Add Minio TLS configuration doc for Kubernetes deployment (#5617 )

Fix deadlock in in-place CopyObject decryption/encryption (#5637 )
In-place decryption/encryption already holds write locks on them, attempting to acquire a read lock would fail.
2026-10-14 13:45:59 +03:00 · 2018-03-12 14:22:23 -07:00 · 2018-03-12 13:52:38 -07:00 · 2018-03-12 11:51:58 -07:00 · 2018-03-12 11:46:53 +05:30 · 2018-03-09 18:18:57 -08:00
382 changed files with 26607 additions and 18051 deletions
@@ -24,3 +24,4 @@ prime/
 snap/.snapcraft/
 stage/
 .sia_temp/
+buildcoveragecoverage.txt
@@ -17,8 +17,8 @@ env:
 script:
 ## Run all the tests
 - make
- diff -au <(gofmt -d cmd) <(printf "")
- diff -au <(gofmt -d pkg) <(printf "")
+- diff -au <(gofmt -s -d cmd) <(printf "")
+- diff -au <(gofmt -s -d pkg) <(printf "")
 - make test GOFLAGS="-timeout 15m -race -v"
 - make coverage

@@ -26,4 +26,4 @@ after_success:
 - bash <(curl -s https://codecov.io/bash)

 go:
- 1.9.1
+- 1.9.4
@@ -1,4 +1,4 @@
-FROM golang:1.9.1-alpine3.6
+FROM golang:1.9.4-alpine3.6

 MAINTAINER Minio Inc <dev@minio.io>

@@ -6,6 +6,8 @@ ENV GOPATH /go
 ENV PATH $PATH:$GOPATH/bin
 ENV CGO_ENABLED 0
 ENV MINIO_UPDATE off
+ENV MINIO_ACCESS_KEY_FILE=access_key \
+    MINIO_SECRET_KEY_FILE=secret_key

 WORKDIR /go/src/github.com/minio/

@@ -1,4 +1,4 @@
-FROM golang:1.9.1-alpine3.6
+FROM golang:1.9.4-alpine3.6

 MAINTAINER Minio Inc <dev@minio.io>

@@ -6,6 +6,8 @@ ENV GOPATH /go
 ENV PATH $PATH:$GOPATH/bin
 ENV CGO_ENABLED 0
 ENV MINIO_UPDATE off
+ENV MINIO_ACCESS_KEY_FILE=access_key \
+    MINIO_SECRET_KEY_FILE=secret_key

 WORKDIR /go/src/github.com/minio/

@@ -5,6 +5,8 @@ MAINTAINER Minio Inc <dev@minio.io>
 COPY dockerscripts/docker-entrypoint.sh dockerscripts/healthcheck.sh /usr/bin/

 ENV MINIO_UPDATE off
+ENV MINIO_ACCESS_KEY_FILE=access_key \
+    MINIO_SECRET_KEY_FILE=secret_key

 RUN \
     apk add --no-cache ca-certificates && \
@@ -7,12 +7,12 @@ BUILD_LDFLAGS := '$(LDFLAGS)'
 all: build

 checks:
-	@echo "Check deps"
+	@echo "Checking dependencies"
 	@(env bash $(PWD)/buildscripts/checkdeps.sh)
-	@echo "Checking project is in GOPATH"
+	@echo "Checking for project in GOPATH"
 	@(env bash $(PWD)/buildscripts/checkgopath.sh)

-getdeps: checks
+getdeps:
 	@echo "Installing golint" && go get -u github.com/golang/lint/golint
 	@echo "Installing gocyclo" && go get -u github.com/fzipp/gocyclo
 	@echo "Installing deadcode" && go get -u github.com/remyoudompheng/go-misc/deadcode
@@ -67,8 +67,8 @@ coverage: build
 	@(env bash $(PWD)/buildscripts/go-coverage.sh)

 # Builds minio locally.
-build:
-	@echo "Building minio binary: $(PWD)/minio"
+build: checks
+	@echo "Building minio binary to './minio'"
 	@CGO_ENABLED=0 go build --ldflags $(BUILD_LDFLAGS) -o $(PWD)/minio

 pkg-add:
@@ -88,12 +88,13 @@ pkg-list:

 # Builds minio and installs it to $GOPATH/bin.
 install: build
-	@echo "Installing minio binary: $(GOPATH)/bin/minio"
+	@echo "Installing minio binary to '$(GOPATH)/bin/minio'"
 	@cp $(PWD)/minio $(GOPATH)/bin/minio
-	@echo "\nInstallation successful. To learn more, try \"minio --help\"."
+	@echo "Installation successful. To learn more, try \"minio --help\"."

 clean:
 	@echo "Cleaning up all the generated files"
 	@find . -name '*.test' | xargs rm -fv
-	@rm -rf build
-	@rm -rf release
+	@rm -rvf minio
+	@rm -rvf build
+	@rm -rvf release
@@ -1,5 +1,5 @@
 # Minio Quickstart Guide
-[![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io) [![Go Report Card](https://goreportcard.com/badge/minio/minio)](https://goreportcard.com/report/minio/minio) [![Docker Pulls](https://img.shields.io/docker/pulls/minio/minio.svg?maxAge=604800)](https://hub.docker.com/r/minio/minio/) [![codecov](https://codecov.io/gh/minio/minio/branch/master/graph/badge.svg)](https://codecov.io/gh/minio/minio) [![Snap Status](https://build.snapcraft.io/badge/minio/minio.svg)](https://build.snapcraft.io/user/minio/minio)
+[![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io) [![Go Report Card](https://goreportcard.com/badge/minio/minio)](https://goreportcard.com/report/minio/minio) [![Docker Pulls](https://img.shields.io/docker/pulls/minio/minio.svg?maxAge=604800)](https://hub.docker.com/r/minio/minio/) [![codecov](https://codecov.io/gh/minio/minio/branch/master/graph/badge.svg)](https://codecov.io/gh/minio/minio)

 Minio is an object storage server released under Apache License v2.0. It is compatible with Amazon S3 cloud storage service. It is best suited for storing unstructured data such as photos, videos, log files, backups and container / VM images. Size of an object can range from a few KBs to a maximum of 5TB.

@@ -48,6 +48,7 @@ chmod 755 minio
 | ----------| -------- | ------|
 |GNU/Linux|64-bit Intel|https://dl.minio.io/server/minio/release/linux-amd64/minio |
 ```sh
+wget https://dl.minio.io/server/minio/release/linux-amd64/minio
 chmod +x minio
 ./minio server /data
 ```
@@ -99,6 +100,11 @@ Minio Server comes with an embedded web based object browser. Point your web bro
 ## Test using Minio Client `mc`
 `mc` provides a modern alternative to UNIX commands like ls, cat, cp, mirror, diff etc. It supports filesystems and Amazon S3 compatible cloud storage services. Follow the Minio Client [Quickstart Guide](https://docs.minio.io/docs/minio-client-quickstart-guide) for further instructions.

+## Pre-existing data
+When deployed on a single drive, Minio server lets clients access any pre-existing data in the data directory. For example, if Minio is started with the command  `minio server /mnt/data`, any pre-existing data in the `/mnt/data` directory would be accessible to the clients.
+
+The above statement is also valid for all gateway backends.
+
 ## Explore Further
 - [Minio Erasure Code QuickStart Guide](https://docs.minio.io/docs/minio-erasure-code-quickstart-guide)
 - [Use `mc` with Minio Server](https://docs.minio.io/docs/minio-client-quickstart-guide)
@@ -109,3 +115,7 @@ Minio Server comes with an embedded web based object browser. Point your web bro

 ## Contribute to Minio Project
 Please follow Minio [Contributor's Guide](https://github.com/minio/minio/blob/master/CONTRIBUTING.md)
+
+
+## License
+[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Fminio%2Fminio.svg?type=large)](https://app.fossa.io/projects/git%2Bgithub.com%2Fminio%2Fminio?ref=badge_large)
@@ -1,197 +0,0 @@
-# Minio 快速入门 [![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io) [![Go Report Card](https://goreportcard.com/badge/minio/minio)](https://goreportcard.com/report/minio/minio) [![codecov](https://codecov.io/gh/minio/minio/branch/master/graph/badge.svg)](https://codecov.io/gh/minio/minio) [![Snap Status](https://build.snapcraft.io/badge/minio/minio.svg)](https://build.snapcraft.io/user/minio/minio)
-
-Minio是一个对象存储服务，基于Apache License v2.0协议. 它完全兼容亚马逊的S3云储存服务，非常适合于存储很多非结构化的数据，例如图片、视频、日志文件、备份数据和容器/虚拟机镜像等，而一个对象文件可以是任意大小，从几kb到最大5T不等。 
-
-##  1. 下载
-
-Minio是一个非常轻量的服务,可以很简单的和其他应用的结合，类似 NodeJS, Redis 或者 MySQL.
-
-| Platform| Architecture | URL|
-| ----------| -------- | ------|
-|GNU/Linux|64-bit Intel|https://dl.minio.io/server/minio/release/linux-amd64/minio|
-|Apple OS X|64-bit Intel|https://dl.minio.io/server/minio/release/darwin-amd64/minio|
-|Microsoft Windows|64-bit|https://dl.minio.io/server/minio/release/windows-amd64/minio.exe|
-|FreeBSD|64-bit|https://dl.minio.io/server/minio/release/freebsd-amd64/minio|
-
-### Homebrew 安装
-
-使用[Homebrew](http://brew.sh/) 来安装minio
- 
-```sh
-$ brew install minio
-$ minio --help
-```
-
-### 源码安装
-
-源码安装只针对开发者和一些高级用户，如果你还没有golang的环境，请安装golang官网安装[How to install Golang](https://docs.minio.io/docs/zh-CN/how-to-install-golang).
-
-```sh
-
-$ go get -u github.com/minio/minio
-
-
-```
-
-## 2. 运行Minio服务
-
-
-### GNU/Linux
-
- ```sh
-
-$ chmod +x minio
-$ ./minio --help
-$ ./minio server /data
-
-端点:  http://10.0.0.10:9000  http://127.0.0.1:9000  http://172.17.0.1:9000
-AccessKey: USWUXHGYZQYFYFFIT3RE
-SecretKey: MOJRH0mkL1IPauahWITSVvyDrQbEEIwljvmxdq03
-区域:    us-east-1
-
-浏览器访问入口:
-   http://10.0.0.10:9000  http://127.0.0.1:9000  http://172.17.0.1:9000
-
-命令行访问: https://docs.minio.io/docs/zh-CN/minio-client-quickstart-guide
-   $ mc config host add myminio http://10.0.0.10:9000 USWUXHGYZQYFYFFIT3RE MOJRH0mkL1IPauahWITSVvyDrQbEEIwljvmxdq03
-
-对象操作API (兼容Amazon S3):
-   Go:         https://docs.minio.io/docs/zh-CN/golang-client-quickstart-guide
-   Java:       https://docs.minio.io/docs/zh-CN/java-client-quickstart-guide
-   Python:     https://docs.minio.io/docs/zh-CN/python-client-quickstart-guide
-   JavaScript: https://docs.minio.io/docs/zh-CN/javascript-client-quickstart-guide
-
-```
-
-### OS X
-
-
- ```sh
-
-$ chmod 755 minio
-$ ./minio --help
-$ ./minio server /data
-
-端点:  http://10.0.0.10:9000  http://127.0.0.1:9000  http://172.17.0.1:9000
-AccessKey: USWUXHGYZQYFYFFIT3RE
-SecretKey: MOJRH0mkL1IPauahWITSVvyDrQbEEIwljvmxdq03
-区域:    us-east-1
-
-浏览器访问入口:
-   http://10.0.0.10:9000  http://127.0.0.1:9000  http://172.17.0.1:9000
-
-命令行访问: https://docs.minio.io/docs/zh-CN/minio-client-quickstart-guide
-   $ mc config host add myminio http://10.0.0.10:9000 USWUXHGYZQYFYFFIT3RE MOJRH0mkL1IPauahWITSVvyDrQbEEIwljvmxdq03
-
-对象操作API (兼容Amazon S3):
-   Go:         https://docs.minio.io/docs/zh-CN/golang-client-quickstart-guide
-   Java:       https://docs.minio.io/docs/zh-CN/java-client-quickstart-guide
-   Python:     https://docs.minio.io/docs/zh-CN/python-client-quickstart-guide
-   JavaScript: https://docs.minio.io/docs/zh-CN/javascript-client-quickstart-guide
-
-```
-
-### Microsoft Windows
-
-```sh
-
-C:\Users\Username\Downloads> minio.exe --help
-C:\Users\Username\Downloads> minio.exe server D:\Photos
-
-端点:  http://10.0.0.10:9000  http://127.0.0.1:9000  http://172.17.0.1:9000
-AccessKey: USWUXHGYZQYFYFFIT3RE
-SecretKey: MOJRH0mkL1IPauahWITSVvyDrQbEEIwljvmxdq03
-区域:    us-east-1
-
-浏览器访问入口:
-   http://10.0.0.10:9000  http://127.0.0.1:9000  http://172.17.0.1:9000
-
-命令行访问: https://docs.minio.io/docs/zh-CN/minio-client-quickstart-guide
-   $ mc.exe config host add myminio http://10.0.0.10:9000 USWUXHGYZQYFYFFIT3RE MOJRH0mkL1IPauahWITSVvyDrQbEEIwljvmxdq03
-
-对象操作API (兼容Amazon S3):
-   Go:         https://docs.minio.io/docs/zh-CN/golang-client-quickstart-guide
-   Java:       https://docs.minio.io/docs/zh-CN/java-client-quickstart-guide
-   Python:     https://docs.minio.io/docs/zh-CN/python-client-quickstart-guide
-   JavaScript: https://docs.minio.io/docs/zh-CN/javascript-client-quickstart-guide
-
-
-```
-
-### Docker
-
-```sh
-
-$ docker pull minio/minio
-$ docker run -p 9000:9000 minio/minio
-
-```
-访问minio的docker入门指南获得更多内容 [here](https://docs.minio.io/docs/zh-CN/minio-docker-quickstart-guide)
-
-### FreeBSD
-
-```sh
-
-$ chmod 755 minio
-$ ./minio --help
-$ ./minio server /data
-
-端点:  http://10.0.0.10:9000  http://127.0.0.1:9000  http://172.17.0.1:9000
-AccessKey: USWUXHGYZQYFYFFIT3RE
-SecretKey: MOJRH0mkL1IPauahWITSVvyDrQbEEIwljvmxdq03
-区域:    us-east-1
-
-浏览器访问入口:
-   http://10.0.0.10:9000  http://127.0.0.1:9000  http://172.17.0.1:9000
-
-命令行访问: https://docs.minio.io/docs/zh-CN/minio-client-quickstart-guide
-   $ mc config host add myminio http://10.0.0.10:9000 USWUXHGYZQYFYFFIT3RE MOJRH0mkL1IPauahWITSVvyDrQbEEIwljvmxdq03
-
-对象操作API (兼容Amazon S3):
-   Go:         https://docs.minio.io/docs/zh-CN/golang-client-quickstart-guide
-   Java:       https://docs.minio.io/docs/zh-CN/java-client-quickstart-guide
-   Python:     https://docs.minio.io/docs/zh-CN/python-client-quickstart-guide
-   JavaScript: https://docs.minio.io/docs/zh-CN/javascript-client-quickstart-guide
-
-
-```
-请访问FreeBSD的官网指南获取更多详细信息[here](https://www.freebsd.org/doc/handbook/zfs-quickstart.html)
-
-## 3. 使用浏览器测试minio服务
-
-打开浏览器并输入 http://127.0.0.1:9000 查看在minio服务器上面的所有bucket
-
-![Screenshot](https://github.com/minio/minio/blob/master/docs/screenshots/minio-browser.jpg?raw=true)
-
-
-## 4. 使用`mc`测试minio服务
-
-
-按照 [这个](https://docs.minio.io/docs/minio-client-quickstart-guide) 安装mc. 使用 `mc ls` 命令显示所有在minio服务上面的bucket.
-
-```sh
-
-$ mc ls myminio/
-[2015-08-05 08:13:22 IST]     0B andoria/
-[2015-08-05 06:14:26 IST]     0B deflector/
-[2015-08-05 08:13:11 IST]     0B ferenginar/
-[2016-03-08 14:56:35 IST]     0B jarjarbing/
-[2016-01-20 16:07:41 IST]     0B my.minio.io/
-
-```
-
-查看更多的例子请访问 [Minio Client Complete Guide](https://docs.minio.io/docs/zh-CN/minio-client-complete-guide).
-
-
-## 5. 更多内容
-
- [Minio Erasure Code 快速入门](https://docs.minio.io/docs/zh-CN/minio-erasure-code-quickstart-guide)
- [Minio Docker 快速入门](https://docs.minio.io/docs/zh-CN/minio-docker-quickstart-guide)
- [使用`mc`测试 Minio Server](https://docs.minio.io/docs/zh-CN/minio-client-quickstart-guide)
- [使用 `aws-cli` 测试 Minio Server](https://docs.minio.io/docs/zh-CN/aws-cli-with-minio)
- [使用 `s3cmd` 测试 Minio Server](https://docs.minio.io/docs/zh-CN/s3cmd-with-minio)
- [使用 `minio-go` SDK ce's测试 Minio Server](https://docs.minio.io/docs/zh-CN/golang-client-quickstart-guide)
-
-
-## 6. 给Minio项目贡献
-请按照Minio [贡献者指导手册](https://github.com/minio/minio/blob/master/CONTRIBUTING.md)
@@ -104,6 +104,11 @@ go get -u github.com/minio/minio
 ## 使用Minio客户端 `mc`进行验证
 `mc` 提供了一些UNIX常用命令的替代品，像ls, cat, cp, mirror, diff这些。 它支持文件系统和亚马逊S3云存储服务。 更多信息请参考 [mc快速入门](https://docs.minio.io/docs/minio-client-quickstart-guide) 。

+## 已经存在的数据
+当在单块磁盘上部署Minio server,Minio server允许客户端访问数据目录下已经存在的数据。比如，如果Minio使用`minio server /mnt/data`启动，那么所有已经在`/mnt/data`目录下的数据都可以被客户端访问到。
+
+上述描述对所有网关后端同样有效。
+
 ## 了解更多
 - [Minio纠删码入门](https://docs.minio.io/docs/minio-erasure-code-quickstart-guide)
 - [`mc`快速入门](https://docs.minio.io/docs/minio-client-quickstart-guide)
@@ -12,7 +12,7 @@ clone_folder: c:\gopath\src\github.com\minio\minio
 # Environment variables
 environment:
  GOPATH: c:\gopath
-  GOROOT: c:\go
+  GOROOT: c:\go19

 # scripts that run after cloning repository
 install:
@@ -41,6 +41,8 @@ import _Login from './js/components/Login.js'
 import _Browse from './js/components/Browse.js'
 import fontAwesome from 'font-awesome/css/font-awesome.css'

+import MaterialDesignIconicFonts from 'material-design-iconic-font/dist/css/material-design-iconic-font.min.css'
+
 import Web from './js/web'
 window.Web = Web

@@ -24,6 +24,8 @@ export const SET_CURRENT_BUCKET = 'SET_CURRENT_BUCKET'
 export const SET_CURRENT_PATH = 'SET_CURRENT_PATH'
 export const SET_BUCKETS = 'SET_BUCKETS'
 export const ADD_BUCKET = 'ADD_BUCKET'
+export const REMOVE_BUCKET = 'REMOVE_BUCKET'
+export const SHOW_BUCKET_DROPDOWN = 'SHOW_BUCKET_DROPDOWN'
 export const SET_VISIBLE_BUCKETS = 'SET_VISIBLE_BUCKETS'
 export const SET_OBJECTS = 'SET_OBJECTS'
 export const APPEND_OBJECTS = 'APPEND_OBJECTS'
@@ -173,6 +175,27 @@ export const addBucket = bucket => {
  }
 }

+export const removeBucket = bucket => {
+  return {
+    type: REMOVE_BUCKET,
+    bucket
+  }
+}
+
+export const showBucketDropdown = bucket => {
+  return {
+    type: SHOW_BUCKET_DROPDOWN,
+    showBucketDropdown: true
+  }
+}
+
+export const hideBucketDropdown = bucket => {
+  return {
+    type: SHOW_BUCKET_DROPDOWN,
+    showBucketDropdown: false
+  }
+}
+
 export const showMakeBucketModal = () => {
  return {
    type: SHOW_MAKEBUCKET_MODAL,
@@ -314,6 +337,31 @@ export const selectBucket = (newCurrentBucket, prefix) => {
  }
 }

+export const deleteBucket = (bucket) => {
+  return (dispatch, getState) => {
+    // DeleteBucket() RPC call will ONLY delete a bucket if it is empty of
+    // objects. This means a call can just be sent, as it is entirely reversable
+    // and won't do any permanent damage.
+    web.DeleteBucket({
+      bucketName: bucket
+    })
+      .then(() => {
+        dispatch(showAlert({
+          type: 'info',
+          message: `Bucket '${bucket}' has been deleted.`
+        }))
+        dispatch(removeBucket(bucket))
+      })
+      .catch(err => {
+        let message = err.message
+        dispatch(showAlert({
+          type: 'danger',
+          message: message
+        }))
+      })
+  }
+}
+
 export const listObjects = () => {
  return (dispatch, getState) => {
    const {buckets, currentBucket, currentPath, marker, objects, istruncated, web} = getState()
@@ -352,7 +400,6 @@ export const listObjects = () => {
 export const selectPrefix = prefix => {
  return (dispatch, getState) => {
    const {currentBucket, web} = getState()
-    dispatch(resetObjects())
    dispatch(setLoadPath(prefix))
    web.ListObjects({
      bucketName: currentBucket,
@@ -367,6 +414,7 @@ export const selectPrefix = prefix => {
          object.name = object.name.replace(`${prefix}`, '');
          return object
        })
+        dispatch(resetObjects())
        dispatch(appendObjects(
          objects,
          res.nextmarker,
@@ -210,9 +210,19 @@ export default class Browse extends React.Component {
    dispatch(actions.hideAbout())
  }

+  toggleBucketDropdown(e) {
+    const {dispatch, showBucketDropdown} = this.props
+    if (showBucketDropdown) {
+      dispatch(actions.hideBucketDropdown())
+    } else {
+      dispatch(actions.showBucketDropdown())
+    }
+  }
+
  showBucketPolicy(e) {
    e.preventDefault()
    const {dispatch} = this.props
+    this.toggleBucketDropdown(e)
    dispatch(actions.showBucketPolicy())
  }

@@ -222,10 +232,17 @@ export default class Browse extends React.Component {
    dispatch(actions.hideBucketPolicy())
  }

+  deleteBucket(e, bucket) {
+    e.preventDefault()
+    const {dispatch} = this.props
+    this.toggleBucketDropdown(e)
+    dispatch(actions.deleteBucket(bucket))
+    browserHistory.push(`${minioBrowserPrefix}/`)
+  }
+
  uploadFile(e) {
    e.preventDefault()
-    const {dispatch, buckets} = this.props
-
+    const {dispatch, buckets, currentBucket} = this.props
    if (buckets.length === 0) {
      dispatch(actions.showAlert({
        type: 'danger',
@@ -233,6 +250,13 @@ export default class Browse extends React.Component {
      }))
      return
    }
+    if (currentBucket === '') {
+      dispatch(actions.showAlert({
+        type: 'danger',
+        message: "Please choose a bucket before trying to upload files."
+      }))
+      return
+    }
    let file = e.target.files[0]
    e.target.value = null
    this.xhr = new XMLHttpRequest()
@@ -577,7 +601,9 @@ export default class Browse extends React.Component {
        <SideBar searchBuckets={ this.searchBuckets.bind(this) }
          selectBucket={ this.selectBucket.bind(this) }
          clickOutside={ this.hideSidebar.bind(this) }
-          showPolicy={ this.showBucketPolicy.bind(this) } />
+          showPolicy={ this.showBucketPolicy.bind(this) }
+          deleteBucket={ this.deleteBucket.bind(this) }
+          toggleBucketDropdown={ this.toggleBucketDropdown.bind(this) } />
        <div className="fe-body">
          <div className={ 'list-actions' + (classNames({
                             ' list-actions-toggled': checkedObjects.length > 0
@@ -21,8 +21,9 @@ import Scrollbars from 'react-custom-scrollbars/lib/Scrollbars'
 import connect from 'react-redux/lib/components/connect'

 import logo from '../../img/logo.svg'
+import Dropdown from 'react-bootstrap/lib/Dropdown'

-let SideBar = ({visibleBuckets, loadBucket, currentBucket, selectBucket, searchBuckets, sidebarStatus, clickOutside, showPolicy}) => {
+let SideBar = ({visibleBuckets, loadBucket, currentBucket, selectBucket, searchBuckets, sidebarStatus, clickOutside, showPolicy, deleteBucket, toggleBucketDropdown, showBucketDropdown}) => {

  const list = visibleBuckets.map((bucket, i) => {
    return <li className={ classNames({
@@ -33,7 +34,19 @@ let SideBar = ({visibleBuckets, loadBucket, currentBucket, selectBucket, searchB
                                    }) }>
               { bucket }
             </a>
-             <i className="fesli-trigger" onClick={ showPolicy }></i>
+             <Dropdown open={bucket === currentBucket && showBucketDropdown} onToggle={toggleBucketDropdown} className="bucket-dropdown" id="bucket-dropdown">
+               <Dropdown.Toggle noCaret>
+                 <i className="zmdi zmdi-more-vert" />
+               </Dropdown.Toggle>
+               <Dropdown.Menu className="dropdown-menu-right">
+                 <li>
+                   <a onClick={ showPolicy }>Edit policy</a>
+                 </li>
+                 <li>
+                   <a onClick={ (e) => deleteBucket(e, bucket) }>Delete</a>
+                 </li>
+               </Dropdown.Menu>
+             </Dropdown>
           </li>
  })

@@ -80,6 +93,7 @@ export default connect(state => {
    visibleBuckets: state.visibleBuckets,
    loadBucket: state.loadBucket,
    currentBucket: state.currentBucket,
+    showBucketDropdown: state.showBucketDropdown,
    sidebarStatus: state.sidebarStatus
  }
 })(SideBar)
@@ -25,6 +25,7 @@ export default (state = {
    storageInfo: {},
    serverInfo: {},
    currentBucket: '',
+    showBucketDropdown: false,
    currentPath: '',
    showMakeBucketModal: false,
    uploads: {},
@@ -71,6 +72,14 @@ export default (state = {
      newState.buckets = [action.bucket, ...newState.buckets]
      newState.visibleBuckets = [action.bucket, ...newState.visibleBuckets]
      break
+    case actions.REMOVE_BUCKET:
+      newState.buckets = newState.buckets.filter(bucket => bucket != action.bucket)
+      newState.visibleBuckets = newState.visibleBuckets.filter(bucket => bucket != action.bucket)
+      newState.currentBucket = ""
+      break
+    case actions.SHOW_BUCKET_DROPDOWN:
+      newState.showBucketDropdown = action.showBucketDropdown
+      break
    case actions.SET_VISIBLE_BUCKETS:
      newState.visibleBuckets = action.visibleBuckets
      break
@@ -87,6 +87,9 @@ export default class Web {
  MakeBucket(args) {
    return this.makeCall('MakeBucket', args)
  }
+  DeleteBucket(args) {
+    return this.makeCall('DeleteBucket', args)
+  }
  ListObjects(args) {
    return this.makeCall('ListObjects', args)
  }
@@ -108,7 +108,7 @@ div.fesl-row {
    &[data-type=zip] { .list-type(#427089, '\f1c6'); }
    &[data-type=audio] { .list-type(#009688, '\f1c7'); }
    &[data-type=code] { .list-type(#997867, "\f1c9"); }
-    &[data-type=excel] { .list-type(#f1c3, '\f1c3'); }
+    &[data-type=excel] { .list-type(#64c866, '\f1c3'); }
    &[data-type=image] { .list-type(#f06292, '\f1c5'); }
    &[data-type=video] { .list-type(#f8c363, '\f1c8'); }
    &[data-type=other] { .list-type(#afafaf, '\f016'); }
@@ -111,7 +111,7 @@
 		}

 		&:hover {
-			.fesli-trigger {
+			.bucket-dropdown .dropdown-toggle {
 				.opacity(0.6);

 				&:hover {
@@ -132,17 +132,40 @@
 	}
 }

-.fesli-trigger {
-	.opacity(0);
-	.transition(all);
-	.transition-duration(200ms);
+/* Dropdown */
+.bucket-dropdown {
 	position: absolute;
-	top: 0;
-	right: 0;
+	top: 0px;
+	right: 0px;
 	width: 35px;
 	height: 100%;
 	cursor: pointer;
-	background: url(../../img/more-h-light.svg) no-repeat top 20px left;
+	color: @white;
+
+	.dropdown-toggle {
+		.opacity(0);
+		.transition(all);
+		.transition-duration(200ms);
+		font-size: 20px;
+		background-color: transparent;
+	}
+
+	.dropdown-menu-right {
+		padding: 15px 0;
+		margin-top: -1px;
+		& li {
+			a:before {
+				content: none;
+				-webkit-box-shadow: @dropdown-shadow;
+				box-shadow: @dropdown-shadow;	
+			}
+			&:not(.active):hover {
+				& > a {
+					color: @dropdown-link-hover-color;
+				}
+			}
+		}
+	}
 }

 /* Scrollbar */
@@ -60,6 +60,7 @@
    "humanize": "0.0.9",
    "json-loader": "^0.5.4",
    "local-storage-fallback": "^1.3.0",
+    "material-design-iconic-font": "^2.2.0",
    "mime-db": "^1.25.0",
    "mime-types": "^2.1.13",
    "moment": "^2.15.1",
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# Minio Cloud Storage, (C) 2014-2016 Minio, Inc.
+# Minio Cloud Storage, (C) 2014-2018 Minio, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -21,7 +21,7 @@ _init() {

    ## Minimum required versions for build dependencies
    GIT_VERSION="1.0"
-    GO_VERSION="1.9.1"
+    GO_VERSION="1.9.4"
    OSX_VERSION="10.8"
    KNAME=$(uname -s)
    ARCH=$(uname -m)
@@ -93,9 +93,7 @@ assert_is_supported_arch() {
            return
            ;;
        *)
-            echo "ERROR"
-            echo "Arch '${ARCH}' not supported."
-            echo "Supported Arch: [x86_64, amd64, aarch64, arm*]"
+            echo "Arch '${ARCH}' is not supported. Supported Arch: [x86_64, amd64, aarch64, arm*]"
            exit 1
    esac
 }
@@ -108,41 +106,31 @@ assert_is_supported_os() {
        Darwin )
            osx_host_version=$(env sw_vers -productVersion)
            if ! check_minimum_version "${OSX_VERSION}" "${osx_host_version}"; then
-                echo "ERROR"
-                echo "OSX version '${osx_host_version}' not supported."
-                echo "Minimum supported version: ${OSX_VERSION}"
+                echo "OSX version '${osx_host_version}' is not supported. Minimum supported version: ${OSX_VERSION}"
                exit 1
            fi
            return
            ;;
        *)
-            echo "ERROR"
-            echo "OS '${KNAME}' is not supported."
-            echo "Supported OS: [Linux, FreeBSD, OpenBSD, NetBSD, Darwin, DragonFly]"
+            echo "OS '${KNAME}' is not supported. Supported OS: [Linux, FreeBSD, OpenBSD, NetBSD, Darwin, DragonFly]"
            exit 1
    esac
 }

 assert_check_golang_env() {
    if ! which go >/dev/null 2>&1; then
-        echo "ERROR"
-        echo "Cannot find go binary in your PATH configuration, please refer to Go installation document at"
-        echo "https://docs.minio.io/docs/how-to-install-golang"
+        echo "Cannot find go binary in your PATH configuration, please refer to Go installation document at https://docs.minio.io/docs/how-to-install-golang"
        exit 1
    fi

    installed_go_version=$(go version | sed 's/^.* go\([0-9.]*\).*$/\1/')
    if ! check_minimum_version "${GO_VERSION}" "${installed_go_version}"; then
-        echo "ERROR"
-        echo "Go version '${installed_go_version}' not supported."
-        echo "Minimum supported version: ${GO_VERSION}"
+        echo "Go runtime version '${installed_go_version}' is unsupported. Minimum supported version: ${GO_VERSION} to compile."
        exit 1
    fi

    if [ -z "${GOPATH}" ]; then
-        echo "ERROR"
-        echo "GOPATH environment variable missing, please refer to Go installation document"
-        echo "https://docs.minio.io/docs/how-to-install-golang"
+        echo "GOPATH environment variable missing, please refer to Go installation document at https://docs.minio.io/docs/how-to-install-golang"
        exit 1
    fi

@@ -152,9 +140,7 @@ assert_check_deps() {
    # support unusual Git versions such as: 2.7.4 (Apple Git-66)
    installed_git_version=$(git version | perl -ne '$_ =~ m/git version (.*?)( |$)/; print "$1\n";')
    if ! check_minimum_version "${GIT_VERSION}" "${installed_git_version}"; then
-        echo "ERROR"
-        echo "Git version '${installed_git_version}' not supported."
-        echo "Minimum supported version: ${GIT_VERSION}"
+        echo "Git version '${installed_git_version}' is not supported. Minimum supported version: ${GIT_VERSION}"
        exit 1
    fi
 }
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Minio Cloud Storage, (C) 2017 Minio, Inc.
+# Minio Cloud Storage, (C) 2017, 2018 Minio, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -45,21 +45,58 @@ function start_minio_fs()
 {
    "${MINIO[@]}" server "${WORK_DIR}/fs-disk" >"$WORK_DIR/fs-minio.log" 2>&1 &
    minio_pid=$!
-    sleep 3
+    sleep 10

    echo "$minio_pid"
 }

-function start_minio_xl()
+function start_minio_erasure()
 {
-    "${MINIO[@]}" server "${WORK_DIR}/xl-disk1" "${WORK_DIR}/xl-disk2" "${WORK_DIR}/xl-disk3" "${WORK_DIR}/xl-disk4" >"$WORK_DIR/xl-minio.log" 2>&1 &
+    "${MINIO[@]}" server "${WORK_DIR}/erasure-disk1" "${WORK_DIR}/erasure-disk2" "${WORK_DIR}/erasure-disk3" "${WORK_DIR}/erasure-disk4" >"$WORK_DIR/erasure-minio.log" 2>&1 &
    minio_pid=$!
-    sleep 3
+    sleep 15

    echo "$minio_pid"
 }

-function start_minio_dist()
+function start_minio_erasure_sets()
+{
+    "${MINIO[@]}" server "${WORK_DIR}/erasure-disk-sets{1...32}" >"$WORK_DIR/erasure-minio-sets.log" 2>&1 &
+    minio_pid=$!
+    sleep 15
+
+    echo "$minio_pid"
+}
+
+function start_minio_dist_erasure_sets()
+{
+    declare -a minio_pids
+    "${MINIO[@]}" server --address=:9000 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9000.log" 2>&1 &
+    minio_pids[0]=$!
+    "${MINIO[@]}" server --address=:9001 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9001.log" 2>&1 &
+    minio_pids[1]=$!
+    "${MINIO[@]}" server --address=:9002 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9002.log" 2>&1 &
+    minio_pids[2]=$!
+    "${MINIO[@]}" server --address=:9003 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9003.log" 2>&1 &
+    minio_pids[3]=$!
+    "${MINIO[@]}" server --address=:9004 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9004.log" 2>&1 &
+    minio_pids[4]=$!
+    "${MINIO[@]}" server --address=:9005 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9005.log" 2>&1 &
+    minio_pids[5]=$!
+    "${MINIO[@]}" server --address=:9006 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9006.log" 2>&1 &
+    minio_pids[6]=$!
+    "${MINIO[@]}" server --address=:9007 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9007.log" 2>&1 &
+    minio_pids[7]=$!
+    "${MINIO[@]}" server --address=:9008 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9008.log" 2>&1 &
+    minio_pids[8]=$!
+    "${MINIO[@]}" server --address=:9009 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9009.log" 2>&1 &
+    minio_pids[9]=$!
+
+    sleep 30
+    echo "${minio_pids[@]}"
+}
+
+function start_minio_dist_erasure()
 {
    declare -a minio_pids
    "${MINIO[@]}" server --address=:9000 "http://127.0.0.1:9000${WORK_DIR}/dist-disk1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk4" >"$WORK_DIR/dist-minio-9000.log" 2>&1 &
@@ -103,9 +140,8 @@ function run_test_fs()
    return "$rv"
 }

-function run_test_xl()
-{
-    minio_pid="$(start_minio_xl)"
+function run_test_erasure_sets() {
+    minio_pid="$(start_minio_erasure_sets)"

    (cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
    rv=$?
@@ -114,16 +150,60 @@ function run_test_xl()
    sleep 3

    if [ "$rv" -ne 0 ]; then
-        cat "$WORK_DIR/xl-minio.log"
+        cat "$WORK_DIR/erasure-minio-sets.log"
    fi
-    rm -f "$WORK_DIR/xl-minio.log"
+    rm -f "$WORK_DIR/erasure-minio-sets.log"

    return "$rv"
 }

-function run_test_dist()
+function run_test_dist_erasure_sets()
 {
-    minio_pids=( $(start_minio_dist) )
+    minio_pids=( $(start_minio_dist_erasure_sets) )
+
+    (cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
+    rv=$?
+
+    for pid in "${minio_pids[@]}"; do
+        kill "$pid"
+    done
+    sleep 3
+
+    if [ "$rv" -ne 0 ]; then
+        for i in $(seq 0 9); do
+            echo "server$i log:"
+            cat "$WORK_DIR/dist-minio-900$i.log"
+        done
+    fi
+
+    for i in $(seq 0 9); do
+        rm -f "$WORK_DIR/dist-minio-900$i.log"
+    done
+
+    return "$rv"
+}
+
+function run_test_erasure()
+{
+    minio_pid="$(start_minio_erasure)"
+
+    (cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
+    rv=$?
+
+    kill "$minio_pid"
+    sleep 3
+
+    if [ "$rv" -ne 0 ]; then
+        cat "$WORK_DIR/erasure-minio.log"
+    fi
+    rm -f "$WORK_DIR/erasure-minio.log"
+
+    return "$rv"
+}
+
+function run_test_dist_erasure()
+{
+    minio_pids=( $(start_minio_dist_erasure) )

    (cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
    rv=$?
@@ -144,7 +224,7 @@ function run_test_dist()
        cat "$WORK_DIR/dist-minio-9003.log"
    fi

-    rm -f "$WORK_DIR/dist-minio-9000.log" "$WORK_DIR/dist-minio-9001.log" "$WORK_DIR/dist-minio-9002.log" "$WORK_DIR/dist-minio-9003.log" 
+    rm -f "$WORK_DIR/dist-minio-9000.log" "$WORK_DIR/dist-minio-9001.log" "$WORK_DIR/dist-minio-9002.log" "$WORK_DIR/dist-minio-9003.log"

   return "$rv"
 }
@@ -207,15 +287,29 @@ function main()
        exit 1
    fi

-    echo "Testing in XL setup"
-    if ! run_test_xl; then
+    echo "Testing in Erasure setup"
+    if ! run_test_erasure; then
        echo "FAILED"
        rm -fr "$WORK_DIR"
        exit 1
    fi

-    echo "Testing in Distribute XL setup"
-    if ! run_test_dist; then
+    echo "Testing in Distributed Erasure setup"
+    if ! run_test_dist_erasure; then
+        echo "FAILED"
+        rm -fr "$WORK_DIR"
+        exit 1
+    fi
+
+    echo "Testing in Erasure setup as sets"
+    if ! run_test_erasure_sets; then
+        echo "FAILED"
+        rm -fr "$WORK_DIR"
+        exit 1
+    fi
+
+    echo "Testing in Distributed Erasure setup as sets"
+    if ! run_test_dist_erasure_sets; then
        echo "FAILED"
        rm -fr "$WORK_DIR"
        exit 1
@@ -0,0 +1,654 @@
+/*
+ * Minio Cloud Storage, (C) 2017 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/minio/minio/pkg/madmin"
+)
+
+// healStatusSummary - overall short summary of a healing sequence
+type healStatusSummary string
+
+// healStatusSummary constants
+const (
+	healNotStartedStatus healStatusSummary = "not started"
+	healRunningStatus                      = "running"
+	healStoppedStatus                      = "stopped"
+	healFinishedStatus                     = "finished"
+)
+
+const (
+	// a heal sequence with this many un-consumed heal result
+	// items blocks until heal-status consumption resumes or is
+	// aborted due to timeout.
+	maxUnconsumedHealResultItems = 1000
+
+	// if no heal-results are consumed (via the heal-status API)
+	// for this timeout duration, the heal sequence is aborted.
+	healUnconsumedTimeout = 24 * time.Hour
+
+	// time-duration to keep heal sequence state after it
+	// completes.
+	keepHealSeqStateDuration = time.Minute * 10
+)
+
+var (
+	errHealIdleTimeout      = fmt.Errorf("healing results were not consumed for too long")
+	errHealPushStopNDiscard = fmt.Errorf("heal push stopped due to heal stop signal")
+	errHealStopSignalled    = fmt.Errorf("heal stop signalled")
+
+	errFnHealFromAPIErr = func(err error) error {
+		errCode := toAPIErrorCode(err)
+		apiErr := getAPIError(errCode)
+		return fmt.Errorf("Heal internal error: %s: %s",
+			apiErr.Code, apiErr.Description)
+	}
+)
+
+// healSequenceStatus - accumulated status of the heal sequence
+type healSequenceStatus struct {
+	// lock to update this structure as it is concurrently
+	// accessed
+	updateLock *sync.RWMutex
+
+	// summary and detail for failures
+	Summary       healStatusSummary `json:"Summary"`
+	FailureDetail string            `json:"Detail,omitempty"`
+	StartTime     time.Time         `json:"StartTime"`
+
+	// disk information
+	NumDisks int `json:"NumDisks"`
+
+	// settings for the heal sequence
+	HealSettings madmin.HealOpts `json:"Settings"`
+
+	// slice of available heal result records
+	Items []madmin.HealResultItem `json:"Items"`
+}
+
+// structure to hold state of all heal sequences in server memory
+type allHealState struct {
+	sync.Mutex
+
+	// map of heal path to heal sequence
+	healSeqMap map[string]*healSequence
+}
+
+var (
+	// global server heal state
+	globalAllHealState allHealState
+)
+
+// initAllHealState - initialize healing apparatus
+func initAllHealState(isErasureMode bool) {
+	if !isErasureMode {
+		return
+	}
+
+	globalAllHealState = allHealState{
+		healSeqMap: make(map[string]*healSequence),
+	}
+}
+
+// getHealSequence - Retrieve a heal sequence by path. The second
+// argument returns if a heal sequence actually exists.
+func (ahs *allHealState) getHealSequence(path string) (h *healSequence, exists bool) {
+	ahs.Lock()
+	defer ahs.Unlock()
+	h, exists = ahs.healSeqMap[path]
+	return h, exists
+}
+
+// LaunchNewHealSequence - launches a background routine that performs
+// healing according to the healSequence argument. For each heal
+// sequence, state is stored in the `globalAllHealState`, which is a
+// map of the heal path to `healSequence` which holds state about the
+// heal sequence.
+//
+// Heal results are persisted in server memory for
+// `keepHealSeqStateDuration`. This function also launches a
+// background routine to clean up heal results after the
+// aforementioned duration.
+func (ahs *allHealState) LaunchNewHealSequence(h *healSequence) (
+	respBytes []byte, errCode APIErrorCode, errMsg string) {
+
+	existsAndLive := false
+	he, exists := ahs.getHealSequence(h.path)
+	if exists {
+		if !he.hasEnded() || len(he.currentStatus.Items) > 0 {
+			existsAndLive = true
+		}
+	}
+	if existsAndLive {
+		// A heal sequence exists on the given path.
+		if h.forceStarted {
+			// stop the running heal sequence - wait for
+			// it to finish.
+			he.stop()
+			for !he.hasEnded() {
+				time.Sleep(10 * time.Second)
+			}
+		} else {
+			errMsg = "Heal is already running on the given path " +
+				"(use force-start option to stop and start afresh). " +
+				fmt.Sprintf("The heal was started by IP %s at %s",
+					h.clientAddress, h.startTime)
+
+			return nil, ErrHealAlreadyRunning, errMsg
+		}
+	}
+
+	ahs.Lock()
+	defer ahs.Unlock()
+
+	// Check if new heal sequence to be started overlaps with any
+	// existing, running sequence
+	for k, hSeq := range ahs.healSeqMap {
+		if !hSeq.hasEnded() && (strings.HasPrefix(k, h.path) ||
+			strings.HasPrefix(h.path, k)) {
+
+			errMsg = "The provided heal sequence path overlaps with an existing " +
+				fmt.Sprintf("heal path: %s", k)
+			return nil, ErrHealOverlappingPaths, errMsg
+		}
+	}
+
+	// Add heal state and start sequence
+	ahs.healSeqMap[h.path] = h
+
+	// Launch top-level background heal go-routine
+	go h.healSequenceStart()
+
+	// Launch clean-up routine to remove this heal sequence (after
+	// it ends) from the global state after timeout has elapsed.
+	go func() {
+		var keepStateTimeout <-chan time.Time
+		ticker := time.NewTicker(time.Minute)
+		defer ticker.Stop()
+		everyMinute := ticker.C
+		for {
+			select {
+			// Check every minute if heal sequence has ended.
+			case <-everyMinute:
+				if h.hasEnded() {
+					keepStateTimeout = time.After(keepHealSeqStateDuration)
+					everyMinute = nil
+				}
+
+			// This case does not fire until the heal
+			// sequence completes.
+			case <-keepStateTimeout:
+				// Heal sequence has ended, keep
+				// results state duration has elapsed,
+				// so purge state.
+				ahs.Lock()
+				defer ahs.Unlock()
+				delete(ahs.healSeqMap, h.path)
+				return
+
+			case <-globalServiceDoneCh:
+				// server could be restarting - need
+				// to exit immediately
+				return
+			}
+		}
+	}()
+
+	b, err := json.Marshal(madmin.HealStartSuccess{
+		h.clientToken,
+		h.clientAddress,
+		h.startTime,
+	})
+	if err != nil {
+		errorIf(err, "Failed to marshal heal result into json.")
+		return nil, ErrInternalError, ""
+	}
+	return b, ErrNone, ""
+}
+
+// PopHealStatusJSON - Called by heal-status API. It fetches the heal
+// status results from global state and returns its JSON
+// representation. The clientToken helps ensure there aren't
+// conflicting clients fetching status.
+func (ahs *allHealState) PopHealStatusJSON(path string,
+	clientToken string) ([]byte, APIErrorCode) {
+
+	// fetch heal state for given path
+	h, exists := ahs.getHealSequence(path)
+	if !exists {
+		// If there is no such heal sequence, return error.
+		return nil, ErrHealNoSuchProcess
+	}
+
+	// Check if client-token is valid
+	if clientToken != h.clientToken {
+		return nil, ErrHealInvalidClientToken
+	}
+
+	// Take lock to access and update the heal-sequence
+	h.currentStatus.updateLock.Lock()
+	defer h.currentStatus.updateLock.Unlock()
+
+	numItems := len(h.currentStatus.Items)
+
+	// calculate index of most recently available heal result
+	// record.
+	lastResultIndex := h.lastSentResultIndex
+	if numItems > 0 {
+		lastResultIndex = h.currentStatus.Items[numItems-1].ResultIndex
+	}
+
+	// After sending status to client, and before relinquishing
+	// the updateLock, reset Item to nil and record the result
+	// index sent to the client.
+	defer func(i int64) {
+		h.lastSentResultIndex = i
+		h.currentStatus.Items = nil
+	}(lastResultIndex)
+
+	jbytes, err := json.Marshal(h.currentStatus)
+	if err != nil {
+		errorIf(err, "Failed to marshal heal result into json.")
+		return nil, ErrInternalError
+	}
+
+	return jbytes, ErrNone
+}
+
+// healSequence - state for each heal sequence initiated on the
+// server.
+type healSequence struct {
+	// bucket, and prefix on which heal seq. was initiated
+	bucket, objPrefix string
+
+	// path is just bucket + "/" + objPrefix
+	path string
+
+	// time at which heal sequence was started
+	startTime time.Time
+
+	// Heal client info
+	clientToken, clientAddress string
+
+	// was this heal sequence force started?
+	forceStarted bool
+
+	// heal settings applied to this heal sequence
+	settings madmin.HealOpts
+
+	// current accumulated status of the heal sequence
+	currentStatus healSequenceStatus
+
+	// channel signalled by background routine when traversal has
+	// completed
+	traverseAndHealDoneCh chan error
+
+	// channel to signal heal sequence to stop (e.g. from the
+	// heal-stop API)
+	stopSignalCh chan struct{}
+
+	// the last result index sent to client
+	lastSentResultIndex int64
+}
+
+// NewHealSequence - creates healSettings, assumes bucket and
+// objPrefix are already validated.
+func newHealSequence(bucket, objPrefix, clientAddr string,
+	numDisks int, hs madmin.HealOpts, forceStart bool) *healSequence {
+
+	return &healSequence{
+		bucket:        bucket,
+		objPrefix:     objPrefix,
+		path:          bucket + "/" + objPrefix,
+		startTime:     UTCNow(),
+		clientToken:   mustGetUUID(),
+		clientAddress: clientAddr,
+		forceStarted:  forceStart,
+		settings:      hs,
+		currentStatus: healSequenceStatus{
+			Summary:      healNotStartedStatus,
+			HealSettings: hs,
+			NumDisks:     numDisks,
+			updateLock:   &sync.RWMutex{},
+		},
+		traverseAndHealDoneCh: make(chan error),
+		stopSignalCh:          make(chan struct{}),
+	}
+}
+
+// isQuitting - determines if the heal sequence is quitting (due to an
+// external signal)
+func (h *healSequence) isQuitting() bool {
+	select {
+	case <-h.stopSignalCh:
+		return true
+	default:
+		return false
+	}
+}
+
+// check if the heal sequence has ended
+func (h *healSequence) hasEnded() bool {
+	h.currentStatus.updateLock.RLock()
+	summary := h.currentStatus.Summary
+	h.currentStatus.updateLock.RUnlock()
+	return summary == healStoppedStatus || summary == healFinishedStatus
+}
+
+// stops the heal sequence - safe to call multiple times.
+func (h *healSequence) stop() {
+	select {
+	case <-h.stopSignalCh:
+	default:
+		close(h.stopSignalCh)
+	}
+}
+
+// pushHealResultItem - pushes a heal result item for consumption in
+// the heal-status API. It blocks if there are
+// maxUnconsumedHealResultItems. When it blocks, the heal sequence
+// routine is effectively paused - this happens when the server has
+// accumulated the maximum number of heal records per heal
+// sequence. When the client consumes further records, the heal
+// sequence automatically resumes. The return value indicates if the
+// operation succeeded.
+func (h *healSequence) pushHealResultItem(r madmin.HealResultItem) error {
+
+	// start a timer to keep an upper time limit to find an empty
+	// slot to add the given heal result - if no slot is found it
+	// means that the server is holding the maximum amount of
+	// heal-results in memory and the client has not consumed it
+	// for too long.
+	unconsumedTimer := time.NewTimer(healUnconsumedTimeout)
+	defer func() {
+		// stop the timeout timer so it is garbage collected.
+		if !unconsumedTimer.Stop() {
+			<-unconsumedTimer.C
+		}
+	}()
+
+	var itemsLen int
+	for {
+		h.currentStatus.updateLock.Lock()
+		itemsLen = len(h.currentStatus.Items)
+		if itemsLen == maxUnconsumedHealResultItems {
+			// unlock and wait to check again if we can push
+			h.currentStatus.updateLock.Unlock()
+
+			// wait for a second, or quit if an external
+			// stop signal is received or the
+			// unconsumedTimer fires.
+			select {
+			// Check after a second
+			case <-time.After(time.Second):
+				continue
+
+			case <-h.stopSignalCh:
+				// discard result and return.
+				return errHealPushStopNDiscard
+
+			// Timeout if no results consumed for too
+			// long.
+			case <-unconsumedTimer.C:
+				return errHealIdleTimeout
+
+			}
+		}
+		break
+	}
+
+	// Set the correct result index for the new result item
+	if itemsLen > 0 {
+		r.ResultIndex = 1 + h.currentStatus.Items[itemsLen-1].ResultIndex
+	} else {
+		r.ResultIndex = 1 + h.lastSentResultIndex
+	}
+
+	// append to results
+	h.currentStatus.Items = append(h.currentStatus.Items, r)
+
+	// release lock
+	h.currentStatus.updateLock.Unlock()
+
+	// This is a "safe" point for the heal sequence to quit if
+	// signalled externally.
+	if h.isQuitting() {
+		return errHealStopSignalled
+	}
+
+	return nil
+}
+
+// healSequenceStart - this is the top-level background heal
+// routine. It launches another go-routine that actually traverses
+// on-disk data, checks and heals according to the selected
+// settings. This go-routine itself, (1) monitors the traversal
+// routine for completion, and (2) listens for external stop
+// signals. When either event happens, it sets the finish status for
+// the heal-sequence.
+func (h *healSequence) healSequenceStart() {
+	// Set status as running
+	h.currentStatus.updateLock.Lock()
+	h.currentStatus.Summary = healRunningStatus
+	h.currentStatus.StartTime = UTCNow()
+	h.currentStatus.updateLock.Unlock()
+
+	go h.traverseAndHeal()
+
+	select {
+	case err, ok := <-h.traverseAndHealDoneCh:
+		h.currentStatus.updateLock.Lock()
+		defer h.currentStatus.updateLock.Unlock()
+		// Heal traversal is complete.
+		if ok {
+			// heal traversal had an error.
+			h.currentStatus.Summary = healStoppedStatus
+			h.currentStatus.FailureDetail = err.Error()
+		} else {
+			// heal traversal succeeded.
+			h.currentStatus.Summary = healFinishedStatus
+		}
+
+	case <-h.stopSignalCh:
+		h.currentStatus.updateLock.Lock()
+		h.currentStatus.Summary = healStoppedStatus
+		h.currentStatus.FailureDetail = errHealStopSignalled.Error()
+		h.currentStatus.updateLock.Unlock()
+
+		// drain traverse channel so the traversal
+		// go-routine does not leak.
+		go func() {
+			// Eventually the traversal go-routine closes
+			// the channel and returns, so this go-routine
+			// itself will not leak.
+			<-h.traverseAndHealDoneCh
+		}()
+	}
+}
+
+// traverseAndHeal - traverses on-disk data and performs healing
+// according to settings. At each "safe" point it also checks if an
+// external quit signal has been received and quits if so. Since the
+// healing traversal may be mutating on-disk data when an external
+// quit signal is received, this routine cannot quit immediately and
+// has to wait until a safe point is reached, such as between scanning
+// two objects.
+func (h *healSequence) traverseAndHeal() {
+	var err error
+	checkErr := func(f func() error) {
+		switch {
+		case err != nil:
+			return
+		case h.isQuitting():
+			err = errHealStopSignalled
+			return
+		}
+		err = f()
+	}
+
+	// Start with format healing
+	checkErr(h.healDiskFormat)
+
+	// Heal buckets and objects
+	checkErr(h.healBuckets)
+
+	if err != nil {
+		h.traverseAndHealDoneCh <- err
+	}
+
+	close(h.traverseAndHealDoneCh)
+}
+
+// healDiskFormat - heals format.json, return value indicates if a
+// failure error occurred.
+func (h *healSequence) healDiskFormat() error {
+	// Get current object layer instance.
+	objectAPI := newObjectLayerFn()
+	if objectAPI == nil {
+		return errServerNotInitialized
+	}
+
+	res, err := objectAPI.HealFormat(h.settings.DryRun)
+	if err != nil {
+		return errFnHealFromAPIErr(err)
+	}
+
+	peersReInitFormat(globalAdminPeers, h.settings.DryRun)
+
+	// Push format heal result
+	return h.pushHealResultItem(res)
+}
+
+// healBuckets - check for all buckets heal or just particular bucket.
+func (h *healSequence) healBuckets() error {
+	// 1. If a bucket was specified, heal only the bucket.
+	if h.bucket != "" {
+		return h.healBucket(h.bucket)
+	}
+
+	// Get current object layer instance.
+	objectAPI := newObjectLayerFn()
+	if objectAPI == nil {
+		return errServerNotInitialized
+	}
+
+	buckets, err := objectAPI.ListBucketsHeal()
+	if err != nil {
+		return errFnHealFromAPIErr(err)
+	}
+
+	for _, bucket := range buckets {
+		if err = h.healBucket(bucket.Name); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// healBucket - traverses and heals given bucket
+func (h *healSequence) healBucket(bucket string) error {
+	if h.isQuitting() {
+		return errHealStopSignalled
+	}
+
+	// Get current object layer instance.
+	objectAPI := newObjectLayerFn()
+	if objectAPI == nil {
+		return errServerNotInitialized
+	}
+
+	bucketLock := globalNSMutex.NewNSLock(bucket, "")
+	if err := bucketLock.GetLock(globalHealingTimeout); err != nil {
+		return err
+	}
+
+	results, err := objectAPI.HealBucket(bucket, h.settings.DryRun)
+	// push any available results before checking for error
+	for _, result := range results {
+		if perr := h.pushHealResultItem(result); perr != nil {
+			bucketLock.Unlock()
+			return perr
+		}
+	}
+	bucketLock.Unlock()
+	// handle heal-bucket error
+	if err != nil {
+		return err
+	}
+
+	if !h.settings.Recursive {
+		if h.objPrefix != "" {
+			// Check if an object named as the objPrefix exists,
+			// and if so heal it.
+			_, err = objectAPI.GetObjectInfo(bucket, h.objPrefix)
+			if err == nil {
+				err = h.healObject(bucket, h.objPrefix)
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	}
+
+	marker := ""
+	isTruncated := true
+	for isTruncated {
+		objectInfos, err := objectAPI.ListObjectsHeal(bucket,
+			h.objPrefix, marker, "", 1000)
+		if err != nil {
+			return errFnHealFromAPIErr(err)
+		}
+
+		for _, o := range objectInfos.Objects {
+			if err := h.healObject(o.Bucket, o.Name); err != nil {
+				return err
+			}
+		}
+
+		isTruncated = objectInfos.IsTruncated
+		marker = objectInfos.NextMarker
+	}
+	return nil
+}
+
+// healObject - heal the given object and record result
+func (h *healSequence) healObject(bucket, object string) error {
+	if h.isQuitting() {
+		return errHealStopSignalled
+	}
+
+	// Get current object layer instance.
+	objectAPI := newObjectLayerFn()
+	if objectAPI == nil {
+		return errServerNotInitialized
+	}
+
+	hri, err := objectAPI.HealObject(bucket, object, h.settings.DryRun)
+	if err != nil {
+		hri.Detail = err.Error()
+	}
+	return h.pushHealResultItem(hri)
+}
@@ -16,7 +16,15 @@

 package cmd

-import router "github.com/gorilla/mux"
+import (
+	"net/http"
+
+	router "github.com/gorilla/mux"
+)
+
+const (
+	adminAPIPathPrefix = "/minio/admin"
+)

 // adminAPIHandlers provides HTTP handlers for Minio admin API.
 type adminAPIHandlers struct {
@@ -27,50 +35,44 @@ func registerAdminRouter(mux *router.Router) {

 	adminAPI := adminAPIHandlers{}
 	// Admin router
-	adminRouter := mux.NewRoute().PathPrefix("/").Subrouter()
+	adminRouter := mux.NewRoute().PathPrefix(adminAPIPathPrefix).Subrouter()
+
+	// Version handler
+	adminRouter.Methods(http.MethodGet).Path("/version").HandlerFunc(adminAPI.VersionHandler)
+
+	adminV1Router := adminRouter.PathPrefix("/v1").Subrouter()

 	/// Service operations

 	// Service status
-	adminRouter.Methods("GET").Queries("service", "").Headers(minioAdminOpHeader, "status").HandlerFunc(adminAPI.ServiceStatusHandler)
+	adminV1Router.Methods(http.MethodGet).Path("/service").HandlerFunc(adminAPI.ServiceStatusHandler)

-	// Service restart
-	adminRouter.Methods("POST").Queries("service", "").Headers(minioAdminOpHeader, "restart").HandlerFunc(adminAPI.ServiceRestartHandler)
-	// Service update credentials
-	adminRouter.Methods("POST").Queries("service", "").Headers(minioAdminOpHeader, "set-credentials").HandlerFunc(adminAPI.ServiceCredentialsHandler)
+	// Service restart and stop - TODO
+	adminV1Router.Methods(http.MethodPost).Path("/service").HandlerFunc(adminAPI.ServiceStopNRestartHandler)

 	// Info operations
-	adminRouter.Methods("GET").Queries("info", "").HandlerFunc(adminAPI.ServerInfoHandler)
+	adminV1Router.Methods(http.MethodGet).Path("/info").HandlerFunc(adminAPI.ServerInfoHandler)

 	/// Lock operations

 	// List Locks
-	adminRouter.Methods("GET").Queries("lock", "").Headers(minioAdminOpHeader, "list").HandlerFunc(adminAPI.ListLocksHandler)
+	adminV1Router.Methods(http.MethodGet).Path("/locks").HandlerFunc(adminAPI.ListLocksHandler)
 	// Clear locks
-	adminRouter.Methods("POST").Queries("lock", "").Headers(minioAdminOpHeader, "clear").HandlerFunc(adminAPI.ClearLocksHandler)
+	adminV1Router.Methods(http.MethodDelete).Path("/locks").HandlerFunc(adminAPI.ClearLocksHandler)

 	/// Heal operations

-	// List Objects needing heal.
-	adminRouter.Methods("GET").Queries("heal", "").Headers(minioAdminOpHeader, "list-objects").HandlerFunc(adminAPI.ListObjectsHealHandler)
-	// List Uploads needing heal.
-	adminRouter.Methods("GET").Queries("heal", "").Headers(minioAdminOpHeader, "list-uploads").HandlerFunc(adminAPI.ListUploadsHealHandler)
-	// List Buckets needing heal.
-	adminRouter.Methods("GET").Queries("heal", "").Headers(minioAdminOpHeader, "list-buckets").HandlerFunc(adminAPI.ListBucketsHealHandler)
-
-	// Heal Buckets.
-	adminRouter.Methods("POST").Queries("heal", "").Headers(minioAdminOpHeader, "bucket").HandlerFunc(adminAPI.HealBucketHandler)
-	// Heal Objects.
-	adminRouter.Methods("POST").Queries("heal", "").Headers(minioAdminOpHeader, "object").HandlerFunc(adminAPI.HealObjectHandler)
-	// Heal Format.
-	adminRouter.Methods("POST").Queries("heal", "").Headers(minioAdminOpHeader, "format").HandlerFunc(adminAPI.HealFormatHandler)
-	// Heal Uploads.
-	adminRouter.Methods("POST").Queries("heal", "").Headers(minioAdminOpHeader, "upload").HandlerFunc(adminAPI.HealUploadHandler)
+	// Heal processing endpoint.
+	adminV1Router.Methods(http.MethodPost).Path("/heal/").HandlerFunc(adminAPI.HealHandler)
+	adminV1Router.Methods(http.MethodPost).Path("/heal/{bucket}").HandlerFunc(adminAPI.HealHandler)
+	adminV1Router.Methods(http.MethodPost).Path("/heal/{bucket}/{prefix:.*}").HandlerFunc(adminAPI.HealHandler)

 	/// Config operations

+	// Update credentials
+	adminV1Router.Methods(http.MethodPut).Path("/config/credential").HandlerFunc(adminAPI.UpdateCredentialsHandler)
 	// Get config
-	adminRouter.Methods("GET").Queries("config", "").Headers(minioAdminOpHeader, "get").HandlerFunc(adminAPI.GetConfigHandler)
-	// Set Config
-	adminRouter.Methods("PUT").Queries("config", "").Headers(minioAdminOpHeader, "set").HandlerFunc(adminAPI.SetConfigHandler)
+	adminV1Router.Methods(http.MethodGet).Path("/config").HandlerFunc(adminAPI.GetConfigHandler)
+	// Set config
+	adminV1Router.Methods(http.MethodPut).Path("/config").HandlerFunc(adminAPI.SetConfigHandler)
 }
@@ -23,7 +23,6 @@ import (
 	"os"
 	"path"
 	"path/filepath"
-	"reflect"
 	"sort"
 	"sync"
 	"time"
@@ -34,9 +33,9 @@ import (

 const (
 	// Admin service names
-	serviceRestartRPC = "Admin.Restart"
+	signalServiceRPC  = "Admin.SignalService"
+	reInitFormatRPC   = "Admin.ReInitFormat"
 	listLocksRPC      = "Admin.ListLocks"
-	reInitDisksRPC    = "Admin.ReInitDisks"
 	serverInfoDataRPC = "Admin.ServerInfoData"
 	getConfigRPC      = "Admin.GetConfig"
 	writeTmpConfigRPC = "Admin.WriteTmpConfig"
@@ -56,60 +55,75 @@ type remoteAdminClient struct {
 // adminCmdRunner - abstracts local and remote execution of admin
 // commands like service stop and service restart.
 type adminCmdRunner interface {
-	Restart() error
+	SignalService(s serviceSignal) error
+	ReInitFormat(dryRun bool) error
 	ListLocks(bucket, prefix string, duration time.Duration) ([]VolumeLockInfo, error)
-	ReInitDisks() error
 	ServerInfoData() (ServerInfoData, error)
 	GetConfig() ([]byte, error)
 	WriteTmpConfig(tmpFileName string, configBytes []byte) error
 	CommitConfig(tmpFileName string) error
 }

-// Restart - Sends a message over channel to the go-routine
-// responsible for restarting the process.
-func (lc localAdminClient) Restart() error {
-	globalServiceSignalCh <- serviceRestart
+var errUnsupportedSignal = fmt.Errorf("unsupported signal: only restart and stop signals are supported")
+
+// SignalService - sends a restart or stop signal to the local server
+func (lc localAdminClient) SignalService(s serviceSignal) error {
+	switch s {
+	case serviceRestart, serviceStop:
+		globalServiceSignalCh <- s
+	default:
+		return errUnsupportedSignal
+	}
 	return nil
 }

+// ReInitFormat - re-initialize disk format.
+func (lc localAdminClient) ReInitFormat(dryRun bool) error {
+	objectAPI := newObjectLayerFn()
+	if objectAPI == nil {
+		return errServerNotInitialized
+	}
+	_, err := objectAPI.HealFormat(dryRun)
+	return err
+}
+
 // ListLocks - Fetches lock information from local lock instrumentation.
 func (lc localAdminClient) ListLocks(bucket, prefix string, duration time.Duration) ([]VolumeLockInfo, error) {
 	return listLocksInfo(bucket, prefix, duration), nil
 }

-// Restart - Sends restart command to remote server via RPC.
-func (rc remoteAdminClient) Restart() error {
-	args := AuthRPCArgs{}
+func (rc remoteAdminClient) SignalService(s serviceSignal) (err error) {
+	switch s {
+	case serviceRestart, serviceStop:
+		reply := AuthRPCReply{}
+		err = rc.Call(signalServiceRPC, &SignalServiceArgs{Sig: s},
+			&reply)
+	default:
+		err = errUnsupportedSignal
+	}
+	return err
+}
+
+// ReInitFormat - re-initialize disk format, remotely.
+func (rc remoteAdminClient) ReInitFormat(dryRun bool) error {
 	reply := AuthRPCReply{}
-	return rc.Call(serviceRestartRPC, &args, &reply)
+	return rc.Call(reInitFormatRPC, &ReInitFormatArgs{
+		DryRun: dryRun,
+	}, &reply)
 }

 // ListLocks - Sends list locks command to remote server via RPC.
 func (rc remoteAdminClient) ListLocks(bucket, prefix string, duration time.Duration) ([]VolumeLockInfo, error) {
 	listArgs := ListLocksQuery{
-		bucket:   bucket,
-		prefix:   prefix,
-		duration: duration,
+		Bucket:   bucket,
+		Prefix:   prefix,
+		Duration: duration,
 	}
 	var reply ListLocksReply
 	if err := rc.Call(listLocksRPC, &listArgs, &reply); err != nil {
 		return nil, err
 	}
-	return reply.volLocks, nil
-}
-
-// ReInitDisks - There is nothing to do here, heal format REST API
-// handler has already formatted and reinitialized the local disks.
-func (lc localAdminClient) ReInitDisks() error {
-	return nil
-}
-
-// ReInitDisks - Signals peers via RPC to reinitialize their disks and
-// object layer.
-func (rc remoteAdminClient) ReInitDisks() error {
-	args := AuthRPCArgs{}
-	reply := AuthRPCReply{}
-	return rc.Call(reInitDisksRPC, &args, &reply)
+	return reply.VolLocks, nil
 }

 // ServerInfoData - Returns the server info of this server.
@@ -225,10 +239,11 @@ func (rc remoteAdminClient) CommitConfig(tmpFileName string) error {
 	return nil
 }

-// adminPeer - represents an entity that implements Restart methods.
+// adminPeer - represents an entity that implements admin API RPCs.
 type adminPeer struct {
 	addr      string
 	cmdRunner adminCmdRunner
+	isLocal   bool
 }

 // type alias for a collection of adminPeer.
@@ -243,6 +258,7 @@ func makeAdminPeers(endpoints EndpointList) (adminPeerList adminPeers) {
 	adminPeerList = append(adminPeerList, adminPeer{
 		thisPeer,
 		localAdminClient{},
+		true,
 	})

 	hostSet := set.CreateStringSet(globalMinioAddr)
@@ -269,16 +285,36 @@ func makeAdminPeers(endpoints EndpointList) (adminPeerList adminPeers) {
 	return adminPeerList
 }

+// peersReInitFormat - reinitialize remote object layers to new format.
+func peersReInitFormat(peers adminPeers, dryRun bool) error {
+	errs := make([]error, len(peers))
+
+	// Send ReInitFormat RPC call to all nodes.
+	// for local adminPeer this is a no-op.
+	wg := sync.WaitGroup{}
+	for i, peer := range peers {
+		wg.Add(1)
+		go func(idx int, peer adminPeer) {
+			defer wg.Done()
+			if !peer.isLocal {
+				errs[idx] = peer.cmdRunner.ReInitFormat(dryRun)
+			}
+		}(i, peer)
+	}
+	wg.Wait()
+	return nil
+}
+
 // Initialize global adminPeer collection.
 func initGlobalAdminPeers(endpoints EndpointList) {
 	globalAdminPeers = makeAdminPeers(endpoints)
 }

-// invokeServiceCmd - Invoke Restart command.
+// invokeServiceCmd - Invoke Restart/Stop command.
 func invokeServiceCmd(cp adminPeer, cmd serviceSignal) (err error) {
 	switch cmd {
-	case serviceRestart:
-		err = cp.cmdRunner.Restart()
+	case serviceRestart, serviceStop:
+		err = cp.cmdRunner.SignalService(cmd)
 	}
 	return err
 }
@@ -352,24 +388,6 @@ func listPeerLocksInfo(peers adminPeers, bucket, prefix string, duration time.Du
 	return groupedLockInfos, nil
 }

-// reInitPeerDisks - reinitialize disks and object layer on peer servers to use the new format.
-func reInitPeerDisks(peers adminPeers) error {
-	errs := make([]error, len(peers))
-
-	// Send ReInitDisks RPC call to all nodes.
-	// for local adminPeer this is a no-op.
-	wg := sync.WaitGroup{}
-	for i, peer := range peers {
-		wg.Add(1)
-		go func(idx int, peer adminPeer) {
-			defer wg.Done()
-			errs[idx] = peer.cmdRunner.ReInitDisks()
-		}(i, peer)
-	}
-	wg.Wait()
-	return nil
-}
-
 // uptimeSlice - used to sort uptimes in chronological order.
 type uptimeSlice []struct {
 	err    error
@@ -466,7 +484,7 @@ func getPeerConfig(peers adminPeers) ([]byte, error) {
 	// Find the maximally occurring config among peers in a
 	// distributed setup.

