feat(replication): proxy GET/HEAD/Tagging for unreplicated objects to replication targets (#6172)

* feat(replication): proxy GET/HEAD/Tagging for unreplicated objects to replication targets Implements the MinIO active-active read-proxy protocol (P1-5 of the replication compatibility review): when a GET/HEAD/GetObjectTagging/ PutObjectTagging/DeleteObjectTagging request fails locally with not-found and the bucket has replication targets, the request is proxied to the targets in rule order, mirroring bucket-replication.go proxyGetToReplicationTarget/proxyHeadToRepTarget/proxyTaggingToRepTarget. Protocol surface: - Anti-loop: inbound {x-rustfs-,x-minio-}source-proxy-request is parsed into ObjectOptions (proxy_request + proxy_header_set, matching MinIO ProxyRequest/ProxyHeaderSet); a request carrying the marker with ANY value is never re-proxied. Outbound client proxy calls send the marker as "true"; replication worker convergence HEADs send it as "false" so a peer's proxy layer cannot answer a convergence check by proxying back to the source (which would fake Completed without a PUT). - Target selection: new replication_proxy.rs get_proxy_targets — empty when the marker is set, versioning is suspended, or no replication config; otherwise filter_target_arns -> TargetClient lookup, skipping targets with proxying disabled. - TargetClient gains head_object_for_proxy/get_object (streaming) and the three tagging calls. Proxy calls never send the replication-check SSE-C exemption header; customer SSE-C keys are forwarded verbatim so the target performs real decryption. Conditional (If-*) headers are not forwarded (MinIO parity); Range and part_number are, with parts_count/tag_count/storage_class/expiration passed through. - Metrics: proxy counters now count only real client proxy traffic, MinIO-aligned (one total per proxied request, one failed when no target served it). The previous misattributed counters — replication worker HEAD/PUT (#2672) and local tagging operations (#2682) — are removed; ReplProxyMetric now maps the tagging counters instead of dropping them. e2e (fake_s3_target extended with tagging + header journaling): proxied GET body + outbound header contract (marker present, no replication-check, SSE-C passthrough), HEAD, anti-loop 404 with zero outbound requests, GetObjectTagging, and metric mapping unit tests. Rolling note: proxying only activates for buckets with replication targets; requests carrying the marker keep pre-upgrade behavior. Refs rustfs/backlog#1675 (P1-5) * fix(replication): fail SSE-C passthrough closed on targets that drop transport headers (#6178) SSE-C ciphertext passthrough replicates via X-Rustfs-Replication-* transport headers. A MinIO/generic-S3 target silently discards them, storing bare ciphertext with no decryption material — yet the PUT succeeded, so the object reported COMPLETED with a silently unreadable replica (backlog#1675 N2). Fail-closed design: - SsecPassthroughCapability {Unknown, Supported, Unsupported} cached in BucketTargetSys per target ARN with a recording timestamp. Entries reset whenever the target is rebuilt, edited, or removed (arn_remotes_map lifecycle) and expire after SSEC_PASSTHROUGH_CAPABILITY_TTL (10 minutes): an expired verdict in either direction is re-earned through the audit, so an Unsupported target recovers automatically after an upgrade (at most one wasted PUT+HEAD audit per bad target per TTL window) and a Supported verdict cannot outlive a backend swapped behind the same endpoint. - Replication worker (replicate_object and replicate_all): fresh Unsupported targets never receive the PUT — the attempt fails immediately into the normal MRF retry channel with a "run ?replication-check to re-probe" hint. Unknown or expired verdicts are audited: after the PUT the worker HEADs the replica back through the replication-check channel (source version id mapped through resolve_read_api_version_id, so null-version objects audit correctly) and requires SSE-C evidence (the echoed customer-algorithm header); missing evidence records Unsupported and fails the attempt. Convergence HEADs are audited the same way, so a broken ciphertext replica from an earlier attempt can never launder itself into COMPLETED via an ETag match. The gate/evidence policy is pure (replication_target_boundary, staleness folded in as an input) for the M2 worker migration. - replication-check grows an SsecPassthrough probe phase: a probe PUT carrying the live transport-header shape, HEAD-back for evidence, and a machine-readable Code BucketRemoteSsecPassthroughUnsupported on failure. The probe verdict is synced into the runtime capability cache. Unlike VersionFidelity, a failed SsecPassthrough phase does NOT fail the target overall — it is a capability limit, not a broken replication contract, and a plaintext-only deployment against such a target must not turn red. - fake_s3_target: default mode now models a RustFS target (stores the transport headers, echoes SSE-C evidence); the new drop_unlisted_replication_headers mode models MinIO. The journal records whether a request carried transport headers. Receiver-echo verification: the replication-check HEAD exemption only skips SSE-C key validation; the response has always built sse-customer-algorithm from stored metadata (rustfs/src/app/object_usecase.rs), so no receiver change was needed — pinned end to end by the replication-check e2e against a real RustFS target. Rolling-upgrade constraint: RustFS targets older than the replication-check HEAD exemption (#5898) answer the audit HEAD without SSE-C evidence (or fail it outright), so SSE-C replication to such targets reports FAILED. This is deliberate — FAILED-and-retryable beats a silently undecryptable replica — and self-heals: once the target is upgraded, the next TTL expiry (or a manual ?replication-check re-probe) re-audits and records Supported. Plaintext and managed-SSE replication are unaffected. The capability cache is per-node; each node audits independently. Known limitations: - The audit judges evidence from the echoed customer-algorithm header only. A hypothetical target that preserves that one header while dropping other transport headers (partial-drop) would pass the audit; no known target behaves this way — observed targets drop the whole unknown-header family. - A mixed-version target cluster can flap the verdict between audits routed to different target nodes until the rollout completes; the TTL bounds how long each stale verdict persists. New e2e (backlog#1675 C1 + N2, red-first): fail-closed against a header-dropping fake (FAILED + no second PUT via the capability cache, journal-asserted; red run showed the old COMPLETED), replication-check reports the SsecPassthrough phase Code while the target stays OK overall, SSE-C heal convergence after a real target outage, and SSE-C existing-object resync landing a REPLICA readable with the customer key. TTL expiry in both directions is pinned at the cache and gate seams.
2026-08-18 18:46:17 +00:00 · 2026-08-18 08:47:22 +08:00
parent 21c2fb42bb
commit daecb93139
22 changed files with 2769 additions and 189 deletions
@@ -32,7 +32,7 @@ pub mod bucket {
    pub mod bucket_target_sys {
        pub use crate::bucket::bucket_target_sys::{
            AdvancedPutOptions, BucketTargetError, BucketTargetSys, PutObjectOptions, RemoveObjectOptions, S3ClientError,
-            TargetClient, append_version_id_query,
+            SsecPassthroughCapability, TargetClient, append_version_id_query,
        };
    }

@@ -198,12 +198,13 @@ pub mod bucket {
            ReplicationType, ResyncOpts, ResyncStatusType, RuntimeReplicationTargetBacklog, TargetReplicationResyncStatus,
            VersionPurgeStatusType, XferStats, commit_force_delete_intent, complete_force_delete_intent,
            delete_replication_state_from_config, delete_replication_version_id, get_global_replication_pool,
-            get_global_replication_stats, init_background_replication, invalid_replication_config_status_field,
-            persist_force_delete_intent, read_durable_mrf_backlog, replication_state_to_filemeta, replication_status_to_filemeta,
-            replication_statuses_map, replication_target_arns, resync_start_conflict_id, should_remove_replication_target,
-            should_schedule_delete_replication, should_use_existing_delete_replication_info,
-            should_use_existing_delete_replication_source, unsupported_replication_config_field,
-            validate_replication_config_structure, validate_replication_config_target_arns, version_purge_status_to_filemeta,
+            get_global_replication_stats, get_proxy_targets, init_background_replication,
+            invalid_replication_config_status_field, persist_force_delete_intent, read_durable_mrf_backlog,
+            replication_state_to_filemeta, replication_status_to_filemeta, replication_statuses_map, replication_target_arns,
+            resync_start_conflict_id, should_remove_replication_target, should_schedule_delete_replication,
+            should_use_existing_delete_replication_info, should_use_existing_delete_replication_source,
+            unsupported_replication_config_field, validate_replication_config_structure, validate_replication_config_target_arns,
+            version_purge_status_to_filemeta,
        };
    }

