart` with SSE, to both
kinds of bucket.
- **Smoke tests**, added to `s3/objectputget.robot`:
- `PutObject` with `--server-side-encryption AES256` succeeds and returns
`"ServerSideEncryption": "AES256"` when
the suite runs on the `encrypted` bucket (`ozonesecure`); on other
buckets it fails with `NotImplemented` and
writes nothing.
- SSE-C always fails with `NotImplemented`.
- Run on the `ozone` compose cluster (regular bucket): both pass. The
`encrypted` branch needs the KMS of the
secure environment and was not run locally.
- **Manual check on the compose cluster with `aws s3api`:**
- `put-object` with `AES256`, with `aws:kms`, and with SSE-C failed with
`NotImplemented` and the new messages;
- `create-multipart-upload` with `AES256` failed with `NotImplemented`;
- `head-object` with SSE-C returned 501;
- only the object written without SSE headers was stored.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