-	serverConfigs := make([]serverConfigV13, len(peers))
+	serverConfigs := make([]serverConfig, len(peers))
 	for i, configBytes := range configs {
 		if errs[i] != nil {
 			continue
@@ -493,7 +511,7 @@ func getPeerConfig(peers adminPeers) ([]byte, error) {

 // getValidServerConfig - finds the server config that is present in
 // quorum or more number of servers.
-func getValidServerConfig(serverConfigs []serverConfigV13, errs []error) (scv serverConfigV13, e error) {
+func getValidServerConfig(serverConfigs []serverConfig, errs []error) (scv serverConfig, e error) {
 	// majority-based quorum
 	quorum := len(serverConfigs)/2 + 1

@@ -536,7 +554,7 @@ func getValidServerConfig(serverConfigs []serverConfigV13, errs []error) (scv se
 				// seen. See example above for
 				// clarity.
 				continue
-			} else if j < i && reflect.DeepEqual(serverConfigs[i], serverConfigs[j]) {
+			} else if j < i && serverConfigs[i].ConfigDiff(&serverConfigs[j]) == "" {
 				// serverConfigs[i] is equal to
 				// serverConfigs[j], update
 				// serverConfigs[j]'s counter since it
@@ -555,7 +573,7 @@ func getValidServerConfig(serverConfigs []serverConfigV13, errs []error) (scv se

 	// We find the maximally occurring server config and check if
 	// there is quorum.
-	var configJSON serverConfigV13
+	var configJSON serverConfig
 	maxOccurrence := 0
 	for i, count := range configCounter {
 		if maxOccurrence < count {
@@ -220,7 +220,7 @@ var (

 // TestGetValidServerConfig - test for getValidServerConfig.
 func TestGetValidServerConfig(t *testing.T) {
-	var c1, c2 serverConfigV13
+	var c1, c2 serverConfig
 	err := json.Unmarshal(config1, &c1)
 	if err != nil {
 		t.Fatalf("json unmarshal of %s failed: %v", string(config1), err)
@@ -233,7 +233,7 @@ func TestGetValidServerConfig(t *testing.T) {

 	// Valid config.
 	noErrs := []error{nil, nil, nil, nil}
-	serverConfigs := []serverConfigV13{c1, c2, c1, c1}
+	serverConfigs := []serverConfig{c1, c2, c1, c1}
 	validConfig, err := getValidServerConfig(serverConfigs, noErrs)
 	if err != nil {
 		t.Errorf("Expected a valid config but received %v instead", err)
@@ -244,7 +244,7 @@ func TestGetValidServerConfig(t *testing.T) {
 	}

 	// Invalid config - no quorum.
-	serverConfigs = []serverConfigV13{c1, c2, c2, c1}
+	serverConfigs = []serverConfig{c1, c2, c2, c1}
 	_, err = getValidServerConfig(serverConfigs, noErrs)
 	if err != errXLWriteQuorum {
 		t.Errorf("Expected to fail due to lack of quorum but received %v", err)
@@ -252,7 +252,7 @@ func TestGetValidServerConfig(t *testing.T) {

 	// All errors
 	allErrs := []error{errDiskNotFound, errDiskNotFound, errDiskNotFound, errDiskNotFound}
-	serverConfigs = []serverConfigV13{{}, {}, {}, {}}
+	serverConfigs = []serverConfig{{}, {}, {}, {}}
 	_, err = getValidServerConfig(serverConfigs, allErrs)
 	if err != errXLWriteQuorum {
 		t.Errorf("Expected to fail due to lack of quorum but received %v", err)
@@ -30,26 +30,30 @@ import (

 const adminPath = "/admin"

-var errUnsupportedBackend = fmt.Errorf("not supported for non erasure-code backend")
-
 // adminCmd - exports RPC methods for service status, stop and
 // restart commands.
 type adminCmd struct {
 	AuthRPCServer
 }

+// SignalServiceArgs - provides the signal argument to SignalService RPC
+type SignalServiceArgs struct {
+	AuthRPCArgs
+	Sig serviceSignal
+}
+
 // ListLocksQuery - wraps ListLocks API's query values to send over RPC.
 type ListLocksQuery struct {
 	AuthRPCArgs
-	bucket   string
-	prefix   string
-	duration time.Duration
+	Bucket   string
+	Prefix   string
+	Duration time.Duration
 }

 // ListLocksReply - wraps ListLocks response over RPC.
 type ListLocksReply struct {
 	AuthRPCReply
-	volLocks []VolumeLockInfo
+	VolLocks []VolumeLockInfo
 }

 // ServerInfoDataReply - wraps the server info response over RPC.
@@ -64,64 +68,38 @@ type ConfigReply struct {
 	Config []byte // json-marshalled bytes of serverConfigV13
 }

-// Restart - Restart this instance of minio server.
-func (s *adminCmd) Restart(args *AuthRPCArgs, reply *AuthRPCReply) error {
+// SignalService - Send a restart or stop signal to the service
+func (s *adminCmd) SignalService(args *SignalServiceArgs, reply *AuthRPCReply) error {
 	if err := args.IsAuthenticated(); err != nil {
 		return err
 	}

-	globalServiceSignalCh <- serviceRestart
+	globalServiceSignalCh <- args.Sig
 	return nil
 }

+// ReInitFormatArgs - provides dry-run information to re-initialize format.json
+type ReInitFormatArgs struct {
+	AuthRPCArgs
+	DryRun bool
+}
+
+// ReInitFormat - re-init 'format.json'
+func (s *adminCmd) ReInitFormat(args *ReInitFormatArgs, reply *AuthRPCReply) error {
+	if err := args.IsAuthenticated(); err != nil {
+		return err
+	}
+	_, err := newObjectLayerFn().HealFormat(args.DryRun)
+	return err
+}
+
 // ListLocks - lists locks held by requests handled by this server instance.
 func (s *adminCmd) ListLocks(query *ListLocksQuery, reply *ListLocksReply) error {
 	if err := query.IsAuthenticated(); err != nil {
 		return err
 	}
-	volLocks := listLocksInfo(query.bucket, query.prefix, query.duration)
-	*reply = ListLocksReply{volLocks: volLocks}
-	return nil
-}
-
-// ReInitDisk - reinitialize storage disks and object layer to use the
-// new format.
-func (s *adminCmd) ReInitDisks(args *AuthRPCArgs, reply *AuthRPCReply) error {
-	if err := args.IsAuthenticated(); err != nil {
-		return err
-	}
-
-	if !globalIsXL {
-		return errUnsupportedBackend
-	}
-
-	// Get the current object layer instance.
-	objLayer := newObjectLayerFn()
-
-	// Initialize new disks to include the newly formatted disks.
-	bootstrapDisks, err := initStorageDisks(globalEndpoints)
-	if err != nil {
-		return err
-	}
-
-	// Wrap into retrying disks
-	retryingDisks := initRetryableStorageDisks(bootstrapDisks,
-		time.Millisecond, time.Millisecond*5, globalStorageHealthCheckInterval, globalStorageRetryThreshold)
-
-	// Initialize new object layer with newly formatted disks.
-	newObjectAPI, err := newXLObjects(retryingDisks)
-	if err != nil {
-		return err
-	}
-
-	// Replace object layer with newly formatted storage.
-	globalObjLayerMutex.Lock()
-	globalObjectAPI = newObjectAPI
-	globalObjLayerMutex.Unlock()
-
-	// Shutdown storage belonging to old object layer instance.
-	objLayer.Shutdown()
-
+	volLocks := listLocksInfo(query.Bucket, query.Prefix, query.Duration)
+	*reply = ListLocksReply{VolLocks: volLocks}
 	return nil
 }

@@ -23,8 +23,8 @@ import (
 )

 func testAdminCmd(cmd cmdType, t *testing.T) {
-	// reset globals.
-	// this is to make sure that the tests are not affected by modified globals.
+	// reset globals. this is to make sure that the tests are not
+	// affected by modified globals.
 	resetTestGlobals()

 	rootPath, err := newTestConfig(globalMinioDefaultRegion)
@@ -42,7 +42,7 @@ func testAdminCmd(cmd cmdType, t *testing.T) {
 	adminServer := adminCmd{}
 	args := LoginRPCArgs{
 		AuthToken:   token,
-		Version:     Version,
+		Version:     globalRPCAPIVersion,
 		RequestTime: UTCNow(),
 	}
 	err = adminServer.Login(&args, &LoginRPCReply{})
@@ -55,12 +55,23 @@ func testAdminCmd(cmd cmdType, t *testing.T) {
 		<-globalServiceSignalCh
 	}()

-	ga := AuthRPCArgs{AuthToken: token}
+	sa := SignalServiceArgs{
+		AuthRPCArgs: AuthRPCArgs{AuthToken: token, Version: globalRPCAPIVersion},
+		Sig:         cmd.toServiceSignal(),
+	}
+
 	genReply := AuthRPCReply{}
 	switch cmd {
-	case restartCmd:
-		if err = adminServer.Restart(&ga, &genReply); err != nil {
-			t.Errorf("restartCmd: Expected: <nil>, got: %v", err)
+	case restartCmd, stopCmd:
+		if err = adminServer.SignalService(&sa, &genReply); err != nil {
+			t.Errorf("restartCmd/stopCmd: Expected: <nil>, got: %v",
+				err)
+		}
+	default:
+		err = adminServer.SignalService(&sa, &genReply)
+		if err != nil && err.Error() != errUnsupportedSignal.Error() {
+			t.Errorf("invalidSignal %s: unexpected error got: %v",
+				cmd, err)
 		}
 	}
 }
@@ -70,8 +81,18 @@ func TestAdminRestart(t *testing.T) {
 	testAdminCmd(restartCmd, t)
 }

-// TestReInitDisks - test for Admin.ReInitDisks RPC service.
-func TestReInitDisks(t *testing.T) {
+// TestAdminStop - test for Admin.Stop RPC service.
+func TestAdminStop(t *testing.T) {
+	testAdminCmd(stopCmd, t)
+}
+
+// TestAdminStatus - test for Admin.Status RPC service (error case)
+func TestAdminStatus(t *testing.T) {
+	testAdminCmd(statusCmd, t)
+}
+
+// TestReInitFormat - test for Admin.ReInitFormat RPC service.
+func TestReInitFormat(t *testing.T) {
 	// Reset global variables to start afresh.
 	resetTestGlobals()

@@ -103,7 +124,7 @@ func TestReInitDisks(t *testing.T) {

 	args := LoginRPCArgs{
 		AuthToken:   token,
-		Version:     Version,
+		Version:     globalRPCAPIVersion,
 		RequestTime: UTCNow(),
 	}
 	err = adminServer.Login(&args, &LoginRPCReply{})
@@ -113,42 +134,17 @@ func TestReInitDisks(t *testing.T) {

 	authArgs := AuthRPCArgs{
 		AuthToken: token,
+		Version:   globalRPCAPIVersion,
 	}
 	authReply := AuthRPCReply{}

-	err = adminServer.ReInitDisks(&authArgs, &authReply)
+	err = adminServer.ReInitFormat(&ReInitFormatArgs{
+		AuthRPCArgs: authArgs,
+		DryRun:      false,
+	}, &authReply)
 	if err != nil {
 		t.Errorf("Expected to pass, but failed with %v", err)
 	}
-
-	token, err = authenticateNode(creds.AccessKey, creds.SecretKey)
-	if err != nil {
-		t.Fatal(err)
-	}
-	// Negative test case with admin rpc server setup for FS.
-	globalIsXL = false
-	fsAdminServer := adminCmd{}
-	fsArgs := LoginRPCArgs{
-		AuthToken:   token,
-		Version:     Version,
-		RequestTime: UTCNow(),
-	}
-	fsReply := LoginRPCReply{}
-	err = fsAdminServer.Login(&fsArgs, &fsReply)
-	if err != nil {
-		t.Fatalf("Failed to login to fs admin server - %v", err)
-	}
-
-	authArgs = AuthRPCArgs{
-		AuthToken: token,
-	}
-	authReply = AuthRPCReply{}
-	// Attempt ReInitDisks service on a FS backend.
-	err = fsAdminServer.ReInitDisks(&authArgs, &authReply)
-	if err != errUnsupportedBackend {
-		t.Errorf("Expected to fail with %v, but received %v",
-			errUnsupportedBackend, err)
-	}
 }

 // TestGetConfig - Test for GetConfig admin RPC.
@@ -172,7 +168,7 @@ func TestGetConfig(t *testing.T) {

 	args := LoginRPCArgs{
 		AuthToken:   token,
-		Version:     Version,
+		Version:     globalRPCAPIVersion,
 		RequestTime: UTCNow(),
 	}
 	reply := LoginRPCReply{}
@@ -183,6 +179,7 @@ func TestGetConfig(t *testing.T) {

 	authArgs := AuthRPCArgs{
 		AuthToken: token,
+		Version:   globalRPCAPIVersion,
 	}

 	configReply := ConfigReply{}
@@ -219,7 +216,7 @@ func TestWriteAndCommitConfig(t *testing.T) {
 	}
 	args := LoginRPCArgs{
 		AuthToken:   token,
-		Version:     Version,
+		Version:     globalRPCAPIVersion,
 		RequestTime: UTCNow(),
 	}
 	reply := LoginRPCReply{}
@@ -234,6 +231,7 @@ func TestWriteAndCommitConfig(t *testing.T) {
 	wArgs := WriteConfigArgs{
 		AuthRPCArgs: AuthRPCArgs{
 			AuthToken: token,
+			Version:   globalRPCAPIVersion,
 		},
 		TmpFileName: tmpFileName,
 		Buf:         buf,
@@ -251,6 +249,7 @@ func TestWriteAndCommitConfig(t *testing.T) {
 	cArgs := CommitConfigArgs{
 		AuthRPCArgs: AuthRPCArgs{
 			AuthToken: token,
+			Version:   globalRPCAPIVersion,
 		},
 		FileName: tmpFileName,
 	}
@@ -18,6 +18,7 @@ package cmd

 import (
 	"encoding/xml"
+	"fmt"
 	"net/http"

 	"github.com/minio/minio/pkg/auth"
@@ -40,8 +41,8 @@ type APIErrorResponse struct {
 	Key        string
 	BucketName string
 	Resource   string
-	RequestID  string `xml:"RequestId"`
-	HostID     string `xml:"HostId"`
+	RequestID  string `xml:"RequestId" json:"RequestId"`
+	HostID     string `xml:"HostId" json:"HostId"`
 }

 // APIErrorCode type of error status.
@@ -123,10 +124,12 @@ const (
 	ErrUnsupportedMetadata
 	ErrMaximumExpires
 	ErrSlowDown
+	ErrInvalidPrefixMarker
 	// Add new error codes here.

 	// Server-Side-Encryption (with Customer provided key) related API errors.
 	ErrInsecureSSECustomerRequest
+	ErrSSEMultipartEncrypted
 	ErrSSEEncryptedObject
 	ErrInvalidEncryptionParameters
 	ErrInvalidSSECustomerAlgorithm
@@ -156,6 +159,7 @@ const (
 	ErrReadQuorum
 	ErrWriteQuorum
 	ErrStorageFull
+	ErrRequestBodyParse
 	ErrObjectExistsAsDirectory
 	ErrPolicyNesting
 	ErrInvalidObjectName
@@ -172,12 +176,21 @@ const (
 	// Please open a https://github.com/minio/minio/issues before adding
 	// new error codes here.

+	ErrMalformedJSON
 	ErrAdminInvalidAccessKey
 	ErrAdminInvalidSecretKey
 	ErrAdminConfigNoQuorum
+	ErrAdminConfigTooLarge
+	ErrAdminConfigBadJSON
 	ErrAdminCredentialsMismatch
 	ErrInsecureClientRequest
 	ErrObjectTampered
+	ErrHealNotImplemented
+	ErrHealNoSuchProcess
+	ErrHealInvalidClientToken
+	ErrHealMissingBucket
+	ErrHealAlreadyRunning
+	ErrHealOverlappingPaths
 )

 // error code to APIError structure, these fields carry respective
@@ -520,6 +533,12 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		Description:    "Please reduce your request",
 		HTTPStatusCode: http.StatusServiceUnavailable,
 	},
+	ErrInvalidPrefixMarker: {
+		Code:           "InvalidPrefixMarker",
+		Description:    "Invalid marker prefix combination",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+
 	// FIXME: Actual XML error response also contains the header which missed in list of signed header parameters.
 	ErrUnsignedHeaders: {
 		Code:           "AccessDenied",
@@ -613,6 +632,11 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		Description:    errInsecureSSERequest.Error(),
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrSSEMultipartEncrypted: {
+		Code:           "InvalidRequest",
+		Description:    "The multipart upload initiate requested encryption. Subsequent part requests must include the appropriate encryption parameters.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 	ErrSSEEncryptedObject: {
 		Code:           "InvalidRequest",
 		Description:    errEncryptedObject.Error(),
@@ -662,6 +686,11 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		Description:    "Storage backend has reached its minimum free disk threshold. Please delete a few objects to proceed.",
 		HTTPStatusCode: http.StatusInternalServerError,
 	},
+	ErrRequestBodyParse: {
+		Code:           "XMinioRequestBodyParse",
+		Description:    "The request body failed to parse.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 	ErrObjectExistsAsDirectory: {
 		Code:           "XMinioObjectExistsAsDirectory",
 		Description:    "Object name already exists as a directory.",
@@ -697,6 +726,11 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		Description:    "Server not initialized, please try again.",
 		HTTPStatusCode: http.StatusServiceUnavailable,
 	},
+	ErrMalformedJSON: {
+		Code:           "XMinioMalformedJSON",
+		Description:    "The JSON you provided was not well-formed or did not validate against our published format.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 	ErrAdminInvalidAccessKey: {
 		Code:           "XMinioAdminInvalidAccessKey",
 		Description:    "The access key is invalid.",
@@ -712,6 +746,17 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		Description:    "Configuration update failed because server quorum was not met",
 		HTTPStatusCode: http.StatusServiceUnavailable,
 	},
+	ErrAdminConfigTooLarge: {
+		Code: "XMinioAdminConfigTooLarge",
+		Description: fmt.Sprintf("Configuration data provided exceeds the allowed maximum of %d bytes",
+			maxConfigJSONSize),
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrAdminConfigBadJSON: {
+		Code:           "XMinioAdminConfigBadJSON",
+		Description:    "JSON configuration provided has objects with duplicate keys",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 	ErrAdminCredentialsMismatch: {
 		Code:           "XMinioAdminCredentialsMismatch",
 		Description:    "Credentials in config mismatch with server environment variables",
@@ -755,6 +800,36 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		Description:    "Invalid Request",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrHealNotImplemented: {
+		Code:           "XMinioHealNotImplemented",
+		Description:    "This server does not implement heal functionality.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrHealNoSuchProcess: {
+		Code:           "XMinioHealNoSuchProcess",
+		Description:    "No such heal process is running on the server",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrHealInvalidClientToken: {
+		Code:           "XMinioHealInvalidClientToken",
+		Description:    "Client token mismatch",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrHealMissingBucket: {
+		Code:           "XMinioHealMissingBucket",
+		Description:    "A heal start request with a non-empty object-prefix parameter requires a bucket to be specified.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrHealAlreadyRunning: {
+		Code:           "XMinioHealAlreadyRunning",
+		Description:    "",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrHealOverlappingPaths: {
+		Code:           "XMinioHealOverlappingPaths",
+		Description:    "",
+		HTTPStatusCode: http.StatusBadRequest,
+	},

 	// Add your error structure here.
 }
@@ -18,6 +18,7 @@ package cmd

 import (
 	"bytes"
+	"encoding/json"
 	"encoding/xml"
 	"fmt"
 	"net/http"
@@ -53,6 +54,14 @@ func encodeResponse(response interface{}) []byte {
 	return bytesBuffer.Bytes()
 }

+// Encodes the response headers into JSON format.
+func encodeResponseJSON(response interface{}) []byte {
+	var bytesBuffer bytes.Buffer
+	e := json.NewEncoder(&bytesBuffer)
+	e.Encode(response)
+	return bytesBuffer.Bytes()
+}
+
 // Write object header
 func setObjectHeaders(w http.ResponseWriter, objInfo ObjectInfo, contentRange *httpRange) {
 	// set common headers
@@ -80,6 +89,11 @@ func setObjectHeaders(w http.ResponseWriter, objInfo ObjectInfo, contentRange *h

 	// Set all other user defined metadata.
 	for k, v := range objInfo.UserDefined {
+		if hasPrefix(k, ReservedMetadataPrefix) {
+			// Do not need to send any internal metadata
+			// values to client.
+			continue
+		}
 		w.Header().Set(k, v)
 	}

@@ -22,6 +22,8 @@ import (
 	"net/url"
 	"path"
 	"time"
+
+	"github.com/minio/minio/pkg/handlers"
 )

 const (
@@ -166,13 +168,12 @@ type ListBucketsResponse struct {

 // Upload container for in progress multipart upload
 type Upload struct {
-	Key            string
-	UploadID       string `xml:"UploadId"`
-	Initiator      Initiator
-	Owner          Owner
-	StorageClass   string
-	Initiated      string
-	HealUploadInfo *HealObjectInfo `xml:"HealObjectInfo,omitempty"`
+	Key          string
+	UploadID     string `xml:"UploadId"`
+	Initiator    Initiator
+	Owner        Owner
+	StorageClass string
+	Initiated    string
 }

 // CommonPrefix container for prefix response in ListObjectsResponse
@@ -182,9 +183,8 @@ type CommonPrefix struct {

 // Bucket container for bucket metadata
 type Bucket struct {
-	Name           string
-	CreationDate   string          // time string of format "2006-01-02T15:04:05.000Z"
-	HealBucketInfo *HealBucketInfo `xml:"HealBucketInfo,omitempty"`
+	Name         string
+	CreationDate string // time string of format "2006-01-02T15:04:05.000Z"
 }

 // Object container for object metadata
@@ -198,8 +198,7 @@ type Object struct {
 	Owner Owner

 	// The class of storage used to store the object.
-	StorageClass   string
-	HealObjectInfo *HealObjectInfo `xml:"HealObjectInfo,omitempty"`
+	StorageClass string
 }

 // CopyObjectResponse container returns ETag and LastModified of the successfully copied object
@@ -284,15 +283,21 @@ func getURLScheme(tls bool) string {
 }

 // getObjectLocation gets the fully qualified URL of an object.
-func getObjectLocation(host, proto, bucket, object string) string {
+func getObjectLocation(r *http.Request, domain, bucket, object string) string {
+	proto := handlers.GetSourceScheme(r)
 	if proto == "" {
 		proto = getURLScheme(globalIsSSL)
 	}
-	u := url.URL{
-		Host:   host,
+	u := &url.URL{
+		Host:   r.Host,
 		Path:   path.Join(slashSeparator, bucket, object),
 		Scheme: proto,
 	}
+	// If domain is set then we need to use bucket DNS style.
+	if domain != "" {
+		u.Host = bucket + "." + domain
+		u.Path = path.Join(slashSeparator, object)
+	}
 	return u.String()
 }

@@ -308,7 +313,6 @@ func generateListBucketsResponse(buckets []BucketInfo) ListBucketsResponse {
 		var listbucket = Bucket{}
 		listbucket.Name = bucket.Name
 		listbucket.CreationDate = bucket.Created.UTC().Format(timeFormatAMZLong)
-		listbucket.HealBucketInfo = bucket.HealBucketInfo
 		listbuckets = append(listbuckets, listbucket)
 	}

@@ -339,8 +343,6 @@ func generateListObjectsV1Response(bucket, prefix, marker, delimiter string, max
 		content.Size = object.Size
 		content.StorageClass = globalMinioDefaultStorageClass
 		content.Owner = owner
-		// object.HealObjectInfo is non-empty only when resp is constructed in ListObjectsHeal.
-		content.HealObjectInfo = object.HealObjectInfo
 		contents = append(contents, content)
 	}
 	// TODO - support EncodingType in xml decoding
@@ -498,7 +500,6 @@ func generateListMultipartUploadsResponse(bucket string, multipartsInfo ListMult
 		newUpload.UploadID = upload.UploadID
 		newUpload.Key = upload.Object
 		newUpload.Initiated = upload.Initiated.UTC().Format(timeFormatAMZLong)
-		newUpload.HealUploadInfo = upload.HealUploadInfo
 		listMultipartUploadsResponse.Uploads[index] = newUpload
 	}
 	return listMultipartUploadsResponse
@@ -584,3 +585,31 @@ func writeErrorResponseHeadersOnly(w http.ResponseWriter, errorCode APIErrorCode
 	apiError := getAPIError(errorCode)
 	writeResponse(w, apiError.HTTPStatusCode, nil, mimeNone)
 }
+
+// writeErrorResponseJSON - writes error response in JSON format;
+// useful for admin APIs.
+func writeErrorResponseJSON(w http.ResponseWriter, errorCode APIErrorCode, reqURL *url.URL) {
+	apiError := getAPIError(errorCode)
+	// Generate error response.
+	errorResponse := getAPIErrorResponse(apiError, reqURL.Path)
+	encodedErrorResponse := encodeResponseJSON(errorResponse)
+	writeResponse(w, apiError.HTTPStatusCode, encodedErrorResponse, mimeJSON)
+}
+
+// writeCustomErrorResponseJSON - similar to writeErrorResponseJSON,
+// but accepts the error message directly (this allows messages to be
+// dynamically generated.)
+func writeCustomErrorResponseJSON(w http.ResponseWriter, errorCode APIErrorCode,
+	errBody string, reqURL *url.URL) {
+
+	apiError := getAPIError(errorCode)
+	errorResponse := APIErrorResponse{
+		Code:      apiError.Code,
+		Message:   errBody,
+		Resource:  reqURL.Path,
+		RequestID: "3L137",
+		HostID:    "3L137",
+	}
+	encodedErrorResponse := encodeResponseJSON(errorResponse)
+	writeResponse(w, apiError.HTTPStatusCode, encodedErrorResponse, mimeJSON)
+}
@@ -17,42 +17,89 @@
 package cmd

 import (
+	"net/http"
 	"testing"
 )

 // Tests object location.
 func TestObjectLocation(t *testing.T) {
 	testCases := []struct {
-		host, proto, bucket, object string
-		expectedLocation            string
+		request          *http.Request
+		bucket, object   string
+		domain           string
+		expectedLocation string
 	}{
 		// Server binding to localhost IP with https.
 		{
-			host:             "127.0.0.1:9000",
-			proto:            httpsScheme,
+			request: &http.Request{
+				Host: "127.0.0.1:9000",
+				Header: map[string][]string{
+					"X-Forwarded-Scheme": {httpScheme},
+				},
+			},
+			bucket:           "testbucket1",
+			object:           "test/1.txt",
+			expectedLocation: "http://127.0.0.1:9000/testbucket1/test/1.txt",
+		},
+		{
+			request: &http.Request{
+				Host: "127.0.0.1:9000",
+				Header: map[string][]string{
+					"X-Forwarded-Scheme": {httpsScheme},
+				},
+			},
 			bucket:           "testbucket1",
 			object:           "test/1.txt",
 			expectedLocation: "https://127.0.0.1:9000/testbucket1/test/1.txt",
 		},
 		// Server binding to fqdn.
 		{
-			host:             "s3.mybucket.org",
-			proto:            httpScheme,
+			request: &http.Request{
+				Host: "s3.mybucket.org",
+				Header: map[string][]string{
+					"X-Forwarded-Scheme": {httpScheme},
+				},
+			},
 			bucket:           "mybucket",
 			object:           "test/1.txt",
 			expectedLocation: "http://s3.mybucket.org/mybucket/test/1.txt",
 		},
 		// Server binding to fqdn.
 		{
-			host:             "mys3.mybucket.org",
-			proto:            "",
+			request: &http.Request{
+				Host:   "mys3.mybucket.org",
+				Header: map[string][]string{},
+			},
 			bucket:           "mybucket",
 			object:           "test/1.txt",
 			expectedLocation: "http://mys3.mybucket.org/mybucket/test/1.txt",
 		},
+		// Server with virtual domain name.
+		{
+			request: &http.Request{
+				Host:   "mys3.bucket.org",
+				Header: map[string][]string{},
+			},
+			domain:           "mys3.bucket.org",
+			bucket:           "mybucket",
+			object:           "test/1.txt",
+			expectedLocation: "http://mybucket.mys3.bucket.org/test/1.txt",
+		},
+		{
+			request: &http.Request{
+				Host: "mys3.bucket.org",
+				Header: map[string][]string{
+					"X-Forwarded-Scheme": {httpsScheme},
+				},
+			},
+			domain:           "mys3.bucket.org",
+			bucket:           "mybucket",
+			object:           "test/1.txt",
+			expectedLocation: "https://mybucket.mys3.bucket.org/test/1.txt",
+		},
 	}
 	for i, testCase := range testCases {
-		gotLocation := getObjectLocation(testCase.host, testCase.proto, testCase.bucket, testCase.object)
+		gotLocation := getObjectLocation(testCase.request, testCase.domain, testCase.bucket, testCase.object)
 		if testCase.expectedLocation != gotLocation {
 			t.Errorf("Test %d: expected %s, got %s", i+1, testCase.expectedLocation, gotLocation)
 		}
@@ -18,15 +18,13 @@ package cmd

 import (
 	"bytes"
+	"errors"
 	"io/ioutil"
 	"net/http"
 	"strings"
-)

-// Verify if the request http Header "x-amz-content-sha256" == "UNSIGNED-PAYLOAD"
-func isRequestUnsignedPayload(r *http.Request) bool {
-	return r.Header.Get("x-amz-content-sha256") == unsignedPayload
-}
+	"github.com/minio/minio/pkg/handlers"
+)

 // Verify if request has JWT.
 func isRequestJWT(r *http.Request) bool {
@@ -58,13 +56,14 @@ func isRequestPresignedSignatureV2(r *http.Request) bool {

 // Verify if request has AWS Post policy Signature Version '4'.
 func isRequestPostPolicySignatureV4(r *http.Request) bool {
-	return strings.Contains(r.Header.Get("Content-Type"), "multipart/form-data") && r.Method == httpPOST
+	return strings.Contains(r.Header.Get("Content-Type"), "multipart/form-data") &&
+		r.Method == http.MethodPost
 }

 // Verify if the request has AWS Streaming Signature Version '4'. This is only valid for 'PUT' operation.
 func isRequestSignStreamingV4(r *http.Request) bool {
 	return r.Header.Get("x-amz-content-sha256") == streamingContentSHA256 &&
-		r.Method == httpPUT
+		r.Method == http.MethodPut
 }

 // Authorization type.
@@ -105,34 +104,38 @@ func getRequestAuthType(r *http.Request) authType {
 	return authTypeUnknown
 }

+// checkAdminRequestAuthType checks whether the request is a valid signature V2 or V4 request.
+// It does not accept presigned or JWT or anonymous requests.
+func checkAdminRequestAuthType(r *http.Request, region string) APIErrorCode {
+	s3Err := ErrAccessDenied
+	if getRequestAuthType(r) == authTypeSigned { // we only support V4 (no presign)
+		s3Err = isReqAuthenticated(r, region)
+	}
+	if s3Err != ErrNone {
+		errorIf(errors.New(getAPIError(s3Err).Description), "%s", dumpRequest(r))
+	}
+	return s3Err
+}
+
 func checkRequestAuthType(r *http.Request, bucket, policyAction, region string) APIErrorCode {
 	reqAuthType := getRequestAuthType(r)

 	switch reqAuthType {
 	case authTypePresignedV2, authTypeSignedV2:
 		// Signature V2 validation.
-		s3Error := isReqAuthenticatedV2(r)
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-		}
-		return s3Error
+		return isReqAuthenticatedV2(r)
 	case authTypeSigned, authTypePresigned:
-		s3Error := isReqAuthenticated(r, region)
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-		}
-		return s3Error
+		return isReqAuthenticated(r, region)
 	}

 	if reqAuthType == authTypeAnonymous && policyAction != "" {
 		// http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
-		sourceIP := getSourceIPAddress(r)
 		resource, err := getResource(r.URL.Path, r.Host, globalDomainName)
 		if err != nil {
 			return ErrInternalError
 		}
 		return enforceBucketPolicy(bucket, policyAction, resource,
-			r.Referer(), sourceIP, r.URL.Query())
+			r.Referer(), handlers.GetSourceIP(r), r.URL.Query())
 	}

 	// By default return ErrAccessDenied
@@ -23,6 +23,7 @@ import (
 	"net/url"
 	"os"
 	"testing"
+	"time"

 	"github.com/minio/minio/pkg/auth"
 )
@@ -190,40 +191,6 @@ func TestS3SupportedAuthType(t *testing.T) {
 	}
 }

-// TestIsRequestUnsignedPayload - Test validates the Unsigned payload detection logic.
-func TestIsRequestUnsignedPayload(t *testing.T) {
-	testCases := []struct {
-		inputAmzContentHeader string
-		expectedResult        bool
-	}{
-		// Test case - 1.
-		// Test case with "X-Amz-Content-Sha256" header set to empty value.
-		{"", false},
-		// Test case - 2.
-		// Test case with "X-Amz-Content-Sha256" header set to  "UNSIGNED-PAYLOAD"
-		// The payload is flagged as unsigned When "X-Amz-Content-Sha256" header is set to  "UNSIGNED-PAYLOAD".
-		{unsignedPayload, true},
-		// Test case - 3.
-		// set to a random value.
-		{"abcd", false},
-	}
-
-	// creating an input HTTP request.
-	// Only the headers are relevant for this particular test.
-	inputReq, err := http.NewRequest("GET", "http://example.com", nil)
-	if err != nil {
-		t.Fatalf("Error initializing input HTTP request: %v", err)
-	}
-
-	for i, testCase := range testCases {
-		inputReq.Header.Set("X-Amz-Content-Sha256", testCase.inputAmzContentHeader)
-		actualResult := isRequestUnsignedPayload(inputReq)
-		if testCase.expectedResult != actualResult {
-			t.Errorf("Test %d: Expected the result to `%v`, but instead got `%v`", i+1, testCase.expectedResult, actualResult)
-		}
-	}
-}
-
 func TestIsRequestPresignedSignatureV2(t *testing.T) {
 	testCases := []struct {
 		inputQueryKey   string
@@ -311,6 +278,39 @@ func mustNewSignedRequest(method string, urlStr string, contentLength int64, bod
 	return req
 }

+// This is similar to mustNewRequest but additionally the request
+// is signed with AWS Signature V2, fails if not able to do so.
+func mustNewSignedV2Request(method string, urlStr string, contentLength int64, body io.ReadSeeker, t *testing.T) *http.Request {
+	req := mustNewRequest(method, urlStr, contentLength, body, t)
+	cred := globalServerConfig.GetCredential()
+	if err := signRequestV2(req, cred.AccessKey, cred.SecretKey); err != nil {
+		t.Fatalf("Unable to inititalized new signed http request %s", err)
+	}
+	return req
+}
+
+// This is similar to mustNewRequest but additionally the request
+// is presigned with AWS Signature V2, fails if not able to do so.
+func mustNewPresignedV2Request(method string, urlStr string, contentLength int64, body io.ReadSeeker, t *testing.T) *http.Request {
+	req := mustNewRequest(method, urlStr, contentLength, body, t)
+	cred := globalServerConfig.GetCredential()
+	if err := preSignV2(req, cred.AccessKey, cred.SecretKey, time.Now().Add(10*time.Minute).Unix()); err != nil {
+		t.Fatalf("Unable to inititalized new signed http request %s", err)
+	}
+	return req
+}
+
+// This is similar to mustNewRequest but additionally the request
+// is presigned with AWS Signature V4, fails if not able to do so.
+func mustNewPresignedRequest(method string, urlStr string, contentLength int64, body io.ReadSeeker, t *testing.T) *http.Request {
+	req := mustNewRequest(method, urlStr, contentLength, body, t)
+	cred := globalServerConfig.GetCredential()
+	if err := preSignV4(req, cred.AccessKey, cred.SecretKey, time.Now().Add(10*time.Minute).Unix()); err != nil {
+		t.Fatalf("Unable to inititalized new signed http request %s", err)
+	}
+	return req
+}
+
 func mustNewSignedBadMD5Request(method string, urlStr string, contentLength int64, body io.ReadSeeker, t *testing.T) *http.Request {
 	req := mustNewRequest(method, urlStr, contentLength, body, t)
 	req.Header.Set("Content-Md5", "YWFhYWFhYWFhYWFhYWFhCg==")
@@ -358,3 +358,32 @@ func TestIsReqAuthenticated(t *testing.T) {
 		}
 	}
 }
+func TestCheckAdminRequestAuthType(t *testing.T) {
+	path, err := newTestConfig(globalMinioDefaultRegion)
+	if err != nil {
+		t.Fatalf("unable initialize config file, %s", err)
+	}
+	defer os.RemoveAll(path)
+
+	creds, err := auth.CreateCredentials("myuser", "mypassword")
+	if err != nil {
+		t.Fatalf("unable create credential, %s", err)
+	}
+
+	globalServerConfig.SetCredential(creds)
+	testCases := []struct {
+		Request *http.Request
+		ErrCode APIErrorCode
+	}{
+		{Request: mustNewRequest("GET", "http://127.0.0.1:9000", 0, nil, t), ErrCode: ErrAccessDenied},
+		{Request: mustNewSignedRequest("GET", "http://127.0.0.1:9000", 0, nil, t), ErrCode: ErrNone},
+		{Request: mustNewSignedV2Request("GET", "http://127.0.0.1:9000", 0, nil, t), ErrCode: ErrAccessDenied},
+		{Request: mustNewPresignedV2Request("GET", "http://127.0.0.1:9000", 0, nil, t), ErrCode: ErrAccessDenied},
+		{Request: mustNewPresignedRequest("GET", "http://127.0.0.1:9000", 0, nil, t), ErrCode: ErrAccessDenied},
+	}
+	for i, testCase := range testCases {
+		if s3Error := checkAdminRequestAuthType(testCase.Request, globalServerConfig.GetRegion()); s3Error != testCase.ErrCode {
+			t.Errorf("Test %d: Unexpected s3error returned wanted %d, got %d", i, testCase.ErrCode, s3Error)
+		}
+	}
+}
@@ -1,5 +1,5 @@
 /*
- * Minio Cloud Storage, (C) 2016, 2017 Minio, Inc.
+ * Minio Cloud Storage, (C) 2016, 2017, 2018 Minio, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -17,7 +17,16 @@
 package cmd

 import (
+	"bufio"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
 	"net/rpc"
+	"strings"
 	"sync"
 	"time"
 )
@@ -52,10 +61,11 @@ type authConfig struct {

 // AuthRPCClient is a authenticated RPC client which does authentication before doing Call().
 type AuthRPCClient struct {
-	sync.RWMutex            // Mutex to lock this object.
-	rpcClient    *RPCClient // Reconnectable RPC client to make any RPC call.
-	config       authConfig // Authentication configuration information.
-	authToken    string     // Authentication token.
+	sync.RWMutex             // Mutex to lock this object.
+	rpcClient    *rpc.Client // RPC client to make any RPC call.
+	config       authConfig  // Authentication configuration information.
+	authToken    string      // Authentication token.
+	version      semVersion  // RPC version.
 }

 // newAuthRPCClient - returns a JWT based authenticated (go) rpc client, which does automatic reconnect.
@@ -73,8 +83,8 @@ func newAuthRPCClient(config authConfig) *AuthRPCClient {
 	}

 	return &AuthRPCClient{
-		rpcClient: newRPCClient(config.serverAddr, config.serviceEndpoint, config.secureConn),
-		config:    config,
+		config:  config,
+		version: globalRPCAPIVersion,
 	}
 }

@@ -99,38 +109,60 @@ func (authClient *AuthRPCClient) Login() (err error) {

 	// Attempt to login if not logged in already.
 	if authClient.authToken == "" {
-		authClient.authToken, err = authenticateNode(authClient.config.accessKey, authClient.config.secretKey)
+		var authToken string
+		authToken, err = authenticateNode(authClient.config.accessKey, authClient.config.secretKey)
 		if err != nil {
 			return err
 		}
+
 		// Login to authenticate your token.
 		var (
 			loginMethod = authClient.config.serviceName + loginMethodName
 			loginArgs   = LoginRPCArgs{
-				AuthToken:   authClient.authToken,
-				Version:     Version,
+				AuthToken:   authToken,
+				Version:     globalRPCAPIVersion,
 				RequestTime: UTCNow(),
 			}
 		)
-		if err = authClient.rpcClient.Call(loginMethod, &loginArgs, &LoginRPCReply{}); err != nil {
+
+		// Re-dial after we have disconnected or if its a fresh run.
+		var rpcClient *rpc.Client
+		rpcClient, err = rpcDial(authClient.config.serverAddr, authClient.config.serviceEndpoint, authClient.config.secureConn)
+		if err != nil {
 			return err
 		}
+
+		if err = rpcClient.Call(loginMethod, &loginArgs, &LoginRPCReply{}); err != nil {
+			// gob doesn't provide any typed errors for us to reflect
+			// upon, this is the only way to return proper error.
+			if strings.Contains(err.Error(), "gob: wrong type") {
+				return errRPCAPIVersionUnsupported
+			}
+			return err
+		}
+
+		// Initialize rpc client and auth token after a successful login.
+		authClient.authToken = authToken
+		authClient.rpcClient = rpcClient
 	}
+
 	return nil
 }

 // call makes a RPC call after logs into the server.
 func (authClient *AuthRPCClient) call(serviceMethod string, args interface {
 	SetAuthToken(authToken string)
+	SetRPCAPIVersion(version semVersion)
 }, reply interface{}) (err error) {
 	if err = authClient.Login(); err != nil {
 		return err
 	} // On successful login, execute RPC call.

-	authClient.RLock()
 	// Set token before the rpc call.
+	authClient.RLock()
+	defer authClient.RUnlock()
 	args.SetAuthToken(authClient.authToken)
-	authClient.RUnlock()
+	args.SetRPCAPIVersion(authClient.version)

 	// Do an RPC call.
 	return authClient.rpcClient.Call(serviceMethod, args, reply)
@@ -139,6 +171,7 @@ func (authClient *AuthRPCClient) call(serviceMethod string, args interface {
 // Call executes RPC call till success or globalAuthRPCRetryThreshold on ErrShutdown.
 func (authClient *AuthRPCClient) Call(serviceMethod string, args interface {
 	SetAuthToken(authToken string)
+	SetRPCAPIVersion(version semVersion)
 }, reply interface{}) (err error) {

 	// Done channel is used to close any lingering retry routine, as soon
@@ -159,6 +192,11 @@ func (authClient *AuthRPCClient) Call(serviceMethod string, args interface {
 				}
 			}
 		}
+		// gob doesn't provide any typed errors for us to reflect
+		// upon, this is the only way to return proper error.
+		if err != nil && strings.Contains(err.Error(), "gob: wrong type") {
+			err = errRPCAPIVersionUnsupported
+		}
 		break
 	}
 	return err
@@ -169,6 +207,10 @@ func (authClient *AuthRPCClient) Close() error {
 	authClient.Lock()
 	defer authClient.Unlock()

+	if authClient.rpcClient == nil {
+		return nil
+	}
+
 	authClient.authToken = ""
 	return authClient.rpcClient.Close()
 }
@@ -182,3 +224,87 @@ func (authClient *AuthRPCClient) ServerAddr() string {
 func (authClient *AuthRPCClient) ServiceEndpoint() string {
 	return authClient.config.serviceEndpoint
 }
+
+// default Dial timeout for RPC connections.
+const defaultDialTimeout = 3 * time.Second
+
+// Connect success message required from rpc server.
+const connectSuccessMessage = "200 Connected to Go RPC"
+
+// dial tries to establish a connection to serverAddr in a safe manner.
+// If there is a valid rpc.Cliemt, it returns that else creates a new one.
+func rpcDial(serverAddr, serviceEndpoint string, secureConn bool) (netRPCClient *rpc.Client, err error) {
+	if serverAddr == "" || serviceEndpoint == "" {
+		return nil, errInvalidArgument
+	}
+	d := &net.Dialer{
+		Timeout: defaultDialTimeout,
+	}
+	var conn net.Conn
+	if secureConn {
+		var hostname string
+		if hostname, _, err = net.SplitHostPort(serverAddr); err != nil {
+			return nil, &net.OpError{
+				Op:   "dial-http",
+				Net:  serverAddr + serviceEndpoint,
+				Addr: nil,
+				Err:  fmt.Errorf("Unable to parse server address <%s>: %s", serverAddr, err),
+			}
+		}
+		// ServerName in tls.Config needs to be specified to support SNI certificates.
+		conn, err = tls.DialWithDialer(d, "tcp", serverAddr, &tls.Config{
+			ServerName: hostname,
+			RootCAs:    globalRootCAs,
+		})
+	} else {
+		conn, err = d.Dial("tcp", serverAddr)
+	}
+
+	if err != nil {
+		// Print RPC connection errors that are worthy to display in log.
+		switch err.(type) {
+		case x509.HostnameError:
+			errorIf(err, "Unable to establish secure connection to %s", serverAddr)
+		}
+
+		return nil, &net.OpError{
+			Op:   "dial-http",
+			Net:  serverAddr + serviceEndpoint,
+			Addr: nil,
+			Err:  err,
+		}
+	}
+
+	// Check for network errors writing over the dialed conn.
+	if _, err = io.WriteString(conn, "CONNECT "+serviceEndpoint+" HTTP/1.0\n\n"); err != nil {
+		conn.Close()
+		return nil, &net.OpError{
+			Op:   "dial-http",
+			Net:  serverAddr + serviceEndpoint,
+			Addr: nil,
+			Err:  err,
+		}
+	}
+
+	// Attempt to read the HTTP response for the HTTP method CONNECT, upon
+	// success return the RPC connection instance.
+	resp, err := http.ReadResponse(bufio.NewReader(conn), &http.Request{
+		Method: http.MethodConnect,
+	})
+	if err != nil {
+		conn.Close()
+		return nil, &net.OpError{
+			Op:   "dial-http",
+			Net:  serverAddr + serviceEndpoint,
+			Addr: nil,
+			Err:  err,
+		}
+	}
+	if resp.Status != connectSuccessMessage {
+		conn.Close()
+		return nil, errors.New("unexpected HTTP response: " + resp.Status)
+	}
+
+	// Initialize rpc client.
+	return rpc.NewClient(conn), nil
+}
@@ -16,7 +16,12 @@

 package cmd

-import "testing"
+import (
+	"crypto/x509"
+	"os"
+	"path"
+	"testing"
+)

 // Tests authorized RPC client.
 func TestAuthRPCClient(t *testing.T) {
@@ -53,3 +58,81 @@ func TestAuthRPCClient(t *testing.T) {
 		t.Fatalf("Unexpected node value %s, but expected %s", authRPC.ServiceEndpoint(), authCfg.serviceEndpoint)
 	}
 }
+
+// Test rpc dial test.
+func TestRPCDial(t *testing.T) {
+	prevRootCAs := globalRootCAs
+	defer func() {
+		globalRootCAs = prevRootCAs
+	}()
+
+	rootPath, err := newTestConfig(globalMinioDefaultRegion)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(rootPath)
+
+	testServer := StartTestServer(t, "")
+	defer testServer.Stop()
+
+	cert, key, err := generateTLSCertKey("127.0.0.1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Set global root CAs.
+	globalRootCAs = x509.NewCertPool()
+	globalRootCAs.AppendCertsFromPEM(cert)
+
+	testServerTLS := StartTestTLSServer(t, "", cert, key)
+	defer testServerTLS.Stop()
+
+	adminEndpoint := path.Join(minioReservedBucketPath, adminPath)
+	testCases := []struct {
+		serverAddr     string
+		serverEndpoint string
+		success        bool
+		secure         bool
+	}{
+		// Empty server addr should fail.
+		{
+			serverAddr:     "",
+			serverEndpoint: adminEndpoint,
+			success:        false,
+		},
+		// Unexpected server addr should fail.
+		{
+			serverAddr:     "example.com",
+			serverEndpoint: adminEndpoint,
+			success:        false,
+		},
+		// Server addr connects but fails for CONNECT call.
+		{
+			serverAddr:     "example.com:80",
+			serverEndpoint: "/",
+			success:        false,
+		},
+		// Successful connecting to insecure RPC server.
+		{
+			serverAddr:     testServer.Server.Listener.Addr().String(),
+			serverEndpoint: adminEndpoint,
+			success:        true,
+		},
+		// Successful connecting to secure RPC server.
+		{
+			serverAddr:     testServerTLS.Server.Listener.Addr().String(),
+			serverEndpoint: adminEndpoint,
+			success:        true,
+			secure:         true,
+		},
+	}
+	for i, testCase := range testCases {
+		_, err = rpcDial(testCase.serverAddr, testCase.serverEndpoint, testCase.secure)
+		if err != nil && testCase.success {
+			t.Errorf("Test %d: Expected success but found failure instead %s", i+1, err)
+		}
+		if err == nil && !testCase.success {
+			t.Errorf("Test %d: Expected failure but found success instead", i+1)
+		}
+	}
+}
@@ -43,7 +43,7 @@ func TestLogin(t *testing.T) {
 		{
 			args: LoginRPCArgs{
 				AuthToken: token,
-				Version:   Version,
+				Version:   globalRPCAPIVersion,
 			},
 			skewTime:    0,
 			expectedErr: nil,
@@ -52,16 +52,16 @@ func TestLogin(t *testing.T) {
 		{
 			args: LoginRPCArgs{
 				AuthToken: token,
-				Version:   "INVALID-" + Version,
+				Version:   semVersion{3, 0, 0},
 			},
 			skewTime:    0,
-			expectedErr: errServerVersionMismatch,
+			expectedErr: errRPCAPIVersionUnsupported,
 		},
 		// Valid username, password and version, not request time
 		{
 			args: LoginRPCArgs{
 				AuthToken: token,
-				Version:   Version,
+				Version:   globalRPCAPIVersion,
 			},
 			skewTime:    20 * time.Minute,
 			expectedErr: errServerTimeMismatch,
@@ -70,7 +70,7 @@ func TestLogin(t *testing.T) {
 		{
 			args: LoginRPCArgs{
 				AuthToken: "",
-				Version:   Version,
+				Version:   globalRPCAPIVersion,
 			},
 			skewTime:    0,
 			expectedErr: errAuthentication,
@@ -239,7 +239,7 @@ func runGetObjectBenchmark(b *testing.B, obj ObjectLayer, objSize int) {
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		var buffer = new(bytes.Buffer)
-		err = obj.GetObject(bucket, "object"+strconv.Itoa(i%10), 0, int64(objSize), buffer)
+		err = obj.GetObject(bucket, "object"+strconv.Itoa(i%10), 0, int64(objSize), buffer, "")
 		if err != nil {
 			b.Error(err)
 		}
@@ -402,7 +402,7 @@ func runGetObjectBenchmarkParallel(b *testing.B, obj ObjectLayer, objSize int) {
 	b.RunParallel(func(pb *testing.PB) {
 		i := 0
 		for pb.Next() {
-			err = obj.GetObject(bucket, "object"+strconv.Itoa(i), 0, int64(objSize), ioutil.Discard)
+			err = obj.GetObject(bucket, "object"+strconv.Itoa(i), 0, int64(objSize), ioutil.Discard, "")
 			if err != nil {
 				b.Error(err)
 			}
@@ -50,6 +50,10 @@ func (br *browserPeerAPIHandlers) SetAuthPeer(args SetAuthPeerArgs, reply *AuthR
 		return fmt.Errorf("Invalid credential passed")
 	}

+	// Acquire lock before updating global configuration.
+	globalServerConfigMu.Lock()
+	defer globalServerConfigMu.Unlock()
+
 	// Update credentials in memory
 	prevCred := globalServerConfig.SetCredential(args.Creds)

@@ -70,11 +70,13 @@ func (s *TestRPCBrowserPeerSuite) testBrowserPeerRPC(t *testing.T) {

 	// Validate for invalid token.
 	args := SetAuthPeerArgs{Creds: creds}
-	args.AuthToken = "garbage"
-	rclient := newRPCClient(s.testAuthConf.serverAddr, s.testAuthConf.serviceEndpoint, false)
+	rclient := newAuthRPCClient(s.testAuthConf)
 	defer rclient.Close()
-	err = rclient.Call("BrowserPeer.SetAuthPeer", &args, &AuthRPCReply{})
-	if err != nil {
+	if err = rclient.Login(); err != nil {
+		t.Fatal(err)
+	}
+	rclient.authToken = "garbage"
+	if err = rclient.Call("BrowserPeer.SetAuthPeer", &args, &AuthRPCReply{}); err != nil {
 		if err.Error() != errInvalidToken.Error() {
 			t.Fatal(err)
 		}
@@ -90,20 +92,14 @@ func (s *TestRPCBrowserPeerSuite) testBrowserPeerRPC(t *testing.T) {
 	}

 	// Validate for failure in login handler with previous credentials.
-	rclient = newRPCClient(s.testAuthConf.serverAddr, s.testAuthConf.serviceEndpoint, false)
+	rclient = newAuthRPCClient(s.testAuthConf)
 	defer rclient.Close()
 	token, err := authenticateNode(creds.AccessKey, creds.SecretKey)
 	if err != nil {
 		t.Fatal(err)
 	}
-	rargs := &LoginRPCArgs{
-		AuthToken:   token,
-		Version:     Version,
-		RequestTime: UTCNow(),
-	}
-	rreply := &LoginRPCReply{}
-	err = rclient.Call("BrowserPeer"+loginMethodName, rargs, rreply)
-	if err != nil {
+	rclient.authToken = token
+	if err = rclient.Login(); err != nil {
 		if err.Error() != errInvalidAccessKeyID.Error() {
 			t.Fatal(err)
 		}
@@ -113,14 +109,8 @@ func (s *TestRPCBrowserPeerSuite) testBrowserPeerRPC(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	// Validate for success in loing handled with valid credetnails.
-	rargs = &LoginRPCArgs{
-		AuthToken:   token,
-		Version:     Version,
-		RequestTime: UTCNow(),
-	}
-	rreply = &LoginRPCReply{}
-	if err = rclient.Call("BrowserPeer"+loginMethodName, rargs, rreply); err != nil {
+	rclient.authToken = token
+	if err = rclient.Login(); err != nil {
 		t.Fatal(err)
 	}
 }
@@ -40,37 +40,10 @@ func validateListObjectsArgs(prefix, marker, delimiter string, maxKeys int) APIE
 	if delimiter != "" && delimiter != "/" {
 		return ErrNotImplemented
 	}
-	// Marker is set validate pre-condition.
-	if marker != "" {
-		// Marker not common with prefix is not implemented.
-		if !hasPrefix(marker, prefix) {
-			return ErrNotImplemented
-		}
-	}
 	// Success.
 	return ErrNone
 }

-// Validate all the ListObjectsV2 query arguments, returns an APIErrorCode
-// if one of the args do not meet the required conditions.
-// Special conditions required by Minio server are as below
-// - delimiter if set should be equal to '/', otherwise the request is rejected.
-func validateGatewayListObjectsV2Args(prefix, marker, delimiter string, maxKeys int) APIErrorCode {
-	// Max keys cannot be negative.
-	if maxKeys < 0 {
-		return ErrInvalidMaxKeys
-	}
-
-	/// Minio special conditions for ListObjects.
-
-	// Verify if delimiter is anything other than '/', which we do not support.
-	if delimiter != "" && delimiter != "/" {
-		return ErrNotImplemented
-	}
-
-	return ErrNone
-}
-
 // ListObjectsV2Handler - GET Bucket (List Objects) Version 2.
 // --------------------------
 // This implementation of the GET operation returns some or all (up to 1000)
@@ -104,23 +77,35 @@ func (api objectAPIHandlers) ListObjectsV2Handler(w http.ResponseWriter, r *http
 		// Then we need to use 'start-after' as marker instead.
 		marker = startAfter
 	}
+
 	// Validate the query params before beginning to serve the request.
 	// fetch-owner is not validated since it is a boolean
 	if s3Error := validateListObjectsArgs(prefix, marker, delimiter, maxKeys); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}
+
 	// Inititate a list objects operation based on the input params.
 	// On success would return back ListObjectsInfo object to be
 	// marshalled into S3 compatible XML header.
-	listObjectsInfo, err := objectAPI.ListObjects(bucket, prefix, marker, delimiter, maxKeys)
+	listObjectsV2Info, err := objectAPI.ListObjectsV2(bucket, prefix, marker, delimiter, maxKeys, fetchOwner, startAfter)
 	if err != nil {
-		errorIf(err, "Unable to list objects.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}

-	response := generateListObjectsV2Response(bucket, prefix, token, listObjectsInfo.NextMarker, startAfter, delimiter, fetchOwner, listObjectsInfo.IsTruncated, maxKeys, listObjectsInfo.Objects, listObjectsInfo.Prefixes)
+	for i := range listObjectsV2Info.Objects {
+		if listObjectsV2Info.Objects[i].IsEncrypted() {
+			listObjectsV2Info.Objects[i].Size, err = listObjectsV2Info.Objects[i].DecryptedSize()
+			if err != nil {
+				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+				return
+			}
+		}
+	}
+
+	response := generateListObjectsV2Response(bucket, prefix, token, listObjectsV2Info.NextContinuationToken, startAfter,
+		delimiter, fetchOwner, listObjectsV2Info.IsTruncated, maxKeys, listObjectsV2Info.Objects, listObjectsV2Info.Prefixes)

 	// Write success response.
 	writeSuccessResponseXML(w, encodeResponse(response))
@@ -150,7 +135,12 @@ func (api objectAPIHandlers) ListObjectsV1Handler(w http.ResponseWriter, r *http
 	// Extract all the litsObjectsV1 query params to their native values.
 	prefix, marker, delimiter, maxKeys, _ := getListObjectsV1Args(r.URL.Query())

-	// Validate all the query params before beginning to serve the request.
+	// Validate the maxKeys lowerbound. When maxKeys > 1000, S3 returns 1000 but
+	// does not throw an error.
+	if maxKeys < 0 {
+		writeErrorResponse(w, ErrInvalidMaxKeys, r.URL)
+		return
+	} // Validate all the query params before beginning to serve the request.
 	if s3Error := validateListObjectsArgs(prefix, marker, delimiter, maxKeys); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
@@ -161,10 +151,20 @@ func (api objectAPIHandlers) ListObjectsV1Handler(w http.ResponseWriter, r *http
 	// marshalled into S3 compatible XML header.
 	listObjectsInfo, err := objectAPI.ListObjects(bucket, prefix, marker, delimiter, maxKeys)
 	if err != nil {
-		errorIf(err, "Unable to list objects.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
+
+	for i := range listObjectsInfo.Objects {
+		if listObjectsInfo.Objects[i].IsEncrypted() {
+			listObjectsInfo.Objects[i].Size, err = listObjectsInfo.Objects[i].DecryptedSize()
+			if err != nil {
+				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+				return
+			}
+		}
+	}
+
 	response := generateListObjectsV1Response(bucket, prefix, marker, delimiter, maxKeys, listObjectsInfo)

 	// Write success response.
@@ -40,7 +40,8 @@ import (
 // Enforces bucket policies for a bucket for a given tatusaction.
 func enforceBucketPolicy(bucket, action, resource, referer, sourceIP string, queryParams url.Values) (s3Error APIErrorCode) {
 	// Verify if bucket actually exists
-	if err := checkBucketExist(bucket, newObjectLayerFn()); err != nil {
+	objAPI := newObjectLayerFn()
+	if err := checkBucketExist(bucket, objAPI); err != nil {
 		err = errors.Cause(err)
 		switch err.(type) {
 		case BucketNameInvalid:
@@ -55,12 +56,11 @@ func enforceBucketPolicy(bucket, action, resource, referer, sourceIP string, que
 		return ErrInternalError
 	}