@@ -27,10 +27,15 @@ use aws_sdk_s3::config::SharedHttpClient;
 use aws_sdk_s3::error::ProvideErrorMetadata;
 use aws_sdk_s3::error::SdkError;
 use aws_sdk_s3::operation::complete_multipart_upload::CompleteMultipartUploadOutput;
+use aws_sdk_s3::operation::delete_object_tagging::{DeleteObjectTaggingError, DeleteObjectTaggingOutput};
+use aws_sdk_s3::operation::get_object::{GetObjectError, GetObjectOutput};
+use aws_sdk_s3::operation::get_object_tagging::{GetObjectTaggingError, GetObjectTaggingOutput};
 use aws_sdk_s3::operation::head_bucket::HeadBucketError;
 use aws_sdk_s3::operation::head_object::HeadObjectError;
+use aws_sdk_s3::operation::put_object_tagging::{PutObjectTaggingError, PutObjectTaggingOutput};
 use aws_sdk_s3::operation::upload_part::UploadPartOutput;
 use aws_sdk_s3::primitives::ByteStream;
+use aws_sdk_s3::types::Tagging as SdkTagging;
 use aws_sdk_s3::types::{
    ChecksumMode, CompletedMultipartUpload, CompletedPart, ObjectLockLegalHoldStatus, ObjectLockRetentionMode,
 };
@@ -57,8 +62,8 @@ use rustfs_utils::http::{
    is_rustfs_header, is_standard_header, is_storageclass_header,
 };
 use rustfs_utils::http::{
-    SUFFIX_FORCE_DELETE, SUFFIX_SOURCE_DELETEMARKER, SUFFIX_SOURCE_ETAG, SUFFIX_SOURCE_MTIME, SUFFIX_SOURCE_REPLICATION_CHECK,
-    SUFFIX_SOURCE_REPLICATION_LEGALHOLD_TIMESTAMP, SUFFIX_SOURCE_REPLICATION_REQUEST,
+    SUFFIX_FORCE_DELETE, SUFFIX_SOURCE_DELETEMARKER, SUFFIX_SOURCE_ETAG, SUFFIX_SOURCE_MTIME, SUFFIX_SOURCE_PROXY_REQUEST,
+    SUFFIX_SOURCE_REPLICATION_CHECK, SUFFIX_SOURCE_REPLICATION_LEGALHOLD_TIMESTAMP, SUFFIX_SOURCE_REPLICATION_REQUEST,
    SUFFIX_SOURCE_REPLICATION_RETENTION_TIMESTAMP, SUFFIX_SOURCE_REPLICATION_TAGGING_TIMESTAMP, SUFFIX_SOURCE_VERSION_ID,
    insert_header,
 };
@@ -294,9 +299,51 @@ struct TargetClientBuildProbe {
    release: Arc<tokio::sync::Semaphore>,
 }

+/// Whether a replication target preserves the SSE-C passthrough transport
+/// headers (`X-Rustfs-Replication-*`) end to end.
+///
+/// A target that silently drops those headers (MinIO, generic S3) stores the
+/// forwarded ciphertext without its decryption material — an unreadable
+/// replica that used to report COMPLETED. The replication worker audits the
+/// first passthrough PUT per target (HEAD-back for SSE-C evidence) and caches
+/// the verdict here; a fresh `Unsupported` fails SSE-C replication closed
+/// before any PUT is sent. Entries follow the `arn_remotes_map` lifecycle
+/// (rebuilding or removing a target resets its capability to `Unknown`) and
+/// additionally expire after [`SSEC_PASSTHROUGH_CAPABILITY_TTL`], after which
+/// the next attempt re-audits.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum SsecPassthroughCapability {
+    #[default]
+    Unknown,
+    Supported,
+    Unsupported,
+}
+
+/// How long an audited SSE-C passthrough verdict stays authoritative.
+///
+/// Trade-off: without a TTL a verdict is sticky for the process lifetime —
+/// an `Unsupported` target that gets upgraded (or re-probed only via
+/// replication-check) would keep failing SSE-C replication forever, and the
+/// fail-open twin: a `Supported` verdict would outlive a backend swapped
+/// behind the same endpoint/ARN. With the TTL, a bad target costs at most
+/// one wasted PUT+HEAD audit per TTL window, and a changed backend is
+/// re-discovered within the same window.
+pub const SSEC_PASSTHROUGH_CAPABILITY_TTL: Duration = Duration::from_secs(10 * 60);
+
+/// A recorded SSE-C passthrough verdict plus when it was recorded, so reads
+/// can report staleness against [`SSEC_PASSTHROUGH_CAPABILITY_TTL`].
+#[derive(Debug, Clone, Copy)]
+struct SsecPassthroughRecord {
+    capability: SsecPassthroughCapability,
+    recorded_at: Instant,
+}
+
 #[derive(Debug, Default)]
 pub struct BucketTargetSys {
    pub arn_remotes_map: Arc<RwLock<HashMap<String, ArnTarget>>>,
+    /// SSE-C passthrough capability verdicts keyed by target ARN. See
+    /// [`SsecPassthroughCapability`]; reset alongside `arn_remotes_map`.
+    ssec_passthrough_map: Arc<RwLock<HashMap<String, SsecPassthroughRecord>>>,
    pub targets_map: Arc<RwLock<HashMap<String, Vec<BucketTarget>>>>,
    pub h_mutex: Arc<RwLock<HashMap<String, EpHealth>>>,
    target_h_mutex: Arc<RwLock<HashMap<String, EpHealth>>>,
@@ -317,6 +364,7 @@ impl BucketTargetSys {
    fn new() -> Self {
        Self {
            arn_remotes_map: Arc::new(RwLock::new(HashMap::new())),
+            ssec_passthrough_map: Arc::new(RwLock::new(HashMap::new())),
            targets_map: Arc::new(RwLock::new(HashMap::new())),
            h_mutex: Arc::new(RwLock::new(HashMap::new())),
            target_h_mutex: Arc::new(RwLock::new(HashMap::new())),
@@ -580,19 +628,59 @@ impl BucketTargetSys {
        let update_mutex = self.target_update_mutex(bucket).await;
        let _update_guard = update_mutex.lock().await;

-        // Lock order: targets_map, then arn_remotes_map, then target_h_mutex.
+        // Lock order: targets_map, then arn_remotes_map, then target_h_mutex,
+        // then ssec_passthrough_map (always last; also taken standalone by the
+        // capability accessors).
        let mut targets_map = self.targets_map.write().await;
        let mut arn_remotes_map = self.arn_remotes_map.write().await;
        let mut health_map = self.target_h_mutex.write().await;

        if let Some(targets) = targets_map.remove(bucket) {
+            let mut ssec_map = self.ssec_passthrough_map.write().await;
            for target in targets {
                arn_remotes_map.remove(&target.arn);
                health_map.remove(&target.arn);
+                ssec_map.remove(&target.arn);
            }
        }
    }

+    /// Cached SSE-C passthrough capability for a target ARN, plus whether the
+    /// verdict is older than [`SSEC_PASSTHROUGH_CAPABILITY_TTL`]. `(Unknown,
+    /// false)` when no verdict has been recorded since the target was built.
+    /// Staleness is computed here so the gate policy stays a pure function.
+    pub async fn ssec_passthrough_capability(&self, arn: &str) -> (SsecPassthroughCapability, bool) {
+        match self.ssec_passthrough_map.read().await.get(arn) {
+            Some(record) => (record.capability, record.recorded_at.elapsed() >= SSEC_PASSTHROUGH_CAPABILITY_TTL),
+            None => (SsecPassthroughCapability::Unknown, false),
+        }
+    }
+
+    /// Record an audited SSE-C passthrough verdict for a target ARN. Written by
+    /// the replication worker's HEAD-back audit and by the replication-check
+    /// SsecPassthrough probe phase.
+    pub async fn record_ssec_passthrough_capability(&self, arn: &str, capability: SsecPassthroughCapability) {
+        self.ssec_passthrough_map.write().await.insert(
+            arn.to_string(),
+            SsecPassthroughRecord {
+                capability,
+                recorded_at: Instant::now(),
+            },
+        );
+    }
+
+    /// Test hook: age an existing verdict so TTL expiry is observable without
+    /// waiting out the real window.
+    #[cfg(test)]
+    pub(crate) async fn backdate_ssec_passthrough_capability(&self, arn: &str, age: Duration) {
+        let backdated = Instant::now()
+            .checked_sub(age)
+            .expect("system uptime must exceed the backdate age");
+        if let Some(record) = self.ssec_passthrough_map.write().await.get_mut(arn) {
+            record.recorded_at = backdated;
+        }
+    }
+
    pub async fn set_target(
        &self,
        bucket: &str,
@@ -948,15 +1036,21 @@ impl BucketTargetSys {
            }
        }

-        // Lock order: targets_map, then arn_remotes_map, then target_h_mutex.
+        // Lock order: targets_map, then arn_remotes_map, then target_h_mutex,
+        // then ssec_passthrough_map (always last; also taken standalone by the
+        // capability accessors).
        let mut targets_map = self.targets_map.write().await;
        let mut arn_remotes_map = self.arn_remotes_map.write().await;
        let mut health_map = self.target_h_mutex.write().await;
        // Remove existing targets
        if let Some(existing_targets) = targets_map.remove(bucket) {
+            let mut ssec_map = self.ssec_passthrough_map.write().await;
            for target in existing_targets {
                arn_remotes_map.remove(&target.arn);
                health_map.remove(&target.arn);
+                // A rebuilt/edited target may point at a different service:
+                // the SSE-C passthrough verdict must be re-audited from Unknown.
+                ssec_map.remove(&target.arn);
                self.update_bandwidth_limit(bucket, &target.arn, 0);
            }
        }
@@ -1446,6 +1540,43 @@ fn resolve_put_api_version_id(source_version_id: &str) -> Option<&str> {
    }
 }

