fix: introduce isLeafDir in healing to fix the crash (#5920)

This PR also supports healing directories.

Fixes #5917

.travis.yml

@@ -31,4 +31,4 @@ after_success:
 - bash <(curl -s https://codecov.io/bash)
 
 go:
-- 1.9.4
+- '1.10.1'

Dockerfile

@@ -1,6 +1,6 @@
-FROM golang:1.9.4-alpine3.6
+FROM golang:1.10.1-alpine3.7
 
-MAINTAINER Minio Inc <dev@minio.io>
+LABEL maintainer="Minio Inc <dev@minio.io>"
 
 ENV GOPATH /go
 ENV PATH $PATH:$GOPATH/bin

Dockerfile.dev

@@ -1,6 +1,6 @@
-FROM golang:1.9.4-alpine3.6
+FROM golang:1.10.1-alpine3.7
 
-MAINTAINER Minio Inc <dev@minio.io>
+LABEL maintainer="Minio Inc <dev@minio.io>"
 
 ENV GOPATH /go
 ENV PATH $PATH:$GOPATH/bin

Dockerfile.release

@@ -1,7 +1,7 @@
-FROM alpine:3.6
+FROM alpine:3.7
+
+LABEL maintainer="Minio Inc <dev@minio.io>"
 
-MAINTAINER Minio Inc <dev@minio.io>
- 
 COPY dockerscripts/docker-entrypoint.sh dockerscripts/healthcheck.sh /usr/bin/
 
 ENV MINIO_UPDATE off
@@ -27,4 +27,3 @@ HEALTHCHECK --interval=30s --timeout=5s \
     CMD /usr/bin/healthcheck.sh
 
 CMD ["minio"]
-

README.md

@@ -138,7 +138,7 @@ firewall-cmd --reload
 ## Test using Minio Browser
 Minio Server comes with an embedded web based object browser. Point your web browser to http://127.0.0.1:9000 ensure your server has started successfully.
 
-![Screenshot](https://github.com/minio/minio/blob/master/docs/screenshots/minio-browser.jpg?raw=true)
+![Screenshot](https://github.com/minio/minio/blob/master/docs/screenshots/minio-browser.png?raw=true)
 
 ## Test using Minio Client `mc`
 `mc` provides a modern alternative to UNIX commands like ls, cat, cp, mirror, diff etc. It supports filesystems and Amazon S3 compatible cloud storage services. Follow the Minio Client [Quickstart Guide](https://docs.minio.io/docs/minio-client-quickstart-guide) for further instructions.

README_zh_CN.md

@@ -84,7 +84,7 @@ go get -u github.com/minio/minio
 ## 使用Minio浏览器进行验证
 安装后使用浏览器访问[http://127.0.0.1:9000](http://127.0.0.1:9000)，如果可以访问，则表示minio已经安装成功。
 
-![Screenshot](https://github.com/minio/minio/blob/master/docs/screenshots/minio-browser.jpg?raw=true)
+![Screenshot](https://github.com/minio/minio/blob/master/docs/screenshots/minio-browser.png?raw=true)
 
 ## 使用Minio客户端 `mc`进行验证
 `mc` 提供了一些UNIX常用命令的替代品，像ls, cat, cp, mirror, diff这些。 它支持文件系统和亚马逊S3云存储服务。 更多信息请参考 [mc快速入门](https://docs.minio.io/docs/minio-client-quickstart-guide) 。

appveyor.yml

@@ -12,7 +12,7 @@ clone_folder: c:\gopath\src\github.com\minio\minio
 # Environment variables
 environment:
   GOPATH: c:\gopath
-  GOROOT: c:\go19
+  GOROOT: c:\go
 
 # scripts that run after cloning repository
 install:

browser/app/less/inc/form.less

@@ -87,6 +87,7 @@ select.form-control {
     z-index: 1;
     border-bottom: 1px solid #eee;
     color: #32393F;
+    box-shadow: none;
     font-size: 13px;
 
 

buildscripts/checkdeps.sh

@@ -21,7 +21,7 @@ _init() {
 
     ## Minimum required versions for build dependencies
     GIT_VERSION="1.0"
-    GO_VERSION="1.9.4"
+    GO_VERSION="1.10.1"
     OSX_VERSION="10.8"
     KNAME=$(uname -s)
     ARCH=$(uname -m)

cmd/acl-handlers.go

@@ -0,0 +1,141 @@
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"encoding/xml"
+	"net/http"
+
+	"github.com/gorilla/mux"
+	"github.com/minio/minio/pkg/policy"
+)
+
+// Data types used for returning dummy access control
+// policy XML, these variables shouldn't be used elsewhere
+// they are only defined to be used in this file alone.
+type grantee struct {
+	XMLNS       string `xml:"xmlns:xsi,attr"`
+	XMLXSI      string `xml:"xsi:type,attr"`
+	Type        string `xml:"Type"`
+	ID          string `xml:"ID,omitempty"`
+	DisplayName string `xml:"DisplayName,omitempty"`
+	URI         string `xml:"URI,omitempty"`
+}
+
+type grant struct {
+	Grantee    grantee `xml:"Grantee"`
+	Permission string  `xml:"Permission"`
+}
+
+type accessControlPolicy struct {
+	XMLName           xml.Name `xml:"AccessControlPolicy"`
+	Owner             Owner    `xml:"Owner"`
+	AccessControlList struct {
+		Grants []grant `xml:"Grant"`
+	} `xml:"AccessControlList"`
+}
+
+// GetBucketACLHandler - GET Bucket ACL
+// -----------------
+// This operation uses the ACL
+// subresource to return the ACL of a specified bucket.
+func (api objectAPIHandlers) GetBucketACLHandler(w http.ResponseWriter, r *http.Request) {
+	ctx := newContext(r, "GetBucketACL")
+
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+
+	objAPI := api.ObjectAPI()
+	if objAPI == nil {
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		return
+	}
+
+	// Allow getBucketACL if policy action is set, since this is a dummy call
+	// we are simply re-purposing the bucketPolicyAction.
+	if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketPolicyAction, bucket, ""); s3Error != ErrNone {
+		writeErrorResponse(w, s3Error, r.URL)
+		return
+	}
+
+	// Before proceeding validate if bucket exists.
+	_, err := objAPI.GetBucketInfo(ctx, bucket)
+	if err != nil {
+		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+		return
+	}
+
+	acl := &accessControlPolicy{}
+	acl.AccessControlList.Grants = append(acl.AccessControlList.Grants, grant{
+		Grantee: grantee{
+			Type: "CanonicalUser",
+		},
+		Permission: "FULL_CONTROL",
+	})
+	if err := xml.NewEncoder(w).Encode(acl); err != nil {
+		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+		return
+	}
+
+	w.(http.Flusher).Flush()
+}
+
+// GetObjectACLHandler - GET Object ACL
+// -----------------
+// This operation uses the ACL
+// subresource to return the ACL of a specified object.
+func (api objectAPIHandlers) GetObjectACLHandler(w http.ResponseWriter, r *http.Request) {
+	ctx := newContext(r, "GetObjectACL")
+
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+	object := vars["object"]
+
+	objAPI := api.ObjectAPI()
+	if objAPI == nil {
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		return
+	}
+
+	// Allow getObjectACL if policy action is set, since this is a dummy call
+	// we are simply re-purposing the bucketPolicyAction.
+	if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketPolicyAction, bucket, ""); s3Error != ErrNone {
+		writeErrorResponse(w, s3Error, r.URL)
+		return
+	}
+
+	// Before proceeding validate if object exists.
+	_, err := objAPI.GetObjectInfo(ctx, bucket, object)
+	if err != nil {
+		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+		return
+	}
+
+	acl := &accessControlPolicy{}
+	acl.AccessControlList.Grants = append(acl.AccessControlList.Grants, grant{
+		Grantee: grantee{
+			Type: "CanonicalUser",
+		},
+		Permission: "FULL_CONTROL",
+	})
+	if err := xml.NewEncoder(w).Encode(acl); err != nil {
+		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+		return
+	}
+
+	w.(http.Flusher).Flush()
+}

cmd/admin-handlers.go

@@ -18,7 +18,9 @@ package cmd
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -27,9 +29,11 @@ import (
 	"time"
 
 	"github.com/gorilla/mux"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/handlers"
 	"github.com/minio/minio/pkg/madmin"
+	"github.com/minio/minio/pkg/quick"
 )
 
 const (
@@ -71,7 +75,7 @@ func (a adminAPIHandlers) VersionHandler(w http.ResponseWriter, r *http.Request)
 	jsonBytes, err := json.Marshal(adminAPIVersionInfo)
 	if err != nil {
 		writeErrorResponseJSON(w, ErrInternalError, r.URL)
-		errorIf(err, "Failed to marshal Admin API Version to JSON.")
+		logger.LogIf(context.Background(), err)
 		return
 	}
 
@@ -99,7 +103,7 @@ func (a adminAPIHandlers) ServiceStatusHandler(w http.ResponseWriter, r *http.Re
 	uptime, err := getPeerUptimes(globalAdminPeers)
 	if err != nil {
 		writeErrorResponseJSON(w, toAPIErrorCode(err), r.URL)
-		errorIf(err, "Possibly failed to get uptime from majority of servers.")
+		logger.LogIf(context.Background(), err)
 		return
 	}
 
@@ -113,7 +117,7 @@ func (a adminAPIHandlers) ServiceStatusHandler(w http.ResponseWriter, r *http.Re
 	jsonBytes, err := json.Marshal(serverStatus)
 	if err != nil {
 		writeErrorResponseJSON(w, ErrInternalError, r.URL)
-		errorIf(err, "Failed to marshal storage info into json.")
+		logger.LogIf(context.Background(), err)
 		return
 	}
 	// Reply with storage information (across nodes in a
@@ -136,7 +140,7 @@ func (a adminAPIHandlers) ServiceStopNRestartHandler(w http.ResponseWriter, r *h
 	var sa madmin.ServiceAction
 	err := json.NewDecoder(r.Body).Decode(&sa)
 	if err != nil {
-		errorIf(err, "Error parsing body JSON")
+		logger.LogIf(context.Background(), err)
 		writeErrorResponseJSON(w, ErrRequestBodyParse, r.URL)
 		return
 	}
@@ -149,7 +153,7 @@ func (a adminAPIHandlers) ServiceStopNRestartHandler(w http.ResponseWriter, r *h
 		serviceSig = serviceStop
 	default:
 		writeErrorResponseJSON(w, ErrMalformedPOSTRequest, r.URL)
-		errorIf(err, "Invalid service action received")
+		logger.LogIf(context.Background(), errors.New("Invalid service action received"))
 		return
 	}
 
@@ -243,7 +247,9 @@ func (a adminAPIHandlers) ServerInfoHandler(w http.ResponseWriter, r *http.Reque
 
 			serverInfoData, err := peer.cmdRunner.ServerInfoData()
 			if err != nil {
-				errorIf(err, "Unable to get server info from %s.", peer.addr)
+				reqInfo := (&logger.ReqInfo{}).AppendTags("peerAddress", peer.addr)
+				ctx := logger.SetReqInfo(context.Background(), reqInfo)
+				logger.LogIf(ctx, err)
 				reply[idx].Error = err.Error()
 				return
 			}
@@ -258,7 +264,7 @@ func (a adminAPIHandlers) ServerInfoHandler(w http.ResponseWriter, r *http.Reque
 	jsonBytes, err := json.Marshal(reply)
 	if err != nil {
 		writeErrorResponseJSON(w, ErrInternalError, r.URL)
-		errorIf(err, "Failed to marshal storage info into json.")
+		logger.LogIf(context.Background(), err)
 		return
 	}
 
@@ -292,7 +298,7 @@ func validateLockQueryParams(vars url.Values) (string, string, time.Duration,
 	}
 	duration, err := time.ParseDuration(olderThanStr)
 	if err != nil {
-		errorIf(err, "Failed to parse duration passed as query value.")
+		logger.LogIf(context.Background(), err)
 		return "", "", time.Duration(0), ErrInvalidDuration
 	}
 
@@ -325,7 +331,7 @@ func (a adminAPIHandlers) ListLocksHandler(w http.ResponseWriter, r *http.Reques
 		duration)
 	if err != nil {
 		writeErrorResponseJSON(w, ErrInternalError, r.URL)
-		errorIf(err, "Failed to fetch lock information from remote nodes.")
+		logger.LogIf(context.Background(), err)
 		return
 	}
 
@@ -333,7 +339,7 @@ func (a adminAPIHandlers) ListLocksHandler(w http.ResponseWriter, r *http.Reques
 	jsonBytes, err := json.Marshal(volLocks)
 	if err != nil {
 		writeErrorResponseJSON(w, ErrInternalError, r.URL)
-		errorIf(err, "Failed to marshal lock information into json.")
+		logger.LogIf(context.Background(), err)
 		return
 	}
 
@@ -350,6 +356,13 @@ func (a adminAPIHandlers) ListLocksHandler(w http.ResponseWriter, r *http.Reques
 func (a adminAPIHandlers) ClearLocksHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, "ClearLocks")
 
+	// Get object layer instance.
+	objLayer := newObjectLayerFn()
+	if objLayer == nil {
+		writeErrorResponseJSON(w, ErrServerNotInitialized, r.URL)
+		return
+	}
+
 	adminAPIErr := checkAdminRequestAuthType(r, globalServerConfig.GetRegion())
 	if adminAPIErr != ErrNone {
 		writeErrorResponseJSON(w, adminAPIErr, r.URL)
@@ -369,7 +382,7 @@ func (a adminAPIHandlers) ClearLocksHandler(w http.ResponseWriter, r *http.Reque
 		duration)
 	if err != nil {
 		writeErrorResponseJSON(w, ErrInternalError, r.URL)
-		errorIf(err, "Failed to fetch lock information from remote nodes.")
+		logger.LogIf(ctx, err)
 		return
 	}
 
@@ -377,11 +390,11 @@ func (a adminAPIHandlers) ClearLocksHandler(w http.ResponseWriter, r *http.Reque
 	jsonBytes, err := json.Marshal(volLocks)
 	if err != nil {
 		writeErrorResponseJSON(w, ErrInternalError, r.URL)
-		errorIf(err, "Failed to marshal lock information into json.")
+		logger.LogIf(ctx, err)
 		return
 	}
 
-	newObjectLayerFn().ClearLocks(ctx, volLocks)
+	objLayer.ClearLocks(ctx, volLocks)
 
 	// Reply with list of locks cleared, as json.
 	writeSuccessResponseJSON(w, jsonBytes)
@@ -425,7 +438,7 @@ func extractHealInitParams(r *http.Request) (bucket, objPrefix string,
 	if clientToken == "" {
 		jerr := json.NewDecoder(r.Body).Decode(&hs)
 		if jerr != nil {
-			errorIf(jerr, "Error parsing body JSON")
+			logger.LogIf(context.Background(), jerr)
 			err = ErrRequestBodyParse
 			return
 		}
@@ -487,6 +500,7 @@ func (a adminAPIHandlers) HealHandler(w http.ResponseWriter, r *http.Request) {
 	// after 10s unless a response item comes in
 	keepConnLive := func(w http.ResponseWriter, respCh chan healResp) {
 		ticker := time.NewTicker(time.Second * 10)
+		defer ticker.Stop()
 		started := false
 	forLoop:
 		for {
@@ -515,7 +529,6 @@ func (a adminAPIHandlers) HealHandler(w http.ResponseWriter, r *http.Request) {
 				break forLoop
 			}
 		}
-		ticker.Stop()
 	}
 
 	// find number of disks in the setup
@@ -555,7 +568,6 @@ func (a adminAPIHandlers) HealHandler(w http.ResponseWriter, r *http.Request) {
 // GetConfigHandler - GET /minio/admin/v1/config
 // Get config.json of this minio setup.
 func (a adminAPIHandlers) GetConfigHandler(w http.ResponseWriter, r *http.Request) {
-
 	// Validate request signature.
 	adminAPIErr := checkAdminRequestAuthType(r, globalServerConfig.GetRegion())
 	if adminAPIErr != ErrNone {
@@ -563,12 +575,6 @@ func (a adminAPIHandlers) GetConfigHandler(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	// check if objectLayer is initialized, if not return.
-	if newObjectLayerFn() == nil {
-		writeErrorResponseJSON(w, ErrServerNotInitialized, r.URL)
-		return
-	}
-
 	// Take a read lock on minio/config.json. NB minio is a
 	// reserved bucket name and wouldn't conflict with normal
 	// object operations.
@@ -583,7 +589,7 @@ func (a adminAPIHandlers) GetConfigHandler(w http.ResponseWriter, r *http.Reques
 	// occurring on a quorum of the servers is returned.
 	configBytes, err := getPeerConfig(globalAdminPeers)
 	if err != nil {
-		errorIf(err, "Failed to get config from peers")
+		logger.LogIf(context.Background(), err)
 		writeErrorResponseJSON(w, toAdminAPIErrCode(err), r.URL)
 		return
 	}
@@ -655,6 +661,7 @@ func writeSetConfigResponse(w http.ResponseWriter, peers adminPeers,
 // SetConfigHandler - PUT /minio/admin/v1/config
 func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Request) {
 
+	ctx := context.Background()
 	// Get current object layer instance.
 	objectAPI := newObjectLayerFn()
 	if objectAPI == nil {
@@ -678,7 +685,7 @@ func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Reques
 		return
 	}
 	if err != io.ErrUnexpectedEOF {
-		errorIf(err, "Failed to read config from request body.")
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -687,8 +694,8 @@ func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Reques
 
 	// Validate JSON provided in the request body: check the
 	// client has not sent JSON objects with duplicate keys.
-	if err = checkDupJSONKeys(string(configBytes)); err != nil {
-		errorIf(err, "config contains duplicate JSON entries.")
+	if err = quick.CheckDuplicateKeys(string(configBytes)); err != nil {
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, ErrAdminConfigBadJSON, r.URL)
 		return
 	}
@@ -696,7 +703,7 @@ func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Reques
 	var config serverConfig
 	err = json.Unmarshal(configBytes, &config)
 	if err != nil {
-		errorIf(err, "Failed to unmarshal JSON configuration", err)
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -718,7 +725,7 @@ func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Reques
 	errs := writeTmpConfigPeers(globalAdminPeers, tmpFileName, configBytes)
 
 	// Check if the operation succeeded in quorum or more nodes.
-	rErr := reduceWriteQuorumErrs(errs, nil, len(globalAdminPeers)/2+1)
+	rErr := reduceWriteQuorumErrs(ctx, errs, nil, len(globalAdminPeers)/2+1)
 	if rErr != nil {
 		writeSetConfigResponse(w, globalAdminPeers, errs, false, r.URL)
 		return
@@ -736,7 +743,7 @@ func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Reques
 
 	// Rename the temporary config file to config.json
 	errs = commitConfigPeers(globalAdminPeers, tmpFileName)
-	rErr = reduceWriteQuorumErrs(errs, nil, len(globalAdminPeers)/2+1)
+	rErr = reduceWriteQuorumErrs(ctx, errs, nil, len(globalAdminPeers)/2+1)
 	if rErr != nil {
 		writeSetConfigResponse(w, globalAdminPeers, errs, false, r.URL)
 		return
@@ -777,7 +784,7 @@ func (a adminAPIHandlers) UpdateCredentialsHandler(w http.ResponseWriter,
 	var req madmin.SetCredsReq
 	err := json.NewDecoder(r.Body).Decode(&req)
 	if err != nil {
-		errorIf(err, "Error parsing body JSON")
+		logger.LogIf(context.Background(), err)
 		writeErrorResponseJSON(w, ErrRequestBodyParse, r.URL)
 		return
 	}
@@ -804,7 +811,9 @@ func (a adminAPIHandlers) UpdateCredentialsHandler(w http.ResponseWriter,
 	// Notify all other Minio peers to update credentials
 	updateErrs := updateCredsOnPeers(creds)
 	for peer, err := range updateErrs {
-		errorIf(err, "Unable to update credentials on peer %s.", peer)
+		reqInfo := (&logger.ReqInfo{}).AppendTags("peerAddress", peer)
+		ctx := logger.SetReqInfo(context.Background(), reqInfo)
+		logger.LogIf(ctx, err)
 	}
 
 	// Update local credentials in memory.

cmd/admin-handlers_test.go

@@ -31,9 +31,8 @@ import (
 	"testing"
 	"time"
 
-	router "github.com/gorilla/mux"
+	"github.com/gorilla/mux"
 	"github.com/minio/minio/pkg/auth"
-	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/madmin"
 )
 
@@ -141,7 +140,7 @@ type adminXLTestBed struct {
 	configPath string
 	xlDirs     []string
 	objLayer   ObjectLayer
-	mux        *router.Router
+	router     *mux.Router
 }
 
 // prepareAdminXLTestBed - helper function that setups a single-node
@@ -182,15 +181,18 @@ func prepareAdminXLTestBed() (*adminXLTestBed, error) {
 		return nil, err
 	}
 
+	// Create new policy system.
+	globalPolicySys = NewPolicySys()
+
 	// Setup admin mgmt REST API handlers.
-	adminRouter := router.NewRouter()
+	adminRouter := mux.NewRouter()
 	registerAdminRouter(adminRouter)
 
 	return &adminXLTestBed{
 		configPath: rootPath,
 		xlDirs:     xlDirs,
 		objLayer:   objLayer,
-		mux:        adminRouter,
+		router:     adminRouter,
 	}, nil
 }
 
@@ -264,7 +266,7 @@ func initTestXLObjLayer() (ObjectLayer, []string, error) {
 		return nil, nil, err
 	}
 	endpoints := mustGetNewEndpointList(xlDirs...)
-	format, err := waitForFormatXL(true, endpoints, 1, 16)
+	format, err := waitForFormatXL(context.Background(), true, endpoints, 1, 16)
 	if err != nil {
 		removeRoots(xlDirs)
 		return nil, nil, err
@@ -300,7 +302,7 @@ func TestAdminVersionHandler(t *testing.T) {
 	}
 
 	rec := httptest.NewRecorder()
-	adminTestBed.mux.ServeHTTP(rec, req)
+	adminTestBed.router.ServeHTTP(rec, req)
 	if http.StatusOK != rec.Code {
 		t.Errorf("Unexpected status code - got %d but expected %d",
 			rec.Code, http.StatusOK)
@@ -441,7 +443,7 @@ func testServicesCmdHandler(cmd cmdType, t *testing.T) {
 	globalMinioAddr = "127.0.0.1:9000"
 	initGlobalAdminPeers(mustGetNewEndpointList("http://127.0.0.1:9000/d1"))
 
-	// Setting up a go routine to simulate ServerMux's
+	// Setting up a go routine to simulate ServerRouter's
 	// handleServiceSignals for stop and restart commands.
 	if cmd == restartCmd {
 		go testServiceSignalReceiver(cmd, t)
@@ -460,7 +462,7 @@ func testServicesCmdHandler(cmd cmdType, t *testing.T) {
 	}
 
 	rec := httptest.NewRecorder()
-	adminTestBed.mux.ServeHTTP(rec, req)
+	adminTestBed.router.ServeHTTP(rec, req)
 
 	if cmd == statusCmd {
 		expectedInfo := madmin.ServiceStatus{
@@ -544,7 +546,7 @@ func TestServiceSetCreds(t *testing.T) {
 		rec := httptest.NewRecorder()
 
 		// Execute request
-		adminTestBed.mux.ServeHTTP(rec, req)
+		adminTestBed.router.ServeHTTP(rec, req)
 
 		// Check if the http code response is expected
 		if rec.Code != testCase.ExpectedStatusCode {
@@ -637,7 +639,7 @@ func TestListLocksHandler(t *testing.T) {
 			t.Fatalf("Test %d - Failed to sign list locks request - %v", i+1, err)
 		}
 		rec := httptest.NewRecorder()
-		adminTestBed.mux.ServeHTTP(rec, req)
+		adminTestBed.router.ServeHTTP(rec, req)
 		if test.expectedStatus != rec.Code {
 			t.Errorf("Test %d - Expected HTTP status code %d but received %d", i+1, test.expectedStatus, rec.Code)
 		}
@@ -704,7 +706,7 @@ func TestClearLocksHandler(t *testing.T) {
 			t.Fatalf("Test %d - Failed to sign clear locks request - %v", i+1, err)
 		}
 		rec := httptest.NewRecorder()
-		adminTestBed.mux.ServeHTTP(rec, req)
+		adminTestBed.router.ServeHTTP(rec, req)
 		if test.expectedStatus != rec.Code {
 			t.Errorf("Test %d - Expected HTTP status code %d but received %d", i+1, test.expectedStatus, rec.Code)
 		}
@@ -762,13 +764,13 @@ func buildAdminRequest(queryVal url.Values, method, path string,
 		"/minio/admin/v1"+path+"?"+queryVal.Encode(),
 		contentLength, bodySeeker)
 	if err != nil {
-		return nil, errors.Trace(err)
+		return nil, err
 	}
 
 	cred := globalServerConfig.GetCredential()
 	err = signRequestV4(req, cred.AccessKey, cred.SecretKey)
 	if err != nil {
-		return nil, errors.Trace(err)
+		return nil, err
 	}
 
 	return req, nil
@@ -796,7 +798,7 @@ func TestGetConfigHandler(t *testing.T) {
 	}
 
 	rec := httptest.NewRecorder()
-	adminTestBed.mux.ServeHTTP(rec, req)
+	adminTestBed.router.ServeHTTP(rec, req)
 	if rec.Code != http.StatusOK {
 		t.Errorf("Expected to succeed but failed with %d", rec.Code)
 	}
@@ -830,7 +832,7 @@ func TestSetConfigHandler(t *testing.T) {
 	}
 
 	rec := httptest.NewRecorder()
-	adminTestBed.mux.ServeHTTP(rec, req)
+	adminTestBed.router.ServeHTTP(rec, req)
 	if rec.Code != http.StatusOK {
 		t.Errorf("Expected to succeed but failed with %d", rec.Code)
 	}
@@ -856,7 +858,7 @@ func TestSetConfigHandler(t *testing.T) {
 		}
 
 		rec := httptest.NewRecorder()
-		adminTestBed.mux.ServeHTTP(rec, req)
+		adminTestBed.router.ServeHTTP(rec, req)
 		respBody := string(rec.Body.Bytes())
 		if rec.Code != http.StatusBadRequest ||
 			!strings.Contains(respBody, "Configuration data provided exceeds the allowed maximum of") {
@@ -875,7 +877,7 @@ func TestSetConfigHandler(t *testing.T) {
 		}
 
 		rec := httptest.NewRecorder()
-		adminTestBed.mux.ServeHTTP(rec, req)
+		adminTestBed.router.ServeHTTP(rec, req)
 		respBody := string(rec.Body.Bytes())
 		if rec.Code != http.StatusBadRequest ||
 			!strings.Contains(respBody, "JSON configuration provided has objects with duplicate keys") {
@@ -905,7 +907,7 @@ func TestAdminServerInfo(t *testing.T) {
 	}
 
 	rec := httptest.NewRecorder()
-	adminTestBed.mux.ServeHTTP(rec, req)
+	adminTestBed.router.ServeHTTP(rec, req)
 	if rec.Code != http.StatusOK {
 		t.Errorf("Expected to succeed but failed with %d", rec.Code)
 	}
@@ -1106,7 +1108,7 @@ func collectHealResults(t *testing.T, adminTestBed *adminXLTestBed, bucket,
 		}
 		req := mkHealStatusReq(t, bucket, prefix, clientToken)
 		rec := httptest.NewRecorder()
-		adminTestBed.mux.ServeHTTP(rec, req)
+		adminTestBed.router.ServeHTTP(rec, req)
 		if http.StatusOK != rec.Code {
 			t.Errorf("Unexpected status code - got %d but expected %d",
 				rec.Code, http.StatusOK)
@@ -1152,7 +1154,7 @@ func TestHealStartNStatusHandler(t *testing.T) {
 	{
 		req := mkHealStartReq(t, bucketName, objName, healOpts)
 		rec := httptest.NewRecorder()
-		adminTestBed.mux.ServeHTTP(rec, req)
+		adminTestBed.router.ServeHTTP(rec, req)
 		if http.StatusOK != rec.Code {
 			t.Errorf("Unexpected status code - got %d but expected %d",
 				rec.Code, http.StatusOK)
@@ -1172,7 +1174,7 @@ func TestHealStartNStatusHandler(t *testing.T) {
 		// test with an invalid client token
 		req := mkHealStatusReq(t, bucketName, objName, hss.ClientToken+hss.ClientToken)
 		rec := httptest.NewRecorder()
-		adminTestBed.mux.ServeHTTP(rec, req)
+		adminTestBed.router.ServeHTTP(rec, req)
 		if rec.Code != http.StatusBadRequest {
 			t.Errorf("Unexpected status code")
 		}

cmd/admin-heal-ops.go

@@ -222,7 +222,7 @@ func (ahs *allHealState) LaunchNewHealSequence(h *healSequence) (
 		StartTime:     h.startTime,
 	})
 	if err != nil {
-		errorIf(err, "Failed to marshal heal result into json.")
+		logger.LogIf(context.Background(), err)
 		return nil, ErrInternalError, ""
 	}
 	return b, ErrNone, ""
@@ -270,7 +270,7 @@ func (ahs *allHealState) PopHealStatusJSON(path string,
 
 	jbytes, err := json.Marshal(h.currentStatus)
 	if err != nil {
-		errorIf(err, "Failed to marshal heal result into json.")
+		logger.LogIf(context.Background(), err)
 		return nil, ErrInternalError
 	}
 
@@ -321,7 +321,9 @@ type healSequence struct {
 func newHealSequence(bucket, objPrefix, clientAddr string,
 	numDisks int, hs madmin.HealOpts, forceStart bool) *healSequence {
 
-	ctx := logger.SetContext(context.Background(), &logger.ReqInfo{clientAddr, "", "", "Heal", bucket, objPrefix, nil})
+	reqInfo := &logger.ReqInfo{RemoteHost: clientAddr, API: "Heal", BucketName: bucket}
+	reqInfo.AppendTags("prefix", objPrefix)
+	ctx := logger.SetReqInfo(context.Background(), reqInfo)
 
 	return &healSequence{
 		bucket:        bucket,
@@ -537,11 +539,17 @@ func (h *healSequence) healDiskFormat() error {
 	}
 
 	res, err := objectAPI.HealFormat(h.ctx, h.settings.DryRun)
-	if err != nil {
+	// return any error, ignore error returned when disks have
+	// already healed.
+	if err != nil && err != errNoHealRequired {
 		return errFnHealFromAPIErr(err)
 	}
 
-	peersReInitFormat(globalAdminPeers, h.settings.DryRun)
+	// Healing succeeded notify the peers to reload format and re-initialize disks.
+	// We will not notify peers only if healing succeeded.
+	if err == nil {
+		peersReInitFormat(globalAdminPeers, h.settings.DryRun)
+	}
 
 	// Push format heal result
 	return h.pushHealResultItem(res)

cmd/admin-router.go

@@ -19,7 +19,7 @@ package cmd
 import (
 	"net/http"
 
-	router "github.com/gorilla/mux"
+	"github.com/gorilla/mux"
 )
 
 const (
@@ -31,11 +31,11 @@ type adminAPIHandlers struct {
 }
 
 // registerAdminRouter - Add handler functions for each service REST API routes.
-func registerAdminRouter(mux *router.Router) {
+func registerAdminRouter(router *mux.Router) {
 
 	adminAPI := adminAPIHandlers{}
 	// Admin router
-	adminRouter := mux.NewRoute().PathPrefix(adminAPIPathPrefix).Subrouter()
+	adminRouter := router.PathPrefix(adminAPIPathPrefix).Subrouter()
 
 	// Version handler
 	adminRouter.Methods(http.MethodGet).Path("/version").HandlerFunc(adminAPI.VersionHandler)

cmd/admin-rpc-client.go

@@ -29,7 +29,7 @@ import (
 	"time"
 
 	"github.com/minio/minio-go/pkg/set"
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 )
 
 const (
@@ -84,13 +84,17 @@ func (lc localAdminClient) ReInitFormat(dryRun bool) error {
 	if objectAPI == nil {
 		return errServerNotInitialized
 	}
-	_, err := objectAPI.HealFormat(context.Background(), dryRun)
-	return err
+	return objectAPI.ReloadFormat(context.Background(), dryRun)
 }
 
 // ListLocks - Fetches lock information from local lock instrumentation.
 func (lc localAdminClient) ListLocks(bucket, prefix string, duration time.Duration) ([]VolumeLockInfo, error) {
-	return listLocksInfo(bucket, prefix, duration), nil
+	// check if objectLayer is initialized, if not return.
+	objectAPI := newObjectLayerFn()
+	if objectAPI == nil {
+		return nil, errServerNotInitialized
+	}
+	return objectAPI.ListLocks(context.Background(), bucket, prefix, duration)
 }
 
 func (rc remoteAdminClient) SignalService(s serviceSignal) (err error) {
@@ -201,7 +205,7 @@ func (rc remoteAdminClient) WriteTmpConfig(tmpFileName string, configBytes []byt
 
 	err := rc.Call(writeTmpConfigRPC, &wArgs, &WriteConfigReply{})
 	if err != nil {
-		errorIf(err, "Failed to write temporary config file.")
+		logger.LogIf(context.Background(), err)
 		return err
 	}
 
@@ -215,7 +219,10 @@ func (lc localAdminClient) CommitConfig(tmpFileName string) error {
 	tmpConfigFile := filepath.Join(getConfigDir(), tmpFileName)
 
 	err := os.Rename(tmpConfigFile, configFile)
-	errorIf(err, fmt.Sprintf("Failed to rename %s to %s", tmpConfigFile, configFile))
+	reqInfo := (&logger.ReqInfo{}).AppendTags("tmpConfigFile", tmpConfigFile)
+	reqInfo.AppendTags("configFile", configFile)
+	ctx := logger.SetReqInfo(context.Background(), reqInfo)
+	logger.LogIf(ctx, err)
 	return err
 }
 
@@ -228,7 +235,7 @@ func (rc remoteAdminClient) CommitConfig(tmpFileName string) error {
 	cReply := CommitConfigReply{}
 	err := rc.Call(commitConfigRPC, &cArgs, &cReply)
 	if err != nil {
-		errorIf(err, "Failed to rename config file.")
+		logger.LogIf(context.Background(), err)
 		return err
 	}
 
@@ -436,7 +443,7 @@ func getPeerUptimes(peers adminPeers) (time.Duration, error) {
 	latestUptime := time.Duration(0)
 	for _, uptime := range uptimes {
 		if uptime.err != nil {
-			errorIf(uptime.err, "Unable to fetch uptime")
+			logger.LogIf(context.Background(), uptime.err)
 			continue
 		}
 
@@ -489,15 +496,17 @@ func getPeerConfig(peers adminPeers) ([]byte, error) {
 		// Unmarshal the received config files.
 		err := json.Unmarshal(configBytes, &serverConfigs[i])
 		if err != nil {
-			errorIf(err, "Failed to unmarshal serverConfig from ", peers[i].addr)
+			reqInfo := (&logger.ReqInfo{}).AppendTags("peerAddress", peers[i].addr)
+			ctx := logger.SetReqInfo(context.Background(), reqInfo)
+			logger.LogIf(ctx, err)
 			return nil, err
 		}
 	}
 
 	configJSON, err := getValidServerConfig(serverConfigs, errs)
 	if err != nil {
-		errorIf(err, "Unable to find a valid server config")
-		return nil, errors.Trace(err)
+		logger.LogIf(context.Background(), err)
+		return nil, err
 	}
 
 	// Return the config.json that was present quorum or more

cmd/admin-rpc-server.go

@@ -25,8 +25,8 @@ import (
 	"path/filepath"
 	"time"
 
-	router "github.com/gorilla/mux"
-	"github.com/minio/minio/pkg/errors"
+	"github.com/gorilla/mux"
+	"github.com/minio/minio/cmd/logger"
 )
 
 const adminPath = "/admin"
@@ -94,8 +94,7 @@ func (s *adminCmd) ReInitFormat(args *ReInitFormatArgs, reply *AuthRPCReply) err
 	if objectAPI == nil {
 		return errServerNotInitialized
 	}
-	_, err := objectAPI.HealFormat(context.Background(), args.DryRun)
-	return err
+	return objectAPI.ReloadFormat(context.Background(), args.DryRun)
 }
 
 // ListLocks - lists locks held by requests handled by this server instance.
@@ -103,7 +102,14 @@ func (s *adminCmd) ListLocks(query *ListLocksQuery, reply *ListLocksReply) error
 	if err := query.IsAuthenticated(); err != nil {
 		return err
 	}
-	volLocks := listLocksInfo(query.Bucket, query.Prefix, query.Duration)
+	objectAPI := newObjectLayerFn()
+	if objectAPI == nil {
+		return errServerNotInitialized
+	}
+	volLocks, err := objectAPI.ListLocks(context.Background(), query.Bucket, query.Prefix, query.Duration)
+	if err != nil {
+		return err
+	}
 	*reply = ListLocksReply{VolLocks: volLocks}
 	return nil
 }
@@ -176,7 +182,9 @@ type WriteConfigReply struct {
 func writeTmpConfigCommon(tmpFileName string, configBytes []byte) error {
 	tmpConfigFile := filepath.Join(getConfigDir(), tmpFileName)
 	err := ioutil.WriteFile(tmpConfigFile, configBytes, 0666)
-	errorIf(err, fmt.Sprintf("Failed to write to temporary config file %s", tmpConfigFile))
+	reqInfo := (&logger.ReqInfo{}).AppendTags("tmpConfigFile", tmpConfigFile)
+	ctx := logger.SetReqInfo(context.Background(), reqInfo)
+	logger.LogIf(ctx, err)
 	return err
 }
 
@@ -209,20 +217,24 @@ func (s *adminCmd) CommitConfig(cArgs *CommitConfigArgs, cReply *CommitConfigRep
 	tmpConfigFile := filepath.Join(getConfigDir(), cArgs.FileName)
 
 	err := os.Rename(tmpConfigFile, configFile)
-	errorIf(err, fmt.Sprintf("Failed to rename %s to %s", tmpConfigFile, configFile))
+	reqInfo := (&logger.ReqInfo{}).AppendTags("tmpConfigFile", tmpConfigFile)
+	reqInfo.AppendTags("configFile", configFile)
+	ctx := logger.SetReqInfo(context.Background(), reqInfo)
+	logger.LogIf(ctx, err)
 	return err
 }
 
 // registerAdminRPCRouter - registers RPC methods for service status,
 // stop and restart commands.
-func registerAdminRPCRouter(mux *router.Router) error {
+func registerAdminRPCRouter(router *mux.Router) error {
 	adminRPCHandler := &adminCmd{}
 	adminRPCServer := newRPCServer()
 	err := adminRPCServer.RegisterName("Admin", adminRPCHandler)
 	if err != nil {
-		return errors.Trace(err)
+		logger.LogIf(context.Background(), err)
+		return err
 	}
-	adminRouter := mux.NewRoute().PathPrefix(minioReservedBucketPath).Subrouter()
+	adminRouter := router.PathPrefix(minioReservedBucketPath).Subrouter()
 	adminRouter.Path(adminPath).Handler(adminRPCServer)
 	return nil
 }

cmd/api-errors.go

@@ -22,7 +22,6 @@ import (
 	"net/http"
 
 	"github.com/minio/minio/pkg/auth"
-	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/event"
 	"github.com/minio/minio/pkg/hash"
 )
@@ -138,6 +137,7 @@ const (
 	ErrMissingSSECustomerKey
 	ErrMissingSSECustomerKeyMD5
 	ErrSSECustomerKeyMD5Mismatch
+	ErrInvalidSSECustomerParameters
 
 	// Bucket notification related errors.
 	ErrEventNotification
@@ -629,7 +629,7 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 	},
 	ErrInsecureSSECustomerRequest: {
 		Code:           "InvalidRequest",
-		Description:    errInsecureSSERequest.Error(),
+		Description:    "Requests specifying Server Side Encryption with Customer provided keys must be made over a secure connection.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrSSEMultipartEncrypted: {
@@ -639,7 +639,7 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 	},
 	ErrSSEEncryptedObject: {
 		Code:           "InvalidRequest",
-		Description:    errEncryptedObject.Error(),
+		Description:    "The object was stored using a form of Server Side Encryption. The correct parameters must be provided to retrieve the object.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrInvalidEncryptionParameters: {
@@ -649,27 +649,32 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 	},
 	ErrInvalidSSECustomerAlgorithm: {
 		Code:           "InvalidArgument",
-		Description:    errInvalidSSEAlgorithm.Error(),
+		Description:    "Requests specifying Server Side Encryption with Customer provided keys must provide a valid encryption algorithm.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrInvalidSSECustomerKey: {
 		Code:           "InvalidArgument",
-		Description:    errInvalidSSEKey.Error(),
+		Description:    "The secret key was invalid for the specified algorithm.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrMissingSSECustomerKey: {
 		Code:           "InvalidArgument",
-		Description:    errMissingSSEKey.Error(),
+		Description:    "Requests specifying Server Side Encryption with Customer provided keys must provide an appropriate secret key.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrMissingSSECustomerKeyMD5: {
 		Code:           "InvalidArgument",
-		Description:    errMissingSSEKeyMD5.Error(),
+		Description:    "Requests specifying Server Side Encryption with Customer provided keys must provide the client calculated MD5 of the secret key.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrSSECustomerKeyMD5Mismatch: {
 		Code:           "InvalidArgument",
-		Description:    errSSEKeyMD5Mismatch.Error(),
+		Description:    "The calculated MD5 hash of the key did not match the hash that was provided.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidSSECustomerParameters: {
+		Code:           "InvalidArgument",
+		Description:    "The provided encryption parameters did not match the ones used originally.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 
@@ -793,7 +798,7 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	// Generic Invalid-Request error. Should be used for response errors only for unlikely
-	// corner case errors for which introducing new APIErrorCode is not worth it. errorIf()
+	// corner case errors for which introducing new APIErrorCode is not worth it. LogIf()
 	// should be used to log the error at the source of the error for debugging purposes.
 	ErrInvalidRequest: {
 		Code:           "InvalidRequest",
@@ -847,7 +852,6 @@ func toAPIErrorCode(err error) (apiErr APIErrorCode) {
 		return ErrNone
 	}
 
-	err = errors.Cause(err)
 	// Verify if the underlying error is signature mismatch.
 	switch err {
 	case errSignatureMismatch:
@@ -884,6 +888,8 @@ func toAPIErrorCode(err error) (apiErr APIErrorCode) {
 		return ErrObjectTampered
 	case errEncryptedObject:
 		return ErrSSEEncryptedObject
+	case errInvalidSSEParameters:
+		return ErrInvalidSSECustomerParameters
 	case errSSEKeyMismatch:
 		return ErrAccessDenied // no access without correct key
 	}
@@ -947,8 +953,6 @@ func toAPIErrorCode(err error) (apiErr APIErrorCode) {
 		apiErr = ErrEntityTooSmall
 	case NotImplemented:
 		apiErr = ErrNotImplemented
-	case PolicyNotFound:
-		apiErr = ErrNoSuchBucketPolicy
 	case PartTooBig:
 		apiErr = ErrEntityTooLarge
 	case UnsupportedMetadata:

cmd/api-resources.go

@@ -78,13 +78,3 @@ func getObjectResources(values url.Values) (uploadID string, partNumberMarker, m
 	encodingType = values.Get("encoding-type")
 	return
 }
-
-// Validates filter values
-func validateFilterValues(values []string) (err APIErrorCode) {
-	for _, value := range values {
-		if !IsValidObjectPrefix(value) {
-			return ErrFilterValueInvalid
-		}
-	}
-	return ErrNone
-}

cmd/api-resources_test.go

@@ -18,7 +18,6 @@ package cmd
 
 import (
 	"net/url"
-	"strings"
 	"testing"
 )
 
@@ -189,38 +188,3 @@ func TestGetObjectsResources(t *testing.T) {
 		}
 	}
 }
-
-// Validates if filter values are correct
-func TestValidateFilterValues(t *testing.T) {
-	testCases := []struct {
-		values        []string
-		expectedError APIErrorCode
-	}{
-		{
-			values:        []string{""},
-			expectedError: ErrNone,
-		},
-		{
-			values:        []string{"", "prefix"},
-			expectedError: ErrNone,
-		},
-		{
-			values:        []string{strings.Repeat("a", 1025)},
-			expectedError: ErrFilterValueInvalid,
-		},
-		{
-			values:        []string{"a\\b"},
-			expectedError: ErrFilterValueInvalid,
-		},
-		{
-			values:        []string{string([]byte{0xff, 0xfe, 0xfd})},
-			expectedError: ErrFilterValueInvalid,
-		},
-	}
-
-	for i, testCase := range testCases {
-		if actualError := validateFilterValues(testCase.values); actualError != testCase.expectedError {
-			t.Errorf("Test %d: Expected %d, got %d", i+1, testCase.expectedError, actualError)
-		}
-	}
-}

cmd/api-response.go

@@ -339,7 +339,7 @@ func generateListObjectsV1Response(bucket, prefix, marker, delimiter string, max
 			content.ETag = "\"" + object.ETag + "\""
 		}
 		content.Size = object.Size
-		content.StorageClass = globalMinioDefaultStorageClass
+		content.StorageClass = object.StorageClass
 		content.Owner = owner
 		contents = append(contents, content)
 	}
@@ -385,7 +385,7 @@ func generateListObjectsV2Response(bucket, prefix, token, nextToken, startAfter,
 			content.ETag = "\"" + object.ETag + "\""
 		}
 		content.Size = object.Size
-		content.StorageClass = globalMinioDefaultStorageClass
+		content.StorageClass = object.StorageClass
 		content.Owner = owner
 		contents = append(contents, content)
 	}

cmd/api-router.go

@@ -19,7 +19,8 @@ package cmd
 import (
 	"net/http"
 