-	if globalBucketPolicies == nil {
+	// Fetch bucket policy, if policy is not set return access denied.
+	p, err := objAPI.GetBucketPolicy(bucket)
+	if err != nil {
 		return ErrAccessDenied
 	}
-
-	// Fetch bucket policy, if policy is not set return access denied.
-	p := globalBucketPolicies.GetBucketPolicy(bucket)
 	if reflect.DeepEqual(p, emptyBucketPolicy) {
 		return ErrAccessDenied
 	}
@@ -89,12 +89,12 @@ func enforceBucketPolicy(bucket, action, resource, referer, sourceIP string, que
 }

 // Check if the action is allowed on the bucket/prefix.
-func isBucketActionAllowed(action, bucket, prefix string) bool {
-	if globalBucketPolicies == nil {
+func isBucketActionAllowed(action, bucket, prefix string, objectAPI ObjectLayer) bool {
+
+	bp, err := objectAPI.GetBucketPolicy(bucket)
+	if err != nil {
 		return false
 	}
-
-	bp := globalBucketPolicies.GetBucketPolicy(bucket)
 	if reflect.DeepEqual(bp, emptyBucketPolicy) {
 		return false
 	}
@@ -127,8 +127,14 @@ func (api objectAPIHandlers) GetBucketLocationHandler(w http.ResponseWriter, r *
 		return
 	}

+	bucketLock := globalNSMutex.NewNSLock(bucket, "")
+	if err := bucketLock.GetRLock(globalObjectTimeout); err != nil {
+		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+		return
+	}
+	defer bucketLock.RUnlock()
+
 	if _, err := objectAPI.GetBucketInfo(bucket); err != nil {
-		errorIf(err, "Unable to fetch bucket info.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -185,7 +191,6 @@ func (api objectAPIHandlers) ListMultipartUploadsHandler(w http.ResponseWriter,

 	listMultipartsInfo, err := objectAPI.ListMultipartUploads(bucket, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads)
 	if err != nil {
-		errorIf(err, "Unable to list multipart uploads.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -221,7 +226,6 @@ func (api objectAPIHandlers) ListBucketsHandler(w http.ResponseWriter, r *http.R
 	// Invoke the list buckets.
 	bucketsInfo, err := objectAPI.ListBuckets()
 	if err != nil {
-		errorIf(err, "Unable to list buckets.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -304,16 +308,9 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 				}
 				return
 			}
-			objectLock := globalNSMutex.NewNSLock(bucket, obj.ObjectName)
-			if timedOutErr := objectLock.GetLock(globalObjectTimeout); timedOutErr != nil {
-				dErrs[i] = timedOutErr
-			} else {
-				defer objectLock.Unlock()
-
-				dErr := objectAPI.DeleteObject(bucket, obj.ObjectName)
-				if dErr != nil {
-					dErrs[i] = dErr
-				}
+			dErr := objectAPI.DeleteObject(bucket, obj.ObjectName)
+			if dErr != nil {
+				dErrs[i] = dErr
 			}
 		}(index, object)
 	}
@@ -335,7 +332,6 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 			deletedObjects = append(deletedObjects, object)
 			continue
 		}
-		errorIf(err, "Unable to delete object. %s", object.ObjectName)
 		// Error during delete should be collected separately.
 		deleteErrors = append(deleteErrors, DeleteError{
 			Code:    errorCodeResponse[toAPIErrorCode(err)].Code,
@@ -409,16 +405,15 @@ func (api objectAPIHandlers) PutBucketHandler(w http.ResponseWriter, r *http.Req
 	}

 	bucketLock := globalNSMutex.NewNSLock(bucket, "")
-	if bucketLock.GetLock(globalObjectTimeout) != nil {
-		writeErrorResponse(w, ErrOperationTimedOut, r.URL)
+	if err := bucketLock.GetLock(globalObjectTimeout); err != nil {
+		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
 	defer bucketLock.Unlock()

 	// Proceed to creating a bucket.
-	err := objectAPI.MakeBucketWithLocation(bucket, "")
+	err := objectAPI.MakeBucketWithLocation(bucket, location)
 	if err != nil {
-		errorIf(err, "Unable to create a bucket.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -546,13 +541,11 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	lengthRange := postPolicyForm.Conditions.ContentLengthRange
 	if lengthRange.Valid {
 		if fileSize < lengthRange.Min {
-			errorIf(err, "Unable to create object.")
 			writeErrorResponse(w, toAPIErrorCode(errDataTooSmall), r.URL)
 			return
 		}

 		if fileSize > lengthRange.Max || isMaxObjectSize(fileSize) {
-			errorIf(err, "Unable to create object.")
 			writeErrorResponse(w, toAPIErrorCode(errDataTooLarge), r.URL)
 			return
 		}
@@ -566,13 +559,6 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 		return
 	}

-	objectLock := globalNSMutex.NewNSLock(bucket, object)
-	if objectLock.GetLock(globalObjectTimeout) != nil {
-		writeErrorResponse(w, ErrOperationTimedOut, r.URL)
-		return
-	}
-	defer objectLock.Unlock()
-
 	hashReader, err := hash.NewReader(fileBody, fileSize, "", "")
 	if err != nil {
 		errorIf(err, "Unable to initialize hashReader.")
@@ -580,15 +566,36 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 		return
 	}

+	if objectAPI.IsEncryptionSupported() {
+		if hasSSECustomerHeader(formValues) && !hasSuffix(object, slashSeparator) { // handle SSE-C requests
+			var reader io.Reader
+			var key []byte
+			key, err = ParseSSECustomerHeader(formValues)
+			if err != nil {
+				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+				return
+			}
+			reader, err = newEncryptReader(hashReader, key, metadata)
+			if err != nil {
+				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+				return
+			}
+			info := ObjectInfo{Size: fileSize}
+			hashReader, err = hash.NewReader(reader, info.EncryptedSize(), "", "") // do not try to verify encrypted content
+			if err != nil {
+				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+				return
+			}
+		}
+	}
+
 	objInfo, err := objectAPI.PutObject(bucket, object, hashReader, metadata)
 	if err != nil {
-		errorIf(err, "Unable to create object.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}

-	port := r.Header.Get("X-Forward-Proto")
-	location := getObjectLocation(r.Host, port, bucket, object)
+	location := getObjectLocation(r, globalDomainName, bucket, object)
 	w.Header().Set("ETag", `"`+objInfo.ETag+`"`)
 	w.Header().Set("Location", location)

@@ -654,15 +661,7 @@ func (api objectAPIHandlers) HeadBucketHandler(w http.ResponseWriter, r *http.Re
 		return
 	}

-	bucketLock := globalNSMutex.NewNSLock(bucket, "")
-	if bucketLock.GetRLock(globalObjectTimeout) != nil {
-		writeErrorResponseHeadersOnly(w, ErrOperationTimedOut)
-		return
-	}
-	defer bucketLock.RUnlock()
-
 	if _, err := objectAPI.GetBucketInfo(bucket); err != nil {
-		errorIf(err, "Unable to fetch bucket info.")
 		writeErrorResponseHeadersOnly(w, toAPIErrorCode(err))
 		return
 	}
@@ -687,38 +686,12 @@ func (api objectAPIHandlers) DeleteBucketHandler(w http.ResponseWriter, r *http.
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]

-	bucketLock := globalNSMutex.NewNSLock(bucket, "")
-	if bucketLock.GetLock(globalObjectTimeout) != nil {
-		writeErrorResponse(w, ErrOperationTimedOut, r.URL)
-		return
-	}
-	defer bucketLock.Unlock()
-
 	// Attempt to delete bucket.
 	if err := objectAPI.DeleteBucket(bucket); err != nil {
-		errorIf(err, "Unable to delete a bucket.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}

-	// Delete bucket access policy, if present - ignore any errors.
-	_ = removeBucketPolicy(bucket, objectAPI)
-
-	// Notify all peers (including self) to update in-memory state
-	S3PeersUpdateBucketPolicy(bucket, policyChange{true, policy.BucketAccessPolicy{}})
-
-	// Delete notification config, if present - ignore any errors.
-	_ = removeNotificationConfig(bucket, objectAPI)
-
-	// Notify all peers (including self) to update in-memory state
-	S3PeersUpdateBucketNotification(bucket, nil)
-
-	// Delete listener config, if present - ignore any errors.
-	_ = removeListenerConfig(bucket, objectAPI)
-
-	// Notify all peers (including self) to update in-memory state
-	S3PeersUpdateBucketListener(bucket, []listenerConfig{})
-
 	// Write success response.
 	writeSuccessNoContent(w)
 }
@@ -35,7 +35,6 @@ func TestGetBucketLocationHandler(t *testing.T) {

 func testGetBucketLocationHandler(obj ObjectLayer, instanceType, bucketName string, apiRouter http.Handler,
 	credentials auth.Credentials, t *testing.T) {
-	initBucketPolicies(obj)

 	// test cases with sample input and expected output.
 	testCases := []struct {
@@ -155,7 +154,7 @@ func testGetBucketLocationHandler(obj ObjectLayer, instanceType, bucketName stri
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getReadOnlyBucketStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, "TestGetBucketLocationHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyBucketStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "TestGetBucketLocationHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyBucketStatement)

 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -180,7 +179,6 @@ func TestHeadBucketHandler(t *testing.T) {

 func testHeadBucketHandler(obj ObjectLayer, instanceType, bucketName string, apiRouter http.Handler,
 	credentials auth.Credentials, t *testing.T) {
-	initBucketPolicies(obj)

 	// test cases with sample input and expected output.
 	testCases := []struct {
@@ -261,7 +259,7 @@ func testHeadBucketHandler(obj ObjectLayer, instanceType, bucketName string, api
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getReadOnlyBucketStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, "TestHeadBucketHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyBucketStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "TestHeadBucketHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyBucketStatement)

 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -287,7 +285,6 @@ func TestListMultipartUploadsHandler(t *testing.T) {
 // testListMultipartUploadsHandler - Tests validate listing of multipart uploads.
 func testListMultipartUploadsHandler(obj ObjectLayer, instanceType, bucketName string, apiRouter http.Handler,
 	credentials auth.Credentials, t *testing.T) {
-	initBucketPolicies(obj)

 	// Collection of non-exhaustive ListMultipartUploads test cases, valid errors
 	// and success responses.
@@ -496,7 +493,7 @@ func testListMultipartUploadsHandler(obj ObjectLayer, instanceType, bucketName s
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getWriteOnlyBucketStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, "TestListMultipartUploadsHandler", bucketName, "", instanceType, apiRouter, anonReq, getWriteOnlyBucketStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "TestListMultipartUploadsHandler", bucketName, "", instanceType, apiRouter, anonReq, getWriteOnlyBucketStatement)

 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -594,7 +591,7 @@ func testListBucketsHandler(obj ObjectLayer, instanceType, bucketName string, ap
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getWriteOnlyObjectStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, "ListBucketsHandler", "", "", instanceType, apiRouter, anonReq, getWriteOnlyObjectStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "ListBucketsHandler", "", "", instanceType, apiRouter, anonReq, getWriteOnlyObjectStatement)

 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -618,7 +615,6 @@ func TestAPIDeleteMultipleObjectsHandler(t *testing.T) {

 func testAPIDeleteMultipleObjectsHandler(obj ObjectLayer, instanceType, bucketName string, apiRouter http.Handler,
 	credentials auth.Credentials, t *testing.T) {
-	initBucketPolicies(obj)

 	var err error
 	// register event notifier.
@@ -822,12 +818,7 @@ func testIsBucketActionAllowedHandler(obj ObjectLayer, instanceType, bucketName
 		{"s3:ListObject", "mybucket", "abc", false, false},
 	}
 	for i, testCase := range testCases {
-		if testCase.isGlobalPoliciesNil {
-			globalBucketPolicies = nil
-		} else {
-			initBucketPolicies(obj)
-		}
-		isAllowed := isBucketActionAllowed(testCase.action, testCase.bucket, testCase.prefix)
+		isAllowed := isBucketActionAllowed(testCase.action, testCase.bucket, testCase.prefix, obj)
 		if isAllowed != testCase.shouldPass {
 			t.Errorf("Case %d: Expected the response status to be `%t`, but instead found `%t`", i+1, testCase.shouldPass, isAllowed)
 		}
@@ -16,8 +16,6 @@

 package cmd

-import "encoding/json"
-
 // BucketMetaState - Interface to update bucket metadata in-memory
 // state.
 type BucketMetaState interface {
@@ -79,13 +77,7 @@ func (lc *localBucketMetaState) UpdateBucketPolicy(args *SetBucketPolicyPeerArgs
 	if objAPI == nil {
 		return errServerNotInitialized
 	}
-
-	var pCh policyChange
-	if err := json.Unmarshal(args.PChBytes, &pCh); err != nil {
-		return err
-	}
-
-	return globalBucketPolicies.SetBucketPolicy(args.Bucket, pCh)
+	return objAPI.RefreshBucketPolicy(args.Bucket)
 }

 // localBucketMetaState.SendEvent - sends event to local event notifier via
@@ -43,12 +43,17 @@ const (
 // not enabled on the bucket, the operation returns an empty
 // NotificationConfiguration element.
 func (api objectAPIHandlers) GetBucketNotificationHandler(w http.ResponseWriter, r *http.Request) {
+
 	objAPI := api.ObjectAPI()
 	if objAPI == nil {
 		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
 		return
 	}

+	if !objAPI.IsNotificationSupported() {
+		writeErrorResponse(w, ErrNotImplemented, r.URL)
+		return
+	}
 	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
@@ -59,7 +64,6 @@ func (api objectAPIHandlers) GetBucketNotificationHandler(w http.ResponseWriter,

 	_, err := objAPI.GetBucketInfo(bucket)
 	if err != nil {
-		errorIf(err, "Unable to find bucket info.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -97,12 +101,17 @@ func (api objectAPIHandlers) GetBucketNotificationHandler(w http.ResponseWriter,
 // By default, your bucket has no event notifications configured. That is,
 // the notification configuration will be an empty NotificationConfiguration.
 func (api objectAPIHandlers) PutBucketNotificationHandler(w http.ResponseWriter, r *http.Request) {
+
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
 		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
 		return
 	}

+	if !objectAPI.IsNotificationSupported() {
+		writeErrorResponse(w, ErrNotImplemented, r.URL)
+		return
+	}
 	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
@@ -113,7 +122,6 @@ func (api objectAPIHandlers) PutBucketNotificationHandler(w http.ResponseWriter,

 	_, err := objectAPI.GetBucketInfo(bucket)
 	if err != nil {
-		errorIf(err, "Unable to find bucket info.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -296,7 +304,10 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit
 		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
 		return
 	}
-
+	if !objAPI.IsNotificationSupported() {
+		writeErrorResponse(w, ErrNotImplemented, r.URL)
+		return
+	}
 	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
@@ -328,7 +339,6 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit

 	_, err := objAPI.GetBucketInfo(bucket)
 	if err != nil {
-		errorIf(err, "Unable to get bucket info.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -223,7 +223,7 @@ func TestSendNotificationEvent(t *testing.T) {

 	go func() {
 		// Send one empty notification event on listenChan
-		events := []NotificationEvent{NotificationEvent{}}
+		events := []NotificationEvent{{}}
 		l.sendNotificationEvent(events)
 		testCh <- struct{}{}
 	}()
@@ -28,6 +28,7 @@ import (
 	humanize "github.com/dustin/go-humanize"
 	mux "github.com/gorilla/mux"
 	"github.com/minio/minio-go/pkg/policy"
+	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/wildcard"
 )

@@ -236,7 +237,6 @@ func (api objectAPIHandlers) PutBucketPolicyHandler(w http.ResponseWriter, r *ht
 	// Before proceeding validate if bucket exists.
 	_, err := objAPI.GetBucketInfo(bucket)
 	if err != nil {
-		errorIf(err, "Unable to find bucket info.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -262,13 +262,29 @@ func (api objectAPIHandlers) PutBucketPolicyHandler(w http.ResponseWriter, r *ht
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
-
-	// Parse validate and save bucket policy.
-	if s3Error := parseAndPersistBucketPolicy(bucket, policyBytes, objAPI); s3Error != ErrNone {
+	policyInfo := policy.BucketAccessPolicy{}
+	if err = json.Unmarshal(policyBytes, &policyInfo); err != nil {
+		writeErrorResponse(w, ErrInvalidPolicyDocument, r.URL)
+		return
+	}
+	// Parse check bucket policy.
+	if s3Error := checkBucketPolicyResources(bucket, policyInfo); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}

+	if err = objAPI.SetBucketPolicy(bucket, policyInfo); err != nil {
+		err = errors.Cause(err)
+		switch err.(type) {
+		case NotImplemented:
+			// Return error for invalid bucket name.
+			writeErrorResponse(w, ErrNotImplemented, r.URL)
+		default:
+			writeErrorResponse(w, ErrMalformedPolicy, r.URL)
+		}
+		return
+	}
+
 	// Success.
 	writeSuccessNoContent(w)
 }
@@ -295,17 +311,13 @@ func (api objectAPIHandlers) DeleteBucketPolicyHandler(w http.ResponseWriter, r
 	// Before proceeding validate if bucket exists.
 	_, err := objAPI.GetBucketInfo(bucket)
 	if err != nil {
-		errorIf(err, "Unable to find bucket info.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}

 	// Delete bucket access policy, by passing an empty policy
 	// struct.
-	err = persistAndNotifyBucketPolicyChange(bucket, policyChange{
-		true, policy.BucketAccessPolicy{},
-	}, objAPI)
-	if err != nil {
+	if err := objAPI.DeleteBucketPolicy(bucket); err != nil {
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -336,15 +348,13 @@ func (api objectAPIHandlers) GetBucketPolicyHandler(w http.ResponseWriter, r *ht
 	// Before proceeding validate if bucket exists.
 	_, err := objAPI.GetBucketInfo(bucket)
 	if err != nil {
-		errorIf(err, "Unable to find bucket info.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}

 	// Read bucket access policy.
-	policy, err := readBucketPolicy(bucket, objAPI)
+	policy, err := objAPI.GetBucketPolicy(bucket)
 	if err != nil {
-		errorIf(err, "Unable to read bucket policy.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -250,7 +250,6 @@ func TestPutBucketPolicyHandler(t *testing.T) {
 // testPutBucketPolicyHandler - Test for Bucket policy end point.
 func testPutBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string, apiRouter http.Handler,
 	credentials auth.Credentials, t *testing.T) {
-	initBucketPolicies(obj)

 	bucketName1 := fmt.Sprintf("%s-1", bucketName)
 	if err := obj.MakeBucketWithLocation(bucketName1, ""); err != nil {
@@ -430,7 +429,7 @@ func testPutBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getWriteOnlyObjectStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, "PutBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getWriteOnlyObjectStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "PutBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getWriteOnlyObjectStatement)

 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -447,6 +446,7 @@ func testPutBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 	// execute the object layer set to `nil` test.
 	// `ExecObjectLayerAPINilTest` manages the operation.
 	ExecObjectLayerAPINilTest(t, nilBucket, "", instanceType, apiRouter, nilReq)
+
 }

 // Wrapper for calling Get Bucket Policy HTTP handler tests for both XL multiple disks and single node setup.
@@ -457,9 +457,6 @@ func TestGetBucketPolicyHandler(t *testing.T) {
 // testGetBucketPolicyHandler - Test for end point which fetches the access policy json of the given bucket.
 func testGetBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string, apiRouter http.Handler,
 	credentials auth.Credentials, t *testing.T) {
-	// initialize bucket policy.
-	initBucketPolicies(obj)
-
 	// template for constructing HTTP request body for PUT bucket policy.
 	bucketPolicyTemplate := `{"Version":"2012-10-17","Statement":[{"Action":["s3:GetBucketLocation","s3:ListBucket"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::%s"],"Sid":""},{"Action":["s3:GetObject"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::%s/this*"],"Sid":""}]}`

@@ -619,7 +616,7 @@ func testGetBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getWriteOnlyObjectStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, "GetBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyObjectStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "GetBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyObjectStatement)

 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -646,8 +643,6 @@ func TestDeleteBucketPolicyHandler(t *testing.T) {
 // testDeleteBucketPolicyHandler - Test for Delete bucket policy end point.
 func testDeleteBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string, apiRouter http.Handler,
 	credentials auth.Credentials, t *testing.T) {
-	// initialize bucket policy.
-	initBucketPolicies(obj)

 	// template for constructing HTTP request body for PUT bucket policy.
 	bucketPolicyTemplate := `{
@@ -824,7 +819,7 @@ func testDeleteBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName str
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getWriteOnlyObjectStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, "DeleteBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyObjectStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "DeleteBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyObjectStatement)

 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -37,9 +37,6 @@ const (
 	bucketPolicyConfig = "policy.json"
 )

-// Variable represents bucket policies in memory.
-var globalBucketPolicies *bucketPolicies
-
 // Global bucket policies list, policies are enforced on each bucket looking
 // through the policies here.
 type bucketPolicies struct {
@@ -49,16 +46,6 @@ type bucketPolicies struct {
 	bucketPolicyConfigs map[string]policy.BucketAccessPolicy
 }

-// Represent a policy change
-type policyChange struct {
-	// isRemove is true if the policy change is to delete the
-	// policy on a bucket.
-	IsRemove bool
-
-	// represents the new policy for the bucket
-	BktPolicy policy.BucketAccessPolicy
-}
-
 // Fetch bucket policy for a given bucket.
 func (bp bucketPolicies) GetBucketPolicy(bucket string) policy.BucketAccessPolicy {
 	bp.rwMutex.RLock()
@@ -68,41 +55,48 @@ func (bp bucketPolicies) GetBucketPolicy(bucket string) policy.BucketAccessPolic

 // Set a new bucket policy for a bucket, this operation will overwrite
 // any previous bucket policies for the bucket.
-func (bp *bucketPolicies) SetBucketPolicy(bucket string, pCh policyChange) error {
+func (bp *bucketPolicies) SetBucketPolicy(bucket string, newpolicy policy.BucketAccessPolicy) error {
 	bp.rwMutex.Lock()
 	defer bp.rwMutex.Unlock()

-	if pCh.IsRemove {
-		delete(bp.bucketPolicyConfigs, bucket)
-	} else {
-		if reflect.DeepEqual(pCh.BktPolicy, emptyBucketPolicy) {
-			return errInvalidArgument
-		}
-		bp.bucketPolicyConfigs[bucket] = pCh.BktPolicy
+	if reflect.DeepEqual(newpolicy, emptyBucketPolicy) {
+		return errInvalidArgument
 	}
+	bp.bucketPolicyConfigs[bucket] = newpolicy
+
 	return nil
 }

-// Loads all bucket policies from persistent layer.
-func loadAllBucketPolicies(objAPI ObjectLayer) (policies map[string]policy.BucketAccessPolicy, err error) {
+// Delete bucket policy from struct for a given bucket.
+func (bp *bucketPolicies) DeleteBucketPolicy(bucket string) error {
+	bp.rwMutex.Lock()
+	defer bp.rwMutex.Unlock()
+	delete(bp.bucketPolicyConfigs, bucket)
+	return nil
+}
+
+// Intialize all bucket policies.
+func initBucketPolicies(objAPI ObjectLayer) (*bucketPolicies, error) {
+	if objAPI == nil {
+		return nil, errInvalidArgument
+	}
+
 	// List buckets to proceed loading all notification configuration.
 	buckets, err := objAPI.ListBuckets()
 	if err != nil {
-		errorIf(err, "Unable to list buckets.")
 		return nil, errors.Cause(err)
 	}

-	policies = make(map[string]policy.BucketAccessPolicy)
-	var pErrs []error
+	policies := make(map[string]policy.BucketAccessPolicy)
 	// Loads bucket policy.
 	for _, bucket := range buckets {
-		bp, pErr := readBucketPolicy(bucket.Name, objAPI)
+		bp, pErr := ReadBucketPolicy(bucket.Name, objAPI)
 		if pErr != nil {
 			// net.Dial fails for rpc client or any
 			// other unexpected errors during net.Dial.
 			if !errors.IsErrIgnored(pErr, errDiskNotFound) {
 				if !isErrBucketPolicyNotFound(pErr) {
-					pErrs = append(pErrs, pErr)
+					return nil, errors.Cause(pErr)
 				}
 			}
 			// Continue to load other bucket policies if possible.
@@ -111,37 +105,11 @@ func loadAllBucketPolicies(objAPI ObjectLayer) (policies map[string]policy.Bucke
 		policies[bucket.Name] = bp
 	}

-	// Look for any errors occurred while reading bucket policies.
-	for _, pErr := range pErrs {
-		if pErr != nil {
-			return policies, pErr
-		}
-	}
-
-	// Success.
-	return policies, nil
-}
-
-// Intialize all bucket policies.
-func initBucketPolicies(objAPI ObjectLayer) error {
-	if objAPI == nil {
-		return errInvalidArgument
-	}
-
-	// Read all bucket policies.
-	policies, err := loadAllBucketPolicies(objAPI)
-	if err != nil {
-		return err
-	}
-
-	// Populate global bucket collection.
-	globalBucketPolicies = &bucketPolicies{
+	// Return all bucket policies.
+	return &bucketPolicies{
 		rwMutex:             &sync.RWMutex{},
 		bucketPolicyConfigs: policies,
-	}
-
-	// Success.
-	return nil
+	}, nil
 }

 // readBucketPolicyJSON - reads bucket policy for an input bucket, returns BucketPolicyNotFound
@@ -149,18 +117,11 @@ func initBucketPolicies(objAPI ObjectLayer) error {
 func readBucketPolicyJSON(bucket string, objAPI ObjectLayer) (bucketPolicyReader io.Reader, err error) {
 	policyPath := pathJoin(bucketConfigPrefix, bucket, bucketPolicyConfig)

-	// Acquire a read lock on policy config before reading.
-	objLock := globalNSMutex.NewNSLock(minioMetaBucket, policyPath)
-	if err = objLock.GetRLock(globalOperationTimeout); err != nil {
-		return nil, err
-	}
-	defer objLock.RUnlock()
-
 	var buffer bytes.Buffer
-	err = objAPI.GetObject(minioMetaBucket, policyPath, 0, -1, &buffer)
+	err = objAPI.GetObject(minioMetaBucket, policyPath, 0, -1, &buffer, "")
 	if err != nil {
 		if isErrObjectNotFound(err) || isErrIncompleteBody(err) {
-			return nil, BucketPolicyNotFound{Bucket: bucket}
+			return nil, PolicyNotFound{Bucket: bucket}
 		}
 		errorIf(err, "Unable to load policy for the bucket %s.", bucket)
 		return nil, errors.Cause(err)
@@ -169,9 +130,9 @@ func readBucketPolicyJSON(bucket string, objAPI ObjectLayer) (bucketPolicyReader
 	return &buffer, nil
 }

-// readBucketPolicy - reads bucket policy for an input bucket, returns BucketPolicyNotFound
+// ReadBucketPolicy - reads bucket policy for an input bucket, returns BucketPolicyNotFound
 // if bucket policy is not found. This function also parses the bucket policy into an object.
-func readBucketPolicy(bucket string, objAPI ObjectLayer) (policy.BucketAccessPolicy, error) {
+func ReadBucketPolicy(bucket string, objAPI ObjectLayer) (policy.BucketAccessPolicy, error) {
 	// Read bucket policy JSON.
 	bucketPolicyReader, err := readBucketPolicyJSON(bucket, objAPI)
 	if err != nil {
@@ -191,15 +152,8 @@ func readBucketPolicy(bucket string, objAPI ObjectLayer) (policy.BucketAccessPol
 // if no policies are found.
 func removeBucketPolicy(bucket string, objAPI ObjectLayer) error {
 	policyPath := pathJoin(bucketConfigPrefix, bucket, bucketPolicyConfig)
-	// Acquire a write lock on policy config before modifying.
-	objLock := globalNSMutex.NewNSLock(minioMetaBucket, policyPath)
-	if err := objLock.GetLock(globalOperationTimeout); err != nil {
-		return err
-	}
-	defer objLock.Unlock()
 	err := objAPI.DeleteObject(minioMetaBucket, policyPath)
 	if err != nil {
-		errorIf(err, "Unable to remove bucket-policy on bucket %s.", bucket)
 		err = errors.Cause(err)
 		if _, ok := err.(ObjectNotFound); ok {
 			return BucketPolicyNotFound{Bucket: bucket}
@@ -217,13 +171,6 @@ func writeBucketPolicy(bucket string, objAPI ObjectLayer, bpy policy.BucketAcces
 		return err
 	}
 	policyPath := pathJoin(bucketConfigPrefix, bucket, bucketPolicyConfig)
-	// Acquire a write lock on policy config before modifying.
-	objLock := globalNSMutex.NewNSLock(minioMetaBucket, policyPath)
-	if err = objLock.GetLock(globalOperationTimeout); err != nil {
-		return err
-	}
-	defer objLock.Unlock()
-
 	hashReader, err := hash.NewReader(bytes.NewReader(buf), int64(len(buf)), "", getSHA256Hash(buf))
 	if err != nil {
 		errorIf(err, "Unable to set policy for the bucket %s", bucket)
@@ -237,62 +184,25 @@ func writeBucketPolicy(bucket string, objAPI ObjectLayer, bpy policy.BucketAcces
 	return nil
 }

-func parseAndPersistBucketPolicy(bucket string, policyBytes []byte, objAPI ObjectLayer) APIErrorCode {
-	// Parse bucket policy.
-	var bktPolicy policy.BucketAccessPolicy
-	err := parseBucketPolicy(bytes.NewReader(policyBytes), &bktPolicy)
-	if err != nil {
-		errorIf(err, "Unable to parse bucket policy.")
-		return ErrInvalidPolicyDocument
-	}
-
-	// Parse check bucket policy.
-	if s3Error := checkBucketPolicyResources(bucket, bktPolicy); s3Error != ErrNone {
-		return s3Error
-	}
-
-	// Acquire a write lock on bucket before modifying its configuration.
-	bucketLock := globalNSMutex.NewNSLock(bucket, "")
-	if bucketLock.GetLock(globalOperationTimeout) != nil {
-		return ErrOperationTimedOut
-	}
-	// Release lock after notifying peers
-	defer bucketLock.Unlock()
-
-	// Save bucket policy.
-	if err = persistAndNotifyBucketPolicyChange(bucket, policyChange{false, bktPolicy}, objAPI); err != nil {
-		switch err.(type) {
-		case BucketNameInvalid:
-			return ErrInvalidBucketName
-		case BucketNotFound:
-			return ErrNoSuchBucket
-		default:
-			errorIf(err, "Unable to save bucket policy.")
-			return ErrInternalError
-		}
-	}
-	return ErrNone
-}
-
 // persistAndNotifyBucketPolicyChange - takes a policyChange argument,
 // persists it to storage, and notify nodes in the cluster about the
 // change. In-memory state is updated in response to the notification.
-func persistAndNotifyBucketPolicyChange(bucket string, pCh policyChange, objAPI ObjectLayer) error {
-	if pCh.IsRemove {
+func persistAndNotifyBucketPolicyChange(bucket string, isRemove bool, bktPolicy policy.BucketAccessPolicy, objAPI ObjectLayer) error {
+	if isRemove {
 		err := removeBucketPolicy(bucket, objAPI)
 		if err != nil {
 			return err
 		}
 	} else {
-		if reflect.DeepEqual(pCh.BktPolicy, emptyBucketPolicy) {
+		if reflect.DeepEqual(bktPolicy, emptyBucketPolicy) {
 			return errInvalidArgument
 		}
-		if err := writeBucketPolicy(bucket, objAPI, pCh.BktPolicy); err != nil {
+		if err := writeBucketPolicy(bucket, objAPI, bktPolicy); err != nil {
 			return err
 		}
 	}

 	// Notify all peers (including self) to update in-memory state
-	S3PeersUpdateBucketPolicy(bucket, pCh)
+	S3PeersUpdateBucketPolicy(bucket)
 	return nil
 }
@@ -22,9 +22,14 @@ import (
 	"encoding/pem"
 	"fmt"
 	"io/ioutil"
-	"path/filepath"
+	"os"
 )

+// TLSPrivateKeyPassword is the environment variable which contains the password used
+// to decrypt the TLS private key. It must be set if the TLS private key is
+// password protected.
+const TLSPrivateKeyPassword = "MINIO_CERT_PASSWD"
+
 func parsePublicCertFile(certFile string) (x509Certs []*x509.Certificate, err error) {
 	// Read certificate file.
 	var data []byte
@@ -58,14 +63,18 @@ func parsePublicCertFile(certFile string) (x509Certs []*x509.Certificate, err er
 func getRootCAs(certsCAsDir string) (*x509.CertPool, error) {
 	// Get all CA file names.
 	var caFiles []string
-	fis, err := ioutil.ReadDir(certsCAsDir)
+	fis, err := readDir(certsCAsDir)
 	if err != nil {
 		return nil, err
 	}
 	for _, fi := range fis {
-		caFiles = append(caFiles, filepath.Join(certsCAsDir, fi.Name()))
+		// Skip all directories.
+		if hasSuffix(fi, slashSeparator) {
+			continue
+		}
+		// We are only interested in regular files here.
+		caFiles = append(caFiles, pathJoin(certsCAsDir, fi))
 	}
-
 	if len(caFiles) == 0 {
 		return nil, nil
 	}
@@ -90,6 +99,36 @@ func getRootCAs(certsCAsDir string) (*x509.CertPool, error) {
 	return rootCAs, nil
 }

+// load an X509 key pair (private key , certificate) from the provided
+// paths. The private key may be encrypted and is decrypted using the
+// ENV_VAR: MINIO_CERT_PASSWD.
+func loadX509KeyPair(certFile, keyFile string) (tls.Certificate, error) {
+	certPEMBlock, err := ioutil.ReadFile(certFile)
+	if err != nil {
+		return tls.Certificate{}, fmt.Errorf("TLS: failed to read cert file: %v", err)
+	}
+	keyPEMBlock, err := ioutil.ReadFile(keyFile)
+	if err != nil {
+		return tls.Certificate{}, fmt.Errorf("TLS: failed to read private key: %v", err)
+	}
+	key, rest := pem.Decode(keyPEMBlock)
+	if len(rest) > 0 {
+		return tls.Certificate{}, fmt.Errorf("TLS: private key contains additional data")
+	}
+	if x509.IsEncryptedPEMBlock(key) {
+		password, ok := os.LookupEnv(TLSPrivateKeyPassword)
+		if !ok {
+			return tls.Certificate{}, fmt.Errorf("TLS: private key is encrypted but no password is present - set env var: %s", TLSPrivateKeyPassword)
+		}
+		decryptedKey, decErr := x509.DecryptPEMBlock(key, []byte(password))
+		if decErr != nil {
+			return tls.Certificate{}, fmt.Errorf("TLS: failed to decrypt private key: %v", decErr)
+		}
+		keyPEMBlock = pem.EncodeToMemory(&pem.Block{Type: key.Type, Bytes: decryptedKey})
+	}
+	return tls.X509KeyPair(certPEMBlock, keyPEMBlock)
+}
+
 func getSSLConfig() (x509Certs []*x509.Certificate, rootCAs *x509.CertPool, tlsCert *tls.Certificate, secureConn bool, err error) {
 	if !(isFile(getPublicCertFile()) && isFile(getPrivateKeyFile())) {
 		return nil, nil, nil, false, nil
@@ -100,7 +139,7 @@ func getSSLConfig() (x509Certs []*x509.Certificate, rootCAs *x509.CertPool, tlsC
 	}

 	var cert tls.Certificate
-	if cert, err = tls.LoadX509KeyPair(getPublicCertFile(), getPrivateKeyFile()); err != nil {
+	if cert, err = loadX509KeyPair(getPublicCertFile(), getPrivateKeyFile()); err != nil {
 		return nil, nil, nil, false, err
 	}

@@ -219,27 +219,16 @@ func TestGetRootCAs(t *testing.T) {
 		t.Fatalf("Unable create test file. %v", err)
 	}

-	nonexistentErr := fmt.Errorf("open nonexistent-dir: no such file or directory")
-	if runtime.GOOS == "windows" {
-		// Below concatenation is done to get rid of goline error
-		// "error strings should not be capitalized or end with punctuation or a newline"
-		nonexistentErr = fmt.Errorf("open nonexistent-dir:" + " The system cannot find the file specified.")
-	}
-
-	err1 := fmt.Errorf("read %s: is a directory", filepath.Join(dir1, "empty-dir"))
-	if runtime.GOOS == "windows" {
-		// Below concatenation is done to get rid of goline error
-		// "error strings should not be capitalized or end with punctuation or a newline"
-		err1 = fmt.Errorf("read %s:"+" The handle is invalid.", filepath.Join(dir1, "empty-dir"))
-	}
-
 	testCases := []struct {
 		certCAsDir  string
 		expectedErr error
 	}{
-		{"nonexistent-dir", nonexistentErr},
-		{dir1, err1},
+		{"nonexistent-dir", errFileNotFound},
+		// Ignores directories.
+		{dir1, nil},
+		// Ignore empty directory.
 		{emptydir, nil},
+		// Loads the cert properly.
 		{dir2, nil},
 	}

@@ -257,3 +246,252 @@ func TestGetRootCAs(t *testing.T) {
 		}
 	}
 }
+
+func TestLoadX509KeyPair(t *testing.T) {
+	for i, testCase := range loadX509KeyPairTests {
+		privateKey, err := createTempFile("private.key", testCase.privateKey)
+		if err != nil {
+			t.Fatalf("Test %d: failed to create tmp private key file: %v", i, err)
+		}
+		certificate, err := createTempFile("public.crt", testCase.certificate)
+		if err != nil {
+			os.Remove(privateKey)
+			t.Fatalf("Test %d: failed to create tmp certificate file: %v", i, err)
+		}
+
+		os.Unsetenv(TLSPrivateKeyPassword)
+		if testCase.password != "" {
+			os.Setenv(TLSPrivateKeyPassword, testCase.password)
+		}
+		_, err = loadX509KeyPair(certificate, privateKey)
+		if err != nil && !testCase.shouldFail {
+			t.Errorf("Test %d: test should succeed but it failed: %v", i, err)
+		}
+		if err == nil && testCase.shouldFail {
+			t.Errorf("Test %d: test should fail but it succeed", i)
+		}
+		os.Remove(privateKey)
+		os.Remove(certificate)
+	}
+}
+
+var loadX509KeyPairTests = []struct {
+	password                string
+	privateKey, certificate string
+	shouldFail              bool
+}{
+	{
+		password: "foobar",
+		privateKey: `-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,CC483BF11678C35F9F02A1AD85DAE285
+
+nMDFd+Qxk1f+S7LwMitmMofNXYNbCY4L1QEqPOOx5wnjNF1wSxmEkL7+h8W4Y/vb
+AQt/7TCcUSuSqEMl45nUIcCbhBos5wz+ShvFiez3qKwmR5HSURvqyN6PIJeAbU+h
+uw/cvAQsCH1Cq+gYkDJqjrizPhGqg7mSkqyeST3PbOl+ZXc0wynIjA34JSwO3c5j
+cF7XKHETtNGj1+AiLruX4wYZAJwQnK375fCoNVMO992zC6K83d8kvGMUgmJjkiIj
+q3s4ymFGfoo0S/XNDQXgE5A5QjAKRKUyW2i7pHIIhTyOpeJQeFHDi2/zaZRxoCog
+lD2/HKLi5xJtRelZaaGyEJ20c05VzaSZ+EtRIN33foNdyQQL6iAUU3hJ6JlcmRIB
+bRfX4XPH1w9UfFU5ZKwUciCoDcL65bsyv/y56ItljBp7Ok+UUKl0H4myFNOSfsuU
+IIj4neslnAvwQ8SN4XUpug+7pGF+2m/5UDwRzSUN1H2RfgWN95kqR+tYqCq/E+KO
+i0svzFrljSHswsFoPBqKngI7hHwc9QTt5q4frXwj9I4F6HHrTKZnC5M4ef26sbJ1
+r7JRmkt0h/GfcS355b0uoBTtF1R8tSJo85Zh47wE+ucdjEvy9/pjnzKqIoJo9bNZ
+ri+ue7GhH5EUca1Kd10bH8FqTF+8AHh4yW6xMxSkSgFGp7KtraAVpdp+6kosymqh
+dz9VMjA8i28btfkS2isRaCpyumaFYJ3DJMFYhmeyt6gqYovmRLX0qrBf8nrkFTAA
+ZmykWsc8ErsCudxlDmKVemuyFL7jtm9IRPq+Jh+IrmixLJFx8PKkNAM6g+A8irx8
+piw+yhRsVy5Jk2QeIqvbpxN6BfCNcix4sWkusiCJrAqQFuSm26Mhh53Ig1DXG4d3
+6QY1T8tW80Q6JHUtDR+iOPqW6EmrNiEopzirvhGv9FicXZ0Lo2yKJueeeihWhFLL
+GmlnCjWVMO4hoo8lWCHv95JkPxGMcecCacKKUbHlXzCGyw3+eeTEHMWMEhziLeBy
+HZJ1/GReI3Sx7XlUCkG4468Yz3PpmbNIk/U5XKE7TGuxKmfcWQpu022iF/9DrKTz
+KVhKimCBXJX345bCFe1rN2z5CV6sv87FkMs5Y+OjPw6qYFZPVKO2TdUUBcpXbQMg
+UW+Kuaax9W7214Stlil727MjRCiH1+0yODg4nWj4pTSocA5R3pn5cwqrjMu97OmL
+ESx4DHmy4keeSy3+AIAehCZlwgeLb70/xCSRhJMIMS9Q6bz8CPkEWN8bBZt95oeo
+37LqZ7lNmq61fs1x1tq0VUnI9HwLFEnsiubp6RG0Yu8l/uImjjjXa/ytW2GXrfUi
+zM22dOntu6u23iBxRBJRWdFTVUz7qrdu+PHavr+Y7TbCeiBwiypmz5llf823UIVx
+btamI6ziAq2gKZhObIhut7sjaLkAyTLlNVkNN1WNaplAXpW25UFVk93MHbvZ27bx
+9iLGs/qB2kDTUjffSQoHTLY1GoLxv83RgVspUGQjslztEEpWfYvGfVLcgYLv933B
+aRW9BRoNZ0czKx7Lhuwjreyb5IcWDarhC8q29ZkkWsQQonaPb0kTEFJul80Yqk0k
+-----END RSA PRIVATE KEY-----`,
+		certificate: `-----BEGIN CERTIFICATE-----
+MIIDiTCCAnGgAwIBAgIJAK5m5S7EE46kMA0GCSqGSIb3DQEBCwUAMFsxCzAJBgNV
+BAYTAlVTMQ4wDAYDVQQIDAVzdGF0ZTERMA8GA1UEBwwIbG9jYXRpb24xFTATBgNV
+BAoMDG9yZ2FuaXphdGlvbjESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTE3MTIxODE4
+MDUyOFoXDTI3MTIxNjE4MDUyOFowWzELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBXN0
+YXRlMREwDwYDVQQHDAhsb2NhdGlvbjEVMBMGA1UECgwMb3JnYW5pemF0aW9uMRIw
+EAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDPJfYY5Dhsntrqwyu7ZgKM/zrlKEjCwGHhWJBdZdeZCHQlY8ISrtDxxp2XMmI6
+HsszalEhNF9fk3vSXWclTuomG03fgGzP4R6QpcwGUCxhRF1J+0b64Yi8pw2uEGsR
+GuMwLhGorcWalNoihgHc0BQ4vO8aaTNTX7iD06olesP6vGNu/S8h0VomE+0v9qYc
+VF66Zaiv/6OmxAtDpElJjVd0mY7G85BlDlFrVwzd7zhRiuJZ4iDg749Xt9GuuKla
+Dvr14glHhP4dQgUbhluJmIHMdx2ZPjk+5FxaDK6I9IUpxczFDe4agDE6lKzU1eLd
+cCXRWFOf6q9lTB1hUZfmWfTxAgMBAAGjUDBOMB0GA1UdDgQWBBTQh7lDTq+8salD
+0HBNILochiiNaDAfBgNVHSMEGDAWgBTQh7lDTq+8salD0HBNILochiiNaDAMBgNV
+HRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAqi9LycxcXKNSDXaPkCKvw7RQy
+iMBDGm1kIY++p3tzbUGuaeu85TsswKnqd50AullEU+aQxRRJGfR8eSKzQJMBXLMQ
+b4ptYCc5OrZtRHT8NaZ/df2tc6I88kN8dBu6ybcNGsevXA/iNX3kKLW7naxdr5jj
+KUudWSuqDCjCmQa5bYb9H6DreLH2lUItSWBa/YmeZ3VSezDCd+XYO53QKwZVj8Jb
+bulZmoo7e7HO1qecEzWKL10UYyEbG3UDPtw+NZc142ZYeEhXQ0dsstGAO5hf3hEl
+kQyKGUTpDbKLuyYMFsoH73YLjBqNe+UEhPwE+FWpcky1Sp9RTx/oMLpiZaPR
+-----END CERTIFICATE-----`,
+		shouldFail: false,
+	},
+	{
+		password: "password",
+		privateKey: `-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,CC483BF11678C35F9F02A1AD85DAE285
+
+nMDFd+Qxk1f+S7LwMitmMofNXYNbCY4L1QEqPOOx5wnjNF1wSxmEkL7+h8W4Y/vb
+AQt/7TCcUSuSqEMl45nUIcCbhBos5wz+ShvFiez3qKwmR5HSURvqyN6PIJeAbU+h
+uw/cvAQsCH1Cq+gYkDJqjrizPhGqg7mSkqyeST3PbOl+ZXc0wynIjA34JSwO3c5j
+cF7XKHETtNGj1+AiLruX4wYZAJwQnK375fCoNVMO992zC6K83d8kvGMUgmJjkiIj
+q3s4ymFGfoo0S/XNDQXgE5A5QjAKRKUyW2i7pHIIhTyOpeJQeFHDi2/zaZRxoCog
+lD2/HKLi5xJtRelZaaGyEJ20c05VzaSZ+EtRIN33foNdyQQL6iAUU3hJ6JlcmRIB
+bRfX4XPH1w9UfFU5ZKwUciCoDcL65bsyv/y56ItljBp7Ok+UUKl0H4myFNOSfsuU
+IIj4neslnAvwQ8SN4XUpug+7pGF+2m/5UDwRzSUN1H2RfgWN95kqR+tYqCq/E+KO
+i0svzFrljSHswsFoPBqKngI7hHwc9QTt5q4frXwj9I4F6HHrTKZnC5M4ef26sbJ1
+r7JRmkt0h/GfcS355b0uoBTtF1R8tSJo85Zh47wE+ucdjEvy9/pjnzKqIoJo9bNZ
+ri+ue7GhH5EUca1Kd10bH8FqTF+8AHh4yW6xMxSkSgFGp7KtraAVpdp+6kosymqh
+dz9VMjA8i28btfkS2isRaCpyumaFYJ3DJMFYhmeyt6gqYovmRLX0qrBf8nrkFTAA
+ZmykWsc8ErsCudxlDmKVemuyFL7jtm9IRPq+Jh+IrmixLJFx8PKkNAM6g+A8irx8
+piw+yhRsVy5Jk2QeIqvbpxN6BfCNcix4sWkusiCJrAqQFuSm26Mhh53Ig1DXG4d3
+6QY1T8tW80Q6JHUtDR+iOPqW6EmrNiEopzirvhGv9FicXZ0Lo2yKJueeeihWhFLL
+GmlnCjWVMO4hoo8lWCHv95JkPxGMcecCacKKUbHlXzCGyw3+eeTEHMWMEhziLeBy
+HZJ1/GReI3Sx7XlUCkG4468Yz3PpmbNIk/U5XKE7TGuxKmfcWQpu022iF/9DrKTz
+KVhKimCBXJX345bCFe1rN2z5CV6sv87FkMs5Y+OjPw6qYFZPVKO2TdUUBcpXbQMg
+UW+Kuaax9W7214Stlil727MjRCiH1+0yODg4nWj4pTSocA5R3pn5cwqrjMu97OmL
+ESx4DHmy4keeSy3+AIAehCZlwgeLb70/xCSRhJMIMS9Q6bz8CPkEWN8bBZt95oeo
+37LqZ7lNmq61fs1x1tq0VUnI9HwLFEnsiubp6RG0Yu8l/uImjjjXa/ytW2GXrfUi
+zM22dOntu6u23iBxRBJRWdFTVUz7qrdu+PHavr+Y7TbCeiBwiypmz5llf823UIVx
+btamI6ziAq2gKZhObIhut7sjaLkAyTLlNVkNN1WNaplAXpW25UFVk93MHbvZ27bx
+9iLGs/qB2kDTUjffSQoHTLY1GoLxv83RgVspUGQjslztEEpWfYvGfVLcgYLv933B
+aRW9BRoNZ0czKx7Lhuwjreyb5IcWDarhC8q29ZkkWsQQonaPb0kTEFJul80Yqk0k
+-----END RSA PRIVATE KEY-----`,
+		certificate: `-----BEGIN CERTIFICATE-----
+MIIDiTCCAnGgAwIBAgIJAK5m5S7EE46kMA0GCSqGSIb3DQEBCwUAMFsxCzAJBgNV
+BAYTAlVTMQ4wDAYDVQQIDAVzdGF0ZTERMA8GA1UEBwwIbG9jYXRpb24xFTATBgNV
+BAoMDG9yZ2FuaXphdGlvbjESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTE3MTIxODE4
+MDUyOFoXDTI3MTIxNjE4MDUyOFowWzELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBXN0
+YXRlMREwDwYDVQQHDAhsb2NhdGlvbjEVMBMGA1UECgwMb3JnYW5pemF0aW9uMRIw
+EAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDPJfYY5Dhsntrqwyu7ZgKM/zrlKEjCwGHhWJBdZdeZCHQlY8ISrtDxxp2XMmI6
+HsszalEhNF9fk3vSXWclTuomG03fgGzP4R6QpcwGUCxhRF1J+0b64Yi8pw2uEGsR
+GuMwLhGorcWalNoihgHc0BQ4vO8aaTNTX7iD06olesP6vGNu/S8h0VomE+0v9qYc
+VF66Zaiv/6OmxAtDpElJjVd0mY7G85BlDlFrVwzd7zhRiuJZ4iDg749Xt9GuuKla
+Dvr14glHhP4dQgUbhluJmIHMdx2ZPjk+5FxaDK6I9IUpxczFDe4agDE6lKzU1eLd
+cCXRWFOf6q9lTB1hUZfmWfTxAgMBAAGjUDBOMB0GA1UdDgQWBBTQh7lDTq+8salD
+0HBNILochiiNaDAfBgNVHSMEGDAWgBTQh7lDTq+8salD0HBNILochiiNaDAMBgNV
+HRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAqi9LycxcXKNSDXaPkCKvw7RQy
+iMBDGm1kIY++p3tzbUGuaeu85TsswKnqd50AullEU+aQxRRJGfR8eSKzQJMBXLMQ
+b4ptYCc5OrZtRHT8NaZ/df2tc6I88kN8dBu6ybcNGsevXA/iNX3kKLW7naxdr5jj
+KUudWSuqDCjCmQa5bYb9H6DreLH2lUItSWBa/YmeZ3VSezDCd+XYO53QKwZVj8Jb
+bulZmoo7e7HO1qecEzWKL10UYyEbG3UDPtw+NZc142ZYeEhXQ0dsstGAO5hf3hEl
+kQyKGUTpDbKLuyYMFsoH73YLjBqNe+UEhPwE+FWpcky1Sp9RTx/oMLpiZaPR
+-----END CERTIFICATE-----`,
+		shouldFail: true,
+	},
+	{
+		password: "",
+		privateKey: `-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEA4K9Qq7vMY2bGkrdFAYpBYNLlCgnnFU+0pi+N+3bjuWmfX/kw
+WXBa3SDqKD08PWWzwvBSLPCCUV2IuUd7tBa1pJ2wXkdoDeI5InYHJKrXbSZonni6
+Bex7sgnqV/9o8xFkSOleoQWZgyeKGxtt0J/Z+zhpH+zXahwM4wOL3yzLSQt+NCKM
+6N96zXYi16DEa89fYwRxPwE1XTRc7Ddggqx+4iRHvYG0fyTNcPB/+UiFw59EE1Sg
+QIyTVntVqpsb6s8XdkFxURoLxefhcMVf2kU0T04OWI3gmeavKfTcj8Z2/bjPSsqP
+mgkADv9Ru6VnSK/96TW/NwxWJ32PBz6Sbl9LdwIDAQABAoIBABVh+d5uH/RxyoIZ
+PI9kx1A1NVQvfI0RK/wJKYC2YdCuw0qLOTGIY+b20z7DumU7TenIVrvhKdzrFhd
+qjMoWh8RdsByMT/pAKD79JATxi64EgrK2IFJ0TfPY8L+JqHDTPT3aK8QVly5/ZW4
+1YmePOOAqdiE9Lc/diaApuYVYD9SL/X7fYs1ezOB4oGXoz0rthX77zHMxcEurpK3
+VgSnaq7FYTVY7GrFB+ASiAlDIyLwztz08Ijn8aG0QAZ8GFuPGSmPMXWjLwFhRZsa
+Gfy5BYiA0bVSnQSPHzAnHu9HyGlsdouVPPvJB3SrvMl+BFhZiUuR8OGSob7z7hfI
+hMyHbNECgYEA/gyG7sHAb5mPkhq9JkTv+LrMY5NDZKYcSlbvBlM3kd6Ib3Hxl+6T
+FMq2TWIrh2+mT1C14htziHd05dF6St995Tby6CJxTj6a/2Odnfm+JcOou/ula4Sz
+92nIGlGPTJXstDbHGnRCpk6AomXK02stydTyrCisOw1H+LyTG6aT0q8CgYEA4mkO
+hfLJkgmJzWIhxHR901uWHz/LId0gC6FQCeaqWmRup6Bl97f0U6xokw4tw8DJOncF
+yZpYRXUXhdv/FXCjtXvAhKIX5+e+3dlzPHIdekSfcY00ip/ifAS1OyVviJia+cna
+eJgq8WLHxJZim9Ah93NlPyiqGPwtasub90qjZbkCgYEA35WK02o1wII3dvCNc7bM
+M+3CoAglEdmXoF1uM/TdPUXKcbqoU3ymeXAGjYhOov3CMp/n0z0xqvLnMLPxmx+i
+ny6DDYXyjlhO9WFogHYhwP636+mHJl8+PAsfDvqk0VRJZDmpdUDIv7DrSQGpRfRX
+8f+2K4oIOlhv9RuRpI4wHwUCgYB8OjaMyn1NEsy4k2qBt4U+jhcdyEv1pbWqi/U1
+qYm5FTgd44VvWVDHBGdQoMv9h28iFCJpzrU2Txv8B4y7v9Ujg+ZLIAFL7j0szt5K
+wTZpWvO9Q0Qb98Q2VgL2lADRiyIlglrMJnoRfiisNfOfGKE6e+eGsxI5qUxmN5e5
+JQvoiQKBgQCqgyuUBIu/Qsb3qUED/o0S5wCel43Yh/Rl+mxDinOUvJfKJSW2SyEk
+jDo0xw3Opg6ZC5Lj2V809LA/XteaIuyhRuqOopjhHIvIvrYGe+2O8q9/Mv40BYW
+0BhJ/Gdseps0C6Z5mTT5Fee4YVlGZuyuNKmKTd4JmqInfBV3ncMWQg==
+-----END RSA PRIVATE KEY-----`,
+		certificate: `-----BEGIN CERTIFICATE-----
+MIIDiTCCAnGgAwIBAgIJAIb84Z5Mh31iMA0GCSqGSIb3DQEBCwUAMFsxCzAJBgNV
+BAYTAlVTMQ4wDAYDVQQIDAVzdGF0ZTERMA8GA1UEBwwIbG9jYXRpb24xFTATBgNV
+BAoMDG9yZ2FuaXphdGlvbjESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTE3MTIxODE4
+NTcyM1oXDTI3MTIxNjE4NTcyM1owWzELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBXN0
+YXRlMREwDwYDVQQHDAhsb2NhdGlvbjEVMBMGA1UECgwMb3JnYW5pemF0aW9uMRIw
+EAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDgr1Cru8xjZsaSt0UBikFg0uUKCecVT7SmL437duO5aZ9f+TBZcFrdIOooPTw9
+ZbPC8FIs8IJRXYi5R3u0FrWknbBeR2gN4jkidgckqtdtJmieeLoF7HuyCepX/2jz
+EWRI6V6hBZmDJ4obG23Qn9n7OGkf7NdqHAzjA4vfLMtJC340Iozo33rNdiLXoMRr
+z19jBHE/ATVdNFzsN2CCrH7iJEe9gbR/JM1w8H/5SIXDn0QTVKBAjJNWe1Wqmxvq
+zxd2QXFRGgvF5+FwxV/aRTRPTg5YjeCZ5q8p9NyPxnb9uM9Kyo+aCQAO/1G7pWdI
+r/3pNb83DFYnfY8HPpJuX0t3AgMBAAGjUDBOMB0GA1UdDgQWBBQ2/bSCHscnoV+0
+d+YJxLu4XLSNIDAfBgNVHSMEGDAWgBQ2/bSCHscnoV+0d+YJxLu4XLSNIDAMBgNV
+HRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQC6p4gPwmkoDtRsP1c8IWgXFka+
+Q59oe79ZK1RqDE6ZZu0rgw07rPzKr4ofW4hTxnx7PUgKOhWLq9VvwEC/9tDbD0Gw
+SKknRZZOiEE3qUZbwNtHMd4UBzpzChTRC6RcwC5zT1/WICMUHxa4b8E2umJuf3Qd
+5Y23sXEESx5evr49z6DLcVe2i70o2wJeWs2kaXqhCJt0X7z0rnYqjfFdvxd8dyzt
+1DXmE45cLadpWHDg26DMsdchamgnqEo79YUxkH6G/Cb8ZX4igQ/CsxCDOKvccjHO
+OncDtuIpK8O7OyfHP3+MBpUFG4P6Ctn7RVcZe9fQweTpfAy18G+loVzuUeOD
+-----END CERTIFICATE-----`,
+		shouldFail: false,
+	},
+	{
+		password: "foobar",
+		privateKey: `-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEA4K9Qq7vMY2bGkrdFAYpBYNLlCgnnFU+0pi+N+3bjuWmfX/kw
+WXBa3SDqKD08PWWzwvBSLPCCUV2IuUd7tBa1pJ2wXkdoDeI5InYHJKrXbSZonni6
+Bex7sgnqV/9o8xFkSOleoQWZgyeKGxtt0J/Z+zhpH+zXahwM4wOL3yzLSQt+NCKM
+6N96zXYi16DEa89fYwRxPwE1XTRc7Ddggqx+4iRHvYG0fyTNcPB/+UiFw59EE1Sg
+QIyTVntVqpsb6s8XdkFxURoLxefhcMVf2kU0T04OWI3gmeavKfTcj8Z2/bjPSsqP
+mgkADv9Ru6VnSK/96TW/NwxWJ32PBz6Sbl9LdwIDAQABAoIBABVh+d5uH/RxyoIZ
+PI9kx1A1NVQvfI0RK/wJKYC2YdCuw0qLOTGIY+b20z7DumU7TenIVrvhKdzrFhd
+qjMoWh8RdsByMT/pAKD79JATxi64EgrK2IFJ0TfPY8L+JqHDTPT3aK8QVly5/ZW4
+1YmePOOAqdiE9Lc/diaApuYVYD9SL/X7fYs1ezOB4oGXoz0rthX77zHMxcEurpK3
+VgSnaq7FYTVY7GrFB+ASiAlDIyLwztz08Ijn8aG0QAZ8GFuPGSmPMXWjLwFhRZsa
+Gfy5BYiA0bVSnQSPHzAnHu9HyGlsdouVPPvJB3SrvMl+BFhZiUuR8OGSob7z7hfI
+hMyHbNECgYEA/gyG7sHAb5mPkhq9JkTv+LrMY5NDZKYcSlbvBlM3kd6Ib3Hxl+6T
+FMq2TWIrh2+mT1C14htziHd05dF6St995Tby6CJxTj6a/2Odnfm+JcOou/ula4Sz
+92nIGlGPTJXstDbHGnRCpk6AomXK02stydTyrCisOw1H+LyTG6aT0q8CgYEA4mkO
+hfLJkgmJzWIhxHR901uWHz/LId0gC6FQCeaqWmRup6Bl97f0U6xokw4tw8DJOncF
+yZpYRXUXhdv/FXCjtXvAhKIX5+e+3dlzPHIdekSfcY00ip/ifAS1OyVviJia+cna
+eJgq8WLHxJZim9Ah93NlPyiqGPwtasub90qjZbkCgYEA35WK02o1wII3dvCNc7bM
+M+3CoAglEdmXoF1uM/TdPUXKcbqoU3ymeXAGjYhOov3CMp/n0z0xqvLnMLPxmx+i
+ny6DDYXyjlhO9WFogHYhwP636+mHJl8+PAsfDvqk0VRJZDmpdUDIv7DrSQGpRfRX
+8f+2K4oIOlhv9RuRpI4wHwUCgYB8OjaMyn1NEsy4k2qBt4U+jhcdyEv1pbWqi/U1
+qYm5FTgd44VvWVDHBGdQoMv9h28iFCJpzrU2Txv8B4y7v9Ujg+ZLIAFL7j0szt5K
+wTZpWvO9Q0Qb98Q2VgL2lADRiyIlglrMJnoRfiisNfOfGKE6e+eGsxI5qUxmN5e5
+JQvoiQKBgQCqgyuUBIu/Qsb3qUED/o0S5wCel43Yh/Rl+mxDinOUvJfKJSW2SyEk
+jDo0xw3Opg6ZC5Lj2V809LA/XteaIuyhRuqOopjhHIvIvrYGe+2O8q9/Mv40BYW
+0BhJ/Gdseps0C6Z5mTT5Fee4YVlGZuyuNKmKTd4JmqInfBV3ncMWQg==
+-----END RSA PRIVATE KEY-----`,
+		certificate: `-----BEGIN CERTIFICATE-----
+MIIDiTCCAnGgAwIBAgIJAIb84Z5Mh31iMA0GCSqGSIb3DQEBCwUAMFsxCzAJBgNV
+BAYTAlVTMQ4wDAYDVQQIDAVzdGF0ZTERMA8GA1UEBwwIbG9jYXRpb24xFTATBgNV
+BAoMDG9yZ2FuaXphdGlvbjESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTE3MTIxODE4
+NTcyM1oXDTI3MTIxNjE4NTcyM1owWzELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBXN0
+YXRlMREwDwYDVQQHDAhsb2NhdGlvbjEVMBMGA1UECgwMb3JnYW5pemF0aW9uMRIw
+EAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDgr1Cru8xjZsaSt0UBikFg0uUKCecVT7SmL437duO5aZ9f+TBZcFrdIOooPTw9
+ZbPC8FIs8IJRXYi5R3u0FrWknbBeR2gN4jkidgckqtdtJmieeLoF7HuyCepX/2jz
+EWRI6V6hBZmDJ4obG23Qn9n7OGkf7NdqHAzjA4vfLMtJC340Iozo33rNdiLXoMRr
+z19jBHE/ATVdNFzsN2CCrH7iJEe9gbR/JM1w8H/5SIXDn0QTVKBAjJNWe1Wqmxvq
+zxd2QXFRGgvF5+FwxV/aRTRPTg5YjeCZ5q8p9NyPxnb9uM9Kyo+aCQAO/1G7pWdI
+r/3pNb83DFYnfY8HPpJuX0t3AgMBAAGjUDBOMB0GA1UdDgQWBBQ2/bSCHscnoV+0
+d+YJxLu4XLSNIDAfBgNVHSMEGDAWgBQ2/bSCHscnoV+0d+YJxLu4XLSNIDAMBgNV
+HRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQC6p4gPwmkoDtRsP1c8IWgXFka+
+Q59oe79ZK1RqDE6ZZu0rgw07rPzKr4ofW4hTxnx7PUgKOhWLq9VvwEC/9tDbD0Gw
+SKknRZZOiEE3qUZbwNtHMd4UBzpzChTRC6RcwC5zT1/WICMUHxa4b8E2umJuf3Qd
+5Y23sXEESx5evr49z6DLcVe2i70o2wJeWs2kaXqhCJt0X7z0rnYqjfFdvxd8dyzt
+1DXmE45cLadpWHDg26DMsdchamgnqEo79YUxkH6G/Cb8ZX4igQ/CsxCDOKvccjHO
+OncDtuIpK8O7OyfHP3+MBpUFG4P6Ctn7RVcZe9fQweTpfAy18G+loVzuUeOD
+-----END CERTIFICATE-----`,
+		shouldFail: false,
+	},
+}
@@ -1,5 +1,5 @@
 /*
- * Minio Cloud Storage, (C) 2017 Minio, Inc.
+ * Minio Cloud Storage, (C) 2017, 2018 Minio, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -51,23 +51,36 @@ func initConfig() {
 }

 func handleCommonCmdArgs(ctx *cli.Context) {
-	// Set configuration directory.
-	{
-		// Get configuration directory from command line argument.
-		configDir := ctx.String("config-dir")
-		if !ctx.IsSet("config-dir") && ctx.GlobalIsSet("config-dir") {
-			configDir = ctx.GlobalString("config-dir")
+
+	var configDir string
+
+	if ctx.IsSet("config-dir") {
+		configDir = ctx.String("config-dir")
+	} else if ctx.GlobalIsSet("config-dir") {
+		configDir = ctx.GlobalString("config-dir")
+		// cli package does not expose parent's "config-dir" option.  Below code is workaround.
+		if configDir == "" || configDir == getConfigDir() {
+			if ctx.Parent().GlobalIsSet("config-dir") {
+				configDir = ctx.Parent().GlobalString("config-dir")
+			}
 		}
+	} else {
+		// Neither local nor global config-dir option is provided.  In this case, try to use
+		// default config directory.
+		configDir = getConfigDir()
 		if configDir == "" {
-			fatalIf(errors.New("empty directory"), "Configuration directory cannot be empty.")
+			fatalIf(errors.New("missing option"), "config-dir option must be provided.")
 		}
-
-		// Disallow relative paths, figure out absolute paths.
-		configDirAbs, err := filepath.Abs(configDir)
-		fatalIf(err, "Unable to fetch absolute path for config directory %s", configDir)
-
-		setConfigDir(configDirAbs)
 	}
+
+	if configDir == "" {
+		fatalIf(errors.New("empty directory"), "Configuration directory cannot be empty.")
+	}
+
+	// Disallow relative paths, figure out absolute paths.
+	configDirAbs, err := filepath.Abs(configDir)
+	fatalIf(err, "Unable to fetch absolute path for config directory %s", configDir)
+	setConfigDir(configDirAbs)
 }

 func handleCommonEnvVars() {
@@ -76,9 +89,6 @@ func handleCommonEnvVars() {
 		globalProfiler = startProfiler(profiler)
 	}