+/// Resolve the S3 `versionId` for a proxied read against a remote target.
+/// RustFS represents the null version internally as the nil UUID while the S3
+/// API addresses it as the literal "null" (same mapping as
+/// [`resolve_put_api_version_id`]); empty means "no version requested".
+pub(crate) fn resolve_read_api_version_id(version_id: Option<String>) -> Option<String> {
+    let version_id = version_id?;
+    let trimmed = version_id.trim();
+    if trimmed.is_empty() {
+        None
+    } else if Uuid::parse_str(trimmed).is_ok_and(|uuid| uuid.is_nil()) {
+        Some(rustfs_filemeta::NULL_VERSION_ID.to_string())
+    } else {
+        Some(trimmed.to_string())
+    }
+}
+
+/// Outbound header set for a proxied read: the caller-provided passthrough
+/// headers (client SSE-C key family, conditional headers) plus the anti-loop
+/// `source-proxy-request` marker in both the x-rustfs- and x-minio- prefixes
+/// (a MinIO target only understands the latter). Never adds
+/// `source-replication-check`: that exemption channel belongs exclusively to
+/// the replication worker's HEAD.
+fn proxy_outbound_headers(mut extra_headers: HeaderMap) -> HeaderMap {
+    insert_header(&mut extra_headers, SUFFIX_SOURCE_PROXY_REQUEST, "true");
+    extra_headers
+}
+
+/// Copy `headers` onto an SDK request inside `customize().map_request` (runs
+/// before signing, so the headers join the SigV4 canonical request).
+fn apply_extra_headers(mut req: HttpRequest, headers: &HeaderMap) -> Result<HttpRequest, std::convert::Infallible> {
+    for (k, v) in headers.iter() {
+        req.headers_mut()
+            .insert(k.as_str().to_string(), v.to_str().unwrap_or("").to_string());
+    }
+    Ok(req)
+}
+
 /// Append `versionId=<id>` to an already-built request URI. aws-sdk-s3's
 /// `PutObjectInput` / `CreateMultipartUploadInput` expose no version id
 /// member, so the query is spliced in via `map_request`, which runs at
@@ -1851,6 +1982,13 @@ impl TargetClient {
        // worker cannot hold; otherwise SSE-C replicas never converge on HEAD.
        let mut headers = HeaderMap::new();
        insert_header(&mut headers, SUFFIX_SOURCE_REPLICATION_CHECK, "true");
+        // `source-proxy-request: false` (MinIO `ProxyHeaderSet` semantics):
+        // the header's mere presence tells the receiver to answer LOCALLY
+        // instead of proxying the miss back to us. Without it, a not-found on
+        // the target gets read-proxied back to this source, echoes the source
+        // object with an identical ETag, and the worker concludes the object
+        // already converged — so it never actually replicates it.
+        insert_header(&mut headers, SUFFIX_SOURCE_PROXY_REQUEST, "false");
        match self
            .client
            .head_object()
@@ -1875,6 +2013,129 @@ impl TargetClient {
        }
    }

+    /// HEAD used by the read-proxy path (GET/HEAD of an object not yet
+    /// replicated locally, MinIO `proxyHeadToRepTarget`).
+    ///
+    /// Deliberately different from [`TargetClient::head_object`]: it must NOT
+    /// send `source-replication-check` — that header is the replication
+    /// worker's SSE-C metadata exemption channel. A proxied client request
+    /// instead forwards the client's own SSE-C headers (`extra_headers`) so
+    /// the target performs the real SSE-C validation/decryption. The
+    /// `source-proxy-request` marker is always added so the target does not
+    /// proxy the request onward (anti-loop).
+    pub async fn head_object_for_proxy(
+        &self,
+        bucket: &str,
+        object: &str,
+        version_id: Option<String>,
+        range: Option<String>,
+        part_number: Option<i32>,
+        extra_headers: HeaderMap,
+    ) -> Result<HeadObjectOutput, SdkError<HeadObjectError>> {
+        let headers = proxy_outbound_headers(extra_headers);
+        self.client
+            .head_object()
+            .bucket(bucket)
+            .key(object)
+            .set_version_id(resolve_read_api_version_id(version_id))
+            .set_range(range)
+            .set_part_number(part_number)
+            .customize()
+            .map_request(move |req| apply_extra_headers(req, &headers))
+            .send()
+            .await
+    }
+
+    /// GET used by the read-proxy path (MinIO `proxyGetToReplicationTarget`).
+    /// Returns the streaming SDK output; callers must forward the body without
+    /// buffering it. Same header contract as [`Self::head_object_for_proxy`]:
+    /// anti-loop marker on, replication-check never sent, client SSE-C /
+    /// conditional headers forwarded verbatim via `extra_headers`.
+    pub async fn get_object(
+        &self,
+        bucket: &str,
+        object: &str,
+        version_id: Option<String>,
+        range: Option<String>,
+        part_number: Option<i32>,
+        extra_headers: HeaderMap,
+    ) -> Result<GetObjectOutput, SdkError<GetObjectError>> {
+        let headers = proxy_outbound_headers(extra_headers);
+        self.client
+            .get_object()
+            .bucket(bucket)
+            .key(object)
+            .set_version_id(resolve_read_api_version_id(version_id))
+            .set_range(range)
+            .set_part_number(part_number)
+            .customize()
+            .map_request(move |req| apply_extra_headers(req, &headers))
+            .send()
+            .await
+    }
+
+    /// GetObjectTagging for the tagging read-proxy path
+    /// (MinIO `proxyGetTaggingToRepTarget`). Anti-loop marker always added.
+    pub async fn get_object_tagging(
+        &self,
+        bucket: &str,
+        object: &str,
+        version_id: Option<String>,
+    ) -> Result<GetObjectTaggingOutput, SdkError<GetObjectTaggingError>> {
+        let headers = proxy_outbound_headers(HeaderMap::new());
+        self.client
+            .get_object_tagging()
+            .bucket(bucket)
+            .key(object)
+            .set_version_id(resolve_read_api_version_id(version_id))
+            .customize()
+            .map_request(move |req| apply_extra_headers(req, &headers))
+            .send()
+            .await
+    }
+
+    /// PutObjectTagging for the tagging proxy path
+    /// (MinIO `proxyTaggingToRepTarget`). Anti-loop marker always added.
+    pub async fn put_object_tagging(
+        &self,
+        bucket: &str,
+        object: &str,
+        version_id: Option<String>,
+        tagging: SdkTagging,
+    ) -> Result<PutObjectTaggingOutput, SdkError<PutObjectTaggingError>> {
+        let headers = proxy_outbound_headers(HeaderMap::new());
+        self.client
+            .put_object_tagging()
+            .bucket(bucket)
+            .key(object)
+            .set_version_id(resolve_read_api_version_id(version_id))
+            .tagging(tagging)
+            .customize()
+            .map_request(move |req| apply_extra_headers(req, &headers))
+            .send()
+            .await
+    }
+
+    /// DeleteObjectTagging for the tagging proxy path
+    /// (MinIO `proxyTaggingToRepTarget`). Anti-loop marker always added.
+    pub async fn delete_object_tagging(
+        &self,
+        bucket: &str,
+        object: &str,
+        version_id: Option<String>,
+    ) -> Result<DeleteObjectTaggingOutput, SdkError<DeleteObjectTaggingError>> {
+        let headers = proxy_outbound_headers(HeaderMap::new());
+        self.client
+            .delete_object_tagging()
+            .bucket(bucket)
+            .key(object)
+            .set_version_id(resolve_read_api_version_id(version_id))
+            .customize()
+            .map_request(move |req| apply_extra_headers(req, &headers))
+            .send()
+            .await
+    }
+
    /// On success returns the version id the target assigned (from
    /// `x-amz-version-id`), letting callers audit the version-identity
    /// contract — a target that adopts the source version echoes it back.
@@ -2504,6 +2765,57 @@ mod tests {
        assert_eq!(health.last_online, Some(now));
    }