-	router "github.com/gorilla/mux"
+	"github.com/gorilla/mux"
+	"github.com/minio/minio/cmd/logger"
 )
 
 // objectAPIHandler implements and provides http handlers for S3 API.
@@ -29,13 +30,13 @@ type objectAPIHandlers struct {
 }
 
 // registerAPIRouter - registers S3 compatible APIs.
-func registerAPIRouter(mux *router.Router) {
+func registerAPIRouter(router *mux.Router) {
 	var err error
 	var cacheConfig = globalServerConfig.GetCacheConfig()
 	if len(cacheConfig.Drives) > 0 {
 		// initialize the new disk cache objects.
 		globalCacheObjectAPI, err = newServerCacheObjects(cacheConfig)
-		fatalIf(err, "Unable to initialize disk caching")
+		logger.FatalIf(err, "Unable to initialize disk caching")
 	}
 
 	// Initialize API.
@@ -45,8 +46,8 @@ func registerAPIRouter(mux *router.Router) {
 	}
 
 	// API Router
-	apiRouter := mux.NewRoute().PathPrefix("/").Subrouter()
-	var routers []*router.Router
+	apiRouter := router.PathPrefix("/").Subrouter()
+	var routers []*mux.Router
 	if globalDomainName != "" {
 		routers = append(routers, apiRouter.Host("{bucket:.+}."+globalDomainName).Subrouter())
 	}
@@ -82,6 +83,10 @@ func registerAPIRouter(mux *router.Router) {
 		bucket.Methods("GET").HandlerFunc(httpTraceAll(api.GetBucketLocationHandler)).Queries("location", "")
 		// GetBucketPolicy
 		bucket.Methods("GET").HandlerFunc(httpTraceAll(api.GetBucketPolicyHandler)).Queries("policy", "")
+
+		// GetBucketACL -- this is a dummy call.
+		bucket.Methods("GET").HandlerFunc(httpTraceAll(api.GetBucketACLHandler)).Queries("acl", "")
+
 		// GetBucketNotification
 		bucket.Methods("GET").HandlerFunc(httpTraceAll(api.GetBucketNotificationHandler)).Queries("notification", "")
 		// ListenBucketNotification

cmd/auth-handler.go

@@ -1,5 +1,5 @@
 /*
- * Minio Cloud Storage, (C) 2015, 2016 Minio, Inc.
+ * Minio Cloud Storage, (C) 2015-2018 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,14 +18,17 @@ package cmd
 
 import (
 	"bytes"
+	"context"
 	"encoding/base64"
 	"encoding/hex"
 	"errors"
+	"io"
 	"io/ioutil"
 	"net/http"
 	"strings"
 
-	"github.com/minio/minio/pkg/handlers"
+	"github.com/minio/minio/cmd/logger"
+	"github.com/minio/minio/pkg/policy"
 )
 
 // Verify if request has JWT.
@@ -114,33 +117,73 @@ func checkAdminRequestAuthType(r *http.Request, region string) APIErrorCode {
 		s3Err = isReqAuthenticated(r, region)
 	}
 	if s3Err != ErrNone {
-		errorIf(errors.New(getAPIError(s3Err).Description), "%s", dumpRequest(r))
+		reqInfo := (&logger.ReqInfo{}).AppendTags("requestHeaders", dumpRequest(r))
+		ctx := logger.SetReqInfo(context.Background(), reqInfo)
+		logger.LogIf(ctx, errors.New(getAPIError(s3Err).Description))
 	}
 	return s3Err
 }
 
-func checkRequestAuthType(r *http.Request, bucket, policyAction, region string) APIErrorCode {
-	reqAuthType := getRequestAuthType(r)
+func checkRequestAuthType(ctx context.Context, r *http.Request, action policy.Action, bucketName, objectName string) APIErrorCode {
+	isOwner := true
+	accountName := globalServerConfig.GetCredential().AccessKey
 
-	switch reqAuthType {
+	switch getRequestAuthType(r) {
+	case authTypeUnknown:
+		return ErrAccessDenied
 	case authTypePresignedV2, authTypeSignedV2:
-		// Signature V2 validation.
-		return isReqAuthenticatedV2(r)
-	case authTypeSigned, authTypePresigned:
-		return isReqAuthenticated(r, region)
-	}
-
-	if reqAuthType == authTypeAnonymous && policyAction != "" {
-		// http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
-		resource, err := getResource(r.URL.Path, r.Host, globalDomainName)
-		if err != nil {
-			return ErrInternalError
+		if errorCode := isReqAuthenticatedV2(r); errorCode != ErrNone {
+			return errorCode
 		}
-		return enforceBucketPolicy(bucket, policyAction, resource,
-			r.Referer(), handlers.GetSourceIP(r), r.URL.Query())
+	case authTypeSigned, authTypePresigned:
+		region := globalServerConfig.GetRegion()
+		switch action {
+		case policy.GetBucketLocationAction, policy.ListAllMyBucketsAction:
+			region = ""
+		}
+
+		if errorCode := isReqAuthenticated(r, region); errorCode != ErrNone {
+			return errorCode
+		}
+	default:
+		isOwner = false
+		accountName = ""
+	}
+
+	// LocationConstraint is valid only for CreateBucketAction.
+	var locationConstraint string
+	if action == policy.CreateBucketAction {
+		// To extract region from XML in request body, get copy of request body.
+		payload, err := ioutil.ReadAll(io.LimitReader(r.Body, maxLocationConstraintSize))
+		if err != nil {
+			logger.LogIf(ctx, err)
+			return ErrMalformedXML
+		}
+
+		// Populate payload to extract location constraint.
+		r.Body = ioutil.NopCloser(bytes.NewReader(payload))
+
+		var s3Error APIErrorCode
+		locationConstraint, s3Error = parseLocationConstraint(r)
+		if s3Error != ErrNone {
+			return s3Error
+		}
+
+		// Populate payload again to handle it in HTTP handler.
+		r.Body = ioutil.NopCloser(bytes.NewReader(payload))
+	}
+
+	if globalPolicySys.IsAllowed(policy.Args{
+		AccountName:     accountName,
+		Action:          action,
+		BucketName:      bucketName,
+		ConditionValues: getConditionValues(r, locationConstraint),
+		IsOwner:         isOwner,
+		ObjectName:      objectName,
+	}) {
+		return ErrNone
 	}
 
-	// By default return ErrAccessDenied
 	return ErrAccessDenied
 }
 
@@ -176,7 +219,7 @@ func isReqAuthenticated(r *http.Request, region string) (s3Error APIErrorCode) {
 
 	payload, err := ioutil.ReadAll(r.Body)
 	if err != nil {
-		errorIf(err, "Unable to read request body for signature verification")
+		logger.LogIf(context.Background(), err)
 		return ErrInternalError
 	}
 

cmd/auth-rpc-client.go

@@ -18,9 +18,9 @@ package cmd
 
 import (
 	"bufio"
+	"context"
 	"crypto/tls"
 	"crypto/x509"
-	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -29,6 +29,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"github.com/minio/minio/cmd/logger"
 )
 
 // Attempt to retry only this many number of times before
@@ -133,6 +135,9 @@ func (authClient *AuthRPCClient) Login() (err error) {
 		}
 
 		if err = rpcClient.Call(loginMethod, &loginArgs, &LoginRPCReply{}); err != nil {
+			// Closing the connection here.
+			rpcClient.Close()
+
 			// gob doesn't provide any typed errors for us to reflect
 			// upon, this is the only way to return proper error.
 			if strings.Contains(err.Error(), "gob: wrong type") {
@@ -192,11 +197,16 @@ func (authClient *AuthRPCClient) Call(serviceMethod string, args interface {
 				}
 			}
 		}
+
 		// gob doesn't provide any typed errors for us to reflect
 		// upon, this is the only way to return proper error.
 		if err != nil && strings.Contains(err.Error(), "gob: wrong type") {
+			// Close the rpc client also when the servers have mismatching rpc versions.
+			authClient.Close()
+
 			err = errRPCAPIVersionUnsupported
 		}
+
 		break
 	}
 	return err
@@ -248,7 +258,7 @@ func rpcDial(serverAddr, serviceEndpoint string, secureConn bool) (netRPCClient
 				Op:   "dial-http",
 				Net:  serverAddr + serviceEndpoint,
 				Addr: nil,
-				Err:  fmt.Errorf("Unable to parse server address <%s>: %s", serverAddr, err),
+				Err:  fmt.Errorf("Unable to parse server address <%s>/<%s>: %s", serverAddr, serviceEndpoint, err),
 			}
 		}
 		// ServerName in tls.Config needs to be specified to support SNI certificates.
@@ -264,7 +274,9 @@ func rpcDial(serverAddr, serviceEndpoint string, secureConn bool) (netRPCClient
 		// Print RPC connection errors that are worthy to display in log.
 		switch err.(type) {
 		case x509.HostnameError:
-			errorIf(err, "Unable to establish secure connection to %s", serverAddr)
+			reqInfo := (&logger.ReqInfo{}).AppendTags("serverAddr", serverAddr)
+			ctx := logger.SetReqInfo(context.Background(), reqInfo)
+			logger.LogIf(ctx, err)
 		}
 
 		return nil, &net.OpError{
@@ -302,7 +314,7 @@ func rpcDial(serverAddr, serviceEndpoint string, secureConn bool) (netRPCClient
 	}
 	if resp.Status != connectSuccessMessage {
 		conn.Close()
-		return nil, errors.New("unexpected HTTP response: " + resp.Status)
+		return nil, fmt.Errorf("Unexpected HTTP response: %s from %s/%s", resp.Status, serverAddr, serviceEndpoint)
 	}
 
 	// Initialize rpc client.

cmd/browser-peer-rpc.go

@@ -17,11 +17,13 @@
 package cmd
 
 import (
+	"context"
 	"fmt"
 	"path"
 	"sync"
 	"time"
 
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
 )
 
@@ -62,7 +64,7 @@ func (br *browserPeerAPIHandlers) SetAuthPeer(args SetAuthPeerArgs, reply *AuthR
 		// Save the current creds when failed to update.
 		globalServerConfig.SetCredential(prevCred)
 
-		errorIf(err, "Unable to update the config with new credentials sent from browser RPC.")
+		logger.LogIf(context.Background(), err)
 		return err
 	}
 

cmd/browser-rpc-router.go

@@ -17,9 +17,10 @@
 package cmd
 
 import (
-	router "github.com/gorilla/mux"
+	"context"
 
-	"github.com/minio/minio/pkg/errors"
+	"github.com/gorilla/mux"
+	"github.com/minio/minio/cmd/logger"
 )
 
 // Set up an RPC endpoint that receives browser related calls. The
@@ -36,16 +37,17 @@ type browserPeerAPIHandlers struct {
 }
 
 // Register RPC router
-func registerBrowserPeerRPCRouter(mux *router.Router) error {
+func registerBrowserPeerRPCRouter(router *mux.Router) error {
 	bpHandlers := &browserPeerAPIHandlers{AuthRPCServer{}}
 
 	bpRPCServer := newRPCServer()
 	err := bpRPCServer.RegisterName("BrowserPeer", bpHandlers)
 	if err != nil {
-		return errors.Trace(err)
+		logger.LogIf(context.Background(), err)
+		return err
 	}
 
-	bpRouter := mux.NewRoute().PathPrefix(minioReservedBucketPath).Subrouter()
+	bpRouter := router.PathPrefix(minioReservedBucketPath).Subrouter()
 	bpRouter.Path(browserPeerPath).Handler(bpRPCServer)
 	return nil
 }

cmd/bucket-handlers-listobjects.go

@@ -20,6 +20,7 @@ import (
 	"net/http"
 
 	"github.com/gorilla/mux"
+	"github.com/minio/minio/pkg/policy"
 )
 
 // Validate all the ListObjects query arguments, returns an APIErrorCode
@@ -64,7 +65,7 @@ func (api objectAPIHandlers) ListObjectsV2Handler(w http.ResponseWriter, r *http
 		return
 	}
 
-	if s3Error := checkRequestAuthType(r, bucket, "s3:ListBucket", globalServerConfig.GetRegion()); s3Error != ErrNone {
+	if s3Error := checkRequestAuthType(ctx, r, policy.ListBucketAction, bucket, ""); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}
@@ -134,7 +135,7 @@ func (api objectAPIHandlers) ListObjectsV1Handler(w http.ResponseWriter, r *http
 		return
 	}
 
-	if s3Error := checkRequestAuthType(r, bucket, "s3:ListBucket", globalServerConfig.GetRegion()); s3Error != ErrNone {
+	if s3Error := checkRequestAuthType(ctx, r, policy.ListBucketAction, bucket, ""); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}

cmd/bucket-handlers.go

@@ -17,7 +17,6 @@
 package cmd
 
 import (
-	"context"
 	"encoding/base64"
 	"encoding/xml"
 	"io"
@@ -26,85 +25,16 @@ import (
 	"net/url"
 	"path"
 	"path/filepath"
-	"reflect"
 	"strings"
 	"sync"
 
-	mux "github.com/gorilla/mux"
-	"github.com/minio/minio-go/pkg/policy"
-	"github.com/minio/minio-go/pkg/set"
-	"github.com/minio/minio/pkg/errors"
+	"github.com/gorilla/mux"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/event"
 	"github.com/minio/minio/pkg/hash"
+	"github.com/minio/minio/pkg/policy"
 )
 
-// http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
-// Enforces bucket policies for a bucket for a given tatusaction.
-func enforceBucketPolicy(bucket, action, resource, referer, sourceIP string, queryParams url.Values) (s3Error APIErrorCode) {
-	// Verify if bucket actually exists
-	objAPI := newObjectLayerFn()
-	if err := checkBucketExist(bucket, objAPI); err != nil {
-		err = errors.Cause(err)
-		switch err.(type) {
-		case BucketNameInvalid:
-			// Return error for invalid bucket name.
-			return ErrInvalidBucketName
-		case BucketNotFound:
-			// For no bucket found we return NoSuchBucket instead.
-			return ErrNoSuchBucket
-		}
-		errorIf(err, "Unable to read bucket policy.")
-		// Return internal error for any other errors so that we can investigate.
-		return ErrInternalError
-	}
-
-	// Fetch bucket policy, if policy is not set return access denied.
-	p, err := objAPI.GetBucketPolicy(context.Background(), bucket)
-	if err != nil {
-		return ErrAccessDenied
-	}
-	if reflect.DeepEqual(p, emptyBucketPolicy) {
-		return ErrAccessDenied
-	}
-
-	// Construct resource in 'arn:aws:s3:::examplebucket/object' format.
-	arn := bucketARNPrefix + strings.TrimSuffix(strings.TrimPrefix(resource, "/"), "/")
-
-	// Get conditions for policy verification.
-	conditionKeyMap := make(policy.ConditionKeyMap)
-	for queryParam := range queryParams {
-		conditionKeyMap[queryParam] = set.CreateStringSet(queryParams.Get(queryParam))
-	}
-
-	// Add request referer to conditionKeyMap if present.
-	if referer != "" {
-		conditionKeyMap["referer"] = set.CreateStringSet(referer)
-	}
-	// Add request source Ip to conditionKeyMap.
-	conditionKeyMap["ip"] = set.CreateStringSet(sourceIP)
-
-	// Validate action, resource and conditions with current policy statements.
-	if !bucketPolicyEvalStatements(action, arn, conditionKeyMap, p.Statements) {
-		return ErrAccessDenied
-	}
-	return ErrNone
-}
-
-// Check if the action is allowed on the bucket/prefix.
-func isBucketActionAllowed(action, bucket, prefix string, objectAPI ObjectLayer) bool {
-	bp, err := objectAPI.GetBucketPolicy(context.Background(), bucket)
-	if err != nil {
-		return false
-	}
-	if reflect.DeepEqual(bp, emptyBucketPolicy) {
-		return false
-	}
-	resource := bucketARNPrefix + path.Join(bucket, prefix)
-	var conditionKeyMap map[string]set.StringSet
-	// Validate action, resource and conditions with current policy statements.
-	return bucketPolicyEvalStatements(action, resource, conditionKeyMap, bp.Statements)
-}
-
 // GetBucketLocationHandler - GET Bucket location.
 // -------------------------
 // This operation returns bucket location.
@@ -120,12 +50,7 @@ func (api objectAPIHandlers) GetBucketLocationHandler(w http.ResponseWriter, r *
 		return
 	}
 
-	s3Error := checkRequestAuthType(r, bucket, "s3:GetBucketLocation", globalMinioDefaultRegion)
-	if s3Error == ErrInvalidRegion {
-		// Clients like boto3 send getBucketLocation() call signed with region that is configured.
-		s3Error = checkRequestAuthType(r, "", "s3:GetBucketLocation", globalServerConfig.GetRegion())
-	}
-	if s3Error != ErrNone {
+	if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketLocationAction, bucket, ""); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}
@@ -179,7 +104,7 @@ func (api objectAPIHandlers) ListMultipartUploadsHandler(w http.ResponseWriter,
 		return
 	}
 
-	if s3Error := checkRequestAuthType(r, bucket, "s3:ListBucketMultipartUploads", globalServerConfig.GetRegion()); s3Error != ErrNone {
+	if s3Error := checkRequestAuthType(ctx, r, policy.ListBucketMultipartUploadsAction, bucket, ""); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}
@@ -227,16 +152,12 @@ func (api objectAPIHandlers) ListBucketsHandler(w http.ResponseWriter, r *http.R
 	if api.CacheAPI() != nil {
 		listBuckets = api.CacheAPI().ListBuckets
 	}
-	// ListBuckets does not have any bucket action.
-	s3Error := checkRequestAuthType(r, "", "", globalMinioDefaultRegion)
-	if s3Error == ErrInvalidRegion {
-		// Clients like boto3 send listBuckets() call signed with region that is configured.
-		s3Error = checkRequestAuthType(r, "", "", globalServerConfig.GetRegion())
-	}
-	if s3Error != ErrNone {
+
+	if s3Error := checkRequestAuthType(ctx, r, policy.ListAllMyBucketsAction, "", ""); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}
+
 	// Invoke the list buckets.
 	bucketsInfo, err := listBuckets(ctx)
 	if err != nil {
@@ -265,12 +186,12 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 		return
 	}
 
-	var authError APIErrorCode
-	if authError = checkRequestAuthType(r, bucket, "s3:DeleteObject", globalServerConfig.GetRegion()); authError != ErrNone {
+	var s3Error APIErrorCode
+	if s3Error = checkRequestAuthType(ctx, r, policy.DeleteObjectAction, bucket, ""); s3Error != ErrNone {
 		// In the event access is denied, a 200 response should still be returned
 		// http://docs.aws.amazon.com/AmazonS3/latest/API/multiobjectdeleteapi.html
-		if authError != ErrAccessDenied {
-			writeErrorResponse(w, authError, r.URL)
+		if s3Error != ErrAccessDenied {
+			writeErrorResponse(w, s3Error, r.URL)
 			return
 		}
 	}
@@ -294,7 +215,7 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 
 	// Read incoming body XML bytes.
 	if _, err := io.ReadFull(r.Body, deleteXMLBytes); err != nil {
-		errorIf(err, "Unable to read HTTP body.")
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, ErrInternalError, r.URL)
 		return
 	}
@@ -302,7 +223,7 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 	// Unmarshal list of keys to be deleted.
 	deleteObjects := &DeleteObjectsRequest{}
 	if err := xml.Unmarshal(deleteXMLBytes, deleteObjects); err != nil {
-		errorIf(err, "Unable to unmarshal delete objects request XML.")
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, ErrMalformedXML, r.URL)
 		return
 	}
@@ -325,7 +246,7 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 			defer wg.Done()
 			// If the request is denied access, each item
 			// should be marked as 'AccessDenied'
-			if authError == ErrAccessDenied {
+			if s3Error == ErrAccessDenied {
 				dErrs[i] = PrefixAccessDenied{
 					Bucket: bucket,
 					Object: obj.ObjectName,
@@ -354,7 +275,7 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 			deletedObjects = append(deletedObjects, object)
 			continue
 		}
-		if _, ok := errors.Cause(err).(ObjectNotFound); ok {
+		if _, ok := err.(ObjectNotFound); ok {
 			// If the object is not found it should be
 			// accounted as deleted as per S3 spec.
 			deletedObjects = append(deletedObjects, object)
@@ -410,16 +331,14 @@ func (api objectAPIHandlers) PutBucketHandler(w http.ResponseWriter, r *http.Req
 		return
 	}
 
-	// PutBucket does not have any bucket action.
-	s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion())
-	if s3Error != ErrNone {
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+
+	if s3Error := checkRequestAuthType(ctx, r, policy.CreateBucketAction, bucket, ""); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}
 
-	vars := mux.Vars(r)
-	bucket := vars["bucket"]
-
 	// Parse incoming location constraint.
 	location, s3Error := parseLocationConstraint(r)
 	if s3Error != ErrNone {
@@ -490,7 +409,7 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	// be loaded in memory, the remaining being put in temporary files.
 	reader, err := r.MultipartReader()
 	if err != nil {
-		errorIf(err, "Unable to initialize multipart reader.")
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL)
 		return
 	}
@@ -498,7 +417,7 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	// Read multipart data and save in memory and in the disk if needed
 	form, err := reader.ReadForm(maxFormMemory)
 	if err != nil {
-		errorIf(err, "Unable to initialize multipart reader.")
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL)
 		return
 	}
@@ -507,9 +426,9 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	defer form.RemoveAll()
 
 	// Extract all form fields
-	fileBody, fileName, fileSize, formValues, err := extractPostPolicyFormValues(form)
+	fileBody, fileName, fileSize, formValues, err := extractPostPolicyFormValues(ctx, form)
 	if err != nil {
-		errorIf(err, "Unable to parse form values.")
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL)
 		return
 	}
@@ -584,16 +503,15 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	}
 
 	// Extract metadata to be saved from received Form.
-	metadata, err := extractMetadataFromHeader(formValues)
+	metadata, err := extractMetadataFromHeader(ctx, formValues)
 	if err != nil {
-		errorIf(err, "found invalid http request header")
 		writeErrorResponse(w, ErrInternalError, r.URL)
 		return
 	}
 
 	hashReader, err := hash.NewReader(fileBody, fileSize, "", "")
 	if err != nil {
-		errorIf(err, "Unable to initialize hashReader.")
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -690,10 +608,11 @@ func (api objectAPIHandlers) HeadBucketHandler(w http.ResponseWriter, r *http.Re
 		return
 	}
 
-	if s3Error := checkRequestAuthType(r, bucket, "s3:ListBucket", globalServerConfig.GetRegion()); s3Error != ErrNone {
+	if s3Error := checkRequestAuthType(ctx, r, policy.ListBucketAction, bucket, ""); s3Error != ErrNone {
 		writeErrorResponseHeadersOnly(w, s3Error)
 		return
 	}
+
 	getBucketInfo := objectAPI.GetBucketInfo
 	if api.CacheAPI() != nil {
 		getBucketInfo = api.CacheAPI().GetBucketInfo
@@ -710,20 +629,20 @@ func (api objectAPIHandlers) HeadBucketHandler(w http.ResponseWriter, r *http.Re
 func (api objectAPIHandlers) DeleteBucketHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, "DeleteBucket")
 
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
 		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
 		return
 	}
 
-	// DeleteBucket does not have any bucket action.
-	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
+	if s3Error := checkRequestAuthType(ctx, r, policy.DeleteBucketAction, bucket, ""); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}
 
-	vars := mux.Vars(r)
-	bucket := vars["bucket"]
 	deleteBucket := objectAPI.DeleteBucket
 	if api.CacheAPI() != nil {
 		deleteBucket = api.CacheAPI().DeleteBucket
@@ -734,14 +653,11 @@ func (api objectAPIHandlers) DeleteBucketHandler(w http.ResponseWriter, r *http.
 		return
 	}
 
-	// Notify all peers (including self) to update in-memory state
-	for addr, err := range globalNotificationSys.UpdateBucketPolicy(bucket) {
-		errorIf(err, "unable to update policy change in remote peer %v", addr)
-	}
-
 	globalNotificationSys.RemoveNotification(bucket)
-	for addr, err := range globalNotificationSys.DeleteBucket(bucket) {
-		errorIf(err, "unable to delete bucket in remote peer %v", addr)
+	globalPolicySys.Remove(bucket)
+	for nerr := range globalNotificationSys.DeleteBucket(bucket) {
+		logger.GetReqInfo(ctx).AppendTags("remotePeer", nerr.Host.Name)
+		logger.LogIf(ctx, nerr.Err)
 	}
 
 	// Write success response.

cmd/bucket-handlers_test.go

@@ -155,7 +155,7 @@ func testGetBucketLocationHandler(obj ObjectLayer, instanceType, bucketName stri
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getReadOnlyBucketStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, obj, "TestGetBucketLocationHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyBucketStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "TestGetBucketLocationHandler", bucketName, "", instanceType, apiRouter, anonReq, getAnonReadOnlyBucketPolicy(bucketName))
 
 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -260,7 +260,7 @@ func testHeadBucketHandler(obj ObjectLayer, instanceType, bucketName string, api
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getReadOnlyBucketStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, obj, "TestHeadBucketHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyBucketStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "TestHeadBucketHandler", bucketName, "", instanceType, apiRouter, anonReq, getAnonReadOnlyBucketPolicy(bucketName))
 
 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -313,7 +313,7 @@ func testListMultipartUploadsHandler(obj ObjectLayer, instanceType, bucketName s
 			maxUploads:         "0",
 			accessKey:          credentials.AccessKey,
 			secretKey:          credentials.SecretKey,
-			expectedRespStatus: http.StatusBadRequest,
+			expectedRespStatus: http.StatusNotFound,
 			shouldPass:         false,
 		},
 		// Test case - 2.
@@ -494,7 +494,7 @@ func testListMultipartUploadsHandler(obj ObjectLayer, instanceType, bucketName s
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getWriteOnlyBucketStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, obj, "TestListMultipartUploadsHandler", bucketName, "", instanceType, apiRouter, anonReq, getWriteOnlyBucketStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "TestListMultipartUploadsHandler", bucketName, "", instanceType, apiRouter, anonReq, getAnonWriteOnlyBucketPolicy(bucketName))
 
 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -592,7 +592,7 @@ func testListBucketsHandler(obj ObjectLayer, instanceType, bucketName string, ap
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getWriteOnlyObjectStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, obj, "ListBucketsHandler", "", "", instanceType, apiRouter, anonReq, getWriteOnlyObjectStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "ListBucketsHandler", "", "", instanceType, apiRouter, anonReq, getAnonWriteOnlyBucketPolicy("*"))
 
 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -793,31 +793,3 @@ func testAPIDeleteMultipleObjectsHandler(obj ObjectLayer, instanceType, bucketNa
 	// `ExecObjectLayerAPINilTest` manages the operation.
 	ExecObjectLayerAPINilTest(t, nilBucket, nilObject, instanceType, apiRouter, nilReq)
 }
-
-func TestIsBucketActionAllowed(t *testing.T) {
-	ExecObjectLayerAPITest(t, testIsBucketActionAllowedHandler, []string{"BucketLocation"})
-}
-
-func testIsBucketActionAllowedHandler(obj ObjectLayer, instanceType, bucketName string, apiRouter http.Handler,
-	credentials auth.Credentials, t *testing.T) {
-
-	testCases := []struct {
-		// input.
-		action              string
-		bucket              string
-		prefix              string
-		isGlobalPoliciesNil bool
-		// flag indicating whether the test should pass.
-		shouldPass bool
-	}{
-		{"s3:GetBucketLocation", "mybucket", "abc", true, false},
-		{"s3:ListObject", "mybucket", "abc", false, false},
-	}
-	for i, testCase := range testCases {
-		isAllowed := isBucketActionAllowed(testCase.action, testCase.bucket, testCase.prefix, obj)
-		if isAllowed != testCase.shouldPass {
-			t.Errorf("Case %d: Expected the response status to be `%t`, but instead found `%t`", i+1, testCase.shouldPass, isAllowed)
-		}
-
-	}
-}

cmd/bucket-notification-handlers.go

@@ -23,10 +23,11 @@ import (
 	"net/http"
 
 	"github.com/gorilla/mux"
-	xerrors "github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/event"
 	"github.com/minio/minio/pkg/event/target"
 	xnet "github.com/minio/minio/pkg/net"
+	"github.com/minio/minio/pkg/policy"
 )
 
 const (
@@ -43,6 +44,9 @@ var errNoSuchNotifications = errors.New("The specified bucket does not have buck
 func (api objectAPIHandlers) GetBucketNotificationHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, "GetBucketNotification")
 
+	vars := mux.Vars(r)
+	bucketName := vars["bucket"]
+
 	objAPI := api.ObjectAPI()
 	if objAPI == nil {
 		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
@@ -53,27 +57,23 @@ func (api objectAPIHandlers) GetBucketNotificationHandler(w http.ResponseWriter,
 		writeErrorResponse(w, ErrNotImplemented, r.URL)
 		return
 	}
-	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
+
+	if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketNotificationAction, bucketName, ""); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}
 
-	vars := mux.Vars(r)
-	bucketName := vars["bucket"]
-
 	_, err := objAPI.GetBucketInfo(ctx, bucketName)
 	if err != nil {
-		errorIf(err, "Unable to find bucket info.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
 
 	// Attempt to successfully load notification config.
-	nConfig, err := readNotificationConfig(objAPI, bucketName)
+	nConfig, err := readNotificationConfig(ctx, objAPI, bucketName)
 	if err != nil {
 		// Ignore errNoSuchNotifications to comply with AWS S3.
-		if xerrors.Cause(err) != errNoSuchNotifications {
-			errorIf(err, "Unable to read notification configuration.")
+		if err != errNoSuchNotifications {
 			writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 			return
 		}
@@ -83,7 +83,7 @@ func (api objectAPIHandlers) GetBucketNotificationHandler(w http.ResponseWriter,
 
 	notificationBytes, err := xml.Marshal(nConfig)
 	if err != nil {
-		errorIf(err, "Unable to marshal notification configuration into XML.", err)
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
@@ -106,14 +106,15 @@ func (api objectAPIHandlers) PutBucketNotificationHandler(w http.ResponseWriter,
 		writeErrorResponse(w, ErrNotImplemented, r.URL)
 		return
 	}
-	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
-		return
-	}
 
 	vars := mux.Vars(r)
 	bucketName := vars["bucket"]
 
+	if s3Error := checkRequestAuthType(ctx, r, policy.PutBucketNotificationAction, bucketName, ""); s3Error != ErrNone {
+		writeErrorResponse(w, s3Error, r.URL)
+		return
+	}
+
 	_, err := objectAPI.GetBucketInfo(ctx, bucketName)
 	if err != nil {
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
@@ -145,8 +146,9 @@ func (api objectAPIHandlers) PutBucketNotificationHandler(w http.ResponseWriter,
 
 	rulesMap := config.ToRulesMap()
 	globalNotificationSys.AddRulesMap(bucketName, rulesMap)
-	for addr, err := range globalNotificationSys.PutBucketNotification(bucketName, rulesMap) {
-		errorIf(err, "unable to put bucket notification to remote peer %v", addr)
+	for nerr := range globalNotificationSys.PutBucketNotification(bucketName, rulesMap) {
+		logger.GetReqInfo(ctx).AppendTags("remotePeer", nerr.Host.Name)
+		logger.LogIf(ctx, nerr.Err)
 	}
 
 	writeSuccessResponseHeadersOnly(w)
@@ -167,14 +169,15 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit
 		writeErrorResponse(w, ErrNotImplemented, r.URL)
 		return
 	}
-	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
-		return
-	}
 
 	vars := mux.Vars(r)
 	bucketName := vars["bucket"]
 
+	if s3Error := checkRequestAuthType(ctx, r, policy.ListenBucketNotificationAction, bucketName, ""); s3Error != ErrNone {
+		writeErrorResponse(w, s3Error, r.URL)
+		return
+	}
+
 	values := r.URL.Query()
 
 	var prefix string
@@ -217,39 +220,48 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit
 	}
 
 	if _, err := objAPI.GetBucketInfo(ctx, bucketName); err != nil {
-		errorIf(err, "Unable to get bucket info.")
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
 
-	host := xnet.MustParseHost(r.RemoteAddr)
-	target := target.NewHTTPClientTarget(*host, w)
+	host, e := xnet.ParseHost(r.RemoteAddr)
+	logger.CriticalIf(ctx, e)
+
+	target, e := target.NewHTTPClientTarget(*host, w)
+	logger.CriticalIf(ctx, e)
+
 	rulesMap := event.NewRulesMap(eventNames, pattern, target.ID())
 
 	if err := globalNotificationSys.AddRemoteTarget(bucketName, target, rulesMap); err != nil {
-		errorIf(err, "Unable to add httpclient target %v to globalNotificationSys.targetList.", target)
+		logger.GetReqInfo(ctx).AppendTags("target", target.ID().Name)
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
 	defer globalNotificationSys.RemoveRemoteTarget(bucketName, target.ID())
 	defer globalNotificationSys.RemoveRulesMap(bucketName, rulesMap)
 
-	thisAddr := xnet.MustParseHost(GetLocalPeer(globalEndpoints))
+	thisAddr, e := xnet.ParseHost(GetLocalPeer(globalEndpoints))
+	logger.CriticalIf(ctx, e)
+
 	if err := SaveListener(objAPI, bucketName, eventNames, pattern, target.ID(), *thisAddr); err != nil {
-		errorIf(err, "Unable to save HTTP listener %v", target)
+		logger.GetReqInfo(ctx).AppendTags("target", target.ID().Name)
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
 
-	errors := globalNotificationSys.ListenBucketNotification(bucketName, eventNames, pattern, target.ID(), *thisAddr)
-	for addr, err := range errors {
-		errorIf(err, "unable to call listen bucket notification to remote peer %v", addr)
+	errCh := globalNotificationSys.ListenBucketNotification(bucketName, eventNames, pattern, target.ID(), *thisAddr)
+	for nerr := range errCh {
+		logger.GetReqInfo(ctx).AppendTags("remotePeer", nerr.Host.Name)
+		logger.LogIf(ctx, nerr.Err)
 	}
 
 	<-target.DoneCh
 
 	if err := RemoveListener(objAPI, bucketName, target.ID(), *thisAddr); err != nil {
-		errorIf(err, "Unable to save HTTP listener %v", target)
+		logger.GetReqInfo(ctx).AppendTags("target", target.ID().Name)
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}

cmd/bucket-policy-handlers.go

@@ -19,206 +19,24 @@ package cmd
 import (
 	"encoding/json"
 	"io"
-	"io/ioutil"
-	"net"
 	"net/http"
-	"runtime"
-	"strings"
 
 	humanize "github.com/dustin/go-humanize"
-	mux "github.com/gorilla/mux"
-	"github.com/minio/minio-go/pkg/policy"
-	"github.com/minio/minio/pkg/errors"
-	"github.com/minio/minio/pkg/wildcard"
+	"github.com/gorilla/mux"
+	"github.com/minio/minio/cmd/logger"
+	"github.com/minio/minio/pkg/policy"
 )
 
-// maximum supported access policy size.
-const maxAccessPolicySize = 20 * humanize.KiByte
+const (
+	// As per AWS S3 specification, 20KiB policy JSON data is allowed.
+	maxBucketPolicySize = 20 * humanize.KiByte
 
-// Verify if a given action is valid for the url path based on the
-// existing bucket access policy.
-func bucketPolicyEvalStatements(action string, resource string, conditions policy.ConditionKeyMap,
-	statements []policy.Statement) bool {
-	for _, statement := range statements {
-		if bucketPolicyMatchStatement(action, resource, conditions, statement) {
-			if statement.Effect == "Allow" {
-				return true
-			}
-			// Do not uncomment kept here for readability.
-			// else statement.Effect == "Deny"
-			return false
-		}
-	}
-	// None match so deny.
-	return false
-}
+	// Policy configuration file.
+	bucketPolicyConfig = "policy.json"
+)
 
-// Verify if action, resource and conditions match input policy statement.
-func bucketPolicyMatchStatement(action string, resource string, conditions policy.ConditionKeyMap,
-	statement policy.Statement) bool {
-	// Verify if action, resource and condition match in given statement.
-	return (bucketPolicyActionMatch(action, statement) &&
-		bucketPolicyResourceMatch(resource, statement) &&
-		bucketPolicyConditionMatch(conditions, statement))
-}
-
-// Verify if given action matches with policy statement.
-func bucketPolicyActionMatch(action string, statement policy.Statement) bool {
-	return !statement.Actions.FuncMatch(actionMatch, action).IsEmpty()
-}
-
-// Match function matches wild cards in 'pattern' for resource.
-func resourceMatch(pattern, resource string) bool {
-	if runtime.GOOS == "windows" {
-		// For windows specifically make sure we are case insensitive.
-		return wildcard.Match(strings.ToLower(pattern), strings.ToLower(resource))
-	}
-	return wildcard.Match(pattern, resource)
-}
-
-// Match function matches wild cards in 'pattern' for action.
-func actionMatch(pattern, action string) bool {
-	return wildcard.MatchSimple(pattern, action)
-}
-
-func refererMatch(pattern, referer string) bool {
-	return wildcard.MatchSimple(pattern, referer)
-}
-
-// isIPInCIDR - checks if a given a IP address is a member of the given subnet.
-func isIPInCIDR(cidr, ip string) bool {
-	// AWS S3 spec says IPs must use standard CIDR notation.
-	// http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html#example-bucket-policies-use-case-3.
-	_, cidrNet, err := net.ParseCIDR(cidr)
-	if err != nil {
-		return false // If provided CIDR can't be parsed no IP will be in the subnet.
-	}
-	addr := net.ParseIP(ip)
-	return cidrNet.Contains(addr)
-}
-
-// Verify if given resource matches with policy statement.
-func bucketPolicyResourceMatch(resource string, statement policy.Statement) bool {
-	// the resource rule for object could contain "*" wild card.
-	// the requested object can be given access based on the already set bucket policy if
-	// the match is successful.
-	// More info: http://docs.aws.amazon.com/AmazonS3/latest/dev/s3-arn-format.html.
-	return !statement.Resources.FuncMatch(resourceMatch, resource).IsEmpty()
-}
-
-// Verify if given condition matches with policy statement.
-func bucketPolicyConditionMatch(conditions policy.ConditionKeyMap, statement policy.Statement) bool {
-	// Supports following conditions.
-	// - StringEquals
-	// - StringNotEquals
-	// - StringLike
-	// - StringNotLike
-	// - IpAddress
-	// - NotIpAddress
-	//
-	// Supported applicable condition keys for each conditions.
-	// - s3:prefix
-	// - s3:max-keys
-	// - s3:aws-Referer
-	// - s3:aws-SourceIp
-
-	// The following loop evaluates the logical AND of all the
-	// conditions in the statement. Note: we can break out of the
-	// loop if and only if a condition evaluates to false.
-	for condition, conditionKeyVal := range statement.Conditions {
-		prefixConditon := conditionKeyVal["s3:prefix"]
-		maxKeyCondition := conditionKeyVal["s3:max-keys"]
-		if condition == "StringEquals" {
-			// If there is no condition with "s3:prefix" or "s3:max-keys" condition key
-			// then there is nothing to check condition against.
-			if !prefixConditon.IsEmpty() && !prefixConditon.Equals(conditions["prefix"]) {
-				return false
-			}
-			if !maxKeyCondition.IsEmpty() && !maxKeyCondition.Equals(conditions["max-keys"]) {
-				return false
-			}
-		} else if condition == "StringNotEquals" {
-			// If there is no condition with "s3:prefix" or "s3:max-keys" condition key
-			// then there is nothing to check condition against.
-			if !prefixConditon.IsEmpty() && prefixConditon.Equals(conditions["prefix"]) {
-				return false
-			}
-			if !maxKeyCondition.IsEmpty() && maxKeyCondition.Equals(conditions["max-keys"]) {
-				return false
-			}
-		} else if condition == "StringLike" {
-			awsReferers := conditionKeyVal["aws:Referer"]
-			// Skip empty condition, it is trivially satisfied.
-			if awsReferers.IsEmpty() {
-				continue
-			}
-			// wildcard match of referer in statement was not empty.
-			// StringLike has a match, i.e, condition evaluates to true.
-			refererFound := false
-			for referer := range conditions["referer"] {
-				if !awsReferers.FuncMatch(refererMatch, referer).IsEmpty() {
-					refererFound = true
-					break
-				}
-			}
-			// No matching referer found, so the condition is false.
-			if !refererFound {
-				return false
-			}
-		} else if condition == "StringNotLike" {
-			awsReferers := conditionKeyVal["aws:Referer"]
-			// Skip empty condition, it is trivially satisfied.
-			if awsReferers.IsEmpty() {
-				continue
-			}
-			// wildcard match of referer in statement was not empty.
-			// StringNotLike has a match, i.e, condition evaluates to false.
-			for referer := range conditions["referer"] {
-				if !awsReferers.FuncMatch(refererMatch, referer).IsEmpty() {
-					return false
-				}
-			}
-		} else if condition == "IpAddress" {
-			awsIps := conditionKeyVal["aws:SourceIp"]
-			// Skip empty condition, it is trivially satisfied.
-			if awsIps.IsEmpty() {
-				continue
-			}
-			// wildcard match of ip if statement was not empty.
-			// Find a valid ip.
-			ipFound := false
-			for ip := range conditions["ip"] {
-				if !awsIps.FuncMatch(isIPInCIDR, ip).IsEmpty() {
-					ipFound = true
-					break
-				}
-			}
-			if !ipFound {
-				return false
-			}
-		} else if condition == "NotIpAddress" {
-			awsIps := conditionKeyVal["aws:SourceIp"]
-			// Skip empty condition, it is trivially satisfied.
-			if awsIps.IsEmpty() {
-				continue
-			}
-			// wildcard match of ip if statement was not empty.
-			// Find if nothing matches.
-			for ip := range conditions["ip"] {
-				if !awsIps.FuncMatch(isIPInCIDR, ip).IsEmpty() {
-					return false
-				}
-			}
-		}
-	}
-
-	return true
-}
-
-// PutBucketPolicyHandler - PUT Bucket policy
-// -----------------
-// This implementation of the PUT operation uses the policy
-// subresource to add to or replace a policy on a bucket
+// PutBucketPolicyHandler - This HTTP handler stores given bucket policy configuration as per
+// https://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
 func (api objectAPIHandlers) PutBucketPolicyHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, "PutBucketPolicy")
 
@@ -228,77 +46,61 @@ func (api objectAPIHandlers) PutBucketPolicyHandler(w http.ResponseWriter, r *ht
 		return
 	}
 
-	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+
+	if s3Error := checkRequestAuthType(ctx, r, policy.PutBucketPolicyAction, bucket, ""); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}
 
-	vars := mux.Vars(r)
-	bucket := vars["bucket"]
-
-	// Before proceeding validate if bucket exists.
-	_, err := objAPI.GetBucketInfo(ctx, bucket)
-	if err != nil {
+	// Check if bucket exists.
+	if _, err := objAPI.GetBucketInfo(ctx, bucket); err != nil {
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
 
-	// If Content-Length is unknown or zero, deny the
-	// request. PutBucketPolicy always needs a Content-Length.
-	if r.ContentLength == -1 || r.ContentLength == 0 {
+	// Error out if Content-Length is missing.
+	// PutBucketPolicy always needs Content-Length.
+	if r.ContentLength <= 0 {
 		writeErrorResponse(w, ErrMissingContentLength, r.URL)
 		return
 	}
-	// If Content-Length is greater than maximum allowed policy size.
-	if r.ContentLength > maxAccessPolicySize {
+
+	// Error out if Content-Length is beyond allowed size.
+	if r.ContentLength > maxBucketPolicySize {
 		writeErrorResponse(w, ErrEntityTooLarge, r.URL)
 		return
 	}
 
-	// Read access policy up to maxAccessPolicySize.
-	// http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
-	// bucket policies are limited to 20KB in size, using a limit reader.
-	policyBytes, err := ioutil.ReadAll(io.LimitReader(r.Body, maxAccessPolicySize))
+	bucketPolicy, err := policy.ParseConfig(io.LimitReader(r.Body, r.ContentLength), bucket)
 	if err != nil {
-		errorIf(err, "Unable to read from client.")
+		writeErrorResponse(w, ErrMalformedPolicy, r.URL)
+		return
+	}
+
+	// Version in policy must not be empty
+	if bucketPolicy.Version == "" {
+		writeErrorResponse(w, ErrMalformedPolicy, r.URL)
+		return
+	}
+
+	if err = objAPI.SetBucketPolicy(ctx, bucket, bucketPolicy); err != nil {
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
-	policyInfo := policy.BucketAccessPolicy{}
-	if err = json.Unmarshal(policyBytes, &policyInfo); err != nil {
-		writeErrorResponse(w, ErrInvalidPolicyDocument, r.URL)
-		return
-	}
-	// Parse check bucket policy.
-	if s3Error := checkBucketPolicyResources(bucket, policyInfo); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
-		return
-	}
 
-	if err = objAPI.SetBucketPolicy(ctx, bucket, policyInfo); err != nil {
-		err = errors.Cause(err)
-		switch err.(type) {
-		case NotImplemented:
-			// Return error for invalid bucket name.
-			writeErrorResponse(w, ErrNotImplemented, r.URL)
-		default:
-			writeErrorResponse(w, ErrMalformedPolicy, r.URL)
-		}
-		return
-	}
-
-	for addr, err := range globalNotificationSys.UpdateBucketPolicy(bucket) {
-		errorIf(err, "unable to update policy change in remote peer %v", addr)
+	globalPolicySys.Set(bucket, *bucketPolicy)
+	for nerr := range globalNotificationSys.SetBucketPolicy(bucket, bucketPolicy) {
+		logger.GetReqInfo(ctx).AppendTags("remotePeer", nerr.Host.Name)
+		logger.LogIf(ctx, nerr.Err)
 	}
 