-	// Check if object cache is disabled.
-	globalXLObjCacheDisabled = strings.EqualFold(os.Getenv("_MINIO_CACHE"), "off")
-
 	accessKey := os.Getenv("MINIO_ACCESS_KEY")
 	secretKey := os.Getenv("MINIO_SECRET_KEY")
 	if accessKey != "" && secretKey != "" {
@@ -102,7 +112,12 @@ func handleCommonEnvVars() {
 		globalIsBrowserEnabled = bool(browserFlag)
 	}

-	globalHTTPTrace = os.Getenv("MINIO_HTTP_TRACE") != ""
+	traceFile := os.Getenv("MINIO_HTTP_TRACE")
+	if traceFile != "" {
+		var err error
+		globalHTTPTraceFile, err = os.OpenFile(traceFile, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0660)
+		fatalIf(err, "error opening file %s", traceFile)
+	}

 	globalDomainName = os.Getenv("MINIO_DOMAIN")
 	if globalDomainName != "" {
@@ -132,13 +147,13 @@ func handleCommonEnvVars() {
 		// Validation is done after parsing both the storage classes. This is needed because we need one
 		// storage class value to deduce the correct value of the other storage class.
 		if globalRRStorageClass.Scheme != "" {
-			err := validateRRSParity(globalRRStorageClass.Parity, globalStandardStorageClass.Parity)
+			err = validateParity(globalStandardStorageClass.Parity, globalRRStorageClass.Parity)
 			fatalIf(err, "Invalid value set in environment variable %s.", reducedRedundancyStorageClassEnv)
 			globalIsStorageClass = true
 		}

 		if globalStandardStorageClass.Scheme != "" {
-			err := validateSSParity(globalStandardStorageClass.Parity, globalRRStorageClass.Parity)
+			err = validateParity(globalStandardStorageClass.Parity, globalRRStorageClass.Parity)
 			fatalIf(err, "Invalid value set in environment variable %s.", standardStorageClassEnv)
 			globalIsStorageClass = true
 		}
@@ -20,7 +20,7 @@ import (
 	"errors"
 	"fmt"
 	"io/ioutil"
-	"strconv"
+	"reflect"
 	"sync"

 	"github.com/minio/minio/pkg/auth"
@@ -49,34 +49,22 @@ var (

 // GetVersion get current config version.
 func (s *serverConfig) GetVersion() string {
-	s.RLock()
-	defer s.RUnlock()
-
 	return s.Version
 }

 // SetRegion set a new region.
 func (s *serverConfig) SetRegion(region string) {
-	s.Lock()
-	defer s.Unlock()
-
 	// Save new region.
 	s.Region = region
 }

 // GetRegion get current region.
 func (s *serverConfig) GetRegion() string {
-	s.RLock()
-	defer s.RUnlock()
-
 	return s.Region
 }

 // SetCredential sets new credential and returns the previous credential.
 func (s *serverConfig) SetCredential(creds auth.Credentials) (prevCred auth.Credentials) {
-	s.Lock()
-	defer s.Unlock()
-
 	// Save previous credential.
 	prevCred = s.Credential

@@ -89,91 +77,92 @@ func (s *serverConfig) SetCredential(creds auth.Credentials) (prevCred auth.Cred

 // GetCredentials get current credentials.
 func (s *serverConfig) GetCredential() auth.Credentials {
-	s.RLock()
-	defer s.RUnlock()
-
 	return s.Credential
 }

 // SetBrowser set if browser is enabled.
 func (s *serverConfig) SetBrowser(b bool) {
-	s.Lock()
-	defer s.Unlock()
-
 	// Set the new value.
 	s.Browser = BrowserFlag(b)
 }

 func (s *serverConfig) SetStorageClass(standardClass, rrsClass storageClass) {
-	s.Lock()
-	defer s.Unlock()
-
-	// Set the values
-	s.StorageClass.Standard = standardClass.Scheme + strconv.Itoa(standardClass.Parity)
-	s.StorageClass.RRS = rrsClass.Scheme + strconv.Itoa(rrsClass.Parity)
+	s.StorageClass.Standard = standardClass
+	s.StorageClass.RRS = rrsClass
 }

-func (s *serverConfig) GetStorageClass() (standardStorageClass, rrsStorageClass storageClass) {
-	s.RLock()
-	defer s.RUnlock()
-
-	var err error
-	var ssc storageClass
-	var rrsc storageClass
-
-	if s.StorageClass.Standard != "" {
-		// Parse the values read from config file into storageClass struct
-		ssc, err = parseStorageClass(s.StorageClass.Standard)
-		fatalIf(err, "Invalid value %s set in config.json", s.StorageClass.Standard)
-	}
-
-	if s.StorageClass.RRS != "" {
-		// Parse the values read from config file into storageClass struct
-		rrsc, err = parseStorageClass(s.StorageClass.RRS)
-		fatalIf(err, "Invalid value %s set in config.json", s.StorageClass.RRS)
-	}
-
-	// Validation is done after parsing both the storage classes. This is needed because we need one
-	// storage class value to deduce the correct value of the other storage class.
-	if rrsc.Scheme != "" {
-		err := validateRRSParity(rrsc.Parity, ssc.Parity)
-		fatalIf(err, "Invalid value %s set in config.json", s.StorageClass.RRS)
-		globalIsStorageClass = true
-	}
-
-	if ssc.Scheme != "" {
-		err := validateSSParity(ssc.Parity, rrsc.Parity)
-		fatalIf(err, "Invalid value %s set in config.json", s.StorageClass.Standard)
-		globalIsStorageClass = true
-	}
-
-	return
+// GetStorageClass reads storage class fields from current config.
+// It returns the standard and reduced redundancy storage class struct
+func (s *serverConfig) GetStorageClass() (storageClass, storageClass) {
+	return s.StorageClass.Standard, s.StorageClass.RRS
 }

 // GetCredentials get current credentials.
 func (s *serverConfig) GetBrowser() bool {
-	s.RLock()
-	defer s.RUnlock()
-
 	return bool(s.Browser)
 }

 // Save config.
 func (s *serverConfig) Save() error {
-	s.RLock()
-	defer s.RUnlock()
-
 	// Save config file.
 	return quick.Save(getConfigFile(), s)
 }

+// Returns the string describing a difference with the given
+// configuration object. If the given configuration object is
+// identical, an empty string is returned.
+func (s *serverConfig) ConfigDiff(t *serverConfig) string {
+	switch {
+	case t == nil:
+		return "Given configuration is empty"
+	case s.Credential != t.Credential:
+		return "Credential configuration differs"
+	case s.Region != t.Region:
+		return "Region configuration differs"
+	case s.Browser != t.Browser:
+		return "Browser configuration differs"
+	case s.Domain != t.Domain:
+		return "Domain configuration differs"
+	case s.StorageClass != t.StorageClass:
+		return "StorageClass configuration differs"
+	case !reflect.DeepEqual(s.Notify.AMQP, t.Notify.AMQP):
+		return "AMQP Notification configuration differs"
+	case !reflect.DeepEqual(s.Notify.NATS, t.Notify.NATS):
+		return "NATS Notification configuration differs"
+	case !reflect.DeepEqual(s.Notify.ElasticSearch, t.Notify.ElasticSearch):
+		return "ElasticSearch Notification configuration differs"
+	case !reflect.DeepEqual(s.Notify.Redis, t.Notify.Redis):
+		return "Redis Notification configuration differs"
+	case !reflect.DeepEqual(s.Notify.PostgreSQL, t.Notify.PostgreSQL):
+		return "PostgreSQL Notification configuration differs"
+	case !reflect.DeepEqual(s.Notify.Kafka, t.Notify.Kafka):
+		return "Kafka Notification configuration differs"
+	case !reflect.DeepEqual(s.Notify.Webhook, t.Notify.Webhook):
+		return "Webhook Notification configuration differs"
+	case !reflect.DeepEqual(s.Notify.MySQL, t.Notify.MySQL):
+		return "MySQL Notification configuration differs"
+	case !reflect.DeepEqual(s.Notify.MQTT, t.Notify.MQTT):
+		return "MQTT Notification configuration differs"
+	case reflect.DeepEqual(s, t):
+		return ""
+	default:
+		// This case will not happen unless this comparison
+		// function has become stale.
+		return "Configuration differs"
+	}
+}
+
 func newServerConfig() *serverConfig {
 	srvCfg := &serverConfig{
 		Version:    serverConfigVersion,
 		Credential: auth.MustGetNewCredentials(),
 		Region:     globalMinioDefaultRegion,
 		Browser:    true,
-		Notify:     &notifier{},
+		StorageClass: storageClassConfig{
+			Standard: storageClass{},
+			RRS:      storageClass{},
+		},
+		Notify: notifier{},
 	}

 	// Make sure to initialize notification configs.
@@ -23,6 +23,7 @@ import (
 	"reflect"
 	"testing"

+	"github.com/minio/minio/pkg/auth"
 	"github.com/tidwall/gjson"
 )

@@ -316,3 +317,92 @@ func TestValidateConfig(t *testing.T) {
 	}

 }
+
+func TestConfigDiff(t *testing.T) {
+	testCases := []struct {
+		s, t *serverConfig
+		diff string
+	}{
+		// 1
+		{&serverConfig{}, nil, "Given configuration is empty"},
+		// 2
+		{
+			&serverConfig{Credential: auth.Credentials{"u1", "p1"}},
+			&serverConfig{Credential: auth.Credentials{"u1", "p2"}},
+			"Credential configuration differs",
+		},
+		// 3
+		{&serverConfig{Region: "us-east-1"}, &serverConfig{Region: "us-west-1"}, "Region configuration differs"},
+		// 4
+		{&serverConfig{Browser: false}, &serverConfig{Browser: true}, "Browser configuration differs"},
+		// 5
+		{&serverConfig{Domain: "domain1"}, &serverConfig{Domain: "domain2"}, "Domain configuration differs"},
+		// 6
+		{
+			&serverConfig{StorageClass: storageClassConfig{storageClass{"1", 8}, storageClass{"2", 6}}},
+			&serverConfig{StorageClass: storageClassConfig{storageClass{"1", 8}, storageClass{"2", 4}}},
+			"StorageClass configuration differs",
+		},
+		// 7
+		{
+			&serverConfig{Notify: notifier{AMQP: map[string]amqpNotify{"1": {Enable: true}}}},
+			&serverConfig{Notify: notifier{AMQP: map[string]amqpNotify{"1": {Enable: false}}}},
+			"AMQP Notification configuration differs",
+		},
+		// 8
+		{
+			&serverConfig{Notify: notifier{NATS: map[string]natsNotify{"1": {Enable: true}}}},
+			&serverConfig{Notify: notifier{NATS: map[string]natsNotify{"1": {Enable: false}}}},
+			"NATS Notification configuration differs",
+		},
+		// 9
+		{
+			&serverConfig{Notify: notifier{ElasticSearch: map[string]elasticSearchNotify{"1": {Enable: true}}}},
+			&serverConfig{Notify: notifier{ElasticSearch: map[string]elasticSearchNotify{"1": {Enable: false}}}},
+			"ElasticSearch Notification configuration differs",
+		},
+		// 10
+		{
+			&serverConfig{Notify: notifier{Redis: map[string]redisNotify{"1": {Enable: true}}}},
+			&serverConfig{Notify: notifier{Redis: map[string]redisNotify{"1": {Enable: false}}}},
+			"Redis Notification configuration differs",
+		},
+		// 11
+		{
+			&serverConfig{Notify: notifier{PostgreSQL: map[string]postgreSQLNotify{"1": {Enable: true}}}},
+			&serverConfig{Notify: notifier{PostgreSQL: map[string]postgreSQLNotify{"1": {Enable: false}}}},
+			"PostgreSQL Notification configuration differs",
+		},
+		// 12
+		{
+			&serverConfig{Notify: notifier{Kafka: map[string]kafkaNotify{"1": {Enable: true}}}},
+			&serverConfig{Notify: notifier{Kafka: map[string]kafkaNotify{"1": {Enable: false}}}},
+			"Kafka Notification configuration differs",
+		},
+		// 13
+		{
+			&serverConfig{Notify: notifier{Webhook: map[string]webhookNotify{"1": {Enable: true}}}},
+			&serverConfig{Notify: notifier{Webhook: map[string]webhookNotify{"1": {Enable: false}}}},
+			"Webhook Notification configuration differs",
+		},
+		// 14
+		{
+			&serverConfig{Notify: notifier{MySQL: map[string]mySQLNotify{"1": {Enable: true}}}},
+			&serverConfig{Notify: notifier{MySQL: map[string]mySQLNotify{"1": {Enable: false}}}},
+			"MySQL Notification configuration differs",
+		},
+		// 15
+		{
+			&serverConfig{Notify: notifier{MQTT: map[string]mqttNotify{"1": {Enable: true}}}},
+			&serverConfig{Notify: notifier{MQTT: map[string]mqttNotify{"1": {Enable: false}}}},
+			"MQTT Notification configuration differs",
+		},
+	}
+
+	for i, testCase := range testCases {
+		got := testCase.s.ConfigDiff(testCase.t)
+		if got != testCase.diff {
+			t.Errorf("Test %d: got %s expected %s", i+1, got, testCase.diff)
+		}
+	}
+}
@@ -1,5 +1,5 @@
 /*
- * Minio Cloud Storage, (C) 2015, 2016, 2017 Minio, Inc.
+ * Minio Cloud Storage, (C) 2015, 2016, 2017, 2018 Minio, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -95,14 +95,16 @@ func (config *ConfigDir) GetPrivateKeyFile() string {
 	return filepath.Join(config.getCertsDir(), privateKeyFile)
 }

-func mustGetDefaultConfigDir() string {
+func getDefaultConfigDir() string {
 	homeDir, err := homedir.Dir()
-	fatalIf(err, "Unable to get home directory.")
+	if err != nil {
+		return ""
+	}

 	return filepath.Join(homeDir, defaultMinioConfigDir)
 }

-var configDir = &ConfigDir{dir: mustGetDefaultConfigDir()}
+var configDir = &ConfigDir{dir: getDefaultConfigDir()}

 func setConfigDir(dir string) {
 	configDir.Set(dir)
@@ -1147,14 +1147,6 @@ func migrateV15ToV16() error {
 	// Load browser config from existing config in the file.
 	srvConfig.Browser = cv15.Browser

-	// Migrate console and file fields
-	if cv15.Logger.Console.Enable {
-		srvConfig.Logger.Console = NewConsoleLogger()
-	}
-	if cv15.Logger.File.Enable {
-		srvConfig.Logger.File = NewFileLogger(cv15.Logger.File.Filename)
-	}
-
 	if err = quick.Save(configFile, srvConfig); err != nil {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv15.Version, srvConfig.Version, err)
 	}
@@ -1725,7 +1717,7 @@ func migrateV21ToV22() error {

 	// Copy over fields from V21 into V22 config struct
 	srvConfig := &serverConfigV22{
-		Notify: &notifier{},
+		Notify: notifier{},
 	}
 	srvConfig.Version = serverConfigVersion
 	srvConfig.Credential = cv21.Credential
@@ -418,6 +418,21 @@ type serverConfigV15 struct {
 	Notify *notifier `json:"notify"`
 }

+// FileLogger is introduced to workaround the dependency about logrus
+type FileLogger struct {
+	Enable   bool   `json:"enable"`
+	Filename string `json:"filename"`
+}
+
+// ConsoleLogger is introduced to workaround the dependency about logrus
+type ConsoleLogger struct {
+	Enable bool `json:"enable"`
+}
+
+// Loggers struct is defined with FileLogger and ConsoleLogger
+// although they are removed from logging logic. They are
+// kept here just to workaround the dependency migration
+// code/logic has on them.
 type loggers struct {
 	sync.RWMutex
 	Console ConsoleLogger `json:"console"`
@@ -532,9 +547,11 @@ type serverConfigV21 struct {
 }

 // serverConfigV22 is just like version '21' with added support
-// for StorageClass
+// for StorageClass.
+//
+// IMPORTANT NOTE: When updating this struct make sure that
+// serverConfig.ConfigDiff() is updated as necessary.
 type serverConfigV22 struct {
-	sync.RWMutex
 	Version string `json:"version"`

 	// S3 API configuration.
@@ -547,5 +564,5 @@ type serverConfigV22 struct {
 	StorageClass storageClassConfig `json:"storageclass"`

 	// Notification queue configuration.
-	Notify *notifier `json:"notify"`
+	Notify notifier `json:"notify"`
 }
@@ -1,74 +0,0 @@
-/*
- * Minio Cloud Storage, (C) 2017 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package cmd
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/Sirupsen/logrus"
-)
-
-// ConsoleLogger - console logger which logs into stderr.
-type ConsoleLogger struct {
-	BaseLogTarget
-}
-
-// Fire - log entry handler.
-func (logger ConsoleLogger) Fire(entry *logrus.Entry) error {
-	if !logger.Enable {
-		return nil
-	}
-
-	msgBytes, err := logger.formatter.Format(entry)
-	if err == nil {
-		fmt.Fprintf(os.Stderr, string(msgBytes))
-	}
-
-	return err
-}
-
-// String - represents ConsoleLogger as string.
-func (logger ConsoleLogger) String() string {
-	enableStr := "disabled"
-	if logger.Enable {
-		enableStr = "enabled"
-	}
-
-	return fmt.Sprintf("console:%s", enableStr)
-}
-
-// NewConsoleLogger - return new console logger object.
-func NewConsoleLogger() (logger ConsoleLogger) {
-	logger.Enable = true
-	logger.formatter = new(logrus.TextFormatter)
-
-	return logger
-}
-
-// InitConsoleLogger - initializes console logger.
-func InitConsoleLogger(logger *ConsoleLogger) {
-	if !logger.Enable {
-		return
-	}
-
-	if logger.formatter == nil {
-		logger.formatter = new(logrus.TextFormatter)
-	}
-
-	return
-}
@@ -1,5 +1,5 @@
 /*
- * Minio Cloud Storage, (C) 2017 Minio, Inc.
+ * Minio Cloud Storage, (C) 2017, 2018 Minio, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -18,13 +18,17 @@ package cmd

 import (
 	"bytes"
+	"crypto/hmac"
 	"crypto/md5"
 	"crypto/rand"
+	"crypto/subtle"
 	"encoding/base64"
+	"encoding/binary"
 	"errors"
 	"io"
 	"net/http"

+	"github.com/minio/minio/pkg/ioutil"
 	sha256 "github.com/minio/sha256-simd"
 	"github.com/minio/sio"
 )
@@ -51,6 +55,13 @@ const (
 	SSECustomerKey = "X-Amz-Server-Side-Encryption-Customer-Key"
 	// SSECustomerKeyMD5 is the AWS SSE-C encryption key MD5 HTTP header key.
 	SSECustomerKeyMD5 = "X-Amz-Server-Side-Encryption-Customer-Key-MD5"
+
+	// SSECopyCustomerAlgorithm is the AWS SSE-C algorithm HTTP header key for CopyObject API.
+	SSECopyCustomerAlgorithm = "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Algorithm"
+	// SSECopyCustomerKey is the AWS SSE-C encryption key HTTP header key for CopyObject API.
+	SSECopyCustomerKey = "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key"
+	// SSECopyCustomerKeyMD5 is the AWS SSE-C encryption key MD5 HTTP header key for CopyObject API.
+	SSECopyCustomerKeyMD5 = "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-MD5"
 )

 const (
@@ -58,8 +69,18 @@ const (
 	// Currently AWS supports only AES256. So the SSE-C key size is fixed to 32 bytes.
 	SSECustomerKeySize = 32

+	// SSEIVSize is the size of the IV data
+	SSEIVSize = 32 // 32 bytes
+
 	// SSECustomerAlgorithmAES256 the only valid S3 SSE-C encryption algorithm identifier.
 	SSECustomerAlgorithmAES256 = "AES256"
+
+	// SSE dare package block size.
+	sseDAREPackageBlockSize = 64 * 1024 // 64KiB bytes
+
+	// SSE dare package meta padding bytes.
+	sseDAREPackageMetaSize = 32 // 32 bytes
+
 )

 // SSE-C key derivation, key verification and key update:
@@ -123,15 +144,21 @@ const (
 // hash function.
 const SSESealAlgorithmDareSha256 = "DARE-SHA256"

-// IsSSECustomerRequest returns true if the given HTTP header
+// hasSSECustomerHeader returns true if the given HTTP header
 // contains server-side-encryption with customer provided key fields.
-func IsSSECustomerRequest(header http.Header) bool {
+func hasSSECustomerHeader(header http.Header) bool {
 	return header.Get(SSECustomerAlgorithm) != "" || header.Get(SSECustomerKey) != "" || header.Get(SSECustomerKeyMD5) != ""
 }

-// ParseSSECustomerRequest parses the SSE-C header fields of the provided request.
+// hasSSECopyCustomerHeader returns true if the given HTTP header
+// contains copy source server-side-encryption with customer provided key fields.
+func hasSSECopyCustomerHeader(header http.Header) bool {
+	return header.Get(SSECopyCustomerAlgorithm) != "" || header.Get(SSECopyCustomerKey) != "" || header.Get(SSECopyCustomerKeyMD5) != ""
+}
+
+// ParseSSECopyCustomerRequest parses the SSE-C header fields of the provided request.
 // It returns the client provided key on success.
-func ParseSSECustomerRequest(r *http.Request) (key []byte, err error) {
+func ParseSSECopyCustomerRequest(r *http.Request) (key []byte, err error) {
 	if !globalIsSSL { // minio only supports HTTP or HTTPS requests not both at the same time
 		// we cannot use r.TLS == nil here because Go's http implementation reflects on
 		// the net.Conn and sets the TLS field of http.Request only if it's an tls.Conn.
@@ -140,6 +167,53 @@ func ParseSSECustomerRequest(r *http.Request) (key []byte, err error) {
 		return nil, errInsecureSSERequest
 	}
 	header := r.Header
+	if algorithm := header.Get(SSECopyCustomerAlgorithm); algorithm != SSECustomerAlgorithmAES256 {
+		return nil, errInvalidSSEAlgorithm
+	}
+	if header.Get(SSECopyCustomerKey) == "" {
+		return nil, errMissingSSEKey
+	}
+	if header.Get(SSECopyCustomerKeyMD5) == "" {
+		return nil, errMissingSSEKeyMD5
+	}
+
+	key, err = base64.StdEncoding.DecodeString(header.Get(SSECopyCustomerKey))
+	if err != nil {
+		return nil, errInvalidSSEKey
+	}
+
+	if len(key) != SSECustomerKeySize {
+		return nil, errInvalidSSEKey
+	}
+	// Make sure we purged the keys from http headers by now.
+	header.Del(SSECopyCustomerKey)
+
+	keyMD5, err := base64.StdEncoding.DecodeString(header.Get(SSECopyCustomerKeyMD5))
+	if err != nil {
+		return nil, errSSEKeyMD5Mismatch
+	}
+	if md5Sum := md5.Sum(key); !bytes.Equal(md5Sum[:], keyMD5) {
+		return nil, errSSEKeyMD5Mismatch
+	}
+	return key, nil
+}
+
+// ParseSSECustomerRequest parses the SSE-C header fields of the provided request.
+// It returns the client provided key on success.
+func ParseSSECustomerRequest(r *http.Request) (key []byte, err error) {
+	return ParseSSECustomerHeader(r.Header)
+}
+
+// ParseSSECustomerHeader parses the SSE-C header fields and returns
+// the client provided key on success.
+func ParseSSECustomerHeader(header http.Header) (key []byte, err error) {
+	if !globalIsSSL { // minio only supports HTTP or HTTPS requests not both at the same time
+		// we cannot use r.TLS == nil here because Go's http implementation reflects on
+		// the net.Conn and sets the TLS field of http.Request only if it's an tls.Conn.
+		// Minio uses a BufConn (wrapping a tls.Conn) so the type check within the http package
+		// will always fail -> r.TLS is always nil even for TLS requests.
+		return nil, errInsecureSSERequest
+	}
 	if algorithm := header.Get(SSECustomerAlgorithm); algorithm != SSECustomerAlgorithmAES256 {
 		return nil, errInvalidSSEAlgorithm
 	}
@@ -154,11 +228,12 @@ func ParseSSECustomerRequest(r *http.Request) (key []byte, err error) {
 	if err != nil {
 		return nil, errInvalidSSEKey
 	}
-	header.Del(SSECustomerKey) // make sure we do not save the key by accident

 	if len(key) != SSECustomerKeySize {
 		return nil, errInvalidSSEKey
 	}
+	// Make sure we purged the keys from http headers by now.
+	header.Del(SSECustomerKey)

 	keyMD5, err := base64.StdEncoding.DecodeString(header.Get(SSECustomerKeyMD5))
 	if err != nil {
@@ -170,16 +245,68 @@ func ParseSSECustomerRequest(r *http.Request) (key []byte, err error) {
 	return key, nil
 }

-// EncryptRequest takes the client provided content and encrypts the data
-// with the client provided key. It also marks the object as client-side-encrypted
-// and sets the correct headers.
-func EncryptRequest(content io.Reader, r *http.Request, metadata map[string]string) (io.Reader, error) {
-	key, err := ParseSSECustomerRequest(r)
-	if err != nil {
-		return nil, err
+// This function rotates old to new key.
+func rotateKey(oldKey []byte, newKey []byte, metadata map[string]string) error {
+	if subtle.ConstantTimeCompare(oldKey, newKey) == 1 {
+		return nil
 	}
 	delete(metadata, SSECustomerKey) // make sure we do not save the key by accident

+	if metadata[ServerSideEncryptionSealAlgorithm] != SSESealAlgorithmDareSha256 { // currently DARE-SHA256 is the only option
+		return errObjectTampered
+	}
+	iv, err := base64.StdEncoding.DecodeString(metadata[ServerSideEncryptionIV])
+	if err != nil || len(iv) != SSEIVSize {
+		return errObjectTampered
+	}
+	sealedKey, err := base64.StdEncoding.DecodeString(metadata[ServerSideEncryptionSealedKey])
+	if err != nil || len(sealedKey) != 64 {
+		return errObjectTampered
+	}
+
+	sha := sha256.New() // derive key encryption key
+	sha.Write(oldKey)
+	sha.Write(iv)
+	keyEncryptionKey := sha.Sum(nil)
+
+	objectEncryptionKey := bytes.NewBuffer(nil) // decrypt object encryption key
+	n, err := sio.Decrypt(objectEncryptionKey, bytes.NewReader(sealedKey), sio.Config{
+		Key: keyEncryptionKey,
+	})
+	if n != 32 || err != nil {
+		// Either the provided key does not match or the object was tampered.
+		// To provide strict AWS S3 compatibility we return: access denied.
+		return errSSEKeyMismatch
+	}
+
+	nonce := make([]byte, 32) // generate random values for key derivation
+	if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
+		return err
+	}
+
+	niv := sha256.Sum256(nonce[:]) // derive key encryption key
+	sha = sha256.New()
+	sha.Write(newKey)
+	sha.Write(niv[:])
+	keyEncryptionKey = sha.Sum(nil)
+
+	sealedKeyW := bytes.NewBuffer(nil) // sealedKey := 16 byte header + 32 byte payload + 16 byte tag
+	n, err = sio.Encrypt(sealedKeyW, bytes.NewReader(objectEncryptionKey.Bytes()), sio.Config{
+		Key: keyEncryptionKey,
+	})
+	if n != 64 || err != nil {
+		return errors.New("failed to seal object encryption key") // if this happens there's a bug in the code (may panic ?)
+	}
+
+	metadata[ServerSideEncryptionIV] = base64.StdEncoding.EncodeToString(niv[:])
+	metadata[ServerSideEncryptionSealAlgorithm] = SSESealAlgorithmDareSha256
+	metadata[ServerSideEncryptionSealedKey] = base64.StdEncoding.EncodeToString(sealedKeyW.Bytes())
+	return nil
+}
+
+func newEncryptMetadata(key []byte, metadata map[string]string) ([]byte, error) {
+	delete(metadata, SSECustomerKey) // make sure we do not save the key by accident
+
 	// security notice:
 	//  - If the first 32 bytes of the random value are ever repeated under the same client-provided
 	//    key the encrypted object will not be tamper-proof. [ P(coll) ~= 1 / 2^(256 / 2)]
@@ -188,8 +315,8 @@ func EncryptRequest(content io.Reader, r *http.Request, metadata map[string]stri
 	//    authenticated en/decryption scheme. The DARE format will generate an 8 byte nonce which must
 	//    be repeated in addition to reveal the object encryption key.
 	//    [ P(coll) ~= 1 / 2^((256 + 64) / 2) ]
-	nonce := make([]byte, 64) // generate random values for key derivation
-	if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
+	nonce := make([]byte, 32+SSEIVSize) // generate random values for key derivation
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
 		return nil, err
 	}
 	sha := sha256.New() // derive object encryption key
@@ -211,31 +338,55 @@ func EncryptRequest(content io.Reader, r *http.Request, metadata map[string]stri
 		return nil, errors.New("failed to seal object encryption key") // if this happens there's a bug in the code (may panic ?)
 	}

+	metadata[ServerSideEncryptionIV] = base64.StdEncoding.EncodeToString(iv[:])
+	metadata[ServerSideEncryptionSealAlgorithm] = SSESealAlgorithmDareSha256
+	metadata[ServerSideEncryptionSealedKey] = base64.StdEncoding.EncodeToString(sealedKey.Bytes())
+
+	return objectEncryptionKey, nil
+}
+
+func newEncryptReader(content io.Reader, key []byte, metadata map[string]string) (io.Reader, error) {
+	objectEncryptionKey, err := newEncryptMetadata(key, metadata)
+	if err != nil {
+		return nil, err
+	}
+
 	reader, err := sio.EncryptReader(content, sio.Config{Key: objectEncryptionKey})
 	if err != nil {
 		return nil, errInvalidSSEKey
 	}

-	metadata[ServerSideEncryptionIV] = base64.StdEncoding.EncodeToString(iv[:])
-	metadata[ServerSideEncryptionSealAlgorithm] = SSESealAlgorithmDareSha256
-	metadata[ServerSideEncryptionSealedKey] = base64.StdEncoding.EncodeToString(sealedKey.Bytes())
 	return reader, nil
 }

-// DecryptRequest decrypts the object with the client provided key. It also removes
-// the client-side-encryption metadata from the object and sets the correct headers.
-func DecryptRequest(client io.Writer, r *http.Request, metadata map[string]string) (io.WriteCloser, error) {
+// EncryptRequest takes the client provided content and encrypts the data
+// with the client provided key. It also marks the object as client-side-encrypted
+// and sets the correct headers.
+func EncryptRequest(content io.Reader, r *http.Request, metadata map[string]string) (io.Reader, error) {
 	key, err := ParseSSECustomerRequest(r)
 	if err != nil {
 		return nil, err
 	}
-	delete(metadata, SSECustomerKey) // make sure we do not save the key by accident
+	return newEncryptReader(content, key, metadata)
+}

+// DecryptCopyRequest decrypts the object with the client provided key. It also removes
+// the client-side-encryption metadata from the object and sets the correct headers.
+func DecryptCopyRequest(client io.Writer, r *http.Request, metadata map[string]string) (io.WriteCloser, error) {
+	key, err := ParseSSECopyCustomerRequest(r)
+	if err != nil {
+		return nil, err
+	}
+	delete(metadata, SSECopyCustomerKey) // make sure we do not save the key by accident
+	return newDecryptWriter(client, key, 0, metadata)
+}
+
+func decryptObjectInfo(key []byte, metadata map[string]string) ([]byte, error) {
 	if metadata[ServerSideEncryptionSealAlgorithm] != SSESealAlgorithmDareSha256 { // currently DARE-SHA256 is the only option
 		return nil, errObjectTampered
 	}
 	iv, err := base64.StdEncoding.DecodeString(metadata[ServerSideEncryptionIV])
-	if err != nil || len(iv) != 32 {
+	if err != nil || len(iv) != SSEIVSize {
 		return nil, errObjectTampered
 	}
 	sealedKey, err := base64.StdEncoding.DecodeString(metadata[ServerSideEncryptionSealedKey])
@@ -257,8 +408,23 @@ func DecryptRequest(client io.Writer, r *http.Request, metadata map[string]strin
 		// To provide strict AWS S3 compatibility we return: access denied.
 		return nil, errSSEKeyMismatch
 	}
+	return objectEncryptionKey.Bytes(), nil
+}

-	writer, err := sio.DecryptWriter(client, sio.Config{Key: objectEncryptionKey.Bytes()})
+func newDecryptWriter(client io.Writer, key []byte, seqNumber uint32, metadata map[string]string) (io.WriteCloser, error) {
+	objectEncryptionKey, err := decryptObjectInfo(key, metadata)
+	if err != nil {
+		return nil, err
+
+	}
+	return newDecryptWriterWithObjectKey(client, objectEncryptionKey, seqNumber, metadata)
+}
+
+func newDecryptWriterWithObjectKey(client io.Writer, objectEncryptionKey []byte, seqNumber uint32, metadata map[string]string) (io.WriteCloser, error) {
+	writer, err := sio.DecryptWriter(client, sio.Config{
+		Key:            objectEncryptionKey,
+		SequenceNumber: seqNumber,
+	})
 	if err != nil {
 		return nil, errInvalidSSEKey
 	}
@@ -266,9 +432,280 @@ func DecryptRequest(client io.Writer, r *http.Request, metadata map[string]strin
 	delete(metadata, ServerSideEncryptionIV)
 	delete(metadata, ServerSideEncryptionSealAlgorithm)
 	delete(metadata, ServerSideEncryptionSealedKey)
+	delete(metadata, ReservedMetadataPrefix+"Encrypted-Multipart")
 	return writer, nil
 }

+// DecryptRequestWithSequenceNumber decrypts the object with the client provided key. It also removes
+// the client-side-encryption metadata from the object and sets the correct headers.
+func DecryptRequestWithSequenceNumber(client io.Writer, r *http.Request, seqNumber uint32, metadata map[string]string) (io.WriteCloser, error) {
+	key, err := ParseSSECustomerRequest(r)
+	if err != nil {
+		return nil, err
+	}
+	delete(metadata, SSECustomerKey) // make sure we do not save the key by accident
+	return newDecryptWriter(client, key, seqNumber, metadata)
+}
+
+// DecryptRequest decrypts the object with the client provided key. It also removes
+// the client-side-encryption metadata from the object and sets the correct headers.
+func DecryptRequest(client io.Writer, r *http.Request, metadata map[string]string) (io.WriteCloser, error) {
+	return DecryptRequestWithSequenceNumber(client, r, 0, metadata)
+}
+
+// DecryptBlocksWriter - decrypts multipart parts, while implementing a io.Writer compatible interface.
+type DecryptBlocksWriter struct {
+	// Original writer where the plain data will be written
+	writer io.Writer
+	// Current decrypter for the current encrypted data block
+	decrypter io.WriteCloser
+	// Start sequence number
+	startSeqNum uint32
+	// Current part index
+	partIndex int
+	// Parts information
+	parts    []objectPartInfo
+	req      *http.Request
+	metadata map[string]string
+
+	partEncRelOffset int64
+
+	copySource bool
+	// Customer Key
+	customerKeyHeader string
+}
+
+func (w *DecryptBlocksWriter) buildDecrypter(partID int) error {
+	m := make(map[string]string)
+	for k, v := range w.metadata {
+		m[k] = v
+	}
+	// Initialize the first decrypter, new decrypters will be initialized in Write() operation as needed.
+	var key []byte
+	var err error
+	if w.copySource {
+		w.req.Header.Set(SSECopyCustomerKey, w.customerKeyHeader)
+		key, err = ParseSSECopyCustomerRequest(w.req)
+	} else {
+		w.req.Header.Set(SSECustomerKey, w.customerKeyHeader)
+		key, err = ParseSSECustomerRequest(w.req)
+	}
+	if err != nil {
+		return err
+	}
+
+	objectEncryptionKey, err := decryptObjectInfo(key, m)
+	if err != nil {
+		return err
+	}
+
+	var partIDbin [4]byte
+	binary.LittleEndian.PutUint32(partIDbin[:], uint32(partID)) // marshal part ID
+
+	mac := hmac.New(sha256.New, objectEncryptionKey) // derive part encryption key from part ID and object key
+	mac.Write(partIDbin[:])
+	partEncryptionKey := mac.Sum(nil)
+
+	// make sure we do not save the key by accident
+	if w.copySource {
+		delete(m, SSECopyCustomerKey)
+	} else {
+		delete(m, SSECustomerKey)
+	}
+
+	// make sure to provide a NopCloser such that a Close
+	// on sio.decryptWriter doesn't close the underlying writer's
+	// close which perhaps can close the stream prematurely.
+	decrypter, err := newDecryptWriterWithObjectKey(ioutil.NopCloser(w.writer), partEncryptionKey, w.startSeqNum, m)
+	if err != nil {
+		return err
+	}
+
+	if w.decrypter != nil {
+		// Pro-actively close the writer such that any pending buffers
+		// are flushed already before we allocate a new decrypter.
+		err = w.decrypter.Close()
+		if err != nil {
+			return err
+		}
+	}
+
+	w.decrypter = decrypter
+	return nil
+}
+
+func (w *DecryptBlocksWriter) Write(p []byte) (int, error) {
+	var err error
+	var n1 int
+	if int64(len(p)) < w.parts[w.partIndex].Size-w.partEncRelOffset {
+		n1, err = w.decrypter.Write(p)
+		if err != nil {
+			return 0, err
+		}
+		w.partEncRelOffset += int64(n1)
+	} else {
+		n1, err = w.decrypter.Write(p[:w.parts[w.partIndex].Size-w.partEncRelOffset])
+		if err != nil {
+			return 0, err
+		}
+
+		// We should now proceed to next part, reset all values appropriately.
+		w.partEncRelOffset = 0
+		w.startSeqNum = 0
+
+		w.partIndex++
+
+		err = w.buildDecrypter(w.partIndex + 1)
+		if err != nil {
+			return 0, err
+		}
+
+		n1, err = w.decrypter.Write(p[n1:])
+		if err != nil {
+			return 0, err
+		}
+
+		w.partEncRelOffset += int64(n1)
+	}
+
+	return len(p), nil
+}
+
+// Close closes the LimitWriter. It behaves like io.Closer.
+func (w *DecryptBlocksWriter) Close() error {
+	if w.decrypter != nil {
+		err := w.decrypter.Close()
+		if err != nil {
+			return err
+		}
+	}
+
+	if closer, ok := w.writer.(io.Closer); ok {
+		return closer.Close()
+	}
+	return nil
+}
+
+// DecryptAllBlocksCopyRequest - setup a struct which can decrypt many concatenated encrypted data
+// parts information helps to know the boundaries of each encrypted data block, this function decrypts
+// all parts starting from part-1.
+func DecryptAllBlocksCopyRequest(client io.Writer, r *http.Request, objInfo ObjectInfo) (io.WriteCloser, int64, error) {
+	w, _, size, err := DecryptBlocksRequest(client, r, 0, objInfo.Size, objInfo, true)
+	return w, size, err
+}
+
+// DecryptBlocksRequest - setup a struct which can decrypt many concatenated encrypted data
+// parts information helps to know the boundaries of each encrypted data block.
+func DecryptBlocksRequest(client io.Writer, r *http.Request, startOffset, length int64, objInfo ObjectInfo, copySource bool) (io.WriteCloser, int64, int64, error) {
+	seqNumber, encStartOffset, encLength := getEncryptedStartOffset(startOffset, length)
+
+	// Encryption length cannot be bigger than the file size, if it is
+	// which is allowed in AWS S3, we simply default to EncryptedSize().
+	if encLength+encStartOffset > objInfo.EncryptedSize() {
+		encLength = objInfo.EncryptedSize() - encStartOffset
+	}
+
+	if len(objInfo.Parts) == 0 || !objInfo.IsEncryptedMultipart() {
+		var writer io.WriteCloser
+		var err error
+		if copySource {
+			writer, err = DecryptCopyRequest(client, r, objInfo.UserDefined)
+		} else {
+			writer, err = DecryptRequestWithSequenceNumber(client, r, seqNumber, objInfo.UserDefined)
+		}
+		if err != nil {
+			return nil, 0, 0, err
+		}
+		return writer, encStartOffset, encLength, nil
+	}
+
+	var partStartIndex int
+	var partStartOffset = startOffset
+	// Skip parts until final offset maps to a particular part offset.
+	for i, part := range objInfo.Parts {
+		decryptedSize, err := decryptedSize(part.Size)
+		if err != nil {
+			return nil, -1, -1, err
+		}
+
+		partStartIndex = i
+
+		// Offset is smaller than size we have reached the
+		// proper part offset, break out we start from
+		// this part index.
+		if partStartOffset < decryptedSize {
+			break
+		}
+
+		// Continue to look for next part.
+		partStartOffset -= decryptedSize
+	}
+
+	startSeqNum := partStartOffset / sseDAREPackageBlockSize
+	partEncRelOffset := int64(startSeqNum) * (sseDAREPackageBlockSize + sseDAREPackageMetaSize)
+
+	w := &DecryptBlocksWriter{
+		writer:            client,
+		startSeqNum:       uint32(startSeqNum),
+		partEncRelOffset:  partEncRelOffset,
+		parts:             objInfo.Parts,
+		partIndex:         partStartIndex,
+		req:               r,
+		customerKeyHeader: r.Header.Get(SSECustomerKey),
+		copySource:        copySource,
+	}
+
+	w.metadata = map[string]string{}
+	// Copy encryption metadata for internal use.
+	for k, v := range objInfo.UserDefined {
+		w.metadata[k] = v
+	}
+
+	// Purge all the encryption headers.
+	delete(objInfo.UserDefined, ServerSideEncryptionIV)
+	delete(objInfo.UserDefined, ServerSideEncryptionSealAlgorithm)
+	delete(objInfo.UserDefined, ServerSideEncryptionSealedKey)
+	delete(objInfo.UserDefined, ReservedMetadataPrefix+"Encrypted-Multipart")
+
+	if w.copySource {
+		w.customerKeyHeader = r.Header.Get(SSECopyCustomerKey)
+	}
+
+	if err := w.buildDecrypter(partStartIndex + 1); err != nil {
+		return nil, 0, 0, err
+	}
+
+	return w, encStartOffset, encLength, nil
+}
+
+// getEncryptedStartOffset - fetch sequence number, encrypted start offset and encrypted length.
+func getEncryptedStartOffset(offset, length int64) (seqNumber uint32, encOffset int64, encLength int64) {
+	onePkgSize := int64(sseDAREPackageBlockSize + sseDAREPackageMetaSize)
+
+	seqNumber = uint32(offset / sseDAREPackageBlockSize)
+	encOffset = int64(seqNumber) * onePkgSize
+	// The math to compute the encrypted length is always
+	// originalLength i.e (offset+length-1) to be divided under
+	// 64KiB blocks which is the payload size for each encrypted
+	// block. This is then multiplied by final package size which
+	// is basically 64KiB + 32. Finally negate the encrypted offset
+	// to get the final encrypted length on disk.
+	encLength = ((offset+length)/sseDAREPackageBlockSize)*onePkgSize - encOffset
+
+	// Check for the remainder, to figure if we need one extract package to read from.
+	if (offset+length)%sseDAREPackageBlockSize > 0 {
+		encLength += onePkgSize
+	}
+
+	return seqNumber, encOffset, encLength
+}
+
+// IsEncryptedMultipart - is the encrypted content multiparted?
+func (o *ObjectInfo) IsEncryptedMultipart() bool {
+	_, ok := o.UserDefined[ReservedMetadataPrefix+"Encrypted-Multipart"]
+	return ok
+}
+
 // IsEncrypted returns true if the object is marked as encrypted.
 func (o *ObjectInfo) IsEncrypted() bool {
 	if _, ok := o.UserDefined[ServerSideEncryptionIV]; ok {
@@ -283,6 +720,34 @@ func (o *ObjectInfo) IsEncrypted() bool {
 	return false
 }

+// IsEncrypted returns true if the object is marked as encrypted.
+func (li *ListPartsInfo) IsEncrypted() bool {
+	if _, ok := li.UserDefined[ServerSideEncryptionIV]; ok {
+		return true
+	}
+	if _, ok := li.UserDefined[ServerSideEncryptionSealAlgorithm]; ok {
+		return true
+	}
+	if _, ok := li.UserDefined[ServerSideEncryptionSealedKey]; ok {
+		return true
+	}
+	return false
+}
+
+func decryptedSize(encryptedSize int64) (int64, error) {
+	if encryptedSize == 0 {
+		return encryptedSize, nil
+	}
+	size := (encryptedSize / (sseDAREPackageBlockSize + sseDAREPackageMetaSize)) * sseDAREPackageBlockSize
+	if mod := encryptedSize % (sseDAREPackageBlockSize + sseDAREPackageMetaSize); mod > 0 {
+		if mod < sseDAREPackageMetaSize+1 {
+			return -1, errObjectTampered // object is not 0 size but smaller than the smallest valid encrypted object
+		}
+		size += mod - sseDAREPackageMetaSize
+	}
+	return size, nil
+}
+
 // DecryptedSize returns the size of the object after decryption in bytes.
 // It returns an error if the object is not encrypted or marked as encrypted
 // but has an invalid size.
@@ -291,42 +756,64 @@ func (o *ObjectInfo) DecryptedSize() (int64, error) {
 	if !o.IsEncrypted() {
 		panic("cannot compute decrypted size of an object which is not encrypted")
 	}
-	if o.Size == 0 {
-		return o.Size, nil
-	}
-	size := (o.Size / (32 + 64*1024)) * (64 * 1024)
-	if mod := o.Size % (32 + 64*1024); mod > 0 {
-		if mod < 33 {
-			return -1, errObjectTampered // object is not 0 size but smaller than the smallest valid encrypted object
-		}
-		size += mod - 32
-	}
-	return size, nil
+
+	return decryptedSize(o.Size)
 }

 // EncryptedSize returns the size of the object after encryption.
 // An encrypted object is always larger than a plain object
 // except for zero size objects.
 func (o *ObjectInfo) EncryptedSize() int64 {
-	size := (o.Size / (64 * 1024)) * (32 + 64*1024)
-	if mod := o.Size % (64 * 1024); mod > 0 {
-		size += mod + 32
+	size := (o.Size / sseDAREPackageBlockSize) * (sseDAREPackageBlockSize + sseDAREPackageMetaSize)
+	if mod := o.Size % (sseDAREPackageBlockSize); mod > 0 {
+		size += mod + sseDAREPackageMetaSize
 	}
 	return size
 }

-// DecryptObjectInfo tries to decrypt the provided object if it is encrypted.
+// DecryptCopyObjectInfo tries to decrypt the provided object if it is encrypted.
 // It fails if the object is encrypted and the HTTP headers don't contain
 // SSE-C headers or the object is not encrypted but SSE-C headers are provided. (AWS behavior)
 // DecryptObjectInfo returns 'ErrNone' if the object is not encrypted or the
 // decryption succeeded.
 //
-// DecryptObjectInfo also returns whether the object is encrypted or not.
-func DecryptObjectInfo(info *ObjectInfo, headers http.Header) (apiErr APIErrorCode, encrypted bool) {
-	if apiErr, encrypted = ErrNone, info.IsEncrypted(); !encrypted && IsSSECustomerRequest(headers) {
+// DecryptCopyObjectInfo also returns whether the object is encrypted or not.
+func DecryptCopyObjectInfo(info *ObjectInfo, headers http.Header) (apiErr APIErrorCode, encrypted bool) {
+	// Directories are never encrypted.
+	if info.IsDir {
+		return ErrNone, false
+	}
+	if apiErr, encrypted = ErrNone, info.IsEncrypted(); !encrypted && hasSSECopyCustomerHeader(headers) {
 		apiErr = ErrInvalidEncryptionParameters
 	} else if encrypted {
-		if !IsSSECustomerRequest(headers) {
+		if !hasSSECopyCustomerHeader(headers) {
+			apiErr = ErrSSEEncryptedObject
+			return
+		}
+		var err error
+		if info.Size, err = info.DecryptedSize(); err != nil {
+			apiErr = toAPIErrorCode(err)
+		}
+	}
+	return
+}
+
+// DecryptObjectInfo tries to decrypt the provided object if it is encrypted.
+// It fails if the object is encrypted and the HTTP headers don't contain
+// SSE-C headers or the object is not encrypted but SSE-C headers are provided. (AWS behavior)
+// DecryptObjectInfo returns 'ErrNone' if the object is not encrypted or the
+// decryption succeeded.
+//
+// DecryptObjectInfo also returns whether the object is encrypted or not.
+func DecryptObjectInfo(info *ObjectInfo, headers http.Header) (apiErr APIErrorCode, encrypted bool) {
+	// Directories are never encrypted.
+	if info.IsDir {
+		return ErrNone, false
+	}
+	if apiErr, encrypted = ErrNone, info.IsEncrypted(); !encrypted && hasSSECustomerHeader(headers) {
+		apiErr = ErrInvalidEncryptionParameters
+	} else if encrypted {
+		if !hasSSECustomerHeader(headers) {
 			apiErr = ErrSSEEncryptedObject
 			return
 		}
@@ -1,5 +1,5 @@
 /*
- * Minio Cloud Storage, (C) 2017 Minio, Inc.
+ * Minio Cloud Storage, (C) 2017, 2018 Minio, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -22,7 +22,32 @@ import (
 	"testing"
 )

-var isSSECustomerRequestTests = []struct {
+var hasSSECopyCustomerHeaderTests = []struct {
+	headers    map[string]string
+	sseRequest bool
+}{
+	{headers: map[string]string{SSECopyCustomerAlgorithm: "AES256", SSECopyCustomerKey: "key", SSECopyCustomerKeyMD5: "md5"}, sseRequest: true},                    // 0
+	{headers: map[string]string{SSECopyCustomerAlgorithm: "AES256"}, sseRequest: true},                                                                             // 1
+	{headers: map[string]string{SSECopyCustomerKey: "key"}, sseRequest: true},                                                                                      // 2
+	{headers: map[string]string{SSECopyCustomerKeyMD5: "md5"}, sseRequest: true},                                                                                   // 3
+	{headers: map[string]string{}, sseRequest: false},                                                                                                              // 4
+	{headers: map[string]string{SSECopyCustomerAlgorithm + " ": "AES256", " " + SSECopyCustomerKey: "key", SSECopyCustomerKeyMD5 + " ": "md5"}, sseRequest: false}, // 5
+	{headers: map[string]string{SSECopyCustomerAlgorithm: "", SSECopyCustomerKey: "", SSECopyCustomerKeyMD5: ""}, sseRequest: false},                               // 6
+}
+
+func TestIsSSECopyCustomerRequest(t *testing.T) {
+	for i, test := range hasSSECopyCustomerHeaderTests {
+		headers := http.Header{}
+		for k, v := range test.headers {
+			headers.Set(k, v)
+		}
+		if hasSSECopyCustomerHeader(headers) != test.sseRequest {
+			t.Errorf("Test %d: Expected hasSSECopyCustomerHeader to return %v", i, test.sseRequest)
+		}
+	}
+}
+
+var hasSSECustomerHeaderTests = []struct {
 	headers    map[string]string
 	sseRequest bool
 }{
@@ -35,14 +60,14 @@ var isSSECustomerRequestTests = []struct {
 	{headers: map[string]string{SSECustomerAlgorithm: "", SSECustomerKey: "", SSECustomerKeyMD5: ""}, sseRequest: false},                               // 6
 }

-func TestIsSSECustomerRequest(t *testing.T) {
-	for i, test := range isSSECustomerRequestTests {
+func TesthasSSECustomerHeader(t *testing.T) {
+	for i, test := range hasSSECustomerHeaderTests {
 		headers := http.Header{}
 		for k, v := range test.headers {
 			headers.Set(k, v)
 		}
-		if IsSSECustomerRequest(headers) != test.sseRequest {
-			t.Errorf("Test %d: Expected IsSSECustomerRequest to return %v", i, test.sseRequest)
+		if hasSSECustomerHeader(headers) != test.sseRequest {
+			t.Errorf("Test %d: Expected hasSSECustomerHeader to return %v", i, test.sseRequest)
 		}
 	}
 }
@@ -145,19 +170,121 @@ func TestParseSSECustomerRequest(t *testing.T) {
 		if (err == nil || err == errSSEKeyMD5Mismatch) && key != "" {
 			t.Errorf("Test %d: Client key survived parsing - found key: %v", i, key)
 		}
+
+	}
+}
+
+var parseSSECopyCustomerRequestTests = []struct {
+	headers map[string]string
+	useTLS  bool
+	err     error
+}{
+	{
+		headers: map[string]string{
+			SSECopyCustomerAlgorithm: "AES256",
+			SSECopyCustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 0
+			SSECopyCustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+		},
+		useTLS: true, err: nil,
+	},
+	{
+		headers: map[string]string{
+			SSECopyCustomerAlgorithm: "AES256",
+			SSECopyCustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 1
+			SSECopyCustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+		},
+		useTLS: false, err: errInsecureSSERequest,
+	},
+	{
+		headers: map[string]string{
+			SSECopyCustomerAlgorithm: "AES 256",
+			SSECopyCustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 2
+			SSECopyCustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+		},
+		useTLS: true, err: errInvalidSSEAlgorithm,
+	},
+	{
+		headers: map[string]string{
+			SSECopyCustomerAlgorithm: "AES256",
+			SSECopyCustomerKey:       "NjE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 3
+			SSECopyCustomerKeyMD5:    "H+jq/LwEOEO90YtiTuNFVw==",
+		},
+		useTLS: true, err: errSSEKeyMD5Mismatch,
+	},
+	{
+		headers: map[string]string{
+			SSECopyCustomerAlgorithm: "AES256",
+			SSECopyCustomerKey:       " jE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 4
+			SSECopyCustomerKeyMD5:    "H+jq/LwEOEO90YtiTuNFVw==",
+		},
+		useTLS: true, err: errInvalidSSEKey,
+	},
+	{
+		headers: map[string]string{
+			SSECopyCustomerAlgorithm: "AES256",
+			SSECopyCustomerKey:       "NjE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 5
+			SSECopyCustomerKeyMD5:    " +jq/LwEOEO90YtiTuNFVw==",
+		},
+		useTLS: true, err: errSSEKeyMD5Mismatch,
+	},
+	{
+		headers: map[string]string{
+			SSECopyCustomerAlgorithm: "AES256",
+			SSECopyCustomerKey:       "vFQ9ScFOF6Tu/BfzMS+rVMvlZGJHi5HmGJenJfrfKI45", // 6
+			SSECopyCustomerKeyMD5:    "9KPgDdZNTHimuYCwnJTp5g==",
+		},
+		useTLS: true, err: errInvalidSSEKey,
+	},
+	{
+		headers: map[string]string{
+			SSECopyCustomerAlgorithm: "AES256",
+			SSECopyCustomerKey:       "", // 7
+			SSECopyCustomerKeyMD5:    "9KPgDdZNTHimuYCwnJTp5g==",
+		},
+		useTLS: true, err: errMissingSSEKey,
+	},
+	{
+		headers: map[string]string{
+			SSECopyCustomerAlgorithm: "AES256",
+			SSECopyCustomerKey:       "vFQ9ScFOF6Tu/BfzMS+rVMvlZGJHi5HmGJenJfrfKI45", // 8
+			SSECopyCustomerKeyMD5:    "",
+		},
+		useTLS: true, err: errMissingSSEKeyMD5,
+	},
+}
+
+func TestParseSSECopyCustomerRequest(t *testing.T) {
+	defer func(flag bool) { globalIsSSL = flag }(globalIsSSL)
+	for i, test := range parseSSECopyCustomerRequestTests {
+		headers := http.Header{}
+		for k, v := range test.headers {
+			headers.Set(k, v)
+		}
+		request := &http.Request{}
+		request.Header = headers
+		globalIsSSL = test.useTLS
+
+		_, err := ParseSSECopyCustomerRequest(request)
+		if err != test.err {
+			t.Errorf("Test %d: Parse returned: %v want: %v", i, err, test.err)
+		}
+		key := request.Header.Get(SSECopyCustomerKey)
+		if (err == nil || err == errSSEKeyMD5Mismatch) && key != "" {
+			t.Errorf("Test %d: Client key survived parsing - found key: %v", i, key)
+		}
 	}
 }

 var encryptedSizeTests = []struct {
 	size, encsize int64
 }{
-	{size: 0, encsize: 0},                                           // 0
-	{size: 1, encsize: 33},                                          // 1
-	{size: 1024, encsize: 1024 + 32},                                // 2
-	{size: 2 * 64 * 1024, encsize: 2 * (64*1024 + 32)},              // 3
-	{size: 100*64*1024 + 1, encsize: 100*(64*1024+32) + 33},         // 4
-	{size: 64*1024 + 1, encsize: (64*1024 + 32) + 33},               // 5
-	{size: 5 * 1024 * 1024 * 1024, encsize: 81920 * (64*1024 + 32)}, // 6
+	{size: 0, encsize: 0},                                                                   // 0
+	{size: 1, encsize: 33},                                                                  // 1
+	{size: 1024, encsize: 1024 + 32},                                                        // 2
+	{size: 2 * sseDAREPackageBlockSize, encsize: 2 * (sseDAREPackageBlockSize + 32)},        // 3
+	{size: 100*sseDAREPackageBlockSize + 1, encsize: 100*(sseDAREPackageBlockSize+32) + 33}, // 4
+	{size: sseDAREPackageBlockSize + 1, encsize: (sseDAREPackageBlockSize + 32) + 33},       // 5
+	{size: 5 * 1024 * 1024 * 1024, encsize: 81920 * (sseDAREPackageBlockSize + 32)},         // 6
 }

 func TestEncryptedSize(t *testing.T) {
@@ -173,15 +300,15 @@ var decryptSSECustomerObjectInfoTests = []struct {
 	encsize, size int64
 	err           error
 }{
-	{encsize: 0, size: 0, err: nil},                                           // 0
-	{encsize: 33, size: 1, err: nil},                                          // 1
-	{encsize: 1024 + 32, size: 1024, err: nil},                                // 2
-	{encsize: 2 * (64*1024 + 32), size: 2 * 64 * 1024, err: nil},              // 3
-	{encsize: 100*(64*1024+32) + 33, size: 100*64*1024 + 1, err: nil},         // 4
-	{encsize: (64*1024 + 32) + 33, size: 64*1024 + 1, err: nil},               // 5
-	{encsize: 81920 * (64*1024 + 32), size: 5 * 1024 * 1024 * 1024, err: nil}, // 6
-	{encsize: 0, size: 0, err: nil},                                           // 7
-	{encsize: 64*1024 + 32 + 31, size: 0, err: errObjectTampered},             // 8
+	{encsize: 0, size: 0, err: nil},                                                                   // 0
+	{encsize: 33, size: 1, err: nil},                                                                  // 1
+	{encsize: 1024 + 32, size: 1024, err: nil},                                                        // 2
+	{encsize: 2 * (sseDAREPackageBlockSize + 32), size: 2 * sseDAREPackageBlockSize, err: nil},        // 3
+	{encsize: 100*(sseDAREPackageBlockSize+32) + 33, size: 100*sseDAREPackageBlockSize + 1, err: nil}, // 4
+	{encsize: (sseDAREPackageBlockSize + 32) + 33, size: sseDAREPackageBlockSize + 1, err: nil},       // 5
+	{encsize: 81920 * (sseDAREPackageBlockSize + 32), size: 5 * 1024 * 1024 * 1024, err: nil},         // 6
+	{encsize: 0, size: 0, err: nil},                                                                   // 7
+	{encsize: sseDAREPackageBlockSize + 32 + 31, size: 0, err: errObjectTampered},                     // 8
 }

