gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-19 19:16:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(s3): enforce SSE-C copy key validation (#5185)

Browse Source
This commit is contained in:
cxymds
2026-07-24 19:11:36 +08:00
committed by GitHub
parent fa26b6730d
commit f46ea6e14f
11 changed files with 749 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/e2e_test/src/kms/common.rs
+9 -4
View File
@@ -657,14 +657,19 @@ pub async fn test_multipart_upload_with_config(
.build();
info!("🔗 Completing multipart upload");
let complete_output = s3_client
let mut complete_request = s3_client
.complete_multipart_upload()
.bucket(bucket)
.key(&config.object_key)
.upload_id(upload_id)
.multipart_upload(completed_multipart_upload)
.send()
.await?;
.multipart_upload(completed_multipart_upload);
if let EncryptionType::SSEC { .. } = &config.encryption_type {
complete_request = complete_request
.sse_customer_algorithm("AES256")
.sse_customer_key(sse_c_key_b64.as_ref().unwrap())
.sse_customer_key_md5(sse_c_key_md5.as_ref().unwrap());
}
let complete_output = complete_request.send().await?;
debug!("Multipart upload finalized with ETag {:?}", complete_output.e_tag());
crates/e2e_test/src/kms/kms_local_test.rs
+3
View File
@@ -625,6 +625,9 @@ async fn test_multipart_upload_with_sse_c(
.bucket(bucket)
.key(object_key)
.upload_id(upload_id)
.sse_customer_algorithm("AES256")
.sse_customer_key(&key_b64)
.sse_customer_key_md5(&key_md5)
.multipart_upload(completed_multipart_upload)
.send()
.await?;
crates/e2e_test/src/kms/multipart_encryption_test.rs
+9 -4
View File
@@ -566,14 +566,19 @@ async fn test_multipart_encryption_type(
.set_parts(Some(completed_parts))
.build();
let _complete_output = s3_client
let mut complete_request = s3_client
.complete_multipart_upload()
.bucket(bucket)
.key(object_key)
.upload_id(upload_id)
.multipart_upload(completed_multipart_upload)
.send()
.await?;
.multipart_upload(completed_multipart_upload);
if matches!(encryption_type, EncryptionType::SSEC) {
complete_request = complete_request
.sse_customer_algorithm("AES256")
.sse_customer_key(sse_c_key.as_ref().unwrap())
.sse_customer_key_md5(sse_c_md5.as_ref().unwrap());
}
let _complete_output = complete_request.send().await?;
// Download and verify
let mut get_request = s3_client.get_object().bucket(bucket).key(object_key);