+    /// N2 TTL contract, both flip directions: a recorded verdict is fresh
+    /// until [`SSEC_PASSTHROUGH_CAPABILITY_TTL`], then reads as expired; a
+    /// re-audit that records the OPPOSITE verdict replaces it as fresh. The
+    /// worker gate maps expired verdicts to ProceedWithAudit (pinned in
+    /// `replication_target_boundary`), so together this proves an Unsupported
+    /// target recovers to Supported through the audit once its verdict ages
+    /// out — and a stale Supported one is re-proven rather than trusted.
+    #[tokio::test]
+    async fn ssec_passthrough_capability_ttl_expires_and_reaudit_flips_verdict() {
+        let sys = BucketTargetSys::default();
+        let arn = "arn:rustfs:replication:us-east-1:bucket:ssec-ttl";
+        let expired_age = SSEC_PASSTHROUGH_CAPABILITY_TTL + Duration::from_secs(1);
+
+        assert_eq!(
+            sys.ssec_passthrough_capability(arn).await,
+            (SsecPassthroughCapability::Unknown, false),
+            "an unrecorded target must read Unknown and never expired"
+        );
+
+        sys.record_ssec_passthrough_capability(arn, SsecPassthroughCapability::Unsupported)
+            .await;
+        assert_eq!(
+            sys.ssec_passthrough_capability(arn).await,
+            (SsecPassthroughCapability::Unsupported, false)
+        );
+
+        sys.backdate_ssec_passthrough_capability(arn, expired_age).await;
+        assert_eq!(
+            sys.ssec_passthrough_capability(arn).await,
+            (SsecPassthroughCapability::Unsupported, true),
+            "an aged-out Unsupported verdict must read expired so the gate re-audits"
+        );
+
+        // The re-audit against an upgraded target records Supported afresh.
+        sys.record_ssec_passthrough_capability(arn, SsecPassthroughCapability::Supported)
+            .await;
+        assert_eq!(
+            sys.ssec_passthrough_capability(arn).await,
+            (SsecPassthroughCapability::Supported, false),
+            "a fresh Supported verdict replaces the expired Unsupported one"
+        );
+
+        // And the fail-open twin: Supported also ages out.
+        sys.backdate_ssec_passthrough_capability(arn, expired_age).await;
+        assert_eq!(
+            sys.ssec_passthrough_capability(arn).await,
+            (SsecPassthroughCapability::Supported, true),
+            "an aged-out Supported verdict must read expired so the gate re-proves it"
+        );
+    }
+
    #[tokio::test]
    async fn list_targets_applies_health_stats_by_arn_and_preserves_endpoint_port() {
        let sys = BucketTargetSys::default();
@@ -14,6 +14,7 @@ paths.
 | `datatypes.rs` | ECStore compatibility re-export for resync status enums. | Re-exports `rustfs-replication` contracts while downstream facade consumers migrate. |
 | `replication_object_decision_boundary.rs` | Object replication option DTOs, resync target projection, delete replication decisions, and multipart planning helpers. | Keeps ECStore runtime modules from importing object decision contracts directly from `rustfs-replication`. |
 | `replication_pool.rs` | Replication queue, worker pool, MRF persistence, bucket stats, and delete/object scheduling. | Depends on bucket target sys, bucket metadata sys, metadata paths, queue contracts through the queue boundary, file metadata replication contracts through local boundaries, config storage, storage contracts through the replication storage boundary, runtime sources, and notification state. |
+| `replication_proxy.rs` | Proxy-target selection for GET/HEAD/Tagging reads of objects not yet replicated locally (MinIO `getProxyTargets` parity: anti-loop, version-suspended, and no-config empty branches). | Uses replication config lookup, rule matching, and target clients through local boundaries. |
 | `replication_queue_boundary.rs` | Queue/admission DTOs, heal queue DTOs, worker sizing, and backpressure helpers. | Keeps ECStore runtime modules from importing queue/backpressure contracts directly from `rustfs-replication`. |
 | `replication_resync_boundary.rs` | Resync DTOs, status classifiers, persisted resync/MRF codec wrappers, and ECStore error mapping. | Keeps ECStore runtime modules from importing resync contract helpers directly from `rustfs-replication`. |
 | `replication_resyncer.rs` | Object replication, delete replication, resync execution, target calls, and multipart target upload paths. | Depends on target calls and target config types through the replication target boundary, metadata paths and metadata systems through the replication metadata boundary, file metadata replication contracts through the filemeta boundary, object decisions and multipart planning through the object decision boundary, resync contracts through the resync boundary, queue DTOs through the queue boundary, error contracts through the error boundary, versioning systems, storage contracts through the replication storage boundary, config-derived storage class labels through the config store, runtime sources, notification events and local event host selection through the event sink, bandwidth reader wrapping, and SetDisks lock timing. |
@@ -29,6 +29,7 @@ mod replication_object_bridge;
 mod replication_object_config;
 mod replication_object_decision_boundary;
 pub(crate) mod replication_pool;
+mod replication_proxy;
 mod replication_queue_boundary;
 mod replication_resync_boundary;
 mod replication_resyncer;
@@ -74,6 +75,7 @@ pub use replication_pool::{
    get_global_replication_pool, get_global_replication_stats, init_background_replication, persist_force_delete_intent,
    read_durable_mrf_backlog, resync_start_conflict_id,
 };
+pub use replication_proxy::get_proxy_targets;
 pub use replication_queue_boundary::{
    DeletedObjectReplicationInfo, ReplicationBatchAdmission, ReplicationHealQueueResult, ReplicationOperation,
    ReplicationPriority, ReplicationQueueAdmission,
@@ -0,0 +1,150 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Proxy-target selection for reads of objects not yet replicated locally
+//! (MinIO `getProxyTargets`, bucket-replication.go).
+//!
+//! During the active-active replication lag window a GET/HEAD/Tagging request
+//! for an object the local site does not have yet may be served by proxying to
+//! a replication target. This module only *selects* the candidate targets; the
+//! request-path callers perform the remote calls and response translation.
+
+use std::sync::Arc;
+
+use tracing::debug;
+
+use super::replication_config_boundary::{ObjectOpts, ReplicationConfigurationExt as _};
+use super::replication_object_config::get_replication_config;
+use super::replication_storage_boundary::ObjectOptions;
+use super::replication_target_boundary::{ReplicationTargetStore, TargetClient};
+
+/// Returns the replication-target clients eligible to serve a proxied read of
+/// `bucket/object`, in rule order. Mirrors MinIO's `getProxyTargets`:
+///
+/// - the `source-proxy-request` header family was present at all
+///   (`opts.proxy_request` / `opts.proxy_header_set`, MinIO `ProxyRequest` /
+///   `ProxyHeaderSet`) -> empty. "true" is the anti-loop marker of an
+///   already-proxied client read; "false" is what a peer's replication
+///   worker sends on convergence HEADs so the receiver answers locally —
+///   proxying that miss back would echo the source object and fake
+///   convergence, permanently skipping replication;
+/// - the bucket's versioning is suspended for the object -> empty;
+/// - no replication configuration / no matching rule -> empty;
+/// - otherwise every distinct target ARN whose rules match the object,
+///   resolved through the bucket target system, skipping targets that opted
+///   out of proxying (`disable_proxy`).
+pub async fn get_proxy_targets(bucket: &str, object: &str, opts: &ObjectOptions) -> Vec<Arc<TargetClient>> {
+    if opts.proxy_request || opts.proxy_header_set {
+        return Vec::new();
+    }
+    if opts.version_suspended {
+        return Vec::new();
+    }
+
+    let cfg = match get_replication_config(bucket).await {
+        Ok(Some(cfg)) => cfg,
+        Ok(None) => return Vec::new(),
+        Err(err) => {
+            debug!(bucket, object, error = %err, "read proxy: failed to load replication config; not proxying");
+            return Vec::new();
+        }
+    };
+
+    let arns = cfg.filter_target_arns(&ObjectOpts {
+        name: object.to_string(),
+        ..Default::default()
+    });
+
+    let mut targets = Vec::with_capacity(arns.len());
+    for arn in arns {
+        let Some(client) = ReplicationTargetStore::remote_target_client(bucket, &arn).await else {
+            debug!(bucket, object, arn, "read proxy: no client for replication target ARN");
+            continue;
+        };
+        if client.disable_proxy {
+            continue;
+        }
+        targets.push(client);
+    }
+
+    targets
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn opts() -> ObjectOptions {
+        ObjectOptions::default()
+    }
+
+    /// Anti-loop: a request that was already proxied by a peer must never be
+    /// proxied onward, regardless of replication configuration.
+    #[tokio::test]
+    async fn proxy_request_yields_no_targets() {
+        let targets = get_proxy_targets(
+            "bucket",
+            "object",
+            &ObjectOptions {
+                proxy_request: true,
+                ..opts()
+            },
+        )
+        .await;
+        assert!(targets.is_empty());
+    }
+
+    /// MinIO `ProxyHeaderSet` parity: the header family being present at all
+    /// disables proxying, even with the value "false" — that is what a
+    /// peer's replication worker sends on convergence HEADs.
+    #[tokio::test]
+    async fn proxy_header_set_yields_no_targets() {
+        let targets = get_proxy_targets(
+            "bucket",
+            "object",
+            &ObjectOptions {
+                proxy_header_set: true,
+                proxy_request: false,
+                ..opts()
+            },
+        )
+        .await;
+        assert!(targets.is_empty());
+    }
+
+    /// Suspended versioning disables proxying (MinIO parity): the local null
+    /// version is authoritative and a remote read could resurrect data.
+    #[tokio::test]
+    async fn version_suspended_yields_no_targets() {
+        let targets = get_proxy_targets(
+            "bucket",
+            "object",
+            &ObjectOptions {
+                version_suspended: true,
+                ..opts()
+            },
+        )
+        .await;
+        assert!(targets.is_empty());
+    }
+
+    /// A bucket without replication configuration has nothing to proxy to.
+    /// (No metadata system is running in unit tests, so the config lookup
+    /// resolves to "no configuration" — the same empty-result contract.)
+    #[tokio::test]
+    async fn missing_replication_config_yields_no_targets() {
+        let targets = get_proxy_targets("bucket-without-replication", "object", &opts()).await;
+        assert!(targets.is_empty());
+    }
+}
@@ -15,10 +15,14 @@
 use super::replication_error_boundary::{Error, Result};
 use super::replication_filemeta_boundary::MrfReplicateEntry;