 	// Success.
 	writeSuccessNoContent(w)
 }
 
-// DeleteBucketPolicyHandler - DELETE Bucket policy
-// -----------------
-// This implementation of the DELETE operation uses the policy
-// subresource to add to remove a policy on a bucket.
+// DeleteBucketPolicyHandler - This HTTP handler removes bucket policy configuration.
 func (api objectAPIHandlers) DeleteBucketPolicyHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, "DeleteBucketPolicy")
 
@@ -308,40 +110,36 @@ func (api objectAPIHandlers) DeleteBucketPolicyHandler(w http.ResponseWriter, r
 		return
 	}
 
-	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+
+	if s3Error := checkRequestAuthType(ctx, r, policy.DeleteBucketPolicyAction, bucket, ""); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}
 
-	vars := mux.Vars(r)
-	bucket := vars["bucket"]
-
-	// Before proceeding validate if bucket exists.
-	_, err := objAPI.GetBucketInfo(ctx, bucket)
-	if err != nil {
+	// Check if bucket exists.
+	if _, err := objAPI.GetBucketInfo(ctx, bucket); err != nil {
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
 
-	// Delete bucket access policy, by passing an empty policy
-	// struct.
 	if err := objAPI.DeleteBucketPolicy(ctx, bucket); err != nil {
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
 
-	for addr, err := range globalNotificationSys.UpdateBucketPolicy(bucket) {
-		errorIf(err, "unable to update policy change in remote peer %v", addr)
+	globalPolicySys.Remove(bucket)
+	for nerr := range globalNotificationSys.RemoveBucketPolicy(bucket) {
+		logger.GetReqInfo(ctx).AppendTags("remotePeer", nerr.Host.Name)
+		logger.LogIf(ctx, nerr.Err)
 	}
 
 	// Success.
 	writeSuccessNoContent(w)
 }
 
-// GetBucketPolicyHandler - GET Bucket policy
-// -----------------
-// This operation uses the policy
-// subresource to return the policy of a specified bucket.
+// GetBucketPolicyHandler - This HTTP handler returns bucket policy configuration.
 func (api objectAPIHandlers) GetBucketPolicyHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, "GetBucketPolicy")
 
@@ -351,35 +149,34 @@ func (api objectAPIHandlers) GetBucketPolicyHandler(w http.ResponseWriter, r *ht
 		return
 	}
 
-	if s3Error := checkRequestAuthType(r, "", "", globalServerConfig.GetRegion()); s3Error != ErrNone {
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+
+	if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketPolicyAction, bucket, ""); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
 		return
 	}
 
-	vars := mux.Vars(r)
-	bucket := vars["bucket"]
-
-	// Before proceeding validate if bucket exists.
-	_, err := objAPI.GetBucketInfo(ctx, bucket)
-	if err != nil {
+	// Check if bucket exists.
+	if _, err := objAPI.GetBucketInfo(ctx, bucket); err != nil {
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
 
 	// Read bucket access policy.
-	policy, err := objAPI.GetBucketPolicy(ctx, bucket)
+	bucketPolicy, err := objAPI.GetBucketPolicy(ctx, bucket)
 	if err != nil {
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
 
-	policyBytes, err := json.Marshal(&policy)
+	policyData, err := json.Marshal(bucketPolicy)
 	if err != nil {
-		errorIf(err, "Unable to marshal bucket policy.")
+		logger.LogIf(ctx, err)
 		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		return
 	}
 
 	// Write to client.
-	w.Write(policyBytes)
+	w.Write(policyData)
 }

cmd/bucket-policy-handlers_test.go

@@ -24,222 +24,72 @@ import (
 	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
+	"reflect"
+	"strings"
 	"testing"
 
-	"github.com/minio/minio-go/pkg/policy"
-	"github.com/minio/minio-go/pkg/set"
 	"github.com/minio/minio/pkg/auth"
+	"github.com/minio/minio/pkg/policy"
+	"github.com/minio/minio/pkg/policy/condition"
 )
 
-// Tests validate Bucket policy resource matcher.
-func TestBucketPolicyResourceMatch(t *testing.T) {
-
-	// generates statement with given resource..
-	generateStatement := func(resource string) policy.Statement {
-		statement := policy.Statement{}
-		statement.Resources = set.CreateStringSet([]string{resource}...)
-		return statement
-	}
-
-	// generates resource prefix.
-	generateResource := func(bucketName, objectName string) string {
-		return bucketARNPrefix + bucketName + "/" + objectName
-	}
-
-	testCases := []struct {
-		resourceToMatch       string
-		statement             policy.Statement
-		expectedResourceMatch bool
-	}{
-		// Test case 1-4.
-		// Policy with resource ending with bucket/* allows access to all objects inside the given bucket.
-		{generateResource("minio-bucket", ""), generateStatement(fmt.Sprintf("%s%s", bucketARNPrefix, "minio-bucket"+"/*")), true},
-		{generateResource("minio-bucket", ""), generateStatement(fmt.Sprintf("%s%s", bucketARNPrefix, "minio-bucket"+"/*")), true},
-		{generateResource("minio-bucket", ""), generateStatement(fmt.Sprintf("%s%s", bucketARNPrefix, "minio-bucket"+"/*")), true},
-		{generateResource("minio-bucket", ""), generateStatement(fmt.Sprintf("%s%s", bucketARNPrefix, "minio-bucket"+"/*")), true},
-		// Test case - 5.
-		// Policy with resource ending with bucket/oo* should not allow access to bucket/output.txt.
-		{generateResource("minio-bucket", "output.txt"), generateStatement(fmt.Sprintf("%s%s", bucketARNPrefix, "minio-bucket"+"/oo*")), false},
-		// Test case - 6.
-		// Policy with resource ending with bucket/oo* should allow access to bucket/ootput.txt.
-		{generateResource("minio-bucket", "ootput.txt"), generateStatement(fmt.Sprintf("%s%s", bucketARNPrefix, "minio-bucket"+"/oo*")), true},
-		// Test case - 7.
-		// Policy with resource ending with bucket/oo* allows access to all sub-dirs starting with "oo" inside given bucket.
-		{generateResource("minio-bucket", "oop-bucket/my-file"), generateStatement(fmt.Sprintf("%s%s", bucketARNPrefix, "minio-bucket"+"/oo*")), true},
-		// Test case - 8.
-		{generateResource("minio-bucket", "Asia/India/1.pjg"), generateStatement(fmt.Sprintf("%s%s", bucketARNPrefix, "minio-bucket"+"/Asia/Japan/*")), false},
-		// Test case - 9.
-		{generateResource("minio-bucket", "Asia/India/1.pjg"), generateStatement(fmt.Sprintf("%s%s", bucketARNPrefix, "minio-bucket"+"/Asia/Japan/*")), false},
-		// Test case - 10.
-		// Proves that the name space is flat.
-		{generateResource("minio-bucket", "Africa/Bihar/India/design_info.doc/Bihar"), generateStatement(fmt.Sprintf("%s%s", bucketARNPrefix,
-			"minio-bucket"+"/*/India/*/Bihar")), true},
-		// Test case - 11.
-		// Proves that the name space is flat.
-		{generateResource("minio-bucket", "Asia/China/India/States/Bihar/output.txt"), generateStatement(fmt.Sprintf("%s%s", bucketARNPrefix,
-			"minio-bucket"+"/*/India/*/Bihar/*")), true},
-	}
-	for i, testCase := range testCases {
-		actualResourceMatch := bucketPolicyResourceMatch(testCase.resourceToMatch, testCase.statement)
-		if testCase.expectedResourceMatch != actualResourceMatch {
-			t.Errorf("Test %d: Expected Resource match to be `%v`, but instead found it to be `%v`", i+1, testCase.expectedResourceMatch, actualResourceMatch)
-		}
+func getAnonReadOnlyBucketPolicy(bucketName string) *policy.Policy {
+	return &policy.Policy{
+		Version: policy.DefaultVersion,
+		Statements: []policy.Statement{policy.NewStatement(
+			policy.Allow,
+			policy.NewPrincipal("*"),
+			policy.NewActionSet(policy.GetBucketLocationAction, policy.ListBucketAction),
+			policy.NewResourceSet(policy.NewResource(bucketName, "")),
+			condition.NewFunctions(),
+		)},
 	}
 }
 
-// TestBucketPolicyActionMatch - Test validates whether given action on the
-// bucket/object matches the allowed actions in policy.Statement.
-// This test preserves the allowed actions for all 3 sets of policies, that is read-write,read-only, write-only.
-// The intention of the test is to catch any changes made to allowed action for on eof the above 3 major policy groups mentioned.
-func TestBucketPolicyActionMatch(t *testing.T) {
-	bucketName := getRandomBucketName()
-	objectPrefix := "test-object"
-
-	testCases := []struct {
-		action         string
-		statement      policy.Statement
-		expectedResult bool
-	}{
-		// s3:GetBucketLocation is the action necessary to be present in the bucket policy to allow
-		// fetching of bucket location on an Anonymous/unsigned request.
-
-		//r ead-write bucket policy is expected to allow GetBucketLocation operation on an anonymous request (Test case - 1).
-		{"s3:GetBucketLocation", getReadWriteBucketStatement(bucketName, objectPrefix), true},
-		//	write-only bucket policy is expected to allow GetBucketLocation operation on an anonymous request (Test case - 2).
-		{"s3:GetBucketLocation", getWriteOnlyBucketStatement(bucketName, objectPrefix), true},
-		//	read-only bucket policy is expected to allow GetBucketLocation operation on an anonymous request (Test case - 3).
-		{"s3:GetBucketLocation", getReadOnlyBucketStatement(bucketName, objectPrefix), true},
-
-		// Any of the Object level access permissions shouldn't allow for GetBucketLocation operation  on an Anonymous/unsigned request (Test cases 4-6).
-		{"s3:GetBucketLocation", getReadWriteObjectStatement(bucketName, objectPrefix), false},
-		{"s3:GetBucketLocation", getWriteOnlyObjectStatement(bucketName, objectPrefix), false},
-		{"s3:GetBucketLocation", getReadOnlyObjectStatement(bucketName, objectPrefix), false},
-
-		// s3:ListBucketMultipartUploads is the action necessary to be present in the bucket policy to allow
-		// Listing of multipart uploads in a given bucket for an Anonymous/unsigned request.
-
-		//read-write bucket policy is expected to allow  ListBucketMultipartUploads operation on an anonymous request (Test case 7).
-		{"s3:ListBucketMultipartUploads", getReadWriteBucketStatement(bucketName, objectPrefix), true},
-		//	write-only bucket policy is expected to allow  ListBucketMultipartUploads operation on an anonymous request (Test case 8).
-		{"s3:ListBucketMultipartUploads", getWriteOnlyBucketStatement(bucketName, objectPrefix), true},
-		// read-only bucket policy is expected to not allow ListBucketMultipartUploads operation on an anonymous request (Test case 9).
-		// the allowed actions in read-only bucket statement are  "s3:GetBucketLocation","s3:ListBucket",
-		// this should not allow for ListBucketMultipartUploads operations.
-		{"s3:ListBucketMultipartUploads", getReadOnlyBucketStatement(bucketName, objectPrefix), false},
-
-		// Any of the object level policy will not allow for s3:ListBucketMultipartUploads (Test cases 10-12).
-		{"s3:ListBucketMultipartUploads", getReadWriteObjectStatement(bucketName, objectPrefix), false},
-		{"s3:ListBucketMultipartUploads", getWriteOnlyObjectStatement(bucketName, objectPrefix), false},
-		{"s3:ListBucketMultipartUploads", getReadOnlyObjectStatement(bucketName, objectPrefix), false},
-
-		// s3:ListBucket is the action necessary to be present in the bucket policy to allow
-		// listing of all objects inside a given bucket on an Anonymous/unsigned request.
-
-		// Cases for testing ListBucket access for different Bucket level access permissions.
-		// read-only bucket policy is expected to allow ListBucket operation on an anonymous request (Test case 13).
-		{"s3:ListBucket", getReadOnlyBucketStatement(bucketName, objectPrefix), true},
-		// read-write bucket policy is expected to allow ListBucket operation on an anonymous request (Test case 14).
-		{"s3:ListBucket", getReadWriteBucketStatement(bucketName, objectPrefix), true},
-		// write-only  bucket policy is expected to not allow ListBucket operation on an anonymous request (Test case 15).
-		// the allowed actions in write-only  bucket statement are "s3:GetBucketLocation",	"s3:ListBucketMultipartUploads",
-		// this should not allow for ListBucket operations.
-		{"s3:ListBucket", getWriteOnlyBucketStatement(bucketName, objectPrefix), false},
-
-		// Cases for testing ListBucket access for different Object level access permissions (Test cases 16-18).
-		// Any of the Object level access permissions shouldn't allow for ListBucket operation  on an Anonymous/unsigned request.
-		{"s3:ListBucket", getReadOnlyObjectStatement(bucketName, objectPrefix), false},
-		{"s3:ListBucket", getReadWriteObjectStatement(bucketName, objectPrefix), false},
-		{"s3:ListBucket", getWriteOnlyObjectStatement(bucketName, objectPrefix), false},
-
-		// s3:DeleteObject is the action necessary to be present in the bucket policy to allow
-		// deleting/removal of  objects inside a given bucket for an Anonymous/unsigned request.
-
-		// Cases for testing DeleteObject access for different Bucket level access permissions (Test cases 19-21).
-		// Any of the Bucket level access permissions shouldn't allow for DeleteObject operation  on an Anonymous/unsigned request.
-		{"s3:DeleteObject", getReadOnlyBucketStatement(bucketName, objectPrefix), false},
-		{"s3:DeleteObject", getReadWriteBucketStatement(bucketName, objectPrefix), false},
-		{"s3:DeleteObject", getWriteOnlyBucketStatement(bucketName, objectPrefix), false},
-
-		// Cases for testing DeleteObject access for different Object level access permissions (Test cases 22).
-		// read-only bucket policy is expected to not allow Delete Object operation on an anonymous request.
-		{"s3:DeleteObject", getReadOnlyObjectStatement(bucketName, objectPrefix), false},
-		// read-write bucket policy is expected to allow Delete Bucket operation on an anonymous request (Test cases 23).
-		{"s3:DeleteObject", getReadWriteObjectStatement(bucketName, objectPrefix), true},
-		// write-only  bucket policy is expected to allow Delete Object operation on an anonymous request (Test cases 24).
-		{"s3:DeleteObject", getWriteOnlyObjectStatement(bucketName, objectPrefix), true},
-
-		// s3:AbortMultipartUpload is the action necessary to be present in the bucket policy to allow
-		// cancelling or abortion of an already initiated multipart upload operation for an Anonymous/unsigned request.
-
-		// Cases for testing AbortMultipartUpload access for different Bucket level access permissions (Test cases 25-27).
-		// Any of the Bucket level access permissions shouldn't allow for AbortMultipartUpload operation on an Anonymous/unsigned request.
-		{"s3:AbortMultipartUpload", getReadOnlyBucketStatement(bucketName, objectPrefix), false},
-		{"s3:AbortMultipartUpload", getReadWriteBucketStatement(bucketName, objectPrefix), false},
-		{"s3:AbortMultipartUpload", getWriteOnlyBucketStatement(bucketName, objectPrefix), false},
-
-		// Cases for testing AbortMultipartUpload access for different Object level access permissions.
-		// read-only object policy is expected to not allow AbortMultipartUpload operation on an anonymous request (Test case 28).
-		{"s3:AbortMultipartUpload", getReadOnlyObjectStatement(bucketName, objectPrefix), false},
-		// read-write object policy is expected to allow AbortMultipartUpload operation on an anonymous request (Test case 29).
-		{"s3:AbortMultipartUpload", getReadWriteObjectStatement(bucketName, objectPrefix), true},
-		// write-only object policy is expected to allow AbortMultipartUpload operation on an anonymous request (Test case 30).
-		{"s3:AbortMultipartUpload", getWriteOnlyObjectStatement(bucketName, objectPrefix), true},
-
-		// s3:PutObject is the action necessary to be present in the bucket policy to allow
-		// uploading of an object for an Anonymous/unsigned request.
-
-		// Cases for testing PutObject access for different Bucket level access permissions (Test cases 31-33).
-		// Any of the Bucket level access permissions shouldn't allow for PutObject operation on an Anonymous/unsigned request.
-		{"s3:PutObject", getReadOnlyBucketStatement(bucketName, objectPrefix), false},
-		{"s3:PutObject", getReadWriteBucketStatement(bucketName, objectPrefix), false},
-		{"s3:PutObject", getWriteOnlyBucketStatement(bucketName, objectPrefix), false},
-
-		// Cases for testing PutObject access for different Object level access permissions.
-		// read-only object policy is expected to not allow PutObject operation on an anonymous request (Test case 34).
-		{"s3:PutObject", getReadOnlyObjectStatement(bucketName, objectPrefix), false},
-		// read-write object policy is expected to allow PutObject operation on an anonymous request (Test case 35).
-		{"s3:PutObject", getReadWriteObjectStatement(bucketName, objectPrefix), true},
-		// write-only  object policy is expected to allow PutObject operation on an anonymous request (Test case 36).
-		{"s3:PutObject", getWriteOnlyObjectStatement(bucketName, objectPrefix), true},
-
-		// s3:GetObject is the action necessary to be present in the bucket policy to allow
-		// downloading of an object for an Anonymous/unsigned request.
-
-		// Cases for testing GetObject access for different Bucket level access permissions (Test cases 37-39).
-		// Any of the Bucket level access permissions shouldn't allow for GetObject operation on an Anonymous/unsigned request.
-		{"s3:GetObject", getReadOnlyBucketStatement(bucketName, objectPrefix), false},
-		{"s3:GetObject", getReadWriteBucketStatement(bucketName, objectPrefix), false},
-		{"s3:GetObject", getWriteOnlyBucketStatement(bucketName, objectPrefix), false},
-
-		// Cases for testing GetObject access for different Object level access permissions.
-		// read-only bucket policy is expected to allow  downloading of an Object on an anonymous request (Test case 40).
-		{"s3:GetObject", getReadOnlyObjectStatement(bucketName, objectPrefix), true},
-		// read-write bucket policy is expected to allow  downloading of an Object on an anonymous request (Test case 41).
-		{"s3:GetObject", getReadWriteObjectStatement(bucketName, objectPrefix), true},
-		// write-only  bucket policy is expected to not allow  downloading of an Object on an anonymous request (Test case 42).
-		{"s3:GetObject", getWriteOnlyObjectStatement(bucketName, objectPrefix), false},
-
-		// s3:ListMultipartUploadParts is the action necessary to be present in the bucket policy to allow
-		// Listing of uploaded parts for an Anonymous/unsigned request.
-
-		// Any of the Bucket level access permissions shouldn't allow for ListMultipartUploadParts operation on an Anonymous/unsigned request.
-		// read-only bucket policy is expected to not allow ListMultipartUploadParts operation on an anonymous request (Test cases 43-45).
-		{"s3:ListMultipartUploadParts", getReadOnlyBucketStatement(bucketName, objectPrefix), false},
-		{"s3:ListMultipartUploadParts", getReadWriteBucketStatement(bucketName, objectPrefix), false},
-		{"s3:ListMultipartUploadParts", getWriteOnlyBucketStatement(bucketName, objectPrefix), false},
-
-		// read-only object policy is expected to not allow ListMultipartUploadParts operation on an anonymous request (Test case 46).
-		{"s3:ListMultipartUploadParts", getReadOnlyObjectStatement(bucketName, objectPrefix), false},
-		// read-write object policy is expected to allow ListMultipartUploadParts operation on an anonymous request (Test case 47).
-		{"s3:ListMultipartUploadParts", getReadWriteObjectStatement(bucketName, objectPrefix), true},
-		// write-only  object policy is expected to allow ListMultipartUploadParts operation on an anonymous request (Test case 48).
-		{"s3:ListMultipartUploadParts", getWriteOnlyObjectStatement(bucketName, objectPrefix), true},
+func getAnonWriteOnlyBucketPolicy(bucketName string) *policy.Policy {
+	return &policy.Policy{
+		Version: policy.DefaultVersion,
+		Statements: []policy.Statement{policy.NewStatement(
+			policy.Allow,
+			policy.NewPrincipal("*"),
+			policy.NewActionSet(
+				policy.GetBucketLocationAction,
+				policy.ListBucketMultipartUploadsAction,
+			),
+			policy.NewResourceSet(policy.NewResource(bucketName, "")),
+			condition.NewFunctions(),
+		)},
 	}
-	for i, testCase := range testCases {
-		actualResult := bucketPolicyActionMatch(testCase.action, testCase.statement)
-		if testCase.expectedResult != actualResult {
-			t.Errorf("Test %d: Expected the result to be `%v`, but instead found it to be `%v`", i+1, testCase.expectedResult, actualResult)
-		}
+}
+
+func getAnonReadOnlyObjectPolicy(bucketName, prefix string) *policy.Policy {
+	return &policy.Policy{
+		Version: policy.DefaultVersion,
+		Statements: []policy.Statement{policy.NewStatement(
+			policy.Allow,
+			policy.NewPrincipal("*"),
+			policy.NewActionSet(policy.GetObjectAction),
+			policy.NewResourceSet(policy.NewResource(bucketName, prefix)),
+			condition.NewFunctions(),
+		)},
+	}
+}
+
+func getAnonWriteOnlyObjectPolicy(bucketName, prefix string) *policy.Policy {
+	return &policy.Policy{
+		Version: policy.DefaultVersion,
+		Statements: []policy.Statement{policy.NewStatement(
+			policy.Allow,
+			policy.NewPrincipal("*"),
+			policy.NewActionSet(
+				policy.AbortMultipartUploadAction,
+				policy.DeleteObjectAction,
+				policy.ListMultipartUploadPartsAction,
+				policy.PutObjectAction,
+			),
+			policy.NewResourceSet(policy.NewResource(bucketName, prefix)),
+			condition.NewFunctions(),
+		)},
 	}
 }
 
@@ -260,6 +110,8 @@ func testPutBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 	// template for constructing HTTP request body for PUT bucket policy.
 	bucketPolicyTemplate := `{"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetBucketLocation","s3:ListBucket"],"Resource":["arn:aws:s3:::%s"]},{"Sid":"","Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetObject"],"Resource":["arn:aws:s3:::%s/this*"]}]}`
 
+	bucketPolicyTemplateWithoutVersion := `{"Version":"","Statement":[{"Sid":"","Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetBucketLocation","s3:ListBucket"],"Resource":["arn:aws:s3:::%s"]},{"Sid":"","Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetObject"],"Resource":["arn:aws:s3:::%s/this*"]}]}`
+
 	// test cases with sample input and expected output.
 	testCases := []struct {
 		bucketName string
@@ -290,7 +142,7 @@ func testPutBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 			bucketName:         bucketName,
 			bucketPolicyReader: bytes.NewReader([]byte(fmt.Sprintf(bucketPolicyTemplate, bucketName, bucketName))),
 
-			policyLen:          maxAccessPolicySize + 1,
+			policyLen:          maxBucketPolicySize + 1,
 			accessKey:          credentials.AccessKey,
 			secretKey:          credentials.SecretKey,
 			expectedRespStatus: http.StatusBadRequest,
@@ -357,7 +209,7 @@ func testPutBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 		// Test case - 8.
 		// non-existent bucket is used.
 		// writing BucketPolicy should fail.
-		// should result is 500 InternalServerError.
+		// should result in 404 StatusNotFound
 		{
 			bucketName:         "non-existent-bucket",
 			bucketPolicyReader: bytes.NewReader([]byte(fmt.Sprintf(bucketPolicyTemplate, "non-existent-bucket", "non-existent-bucket"))),
@@ -368,9 +220,9 @@ func testPutBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 			expectedRespStatus: http.StatusNotFound,
 		},
 		// Test case - 9.
-		// invalid bucket name is used.
+		// non-existent bucket is used (with invalid bucket name)
 		// writing BucketPolicy should fail.
-		// should result is 400 StatusBadRequest.
+		// should result in 404 StatusNotFound
 		{
 			bucketName:         ".invalid-bucket",
 			bucketPolicyReader: bytes.NewReader([]byte(fmt.Sprintf(bucketPolicyTemplate, ".invalid-bucket", ".invalid-bucket"))),
@@ -378,6 +230,19 @@ func testPutBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 			policyLen:          len(fmt.Sprintf(bucketPolicyTemplate, bucketName, bucketName)),
 			accessKey:          credentials.AccessKey,
 			secretKey:          credentials.SecretKey,
+			expectedRespStatus: http.StatusNotFound,
+		},
+		// Test case - 10.
+		// Existent bucket with policy with Version field empty.
+		// writing BucketPolicy should fail.
+		// should result in 400 StatusBadRequest.
+		{
+			bucketName:         bucketName,
+			bucketPolicyReader: bytes.NewReader([]byte(fmt.Sprintf(bucketPolicyTemplateWithoutVersion, bucketName, bucketName))),
+
+			policyLen:          len(fmt.Sprintf(bucketPolicyTemplateWithoutVersion, bucketName, bucketName)),
+			accessKey:          credentials.AccessKey,
+			secretKey:          credentials.SecretKey,
 			expectedRespStatus: http.StatusBadRequest,
 		},
 	}
@@ -430,7 +295,7 @@ func testPutBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getWriteOnlyObjectStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, obj, "PutBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getWriteOnlyObjectStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "PutBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getAnonWriteOnlyBucketPolicy(bucketName))
 
 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -459,7 +324,7 @@ func TestGetBucketPolicyHandler(t *testing.T) {
 func testGetBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string, apiRouter http.Handler,
 	credentials auth.Credentials, t *testing.T) {
 	// template for constructing HTTP request body for PUT bucket policy.
-	bucketPolicyTemplate := `{"Version":"2012-10-17","Statement":[{"Action":["s3:GetBucketLocation","s3:ListBucket"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::%s"],"Sid":""},{"Action":["s3:GetObject"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::%s/this*"],"Sid":""}]}`
+	bucketPolicyTemplate := `{"Version":"2012-10-17","Statement":[{"Action":["s3:GetBucketLocation","s3:ListBucket"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::%s"]},{"Action":["s3:GetObject"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::%s/this*"]}]}`
 
 	// Writing bucket policy before running test on GetBucketPolicy.
 	putTestPolicies := []struct {
@@ -535,13 +400,13 @@ func testGetBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 			expectedRespStatus:   http.StatusNotFound,
 		},
 		// Test case - 3.
-		// Case with invalid bucket name.
+		// Case with non-existent bucket name.
 		{
 			bucketName:           ".invalid-bucket-name",
 			accessKey:            credentials.AccessKey,
 			secretKey:            credentials.SecretKey,
 			expectedBucketPolicy: "",
-			expectedRespStatus:   http.StatusBadRequest,
+			expectedRespStatus:   http.StatusNotFound,
 		},
 	}
 	// Iterating over the cases, fetching the policy and validating the response.
@@ -572,7 +437,16 @@ func testGetBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 
 		if recV4.Code != testCase.expectedRespStatus {
 			// Verify whether the bucket policy fetched is same as the one inserted.
-			if expectedBucketPolicyStr != string(bucketPolicyReadBuf) {
+			expectedPolicy, err := policy.ParseConfig(strings.NewReader(expectedBucketPolicyStr), testCase.bucketName)
+			if err != nil {
+				t.Fatalf("unexpected error. %v", err)
+			}
+			gotPolicy, err := policy.ParseConfig(bytes.NewReader(bucketPolicyReadBuf), testCase.bucketName)
+			if err != nil {
+				t.Fatalf("unexpected error. %v", err)
+			}
+
+			if !reflect.DeepEqual(expectedPolicy, gotPolicy) {
 				t.Errorf("Test %d: %s: Bucket policy differs from expected value.", i+1, instanceType)
 			}
 		}
@@ -598,7 +472,16 @@ func testGetBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 		}
 		if recV2.Code == http.StatusOK {
 			// Verify whether the bucket policy fetched is same as the one inserted.
-			if expectedBucketPolicyStr != string(bucketPolicyReadBuf) {
+			expectedPolicy, err := policy.ParseConfig(strings.NewReader(expectedBucketPolicyStr), testCase.bucketName)
+			if err != nil {
+				t.Fatalf("unexpected error. %v", err)
+			}
+			gotPolicy, err := policy.ParseConfig(bytes.NewReader(bucketPolicyReadBuf), testCase.bucketName)
+			if err != nil {
+				t.Fatalf("unexpected error. %v", err)
+			}
+
+			if !reflect.DeepEqual(expectedPolicy, gotPolicy) {
 				t.Errorf("Test %d: %s: Bucket policy differs from expected value.", i+1, instanceType)
 			}
 		}
@@ -617,7 +500,7 @@ func testGetBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName string
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getWriteOnlyObjectStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, obj, "GetBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyObjectStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "GetBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getAnonReadOnlyBucketPolicy(bucketName))
 
 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -742,12 +625,12 @@ func testDeleteBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName str
 			expectedRespStatus: http.StatusNotFound,
 		},
 		// Test case - 3.
-		// Case with invalid bucket name.
+		// Case with non-existent-bucket.
 		{
 			bucketName:         ".invalid-bucket-name",
 			accessKey:          credentials.AccessKey,
 			secretKey:          credentials.SecretKey,
-			expectedRespStatus: http.StatusBadRequest,
+			expectedRespStatus: http.StatusNotFound,
 		},
 	}
 	// Iterating over the cases and deleting the bucket policy and then asserting response.
@@ -820,7 +703,7 @@ func testDeleteBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName str
 	// ExecObjectLayerAPIAnonTest - Calls the HTTP API handler using the anonymous request, validates the ErrAccessDeniedResponse,
 	// sets the bucket policy using the policy statement generated from `getWriteOnlyObjectStatement` so that the
 	// unsigned request goes through and its validated again.
-	ExecObjectLayerAPIAnonTest(t, obj, "DeleteBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getReadOnlyObjectStatement)
+	ExecObjectLayerAPIAnonTest(t, obj, "DeleteBucketPolicyHandler", bucketName, "", instanceType, apiRouter, anonReq, getAnonWriteOnlyBucketPolicy(bucketName))
 
 	// HTTP request for testing when `objectLayer` is set to `nil`.
 	// There is no need to use an existing bucket and valid input for creating the request
@@ -838,174 +721,3 @@ func testDeleteBucketPolicyHandler(obj ObjectLayer, instanceType, bucketName str
 	// `ExecObjectLayerAPINilTest` manages the operation.
 	ExecObjectLayerAPINilTest(t, nilBucket, "", instanceType, apiRouter, nilReq)
 }
-
-// TestBucketPolicyConditionMatch - Tests to validate whether bucket policy conditions match.
-func TestBucketPolicyConditionMatch(t *testing.T) {
-	// obtain the inner map[string]set.StringSet for policy.Statement.Conditions.
-	getInnerMap := func(key2, value string) map[string]set.StringSet {
-		innerMap := make(map[string]set.StringSet)
-		innerMap[key2] = set.CreateStringSet(value)
-		return innerMap
-	}
-
-	// obtain policy.Statement with Conditions set.
-	getStatementWithCondition := func(key1, key2, value string) policy.Statement {
-		innerMap := getInnerMap(key2, value)
-		// to set policyStatment.Conditions .
-		conditions := make(policy.ConditionMap)
-		conditions[key1] = innerMap
-		// new policy statement.
-		statement := policy.Statement{}
-		// set the condition.
-		statement.Conditions = conditions
-		return statement
-	}
-
-	testCases := []struct {
-		statementCondition policy.Statement
-		condition          map[string]set.StringSet
-
-		expectedMatch bool
-	}{
-
-		// Test case - 1.
-		// StringEquals condition matches.
-		{
-
-			statementCondition: getStatementWithCondition("StringEquals", "s3:prefix", "Asia/"),
-			condition:          getInnerMap("prefix", "Asia/"),
-
-			expectedMatch: true,
-		},
-		// Test case - 2.
-		// StringEquals condition doesn't match.
-		{
-
-			statementCondition: getStatementWithCondition("StringEquals", "s3:prefix", "Asia/"),
-			condition:          getInnerMap("prefix", "Africa/"),
-
-			expectedMatch: false,
-		},
-		// Test case - 3.
-		// StringEquals condition matches.
-		{
-
-			statementCondition: getStatementWithCondition("StringEquals", "s3:max-keys", "Asia/"),
-			condition:          getInnerMap("max-keys", "Asia/"),
-
-			expectedMatch: true,
-		},
-		// Test case - 4.
-		// StringEquals condition doesn't match.
-		{
-
-			statementCondition: getStatementWithCondition("StringEquals", "s3:max-keys", "Asia/"),
-			condition:          getInnerMap("max-keys", "Africa/"),
-
-			expectedMatch: false,
-		},
-		// Test case - 5.
-		// StringNotEquals condition matches.
-		{
-
-			statementCondition: getStatementWithCondition("StringNotEquals", "s3:prefix", "Asia/"),
-			condition:          getInnerMap("prefix", "Asia/"),
-
-			expectedMatch: false,
-		},
-		// Test case - 6.
-		// StringNotEquals condition doesn't match.
-		{
-
-			statementCondition: getStatementWithCondition("StringNotEquals", "s3:prefix", "Asia/"),
-			condition:          getInnerMap("prefix", "Africa/"),
-
-			expectedMatch: true,
-		},
-		// Test case - 7.
-		// StringNotEquals condition matches.
-		{
-
-			statementCondition: getStatementWithCondition("StringNotEquals", "s3:max-keys", "Asia/"),
-			condition:          getInnerMap("max-keys", "Asia/"),
-
-			expectedMatch: false,
-		},
-		// Test case - 8.
-		// StringNotEquals condition doesn't match.
-		{
-
-			statementCondition: getStatementWithCondition("StringNotEquals", "s3:max-keys", "Asia/"),
-			condition:          getInnerMap("max-keys", "Africa/"),
-
-			expectedMatch: true,
-		},
-		// Test case - 9.
-		// StringLike condition matches.
-		{
-			statementCondition: getStatementWithCondition("StringLike", "aws:Referer", "http://www.example.com/"),
-			condition:          getInnerMap("referer", "http://www.example.com/"),
-			expectedMatch:      true,
-		},
-		// Test case - 10.
-		// StringLike condition doesn't match.
-		{
-			statementCondition: getStatementWithCondition("StringLike", "aws:Referer", "http://www.example.com/"),
-			condition:          getInnerMap("referer", "www.somethingelse.com"),
-			expectedMatch:      false,
-		},
-		// Test case - 11.
-		// StringNotLike condition evaluates to false.
-		{
-			statementCondition: getStatementWithCondition("StringNotLike", "aws:Referer", "http://www.example.com/"),
-			condition:          getInnerMap("referer", "http://www.example.com/"),
-			expectedMatch:      false,
-		},
-		// Test case - 12.
-		// StringNotLike condition evaluates to true.
-		{
-			statementCondition: getStatementWithCondition("StringNotLike", "aws:Referer", "http://www.example.com/"),
-			condition:          getInnerMap("referer", "http://somethingelse.com/"),
-			expectedMatch:      true,
-		},
-		// Test case 13.
-		// IpAddress condition evaluates to true.
-		{
-			statementCondition: getStatementWithCondition("IpAddress", "aws:SourceIp", "54.240.143.0/24"),
-			condition:          getInnerMap("ip", "54.240.143.2"),
-			expectedMatch:      true,
-		},
-		// Test case 14.
-		// IpAddress condition evaluates to false.
-		{
-			statementCondition: getStatementWithCondition("IpAddress", "aws:SourceIp", "54.240.143.0/24"),
-			condition:          getInnerMap("ip", "127.240.143.224"),
-			expectedMatch:      false,
-		},
-		// Test case 15.
-		// NotIpAddress condition evaluates to true.
-		{
-			statementCondition: getStatementWithCondition("NotIpAddress", "aws:SourceIp", "54.240.143.0/24"),
-			condition:          getInnerMap("ip", "54.240.144.188"),
-			expectedMatch:      true,
-		},
-		// Test case 16.
-		// NotIpAddress condition evaluates to false.
-		{
-			statementCondition: getStatementWithCondition("NotIpAddress", "aws:SourceIp", "54.240.143.0/24"),
-			condition:          getInnerMap("ip", "54.240.143.243"),
-			expectedMatch:      false,
-		},
-	}
-
-	for i, tc := range testCases {
-		t.Run(fmt.Sprintf("Case %d", i+1), func(t *testing.T) {
-			// call the function under test and assert the result with the expected result.
-			doesMatch := bucketPolicyConditionMatch(tc.condition, tc.statementCondition)
-			if tc.expectedMatch != doesMatch {
-				t.Errorf("Expected the match to be `%v`; got `%v` - %v %v.",
-					tc.expectedMatch, doesMatch, tc.condition, tc.statementCondition)
-			}
-		})
-	}
-}

cmd/bucket-policy-parser.go

@@ -1,295 +0,0 @@
-/*
- * Minio Cloud Storage, (C) 2015, 2016, 2017 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// Package cmd This file implements AWS Access Policy Language parser in
-// accordance with http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
-package cmd
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"sort"
-	"strings"
-
-	"github.com/minio/minio-go/pkg/policy"
-	"github.com/minio/minio-go/pkg/set"
-)
-
-var emptyBucketPolicy = policy.BucketAccessPolicy{}
-
-var conditionKeyActionMap = policy.ConditionKeyMap{
-	"s3:prefix": set.CreateStringSet("s3:ListBucket", "s3:ListBucketMultipartUploads"),
-	"s3:max-keys": set.CreateStringSet("s3:ListBucket", "s3:ListBucketMultipartUploads",
-		"s3:ListMultipartUploadParts"),
-}
-
-// supportedActionMap - lists all the actions supported by minio.
-var supportedActionMap = set.CreateStringSet("*", "s3:*", "s3:GetObject",
-	"s3:ListBucket", "s3:PutObject", "s3:GetBucketLocation", "s3:DeleteObject",
-	"s3:AbortMultipartUpload", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts")
-
-// supported Conditions type.
-var supportedConditionsType = set.CreateStringSet("StringEquals", "StringNotEquals", "StringLike", "StringNotLike", "IpAddress", "NotIpAddress")
-
-// Validate s3:prefix, s3:max-keys are present if not
-// supported keys for the conditions.
-var supportedConditionsKey = set.CreateStringSet("s3:prefix", "s3:max-keys", "aws:Referer", "aws:SourceIp")
-
-// supportedEffectMap - supported effects.
-var supportedEffectMap = set.CreateStringSet("Allow", "Deny")
-
-// isValidActions - are actions valid.
-func isValidActions(actions set.StringSet) (err error) {
-	// Statement actions cannot be empty.
-	if actions.IsEmpty() {
-		err = errors.New("Action list cannot be empty")
-		return err
-	}
-	if unsupportedActions := actions.Difference(supportedActionMap); !unsupportedActions.IsEmpty() {
-		err = fmt.Errorf("Unsupported actions found: ‘%#v’, please validate your policy document",
-			unsupportedActions)
-		return err
-	}
-	return nil
-}
-
-// isValidEffect - is effect valid.
-func isValidEffect(effect string) (err error) {
-	// Statement effect cannot be empty.
-	if effect == "" {
-		err = errors.New("Policy effect cannot be empty")
-		return err
-	}
-	if !supportedEffectMap.Contains(effect) {
-		err = errors.New("Unsupported Effect found: ‘" + effect + "’, please validate your policy document")
-		return err
-	}
-	return nil
-}
-
-// isValidResources - are valid resources.
-func isValidResources(resources set.StringSet) (err error) {
-	// Statement resources cannot be empty.
-	if resources.IsEmpty() {
-		err = errors.New("Resource list cannot be empty")
-		return err
-	}
-	for resource := range resources {
-		if !hasPrefix(resource, bucketARNPrefix) {
-			err = errors.New("Unsupported resource style found: ‘" + resource + "’, please validate your policy document")
-			return err
-		}
-		resourceSuffix := strings.SplitAfter(resource, bucketARNPrefix)[1]
-		if len(resourceSuffix) == 0 || hasPrefix(resourceSuffix, "/") {
-			err = errors.New("Invalid resource style found: ‘" + resource + "’, please validate your policy document")
-			return err
-		}
-	}
-	return nil
-}
-
-// isValidPrincipals - are valid principals.
-func isValidPrincipals(principal policy.User) (err error) {
-	if principal.AWS.IsEmpty() {
-		return errors.New("Principal cannot be empty")
-	}
-	if diff := principal.AWS.Difference(set.CreateStringSet("*")); !diff.IsEmpty() {
-		// Minio does not support or implement IAM, "*" is the only valid value.
-		// Amazon s3 doc on principal:
-		// http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Principal
-		err = fmt.Errorf("Unsupported principals found: ‘%#v’, please validate your policy document",
-			diff)
-		return err
-	}
-	return nil
-}
-
-// isValidConditions - returns nil if the given conditions valid and
-// corresponding error otherwise.
-func isValidConditions(actions set.StringSet, conditions policy.ConditionMap) (err error) {
-	// Verify conditions should be valid. Validate if only
-	// supported condition keys are present and return error
-	// otherwise.
-	conditionKeyVal := make(map[string]set.StringSet)
-	for conditionType := range conditions {
-		if !supportedConditionsType.Contains(conditionType) {
-			err = fmt.Errorf("Unsupported condition type '%s', please validate your policy document", conditionType)
-			return err
-		}
-		for key, value := range conditions[conditionType] {
-			if !supportedConditionsKey.Contains(key) {
-				err = fmt.Errorf("Unsupported condition key '%s', please validate your policy document", conditionType)
-				return err
-			}
-
-			compatibleActions := conditionKeyActionMap[key]
-			if !compatibleActions.IsEmpty() &&
-				compatibleActions.Intersection(actions).IsEmpty() {
-				err = fmt.Errorf("Unsupported condition key %s for the given actions %s, "+
-					"please validate your policy document", key, actions)
-				return err
-			}
-
-			conditionVal, ok := conditionKeyVal[key]
-			if ok && !value.Intersection(conditionVal).IsEmpty() {
-				err = fmt.Errorf("Ambigious condition values for key '%s', please validate your policy document", key)
-				return err
-			}
-			conditionKeyVal[key] = value
-		}
-	}
-	return nil
-}
-
-// List of actions for which prefixes are not allowed.
-var invalidPrefixActions = set.StringSet{
-	"s3:GetBucketLocation":          {},
-	"s3:ListBucket":                 {},
-	"s3:ListBucketMultipartUploads": {},
-	// Add actions which do not honor prefixes.
-}
-
-// resourcePrefix - provides the prefix removing any wildcards.
-func resourcePrefix(resource string) string {
-	if strings.HasSuffix(resource, "*") {
-		resource = strings.TrimSuffix(resource, "*")
-	}
-	return resource
-}
-
-// checkBucketPolicyResources validates Resources in unmarshalled bucket policy structure.
-// - Resources are validated against the given set of Actions.
-// -
-func checkBucketPolicyResources(bucket string, bucketPolicy policy.BucketAccessPolicy) APIErrorCode {
-	// Validate statements for special actions and collect resources
-	// for others to validate nesting.
-	var resourceMap = set.NewStringSet()
-	for _, statement := range bucketPolicy.Statements {
-		for action := range statement.Actions {
-			for resource := range statement.Resources {
-				resourcePrefix := strings.SplitAfter(resource, bucketARNPrefix)[1]
-				if _, ok := invalidPrefixActions[action]; ok {
-					// Resource prefix is not equal to bucket for
-					// prefix invalid actions, reject them.
-					if resourcePrefix != bucket {
-						return ErrMalformedPolicy
-					}
-				} else {
-					// For all other actions validate if resourcePrefix begins
-					// with bucket name, if not reject them.
-					if strings.Split(resourcePrefix, "/")[0] != bucket {
-						return ErrMalformedPolicy
-					}
-					// All valid resources collect them separately to verify nesting.
-					resourceMap.Add(resourcePrefix)
-				}
-			}
-		}
-	}
-
-	var resources []string
-	for resource := range resourceMap {
-		resources = append(resources, resourcePrefix(resource))
-	}
-
-	// Sort strings as shorter first.
-	sort.Strings(resources)
-
-	for len(resources) > 1 {
-		var resource string
-		resource, resources = resources[0], resources[1:]
-		// Loop through all resources, if one of them matches with
-		// previous shorter one, it means we have detected
-		// nesting. Reject such rules.
-		for _, otherResource := range resources {
-			// Common prefix reject such rules.
-			if hasPrefix(otherResource, resource) {
-				return ErrPolicyNesting
-			}
-		}
-	}
-
-	// No errors found.
-	return ErrNone
-}
-
-// parseBucketPolicy - parses and validates if bucket policy is of
-// proper JSON and follows allowed restrictions with policy standards.
-func parseBucketPolicy(bucketPolicyReader io.Reader, bktPolicy *policy.BucketAccessPolicy) (err error) {
-	// Parse bucket policy reader.
-	decoder := json.NewDecoder(bucketPolicyReader)
-	if err = decoder.Decode(bktPolicy); err != nil {
-		return err
-	}
-
-	// Policy version cannot be empty.
-	if len(bktPolicy.Version) == 0 {
-		err = errors.New("Policy version cannot be empty")
-		return err
-	}
-
-	// Policy statements cannot be empty.
-	if len(bktPolicy.Statements) == 0 {
-		err = errors.New("Policy statement cannot be empty")
-		return err
-	}
-
-	// Loop through all policy statements and validate entries.
-	for _, statement := range bktPolicy.Statements {
-		// Statement effect should be valid.
-		if err := isValidEffect(statement.Effect); err != nil {
-			return err
-		}
-		// Statement principal should be supported format.
-		if err := isValidPrincipals(statement.Principal); err != nil {
-			return err
-		}
-		// Statement actions should be valid.
-		if err := isValidActions(statement.Actions); err != nil {
-			return err
-		}
-		// Statement resources should be valid.
-		if err := isValidResources(statement.Resources); err != nil {
-			return err
-		}
-		// Statement conditions should be valid.
-		if err := isValidConditions(statement.Actions, statement.Conditions); err != nil {
-			return err
-		}
-	}
-
-	// Separate deny and allow statements, so that we can apply deny
-	// statements in the beginning followed by Allow statements.
-	var denyStatements []policy.Statement
-	var allowStatements []policy.Statement
-	for _, statement := range bktPolicy.Statements {
-		if statement.Effect == "Deny" {
-			denyStatements = append(denyStatements, statement)
-			continue
-		}
-
-		// else if statement.Effect == "Allow"
-		allowStatements = append(allowStatements, statement)
-	}
-
-	// Deny statements are enforced first once matched.
-	bktPolicy.Statements = append(denyStatements, allowStatements...)
-
-	// Return successfully parsed policy structure.
-	return nil
-}