 func TestDecryptedSize(t *testing.T) {
@@ -0,0 +1,251 @@
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/minio/minio-go/pkg/set"
+	"github.com/minio/minio/pkg/ellipses"
+)
+
+// This file implements and supports ellipses pattern for
+// `minio server` command line arguments.
+
+// Maximum number of unique args supported on the command line.
+const (
+	serverCommandLineArgsMax = 32
+)
+
+// Endpoint set represents parsed ellipses values, also provides
+// methods to get the sets of endpoints.
+type endpointSet struct {
+	argPatterns []ellipses.ArgPattern
+	endpoints   []string   // Endpoints saved from previous GetEndpoints().
+	setIndexes  [][]uint64 // All the sets.
+}
+
+// Supported set sizes this is used to find the optimal
+// single set size.
+var setSizes = []uint64{4, 6, 8, 10, 12, 14, 16}
+
+// getDivisibleSize - returns a greatest common divisor of
+// all the ellipses sizes.
+func getDivisibleSize(totalSizes []uint64) (result uint64) {
+	gcd := func(x, y uint64) uint64 {
+		for y != 0 {
+			x, y = y, x%y
+		}
+		return x
+	}
+	result = totalSizes[0]
+	for i := 1; i < len(totalSizes); i++ {
+		result = gcd(result, totalSizes[i])
+	}
+	return result
+}
+
+// getSetIndexes returns list of indexes which provides the set size
+// on each index, this function also determines the final set size
+// The final set size has the affinity towards choosing smaller
+// indexes (total sets)
+func getSetIndexes(args []string, totalSizes []uint64) (setIndexes [][]uint64, err error) {
+	if len(totalSizes) == 0 || len(args) == 0 {
+		return nil, errInvalidArgument
+	}
+
+	setIndexes = make([][]uint64, len(totalSizes))
+	for i, totalSize := range totalSizes {
+		// Check if totalSize has minimum range upto setSize
+		if totalSize < setSizes[0] {
+			return nil, fmt.Errorf("Invalid inputs (%s). Ellipses range or number of args %d should be atleast divisible by least possible set size %d",
+				args[i], totalSize, setSizes[0])
+		}
+	}
+
+	var setSize uint64
+
+	commonSize := getDivisibleSize(totalSizes)
+	if commonSize > setSizes[len(setSizes)-1] {
+		prevD := commonSize / setSizes[0]
+		for _, i := range setSizes {
+			if commonSize%i == 0 {
+				d := commonSize / i
+				if d <= prevD {
+					prevD = d
+					setSize = i
+				}
+			}
+		}
+	} else {
+		setSize = commonSize
+	}
+
+	// isValidSetSize - checks whether given count is a valid set size for erasure coding.
+	isValidSetSize := func(count uint64) bool {
+		return (count >= setSizes[0] && count <= setSizes[len(setSizes)-1] && count%2 == 0)
+	}
+
+	// Check whether setSize is with the supported range.
+	if !isValidSetSize(setSize) {
+		return nil, fmt.Errorf("Invalid inputs (%s). Ellipses range or number of args %d should be atleast divisible by least possible set size %d",
+			args, setSize, setSizes[0])
+	}
+
+	for i := range totalSizes {
+		for j := uint64(0); j < totalSizes[i]/setSize; j++ {
+			setIndexes[i] = append(setIndexes[i], setSize)
+		}
+	}
+
+	return setIndexes, nil
+}
+
+// Returns all the expanded endpoints, each argument is expanded separately.
+func (s endpointSet) getEndpoints() (endpoints []string) {
+	if len(s.endpoints) != 0 {
+		return s.endpoints
+	}
+	for _, argPattern := range s.argPatterns {
+		for _, lbls := range argPattern.Expand() {
+			endpoints = append(endpoints, strings.Join(lbls, ""))
+		}
+	}
+	s.endpoints = endpoints
+	return endpoints
+}
+
+// Get returns the sets representation of the endpoints
+// this function also intelligently decides on what will
+// be the right set size etc.
+func (s endpointSet) Get() (sets [][]string) {
+	var k = uint64(0)
+	endpoints := s.getEndpoints()
+	for i := range s.setIndexes {
+		for j := range s.setIndexes[i] {
+			sets = append(sets, endpoints[k:s.setIndexes[i][j]+k])
+			k = s.setIndexes[i][j] + k
+		}
+	}
+
+	return sets
+}
+
+// Return the total size for each argument patterns.
+func getTotalSizes(argPatterns []ellipses.ArgPattern) []uint64 {
+	var totalSizes []uint64
+	for _, argPattern := range argPatterns {
+		var totalSize uint64 = 1
+		for _, p := range argPattern {
+			totalSize = totalSize * uint64(len(p.Seq))
+		}
+		totalSizes = append(totalSizes, totalSize)
+	}
+	return totalSizes
+}
+
+// Parses all arguments and returns an endpointSet which is a collection
+// of endpoints following the ellipses pattern, this is what is used
+// by the object layer for initializing itself.
+func parseEndpointSet(args ...string) (ep endpointSet, err error) {
+	var argPatterns = make([]ellipses.ArgPattern, len(args))
+	for i, arg := range args {
+		patterns, perr := ellipses.FindEllipsesPatterns(arg)
+		if perr != nil {
+			return endpointSet{}, perr
+		}
+		argPatterns[i] = patterns
+	}
+
+	ep.setIndexes, err = getSetIndexes(args, getTotalSizes(argPatterns))
+	if err != nil {
+		return endpointSet{}, err
+	}
+
+	ep.argPatterns = argPatterns
+
+	return ep, nil
+}
+
+// Parses all ellipses input arguments, expands them into corresponding
+// list of endpoints chunked evenly in accordance with a specific
+// set size.
+// For example: {1...64} is divided into 4 sets each of size 16.
+// This applies to even distributed setup syntax as well.
+func getAllSets(args ...string) ([][]string, error) {
+	if len(args) == 0 {
+		return nil, errInvalidArgument
+	}
+
+	var setArgs [][]string
+	if !ellipses.HasEllipses(args...) {
+		var setIndexes [][]uint64
+		// Check if we have more one args.
+		if len(args) > 1 {
+			var err error
+			setIndexes, err = getSetIndexes(args, []uint64{uint64(len(args))})
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			// We are in FS setup, proceed forward.
+			setIndexes = [][]uint64{{uint64(len(args))}}
+		}
+		s := endpointSet{
+			endpoints:  args,
+			setIndexes: setIndexes,
+		}
+		setArgs = s.Get()
+	} else {
+		s, err := parseEndpointSet(args...)
+		if err != nil {
+			return nil, err
+		}
+		setArgs = s.Get()
+	}
+
+	uniqueArgs := set.NewStringSet()
+	for _, sargs := range setArgs {
+		for _, arg := range sargs {
+			if uniqueArgs.Contains(arg) {
+				return nil, fmt.Errorf("Input args (%s) has duplicate ellipses", args)
+			}
+			uniqueArgs.Add(arg)
+		}
+	}
+
+	return setArgs, nil
+}
+
+// CreateServerEndpoints - validates and creates new endpoints from input args, supports
+// both ellipses and without ellipses transparently.
+func createServerEndpoints(serverAddr string, args ...string) (string, EndpointList, SetupType, int, int, error) {
+	setArgs, err := getAllSets(args...)
+	if err != nil {
+		return serverAddr, nil, -1, 0, 0, err
+	}
+
+	var endpoints EndpointList
+	var setupType SetupType
+	serverAddr, endpoints, setupType, err = CreateEndpoints(serverAddr, setArgs...)
+	if err != nil {
+		return serverAddr, nil, -1, 0, 0, err
+	}
+
+	return serverAddr, endpoints, setupType, len(setArgs), len(setArgs[0]), nil
+}
@@ -0,0 +1,388 @@
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/minio/minio/pkg/ellipses"
+)
+
+// Tests create endpoints with ellipses and without.
+func TestCreateServerEndpoints(t *testing.T) {
+	testCases := []struct {
+		serverAddr string
+		args       []string
+		success    bool
+	}{
+		// Invalid input.
+		{"", []string{}, false},
+		// Range cannot be negative.
+		{":9000", []string{"/export1{-1...1}"}, false},
+		// Range cannot start bigger than end.
+		{":9000", []string{"/export1{64...1}"}, false},
+		// Range can only be numeric.
+		{":9000", []string{"/export1{a...z}"}, false},
+		// Duplicate disks not allowed.
+		{":9000", []string{"/export1{1...32}", "/export1{1...32}"}, false},
+		// Same host cannot export same disk on two ports - special case localhost.
+		{":9001", []string{"http://localhost:900{1...2}/export{1...64}"}, false},
+
+		// Valid inputs.
+		{":9000", []string{"/export1"}, true},
+		{":9000", []string{"/export1", "/export2", "/export3", "/export4"}, true},
+		{":9000", []string{"/export1{1...64}"}, true},
+		{":9000", []string{"/export1{01...64}"}, true},
+		{":9000", []string{"/export1{1...32}", "/export1{33...64}"}, true},
+		{":9001", []string{"http://localhost:9001/export{1...64}"}, true},
+		{":9001", []string{"http://localhost:9001/export{01...64}"}, true},
+	}
+
+	for i, testCase := range testCases {
+		_, _, _, _, _, err := createServerEndpoints(testCase.serverAddr, testCase.args...)
+		if err != nil && testCase.success {
+			t.Errorf("Test %d: Expected success but failed instead %s", i+1, err)
+		}
+		if err == nil && !testCase.success {
+			t.Errorf("Test %d: Expected failure but passed instead", i+1)
+		}
+	}
+}
+
+// Test tests calculating set indexes.
+func TestGetSetIndexes(t *testing.T) {
+	testCases := []struct {
+		args       []string
+		totalSizes []uint64
+		indexes    [][]uint64
+		success    bool
+	}{
+		// Invalid inputs.
+		{
+			[]string{"data{1...27}"},
+			[]uint64{27},
+			nil,
+			false,
+		},
+		// Valid inputs.
+		{
+			[]string{"data{1...64}"},
+			[]uint64{64},
+			[][]uint64{{16, 16, 16, 16}},
+			true,
+		},
+		{
+			[]string{"data{1...24}"},
+			[]uint64{24},
+			[][]uint64{{12, 12}},
+			true,
+		},
+		{
+			[]string{"data/controller{1...11}/export{1...8}"},
+			[]uint64{88},
+			[][]uint64{{8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8}},
+			true,
+		},
+		{
+			[]string{"data{1...4}"},
+			[]uint64{4},
+			[][]uint64{{4}},
+			true,
+		},
+	}
+
+	for i, testCase := range testCases {
+		t.Run(fmt.Sprintf("Test%d", i+1), func(t *testing.T) {
+			gotIndexes, err := getSetIndexes(testCase.args, testCase.totalSizes)
+			if err != nil && testCase.success {
+				t.Errorf("Expected success but failed instead %s", err)
+			}
+			if err == nil && !testCase.success {
+				t.Errorf("Expected failure but passed instead")
+			}
+			if !reflect.DeepEqual(testCase.indexes, gotIndexes) {
+				t.Errorf("Expected %v, got %v", testCase.indexes, gotIndexes)
+			}
+		})
+	}
+}
+
+func getSequences(start int, number int, paddinglen int) (seq []string) {
+	for i := start; i <= number; i++ {
+		if paddinglen == 0 {
+			seq = append(seq, fmt.Sprintf("%d", i))
+		} else {
+			seq = append(seq, fmt.Sprintf(fmt.Sprintf("%%0%dd", paddinglen), i))
+		}
+	}
+	return seq
+}
+
+// Test tests parses endpoint ellipses input pattern.
+func TestParseEndpointSet(t *testing.T) {
+	testCases := []struct {
+		arg     string
+		es      endpointSet
+		success bool
+	}{
+		// Tests invalid inputs.
+		{
+			"...",
+			endpointSet{},
+			false,
+		},
+		// Indivisible range.
+		{
+			"{1...27}",
+			endpointSet{},
+			false,
+		},
+		// No range specified.
+		{
+			"{...}",
+			endpointSet{},
+			false,
+		},
+		// Invalid range.
+		{
+			"http://minio{2...3}/export/set{1...0}",
+			endpointSet{},
+			false,
+		},
+		// Range cannot be smaller than 4 minimum.
+		{
+			"/export{1..2}",
+			endpointSet{},
+			false,
+		},
+		// Unsupported characters.
+		{
+			"/export/test{1...2O}",
+			endpointSet{},
+			false,
+		},
+		// Tests valid inputs.
+		{
+			"/export/set{1...64}",
+			endpointSet{
+				[]ellipses.ArgPattern{
+					[]ellipses.Pattern{
+						{
+							"/export/set",
+							"",
+							getSequences(1, 64, 0),
+						},
+					},
+				},
+				nil,
+				[][]uint64{{16, 16, 16, 16}},
+			},
+			true,
+		},
+		// Valid input for distributed setup.
+		{
+			"http://minio{2...3}/export/set{1...64}",
+			endpointSet{
+				[]ellipses.ArgPattern{
+					[]ellipses.Pattern{
+						{
+							"",
+							"",
+							getSequences(1, 64, 0),
+						},
+						{
+							"http://minio",
+							"/export/set",
+							getSequences(2, 3, 0),
+						},
+					},
+				},
+				nil,
+				[][]uint64{{16, 16, 16, 16, 16, 16, 16, 16}},
+			},
+			true,
+		},
+		// Supporting some advanced cases.
+		{
+			"http://minio{1...64}.mydomain.net/data",
+			endpointSet{
+				[]ellipses.ArgPattern{
+					[]ellipses.Pattern{
+						{
+							"http://minio",
+							".mydomain.net/data",
+							getSequences(1, 64, 0),
+						},
+					},
+				},
+				nil,
+				[][]uint64{{16, 16, 16, 16}},
+			},
+			true,
+		},
+		{
+			"http://rack{1...4}.mydomain.minio{1...16}/data",
+			endpointSet{
+				[]ellipses.ArgPattern{
+					[]ellipses.Pattern{
+						{
+							"",
+							"/data",
+							getSequences(1, 16, 0),
+						},
+						{
+							"http://rack",
+							".mydomain.minio",
+							getSequences(1, 4, 0),
+						},
+					},
+				},
+				nil,
+				[][]uint64{{16, 16, 16, 16}},
+			},
+			true,
+		},
+		// Supporting kubernetes cases.
+		{
+			"http://minio{0...15}.mydomain.net/data{0...1}",
+			endpointSet{
+				[]ellipses.ArgPattern{
+					[]ellipses.Pattern{
+						{
+							"",
+							"",
+							getSequences(0, 1, 0),
+						},
+						{
+							"http://minio",
+							".mydomain.net/data",
+							getSequences(0, 15, 0),
+						},
+					},
+				},
+				nil,
+				[][]uint64{{16, 16}},
+			},
+			true,
+		},
+		// No host regex, just disks.
+		{
+			"http://server1/data{1...32}",
+			endpointSet{
+				[]ellipses.ArgPattern{
+					[]ellipses.Pattern{
+						{
+							"http://server1/data",
+							"",
+							getSequences(1, 32, 0),
+						},
+					},
+				},
+				nil,
+				[][]uint64{{16, 16}},
+			},
+			true,
+		},
+		// No host regex, just disks with two position numerics.
+		{
+			"http://server1/data{01...32}",
+			endpointSet{
+				[]ellipses.ArgPattern{
+					[]ellipses.Pattern{
+						{
+							"http://server1/data",
+							"",
+							getSequences(1, 32, 2),
+						},
+					},
+				},
+				nil,
+				[][]uint64{{16, 16}},
+			},
+			true,
+		},
+		// More than 2 ellipses are supported as well.
+		{
+			"http://minio{2...3}/export/set{1...64}/test{1...2}",
+			endpointSet{
+				[]ellipses.ArgPattern{
+					[]ellipses.Pattern{
+						{
+							"",
+							"",
+							getSequences(1, 2, 0),
+						},
+						{
+							"",
+							"/test",
+							getSequences(1, 64, 0),
+						},
+						{
+							"http://minio",
+							"/export/set",
+							getSequences(2, 3, 0),
+						},
+					},
+				},
+				nil,
+				[][]uint64{{16, 16, 16, 16, 16, 16, 16, 16,
+					16, 16, 16, 16, 16, 16, 16, 16}},
+			},
+			true,
+		},
+		// More than 1 ellipses per argument for standalone setup.
+		{
+			"/export{1...10}/disk{1...10}",
+			endpointSet{
+				[]ellipses.ArgPattern{
+					[]ellipses.Pattern{
+						{
+							"",
+							"",
+							getSequences(1, 10, 0),
+						},
+						{
+							"/export",
+							"/disk",
+							getSequences(1, 10, 0),
+						},
+					},
+				},
+				nil,
+				[][]uint64{{10, 10, 10, 10, 10, 10, 10, 10, 10, 10}},
+			},
+			true,
+		},
+	}
+
+	for i, testCase := range testCases {
+		t.Run(fmt.Sprintf("Test%d", i+1), func(t *testing.T) {
+			gotEs, err := parseEndpointSet(testCase.arg)
+			if err != nil && testCase.success {
+				t.Errorf("Expected success but failed instead %s", err)
+			}
+			if err == nil && !testCase.success {
+				t.Errorf("Expected failure but passed instead")
+			}
+			if !reflect.DeepEqual(testCase.es, gotEs) {
+				t.Errorf("Expected %v, got %v", testCase.es, gotEs)
+			}
+		})
+	}
+}
@@ -23,7 +23,6 @@ import (
 	"path"
 	"path/filepath"
 	"runtime"
-	"sort"
 	"strconv"
 	"strings"

@@ -45,7 +44,8 @@ const (
 // Endpoint - any type of endpoint.
 type Endpoint struct {
 	*url.URL
-	IsLocal bool
+	IsLocal  bool
+	SetIndex int
 }

 func (endpoint Endpoint) String() string {
@@ -166,38 +166,22 @@ func NewEndpoint(arg string) (ep Endpoint, e error) {
 // EndpointList - list of same type of endpoint.
 type EndpointList []Endpoint

-// Swap - helper method for sorting.
-func (endpoints EndpointList) Swap(i, j int) {
-	endpoints[i], endpoints[j] = endpoints[j], endpoints[i]
-}
-
-// Len - helper method for sorting.
-func (endpoints EndpointList) Len() int {
-	return len(endpoints)
-}
-
-// Less - helper method for sorting.
-func (endpoints EndpointList) Less(i, j int) bool {
-	return endpoints[i].String() < endpoints[j].String()
-}
-
 // IsHTTPS - returns true if secure for URLEndpointType.
 func (endpoints EndpointList) IsHTTPS() bool {
 	return endpoints[0].IsHTTPS()
 }

+// GetString - returns endpoint string of i-th endpoint (0-based),
+// and empty string for invalid indexes.
+func (endpoints EndpointList) GetString(i int) string {
+	if i < 0 || i >= len(endpoints) {
+		return ""
+	}
+	return endpoints[i].String()
+}
+
 // NewEndpointList - returns new endpoint list based on input args.
 func NewEndpointList(args ...string) (endpoints EndpointList, err error) {
-	// isValidDistribution - checks whether given count is a valid distribution for erasure coding.
-	isValidDistribution := func(count int) bool {
-		return (count >= minErasureBlocks && count <= maxErasureBlocks && count%2 == 0)
-	}
-
-	// Check whether no. of args are valid for XL distribution.
-	if !isValidDistribution(len(args)) {
-		return nil, fmt.Errorf("A total of %d endpoints were found. For erasure mode it should be an even number between %d and %d", len(args), minErasureBlocks, maxErasureBlocks)
-	}
-
 	var endpointType EndpointType
 	var scheme string

@@ -227,8 +211,6 @@ func NewEndpointList(args ...string) (endpoints EndpointList, err error) {
 		endpoints = append(endpoints, endpoint)
 	}

-	sort.Sort(endpoints)
-
 	return endpoints, nil
 }

@@ -249,7 +231,7 @@ func checkCrossDeviceMounts(endpoints EndpointList) (err error) {
 }

 // CreateEndpoints - validates and creates new endpoints for given args.
-func CreateEndpoints(serverAddr string, args ...string) (string, EndpointList, SetupType, error) {
+func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList, SetupType, error) {
 	var endpoints EndpointList
 	var setupType SetupType
 	var err error
@@ -262,9 +244,9 @@ func CreateEndpoints(serverAddr string, args ...string) (string, EndpointList, S
 	_, serverAddrPort := mustSplitHostPort(serverAddr)

 	// For single arg, return FS setup.
-	if len(args) == 1 {
+	if len(args) == 1 && len(args[0]) == 1 {
 		var endpoint Endpoint
-		endpoint, err = NewEndpoint(args[0])
+		endpoint, err = NewEndpoint(args[0][0])
 		if err != nil {
 			return serverAddr, endpoints, setupType, err
 		}
@@ -281,14 +263,25 @@ func CreateEndpoints(serverAddr string, args ...string) (string, EndpointList, S
 		return serverAddr, endpoints, setupType, nil
 	}

-	// Convert args to endpoints
-	if endpoints, err = NewEndpointList(args...); err != nil {
-		return serverAddr, endpoints, setupType, err
-	}
+	for i, iargs := range args {
+		var newEndpoints EndpointList
+		// Convert args to endpoints
+		var eps EndpointList
+		eps, err = NewEndpointList(iargs...)
+		if err != nil {
+			return serverAddr, endpoints, setupType, err
+		}

-	// Check for cross device mounts if any.
-	if err = checkCrossDeviceMounts(endpoints); err != nil {
-		return serverAddr, endpoints, setupType, err
+		// Check for cross device mounts if any.
+		if err = checkCrossDeviceMounts(eps); err != nil {
+			return serverAddr, endpoints, setupType, err
+		}
+
+		for _, ep := range eps {
+			ep.SetIndex = i
+			newEndpoints = append(newEndpoints, ep)
+		}
+		endpoints = append(endpoints, newEndpoints...)
 	}

 	// Return XL setup when all endpoints are path style.
@@ -325,7 +318,7 @@ func CreateEndpoints(serverAddr string, args ...string) (string, EndpointList, S
 		return serverAddr, endpoints, setupType, fmt.Errorf("no endpoint found for this host")
 	}

-	// Check whether same path is not used in endpoints of a host.
+	// Check whether same path is not used in endpoints of a host on different port.
 	{
 		pathIPMap := make(map[string]set.StringSet)
 		for _, endpoint := range endpoints {
@@ -340,7 +333,6 @@ func CreateEndpoints(serverAddr string, args ...string) (string, EndpointList, S
 					err = fmt.Errorf("path '%s' can not be served by different port on same address", endpoint.Path)
 					return serverAddr, endpoints, setupType, err
 				}
-
 				pathIPMap[endpoint.Path] = IPSet.Union(hostIPSet)
 			} else {
 				pathIPMap[endpoint.Path] = hostIPSet
@@ -348,6 +340,21 @@ func CreateEndpoints(serverAddr string, args ...string) (string, EndpointList, S
 		}
 	}

+	// Check whether same path is used for more than 1 local endpoints.
+	{
+		localPathSet := set.CreateStringSet()
+		for _, endpoint := range endpoints {
+			if !endpoint.IsLocal {
+				continue
+			}
+			if localPathSet.Contains(endpoint.Path) {
+				err = fmt.Errorf("path '%s' cannot be served by different address on same server", endpoint.Path)
+				return serverAddr, endpoints, setupType, err
+			}
+			localPathSet.Add(endpoint.Path)
+		}
+	}
+
 	// Check whether serverAddrPort matches at least in one of port used in local endpoints.
 	{
 		if !localPortSet.Contains(serverAddrPort) {
@@ -418,6 +425,23 @@ func CreateEndpoints(serverAddr string, args ...string) (string, EndpointList, S
 		}
 	}

+	uniqueArgs := set.NewStringSet()
+	for _, endpoint := range endpoints {
+		uniqueArgs.Add(endpoint.Host)
+	}
+
+	// Error out if we have more than serverCommandLineArgsMax unique servers.
+	if len(uniqueArgs.ToSlice()) > serverCommandLineArgsMax {
+		err := fmt.Errorf("Unsupported number of endpoints (%s), total number of servers cannot be more than %d", endpoints, serverCommandLineArgsMax)
+		return serverAddr, endpoints, setupType, err
+	}
+
+	// Error out if we have less than 2 unique servers.
+	if len(uniqueArgs.ToSlice()) < 2 && setupType == DistXLSetupType {
+		err := fmt.Errorf("Unsupported number of endpoints (%s), minimum number of servers cannot be less than 2 in distributed setup", endpoints)
+		return serverAddr, endpoints, setupType, err
+	}
+
 	setupType = DistXLSetupType
 	return serverAddr, endpoints, setupType, nil
 }
@@ -20,7 +20,6 @@ import (
 	"fmt"
 	"net/url"
 	"reflect"
-	"sort"
 	"strings"
 	"testing"
 )
@@ -108,7 +107,6 @@ func TestNewEndpointList(t *testing.T) {
 		{[]string{"d1", "d2", "d3", "d1"}, fmt.Errorf("duplicate endpoints found")},
 		{[]string{"d1", "d2", "d3", "./d1"}, fmt.Errorf("duplicate endpoints found")},
 		{[]string{"http://localhost/d1", "http://localhost/d2", "http://localhost/d1", "http://localhost/d4"}, fmt.Errorf("duplicate endpoints found")},
-		{[]string{"d1", "d2", "d3", "d4", "d5"}, fmt.Errorf("A total of 5 endpoints were found. For erasure mode it should be an even number between 4 and 16")},
 		{[]string{"ftp://server/d1", "http://server/d2", "http://server/d3", "http://server/d4"}, fmt.Errorf("'ftp://server/d1': invalid URL endpoint format")},
 		{[]string{"d1", "http://localhost/d2", "d3", "d4"}, fmt.Errorf("mixed style endpoints are not supported")},
 		{[]string{"http://example.org/d1", "https://example.com/d1", "http://example.net/d1", "https://example.edut/d1"}, fmt.Errorf("mixed scheme is not supported")},
@@ -142,7 +140,6 @@ func TestCreateEndpoints(t *testing.T) {
 	getExpectedEndpoints := func(args []string, prefix string) ([]*url.URL, []bool) {
 		var URLs []*url.URL
 		var localFlags []bool
-		sort.Strings(args)
 		for _, arg := range args {
 			u, _ := url.Parse(arg)
 			URLs = append(URLs, u)
@@ -157,8 +154,8 @@ func TestCreateEndpoints(t *testing.T) {
 	args := []string{
 		"http://" + nonLoopBackIP + ":10000/d1",
 		"http://" + nonLoopBackIP + ":10000/d2",
-		"http://example.com:10000/d4",
 		"http://example.org:10000/d3",
+		"http://example.com:10000/d4",
 	}
 	case1URLs, case1LocalFlags := getExpectedEndpoints(args, "http://"+nonLoopBackIP+":10000/")

@@ -167,26 +164,26 @@ func TestCreateEndpoints(t *testing.T) {
 	args = []string{
 		"http://" + nonLoopBackIP + ":10000/d1",
 		"http://" + nonLoopBackIP + ":9000/d2",
-		"http://example.com:10000/d4",
 		"http://example.org:10000/d3",
+		"http://example.com:10000/d4",
 	}
 	case2URLs, case2LocalFlags := getExpectedEndpoints(args, "http://"+nonLoopBackIP+":10000/")

 	case3Endpoint1 := "http://" + nonLoopBackIP + "/d1"
 	args = []string{
 		"http://" + nonLoopBackIP + ":80/d1",
+		"http://example.org:9000/d2",
 		"http://example.com:80/d3",
 		"http://example.net:80/d4",
-		"http://example.org:9000/d2",
 	}
 	case3URLs, case3LocalFlags := getExpectedEndpoints(args, "http://"+nonLoopBackIP+":80/")

 	case4Endpoint1 := "http://" + nonLoopBackIP + "/d1"
 	args = []string{
 		"http://" + nonLoopBackIP + ":9000/d1",
+		"http://example.org:9000/d2",
 		"http://example.com:9000/d3",
 		"http://example.net:9000/d4",
-		"http://example.org:9000/d2",
 	}
 	case4URLs, case4LocalFlags := getExpectedEndpoints(args, "http://"+nonLoopBackIP+":9000/")

@@ -213,29 +210,29 @@ func TestCreateEndpoints(t *testing.T) {

 	testCases := []struct {
 		serverAddr         string
-		args               []string
+		args               [][]string
 		expectedServerAddr string
 		expectedEndpoints  EndpointList
 		expectedSetupType  SetupType
 		expectedErr        error
 	}{
-		{"localhost", []string{}, "", EndpointList{}, -1, fmt.Errorf("address localhost: missing port in address")},
+		{"localhost", [][]string{}, "", EndpointList{}, -1, fmt.Errorf("address localhost: missing port in address")},

 		// FS Setup
-		{"localhost:9000", []string{"http://localhost/d1"}, "", EndpointList{}, -1, fmt.Errorf("use path style endpoint for FS setup")},
-		{":443", []string{"d1"}, ":443", EndpointList{Endpoint{URL: &url.URL{Path: "d1"}, IsLocal: true}}, FSSetupType, nil},
-		{"localhost:10000", []string{"/d1"}, "localhost:10000", EndpointList{Endpoint{URL: &url.URL{Path: "/d1"}, IsLocal: true}}, FSSetupType, nil},
-		{"localhost:10000", []string{"./d1"}, "localhost:10000", EndpointList{Endpoint{URL: &url.URL{Path: "d1"}, IsLocal: true}}, FSSetupType, nil},
-		{"localhost:10000", []string{`\d1`}, "localhost:10000", EndpointList{Endpoint{URL: &url.URL{Path: `\d1`}, IsLocal: true}}, FSSetupType, nil},
-		{"localhost:10000", []string{`.\d1`}, "localhost:10000", EndpointList{Endpoint{URL: &url.URL{Path: `.\d1`}, IsLocal: true}}, FSSetupType, nil},
-		{":8080", []string{"https://example.org/d1", "https://example.org/d2", "https://example.org/d3", "https://example.org/d4"}, "", EndpointList{}, -1, fmt.Errorf("no endpoint found for this host")},
-		{":8080", []string{"https://example.org/d1", "https://example.com/d2", "https://example.net:8000/d3", "https://example.edu/d1"}, "", EndpointList{}, -1, fmt.Errorf("no endpoint found for this host")},
-		{"localhost:9000", []string{"https://127.0.0.1:9000/d1", "https://localhost:9001/d1", "https://example.com/d1", "https://example.com/d2"}, "", EndpointList{}, -1, fmt.Errorf("path '/d1' can not be served by different port on same address")},
-		{"localhost:9000", []string{"https://127.0.0.1:8000/d1", "https://localhost:9001/d2", "https://example.com/d1", "https://example.com/d2"}, "", EndpointList{}, -1, fmt.Errorf("port number in server address must match with one of the port in local endpoints")},
-		{"localhost:10000", []string{"https://127.0.0.1:8000/d1", "https://localhost:8000/d2", "https://example.com/d1", "https://example.com/d2"}, "", EndpointList{}, -1, fmt.Errorf("server address and local endpoint have different ports")},
+		{"localhost:9000", [][]string{{"http://localhost/d1"}}, "", EndpointList{}, -1, fmt.Errorf("use path style endpoint for FS setup")},
+		{":443", [][]string{{"d1"}}, ":443", EndpointList{Endpoint{URL: &url.URL{Path: "d1"}, IsLocal: true}}, FSSetupType, nil},
+		{"localhost:10000", [][]string{{"/d1"}}, "localhost:10000", EndpointList{Endpoint{URL: &url.URL{Path: "/d1"}, IsLocal: true}}, FSSetupType, nil},
+		{"localhost:10000", [][]string{{"./d1"}}, "localhost:10000", EndpointList{Endpoint{URL: &url.URL{Path: "d1"}, IsLocal: true}}, FSSetupType, nil},
+		{"localhost:10000", [][]string{{`\d1`}}, "localhost:10000", EndpointList{Endpoint{URL: &url.URL{Path: `\d1`}, IsLocal: true}}, FSSetupType, nil},
+		{"localhost:10000", [][]string{{`.\d1`}}, "localhost:10000", EndpointList{Endpoint{URL: &url.URL{Path: `.\d1`}, IsLocal: true}}, FSSetupType, nil},
+		{":8080", [][]string{{"https://example.org/d1", "https://example.org/d2", "https://example.org/d3", "https://example.org/d4"}}, "", EndpointList{}, -1, fmt.Errorf("no endpoint found for this host")},
+		{":8080", [][]string{{"https://example.org/d1", "https://example.com/d2", "https://example.net:8000/d3", "https://example.edu/d1"}}, "", EndpointList{}, -1, fmt.Errorf("no endpoint found for this host")},
+		{"localhost:9000", [][]string{{"https://127.0.0.1:9000/d1", "https://localhost:9001/d1", "https://example.com/d1", "https://example.com/d2"}}, "", EndpointList{}, -1, fmt.Errorf("path '/d1' can not be served by different port on same address")},
+		{"localhost:9000", [][]string{{"https://127.0.0.1:8000/d1", "https://localhost:9001/d2", "https://example.com/d1", "https://example.com/d2"}}, "", EndpointList{}, -1, fmt.Errorf("port number in server address must match with one of the port in local endpoints")},
+		{"localhost:10000", [][]string{{"https://127.0.0.1:8000/d1", "https://localhost:8000/d2", "https://example.com/d1", "https://example.com/d2"}}, "", EndpointList{}, -1, fmt.Errorf("server address and local endpoint have different ports")},

 		// XL Setup with PathEndpointType
-		{":1234", []string{"/d1", "/d2", "d3", "d4"}, ":1234",
+		{":1234", [][]string{{"/d1", "/d2", "d3", "d4"}}, ":1234",
 			EndpointList{
 				Endpoint{URL: &url.URL{Path: "/d1"}, IsLocal: true},
 				Endpoint{URL: &url.URL{Path: "/d2"}, IsLocal: true},
@@ -243,53 +240,55 @@ func TestCreateEndpoints(t *testing.T) {
 				Endpoint{URL: &url.URL{Path: "d4"}, IsLocal: true},
 			}, XLSetupType, nil},
 		// XL Setup with URLEndpointType
-		{":9000", []string{"http://localhost/d1", "http://localhost/d2", "http://localhost/d3", "http://localhost/d4"}, ":9000", EndpointList{
+		{":9000", [][]string{{"http://localhost/d1", "http://localhost/d2", "http://localhost/d3", "http://localhost/d4"}}, ":9000", EndpointList{
 			Endpoint{URL: &url.URL{Path: "/d1"}, IsLocal: true},
 			Endpoint{URL: &url.URL{Path: "/d2"}, IsLocal: true},
 			Endpoint{URL: &url.URL{Path: "/d3"}, IsLocal: true},
 			Endpoint{URL: &url.URL{Path: "/d4"}, IsLocal: true},
 		}, XLSetupType, nil},
 		// XL Setup with URLEndpointType having mixed naming to local host.
-		{"127.0.0.1:10000", []string{"http://localhost/d1", "http://localhost/d2", "http://127.0.0.1/d3", "http://127.0.0.1/d4"}, ":10000", EndpointList{
+		{"127.0.0.1:10000", [][]string{{"http://localhost/d1", "http://localhost/d2", "http://127.0.0.1/d3", "http://127.0.0.1/d4"}}, ":10000", EndpointList{
 			Endpoint{URL: &url.URL{Path: "/d1"}, IsLocal: true},
 			Endpoint{URL: &url.URL{Path: "/d2"}, IsLocal: true},
 			Endpoint{URL: &url.URL{Path: "/d3"}, IsLocal: true},
 			Endpoint{URL: &url.URL{Path: "/d4"}, IsLocal: true},
 		}, XLSetupType, nil},
-		{":9001", []string{"http://10.0.0.1:9000/export", "http://10.0.0.2:9000/export", "http://" + nonLoopBackIP + ":9001/export", "http://10.0.0.2:9001/export"}, "", EndpointList{}, -1, fmt.Errorf("path '/export' can not be served by different port on same address")},
+		{":9001", [][]string{{"http://10.0.0.1:9000/export", "http://10.0.0.2:9000/export", "http://" + nonLoopBackIP + ":9001/export", "http://10.0.0.2:9001/export"}}, "", EndpointList{}, -1, fmt.Errorf("path '/export' can not be served by different port on same address")},

-		{":9000", []string{"http://localhost/d1", "http://localhost/d2", "http://example.org/d3", "http://example.com/d4"}, "", EndpointList{}, -1, fmt.Errorf("'localhost' resolves to loopback address is not allowed for distributed XL")},
+		{":9000", [][]string{{"http://127.0.0.1:9000/export", "http://" + nonLoopBackIP + ":9000/export", "http://10.0.0.1:9000/export", "http://10.0.0.2:9000/export"}}, "", EndpointList{}, -1, fmt.Errorf("path '/export' cannot be served by different address on same server")},
+
+		{":9000", [][]string{{"http://localhost/d1", "http://localhost/d2", "http://example.org/d3", "http://example.com/d4"}}, "", EndpointList{}, -1, fmt.Errorf("'localhost' resolves to loopback address is not allowed for distributed XL")},

 		// DistXL type
-		{"127.0.0.1:10000", []string{case1Endpoint1, case1Endpoint2, "http://example.org/d3", "http://example.com/d4"}, "127.0.0.1:10000", EndpointList{
+		{"127.0.0.1:10000", [][]string{{case1Endpoint1, case1Endpoint2, "http://example.org/d3", "http://example.com/d4"}}, "127.0.0.1:10000", EndpointList{
 			Endpoint{URL: case1URLs[0], IsLocal: case1LocalFlags[0]},
 			Endpoint{URL: case1URLs[1], IsLocal: case1LocalFlags[1]},
 			Endpoint{URL: case1URLs[2], IsLocal: case1LocalFlags[2]},
 			Endpoint{URL: case1URLs[3], IsLocal: case1LocalFlags[3]},
 		}, DistXLSetupType, nil},

-		{"127.0.0.1:10000", []string{case2Endpoint1, case2Endpoint2, "http://example.org/d3", "http://example.com/d4"}, "127.0.0.1:10000", EndpointList{
+		{"127.0.0.1:10000", [][]string{{case2Endpoint1, case2Endpoint2, "http://example.org/d3", "http://example.com/d4"}}, "127.0.0.1:10000", EndpointList{
 			Endpoint{URL: case2URLs[0], IsLocal: case2LocalFlags[0]},
 			Endpoint{URL: case2URLs[1], IsLocal: case2LocalFlags[1]},
 			Endpoint{URL: case2URLs[2], IsLocal: case2LocalFlags[2]},
 			Endpoint{URL: case2URLs[3], IsLocal: case2LocalFlags[3]},
 		}, DistXLSetupType, nil},

-		{":80", []string{case3Endpoint1, "http://example.org:9000/d2", "http://example.com/d3", "http://example.net/d4"}, ":80", EndpointList{
+		{":80", [][]string{{case3Endpoint1, "http://example.org:9000/d2", "http://example.com/d3", "http://example.net/d4"}}, ":80", EndpointList{
 			Endpoint{URL: case3URLs[0], IsLocal: case3LocalFlags[0]},
 			Endpoint{URL: case3URLs[1], IsLocal: case3LocalFlags[1]},
 			Endpoint{URL: case3URLs[2], IsLocal: case3LocalFlags[2]},
 			Endpoint{URL: case3URLs[3], IsLocal: case3LocalFlags[3]},
 		}, DistXLSetupType, nil},

-		{":9000", []string{case4Endpoint1, "http://example.org/d2", "http://example.com/d3", "http://example.net/d4"}, ":9000", EndpointList{
+		{":9000", [][]string{{case4Endpoint1, "http://example.org/d2", "http://example.com/d3", "http://example.net/d4"}}, ":9000", EndpointList{
 			Endpoint{URL: case4URLs[0], IsLocal: case4LocalFlags[0]},
 			Endpoint{URL: case4URLs[1], IsLocal: case4LocalFlags[1]},
 			Endpoint{URL: case4URLs[2], IsLocal: case4LocalFlags[2]},
 			Endpoint{URL: case4URLs[3], IsLocal: case4LocalFlags[3]},
 		}, DistXLSetupType, nil},

-		{":9000", []string{case5Endpoint1, case5Endpoint2, case5Endpoint3, case5Endpoint4}, ":9000", EndpointList{
+		{":9000", [][]string{{case5Endpoint1, case5Endpoint2, case5Endpoint3, case5Endpoint4}}, ":9000", EndpointList{
 			Endpoint{URL: case5URLs[0], IsLocal: case5LocalFlags[0]},
 			Endpoint{URL: case5URLs[1], IsLocal: case5LocalFlags[1]},
 			Endpoint{URL: case5URLs[2], IsLocal: case5LocalFlags[2]},
@@ -297,7 +296,7 @@ func TestCreateEndpoints(t *testing.T) {
 		}, DistXLSetupType, nil},

 		// DistXL Setup using only local host.
-		{":9003", []string{"http://localhost:9000/d1", "http://localhost:9001/d2", "http://127.0.0.1:9002/d3", case6Endpoint}, ":9003", EndpointList{
+		{":9003", [][]string{{"http://localhost:9000/d1", "http://localhost:9001/d2", "http://127.0.0.1:9002/d3", case6Endpoint}}, ":9003", EndpointList{
 			Endpoint{URL: case6URLs[0], IsLocal: case6LocalFlags[0]},
 			Endpoint{URL: case6URLs[1], IsLocal: case6LocalFlags[1]},
 			Endpoint{URL: case6URLs[2], IsLocal: case6LocalFlags[2]},
@@ -70,7 +70,7 @@ func TestErasureCreateFile(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Test %d: failed to create test setup: %v", i, err)
 		}
-		storage, err := NewErasureStorage(setup.disks, test.dataBlocks, test.onDisks-test.dataBlocks)
+		storage, err := NewErasureStorage(setup.disks, test.dataBlocks, test.onDisks-test.dataBlocks, test.blocksize)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create ErasureStorage: %v", i, err)
@@ -125,7 +125,7 @@ func benchmarkErasureWrite(data, parity, dataDown, parityDown int, size int64, b
 		b.Fatalf("failed to create test setup: %v", err)
 	}
 	defer setup.Remove()
-	storage, err := NewErasureStorage(setup.disks, data, parity)
+	storage, err := NewErasureStorage(setup.disks, data, parity, blockSizeV1)
 	if err != nil {
 		b.Fatalf("failed to create ErasureStorage: %v", err)
 	}
@@ -70,68 +70,71 @@ func (s ErasureStorage) HealFile(staleDisks []StorageAPI, volume, path string, b
 	}
 	writeErrors := make([]error, len(s.disks))

+	// Read part file data on each disk
+	chunksize := ceilFrac(blocksize, int64(s.dataBlocks))
+	numBlocks := ceilFrac(size, blocksize)
+
+	readLen := chunksize * (numBlocks - 1)
+
+	lastChunkSize := chunksize
+	hasSmallerLastBlock := size%blocksize != 0
+	if hasSmallerLastBlock {
+		lastBlockLen := size % blocksize
+		lastChunkSize = ceilFrac(lastBlockLen, int64(s.dataBlocks))
+	}
+	readLen += lastChunkSize
+	var buffers [][]byte
+	buffers, _, err = s.readConcurrent(volume, path, 0, readLen, verifiers)
+	if err != nil {
+		return f, err
+	}
+
 	// Scan part files on disk, block-by-block reconstruct it and
 	// write to stale disks.
-	chunksize := getChunkSize(blocksize, s.dataBlocks)
 	blocks := make([][]byte, len(s.disks))
-	for i := range blocks {
-		blocks[i] = make([]byte, chunksize)
+
+	if numBlocks > 1 {
+		// Allocate once for all the equal length blocks. The
+		// last block may have a different length - allocation
+		// for this happens inside the for loop below.
+		for i := range blocks {
+			if len(buffers[i]) == 0 {
+				blocks[i] = make([]byte, chunksize)
+			}
+		}
 	}
-	var chunkOffset, blockOffset int64

-	// The for loop below is entered when size == 0 and
-	// blockOffset == 0 to allow for reconstructing empty files.
-	for ; blockOffset == 0 || blockOffset < size; blockOffset += blocksize {
-		// last iteration may have less than blocksize data
-		// left, so chunksize needs to be recomputed.
-		if size < blockOffset+blocksize {
-			chunksize = getChunkSize(size-blockOffset, s.dataBlocks)
+	var buffOffset int64
+	for blockNumber := int64(0); blockNumber < numBlocks; blockNumber++ {
+		if blockNumber == numBlocks-1 && lastChunkSize != chunksize {
 			for i := range blocks {
-				blocks[i] = blocks[i][:chunksize]
-			}
-		}
-		// read a chunk from each disk, until we have
-		// `s.dataBlocks` number of chunks set to non-nil in
-		// `blocks`
-		numReads := 0
-		for i, disk := range s.disks {
-			// skip reading from unavailable or stale disks
-			if disk == nil || staleDisks[i] != nil {
-				blocks[i] = blocks[i][:0] // mark shard as missing
-				continue
-			}
-			_, err = disk.ReadFile(volume, path, chunkOffset, blocks[i], verifiers[i])
-			if err != nil {
-				// LOG FIXME: add a conditional log
-				// for read failures, once per-disk
-				// per-function-invocation.
-				blocks[i] = blocks[i][:0] // mark shard as missing
-				continue
-			}
-			numReads++
-			if numReads == s.dataBlocks {
-				// we have enough data to reconstruct
-				// mark all other blocks as missing
-				for j := i + 1; j < len(blocks); j++ {
-					blocks[j] = blocks[j][:0] // mark shard as missing
+				if len(buffers[i]) == 0 {
+					blocks[i] = make([]byte, lastChunkSize)
 				}
-				break
 			}
 		}

-		// advance the chunk offset to prepare for next loop
-		// iteration
-		chunkOffset += chunksize
-
-		// reconstruct data - this computes all data and
-		// parity shards - but we skip this step if we are
-		// reconstructing an empty file.
-		if chunksize > 0 {
-			if err = s.ErasureDecodeDataAndParityBlocks(blocks); err != nil {
-				return f, err
+		for i := range blocks {
+			if len(buffers[i]) == 0 {
+				blocks[i] = blocks[i][0:0]
 			}
 		}

+		csize := chunksize
+		if blockNumber == numBlocks-1 {
+			csize = lastChunkSize
+		}
+		for i := range blocks {
+			if len(buffers[i]) != 0 {
+				blocks[i] = buffers[i][buffOffset : buffOffset+csize]
+			}
+		}
+		buffOffset += csize
+
+		if err = s.ErasureDecodeDataAndParityBlocks(blocks); err != nil {
+			return f, err
+		}
+
 		// write computed shards as chunks on file in each
 		// stale disk
 		writeSucceeded := false
@@ -74,7 +74,7 @@ func TestErasureHealFile(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Test %d: failed to setup XL environment: %v", i, err)
 		}
-		storage, err := NewErasureStorage(setup.disks, test.dataBlocks, test.disks-test.dataBlocks)
+		storage, err := NewErasureStorage(setup.disks, test.dataBlocks, test.disks-test.dataBlocks, test.blocksize)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create ErasureStorage: %v", i, err)
@@ -22,10 +22,74 @@ import (
 	"github.com/minio/minio/pkg/errors"
 )

-// ReadFile reads as much data as requested from the file under the given volume and path and writes the data to the provided writer.
-// The algorithm and the keys/checksums are used to verify the integrity of the given file. ReadFile will read data from the given offset
-// up to the given length. If parts of the file are corrupted ReadFile tries to reconstruct the data.
-func (s ErasureStorage) ReadFile(writer io.Writer, volume, path string, offset, length int64, totalLength int64, checksums [][]byte, algorithm BitrotAlgorithm, blocksize int64) (f ErasureFileInfo, err error) {
+type errIdx struct {
+	idx int
+	err error
+}
+
+func (s ErasureStorage) readConcurrent(volume, path string, offset, length int64,
+	verifiers []*BitrotVerifier) (buffers [][]byte, needsReconstruction bool,
+	err error) {
+
+	errChan := make(chan errIdx)
+	stageBuffers := make([][]byte, len(s.disks))
+	buffers = make([][]byte, len(s.disks))
+
+	readDisk := func(i int) {
+		stageBuffers[i] = make([]byte, length)
+		disk := s.disks[i]
+		if disk == OfflineDisk {
+			errChan <- errIdx{i, errors.Trace(errDiskNotFound)}
+			return
+		}
+		_, rerr := disk.ReadFile(volume, path, offset, stageBuffers[i], verifiers[i])
+		errChan <- errIdx{i, rerr}
+	}
+
+	var finishedCount, successCount, launchIndex int
+
+	for ; launchIndex < s.dataBlocks; launchIndex++ {
+		go readDisk(launchIndex)
+	}
+	for finishedCount < launchIndex {
+		select {
+		case errVal := <-errChan:
+			finishedCount++
+			if errVal.err != nil {
+				// TODO: meaningfully log the disk read error
+
+				// A disk failed to return data, so we
+				// request an additional disk if possible
+				if launchIndex < s.dataBlocks+s.parityBlocks {
+					needsReconstruction = true
+					// requiredBlocks++
+					go readDisk(launchIndex)
+					launchIndex++
+				}
+			} else {
+				successCount++
+				buffers[errVal.idx] = stageBuffers[errVal.idx]
+				stageBuffers[errVal.idx] = nil
+			}
+		}
+	}
+	if successCount != s.dataBlocks {
+		// Not enough disks returns data.
+		err = errors.Trace(errXLReadQuorum)
+	}
+	return
+}
+
+// ReadFile reads as much data as requested from the file under the
+// given volume and path and writes the data to the provided writer.
+// The algorithm and the keys/checksums are used to verify the
+// integrity of the given file. ReadFile will read data from the given
+// offset up to the given length. If parts of the file are corrupted
+// ReadFile tries to reconstruct the data.
+func (s ErasureStorage) ReadFile(writer io.Writer, volume, path string, offset,
+	length, totalLength int64, checksums [][]byte, algorithm BitrotAlgorithm,
+	blocksize int64) (f ErasureFileInfo, err error) {
+
 	if offset < 0 || length < 0 {
 		return f, errors.Trace(errUnexpected)
 	}
@@ -44,117 +108,122 @@ func (s ErasureStorage) ReadFile(writer io.Writer, volume, path string, offset,
 		}
 		verifiers[i] = NewBitrotVerifier(algorithm, checksums[i])
 	}
-	errChans := make([]chan error, len(s.disks))
-	for i := range errChans {
-		errChans[i] = make(chan error, 1)
-	}
-	lastBlock := totalLength / blocksize
-	startOffset := offset % blocksize
-	chunksize := getChunkSize(blocksize, s.dataBlocks)

+	chunksize := ceilFrac(blocksize, int64(s.dataBlocks))
+
+	// We read all whole-blocks of erasure coded data containing
+	// the requested data range.
+	//
+	// The start index of the erasure coded block containing the
+	// `offset` byte of data is:
+	partDataStartIndex := (offset / blocksize) * chunksize
+	// The start index of the erasure coded block containing the
+	// (last) byte of data at the index `offset + length - 1` is:
+	blockStartIndex := ((offset + length - 1) / blocksize) * chunksize
+	// However, we need the end index of the e.c. block containing
+	// the last byte - we need to check if that block is the last
+	// block in the part (in that case, it may be have a different
+	// chunk size)
+	isLastBlock := (totalLength-1)/blocksize == (offset+length-1)/blocksize
+	var partDataEndIndex int64
+	if isLastBlock {
+		lastBlockChunkSize := chunksize
+		if totalLength%blocksize != 0 {
+			lastBlockChunkSize = ceilFrac(totalLength%blocksize, int64(s.dataBlocks))
+		}
+		partDataEndIndex = blockStartIndex + lastBlockChunkSize - 1
+	} else {
+		partDataEndIndex = blockStartIndex + chunksize - 1
+	}
+
+	// Thus, the length of data to be read from the part file(s) is:
+	partDataLength := partDataEndIndex - partDataStartIndex + 1
+	// The calculation above does not apply when length == 0:
+	if length == 0 {
+		partDataLength = 0
+	}
+
+	var buffers [][]byte
+	var needsReconstruction bool
+	buffers, needsReconstruction, err = s.readConcurrent(volume, path,
+		partDataStartIndex, partDataLength, verifiers)
+	if err != nil {
+		// Could not read enough disks.
+		return
+	}
+
+	numChunks := ceilFrac(partDataLength, chunksize)
 	blocks := make([][]byte, len(s.disks))
-	for i := range blocks {
-		blocks[i] = make([]byte, chunksize)
-	}
-	for off := offset / blocksize; length > 0; off++ {
-		blockOffset := off * chunksize

-		if currentBlock := (offset + f.Size) / blocksize; currentBlock == lastBlock {
-			blocksize = totalLength % blocksize
-			chunksize = getChunkSize(blocksize, s.dataBlocks)
-			for i := range blocks {
-				blocks[i] = blocks[i][:chunksize]
+	if needsReconstruction && numChunks > 1 {
+		// Allocate once for all the equal length blocks. The
+		// last block may have a different length - allocation
+		// for this happens inside the for loop below.
+		for i := range blocks {
+			if len(buffers[i]) == 0 {
+				blocks[i] = make([]byte, chunksize)
 			}
 		}
-		err = s.readConcurrent(volume, path, blockOffset, blocks, verifiers, errChans)
-		if err != nil {
-			return f, errors.Trace(errXLReadQuorum)
+	}
+
+	var buffOffset int64
+	for chunkNumber := int64(0); chunkNumber < numChunks; chunkNumber++ {
+		if chunkNumber == numChunks-1 && partDataLength%chunksize != 0 {
+			chunksize = partDataLength % chunksize
+			// We allocate again as the last chunk has a
+			// different size.
+			for i := range blocks {
+				if len(buffers[i]) == 0 {
+					blocks[i] = make([]byte, chunksize)
+				}
+			}
 		}

-		writeLength := blocksize - startOffset
-		if length < writeLength {
-			writeLength = length
+		for i := range blocks {
+			if len(buffers[i]) == 0 {
+				blocks[i] = blocks[i][0:0]
+			}
 		}
-		n, err := writeDataBlocks(writer, blocks, s.dataBlocks, startOffset, writeLength)
+
+		for i := range blocks {
+			if len(buffers[i]) != 0 {
+				blocks[i] = buffers[i][buffOffset : buffOffset+chunksize]
+			}
+		}
+		buffOffset += chunksize
+
+		if needsReconstruction {
+			if err = s.ErasureDecodeDataBlocks(blocks); err != nil {
+				return f, errors.Trace(err)
+			}
+		}
+
+		var writeStart int64
+		if chunkNumber == 0 {
+			writeStart = offset % blocksize
+		}
+
+		writeLength := blocksize - writeStart
+		if chunkNumber == numChunks-1 {
+			lastBlockLength := (offset + length) % blocksize
+			if lastBlockLength != 0 {
+				writeLength = lastBlockLength - writeStart
+			}
+		}
+		n, err := writeDataBlocks(writer, blocks, s.dataBlocks, writeStart, writeLength)
 		if err != nil {
 			return f, err
 		}
-		startOffset = 0
+
 		f.Size += n
-		length -= n
 	}

 	f.Algorithm = algorithm
 	for i, disk := range s.disks {
-		if disk == OfflineDisk {
+		if disk == OfflineDisk || buffers[i] == nil {
 			continue
 		}
 		f.Checksums[i] = verifiers[i].Sum(nil)
 	}
 	return f, nil
 }
-
-func erasureCountMissingBlocks(blocks [][]byte, limit int) int {
-	missing := 0
-	for i := range blocks[:limit] {
-		if len(blocks[i]) == 0 {
-			missing++
-		}
-	}
-	return missing
-}
-
-// readConcurrent reads all requested data concurrently from the disks into blocks. It returns an error if
-// too many disks failed while reading.
-func (s *ErasureStorage) readConcurrent(volume, path string, offset int64, blocks [][]byte, verifiers []*BitrotVerifier, errChans []chan error) (err error) {
-	errs := make([]error, len(s.disks))
-
-	erasureReadBlocksConcurrent(s.disks[:s.dataBlocks], volume, path, offset, blocks[:s.dataBlocks], verifiers[:s.dataBlocks], errs[:s.dataBlocks], errChans[:s.dataBlocks])
-	missingDataBlocks := erasureCountMissingBlocks(blocks, s.dataBlocks)
-	mustReconstruct := missingDataBlocks > 0
-	if mustReconstruct {
-		requiredReads := s.dataBlocks + missingDataBlocks
-		if requiredReads > s.dataBlocks+s.parityBlocks {
-			return errXLReadQuorum
-		}
-		erasureReadBlocksConcurrent(s.disks[s.dataBlocks:requiredReads], volume, path, offset, blocks[s.dataBlocks:requiredReads], verifiers[s.dataBlocks:requiredReads], errs[s.dataBlocks:requiredReads], errChans[s.dataBlocks:requiredReads])
-		if erasureCountMissingBlocks(blocks, requiredReads) > 0 {
-			erasureReadBlocksConcurrent(s.disks[requiredReads:], volume, path, offset, blocks[requiredReads:], verifiers[requiredReads:], errs[requiredReads:], errChans[requiredReads:])
-		}
-	}
-	if err = reduceReadQuorumErrs(errs, []error{}, s.dataBlocks); err != nil {
-		return err
-	}
-	if mustReconstruct {
-		if err = s.ErasureDecodeDataBlocks(blocks); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// erasureReadBlocksConcurrent reads all data from each disk to each data block in parallel.
-// Therefore disks, blocks, verifiers errors and locks must have the same length.
-func erasureReadBlocksConcurrent(disks []StorageAPI, volume, path string, offset int64, blocks [][]byte, verifiers []*BitrotVerifier, errors []error, errChans []chan error) {
-	for i := range errChans {
-		go erasureReadFromFile(disks[i], volume, path, offset, blocks[i], verifiers[i], errChans[i])
-	}
-	for i := range errChans {
-		errors[i] = <-errChans[i] // blocks until the go routine 'i' is done - no data race
-		if errors[i] != nil {
-			disks[i] = OfflineDisk
-			blocks[i] = blocks[i][:0] // mark shard as missing
-		}
-	}
-}
-
-// erasureReadFromFile reads data from the disk to buffer in parallel.
-// It sends the returned error through the error channel.
-func erasureReadFromFile(disk StorageAPI, volume, path string, offset int64, buffer []byte, verifier *BitrotVerifier, errChan chan<- error) {
-	if disk == OfflineDisk {
-		errChan <- errors.Trace(errDiskNotFound)
-		return
-	}
-	_, err := disk.ReadFile(volume, path, offset, buffer, verifier)
-	errChan <- err
-}
@@ -86,7 +86,7 @@ func TestErasureReadFile(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Test %d: failed to create test setup: %v", i, err)
 		}
-		storage, err := NewErasureStorage(setup.disks, test.dataBlocks, test.onDisks-test.dataBlocks)
+		storage, err := NewErasureStorage(setup.disks, test.dataBlocks, test.onDisks-test.dataBlocks, test.blocksize)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create ErasureStorage: %v", i, err)
@@ -174,7 +174,7 @@ func TestErasureReadFileRandomOffsetLength(t *testing.T) {
 	}
 	defer setup.Remove()

-	storage, err := NewErasureStorage(setup.disks, dataBlocks, parityBlocks)
+	storage, err := NewErasureStorage(setup.disks, dataBlocks, parityBlocks, blockSize)
 	if err != nil {
 		t.Fatalf("failed to create ErasureStorage: %v", err)
 	}
@@ -231,7 +231,7 @@ func benchmarkErasureRead(data, parity, dataDown, parityDown int, size int64, b
 		b.Fatalf("failed to create test setup: %v", err)
 	}
 	defer setup.Remove()
-	storage, err := NewErasureStorage(setup.disks, data, parity)
+	storage, err := NewErasureStorage(setup.disks, data, parity, blockSizeV1)
 	if err != nil {
 		b.Fatalf("failed to create ErasureStorage: %v", err)
 	}
@@ -98,11 +98,3 @@ func writeDataBlocks(dst io.Writer, enBlocks [][]byte, dataBlocks int, offset in
 	// Success.
 	return totalWritten, nil
 }
-
-// chunkSize is roughly BlockSize/DataBlocks.
-// chunkSize is calculated such that chunkSize*DataBlocks accommodates BlockSize bytes.
-// So chunkSize*DataBlocks can be slightly larger than BlockSize if BlockSize is not divisible by
-// DataBlocks. The extra space will have 0-padding.
-func getChunkSize(blockSize int64, dataBlocks int) int64 {
-	return (blockSize + int64(dataBlocks) - 1) / int64(dataBlocks)
-}
@@ -1,53 +0,0 @@
-/*
- * Minio Cloud Storage, (C) 2016 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package cmd
-
-import "testing"
-
-// Tests validate the output of getChunkSize.
-func TestGetChunkSize(t *testing.T) {
-	// Refer to comments on getChunkSize() for details.
-	testCases := []struct {
-		blockSize  int64
-		dataBlocks int
-		// expected result.
-		expectedChunkSize int64
-	}{
-		{
-			10,
-			10,
-			1,
-		},
-		{
-			10,
-			11,
-			1,
-		},
-		{
-			10,
-			9,
-			2,
-		},
-	}
-	// Verify getChunkSize() for the test cases.
-	for i, testCase := range testCases {
-		got := getChunkSize(testCase.blockSize, testCase.dataBlocks)
-		if testCase.expectedChunkSize != got {
-			t.Errorf("Test %d : expected=%d got=%d", i+1, testCase.expectedChunkSize, got)
-		}
-	}
-}
@@ -44,8 +44,9 @@ type ErasureStorage struct {

 // NewErasureStorage creates a new ErasureStorage. The storage erasure codes and protects all data written to
 // the disks.
-func NewErasureStorage(disks []StorageAPI, dataBlocks, parityBlocks int) (s ErasureStorage, err error) {
-	erasure, err := reedsolomon.New(dataBlocks, parityBlocks)
+func NewErasureStorage(disks []StorageAPI, dataBlocks, parityBlocks int, blockSize int64) (s ErasureStorage, err error) {
+	shardsize := (int(blockSize) + dataBlocks - 1) / dataBlocks
+	erasure, err := reedsolomon.New(dataBlocks, parityBlocks, reedsolomon.WithAutoGoroutines(shardsize))
 	if err != nil {
 		return s, errors.Tracef("failed to create erasure coding: %v", err)
 	}
@@ -52,7 +52,7 @@ func TestErasureDecode(t *testing.T) {
 		copy(buffer, data)

 		disks := make([]StorageAPI, test.dataBlocks+test.parityBlocks)
-		storage, err := NewErasureStorage(disks, test.dataBlocks, test.parityBlocks)
+		storage, err := NewErasureStorage(disks, test.dataBlocks, test.parityBlocks, blockSizeV1)
 		if err != nil {
 			t.Fatalf("Test %d: failed to create erasure storage: %v", i, err)
 		}
@@ -365,15 +365,8 @@ func loadNotificationConfig(bucket string, objAPI ObjectLayer) (*notificationCon
 	// Construct the notification config path.
 	ncPath := path.Join(bucketConfigPrefix, bucket, bucketNotificationConfig)

-	// Acquire a write lock on notification config before modifying.
-	objLock := globalNSMutex.NewNSLock(minioMetaBucket, ncPath)
-	if err := objLock.GetRLock(globalOperationTimeout); err != nil {
-		return nil, err
-	}
-	defer objLock.RUnlock()
-
 	var buffer bytes.Buffer
-	err := objAPI.GetObject(minioMetaBucket, ncPath, 0, -1, &buffer) // Read everything.
+	err := objAPI.GetObject(minioMetaBucket, ncPath, 0, -1, &buffer, "") // Read everything.
 	if err != nil {
 		// 'notification.xml' not found return
 		// 'errNoSuchNotifications'.  This is default when no
@@ -416,15 +409,8 @@ func loadListenerConfig(bucket string, objAPI ObjectLayer) ([]listenerConfig, er
 	// Construct the notification config path.
 	lcPath := path.Join(bucketConfigPrefix, bucket, bucketListenerConfig)

-	// Acquire a write lock on notification config before modifying.
-	objLock := globalNSMutex.NewNSLock(minioMetaBucket, lcPath)
-	if err := objLock.GetRLock(globalOperationTimeout); err != nil {
-		return nil, err
-	}
-	defer objLock.RUnlock()
-
 	var buffer bytes.Buffer
-	err := objAPI.GetObject(minioMetaBucket, lcPath, 0, -1, &buffer)
+	err := objAPI.GetObject(minioMetaBucket, lcPath, 0, -1, &buffer, "")
 	if err != nil {
 		// 'listener.json' not found return
 		// 'errNoSuchNotifications'.  This is default when no
@@ -463,12 +449,6 @@ func persistNotificationConfig(bucket string, ncfg *notificationConfig, obj Obje

 	// build path
 	ncPath := path.Join(bucketConfigPrefix, bucket, bucketNotificationConfig)
-	// Acquire a write lock on notification config before modifying.
-	objLock := globalNSMutex.NewNSLock(minioMetaBucket, ncPath)
-	if err = objLock.GetLock(globalOperationTimeout); err != nil {
-		return err
-	}
-	defer objLock.Unlock()

 	// write object to path
 	hashReader, err := hash.NewReader(bytes.NewReader(buf), int64(len(buf)), "", getSHA256Hash(buf))
@@ -494,12 +474,6 @@ func persistListenerConfig(bucket string, lcfg []listenerConfig, obj ObjectLayer

 	// build path
 	lcPath := path.Join(bucketConfigPrefix, bucket, bucketListenerConfig)
-	// Acquire a write lock on notification config before modifying.
-	objLock := globalNSMutex.NewNSLock(minioMetaBucket, lcPath)
-	if err = objLock.GetLock(globalOperationTimeout); err != nil {
-		return err
-	}
-	defer objLock.Unlock()

 	// write object to path
 	hashReader, err := hash.NewReader(bytes.NewReader(buf), int64(len(buf)), "", getSHA256Hash(buf))
@@ -526,12 +500,6 @@ func removeNotificationConfig(bucket string, objAPI ObjectLayer) error {

 	ncPath := path.Join(bucketConfigPrefix, bucket, bucketNotificationConfig)

-	// Acquire a write lock on notification config before modifying.
-	objLock := globalNSMutex.NewNSLock(minioMetaBucket, ncPath)
-	if err := objLock.GetLock(globalOperationTimeout); err != nil {
-		return err
-	}
-	defer objLock.Unlock()
 	return objAPI.DeleteObject(minioMetaBucket, ncPath)
 }

@@ -540,12 +508,6 @@ func removeListenerConfig(bucket string, objAPI ObjectLayer) error {
 	// make the path
 	lcPath := path.Join(bucketConfigPrefix, bucket, bucketListenerConfig)

-	// Acquire a write lock on notification config before modifying.
-	objLock := globalNSMutex.NewNSLock(minioMetaBucket, lcPath)
-	if err := objLock.GetLock(globalOperationTimeout); err != nil {
-		return err
-	}
-	defer objLock.Unlock()
 	return objAPI.DeleteObject(minioMetaBucket, lcPath)
 }

@@ -37,7 +37,7 @@ func TestInitEventNotifierFaultyDisks(t *testing.T) {
 	// remove the root directory after the test ends.
 	defer os.RemoveAll(rootPath)