+/// Kept test-only: the runtime consumer was the worker HEAD's fake proxy
+/// counting (removed in backlog#1675 P1-5); the resyncer tests still pin the
+/// classifier's semantics for the real client read-proxy failure accounting.
+#[cfg(test)]
+pub(crate) use rustfs_replication::should_count_head_proxy_failure;
 pub use rustfs_replication::{BucketReplicationResyncStatus, ResyncOpts, ResyncStatusType, TargetReplicationResyncStatus};
 pub(crate) use rustfs_replication::{
    is_version_id_mismatch, resync_state_accepts_update, sanitize_resync_error_detail, should_auto_resume_resync,
-    should_count_head_proxy_failure,
 };

 #[allow(
@@ -36,6 +36,7 @@ use super::replication_object_decision_boundary::{
 };
 use super::replication_queue_boundary::{DeletedObjectReplicationInfo, ReplicationQueueAdmission};
 use super::replication_resync_boundary::ResyncStatusType;
+#[cfg(test)]
 use super::replication_resync_boundary::should_count_head_proxy_failure;
 use super::replication_resync_boundary::{
    BucketReplicationResyncStatus, ResyncOpts, TargetReplicationResyncStatus, encode_resync_file, is_version_id_mismatch,
@@ -48,10 +49,12 @@ use super::replication_storage_boundary::{
    ReplicationDeletedObject, ReplicationObjectIO, ReplicationStorage, StatObjectOptions, StorageObjectInfoOrErr, WalkOptions,
 };
 use super::replication_target_boundary::{
-    PutObjectOptions, PutObjectPartOptions, ReplicationTargetStore, TargetClient, replication_action_for_target_head,
+    ERR_REPLICATION_SSEC_PASSTHROUGH_UNSUPPORTED, PutObjectOptions, PutObjectPartOptions, ReplicationTargetStore,
+    SsecPassthroughCapability, SsecPassthroughGate, TargetClient, replication_action_for_target_head,
    replication_complete_multipart_options, replication_delete_marker_purge_remove_options, replication_delete_remove_options,
    replication_force_delete_remove_options, replication_object_is_ssec_encrypted, replication_put_object_header_size,
-    replication_put_object_options, replication_target_head_is_newer_null_version,
+    replication_put_object_options, replication_target_head_is_newer_null_version, resolve_read_api_version_id,
+    ssec_passthrough_evidence_present, ssec_passthrough_gate,
 };
 use super::replication_versioning_boundary::ReplicationVersioningStore;
 use super::runtime_boundary as runtime_sources;
@@ -234,32 +237,18 @@ fn audit_target_version_identity(tgt_client: &TargetClient, source_version_id: &
    }
 }

-fn is_head_proxy_failure(err: &SdkError<HeadObjectError>) -> bool {
-    let (is_not_found, code) = err
-        .as_service_error()
-        .map(|service_err| (service_err.is_not_found(), service_err.code()))
-        .unwrap_or((false, None));
-    let raw_status = err.raw_response().map(|resp| resp.status().as_u16());
-    should_count_head_proxy_failure(is_not_found, code, raw_status)
-}
-
-async fn record_proxy_request(bucket: &str, api: &str, is_err: bool) {
-    if let Some(stats) = runtime_sources::replication_stats() {
-        stats.inc_proxy(bucket, api, is_err).await;
-    }
-}
-
-async fn head_object_with_proxy_stats(
-    source_bucket: &str,
+/// HEAD against a replication target on behalf of the replication worker
+/// (resync/heal/delete convergence checks). This is NOT a client read proxy:
+/// it must not touch the proxy metrics — those count only real GET/HEAD/
+/// Tagging requests proxied for clients (see `replication_proxy.rs` /
+/// `TargetClient::head_object_for_proxy`).
+async fn head_object_for_worker(
    target_client: &TargetClient,
    target_bucket: &str,
    object: &str,
    version_id: Option<String>,
 ) -> std::result::Result<HeadObjectOutput, SdkError<HeadObjectError>> {
-    let result = target_client.head_object(target_bucket, object, version_id).await;
-    let is_err = result.as_ref().err().is_some_and(is_head_proxy_failure);
-    record_proxy_request(source_bucket, "HeadObject", is_err).await;
-    result
+    target_client.head_object(target_bucket, object, version_id).await
 }

 fn is_version_id_format_mismatch(err: &SdkError<HeadObjectError>) -> bool {
@@ -282,17 +271,124 @@ async fn mark_replication_target_offline_if_needed(target_client: &Arc<TargetCli
 }

 async fn head_object_fallback(
-    source_bucket: &str,
    tgt_client: &TargetClient,
    object: &str,
 ) -> std::result::Result<Option<HeadObjectOutput>, SdkError<HeadObjectError>> {
-    match head_object_with_proxy_stats(source_bucket, tgt_client, &tgt_client.bucket, object, None).await {
+    match head_object_for_worker(tgt_client, &tgt_client.bucket, object, None).await {
        Ok(oi) => Ok(Some(oi)),
        Err(e) if e.as_service_error().is_some_and(|se| se.is_not_found()) || has_raw_status(&e, 404) => Ok(None),
        Err(e) => Err(e),
    }
 }

+/// Resolve the N2 fail-closed gate for an SSE-C passthrough attempt against
+/// this target. Returns `Some(audit_required)` when replication may proceed;
+/// on a freshly-flagged header-dropping target it settles `rinfo` as FAILED
+/// (no PUT is ever sent — the object stays on the normal MRF retry channel
+/// and re-audits once the verdict's TTL expires or replication-check
+/// re-probes the target) and returns `None`.
+async fn resolve_ssec_passthrough_gate(
+    ssec: bool,
+    tgt_client: &TargetClient,
+    bucket: &str,
+    object: &str,
+    rinfo: &mut ReplicatedTargetInfo,
+) -> Option<bool> {
+    let (capability, expired) = ReplicationTargetStore::ssec_passthrough_capability(&tgt_client.arn).await;
+    match ssec_passthrough_gate(ssec, capability, expired) {
+        SsecPassthroughGate::Proceed => Some(false),
+        SsecPassthroughGate::ProceedWithAudit => Some(true),
+        SsecPassthroughGate::FailClosed => {
+            rinfo.replication_status = ReplicationStatusType::Failed;
+            rinfo.error = Some(ERR_REPLICATION_SSEC_PASSTHROUGH_UNSUPPORTED.to_string());
+            warn!(
+                event = EVENT_RESYNC_TARGET_OPERATION_FAILED,
+                component = LOG_COMPONENT_ECSTORE,
+                subsystem = LOG_SUBSYSTEM_REPLICATION_RESYNC,
+                bucket = %bucket,
+                object = %object,
+                arn = %tgt_client.arn,
+                operation = "ssec_passthrough_gate",
+                error = ERR_REPLICATION_SSEC_PASSTHROUGH_UNSUPPORTED,
+                "Replication target operation failed"
+            );
+            None
+        }
+    }
+}
+
+/// Judge SSE-C passthrough evidence on a HEAD of the replica and record the
+/// capability verdict for the target. Returns true when the SSE-C material
+/// provably survived; otherwise records `Unsupported` and settles `rinfo` as
+/// FAILED so the attempt never reports a silently unreadable COMPLETED.
+async fn settle_ssec_passthrough_evidence(
+    head: &HeadObjectOutput,
+    tgt_client: &TargetClient,
+    bucket: &str,
+    object: &str,
+    rinfo: &mut ReplicatedTargetInfo,
+) -> bool {
+    if ssec_passthrough_evidence_present(head) {
+        ReplicationTargetStore::record_ssec_passthrough_capability(&tgt_client.arn, SsecPassthroughCapability::Supported).await;
+        return true;
+    }
+    ReplicationTargetStore::record_ssec_passthrough_capability(&tgt_client.arn, SsecPassthroughCapability::Unsupported).await;
+    rinfo.replication_status = ReplicationStatusType::Failed;
+    rinfo.error = Some(ERR_REPLICATION_SSEC_PASSTHROUGH_UNSUPPORTED.to_string());
+    warn!(
+        event = EVENT_RESYNC_TARGET_OPERATION_FAILED,
+        component = LOG_COMPONENT_ECSTORE,
+        subsystem = LOG_SUBSYSTEM_REPLICATION_RESYNC,
+        bucket = %bucket,
+        object = %object,
+        arn = %tgt_client.arn,
+        endpoint = %tgt_client.endpoint,
+        operation = "ssec_passthrough_audit",
+        error = ERR_REPLICATION_SSEC_PASSTHROUGH_UNSUPPORTED,
+        "Replication target operation failed"
+    );
+    false
+}
+
+/// Post-PUT HEAD-back audit for an SSE-C passthrough replica, over the worker
+/// HEAD channel (replication-check exemption plus the `source-proxy-request:
+/// false` suppression header, so the target answers locally without a
+/// customer key). A HEAD transport failure leaves the capability `Unknown`
+/// but still fails this attempt: an unverifiable SSE-C replica must not
+/// report COMPLETED.
+async fn audit_ssec_passthrough_replica(
+    tgt_client: &Arc<TargetClient>,
+    bucket: &str,
+    object: &str,
+    version_id: Option<String>,
+    rinfo: &mut ReplicatedTargetInfo,
+) -> bool {
+    // Address the replica the way the PUT named it: a nil source version id
+    // (versioning-suspended / null-version objects) maps to the "null"
+    // version, so the audit HEAD does not 4xx-loop on those objects.
+    let version_id = resolve_read_api_version_id(version_id);
+    match head_object_for_worker(tgt_client.as_ref(), &tgt_client.bucket, object, version_id).await {
+        Ok(head) => settle_ssec_passthrough_evidence(&head, tgt_client, bucket, object, rinfo).await,
+        Err(e) => {
+            rinfo.replication_status = ReplicationStatusType::Failed;
+            rinfo.error = Some(format!("SSE-C passthrough audit HEAD failed: {e}"));
+            warn!(
+                event = EVENT_RESYNC_TARGET_OPERATION_FAILED,
+                component = LOG_COMPONENT_ECSTORE,
+                subsystem = LOG_SUBSYSTEM_REPLICATION_RESYNC,
+                bucket = %bucket,
+                object = %object,
+                arn = %tgt_client.arn,
+                operation = "ssec_passthrough_audit_head",
+                error = %e,
+                "Replication target operation failed"
+            );
+            mark_replication_target_offline_if_needed(tgt_client, &e).await;
+            false
+        }
+    }
+}
+
 static RESYNC_WORKER_COUNT: usize = 10;