cmd/bucket-policy-parser_test.go

@@ -1,867 +0,0 @@
-/*
- * Minio Cloud Storage, (C) 2015, 2016 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package cmd
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"reflect"
-	"testing"
-
-	"github.com/minio/minio-go/pkg/policy"
-	"github.com/minio/minio-go/pkg/set"
-)
-
-// Common bucket actions for both read and write policies.
-var (
-	readWriteBucketActions = []string{
-		"s3:GetBucketLocation",
-		"s3:ListBucket",
-		"s3:ListBucketMultipartUploads",
-		// Add more bucket level read-write actions here.
-	}
-	readWriteObjectActions = []string{
-		"s3:AbortMultipartUpload",
-		"s3:DeleteObject",
-		"s3:GetObject",
-		"s3:ListMultipartUploadParts",
-		"s3:PutObject",
-		// Add more object level read-write actions here.
-	}
-)
-
-// Write only actions.
-var (
-	writeOnlyBucketActions = []string{
-		"s3:GetBucketLocation",
-		"s3:ListBucketMultipartUploads",
-		// Add more bucket level write actions here.
-	}
-	writeOnlyObjectActions = []string{
-		"s3:AbortMultipartUpload",
-		"s3:DeleteObject",
-		"s3:ListMultipartUploadParts",
-		"s3:PutObject",
-		// Add more object level write actions here.
-	}
-)
-
-// Read only actions.
-var (
-	readOnlyBucketActions = []string{
-		"s3:GetBucketLocation",
-		"s3:ListBucket",
-		// Add more bucket level read actions here.
-	}
-	readOnlyObjectActions = []string{
-		"s3:GetObject",
-		// Add more object level read actions here.
-	}
-)
-
-// Obtain bucket statement for read-write bucketPolicy.
-func getReadWriteObjectStatement(bucketName, objectPrefix string) policy.Statement {
-	objectResourceStatement := policy.Statement{}
-	objectResourceStatement.Effect = "Allow"
-	objectResourceStatement.Principal = policy.User{
-		AWS: set.StringSet{"*": struct{}{}},
-	}
-	objectResourceStatement.Resources = set.CreateStringSet([]string{fmt.Sprintf("%s%s", bucketARNPrefix, bucketName+"/"+objectPrefix+"*")}...)
-	objectResourceStatement.Actions = set.CreateStringSet(readWriteObjectActions...)
-	return objectResourceStatement
-}
-
-// Obtain object statement for read-write bucketPolicy.
-func getReadWriteBucketStatement(bucketName, objectPrefix string) policy.Statement {
-	bucketResourceStatement := policy.Statement{}
-	bucketResourceStatement.Effect = "Allow"
-	bucketResourceStatement.Principal = policy.User{
-		AWS: set.StringSet{"*": struct{}{}},
-	}
-	bucketResourceStatement.Resources = set.CreateStringSet([]string{fmt.Sprintf("%s%s", bucketARNPrefix, bucketName)}...)
-	bucketResourceStatement.Actions = set.CreateStringSet(readWriteBucketActions...)
-	return bucketResourceStatement
-}
-
-// Obtain statements for read-write bucketPolicy.
-func getReadWriteStatement(bucketName, objectPrefix string) []policy.Statement {
-	statements := []policy.Statement{}
-	// Save the read write policy.
-	statements = append(statements, getReadWriteBucketStatement(bucketName, objectPrefix), getReadWriteObjectStatement(bucketName, objectPrefix))
-	return statements
-}
-
-// Obtain bucket statement for read only bucketPolicy.
-func getReadOnlyBucketStatement(bucketName, objectPrefix string) policy.Statement {
-	bucketResourceStatement := policy.Statement{}
-	bucketResourceStatement.Effect = "Allow"
-	bucketResourceStatement.Principal = policy.User{
-		AWS: set.StringSet{"*": struct{}{}},
-	}
-	bucketResourceStatement.Resources = set.CreateStringSet([]string{fmt.Sprintf("%s%s", bucketARNPrefix, bucketName)}...)
-	bucketResourceStatement.Actions = set.CreateStringSet(readOnlyBucketActions...)
-	return bucketResourceStatement
-}
-
-// Obtain object statement for read only bucketPolicy.
-func getReadOnlyObjectStatement(bucketName, objectPrefix string) policy.Statement {
-	objectResourceStatement := policy.Statement{}
-	objectResourceStatement.Effect = "Allow"
-	objectResourceStatement.Principal = policy.User{
-		AWS: set.StringSet{"*": struct{}{}},
-	}
-	objectResourceStatement.Resources = set.CreateStringSet([]string{fmt.Sprintf("%s%s", bucketARNPrefix, bucketName+"/"+objectPrefix+"*")}...)
-	objectResourceStatement.Actions = set.CreateStringSet(readOnlyObjectActions...)
-	return objectResourceStatement
-}
-
-// Obtain statements for read only bucketPolicy.
-func getReadOnlyStatement(bucketName, objectPrefix string) []policy.Statement {
-	statements := []policy.Statement{}
-	// Save the read only policy.
-	statements = append(statements, getReadOnlyBucketStatement(bucketName, objectPrefix), getReadOnlyObjectStatement(bucketName, objectPrefix))
-	return statements
-}
-
-// Obtain bucket statements for write only bucketPolicy.
-func getWriteOnlyBucketStatement(bucketName, objectPrefix string) policy.Statement {
-
-	bucketResourceStatement := policy.Statement{}
-	bucketResourceStatement.Effect = "Allow"
-	bucketResourceStatement.Principal = policy.User{
-		AWS: set.StringSet{"*": struct{}{}},
-	}
-	bucketResourceStatement.Resources = set.CreateStringSet([]string{fmt.Sprintf("%s%s", bucketARNPrefix, bucketName)}...)
-	bucketResourceStatement.Actions = set.CreateStringSet(writeOnlyBucketActions...)
-	return bucketResourceStatement
-}
-
-// Obtain object statements for write only bucketPolicy.
-func getWriteOnlyObjectStatement(bucketName, objectPrefix string) policy.Statement {
-	objectResourceStatement := policy.Statement{}
-	objectResourceStatement.Effect = "Allow"
-	objectResourceStatement.Principal = policy.User{
-		AWS: set.StringSet{"*": struct{}{}},
-	}
-	objectResourceStatement.Resources = set.CreateStringSet([]string{fmt.Sprintf("%s%s", bucketARNPrefix, bucketName+"/"+objectPrefix+"*")}...)
-	objectResourceStatement.Actions = set.CreateStringSet(writeOnlyObjectActions...)
-	return objectResourceStatement
-}
-
-// Obtain statements for write only bucketPolicy.
-func getWriteOnlyStatement(bucketName, objectPrefix string) []policy.Statement {
-	statements := []policy.Statement{}
-	// Write only policy.
-	// Save the write only policy.
-	statements = append(statements, getWriteOnlyBucketStatement(bucketName, objectPrefix), getWriteOnlyBucketStatement(bucketName, objectPrefix))
-	return statements
-}
-
-// Tests validate Action validator.
-func TestIsValidActions(t *testing.T) {
-	testCases := []struct {
-		// input.
-		actions set.StringSet
-		// expected output.
-		err error
-		// flag indicating whether the test should pass.
-		shouldPass bool
-	}{
-		// Inputs with unsupported Action.
-		// Test case - 1.
-		// "s3:ListObject" is an invalid Action.
-		{set.CreateStringSet([]string{"s3:GetObject", "s3:ListObject", "s3:RemoveObject"}...),
-			errors.New("Unsupported actions found: ‘set.StringSet{\"s3:RemoveObject\":struct {}{}, \"s3:ListObject\":struct {}{}}’, please validate your policy document"), false},
-		// Test case - 2.
-		// Empty Actions.
-		{set.CreateStringSet([]string{}...), errors.New("Action list cannot be empty"), false},
-		// Test case - 3.
-		// "s3:DeleteEverything"" is an invalid Action.
-		{set.CreateStringSet([]string{"s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:DeleteEverything"}...),
-			errors.New("Unsupported actions found: ‘set.StringSet{\"s3:DeleteEverything\":struct {}{}}’, please validate your policy document"), false},
-		// Inputs with valid Action.
-		// Test Case - 4.
-		{set.CreateStringSet([]string{
-			"s3:*", "*", "s3:GetObject", "s3:ListBucket",
-			"s3:PutObject", "s3:GetBucketLocation", "s3:DeleteObject",
-			"s3:AbortMultipartUpload", "s3:ListBucketMultipartUploads",
-			"s3:ListMultipartUploadParts"}...), nil, true},
-	}
-	for i, testCase := range testCases {
-		err := isValidActions(testCase.actions)
-		if err != nil && testCase.shouldPass {
-			t.Errorf("Test %d: Expected to pass, but failed with: <ERROR> %s", i+1, err.Error())
-		}
-		if err == nil && !testCase.shouldPass {
-			t.Errorf("Test %d: Expected to fail with <ERROR> \"%s\", but passed instead", i+1, testCase.err.Error())
-		}
-	}
-}
-
-// Tests validate Effect validator.
-func TestIsValidEffect(t *testing.T) {
-	testCases := []struct {
-		// input.
-		effect string
-		// expected output.
-		err error
-		// flag indicating whether the test should pass.
-		shouldPass bool
-	}{
-		// Inputs with unsupported Effect.
-		// Test case - 1.
-		{"", errors.New("Policy effect cannot be empty"), false},
-		// Test case - 2.
-		{"DontAllow", errors.New("Unsupported Effect found: ‘DontAllow’, please validate your policy document"), false},
-		// Test case - 3.
-		{"NeverAllow", errors.New("Unsupported Effect found: ‘NeverAllow’, please validate your policy document"), false},
-		// Test case - 4.
-		{"AllowAlways", errors.New("Unsupported Effect found: ‘AllowAlways’, please validate your policy document"), false},
-
-		// Inputs with valid Effect.
-		// Test Case - 5.
-		{"Allow", nil, true},
-		// Test Case - 6.
-		{"Deny", nil, true},
-	}
-	for i, testCase := range testCases {
-		err := isValidEffect(testCase.effect)
-		if err != nil && testCase.shouldPass {
-			t.Errorf("Test %d: Expected to pass, but failed with: <ERROR> %s", i+1, err.Error())
-		}
-		if err == nil && !testCase.shouldPass {
-			t.Errorf("Test %d: Expected to fail with <ERROR> \"%s\", but passed instead", i+1, testCase.err.Error())
-		}
-		// Failed as expected, but does it fail for the expected reason.
-		if err != nil && !testCase.shouldPass {
-			if err.Error() != testCase.err.Error() {
-				t.Errorf("Test %d: Expected to fail with error \"%s\", but instead failed with error \"%s\"", i+1, testCase.err.Error(), err.Error())
-			}
-		}
-	}
-}
-
-// Tests validate Resources validator.
-func TestIsValidResources(t *testing.T) {
-	testCases := []struct {
-		// input.
-		resources []string
-		// expected output.
-		err error
-		// flag indicating whether the test should pass.
-		shouldPass bool
-	}{
-		// Inputs with unsupported Action.
-		// Test case - 1.
-		// Empty Resources.
-		{[]string{}, errors.New("Resource list cannot be empty"), false},
-		// Test case - 2.
-		// A valid resource should have prefix bucketARNPrefix.
-		{[]string{"my-resource"}, errors.New("Unsupported resource style found: ‘my-resource’, please validate your policy document"), false},
-		// Test case - 3.
-		// A Valid resource should have bucket name followed by bucketARNPrefix.
-		{[]string{bucketARNPrefix}, errors.New("Invalid resource style found: ‘arn:aws:s3:::’, please validate your policy document"), false},
-		// Test Case - 4.
-		// Valid resource shouldn't have slash('/') followed by bucketARNPrefix.
-		{[]string{bucketARNPrefix + "/"}, errors.New("Invalid resource style found: ‘arn:aws:s3:::/’, please validate your policy document"), false},
-
-		// Test cases with valid Resources.
-		{[]string{bucketARNPrefix + "my-bucket"}, nil, true},
-		{[]string{bucketARNPrefix + "my-bucket/Asia/*"}, nil, true},
-		{[]string{bucketARNPrefix + "my-bucket/Asia/India/*"}, nil, true},
-	}
-	for i, testCase := range testCases {
-		err := isValidResources(set.CreateStringSet(testCase.resources...))
-		if err != nil && testCase.shouldPass {
-			t.Errorf("Test %d: Expected to pass, but failed with: <ERROR> %s", i+1, err.Error())
-		}
-		if err == nil && !testCase.shouldPass {
-			t.Errorf("Test %d: Expected to fail with <ERROR> \"%s\", but passed instead", i+1, testCase.err.Error())
-		}
-		// Failed as expected, but does it fail for the expected reason.
-		if err != nil && !testCase.shouldPass {
-			if err.Error() != testCase.err.Error() {
-				t.Errorf("Test %d: Expected to fail with error \"%s\", but instead failed with error \"%s\"", i+1, testCase.err.Error(), err.Error())
-			}
-		}
-	}
-}
-
-// Tests validate principals validator.
-func TestIsValidPrincipals(t *testing.T) {
-	testCases := []struct {
-		// input.
-		principals []string
-		// expected output.
-		err error
-		// flag indicating whether the test should pass.
-		shouldPass bool
-	}{
-		// Inputs with unsupported Principals.
-		// Test case - 1.
-		// Empty Principals list.
-		{[]string{}, errors.New("Principal cannot be empty"), false},
-		// Test case - 2.
-		// "*" is the only valid principal.
-		{[]string{"my-principal"}, errors.New("Unsupported principals found: ‘set.StringSet{\"my-principal\":struct {}{}}’, please validate your policy document"), false},
-		// Test case - 3.
-		{[]string{"*", "111122233"}, errors.New("Unsupported principals found: ‘set.StringSet{\"111122233\":struct {}{}}’, please validate your policy document"), false},
-		// Test case - 4.
-		// Test case with valid principal value.
-		{[]string{"*"}, nil, true},
-	}
-	for i, testCase := range testCases {
-		u := policy.User{
-			AWS: set.CreateStringSet(testCase.principals...),
-		}
-		err := isValidPrincipals(u)
-		if err != nil && testCase.shouldPass {
-			t.Errorf("Test %d: Expected to pass, but failed with: <ERROR> %s", i+1, err.Error())
-		}
-		if err == nil && !testCase.shouldPass {
-			t.Errorf("Test %d: Expected to fail with <ERROR> \"%s\", but passed instead", i+1, testCase.err.Error())
-		}
-		// Failed as expected, but does it fail for the expected reason.
-		if err != nil && !testCase.shouldPass {
-			if err.Error() != testCase.err.Error() {
-				t.Errorf("Test %d: Expected to fail with error \"%s\", but instead failed with error \"%s\"", i+1, testCase.err.Error(), err.Error())
-			}
-		}
-	}
-}
-
-// getEmptyConditionMap - returns a function that generates a
-// condition key map for a given key.
-func getEmptyConditionMap(conditionKey string) func() policy.ConditionMap {
-	emptyConditonGenerator := func() policy.ConditionMap {
-		emptyMap := make(policy.ConditionKeyMap)
-		conditions := make(policy.ConditionMap)
-		conditions[conditionKey] = emptyMap
-		return conditions
-	}
-	return emptyConditonGenerator
-}
-
-// Tests validate policy.Statement condition validator.
-func TestIsValidConditions(t *testing.T) {
-	// returns empty conditions map.
-	setEmptyConditions := func() policy.ConditionMap {
-		return make(policy.ConditionMap)
-	}
-
-	// returns map with the "StringEquals" set to empty map.
-	setEmptyStringEquals := getEmptyConditionMap("StringEquals")
-
-	// returns map with the "StringNotEquals" set to empty map.
-	setEmptyStringNotEquals := getEmptyConditionMap("StringNotEquals")
-
-	// returns map with the "StringLike" set to empty map.
-	setEmptyStringLike := getEmptyConditionMap("StringLike")
-
-	// returns map with the "StringNotLike" set to empty map.
-	setEmptyStringNotLike := getEmptyConditionMap("StringNotLike")
-
-	// returns map with the "IpAddress" set to empty map.
-	setEmptyIPAddress := getEmptyConditionMap("IpAddress")
-
-	// returns map with "NotIpAddress" set to empty map.
-	setEmptyNotIPAddress := getEmptyConditionMap("NotIpAddress")
-
-	// Generate conditions.
-	generateConditions := func(key1, key2, value string) policy.ConditionMap {
-		innerMap := make(policy.ConditionKeyMap)
-		innerMap[key2] = set.CreateStringSet(value)
-		conditions := make(policy.ConditionMap)
-		conditions[key1] = innerMap
-		return conditions
-	}
-
-	// generate ambigious conditions.
-	generateAmbigiousConditions := func() policy.ConditionMap {
-		prefixMap := make(policy.ConditionKeyMap)
-		prefixMap["s3:prefix"] = set.CreateStringSet("Asia/")
-		conditions := make(policy.ConditionMap)
-		conditions["StringEquals"] = prefixMap
-		conditions["StringNotEquals"] = prefixMap
-		return conditions
-	}
-
-	// generate valid and non valid type in the condition map.
-	generateValidInvalidConditions := func() policy.ConditionMap {
-		innerMap := make(policy.ConditionKeyMap)
-		innerMap["s3:prefix"] = set.CreateStringSet("Asia/")
-		conditions := make(policy.ConditionMap)
-		conditions["StringEquals"] = innerMap
-		conditions["InvalidType"] = innerMap
-		return conditions
-	}
-
-	// generate valid and invalid keys for valid types in the same condition map.
-	generateValidInvalidConditionKeys := func() policy.ConditionMap {
-		innerMapValid := make(policy.ConditionKeyMap)
-		innerMapValid["s3:prefix"] = set.CreateStringSet("Asia/")
-		innerMapInValid := make(map[string]set.StringSet)
-		innerMapInValid["s3:invalid"] = set.CreateStringSet("Asia/")
-		conditions := make(policy.ConditionMap)
-		conditions["StringEquals"] = innerMapValid
-		conditions["StringEquals"] = innerMapInValid
-		return conditions
-	}
-
-	// List of Conditions used for test cases.
-	testConditions := []policy.ConditionMap{
-		generateConditions("StringValues", "s3:max-keys", "100"),
-		generateConditions("StringEquals", "s3:Object", "100"),
-		generateAmbigiousConditions(),
-		generateValidInvalidConditions(),
-		generateValidInvalidConditionKeys(),
-		setEmptyConditions(),
-		setEmptyStringEquals(),
-		setEmptyStringNotEquals(),
-		setEmptyStringLike(),
-		setEmptyStringNotLike(),
-		setEmptyIPAddress(),
-		setEmptyNotIPAddress(),
-		generateConditions("StringEquals", "s3:prefix", "Asia/"),
-		generateConditions("StringEquals", "s3:max-keys", "100"),
-		generateConditions("StringNotEquals", "s3:prefix", "Asia/"),
-		generateConditions("StringNotEquals", "s3:max-keys", "100"),
-	}
-
-	getObjectActionSet := set.CreateStringSet("s3:GetObject")
-	roBucketActionSet := set.CreateStringSet(readOnlyBucketActions...)
-	maxKeysConditionErr := fmt.Errorf("Unsupported condition key %s for the given actions %s, "+
-		"please validate your policy document", "s3:max-keys", getObjectActionSet)
-	testCases := []struct {
-		inputActions   set.StringSet
-		inputCondition policy.ConditionMap
-		// expected result.
-		expectedErr error
-		// flag indicating whether test should pass.
-		shouldPass bool
-	}{
-		// Malformed conditions.
-		// Test case - 1.
-		// "StringValues" is an invalid type.
-		{roBucketActionSet, testConditions[0], fmt.Errorf("Unsupported condition type 'StringValues', " +
-			"please validate your policy document"), false},
-		// Test case - 2.
-		// "s3:Object" is an invalid key.
-		{roBucketActionSet, testConditions[1], fmt.Errorf("Unsupported condition key " +
-			"'StringEquals', please validate your policy document"), false},
-		// Test case - 3.
-		// Test case with Ambigious conditions set.
-		{roBucketActionSet, testConditions[2], fmt.Errorf("Ambigious condition values for key 's3:prefix', " +
-			"please validate your policy document"), false},
-		// Test case - 4.
-		// Test case with valid and invalid condition types.
-		{roBucketActionSet, testConditions[3], fmt.Errorf("Unsupported condition type 'InvalidType', " +
-			"please validate your policy document"), false},
-		// Test case - 5.
-		// Test case with valid and invalid condition keys.
-		{roBucketActionSet, testConditions[4], fmt.Errorf("Unsupported condition key 'StringEquals', " +
-			"please validate your policy document"), false},
-		// Test cases with valid conditions.
-		// Test case - 6.
-		{roBucketActionSet, testConditions[5], nil, true},
-		// Test case - 7.
-		{roBucketActionSet, testConditions[6], nil, true},
-		// Test case - 8.
-		{roBucketActionSet, testConditions[7], nil, true},
-		// Test case - 9.
-		{roBucketActionSet, testConditions[8], nil, true},
-		// Test case - 10.
-		{roBucketActionSet, testConditions[9], nil, true},
-		// Test case - 11.
-		{roBucketActionSet, testConditions[10], nil, true},
-		// Test case - 12.
-		{roBucketActionSet, testConditions[11], nil, true},
-		// Test case - 13.
-		{roBucketActionSet, testConditions[12], nil, true},
-		// Test case - 11.
-		{roBucketActionSet, testConditions[13], nil, true},
-		// Test case - 12.
-		{roBucketActionSet, testConditions[14], nil, true},
-		// Test case - 13.
-		{getObjectActionSet, testConditions[15], maxKeysConditionErr, false},
-	}
-	for i, testCase := range testCases {
-		actualErr := isValidConditions(testCase.inputActions, testCase.inputCondition)
-		if actualErr != nil && testCase.shouldPass {
-			t.Errorf("Test %d: Expected to pass, but failed with: <ERROR> %s", i+1, actualErr.Error())
-		}
-		if actualErr == nil && !testCase.shouldPass {
-			t.Errorf("Test %d: Expected to fail with <ERROR> \"%s\", but passed instead", i+1, testCase.expectedErr.Error())
-		}
-		// Failed as expected, but does it fail for the expected reason.
-		if actualErr != nil && !testCase.shouldPass {
-			if actualErr.Error() != testCase.expectedErr.Error() {
-				t.Errorf("Test %d: Expected to fail with error \"%s\", but instead failed with error \"%s\"", i+1, testCase.expectedErr.Error(), actualErr.Error())
-			}
-		}
-	}
-}
-
-// Tests validate Policy Action and Resource fields.
-func TestCheckbucketPolicyResources(t *testing.T) {
-	// constructing policy statement without invalidPrefixActions (check bucket-policy-parser.go).
-	setValidPrefixActions := func(statements []policy.Statement) []policy.Statement {
-		statements[0].Actions = set.CreateStringSet([]string{"s3:DeleteObject", "s3:PutObject"}...)
-		return statements
-	}
-	// contracting policy statement with recursive resources.
-	// should result in ErrMalformedPolicy
-	setRecurseResource := func(statements []policy.Statement) []policy.Statement {
-		statements[0].Resources = set.CreateStringSet([]string{"arn:aws:s3:::minio-bucket/Asia/*", "arn:aws:s3:::minio-bucket/Asia/India/*"}...)
-		return statements
-	}
-
-	// constructing policy statement with lexically close characters.
-	// should not result in ErrMalformedPolicy
-	setResourceLexical := func(statements []policy.Statement) []policy.Statement {
-		statements[0].Resources = set.CreateStringSet([]string{"arn:aws:s3:::minio-bucket/op*", "arn:aws:s3:::minio-bucket/oo*"}...)
-		return statements
-	}
-
-	// List of bucketPolicy used for tests.
-	bucketAccessPolicies := []policy.BucketAccessPolicy{
-		// bucketPolicy - 1.
-		// Contains valid read only policy statement.
-		{Version: "1.0", Statements: getReadOnlyStatement("minio-bucket", "")},
-		// bucketPolicy - 2.
-		// Contains valid read-write only policy statement.
-		{Version: "1.0", Statements: getReadWriteStatement("minio-bucket", "Asia/")},
-		// bucketPolicy - 3.
-		// Contains valid write only policy statement.
-		{Version: "1.0", Statements: getWriteOnlyStatement("minio-bucket", "Asia/India/")},
-		// bucketPolicy - 4.
-		// Contains invalidPrefixActions.
-		// Since resourcePrefix is not to the bucket-name, it return ErrMalformedPolicy.
-		{Version: "1.0", Statements: getReadOnlyStatement("minio-bucket-fail", "Asia/India/")},
-		// bucketPolicy - 5.
-		// constructing policy statement without invalidPrefixActions (check bucket-policy-parser.go).
-		// but bucket part of the resource is not equal to the bucket name.
-		// this results in return of ErrMalformedPolicy.
-		{Version: "1.0", Statements: setValidPrefixActions(getWriteOnlyStatement("minio-bucket-fail", "Asia/India/"))},
-		// bucketPolicy - 6.
-		// contracting policy statement with recursive resources.
-		// should result in ErrMalformedPolicy
-		{Version: "1.0", Statements: setRecurseResource(setValidPrefixActions(getWriteOnlyStatement("minio-bucket", "")))},
-		// BucketPolciy - 7.
-		// constructing policy statement with non recursive but
-		// lexically close resources.
-		// should result in ErrNone.
-		{Version: "1.0", Statements: setResourceLexical(setValidPrefixActions(getWriteOnlyStatement("minio-bucket", "oo")))},
-	}
-
-	testCases := []struct {
-		inputPolicy policy.BucketAccessPolicy
-		// expected results.
-		apiErrCode APIErrorCode
-		// Flag indicating whether the test should pass.
-		shouldPass bool
-	}{
-		// Test case - 1.
-		{bucketAccessPolicies[0], ErrNone, true},
-		// Test case - 2.
-		{bucketAccessPolicies[1], ErrNone, true},
-		// Test case - 3.
-		{bucketAccessPolicies[2], ErrNone, true},
-		// Test case - 4.
-		// contains invalidPrefixActions (check bucket-policy-parser.go).
-		// Resource prefix will not be equal to the bucket name in this case.
-		{bucketAccessPolicies[3], ErrMalformedPolicy, false},
-		// Test case - 5.
-		// actions contain invalidPrefixActions (check bucket-policy-parser.go).
-		// Resource prefix bucket part is not equal to the bucket name in this case.
-		{bucketAccessPolicies[4], ErrMalformedPolicy, false},
-		// Test case - 6.
-		// contracting policy statement with recursive resources.
-		// should result in ErrPolicyNesting.
-		{bucketAccessPolicies[5], ErrPolicyNesting, false},
-		// Test case - 7.
-		// constructing policy statement with lexically close
-		// characters.
-		// should result in ErrNone.
-		{bucketAccessPolicies[6], ErrNone, true},
-	}
-	for i, testCase := range testCases {
-		apiErrCode := checkBucketPolicyResources("minio-bucket", testCase.inputPolicy)
-		if apiErrCode != ErrNone && testCase.shouldPass {
-			t.Errorf("Test %d: Expected to pass, but failed with Errocode %v", i+1, apiErrCode)
-		}
-		if apiErrCode == ErrNone && !testCase.shouldPass {
-			t.Errorf("Test %d: Expected to fail with ErrCode %v, but passed instead", i+1, testCase.apiErrCode)
-		}
-		// Failed as expected, but does it fail for the expected reason.
-		if apiErrCode != ErrNone && !testCase.shouldPass {
-			if testCase.apiErrCode != apiErrCode {
-				t.Errorf("Test %d: Expected to fail with error code %v, but instead failed with error code %v", i+1, testCase.apiErrCode, apiErrCode)
-			}
-		}
-	}
-}
-
-// Tests validate parsing of BucketAccessPolicy.
-func TestParseBucketPolicy(t *testing.T) {
-	// set Unsupported Actions.
-	setUnsupportedActions := func(statements []policy.Statement) []policy.Statement {
-		// "s3:DeleteEverything"" is an Unsupported Action.
-		statements[0].Actions = set.CreateStringSet([]string{"s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:DeleteEverything"}...)
-		return statements
-	}
-	// set unsupported Effect.
-	setUnsupportedEffect := func(statements []policy.Statement) []policy.Statement {
-		// Effect "Don't allow" is Unsupported.
-		statements[0].Effect = "DontAllow"
-		return statements
-	}
-	// set unsupported principals.
-	setUnsupportedPrincipals := func(statements []policy.Statement) []policy.Statement {
-		// "User1111"" is an Unsupported Principal.
-		statements[0].Principal = policy.User{
-			AWS: set.CreateStringSet([]string{"*", "User1111"}...),
-		}
-		return statements
-	}
-	// set unsupported Resources.
-	setUnsupportedResources := func(statements []policy.Statement) []policy.Statement {
-		// "s3:DeleteEverything"" is an Unsupported Action.
-		statements[0].Resources = set.CreateStringSet([]string{"my-resource"}...)
-		return statements
-	}
-	// List of bucketPolicy used for test cases.
-	bucketAccesPolicies := []policy.BucketAccessPolicy{
-		// bucketPolicy - 0.
-		// bucketPolicy statement empty.
-		{Version: "1.0"},
-		// bucketPolicy - 1.
-		// bucketPolicy version empty.
-		{Version: "", Statements: []policy.Statement{}},
-		// bucketPolicy - 2.
-		// Readonly bucketPolicy.
-		{Version: "1.0", Statements: getReadOnlyStatement("minio-bucket", "")},
-		// bucketPolicy - 3.
-		// Read-Write bucket policy.
-		{Version: "1.0", Statements: getReadWriteStatement("minio-bucket", "Asia/")},
-		// bucketPolicy - 4.
-		// Write only bucket policy.
-		{Version: "1.0", Statements: getWriteOnlyStatement("minio-bucket", "Asia/India/")},
-		// bucketPolicy - 5.
-		// bucketPolicy statement contains unsupported action.
-		{Version: "1.0", Statements: setUnsupportedActions(getReadOnlyStatement("minio-bucket", ""))},
-		// bucketPolicy - 6.
-		// bucketPolicy statement contains unsupported Effect.
-		{Version: "1.0", Statements: setUnsupportedEffect(getReadWriteStatement("minio-bucket", "Asia/"))},
-		// bucketPolicy - 7.
-		// bucketPolicy statement contains unsupported Principal.
-		{Version: "1.0", Statements: setUnsupportedPrincipals(getWriteOnlyStatement("minio-bucket", "Asia/India/"))},
-		// bucketPolicy - 8.
-		// bucketPolicy statement contains unsupported Resource.
-		{Version: "1.0", Statements: setUnsupportedResources(getWriteOnlyStatement("minio-bucket", "Asia/India/"))},
-	}
-
-	testCases := []struct {
-		inputPolicy policy.BucketAccessPolicy
-		// expected results.
-		expectedPolicy policy.BucketAccessPolicy
-		err            error
-		// Flag indicating whether the test should pass.
-		shouldPass bool
-	}{
-		// Test case - 1.
-		// bucketPolicy statement empty.
-		{bucketAccesPolicies[0], policy.BucketAccessPolicy{}, errors.New("Policy statement cannot be empty"), false},
-		// Test case - 2.
-		// bucketPolicy version empty.
-		{bucketAccesPolicies[1], policy.BucketAccessPolicy{}, errors.New("Policy version cannot be empty"), false},
-		// Test case - 3.
-		// Readonly bucketPolicy.
-		{bucketAccesPolicies[2], bucketAccesPolicies[2], nil, true},
-		// Test case - 4.
-		// Read-Write bucket policy.
-		{bucketAccesPolicies[3], bucketAccesPolicies[3], nil, true},
-		// Test case - 5.
-		// Write only bucket policy.
-		{bucketAccesPolicies[4], bucketAccesPolicies[4], nil, true},
-		// Test case - 6.
-		// bucketPolicy statement contains unsupported action.
-		{bucketAccesPolicies[5], bucketAccesPolicies[5], fmt.Errorf("Unsupported actions found: ‘set.StringSet{\"s3:DeleteEverything\":struct {}{}}’, please validate your policy document"), false},
-		// Test case - 7.
-		// bucketPolicy statement contains unsupported Effect.
-		{bucketAccesPolicies[6], bucketAccesPolicies[6], fmt.Errorf("Unsupported Effect found: ‘DontAllow’, please validate your policy document"), false},
-		// Test case - 8.
-		// bucketPolicy statement contains unsupported Principal.
-		{bucketAccesPolicies[7], bucketAccesPolicies[7], fmt.Errorf("Unsupported principals found: ‘set.StringSet{\"User1111\":struct {}{}}’, please validate your policy document"), false},
-		// Test case - 9.
-		// bucketPolicy statement contains unsupported Resource.
-		{bucketAccesPolicies[8], bucketAccesPolicies[8], fmt.Errorf("Unsupported resource style found: ‘my-resource’, please validate your policy document"), false},
-	}
-	for i, testCase := range testCases {
-		var buffer bytes.Buffer
-		encoder := json.NewEncoder(&buffer)
-		err := encoder.Encode(testCase.inputPolicy)
-		if err != nil {
-			t.Fatalf("Test %d: Couldn't Marshal bucket policy %s", i+1, err)
-		}
-
-		var actualAccessPolicy = policy.BucketAccessPolicy{}
-		err = parseBucketPolicy(&buffer, &actualAccessPolicy)
-		if err != nil && testCase.shouldPass {
-			t.Errorf("Test %d: Expected to pass, but failed with: <ERROR> %s", i+1, err.Error())
-		}
-		if err == nil && !testCase.shouldPass {
-			t.Errorf("Test %d: Expected to fail with <ERROR> \"%s\", but passed instead", i+1, testCase.err.Error())
-		}
-		// Failed as expected, but does it fail for the expected reason.
-		if err != nil && !testCase.shouldPass {
-			if err.Error() != testCase.err.Error() {
-				t.Errorf("Test %d: Expected to fail with error \"%s\", but instead failed with error \"%s\"", i+1, testCase.err.Error(), err.Error())
-			}
-		}
-		// Test passes as expected, but the output values are verified for correctness here.
-		if err == nil && testCase.shouldPass {
-			if !reflect.DeepEqual(testCase.expectedPolicy, actualAccessPolicy) {
-				t.Errorf("Test %d: The expected statements from resource statement generator doesn't match the actual statements", i+1)
-			}
-		}
-	}
-}
-
-func TestAWSRefererCondition(t *testing.T) {
-	resource := set.CreateStringSet([]string{
-		fmt.Sprintf("%s%s", bucketARNPrefix, "minio-bucket"+"/"+"Asia"+"*"),
-	}...)
-
-	conditionsKeyMap := make(policy.ConditionKeyMap)
-	conditionsKeyMap.Add("aws:Referer",
-		set.CreateStringSet("www.example.com",
-			"http://www.example.com"))
-
-	requestConditionMap := make(policy.ConditionKeyMap)
-	requestConditionMap["referer"] = set.CreateStringSet("www.example.com")
-
-	testCases := []struct {
-		effect       string
-		conditionKey string
-		match        bool
-	}{
-		{
-			effect:       "Allow",
-			conditionKey: "StringLike",
-			match:        true,
-		},
-		{
-			effect:       "Allow",
-			conditionKey: "StringNotLike",
-			match:        false,
-		},
-		{
-			effect:       "Deny",
-			conditionKey: "StringLike",
-			match:        true,
-		},
-		{
-			effect:       "Deny",
-			conditionKey: "StringNotLike",
-			match:        false,
-		},
-	}
-
-	for i, test := range testCases {
-		conditions := make(policy.ConditionMap)
-		conditions[test.conditionKey] = conditionsKeyMap
-
-		allowStatement := policy.Statement{
-			Sid:    "Testing AWS referer condition",
-			Effect: test.effect,
-			Principal: policy.User{
-				AWS: set.CreateStringSet("*"),
-			},
-			Resources:  resource,
-			Conditions: conditions,
-		}
-
-		if result := bucketPolicyConditionMatch(requestConditionMap, allowStatement); result != test.match {
-			t.Errorf("Test %d -  Expected conditons to evaluate to %v but got %v",
-				i+1, test.match, result)
-		}
-	}
-}
-
-func TestAWSSourceIPCondition(t *testing.T) {
-	resource := set.CreateStringSet([]string{
-		fmt.Sprintf("%s%s", bucketARNPrefix, "minio-bucket"+"/"+"Asia"+"*"),
-	}...)
-
-	conditionsKeyMap := make(policy.ConditionKeyMap)
-	// Test both IPv4 and IPv6 addresses.
-	conditionsKeyMap.Add("aws:SourceIp",
-		set.CreateStringSet("54.240.143.0/24",
-			"2001:DB8:1234:5678::/64"))
-
-	requestConditionMap := make(policy.ConditionKeyMap)
-	requestConditionMap["ip"] = set.CreateStringSet("54.240.143.2")
-
-	testCases := []struct {
-		effect       string
-		conditionKey string
-		match        bool
-	}{
-		{
-			effect:       "Allow",
-			conditionKey: "IpAddress",
-			match:        true,
-		},
-		{
-			effect:       "Allow",
-			conditionKey: "NotIpAddress",
-			match:        false,
-		},
-		{
-			effect:       "Deny",
-			conditionKey: "IpAddress",
-			match:        true,
-		},
-		{
-			effect:       "Deny",
-			conditionKey: "NotIpAddress",
-			match:        false,
-		},
-	}
-
-	for i, test := range testCases {
-		conditions := make(policy.ConditionMap)
-		conditions[test.conditionKey] = conditionsKeyMap
-
-		allowStatement := policy.Statement{
-			Sid:    "Testing AWS referer condition",
-			Effect: test.effect,
-			Principal: policy.User{
-				AWS: set.CreateStringSet("*"),
-			},
-			Resources:  resource,
-			Conditions: conditions,
-		}
-
-		if result := bucketPolicyConditionMatch(requestConditionMap, allowStatement); result != test.match {
-			t.Errorf("Test %d -  Expected conditons to evaluate to %v but got %v",
-				i+1, test.match, result)
-		}
-	}
-}

cmd/bucket-policy.go

@@ -1,207 +0,0 @@
-/*
- * Minio Cloud Storage, (C) 2015, 2016, 2017, 2018 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package cmd
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"reflect"
-	"sync"
-
-	"github.com/minio/minio-go/pkg/policy"
-	"github.com/minio/minio/pkg/errors"
-	"github.com/minio/minio/pkg/hash"
-)
-
-const (
-	// Static prefix to be used while constructing bucket ARN.
-	// refer to S3 docs for more info.
-	bucketARNPrefix = "arn:aws:s3:::"
-
-	// Bucket policy config name.
-	bucketPolicyConfig = "policy.json"
-)
-
-// Global bucket policies list, policies are enforced on each bucket looking
-// through the policies here.
-type bucketPolicies struct {
-	rwMutex *sync.RWMutex
-
-	// Collection of 'bucket' policies.
-	bucketPolicyConfigs map[string]policy.BucketAccessPolicy
-}
-
-// Fetch bucket policy for a given bucket.
-func (bp bucketPolicies) GetBucketPolicy(bucket string) policy.BucketAccessPolicy {
-	bp.rwMutex.RLock()
-	defer bp.rwMutex.RUnlock()
-	return bp.bucketPolicyConfigs[bucket]
-}
-
-// Set a new bucket policy for a bucket, this operation will overwrite
-// any previous bucket policies for the bucket.
-func (bp *bucketPolicies) SetBucketPolicy(bucket string, newpolicy policy.BucketAccessPolicy) error {
-	bp.rwMutex.Lock()
-	defer bp.rwMutex.Unlock()
-
-	if reflect.DeepEqual(newpolicy, emptyBucketPolicy) {
-		return errInvalidArgument
-	}
-	bp.bucketPolicyConfigs[bucket] = newpolicy
-
-	return nil
-}
-
-// Delete bucket policy from struct for a given bucket.
-func (bp *bucketPolicies) DeleteBucketPolicy(bucket string) error {
-	bp.rwMutex.Lock()
-	defer bp.rwMutex.Unlock()
-	delete(bp.bucketPolicyConfigs, bucket)
-	return nil
-}
-
-// Intialize all bucket policies.
-func initBucketPolicies(objAPI ObjectLayer) (*bucketPolicies, error) {
-	if objAPI == nil {
-		return nil, errInvalidArgument
-	}
-
-	// List buckets to proceed loading all notification configuration.
-	buckets, err := objAPI.ListBuckets(context.Background())
-	if err != nil {
-		return nil, errors.Cause(err)
-	}
-
-	policies := make(map[string]policy.BucketAccessPolicy)
-	// Loads bucket policy.
-	for _, bucket := range buckets {
-		bp, pErr := ReadBucketPolicy(bucket.Name, objAPI)
-		if pErr != nil {
-			// net.Dial fails for rpc client or any
-			// other unexpected errors during net.Dial.
-			if !errors.IsErrIgnored(pErr, errDiskNotFound) {
-				if !isErrBucketPolicyNotFound(pErr) {
-					return nil, errors.Cause(pErr)
-				}
-			}
-			// Continue to load other bucket policies if possible.
-			continue
-		}
-		policies[bucket.Name] = bp
-	}
-
-	// Return all bucket policies.
-	return &bucketPolicies{
-		rwMutex:             &sync.RWMutex{},
-		bucketPolicyConfigs: policies,
-	}, nil
-}
-
-// readBucketPolicyJSON - reads bucket policy for an input bucket, returns BucketPolicyNotFound
-// if bucket policy is not found.
-func readBucketPolicyJSON(bucket string, objAPI ObjectLayer) (bucketPolicyReader io.Reader, err error) {
-	policyPath := pathJoin(bucketConfigPrefix, bucket, bucketPolicyConfig)
-
-	var buffer bytes.Buffer
-	err = objAPI.GetObject(context.Background(), minioMetaBucket, policyPath, 0, -1, &buffer, "")
-	if err != nil {
-		if isErrObjectNotFound(err) || isErrIncompleteBody(err) {
-			return nil, PolicyNotFound{Bucket: bucket}
-		}
-		errorIf(err, "Unable to load policy for the bucket %s.", bucket)
-		return nil, errors.Cause(err)
-	}
-
-	return &buffer, nil
-}
-
-// ReadBucketPolicy - reads bucket policy for an input bucket, returns BucketPolicyNotFound
-// if bucket policy is not found. This function also parses the bucket policy into an object.
-func ReadBucketPolicy(bucket string, objAPI ObjectLayer) (policy.BucketAccessPolicy, error) {
-	// Read bucket policy JSON.
-	bucketPolicyReader, err := readBucketPolicyJSON(bucket, objAPI)
-	if err != nil {
-		return emptyBucketPolicy, err
-	}
-
-	// Parse the saved policy.
-	var bp policy.BucketAccessPolicy
-	if err = parseBucketPolicy(bucketPolicyReader, &bp); err != nil {
-		return emptyBucketPolicy, err
-
-	}
-	return bp, nil
-}
-
-// removeBucketPolicy - removes any previously written bucket policy. Returns BucketPolicyNotFound
-// if no policies are found.
-func removeBucketPolicy(bucket string, objAPI ObjectLayer) error {
-	policyPath := pathJoin(bucketConfigPrefix, bucket, bucketPolicyConfig)
-	err := objAPI.DeleteObject(context.Background(), minioMetaBucket, policyPath)
-	if err != nil {
-		err = errors.Cause(err)
-		if _, ok := err.(ObjectNotFound); ok {
-			return BucketPolicyNotFound{Bucket: bucket}
-		}
-		return err
-	}
-	return nil
-}
-
-// writeBucketPolicy - save a bucket policy that is assumed to be validated.
-func writeBucketPolicy(bucket string, objAPI ObjectLayer, bpy policy.BucketAccessPolicy) error {
-	buf, err := json.Marshal(bpy)
-	if err != nil {
-		errorIf(err, "Unable to marshal bucket policy '%#v' to JSON", bpy)
-		return err
-	}
-	policyPath := pathJoin(bucketConfigPrefix, bucket, bucketPolicyConfig)
-	hashReader, err := hash.NewReader(bytes.NewReader(buf), int64(len(buf)), "", getSHA256Hash(buf))
-	if err != nil {
-		errorIf(err, "Unable to set policy for the bucket %s", bucket)
-		return errors.Cause(err)
-	}
-
-	if _, err = objAPI.PutObject(context.Background(), minioMetaBucket, policyPath, hashReader, nil); err != nil {
-		errorIf(err, "Unable to set policy for the bucket %s", bucket)
-		return errors.Cause(err)
-	}
-	return nil
-}
-
-// persistAndNotifyBucketPolicyChange - takes a policyChange argument,
-// persists it to storage, and notify nodes in the cluster about the
-// change. In-memory state is updated in response to the notification.
-func persistAndNotifyBucketPolicyChange(bucket string, isRemove bool, bktPolicy policy.BucketAccessPolicy, objAPI ObjectLayer) error {
-	if isRemove {
-		err := removeBucketPolicy(bucket, objAPI)
-		if err != nil {
-			return err
-		}
-	} else {
-		if reflect.DeepEqual(bktPolicy, emptyBucketPolicy) {
-			return errInvalidArgument
-		}
-		if err := writeBucketPolicy(bucket, objAPI, bktPolicy); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}

cmd/certs.go

@@ -17,10 +17,12 @@
 package cmd
 
 import (
+	"bytes"
+	"crypto"
+	"crypto/ecdsa"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/pem"
-	"fmt"
 	"io/ioutil"
 	"os"
 )
@@ -37,24 +39,27 @@ func parsePublicCertFile(certFile string) (x509Certs []*x509.Certificate, err er
 		return nil, err
 	}
 