-	disks, err := getRandomDisks(4)
+	disks, err := getRandomDisks(16)
 	if err != nil {
 		t.Fatal("Unable to create directories for FS backend. ", err)
 	}
@@ -64,12 +64,13 @@ func TestInitEventNotifierFaultyDisks(t *testing.T) {
 	notificationXML += "</NotificationConfiguration>"
 	size := int64(len([]byte(notificationXML)))
 	reader := bytes.NewReader([]byte(notificationXML))
-	if _, err := xl.PutObject(minioMetaBucket, bucketConfigPrefix+"/"+bucketName+"/"+bucketNotificationConfig, mustGetHashReader(t, reader, size, "", ""), nil); err != nil {
+	bucketConfigPath := bucketConfigPrefix + "/" + bucketName + "/" + bucketNotificationConfig
+	if _, err := xl.PutObject(minioMetaBucket, bucketConfigPath, mustGetHashReader(t, reader, size, "", ""), nil); err != nil {
 		t.Fatal("Unexpected error:", err)
 	}

 	for i, d := range xl.storageDisks {
-		xl.storageDisks[i] = newNaughtyDisk(d.(*retryStorage), nil, errFaultyDisk)
+		xl.storageDisks[i] = newNaughtyDisk(d, nil, errFaultyDisk)
 	}
 	// Test initEventNotifier() with faulty disks
 	for i := 1; i <= 3; i++ {
@@ -1,86 +0,0 @@
-/*
- * Minio Cloud Storage, (C) 2017 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package cmd
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/Sirupsen/logrus"
-)
-
-// FileLogger - file logger which logs to a file.
-type FileLogger struct {
-	BaseLogTarget
-	Filename string `json:"filename"`
-	file     *os.File
-}
-
-// Fire - log entry handler.
-func (logger FileLogger) Fire(entry *logrus.Entry) (err error) {
-	if !logger.Enable {
-		return nil
-	}
-
-	msgBytes, err := logger.formatter.Format(entry)
-	if err != nil {
-		return err
-	}
-
-	if _, err = logger.file.Write(msgBytes); err != nil {
-		return err
-	}
-
-	err = logger.file.Sync()
-	return err
-}
-
-// String - represents ConsoleLogger as string.
-func (logger FileLogger) String() string {
-	enableStr := "disabled"
-	if logger.Enable {
-		enableStr = "enabled"
-	}
-
-	return fmt.Sprintf("file:%s:%s", enableStr, logger.Filename)
-}
-
-// NewFileLogger - creates new file logger object.
-func NewFileLogger(filename string) (logger FileLogger) {
-	logger.Enable = true
-	logger.formatter = new(logrus.JSONFormatter)
-	logger.Filename = filename
-
-	return logger
-}
-
-// InitFileLogger - initializes file logger.
-func InitFileLogger(logger *FileLogger) (err error) {
-	if !logger.Enable {
-		return err
-	}
-
-	if logger.formatter == nil {
-		logger.formatter = new(logrus.JSONFormatter)
-	}
-
-	if logger.file == nil {
-		logger.file, err = os.OpenFile(logger.Filename, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0664)
-	}
-
-	return err
-}
@@ -1,906 +0,0 @@
-/*
- * Minio Cloud Storage, (C) 2016 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package cmd
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"reflect"
-	"sync"
-
-	errors2 "github.com/minio/minio/pkg/errors"
-	"github.com/minio/minio/pkg/lock"
-)
-
-// fsFormat - structure holding 'fs' format.
-type fsFormat struct {
-	Version string `json:"version"`
-}
-
-// FS format version strings.
-const (
-	// Represents the current backend disk structure
-	// version under `.minio.sys` and actual data namespace.
-
-	// formatConfigV1.fsFormat.Version
-	fsFormatBackendV1 = "1"
-)
-
-// xlFormat - structure holding 'xl' format.
-type xlFormat struct {
-	Version string `json:"version"` // Version of 'xl' format.
-	Disk    string `json:"disk"`    // Disk field carries assigned disk uuid.
-	// JBOD field carries the input disk order generated the first
-	// time when fresh disks were supplied.
-	JBOD []string `json:"jbod"`
-}
-
-// XL format version strings.
-const (
-	// Represents the current backend disk structure
-	// version under `.minio.sys` and actual data namespace.
-
-	// formatConfigV1.xlFormat.Version
-	xlFormatBackendV1 = "1"
-)
-
-// formatConfigV1 - structure holds format config version '1'.
-type formatConfigV1 struct {
-	Version string `json:"version"` // Version of the format config.
-	// Format indicates the backend format type, supports two values 'xl' and 'fs'.
-	Format string    `json:"format"`
-	FS     *fsFormat `json:"fs,omitempty"` // FS field holds fs format.
-	XL     *xlFormat `json:"xl,omitempty"` // XL field holds xl format.
-}
-
-// Format json file.
-const (
-	// Format config file carries backend format specific details.
-	formatConfigFile = "format.json"
-
-	// Format config tmp file carries backend format.
-	formatConfigFileTmp = "format.json.tmp"
-)
-
-// `format.json` version value.
-const (
-	// formatConfigV1.Version represents the version string
-	// of the current structure and its fields in `format.json`.
-	formatFileV1 = "1"
-
-	// Future `format.json` structure changes should have
-	// its own version and should be subsequently listed here.
-)
-
-// Constitutes `format.json` backend name.
-const (
-	// Represents FS backend.
-	formatBackendFS = "fs"
-
-	// Represents XL backend.
-	formatBackendXL = "xl"
-)
-
-// CheckFS if the format is FS and is valid with right values
-// returns appropriate errors otherwise.
-func (f *formatConfigV1) CheckFS() error {
-	// Validate if format config version is v1.
-	if f.Version != formatFileV1 {
-		return fmt.Errorf("Unknown format file version '%s'", f.Version)
-	}
-
-	// Validate if we have the expected format.
-	if f.Format != formatBackendFS {
-		return fmt.Errorf("FS backend format required. Found '%s'", f.Format)
-	}
-
-	// Check if format is currently supported.
-	if f.FS.Version != fsFormatBackendV1 {
-		return fmt.Errorf("Unknown backend FS format version '%s'", f.FS.Version)
-	}
-
-	// Success.
-	return nil
-}
-
-// LoadFormat - loads format config v1, returns `errUnformattedDisk`
-// if reading format.json fails with io.EOF.
-func (f *formatConfigV1) LoadFormat(lk *lock.LockedFile) error {
-	_, err := f.ReadFrom(lk)
-	if errors2.Cause(err) == io.EOF {
-		// No data on disk `format.json` still empty
-		// treat it as unformatted disk.
-		return errors2.Trace(errUnformattedDisk)
-	}
-	return err
-}
-
-func (f *formatConfigV1) WriteTo(lk *lock.LockedFile) (n int64, err error) {
-	// Serialize to prepare to write to disk.
-	var fbytes []byte
-	fbytes, err = json.Marshal(f)
-	if err != nil {
-		return 0, errors2.Trace(err)
-	}
-	if err = lk.Truncate(0); err != nil {
-		return 0, errors2.Trace(err)
-	}
-	_, err = lk.Write(fbytes)
-	if err != nil {
-		return 0, errors2.Trace(err)
-	}
-	return int64(len(fbytes)), nil
-}
-
-func (f *formatConfigV1) ReadFrom(lk *lock.LockedFile) (n int64, err error) {
-	var fbytes []byte
-	fi, err := lk.Stat()
-	if err != nil {
-		return 0, errors2.Trace(err)
-	}
-	fbytes, err = ioutil.ReadAll(io.NewSectionReader(lk, 0, fi.Size()))
-	if err != nil {
-		return 0, errors2.Trace(err)
-	}
-	if len(fbytes) == 0 {
-		return 0, errors2.Trace(io.EOF)
-	}
-	// Decode `format.json`.
-	if err = json.Unmarshal(fbytes, f); err != nil {
-		return 0, errors2.Trace(err)
-	}
-	return int64(len(fbytes)), nil
-}
-
-func newFSFormat() (format *formatConfigV1) {
-	return newFSFormatV1()
-}
-
-// newFSFormatV1 - initializes new formatConfigV1 with FS format info.
-func newFSFormatV1() (format *formatConfigV1) {
-	return &formatConfigV1{
-		Version: formatFileV1,
-		Format:  formatBackendFS,
-		FS: &fsFormat{
-			Version: fsFormatBackendV1,
-		},
-	}
-}
-
-/*
-
-All disks online
-----------------
- All Unformatted - format all and return success.
- Some Unformatted - format all and return success.
- Any JBOD inconsistent - return failure // Requires deep inspection, phase2.
- Some are corrupt (missing format.json) - return failure  // Requires deep inspection, phase2.
- Any unrecognized disks - return failure
-
-Some disks are offline and we have quorum.
-----------------
- Some unformatted - no heal, return success.
- Any JBOD inconsistent - return failure // Requires deep inspection, phase2.
- Some are corrupt (missing format.json) - return failure  // Requires deep inspection, phase2.
- Any unrecognized disks - return failure
-
-No read quorum
-----------------
-failure for all cases.
-
-// Pseudo code for managing `format.json`.
-
-// Generic checks.
-if (no quorum) return error
-if (any disk is corrupt) return error // phase2
-if (jbod inconsistent) return error // phase2
-if (disks not recognized) // Always error.
-
-// Specific checks.
-if (all disks online)
-  if (all disks return format.json)
-     if (jbod consistent)
-        if (all disks recognized)
-          return
-  else
-     if (all disks return format.json not found)
-        (initialize format)
-        return
-     else (some disks return format.json not found)
-        (heal format)
-        return
-     fi
-   fi
-else // No healing at this point forward, some disks are offline or dead.
-   if (some disks return format.json not found)
-      if (with force)
-         // Offline disks are marked as dead.
-         (heal format) // Offline disks should be marked as dead.
-         return success
-      else (without force)
-         // --force is necessary to heal few drives, because some drives
-         // are offline. Offline disks will be marked as dead.
-         return error
-      fi
-fi
-*/
-
-// error returned when some disks are offline.
-var errSomeDiskOffline = errors.New("some disks are offline")
-
-// errDiskOrderMismatch - returned when disk UUID is not in consistent JBOD order.
-var errDiskOrderMismatch = errors.New("disk order mismatch")
-
-// formatErrsSummary - summarizes errors into different classes
-func formatErrsSummary(errs []error) (formatCount, unformattedDiskCount,
-	diskNotFoundCount, corruptedFormatCount, otherErrCount int) {
-
-	for _, err := range errs {
-		switch err {
-		case errDiskNotFound:
-			diskNotFoundCount++
-		case errUnformattedDisk:
-			unformattedDiskCount++
-		case errCorruptedFormat:
-			corruptedFormatCount++
-		case nil:
-			// implies that format is not nil
-			formatCount++
-		default:
-			otherErrCount++
-		}
-	}
-	return
-}
-
-// loadAllFormats - load all format config from all input disks in parallel.
-func loadAllFormats(bootstrapDisks []StorageAPI) ([]*formatConfigV1, []error) {
-	// Initialize sync waitgroup.
-	var wg = &sync.WaitGroup{}
-
-	// Initialize list of errors.
-	var sErrs = make([]error, len(bootstrapDisks))
-
-	// Initialize format configs.
-	var formatConfigs = make([]*formatConfigV1, len(bootstrapDisks))
-
-	// Make a volume entry on all underlying storage disks.
-	for index, disk := range bootstrapDisks {
-		if disk == nil {
-			sErrs[index] = errDiskNotFound
-			continue
-		}
-		wg.Add(1)
-		// Make a volume inside a go-routine.
-		go func(index int, disk StorageAPI) {
-			defer wg.Done()
-			formatConfig, lErr := loadFormat(disk)
-			if lErr != nil {
-				sErrs[index] = lErr
-				return
-			}
-			formatConfigs[index] = formatConfig
-		}(index, disk)
-	}
-
-	// Wait for all make vol to finish.
-	wg.Wait()
-
-	for _, err := range sErrs {
-		if err != nil {
-			// Return all formats and errors.
-			return formatConfigs, sErrs
-		}
-	}
-	// Return all formats and nil
-	return formatConfigs, sErrs
-}
-
-// genericFormatCheckXL - validates and returns error.
-// if (no quorum) return error
-// if (any disk is corrupt) return error // phase2
-// if (jbod inconsistent) return error // phase2
-// if (disks not recognized) // Always error.
-func genericFormatCheckXL(formatConfigs []*formatConfigV1, sErrs []error) (err error) {
-	// Calculate the errors.
-	var (
-		errCorruptFormatCount = 0
-		errCount              = 0
-	)
-
-	// Through all errors calculate the actual errors.
-	for _, lErr := range sErrs {
-		if lErr == nil {
-			continue
-		}
-		// These errors are good conditions, means disk is online.
-		if lErr == errUnformattedDisk || lErr == errVolumeNotFound {
-			continue
-		}
-		if lErr == errCorruptedFormat {
-			errCorruptFormatCount++
-		} else {
-			errCount++
-		}
-	}
-
-	// Calculate read quorum.
-	readQuorum := len(formatConfigs) / 2
-
-	// Validate the err count under read quorum.
-	if errCount > len(formatConfigs)-readQuorum {
-		return errXLReadQuorum
-	}
-
-	// Check if number of corrupted format under read quorum
-	if errCorruptFormatCount > len(formatConfigs)-readQuorum {
-		return errCorruptedFormat
-	}
-
-	// Validates if format and JBOD are consistent across all disks.
-	if err = checkFormatXL(formatConfigs); err != nil {
-		return err
-	}
-
-	// Success..
-	return nil
-}
-
-// isSavedUUIDInOrder - validates if disk uuid is present and valid in all
-// available format config JBOD. This function also validates if the disk UUID
-// is always available on all JBOD under the same order.
-func isSavedUUIDInOrder(uuid string, formatConfigs []*formatConfigV1) bool {
-	var orderIndexes []int
-	// Validate each for format.json for relevant uuid.
-	for _, formatConfig := range formatConfigs {
-		if formatConfig == nil {
-			continue
-		}
-		// Validate if UUID is present in JBOD.
-		uuidIndex := findDiskIndex(uuid, formatConfig.XL.JBOD)
-		if uuidIndex == -1 {
-			// UUID not found.
-			errorIf(errDiskNotFound, "Disk %s not found in JBOD list", uuid)
-			return false
-		}
-		// Save the position of UUID present in JBOD.
-		orderIndexes = append(orderIndexes, uuidIndex+1)
-	}
-	// Once uuid is found, verify if the uuid
-	// present in same order across all format configs.
-	prevOrderIndex := orderIndexes[0]
-	for _, orderIndex := range orderIndexes {
-		if prevOrderIndex != orderIndex {
-			errorIf(errDiskOrderMismatch, "Disk %s is in wrong order wanted %d, saw %d ", uuid, prevOrderIndex, orderIndex)
-			return false
-		}
-	}
-	// Returns success, when we have verified if uuid
-	// is consistent and valid across all format configs.
-	return true
-}
-
-// checkDisksConsistency - checks if all disks are consistent with all JBOD entries on all disks.
-func checkDisksConsistency(formatConfigs []*formatConfigV1) error {
-	var disks = make([]string, len(formatConfigs))
-	// Collect currently available disk uuids.
-	for index, formatConfig := range formatConfigs {
-		if formatConfig == nil {
-			disks[index] = ""
-			continue
-		}
-		disks[index] = formatConfig.XL.Disk
-	}
-	// Validate collected uuids and verify JBOD.
-	for _, uuid := range disks {
-		if uuid == "" {
-			continue
-		}
-		// Is uuid present on all JBOD ?.
-		if !isSavedUUIDInOrder(uuid, formatConfigs) {
-			return fmt.Errorf("%s disk not found in JBOD", uuid)
-		}
-	}
-	return nil
-}
-
-// checkJBODConsistency - validate xl jbod order if they are consistent.
-func checkJBODConsistency(formatConfigs []*formatConfigV1) error {
-	var sentinelJBOD []string
-	// Extract first valid JBOD.
-	for _, format := range formatConfigs {
-		if format == nil {
-			continue
-		}
-		sentinelJBOD = format.XL.JBOD
-		break
-	}
-	for _, format := range formatConfigs {
-		if format == nil {
-			continue
-		}
-		currentJBOD := format.XL.JBOD
-		if !reflect.DeepEqual(sentinelJBOD, currentJBOD) {
-			return errors.New("Inconsistent JBOD found")
-		}
-	}
-	return nil
-}
-
-// findDiskIndex returns position of disk in JBOD.
-func findDiskIndex(disk string, jbod []string) int {
-	for index, uuid := range jbod {
-		if uuid == disk {
-			return index
-		}
-	}
-	return -1
-}
-
-// reorderDisks - reorder disks in JBOD order, and return reference
-// format-config. If assignUUIDs is true, it assigns UUIDs to disks
-// with missing format configurations in the reference configuration.
-func reorderDisks(bootstrapDisks []StorageAPI,
-	formatConfigs []*formatConfigV1, assignUUIDs bool) (*formatConfigV1,
-	[]StorageAPI, error) {
-
-	// Pick first non-nil format-cfg as reference
-	var refCfg *formatConfigV1
-	for _, formatConfig := range formatConfigs {
-		if formatConfig != nil {
-			refCfg = formatConfig
-			break
-		}
-	}
-	if refCfg == nil {
-		return nil, nil, fmt.Errorf("could not find any valid config")
-	}
-	refJBOD := refCfg.XL.JBOD
-
-	// construct reordered disk slice
-	var newDisks = make([]StorageAPI, len(bootstrapDisks))
-	for fIndex, format := range formatConfigs {
-		if format == nil {
-			continue
-		}
-		jIndex := findDiskIndex(format.XL.Disk, refJBOD)
-		if jIndex == -1 {
-			return nil, nil, errors.New("Unrecognized uuid " + format.XL.Disk + " found")
-		}
-		newDisks[jIndex] = bootstrapDisks[fIndex]
-	}
-
-	if assignUUIDs {
-		// Based on orderedDisks generate new UUIDs in the ref. config
-		// for disks without format-configs.
-		for index, disk := range newDisks {
-			if disk == nil {
-				refCfg.XL.JBOD[index] = mustGetUUID()
-			}
-		}
-	}
-
-	return refCfg, newDisks, nil
-}
-
-// loadFormat - loads format.json from disk.
-func loadFormat(disk StorageAPI) (format *formatConfigV1, err error) {
-	buf, err := disk.ReadAll(minioMetaBucket, formatConfigFile)
-	if err != nil {
-		// 'file not found' and 'volume not found' as
-		// same. 'volume not found' usually means its a fresh disk.
-		if err == errFileNotFound || err == errVolumeNotFound {
-			var vols []VolInfo
-			vols, err = disk.ListVols()
-			if err != nil {
-				return nil, err
-			}
-			if len(vols) > 1 {
-				// 'format.json' not found, but we found user data.
-				return nil, errCorruptedFormat
-			}
-			// No other data found, its a fresh disk.
-			return nil, errUnformattedDisk
-		}
-		return nil, err
-	}
-
-	// Try to decode format json into formatConfigV1 struct.
-	format = &formatConfigV1{}
-	if err = json.Unmarshal(buf, format); err != nil {
-		return nil, err
-	}
-
-	// Success.
-	return format, nil
-}
-
-// collectNSaveNewFormatConfigs - creates new format configs based on
-// the reference config and saves it on all disks, this is to be
-// called from healFormatXL* functions.
-func collectNSaveNewFormatConfigs(referenceConfig *formatConfigV1,
-	orderedDisks []StorageAPI) error {
-
-	// Collect new format configs that need to be written.
-	var newFormatConfigs = make([]*formatConfigV1, len(orderedDisks))
-	for index := range orderedDisks {
-		// New configs are generated since we are going
-		// to re-populate across all disks.
-		config := &formatConfigV1{
-			Version: referenceConfig.Version,
-			Format:  referenceConfig.Format,
-			XL: &xlFormat{
-				Version: referenceConfig.XL.Version,
-				Disk:    referenceConfig.XL.JBOD[index],
-				JBOD:    referenceConfig.XL.JBOD,
-			},
-		}
-		newFormatConfigs[index] = config
-	}
-
-	// Initialize meta volume, if volume already exists ignores it.
-	if err := initMetaVolume(orderedDisks); err != nil {
-		return fmt.Errorf("Unable to initialize '.minio.sys' meta volume, %s", err)
-	}
-
-	// Save new `format.json` across all disks, in JBOD order.
-	return saveFormatXL(orderedDisks, newFormatConfigs)
-}
-
-// Heals any missing format.json on the drives. Returns error only for
-// unexpected errors as regular errors can be ignored since there
-// might be enough quorum to be operational.  Heals only fresh disks.
-func healFormatXLFreshDisks(storageDisks []StorageAPI,
-	formatConfigs []*formatConfigV1) error {
-
-	// Reorder the disks based on the JBOD order.
-	referenceConfig, orderedDisks, err := reorderDisks(storageDisks,
-		formatConfigs, true)
-	if err != nil {
-		return err
-	}
-
-	// Fill in the missing disk back from format configs.
-	// We need to make sure we have kept the previous order
-	// and allowed fresh disks to be arranged anywhere.
-	// Following block facilitates to put fresh disks.
-	for index, format := range formatConfigs {
-		// Format is missing so we go through ordered disks.
-		if format == nil {
-			// At this point when disk is missing the fresh disk
-			// in the stack get it back from storageDisks.
-			for oIndex, disk := range orderedDisks {
-				if disk == nil {
-					orderedDisks[oIndex] = storageDisks[index]
-					break
-				}
-			}
-		}
-	}
-
-	// apply new format config and save to all disks
-	return collectNSaveNewFormatConfigs(referenceConfig, orderedDisks)
-}
-
-// collectUnAssignedDisks - collect disks unassigned to orderedDisks
-// from storageDisks and return them.
-func collectUnAssignedDisks(storageDisks, orderedDisks []StorageAPI) (
-	uDisks []StorageAPI) {
-
-	// search for each disk from storageDisks in orderedDisks
-	for i := range storageDisks {
-		found := false
-		for j := range orderedDisks {
-			if storageDisks[i] == orderedDisks[j] {
-				found = true
-				break
-			}
-		}
-		if !found {
-			// append not found disk to result
-			uDisks = append(uDisks, storageDisks[i])
-		}
-	}
-	return uDisks
-}
-
-// Inspect the content of all disks to guess the right order according
-// to the format files. The right order is represented in orderedDisks
-func reorderDisksByInspection(orderedDisks, storageDisks []StorageAPI,
-	formatConfigs []*formatConfigV1) ([]StorageAPI, error) {
-
-	for index, format := range formatConfigs {
-		if format != nil {
-			continue
-		}
-		vols, err := storageDisks[index].ListVols()
-		if err != nil {
-			return nil, err
-		}
-		if len(vols) == 0 {
-			continue
-		}
-		volName := ""
-		// Avoid picking minioMetaBucket because ListVols()
-		// returns a non ordered list
-		for i := range vols {
-			if vols[i].Name != minioMetaBucket {
-				volName = vols[i].Name
-				break
-			}
-		}
-		if volName == "" {
-			continue
-		}
-		objects, err := storageDisks[index].ListDir(volName, "")
-		if err != nil {
-			return nil, err
-		}
-		if len(objects) == 0 {
-			continue
-		}
-		xlData, err := readXLMeta(storageDisks[index], volName, objects[0])
-		if err != nil {
-			if err == errFileNotFound {
-				continue
-			}
-			return nil, err
-		}
-		diskIndex := -1
-		for i, d := range xlData.Erasure.Distribution {
-			if d == xlData.Erasure.Index {
-				diskIndex = i
-			}
-		}
-		// Check for found results
-		if diskIndex == -1 || orderedDisks[diskIndex] != nil {
-			// Some inconsistent data are found, exit immediately.
-			return nil, errCorruptedFormat
-		}
-		orderedDisks[diskIndex] = storageDisks[index]
-	}
-	return orderedDisks, nil
-}
-
-// Heals corrupted format json in all disks
-func healFormatXLCorruptedDisks(storageDisks []StorageAPI,
-	formatConfigs []*formatConfigV1) error {
-
-	// Reorder the disks based on the JBOD order.
-	referenceConfig, orderedDisks, err := reorderDisks(storageDisks,
-		formatConfigs, true)
-	if err != nil {
-		return err
-	}
-
-	// For disks with corrupted formats, inspect the disks
-	// contents to guess the disks order
-	orderedDisks, err = reorderDisksByInspection(orderedDisks, storageDisks,
-		formatConfigs)
-	if err != nil {
-		return err
-	}
-
-	// At this stage, all disks with corrupted formats but with
-	// objects inside found their way.  Now take care of
-	// unformatted disks, which are the `unAssignedDisks`
-	unAssignedDisks := collectUnAssignedDisks(storageDisks, orderedDisks)
-
-	// Assign unassigned disks to nil elements in orderedDisks
-	for i, disk := range orderedDisks {
-		if disk == nil && len(unAssignedDisks) > 0 {
-			orderedDisks[i] = unAssignedDisks[0]
-			unAssignedDisks = unAssignedDisks[1:]
-		}
-	}
-
-	// apply new format config and save to all disks
-	return collectNSaveNewFormatConfigs(referenceConfig, orderedDisks)
-}
-
-// loadFormatXL - loads XL `format.json` and returns back properly
-// ordered storage slice based on `format.json`.
-func loadFormatXL(bootstrapDisks []StorageAPI, readQuorum int) (disks []StorageAPI, err error) {
-	var unformattedDisksFoundCnt = 0
-	var diskNotFoundCount = 0
-	var corruptedDisksFoundCnt = 0
-	formatConfigs := make([]*formatConfigV1, len(bootstrapDisks))
-
-	// Try to load `format.json` bootstrap disks.
-	for index, disk := range bootstrapDisks {
-		if disk == nil {
-			diskNotFoundCount++
-			continue
-		}
-		var formatXL *formatConfigV1
-		formatXL, err = loadFormat(disk)
-		if err != nil {
-			if err == errUnformattedDisk {
-				unformattedDisksFoundCnt++
-				continue
-			} else if err == errDiskNotFound {
-				diskNotFoundCount++
-				continue
-			} else if err == errCorruptedFormat {
-				corruptedDisksFoundCnt++
-				continue
-			}
-			return nil, err
-		}
-		// Save valid formats.
-		formatConfigs[index] = formatXL
-	}
-
-	// If all disks indicate that 'format.json' is not available return 'errUnformattedDisk'.
-	if unformattedDisksFoundCnt > len(bootstrapDisks)-readQuorum {
-		return nil, errUnformattedDisk
-	} else if corruptedDisksFoundCnt > len(bootstrapDisks)-readQuorum {
-		return nil, errCorruptedFormat
-	} else if diskNotFoundCount == len(bootstrapDisks) {
-		return nil, errDiskNotFound
-	} else if diskNotFoundCount > len(bootstrapDisks)-readQuorum {
-		return nil, errXLReadQuorum
-	}
-
-	// Validate the format configs read are correct.
-	if err = checkFormatXL(formatConfigs); err != nil {
-		return nil, err
-	}
-	// Erasure code requires disks to be presented in the same
-	// order each time.
-	_, orderedDisks, err := reorderDisks(bootstrapDisks, formatConfigs,
-		false)
-	return orderedDisks, err
-}
-
-func checkFormatXLValue(formatXL *formatConfigV1) error {
-	// Validate format version and format type.
-	if formatXL.Version != formatFileV1 {
-		return fmt.Errorf("Unsupported version of backend format [%s] found", formatXL.Version)
-	}
-	if formatXL.Format != formatBackendXL {
-		return fmt.Errorf("Unsupported backend format [%s] found", formatXL.Format)
-	}
-	if formatXL.XL.Version != "1" {
-		return fmt.Errorf("Unsupported XL backend format found [%s]", formatXL.XL.Version)
-	}
-	return nil
-}
-
-func checkFormatXLValues(formatConfigs []*formatConfigV1) (int, error) {
-	for i, formatXL := range formatConfigs {
-		if formatXL == nil {
-			continue
-		}
-		if err := checkFormatXLValue(formatXL); err != nil {
-			return i, err
-		}
-		if len(formatConfigs) != len(formatXL.XL.JBOD) {
-			return i, fmt.Errorf("Number of disks %d did not match the backend format %d",
-				len(formatConfigs), len(formatXL.XL.JBOD))
-		}
-	}
-	return -1, nil
-}
-
-// checkFormatXL - verifies if format.json format is intact.
-func checkFormatXL(formatConfigs []*formatConfigV1) error {
-	if _, err := checkFormatXLValues(formatConfigs); err != nil {
-		return err
-	}
-	if err := checkJBODConsistency(formatConfigs); err != nil {
-		return err
-	}
-	return checkDisksConsistency(formatConfigs)
-}
-
-// saveFormatXL - populates `format.json` on disks in its order.
-func saveFormatXL(storageDisks []StorageAPI, formats []*formatConfigV1) error {
-	var errs = make([]error, len(storageDisks))
-	var wg = &sync.WaitGroup{}
-	// Write `format.json` to all disks.
-	for index, disk := range storageDisks {
-		if disk == nil {
-			continue
-		}
-		wg.Add(1)
-		go func(index int, disk StorageAPI, format *formatConfigV1) {
-			defer wg.Done()
-
-			// Marshal and write to disk.
-			formatBytes, err := json.Marshal(format)
-			if err != nil {
-				errs[index] = err
-				return
-			}
-
-			// Purge any existing temporary file, okay to ignore errors here.
-			disk.DeleteFile(minioMetaBucket, formatConfigFileTmp)
-
-			// Append file `format.json.tmp`.
-			if err = disk.AppendFile(minioMetaBucket, formatConfigFileTmp, formatBytes); err != nil {
-				errs[index] = err
-				return
-			}
-			// Rename file `format.json.tmp` --> `format.json`.
-			if err = disk.RenameFile(minioMetaBucket, formatConfigFileTmp, minioMetaBucket, formatConfigFile); err != nil {
-				errs[index] = err
-				return
-			}
-		}(index, disk, formats[index])
-	}
-
-	// Wait for the routines to finish.
-	wg.Wait()
-
-	// Validate if we encountered any errors, return quickly.
-	for _, err := range errs {
-		if err != nil {
-			// Failure.
-			return err
-		}
-	}
-
-	// Success.
-	return nil
-}
-
-// initFormatXL - save XL format configuration on all disks.
-func initFormatXL(storageDisks []StorageAPI) (err error) {
-	// Initialize jbods.
-	var jbod = make([]string, len(storageDisks))
-
-	// Initialize formats.
-	var formats = make([]*formatConfigV1, len(storageDisks))
-
-	// Initialize `format.json`.
-	for index, disk := range storageDisks {
-		if disk == nil {
-			continue
-		}
-		// Allocate format config.
-		formats[index] = &formatConfigV1{
-			Version: formatFileV1,
-			Format:  formatBackendXL,
-			XL: &xlFormat{
-				Version: xlFormatBackendV1,
-				Disk:    mustGetUUID(),
-			},
-		}
-		jbod[index] = formats[index].XL.Disk
-	}
-
-	// Update the jbod entries.
-	for index, disk := range storageDisks {
-		if disk == nil {
-			continue
-		}
-		// Save jbod.
-		formats[index].XL.JBOD = jbod
-	}
-
-	// Initialize meta volume, if volume already exists ignores it.
-	if err := initMetaVolume(storageDisks); err != nil {
-		return fmt.Errorf("Unable to initialize '.minio.sys' meta volume, %s", err)
-	}
-
-	// Save formats `format.json` across all disks.
-	return saveFormatXL(storageDisks, formats)
-}
@@ -0,0 +1,259 @@
+/*
+ * Minio Cloud Storage, (C) 2017 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"time"
+
+	errors2 "github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/pkg/lock"
+)
+
+// FS format version strings.
+const (
+	formatBackendFS   = "fs"
+	formatFSVersionV1 = "1"
+	formatFSVersionV2 = "2"
+)
+
+// formatFSV1 - structure holds format version '1'.
+type formatFSV1 struct {
+	formatMetaV1
+	FS struct {
+		Version string `json:"version"`
+	} `json:"fs"`
+}
+
+// formatFSV2 - structure is same as formatFSV1. But the multipart backend
+// structure is flat instead of hierarchy now.
+// In .minio.sys/multipart we have:
+// sha256(bucket/object)/uploadID/[fs.json, 1.etag, 2.etag ....]
+type formatFSV2 = formatFSV1
+
+// Used to detect the version of "fs" format.
+type formatFSVersionDetect struct {
+	FS struct {
+		Version string `json:"version"`
+	} `json:"fs"`
+}
+
+// Returns the latest "fs" format V1
+func newFormatFSV1() (format *formatFSV1) {
+	f := &formatFSV1{}
+	f.Version = formatMetaVersionV1
+	f.Format = formatBackendFS
+	f.FS.Version = formatFSVersionV1
+	return f
+}
+
+// Returns the latest "fs" format V2
+func newFormatFSV2() (format *formatFSV2) {
+	f := &formatFSV2{}
+	f.Version = formatMetaVersionV1
+	f.Format = formatBackendFS
+	f.FS.Version = formatFSVersionV2
+	return f
+}
+
+// Returns the field formatMetaV1.Format i.e the string "fs" which is never likely to change.
+// We do not use this function in XL to get the format as the file is not fcntl-locked on XL.
+func formatMetaGetFormatBackendFS(r io.ReadSeeker) (string, error) {
+	format := &formatMetaV1{}
+	if err := jsonLoad(r, format); err != nil {
+		return "", err
+	}
+	if format.Version == formatMetaVersionV1 {
+		return format.Format, nil
+	}
+	return "", fmt.Errorf(`format.Version expected: %s, got: %s`, formatMetaVersionV1, format.Version)
+}
+
+// Returns formatFS.FS.Version
+func formatFSGetVersion(r io.ReadSeeker) (string, error) {
+	format := &formatFSVersionDetect{}
+	if err := jsonLoad(r, format); err != nil {
+		return "", err
+	}
+	return format.FS.Version, nil
+}
+
+// Migrate from V1 to V2. V2 implements new backend format for multipart
+// uploads. Delete the previous multipart directory.
+func formatFSMigrateV1ToV2(wlk *lock.LockedFile, fsPath string) error {
+	version, err := formatFSGetVersion(wlk)
+	if err != nil {
+		return err
+	}
+
+	if version != formatFSVersionV1 {
+		return fmt.Errorf(`format.json version expected %s, found %s`, formatFSVersionV1, version)
+	}
+
+	if err = fsRemoveAll(path.Join(fsPath, minioMetaMultipartBucket)); err != nil {
+		return err
+	}
+
+	if err = os.MkdirAll(path.Join(fsPath, minioMetaMultipartBucket), 0755); err != nil {
+		return err
+	}
+
+	return jsonSave(wlk.File, newFormatFSV2())
+}
+
+// Migrate the "fs" backend.
+// Migration should happen when formatFSV1.FS.Version changes. This version
+// can change when there is a change to the struct formatFSV1.FS or if there
+// is any change in the backend file system tree structure.
+func formatFSMigrate(wlk *lock.LockedFile, fsPath string) error {
+	// Add any migration code here in case we bump format.FS.Version
+	version, err := formatFSGetVersion(wlk)
+	if err != nil {
+		return err
+	}
+
+	switch version {
+	case formatFSVersionV1:
+		if err = formatFSMigrateV1ToV2(wlk, fsPath); err != nil {
+			return err
+		}
+		fallthrough
+	case formatFSVersionV2:
+		// We are at the latest version.
+	}
+
+	// Make sure that the version is what we expect after the migration.
+	version, err = formatFSGetVersion(wlk)
+	if err != nil {
+		return err
+	}
+	if version != formatFSVersionV2 {
+		return fmt.Errorf(`%s file: expected FS version: %s, found FS version: %s`, formatConfigFile, formatFSVersionV2, version)
+	}
+	return nil
+}
+
+// Creates a new format.json if unformatted.
+func createFormatFS(fsFormatPath string) error {
+	// Attempt a write lock on formatConfigFile `format.json`
+	// file stored in minioMetaBucket(.minio.sys) directory.
+	lk, err := lock.TryLockedOpenFile(fsFormatPath, os.O_RDWR|os.O_CREATE, 0600)
+	if err != nil {
+		return errors2.Trace(err)
+	}
+	// Close the locked file upon return.
+	defer lk.Close()
+
+	fi, err := lk.Stat()
+	if err != nil {
+		return errors2.Trace(err)
+	}
+	if fi.Size() != 0 {
+		// format.json already got created because of another minio process's createFormatFS()
+		return nil
+	}
+
+	return jsonSave(lk.File, newFormatFSV1())
+}
+
+// This function returns a read-locked format.json reference to the caller.
+// The file descriptor should be kept open throughout the life
+// of the process so that another minio process does not try to
+// migrate the backend when we are actively working on the backend.
+func initFormatFS(fsPath string) (rlk *lock.RLockedFile, err error) {
+	fsFormatPath := pathJoin(fsPath, minioMetaBucket, formatConfigFile)
+	// Any read on format.json should be done with read-lock.
+	// Any write on format.json should be done with write-lock.
+	for {
+		isEmpty := false
+		rlk, err := lock.RLockedOpenFile(fsFormatPath)
+		if err == nil {
+			// format.json can be empty in a rare condition when another
+			// minio process just created the file but could not hold lock
+			// and write to it.
+			var fi os.FileInfo
+			fi, err = rlk.Stat()
+			if err != nil {
+				return nil, errors2.Trace(err)
+			}
+			isEmpty = fi.Size() == 0
+		}
+		if os.IsNotExist(err) || isEmpty {
+			if err == nil {
+				rlk.Close()
+			}
+			// Fresh disk - create format.json
+			err = createFormatFS(fsFormatPath)
+			if err == lock.ErrAlreadyLocked {
+				// Lock already present, sleep and attempt again.
+				// Can happen in a rare situation when a parallel minio process
+				// holds the lock and creates format.json
+				time.Sleep(100 * time.Millisecond)
+				continue
+			}
+			if err != nil {
+				return nil, errors2.Trace(err)
+			}
+			// After successfully creating format.json try to hold a read-lock on
+			// the file.
+			continue
+		}
+		if err != nil {
+			return nil, errors2.Trace(err)
+		}
+
+		formatBackend, err := formatMetaGetFormatBackendFS(rlk)
+		if err != nil {
+			return nil, errors2.Trace(err)
+		}
+		if formatBackend != formatBackendFS {
+			return nil, fmt.Errorf(`%s file: expected format-type: %s, found: %s`, formatConfigFile, formatBackendFS, formatBackend)
+		}
+		version, err := formatFSGetVersion(rlk)
+		if err != nil {
+			return nil, err
+		}
+		if version != formatFSVersionV2 {
+			// Format needs migration
+			rlk.Close()
+			// Hold write lock during migration so that we do not disturb any
+			// minio processes running in parallel.
+			wlk, err := lock.TryLockedOpenFile(fsFormatPath, os.O_RDWR, 0)
+			if err == lock.ErrAlreadyLocked {
+				// Lock already present, sleep and attempt again.
+				time.Sleep(100 * time.Millisecond)
+				continue
+			}
+			if err != nil {
+				return nil, err
+			}
+			err = formatFSMigrate(wlk, fsPath)
+			wlk.Close()
+			if err != nil {
+				// Migration failed, bail out so that the user can observe what happened.
+				return nil, err
+			}
+			// Successfully migrated, now try to hold a read-lock on format.json
+			continue
+		}
+
+		return rlk, nil
+	}
+}
@@ -0,0 +1,102 @@
+/*
+ * Minio Cloud Storage, (C) 2017 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// TestFSFormatFS - tests initFormatFS, formatMetaGetFormatBackendFS, formatFSGetVersion.
+func TestFSFormatFS(t *testing.T) {
+	// Prepare for testing
+	disk := filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
+	defer os.RemoveAll(disk)
+
+	fsFormatPath := pathJoin(disk, minioMetaBucket, formatConfigFile)
+
+	// Assign a new UUID.
+	uuid := mustGetUUID()
+
+	// Initialize meta volume, if volume already exists ignores it.
+	if err := initMetaVolumeFS(disk, uuid); err != nil {
+		t.Fatal(err)
+	}
+
+	rlk, err := initFormatFS(disk)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rlk.Close()
+
+	// Do the basic sanity checks to check if initFormatFS() did its job.
+	f, err := os.OpenFile(fsFormatPath, os.O_RDWR, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+
+	format, err := formatMetaGetFormatBackendFS(f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if format != formatBackendFS {
+		t.Fatalf(`expected: %s, got: %s`, formatBackendFS, format)
+	}
+	version, err := formatFSGetVersion(f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if version != formatFSVersionV2 {
+		t.Fatalf(`expected: %s, got: %s`, formatFSVersionV2, version)
+	}
+
+	// Corrupt the format.json file and test the functions.
+	// formatMetaGetFormatBackendFS, formatFSGetVersion, initFormatFS should return errors.
+	if err = f.Truncate(0); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = f.WriteString("b"); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err = formatMetaGetFormatBackendFS(f); err == nil {
+		t.Fatal("expected to fail")
+	}
+	if _, err = formatFSGetVersion(rlk); err == nil {
+		t.Fatal("expected to fail")
+	}
+	if _, err = initFormatFS(disk); err == nil {
+		t.Fatal("expected to fail")
+	}
+
+	// With unknown formatMetaV1.Version formatMetaGetFormatBackendFS, initFormatFS should return error.
+	if err = f.Truncate(0); err != nil {
+		t.Fatal(err)
+	}
+	// Here we set formatMetaV1.Version to "2"
+	if _, err = f.WriteString(`{"version":"2","format":"fs","fs":{"version":"1"}}`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = formatMetaGetFormatBackendFS(f); err == nil {
+		t.Fatal("expected to fail")
+	}
+	if _, err = initFormatFS(disk); err == nil {
+		t.Fatal("expected to fail")
+	}
+}
@@ -0,0 +1,52 @@
+/*
+ * Minio Cloud Storage, (C) 2017 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+// Format related consts
+const (
+	// Format config file carries backend format specific details.
+	formatConfigFile = "format.json"
+
+	// Format config tmp file carries backend format.
+	formatConfigFileTmp = "format.json.tmp"
+)
+
+const (
+	// Version of the formatMetaV1
+	formatMetaVersionV1 = "1"
+)
+
+// format.json currently has the format:
+// {
+//   "version": "1",
+//   "format": "XXXXX",
+//   "XXXXX": {
+//
+//   }
+// }
+// Here "XXXXX" depends on the backend, currently we have "fs" and "xl" implementations.
+// formatMetaV1 should be inherited by backend format structs. Please look at format-fs.go
+// and format-xl.go for details.
+
+// Ideally we will never have a situation where we will have to change the
+// fields of this struct and deal with related migration.
+type formatMetaV1 struct {
+	// Version of the format config.
+	Version string `json:"version"`
+	// Format indicates the backend format type, supports two values 'xl' and 'fs'.
+	Format string `json:"format"`
+}
@@ -0,0 +1,702 @@
+/*
+ * Minio Cloud Storage, (C) 2016, 2017, 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"sync"
+
+	"encoding/hex"
+
+	humanize "github.com/dustin/go-humanize"
+	"github.com/minio/minio/pkg/errors"
+	sha256 "github.com/minio/sha256-simd"
+)
+
+const (
+	// Represents XL backend.
+	formatBackendXL = "xl"
+
+	// formatXLV1.XL.Version - version '1'.
+	formatXLVersionV1 = "1"
+
+	// formatXLV2.XL.Version - version '2'.
+	formatXLVersionV2 = "2"
+
+	// Distribution algorithm used.
+	formatXLVersionV2DistributionAlgo = "CRCMOD"
+)
+
+// Offline disk UUID represents an offline disk.
+const offlineDiskUUID = "ffffffff-ffff-ffff-ffff-ffffffffffff"
+
+// Healing is only supported for the list of errors mentioned here.
+var formatHealErrors = map[error]struct{}{
+	errUnformattedDisk: {},
+	errDiskNotFound:    {},
+}
+
+// List of errors considered critical for disk formatting.
+var formatCriticalErrors = map[error]struct{}{
+	errCorruptedFormat: {},
+	errFaultyDisk:      {},
+}
+
+// Used to detect the version of "xl" format.
+type formatXLVersionDetect struct {
+	XL struct {
+		Version string `json:"version"`
+	} `json:"xl"`
+}
+
+// Represents the V1 backend disk structure version
+// under `.minio.sys` and actual data namespace.
+// formatXLV1 - structure holds format config version '1'.
+type formatXLV1 struct {
+	formatMetaV1
+	XL struct {
+		Version string `json:"version"` // Version of 'xl' format.
+		Disk    string `json:"disk"`    // Disk field carries assigned disk uuid.
+		// JBOD field carries the input disk order generated the first
+		// time when fresh disks were supplied.
+		JBOD []string `json:"jbod"`
+	} `json:"xl"` // XL field holds xl format.
+}
+
+// Represents the V2 backend disk structure version
+// under `.minio.sys` and actual data namespace.
+// formatXLV2 - structure holds format config version '2'.
+type formatXLV2 struct {
+	Version string `json:"version"`
+	Format  string `json:"format"`
+	XL      struct {
+		Version string `json:"version"` // Version of 'xl' format.
+		This    string `json:"this"`    // This field carries assigned disk uuid.
+		// Sets field carries the input disk order generated the first
+		// time when fresh disks were supplied, it is a two dimensional
+		// array second dimension represents list of disks used per set.
+		Sets [][]string `json:"sets"`
+		// Distribution algorithm represents the hashing algorithm
+		// to pick the right set index for an object.
+		DistributionAlgo string `json:"distributionAlgo"`
+	} `json:"xl"`
+}
+
+// Returns formatXL.XL.Version
+func newFormatXLV2(numSets int, setLen int) *formatXLV2 {
+	format := &formatXLV2{}
+	format.Version = formatMetaVersionV1
+	format.Format = formatBackendXL
+	format.XL.Version = formatXLVersionV2
+	format.XL.DistributionAlgo = formatXLVersionV2DistributionAlgo
+	format.XL.Sets = make([][]string, numSets)
+
+	for i := 0; i < numSets; i++ {
+		format.XL.Sets[i] = make([]string, setLen)
+		for j := 0; j < setLen; j++ {
+			format.XL.Sets[i][j] = mustGetUUID()
+		}
+	}
+	return format
+}
+
+// Returns formatXL.XL.Version information, this code is specifically
+// used to read XL `format.json` and capture any version information
+// that it may have.
+func formatXLGetVersion(formatPath string) (string, error) {
+	format := &formatXLVersionDetect{}
+	b, err := ioutil.ReadFile(formatPath)
+	if err != nil {
+		return "", err
+	}
+	if err = json.Unmarshal(b, format); err != nil {
+		return "", err
+	}
+	return format.XL.Version, nil
+}
+
+// Returns format meta format version from `format.json`. This code
+// is specifically used to detect meta format.
+func formatMetaGetFormatBackendXL(formatPath string) (string, error) {
+	meta := &formatMetaV1{}
+	b, err := ioutil.ReadFile(formatPath)
+	if err != nil {
+		return "", err
+	}
+	if err = json.Unmarshal(b, meta); err != nil {
+		return "", err
+	}
+	if meta.Version != formatMetaVersionV1 {
+		return "", fmt.Errorf(`format.Version expected: %s, got: %s`, formatMetaVersionV1, meta.Version)
+	}
+	return meta.Format, nil
+}
+
+// Migrates all previous versions to latest version of `format.json`,
+// this code calls migration in sequence, such as V1 is migrated to V2
+// first before it V2 migrates to V3.
+func formatXLMigrate(export string) error {
+	formatPath := pathJoin(export, minioMetaBucket, formatConfigFile)
+	backend, err := formatMetaGetFormatBackendXL(formatPath)
+	if err != nil {
+		return err
+	}
+	if backend != formatBackendXL {
+		return fmt.Errorf(`Disk %s: found backend %s, expected %s`, export, backend, formatBackendXL)
+	}
+	version, err := formatXLGetVersion(formatPath)
+	if err != nil {
+		return err
+	}
+	switch version {
+	case formatXLVersionV1:
+		if err = formatXLMigrateV1ToV2(export); err != nil {
+			return err
+		}
+		fallthrough
+	case formatXLVersionV2:
+		// V2 is the latest version.
+		return nil
+	}
+	return fmt.Errorf(`%s: unknown format version %s`, export, version)
+}
+
+// Migrates version V1 of format.json to version V2 of format.json,
+// migration fails upon any error.
+func formatXLMigrateV1ToV2(export string) error {
+	formatPath := pathJoin(export, minioMetaBucket, formatConfigFile)
+	version, err := formatXLGetVersion(formatPath)
+	if err != nil {
+		return err
+	}
+	if version != formatXLVersionV1 {
+		return fmt.Errorf(`Disk %s: format version expected %s, found %s`, export, formatXLVersionV1, version)
+	}
+
+	formatV1 := &formatXLV1{}
+	b, err := ioutil.ReadFile(formatPath)
+	if err != nil {
+		return err
+	}
+	if err = json.Unmarshal(b, formatV1); err != nil {
+		return err
+	}
+
+	formatV2 := newFormatXLV2(1, len(formatV1.XL.JBOD))
+	formatV2.XL.This = formatV1.XL.Disk
+	copy(formatV2.XL.Sets[0], formatV1.XL.JBOD)
+
+	b, err = json.Marshal(formatV2)
+	if err != nil {
+		return err
+	}
+	return ioutil.WriteFile(formatPath, b, 0644)
+}
+
+// Returns true, if one of the errors is non-nil.
+func hasAnyErrors(errs []error) bool {
+	for _, err := range errs {
+		if err != nil {
+			return true
+		}
+	}
+	return false
+}
+
+// countErrs - count a specific error.
+func countErrs(errs []error, err error) int {
+	var i = 0
+	for _, err1 := range errs {
+		if errors.Cause(err1) == err {
+			i++
+		}
+	}
+	return i
+}
+
+// Does all errors indicate we need to initialize all disks?.
+func shouldInitXLDisks(errs []error) bool {
+	return countErrs(errs, errUnformattedDisk) == len(errs)
+}
+
+// loadFormatXLAll - load all format config from all input disks in parallel.
+func loadFormatXLAll(endpoints EndpointList) ([]*formatXLV2, []error) {
+	// Initialize sync waitgroup.
+	var wg = &sync.WaitGroup{}
+
+	bootstrapDisks := make([]StorageAPI, len(endpoints))
+	for i, endpoint := range endpoints {
+		disk, err := newStorageAPI(endpoint)
+		if err != nil {
+			continue
+		}
+		bootstrapDisks[i] = disk
+	}
+
+	// Initialize list of errors.
+	var sErrs = make([]error, len(bootstrapDisks))
+
+	// Initialize format configs.
+	var formats = make([]*formatXLV2, len(bootstrapDisks))
+
+	// Load format from each disk in parallel
+	for index, disk := range bootstrapDisks {
+		if disk == nil {
+			sErrs[index] = errDiskNotFound
+			continue
+		}
+		wg.Add(1)
+		// Launch go-routine per disk.
+		go func(index int, disk StorageAPI) {
+			defer wg.Done()
+			format, lErr := loadFormatXL(disk)
+			if lErr != nil {
+				// close the internal connection, to avoid fd leaks.
+				disk.Close()
+				sErrs[index] = lErr
+				return
+			}
+			formats[index] = format
+		}(index, disk)
+	}
+
+	// Wait for all go-routines to finish.
+	wg.Wait()
+
+	// Return all formats and nil
+	return formats, sErrs
+}
+
+func undoSaveFormatXLAll(disks []StorageAPI) {
+	// Initialize sync waitgroup.
+	var wg = &sync.WaitGroup{}
+	// Undo previous save format.json entry from all underlying storage disks.
+	for index, disk := range disks {
+		if disk == nil {
+			continue
+		}
+		wg.Add(1)
+		// Delete a bucket inside a go-routine.
+		go func(index int, disk StorageAPI) {
+			defer wg.Done()
+			_ = disk.DeleteFile(minioMetaBucket, formatConfigFile)
+		}(index, disk)
+	}
+
+	// Wait for all make vol to finish.
+	wg.Wait()
+}
+
+func saveFormatXL(disk StorageAPI, format *formatXLV2) error {
+	// Marshal and write to disk.
+	formatBytes, err := json.Marshal(format)
+	if err != nil {
+		return err
+	}
+
+	// Purge any existing temporary file, okay to ignore errors here.
+	disk.DeleteFile(minioMetaBucket, formatConfigFileTmp)
+
+	// Append file `format.json.tmp`.
+	if err = disk.AppendFile(minioMetaBucket, formatConfigFileTmp, formatBytes); err != nil {
+		return err
+	}
+
+	// Rename file `format.json.tmp` --> `format.json`.
+	return disk.RenameFile(minioMetaBucket, formatConfigFileTmp, minioMetaBucket, formatConfigFile)
+}
+
+// loadFormatXL - loads format.json from disk.
+func loadFormatXL(disk StorageAPI) (format *formatXLV2, err error) {
+	buf, err := disk.ReadAll(minioMetaBucket, formatConfigFile)
+	if err != nil {
+		// 'file not found' and 'volume not found' as
+		// same. 'volume not found' usually means its a fresh disk.
+		if err == errFileNotFound || err == errVolumeNotFound {
+			var vols []VolInfo
+			vols, err = disk.ListVols()
+			if err != nil {
+				return nil, err
+			}
+			if len(vols) > 1 || (len(vols) == 1 &&
+				vols[0].Name != minioMetaBucket &&
+				vols[0].Name != "lost+found") {
+				// 'format.json' not found, but we
+				// found user data.
+				return nil, errCorruptedFormat
+			}
+			// No other data found, its a fresh disk.
+			return nil, errUnformattedDisk
+		}
+		return nil, err
+	}
+
+	// Try to decode format json into formatConfigV1 struct.
+	format = &formatXLV2{}
+	if err = json.Unmarshal(buf, format); err != nil {
+		return nil, err
+	}
+
+	// Success.
+	return format, nil
+}
+
+// Valid formatXL basic versions.
+func checkFormatXLValue(formatXL *formatXLV2) error {
+	// Validate format version and format type.
+	if formatXL.Version != formatMetaVersionV1 {
+		return fmt.Errorf("Unsupported version of backend format [%s] found", formatXL.Version)
+	}
+	if formatXL.Format != formatBackendXL {
+		return fmt.Errorf("Unsupported backend format [%s] found", formatXL.Format)
+	}
+	if formatXL.XL.Version != formatXLVersionV2 {
+		return fmt.Errorf("Unsupported XL backend format found [%s]", formatXL.XL.Version)
+	}
+	return nil
+}
+
+// Check all format values.
+func checkFormatXLValues(formats []*formatXLV2) error {
+	for i, formatXL := range formats {
+		if formatXL == nil {
+			continue
+		}
+		if err := checkFormatXLValue(formatXL); err != nil {
+			return err
+		}
+		if len(formats) != len(formatXL.XL.Sets)*len(formatXL.XL.Sets[0]) {
+			return fmt.Errorf("%s disk is already being used in another erasure deployment. (Number of disks specified: %d but the number of disks found in the %s disk's format.json: %d)",
+				humanize.Ordinal(i+1), len(formats), humanize.Ordinal(i+1), len(formatXL.XL.Sets)*len(formatXL.XL.Sets[0]))
+		}
+	}
+	return nil
+}
+
+// Get backend XL format in quorum `format.json`.
+func getFormatXLInQuorum(formats []*formatXLV2) (*formatXLV2, error) {
+	formatHashes := make([]string, len(formats))
+	for i, format := range formats {
+		if format == nil {
+			continue
+		}
+		h := sha256.New()
+		for _, set := range format.XL.Sets {
+			for _, diskID := range set {
+				h.Write([]byte(diskID))
+			}
+		}
+		formatHashes[i] = hex.EncodeToString(h.Sum(nil))
+	}
+
+	formatCountMap := make(map[string]int)
+	for _, hash := range formatHashes {
+		if hash == "" {
+			continue
+		}
+		formatCountMap[hash]++
+	}
+
+	maxHash := ""
+	maxCount := 0
+	for hash, count := range formatCountMap {
+		if count > maxCount {
+			maxCount = count
+			maxHash = hash
+		}
+	}
+
+	if maxCount < len(formats)/2 {
+		return nil, errXLReadQuorum
+	}
+
+	for i, hash := range formatHashes {
+		if hash == maxHash {
+			format := *formats[i]
+			format.XL.This = ""
+			return &format, nil
+		}
+	}
+
+	return nil, errXLReadQuorum
+}
+
+func formatXLV2Check(reference *formatXLV2, format *formatXLV2) error {
+	tmpFormat := *format
+	this := tmpFormat.XL.This
+	tmpFormat.XL.This = ""
+	if len(reference.XL.Sets) != len(format.XL.Sets) {
+		return fmt.Errorf("Expected number of sets %d, got %d", len(reference.XL.Sets), len(format.XL.Sets))
+	}
+
+	// Make sure that the sets match.
+	for i := range reference.XL.Sets {
+		if len(reference.XL.Sets[i]) != len(format.XL.Sets[i]) {
+			return fmt.Errorf("Each set should be of same size, expected %d got %d",
+				len(reference.XL.Sets[i]), len(format.XL.Sets[i]))
+		}
+		for j := range reference.XL.Sets[i] {
+			if reference.XL.Sets[i][j] != format.XL.Sets[i][j] {
+				return fmt.Errorf("UUID on positions %d:%d do not match with, expected %s got %s",
+					i, j, reference.XL.Sets[i][j], format.XL.Sets[i][j])
+			}
+		}
+	}
+
+	// Make sure that the diskID is found in the set.
+	for i := 0; i < len(tmpFormat.XL.Sets); i++ {
+		for j := 0; j < len(tmpFormat.XL.Sets[i]); j++ {
+			if this == tmpFormat.XL.Sets[i][j] {
+				return nil
+			}
+		}
+	}
+	return fmt.Errorf("Disk ID %s not found in any disk sets %s", this, format.XL.Sets)
+}
+
+// saveFormatXLAll - populates `format.json` on disks in its order.
+func saveFormatXLAll(endpoints EndpointList, formats []*formatXLV2) error {
+	storageDisks, err := initStorageDisks(endpoints)
+	if err != nil {
+		return err
+	}
+
+	var errs = make([]error, len(storageDisks))
+
+	var wg = &sync.WaitGroup{}
+
+	// Write `format.json` to all disks.
+	for index, disk := range storageDisks {
+		if formats[index] == nil || disk == nil {
+			errs[index] = errDiskNotFound
+			continue
+		}
+		wg.Add(1)
+		go func(index int, disk StorageAPI, format *formatXLV2) {
+			defer wg.Done()
+			errs[index] = saveFormatXL(disk, format)
+		}(index, disk, formats[index])
+	}
+
+	// Wait for the routines to finish.
+	wg.Wait()
+
+	writeQuorum := len(endpoints)/2 + 1
+	err = reduceWriteQuorumErrs(errs, nil, writeQuorum)
+	if errors.Cause(err) == errXLWriteQuorum {
+		// Purge all successfully created `format.json`
+		// when we do not have enough quorum.
+		undoSaveFormatXLAll(storageDisks)
+	}
+
+	return err
+}
+
+// Initialize storage disks based on input arguments.
+func initStorageDisks(endpoints EndpointList) ([]StorageAPI, error) {
+	// Bootstrap disks.
+	storageDisks := make([]StorageAPI, len(endpoints))
+	for index, endpoint := range endpoints {
+		// Intentionally ignore disk not found errors. XL is designed
+		// to handle these errors internally.
+		storage, err := newStorageAPI(endpoint)
+		if err != nil && err != errDiskNotFound {
+			return nil, err
+		}
+		storageDisks[index] = storage
+	}
+	return storageDisks, nil
+}
+
+// initFormatXL - save XL format configuration on all disks.
+func initFormatXL(endpoints EndpointList, setCount, disksPerSet int) (format *formatXLV2, err error) {
+	format = newFormatXLV2(setCount, disksPerSet)
+	formats := make([]*formatXLV2, len(endpoints))
+
+	for i := 0; i < setCount; i++ {
+		for j := 0; j < disksPerSet; j++ {
+			newFormat := *format
+			newFormat.XL.This = format.XL.Sets[i][j]
+			formats[i*disksPerSet+j] = &newFormat
+		}
+	}
+
+	// Initialize meta volume, if volume already exists ignores it.
+	if err = initFormatXLMetaVolume(endpoints, formats); err != nil {
+		return format, fmt.Errorf("Unable to initialize '.minio.sys' meta volume, %s", err)
+	}
+
+	// Save formats `format.json` across all disks.
+	if err = saveFormatXLAll(endpoints, formats); err != nil {
+		return nil, err
+	}
+
+	return format, nil
+}
+
+// Make XL backend meta volumes.
+func makeFormatXLMetaVolumes(disk StorageAPI) error {
+	// Attempt to create `.minio.sys`.
+	if err := disk.MakeVol(minioMetaBucket); err != nil {
+		if !errors.IsErrIgnored(err, initMetaVolIgnoredErrs...) {
+			return err
+		}
+	}
+	if err := disk.MakeVol(minioMetaTmpBucket); err != nil {
+		if !errors.IsErrIgnored(err, initMetaVolIgnoredErrs...) {
+			return err
+		}
+	}
+	if err := disk.MakeVol(minioMetaMultipartBucket); err != nil {
+		if !errors.IsErrIgnored(err, initMetaVolIgnoredErrs...) {
+			return err
+		}
+	}
+	return nil
+}
+
+var initMetaVolIgnoredErrs = append(baseIgnoredErrs, errVolumeExists)
+
+// Initializes meta volume on all input storage disks.
+func initFormatXLMetaVolume(endpoints EndpointList, formats []*formatXLV2) error {
+	storageDisks, err := initStorageDisks(endpoints)
+	if err != nil {
+		return err
+	}
+
+	// This happens for the first time, but keep this here since this
+	// is the only place where it can be made expensive optimizing all
+	// other calls. Create minio meta volume, if it doesn't exist yet.
+	var wg = &sync.WaitGroup{}
+
+	// Initialize errs to collect errors inside go-routine.
+	var errs = make([]error, len(storageDisks))
+
+	// Initialize all disks in parallel.
+	for index, disk := range storageDisks {
+		if formats[index] == nil || disk == nil {
+			// Ignore create meta volume on disks which are not found.
+			continue
+		}
+		wg.Add(1)
+		go func(index int, disk StorageAPI) {
+			// Indicate this wait group is done.
+			defer wg.Done()
+
+			errs[index] = makeFormatXLMetaVolumes(disk)
+		}(index, disk)
+	}
+
+	// Wait for all cleanup to finish.
+	wg.Wait()
+
+	// Return upon first error.
+	for _, err := range errs {
+		if err == nil {
+			continue
+		}
+		return toObjectErr(err, minioMetaBucket)
+	}
+
+	// Return success here.
+	return nil
+}
+
+// Get all UUIDs which are present in reference format should
+// be present in the list of formats provided, those are considered
+// as online UUIDs.
+func getOnlineUUIDs(refFormat *formatXLV2, formats []*formatXLV2) (onlineUUIDs []string) {
+	for _, format := range formats {
+		if format == nil {
+			continue
+		}
+		for _, set := range refFormat.XL.Sets {
+			for _, uuid := range set {
+				if format.XL.This == uuid {
+					onlineUUIDs = append(onlineUUIDs, uuid)
+				}
+			}
+		}
+	}
+	return onlineUUIDs
+}
+
+// Look for all UUIDs which are not present in reference format
+// but are present in the onlineUUIDs list, construct of list such
+// offline UUIDs.
+func getOfflineUUIDs(refFormat *formatXLV2, formats []*formatXLV2) (offlineUUIDs []string) {
+	onlineUUIDs := getOnlineUUIDs(refFormat, formats)
+	for i, set := range refFormat.XL.Sets {
+		for j, uuid := range set {
+			var found bool
+			for _, onlineUUID := range onlineUUIDs {
+				if refFormat.XL.Sets[i][j] == onlineUUID {
+					found = true
+				}
+			}
+			if !found {
+				offlineUUIDs = append(offlineUUIDs, uuid)
+			}
+		}
+	}
+	return offlineUUIDs
+}
+
+// Mark all UUIDs that are offline.
+func markUUIDsOffline(refFormat *formatXLV2, formats []*formatXLV2) {
+	offlineUUIDs := getOfflineUUIDs(refFormat, formats)
+	for i, set := range refFormat.XL.Sets {
+		for j := range set {
+			for _, offlineUUID := range offlineUUIDs {
+				if refFormat.XL.Sets[i][j] == offlineUUID {
+					refFormat.XL.Sets[i][j] = offlineDiskUUID
+				}
+			}
+		}
+	}
+}
+
+// Initialize a new set of set formats which will be written to all disks.
+func newHealFormatSets(refFormat *formatXLV2, setCount, disksPerSet int, formats []*formatXLV2, errs []error) [][]*formatXLV2 {
+	newFormats := make([][]*formatXLV2, setCount)
+	for i := range refFormat.XL.Sets {
+		newFormats[i] = make([]*formatXLV2, disksPerSet)
+	}
+	for i := range refFormat.XL.Sets {
+		for j := range refFormat.XL.Sets[i] {
+			if errs[i*disksPerSet+j] == errUnformattedDisk || errs[i*disksPerSet+j] == nil {
+				newFormats[i][j] = &formatXLV2{}
+				newFormats[i][j].Version = refFormat.Version
+				newFormats[i][j].Format = refFormat.Format
+				newFormats[i][j].XL.Version = refFormat.XL.Version
+				newFormats[i][j].XL.DistributionAlgo = refFormat.XL.DistributionAlgo
+			}
+			if errs[i*disksPerSet+j] == errUnformattedDisk {
+				newFormats[i][j].XL.This = ""
+				newFormats[i][j].XL.Sets = nil
+				continue
+			}
+			if errs[i*disksPerSet+j] == nil {
+				newFormats[i][j].XL.This = formats[i*disksPerSet+j].XL.This
+				newFormats[i][j].XL.Sets = nil
+			}
+		}
+	}
+	return newFormats
+}
@@ -0,0 +1,398 @@
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"os"
+	"testing"
+)
+
+// Test get offline/online uuids.
+func TestGetUUIDs(t *testing.T) {
+	fmtV2 := newFormatXLV2(4, 16)
+	formats := make([]*formatXLV2, 64)
+
+	for i := 0; i < 4; i++ {
+		for j := 0; j < 16; j++ {
+			newFormat := *fmtV2
+			newFormat.XL.This = fmtV2.XL.Sets[i][j]
+			formats[i*16+j] = &newFormat
+		}
+	}
+
+	gotCount := len(getOnlineUUIDs(fmtV2, formats))
+	if gotCount != 64 {
+		t.Errorf("Expected online count '64', got '%d'", gotCount)
+	}
+
+	for i := 0; i < 4; i++ {
+		for j := 0; j < 16; j++ {
+			if j < 4 {
+				formats[i*16+j] = nil
+			}
+		}
+	}
+
+	gotCount = len(getOnlineUUIDs(fmtV2, formats))
+	if gotCount != 48 {
+		t.Errorf("Expected online count '48', got '%d'", gotCount)
+	}
+
+	gotCount = len(getOfflineUUIDs(fmtV2, formats))
+	if gotCount != 16 {
+		t.Errorf("Expected offline count '16', got '%d'", gotCount)
+	}
+
+	markUUIDsOffline(fmtV2, formats)
+	gotCount = 0
+	for i := range fmtV2.XL.Sets {
+		for j := range fmtV2.XL.Sets[i] {
+			if fmtV2.XL.Sets[i][j] == offlineDiskUUID {
+				gotCount++
+			}
+		}
+	}
+	if gotCount != 16 {
+		t.Errorf("Expected offline count '16', got '%d'", gotCount)
+	}
+}
+
+// Tests format xl get version.
+func TestFormatXLGetVersion(t *testing.T) {
+	// Get test root.
+	rootPath, err := getTestRoot()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(rootPath)
+
+	v := &formatXLVersionDetect{}
+	v.XL.Version = "1"
+	b, err := json.Marshal(v)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = ioutil.WriteFile(pathJoin(rootPath, formatConfigFile), b, os.FileMode(0644)); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = formatXLGetVersion("not-found")
+	if err == nil {
+		t.Fatal("Expected to fail but found success")
+	}
+
+	vstr, err := formatXLGetVersion(pathJoin(rootPath, formatConfigFile))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if vstr != "1" {
+		t.Fatalf("Expected version '1', got '%s'", vstr)
+	}
+}
+
+// Tests format get backend format.
+func TestFormatMetaGetFormatBackendXL(t *testing.T) {
+	// Get test root.
+	rootPath, err := getTestRoot()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(rootPath)
+
+	m := &formatMetaV1{
+		Format:  "fs",
+		Version: formatMetaVersionV1,
+	}
+
+	b, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err = ioutil.WriteFile(pathJoin(rootPath, formatConfigFile), b, os.FileMode(0644)); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = formatMetaGetFormatBackendXL("not-found")
+	if err == nil {
+		t.Fatal("Expected to fail but found success")
+	}
+
+	format, err := formatMetaGetFormatBackendXL(pathJoin(rootPath, formatConfigFile))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if format != m.Format {
+		t.Fatalf("Expected format value %s, got %s", m.Format, format)
+	}
+
+	m = &formatMetaV1{
+		Format:  "xl",
+		Version: "2",
+	}
+
+	b, err = json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err = ioutil.WriteFile(pathJoin(rootPath, formatConfigFile), b, os.FileMode(0644)); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = formatMetaGetFormatBackendXL(pathJoin(rootPath, formatConfigFile))
+	if err == nil {
+		t.Fatal("Expected to fail with incompatible meta version")
+	}
+}
+
+// Tests xl format migration.
+func TestFormatXLMigrate(t *testing.T) {
+	// Get test root.
+	rootPath, err := getTestRoot()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(rootPath)
+
+	m := &formatXLV1{}
+	m.Format = formatBackendXL
+	m.Version = formatMetaVersionV1
+	m.XL.Version = formatXLVersionV1
+	m.XL.Disk = mustGetUUID()
+	m.XL.JBOD = []string{m.XL.Disk, mustGetUUID(), mustGetUUID(), mustGetUUID()}
+
+	b, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err = os.MkdirAll(pathJoin(rootPath, minioMetaBucket), os.FileMode(0755)); err != nil {
+		t.Fatal(err)
+	}
+
+	if err = ioutil.WriteFile(pathJoin(rootPath, minioMetaBucket, formatConfigFile), b, os.FileMode(0644)); err != nil {
+		t.Fatal(err)
+	}
+
+	if err = formatXLMigrate(rootPath); err != nil {
+		t.Fatal(err)
+	}
+
+	m = &formatXLV1{}
+	m.Format = "unknown"
+	m.Version = formatMetaVersionV1
+	m.XL.Version = formatXLVersionV1
+	m.XL.Disk = mustGetUUID()
+	m.XL.JBOD = []string{m.XL.Disk, mustGetUUID(), mustGetUUID(), mustGetUUID()}
+
+	b, err = json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err = ioutil.WriteFile(pathJoin(rootPath, minioMetaBucket, formatConfigFile), b, os.FileMode(0644)); err != nil {
+		t.Fatal(err)
+	}
+
+	if err = formatXLMigrate(rootPath); err == nil {
+		t.Fatal("Expected to fail with unexpected backend format")
+	}
+
+	m = &formatXLV1{}
+	m.Format = formatBackendXL
+	m.Version = formatMetaVersionV1
+	m.XL.Version = "3"
+	m.XL.Disk = mustGetUUID()
+	m.XL.JBOD = []string{m.XL.Disk, mustGetUUID(), mustGetUUID(), mustGetUUID()}
+
+	b, err = json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err = ioutil.WriteFile(pathJoin(rootPath, minioMetaBucket, formatConfigFile), b, os.FileMode(0644)); err != nil {
+		t.Fatal(err)
+	}
+
+	if err = formatXLMigrate(rootPath); err == nil {
+		t.Fatal("Expected to fail with unexpected backend format version number")
+	}
+}
+
+// Tests check format xl value.
+func TestCheckFormatXLValue(t *testing.T) {
+	testCases := []struct {
+		format  *formatXLV2
+		success bool
+	}{
+		// Invalid XL format version "2".
+		{
+			&formatXLV2{
+				Version: "2",
+				Format:  "XL",
+				XL: struct {
+					Version          string     `json:"version"`
+					This             string     `json:"this"`
+					Sets             [][]string `json:"sets"`
+					DistributionAlgo string     `json:"distributionAlgo"`
+				}{
+					Version: "2",
+				},
+			},
+			false,
+		},
+		// Invalid XL format "Unknown".
+		{
+			&formatXLV2{
+				Version: "1",
+				Format:  "Unknown",
+				XL: struct {
+					Version          string     `json:"version"`
+					This             string     `json:"this"`
+					Sets             [][]string `json:"sets"`
+					DistributionAlgo string     `json:"distributionAlgo"`
+				}{
+					Version: "2",
+				},
+			},
+			false,
+		},
+		// Invalid XL format version "0".
+		{
+			&formatXLV2{
+				Version: "1",
+				Format:  "XL",
+				XL: struct {
+					Version          string     `json:"version"`
+					This             string     `json:"this"`
+					Sets             [][]string `json:"sets"`
+					DistributionAlgo string     `json:"distributionAlgo"`
+				}{
+					Version: "0",
+				},
+			},
+			false,
+		},
+	}
+
+	// Valid all test cases.
+	for i, testCase := range testCases {
+		if err := checkFormatXLValue(testCase.format); err != nil && testCase.success {
+			t.Errorf("Test %d: Expected failure %s", i+1, err)
+		}
+	}
+}
+
+// Tests getFormatXLInQuorum()
+func TestGetFormatXLInQuorumCheck(t *testing.T) {
+	setCount := 2
+	disksPerSet := 16
+
+	format := newFormatXLV2(setCount, disksPerSet)
+	formats := make([]*formatXLV2, 32)
+
+	for i := 0; i < setCount; i++ {
+		for j := 0; j < disksPerSet; j++ {
+			newFormat := *format
+			newFormat.XL.This = format.XL.Sets[i][j]
+			formats[i*disksPerSet+j] = &newFormat
+		}
+	}
+
+	// Return a format from list of formats in quorum.
+	quorumFormat, err := getFormatXLInQuorum(formats)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Check if the reference format and input formats are same.
+	if err = formatXLV2Check(quorumFormat, formats[0]); err != nil {
+		t.Fatal(err)
+	}
+
+	// QuorumFormat has .This field empty on purpose, expect a failure.
+	if err = formatXLV2Check(formats[0], quorumFormat); err == nil {
+		t.Fatal("Unexpected success")
+	}
+
+	formats[0] = nil
+	quorumFormat, err = getFormatXLInQuorum(formats)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	badFormat := *quorumFormat
+	badFormat.XL.Sets = nil
+	if err = formatXLV2Check(quorumFormat, &badFormat); err == nil {
+		t.Fatal("Unexpected success")
+	}
+
+	badFormatUUID := *quorumFormat
+	badFormatUUID.XL.Sets[0][0] = "bad-uuid"
+	if err = formatXLV2Check(quorumFormat, &badFormatUUID); err == nil {
+		t.Fatal("Unexpected success")
+	}
+
+	badFormatSetSize := *quorumFormat
+	badFormatSetSize.XL.Sets[0] = nil
+	if err = formatXLV2Check(quorumFormat, &badFormatSetSize); err == nil {
+		t.Fatal("Unexpected success")
+	}
+
+	for i := range formats {
+		if i < 17 {
+			formats[i] = nil
+		}
+	}
+	if _, err = getFormatXLInQuorum(formats); err == nil {
+		t.Fatal("Unexpected success")
+	}
+}
+
+// Initialize new format sets.
+func TestNewFormatSets(t *testing.T) {
+	setCount := 2
+	disksPerSet := 16
+
+	format := newFormatXLV2(setCount, disksPerSet)
+	formats := make([]*formatXLV2, 32)
+	errs := make([]error, 32)
+
+	for i := 0; i < setCount; i++ {
+		for j := 0; j < disksPerSet; j++ {
+			newFormat := *format
+			newFormat.XL.This = format.XL.Sets[i][j]
+			formats[i*disksPerSet+j] = &newFormat
+		}
+	}
+
+	quorumFormat, err := getFormatXLInQuorum(formats)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// 16th disk is unformatted.
+	errs[15] = errUnformattedDisk
+
+	newFormats := newHealFormatSets(quorumFormat, setCount, disksPerSet, formats, errs)
+	if newFormats == nil {
+		t.Fatal("Unexpected failure")
+	}
+}
@@ -1,240 +0,0 @@
-/*
- * Minio Cloud Storage, (C) 2016 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package cmd
-
-import (
-	"errors"
-	"io"
-	"os"
-	"reflect"
-	"sync"
-	"time"
-)
-
-// Error sent by appendParts go-routine when there are holes in parts.
-// For ex. let's say client uploads part-2 before part-1 in which case we
-// can not append and have to wait till part-1 is uploaded. Hence we return
-// this error. Currently this error is not used in the caller.
-var errPartsMissing = errors.New("required parts missing")
-
-// Error sent when appendParts go-routine has waited long enough and timedout.
-var errAppendPartsTimeout = errors.New("appendParts go-routine timeout")
-
-// Timeout value for the appendParts go-routine.
-var appendPartsTimeout = 24 * 60 * 60 * time.Second // 24 Hours.
-
-// Holds a map of uploadID->appendParts go-routine
-type backgroundAppend struct {
-	sync.Mutex
-	infoMap    map[string]bgAppendPartsInfo
-	appendFile io.WriteCloser
-}
-
-// Input to the appendParts go-routine
-type bgAppendPartsInput struct {
-	meta  fsMetaV1   // list of parts that need to be appended
-	errCh chan error // error sent by appendParts go-routine
-}
-
-// Identifies an appendParts go-routine.
-type bgAppendPartsInfo struct {
-	inputCh    chan bgAppendPartsInput
-	timeoutCh  chan struct{} // closed by appendParts go-routine when it timesout
-	abortCh    chan struct{} // closed after abort of upload to end the appendParts go-routine
-	completeCh chan struct{} // closed after complete of upload to end the appendParts go-routine
-}
-
-// Called after a part is uploaded so that it can be appended in the background.
-func (fs fsObjects) append(bucket, object, uploadID string, meta fsMetaV1) chan error {
-	fs.bgAppend.Lock()
-	info, ok := fs.bgAppend.infoMap[uploadID]
-	if !ok {
-		// Corresponding appendParts go-routine was not found, create a new one. Would happen when the first
-		// part of a multipart upload is uploaded.
-		inputCh := make(chan bgAppendPartsInput)
-		timeoutCh := make(chan struct{})
-		abortCh := make(chan struct{})
-		completeCh := make(chan struct{})
-
-		info = bgAppendPartsInfo{inputCh, timeoutCh, abortCh, completeCh}
-		fs.bgAppend.infoMap[uploadID] = info
-
-		go fs.appendParts(bucket, object, uploadID, info)
-	}
-	fs.bgAppend.Unlock()
-
-	errCh := make(chan error)
-	go func() {
-		// send input in a goroutine as send on the inputCh can block if appendParts go-routine
-		// is busy appending a part.
-		select {
-		case <-info.timeoutCh:
-			// This is to handle a rare race condition where we found info in b.infoMap
-			// but soon after that appendParts go-routine timed out.
-			errCh <- errAppendPartsTimeout
-		case info.inputCh <- bgAppendPartsInput{meta, errCh}:
-		}
-	}()
-
-	return errCh
-}
-
-// Called on complete-multipart-upload. Returns nil if the required parts have been appended.
-func (fs *fsObjects) complete(bucket, object, uploadID string, meta fsMetaV1) error {
-	fs.bgAppend.Lock()
-	defer fs.bgAppend.Unlock()
-
-	info, ok := fs.bgAppend.infoMap[uploadID]
-	delete(fs.bgAppend.infoMap, uploadID)
-	if !ok {
-		return errPartsMissing
-	}
-
-	errCh := make(chan error)
-
-	select {
-	case <-info.timeoutCh:
-		// This is to handle a rare race condition where we found info in b.infoMap
-		// but soon after that appendParts go-routine timedouted out.
-		return errAppendPartsTimeout
-	case info.inputCh <- bgAppendPartsInput{meta, errCh}:
-	}
-
-	err := <-errCh
-
-	close(info.completeCh)
-
-	return err
-}
-
-// Called after complete-multipart-upload or abort-multipart-upload so that the appendParts go-routine is not left dangling.
-func (fs fsObjects) abort(uploadID string) {
-	fs.bgAppend.Lock()
-	defer fs.bgAppend.Unlock()
-
-	info, ok := fs.bgAppend.infoMap[uploadID]
-	if !ok {
-		return
-	}
-
-	delete(fs.bgAppend.infoMap, uploadID)
-
-	info.abortCh <- struct{}{}
-}
-
-// This is run as a go-routine that appends the parts in the background.
-func (fs fsObjects) appendParts(bucket, object, uploadID string, info bgAppendPartsInfo) {
-	appendPath := pathJoin(fs.fsPath, minioMetaTmpBucket, fs.fsUUID, uploadID)
-	// Holds the list of parts that is already appended to the "append" file.
-	appendMeta := fsMetaV1{}
-
-	// Allocate staging read buffer.
-	buf := make([]byte, readSizeV1)
-	for {
-		select {
-		case input := <-info.inputCh:
-			// We receive on this channel when new part gets uploaded or when complete-multipart sends
-			// a value on this channel to confirm if all the required parts are appended.
-			meta := input.meta
-
-			for {
-				// Append should be done such a way that if part-3 and part-2 is uploaded before part-1, we
-				// wait till part-1 is uploaded after which we append part-2 and part-3 as well in this for-loop.
-				part, appendNeeded := partToAppend(meta, appendMeta)
-				if !appendNeeded {
-					if reflect.DeepEqual(meta.Parts, appendMeta.Parts) {
-						// Sending nil is useful so that the complete-multipart-upload knows that
-						// all the required parts have been appended.
-						input.errCh <- nil
-					} else {
-						// Sending error is useful so that complete-multipart-upload can fall-back to
-						// its own append process.
-						input.errCh <- errPartsMissing
-					}
-					break
-				}
-
-				if err := fs.appendPart(bucket, object, uploadID, part, buf); err != nil {
-					fsRemoveFile(appendPath)
-					appendMeta.Parts = nil
-					input.errCh <- err
-					break
-				}
-
-				appendMeta.AddObjectPart(part.Number, part.Name, part.ETag, part.Size)
-			}
-		case <-info.abortCh:
-			// abort-multipart-upload closed abortCh to end the appendParts go-routine.
-			fsRemoveFile(appendPath)
-
-			// So that any racing PutObjectPart does not leave a dangling go-routine.
-			close(info.timeoutCh)
-
-			return
-		case <-info.completeCh:
-			// complete-multipart-upload closed completeCh to end the appendParts go-routine.
-			close(info.timeoutCh) // So that any racing PutObjectPart does not leave a dangling go-routine.
-			return
-		case <-time.After(appendPartsTimeout):
-			// Timeout the goroutine to garbage collect its resources. This would happen if the client initiates
-			// a multipart upload and does not complete/abort it.
-			fs.bgAppend.Lock()
-			delete(fs.bgAppend.infoMap, uploadID)
-			fs.bgAppend.Unlock()
-
-			// Delete the temporary append file as well.
-			fsRemoveFile(appendPath)
-
-			close(info.timeoutCh)
-			return
-		}
-	}
-}
-
-// Appends the "part" to the append-file inside "tmp/" that finally gets moved to the actual location
-// upon complete-multipart-upload.
-func (fs fsObjects) appendPart(bucket, object, uploadID string, part objectPartInfo, buf []byte) error {
-	partPath := pathJoin(fs.fsPath, minioMetaMultipartBucket, bucket, object, uploadID, part.Name)
-
-	var offset int64
-	// Read each file part to start writing to the temporary concatenated object.
-	file, size, err := fsOpenFile(partPath, offset)
-	if err != nil {
-		if err == errFileNotFound {
-			return errPartsMissing
-		}
-		return err
-	}
-	defer file.Close()
-
-	tmpObjPath := pathJoin(fs.fsPath, minioMetaTmpBucket, fs.fsUUID, uploadID)
-	// No need to hold a lock, this is a unique file and will be only written
-	// to one one process per uploadID per minio process.
-	wfile, err := os.OpenFile((tmpObjPath), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0666)
-	if err != nil {
-		return err
-	}
-	defer wfile.Close()
-
-	// Fallocate more space as we concatenate.
-	if err = fsFAllocate(int(wfile.Fd()), 0, size); err != nil {
-		return err
-	}
-
-	_, err = io.CopyBuffer(wfile, file, buf)
-	return err
-}
@@ -1,5 +1,5 @@
 /*
- * Minio Cloud Storage, (C) 2016 Minio, Inc.
+ * Minio Cloud Storage, (C) 2016, 2017, 2018 Minio, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -17,13 +17,13 @@
 package cmd

