gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-16 09:58:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

perf(storage): converge Wave 2 hot-path optimizations (#6065)

Browse Source 
* perf(get): share inline shards and lock clients

Co-Authored-By: heihutu <heihutu@gmail.com>

* perf(ecstore): converge PUT encoding on contiguous blocks

Co-Authored-By: heihutu <heihutu@gmail.com>

* perf(get): cache codec streaming gate config

Co-Authored-By: heihutu <heihutu@gmail.com>

* fix(sse): redact projected customer headers

Co-Authored-By: heihutu <heihutu@gmail.com>

* perf(ecstore): collapse GET metadata snapshots

Co-Authored-By: heihutu <heihutu@gmail.com>

* perf(ecstore): reuse decode stripe scratch

Co-Authored-By: heihutu <heihutu@gmail.com>

* refactor(ecstore): trim decode scratch adapters

Co-Authored-By: heihutu <heihutu@gmail.com>

* test(ecstore): adapt transition checks to metadata snapshots

Co-Authored-By: heihutu <heihutu@gmail.com>

* perf(get): release metadata snapshots at ownership boundary

Co-Authored-By: heihutu <heihutu@gmail.com>

* refactor(ecstore): close cumulative fast-path findings

Co-Authored-By: heihutu <heihutu@gmail.com>

* fix(storage): preserve lock and header invariants

Co-Authored-By: heihutu <heihutu@gmail.com>

* test(ecstore): adapt cumulative paths after rebase

Co-Authored-By: heihutu <heihutu@gmail.com>

* fix(rio-v2): adapt generated metadata fixture

Co-Authored-By: heihutu <heihutu@gmail.com>

---------

Co-authored-by: heihutu <heihutu@gmail.com>
This commit is contained in:
houseme
2026-08-13 16:34:28 +08:00
committed by GitHub
parent 36deab8670
commit d2b1003612
24 changed files with 1233 additions and 697 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/utils/src/http/object_encryption_keys.rs
+31 -1
View File
@@ -25,7 +25,7 @@
// The lowercase stored forms, matching exactly what encryption_material_to_metadata
// persists. The read-path SSE-C check is case-sensitive, so restoring under any
// other casing would classify the replica as managed-SSE and reject SSE-C GETs.
use super::headers::{SSEC_ALGORITHM_HEADER, SSEC_KEY_MD5_HEADER};
use super::headers::{SSEC_ALGORITHM_HEADER, SSEC_KEY_HEADER, SSEC_KEY_MD5_HEADER};
pub const INTERNAL_ENCRYPTION_KEY_ID_HEADER: &str = "x-rustfs-encryption-key-id";
pub const INTERNAL_ENCRYPTION_KEY_HEADER: &str = "x-rustfs-encryption-key";
@@ -85,6 +85,20 @@ pub const SSEC_REPLICATION_TRANSPORT_HEADERS: &[(&str, &str)] = &[
(MINIO_INTERNAL_ENCRYPTION_MULTIPART_HEADER, REPLICATION_ENCRYPTED_MULTIPART_HEADER),
];
/// Retains only the SSE-C headers consumed by object readers and marks their
/// values sensitive so instrumented storage calls cannot expose key material.
pub fn project_ssec_transport_headers(headers: &http::HeaderMap) -> http::HeaderMap {
let mut projected = http::HeaderMap::new();
for name in [SSEC_ALGORITHM_HEADER, SSEC_KEY_HEADER, SSEC_KEY_MD5_HEADER] {
if let Some(value) = headers.get(name) {
let mut value = value.clone();
value.set_sensitive(true);
projected.insert(name, value);
}
}
projected
}
/// Prefixes of replication SSE transport keys whose values carry encryption
/// material and must never reach logs. Consumed by `rustfs_filemeta` redaction.
pub const REPLICATION_SSE_TRANSPORT_PREFIXES: &[&str] = &[
@@ -155,6 +169,22 @@ pub fn is_replication_stripped_encryption_key(key: &str) -> bool {
mod tests {
use super::*;
#[test]
fn ssec_transport_projection_retains_only_redacted_reader_headers() {
let mut headers = http::HeaderMap::new();
headers.insert(SSEC_ALGORITHM_HEADER, http::HeaderValue::from_static("AES256"));
headers.insert(SSEC_KEY_HEADER, http::HeaderValue::from_static("secret-key"));
headers.insert(SSEC_KEY_MD5_HEADER, http::HeaderValue::from_static("key-md5"));
headers.insert(http::header::AUTHORIZATION, http::HeaderValue::from_static("credential"));
let projected = project_ssec_transport_headers(&headers);
assert_eq!(projected.len(), 3);
assert!(projected.values().all(http::HeaderValue::is_sensitive));
assert!(projected.get(http::header::AUTHORIZATION).is_none());
assert!(!format!("{projected:?}").contains("secret-key"));
}
#[test]
fn transport_metadata_roundtrip_restores_stored_keys() {
let mut headers = http::HeaderMap::new();