gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-07 22:03:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(storage): restore legacy SSE-S3 read compatibility (#3584)

Browse Source 
* Update .gitignore

* Fix. fixed SSE-S3 compatibility issues in large-scale testing

* fix

* fix(ecstore): reject whitespace bucket names

* Update replication_extension_test.rs

* style(ecstore): format bucket whitespace test

---------

Co-authored-by: houseme <housemecn@gmail.com>
Co-authored-by: cxymds <cxymds@gmail.com>
This commit is contained in:
唐小鸭
2026-06-23 21:35:17 +08:00
committed by GitHub
parent 5c60f0cae9
commit eff656e086
13 changed files with 1239 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/kms/src/service.rs
+24 -1
View File
@@ -232,9 +232,26 @@ impl ObjectEncryptionService {
/// DataKey with decrypted key
///
pub async fn decrypt_data_key(&self, encrypted_key: &[u8], context: &ObjectEncryptionContext) -> Result<DataKey> {
self.decrypt_data_key_with_context(encrypted_key, request_encryption_context(context))
.await
}
/// Decrypt a data key written by legacy RustFS versions that reused KMS data
/// keys across objects with different encryption contexts.
///
/// Callers must restrict this to positively identified legacy object metadata.
pub async fn decrypt_legacy_data_key(&self, encrypted_key: &[u8]) -> Result<DataKey> {
self.decrypt_data_key_with_context(encrypted_key, HashMap::new()).await
}
async fn decrypt_data_key_with_context(
&self,
encrypted_key: &[u8],
encryption_context: HashMap<String, String>,
) -> Result<DataKey> {
let decrypt_request = DecryptRequest {
ciphertext: encrypted_key.to_vec(),
encryption_context: request_encryption_context(context),
encryption_context,
grant_tokens: Vec::new(),
};
@@ -928,5 +945,11 @@ mod tests {
.await
.expect("decrypt should accept matching KMS context");
assert_ne!(decrypted.plaintext_key, [0u8; 32]);
let legacy_decrypted = service
.decrypt_legacy_data_key(&encrypted_key)
.await
.expect("legacy decrypt should use the backend compatibility path");
assert_eq!(legacy_decrypted.plaintext_key, decrypted.plaintext_key);
}
}