mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-29 16:37:07 +00:00
唐小鸭
9118a6e344
Single-part encrypted objects in the legacy format could not serve range reads without decrypting from byte 0: v1 frames are emitted per upstream read, so no closed-form plaintext-to-ciphertext mapping exists. The v2 layout fixed the frame length (8218 ciphertext bytes per 8 KiB plaintext frame), making the mapping closed-form. Consume it: - Single-part PUTs that encrypt locally under the v2 write switch stamp the frame-layout marker, valued with the object's data_dir token - ciphertext passthrough, data movement and copies mint a new data_dir or strip the marker, so a re-homed marker disqualifies itself. - The encrypted read plan seeks marked, uncompressed single-part objects to frame_index * 8218 and decrypts from that frame: the frame index rides the plan's sequence-number slot into DecryptReader::new_at_block, whose nonce and AAD bind absolute indices. New metric path label frame_seek. - A lying marker fails closed: v2 authentication rejects bytes at a fake frame boundary; plaintext is never served from the wrong offset. Compressed objects and multipart sub-part seeks keep the conservative paths (follow-up work); reading needs no switch - seekability follows the marker.
65 lines
1.4 KiB
Rust
65 lines
1.4 KiB
Rust
// Copyright 2024 RustFS Team
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
//! KMS (Key Management Service) End-to-End Tests
|
|
//!
|
|
//! This module contains comprehensive end-to-end tests for RustFS KMS functionality,
|
|
//! including tests for both Local and Vault backends.
|
|
|
|
// KMS-specific common utilities
|
|
#[cfg(test)]
|
|
pub mod common;
|
|
|
|
#[cfg(test)]
|
|
mod kms_local_test;
|
|
|
|
#[cfg(test)]
|
|
mod kms_vault_test;
|
|
|
|
#[cfg(test)]
|
|
mod kms_comprehensive_test;
|
|
|
|
#[cfg(test)]
|
|
mod multipart_encryption_test;
|
|
|
|
#[cfg(test)]
|
|
mod kms_edge_cases_test;
|
|
|
|
#[cfg(test)]
|
|
mod kms_fault_recovery_test;
|
|
|
|
#[cfg(test)]
|
|
mod bucket_default_encryption_test;
|
|
|
|
#[cfg(test)]
|
|
mod encryption_metadata_test;
|
|
|
|
#[cfg(test)]
|
|
mod copy_object_self_copy_sse_test;
|
|
|
|
#[cfg(test)]
|
|
mod encrypted_range_get_test;
|
|
|
|
#[cfg(test)]
|
|
mod copy_object_version_restore_sse_test;
|
|
|
|
#[cfg(test)]
|
|
mod configured_roundtrip_test;
|
|
|
|
#[cfg(test)]
|
|
mod kms_authorization_negative_matrix_test;
|
|
|
|
#[cfg(test)]
|
|
mod kms_ilm_sse_kms_test;
|