+	// Trimming leading and tailing white spaces.
+	data = bytes.TrimSpace(data)
+
 	// Parse all certs in the chain.
 	current := data
 	for len(current) > 0 {
 		var pemBlock *pem.Block
 		if pemBlock, current = pem.Decode(current); pemBlock == nil {
-			return nil, fmt.Errorf("Could not read PEM block from file %s", certFile)
+			return nil, uiErrSSLUnexpectedData(nil).Msg("Could not read PEM block from file %s", certFile)
 		}
 
 		var x509Cert *x509.Certificate
 		if x509Cert, err = x509.ParseCertificate(pemBlock.Bytes); err != nil {
-			return nil, err
+			return nil, uiErrSSLUnexpectedData(err)
 		}
 
 		x509Certs = append(x509Certs, x509Cert)
 	}
 
 	if len(x509Certs) == 0 {
-		return nil, fmt.Errorf("Empty public certificate file %s", certFile)
+		return nil, uiErrSSLUnexpectedData(nil).Msg("Empty public certificate file %s", certFile)
 	}
 
 	return x509Certs, nil
@@ -105,28 +110,32 @@ func getRootCAs(certsCAsDir string) (*x509.CertPool, error) {
 func loadX509KeyPair(certFile, keyFile string) (tls.Certificate, error) {
 	certPEMBlock, err := ioutil.ReadFile(certFile)
 	if err != nil {
-		return tls.Certificate{}, fmt.Errorf("TLS: failed to read cert file: %v", err)
+		return tls.Certificate{}, uiErrSSLUnexpectedError(err)
 	}
 	keyPEMBlock, err := ioutil.ReadFile(keyFile)
 	if err != nil {
-		return tls.Certificate{}, fmt.Errorf("TLS: failed to read private key: %v", err)
+		return tls.Certificate{}, uiErrSSLUnexpectedError(err)
 	}
 	key, rest := pem.Decode(keyPEMBlock)
 	if len(rest) > 0 {
-		return tls.Certificate{}, fmt.Errorf("TLS: private key contains additional data")
+		return tls.Certificate{}, uiErrSSLUnexpectedData(nil).Msg("The private key contains additional data")
 	}
 	if x509.IsEncryptedPEMBlock(key) {
 		password, ok := os.LookupEnv(TLSPrivateKeyPassword)
 		if !ok {
-			return tls.Certificate{}, fmt.Errorf("TLS: private key is encrypted but no password is present - set env var: %s", TLSPrivateKeyPassword)
+			return tls.Certificate{}, uiErrSSLNoPassword(nil)
 		}
 		decryptedKey, decErr := x509.DecryptPEMBlock(key, []byte(password))
 		if decErr != nil {
-			return tls.Certificate{}, fmt.Errorf("TLS: failed to decrypt private key: %v", decErr)
+			return tls.Certificate{}, uiErrSSLWrongPassword(decErr)
 		}
 		keyPEMBlock = pem.EncodeToMemory(&pem.Block{Type: key.Type, Bytes: decryptedKey})
 	}
-	return tls.X509KeyPair(certPEMBlock, keyPEMBlock)
+	cert, err := tls.X509KeyPair(certPEMBlock, keyPEMBlock)
+	if err != nil {
+		return tls.Certificate{}, uiErrSSLUnexpectedData(nil).Msg(err.Error())
+	}
+	return cert, nil
 }
 
 func getSSLConfig() (x509Certs []*x509.Certificate, rootCAs *x509.CertPool, tlsCert *tls.Certificate, secureConn bool, err error) {
@@ -142,6 +151,16 @@ func getSSLConfig() (x509Certs []*x509.Certificate, rootCAs *x509.CertPool, tlsC
 	if cert, err = loadX509KeyPair(getPublicCertFile(), getPrivateKeyFile()); err != nil {
 		return nil, nil, nil, false, err
 	}
+	// Ensure that the private key is not a P-384 or P-521 EC key.
+	// The Go TLS stack does not provide constant-time implementations of P-384 and P-521.
+	if priv, ok := cert.PrivateKey.(crypto.Signer); ok {
+		if pub, ok := priv.Public().(*ecdsa.PublicKey); ok {
+			if name := pub.Params().Name; name == "P-384" || name == "P-521" { // unfortunately there is no cleaner way to check
+				return nil, nil, nil, false, uiErrSSLUnexpectedData(nil).Msg("tls: the ECDSA curve '%s' is not supported", name)
+			}
+		}
+
+	}
 
 	tlsCert = &cert
 

cmd/common-main.go

@@ -25,6 +25,7 @@ import (
 	"time"
 
 	"github.com/minio/cli"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
 )
 
@@ -33,9 +34,9 @@ func checkUpdate(mode string) {
 	// Its OK to ignore any errors during doUpdate() here.
 	if updateMsg, _, currentReleaseTime, latestReleaseTime, err := getUpdateInfo(2*time.Second, mode); err == nil {
 		if globalInplaceUpdateDisabled {
-			log.Println(updateMsg)
+			logger.StartupMessage(updateMsg)
 		} else {
-			log.Println(prepareUpdateMessage("Run `minio update`", latestReleaseTime.Sub(currentReleaseTime)))
+			logger.StartupMessage(prepareUpdateMessage("Run `minio update`", latestReleaseTime.Sub(currentReleaseTime)))
 		}
 	}
 }
@@ -43,11 +44,11 @@ func checkUpdate(mode string) {
 func initConfig() {
 	// Config file does not exist, we create it fresh and return upon success.
 	if isFile(getConfigFile()) {
-		fatalIf(migrateConfig(), "Config migration failed.")
-		fatalIf(loadConfig(), "Unable to load config version: '%s'.", serverConfigVersion)
+		logger.FatalIf(migrateConfig(), "Config migration failed")
+		logger.FatalIf(loadConfig(), "Unable to load the configuration file")
 	} else {
-		fatalIf(newConfig(), "Unable to initialize minio config for the first time.")
-		log.Println("Created minio configuration file successfully at " + getConfigDir())
+		logger.FatalIf(newConfig(), "Unable to initialize minio config for the first time")
+		logger.Info("Created minio configuration file successfully at " + getConfigDir())
 	}
 }
 
@@ -70,17 +71,17 @@ func handleCommonCmdArgs(ctx *cli.Context) {
 		// default config directory.
 		configDir = getConfigDir()
 		if configDir == "" {
-			fatalIf(errors.New("missing option"), "config-dir option must be provided.")
+			logger.FatalIf(errors.New("missing option"), "config-dir option must be provided")
 		}
 	}
 
 	if configDir == "" {
-		fatalIf(errors.New("empty directory"), "Configuration directory cannot be empty.")
+		logger.FatalIf(errors.New("empty directory"), "Configuration directory cannot be empty")
 	}
 
 	// Disallow relative paths, figure out absolute paths.
 	configDirAbs, err := filepath.Abs(configDir)
-	fatalIf(err, "Unable to fetch absolute path for config directory %s", configDir)
+	logger.FatalIf(err, "Unable to fetch absolute path for config directory %s", configDir)
 	setConfigDir(configDirAbs)
 }
 
@@ -94,7 +95,9 @@ func handleCommonEnvVars() {
 	secretKey := os.Getenv("MINIO_SECRET_KEY")
 	if accessKey != "" && secretKey != "" {
 		cred, err := auth.CreateCredentials(accessKey, secretKey)
-		fatalIf(err, "Invalid access/secret Key set in environment.")
+		if err != nil {
+			logger.Fatal(uiErrInvalidCredentials(err), "Unable to validate credentials inherited from the shell environment")
+		}
 
 		// credential Envs are set globally.
 		globalIsEnvCreds = true
@@ -104,7 +107,7 @@ func handleCommonEnvVars() {
 	if browser := os.Getenv("MINIO_BROWSER"); browser != "" {
 		browserFlag, err := ParseBrowserFlag(browser)
 		if err != nil {
-			fatalIf(errors.New("invalid value"), "Unknown value ‘%s’ in MINIO_BROWSER environment variable.", browser)
+			logger.Fatal(uiErrInvalidBrowserValue(nil).Msg("Unknown value `%s`", browser), "Unable to validate MINIO_BROWSER environment variable")
 		}
 
 		// browser Envs are set globally, this does not represent
@@ -117,7 +120,7 @@ func handleCommonEnvVars() {
 	if traceFile != "" {
 		var err error
 		globalHTTPTraceFile, err = os.OpenFile(traceFile, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0660)
-		fatalIf(err, "error opening file %s", traceFile)
+		logger.FatalIf(err, "error opening file %s", traceFile)
 	}
 
 	globalDomainName = os.Getenv("MINIO_DOMAIN")
@@ -127,18 +130,26 @@ func handleCommonEnvVars() {
 
 	if drives := os.Getenv("MINIO_CACHE_DRIVES"); drives != "" {
 		driveList, err := parseCacheDrives(strings.Split(drives, cacheEnvDelimiter))
-		fatalIf(err, "Invalid value set in environment variable MINIO_CACHE_DRIVES %s.", drives)
+		if err != nil {
+			logger.Fatal(err, "Unable to parse MINIO_CACHE_DRIVES value (%s)", drives)
+		}
 		globalCacheDrives = driveList
 		globalIsDiskCacheEnabled = true
 	}
+
 	if excludes := os.Getenv("MINIO_CACHE_EXCLUDE"); excludes != "" {
 		excludeList, err := parseCacheExcludes(strings.Split(excludes, cacheEnvDelimiter))
-		fatalIf(err, "Invalid value set in environment variable MINIO_CACHE_EXCLUDE %s.", excludes)
+		if err != nil {
+			logger.Fatal(err, "Unable to parse MINIO_CACHE_EXCLUDE value (`%s`)", excludes)
+		}
 		globalCacheExcludes = excludeList
 	}
+
 	if expiryStr := os.Getenv("MINIO_CACHE_EXPIRY"); expiryStr != "" {
 		expiry, err := strconv.Atoi(expiryStr)
-		fatalIf(err, "Invalid value set in environment variable MINIO_CACHE_EXPIRY %s.", expiryStr)
+		if err != nil {
+			logger.Fatal(uiErrInvalidCacheExpiryValue(err), "Unable to parse MINIO_CACHE_EXPIRY value (`%s`)", expiryStr)
+		}
 		globalCacheExpiry = expiry
 	}
 
@@ -154,25 +165,25 @@ func handleCommonEnvVars() {
 		// Check for environment variables and parse into storageClass struct
 		if ssc := os.Getenv(standardStorageClassEnv); ssc != "" {
 			globalStandardStorageClass, err = parseStorageClass(ssc)
-			fatalIf(err, "Invalid value set in environment variable %s.", standardStorageClassEnv)
+			logger.FatalIf(err, "Invalid value set in environment variable %s", standardStorageClassEnv)
 		}
 
 		if rrsc := os.Getenv(reducedRedundancyStorageClassEnv); rrsc != "" {
 			globalRRStorageClass, err = parseStorageClass(rrsc)
-			fatalIf(err, "Invalid value set in environment variable %s.", reducedRedundancyStorageClassEnv)
+			logger.FatalIf(err, "Invalid value set in environment variable %s", reducedRedundancyStorageClassEnv)
 		}
 
 		// Validation is done after parsing both the storage classes. This is needed because we need one
 		// storage class value to deduce the correct value of the other storage class.
 		if globalRRStorageClass.Scheme != "" {
 			err = validateParity(globalStandardStorageClass.Parity, globalRRStorageClass.Parity)
-			fatalIf(err, "Invalid value set in environment variable %s.", reducedRedundancyStorageClassEnv)
+			logger.FatalIf(err, "Invalid value set in environment variable %s", reducedRedundancyStorageClassEnv)
 			globalIsStorageClass = true
 		}
 
 		if globalStandardStorageClass.Scheme != "" {
 			err = validateParity(globalStandardStorageClass.Parity, globalRRStorageClass.Parity)
-			fatalIf(err, "Invalid value set in environment variable %s.", standardStorageClassEnv)
+			logger.FatalIf(err, "Invalid value set in environment variable %s", standardStorageClassEnv)
 			globalIsStorageClass = true
 		}
 	}

cmd/config-current.go

@@ -19,15 +19,15 @@ package cmd
 import (
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"reflect"
 	"sync"
 
+	"github.com/minio/minio/cmd/logger"
+
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/event"
 	"github.com/minio/minio/pkg/event/target"
 	"github.com/minio/minio/pkg/quick"
-	"github.com/tidwall/gjson"
 )
 
 // Steps to move from version N to version N+1
@@ -139,6 +139,8 @@ func (s *serverConfig) ConfigDiff(t *serverConfig) string {
 		return "Domain configuration differs"
 	case s.StorageClass != t.StorageClass:
 		return "StorageClass configuration differs"
+	case !reflect.DeepEqual(s.Cache, t.Cache):
+		return "Cache configuration differs"
 	case !reflect.DeepEqual(s.Notify.AMQP, t.Notify.AMQP):
 		return "AMQP Notification configuration differs"
 	case !reflect.DeepEqual(s.Notify.NATS, t.Notify.NATS):
@@ -167,9 +169,12 @@ func (s *serverConfig) ConfigDiff(t *serverConfig) string {
 }
 
 func newServerConfig() *serverConfig {
+	cred, err := auth.GetNewCredentials()
+	logger.FatalIf(err, "")
+
 	srvCfg := &serverConfig{
 		Version:    serverConfigVersion,
-		Credential: auth.MustGetNewCredentials(),
+		Credential: cred,
 		Region:     globalMinioDefaultRegion,
 		Browser:    true,
 		StorageClass: storageClassConfig{
@@ -252,57 +257,6 @@ func newConfig() error {
 	return globalServerConfig.Save()
 }
 
-// doCheckDupJSONKeys recursively detects duplicate json keys
-func doCheckDupJSONKeys(key, value gjson.Result) error {
-	// Key occurrences map of the current scope to count
-	// if there is any duplicated json key.
-	keysOcc := make(map[string]int)
-
-	// Holds the found error
-	var checkErr error
-
-	// Iterate over keys in the current json scope
-	value.ForEach(func(k, v gjson.Result) bool {
-		// If current key is not null, check if its
-		// value contains some duplicated keys.
-		if k.Type != gjson.Null {
-			keysOcc[k.String()]++
-			checkErr = doCheckDupJSONKeys(k, v)
-		}
-		return checkErr == nil
-	})
-
-	// Check found err
-	if checkErr != nil {
-		return errors.New(key.String() + " => " + checkErr.Error())
-	}
-
-	// Check for duplicated keys
-	for k, v := range keysOcc {
-		if v > 1 {
-			return errors.New(key.String() + " => `" + k + "` entry is duplicated")
-		}
-	}
-
-	return nil
-}
-
-// Check recursively if a key is duplicated in the same json scope
-// e.g.:
-//  `{ "key" : { "key" ..` is accepted
-//  `{ "key" : { "subkey" : "val1", "subkey": "val2" ..` throws subkey duplicated error
-func checkDupJSONKeys(json string) error {
-	// Parse config with gjson library
-	config := gjson.Parse(json)
-
-	// Create a fake rootKey since root json doesn't seem to have representation
-	// in gjson library.
-	rootKey := gjson.Result{Type: gjson.String, Str: minioConfigFile}
-
-	// Check if loaded json contains any duplicated keys
-	return doCheckDupJSONKeys(rootKey, config)
-}
-
 // getValidConfig - returns valid server configuration
 func getValidConfig() (*serverConfig, error) {
 	srvCfg := &serverConfig{
@@ -310,8 +264,7 @@ func getValidConfig() (*serverConfig, error) {
 		Browser: true,
 	}
 
-	configFile := getConfigFile()
-	if _, err := quick.Load(configFile, srvCfg); err != nil {
+	if _, err := quick.Load(getConfigFile(), srvCfg); err != nil {
 		return nil, err
 	}
 
@@ -319,21 +272,11 @@ func getValidConfig() (*serverConfig, error) {
 		return nil, fmt.Errorf("configuration version mismatch. Expected: ‘%s’, Got: ‘%s’", serverConfigVersion, srvCfg.Version)
 	}
 
-	// Load config file json and check for duplication json keys
-	jsonBytes, err := ioutil.ReadFile(configFile)
-	if err != nil {
-		return nil, err
-	}
-	if err = checkDupJSONKeys(string(jsonBytes)); err != nil {
-		return nil, err
-	}
-
 	// Validate credential fields only when
 	// they are not set via the environment
-
 	// Error out if global is env credential is not set and config has invalid credential
 	if !globalIsEnvCreds && !srvCfg.Credential.IsValid() {
-		return nil, errors.New("invalid credential in config file " + configFile)
+		return nil, errors.New("invalid credential in config file " + getConfigFile())
 	}
 
 	return srvCfg, nil
@@ -344,7 +287,7 @@ func getValidConfig() (*serverConfig, error) {
 func loadConfig() error {
 	srvCfg, err := getValidConfig()
 	if err != nil {
-		return err
+		return uiErrInvalidConfig(nil).Msg(err.Error())
 	}
 
 	// If env is set override the credentials from config file.

cmd/config-current_test.go

@@ -24,7 +24,6 @@ import (
 
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/event/target"
-	"github.com/tidwall/gjson"
 )
 
 func TestServerConfig(t *testing.T) {
@@ -126,34 +125,6 @@ func TestServerConfigWithEnvs(t *testing.T) {
 	}
 }
 
-func TestCheckDupJSONKeys(t *testing.T) {
-	testCases := []struct {
-		json       string
-		shouldPass bool
-	}{
-		{`{}`, true},
-		{`{"version" : "13"}`, true},
-		{`{"version" : "13", "version": "14"}`, false},
-		{`{"version" : "13", "credential": {"accessKey": "12345"}}`, true},
-		{`{"version" : "13", "credential": {"accessKey": "12345", "accessKey":"12345"}}`, false},
-		{`{"version" : "13", "notify": {"amqp": {"1"}, "webhook":{"3"}}}`, true},
-		{`{"version" : "13", "notify": {"amqp": {"1"}, "amqp":{"3"}}}`, false},
-		{`{"version" : "13", "notify": {"amqp": {"1":{}, "2":{}}}}`, true},
-		{`{"version" : "13", "notify": {"amqp": {"1":{}, "1":{}}}}`, false},
-	}
-
-	for i, testCase := range testCases {
-		err := doCheckDupJSONKeys(gjson.Result{}, gjson.Parse(testCase.json))
-		if testCase.shouldPass && err != nil {
-			t.Errorf("Test %d, should pass but it failed with err = %v", i+1, err)
-		}
-		if !testCase.shouldPass && err == nil {
-			t.Errorf("Test %d, should fail but it succeed.", i+1)
-		}
-	}
-
-}
-
 // Tests config validator..
 func TestValidateConfig(t *testing.T) {
 	rootPath, err := newTestConfig(globalMinioDefaultRegion)

cmd/config-migrate.go

@@ -21,6 +21,7 @@ import (
 	"os"
 	"path/filepath"
 
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/event"
 	"github.com/minio/minio/pkg/event/target"
@@ -29,7 +30,7 @@ import (
 )
 
 // DO NOT EDIT following message template, please open a github issue to discuss instead.
-var configMigrateMSGTemplate = "Configuration file %s migrated from version '%s' to '%s' successfully.\n"
+var configMigrateMSGTemplate = "Configuration file %s migrated from version '%s' to '%s' successfully."
 
 // Migrates all config versions from "1" to "18".
 func migrateConfig() error {
@@ -194,7 +195,7 @@ func purgeV1() error {
 	}
 
 	os.RemoveAll(configFile)
-	log.Println("Removed unsupported config version ‘1’.")
+	logger.Info("Removed unsupported config version ‘1’.")
 	return nil
 }
 
@@ -252,7 +253,7 @@ func migrateV2ToV3() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv2.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv2.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv2.Version, srvConfig.Version)
 	return nil
 }
 
@@ -290,7 +291,7 @@ func migrateV3ToV4() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv3.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv3.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv3.Version, srvConfig.Version)
 	return nil
 }
 
@@ -331,7 +332,7 @@ func migrateV4ToV5() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv4.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv4.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv4.Version, srvConfig.Version)
 	return nil
 }
 
@@ -420,7 +421,7 @@ func migrateV5ToV6() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv5.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv5.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv5.Version, srvConfig.Version)
 	return nil
 }
 
@@ -476,7 +477,7 @@ func migrateV6ToV7() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv6.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv6.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv6.Version, srvConfig.Version)
 	return nil
 }
 
@@ -539,7 +540,7 @@ func migrateV7ToV8() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv7.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv7.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv7.Version, srvConfig.Version)
 	return nil
 }
 
@@ -609,7 +610,7 @@ func migrateV8ToV9() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv8.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv8.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv8.Version, srvConfig.Version)
 	return nil
 }
 
@@ -677,7 +678,7 @@ func migrateV9ToV10() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv9.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv9.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv9.Version, srvConfig.Version)
 	return nil
 }
 
@@ -748,7 +749,7 @@ func migrateV10ToV11() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv10.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv10.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv10.Version, srvConfig.Version)
 	return nil
 }
 
@@ -846,7 +847,7 @@ func migrateV11ToV12() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv11.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv11.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv11.Version, srvConfig.Version)
 	return nil
 }
 
@@ -926,7 +927,7 @@ func migrateV12ToV13() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv12.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv12.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv12.Version, srvConfig.Version)
 	return nil
 }
 
@@ -1011,7 +1012,7 @@ func migrateV13ToV14() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv13.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv13.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv13.Version, srvConfig.Version)
 	return nil
 }
 
@@ -1100,7 +1101,7 @@ func migrateV14ToV15() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv14.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv14.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv14.Version, srvConfig.Version)
 	return nil
 }
 
@@ -1190,7 +1191,7 @@ func migrateV15ToV16() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv15.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv15.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv15.Version, srvConfig.Version)
 	return nil
 }
 
@@ -1311,7 +1312,7 @@ func migrateV16ToV17() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv16.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv16.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv16.Version, srvConfig.Version)
 	return nil
 }
 
@@ -1415,7 +1416,7 @@ func migrateV17ToV18() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv17.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv17.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv17.Version, srvConfig.Version)
 	return nil
 }
 
@@ -1521,7 +1522,7 @@ func migrateV18ToV19() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv18.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv18.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv18.Version, srvConfig.Version)
 	return nil
 }
 
@@ -1626,7 +1627,7 @@ func migrateV19ToV20() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv19.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv19.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv19.Version, srvConfig.Version)
 	return nil
 }
 
@@ -1730,7 +1731,7 @@ func migrateV20ToV21() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv20.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv20.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv20.Version, srvConfig.Version)
 	return nil
 }
 
@@ -1834,7 +1835,7 @@ func migrateV21ToV22() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv21.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv21.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv21.Version, srvConfig.Version)
 	return nil
 }
 
@@ -1947,6 +1948,6 @@ func migrateV22ToV23() error {
 		return fmt.Errorf("Failed to migrate config from ‘%s’ to ‘%s’. %v", cv22.Version, srvConfig.Version, err)
 	}
 
-	log.Printf(configMigrateMSGTemplate, configFile, cv22.Version, srvConfig.Version)
+	logger.Info(configMigrateMSGTemplate, configFile, cv22.Version, srvConfig.Version)
 	return nil
 }

cmd/config-versions.go

@@ -580,7 +580,10 @@ type serverConfigV22 struct {
 	Notify notifier `json:"notify"`
 }
 
-// serverConfigV23 is just like version '22' with addition of cache field
+// serverConfigV23 is just like version '22' with addition of cache field.
+//
+// IMPORTANT NOTE: When updating this struct make sure that
+// serverConfig.ConfigDiff() is updated as necessary.
 type serverConfigV23 struct {
 	Version string `json:"version"`
 

cmd/crossdomain-xml-handler_test.go

@@ -21,14 +21,14 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	router "github.com/gorilla/mux"
+	"github.com/gorilla/mux"
 )
 
 // Test cross domain xml handler.
 func TestCrossXMLHandler(t *testing.T) {
 	// Server initialization.
-	mux := router.NewRouter().SkipClean(true)
-	handler := setCrossDomainPolicy(mux)
+	router := mux.NewRouter().SkipClean(true)
+	handler := setCrossDomainPolicy(router)
 	srv := httptest.NewServer(handler)
 
 	resp, err := http.Get(srv.URL + crossDomainXMLEntity)

cmd/disk-cache-config.go

@@ -18,7 +18,6 @@ package cmd
 
 import (
 	"encoding/json"
-	"fmt"
 	"path/filepath"
 )
 
@@ -54,7 +53,7 @@ func (cfg *CacheConfig) UnmarshalJSON(data []byte) (err error) {
 func parseCacheDrives(drives []string) ([]string, error) {
 	for _, d := range drives {
 		if !filepath.IsAbs(d) {
-			return nil, fmt.Errorf("cache dir should be absolute path: %s", d)
+			return nil, uiErrInvalidCacheDrivesValue(nil).Msg("cache dir should be absolute path: %s", d)
 		}
 	}
 	return drives, nil
@@ -64,10 +63,10 @@ func parseCacheDrives(drives []string) ([]string, error) {
 func parseCacheExcludes(excludes []string) ([]string, error) {
 	for _, e := range excludes {
 		if len(e) == 0 {
-			return nil, fmt.Errorf("cache exclude path (%s) cannot be empty", e)
+			return nil, uiErrInvalidCacheExcludesValue(nil).Msg("cache exclude path (%s) cannot be empty", e)
 		}
 		if hasPrefix(e, slashSeparator) {
-			return nil, fmt.Errorf("cache exclude pattern (%s) cannot start with / as prefix", e)
+			return nil, uiErrInvalidCacheExcludesValue(nil).Msg("cache exclude pattern (%s) cannot start with / as prefix", e)
 		}
 	}
 	return excludes, nil

cmd/disk-cache-fs.go

@@ -28,8 +28,8 @@ import (
 	"sync"
 	"time"
 
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/disk"
-	errors2 "github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/hash"
 	"github.com/minio/minio/pkg/lock"
 )
@@ -37,7 +37,6 @@ import (
 const (
 	// cache.json object metadata for cached objects.
 	cacheMetaJSONFile = "cache.json"
-	cacheMetaFormat   = "cache"
 
 	cacheEnvDelimiter = ";"
 )
@@ -93,7 +92,7 @@ func newCacheFSObjects(dir string, expiry int, maxDiskUsagePct int) (*cacheFSObj
 		appendFileMap: make(map[string]*fsAppendFile),
 	}
 
-	go fsObjects.cleanupStaleMultipartUploads(globalMultipartCleanupInterval, globalMultipartExpiry, globalServiceDoneCh)
+	go fsObjects.cleanupStaleMultipartUploads(context.Background(), globalMultipartCleanupInterval, globalMultipartExpiry, globalServiceDoneCh)
 
 	cacheFS := cacheFSObjects{
 		FSObjects:       fsObjects,
@@ -116,7 +115,9 @@ func (cfs *cacheFSObjects) diskUsageLow() bool {
 	minUsage := cfs.maxDiskUsagePct * 80 / 100
 	di, err := disk.GetInfo(cfs.dir)
 	if err != nil {
-		errorIf(err, "Error getting disk information on %s", cfs.dir)
+		reqInfo := (&logger.ReqInfo{}).AppendTags("cachePath", cfs.dir)
+		ctx := logger.SetReqInfo(context.Background(), reqInfo)
+		logger.LogIf(ctx, err)
 		return false
 	}
 	usedPercent := (di.Total - di.Free) * 100 / di.Total
@@ -128,7 +129,9 @@ func (cfs *cacheFSObjects) diskUsageLow() bool {
 func (cfs *cacheFSObjects) diskUsageHigh() bool {
 	di, err := disk.GetInfo(cfs.dir)
 	if err != nil {
-		errorIf(err, "Error getting disk information on %s", cfs.dir)
+		reqInfo := (&logger.ReqInfo{}).AppendTags("cachePath", cfs.dir)
+		ctx := logger.SetReqInfo(context.Background(), reqInfo)
+		logger.LogIf(ctx, err)
 		return true
 	}
 	usedPercent := (di.Total - di.Free) * 100 / di.Total
@@ -140,7 +143,9 @@ func (cfs *cacheFSObjects) diskUsageHigh() bool {
 func (cfs *cacheFSObjects) diskAvailable(size int64) bool {
 	di, err := disk.GetInfo(cfs.dir)
 	if err != nil {
-		errorIf(err, "Error getting disk information on %s", cfs.dir)
+		reqInfo := (&logger.ReqInfo{}).AppendTags("cachePath", cfs.dir)
+		ctx := logger.SetReqInfo(context.Background(), reqInfo)
+		logger.LogIf(ctx, err)
 		return false
 	}
 	usedPercent := (di.Total - (di.Free - uint64(size))) * 100 / di.Total
@@ -150,11 +155,11 @@ func (cfs *cacheFSObjects) diskAvailable(size int64) bool {
 // purges all content marked trash from the cache.
 func (cfs *cacheFSObjects) purgeTrash() {
 	ticker := time.NewTicker(time.Minute * cacheCleanupInterval)
+	defer ticker.Stop()
+
 	for {
 		select {
 		case <-globalServiceDoneCh:
-			// Stop the timer.
-			ticker.Stop()
 			return
 		case <-ticker.C:
 			trashPath := path.Join(cfs.fsPath, minioMetaBucket, cacheTrashDir)
@@ -163,14 +168,15 @@ func (cfs *cacheFSObjects) purgeTrash() {
 				return
 			}
 			for _, entry := range entries {
-				fi, err := fsStatVolume(pathJoin(trashPath, entry))
+				ctx := logger.SetReqInfo(context.Background(), &logger.ReqInfo{})
+				fi, err := fsStatVolume(ctx, pathJoin(trashPath, entry))
 				if err != nil {
 					continue
 				}
 				dir := path.Join(trashPath, fi.Name())
 
 				// Delete all expired cache content.
-				fsRemoveAll(dir)
+				fsRemoveAll(ctx, dir)
 			}
 		}
 	}
@@ -193,7 +199,7 @@ func (cfs *cacheFSObjects) purge() {
 			deletedCount := 0
 			buckets, err := cfs.ListBuckets(ctx)
 			if err != nil {
-				errorIf(err, "Unable to list buckets.")
+				logger.LogIf(ctx, err)
 			}
 			// Reset cache online status if drive was offline earlier.
 			if !cfs.IsOnline() {
@@ -221,7 +227,7 @@ func (cfs *cacheFSObjects) purge() {
 							continue
 						}
 						if err = cfs.DeleteObject(ctx, bucket.Name, object.Name); err != nil {
-							errorIf(err, "Unable to remove cache entry in dir %s/%s", bucket.Name, object.Name)
+							logger.LogIf(ctx, err)
 							continue
 						}
 						deletedCount++
@@ -271,7 +277,7 @@ func (cfs *cacheFSObjects) Put(ctx context.Context, bucket, object string, data
 	}
 	_, err := cfs.PutObject(ctx, bucket, object, data, metadata)
 	// if err is due to disk being offline , mark cache drive as offline
-	if errors2.IsErr(err, baseErrs...) {
+	if IsErr(err, baseErrs...) {
 		cfs.setOnline(false)
 	}
 	return err
@@ -313,7 +319,7 @@ func (cfs *cacheFSObjects) PutObject(ctx context.Context, bucket string, object
 	var err error
 
 	// Validate if bucket name is valid and exists.
-	if _, err = fs.statBucketDir(bucket); err != nil {
+	if _, err = fs.statBucketDir(ctx, bucket); err != nil {
 		return ObjectInfo{}, toObjectErr(err, bucket)
 	}
 
@@ -325,31 +331,32 @@ func (cfs *cacheFSObjects) PutObject(ctx context.Context, bucket string, object
 	// and return success.
 	if isObjectDir(object, data.Size()) {
 		// Check if an object is present as one of the parent dir.
-		if fs.parentDirIsObject(bucket, path.Dir(object)) {
-			return ObjectInfo{}, toObjectErr(errors2.Trace(errFileAccessDenied), bucket, object)
+		if fs.parentDirIsObject(ctx, bucket, path.Dir(object)) {
+			return ObjectInfo{}, toObjectErr(errFileAccessDenied, bucket, object)
 		}
 		if err = mkdirAll(pathJoin(fs.fsPath, bucket, object), 0777); err != nil {
 			return ObjectInfo{}, toObjectErr(err, bucket, object)
 		}
 		var fi os.FileInfo
-		if fi, err = fsStatDir(pathJoin(fs.fsPath, bucket, object)); err != nil {
+		if fi, err = fsStatDir(ctx, pathJoin(fs.fsPath, bucket, object)); err != nil {
 			return ObjectInfo{}, toObjectErr(err, bucket, object)
 		}
 		return fsMeta.ToObjectInfo(bucket, object, fi), nil
 	}
 
-	if err = checkPutObjectArgs(bucket, object, fs, data.Size()); err != nil {
+	if err = checkPutObjectArgs(ctx, bucket, object, fs, data.Size()); err != nil {
 		return ObjectInfo{}, err
 	}
 
 	// Check if an object is present as one of the parent dir.
-	if fs.parentDirIsObject(bucket, path.Dir(object)) {
-		return ObjectInfo{}, toObjectErr(errors2.Trace(errFileAccessDenied), bucket, object)
+	if fs.parentDirIsObject(ctx, bucket, path.Dir(object)) {
+		return ObjectInfo{}, toObjectErr(errFileAccessDenied, bucket, object)
 	}
 
 	// Validate input data size and it can never be less than zero.
 	if data.Size() < 0 {
-		return ObjectInfo{}, errors2.Trace(errInvalidArgument)
+		logger.LogIf(ctx, errInvalidArgument)
+		return ObjectInfo{}, errInvalidArgument
 	}
 
 	var wlk *lock.LockedFile
@@ -359,7 +366,8 @@ func (cfs *cacheFSObjects) PutObject(ctx context.Context, bucket string, object
 
 		wlk, err = fs.rwPool.Create(fsMetaPath)
 		if err != nil {
-			return ObjectInfo{}, toObjectErr(errors2.Trace(err), bucket, object)
+			logger.LogIf(ctx, err)
+			return ObjectInfo{}, toObjectErr(err, bucket, object)
 		}
 		// This close will allow for locks to be synchronized on `fs.json`.
 		defer wlk.Close()
@@ -367,7 +375,7 @@ func (cfs *cacheFSObjects) PutObject(ctx context.Context, bucket string, object
 			// Remove meta file when PutObject encounters any error
 			if retErr != nil {
 				tmpDir := pathJoin(fs.fsPath, minioMetaTmpBucket, fs.fsUUID)
-				fsRemoveMeta(bucketMetaDir, fsMetaPath, tmpDir)
+				fsRemoveMeta(ctx, bucketMetaDir, fsMetaPath, tmpDir)
 			}
 		}()
 	}
@@ -385,10 +393,9 @@ func (cfs *cacheFSObjects) PutObject(ctx context.Context, bucket string, object
 
 	buf := make([]byte, int(bufSize))
 	fsTmpObjPath := pathJoin(fs.fsPath, minioMetaTmpBucket, fs.fsUUID, tempObj)
-	bytesWritten, err := fsCreateFile(fsTmpObjPath, data, buf, data.Size())
+	bytesWritten, err := fsCreateFile(ctx, fsTmpObjPath, data, buf, data.Size())
 	if err != nil {
-		fsRemoveFile(fsTmpObjPath)
-		errorIf(err, "Failed to create object %s/%s", bucket, object)
+		fsRemoveFile(ctx, fsTmpObjPath)
 		return ObjectInfo{}, toObjectErr(err, bucket, object)
 	}
 	if fsMeta.Meta["etag"] == "" {
@@ -397,18 +404,18 @@ func (cfs *cacheFSObjects) PutObject(ctx context.Context, bucket string, object
 	// Should return IncompleteBody{} error when reader has fewer
 	// bytes than specified in request header.
 	if bytesWritten < data.Size() {
-		fsRemoveFile(fsTmpObjPath)
-		return ObjectInfo{}, errors2.Trace(IncompleteBody{})
+		fsRemoveFile(ctx, fsTmpObjPath)
+		return ObjectInfo{}, IncompleteBody{}
 	}
 
 	// Delete the temporary object in the case of a
 	// failure. If PutObject succeeds, then there would be
 	// nothing to delete.
-	defer fsRemoveFile(fsTmpObjPath)
+	defer fsRemoveFile(ctx, fsTmpObjPath)
 
 	// Entire object was written to the temp location, now it's safe to rename it to the actual location.
 	fsNSObjPath := pathJoin(fs.fsPath, bucket, object)
-	if err = fsRenameFile(fsTmpObjPath, fsNSObjPath); err != nil {
+	if err = fsRenameFile(ctx, fsTmpObjPath, fsNSObjPath); err != nil {
 		return ObjectInfo{}, toObjectErr(err, bucket, object)
 	}
 
@@ -420,7 +427,7 @@ func (cfs *cacheFSObjects) PutObject(ctx context.Context, bucket string, object
 	}
 
 	// Stat the file to fetch timestamp, size.
-	fi, err := fsStatFile(pathJoin(fs.fsPath, bucket, object))
+	fi, err := fsStatFile(ctx, pathJoin(fs.fsPath, bucket, object))
 	if err != nil {
 		return ObjectInfo{}, toObjectErr(err, bucket, object)
 	}
@@ -447,11 +454,11 @@ func (cfs *cacheFSObjects) NewMultipartUpload(ctx context.Context, bucket, objec
 		}
 	}
 	fs := cfs.FSObjects
-	if err := checkNewMultipartArgs(bucket, object, fs); err != nil {
+	if err := checkNewMultipartArgs(ctx, bucket, object, fs); err != nil {
 		return "", toObjectErr(err, bucket)
 	}
 
-	if _, err := fs.statBucketDir(bucket); err != nil {
+	if _, err := fs.statBucketDir(ctx, bucket); err != nil {
 		return "", toObjectErr(err, bucket)
 	}
 
@@ -459,7 +466,8 @@ func (cfs *cacheFSObjects) NewMultipartUpload(ctx context.Context, bucket, objec
 
 	err := mkdirAll(uploadIDDir, 0755)
 	if err != nil {
-		return "", errors2.Trace(err)
+		logger.LogIf(ctx, err)
+		return "", err
 	}
 
 	// Initialize fs.json values.
@@ -468,11 +476,13 @@ func (cfs *cacheFSObjects) NewMultipartUpload(ctx context.Context, bucket, objec
 
 	fsMetaBytes, err := json.Marshal(fsMeta)
 	if err != nil {
-		return "", errors2.Trace(err)
+		logger.LogIf(ctx, err)
+		return "", err
 	}
 
 	if err = ioutil.WriteFile(pathJoin(uploadIDDir, fs.metaJSONFile), fsMetaBytes, 0644); err != nil {
-		return "", errors2.Trace(err)
+		logger.LogIf(ctx, err)
+		return "", err
 	}
 	return uploadID, nil
 }
@@ -485,7 +495,7 @@ func (cfs *cacheFSObjects) moveBucketToTrash(ctx context.Context, bucket string)
 		return err
 	}
 	defer bucketLock.Unlock()
-	bucketDir, err := fs.getBucketDir(bucket)
+	bucketDir, err := fs.getBucketDir(ctx, bucket)
 	if err != nil {
 		return toObjectErr(err, bucket)
 	}
@@ -493,12 +503,13 @@ func (cfs *cacheFSObjects) moveBucketToTrash(ctx context.Context, bucket string)
 	expiredDir := path.Join(trashPath, bucket)
 	// Attempt to move regular bucket to expired directory.
 	if err = fsRenameDir(bucketDir, expiredDir); err != nil {
+		logger.LogIf(ctx, err)
 		return toObjectErr(err, bucket)
 	}
 	// Cleanup all the bucket metadata.
 	ominioMetadataBucketDir := pathJoin(fs.fsPath, minioMetaBucket, bucketMetaPrefix, bucket)
 	nminioMetadataBucketDir := pathJoin(trashPath, MustGetUUID())
-	_ = fsRenameDir(ominioMetadataBucketDir, nminioMetadataBucketDir)
+	logger.LogIf(ctx, fsRenameDir(ominioMetadataBucketDir, nminioMetadataBucketDir))
 	return nil
 }
 
@@ -506,22 +517,22 @@ func (cfs *cacheFSObjects) moveBucketToTrash(ctx context.Context, bucket string)
 // paths for windows automatically.
 func fsRenameDir(dirPath, newPath string) (err error) {
 	if dirPath == "" || newPath == "" {
-		return errors2.Trace(errInvalidArgument)
+		return errInvalidArgument
 	}
 
 	if err = checkPathLength(dirPath); err != nil {
-		return errors2.Trace(err)
+		return err
 	}
 	if err = checkPathLength(newPath); err != nil {
-		return errors2.Trace(err)
+		return err
 	}
 	if err = os.Rename(dirPath, newPath); err != nil {
 		if os.IsNotExist(err) {
-			return errors2.Trace(errVolumeNotFound)
+			return errVolumeNotFound
 		} else if isSysErrNotEmpty(err) {
-			return errors2.Trace(errVolumeNotEmpty)
+			return errVolumeNotEmpty
 		}
-		return errors2.Trace(err)
+		return err
 	}
 	return nil
 }

cmd/disk-cache.go

@@ -31,7 +31,7 @@ import (
 
 	"github.com/djherbis/atime"
 
-	errors2 "github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/wildcard"
 
 	"github.com/minio/minio/pkg/hash"
@@ -103,8 +103,8 @@ type CacheObjectLayer interface {
 
 // backendDownError returns true if err is due to backend failure or faulty disk if in server mode
 func backendDownError(err error) bool {
-	_, backendDown := errors2.Cause(err).(BackendDown)
-	return backendDown || errors2.IsErr(err, baseErrs...)
+	_, backendDown := err.(BackendDown)
+	return backendDown || IsErr(err, baseErrs...)
 }
 
 // get cache disk where object is currently cached for a GET operation. If object does not exist at that location,
@@ -191,7 +191,7 @@ func (c cacheObjects) GetObject(ctx context.Context, bucket, object string, star
 	objInfo, err := GetObjectInfoFn(ctx, bucket, object)
 	backendDown := backendDownError(err)
 	if err != nil && !backendDown {
-		if _, ok := errors2.Cause(err).(ObjectNotFound); ok {
+		if _, ok := err.(ObjectNotFound); ok {
 			// Delete the cached entry if backend object was deleted.
 			dcache.Delete(ctx, bucket, object)
 		}
@@ -255,7 +255,7 @@ func (c cacheObjects) GetObjectInfo(ctx context.Context, bucket, object string)
 	}
 	objInfo, err := getObjectInfoFn(ctx, bucket, object)
 	if err != nil {
-		if _, ok := errors2.Cause(err).(ObjectNotFound); ok {
+		if _, ok := err.(ObjectNotFound); ok {
 			// Delete the cached entry if backend object was deleted.
 			dcache.Delete(ctx, bucket, object)
 			return ObjectInfo{}, err
@@ -289,12 +289,20 @@ func listDirCacheFactory(isLeaf isLeafFunc, treeWalkIgnoredErrs []error, disks [
 	listCacheDirs := func(bucket, prefixDir, prefixEntry string) (dirs []string, err error) {
 		var entries []string
 		for _, disk := range disks {
+			// ignore disk-caches that might be missing/offline
+			if disk == nil {
+				continue
+			}
 			fs := disk.FSObjects
 			entries, err = readDir(pathJoin(fs.fsPath, bucket, prefixDir))
+
+			// For any reason disk was deleted or goes offline, continue
+			// and list from other disks if possible.
 			if err != nil {
-				// For any reason disk was deleted or goes offline, continue
-				// and list from other disks if possible.
-				continue
+				if IsErrIgnored(err, treeWalkIgnoredErrs...) {
+					continue
+				}
+				return nil, err
 			}
 
 			// Filter entries that have the prefix prefixEntry.
@@ -345,12 +353,20 @@ func (c cacheObjects) listCacheObjects(ctx context.Context, bucket, prefix, mark
 			if err != nil {
 				return false
 			}
-			_, err = fs.getObjectInfo(bucket, object)
+			_, err = fs.getObjectInfo(ctx, bucket, object)
 			return err == nil
 		}
 