 import (
-	"fmt"
 	"io"
 	"os"
 	pathutil "path"
 	"runtime"

 	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/pkg/lock"
 )

 // Removes only the file at given path does not remove
@@ -91,24 +91,6 @@ func fsRemoveDir(dirPath string) (err error) {
 	return nil
 }

-// Creates a new directory, parent dir is also recursively created
-// if it doesn't exist.
-func fsMkdirAll(dirPath string) (err error) {
-	if dirPath == "" {
-		return errors.Trace(errInvalidArgument)
-	}
-
-	if err = checkPathLength(dirPath); err != nil {
-		return errors.Trace(err)
-	}
-
-	if err = os.MkdirAll(dirPath, 0777); err != nil {
-		return errors.Trace(err)
-	}
-
-	return nil
-}
-
 // Creates a new directory, parent dir should exist
 // otherwise returns an error. If directory already
 // exists returns an error. Windows long paths
@@ -277,7 +259,7 @@ func fsCreateFile(filePath string, reader io.Reader, buf []byte, fallocSize int6
 		return 0, errors.Trace(err)
 	}

-	if err := os.MkdirAll(pathutil.Dir(filePath), 0777); err != nil {
+	if err := mkdirAll(pathutil.Dir(filePath), 0777); err != nil {
 		return 0, errors.Trace(err)
 	}

@@ -285,7 +267,7 @@ func fsCreateFile(filePath string, reader io.Reader, buf []byte, fallocSize int6
 		return 0, errors.Trace(err)
 	}

-	writer, err := os.OpenFile((filePath), os.O_CREATE|os.O_WRONLY, 0666)
+	writer, err := lock.Open(filePath, os.O_CREATE|os.O_WRONLY, 0666)
 	if err != nil {
 		return 0, osErrToFSFileErr(err)
 	}
@@ -310,39 +292,10 @@ func fsCreateFile(filePath string, reader io.Reader, buf []byte, fallocSize int6
 			return 0, errors.Trace(err)
 		}
 	}
+
 	return bytesWritten, nil
 }

-// Removes uploadID at destination path.
-func fsRemoveUploadIDPath(basePath, uploadIDPath string) error {
-	if basePath == "" || uploadIDPath == "" {
-		return errors.Trace(errInvalidArgument)
-	}
-	if err := checkPathLength(basePath); err != nil {
-		return errors.Trace(err)
-	}
-	if err := checkPathLength(uploadIDPath); err != nil {
-		return errors.Trace(err)
-	}
-
-	// List all the entries in uploadID.
-	entries, err := readDir(uploadIDPath)
-	if err != nil && err != errFileNotFound {
-		return errors.Trace(err)
-	}
-
-	// Delete all the entries obtained from previous readdir.
-	for _, entryPath := range entries {
-		err = fsDeleteFile(basePath, pathJoin(uploadIDPath, entryPath))
-		if err != nil && err != errFileNotFound {
-			return errors.Trace(err)
-		}
-	}
-
-	fsRemoveDir(uploadIDPath)
-	return nil
-}
-
 // fsFAllocate is similar to Fallocate but provides a convenient
 // wrapper to handle various operating system specific errors.
 func fsFAllocate(fd int, offset int64, len int64) (err error) {
@@ -374,19 +327,16 @@ func fsRenameFile(sourcePath, destPath string) error {
 	if err := checkPathLength(destPath); err != nil {
 		return errors.Trace(err)
 	}
+
 	// Verify if source path exists.
-	if _, err := os.Stat((sourcePath)); err != nil {
+	if _, err := os.Stat(sourcePath); err != nil {
 		return osErrToFSFileErr(err)
 	}
-	if err := os.MkdirAll(pathutil.Dir(destPath), 0777); err != nil {
-		return errors.Trace(err)
-	}
-	if err := os.Rename((sourcePath), (destPath)); err != nil {
-		if isSysErrCrossDevice(err) {
-			return errors.Trace(fmt.Errorf("%s (%s)->(%s)", errCrossDeviceLink, sourcePath, destPath))
-		}
+
+	if err := renameAll(sourcePath, destPath); err != nil {
 		return errors.Trace(err)
 	}
+
 	return nil
 }

@@ -28,28 +28,6 @@ import (
 	"github.com/minio/minio/pkg/lock"
 )

-// Tests - fsMkdirAll()
-func TestFSMkdirAll(t *testing.T) {
-	// create posix test setup
-	_, path, err := newPosixTestSetup()
-	if err != nil {
-		t.Fatalf("Unable to create posix test setup, %s", err)
-	}
-	defer os.RemoveAll(path)
-
-	if err = fsMkdirAll(""); errors.Cause(err) != errInvalidArgument {
-		t.Fatal("Unexpected error", err)
-	}
-
-	if err = fsMkdirAll(pathJoin(path, "my-obj-del-0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001")); errors.Cause(err) != errFileNameTooLong {
-		t.Fatal("Unexpected error", err)
-	}
-
-	if err = fsMkdirAll(pathJoin(path, "success-vol", "success-object")); err != nil {
-		t.Fatal("Unexpected error", err)
-	}
-}
-
 func TestFSRenameFile(t *testing.T) {
 	// create posix test setup
 	_, path, err := newPosixTestSetup()
@@ -17,14 +17,11 @@
 package cmd

 import (
-	"encoding/json"
 	"io"
 	"io/ioutil"
 	"os"
 	pathutil "path"
-	"sort"
 	"strings"
-	"time"

 	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/lock"
@@ -122,64 +119,24 @@ func (m fsMetaV1) ToObjectInfo(bucket, object string, fi os.FileInfo) ObjectInfo
 	// etag/md5Sum has already been extracted. We need to
 	// remove to avoid it from appearing as part of
 	// response headers. e.g, X-Minio-* or X-Amz-*.
-	objInfo.UserDefined = cleanMetaETag(m.Meta)
+	objInfo.UserDefined = cleanMetadata(m.Meta)
+
+	// All the parts per object.
+	objInfo.Parts = m.Parts

 	// Success..
 	return objInfo
 }

-// ObjectPartIndex - returns the index of matching object part number.
-func (m fsMetaV1) ObjectPartIndex(partNumber int) (partIndex int) {
-	for i, part := range m.Parts {
-		if partNumber == part.Number {
-			partIndex = i
-			return partIndex
-		}
-	}
-	return -1
-}
-
-// AddObjectPart - add a new object part in order.
-func (m *fsMetaV1) AddObjectPart(partNumber int, partName string, partETag string, partSize int64) {
-	partInfo := objectPartInfo{
-		Number: partNumber,
-		Name:   partName,
-		ETag:   partETag,
-		Size:   partSize,
-	}
-
-	// Update part info if it already exists.
-	for i, part := range m.Parts {
-		if partNumber == part.Number {
-			m.Parts[i] = partInfo
-			return
-		}
-	}
-
-	// Proceed to include new part info.
-	m.Parts = append(m.Parts, partInfo)
-
-	// Parts in fsMeta should be in sorted order by part number.
-	sort.Sort(byObjectPartNumber(m.Parts))
-}
-
 func (m *fsMetaV1) WriteTo(lk *lock.LockedFile) (n int64, err error) {
-	var metadataBytes []byte
-	metadataBytes, err = json.Marshal(m)
+	if err = jsonSave(lk, m); err != nil {
+		return 0, err
+	}
+	fi, err := lk.Stat()
 	if err != nil {
-		return 0, errors.Trace(err)
+		return 0, err
 	}
-
-	if err = lk.Truncate(0); err != nil {
-		return 0, errors.Trace(err)
-	}
-
-	if _, err = lk.Write(metadataBytes); err != nil {
-		return 0, errors.Trace(err)
-	}
-
-	// Success.
-	return int64(len(metadataBytes)), nil
+	return fi.Size(), nil
 }

 func parseFSVersion(fsMetaBuf []byte) string {
@@ -204,19 +161,26 @@ func parseFSMetaMap(fsMetaBuf []byte) map[string]string {
 	return metaMap
 }

-func parseFSParts(fsMetaBuf []byte) []objectPartInfo {
-	// Parse the FS Parts.
-	partsResult := gjson.GetBytes(fsMetaBuf, "parts").Array()
-	partInfo := make([]objectPartInfo, len(partsResult))
-	for i, p := range partsResult {
-		info := objectPartInfo{}
-		info.Number = int(p.Get("number").Int())
-		info.Name = p.Get("name").String()
-		info.ETag = p.Get("etag").String()
-		info.Size = p.Get("size").Int()
-		partInfo[i] = info
-	}
-	return partInfo
+func parseFSPartsArray(fsMetaBuf []byte) []objectPartInfo {
+	// Get xlMetaV1.Parts array
+	var partsArray []objectPartInfo
+
+	partsArrayResult := gjson.GetBytes(fsMetaBuf, "parts")
+	partsArrayResult.ForEach(func(key, part gjson.Result) bool {
+		partJSON := part.String()
+		number := gjson.Get(partJSON, "number").Int()
+		name := gjson.Get(partJSON, "name").String()
+		etag := gjson.Get(partJSON, "etag").String()
+		size := gjson.Get(partJSON, "size").Int()
+		partsArray = append(partsArray, objectPartInfo{
+			Number: int(number),
+			Name:   name,
+			ETag:   etag,
+			Size:   size,
+		})
+		return true
+	})
+	return partsArray
 }

 func (m *fsMetaV1) ReadFrom(lk *lock.LockedFile) (n int64, err error) {
@@ -247,12 +211,12 @@ func (m *fsMetaV1) ReadFrom(lk *lock.LockedFile) (n int64, err error) {
 		return 0, errors.Trace(errCorruptedFormat)
 	}

+	// obtain parts information
+	m.Parts = parseFSPartsArray(fsMetaBuf)
+
 	// obtain metadata.
 	m.Meta = parseFSMetaMap(fsMetaBuf)

-	// obtain parts info list.
-	m.Parts = parseFSParts(fsMetaBuf)
-
 	// obtain minio release date.
 	m.Minio.Release = parseFSRelease(fsMetaBuf)

@@ -268,110 +232,3 @@ func newFSMetaV1() (fsMeta fsMetaV1) {
 	fsMeta.Minio.Release = ReleaseTag
 	return fsMeta
 }
-
-// Check if disk has already a valid format, holds a read lock and
-// upon success returns it to the caller to be closed.
-func checkLockedValidFormatFS(fsPath string) (*lock.RLockedFile, error) {
-	fsFormatPath := pathJoin(fsPath, minioMetaBucket, formatConfigFile)
-
-	rlk, err := lock.RLockedOpenFile((fsFormatPath))
-	if err != nil {
-		if os.IsNotExist(err) {
-			// If format.json not found then
-			// its an unformatted disk.
-			return nil, errors.Trace(errUnformattedDisk)
-		}
-		return nil, errors.Trace(err)
-	}
-
-	var format = &formatConfigV1{}
-	if err = format.LoadFormat(rlk.LockedFile); err != nil {
-		rlk.Close()
-		return nil, err
-	}
-
-	// Check format FS.
-	if err = format.CheckFS(); err != nil {
-		rlk.Close()
-		return nil, err
-	}
-
-	//  Always return read lock here and should be closed by the caller.
-	return rlk, errors.Trace(err)
-}
-
-// Creates a new format.json if unformatted.
-func createFormatFS(fsPath string) error {
-	fsFormatPath := pathJoin(fsPath, minioMetaBucket, formatConfigFile)
-
-	// Attempt a write lock on formatConfigFile `format.json`
-	// file stored in minioMetaBucket(.minio.sys) directory.
-	lk, err := lock.TryLockedOpenFile((fsFormatPath), os.O_RDWR|os.O_CREATE, 0600)
-	if err != nil {
-		return errors.Trace(err)
-	}
-	// Close the locked file upon return.
-	defer lk.Close()
-
-	// Load format on disk, checks if we are unformatted
-	// writes the new format.json
-	var format = &formatConfigV1{}
-	err = format.LoadFormat(lk)
-	if errors.Cause(err) == errUnformattedDisk {
-		_, err = newFSFormat().WriteTo(lk)
-		return err
-	}
-	return err
-}
-
-func initFormatFS(fsPath string) (rlk *lock.RLockedFile, err error) {
-	// This loop validates format.json by holding a read lock and
-	// proceeds if disk unformatted to hold non-blocking WriteLock
-	// If for some reason non-blocking WriteLock fails and the error
-	// is lock.ErrAlreadyLocked i.e some other process is holding a
-	// lock we retry in the loop again.
-	for {
-		// Validate the `format.json` for expected values.
-		rlk, err = checkLockedValidFormatFS(fsPath)
-		switch {
-		case err == nil:
-			// Holding a read lock ensures that any write lock operation
-			// is blocked if attempted in-turn avoiding corruption on
-			// the backend disk.
-			return rlk, nil
-		case errors.Cause(err) == errUnformattedDisk:
-			if err = createFormatFS(fsPath); err != nil {
-				// Existing write locks detected.
-				if errors.Cause(err) == lock.ErrAlreadyLocked {
-					// Lock already present, sleep and attempt again.
-					time.Sleep(100 * time.Millisecond)
-					continue
-				}
-
-				// Unexpected error, return.
-				return nil, err
-			}
-
-			// Loop will continue to attempt a read-lock on `format.json`.
-		default:
-			// Unhandled error return.
-			return nil, err
-		}
-	}
-}
-
-// Return if the part info in uploadedParts and CompleteParts are same.
-func isPartsSame(uploadedParts []objectPartInfo, CompleteParts []CompletePart) bool {
-	if len(uploadedParts) != len(CompleteParts) {
-		return false
-	}
-
-	for i := range CompleteParts {
-		if uploadedParts[i].Number != CompleteParts[i].PartNumber ||
-			uploadedParts[i].ETag != CompleteParts[i].ETag {
-			return false
-		}
-	}
-
-	return true
-}
@@ -44,7 +44,7 @@ func TestReadFSMetadata(t *testing.T) {
 	defer os.RemoveAll(disk)

 	obj := initFSObjects(disk, t)
-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)

 	bucketName := "bucket"
 	objectName := "object"
@@ -79,7 +79,7 @@ func TestWriteFSMetadata(t *testing.T) {
 	defer os.RemoveAll(disk)

 	obj := initFSObjects(disk, t)
-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)

 	bucketName := "bucket"
 	objectName := "object"
@@ -33,7 +33,7 @@ func TestFSCleanupMultipartUploadsInRoutine(t *testing.T) {
 	defer os.RemoveAll(disk)

 	obj := initFSObjects(disk, t)
-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)

 	// Close the go-routine, we are going to
 	// manually start it and test in this test case.
@@ -48,7 +48,7 @@ func TestFSCleanupMultipartUploadsInRoutine(t *testing.T) {
 		t.Fatal("Unexpected err: ", err)
 	}

-	go cleanupStaleMultipartUploads(20*time.Millisecond, 0, obj, fs.listMultipartUploadsCleanup, globalServiceDoneCh)
+	go fs.cleanupStaleMultipartUploads(20*time.Millisecond, 0, globalServiceDoneCh)

 	// Wait for 40ms such that - we have given enough time for
 	// cleanup routine to kick in.
@@ -66,71 +66,6 @@ func TestFSCleanupMultipartUploadsInRoutine(t *testing.T) {
 	}
 }

-// Tests cleanup of stale upload ids.
-func TestFSCleanupMultipartUpload(t *testing.T) {
-	// Prepare for tests
-	disk := filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
-	defer os.RemoveAll(disk)
-
-	obj := initFSObjects(disk, t)
-	fs := obj.(*fsObjects)
-
-	// Close the multipart cleanup go-routine.
-	// In this test we are going to manually call
-	// the function which actually cleans the stale
-	// uploads.
-	globalServiceDoneCh <- struct{}{}
-
-	bucketName := "bucket"
-	objectName := "object"
-
-	obj.MakeBucketWithLocation(bucketName, "")
-	uploadID, err := obj.NewMultipartUpload(bucketName, objectName, nil)
-	if err != nil {
-		t.Fatal("Unexpected err: ", err)
-	}
-
-	if err = cleanupStaleMultipartUpload(bucketName, 0, obj, fs.listMultipartUploadsCleanup); err != nil {
-		t.Fatal("Unexpected err: ", err)
-	}
-
-	// Check if upload id was already purged.
-	if err = obj.AbortMultipartUpload(bucketName, objectName, uploadID); err != nil {
-		err = errors.Cause(err)
-		if _, ok := err.(InvalidUploadID); !ok {
-			t.Fatal("Unexpected err: ", err)
-		}
-	}
-}
-
-// TestFSWriteUploadJSON - tests for writeUploadJSON for FS
-func TestFSWriteUploadJSON(t *testing.T) {
-	// Prepare for tests
-	disk := filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
-	defer os.RemoveAll(disk)
-
-	obj := initFSObjects(disk, t)
-	fs := obj.(*fsObjects)
-
-	bucketName := "bucket"
-	objectName := "object"
-
-	obj.MakeBucketWithLocation(bucketName, "")
-	_, err := obj.NewMultipartUpload(bucketName, objectName, nil)
-	if err != nil {
-		t.Fatal("Unexpected err: ", err)
-	}
-
-	// newMultipartUpload will fail.
-	fs.fsPath = filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
-	_, err = obj.NewMultipartUpload(bucketName, objectName, nil)
-	if err != nil {
-		if _, ok := errors.Cause(err).(BucketNotFound); !ok {
-			t.Fatal("Unexpected err: ", err)
-		}
-	}
-}
-
 // TestNewMultipartUploadFaultyDisk - test NewMultipartUpload with faulty disks
 func TestNewMultipartUploadFaultyDisk(t *testing.T) {
 	// Prepare for tests
@@ -138,7 +73,7 @@ func TestNewMultipartUploadFaultyDisk(t *testing.T) {
 	defer os.RemoveAll(disk)
 	obj := initFSObjects(disk, t)

-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)
 	bucketName := "bucket"
 	objectName := "object"

@@ -167,7 +102,7 @@ func TestPutObjectPartFaultyDisk(t *testing.T) {
 	disk := filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	defer os.RemoveAll(disk)
 	obj := initFSObjects(disk, t)
-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)
 	bucketName := "bucket"
 	objectName := "object"
 	data := []byte("12345")
@@ -199,7 +134,7 @@ func TestCompleteMultipartUploadFaultyDisk(t *testing.T) {
 	defer os.RemoveAll(disk)
 	obj := initFSObjects(disk, t)

-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)
 	bucketName := "bucket"
 	objectName := "object"
 	data := []byte("12345")
@@ -215,12 +150,7 @@ func TestCompleteMultipartUploadFaultyDisk(t *testing.T) {

 	md5Hex := getMD5Hash(data)

-	if _, err := fs.PutObjectPart(bucketName, objectName, uploadID, 1, mustGetHashReader(t, bytes.NewReader(data), 5, md5Hex, "")); err != nil {
-		t.Fatal("Unexpected error ", err)
-	}
-
 	parts := []CompletePart{{PartNumber: 1, ETag: md5Hex}}
-
 	fs.fsPath = filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	if _, err := fs.CompleteMultipartUpload(bucketName, objectName, uploadID, parts); err != nil {
 		if !isSameType(errors.Cause(err), BucketNotFound{}) {
@@ -229,14 +159,14 @@ func TestCompleteMultipartUploadFaultyDisk(t *testing.T) {
 	}
 }

-// TestCompleteMultipartUploadFaultyDisk - test CompleteMultipartUpload with faulty disks
+// TestCompleteMultipartUpload - test CompleteMultipartUpload
 func TestCompleteMultipartUpload(t *testing.T) {
 	// Prepare for tests
 	disk := filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	defer os.RemoveAll(disk)
 	obj := initFSObjects(disk, t)

-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)
 	bucketName := "bucket"
 	objectName := "object"
 	data := []byte("12345")
@@ -263,14 +193,14 @@ func TestCompleteMultipartUpload(t *testing.T) {
 	}
 }

-// TestCompleteMultipartUploadFaultyDisk - test CompleteMultipartUpload with faulty disks
+// TestCompleteMultipartUpload - test CompleteMultipartUpload
 func TestAbortMultipartUpload(t *testing.T) {
 	// Prepare for tests
 	disk := filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	defer os.RemoveAll(disk)
 	obj := initFSObjects(disk, t)

-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)
 	bucketName := "bucket"
 	objectName := "object"
 	data := []byte("12345")
@@ -289,7 +219,7 @@ func TestAbortMultipartUpload(t *testing.T) {
 	if _, err := fs.PutObjectPart(bucketName, objectName, uploadID, 1, mustGetHashReader(t, bytes.NewReader(data), 5, md5Hex, "")); err != nil {
 		t.Fatal("Unexpected error ", err)
 	}
-
+	time.Sleep(time.Second) // Without Sleep on windows, the fs.AbortMultipartUpload() fails with "The process cannot access the file because it is being used by another process."
 	if err := fs.AbortMultipartUpload(bucketName, objectName, uploadID); err != nil {
 		t.Fatal("Unexpected error ", err)
 	}
@@ -303,27 +233,19 @@ func TestListMultipartUploadsFaultyDisk(t *testing.T) {

 	obj := initFSObjects(disk, t)

-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)
 	bucketName := "bucket"
 	objectName := "object"
-	data := []byte("12345")

 	if err := obj.MakeBucketWithLocation(bucketName, ""); err != nil {
 		t.Fatal("Cannot create bucket, err: ", err)
 	}

-	uploadID, err := fs.NewMultipartUpload(bucketName, objectName, map[string]string{"X-Amz-Meta-xid": "3f"})
+	_, err := fs.NewMultipartUpload(bucketName, objectName, map[string]string{"X-Amz-Meta-xid": "3f"})
 	if err != nil {
 		t.Fatal("Unexpected error ", err)
 	}

-	md5Hex := getMD5Hash(data)
-	sha256sum := ""
-
-	if _, err := fs.PutObjectPart(bucketName, objectName, uploadID, 1, mustGetHashReader(t, bytes.NewReader(data), 5, md5Hex, sha256sum)); err != nil {
-		t.Fatal("Unexpected error ", err)
-	}
-
 	fs.fsPath = filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	if _, err := fs.ListMultipartUploads(bucketName, objectName, "", "", "", 1000); err != nil {
 		if !isSameType(errors.Cause(err), BucketNotFound{}) {
@@ -24,16 +24,21 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"reflect"
 	"sort"
+	"sync"
 	"syscall"
+	"time"

+	"github.com/minio/minio-go/pkg/policy"
 	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/hash"
 	"github.com/minio/minio/pkg/lock"
+	"github.com/minio/minio/pkg/madmin"
 )

-// fsObjects - Implements fs object layer.
-type fsObjects struct {
+// FSObjects - Implements fs object layer.
+type FSObjects struct {
 	// Path to be exported over S3 API.
 	fsPath string

@@ -50,8 +55,21 @@ type fsObjects struct {
 	// ListObjects pool management.
 	listPool *treeWalkPool

-	// To manage the appendRoutine go0routines
-	bgAppend *backgroundAppend
+	appendFileMap   map[string]*fsAppendFile
+	appendFileMapMu sync.Mutex
+
+	// To manage the appendRoutine go-routines
+	nsMutex *nsLockMap
+
+	// Variable represents bucket policies in memory.
+	bucketPolicies *bucketPolicies
+}
+
+// Represents the background append file.
+type fsAppendFile struct {
+	sync.Mutex
+	parts    []PartInfo // List of parts appended.
+	filePath string     // Absolute path of the file in the temp location.
 }

 // Initializes meta volume on all the fs path.
@@ -75,8 +93,8 @@ func initMetaVolumeFS(fsPath, fsUUID string) error {

 }

-// newFSObjectLayer - initialize new fs object layer.
-func newFSObjectLayer(fsPath string) (ObjectLayer, error) {
+// NewFSObjectLayer - initialize new fs object layer.
+func NewFSObjectLayer(fsPath string) (ObjectLayer, error) {
 	if fsPath == "" {
 		return nil, errInvalidArgument
 	}
@@ -128,16 +146,15 @@ func newFSObjectLayer(fsPath string) (ObjectLayer, error) {
 	}

 	// Initialize fs objects.
-	fs := &fsObjects{
+	fs := &FSObjects{
 		fsPath: fsPath,
 		fsUUID: fsUUID,
 		rwPool: &fsIOPool{
 			readersMap: make(map[string]*lock.RLockedFile),
 		},
-		listPool: newTreeWalkPool(globalLookupTimeout),
-		bgAppend: &backgroundAppend{
-			infoMap: make(map[string]bgAppendPartsInfo),
-		},
+		nsMutex:       newNSLock(false),
+		listPool:      newTreeWalkPool(globalLookupTimeout),
+		appendFileMap: make(map[string]*fsAppendFile),
 	}

 	// Once the filesystem has initialized hold the read lock for
@@ -147,7 +164,8 @@ func newFSObjectLayer(fsPath string) (ObjectLayer, error) {
 	fs.fsFormatRlk = rlk

 	// Initialize and load bucket policies.
-	if err = initBucketPolicies(fs); err != nil {
+	fs.bucketPolicies, err = initBucketPolicies(fs)
+	if err != nil {
 		return nil, fmt.Errorf("Unable to load all bucket policies. %s", err)
 	}

@@ -156,15 +174,14 @@ func newFSObjectLayer(fsPath string) (ObjectLayer, error) {
 		return nil, fmt.Errorf("Unable to initialize event notification. %s", err)
 	}

-	// Start background process to cleanup old multipart objects in `.minio.sys`.
-	go cleanupStaleMultipartUploads(multipartCleanupInterval, multipartExpiry, fs, fs.listMultipartUploadsCleanup, globalServiceDoneCh)
+	go fs.cleanupStaleMultipartUploads(multipartCleanupInterval, multipartExpiry, globalServiceDoneCh)

 	// Return successfully initialized object layer.
 	return fs, nil
 }

-// Should be called when process shuts down.
-func (fs fsObjects) Shutdown() error {
+// Shutdown - should be called when process shuts down.
+func (fs *FSObjects) Shutdown() error {
 	fs.fsFormatRlk.Close()

 	// Cleanup and delete tmp uuid.
@@ -172,7 +189,7 @@ func (fs fsObjects) Shutdown() error {
 }

 // StorageInfo - returns underlying storage statistics.
-func (fs fsObjects) StorageInfo() StorageInfo {
+func (fs *FSObjects) StorageInfo() StorageInfo {
 	info, err := getDiskInfo((fs.fsPath))
 	errorIf(err, "Unable to get disk info %#v", fs.fsPath)
 	storageInfo := StorageInfo{
@@ -183,12 +200,24 @@ func (fs fsObjects) StorageInfo() StorageInfo {
 	return storageInfo
 }

+// Locking operations
+
+// ListLocks - List namespace locks held in object layer
+func (fs *FSObjects) ListLocks(bucket, prefix string, duration time.Duration) ([]VolumeLockInfo, error) {
+	return []VolumeLockInfo{}, NotImplemented{}
+}
+
+// ClearLocks - Clear namespace locks held in object layer
+func (fs *FSObjects) ClearLocks([]VolumeLockInfo) error {
+	return NotImplemented{}
+}
+
 /// Bucket operations

 // getBucketDir - will convert incoming bucket names to
 // corresponding valid bucket names on the backend in a platform
 // compatible way for all operating systems.
-func (fs fsObjects) getBucketDir(bucket string) (string, error) {
+func (fs *FSObjects) getBucketDir(bucket string) (string, error) {
 	// Verify if bucket is valid.
 	if !IsValidBucketName(bucket) {
 		return "", errors.Trace(BucketNameInvalid{Bucket: bucket})
@@ -198,7 +227,7 @@ func (fs fsObjects) getBucketDir(bucket string) (string, error) {
 	return bucketDir, nil
 }

-func (fs fsObjects) statBucketDir(bucket string) (os.FileInfo, error) {
+func (fs *FSObjects) statBucketDir(bucket string) (os.FileInfo, error) {
 	bucketDir, err := fs.getBucketDir(bucket)
 	if err != nil {
 		return nil, err
@@ -210,9 +239,14 @@ func (fs fsObjects) statBucketDir(bucket string) (os.FileInfo, error) {
 	return st, nil
 }

-// MakeBucket - create a new bucket, returns if it
+// MakeBucketWithLocation - create a new bucket, returns if it
 // already exists.
-func (fs fsObjects) MakeBucketWithLocation(bucket, location string) error {
+func (fs *FSObjects) MakeBucketWithLocation(bucket, location string) error {
+	bucketLock := fs.nsMutex.NewNSLock(bucket, "")
+	if err := bucketLock.GetLock(globalObjectTimeout); err != nil {
+		return err
+	}
+	defer bucketLock.Unlock()
 	bucketDir, err := fs.getBucketDir(bucket)
 	if err != nil {
 		return toObjectErr(err, bucket)
@@ -226,7 +260,12 @@ func (fs fsObjects) MakeBucketWithLocation(bucket, location string) error {
 }

 // GetBucketInfo - fetch bucket metadata info.
-func (fs fsObjects) GetBucketInfo(bucket string) (bi BucketInfo, e error) {
+func (fs *FSObjects) GetBucketInfo(bucket string) (bi BucketInfo, e error) {
+	bucketLock := fs.nsMutex.NewNSLock(bucket, "")
+	if e := bucketLock.GetRLock(globalObjectTimeout); e != nil {
+		return bi, e
+	}
+	defer bucketLock.RUnlock()
 	st, err := fs.statBucketDir(bucket)
 	if err != nil {
 		return bi, toObjectErr(err, bucket)
@@ -241,7 +280,7 @@ func (fs fsObjects) GetBucketInfo(bucket string) (bi BucketInfo, e error) {
 }

 // ListBuckets - list all s3 compatible buckets (directories) at fsPath.
-func (fs fsObjects) ListBuckets() ([]BucketInfo, error) {
+func (fs *FSObjects) ListBuckets() ([]BucketInfo, error) {
 	if err := checkPathLength(fs.fsPath); err != nil {
 		return nil, errors.Trace(err)
 	}
@@ -282,7 +321,12 @@ func (fs fsObjects) ListBuckets() ([]BucketInfo, error) {

 // DeleteBucket - delete a bucket and all the metadata associated
 // with the bucket including pending multipart, object metadata.
-func (fs fsObjects) DeleteBucket(bucket string) error {
+func (fs *FSObjects) DeleteBucket(bucket string) error {
+	bucketLock := fs.nsMutex.NewNSLock(bucket, "")
+	if err := bucketLock.GetLock(globalObjectTimeout); err != nil {
+		return err
+	}
+	defer bucketLock.Unlock()
 	bucketDir, err := fs.getBucketDir(bucket)
 	if err != nil {
 		return toObjectErr(err, bucket)
@@ -305,6 +349,9 @@ func (fs fsObjects) DeleteBucket(bucket string) error {
 		return toObjectErr(err, bucket)
 	}

+	// Delete all bucket metadata.
+	deleteBucketMetadata(bucket, fs)
+
 	return nil
 }

@@ -313,23 +360,39 @@ func (fs fsObjects) DeleteBucket(bucket string) error {
 // CopyObject - copy object source object to destination object.
 // if source object and destination object are same we only
 // update metadata.
-func (fs fsObjects) CopyObject(srcBucket, srcObject, dstBucket, dstObject string, metadata map[string]string) (oi ObjectInfo, e error) {
+func (fs *FSObjects) CopyObject(srcBucket, srcObject, dstBucket, dstObject string, srcInfo ObjectInfo) (oi ObjectInfo, e error) {
+	cpSrcDstSame := isStringEqual(pathJoin(srcBucket, srcObject), pathJoin(dstBucket, dstObject))
+	// Hold write lock on destination since in both cases
+	// - if source and destination are same
+	// - if source and destination are different
+	// it is the sole mutating state.
+	objectDWLock := fs.nsMutex.NewNSLock(dstBucket, dstObject)
+	if err := objectDWLock.GetLock(globalObjectTimeout); err != nil {
+		return oi, err
+	}
+	defer objectDWLock.Unlock()
+	// if source and destination are different, we have to hold
+	// additional read lock as well to protect against writes on
+	// source.
+	if !cpSrcDstSame {
+		// Hold read locks on source object only if we are
+		// going to read data from source object.
+		objectSRLock := fs.nsMutex.NewNSLock(srcBucket, srcObject)
+		if err := objectSRLock.GetRLock(globalObjectTimeout); err != nil {
+			return oi, err
+		}
+		defer objectSRLock.RUnlock()
+	}
 	if _, err := fs.statBucketDir(srcBucket); err != nil {
 		return oi, toObjectErr(err, srcBucket)
 	}

-	// Stat the file to get file size.
-	fi, err := fsStatFile(pathJoin(fs.fsPath, srcBucket, srcObject))
-	if err != nil {
-		return oi, toObjectErr(err, srcBucket, srcObject)
-	}
+	if cpSrcDstSame && srcInfo.metadataOnly {
+		// Close any writer which was initialized.
+		defer srcInfo.Writer.Close()

-	// Check if this request is only metadata update.
-	cpMetadataOnly := isStringEqual(pathJoin(srcBucket, srcObject), pathJoin(dstBucket, dstObject))
-	if cpMetadataOnly {
 		fsMetaPath := pathJoin(fs.fsPath, minioMetaBucket, bucketMetaPrefix, srcBucket, srcObject, fsMetaJSONFile)
-		var wlk *lock.LockedFile
-		wlk, err = fs.rwPool.Write(fsMetaPath)
+		wlk, err := fs.rwPool.Write(fsMetaPath)
 		if err != nil {
 			return oi, toObjectErr(errors.Trace(err), srcBucket, srcObject)
 		}
@@ -338,44 +401,45 @@ func (fs fsObjects) CopyObject(srcBucket, srcObject, dstBucket, dstObject string

 		// Save objects' metadata in `fs.json`.
 		fsMeta := newFSMetaV1()
-		fsMeta.Meta = metadata
+		if _, err = fsMeta.ReadFrom(wlk); err != nil {
+			return oi, toObjectErr(err, srcBucket, srcObject)
+		}
+
+		fsMeta.Meta = srcInfo.UserDefined
+		fsMeta.Meta["etag"] = srcInfo.ETag
 		if _, err = fsMeta.WriteTo(wlk); err != nil {
 			return oi, toObjectErr(err, srcBucket, srcObject)
 		}

+		// Stat the file to get file size.
+		fi, err := fsStatFile(pathJoin(fs.fsPath, srcBucket, srcObject))
+		if err != nil {
+			return oi, toObjectErr(err, srcBucket, srcObject)
+		}
+
 		// Return the new object info.
 		return fsMeta.ToObjectInfo(srcBucket, srcObject, fi), nil
 	}

-	// Length of the file to read.
-	length := fi.Size()
-
-	// Initialize pipe.
-	pipeReader, pipeWriter := io.Pipe()
-
 	go func() {
-		var startOffset int64 // Read the whole file.
-		if gerr := fs.GetObject(srcBucket, srcObject, startOffset, length, pipeWriter); gerr != nil {
-			errorIf(gerr, "Unable to read %s/%s.", srcBucket, srcObject)
-			pipeWriter.CloseWithError(gerr)
+		if gerr := fs.getObject(srcBucket, srcObject, 0, srcInfo.Size, srcInfo.Writer, srcInfo.ETag, !cpSrcDstSame); gerr != nil {
+			if gerr = srcInfo.Writer.Close(); gerr != nil {
+				errorIf(gerr, "Unable to read the object %s/%s.", srcBucket, srcObject)
+			}
+			return
+		}
+		// Close writer explicitly signalling we wrote all data.
+		if gerr := srcInfo.Writer.Close(); gerr != nil {
+			errorIf(gerr, "Unable to read the object %s/%s.", srcBucket, srcObject)
 			return
 		}
-		pipeWriter.Close() // Close writer explicitly signalling we wrote all data.
 	}()

-	hashReader, err := hash.NewReader(pipeReader, length, "", "")
+	objInfo, err := fs.putObject(dstBucket, dstObject, srcInfo.Reader, srcInfo.UserDefined)
 	if err != nil {
 		return oi, toObjectErr(err, dstBucket, dstObject)
 	}

-	objInfo, err := fs.PutObject(dstBucket, dstObject, hashReader, metadata)
-	if err != nil {
-		return oi, toObjectErr(err, dstBucket, dstObject)
-	}
-
-	// Explicitly close the reader.
-	pipeReader.Close()
-
 	return objInfo, nil
 }

@@ -385,11 +449,22 @@ func (fs fsObjects) CopyObject(srcBucket, srcObject, dstBucket, dstObject string
 //
 // startOffset indicates the starting read location of the object.
 // length indicates the total length of the object.
-func (fs fsObjects) GetObject(bucket, object string, offset int64, length int64, writer io.Writer) (err error) {
-	if err = checkBucketAndObjectNamesFS(bucket, object); err != nil {
+func (fs *FSObjects) GetObject(bucket, object string, offset int64, length int64, writer io.Writer, etag string) (err error) {
+	if err = checkGetObjArgs(bucket, object); err != nil {
 		return err
 	}

+	// Lock the object before reading.
+	objectLock := fs.nsMutex.NewNSLock(bucket, object)
+	if err := objectLock.GetRLock(globalObjectTimeout); err != nil {
+		return err
+	}
+	defer objectLock.RUnlock()
+	return fs.getObject(bucket, object, offset, length, writer, etag, true)
+}
+
+// getObject - wrapper for GetObject
+func (fs *FSObjects) getObject(bucket, object string, offset int64, length int64, writer io.Writer, etag string, lock bool) (err error) {
 	if _, err = fs.statBucketDir(bucket); err != nil {
 		return toObjectErr(err, bucket)
 	}
@@ -412,11 +487,23 @@ func (fs fsObjects) GetObject(bucket, object string, offset int64, length int64,

 	if bucket != minioMetaBucket {
 		fsMetaPath := pathJoin(fs.fsPath, minioMetaBucket, bucketMetaPrefix, bucket, object, fsMetaJSONFile)
-		_, err = fs.rwPool.Open(fsMetaPath)
-		if err != nil && err != errFileNotFound {
-			return toObjectErr(errors.Trace(err), bucket, object)
+		if lock {
+			_, err = fs.rwPool.Open(fsMetaPath)
+			if err != nil && err != errFileNotFound {
+				return toObjectErr(errors.Trace(err), bucket, object)
+			}
+			defer fs.rwPool.Close(fsMetaPath)
+		}
+	}
+
+	if etag != "" {
+		objEtag, perr := fs.getObjectETag(bucket, object, lock)
+		if perr != nil {
+			return toObjectErr(errors.Trace(perr), bucket, object)
+		}
+		if objEtag != etag {
+			return toObjectErr(errors.Trace(InvalidETag{}), bucket, object)
 		}
-		defer fs.rwPool.Close(fsMetaPath)
 	}

 	// Read the object, doesn't exist returns an s3 compatible error.
@@ -451,7 +538,7 @@ func (fs fsObjects) GetObject(bucket, object string, offset int64, length int64,
 }

 // getObjectInfo - wrapper for reading object metadata and constructs ObjectInfo.
-func (fs fsObjects) getObjectInfo(bucket, object string) (oi ObjectInfo, e error) {
+func (fs *FSObjects) getObjectInfo(bucket, object string) (oi ObjectInfo, e error) {
 	fsMeta := fsMetaV1{}
 	fi, err := fsStatDir(pathJoin(fs.fsPath, bucket, object))
 	if err != nil && errors.Cause(err) != errFileAccessDenied {
@@ -498,25 +585,16 @@ func (fs fsObjects) getObjectInfo(bucket, object string) (oi ObjectInfo, e error
 	return fsMeta.ToObjectInfo(bucket, object, fi), nil
 }

-// Checks bucket and object name validity, returns nil if both are valid.
-func checkBucketAndObjectNamesFS(bucket, object string) error {
-	// Verify if bucket is valid.
-	if !IsValidBucketName(bucket) {
-		return errors.Trace(BucketNameInvalid{Bucket: bucket})
-	}
-	// Verify if object is valid.
-	if len(object) == 0 {
-		return errors.Trace(ObjectNameInvalid{Bucket: bucket, Object: object})
-	}
-	if !IsValidObjectPrefix(object) {
-		return errors.Trace(ObjectNameInvalid{Bucket: bucket, Object: object})
-	}
-	return nil
-}
-
 // GetObjectInfo - reads object metadata and replies back ObjectInfo.
-func (fs fsObjects) GetObjectInfo(bucket, object string) (oi ObjectInfo, e error) {
-	if err := checkBucketAndObjectNamesFS(bucket, object); err != nil {
+func (fs *FSObjects) GetObjectInfo(bucket, object string) (oi ObjectInfo, e error) {
+	// Lock the object before reading.
+	objectLock := fs.nsMutex.NewNSLock(bucket, object)
+	if err := objectLock.GetRLock(globalObjectTimeout); err != nil {
+		return oi, err
+	}
+	defer objectLock.RUnlock()
+
+	if err := checkGetObjArgs(bucket, object); err != nil {
 		return oi, err
 	}

@@ -530,7 +608,7 @@ func (fs fsObjects) GetObjectInfo(bucket, object string) (oi ObjectInfo, e error
 // This function does the following check, suppose
 // object is "a/b/c/d", stat makes sure that objects ""a/b/c""
 // "a/b" and "a" do not exist.
-func (fs fsObjects) parentDirIsObject(bucket, parent string) bool {
+func (fs *FSObjects) parentDirIsObject(bucket, parent string) bool {
 	var isParentDirObject func(string) bool
 	isParentDirObject = func(p string) bool {
 		if p == "." || p == "/" {
@@ -551,12 +629,25 @@ func (fs fsObjects) parentDirIsObject(bucket, parent string) bool {
 // until EOF, writes data directly to configured filesystem path.
 // Additionally writes `fs.json` which carries the necessary metadata
 // for future object operations.
-func (fs fsObjects) PutObject(bucket string, object string, data *hash.Reader, metadata map[string]string) (objInfo ObjectInfo, retErr error) {
+func (fs *FSObjects) PutObject(bucket string, object string, data *hash.Reader, metadata map[string]string) (objInfo ObjectInfo, retErr error) {
+	if err := checkPutObjectArgs(bucket, object, fs, data.Size()); err != nil {
+		return ObjectInfo{}, err
+	}
+	// Lock the object.
+	objectLock := fs.nsMutex.NewNSLock(bucket, object)
+	if err := objectLock.GetLock(globalObjectTimeout); err != nil {
+		return objInfo, err
+	}
+	defer objectLock.Unlock()
+	return fs.putObject(bucket, object, data, metadata)
+}
+
+// putObject - wrapper for PutObject
+func (fs *FSObjects) putObject(bucket string, object string, data *hash.Reader, metadata map[string]string) (objInfo ObjectInfo, retErr error) {
 	// No metadata is set, allocate a new one.
 	if metadata == nil {
 		metadata = make(map[string]string)
 	}
-
 	var err error

 	// Validate if bucket name is valid and exists.
@@ -575,7 +666,7 @@ func (fs fsObjects) PutObject(bucket string, object string, data *hash.Reader, m
 		if fs.parentDirIsObject(bucket, path.Dir(object)) {
 			return ObjectInfo{}, toObjectErr(errors.Trace(errFileAccessDenied), bucket, object)
 		}
-		if err = fsMkdirAll(pathJoin(fs.fsPath, bucket, object)); err != nil {
+		if err = mkdirAll(pathJoin(fs.fsPath, bucket, object), 0777); err != nil {
 			return ObjectInfo{}, toObjectErr(err, bucket, object)
 		}
 		var fi os.FileInfo
@@ -585,7 +676,7 @@ func (fs fsObjects) PutObject(bucket string, object string, data *hash.Reader, m
 		return fsMeta.ToObjectInfo(bucket, object, fi), nil
 	}

-	if err = checkPutObjectArgs(bucket, object, fs); err != nil {
+	if err = checkPutObjectArgs(bucket, object, fs, data.Size()); err != nil {
 		return ObjectInfo{}, err
 	}

@@ -634,7 +725,6 @@ func (fs fsObjects) PutObject(bucket string, object string, data *hash.Reader, m
 	bytesWritten, err := fsCreateFile(fsTmpObjPath, data, buf, data.Size())
 	if err != nil {
 		fsRemoveFile(fsTmpObjPath)
-		errorIf(err, "Failed to create object %s/%s", bucket, object)
 		return ObjectInfo{}, toObjectErr(err, bucket, object)
 	}

@@ -677,8 +767,15 @@ func (fs fsObjects) PutObject(bucket string, object string, data *hash.Reader, m

 // DeleteObject - deletes an object from a bucket, this operation is destructive
 // and there are no rollbacks supported.
-func (fs fsObjects) DeleteObject(bucket, object string) error {
-	if err := checkBucketAndObjectNamesFS(bucket, object); err != nil {
+func (fs *FSObjects) DeleteObject(bucket, object string) error {
+	// Acquire a write lock before deleting the object.
+	objectLock := fs.nsMutex.NewNSLock(bucket, object)
+	if err := objectLock.GetLock(globalOperationTimeout); err != nil {
+		return err
+	}
+	defer objectLock.Unlock()
+
+	if err := checkDelObjArgs(bucket, object); err != nil {
 		return err
 	}

@@ -714,16 +811,10 @@ func (fs fsObjects) DeleteObject(bucket, object string) error {
 	return nil
 }

-// list of all errors that can be ignored in tree walk operation in FS
-var fsTreeWalkIgnoredErrs = append(baseIgnoredErrs, []error{
-	errFileNotFound,
-	errVolumeNotFound,
-}...)
-
 // Returns function "listDir" of the type listDirFunc.
 // isLeaf - is used by listDir function to check if an entry
 // is a leaf or non-leaf entry.
-func (fs fsObjects) listDirFactory(isLeaf isLeafFunc) listDirFunc {
+func (fs *FSObjects) listDirFactory(isLeaf isLeafFunc) listDirFunc {
 	// listDir - lists all the entries at a given prefix and given entry in the prefix.
 	listDir := func(bucket, prefixDir, prefixEntry string) (entries []string, delayIsLeaf bool, err error) {
 		entries, err = readDir(pathJoin(fs.fsPath, bucket, prefixDir))
@@ -740,43 +831,55 @@ func (fs fsObjects) listDirFactory(isLeaf isLeafFunc) listDirFunc {

 // getObjectETag is a helper function, which returns only the md5sum
 // of the file on the disk.
-func (fs fsObjects) getObjectETag(bucket, entry string) (string, error) {
+func (fs *FSObjects) getObjectETag(bucket, entry string, lock bool) (string, error) {
 	fsMetaPath := pathJoin(fs.fsPath, minioMetaBucket, bucketMetaPrefix, bucket, entry, fsMetaJSONFile)

-	// Read `fs.json` to perhaps contend with
-	// parallel Put() operations.
-	rlk, err := fs.rwPool.Open(fsMetaPath)
-	// Ignore if `fs.json` is not available, this is true for pre-existing data.
-	if err != nil && err != errFileNotFound {
-		return "", toObjectErr(errors.Trace(err), bucket, entry)
-	}
+	var reader io.Reader
+	var fi os.FileInfo
+	var size int64
+	if lock {
+		// Read `fs.json` to perhaps contend with
+		// parallel Put() operations.
+		rlk, err := fs.rwPool.Open(fsMetaPath)
+		// Ignore if `fs.json` is not available, this is true for pre-existing data.
+		if err != nil && err != errFileNotFound {
+			return "", toObjectErr(errors.Trace(err), bucket, entry)
+		}

-	// If file is not found, we don't need to proceed forward.
-	if err == errFileNotFound {
-		return "", nil
-	}
+		// If file is not found, we don't need to proceed forward.
+		if err == errFileNotFound {
+			return "", nil
+		}

-	// Read from fs metadata only if it exists.
-	defer fs.rwPool.Close(fsMetaPath)
+		// Read from fs metadata only if it exists.
+		defer fs.rwPool.Close(fsMetaPath)

-	// Fetch the size of the underlying file.
-	fi, err := rlk.LockedFile.Stat()
-	if err != nil {
-		return "", toObjectErr(errors.Trace(err), bucket, entry)
+		// Fetch the size of the underlying file.
+		fi, err = rlk.LockedFile.Stat()
+		if err != nil {
+			return "", toObjectErr(errors.Trace(err), bucket, entry)
+		}
+
+		size = fi.Size()
+		reader = io.NewSectionReader(rlk.LockedFile, 0, fi.Size())
+	} else {
+		var err error
+		reader, size, err = fsOpenFile(fsMetaPath, 0)
+		if err != nil {
+			return "", toObjectErr(errors.Trace(err), bucket, entry)
+		}
 	}

 	// `fs.json` can be empty due to previously failed
 	// PutObject() transaction, if we arrive at such
 	// a situation we just ignore and continue.
-	if fi.Size() == 0 {
+	if size == 0 {
 		return "", nil
 	}

-	// Wrap the locked file in a ReadAt() backend section reader to
-	// make sure the underlying offsets don't move.
-	fsMetaBuf, err := ioutil.ReadAll(io.NewSectionReader(rlk.LockedFile, 0, fi.Size()))
+	fsMetaBuf, err := ioutil.ReadAll(reader)
 	if err != nil {
-		return "", errors.Trace(err)
+		return "", toObjectErr(errors.Trace(err), bucket, entry)
 	}

 	// Check if FS metadata is valid, if not return error.
@@ -789,11 +892,17 @@ func (fs fsObjects) getObjectETag(bucket, entry string) (string, error) {