 fn resync_status_duration(
@@ -1186,7 +1282,7 @@ async fn verify_resync_head_result(
            // (400). Re-verify without the versionId before
            // concluding the object failed to replicate, instead
            // of counting a well-replicated object as failed.
-            match head_object_fallback(&roi.bucket, target_client.as_ref(), &roi.name).await {
+            match head_object_fallback(target_client.as_ref(), &roi.name).await {
                Ok(Some(_)) => {
                    st.replicated_count += 1;
                    st.replicated_size += roi.size;
@@ -1236,8 +1332,7 @@ async fn resync_worker_process_object<S: ReplicationStorage>(

    let reset_id = target_client.reset_id.clone();

-    let head_result = head_object_with_proxy_stats(
-        bucket_name,
+    let head_result = head_object_for_worker(
        target_client.as_ref(),
        &target_client.bucket,
        &roi.name,
@@ -2521,8 +2616,7 @@ async fn replicate_delete_to_target(dobj: &DeletedObjectReplicationInfo, tgt_cli
    let version_id = target_delete_version_id(version_id, is_version_purge);

    if dobj.delete_object.delete_marker && dobj.delete_object.delete_marker_version_id.is_some() {
-        match head_object_with_proxy_stats(
-            &dobj.bucket,
+        match head_object_for_worker(
            tgt_client.as_ref(),
            &tgt_client.bucket,
            &dobj.delete_object.object_name,
@@ -2888,6 +2982,21 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {
            return rinfo;
        }

+        // N2 fail-closed: never PUT SSE-C ciphertext at a target known to drop
+        // the passthrough transport headers, and never trust a convergence HEAD
+        // against such a target — a previous broken replica matches by ETag.
+        let Some(ssec_audit_required) = resolve_ssec_passthrough_gate(self.ssec, &tgt_client, &bucket, &object, &mut rinfo).await
+        else {
+            send_local_event(EventArgs {
+                event_name: EventName::ObjectReplicationNotTracked.to_string(),
+                bucket_name: bucket.clone(),
+                object: self.to_object_info(),
+                user_agent: "Internal: [Replication]".to_string(),
+                ..Default::default()
+            });
+            return rinfo;
+        };
+
        let versioned = ReplicationVersioningStore::prefix_enabled(&bucket, &object).await;
        let version_suspended = ReplicationVersioningStore::prefix_suspended(&bucket, &object).await;

@@ -2985,18 +3094,20 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {
        }

        let mut replication_action = replication_action;
-        match head_object_with_proxy_stats(
-            &bucket,
-            tgt_client.as_ref(),
-            &tgt_client.bucket,
-            &object,
-            self.version_id.map(|v| v.to_string()),
-        )
-        .await
+        match head_object_for_worker(tgt_client.as_ref(), &tgt_client.bucket, &object, self.version_id.map(|v| v.to_string()))
+            .await
        {
            Ok(oi) => {
                replication_action = replication_action_for_target_head(&object_info, &oi, self.op_type);
                if replication_action == ReplicationAction::None {
+                    // An SSE-C replica only counts as converged when the same
+                    // HEAD proves its decryption material survived; a broken
+                    // ciphertext copy from an earlier attempt matches by ETag.
+                    if ssec_audit_required
+                        && !settle_ssec_passthrough_evidence(&oi, &tgt_client, &bucket, &object, &mut rinfo).await
+                    {
+                        return rinfo;
+                    }
                    rinfo.replication_status = ReplicationStatusType::Completed;
                    rinfo.replication_resynced = true;
                    rinfo.replication_action = ReplicationAction::None;
@@ -3009,8 +3120,13 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {
                    // Object not on target yet → fall through to PUT.
                } else if is_version_id_format_mismatch(&e) {
                    // Version-ID format mismatch: retry without versionId and compare ETags.
-                    match head_object_fallback(&bucket, &tgt_client, &object).await {
+                    match head_object_fallback(&tgt_client, &object).await {
                        Ok(Some(oi)) if replication_etags_match(object_info.etag.as_deref(), oi.e_tag.as_deref()) => {
+                            if ssec_audit_required
+                                && !settle_ssec_passthrough_evidence(&oi, &tgt_client, &bucket, &object, &mut rinfo).await
+                            {
+                                return rinfo;
+                            }
                            rinfo.replication_status = ReplicationStatusType::Completed;
                            rinfo.replication_resynced = true;
                            rinfo.replication_action = ReplicationAction::None;
@@ -3085,7 +3201,6 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {
            }
        };

-        let has_tagging_replication = !put_opts.user_tags.is_empty();
        if let Some(err) = if is_multipart {
            drop(gr);
            let result = replicate_object_with_multipart(MultipartReplicationContext {
@@ -3100,10 +3215,6 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {
                put_opts,
            })
            .await;
-            record_proxy_request(&bucket, "PutObject", result.is_err()).await;
-            if has_tagging_replication {
-                record_proxy_request(&bucket, "PutObjectTagging", result.is_err()).await;
-            }
            result.err()
        } else {
            gr.stream = wrap_with_bandwidth_monitor(gr.stream, &put_opts, &bucket, &rinfo.arn);
@@ -3119,10 +3230,6 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {
                    )
                })
                .map_err(|e| std::io::Error::other(e.to_string()));
-            record_proxy_request(&bucket, "PutObject", result.is_err()).await;
-            if has_tagging_replication {
-                record_proxy_request(&bucket, "PutObjectTagging", result.is_err()).await;
-            }
            result.err()
        } {
            rinfo.replication_status = ReplicationStatusType::Failed;
@@ -3144,6 +3251,15 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {
            return rinfo;
        }

+        // First SSE-C passthrough PUT against this target: verify the replica
+        // kept its decryption material before reporting COMPLETED.
+        if ssec_audit_required
+            && !audit_ssec_passthrough_replica(&tgt_client, &bucket, &object, self.version_id.map(|v| v.to_string()), &mut rinfo)
+                .await
+        {
+            return rinfo;
+        }
+
        rinfo.replication_status = ReplicationStatusType::Completed;

        rinfo
@@ -3166,6 +3282,21 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {
            return rinfo;
        }