+		isLeafDir := func(bucket, object string) bool {
+			fs, err := c.cache.getCacheFS(ctx, bucket, object)
+			if err != nil {
+				return false
+			}
+			return fs.isObjectDir(bucket, object)
+		}
+
 		listDir := listDirCacheFactory(isLeaf, cacheTreeWalkIgnoredErrs, c.cache.cfs)
-		walkResultCh = startTreeWalk(bucket, prefix, marker, recursive, listDir, isLeaf, endWalkCh)
+		walkResultCh = startTreeWalk(ctx, bucket, prefix, marker, recursive, listDir, isLeaf, isLeafDir, endWalkCh)
 	}
 
 	for i := 0; i < maxKeys; {
@@ -377,16 +393,16 @@ func (c cacheObjects) listCacheObjects(ctx context.Context, bucket, prefix, mark
 			var err error
 			fs, err := c.cache.getCacheFS(ctx, bucket, entry)
 			if err != nil {
-				// Ignore errFileNotFound
-				if errors2.Cause(err) == errFileNotFound {
+				// Ignore errDiskNotFound
+				if err == errDiskNotFound {
 					continue
 				}
 				return result, toObjectErr(err, bucket, prefix)
 			}
-			objInfo, err = fs.getObjectInfo(bucket, entry)
+			objInfo, err = fs.getObjectInfo(ctx, bucket, entry)
 			if err != nil {
-				// Ignore errFileNotFound
-				if errors2.Cause(err) == errFileNotFound {
+				// Ignore ObjectNotFound error
+				if _, ok := err.(ObjectNotFound); ok {
 					continue
 				}
 				return result, toObjectErr(err, bucket, prefix)
@@ -409,7 +425,7 @@ func (c cacheObjects) listCacheObjects(ctx context.Context, bucket, prefix, mark
 	result = ListObjectsInfo{IsTruncated: !eof}
 	for _, objInfo := range objInfos {
 		result.NextMarker = objInfo.Name
-		if objInfo.IsDir {
+		if objInfo.IsDir && delimiter == slashSeparator {
 			result.Prefixes = append(result.Prefixes, objInfo.Name)
 			continue
 		}
@@ -469,6 +485,10 @@ func (c cacheObjects) ListObjectsV2(ctx context.Context, bucket, prefix, continu
 func (c cacheObjects) listBuckets(ctx context.Context) (buckets []BucketInfo, err error) {
 	m := make(map[string]string)
 	for _, cache := range c.cache.cfs {
+		// ignore disk-caches that might be missing/offline
+		if cache == nil {
+			continue
+		}
 		entries, err := cache.ListBuckets(ctx)
 
 		if err != nil {
@@ -507,6 +527,10 @@ func (c cacheObjects) GetBucketInfo(ctx context.Context, bucket string) (bucketI
 	bucketInfo, err = getBucketInfoFn(ctx, bucket)
 	if backendDownError(err) {
 		for _, cache := range c.cache.cfs {
+			// ignore disk-caches that might be missing/offline
+			if cache == nil {
+				continue
+			}
 			if bucketInfo, err = cache.GetBucketInfo(ctx, bucket); err == nil {
 				return
 			}
@@ -754,7 +778,8 @@ func (c cacheObjects) StorageInfo(ctx context.Context) (storageInfo StorageInfo)
 			continue
 		}
 		info, err := getDiskInfo((cfs.fsPath))
-		errorIf(err, "Unable to get disk info %#v", cfs.fsPath)
+		logger.GetReqInfo(ctx).AppendTags("cachePath", cfs.fsPath)
+		logger.LogIf(ctx, err)
 		total += info.Total
 		free += info.Free
 	}
@@ -771,6 +796,10 @@ func (c cacheObjects) DeleteBucket(ctx context.Context, bucket string) (err erro
 	deleteBucketFn := c.DeleteBucketFn
 	var toDel []*cacheFSObjects
 	for _, cfs := range c.cache.cfs {
+		// ignore disk-caches that might be missing/offline
+		if cfs == nil {
+			continue
+		}
 		if _, cerr := cfs.GetBucketInfo(ctx, bucket); cerr == nil {
 			toDel = append(toDel, cfs)
 		}
@@ -791,7 +820,8 @@ func (c cacheObjects) DeleteBucket(ctx context.Context, bucket string) (err erro
 // or the global env overrides.
 func newCache(config CacheConfig) (*diskCache, error) {
 	var cfsObjects []*cacheFSObjects
-	formats, err := loadAndValidateCacheFormat(config.Drives)
+	ctx := logger.SetReqInfo(context.Background(), &logger.ReqInfo{})
+	formats, err := loadAndValidateCacheFormat(ctx, config.Drives)
 	if err != nil {
 		return nil, err
 	}

cmd/encryption-v1.go

@@ -18,6 +18,7 @@ package cmd
 
 import (
 	"bytes"
+	"context"
 	"crypto/hmac"
 	"crypto/md5"
 	"crypto/rand"
@@ -27,7 +28,9 @@ import (
 	"errors"
 	"io"
 	"net/http"
+	"strconv"
 
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/ioutil"
 	sha256 "github.com/minio/sha256-simd"
 	"github.com/minio/sio"
@@ -35,14 +38,15 @@ import (
 
 var (
 	// AWS errors for invalid SSE-C requests.
-	errInsecureSSERequest  = errors.New("Requests specifying Server Side Encryption with Customer provided keys must be made over a secure connection")
-	errEncryptedObject     = errors.New("The object was stored using a form of Server Side Encryption. The correct parameters must be provided to retrieve the object")
-	errInvalidSSEAlgorithm = errors.New("Requests specifying Server Side Encryption with Customer provided keys must provide a valid encryption algorithm")
-	errMissingSSEKey       = errors.New("Requests specifying Server Side Encryption with Customer provided keys must provide an appropriate secret key")
-	errInvalidSSEKey       = errors.New("The secret key was invalid for the specified algorithm")
-	errMissingSSEKeyMD5    = errors.New("Requests specifying Server Side Encryption with Customer provided keys must provide the client calculated MD5 of the secret key")
-	errSSEKeyMD5Mismatch   = errors.New("The calculated MD5 hash of the key did not match the hash that was provided")
-	errSSEKeyMismatch      = errors.New("The client provided key does not match the key provided when the object was encrypted") // this msg is not shown to the client
+	errInsecureSSERequest   = errors.New("SSE-C requests require TLS connections")
+	errEncryptedObject      = errors.New("The object was stored using a form of SSE")
+	errInvalidSSEAlgorithm  = errors.New("The SSE-C algorithm is not valid")
+	errMissingSSEKey        = errors.New("The SSE-C request is missing the customer key")
+	errInvalidSSEKey        = errors.New("The SSE-C key is invalid")
+	errMissingSSEKeyMD5     = errors.New("The SSE-C request is missing the customer key MD5")
+	errSSEKeyMD5Mismatch    = errors.New("The key MD5 does not match the SSE-C key")
+	errSSEKeyMismatch       = errors.New("The SSE-C key is not correct")                  // access denied
+	errInvalidSSEParameters = errors.New("The SSE-C key for key-rotation is not correct") // special access denied
 
 	// Additional Minio errors for SSE-C requests.
 	errObjectTampered = errors.New("The requested object was modified and may be compromised")
@@ -247,9 +251,6 @@ func ParseSSECustomerHeader(header http.Header) (key []byte, err error) {
 
 // This function rotates old to new key.
 func rotateKey(oldKey []byte, newKey []byte, metadata map[string]string) error {
-	if subtle.ConstantTimeCompare(oldKey, newKey) == 1 {
-		return nil
-	}
 	delete(metadata, SSECustomerKey) // make sure we do not save the key by accident
 
 	if metadata[ServerSideEncryptionSealAlgorithm] != SSESealAlgorithmDareSha256 { // currently DARE-SHA256 is the only option
@@ -273,10 +274,14 @@ func rotateKey(oldKey []byte, newKey []byte, metadata map[string]string) error {
 	n, err := sio.Decrypt(objectEncryptionKey, bytes.NewReader(sealedKey), sio.Config{
 		Key: keyEncryptionKey,
 	})
-	if n != 32 || err != nil {
-		// Either the provided key does not match or the object was tampered.
-		// To provide strict AWS S3 compatibility we return: access denied.
-		return errSSEKeyMismatch
+	if n != 32 || err != nil { // Either the provided key does not match or the object was tampered.
+		if subtle.ConstantTimeCompare(oldKey, newKey) == 1 {
+			return errInvalidSSEParameters // AWS returns special error for equal but invalid keys.
+		}
+		return errSSEKeyMismatch // To provide strict AWS S3 compatibility we return: access denied.
+	}
+	if subtle.ConstantTimeCompare(oldKey, newKey) == 1 {
+		return nil // we don't need to rotate keys if newKey == oldKey
 	}
 
 	nonce := make([]byte, 32) // generate random values for key derivation
@@ -737,10 +742,9 @@ func (li *ListPartsInfo) IsEncrypted() bool {
 // DecryptedSize returns the size of the object after decryption in bytes.
 // It returns an error if the object is not encrypted or marked as encrypted
 // but has an invalid size.
-// DecryptedSize panics if the referred object is not encrypted.
 func (o *ObjectInfo) DecryptedSize() (int64, error) {
 	if !o.IsEncrypted() {
-		panic("cannot compute decrypted size of an object which is not encrypted")
+		return 0, errors.New("Cannot compute decrypted size of an unencrypted object")
 	}
 	size, err := sio.DecryptedSize(uint64(o.Size))
 	if err != nil {
@@ -755,7 +759,11 @@ func (o *ObjectInfo) DecryptedSize() (int64, error) {
 func (o *ObjectInfo) EncryptedSize() int64 {
 	size, err := sio.EncryptedSize(uint64(o.Size))
 	if err != nil {
-		panic(err) // Since AWS S3 allows parts to be 5GB at most this cannot happen - sio max. size is 256 TB
+		// This cannot happen since AWS S3 allows parts to be 5GB at most
+		// sio max. size is 256 TB
+		reqInfo := (&logger.ReqInfo{}).AppendTags("size", strconv.FormatUint(size, 10))
+		ctx := logger.SetReqInfo(context.Background(), reqInfo)
+		logger.CriticalIf(ctx, err)
 	}
 	return int64(size)
 }

cmd/endpoint-ellipses.go

@@ -70,11 +70,10 @@ func getSetIndexes(args []string, totalSizes []uint64) (setIndexes [][]uint64, e
 	}
 
 	setIndexes = make([][]uint64, len(totalSizes))
-	for i, totalSize := range totalSizes {
+	for _, totalSize := range totalSizes {
 		// Check if totalSize has minimum range upto setSize
 		if totalSize < setSizes[0] {
-			return nil, fmt.Errorf("Invalid inputs (%s). Ellipses range or number of args %d should be atleast divisible by least possible set size %d",
-				args[i], totalSize, setSizes[0])
+			return nil, uiErrInvalidNumberOfErasureEndpoints(nil)
 		}
 	}
 
@@ -103,8 +102,7 @@ func getSetIndexes(args []string, totalSizes []uint64) (setIndexes [][]uint64, e
 
 	// Check whether setSize is with the supported range.
 	if !isValidSetSize(setSize) {
-		return nil, fmt.Errorf("Invalid inputs (%s). Ellipses range or number of args %d should be atleast divisible by least possible set size %d",
-			args, setSize, setSizes[0])
+		return nil, uiErrInvalidNumberOfErasureEndpoints(nil)
 	}
 
 	for i := range totalSizes {
@@ -167,14 +165,14 @@ func parseEndpointSet(args ...string) (ep endpointSet, err error) {
 	for i, arg := range args {
 		patterns, perr := ellipses.FindEllipsesPatterns(arg)
 		if perr != nil {
-			return endpointSet{}, perr
+			return endpointSet{}, uiErrInvalidErasureEndpoints(nil).Msg(perr.Error())
 		}
 		argPatterns[i] = patterns
 	}
 
 	ep.setIndexes, err = getSetIndexes(args, getTotalSizes(argPatterns))
 	if err != nil {
-		return endpointSet{}, err
+		return endpointSet{}, uiErrInvalidErasureEndpoints(nil).Msg(err.Error())
 	}
 
 	ep.argPatterns = argPatterns
@@ -223,7 +221,7 @@ func getAllSets(args ...string) ([][]string, error) {
 	for _, sargs := range setArgs {
 		for _, arg := range sargs {
 			if uniqueArgs.Contains(arg) {
-				return nil, fmt.Errorf("Input args (%s) has duplicate ellipses", args)
+				return nil, uiErrInvalidErasureEndpoints(nil).Msg(fmt.Sprintf("Input args (%s) has duplicate ellipses", args))
 			}
 			uniqueArgs.Add(arg)
 		}

cmd/endpoint.go

@@ -27,6 +27,7 @@ import (
 	"strings"
 
 	"github.com/minio/minio-go/pkg/set"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/mountinfo"
 )
 
@@ -251,14 +252,14 @@ func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList,
 			return serverAddr, endpoints, setupType, err
 		}
 		if endpoint.Type() != PathEndpointType {
-			return serverAddr, endpoints, setupType, fmt.Errorf("use path style endpoint for FS setup")
+			return serverAddr, endpoints, setupType, uiErrInvalidFSEndpoint(nil).Msg("use path style endpoint for FS setup")
 		}
 		endpoints = append(endpoints, endpoint)
 		setupType = FSSetupType
 
 		// Check for cross device mounts if any.
 		if err = checkCrossDeviceMounts(endpoints); err != nil {
-			return serverAddr, endpoints, setupType, err
+			return serverAddr, endpoints, setupType, uiErrInvalidFSEndpoint(nil).Msg(err.Error())
 		}
 		return serverAddr, endpoints, setupType, nil
 	}
@@ -269,12 +270,12 @@ func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList,
 		var eps EndpointList
 		eps, err = NewEndpointList(iargs...)
 		if err != nil {
-			return serverAddr, endpoints, setupType, err
+			return serverAddr, endpoints, setupType, uiErrInvalidErasureEndpoints(nil).Msg(err.Error())
 		}
 
 		// Check for cross device mounts if any.
 		if err = checkCrossDeviceMounts(eps); err != nil {
-			return serverAddr, endpoints, setupType, err
+			return serverAddr, endpoints, setupType, uiErrInvalidErasureEndpoints(nil).Msg(err.Error())
 		}
 
 		for _, ep := range eps {
@@ -315,7 +316,7 @@ func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList,
 
 	// No local endpoint found.
 	if localEndpointCount == 0 {
-		return serverAddr, endpoints, setupType, fmt.Errorf("no endpoint found for this host")
+		return serverAddr, endpoints, setupType, uiErrInvalidErasureEndpoints(nil).Msg("no endpoint pointing to the local machine is found")
 	}
 
 	// Check whether same path is not used in endpoints of a host on different port.
@@ -330,8 +331,8 @@ func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList,
 			hostIPSet, _ := getHostIP4(host)
 			if IPSet, ok := pathIPMap[endpoint.Path]; ok {
 				if !IPSet.Intersection(hostIPSet).IsEmpty() {
-					err = fmt.Errorf("path '%s' can not be served by different port on same address", endpoint.Path)
-					return serverAddr, endpoints, setupType, err
+					return serverAddr, endpoints, setupType,
+						uiErrInvalidErasureEndpoints(nil).Msg(fmt.Sprintf("path '%s' can not be served by different port on same address", endpoint.Path))
 				}
 				pathIPMap[endpoint.Path] = IPSet.Union(hostIPSet)
 			} else {
@@ -348,8 +349,8 @@ func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList,
 				continue
 			}
 			if localPathSet.Contains(endpoint.Path) {
-				err = fmt.Errorf("path '%s' cannot be served by different address on same server", endpoint.Path)
-				return serverAddr, endpoints, setupType, err
+				return serverAddr, endpoints, setupType,
+					uiErrInvalidErasureEndpoints(nil).Msg(fmt.Sprintf("path '%s' cannot be served by different address on same server", endpoint.Path))
 			}
 			localPathSet.Add(endpoint.Path)
 		}
@@ -359,12 +360,11 @@ func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList,
 	{
 		if !localPortSet.Contains(serverAddrPort) {
 			if len(localPortSet) > 1 {
-				err = fmt.Errorf("port number in server address must match with one of the port in local endpoints")
-			} else {
-				err = fmt.Errorf("server address and local endpoint have different ports")
+				return serverAddr, endpoints, setupType,
+					uiErrInvalidErasureEndpoints(nil).Msg("port number in server address must match with one of the port in local endpoints")
 			}
-
-			return serverAddr, endpoints, setupType, err
+			return serverAddr, endpoints, setupType,
+				uiErrInvalidErasureEndpoints(nil).Msg("server address and local endpoint have different ports")
 		}
 	}
 
@@ -373,7 +373,7 @@ func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList,
 		// If all endpoints have same port number, then this is XL setup using URL style endpoints.
 		if len(localPortSet) == 1 {
 			if len(localServerAddrSet) > 1 {
-				// TODO: Eventhough all endpoints are local, the local host is referred by different IP/name.
+				// TODO: Even though all endpoints are local, the local host is referred by different IP/name.
 				// eg '172.0.0.1', 'localhost' and 'mylocalhostname' point to same local host.
 				//
 				// In this case, we bind to 0.0.0.0 ie to all interfaces.
@@ -387,7 +387,7 @@ func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList,
 			return serverAddr, endpoints, setupType, nil
 		}
 
-		// Eventhough all endpoints are local, but those endpoints use different ports.
+		// Even though all endpoints are local, but those endpoints use different ports.
 		// This means it is DistXL setup.
 	} else {
 		// This is DistXL setup.
@@ -399,7 +399,7 @@ func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList,
 			}
 
 			ipList, err := getHostIP4(host)
-			fatalIf(err, "unexpected error when resolving host '%s'", host)
+			logger.FatalIf(err, "unexpected error when resolving host '%s'", host)
 
 			// Filter ipList by IPs those start with '127.'.
 			loopBackIPs := ipList.FuncMatch(func(ip string, matchString string) bool {

cmd/endpoint_test.go

@@ -225,8 +225,8 @@ func TestCreateEndpoints(t *testing.T) {
 		{"localhost:10000", [][]string{{"./d1"}}, "localhost:10000", EndpointList{Endpoint{URL: &url.URL{Path: "d1"}, IsLocal: true}}, FSSetupType, nil},
 		{"localhost:10000", [][]string{{`\d1`}}, "localhost:10000", EndpointList{Endpoint{URL: &url.URL{Path: `\d1`}, IsLocal: true}}, FSSetupType, nil},
 		{"localhost:10000", [][]string{{`.\d1`}}, "localhost:10000", EndpointList{Endpoint{URL: &url.URL{Path: `.\d1`}, IsLocal: true}}, FSSetupType, nil},
-		{":8080", [][]string{{"https://example.org/d1", "https://example.org/d2", "https://example.org/d3", "https://example.org/d4"}}, "", EndpointList{}, -1, fmt.Errorf("no endpoint found for this host")},
-		{":8080", [][]string{{"https://example.org/d1", "https://example.com/d2", "https://example.net:8000/d3", "https://example.edu/d1"}}, "", EndpointList{}, -1, fmt.Errorf("no endpoint found for this host")},
+		{":8080", [][]string{{"https://example.org/d1", "https://example.org/d2", "https://example.org/d3", "https://example.org/d4"}}, "", EndpointList{}, -1, fmt.Errorf("no endpoint pointing to the local machine is found")},
+		{":8080", [][]string{{"https://example.org/d1", "https://example.com/d2", "https://example.net:8000/d3", "https://example.edu/d1"}}, "", EndpointList{}, -1, fmt.Errorf("no endpoint pointing to the local machine is found")},
 		{"localhost:9000", [][]string{{"https://127.0.0.1:9000/d1", "https://localhost:9001/d1", "https://example.com/d1", "https://example.com/d2"}}, "", EndpointList{}, -1, fmt.Errorf("path '/d1' can not be served by different port on same address")},
 		{"localhost:9000", [][]string{{"https://127.0.0.1:8000/d1", "https://localhost:9001/d2", "https://example.com/d1", "https://example.com/d2"}}, "", EndpointList{}, -1, fmt.Errorf("port number in server address must match with one of the port in local endpoints")},
 		{"localhost:10000", [][]string{{"https://127.0.0.1:8000/d1", "https://localhost:8000/d2", "https://example.com/d1", "https://example.com/d2"}}, "", EndpointList{}, -1, fmt.Errorf("server address and local endpoint have different ports")},

cmd/erasure-createfile.go

@@ -17,18 +17,20 @@
 package cmd
 
 import (
+	"context"
 	"hash"
 	"io"
 
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 )
 
 // CreateFile creates a new bitrot encoded file spread over all available disks. CreateFile will create
 // the file at the given volume and path. It will read from src until an io.EOF occurs. The given algorithm will
 // be used to protect the erasure encoded file.
-func (s *ErasureStorage) CreateFile(src io.Reader, volume, path string, buffer []byte, algorithm BitrotAlgorithm, writeQuorum int) (f ErasureFileInfo, err error) {
+func (s *ErasureStorage) CreateFile(ctx context.Context, src io.Reader, volume, path string, buffer []byte, algorithm BitrotAlgorithm, writeQuorum int) (f ErasureFileInfo, err error) {
 	if !algorithm.Available() {
-		return f, errors.Trace(errBitrotHashAlgoInvalid)
+		logger.LogIf(ctx, errBitrotHashAlgoInvalid)
+		return f, errBitrotHashAlgoInvalid
 	}
 	f.Checksums = make([][]byte, len(s.disks))
 	hashers := make([]hash.Hash, len(s.disks))
@@ -50,21 +52,22 @@ func (s *ErasureStorage) CreateFile(src io.Reader, volume, path string, buffer [
 			}
 			blocks = make([][]byte, len(s.disks)) // write empty block
 		} else if err == nil || (n > 0 && err == io.ErrUnexpectedEOF) {
-			blocks, err = s.ErasureEncode(buffer[:n])
+			blocks, err = s.ErasureEncode(ctx, buffer[:n])
 			if err != nil {
 				return f, err
 			}
 		} else {
-			return f, errors.Trace(err)
+			logger.LogIf(ctx, err)
+			return f, err
 		}
 
 		for i := range errChans { // span workers
-			go erasureAppendFile(s.disks[i], volume, path, hashers[i], blocks[i], errChans[i])
+			go erasureAppendFile(ctx, s.disks[i], volume, path, hashers[i], blocks[i], errChans[i])
 		}
 		for i := range errChans { // wait until all workers are finished
 			errs[i] = <-errChans[i]
 		}
-		if err = reduceWriteQuorumErrs(errs, objectOpIgnoredErrs, writeQuorum); err != nil {
+		if err = reduceWriteQuorumErrs(ctx, errs, objectOpIgnoredErrs, writeQuorum); err != nil {
 			return f, err
 		}
 		s.disks = evalDisks(s.disks, errs)
@@ -83,9 +86,10 @@ func (s *ErasureStorage) CreateFile(src io.Reader, volume, path string, buffer [
 
 // erasureAppendFile appends the content of buf to the file on the given disk and updates computes
 // the hash of the written data. It sends the write error (or nil) over the error channel.
-func erasureAppendFile(disk StorageAPI, volume, path string, hash hash.Hash, buf []byte, errChan chan<- error) {
+func erasureAppendFile(ctx context.Context, disk StorageAPI, volume, path string, hash hash.Hash, buf []byte, errChan chan<- error) {
 	if disk == OfflineDisk {
-		errChan <- errors.Trace(errDiskNotFound)
+		logger.LogIf(ctx, errDiskNotFound)
+		errChan <- errDiskNotFound
 		return
 	}
 	err := disk.AppendFile(volume, path, buf)

cmd/erasure-createfile_test.go

@@ -18,6 +18,7 @@ package cmd
 
 import (
 	"bytes"
+	"context"
 	"crypto/rand"
 	"io"
 	"testing"
@@ -70,7 +71,7 @@ func TestErasureCreateFile(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Test %d: failed to create test setup: %v", i, err)
 		}
-		storage, err := NewErasureStorage(setup.disks, test.dataBlocks, test.onDisks-test.dataBlocks, test.blocksize)
+		storage, err := NewErasureStorage(context.Background(), setup.disks, test.dataBlocks, test.onDisks-test.dataBlocks, test.blocksize)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create ErasureStorage: %v", i, err)
@@ -82,7 +83,7 @@ func TestErasureCreateFile(t *testing.T) {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to generate random test data: %v", i, err)
 		}
-		file, err := storage.CreateFile(bytes.NewReader(data[test.offset:]), "testbucket", "object", buffer, test.algorithm, test.dataBlocks+1)
+		file, err := storage.CreateFile(context.Background(), bytes.NewReader(data[test.offset:]), "testbucket", "object", buffer, test.algorithm, test.dataBlocks+1)
 		if err != nil && !test.shouldFail {
 			t.Errorf("Test %d: should pass but failed with: %v", i, err)
 		}
@@ -100,7 +101,7 @@ func TestErasureCreateFile(t *testing.T) {
 			if test.offDisks > 0 {
 				storage.disks[0] = OfflineDisk
 			}
-			file, err = storage.CreateFile(bytes.NewReader(data[test.offset:]), "testbucket", "object2", buffer, test.algorithm, test.dataBlocks+1)
+			file, err = storage.CreateFile(context.Background(), bytes.NewReader(data[test.offset:]), "testbucket", "object2", buffer, test.algorithm, test.dataBlocks+1)
 			if err != nil && !test.shouldFailQuorum {
 				t.Errorf("Test %d: should pass but failed with: %v", i, err)
 			}
@@ -125,7 +126,7 @@ func benchmarkErasureWrite(data, parity, dataDown, parityDown int, size int64, b
 		b.Fatalf("failed to create test setup: %v", err)
 	}
 	defer setup.Remove()
-	storage, err := NewErasureStorage(setup.disks, data, parity, blockSizeV1)
+	storage, err := NewErasureStorage(context.Background(), setup.disks, data, parity, blockSizeV1)
 	if err != nil {
 		b.Fatalf("failed to create ErasureStorage: %v", err)
 	}
@@ -143,7 +144,7 @@ func benchmarkErasureWrite(data, parity, dataDown, parityDown int, size int64, b
 	b.SetBytes(size)
 	b.ReportAllocs()
 	for i := 0; i < b.N; i++ {
-		_, err := storage.CreateFile(bytes.NewReader(content), "testbucket", "object", buffer, DefaultBitrotAlgorithm, data+1)
+		_, err := storage.CreateFile(context.Background(), bytes.NewReader(content), "testbucket", "object", buffer, DefaultBitrotAlgorithm, data+1)
 		if err != nil {
 			panic(err)
 		}

cmd/erasure-healfile.go

@@ -17,11 +17,12 @@
 package cmd
 
 import (
+	"context"
 	"fmt"
 	"hash"
 	"strings"
 
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 )
 
 // HealFile tries to reconstruct an erasure-coded file spread over all
@@ -45,12 +46,13 @@ import (
 //
 // It returns bitrot checksums for the non-nil staleDisks on which
 // healing succeeded.
-func (s ErasureStorage) HealFile(staleDisks []StorageAPI, volume, path string, blocksize int64,
+func (s ErasureStorage) HealFile(ctx context.Context, staleDisks []StorageAPI, volume, path string, blocksize int64,
 	dstVol, dstPath string, size int64, alg BitrotAlgorithm, checksums [][]byte) (
 	f ErasureFileInfo, err error) {
 
 	if !alg.Available() {
-		return f, errors.Trace(errBitrotHashAlgoInvalid)
+		logger.LogIf(ctx, errBitrotHashAlgoInvalid)
+		return f, errBitrotHashAlgoInvalid
 	}
 
 	// Initialization
@@ -84,7 +86,7 @@ func (s ErasureStorage) HealFile(staleDisks []StorageAPI, volume, path string, b
 	}
 	readLen += lastChunkSize
 	var buffers [][]byte
-	buffers, _, err = s.readConcurrent(volume, path, 0, readLen, verifiers)
+	buffers, _, err = s.readConcurrent(ctx, volume, path, 0, readLen, verifiers)
 	if err != nil {
 		return f, err
 	}
@@ -131,7 +133,7 @@ func (s ErasureStorage) HealFile(staleDisks []StorageAPI, volume, path string, b
 		}
 		buffOffset += csize
 
-		if err = s.ErasureDecodeDataAndParityBlocks(blocks); err != nil {
+		if err = s.ErasureDecodeDataAndParityBlocks(ctx, blocks); err != nil {
 			return f, err
 		}
 
@@ -155,7 +157,9 @@ func (s ErasureStorage) HealFile(staleDisks []StorageAPI, volume, path string, b
 		// If all disks had write errors we quit.
 		if !writeSucceeded {
 			// build error from all write errors
-			return f, errors.Trace(joinWriteErrors(writeErrors))
+			err := joinWriteErrors(writeErrors)
+			logger.LogIf(ctx, err)
+			return f, err
 		}
 	}
 

cmd/erasure-healfile_test.go

@@ -18,6 +18,7 @@ package cmd
 
 import (
 	"bytes"
+	"context"
 	"crypto/rand"
 	"io"
 	"reflect"
@@ -74,7 +75,7 @@ func TestErasureHealFile(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Test %d: failed to setup XL environment: %v", i, err)
 		}
-		storage, err := NewErasureStorage(setup.disks, test.dataBlocks, test.disks-test.dataBlocks, test.blocksize)
+		storage, err := NewErasureStorage(context.Background(), setup.disks, test.dataBlocks, test.disks-test.dataBlocks, test.blocksize)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create ErasureStorage: %v", i, err)
@@ -89,7 +90,7 @@ func TestErasureHealFile(t *testing.T) {
 			algorithm = DefaultBitrotAlgorithm
 		}
 		buffer := make([]byte, test.blocksize, 2*test.blocksize)
-		file, err := storage.CreateFile(bytes.NewReader(data), "testbucket", "testobject", buffer, algorithm, test.dataBlocks+1)
+		file, err := storage.CreateFile(context.Background(), bytes.NewReader(data), "testbucket", "testobject", buffer, algorithm, test.dataBlocks+1)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create random test data: %v", i, err)
@@ -113,7 +114,7 @@ func TestErasureHealFile(t *testing.T) {
 		}
 
 		// test case setup is complete - now call Healfile()
-		info, err := storage.HealFile(staleDisks, "testbucket", "testobject", test.blocksize, "testbucket", "healedobject", test.size, test.algorithm, file.Checksums)
+		info, err := storage.HealFile(context.Background(), staleDisks, "testbucket", "testobject", test.blocksize, "testbucket", "healedobject", test.size, test.algorithm, file.Checksums)
 		if err != nil && !test.shouldFail {
 			t.Errorf("Test %d: should pass but it failed with: %v", i, err)
 		}

cmd/erasure-readfile.go

@@ -17,9 +17,10 @@
 package cmd
 
 import (
+	"context"
 	"io"
 
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 )
 
 type errIdx struct {
@@ -27,7 +28,7 @@ type errIdx struct {
 	err error
 }
 
-func (s ErasureStorage) readConcurrent(volume, path string, offset, length int64,
+func (s ErasureStorage) readConcurrent(ctx context.Context, volume, path string, offset, length int64,
 	verifiers []*BitrotVerifier) (buffers [][]byte, needsReconstruction bool,
 	err error) {
 
@@ -39,7 +40,8 @@ func (s ErasureStorage) readConcurrent(volume, path string, offset, length int64
 		stageBuffers[i] = make([]byte, length)
 		disk := s.disks[i]
 		if disk == OfflineDisk {
-			errChan <- errIdx{i, errors.Trace(errDiskNotFound)}
+			logger.LogIf(ctx, errDiskNotFound)
+			errChan <- errIdx{i, errDiskNotFound}
 			return
 		}
 		_, rerr := disk.ReadFile(volume, path, offset, stageBuffers[i], verifiers[i])
@@ -75,7 +77,8 @@ func (s ErasureStorage) readConcurrent(volume, path string, offset, length int64
 	}
 	if successCount != s.dataBlocks {
 		// Not enough disks returns data.
-		err = errors.Trace(errXLReadQuorum)
+		err = errXLReadQuorum
+		logger.LogIf(ctx, err)
 	}
 	return
 }
@@ -86,18 +89,21 @@ func (s ErasureStorage) readConcurrent(volume, path string, offset, length int64
 // integrity of the given file. ReadFile will read data from the given
 // offset up to the given length. If parts of the file are corrupted
 // ReadFile tries to reconstruct the data.
-func (s ErasureStorage) ReadFile(writer io.Writer, volume, path string, offset,
+func (s ErasureStorage) ReadFile(ctx context.Context, writer io.Writer, volume, path string, offset,
 	length, totalLength int64, checksums [][]byte, algorithm BitrotAlgorithm,
 	blocksize int64) (f ErasureFileInfo, err error) {
 
 	if offset < 0 || length < 0 {
-		return f, errors.Trace(errUnexpected)
+		logger.LogIf(ctx, errUnexpected)
+		return f, errUnexpected
 	}
 	if offset+length > totalLength {
-		return f, errors.Trace(errUnexpected)
+		logger.LogIf(ctx, errUnexpected)
+		return f, errUnexpected
 	}
 	if !algorithm.Available() {
-		return f, errors.Trace(errBitrotHashAlgoInvalid)
+		logger.LogIf(ctx, errBitrotHashAlgoInvalid)
+		return f, errBitrotHashAlgoInvalid
 	}
 
 	f.Checksums = make([][]byte, len(s.disks))
@@ -145,7 +151,7 @@ func (s ErasureStorage) ReadFile(writer io.Writer, volume, path string, offset,
 
 	var buffers [][]byte
 	var needsReconstruction bool
-	buffers, needsReconstruction, err = s.readConcurrent(volume, path,
+	buffers, needsReconstruction, err = s.readConcurrent(ctx, volume, path,
 		partDataStartIndex, partDataLength, verifiers)
 	if err != nil {
 		// Could not read enough disks.
@@ -194,7 +200,8 @@ func (s ErasureStorage) ReadFile(writer io.Writer, volume, path string, offset,
 
 		if needsReconstruction {
 			if err = s.ErasureDecodeDataBlocks(blocks); err != nil {
-				return f, errors.Trace(err)
+				logger.LogIf(ctx, err)
+				return f, err
 			}
 		}
 
@@ -210,7 +217,7 @@ func (s ErasureStorage) ReadFile(writer io.Writer, volume, path string, offset,
 				writeLength = lastBlockLength - writeStart
 			}
 		}
-		n, err := writeDataBlocks(writer, blocks, s.dataBlocks, writeStart, writeLength)
+		n, err := writeDataBlocks(ctx, writer, blocks, s.dataBlocks, writeStart, writeLength)
 		if err != nil {
 			return f, err
 		}

cmd/erasure-readfile_test.go

@@ -18,6 +18,7 @@ package cmd
 
 import (
 	"bytes"
+	"context"
 	crand "crypto/rand"
 	"io"
 	"math/rand"
@@ -86,7 +87,7 @@ func TestErasureReadFile(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Test %d: failed to create test setup: %v", i, err)
 		}
-		storage, err := NewErasureStorage(setup.disks, test.dataBlocks, test.onDisks-test.dataBlocks, test.blocksize)
+		storage, err := NewErasureStorage(context.Background(), setup.disks, test.dataBlocks, test.onDisks-test.dataBlocks, test.blocksize)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create ErasureStorage: %v", i, err)
@@ -102,13 +103,13 @@ func TestErasureReadFile(t *testing.T) {
 			writeAlgorithm = DefaultBitrotAlgorithm
 		}
 		buffer := make([]byte, test.blocksize, 2*test.blocksize)
-		file, err := storage.CreateFile(bytes.NewReader(data[:]), "testbucket", "object", buffer, writeAlgorithm, test.dataBlocks+1)
+		file, err := storage.CreateFile(context.Background(), bytes.NewReader(data[:]), "testbucket", "object", buffer, writeAlgorithm, test.dataBlocks+1)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create erasure test file: %v", i, err)
 		}
 		writer := bytes.NewBuffer(nil)
-		readInfo, err := storage.ReadFile(writer, "testbucket", "object", test.offset, test.length, test.data, file.Checksums, test.algorithm, test.blocksize)
+		readInfo, err := storage.ReadFile(context.Background(), writer, "testbucket", "object", test.offset, test.length, test.data, file.Checksums, test.algorithm, test.blocksize)
 		if err != nil && !test.shouldFail {
 			t.Errorf("Test %d: should pass but failed with: %v", i, err)
 		}
@@ -134,7 +135,7 @@ func TestErasureReadFile(t *testing.T) {
 			if test.offDisks > 0 {
 				storage.disks[0] = OfflineDisk
 			}
-			readInfo, err = storage.ReadFile(writer, "testbucket", "object", test.offset, test.length, test.data, file.Checksums, test.algorithm, test.blocksize)
+			readInfo, err = storage.ReadFile(context.Background(), writer, "testbucket", "object", test.offset, test.length, test.data, file.Checksums, test.algorithm, test.blocksize)
 			if err != nil && !test.shouldFailQuorum {
 				t.Errorf("Test %d: should pass but failed with: %v", i, err)
 			}
@@ -174,7 +175,7 @@ func TestErasureReadFileRandomOffsetLength(t *testing.T) {
 	}
 	defer setup.Remove()
 
-	storage, err := NewErasureStorage(setup.disks, dataBlocks, parityBlocks, blockSize)
+	storage, err := NewErasureStorage(context.Background(), setup.disks, dataBlocks, parityBlocks, blockSize)
 	if err != nil {
 		t.Fatalf("failed to create ErasureStorage: %v", err)
 	}
@@ -191,7 +192,7 @@ func TestErasureReadFileRandomOffsetLength(t *testing.T) {
 
 	// Create a test file to read from.
 	buffer := make([]byte, blockSize, 2*blockSize)
-	file, err := storage.CreateFile(bytes.NewReader(data), "testbucket", "testobject", buffer, DefaultBitrotAlgorithm, dataBlocks+1)
+	file, err := storage.CreateFile(context.Background(), bytes.NewReader(data), "testbucket", "testobject", buffer, DefaultBitrotAlgorithm, dataBlocks+1)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -211,7 +212,7 @@ func TestErasureReadFileRandomOffsetLength(t *testing.T) {
 
 		expected := data[offset : offset+readLen]
 
-		_, err = storage.ReadFile(buf, "testbucket", "testobject", offset, readLen, length, file.Checksums, DefaultBitrotAlgorithm, blockSize)
+		_, err = storage.ReadFile(context.Background(), buf, "testbucket", "testobject", offset, readLen, length, file.Checksums, DefaultBitrotAlgorithm, blockSize)
 		if err != nil {
 			t.Fatal(err, offset, readLen)
 		}
@@ -231,14 +232,14 @@ func benchmarkErasureRead(data, parity, dataDown, parityDown int, size int64, b
 		b.Fatalf("failed to create test setup: %v", err)
 	}
 	defer setup.Remove()
-	storage, err := NewErasureStorage(setup.disks, data, parity, blockSizeV1)
+	storage, err := NewErasureStorage(context.Background(), setup.disks, data, parity, blockSizeV1)
 	if err != nil {
 		b.Fatalf("failed to create ErasureStorage: %v", err)
 	}
 
 	content := make([]byte, size)
 	buffer := make([]byte, blockSizeV1, 2*blockSizeV1)
-	file, err := storage.CreateFile(bytes.NewReader(content), "testbucket", "object", buffer, DefaultBitrotAlgorithm, data+1)
+	file, err := storage.CreateFile(context.Background(), bytes.NewReader(content), "testbucket", "object", buffer, DefaultBitrotAlgorithm, data+1)
 	if err != nil {
 		b.Fatalf("failed to create erasure test file: %v", err)
 	}
@@ -255,7 +256,7 @@ func benchmarkErasureRead(data, parity, dataDown, parityDown int, size int64, b
 	b.SetBytes(size)
 	b.ReportAllocs()
 	for i := 0; i < b.N; i++ {
-		if file, err = storage.ReadFile(bytes.NewBuffer(content[:0]), "testbucket", "object", 0, size, size, checksums, DefaultBitrotAlgorithm, blockSizeV1); err != nil {
+		if file, err = storage.ReadFile(context.Background(), bytes.NewBuffer(content[:0]), "testbucket", "object", 0, size, size, checksums, DefaultBitrotAlgorithm, blockSizeV1); err != nil {
 			panic(err)
 		}
 	}

cmd/erasure-utils.go

@@ -18,10 +18,11 @@ package cmd
 
 import (
 	"bytes"
+	"context"
 	"io"
 
 	"github.com/klauspost/reedsolomon"
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 )
 
 // getDataBlockLen - get length of data blocks from encoded blocks.
@@ -36,20 +37,23 @@ func getDataBlockLen(enBlocks [][]byte, dataBlocks int) int {
 
 // Writes all the data blocks from encoded blocks until requested
 // outSize length. Provides a way to skip bytes until the offset.
-func writeDataBlocks(dst io.Writer, enBlocks [][]byte, dataBlocks int, offset int64, length int64) (int64, error) {
+func writeDataBlocks(ctx context.Context, dst io.Writer, enBlocks [][]byte, dataBlocks int, offset int64, length int64) (int64, error) {
 	// Offset and out size cannot be negative.
 	if offset < 0 || length < 0 {
-		return 0, errors.Trace(errUnexpected)
+		logger.LogIf(ctx, errUnexpected)
+		return 0, errUnexpected
 	}
 
 	// Do we have enough blocks?
 	if len(enBlocks) < dataBlocks {
-		return 0, errors.Trace(reedsolomon.ErrTooFewShards)
+		logger.LogIf(ctx, reedsolomon.ErrTooFewShards)
+		return 0, reedsolomon.ErrTooFewShards
 	}
 
 	// Do we have enough data?
 	if int64(getDataBlockLen(enBlocks, dataBlocks)) < length {
-		return 0, errors.Trace(reedsolomon.ErrShortData)
+		logger.LogIf(ctx, reedsolomon.ErrShortData)
+		return 0, reedsolomon.ErrShortData
 	}
 
 	// Counter to decrement total left to write.
@@ -77,7 +81,8 @@ func writeDataBlocks(dst io.Writer, enBlocks [][]byte, dataBlocks int, offset in
 		if write < int64(len(block)) {
 			n, err := io.Copy(dst, bytes.NewReader(block[:write]))
 			if err != nil {
-				return 0, errors.Trace(err)
+				logger.LogIf(ctx, err)
+				return 0, err
 			}
 			totalWritten += n
 			break
@@ -85,7 +90,8 @@ func writeDataBlocks(dst io.Writer, enBlocks [][]byte, dataBlocks int, offset in
 		// Copy the block.
 		n, err := io.Copy(dst, bytes.NewReader(block))
 		if err != nil {
-			return 0, errors.Trace(err)
+			logger.LogIf(ctx, err)
+			return 0, err
 		}
 
 		// Decrement output size.

cmd/erasure.go

@@ -17,11 +17,12 @@
 package cmd
 
 import (
+	"context"
 	"crypto/subtle"
 	"hash"
 
 	"github.com/klauspost/reedsolomon"
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 )
 
 // OfflineDisk represents an unavailable disk.
@@ -44,11 +45,12 @@ type ErasureStorage struct {
 
 // NewErasureStorage creates a new ErasureStorage. The storage erasure codes and protects all data written to
 // the disks.
-func NewErasureStorage(disks []StorageAPI, dataBlocks, parityBlocks int, blockSize int64) (s ErasureStorage, err error) {
+func NewErasureStorage(ctx context.Context, disks []StorageAPI, dataBlocks, parityBlocks int, blockSize int64) (s ErasureStorage, err error) {
 	shardsize := (int(blockSize) + dataBlocks - 1) / dataBlocks
 	erasure, err := reedsolomon.New(dataBlocks, parityBlocks, reedsolomon.WithAutoGoroutines(shardsize))
 	if err != nil {
-		return s, errors.Tracef("failed to create erasure coding: %v", err)
+		logger.LogIf(ctx, err)
+		return s, err
 	}
 	s = ErasureStorage{
 		disks:        make([]StorageAPI, len(disks)),
@@ -62,13 +64,15 @@ func NewErasureStorage(disks []StorageAPI, dataBlocks, parityBlocks int, blockSi
 
 // ErasureEncode encodes the given data and returns the erasure-coded data.
 // It returns an error if the erasure coding failed.
-func (s *ErasureStorage) ErasureEncode(data []byte) ([][]byte, error) {
+func (s *ErasureStorage) ErasureEncode(ctx context.Context, data []byte) ([][]byte, error) {
 	encoded, err := s.erasure.Split(data)
 	if err != nil {
-		return nil, errors.Tracef("failed to split data: %v", err)
+		logger.LogIf(ctx, err)
+		return nil, err
 	}
 	if err = s.erasure.Encode(encoded); err != nil {
-		return nil, errors.Tracef("failed to encode data: %v", err)
+		logger.LogIf(ctx, err)
+		return nil, err
 	}
 	return encoded, nil
 }
@@ -78,16 +82,17 @@ func (s *ErasureStorage) ErasureEncode(data []byte) ([][]byte, error) {
 // It returns an error if the decoding failed.
 func (s *ErasureStorage) ErasureDecodeDataBlocks(data [][]byte) error {
 	if err := s.erasure.ReconstructData(data); err != nil {
-		return errors.Tracef("failed to reconstruct data: %v", err)
+		return err
 	}
 	return nil
 }
 