 // ListObjects - list all objects at prefix upto maxKeys., optionally delimited by '/'. Maintains the list pool
 // state for future re-entrant list requests.
-func (fs fsObjects) ListObjects(bucket, prefix, marker, delimiter string, maxKeys int) (loi ListObjectsInfo, e error) {
+func (fs *FSObjects) ListObjects(bucket, prefix, marker, delimiter string, maxKeys int) (loi ListObjectsInfo, e error) {
 	if err := checkListObjsArgs(bucket, prefix, marker, delimiter, fs); err != nil {
 		return loi, err
 	}
-
+	// Marker is set validate pre-condition.
+	if marker != "" {
+		// Marker not common with prefix is not implemented.Send an empty response
+		if !hasPrefix(marker, prefix) {
+			return ListObjectsInfo{}, e
+		}
+	}
 	if _, err := fs.statBucketDir(bucket); err != nil {
 		return loi, err
 	}
@@ -826,52 +935,12 @@ func (fs fsObjects) ListObjects(bucket, prefix, marker, delimiter string, maxKey
 	// Convert entry to ObjectInfo
 	entryToObjectInfo := func(entry string) (objInfo ObjectInfo, err error) {
 		// Protect the entry from concurrent deletes, or renames.
-		objectLock := globalNSMutex.NewNSLock(bucket, entry)
+		objectLock := fs.nsMutex.NewNSLock(bucket, entry)
 		if err = objectLock.GetRLock(globalListingTimeout); err != nil {
 			return ObjectInfo{}, err
 		}
-
-		if hasSuffix(entry, slashSeparator) {
-			var fi os.FileInfo
-			fi, err = fsStatDir(pathJoin(fs.fsPath, bucket, entry))
-			objectLock.RUnlock()
-			if err != nil {
-				return objInfo, err
-			}
-			// Success.
-			return ObjectInfo{
-				// Object name needs to be full path.
-				Name:    entry,
-				Bucket:  bucket,
-				Size:    fi.Size(),
-				ModTime: fi.ModTime(),
-				IsDir:   fi.IsDir(),
-			}, nil
-		}
-
-		var etag string
-		etag, err = fs.getObjectETag(bucket, entry)
-		objectLock.RUnlock()
-		if err != nil {
-			return ObjectInfo{}, err
-		}
-
-		// Stat the file to get file size.
-		var fi os.FileInfo
-		fi, err = fsStatFile(pathJoin(fs.fsPath, bucket, entry))
-		if err != nil {
-			return ObjectInfo{}, toObjectErr(err, bucket, entry)
-		}
-
-		// Success.
-		return ObjectInfo{
-			Name:    entry,
-			Bucket:  bucket,
-			Size:    fi.Size(),
-			ModTime: fi.ModTime(),
-			IsDir:   fi.IsDir(),
-			ETag:    etag,
-		}, nil
+		defer objectLock.RUnlock()
+		return fs.getObjectInfo(bucket, entry)
 	}

 	heal := false // true only for xl.ListObjectsHeal()
@@ -942,27 +1011,88 @@ func (fs fsObjects) ListObjects(bucket, prefix, marker, delimiter string, maxKey
 	return result, nil
 }

+// HealFormat - no-op for fs, Valid only for XL.
+func (fs *FSObjects) HealFormat(dryRun bool) (madmin.HealResultItem, error) {
+	return madmin.HealResultItem{}, errors.Trace(NotImplemented{})
+}
+
 // HealObject - no-op for fs. Valid only for XL.
-func (fs fsObjects) HealObject(bucket, object string) (int, int, error) {
-	return 0, 0, errors.Trace(NotImplemented{})
+func (fs *FSObjects) HealObject(bucket, object string, dryRun bool) (
+	res madmin.HealResultItem, err error) {
+	return res, errors.Trace(NotImplemented{})
 }

 // HealBucket - no-op for fs, Valid only for XL.
-func (fs fsObjects) HealBucket(bucket string) error {
-	return errors.Trace(NotImplemented{})
+func (fs *FSObjects) HealBucket(bucket string, dryRun bool) ([]madmin.HealResultItem,
+	error) {
+	return nil, errors.Trace(NotImplemented{})
 }

 // ListObjectsHeal - list all objects to be healed. Valid only for XL
-func (fs fsObjects) ListObjectsHeal(bucket, prefix, marker, delimiter string, maxKeys int) (loi ListObjectsInfo, e error) {
+func (fs *FSObjects) ListObjectsHeal(bucket, prefix, marker, delimiter string, maxKeys int) (loi ListObjectsInfo, e error) {
 	return loi, errors.Trace(NotImplemented{})
 }

 // ListBucketsHeal - list all buckets to be healed. Valid only for XL
-func (fs fsObjects) ListBucketsHeal() ([]BucketInfo, error) {
+func (fs *FSObjects) ListBucketsHeal() ([]BucketInfo, error) {
 	return []BucketInfo{}, errors.Trace(NotImplemented{})
 }

-func (fs fsObjects) ListUploadsHeal(bucket, prefix, marker, uploadIDMarker,
-	delimiter string, maxUploads int) (lmi ListMultipartsInfo, e error) {
-	return lmi, errors.Trace(NotImplemented{})
+// SetBucketPolicy sets policy on bucket
+func (fs *FSObjects) SetBucketPolicy(bucket string, policy policy.BucketAccessPolicy) error {
+	return persistAndNotifyBucketPolicyChange(bucket, false, policy, fs)
+}
+
+// GetBucketPolicy will get policy on bucket
+func (fs *FSObjects) GetBucketPolicy(bucket string) (policy.BucketAccessPolicy, error) {
+	policy := fs.bucketPolicies.GetBucketPolicy(bucket)
+	if reflect.DeepEqual(policy, emptyBucketPolicy) {
+		return ReadBucketPolicy(bucket, fs)
+	}
+	return policy, nil
+}
+
+// DeleteBucketPolicy deletes all policies on bucket
+func (fs *FSObjects) DeleteBucketPolicy(bucket string) error {
+	return persistAndNotifyBucketPolicyChange(bucket, true, emptyBucketPolicy, fs)
+}
+
+// ListObjectsV2 lists all blobs in bucket filtered by prefix
+func (fs *FSObjects) ListObjectsV2(bucket, prefix, continuationToken, delimiter string, maxKeys int, fetchOwner bool, startAfter string) (result ListObjectsV2Info, err error) {
+	loi, err := fs.ListObjects(bucket, prefix, continuationToken, delimiter, maxKeys)
+	if err != nil {
+		return result, err
+	}
+
+	listObjectsV2Info := ListObjectsV2Info{
+		IsTruncated:           loi.IsTruncated,
+		ContinuationToken:     continuationToken,
+		NextContinuationToken: loi.NextMarker,
+		Objects:               loi.Objects,
+		Prefixes:              loi.Prefixes,
+	}
+	return listObjectsV2Info, err
+}
+
+// RefreshBucketPolicy refreshes cache policy with what's on disk.
+func (fs *FSObjects) RefreshBucketPolicy(bucket string) error {
+	policy, err := ReadBucketPolicy(bucket, fs)
+
+	if err != nil {
+		if reflect.DeepEqual(policy, emptyBucketPolicy) {
+			return fs.bucketPolicies.DeleteBucketPolicy(bucket)
+		}
+		return err
+	}
+	return fs.bucketPolicies.SetBucketPolicy(bucket, policy)
+}
+
+// IsNotificationSupported returns whether bucket notification is applicable for this layer.
+func (fs *FSObjects) IsNotificationSupported() bool {
+	return true
+}
+
+// IsEncryptionSupported returns whether server side encryption is applicable for this layer.
+func (fs *FSObjects) IsEncryptionSupported() bool {
+	return true
 }
@@ -56,7 +56,7 @@ func TestFSParentDirIsObject(t *testing.T) {
 		t.Fatalf("Unexpected object name returned got %s, expected %s", objInfo.Name, objectName)
 	}

-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)
 	testCases := []struct {
 		parentIsObject bool
 		objectName     string
@@ -101,16 +101,16 @@ func TestFSParentDirIsObject(t *testing.T) {
 // and constructs a valid `FS` object layer.
 func TestNewFS(t *testing.T) {
 	// Do not attempt to create this path, the test validates
-	// so that newFSObjectLayer initializes non existing paths
+	// so that NewFSObjectLayer initializes non existing paths
 	// and successfully returns initialized object layer.
 	disk := filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	defer os.RemoveAll(disk)

-	_, err := newFSObjectLayer("")
+	_, err := NewFSObjectLayer("")
 	if err != errInvalidArgument {
 		t.Errorf("Expecting error invalid argument, got %s", err)
 	}
-	_, err = newFSObjectLayer(disk)
+	_, err = NewFSObjectLayer(disk)
 	if err != nil {
 		errMsg := "Unable to recognize backend format, Disk is not in FS format."
 		if err.Error() == errMsg {
@@ -131,10 +131,10 @@ func TestFSShutdown(t *testing.T) {
 	bucketName := "testbucket"
 	objectName := "object"
 	// Create and return an fsObject with its path in the disk
-	prepareTest := func() (*fsObjects, string) {
+	prepareTest := func() (*FSObjects, string) {
 		disk := filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 		obj := initFSObjects(disk, t)
-		fs := obj.(*fsObjects)
+		fs := obj.(*FSObjects)
 		objectContent := "12345"
 		obj.MakeBucketWithLocation(bucketName, "")
 		obj.PutObject(bucketName, objectName, mustGetHashReader(t, bytes.NewReader([]byte(objectContent)), int64(len(objectContent)), "", ""), nil)
@@ -164,7 +164,7 @@ func TestFSGetBucketInfo(t *testing.T) {
 	defer os.RemoveAll(disk)

 	obj := initFSObjects(disk, t)
-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)
 	bucketName := "bucket"

 	obj.MakeBucketWithLocation(bucketName, "")
@@ -266,7 +266,7 @@ func TestFSDeleteObject(t *testing.T) {
 	defer os.RemoveAll(disk)

 	obj := initFSObjects(disk, t)
-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)
 	bucketName := "bucket"
 	objectName := "object"

@@ -311,7 +311,7 @@ func TestFSDeleteBucket(t *testing.T) {
 	defer os.RemoveAll(disk)

 	obj := initFSObjects(disk, t)
-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)
 	bucketName := "bucket"

 	err := obj.MakeBucketWithLocation(bucketName, "")
@@ -350,7 +350,7 @@ func TestFSListBuckets(t *testing.T) {
 	defer os.RemoveAll(disk)

 	obj := initFSObjects(disk, t)
-	fs := obj.(*fsObjects)
+	fs := obj.(*FSObjects)

 	bucketName := "bucket"
 	if err := obj.MakeBucketWithLocation(bucketName, ""); err != nil {
@@ -400,7 +400,7 @@ func TestFSHealObject(t *testing.T) {
 	defer os.RemoveAll(disk)

 	obj := initFSObjects(disk, t)
-	_, _, err := obj.HealObject("bucket", "object")
+	_, err := obj.HealObject("bucket", "object", false)
 	if err == nil || !isSameType(errors.Cause(err), NotImplemented{}) {
 		t.Fatalf("Heal Object should return NotImplemented error ")
 	}
@@ -1,947 +0,0 @@
-/*
- * Minio Cloud Storage, (C) 2017 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package cmd
-
-import (
-	"io"
-	goioutil "io/ioutil"
-	"net"
-	"net/http"
-	"strconv"
-
-	"encoding/hex"
-	"encoding/json"
-
-	router "github.com/gorilla/mux"
-	"github.com/minio/minio-go/pkg/policy"
-	"github.com/minio/minio/pkg/hash"
-	"github.com/minio/minio/pkg/ioutil"
-)
-
-// GetObjectHandler - GET Object
-// ----------
-// This implementation of the GET operation retrieves object. To use GET,
-// you must have READ access to the object.
-func (api gatewayAPIHandlers) GetObjectHandler(w http.ResponseWriter, r *http.Request) {
-	var object, bucket string
-	vars := router.Vars(r)
-	bucket = vars["bucket"]
-	object = vars["object"]
-
-	// Fetch object stat info.
-	objectAPI := api.ObjectAPI()
-	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
-		return
-	}
-
-	reqAuthType := getRequestAuthType(r)
-
-	switch reqAuthType {
-	case authTypePresignedV2, authTypeSignedV2:
-		// Signature V2 validation.
-		s3Error := isReqAuthenticatedV2(r)
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeSigned, authTypePresigned:
-		s3Error := isReqAuthenticated(r, globalServerConfig.GetRegion())
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeAnonymous:
-		// No verification needed for anonymous requests.
-	default:
-		// For all unknown auth types return error.
-		writeErrorResponse(w, ErrAccessDenied, r.URL)
-		return
-	}
-
-	getObjectInfo := objectAPI.GetObjectInfo
-	if reqAuthType == authTypeAnonymous {
-		getObjectInfo = objectAPI.AnonGetObjectInfo
-	}
-	objInfo, err := getObjectInfo(bucket, object)
-	if err != nil {
-		errorIf(err, "Unable to fetch object info.")
-		apiErr := toAPIErrorCode(err)
-		if apiErr == ErrNoSuchKey {
-			apiErr = errAllowableObjectNotFound(bucket, r)
-		}
-		writeErrorResponse(w, apiErr, r.URL)
-		return
-	}
-
-	// Get request range.
-	var hrange *httpRange
-	rangeHeader := r.Header.Get("Range")
-	if rangeHeader != "" {
-		if hrange, err = parseRequestRange(rangeHeader, objInfo.Size); err != nil {
-			// Handle only errInvalidRange
-			// Ignore other parse error and treat it as regular Get request like Amazon S3.
-			if err == errInvalidRange {
-				writeErrorResponse(w, ErrInvalidRange, r.URL)
-				return
-			}
-
-			// log the error.
-			errorIf(err, "Invalid request range")
-		}
-	}
-
-	// Validate pre-conditions if any.
-	if checkPreconditions(w, r, objInfo) {
-		return
-	}
-
-	// Get the object.
-	var startOffset int64
-	length := objInfo.Size
-	if hrange != nil {
-		startOffset = hrange.offsetBegin
-		length = hrange.getLength()
-	}
-
-	getObject := objectAPI.GetObject
-	if reqAuthType == authTypeAnonymous {
-		getObject = objectAPI.AnonGetObject
-	}
-
-	setObjectHeaders(w, objInfo, hrange)
-	setHeadGetRespHeaders(w, r.URL.Query())
-	httpWriter := ioutil.WriteOnClose(w)
-	// Reads the object at startOffset and writes to mw.
-	if err = getObject(bucket, object, startOffset, length, httpWriter); err != nil {
-		errorIf(err, "Unable to write to client.")
-		if !httpWriter.HasWritten() {
-			// Error response only if no data has been written to client yet. i.e if
-			// partial data has already been written before an error
-			// occurred then no point in setting StatusCode and
-			// sending error XML.
-			writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		}
-		return
-	}
-	if err = httpWriter.Close(); err != nil {
-		if !httpWriter.HasWritten() { // write error response only if no data has been written to client yet
-			writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-			return
-		}
-	}
-
-	// Get host and port from Request.RemoteAddr.
-	host, port, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		host, port = "", ""
-	}
-
-	// Notify object accessed via a GET request.
-	eventNotify(eventData{
-		Type:      ObjectAccessedGet,
-		Bucket:    bucket,
-		ObjInfo:   objInfo,
-		ReqParams: extractReqParams(r),
-		UserAgent: r.UserAgent(),
-		Host:      host,
-		Port:      port,
-	})
-}
-
-// PutObjectHandler - PUT Object
-// ----------
-// This implementation of the PUT operation adds an object to a bucket.
-func (api gatewayAPIHandlers) PutObjectHandler(w http.ResponseWriter, r *http.Request) {
-	objectAPI := api.ObjectAPI()
-	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
-		return
-	}
-
-	// X-Amz-Copy-Source shouldn't be set for this call.
-	if _, ok := r.Header["X-Amz-Copy-Source"]; ok {
-		writeErrorResponse(w, ErrInvalidCopySource, r.URL)
-		return
-	}
-
-	var object, bucket string
-	vars := router.Vars(r)
-	bucket = vars["bucket"]
-	object = vars["object"]
-
-	// Validate storage class metadata if present
-	if _, ok := r.Header[amzStorageClassCanonical]; ok {
-		if !isValidStorageClassMeta(r.Header.Get(amzStorageClassCanonical)) {
-			writeErrorResponse(w, ErrInvalidStorageClass, r.URL)
-			return
-		}
-	}
-
-	// TODO: we should validate the object name here
-
-	// Get Content-Md5 sent by client and verify if valid
-	md5Bytes, err := checkValidMD5(r.Header.Get("Content-Md5"))
-	if err != nil {
-		errorIf(err, "Unable to validate content-md5 format.")
-		writeErrorResponse(w, ErrInvalidDigest, r.URL)
-		return
-	}
-
-	/// if Content-Length is unknown/missing, deny the request
-	size := r.ContentLength
-	reqAuthType := getRequestAuthType(r)
-	if reqAuthType == authTypeStreamingSigned {
-		sizeStr := r.Header.Get("x-amz-decoded-content-length")
-		size, err = strconv.ParseInt(sizeStr, 10, 64)
-		if err != nil {
-			errorIf(err, "Unable to parse `x-amz-decoded-content-length` into its integer value", sizeStr)
-			writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-			return
-		}
-	}
-	if size == -1 {
-		writeErrorResponse(w, ErrMissingContentLength, r.URL)
-		return
-	}
-
-	/// maximum Upload size for objects in a single operation
-	if isMaxObjectSize(size) {
-		writeErrorResponse(w, ErrEntityTooLarge, r.URL)
-		return
-	}
-
-	// Extract metadata to be saved from incoming HTTP header.
-	metadata, err := extractMetadataFromHeader(r.Header)
-	if err != nil {
-		errorIf(err, "found invalid http request header")
-		writeErrorResponse(w, ErrInternalError, r.URL)
-		return
-	}
-	if reqAuthType == authTypeStreamingSigned {
-		if contentEncoding, ok := metadata["content-encoding"]; ok {
-			contentEncoding = trimAwsChunkedContentEncoding(contentEncoding)
-			if contentEncoding != "" {
-				// Make sure to trim and save the content-encoding
-				// parameter for a streaming signature which is set
-				// to a custom value for example: "aws-chunked,gzip".
-				metadata["content-encoding"] = contentEncoding
-			} else {
-				// Trimmed content encoding is empty when the header
-				// value is set to "aws-chunked" only.
-
-				// Make sure to delete the content-encoding parameter
-				// for a streaming signature which is set to value
-				// for example: "aws-chunked"
-				delete(metadata, "content-encoding")
-			}
-		}
-	}
-
-	// Lock the object.
-	objectLock := globalNSMutex.NewNSLock(bucket, object)
-	if objectLock.GetLock(globalOperationTimeout) != nil {
-		writeErrorResponse(w, ErrOperationTimedOut, r.URL)
-		return
-	}
-	defer objectLock.Unlock()
-
-	var (
-		// Make sure we hex encode md5sum here.
-		md5hex    = hex.EncodeToString(md5Bytes)
-		sha256hex = ""
-		putObject = objectAPI.PutObject
-		reader    = r.Body
-	)
-
-	switch reqAuthType {
-	default:
-		// For all unknown auth types return error.
-		writeErrorResponse(w, ErrAccessDenied, r.URL)
-		return
-	case authTypeAnonymous:
-		putObject = objectAPI.AnonPutObject
-	case authTypeStreamingSigned:
-		// Initialize stream signature verifier.
-		var s3Error APIErrorCode
-		reader, s3Error = newSignV4ChunkedReader(r)
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeSignedV2, authTypePresignedV2:
-		s3Error := isReqAuthenticatedV2(r)
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypePresigned, authTypeSigned:
-		if s3Error := reqSignatureV4Verify(r, globalServerConfig.GetRegion()); s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-		if !skipContentSha256Cksum(r) {
-			sha256hex = getContentSha256Cksum(r)
-		}
-	}
-
-	hashReader, err := hash.NewReader(reader, size, md5hex, sha256hex)
-	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	objInfo, err := putObject(bucket, object, hashReader, metadata)
-	if err != nil {
-		errorIf(err, "Unable to save an object %s", r.URL.Path)
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	w.Header().Set("ETag", "\""+objInfo.ETag+"\"")
-	writeSuccessResponseHeadersOnly(w)
-
-	// Get host and port from Request.RemoteAddr.
-	host, port, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		host, port = "", ""
-	}
-
-	// Notify object created event.
-	eventNotify(eventData{
-		Type:      ObjectCreatedPut,
-		Bucket:    bucket,
-		ObjInfo:   objInfo,
-		ReqParams: extractReqParams(r),
-		UserAgent: r.UserAgent(),
-		Host:      host,
-		Port:      port,
-	})
-}
-
-// HeadObjectHandler - HEAD Object
-// -----------
-// The HEAD operation retrieves metadata from an object without returning the object itself.
-func (api gatewayAPIHandlers) HeadObjectHandler(w http.ResponseWriter, r *http.Request) {
-	var object, bucket string
-	vars := router.Vars(r)
-	bucket = vars["bucket"]
-	object = vars["object"]
-
-	objectAPI := api.ObjectAPI()
-	if objectAPI == nil {
-		writeErrorResponseHeadersOnly(w, ErrServerNotInitialized)
-		return
-	}
-
-	reqAuthType := getRequestAuthType(r)
-
-	switch reqAuthType {
-	case authTypePresignedV2, authTypeSignedV2:
-		// Signature V2 validation.
-		s3Error := isReqAuthenticatedV2(r)
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeSigned, authTypePresigned:
-		s3Error := isReqAuthenticated(r, globalServerConfig.GetRegion())
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeAnonymous:
-		// No verification needed for anonymous requests.
-	default:
-		// For all unknown auth types return error.
-		writeErrorResponse(w, ErrAccessDenied, r.URL)
-		return
-	}
-
-	getObjectInfo := objectAPI.GetObjectInfo
-	if reqAuthType == authTypeAnonymous {
-		getObjectInfo = objectAPI.AnonGetObjectInfo
-	}
-	objInfo, err := getObjectInfo(bucket, object)
-	if err != nil {
-		errorIf(err, "Unable to fetch object info.")
-		apiErr := toAPIErrorCode(err)
-		if apiErr == ErrNoSuchKey {
-			apiErr = errAllowableObjectNotFound(bucket, r)
-		}
-		writeErrorResponse(w, apiErr, r.URL)
-		return
-	}
-
-	// Validate pre-conditions if any.
-	if checkPreconditions(w, r, objInfo) {
-		return
-	}
-
-	// Set standard object headers.
-	setObjectHeaders(w, objInfo, nil)
-
-	// Set any additional requested response headers.
-	setHeadGetRespHeaders(w, r.URL.Query())
-
-	// Successful response.
-	w.WriteHeader(http.StatusOK)
-
-	// Get host and port from Request.RemoteAddr.
-	host, port, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		host, port = "", ""
-	}
-
-	// Notify object accessed via a HEAD request.
-	eventNotify(eventData{
-		Type:      ObjectAccessedHead,
-		Bucket:    bucket,
-		ObjInfo:   objInfo,
-		ReqParams: extractReqParams(r),
-		UserAgent: r.UserAgent(),
-		Host:      host,
-		Port:      port,
-	})
-}
-
-// PutBucketPolicyHandler - PUT Bucket policy
-// -----------------
-// This implementation of the PUT operation uses the policy
-// subresource to add to or replace a policy on a bucket
-func (api gatewayAPIHandlers) PutBucketPolicyHandler(w http.ResponseWriter, r *http.Request) {
-	objAPI := api.ObjectAPI()
-	if objAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
-		return
-	}
-
-	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
-		return
-	}
-
-	vars := router.Vars(r)
-	bucket := vars["bucket"]
-
-	// Before proceeding validate if bucket exists.
-	_, err := objAPI.GetBucketInfo(bucket)
-	if err != nil {
-		errorIf(err, "Unable to find bucket info.")
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	// If Content-Length is unknown or zero, deny the
-	// request. PutBucketPolicy always needs a Content-Length.
-	if r.ContentLength == -1 || r.ContentLength == 0 {
-		writeErrorResponse(w, ErrMissingContentLength, r.URL)
-		return
-	}
-	// If Content-Length is greater than maximum allowed policy size.
-	if r.ContentLength > maxAccessPolicySize {
-		writeErrorResponse(w, ErrEntityTooLarge, r.URL)
-		return
-	}
-
-	// Read access policy up to maxAccessPolicySize.
-	// http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
-	// bucket policies are limited to 20KB in size, using a limit reader.
-	policyBytes, err := goioutil.ReadAll(io.LimitReader(r.Body, maxAccessPolicySize))
-	if err != nil {
-		errorIf(err, "Unable to read from client.")
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	policyInfo := policy.BucketAccessPolicy{}
-	if err = json.Unmarshal(policyBytes, &policyInfo); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	if err = objAPI.SetBucketPolicies(bucket, policyInfo); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-	// Success.
-	writeSuccessNoContent(w)
-}
-
-// DeleteBucketPolicyHandler - DELETE Bucket policy
-// -----------------
-// This implementation of the DELETE operation uses the policy
-// subresource to add to remove a policy on a bucket.
-func (api gatewayAPIHandlers) DeleteBucketPolicyHandler(w http.ResponseWriter, r *http.Request) {
-	objAPI := api.ObjectAPI()
-	if objAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
-		return
-	}
-
-	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
-		return
-	}
-
-	vars := router.Vars(r)
-	bucket := vars["bucket"]
-
-	// Before proceeding validate if bucket exists.
-	_, err := objAPI.GetBucketInfo(bucket)
-	if err != nil {
-		errorIf(err, "Unable to find bucket info.")
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	// Delete bucket access policy, by passing an empty policy
-	// struct.
-	objAPI.DeleteBucketPolicies(bucket)
-	// Success.
-	writeSuccessNoContent(w)
-}
-
-// GetBucketPolicyHandler - GET Bucket policy
-// -----------------
-// This operation uses the policy
-// subresource to return the policy of a specified bucket.
-func (api gatewayAPIHandlers) GetBucketPolicyHandler(w http.ResponseWriter, r *http.Request) {
-	objAPI := api.ObjectAPI()
-	if objAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
-		return
-	}
-
-	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
-		return
-	}
-
-	vars := router.Vars(r)
-	bucket := vars["bucket"]
-
-	// Before proceeding validate if bucket exists.
-	_, err := objAPI.GetBucketInfo(bucket)
-	if err != nil {
-		errorIf(err, "Unable to find bucket info.")
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	bp, err := objAPI.GetBucketPolicies(bucket)
-	if err != nil {
-		errorIf(err, "Unable to read bucket policy.")
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	policyBytes, err := json.Marshal(bp)
-	if err != nil {
-		errorIf(err, "Unable to read bucket policy.")
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-	// Write to client.
-	w.Write(policyBytes)
-}
-
-// GetBucketNotificationHandler - This implementation of the GET
-// operation uses the notification subresource to return the
-// notification configuration of a bucket. If notifications are
-// not enabled on the bucket, the operation returns an empty
-// NotificationConfiguration element.
-func (api gatewayAPIHandlers) GetBucketNotificationHandler(w http.ResponseWriter, r *http.Request) {
-	writeErrorResponse(w, ErrNotImplemented, r.URL)
-}
-
-// PutBucketNotificationHandler - Minio notification feature enables
-// you to receive notifications when certain events happen in your bucket.
-// Using this API, you can replace an existing notification configuration.
-// The configuration is an XML file that defines the event types that you
-// want Minio to publish and the destination where you want Minio to publish
-// an event notification when it detects an event of the specified type.
-// By default, your bucket has no event notifications configured. That is,
-// the notification configuration will be an empty NotificationConfiguration.
-func (api gatewayAPIHandlers) PutBucketNotificationHandler(w http.ResponseWriter, r *http.Request) {
-	writeErrorResponse(w, ErrNotImplemented, r.URL)
-}
-
-// ListenBucketNotificationHandler - list bucket notifications.
-func (api gatewayAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWriter, r *http.Request) {
-	writeErrorResponse(w, ErrNotImplemented, r.URL)
-}
-
-// PutBucketHandler - PUT Bucket
-// ----------
-// This implementation of the PUT operation creates a new bucket for authenticated request
-func (api gatewayAPIHandlers) PutBucketHandler(w http.ResponseWriter, r *http.Request) {
-	objectAPI := api.ObjectAPI()
-	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
-		return
-	}
-
-	// PutBucket does not have any bucket action.
-	s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion())
-	if s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
-		return
-	}
-
-	vars := router.Vars(r)
-	bucket := vars["bucket"]
-
-	// Validate if incoming location constraint is valid, reject
-	// requests which do not follow valid region requirements.
-	location, s3Error := parseLocationConstraint(r)
-	if s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
-		return
-	}
-
-	bucketLock := globalNSMutex.NewNSLock(bucket, "")
-	if bucketLock.GetLock(globalOperationTimeout) != nil {
-		writeErrorResponse(w, ErrOperationTimedOut, r.URL)
-		return
-	}
-	defer bucketLock.Unlock()
-
-	// Proceed to creating a bucket.
-	err := objectAPI.MakeBucketWithLocation(bucket, location)
-	if err != nil {
-		errorIf(err, "Unable to create a bucket.")
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	// Make sure to add Location information here only for bucket
-	w.Header().Set("Location", getLocation(r))
-
-	writeSuccessResponseHeadersOnly(w)
-}
-
-// DeleteBucketHandler - Delete bucket
-func (api gatewayAPIHandlers) DeleteBucketHandler(w http.ResponseWriter, r *http.Request) {
-	objectAPI := api.ObjectAPI()
-	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
-		return
-	}
-
-	// DeleteBucket does not have any bucket action.
-	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
-		return
-	}
-
-	vars := router.Vars(r)
-	bucket := vars["bucket"]
-
-	// Attempt to delete bucket.
-	if err := objectAPI.DeleteBucket(bucket); err != nil {
-		errorIf(err, "Unable to delete a bucket.")
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	// Write success response.
-	writeSuccessNoContent(w)
-}
-
-// ListObjectsV1Handler - GET Bucket (List Objects) Version 1.
-// --------------------------
-// This implementation of the GET operation returns some or all (up to 1000)
-// of the objects in a bucket. You can use the request parameters as selection
-// criteria to return a subset of the objects in a bucket.
-//
-func (api gatewayAPIHandlers) ListObjectsV1Handler(w http.ResponseWriter, r *http.Request) {
-	vars := router.Vars(r)
-	bucket := vars["bucket"]
-
-	objectAPI := api.ObjectAPI()
-	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
-		return
-	}
-
-	reqAuthType := getRequestAuthType(r)
-
-	switch reqAuthType {
-	case authTypePresignedV2, authTypeSignedV2:
-		// Signature V2 validation.
-		s3Error := isReqAuthenticatedV2(r)
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeSigned, authTypePresigned:
-		s3Error := isReqAuthenticated(r, globalServerConfig.GetRegion())
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeAnonymous:
-		// No verification needed for anonymous requests.
-	default:
-		// For all unknown auth types return error.
-		writeErrorResponse(w, ErrAccessDenied, r.URL)
-		return
-	}
-
-	// Extract all the listObjectsV1 query params to their native
-	// values.  N B We delegate validation of params to respective
-	// gateway backends.
-	prefix, marker, delimiter, maxKeys, _ := getListObjectsV1Args(r.URL.Query())
-
-	// Validate the maxKeys lowerbound. When maxKeys > 1000, S3 returns 1000 but
-	// does not throw an error.
-	if maxKeys < 0 {
-		writeErrorResponse(w, ErrInvalidMaxKeys, r.URL)
-		return
-	}
-
-	listObjects := objectAPI.ListObjects
-	if reqAuthType == authTypeAnonymous {
-		listObjects = objectAPI.AnonListObjects
-	}
-	// Inititate a list objects operation based on the input params.
-	// On success would return back ListObjectsInfo object to be
-	// marshalled into S3 compatible XML header.
-	listObjectsInfo, err := listObjects(bucket, prefix, marker, delimiter, maxKeys)
-	if err != nil {
-		errorIf(err, "Unable to list objects.")
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-	response := generateListObjectsV1Response(bucket, prefix, marker, delimiter, maxKeys, listObjectsInfo)
-	// Write success response.
-	writeSuccessResponseXML(w, encodeResponse(response))
-}
-
-// ListObjectsV2Handler - GET Bucket (List Objects) Version 2.
-// --------------------------
-// This implementation of the GET operation returns some or all (up to 1000)
-// of the objects in a bucket. You can use the request parameters as selection
-// criteria to return a subset of the objects in a bucket.
-//
-// NOTE: It is recommended that this API to be used for application development.
-// Minio continues to support ListObjectsV1 for supporting legacy tools.
-func (api gatewayAPIHandlers) ListObjectsV2Handler(w http.ResponseWriter, r *http.Request) {
-	vars := router.Vars(r)
-	bucket := vars["bucket"]
-
-	objectAPI := api.ObjectAPI()
-	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
-		return
-	}
-
-	reqAuthType := getRequestAuthType(r)
-
-	switch reqAuthType {
-	case authTypePresignedV2, authTypeSignedV2:
-		// Signature V2 validation.
-		s3Error := isReqAuthenticatedV2(r)
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeSigned, authTypePresigned:
-		s3Error := isReqAuthenticated(r, globalServerConfig.GetRegion())
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeAnonymous:
-		// No verification needed for anonymous requests.
-	default:
-		// For all unknown auth types return error.
-		writeErrorResponse(w, ErrAccessDenied, r.URL)
-		return
-	}
-
-	// Extract all the listObjectsV2 query params to their native values.
-	prefix, token, startAfter, delimiter, fetchOwner, maxKeys, _ := getListObjectsV2Args(r.URL.Query())
-
-	// In ListObjectsV2 'continuation-token' is the marker.
-	marker := token
-	// Check if 'continuation-token' is empty.
-	if token == "" {
-		// Then we need to use 'start-after' as marker instead.
-		marker = startAfter
-	}
-
-	listObjectsV2 := objectAPI.ListObjectsV2
-	if reqAuthType == authTypeAnonymous {
-		listObjectsV2 = objectAPI.AnonListObjectsV2
-	}
-
-	// Validate the query params before beginning to serve the request.
-	// fetch-owner is not validated since it is a boolean
-	if s3Error := validateGatewayListObjectsV2Args(prefix, marker, delimiter, maxKeys); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
-		return
-	}
-	// Inititate a list objects operation based on the input params.
-	// On success would return back ListObjectsV2Info object to be
-	// serialized as XML and sent as S3 compatible response body.
-	listObjectsV2Info, err := listObjectsV2(bucket, prefix, token, delimiter, maxKeys, fetchOwner, startAfter)
-	if err != nil {
-		errorIf(err, "Unable to list objects. Args to listObjectsV2 are bucket=%s, prefix=%s, token=%s, delimiter=%s", bucket, prefix, token, delimiter)
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	response := generateListObjectsV2Response(bucket, prefix, token, listObjectsV2Info.NextContinuationToken, startAfter, delimiter, fetchOwner, listObjectsV2Info.IsTruncated, maxKeys, listObjectsV2Info.Objects, listObjectsV2Info.Prefixes)
-	// Write success response.
-	writeSuccessResponseXML(w, encodeResponse(response))
-}
-
-// HeadBucketHandler - HEAD Bucket
-// ----------
-// This operation is useful to determine if a bucket exists.
-// The operation returns a 200 OK if the bucket exists and you
-// have permission to access it. Otherwise, the operation might
-// return responses such as 404 Not Found and 403 Forbidden.
-func (api gatewayAPIHandlers) HeadBucketHandler(w http.ResponseWriter, r *http.Request) {
-	vars := router.Vars(r)
-	bucket := vars["bucket"]
-
-	objectAPI := api.ObjectAPI()
-	if objectAPI == nil {
-		writeErrorResponseHeadersOnly(w, ErrServerNotInitialized)
-		return
-	}
-
-	reqAuthType := getRequestAuthType(r)
-
-	switch reqAuthType {
-	case authTypePresignedV2, authTypeSignedV2:
-		// Signature V2 validation.
-		s3Error := isReqAuthenticatedV2(r)
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeSigned, authTypePresigned:
-		s3Error := isReqAuthenticated(r, globalServerConfig.GetRegion())
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeAnonymous:
-		// No verification needed for anonymous requests.
-	default:
-		// For all unknown auth types return error.
-		writeErrorResponse(w, ErrAccessDenied, r.URL)
-		return
-	}
-
-	getBucketInfo := objectAPI.GetBucketInfo
-	if reqAuthType == authTypeAnonymous {
-		getBucketInfo = objectAPI.AnonGetBucketInfo
-	}
-
-	if _, err := getBucketInfo(bucket); err != nil {
-		errorIf(err, "Unable to fetch bucket info.")
-		writeErrorResponseHeadersOnly(w, toAPIErrorCode(err))
-		return
-	}
-
-	writeSuccessResponseHeadersOnly(w)
-}
-
-// GetBucketLocationHandler - GET Bucket location.
-// -------------------------
-// This operation returns bucket location.
-func (api gatewayAPIHandlers) GetBucketLocationHandler(w http.ResponseWriter, r *http.Request) {
-	vars := router.Vars(r)
-	bucket := vars["bucket"]
-
-	objectAPI := api.ObjectAPI()
-	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
-		return
-	}
-	reqAuthType := getRequestAuthType(r)
-
-	switch reqAuthType {
-	case authTypePresignedV2, authTypeSignedV2:
-		// Signature V2 validation.
-		s3Error := isReqAuthenticatedV2(r)
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeSigned, authTypePresigned:
-		s3Error := isReqAuthenticated(r, globalMinioDefaultRegion)
-		if s3Error == ErrInvalidRegion {
-			// Clients like boto3 send getBucketLocation() call signed with region that is configured.
-			s3Error = isReqAuthenticated(r, globalServerConfig.GetRegion())
-		}
-		if s3Error != ErrNone {
-			errorIf(errSignatureMismatch, "%s", dumpRequest(r))
-			writeErrorResponse(w, s3Error, r.URL)
-			return
-		}
-	case authTypeAnonymous:
-		// No verification needed for anonymous requests.
-	default:
-		// For all unknown auth types return error.
-		writeErrorResponse(w, ErrAccessDenied, r.URL)
-		return
-	}
-
-	getBucketInfo := objectAPI.GetBucketInfo
-	if reqAuthType == authTypeAnonymous {
-		getBucketInfo = objectAPI.AnonGetBucketInfo
-	}
-
-	if _, err := getBucketInfo(bucket); err != nil {
-		errorIf(err, "Unable to fetch bucket info.")
-		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-		return
-	}
-
-	// Generate response.
-	encodedSuccessResponse := encodeResponse(LocationResponse{})
-	// Get current region.
-	region := globalServerConfig.GetRegion()
-	if region != globalMinioDefaultRegion {
-		encodedSuccessResponse = encodeResponse(LocationResponse{
-			Location: region,
-		})
-	}
-
-	// Write success response.
-	writeSuccessResponseXML(w, encodedSuccessResponse)
-}
@@ -1,5 +1,5 @@
 /*
- * Minio Cloud Storage, (C) 2017 Minio, Inc.
+ * Minio Cloud Storage, (C) 2017, 2018 Minio, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -112,8 +112,15 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 		cli.ShowCommandHelpAndExit(ctx, gatewayName, 1)
 	}

+	// Get "json" flag from command line argument and
+	// enable json and quite modes if jason flag is turned on.
+	jsonFlag := ctx.IsSet("json") || ctx.GlobalIsSet("json")
+	if jsonFlag {
+		log.EnableJSON()
+	}
+
 	// Get quiet flag from command line argument.
-	quietFlag := ctx.Bool("quiet") || ctx.GlobalBool("quiet")
+	quietFlag := ctx.IsSet("quiet") || ctx.GlobalIsSet("quiet")
 	if quietFlag {
 		log.EnableQuiet()
 	}
@@ -164,7 +171,7 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 	if globalIsBrowserEnabled {
 		fatalIf(registerWebRouter(router), "Unable to configure web browser")
 	}
-	registerGatewayAPIRouter(router, newObject)
+	registerAPIRouter(router)

 	var handlerFns = []HandlerFunc{
 		// Validate all the incoming paths.
@@ -17,13 +17,7 @@
 package cmd

 import (
-	"io"
-	"net/http"
-
-	router "github.com/gorilla/mux"
-	"github.com/minio/minio-go/pkg/policy"
 	"github.com/minio/minio/pkg/auth"
-	"github.com/minio/minio/pkg/hash"
 )

 // GatewayMinioSysTmp prefix is used in Azure/GCS gateway for save metadata sent by Initialize Multipart Upload API.
@@ -34,123 +28,9 @@ type Gateway interface {
 	// Name returns the unique name of the gateway.
 	Name() string

-	// NewGatewayLayer returns a new gateway layer.
-	NewGatewayLayer(creds auth.Credentials) (GatewayLayer, error)
+	// NewGatewayLayer returns a new  ObjectLayer.
+	NewGatewayLayer(creds auth.Credentials) (ObjectLayer, error)

 	// Returns true if gateway is ready for production.
 	Production() bool
 }
-
-// GatewayLayer - interface to implement gateway mode.
-type GatewayLayer interface {
-	ObjectLayer
-
-	AnonGetObject(bucket, object string, startOffset int64, length int64, writer io.Writer) (err error)
-	AnonGetObjectInfo(bucket, object string) (objInfo ObjectInfo, err error)
-
-	AnonPutObject(bucket string, object string, data *hash.Reader, metadata map[string]string) (ObjectInfo, error)
-
-	SetBucketPolicies(string, policy.BucketAccessPolicy) error
-	GetBucketPolicies(string) (policy.BucketAccessPolicy, error)
-	DeleteBucketPolicies(string) error
-	AnonListObjects(bucket, prefix, marker, delimiter string, maxKeys int) (result ListObjectsInfo, err error)
-	AnonListObjectsV2(bucket, prefix, continuationToken, delimiter string, maxKeys int, fetchOwner bool, startAfter string) (result ListObjectsV2Info, err error)
-	ListObjectsV2(bucket, prefix, continuationToken, delimiter string, maxKeys int, fetchOwner bool, startAfter string) (result ListObjectsV2Info, err error)
-	AnonGetBucketInfo(bucket string) (bucketInfo BucketInfo, err error)
-}
-
-// Implements and provides http handlers for S3 API.
-// Overrides GetObject HeadObject and Policy related handlers.
-type gatewayAPIHandlers struct {
-	objectAPIHandlers
-	ObjectAPI func() GatewayLayer
-}
-
-// registerAPIRouter - registers S3 compatible APIs.
-func registerGatewayAPIRouter(mux *router.Router, gw GatewayLayer) {
-	// Initialize API.
-	api := gatewayAPIHandlers{
-		ObjectAPI: func() GatewayLayer { return gw },
-		objectAPIHandlers: objectAPIHandlers{
-			ObjectAPI: newObjectLayerFn,
-		},
-	}
-
-	// API Router
-	apiRouter := mux.NewRoute().PathPrefix("/").Subrouter()
-
-	var routers []*router.Router
-	if globalDomainName != "" {
-		routers = append(routers, apiRouter.Host("{bucket:.+}."+globalDomainName).Subrouter())
-	}
-	routers = append(routers, apiRouter.PathPrefix("/{bucket}").Subrouter())
-
-	// Object operations
-	for _, bucket := range routers {
-		/// Object operations
-
-		// HeadObject
-		bucket.Methods("HEAD").Path("/{object:.+}").HandlerFunc(httpTraceAll(api.HeadObjectHandler))
-		// CopyObjectPart
-		bucket.Methods("PUT").Path("/{object:.+}").HeadersRegexp("X-Amz-Copy-Source", ".*?(\\/|%2F).*?").HandlerFunc(httpTraceAll(api.CopyObjectPartHandler)).Queries("partNumber", "{partNumber:[0-9]+}", "uploadId", "{uploadId:.*}")
-		// PutObjectPart
-		bucket.Methods("PUT").Path("/{object:.+}").HandlerFunc(httpTraceHdrs(api.PutObjectPartHandler)).Queries("partNumber", "{partNumber:[0-9]+}", "uploadId", "{uploadId:.*}")
-		// ListObjectPxarts
-		bucket.Methods("GET").Path("/{object:.+}").HandlerFunc(httpTraceAll(api.ListObjectPartsHandler)).Queries("uploadId", "{uploadId:.*}")
-		// CompleteMultipartUpload
-		bucket.Methods("POST").Path("/{object:.+}").HandlerFunc(httpTraceAll(api.CompleteMultipartUploadHandler)).Queries("uploadId", "{uploadId:.*}")
-		// NewMultipartUpload
-		bucket.Methods("POST").Path("/{object:.+}").HandlerFunc(httpTraceAll(api.NewMultipartUploadHandler)).Queries("uploads", "")
-		// AbortMultipartUpload
-		bucket.Methods("DELETE").Path("/{object:.+}").HandlerFunc(httpTraceAll(api.AbortMultipartUploadHandler)).Queries("uploadId", "{uploadId:.*}")
-		// GetObject
-		bucket.Methods("GET").Path("/{object:.+}").HandlerFunc(httpTraceHdrs(api.GetObjectHandler))
-		// CopyObject
-		bucket.Methods("PUT").Path("/{object:.+}").HeadersRegexp("X-Amz-Copy-Source", ".*?(\\/|%2F).*?").HandlerFunc(httpTraceAll(api.CopyObjectHandler))
-		// PutObject
-		bucket.Methods("PUT").Path("/{object:.+}").HandlerFunc(httpTraceHdrs(api.PutObjectHandler))
-		// DeleteObject
-		bucket.Methods("DELETE").Path("/{object:.+}").HandlerFunc(httpTraceAll(api.DeleteObjectHandler))
-
-		/// Bucket operations
-
-		// GetBucketLocation
-		bucket.Methods("GET").HandlerFunc(httpTraceAll(api.GetBucketLocationHandler)).Queries("location", "")
-		// GetBucketPolicy
-		bucket.Methods("GET").HandlerFunc(httpTraceAll(api.GetBucketPolicyHandler)).Queries("policy", "")
-		// GetBucketNotification
-		bucket.Methods("GET").HandlerFunc(httpTraceAll(api.GetBucketNotificationHandler)).Queries("notification", "")
-		// ListenBucketNotification
-		bucket.Methods("GET").HandlerFunc(httpTraceAll(api.ListenBucketNotificationHandler)).Queries("events", "{events:.*}")
-		// ListMultipartUploads
-		bucket.Methods("GET").HandlerFunc(httpTraceAll(api.ListMultipartUploadsHandler)).Queries("uploads", "")
-		// ListObjectsV2
-		bucket.Methods("GET").HandlerFunc(httpTraceAll(api.ListObjectsV2Handler)).Queries("list-type", "2")
-		// ListObjectsV1 (Legacy)
-		bucket.Methods("GET").HandlerFunc(httpTraceAll(api.ListObjectsV1Handler))
-		// PutBucketPolicy
-		bucket.Methods("PUT").HandlerFunc(httpTraceAll(api.PutBucketPolicyHandler)).Queries("policy", "")
-		// PutBucketNotification
-		bucket.Methods("PUT").HandlerFunc(httpTraceAll(api.PutBucketNotificationHandler)).Queries("notification", "")
-		// PutBucket
-		bucket.Methods("PUT").HandlerFunc(httpTraceAll(api.PutBucketHandler))
-		// HeadBucket
-		bucket.Methods("HEAD").HandlerFunc(httpTraceAll(api.HeadBucketHandler))
-		// PostPolicy
-		bucket.Methods("POST").HeadersRegexp("Content-Type", "multipart/form-data*").HandlerFunc(httpTraceAll(api.PostPolicyBucketHandler))
-		// DeleteMultipleObjects
-		bucket.Methods("POST").HandlerFunc(httpTraceAll(api.DeleteMultipleObjectsHandler)).Queries("delete", "")
-		// DeleteBucketPolicy
-		bucket.Methods("DELETE").HandlerFunc(httpTraceAll(api.DeleteBucketPolicyHandler)).Queries("policy", "")
-		// DeleteBucket
-		bucket.Methods("DELETE").HandlerFunc(httpTraceAll(api.DeleteBucketHandler))
-	}
-
-	/// Root operation
-
-	// ListBuckets
-	apiRouter.Methods("GET").Path("/").HandlerFunc(httpTraceAll(api.ListBucketsHandler))
-
-	// If none of the routes match.
-	apiRouter.NotFoundHandler = http.HandlerFunc(httpTraceAll(notFoundHandler))
-}
@@ -53,6 +53,8 @@ func printGatewayCommonMsg(apiEndpoints []string) {
 	log.Println(colorBlue("AccessKey: ") + colorBold(fmt.Sprintf("%s ", cred.AccessKey)))
 	log.Println(colorBlue("SecretKey: ") + colorBold(fmt.Sprintf("%s ", cred.SecretKey)))

-	log.Println(colorBlue("\nBrowser Access:"))
-	log.Println(fmt.Sprintf(getFormatStr(len(apiEndpointStr), 3), apiEndpointStr))
+	if globalIsBrowserEnabled {
+		log.Println(colorBlue("\nBrowser Access:"))
+		log.Println(fmt.Sprintf(getFormatStr(len(apiEndpointStr), 3), apiEndpointStr))
+	}
 }
@@ -17,11 +17,12 @@
 package cmd

 import (
-	"io"
+	"time"

 	"github.com/minio/minio-go/pkg/policy"
 	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/hash"
+	"github.com/minio/minio/pkg/madmin"
 )

 // GatewayUnsupported list of unsupported call stubs for gateway.
@@ -37,8 +38,8 @@ func (a GatewayUnsupported) NewMultipartUpload(bucket string, object string, met
 	return "", errors.Trace(NotImplemented{})
 }

-// CopyObjectPart copy part of object to other bucket and object
-func (a GatewayUnsupported) CopyObjectPart(srcBucket string, srcObject string, destBucket string, destObject string, uploadID string, partID int, startOffset int64, length int64, metadata map[string]string) (pi PartInfo, err error) {
+// CopyObjectPart copy part of object to uploadID for another object
+func (a GatewayUnsupported) CopyObjectPart(srcBucket, srcObject, destBucket, destObject, uploadID string, partID int, startOffset, length int64, srcInfo ObjectInfo) (pi PartInfo, err error) {
 	return pi, errors.Trace(NotImplemented{})
 }

@@ -62,24 +63,29 @@ func (a GatewayUnsupported) CompleteMultipartUpload(bucket string, object string
 	return oi, errors.Trace(NotImplemented{})
 }

-// SetBucketPolicies sets policy on bucket
-func (a GatewayUnsupported) SetBucketPolicies(bucket string, policyInfo policy.BucketAccessPolicy) error {
+// SetBucketPolicy sets policy on bucket
+func (a GatewayUnsupported) SetBucketPolicy(bucket string, policyInfo policy.BucketAccessPolicy) error {
 	return errors.Trace(NotImplemented{})
 }

-// GetBucketPolicies will get policy on bucket
-func (a GatewayUnsupported) GetBucketPolicies(bucket string) (bal policy.BucketAccessPolicy, err error) {
+// GetBucketPolicy will get policy on bucket
+func (a GatewayUnsupported) GetBucketPolicy(bucket string) (bal policy.BucketAccessPolicy, err error) {
 	return bal, errors.Trace(NotImplemented{})
 }

-// DeleteBucketPolicies deletes all policies on bucket
-func (a GatewayUnsupported) DeleteBucketPolicies(bucket string) error {
+// DeleteBucketPolicy deletes all policies on bucket
+func (a GatewayUnsupported) DeleteBucketPolicy(bucket string) error {
 	return errors.Trace(NotImplemented{})
 }

+// HealFormat - Not implemented stub
+func (a GatewayUnsupported) HealFormat(dryRun bool) (madmin.HealResultItem, error) {
+	return madmin.HealResultItem{}, errors.Trace(NotImplemented{})
+}
+
 // HealBucket - Not implemented stub
-func (a GatewayUnsupported) HealBucket(bucket string) error {
-	return errors.Trace(NotImplemented{})
+func (a GatewayUnsupported) HealBucket(bucket string, dryRun bool) ([]madmin.HealResultItem, error) {
+	return nil, errors.Trace(NotImplemented{})
 }

 // ListBucketsHeal - Not implemented stub
@@ -88,8 +94,8 @@ func (a GatewayUnsupported) ListBucketsHeal() (buckets []BucketInfo, err error)
 }

 // HealObject - Not implemented stub
-func (a GatewayUnsupported) HealObject(bucket, object string) (int, int, error) {
-	return 0, 0, errors.Trace(NotImplemented{})
+func (a GatewayUnsupported) HealObject(bucket, object string, dryRun bool) (h madmin.HealResultItem, e error) {
+	return h, errors.Trace(NotImplemented{})
 }

 // ListObjectsV2 - Not implemented stub
@@ -102,47 +108,35 @@ func (a GatewayUnsupported) ListObjectsHeal(bucket, prefix, marker, delimiter st
 	return loi, errors.Trace(NotImplemented{})
 }

-// ListUploadsHeal - Not implemented stub
-func (a GatewayUnsupported) ListUploadsHeal(bucket, prefix, marker, uploadIDMarker,
-	delimiter string, maxUploads int) (lmi ListMultipartsInfo, e error) {
-	return lmi, errors.Trace(NotImplemented{})
+// CopyObject copies a blob from source container to destination container.
+func (a GatewayUnsupported) CopyObject(srcBucket string, srcObject string, destBucket string, destObject string,
+	srcInfo ObjectInfo) (objInfo ObjectInfo, err error) {
+	return objInfo, errors.Trace(NotImplemented{})
 }

-// AnonListObjects - List objects anonymously
-func (a GatewayUnsupported) AnonListObjects(bucket string, prefix string, marker string, delimiter string,
-	maxKeys int) (loi ListObjectsInfo, err error) {
-	return loi, errors.Trace(NotImplemented{})
+// Locking operations
+
+// ListLocks lists namespace locks held in object layer
+func (a GatewayUnsupported) ListLocks(bucket, prefix string, duration time.Duration) ([]VolumeLockInfo, error) {
+	return []VolumeLockInfo{}, errors.Trace(NotImplemented{})
 }

-// AnonListObjectsV2 - List objects in V2 mode, anonymously
-func (a GatewayUnsupported) AnonListObjectsV2(bucket, prefix, continuationToken, delimiter string, maxKeys int,
-	fetchOwner bool, startAfter string) (loi ListObjectsV2Info, err error) {
-	return loi, errors.Trace(NotImplemented{})
-}
-
-// AnonGetBucketInfo - Get bucket metadata anonymously.
-func (a GatewayUnsupported) AnonGetBucketInfo(bucket string) (bi BucketInfo, err error) {
-	return bi, errors.Trace(NotImplemented{})
-}
-
-// AnonPutObject creates a new object anonymously with the incoming data,
-func (a GatewayUnsupported) AnonPutObject(bucket, object string, data *hash.Reader,
-	metadata map[string]string) (ObjectInfo, error) {
-	return ObjectInfo{}, errors.Trace(NotImplemented{})
-}
-
-// AnonGetObject downloads object anonymously.
-func (a GatewayUnsupported) AnonGetObject(bucket, object string, startOffset int64, length int64, writer io.Writer) (err error) {
+// ClearLocks clears namespace locks held in object layer
+func (a GatewayUnsupported) ClearLocks([]VolumeLockInfo) error {
 	return errors.Trace(NotImplemented{})
 }

-// AnonGetObjectInfo returns stat information about an object anonymously.
-func (a GatewayUnsupported) AnonGetObjectInfo(bucket, object string) (objInfo ObjectInfo, err error) {
-	return objInfo, errors.Trace(NotImplemented{})
+// RefreshBucketPolicy refreshes cache policy with what's on disk.
+func (a GatewayUnsupported) RefreshBucketPolicy(bucket string) error {
+	return errors.Trace(NotImplemented{})
 }

-// CopyObject copies a blob from source container to destination container.
-func (a GatewayUnsupported) CopyObject(srcBucket string, srcObject string, destBucket string, destObject string,
-	metadata map[string]string) (objInfo ObjectInfo, err error) {
-	return objInfo, errors.Trace(NotImplemented{})
+// IsNotificationSupported returns whether bucket notification is applicable for this layer.
+func (a GatewayUnsupported) IsNotificationSupported() bool {
+	return false
+}
+
+// IsEncryptionSupported returns whether server side encryption is applicable for this layer.
+func (a GatewayUnsupported) IsEncryptionSupported() bool {
+	return false
 }
@@ -1,322 +0,0 @@
-/*
- * Minio Cloud Storage, (C) 2017 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package azure
-
-import (
-	"encoding/xml"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"net/http"
-	"net/url"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/Azure/azure-sdk-for-go/storage"
-	"github.com/minio/minio/pkg/errors"
-
-	minio "github.com/minio/minio/cmd"
-)
-
-// Copied from github.com/Azure/azure-sdk-for-go/storage/container.go
-func azureListBlobsGetParameters(p storage.ListBlobsParameters) url.Values {
-	out := url.Values{}
-
-	if p.Prefix != "" {
-		out.Set("prefix", p.Prefix)
-	}
-	if p.Delimiter != "" {
-		out.Set("delimiter", p.Delimiter)
-	}
-	if p.Marker != "" {
-		out.Set("marker", p.Marker)
-	}
-	if p.Include != nil {
-		addString := func(datasets []string, include bool, text string) []string {
-			if include {
-				datasets = append(datasets, text)
-			}
-			return datasets
-		}
-
-		include := []string{}
-		include = addString(include, p.Include.Snapshots, "snapshots")
-		include = addString(include, p.Include.Metadata, "metadata")
-		include = addString(include, p.Include.UncommittedBlobs, "uncommittedblobs")
-		include = addString(include, p.Include.Copy, "copy")
-		fullInclude := strings.Join(include, ",")
-		out.Set("include", fullInclude)
-	}
-	if p.MaxResults != 0 {
-		out.Set("maxresults", fmt.Sprintf("%v", p.MaxResults))
-	}
-	if p.Timeout != 0 {
-		out.Set("timeout", fmt.Sprintf("%v", p.Timeout))
-	}
-
-	return out
-}
-
-// Make anonymous HTTP request to azure endpoint.
-func azureAnonRequest(verb, urlStr string, header http.Header) (*http.Response, error) {
-	req, err := http.NewRequest(verb, urlStr, nil)
-	if err != nil {
-		return nil, err
-	}
-	if header != nil {
-		req.Header = header
-	}
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-
-	// 4XX and 5XX are error HTTP codes.
-	if resp.StatusCode >= 400 && resp.StatusCode <= 511 {
-		defer resp.Body.Close()
-		respBody, err := ioutil.ReadAll(resp.Body)
-		if err != nil {
-			return nil, err
-		}
-
-		if len(respBody) == 0 {
-			// no error in response body, might happen in HEAD requests
-			return nil, storage.AzureStorageServiceError{
-				StatusCode: resp.StatusCode,
-				Code:       resp.Status,
-				Message:    "no response body was available for error status code",
-			}
-		}
-		// Response contains Azure storage service error object.
-		var storageErr storage.AzureStorageServiceError
-		if err := xml.Unmarshal(respBody, &storageErr); err != nil {
-			return nil, err
-		}
-		storageErr.StatusCode = resp.StatusCode
-		return nil, storageErr
-	}
-
-	return resp, nil
-}
-
-// AnonGetBucketInfo - Get bucket metadata from azure anonymously.
-func (a *azureObjects) AnonGetBucketInfo(bucket string) (bucketInfo minio.BucketInfo, err error) {
-	blobURL := a.client.GetContainerReference(bucket).GetBlobReference("").GetURL()
-	url, err := url.Parse(blobURL)
-	if err != nil {
-		return bucketInfo, azureToObjectError(errors.Trace(err))
-	}
-	url.RawQuery = "restype=container"
-	resp, err := azureAnonRequest(http.MethodHead, url.String(), nil)
-	if err != nil {
-		return bucketInfo, azureToObjectError(errors.Trace(err), bucket)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return bucketInfo, azureToObjectError(errors.Trace(minio.AnonErrToObjectErr(resp.StatusCode, bucket)), bucket)
-	}
-
-	t, err := time.Parse(time.RFC1123, resp.Header.Get("Last-Modified"))
-	if err != nil {
-		return bucketInfo, errors.Trace(err)
-	}
-
-	return minio.BucketInfo{
-		Name:    bucket,
-		Created: t,
-	}, nil
-}
-
-// AnonGetObject - SendGET request without authentication.
-// This is needed when clients send GET requests on objects that can be downloaded without auth.
-func (a *azureObjects) AnonGetObject(bucket, object string, startOffset int64, length int64, writer io.Writer) (err error) {
-	h := make(http.Header)
-	if length > 0 && startOffset > 0 {
-		h.Add("Range", fmt.Sprintf("bytes=%d-%d", startOffset, startOffset+length-1))
-	} else if startOffset > 0 {
-		h.Add("Range", fmt.Sprintf("bytes=%d-", startOffset))
-	}
-
-	blobURL := a.client.GetContainerReference(bucket).GetBlobReference(object).GetURL()
-	resp, err := azureAnonRequest(http.MethodGet, blobURL, h)
-	if err != nil {
-		return azureToObjectError(errors.Trace(err), bucket, object)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusPartialContent && resp.StatusCode != http.StatusOK {
-		return azureToObjectError(errors.Trace(minio.AnonErrToObjectErr(resp.StatusCode, bucket, object)), bucket, object)
-	}
-
-	_, err = io.Copy(writer, resp.Body)
-	return errors.Trace(err)
-}
-
-// AnonGetObjectInfo - Send HEAD request without authentication and convert the
-// result to ObjectInfo.
-func (a *azureObjects) AnonGetObjectInfo(bucket, object string) (objInfo minio.ObjectInfo, err error) {
-	blobURL := a.client.GetContainerReference(bucket).GetBlobReference(object).GetURL()
-	resp, err := azureAnonRequest(http.MethodHead, blobURL, nil)
-	if err != nil {
-		return objInfo, azureToObjectError(errors.Trace(err), bucket, object)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return objInfo, azureToObjectError(errors.Trace(minio.AnonErrToObjectErr(resp.StatusCode, bucket, object)), bucket, object)
-	}
-
-	var contentLength int64
-	contentLengthStr := resp.Header.Get("Content-Length")
-	if contentLengthStr != "" {
-		contentLength, err = strconv.ParseInt(contentLengthStr, 0, 64)
-		if err != nil {
-			return objInfo, azureToObjectError(errors.Trace(fmt.Errorf("Unexpected error")), bucket, object)
-		}
-	}
-
-	t, err := time.Parse(time.RFC1123, resp.Header.Get("Last-Modified"))
-	if err != nil {
-		return objInfo, errors.Trace(err)
-	}
-
-	objInfo.ModTime = t
-	objInfo.Bucket = bucket
-	objInfo.UserDefined = make(map[string]string)
-	if resp.Header.Get("Content-Encoding") != "" {
-		objInfo.UserDefined["Content-Encoding"] = resp.Header.Get("Content-Encoding")
-	}
-	objInfo.UserDefined["Content-Type"] = resp.Header.Get("Content-Type")
-	objInfo.ETag = resp.Header.Get("Etag")
-	objInfo.ModTime = t
-	objInfo.Name = object
-	objInfo.Size = contentLength
-	return
-}
-
-// AnonListObjects - Use Azure equivalent ListBlobs.
-func (a *azureObjects) AnonListObjects(bucket, prefix, marker, delimiter string, maxKeys int) (result minio.ListObjectsInfo, err error) {
-	params := storage.ListBlobsParameters{
-		Prefix:     prefix,
-		Marker:     marker,
-		Delimiter:  delimiter,
-		MaxResults: uint(maxKeys),
-	}
-
-	q := azureListBlobsGetParameters(params)
-	q.Set("restype", "container")
-	q.Set("comp", "list")
-
-	blobURL := a.client.GetContainerReference(bucket).GetBlobReference("").GetURL()
-	url, err := url.Parse(blobURL)
-	if err != nil {
-		return result, azureToObjectError(errors.Trace(err))
-	}
-	url.RawQuery = q.Encode()
-
-	resp, err := azureAnonRequest(http.MethodGet, url.String(), nil)
-	if err != nil {
-		return result, azureToObjectError(errors.Trace(err))
-	}
-	defer resp.Body.Close()
-
-	var listResp storage.BlobListResponse
-
-	data, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return result, azureToObjectError(errors.Trace(err))
-	}
-	err = xml.Unmarshal(data, &listResp)
-	if err != nil {
-		return result, azureToObjectError(errors.Trace(err))
-	}
-
-	result.IsTruncated = listResp.NextMarker != ""
-	result.NextMarker = listResp.NextMarker
-	for _, object := range listResp.Blobs {
-		result.Objects = append(result.Objects, minio.ObjectInfo{
-			Bucket:          bucket,
-			Name:            object.Name,
-			ModTime:         time.Time(object.Properties.LastModified),
-			Size:            object.Properties.ContentLength,
-			ETag:            object.Properties.Etag,
-			ContentType:     object.Properties.ContentType,
-			ContentEncoding: object.Properties.ContentEncoding,
-		})
-	}
-	result.Prefixes = listResp.BlobPrefixes
-	return result, nil
-}
-
-// AnonListObjectsV2 - List objects in V2 mode, anonymously
-func (a *azureObjects) AnonListObjectsV2(bucket, prefix, continuationToken, delimiter string, maxKeys int, fetchOwner bool, startAfter string) (result minio.ListObjectsV2Info, err error) {
-	params := storage.ListBlobsParameters{
-		Prefix:     prefix,
-		Marker:     continuationToken,
-		Delimiter:  delimiter,
-		MaxResults: uint(maxKeys),
-	}
-
-	q := azureListBlobsGetParameters(params)
-	q.Set("restype", "container")
-	q.Set("comp", "list")
-
-	blobURL := a.client.GetContainerReference(bucket).GetBlobReference("").GetURL()
-	url, err := url.Parse(blobURL)
-	if err != nil {
-		return result, azureToObjectError(errors.Trace(err))
-	}
-	url.RawQuery = q.Encode()
-
-	resp, err := http.Get(url.String())
-	if err != nil {
-		return result, azureToObjectError(errors.Trace(err))
-	}
-	defer resp.Body.Close()
-
-	var listResp storage.BlobListResponse
-
-	data, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return result, azureToObjectError(errors.Trace(err))
-	}
-	err = xml.Unmarshal(data, &listResp)
-	if err != nil {
-		return result, azureToObjectError(errors.Trace(err))
-	}
-
-	// If NextMarker is not empty, this means response is truncated and NextContinuationToken should be set
-	if listResp.NextMarker != "" {
-		result.IsTruncated = true
-		result.NextContinuationToken = listResp.NextMarker
-	}
-	for _, object := range listResp.Blobs {
-		result.Objects = append(result.Objects, minio.ObjectInfo{
-			Bucket:          bucket,
-			Name:            object.Name,
-			ModTime:         time.Time(object.Properties.LastModified),
-			Size:            object.Properties.ContentLength,
-			ETag:            minio.CanonicalizeETag(object.Properties.Etag),
-			ContentType:     object.Properties.ContentType,
-			ContentEncoding: object.Properties.ContentEncoding,
-		})
-	}
-	result.Prefixes = listResp.BlobPrefixes
-	return result, nil
-}
--- a/Show More
+++ b/Show More