+        // N2 fail-closed: see the gate in `replicate_object` — the same policy
+        // applies to the metadata/existing-object transport.
+        let Some(ssec_audit_required) = resolve_ssec_passthrough_gate(self.ssec, &tgt_client, &bucket, &object, &mut rinfo).await
+        else {
+            send_local_event(EventArgs {
+                event_name: EventName::ObjectReplicationNotTracked.to_string(),
+                bucket_name: bucket.clone(),
+                object: self.to_object_info(),
+                user_agent: "Internal: [Replication]".to_string(),
+                ..Default::default()
+            });
+            rinfo.duration = (OffsetDateTime::now_utc() - start_time).unsigned_abs();
+            return rinfo;
+        };
+
        let versioned = ReplicationVersioningStore::prefix_enabled(&bucket, &object).await;
        let version_suspended = ReplicationVersioningStore::prefix_suspended(&bucket, &object).await;

@@ -3204,8 +3335,19 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {

        let _sopts = replicate_all_stat_options(&object_info, &bucket, &tgt_client);

-        let Some((replication_action, object_info)) =
-            resolve_replicate_all_action(self, &tgt_client, &bucket, &object, object_info, start_time, &mut rinfo).await
+        let Some((replication_action, object_info)) = resolve_replicate_all_action(
+            ReplicateAllActionContext {
+                roi: self,
+                tgt_client: &tgt_client,
+                bucket: &bucket,
+                object: &object,
+                start_time,
+                ssec_audit_required,
+            },
+            object_info,
+            &mut rinfo,
+        )
+        .await
        else {
            return rinfo;
        };
@@ -3260,6 +3402,16 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {
            return rinfo;
        }

+        // First SSE-C passthrough PUT against this target: verify the replica
+        // kept its decryption material before reporting COMPLETED.
+        if ssec_audit_required
+            && !audit_ssec_passthrough_replica(&tgt_client, &bucket, &object, self.version_id.map(|v| v.to_string()), &mut rinfo)
+                .await
+        {
+            rinfo.duration = (OffsetDateTime::now_utc() - start_time).unsigned_abs();
+            return rinfo;
+        }
+
        rinfo
    }

@@ -3472,33 +3624,49 @@ fn apply_replication_resync_timestamp(rinfo: &mut ReplicatedTargetInfo, reset_id
    rinfo.replication_resynced = true;
 }

+/// Borrowed inputs for [`resolve_replicate_all_action`].
+struct ReplicateAllActionContext<'a> {
+    roi: &'a ReplicateObjectInfo,
+    tgt_client: &'a Arc<TargetClient>,
+    bucket: &'a str,
+    object: &'a str,
+    start_time: OffsetDateTime,
+    /// N2: the target's SSE-C passthrough capability is still `Unknown`, so a
+    /// converged-looking replica must additionally prove its SSE-C material
+    /// survived before the comparison may settle COMPLETED.
+    ssec_audit_required: bool,
+}
+
 /// Compare the source object against the target via HEAD and decide which
 /// replication action is still required. Returns `None` after fully settling
 /// `rinfo` when replication must stop here — either because the target already
 /// matches or because the comparison failed.
 async fn resolve_replicate_all_action(
-    roi: &ReplicateObjectInfo,
-    tgt_client: &Arc<TargetClient>,
-    bucket: &str,
-    object: &str,
+    ctx: ReplicateAllActionContext<'_>,
    object_info: ObjectInfo,
-    start_time: OffsetDateTime,
    rinfo: &mut ReplicatedTargetInfo,
 ) -> Option<(ReplicationAction, ObjectInfo)> {
-    let replication_action;
-    match head_object_with_proxy_stats(
+    let ReplicateAllActionContext {
+        roi,
+        tgt_client,
        bucket,
-        tgt_client.as_ref(),
-        &tgt_client.bucket,
        object,
-        roi.version_id.map(|v| v.to_string()),
-    )
-    .await
-    {
+        start_time,
+        ssec_audit_required,
+    } = ctx;
+    let replication_action;
+    match head_object_for_worker(tgt_client.as_ref(), &tgt_client.bucket, object, roi.version_id.map(|v| v.to_string())).await {
        Ok(oi) => {
            replication_action = replication_action_for_target_head(&object_info, &oi, roi.op_type);
            rinfo.replication_status = ReplicationStatusType::Completed;
            if replication_action == ReplicationAction::None {
+                // An SSE-C replica only counts as converged when the same HEAD
+                // proves its decryption material survived; a broken ciphertext
+                // copy from an earlier attempt matches by ETag.
+                if ssec_audit_required && !settle_ssec_passthrough_evidence(&oi, tgt_client, bucket, object, rinfo).await {
+                    rinfo.duration = (OffsetDateTime::now_utc() - start_time).unsigned_abs();
+                    return None;
+                }
                if roi.op_type == ReplicationType::ExistingObject
                    && replication_target_head_is_newer_null_version(&object_info, &oi)
                {
@@ -3545,9 +3713,15 @@ async fn resolve_replicate_all_action(
        Err(e) => {
            if is_version_id_format_mismatch(&e) {
                // Version-ID format mismatch: retry without versionId and compare ETags.
-                match head_object_fallback(bucket, tgt_client, object).await {
+                match head_object_fallback(tgt_client, object).await {
                    Ok(Some(oi)) => {
                        replication_action = if replication_etags_match(object_info.etag.as_deref(), oi.e_tag.as_deref()) {
+                            if ssec_audit_required
+                                && !settle_ssec_passthrough_evidence(&oi, tgt_client, bucket, object, rinfo).await
+                            {
+                                rinfo.duration = (OffsetDateTime::now_utc() - start_time).unsigned_abs();
+                                return None;
+                            }
                            ReplicationAction::None
                        } else {
                            ReplicationAction::All
@@ -3668,7 +3842,6 @@ async fn replicate_all_payload_to_target<S: ReplicationObjectIO>(
    ctx: ReplicateAllPayloadContext<'_, S>,
    mut gr: GetObjectReader,
 ) -> Option<std::io::Error> {
-    let has_tagging_replication = !ctx.put_opts.user_tags.is_empty();
    if ctx.is_multipart {
        drop(gr);
        let result = replicate_object_with_multipart(MultipartReplicationContext {
@@ -3683,10 +3856,6 @@ async fn replicate_all_payload_to_target<S: ReplicationObjectIO>(
            put_opts: ctx.put_opts,
        })
        .await;
-        record_proxy_request(ctx.bucket, "PutObject", result.is_err()).await;
-        if has_tagging_replication {
-            record_proxy_request(ctx.bucket, "PutObjectTagging", result.is_err()).await;
-        }
        result.err()
    } else {
        gr.stream = wrap_with_bandwidth_monitor(gr.stream, &ctx.put_opts, ctx.bucket, ctx.arn);
@@ -3703,10 +3872,6 @@ async fn replicate_all_payload_to_target<S: ReplicationObjectIO>(
                )
            })
            .map_err(|e| std::io::Error::other(e.to_string()));
-        record_proxy_request(ctx.bucket, "PutObject", result.is_err()).await;
-        if has_tagging_replication {
-            record_proxy_request(ctx.bucket, "PutObjectTagging", result.is_err()).await;
-        }
        result.err()
    }
 }
@@ -1161,6 +1161,31 @@ mod tests {
        assert!(all.contains_key("proxy-only-bucket"));
    }

+    /// Pins the read-proxy metric contract (backlog#1675 P1-5): the API
+    /// strings the GET/HEAD/Tagging proxy paths record map onto the
+    /// get/head/tagging totals, and only unexpected failures raise the
+    /// failed counters.
+    #[tokio::test]
+    async fn test_proxy_stats_map_read_proxy_apis_to_totals() {
+        let stats = ReplicationStats::new();
+        stats.inc_proxy("proxy-bucket", "GetObject", false).await;
+        stats.inc_proxy("proxy-bucket", "GetObject", true).await;
+        stats.inc_proxy("proxy-bucket", "HeadObject", false).await;
+        stats.inc_proxy("proxy-bucket", "GetObjectTagging", false).await;
+        stats.inc_proxy("proxy-bucket", "PutObjectTagging", false).await;
+        stats.inc_proxy("proxy-bucket", "DeleteObjectTagging", true).await;
+
+        let metric = stats.get_proxy_stats("proxy-bucket").await;
+        assert_eq!(metric.get_total, 2);
+        assert_eq!(metric.get_failed, 1);
+        assert_eq!(metric.head_total, 1);
+        assert_eq!(metric.head_failed, 0);
+        assert_eq!(metric.get_tag_total, 1);
+        assert_eq!(metric.put_tag_total, 1);
+        assert_eq!(metric.delete_tag_total, 1);
+        assert_eq!(metric.delete_tag_failed, 1);
+    }
+
    #[tokio::test]
    async fn test_calculate_bucket_replication_stats_merges_resync_metrics() {
        let stats = ReplicationStats::new();
@@ -36,7 +36,8 @@ use time::OffsetDateTime;
 use time::format_description::well_known::Rfc3339;

 pub(crate) use crate::bucket::bucket_target_sys::{
-    AdvancedPutOptions, PutObjectOptions, PutObjectPartOptions, RemoveObjectOptions, TargetClient,
+    AdvancedPutOptions, PutObjectOptions, PutObjectPartOptions, RemoveObjectOptions, SsecPassthroughCapability, TargetClient,
+    resolve_read_api_version_id,
 };
 #[cfg(test)]
 pub(crate) use crate::bucket::target::BucketTarget;
@@ -65,6 +66,8 @@ static STANDARD_HEADERS: &[&str] = &[
 ];

 const ERR_REPLICATION_ENCRYPTION_METADATA_UNSUPPORTED: &str = "replication source contains unsupported encryption metadata";
+pub(crate) const ERR_REPLICATION_SSEC_PASSTHROUGH_UNSUPPORTED: &str = "replication target does not support SSE-C passthrough: the replica would lose its decryption material \
+     (run ?replication-check to re-probe)";