 // ErasureDecodeDataAndParityBlocks decodes the given erasure-coded data and verifies it.
 // It returns an error if the decoding failed.
-func (s *ErasureStorage) ErasureDecodeDataAndParityBlocks(data [][]byte) error {
+func (s *ErasureStorage) ErasureDecodeDataAndParityBlocks(ctx context.Context, data [][]byte) error {
 	if err := s.erasure.Reconstruct(data); err != nil {
-		return errors.Tracef("failed to reconstruct data: %v", err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 	return nil
 }

cmd/erasure_test.go

@@ -18,6 +18,7 @@ package cmd
 
 import (
 	"bytes"
+	"context"
 	"crypto/rand"
 	"io"
 	"os"
@@ -52,11 +53,11 @@ func TestErasureDecode(t *testing.T) {
 		copy(buffer, data)
 
 		disks := make([]StorageAPI, test.dataBlocks+test.parityBlocks)
-		storage, err := NewErasureStorage(disks, test.dataBlocks, test.parityBlocks, blockSizeV1)
+		storage, err := NewErasureStorage(context.Background(), disks, test.dataBlocks, test.parityBlocks, blockSizeV1)
 		if err != nil {
 			t.Fatalf("Test %d: failed to create erasure storage: %v", i, err)
 		}
-		encoded, err := storage.ErasureEncode(buffer)
+		encoded, err := storage.ErasureEncode(context.Background(), buffer)
 		if err != nil {
 			t.Fatalf("Test %d: failed to encode data: %v", i, err)
 		}
@@ -69,7 +70,7 @@ func TestErasureDecode(t *testing.T) {
 		}
 
 		if test.reconstructParity {
-			err = storage.ErasureDecodeDataAndParityBlocks(encoded)
+			err = storage.ErasureDecodeDataAndParityBlocks(context.Background(), encoded)
 		} else {
 			err = storage.ErasureDecodeDataBlocks(encoded)
 		}
@@ -98,7 +99,7 @@ func TestErasureDecode(t *testing.T) {
 			}
 
 			decodedData := new(bytes.Buffer)
-			if _, err = writeDataBlocks(decodedData, decoded, test.dataBlocks, 0, int64(len(data))); err != nil {
+			if _, err = writeDataBlocks(context.Background(), decodedData, decoded, test.dataBlocks, 0, int64(len(data))); err != nil {
 				t.Errorf("Test %d: failed to write data blocks: %v", i, err)
 			}
 			if !bytes.Equal(decodedData.Bytes(), data) {

cmd/format-disk-cache.go

@@ -17,13 +17,14 @@
 package cmd
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io"
 	"os"
 	"reflect"
 
-	errors2 "github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 )
 
 const (
@@ -86,28 +87,19 @@ func newFormatCacheV1(drives []string) []*formatCacheV1 {
 	return formats
 }
 
-// Returns format.Cache.Version
-func formatCacheGetVersion(r io.ReadSeeker) (string, error) {
-	format := &formatCacheVersionDetect{}
-	if err := jsonLoad(r, format); err != nil {
-		return "", err
-	}
-	return format.Cache.Version, nil
-}
-
 // Creates a new cache format.json if unformatted.
 func createFormatCache(fsFormatPath string, format *formatCacheV1) error {
 	// open file using READ & WRITE permission
 	var file, err = os.OpenFile(fsFormatPath, os.O_RDWR|os.O_CREATE, 0600)
 	if err != nil {
-		return errors2.Trace(err)
+		return err
 	}
 	// Close the locked file upon return.
 	defer file.Close()
 
 	fi, err := file.Stat()
 	if err != nil {
-		return errors2.Trace(err)
+		return err
 	}
 	if fi.Size() != 0 {
 		// format.json already got created because of another minio process's createFormatCache()
@@ -118,7 +110,7 @@ func createFormatCache(fsFormatPath string, format *formatCacheV1) error {
 
 // This function creates a cache format file on disk and returns a slice
 // of format cache config
-func initFormatCache(drives []string) (formats []*formatCacheV1, err error) {
+func initFormatCache(ctx context.Context, drives []string) (formats []*formatCacheV1, err error) {
 	nformats := newFormatCacheV1(drives)
 	for _, drive := range drives {
 		_, err = os.Stat(drive)
@@ -126,28 +118,36 @@ func initFormatCache(drives []string) (formats []*formatCacheV1, err error) {
 			continue
 		}
 		if !os.IsNotExist(err) {
+			logger.GetReqInfo(ctx).AppendTags("drive", drive)
+			logger.LogIf(ctx, err)
 			return nil, err
 		}
 		if err = os.Mkdir(drive, 0777); err != nil {
+			logger.GetReqInfo(ctx).AppendTags("drive", drive)
+			logger.LogIf(ctx, err)
 			return nil, err
 		}
 	}
 	for i, drive := range drives {
 		if err = os.Mkdir(pathJoin(drive, minioMetaBucket), 0777); err != nil {
 			if !os.IsExist(err) {
+				logger.GetReqInfo(ctx).AppendTags("drive", drive)
+				logger.LogIf(ctx, err)
 				return nil, err
 			}
 		}
 		cacheFormatPath := pathJoin(drive, minioMetaBucket, formatConfigFile)
 		// Fresh disk - create format.json for this cfs
 		if err = createFormatCache(cacheFormatPath, nformats[i]); err != nil {
+			logger.GetReqInfo(ctx).AppendTags("drive", drive)
+			logger.LogIf(ctx, err)
 			return nil, err
 		}
 	}
 	return nformats, nil
 }
 
-func loadFormatCache(drives []string) ([]*formatCacheV1, error) {
+func loadFormatCache(ctx context.Context, drives []string) ([]*formatCacheV1, error) {
 	formats := make([]*formatCacheV1, len(drives))
 	for i, drive := range drives {
 		cacheFormatPath := pathJoin(drive, minioMetaBucket, formatConfigFile)
@@ -156,6 +156,7 @@ func loadFormatCache(drives []string) ([]*formatCacheV1, error) {
 			if os.IsNotExist(err) {
 				continue
 			}
+			logger.LogIf(ctx, err)
 			return nil, err
 		}
 		defer f.Close()
@@ -268,7 +269,7 @@ func findCacheDiskIndex(disk string, disks []string) int {
 }
 
 // validate whether cache drives order has changed
-func validateCacheFormats(formats []*formatCacheV1) error {
+func validateCacheFormats(ctx context.Context, formats []*formatCacheV1) error {
 	count := 0
 	for _, format := range formats {
 		if format == nil {
@@ -279,12 +280,16 @@ func validateCacheFormats(formats []*formatCacheV1) error {
 		return errors.New("Cache format files missing on all drives")
 	}
 	if _, err := checkFormatCacheValues(formats); err != nil {
+		logger.LogIf(ctx, err)
 		return err
 	}
 	if err := checkCacheDisksSliceConsistency(formats); err != nil {
+		logger.LogIf(ctx, err)
 		return err
 	}
-	return checkCacheDiskConsistency(formats)
+	err := checkCacheDiskConsistency(formats)
+	logger.LogIf(ctx, err)
+	return err
 }
 
 // return true if all of the list of cache drives are
@@ -303,16 +308,16 @@ func cacheDrivesUnformatted(drives []string) bool {
 // create format.json for each cache drive if fresh disk or load format from disk
 // Then validate the format for all drives in the cache to ensure order
 // of cache drives has not changed.
-func loadAndValidateCacheFormat(drives []string) (formats []*formatCacheV1, err error) {
+func loadAndValidateCacheFormat(ctx context.Context, drives []string) (formats []*formatCacheV1, err error) {
 	if cacheDrivesUnformatted(drives) {
-		formats, err = initFormatCache(drives)
+		formats, err = initFormatCache(ctx, drives)
 	} else {
-		formats, err = loadFormatCache(drives)
+		formats, err = loadFormatCache(ctx, drives)
 	}
 	if err != nil {
 		return nil, err
 	}
-	if err = validateCacheFormats(formats); err != nil {
+	if err = validateCacheFormats(ctx, formats); err != nil {
 		return nil, err
 	}
 	return formats, nil

cmd/format-disk-cache_test.go

@@ -17,18 +17,30 @@
 package cmd
 
 import (
+	"context"
+	"io"
 	"os"
 	"testing"
 )
 
+// Returns format.Cache.Version
+func formatCacheGetVersion(r io.ReadSeeker) (string, error) {
+	format := &formatCacheVersionDetect{}
+	if err := jsonLoad(r, format); err != nil {
+		return "", err
+	}
+	return format.Cache.Version, nil
+}
+
 // TestDiskCacheFormat - tests initFormatCache, formatMetaGetFormatBackendCache, formatCacheGetVersion.
 func TestDiskCacheFormat(t *testing.T) {
+	ctx := context.Background()
 	fsDirs, err := getRandomDisks(1)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	_, err = initFormatCache(fsDirs)
+	_, err = initFormatCache(ctx, fsDirs)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -56,7 +68,7 @@ func TestDiskCacheFormat(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if _, err = loadAndValidateCacheFormat(fsDirs); err == nil {
+	if _, err = loadAndValidateCacheFormat(context.Background(), fsDirs); err == nil {
 		t.Fatal("expected to fail")
 	}
 
@@ -69,7 +81,7 @@ func TestDiskCacheFormat(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if _, err = loadAndValidateCacheFormat(fsDirs); err == nil {
+	if _, err = loadAndValidateCacheFormat(context.Background(), fsDirs); err == nil {
 		t.Fatal("expected to fail")
 	}
 }
@@ -307,7 +319,7 @@ func TestFormatCache(t *testing.T) {
 	}
 
 	for i, testCase := range testCases {
-		err := validateCacheFormats(testCase.formatConfigs)
+		err := validateCacheFormats(context.Background(), testCase.formatConfigs)
 		if err != nil && testCase.shouldPass {
 			t.Errorf("Test %d: Expected to pass but failed with %s", i+1, err)
 		}

cmd/format-fs.go

@@ -17,13 +17,13 @@
 package cmd
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"os"
 	"path"
 	"time"
 
-	errors2 "github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/lock"
 )
 
@@ -97,7 +97,7 @@ func formatFSGetVersion(r io.ReadSeeker) (string, error) {
 
 // Migrate from V1 to V2. V2 implements new backend format for multipart
 // uploads. Delete the previous multipart directory.
-func formatFSMigrateV1ToV2(wlk *lock.LockedFile, fsPath string) error {
+func formatFSMigrateV1ToV2(ctx context.Context, wlk *lock.LockedFile, fsPath string) error {
 	version, err := formatFSGetVersion(wlk)
 	if err != nil {
 		return err
@@ -107,7 +107,7 @@ func formatFSMigrateV1ToV2(wlk *lock.LockedFile, fsPath string) error {
 		return fmt.Errorf(`format.json version expected %s, found %s`, formatFSVersionV1, version)
 	}
 
-	if err = fsRemoveAll(path.Join(fsPath, minioMetaMultipartBucket)); err != nil {
+	if err = fsRemoveAll(ctx, path.Join(fsPath, minioMetaMultipartBucket)); err != nil {
 		return err
 	}
 
@@ -122,7 +122,7 @@ func formatFSMigrateV1ToV2(wlk *lock.LockedFile, fsPath string) error {
 // Migration should happen when formatFSV1.FS.Version changes. This version
 // can change when there is a change to the struct formatFSV1.FS or if there
 // is any change in the backend file system tree structure.
-func formatFSMigrate(wlk *lock.LockedFile, fsPath string) error {
+func formatFSMigrate(ctx context.Context, wlk *lock.LockedFile, fsPath string) error {
 	// Add any migration code here in case we bump format.FS.Version
 	version, err := formatFSGetVersion(wlk)
 	if err != nil {
@@ -131,7 +131,7 @@ func formatFSMigrate(wlk *lock.LockedFile, fsPath string) error {
 
 	switch version {
 	case formatFSVersionV1:
-		if err = formatFSMigrateV1ToV2(wlk, fsPath); err != nil {
+		if err = formatFSMigrateV1ToV2(ctx, wlk, fsPath); err != nil {
 			return err
 		}
 		fallthrough
@@ -145,25 +145,25 @@ func formatFSMigrate(wlk *lock.LockedFile, fsPath string) error {
 		return err
 	}
 	if version != formatFSVersionV2 {
-		return fmt.Errorf(`%s file: expected FS version: %s, found FS version: %s`, formatConfigFile, formatFSVersionV2, version)
+		return uiErrUnexpectedBackendVersion(fmt.Errorf(`%s file: expected FS version: %s, found FS version: %s`, formatConfigFile, formatFSVersionV2, version))
 	}
 	return nil
 }
 
 // Creates a new format.json if unformatted.
-func createFormatFS(fsFormatPath string) error {
+func createFormatFS(ctx context.Context, fsFormatPath string) error {
 	// Attempt a write lock on formatConfigFile `format.json`
 	// file stored in minioMetaBucket(.minio.sys) directory.
 	lk, err := lock.TryLockedOpenFile(fsFormatPath, os.O_RDWR|os.O_CREATE, 0600)
 	if err != nil {
-		return errors2.Trace(err)
+		return err
 	}
 	// Close the locked file upon return.
 	defer lk.Close()
 
 	fi, err := lk.Stat()
 	if err != nil {
-		return errors2.Trace(err)
+		return err
 	}
 	if fi.Size() != 0 {
 		// format.json already got created because of another minio process's createFormatFS()
@@ -177,7 +177,7 @@ func createFormatFS(fsFormatPath string) error {
 // The file descriptor should be kept open throughout the life
 // of the process so that another minio process does not try to
 // migrate the backend when we are actively working on the backend.
-func initFormatFS(fsPath string) (rlk *lock.RLockedFile, err error) {
+func initFormatFS(ctx context.Context, fsPath string) (rlk *lock.RLockedFile, err error) {
 	fsFormatPath := pathJoin(fsPath, minioMetaBucket, formatConfigFile)
 	// Any read on format.json should be done with read-lock.
 	// Any write on format.json should be done with write-lock.
@@ -191,7 +191,7 @@ func initFormatFS(fsPath string) (rlk *lock.RLockedFile, err error) {
 			var fi os.FileInfo
 			fi, err = rlk.Stat()
 			if err != nil {
-				return nil, errors2.Trace(err)
+				return nil, err
 			}
 			isEmpty = fi.Size() == 0
 		}
@@ -200,7 +200,7 @@ func initFormatFS(fsPath string) (rlk *lock.RLockedFile, err error) {
 				rlk.Close()
 			}
 			// Fresh disk - create format.json
-			err = createFormatFS(fsFormatPath)
+			err = createFormatFS(ctx, fsFormatPath)
 			if err == lock.ErrAlreadyLocked {
 				// Lock already present, sleep and attempt again.
 				// Can happen in a rare situation when a parallel minio process
@@ -209,19 +209,19 @@ func initFormatFS(fsPath string) (rlk *lock.RLockedFile, err error) {
 				continue
 			}
 			if err != nil {
-				return nil, errors2.Trace(err)
+				return nil, err
 			}
 			// After successfully creating format.json try to hold a read-lock on
 			// the file.
 			continue
 		}
 		if err != nil {
-			return nil, errors2.Trace(err)
+			return nil, err
 		}
 
 		formatBackend, err := formatMetaGetFormatBackendFS(rlk)
 		if err != nil {
-			return nil, errors2.Trace(err)
+			return nil, err
 		}
 		if formatBackend != formatBackendFS {
 			return nil, fmt.Errorf(`%s file: expected format-type: %s, found: %s`, formatConfigFile, formatBackendFS, formatBackend)
@@ -244,7 +244,7 @@ func initFormatFS(fsPath string) (rlk *lock.RLockedFile, err error) {
 			if err != nil {
 				return nil, err
 			}
-			err = formatFSMigrate(wlk, fsPath)
+			err = formatFSMigrate(ctx, wlk, fsPath)
 			wlk.Close()
 			if err != nil {
 				// Migration failed, bail out so that the user can observe what happened.

cmd/format-fs_test.go

@@ -17,6 +17,7 @@
 package cmd
 
 import (
+	"context"
 	"os"
 	"path/filepath"
 	"testing"
@@ -38,7 +39,7 @@ func TestFSFormatFS(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	rlk, err := initFormatFS(disk)
+	rlk, err := initFormatFS(context.Background(), disk)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -81,7 +82,7 @@ func TestFSFormatFS(t *testing.T) {
 	if _, err = formatFSGetVersion(rlk); err == nil {
 		t.Fatal("expected to fail")
 	}
-	if _, err = initFormatFS(disk); err == nil {
+	if _, err = initFormatFS(context.Background(), disk); err == nil {
 		t.Fatal("expected to fail")
 	}
 
@@ -96,7 +97,7 @@ func TestFSFormatFS(t *testing.T) {
 	if _, err = formatMetaGetFormatBackendFS(f); err == nil {
 		t.Fatal("expected to fail")
 	}
-	if _, err = initFormatFS(disk); err == nil {
+	if _, err = initFormatFS(context.Background(), disk); err == nil {
 		t.Fatal("expected to fail")
 	}
 }

cmd/format-xl.go

@@ -17,6 +17,7 @@
 package cmd
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -26,7 +27,6 @@ import (
 	"encoding/hex"
 
 	humanize "github.com/dustin/go-humanize"
-	"github.com/minio/minio/pkg/errors"
 	sha256 "github.com/minio/sha256-simd"
 )
 
@@ -288,10 +288,10 @@ func formatXLMigrateV2ToV3(export string) error {
 	return ioutil.WriteFile(formatPath, b, 0644)
 }
 
-// Returns true, if one of the errors is non-nil.
-func hasAnyErrors(errs []error) bool {
+// Returns true, if one of the errors is non-nil and is Unformatted disk.
+func hasAnyErrorsUnformatted(errs []error) bool {
 	for _, err := range errs {
-		if err != nil {
+		if err != nil && err == errUnformattedDisk {
 			return true
 		}
 	}
@@ -302,7 +302,7 @@ func hasAnyErrors(errs []error) bool {
 func countErrs(errs []error, err error) int {
 	var i = 0
 	for _, err1 := range errs {
-		if errors.Cause(err1) == err {
+		if err1 == err {
 			i++
 		}
 	}
@@ -314,6 +314,11 @@ func shouldInitXLDisks(errs []error) bool {
 	return countErrs(errs, errUnformattedDisk) == len(errs)
 }
 
+// Check if unformatted disks are equal to write quorum.
+func quorumUnformattedDisks(errs []error) bool {
+	return countErrs(errs, errUnformattedDisk) >= (len(errs)/2)+1
+}
+
 // loadFormatXLAll - load all format config from all input disks in parallel.
 func loadFormatXLAll(storageDisks []StorageAPI) ([]*formatXLV3, []error) {
 	// Initialize sync waitgroup.
@@ -520,7 +525,7 @@ func formatXLV3Check(reference *formatXLV3, format *formatXLV3) error {
 }
 
 // saveFormatXLAll - populates `format.json` on disks in its order.
-func saveFormatXLAll(storageDisks []StorageAPI, formats []*formatXLV3) error {
+func saveFormatXLAll(ctx context.Context, storageDisks []StorageAPI, formats []*formatXLV3) error {
 	var errs = make([]error, len(storageDisks))
 
 	var wg = &sync.WaitGroup{}
@@ -542,7 +547,7 @@ func saveFormatXLAll(storageDisks []StorageAPI, formats []*formatXLV3) error {
 	wg.Wait()
 
 	writeQuorum := len(storageDisks)/2 + 1
-	return reduceWriteQuorumErrs(errs, nil, writeQuorum)
+	return reduceWriteQuorumErrs(ctx, errs, nil, writeQuorum)
 }
 
 // relinquishes the underlying connection for all storage disks.
@@ -614,7 +619,7 @@ func fixFormatXLV3(storageDisks []StorageAPI, endpoints EndpointList, formats []
 }
 
 // initFormatXL - save XL format configuration on all disks.
-func initFormatXL(storageDisks []StorageAPI, setCount, disksPerSet int) (format *formatXLV3, err error) {
+func initFormatXL(ctx context.Context, storageDisks []StorageAPI, setCount, disksPerSet int) (format *formatXLV3, err error) {
 	format = newFormatXLV3(setCount, disksPerSet)
 	formats := make([]*formatXLV3, len(storageDisks))
 
@@ -632,7 +637,7 @@ func initFormatXL(storageDisks []StorageAPI, setCount, disksPerSet int) (format
 	}
 
 	// Save formats `format.json` across all disks.
-	if err = saveFormatXLAll(storageDisks, formats); err != nil {
+	if err = saveFormatXLAll(ctx, storageDisks, formats); err != nil {
 		return nil, err
 	}
 
@@ -643,17 +648,17 @@ func initFormatXL(storageDisks []StorageAPI, setCount, disksPerSet int) (format
 func makeFormatXLMetaVolumes(disk StorageAPI) error {
 	// Attempt to create `.minio.sys`.
 	if err := disk.MakeVol(minioMetaBucket); err != nil {
-		if !errors.IsErrIgnored(err, initMetaVolIgnoredErrs...) {
+		if !IsErrIgnored(err, initMetaVolIgnoredErrs...) {
 			return err
 		}
 	}
 	if err := disk.MakeVol(minioMetaTmpBucket); err != nil {
-		if !errors.IsErrIgnored(err, initMetaVolIgnoredErrs...) {
+		if !IsErrIgnored(err, initMetaVolIgnoredErrs...) {
 			return err
 		}
 	}
 	if err := disk.MakeVol(minioMetaMultipartBucket); err != nil {
-		if !errors.IsErrIgnored(err, initMetaVolIgnoredErrs...) {
+		if !IsErrIgnored(err, initMetaVolIgnoredErrs...) {
 			return err
 		}
 	}

cmd/format-xl_test.go

@@ -22,8 +22,6 @@ import (
 	"os"
 	"reflect"
 	"testing"
-
-	"github.com/minio/minio/pkg/errors"
 )
 
 // Test get offline/online uuids.
@@ -114,7 +112,7 @@ func TestFixFormatV3(t *testing.T) {
 
 	newFormats, errs := loadFormatXLAll(storageDisks)
 	for _, err := range errs {
-		if err != nil && errors.Cause(err) != errUnformattedDisk {
+		if err != nil && err != errUnformattedDisk {
 			t.Fatal(err)
 		}
 	}

cmd/fs-v1-helpers.go

@@ -17,52 +17,63 @@
 package cmd
 
 import (
+	"context"
 	"io"
 	"os"
 	pathutil "path"
 	"runtime"
 
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/lock"
 )
 
 // Removes only the file at given path does not remove
 // any parent directories, handles long paths for
 // windows automatically.
-func fsRemoveFile(filePath string) (err error) {
+func fsRemoveFile(ctx context.Context, filePath string) (err error) {
 	if filePath == "" {
-		return errors.Trace(errInvalidArgument)
+		logger.LogIf(ctx, errInvalidArgument)
+		return errInvalidArgument
 	}
 
 	if err = checkPathLength(filePath); err != nil {
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	if err = os.Remove((filePath)); err != nil {
-		return osErrToFSFileErr(err)
+		err = osErrToFSFileErr(err)
+		if err != errFileNotFound {
+			logger.LogIf(ctx, err)
+		}
 	}
 
-	return nil
+	return err
 }
 
 // Removes all files and folders at a given path, handles
 // long paths for windows automatically.
-func fsRemoveAll(dirPath string) (err error) {
+func fsRemoveAll(ctx context.Context, dirPath string) (err error) {
 	if dirPath == "" {
-		return errors.Trace(errInvalidArgument)
+		logger.LogIf(ctx, errInvalidArgument)
+		return errInvalidArgument
 	}
 
 	if err = checkPathLength(dirPath); err != nil {
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	if err = os.RemoveAll(dirPath); err != nil {
 		if os.IsPermission(err) {
-			return errors.Trace(errVolumeAccessDenied)
+			logger.LogIf(ctx, errVolumeAccessDenied)
+			return errVolumeAccessDenied
 		} else if isSysErrNotEmpty(err) {
-			return errors.Trace(errVolumeNotEmpty)
+			logger.LogIf(ctx, errVolumeNotEmpty)
+			return errVolumeNotEmpty
 		}
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	return nil
@@ -70,22 +81,25 @@ func fsRemoveAll(dirPath string) (err error) {
 
 // Removes a directory only if its empty, handles long
 // paths for windows automatically.
-func fsRemoveDir(dirPath string) (err error) {
+func fsRemoveDir(ctx context.Context, dirPath string) (err error) {
 	if dirPath == "" {
-		return errors.Trace(errInvalidArgument)
+		logger.LogIf(ctx, errInvalidArgument)
+		return errInvalidArgument
 	}
 
 	if err = checkPathLength(dirPath); err != nil {
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	if err = os.Remove((dirPath)); err != nil {
 		if os.IsNotExist(err) {
-			return errors.Trace(errVolumeNotFound)
+			return errVolumeNotFound
 		} else if isSysErrNotEmpty(err) {
-			return errors.Trace(errVolumeNotEmpty)
+			return errVolumeNotEmpty
 		}
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	return nil
@@ -95,29 +109,35 @@ func fsRemoveDir(dirPath string) (err error) {
 // otherwise returns an error. If directory already
 // exists returns an error. Windows long paths
 // are handled automatically.
-func fsMkdir(dirPath string) (err error) {
+func fsMkdir(ctx context.Context, dirPath string) (err error) {
 	if dirPath == "" {
-		return errors.Trace(errInvalidArgument)
+		logger.LogIf(ctx, errInvalidArgument)
+		return errInvalidArgument
 	}
 
 	if err = checkPathLength(dirPath); err != nil {
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	if err = os.Mkdir((dirPath), 0777); err != nil {
 		if os.IsExist(err) {
-			return errors.Trace(errVolumeExists)
+			return errVolumeExists
 		} else if os.IsPermission(err) {
-			return errors.Trace(errDiskAccessDenied)
+			logger.LogIf(ctx, errDiskAccessDenied)
+			return errDiskAccessDenied
 		} else if isSysErrNotDir(err) {
 			// File path cannot be verified since
 			// one of the parents is a file.
-			return errors.Trace(errDiskAccessDenied)
+			logger.LogIf(ctx, errDiskAccessDenied)
+			return errDiskAccessDenied
 		} else if isSysErrPathNotFound(err) {
 			// Add specific case for windows.
-			return errors.Trace(errDiskAccessDenied)
+			logger.LogIf(ctx, errDiskAccessDenied)
+			return errDiskAccessDenied
 		}
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	return nil
@@ -128,36 +148,38 @@ func fsMkdir(dirPath string) (err error) {
 // not perform any higher layer interpretation of files v/s
 // directories. For higher level interpretation look at
 // fsStatFileDir, fsStatFile, fsStatDir.
-func fsStat(statLoc string) (os.FileInfo, error) {
+func fsStat(ctx context.Context, statLoc string) (os.FileInfo, error) {
 	if statLoc == "" {
-		return nil, errors.Trace(errInvalidArgument)
+		logger.LogIf(ctx, errInvalidArgument)
+		return nil, errInvalidArgument
 	}
 	if err := checkPathLength(statLoc); err != nil {
-		return nil, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return nil, err
 	}
-	fi, err := os.Stat((statLoc))
+	fi, err := os.Stat(statLoc)
 	if err != nil {
-		return nil, errors.Trace(err)
+		return nil, err
 	}
 
 	return fi, nil
 }
 
 // Lookup if volume exists, returns volume attributes upon success.
-func fsStatVolume(volume string) (os.FileInfo, error) {
-	fi, err := fsStat(volume)
+func fsStatVolume(ctx context.Context, volume string) (os.FileInfo, error) {
+	fi, err := fsStat(ctx, volume)
 	if err != nil {
-		err = errors.Cause(err)
 		if os.IsNotExist(err) {
-			return nil, errors.Trace(errVolumeNotFound)
+			return nil, errVolumeNotFound
 		} else if os.IsPermission(err) {
-			return nil, errors.Trace(errVolumeAccessDenied)
+			return nil, errVolumeAccessDenied
 		}
-		return nil, errors.Trace(err)
+		return nil, err
 	}
 
 	if !fi.IsDir() {
-		return nil, errors.Trace(errVolumeAccessDenied)
+		logger.LogIf(ctx, errVolumeAccessDenied)
+		return nil, errVolumeAccessDenied
 	}
 
 	return fi, nil
@@ -171,77 +193,112 @@ func osErrToFSFileErr(err error) error {
 	if err == nil {
 		return nil
 	}
-	err = errors.Cause(err)
 	if os.IsNotExist(err) {
-		return errors.Trace(errFileNotFound)
+		return errFileNotFound
 	}
 	if os.IsPermission(err) {
-		return errors.Trace(errFileAccessDenied)
+		return errFileAccessDenied
 	}
 	if isSysErrNotDir(err) {
-		return errors.Trace(errFileAccessDenied)
+		return errFileAccessDenied
 	}
 	if isSysErrPathNotFound(err) {
-		return errors.Trace(errFileNotFound)
+		return errFileNotFound
 	}
 	return err
 }
 
 // Lookup if directory exists, returns directory attributes upon success.
-func fsStatDir(statDir string) (os.FileInfo, error) {
-	fi, err := fsStat(statDir)
+func fsStatDir(ctx context.Context, statDir string) (os.FileInfo, error) {
+	fi, err := fsStat(ctx, statDir)
 	if err != nil {
-		return nil, osErrToFSFileErr(err)
+		err = osErrToFSFileErr(err)
+		if err != errFileNotFound {
+			logger.LogIf(ctx, err)
+		}
+		return nil, err
 	}
 	if !fi.IsDir() {
-		return nil, errors.Trace(errFileAccessDenied)
+		logger.LogIf(ctx, errFileAccessDenied)
+		return nil, errFileAccessDenied
 	}
 	return fi, nil
 }
 
-// Lookup if file exists, returns file attributes upon success.
-func fsStatFile(statFile string) (os.FileInfo, error) {
-	fi, err := fsStat(statFile)
+// Returns if the dirPath is a directory.
+func fsIsDir(ctx context.Context, dirPath string) bool {
+	fi, err := fsStat(ctx, dirPath)
 	if err != nil {
-		return nil, osErrToFSFileErr(err)
+		return false
+	}
+	return fi.IsDir()
+}
+
+// Lookup if file exists, returns file attributes upon success.
+func fsStatFile(ctx context.Context, statFile string) (os.FileInfo, error) {
+	fi, err := fsStat(ctx, statFile)
+	if err != nil {
+		err = osErrToFSFileErr(err)
+		if err != errFileNotFound {
+			logger.LogIf(ctx, err)
+		}
+		return nil, err
 	}
 	if fi.IsDir() {
-		return nil, errors.Trace(errFileAccessDenied)
+		logger.LogIf(ctx, errFileAccessDenied)
+		return nil, errFileAccessDenied
 	}
 	return fi, nil
 }
 
+// Returns if the filePath is a regular file.
+func fsIsFile(ctx context.Context, filePath string) bool {
+	fi, err := fsStat(ctx, filePath)
+	if err != nil {
+		return false
+	}
+	return fi.Mode().IsRegular()
+}
+
 // Opens the file at given path, optionally from an offset. Upon success returns
 // a readable stream and the size of the readable stream.
-func fsOpenFile(readPath string, offset int64) (io.ReadCloser, int64, error) {
+func fsOpenFile(ctx context.Context, readPath string, offset int64) (io.ReadCloser, int64, error) {
 	if readPath == "" || offset < 0 {
-		return nil, 0, errors.Trace(errInvalidArgument)
+		logger.LogIf(ctx, errInvalidArgument)
+		return nil, 0, errInvalidArgument
 	}
 	if err := checkPathLength(readPath); err != nil {
-		return nil, 0, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return nil, 0, err
 	}
 
-	fr, err := os.Open((readPath))
+	fr, err := os.Open(readPath)
 	if err != nil {
 		return nil, 0, osErrToFSFileErr(err)
 	}
 
 	// Stat to get the size of the file at path.
-	st, err := os.Stat((readPath))
+	st, err := os.Stat(readPath)
 	if err != nil {
-		return nil, 0, errors.Trace(err)
+		err = osErrToFSFileErr(err)
+		if err != errFileNotFound {
+			logger.LogIf(ctx, err)
+		}
+		return nil, 0, err
 	}
 
 	// Verify if its not a regular file, since subsequent Seek is undefined.
 	if !st.Mode().IsRegular() {
-		return nil, 0, errors.Trace(errIsNotRegular)
+		logger.LogIf(ctx, errIsNotRegular)
+		return nil, 0, errIsNotRegular
 	}
 
 	// Seek to the requested offset.
 	if offset > 0 {
 		_, err = fr.Seek(offset, os.SEEK_SET)
 		if err != nil {
-			return nil, 0, errors.Trace(err)
+			logger.LogIf(ctx, err)
+			return nil, 0, err
 		}
 	}
 
@@ -250,21 +307,25 @@ func fsOpenFile(readPath string, offset int64) (io.ReadCloser, int64, error) {
 }
 
 // Creates a file and copies data from incoming reader. Staging buffer is used by io.CopyBuffer.
-func fsCreateFile(filePath string, reader io.Reader, buf []byte, fallocSize int64) (int64, error) {
+func fsCreateFile(ctx context.Context, filePath string, reader io.Reader, buf []byte, fallocSize int64) (int64, error) {
 	if filePath == "" || reader == nil {
-		return 0, errors.Trace(errInvalidArgument)
+		logger.LogIf(ctx, errInvalidArgument)
+		return 0, errInvalidArgument
 	}
 
 	if err := checkPathLength(filePath); err != nil {
-		return 0, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return 0, err
 	}
 
 	if err := mkdirAll(pathutil.Dir(filePath), 0777); err != nil {
-		return 0, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return 0, err
 	}
 
 	if err := checkDiskFree(pathutil.Dir(filePath), fallocSize); err != nil {
-		return 0, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return 0, err
 	}
 
 	writer, err := lock.Open(filePath, os.O_CREATE|os.O_WRONLY, 0666)
@@ -276,7 +337,8 @@ func fsCreateFile(filePath string, reader io.Reader, buf []byte, fallocSize int6
 	// Fallocate only if the size is final object is known.
 	if fallocSize > 0 {
 		if err = fsFAllocate(int(writer.Fd()), 0, fallocSize); err != nil {
-			return 0, errors.Trace(err)
+			logger.LogIf(ctx, err)
+			return 0, err
 		}
 	}
 
@@ -284,12 +346,14 @@ func fsCreateFile(filePath string, reader io.Reader, buf []byte, fallocSize int6
 	if buf != nil {
 		bytesWritten, err = io.CopyBuffer(writer, reader, buf)
 		if err != nil {
-			return 0, errors.Trace(err)
+			logger.LogIf(ctx, err)
+			return 0, err
 		}
 	} else {
 		bytesWritten, err = io.Copy(writer, reader)
 		if err != nil {
-			return 0, errors.Trace(err)
+			logger.LogIf(ctx, err)
+			return 0, err
 		}
 	}
 
@@ -320,12 +384,14 @@ func fsFAllocate(fd int, offset int64, len int64) (err error) {
 
 // Renames source path to destination path, creates all the
 // missing parents if they don't exist.
-func fsRenameFile(sourcePath, destPath string) error {
+func fsRenameFile(ctx context.Context, sourcePath, destPath string) error {
 	if err := checkPathLength(sourcePath); err != nil {
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 	if err := checkPathLength(destPath); err != nil {
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	// Verify if source path exists.
@@ -334,27 +400,36 @@ func fsRenameFile(sourcePath, destPath string) error {
 	}
 
 	if err := renameAll(sourcePath, destPath); err != nil {
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	return nil
 }
 
 // fsDeleteFile is a wrapper for deleteFile(), after checking the path length.
-func fsDeleteFile(basePath, deletePath string) error {
+func fsDeleteFile(ctx context.Context, basePath, deletePath string) error {
 	if err := checkPathLength(basePath); err != nil {
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	if err := checkPathLength(deletePath); err != nil {
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
-	return deleteFile(basePath, deletePath)
+	if err := deleteFile(basePath, deletePath); err != nil {
+		if err != errFileNotFound {
+			logger.LogIf(ctx, err)
+		}
+		return err
+	}
+	return nil
 }
 
 // fsRemoveMeta safely removes a locked file and takes care of Windows special case
-func fsRemoveMeta(basePath, deletePath, tmpDir string) error {
+func fsRemoveMeta(ctx context.Context, basePath, deletePath, tmpDir string) error {
 	// Special case for windows please read through.
 	if runtime.GOOS == globalWindowsOSName {
 		// Ordinarily windows does not permit deletion or renaming of files still
@@ -388,13 +463,13 @@ func fsRemoveMeta(basePath, deletePath, tmpDir string) error {
 
 		tmpPath := pathJoin(tmpDir, mustGetUUID())
 
-		fsRenameFile(deletePath, tmpPath)
+		fsRenameFile(ctx, deletePath, tmpPath)
 
 		// Proceed to deleting the directory if empty
-		fsDeleteFile(basePath, pathutil.Dir(deletePath))
+		fsDeleteFile(ctx, basePath, pathutil.Dir(deletePath))
 
 		// Finally delete the renamed file.
-		return fsDeleteFile(tmpDir, tmpPath)
+		return fsDeleteFile(ctx, tmpDir, tmpPath)
 	}
-	return fsDeleteFile(basePath, deletePath)
+	return fsDeleteFile(ctx, basePath, deletePath)
 }

cmd/fs-v1-helpers_test.go

@@ -18,13 +18,13 @@ package cmd
 
 import (
 	"bytes"
+	"context"
 	"io"
 	"io/ioutil"
 	"os"
 	"path"
 	"testing"
 
-	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/lock"
 )
 
@@ -36,19 +36,19 @@ func TestFSRenameFile(t *testing.T) {
 	}
 	defer os.RemoveAll(path)
 
-	if err = fsMkdir(pathJoin(path, "testvolume1")); err != nil {
+	if err = fsMkdir(context.Background(), pathJoin(path, "testvolume1")); err != nil {
 		t.Fatal(err)
 	}
-	if err = fsRenameFile(pathJoin(path, "testvolume1"), pathJoin(path, "testvolume2")); err != nil {
+	if err = fsRenameFile(context.Background(), pathJoin(path, "testvolume1"), pathJoin(path, "testvolume2")); err != nil {
 		t.Fatal(err)
 	}
-	if err = fsRenameFile(pathJoin(path, "testvolume1"), pathJoin(path, "testvolume2")); errors.Cause(err) != errFileNotFound {
+	if err = fsRenameFile(context.Background(), pathJoin(path, "testvolume1"), pathJoin(path, "testvolume2")); err != errFileNotFound {
 		t.Fatal(err)
 	}
-	if err = fsRenameFile(pathJoin(path, "my-obj-del-0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"), pathJoin(path, "testvolume2")); errors.Cause(err) != errFileNameTooLong {
+	if err = fsRenameFile(context.Background(), pathJoin(path, "my-obj-del-0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"), pathJoin(path, "testvolume2")); err != errFileNameTooLong {
 		t.Fatal("Unexpected error", err)
 	}
-	if err = fsRenameFile(pathJoin(path, "testvolume1"), pathJoin(path, "my-obj-del-0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001")); errors.Cause(err) != errFileNameTooLong {
+	if err = fsRenameFile(context.Background(), pathJoin(path, "testvolume1"), pathJoin(path, "my-obj-del-0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001")); err != errFileNameTooLong {
 		t.Fatal("Unexpected error", err)
 	}
 }
@@ -63,30 +63,30 @@ func TestFSStats(t *testing.T) {
 
 	// Setup test environment.
 
