astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-10-30 12:30:39 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(iam): isolate policy reloads and propagate KMS cancellation

Browse Source 
Release the authentication-cache lock while retaining IAM write ordering. Carry request cancellation through IAM and SSE-S3 list decryption, and publish policy replacements only after a complete successful load.

Preserve caller deadlines for slow policy queries and keep the existing etcd read budget scoped to its RPC. Cover concurrent refresh, updates, revocation, cancellation, and deadline compatibility.

Validation: 36 focused and 23 adversarial scenarios each passed three race runs; real 32-second object/etcd probes passed. Full suite passed with the Go DNS resolver after reproducing native DNS failures on the baseline; existing etcd suites, make verifiers, and make build also passed.
Signed-off-by: Feng Ruohang <rh@vonng.com>
This commit is contained in:
Feng Ruohang
2026-10-23 15:50:12 +08:00
parent a07d655dc6
commit 1b5477f3df
13 changed files with 1077 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/config/crypto.go
+7 -4
View File
@@ -48,8 +48,8 @@ func EncryptBytes(k *kms.KMS, plaintext []byte, context kms.Context) ([]byte, er
// DecryptBytes decrypts the ciphertext using a key managed by the KMS.
// The same context that have been used during encryption must be
// provided.
func DecryptBytes(k *kms.KMS, ciphertext []byte, context kms.Context) ([]byte, error) {
plaintext, err := Decrypt(k, bytes.NewReader(ciphertext), context)
func DecryptBytes(ctx context.Context, k *kms.KMS, ciphertext []byte, associatedData kms.Context) ([]byte, error) {
plaintext, err := Decrypt(ctx, k, bytes.NewReader(ciphertext), associatedData)
if err != nil {
return nil, err
}
@@ -115,7 +115,10 @@ func Encrypt(k *kms.KMS, plaintext io.Reader, ctx kms.Context) (io.Reader, error
// Decrypt decrypts the ciphertext using a key managed by the KMS.
// The same context that have been used during encryption must be
// provided.
func Decrypt(k *kms.KMS, ciphertext io.Reader, associatedData kms.Context) (io.Reader, error) {
func Decrypt(ctx context.Context, k *kms.KMS, ciphertext io.Reader, associatedData kms.Context) (io.Reader, error) {
if err := ctx.Err(); err != nil {
return nil, err
}
const (
MaxMetadataSize = 1 << 20 // max. size of the metadata
Version = 1
@@ -145,7 +148,7 @@ func Decrypt(k *kms.KMS, ciphertext io.Reader, associatedData kms.Context) (io.R
return nil, err
}
key, err := k.Decrypt(context.TODO(), &kms.DecryptRequest{
key, err := k.Decrypt(ctx, &kms.DecryptRequest{
Name: metadata.KeyID,
Ciphertext: metadata.KMSKey,
AssociatedData: associatedData,
internal/config/crypto_test.go
+2 -1
View File
@@ -19,6 +19,7 @@ package config
import (
"bytes"
"context"
"encoding/hex"
"io"
"testing"
@@ -68,7 +69,7 @@ func TestEncryptDecrypt(t *testing.T) {
t.Fatalf("Test %d: failed to encrypt stream: %v", i, err)
}
plaintext, err := Decrypt(KMS, bytes.NewReader(data), test.Context)
plaintext, err := Decrypt(context.Background(), KMS, bytes.NewReader(data), test.Context)
if err != nil {
t.Fatalf("Test %d: failed to decrypt stream: %v", i, err)
}