 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum ReplicationSourceEncryption {
@@ -146,6 +149,54 @@ pub(crate) fn replication_object_is_ssec_encrypted(user_defined: &HashMap<String
    rustfs_replication::is_ssec_encrypted(user_defined)
 }

+/// Fail-closed decision for an SSE-C passthrough replication attempt, derived
+/// from the target's cached [`SsecPassthroughCapability`]. Pure so the policy
+/// can migrate with the worker (M2) without dragging the cache along; the
+/// caller computes `expired` from the cache record's age (see
+/// `SSEC_PASSTHROUGH_CAPABILITY_TTL`).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum SsecPassthroughGate {
+    /// Not an SSE-C object, or the target has a fresh proof that it preserves
+    /// the passthrough transport headers: replicate without a HEAD-back audit.
+    Proceed,
+    /// No usable verdict — first SSE-C attempt since the target was (re)built,
+    /// or the recorded verdict (in either direction) aged out: PUT, then HEAD
+    /// the replica back and require SSE-C evidence before reporting COMPLETED.
+    ProceedWithAudit,
+    /// The target was recently proven to drop the passthrough headers: do not
+    /// send the PUT, report FAILED (the object stays on the normal MRF retry
+    /// channel and re-audits once the verdict expires).
+    FailClosed,
+}
+
+pub(crate) fn ssec_passthrough_gate(ssec: bool, capability: SsecPassthroughCapability, expired: bool) -> SsecPassthroughGate {
+    if !ssec {
+        return SsecPassthroughGate::Proceed;
+    }
+    // An expired verdict — Supported or Unsupported — must be re-earned: a
+    // stale Unsupported would otherwise stick forever after a target upgrade,
+    // and a stale Supported would fail open after a backend swap behind the
+    // same endpoint.
+    if expired {
+        return SsecPassthroughGate::ProceedWithAudit;
+    }
+    match capability {
+        SsecPassthroughCapability::Supported => SsecPassthroughGate::Proceed,
+        SsecPassthroughCapability::Unknown => SsecPassthroughGate::ProceedWithAudit,
+        SsecPassthroughCapability::Unsupported => SsecPassthroughGate::FailClosed,
+    }
+}
+
+/// True when a replication-check HEAD of the replica proves the SSE-C
+/// material survived passthrough: a RustFS target restores the transport
+/// headers into the stored SSE-C keys and its HEAD echoes
+/// `x-amz-server-side-encryption-customer-algorithm` (the replication-check
+/// exemption skips key validation but not the metadata echo). A target that
+/// dropped the headers stored a plain object and echoes nothing.
+pub(crate) fn ssec_passthrough_evidence_present(head: &HeadObjectOutput) -> bool {
+    head.sse_customer_algorithm.as_deref().is_some_and(|algo| !algo.is_empty())
+}
+
 pub(crate) struct ReplicationTargetStore;

 impl ReplicationTargetStore {
@@ -165,6 +216,17 @@ impl ReplicationTargetStore {
        BucketTargetSys::get().mark_target_offline(target_client).await
    }

+    /// Returns the cached verdict and whether it has outlived its TTL.
+    pub(crate) async fn ssec_passthrough_capability(arn: &str) -> (SsecPassthroughCapability, bool) {
+        BucketTargetSys::get().ssec_passthrough_capability(arn).await
+    }
+
+    pub(crate) async fn record_ssec_passthrough_capability(arn: &str, capability: SsecPassthroughCapability) {
+        BucketTargetSys::get()
+            .record_ssec_passthrough_capability(arn, capability)
+            .await
+    }
+
    #[cfg(test)]
    pub(crate) async fn register_test_target(target_client: &Arc<TargetClient>) {
        BucketTargetSys::get().arn_remotes_map.write().await.insert(
@@ -898,6 +960,71 @@ mod tests {
        }
    }

+    /// N2 fail-closed policy: SSE-C replication may only proceed silently
+    /// against a target with a FRESH proof that it preserves the passthrough
+    /// transport headers. Unknown targets must be audited; freshly-flagged
+    /// dropping targets must never receive the PUT; an expired verdict in
+    /// EITHER direction must be re-earned through the audit — a sticky
+    /// Unsupported would outlive a target upgrade, and a sticky Supported
+    /// would fail open after a backend swap behind the same endpoint.
+    #[test]
+    fn ssec_passthrough_gate_is_fail_closed_and_ttl_bounded() {
+        for capability in [
+            SsecPassthroughCapability::Unknown,
+            SsecPassthroughCapability::Supported,
+            SsecPassthroughCapability::Unsupported,
+        ] {
+            for expired in [false, true] {
+                assert_eq!(
+                    ssec_passthrough_gate(false, capability, expired),
+                    SsecPassthroughGate::Proceed,
+                    "non-SSE-C objects must never be gated on the passthrough capability"
+                );
+            }
+        }
+        assert_eq!(
+            ssec_passthrough_gate(true, SsecPassthroughCapability::Supported, false),
+            SsecPassthroughGate::Proceed
+        );
+        assert_eq!(
+            ssec_passthrough_gate(true, SsecPassthroughCapability::Unknown, false),
+            SsecPassthroughGate::ProceedWithAudit
+        );
+        assert_eq!(
+            ssec_passthrough_gate(true, SsecPassthroughCapability::Unsupported, false),
+            SsecPassthroughGate::FailClosed
+        );
+        // Expiry flips both directions back to the audit.
+        assert_eq!(
+            ssec_passthrough_gate(true, SsecPassthroughCapability::Unsupported, true),
+            SsecPassthroughGate::ProceedWithAudit,
+            "an expired Unsupported verdict must allow a re-audit (upgraded target recovers without operator action)"
+        );
+        assert_eq!(
+            ssec_passthrough_gate(true, SsecPassthroughCapability::Supported, true),
+            SsecPassthroughGate::ProceedWithAudit,
+            "an expired Supported verdict must be re-proven (backend swap behind the same endpoint must not fail open)"
+        );
+    }
+
+    #[test]
+    fn ssec_passthrough_evidence_requires_customer_algorithm_echo() {
+        let with_evidence = HeadObjectOutput::builder().sse_customer_algorithm("AES256").build();
+        assert!(ssec_passthrough_evidence_present(&with_evidence));
+
+        let empty_algorithm = HeadObjectOutput::builder().sse_customer_algorithm("").build();
+        assert!(
+            !ssec_passthrough_evidence_present(&empty_algorithm),
+            "an empty echo is not evidence of preserved SSE-C material"
+        );
+
+        let without_evidence = HeadObjectOutput::builder().e_tag("\"abc\"").content_length(8).build();
+        assert!(
+            !ssec_passthrough_evidence_present(&without_evidence),
+            "a plain HEAD response must classify the target as having dropped the material"
+        );
+    }
+
    #[test]
    fn replication_put_options_adds_ssec_checksum_metadata() {
        let metadata = HashMap::from([(SSEC_ALGORITHM_HEADER.to_string(), "AES256".to_string())]);
@@ -277,6 +277,20 @@ pub struct ObjectOptions {
    /// fence avoids recursively acquiring the read lock behind a queued writer.
    pub bucket_lifecycle_lock_fence: Option<NamespaceLockFence>,
    pub replication_request: bool,
+    /// True when the inbound request carried the
+    /// `{x-rustfs-,x-minio-}source-proxy-request` header family with the
+    /// value "true": the request was already proxied by a replication peer,
+    /// so this server must not proxy a local miss onward (anti-loop,
+    /// MinIO-compatible). The header only disables proxying — it grants no
+    /// capability — so no authorization gate is required to honor it.
+    pub proxy_request: bool,
+    /// True when the `source-proxy-request` header family was present at
+    /// all, regardless of value (MinIO's `ProxyHeaderSet`). A replication
+    /// peer sends `source-proxy-request: false` on its worker convergence
+    /// HEADs precisely so the receiver answers locally instead of proxying
+    /// back — otherwise a proxied 404->200 echo makes the worker believe the
+    /// object already converged and it never replicates it.
+    pub proxy_header_set: bool,
    /// Source-cluster LWW timestamps carried by an authorized replication
    /// request; None when the source never modified the category. Only the
    /// replication-authorized options builders may set these.