-	if err = fsMkdir(""); errors.Cause(err) != errInvalidArgument {
+	if err = fsMkdir(context.Background(), ""); err != errInvalidArgument {
 		t.Fatal("Unexpected error", err)
 	}
 
-	if err = fsMkdir(pathJoin(path, "my-obj-del-0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001")); errors.Cause(err) != errFileNameTooLong {
+	if err = fsMkdir(context.Background(), pathJoin(path, "my-obj-del-0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001")); err != errFileNameTooLong {
 		t.Fatal("Unexpected error", err)
 	}
 
-	if err = fsMkdir(pathJoin(path, "success-vol")); err != nil {
+	if err = fsMkdir(context.Background(), pathJoin(path, "success-vol")); err != nil {
 		t.Fatalf("Unable to create volume, %s", err)
 	}
 
 	var reader = bytes.NewReader([]byte("Hello, world"))
-	if _, err = fsCreateFile(pathJoin(path, "success-vol", "success-file"), reader, nil, 0); err != nil {
+	if _, err = fsCreateFile(context.Background(), pathJoin(path, "success-vol", "success-file"), reader, nil, 0); err != nil {
 		t.Fatalf("Unable to create file, %s", err)
 	}
 	// Seek back.
 	reader.Seek(0, 0)
 
-	if err = fsMkdir(pathJoin(path, "success-vol", "success-file")); errors.Cause(err) != errVolumeExists {
+	if err = fsMkdir(context.Background(), pathJoin(path, "success-vol", "success-file")); err != errVolumeExists {
 		t.Fatal("Unexpected error", err)
 	}
 
-	if _, err = fsCreateFile(pathJoin(path, "success-vol", "path/to/success-file"), reader, nil, 0); err != nil {
+	if _, err = fsCreateFile(context.Background(), pathJoin(path, "success-vol", "path/to/success-file"), reader, nil, 0); err != nil {
 		t.Fatalf("Unable to create file, %s", err)
 	}
 	// Seek back.
@@ -169,12 +169,12 @@ func TestFSStats(t *testing.T) {
 
 	for i, testCase := range testCases {
 		if testCase.srcPath != "" {
-			if _, err := fsStatFile(pathJoin(testCase.srcFSPath, testCase.srcVol,
-				testCase.srcPath)); errors.Cause(err) != testCase.expectedErr {
+			if _, err := fsStatFile(context.Background(), pathJoin(testCase.srcFSPath, testCase.srcVol,
+				testCase.srcPath)); err != testCase.expectedErr {
 				t.Fatalf("TestPosix case %d: Expected: \"%s\", got: \"%s\"", i+1, testCase.expectedErr, err)
 			}
 		} else {
-			if _, err := fsStatVolume(pathJoin(testCase.srcFSPath, testCase.srcVol)); errors.Cause(err) != testCase.expectedErr {
+			if _, err := fsStatVolume(context.Background(), pathJoin(testCase.srcFSPath, testCase.srcVol)); err != testCase.expectedErr {
 				t.Fatalf("TestPosix case %d: Expected: \"%s\", got: \"%s\"", i+1, testCase.expectedErr, err)
 			}
 		}
@@ -189,20 +189,20 @@ func TestFSCreateAndOpen(t *testing.T) {
 	}
 	defer os.RemoveAll(path)
 
-	if err = fsMkdir(pathJoin(path, "success-vol")); err != nil {
+	if err = fsMkdir(context.Background(), pathJoin(path, "success-vol")); err != nil {
 		t.Fatalf("Unable to create directory, %s", err)
 	}
 
-	if _, err = fsCreateFile("", nil, nil, 0); errors.Cause(err) != errInvalidArgument {
+	if _, err = fsCreateFile(context.Background(), "", nil, nil, 0); err != errInvalidArgument {
 		t.Fatal("Unexpected error", err)
 	}
 
-	if _, _, err = fsOpenFile("", -1); errors.Cause(err) != errInvalidArgument {
+	if _, _, err = fsOpenFile(context.Background(), "", -1); err != errInvalidArgument {
 		t.Fatal("Unexpected error", err)
 	}
 
 	var reader = bytes.NewReader([]byte("Hello, world"))
-	if _, err = fsCreateFile(pathJoin(path, "success-vol", "success-file"), reader, nil, 0); err != nil {
+	if _, err = fsCreateFile(context.Background(), pathJoin(path, "success-vol", "success-file"), reader, nil, 0); err != nil {
 		t.Fatalf("Unable to create file, %s", err)
 	}
 	// Seek back.
@@ -230,18 +230,18 @@ func TestFSCreateAndOpen(t *testing.T) {
 	}
 
 	for i, testCase := range testCases {
-		_, err = fsCreateFile(pathJoin(path, testCase.srcVol, testCase.srcPath), reader, nil, 0)
-		if errors.Cause(err) != testCase.expectedErr {
+		_, err = fsCreateFile(context.Background(), pathJoin(path, testCase.srcVol, testCase.srcPath), reader, nil, 0)
+		if err != testCase.expectedErr {
 			t.Errorf("Test case %d: Expected: \"%s\", got: \"%s\"", i+1, testCase.expectedErr, err)
 		}
-		_, _, err = fsOpenFile(pathJoin(path, testCase.srcVol, testCase.srcPath), 0)
-		if errors.Cause(err) != testCase.expectedErr {
+		_, _, err = fsOpenFile(context.Background(), pathJoin(path, testCase.srcVol, testCase.srcPath), 0)
+		if err != testCase.expectedErr {
 			t.Errorf("Test case %d: Expected: \"%s\", got: \"%s\"", i+1, testCase.expectedErr, err)
 		}
 	}
 
 	// Attempt to open a directory.
-	if _, _, err = fsOpenFile(pathJoin(path), 0); errors.Cause(err) != errIsNotRegular {
+	if _, _, err = fsOpenFile(context.Background(), pathJoin(path), 0); err != errIsNotRegular {
 		t.Fatal("Unexpected error", err)
 	}
 }
@@ -255,20 +255,20 @@ func TestFSDeletes(t *testing.T) {
 	defer os.RemoveAll(path)
 
 	// Setup test environment.
-	if err = fsMkdir(pathJoin(path, "success-vol")); err != nil {
+	if err = fsMkdir(context.Background(), pathJoin(path, "success-vol")); err != nil {
 		t.Fatalf("Unable to create directory, %s", err)
 	}
 
 	var buf = make([]byte, 4096)
 	var reader = bytes.NewReader([]byte("Hello, world"))
-	if _, err = fsCreateFile(pathJoin(path, "success-vol", "success-file"), reader, buf, reader.Size()); err != nil {
+	if _, err = fsCreateFile(context.Background(), pathJoin(path, "success-vol", "success-file"), reader, buf, reader.Size()); err != nil {
 		t.Fatalf("Unable to create file, %s", err)
 	}
 	// Seek back.
 	reader.Seek(0, io.SeekStart)
 
 	// folder is not empty
-	err = fsMkdir(pathJoin(path, "success-vol", "not-empty"))
+	err = fsMkdir(context.Background(), pathJoin(path, "success-vol", "not-empty"))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -278,10 +278,10 @@ func TestFSDeletes(t *testing.T) {
 	}
 
 	// recursive
-	if err = fsMkdir(pathJoin(path, "success-vol", "parent")); err != nil {
+	if err = fsMkdir(context.Background(), pathJoin(path, "success-vol", "parent")); err != nil {
 		t.Fatal(err)
 	}
-	if err = fsMkdir(pathJoin(path, "success-vol", "parent", "dir")); err != nil {
+	if err = fsMkdir(context.Background(), pathJoin(path, "success-vol", "parent", "dir")); err != nil {
 		t.Fatal(err)
 	}
 
@@ -343,7 +343,7 @@ func TestFSDeletes(t *testing.T) {
 	}
 
 	for i, testCase := range testCases {
-		if err = fsDeleteFile(testCase.basePath, pathJoin(testCase.basePath, testCase.srcVol, testCase.srcPath)); errors.Cause(err) != testCase.expectedErr {
+		if err = fsDeleteFile(context.Background(), testCase.basePath, pathJoin(testCase.basePath, testCase.srcVol, testCase.srcPath)); err != testCase.expectedErr {
 			t.Errorf("Test case %d: Expected: \"%s\", got: \"%s\"", i+1, testCase.expectedErr, err)
 		}
 	}
@@ -358,7 +358,7 @@ func BenchmarkFSDeleteFile(b *testing.B) {
 	defer os.RemoveAll(path)
 
 	// Setup test environment.
-	if err = fsMkdir(pathJoin(path, "benchmark")); err != nil {
+	if err = fsMkdir(context.Background(), pathJoin(path, "benchmark")); err != nil {
 		b.Fatalf("Unable to create directory, %s", err)
 	}
 
@@ -375,7 +375,7 @@ func BenchmarkFSDeleteFile(b *testing.B) {
 		}
 		b.StartTimer()
 
-		err = fsDeleteFile(benchDir, filename)
+		err = fsDeleteFile(context.Background(), benchDir, filename)
 		if err != nil {
 			b.Fatal(err)
 		}
@@ -392,18 +392,18 @@ func TestFSRemoves(t *testing.T) {
 	defer os.RemoveAll(path)
 
 	// Setup test environment.
-	if err = fsMkdir(pathJoin(path, "success-vol")); err != nil {
+	if err = fsMkdir(context.Background(), pathJoin(path, "success-vol")); err != nil {
 		t.Fatalf("Unable to create directory, %s", err)
 	}
 
 	var reader = bytes.NewReader([]byte("Hello, world"))
-	if _, err = fsCreateFile(pathJoin(path, "success-vol", "success-file"), reader, nil, 0); err != nil {
+	if _, err = fsCreateFile(context.Background(), pathJoin(path, "success-vol", "success-file"), reader, nil, 0); err != nil {
 		t.Fatalf("Unable to create file, %s", err)
 	}
 	// Seek back.
 	reader.Seek(0, 0)
 
-	if _, err = fsCreateFile(pathJoin(path, "success-vol", "success-file-new"), reader, nil, 0); err != nil {
+	if _, err = fsCreateFile(context.Background(), pathJoin(path, "success-vol", "success-file-new"), reader, nil, 0); err != nil {
 		t.Fatalf("Unable to create file, %s", err)
 	}
 	// Seek back.
@@ -477,25 +477,25 @@ func TestFSRemoves(t *testing.T) {
 
 	for i, testCase := range testCases {
 		if testCase.srcPath != "" {
-			if err = fsRemoveFile(pathJoin(testCase.srcFSPath, testCase.srcVol, testCase.srcPath)); errors.Cause(err) != testCase.expectedErr {
+			if err = fsRemoveFile(context.Background(), pathJoin(testCase.srcFSPath, testCase.srcVol, testCase.srcPath)); err != testCase.expectedErr {
 				t.Errorf("Test case %d: Expected: \"%s\", got: \"%s\"", i+1, testCase.expectedErr, err)
 			}
 		} else {
-			if err = fsRemoveDir(pathJoin(testCase.srcFSPath, testCase.srcVol, testCase.srcPath)); errors.Cause(err) != testCase.expectedErr {
+			if err = fsRemoveDir(context.Background(), pathJoin(testCase.srcFSPath, testCase.srcVol, testCase.srcPath)); err != testCase.expectedErr {
 				t.Error(err)
 			}
 		}
 	}
 
-	if err = fsRemoveAll(pathJoin(path, "success-vol")); err != nil {
+	if err = fsRemoveAll(context.Background(), pathJoin(path, "success-vol")); err != nil {
 		t.Fatal(err)
 	}
 
-	if err = fsRemoveAll(""); errors.Cause(err) != errInvalidArgument {
+	if err = fsRemoveAll(context.Background(), ""); err != errInvalidArgument {
 		t.Fatal(err)
 	}
 
-	if err = fsRemoveAll("my-obj-del-0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"); errors.Cause(err) != errFileNameTooLong {
+	if err = fsRemoveAll(context.Background(), "my-obj-del-0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"); err != errFileNameTooLong {
 		t.Fatal(err)
 	}
 }
@@ -509,14 +509,14 @@ func TestFSRemoveMeta(t *testing.T) {
 	defer os.RemoveAll(fsPath)
 
 	// Setup test environment.
-	if err = fsMkdir(pathJoin(fsPath, "success-vol")); err != nil {
+	if err = fsMkdir(context.Background(), pathJoin(fsPath, "success-vol")); err != nil {
 		t.Fatalf("Unable to create directory, %s", err)
 	}
 
 	filePath := pathJoin(fsPath, "success-vol", "success-file")
 
 	var reader = bytes.NewReader([]byte("Hello, world"))
-	if _, err = fsCreateFile(filePath, reader, nil, 0); err != nil {
+	if _, err = fsCreateFile(context.Background(), filePath, reader, nil, 0); err != nil {
 		t.Fatalf("Unable to create file, %s", err)
 	}
 
@@ -535,7 +535,7 @@ func TestFSRemoveMeta(t *testing.T) {
 		t.Fatal(tmpErr)
 	}
 
-	if err := fsRemoveMeta(fsPath, filePath, tmpDir); err != nil {
+	if err := fsRemoveMeta(context.Background(), fsPath, filePath, tmpDir); err != nil {
 		t.Fatalf("Unable to remove file, %s", err)
 	}
 
@@ -547,3 +547,33 @@ func TestFSRemoveMeta(t *testing.T) {
 		t.Fatalf("`%s` parent directory found though it should have been deleted.", filePath)
 	}
 }
+
+func TestFSIsDir(t *testing.T) {
+	dirPath, err := ioutil.TempDir(globalTestTmpDir, "minio-")
+	if err != nil {
+		t.Fatalf("Unable to create tmp directory %s", err)
+	}
+	defer os.RemoveAll(dirPath)
+
+	if !fsIsDir(context.Background(), dirPath) {
+		t.Fatalf("Expected %s to be a directory", dirPath)
+	}
+}
+
+func TestFSIsFile(t *testing.T) {
+	dirPath, err := ioutil.TempDir(globalTestTmpDir, "minio-")
+	if err != nil {
+		t.Fatalf("Unable to create tmp directory %s", err)
+	}
+	defer os.RemoveAll(dirPath)
+
+	filePath := pathJoin(dirPath, "tmpfile")
+
+	if err = ioutil.WriteFile(filePath, nil, 0777); err != nil {
+		t.Fatalf("Unable to create file %s", filePath)
+	}
+
+	if !fsIsFile(context.Background(), filePath) {
+		t.Fatalf("Expected %s to be a file", filePath)
+	}
+}

cmd/fs-v1-metadata.go

@@ -17,6 +17,7 @@
 package cmd
 
 import (
+	"context"
 	"encoding/hex"
 	"encoding/json"
 	"io"
@@ -25,7 +26,7 @@ import (
 	pathutil "path"
 	"strings"
 
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/lock"
 	"github.com/minio/minio/pkg/mimedb"
 	"github.com/tidwall/gjson"
@@ -165,10 +166,14 @@ func (m fsMetaV1) ToObjectInfo(bucket, object string, fi os.FileInfo) ObjectInfo
 		}
 	}
 
-	// Extract etag from metadata.
 	objInfo.ETag = extractETag(m.Meta)
 	objInfo.ContentType = m.Meta["content-type"]
 	objInfo.ContentEncoding = m.Meta["content-encoding"]
+	if storageClass, ok := m.Meta[amzStorageClass]; ok {
+		objInfo.StorageClass = storageClass
+	} else {
+		objInfo.StorageClass = globalMinioDefaultStorageClass
+	}
 
 	// etag/md5Sum has already been extracted. We need to
 	// remove to avoid it from appearing as part of
@@ -197,14 +202,6 @@ func parseFSVersion(fsMetaBuf []byte) string {
 	return gjson.GetBytes(fsMetaBuf, "version").String()
 }
 
-func parseFSFormat(fsMetaBuf []byte) string {
-	return gjson.GetBytes(fsMetaBuf, "format").String()
-}
-
-func parseFSRelease(fsMetaBuf []byte) string {
-	return gjson.GetBytes(fsMetaBuf, "minio.release").String()
-}
-
 func parseFSMetaMap(fsMetaBuf []byte) map[string]string {
 	// Get xlMetaV1.Meta map.
 	metaMapResult := gjson.GetBytes(fsMetaBuf, "meta").Map()
@@ -237,20 +234,23 @@ func parseFSPartsArray(fsMetaBuf []byte) []objectPartInfo {
 	return partsArray
 }
 
-func (m *fsMetaV1) ReadFrom(lk *lock.LockedFile) (n int64, err error) {
+func (m *fsMetaV1) ReadFrom(ctx context.Context, lk *lock.LockedFile) (n int64, err error) {
 	var fsMetaBuf []byte
 	fi, err := lk.Stat()
 	if err != nil {
-		return 0, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return 0, err
 	}
 
 	fsMetaBuf, err = ioutil.ReadAll(io.NewSectionReader(lk, 0, fi.Size()))
 	if err != nil {
-		return 0, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return 0, err
 	}
 
 	if len(fsMetaBuf) == 0 {
-		return 0, errors.Trace(io.EOF)
+		logger.LogIf(ctx, io.EOF)
+		return 0, io.EOF
 	}
 
 	// obtain version.
@@ -259,7 +259,9 @@ func (m *fsMetaV1) ReadFrom(lk *lock.LockedFile) (n int64, err error) {
 	// Verify if the format is valid, return corrupted format
 	// for unrecognized formats.
 	if !isFSMetaValid(m.Version) {
-		return 0, errors.Trace(errCorruptedFormat)
+		logger.GetReqInfo(ctx).AppendTags("file", lk.Name())
+		logger.LogIf(ctx, errCorruptedFormat)
+		return 0, errCorruptedFormat
 	}
 
 	// obtain parts information

cmd/fs-v1-metadata_test.go

@@ -70,7 +70,7 @@ func TestReadFSMetadata(t *testing.T) {
 
 	// Regular fs metadata reading, no errors expected
 	fsMeta := fsMetaV1{}
-	if _, err = fsMeta.ReadFrom(rlk.LockedFile); err != nil {
+	if _, err = fsMeta.ReadFrom(context.Background(), rlk.LockedFile); err != nil {
 		t.Fatal("Unexpected error ", err)
 	}
 }
@@ -105,7 +105,7 @@ func TestWriteFSMetadata(t *testing.T) {
 
 	// FS metadata reading, no errors expected (healthy disk)
 	fsMeta := fsMetaV1{}
-	_, err = fsMeta.ReadFrom(rlk.LockedFile)
+	_, err = fsMeta.ReadFrom(context.Background(), rlk.LockedFile)
 	if err != nil {
 		t.Fatal("Unexpected error ", err)
 	}

cmd/fs-v1-multipart.go

@@ -29,7 +29,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 	mioutil "github.com/minio/minio/pkg/ioutil"
 
 	"github.com/minio/minio/pkg/hash"
@@ -64,8 +64,9 @@ func (fs *FSObjects) decodePartFile(name string) (partNumber int, etag string, e
 }
 
 // Appends parts to an appendFile sequentially.
-func (fs *FSObjects) backgroundAppend(bucket, object, uploadID string) {
+func (fs *FSObjects) backgroundAppend(ctx context.Context, bucket, object, uploadID string) {
 	fs.appendFileMapMu.Lock()
+	logger.GetReqInfo(ctx).AppendTags("uploadID", uploadID)
 	file := fs.appendFileMap[uploadID]
 	if file == nil {
 		file = &fsAppendFile{
@@ -84,7 +85,8 @@ func (fs *FSObjects) backgroundAppend(bucket, object, uploadID string) {
 
 	entries, err := readDir(uploadIDDir)
 	if err != nil {
-		errorIf(err, "error reading directory %s", uploadIDDir)
+		logger.GetReqInfo(ctx).AppendTags("uploadIDDir", uploadIDDir)
+		logger.LogIf(ctx, err)
 		return
 	}
 	sort.Strings(entries)
@@ -95,7 +97,8 @@ func (fs *FSObjects) backgroundAppend(bucket, object, uploadID string) {
 		}
 		partNumber, etag, err := fs.decodePartFile(entry)
 		if err != nil {
-			errorIf(err, "unable to split the file name into partNumber and etag: %s", entry)
+			logger.GetReqInfo(ctx).AppendTags("entry", entry)
+			logger.LogIf(ctx, err)
 			return
 		}
 		if partNumber < nextPartNumber {
@@ -110,7 +113,9 @@ func (fs *FSObjects) backgroundAppend(bucket, object, uploadID string) {
 		partPath := pathJoin(uploadIDDir, entry)
 		err = mioutil.AppendFile(file.filePath, partPath)
 		if err != nil {
-			errorIf(err, "Unable to append %s to %s", partPath, file.filePath)
+			reqInfo := logger.GetReqInfo(ctx).AppendTags("partPath", partPath)
+			reqInfo.AppendTags("filepath", file.filePath)
+			logger.LogIf(ctx, err)
 			return
 		}
 
@@ -122,12 +127,12 @@ func (fs *FSObjects) backgroundAppend(bucket, object, uploadID string) {
 // ListMultipartUploads - lists all the uploadIDs for the specified object.
 // We do not support prefix based listing.
 func (fs *FSObjects) ListMultipartUploads(ctx context.Context, bucket, object, keyMarker, uploadIDMarker, delimiter string, maxUploads int) (result ListMultipartsInfo, e error) {
-	if err := checkListMultipartArgs(bucket, object, keyMarker, uploadIDMarker, delimiter, fs); err != nil {
-		return result, toObjectErr(errors.Trace(err))
+	if err := checkListMultipartArgs(ctx, bucket, object, keyMarker, uploadIDMarker, delimiter, fs); err != nil {
+		return result, toObjectErr(err)
 	}
 
-	if _, err := fs.statBucketDir(bucket); err != nil {
-		return result, toObjectErr(errors.Trace(err), bucket)
+	if _, err := fs.statBucketDir(ctx, bucket); err != nil {
+		return result, toObjectErr(err, bucket)
 	}
 
 	result.MaxUploads = maxUploads
@@ -143,7 +148,8 @@ func (fs *FSObjects) ListMultipartUploads(ctx context.Context, bucket, object, k
 			result.IsTruncated = false
 			return result, nil
 		}
-		return result, toObjectErr(errors.Trace(err))
+		logger.LogIf(ctx, err)
+		return result, toObjectErr(err)
 	}
 
 	// S3 spec says uploaIDs should be sorted based on initiated time. ModTime of fs.json
@@ -151,7 +157,7 @@ func (fs *FSObjects) ListMultipartUploads(ctx context.Context, bucket, object, k
 	var uploads []MultipartInfo
 	for _, uploadID := range uploadIDs {
 		metaFilePath := pathJoin(fs.getMultipartSHADir(bucket, object), uploadID, fs.metaJSONFile)
-		fi, err := fsStatFile(metaFilePath)
+		fi, err := fsStatFile(ctx, metaFilePath)
 		if err != nil {
 			return result, toObjectErr(err, bucket, object)
 		}
@@ -204,11 +210,11 @@ func (fs *FSObjects) ListMultipartUploads(ctx context.Context, bucket, object, k
 //
 // Implements S3 compatible initiate multipart API.
 func (fs *FSObjects) NewMultipartUpload(ctx context.Context, bucket, object string, meta map[string]string) (string, error) {
-	if err := checkNewMultipartArgs(bucket, object, fs); err != nil {
+	if err := checkNewMultipartArgs(ctx, bucket, object, fs); err != nil {
 		return "", toObjectErr(err, bucket)
 	}
 
-	if _, err := fs.statBucketDir(bucket); err != nil {
+	if _, err := fs.statBucketDir(ctx, bucket); err != nil {
 		return "", toObjectErr(err, bucket)
 	}
 
@@ -217,7 +223,8 @@ func (fs *FSObjects) NewMultipartUpload(ctx context.Context, bucket, object stri
 
 	err := mkdirAll(uploadIDDir, 0755)
 	if err != nil {
-		return "", errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return "", err
 	}
 
 	// Initialize fs.json values.
@@ -226,11 +233,13 @@ func (fs *FSObjects) NewMultipartUpload(ctx context.Context, bucket, object stri
 
 	fsMetaBytes, err := json.Marshal(fsMeta)
 	if err != nil {
-		return "", errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return "", err
 	}
 
 	if err = ioutil.WriteFile(pathJoin(uploadIDDir, fs.metaJSONFile), fsMetaBytes, 0644); err != nil {
-		return "", errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return "", err
 	}
 
 	return uploadID, nil
@@ -242,22 +251,22 @@ func (fs *FSObjects) NewMultipartUpload(ctx context.Context, bucket, object stri
 func (fs *FSObjects) CopyObjectPart(ctx context.Context, srcBucket, srcObject, dstBucket, dstObject, uploadID string, partID int,
 	startOffset int64, length int64, srcInfo ObjectInfo) (pi PartInfo, e error) {
 
-	if err := checkNewMultipartArgs(srcBucket, srcObject, fs); err != nil {
-		return pi, toObjectErr(errors.Trace(err))
+	if err := checkNewMultipartArgs(ctx, srcBucket, srcObject, fs); err != nil {
+		return pi, toObjectErr(err)
 	}
 
 	// Initialize pipe.
 	go func() {
 		if gerr := fs.GetObject(ctx, srcBucket, srcObject, startOffset, length, srcInfo.Writer, srcInfo.ETag); gerr != nil {
 			if gerr = srcInfo.Writer.Close(); gerr != nil {
-				errorIf(gerr, "Unable to read %s/%s.", srcBucket, srcObject)
+				logger.LogIf(ctx, gerr)
 				return
 			}
 			return
 		}
 		// Close writer explicitly signalling we wrote all data.
 		if gerr := srcInfo.Writer.Close(); gerr != nil {
-			errorIf(gerr, "Unable to read %s/%s.", srcBucket, srcObject)
+			logger.LogIf(ctx, gerr)
 			return
 		}
 	}()
@@ -275,26 +284,27 @@ func (fs *FSObjects) CopyObjectPart(ctx context.Context, srcBucket, srcObject, d
 // written to '.minio.sys/tmp' location and safely renamed to
 // '.minio.sys/multipart' for reach parts.
 func (fs *FSObjects) PutObjectPart(ctx context.Context, bucket, object, uploadID string, partID int, data *hash.Reader) (pi PartInfo, e error) {
-	if err := checkPutObjectPartArgs(bucket, object, fs); err != nil {
-		return pi, toObjectErr(errors.Trace(err), bucket)
+	if err := checkPutObjectPartArgs(ctx, bucket, object, fs); err != nil {
+		return pi, toObjectErr(err, bucket)
 	}
 
-	if _, err := fs.statBucketDir(bucket); err != nil {
-		return pi, toObjectErr(errors.Trace(err), bucket)
+	if _, err := fs.statBucketDir(ctx, bucket); err != nil {
+		return pi, toObjectErr(err, bucket)
 	}
 
 	// Validate input data size and it can never be less than zero.
 	if data.Size() < 0 {
-		return pi, toObjectErr(errors.Trace(errInvalidArgument))
+		logger.LogIf(ctx, errInvalidArgument)
+		return pi, toObjectErr(errInvalidArgument)
 	}
 
 	uploadIDDir := fs.getUploadIDDir(bucket, object, uploadID)
 
 	// Just check if the uploadID exists to avoid copy if it doesn't.
-	_, err := fsStatFile(pathJoin(uploadIDDir, fs.metaJSONFile))
+	_, err := fsStatFile(ctx, pathJoin(uploadIDDir, fs.metaJSONFile))
 	if err != nil {
-		if errors.Cause(err) == errFileNotFound || errors.Cause(err) == errFileAccessDenied {
-			return pi, errors.Trace(InvalidUploadID{UploadID: uploadID})
+		if err == errFileNotFound || err == errFileAccessDenied {
+			return pi, InvalidUploadID{UploadID: uploadID}
 		}
 		return pi, toObjectErr(err, bucket, object)
 	}
@@ -306,23 +316,23 @@ func (fs *FSObjects) PutObjectPart(ctx context.Context, bucket, object, uploadID
 	buf := make([]byte, bufSize)
 
 	tmpPartPath := pathJoin(fs.fsPath, minioMetaTmpBucket, fs.fsUUID, uploadID+"."+mustGetUUID()+"."+strconv.Itoa(partID))
-	bytesWritten, err := fsCreateFile(tmpPartPath, data, buf, data.Size())
+	bytesWritten, err := fsCreateFile(ctx, tmpPartPath, data, buf, data.Size())
 	if err != nil {
-		fsRemoveFile(tmpPartPath)
+		fsRemoveFile(ctx, tmpPartPath)
 		return pi, toObjectErr(err, minioMetaTmpBucket, tmpPartPath)
 	}
 
 	// Should return IncompleteBody{} error when reader has fewer
 	// bytes than specified in request header.
 	if bytesWritten < data.Size() {
-		fsRemoveFile(tmpPartPath)
-		return pi, errors.Trace(IncompleteBody{})
+		fsRemoveFile(ctx, tmpPartPath)
+		return pi, IncompleteBody{}
 	}
 
 	// Delete temporary part in case of failure. If
 	// PutObjectPart succeeds then there would be nothing to
 	// delete in which case we just ignore the error.
-	defer fsRemoveFile(tmpPartPath)
+	defer fsRemoveFile(ctx, tmpPartPath)
 
 	etag := hex.EncodeToString(data.MD5Current())
 	if etag == "" {
@@ -330,13 +340,13 @@ func (fs *FSObjects) PutObjectPart(ctx context.Context, bucket, object, uploadID
 	}
 	partPath := pathJoin(uploadIDDir, fs.encodePartFile(partID, etag))
 
-	if err = fsRenameFile(tmpPartPath, partPath); err != nil {
+	if err = fsRenameFile(ctx, tmpPartPath, partPath); err != nil {
 		return pi, toObjectErr(err, minioMetaMultipartBucket, partPath)
 	}
 
-	go fs.backgroundAppend(bucket, object, uploadID)
+	go fs.backgroundAppend(ctx, bucket, object, uploadID)
 
-	fi, err := fsStatFile(partPath)
+	fi, err := fsStatFile(ctx, partPath)
 	if err != nil {
 		return pi, toObjectErr(err, minioMetaMultipartBucket, partPath)
 	}
@@ -356,8 +366,8 @@ func (fs *FSObjects) PutObjectPart(ctx context.Context, bucket, object, uploadID
 // ListPartsInfo structure is unmarshalled directly into XML and
 // replied back to the client.
 func (fs *FSObjects) ListObjectParts(ctx context.Context, bucket, object, uploadID string, partNumberMarker, maxParts int) (result ListPartsInfo, e error) {
-	if err := checkListPartsArgs(bucket, object, fs); err != nil {
-		return result, toObjectErr(errors.Trace(err))
+	if err := checkListPartsArgs(ctx, bucket, object, fs); err != nil {
+		return result, toObjectErr(err)
 	}
 	result.Bucket = bucket
 	result.Object = object
@@ -366,22 +376,23 @@ func (fs *FSObjects) ListObjectParts(ctx context.Context, bucket, object, upload
 	result.PartNumberMarker = partNumberMarker
 
 	// Check if bucket exists
-	if _, err := fs.statBucketDir(bucket); err != nil {
-		return result, toObjectErr(errors.Trace(err), bucket)
+	if _, err := fs.statBucketDir(ctx, bucket); err != nil {
+		return result, toObjectErr(err, bucket)
 	}
 
 	uploadIDDir := fs.getUploadIDDir(bucket, object, uploadID)
-	_, err := fsStatFile(pathJoin(uploadIDDir, fs.metaJSONFile))
+	_, err := fsStatFile(ctx, pathJoin(uploadIDDir, fs.metaJSONFile))
 	if err != nil {
-		if errors.Cause(err) == errFileNotFound || errors.Cause(err) == errFileAccessDenied {
-			return result, errors.Trace(InvalidUploadID{UploadID: uploadID})
+		if err == errFileNotFound || err == errFileAccessDenied {
+			return result, InvalidUploadID{UploadID: uploadID}
 		}
-		return result, toObjectErr(errors.Trace(err), bucket, object)
+		return result, toObjectErr(err, bucket, object)
 	}
 
 	entries, err := readDir(uploadIDDir)
 	if err != nil {
-		return result, toObjectErr(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return result, toObjectErr(err, bucket)
 	}
 
 	partsMap := make(map[int]string)
@@ -391,20 +402,21 @@ func (fs *FSObjects) ListObjectParts(ctx context.Context, bucket, object, upload
 		}
 		partNumber, etag1, derr := fs.decodePartFile(entry)
 		if derr != nil {
-			return result, toObjectErr(errors.Trace(derr))
+			logger.LogIf(ctx, derr)
+			return result, toObjectErr(derr)
 		}
 		etag2, ok := partsMap[partNumber]
 		if !ok {
 			partsMap[partNumber] = etag1
 			continue
 		}
-		stat1, serr := fsStatFile(pathJoin(uploadIDDir, fs.encodePartFile(partNumber, etag1)))
+		stat1, serr := fsStatFile(ctx, pathJoin(uploadIDDir, fs.encodePartFile(partNumber, etag1)))
 		if serr != nil {
-			return result, toObjectErr(errors.Trace(serr))
+			return result, toObjectErr(serr)
 		}
-		stat2, serr := fsStatFile(pathJoin(uploadIDDir, fs.encodePartFile(partNumber, etag2)))
+		stat2, serr := fsStatFile(ctx, pathJoin(uploadIDDir, fs.encodePartFile(partNumber, etag2)))
 		if serr != nil {
-			return result, toObjectErr(errors.Trace(serr))
+			return result, toObjectErr(serr)
 		}
 		if stat1.ModTime().After(stat2.ModTime()) {
 			partsMap[partNumber] = etag1
@@ -443,9 +455,9 @@ func (fs *FSObjects) ListObjectParts(ctx context.Context, bucket, object, upload
 	}
 	for i, part := range result.Parts {
 		var stat os.FileInfo
-		stat, err = fsStatFile(pathJoin(uploadIDDir, fs.encodePartFile(part.PartNumber, part.ETag)))
+		stat, err = fsStatFile(ctx, pathJoin(uploadIDDir, fs.encodePartFile(part.PartNumber, part.ETag)))
 		if err != nil {
-			return result, toObjectErr(errors.Trace(err))
+			return result, toObjectErr(err)
 		}
 		result.Parts[i].LastModified = stat.ModTime()
 		result.Parts[i].Size = stat.Size()
@@ -453,7 +465,8 @@ func (fs *FSObjects) ListObjectParts(ctx context.Context, bucket, object, upload
 
 	fsMetaBytes, err := ioutil.ReadFile(pathJoin(uploadIDDir, fs.metaJSONFile))
 	if err != nil {
-		return result, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return result, err
 	}
 
 	result.UserDefined = parseFSMetaMap(fsMetaBytes)
@@ -467,31 +480,31 @@ func (fs *FSObjects) ListObjectParts(ctx context.Context, bucket, object, upload
 //
 // Implements S3 compatible Complete multipart API.
 func (fs *FSObjects) CompleteMultipartUpload(ctx context.Context, bucket string, object string, uploadID string, parts []CompletePart) (oi ObjectInfo, e error) {
-	if err := checkCompleteMultipartArgs(bucket, object, fs); err != nil {
+	if err := checkCompleteMultipartArgs(ctx, bucket, object, fs); err != nil {
 		return oi, toObjectErr(err)
 	}
 
 	// Check if an object is present as one of the parent dir.
-	if fs.parentDirIsObject(bucket, pathutil.Dir(object)) {
-		return oi, toObjectErr(errors.Trace(errFileAccessDenied), bucket, object)
+	if fs.parentDirIsObject(ctx, bucket, pathutil.Dir(object)) {
+		return oi, toObjectErr(errFileAccessDenied, bucket, object)
 	}
 
-	if _, err := fs.statBucketDir(bucket); err != nil {
+	if _, err := fs.statBucketDir(ctx, bucket); err != nil {
 		return oi, toObjectErr(err, bucket)
 	}
 
 	uploadIDDir := fs.getUploadIDDir(bucket, object, uploadID)
 	// Just check if the uploadID exists to avoid copy if it doesn't.
-	_, err := fsStatFile(pathJoin(uploadIDDir, fs.metaJSONFile))
+	_, err := fsStatFile(ctx, pathJoin(uploadIDDir, fs.metaJSONFile))
 	if err != nil {
-		if errors.Cause(err) == errFileNotFound || errors.Cause(err) == errFileAccessDenied {
-			return oi, errors.Trace(InvalidUploadID{UploadID: uploadID})
+		if err == errFileNotFound || err == errFileAccessDenied {
+			return oi, InvalidUploadID{UploadID: uploadID}
 		}
 		return oi, toObjectErr(err, bucket, object)
 	}
 
 	// Calculate s3 compatible md5sum for complete multipart.
-	s3MD5, err := getCompleteMultipartMD5(parts)
+	s3MD5, err := getCompleteMultipartMD5(ctx, parts)
 	if err != nil {
 		return oi, err
 	}
@@ -507,12 +520,12 @@ func (fs *FSObjects) CompleteMultipartUpload(ctx context.Context, bucket string,
 	for i, part := range parts {
 		partPath := pathJoin(uploadIDDir, fs.encodePartFile(part.PartNumber, part.ETag))
 		var fi os.FileInfo
-		fi, err = fsStatFile(partPath)
+		fi, err = fsStatFile(ctx, partPath)
 		if err != nil {
-			if errors.Cause(err) == errFileNotFound || errors.Cause(err) == errFileAccessDenied {
-				return oi, errors.Trace(InvalidPart{})
+			if err == errFileNotFound || err == errFileAccessDenied {
+				return oi, InvalidPart{}
 			}
-			return oi, errors.Trace(err)
+			return oi, err
 		}
 		if partSize == -1 {
 			partSize = fi.Size()
@@ -530,11 +543,13 @@ func (fs *FSObjects) CompleteMultipartUpload(ctx context.Context, bucket string,
 
 		// All parts except the last part has to be atleast 5MB.
 		if !isMinAllowedPartSize(fi.Size()) {
-			return oi, errors.Trace(PartTooSmall{
+			err = PartTooSmall{
 				PartNumber: part.PartNumber,
 				PartSize:   fi.Size(),
 				PartETag:   part.ETag,
-			})
+			}
+			logger.LogIf(ctx, err)
+			return oi, err
 		}
 
 		// TODO: Make necessary changes in future as explained in the below comment.
@@ -545,7 +560,8 @@ func (fs *FSObjects) CompleteMultipartUpload(ctx context.Context, bucket string,
 		// CompleteMultipartUpload we already have the full file available which can be
 		// renamed to the main name-space.
 		if partSize != fi.Size() {
-			return oi, errors.Trace(PartsSizeUnequal{})
+			logger.LogIf(ctx, PartsSizeUnequal{})
+			return oi, PartsSizeUnequal{}
 		}
 	}
 
@@ -557,7 +573,7 @@ func (fs *FSObjects) CompleteMultipartUpload(ctx context.Context, bucket string,
 	// 1. The last PutObjectPart triggers go-routine fs.backgroundAppend, this go-routine has not started yet.
 	// 2. Now CompleteMultipartUpload gets called which sees that lastPart is not appended and starts appending
 	//    from the beginning
-	fs.backgroundAppend(bucket, object, uploadID)
+	fs.backgroundAppend(ctx, bucket, object, uploadID)
 
 	fs.appendFileMapMu.Lock()
 	file := fs.appendFileMap[uploadID]
@@ -585,12 +601,13 @@ func (fs *FSObjects) CompleteMultipartUpload(ctx context.Context, bucket string,
 	}
 
 	if appendFallback {
-		fsRemoveFile(file.filePath)
+		fsRemoveFile(ctx, file.filePath)
 		for _, part := range parts {
 			partPath := pathJoin(uploadIDDir, fs.encodePartFile(part.PartNumber, part.ETag))
 			err = mioutil.AppendFile(appendFilePath, partPath)
 			if err != nil {
-				return oi, toObjectErr(errors.Trace(err))
+				logger.LogIf(ctx, err)
+				return oi, toObjectErr(err)
 			}
 		}
 	}
@@ -604,18 +621,21 @@ func (fs *FSObjects) CompleteMultipartUpload(ctx context.Context, bucket string,
 	fsMetaPath := pathJoin(fs.fsPath, minioMetaBucket, bucketMetaPrefix, bucket, object, fs.metaJSONFile)
 	metaFile, err := fs.rwPool.Create(fsMetaPath)
 	if err != nil {
-		return oi, toObjectErr(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return oi, toObjectErr(err, bucket, object)
 	}
 	defer metaFile.Close()
 
 	// Read saved fs metadata for ongoing multipart.
 	fsMetaBuf, err := ioutil.ReadFile(pathJoin(uploadIDDir, fs.metaJSONFile))
 	if err != nil {
-		return oi, toObjectErr(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return oi, toObjectErr(err, bucket, object)
 	}
 	err = json.Unmarshal(fsMetaBuf, &fsMeta)
 	if err != nil {
-		return oi, toObjectErr(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return oi, toObjectErr(err, bucket, object)
 	}
 	// Save additional metadata.
 	if len(fsMeta.Meta) == 0 {
@@ -623,24 +643,26 @@ func (fs *FSObjects) CompleteMultipartUpload(ctx context.Context, bucket string,
 	}
 	fsMeta.Meta["etag"] = s3MD5
 	if _, err = fsMeta.WriteTo(metaFile); err != nil {
-		return oi, toObjectErr(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return oi, toObjectErr(err, bucket, object)
 	}
 
 	// Deny if WORM is enabled
 	if globalWORMEnabled {
-		if _, err = fsStatFile(pathJoin(fs.fsPath, bucket, object)); err == nil {
-			return ObjectInfo{}, errors.Trace(ObjectAlreadyExists{Bucket: bucket, Object: object})
+		if _, err = fsStatFile(ctx, pathJoin(fs.fsPath, bucket, object)); err == nil {
+			return ObjectInfo{}, ObjectAlreadyExists{Bucket: bucket, Object: object}
 		}
 	}
 
-	err = fsRenameFile(appendFilePath, pathJoin(fs.fsPath, bucket, object))
+	err = fsRenameFile(ctx, appendFilePath, pathJoin(fs.fsPath, bucket, object))
 	if err != nil {
-		return oi, toObjectErr(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return oi, toObjectErr(err, bucket, object)
 	}
-	fsRemoveAll(uploadIDDir)
-	fi, err := fsStatFile(pathJoin(fs.fsPath, bucket, object))
+	fsRemoveAll(ctx, uploadIDDir)
+	fi, err := fsStatFile(ctx, pathJoin(fs.fsPath, bucket, object))
 	if err != nil {
-		return oi, toObjectErr(errors.Trace(err), bucket, object)
+		return oi, toObjectErr(err, bucket, object)
 	}
 
 	return fsMeta.ToObjectInfo(bucket, object, fi), nil
@@ -659,12 +681,12 @@ func (fs *FSObjects) CompleteMultipartUpload(ctx context.Context, bucket string,
 // no affect and further requests to the same uploadID would not be
 // honored.
 func (fs *FSObjects) AbortMultipartUpload(ctx context.Context, bucket, object, uploadID string) error {
-	if err := checkAbortMultipartArgs(bucket, object, fs); err != nil {
+	if err := checkAbortMultipartArgs(ctx, bucket, object, fs); err != nil {
 		return err
 	}
 
-	if _, err := fs.statBucketDir(bucket); err != nil {
-		return toObjectErr(errors.Trace(err), bucket)
+	if _, err := fs.statBucketDir(ctx, bucket); err != nil {
+		return toObjectErr(err, bucket)
 	}
 
 	fs.appendFileMapMu.Lock()
@@ -673,16 +695,16 @@ func (fs *FSObjects) AbortMultipartUpload(ctx context.Context, bucket, object, u
 
 	uploadIDDir := fs.getUploadIDDir(bucket, object, uploadID)
 	// Just check if the uploadID exists to avoid copy if it doesn't.
-	_, err := fsStatFile(pathJoin(uploadIDDir, fs.metaJSONFile))
+	_, err := fsStatFile(ctx, pathJoin(uploadIDDir, fs.metaJSONFile))
 	if err != nil {
-		if errors.Cause(err) == errFileNotFound || errors.Cause(err) == errFileAccessDenied {
-			return errors.Trace(InvalidUploadID{UploadID: uploadID})
+		if err == errFileNotFound || err == errFileAccessDenied {
+			return InvalidUploadID{UploadID: uploadID}
 		}
-		return toObjectErr(errors.Trace(err), bucket, object)
+		return toObjectErr(err, bucket, object)
 	}
 	// Ignore the error returned as Windows fails to remove directory if a file in it
 	// is Open()ed by the backgroundAppend()
-	fsRemoveAll(uploadIDDir)
+	fsRemoveAll(ctx, uploadIDDir)
 
 	return nil
 }
@@ -690,13 +712,13 @@ func (fs *FSObjects) AbortMultipartUpload(ctx context.Context, bucket, object, u
 // Removes multipart uploads if any older than `expiry` duration
 // on all buckets for every `cleanupInterval`, this function is
 // blocking and should be run in a go-routine.
-func (fs *FSObjects) cleanupStaleMultipartUploads(cleanupInterval, expiry time.Duration, doneCh chan struct{}) {
+func (fs *FSObjects) cleanupStaleMultipartUploads(ctx context.Context, cleanupInterval, expiry time.Duration, doneCh chan struct{}) {
 	ticker := time.NewTicker(cleanupInterval)
+	defer ticker.Stop()
+
 	for {
 		select {
 		case <-doneCh:
-			// Stop the timer.
-			ticker.Stop()
 			return
 		case <-ticker.C:
 			now := time.Now()
@@ -710,12 +732,12 @@ func (fs *FSObjects) cleanupStaleMultipartUploads(cleanupInterval, expiry time.D
 					continue
 				}
 				for _, uploadID := range uploadIDs {
-					fi, err := fsStatDir(pathJoin(fs.fsPath, minioMetaMultipartBucket, entry, uploadID))
+					fi, err := fsStatDir(ctx, pathJoin(fs.fsPath, minioMetaMultipartBucket, entry, uploadID))
 					if err != nil {
 						continue
 					}
 					if now.Sub(fi.ModTime()) > expiry {
-						fsRemoveAll(pathJoin(fs.fsPath, minioMetaMultipartBucket, entry, uploadID))
+						fsRemoveAll(ctx, pathJoin(fs.fsPath, minioMetaMultipartBucket, entry, uploadID))
 					}
 				}
 			}

cmd/fs-v1-multipart_test.go

@@ -23,8 +23,6 @@ import (
 	"path/filepath"
 	"testing"
 	"time"
-
-	"github.com/minio/minio/pkg/errors"
 )
 
 // Tests cleanup multipart uploads for filesystem backend.
@@ -49,7 +47,7 @@ func TestFSCleanupMultipartUploadsInRoutine(t *testing.T) {
 		t.Fatal("Unexpected err: ", err)
 	}
 
-	go fs.cleanupStaleMultipartUploads(20*time.Millisecond, 0, globalServiceDoneCh)
+	go fs.cleanupStaleMultipartUploads(context.Background(), 20*time.Millisecond, 0, globalServiceDoneCh)
 
 	// Wait for 40ms such that - we have given enough time for
 	// cleanup routine to kick in.
@@ -60,7 +58,6 @@ func TestFSCleanupMultipartUploadsInRoutine(t *testing.T) {
 
 	// Check if upload id was already purged.
 	if err = obj.AbortMultipartUpload(context.Background(), bucketName, objectName, uploadID); err != nil {
-		err = errors.Cause(err)
 		if _, ok := err.(InvalidUploadID); !ok {
 			t.Fatal("Unexpected err: ", err)
 		}
@@ -85,7 +82,7 @@ func TestNewMultipartUploadFaultyDisk(t *testing.T) {
 	// Test with disk removed.
 	fs.fsPath = filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	if _, err := fs.NewMultipartUpload(context.Background(), bucketName, objectName, map[string]string{"X-Amz-Meta-xid": "3f"}); err != nil {
-		if !isSameType(errors.Cause(err), BucketNotFound{}) {
+		if !isSameType(err, BucketNotFound{}) {
 			t.Fatal("Unexpected error ", err)
 		}
 	}
@@ -123,7 +120,7 @@ func TestPutObjectPartFaultyDisk(t *testing.T) {
 
 	fs.fsPath = filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	_, err = fs.PutObjectPart(context.Background(), bucketName, objectName, uploadID, 1, mustGetHashReader(t, bytes.NewReader(data), dataLen, md5Hex, sha256sum))
-	if !isSameType(errors.Cause(err), BucketNotFound{}) {
+	if !isSameType(err, BucketNotFound{}) {
 		t.Fatal("Unexpected error ", err)
 	}
 }
@@ -154,7 +151,7 @@ func TestCompleteMultipartUploadFaultyDisk(t *testing.T) {
 	parts := []CompletePart{{PartNumber: 1, ETag: md5Hex}}
 	fs.fsPath = filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	if _, err := fs.CompleteMultipartUpload(context.Background(), bucketName, objectName, uploadID, parts); err != nil {
-		if !isSameType(errors.Cause(err), BucketNotFound{}) {
+		if !isSameType(err, BucketNotFound{}) {
 			t.Fatal("Unexpected error ", err)
 		}
 	}
@@ -249,7 +246,7 @@ func TestListMultipartUploadsFaultyDisk(t *testing.T) {
 
 	fs.fsPath = filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	if _, err := fs.ListMultipartUploads(context.Background(), bucketName, objectName, "", "", "", 1000); err != nil {
-		if !isSameType(errors.Cause(err), BucketNotFound{}) {
+		if !isSameType(err, BucketNotFound{}) {
 			t.Fatal("Unexpected error ", err)
 		}
 	}

cmd/fs-v1-rwpool.go

@@ -17,10 +17,12 @@
 package cmd
 
 import (
+	"context"
 	"os"
 	pathutil "path"
 	"sync"
 
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/lock"
 )
 
@@ -48,7 +50,9 @@ func (fsi *fsIOPool) lookupToRead(path string) (*lock.RLockedFile, bool) {
 		// If the file is closed and not removed from map is a bug.
 		if rlkFile.IsClosed() {
 			// Log this as an error.
-			errorIf(errUnexpected, "Unexpected entry found on the map %s", path)
+			reqInfo := (&logger.ReqInfo{}).AppendTags("path", path)
+			ctx := logger.SetReqInfo(context.Background(), reqInfo)
+			logger.LogIf(ctx, errUnexpected)
 
 			// Purge the cached lock path from map.
 			delete(fsi.readersMap, path)
@@ -164,12 +168,7 @@ func (fsi *fsIOPool) Create(path string) (wlk *lock.LockedFile, err error) {
 	}
 
 	// Creates parent if missing.
-	if err = os.MkdirAll(pathutil.Dir(path), 0777); err != nil {
-		if os.IsPermission(err) {
-			return nil, errFileAccessDenied
-		} else if isSysErrNotDir(err) {
-			return nil, errFileAccessDenied
-		}
+	if err = mkdirAll(pathutil.Dir(path), 0777); err != nil {
 		return nil, err
 	}
 

cmd/fs-v1.go

@@ -19,25 +19,26 @@ package cmd
 import (
 	"context"
 	"encoding/hex"
-	"fmt"
 	"io"
 	"io/ioutil"
 	"os"
 	"path"
-	"path/filepath"
-	"reflect"
 	"sort"
+	"strings"
 	"sync"
-	"syscall"
 	"time"
 
-	"github.com/minio/minio-go/pkg/policy"
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/hash"
 	"github.com/minio/minio/pkg/lock"
 	"github.com/minio/minio/pkg/madmin"
+	"github.com/minio/minio/pkg/mimedb"
+	"github.com/minio/minio/pkg/policy"
 )
 
+// Default etag is used for pre-existing objects.
+var defaultEtag = "00000000000000000000000000000000-1"
+
 // FSObjects - Implements fs object layer.
 type FSObjects struct {
 	// Path to be exported over S3 API.
@@ -62,9 +63,6 @@ type FSObjects struct {
 
 	// To manage the appendRoutine go-routines
 	nsMutex *nsLockMap
-
-	// Variable represents bucket policies in memory.
-	bucketPolicies *bucketPolicies
 }
 
 // Represents the background append file.
@@ -81,6 +79,7 @@ func initMetaVolumeFS(fsPath, fsUUID string) error {
 	// optimizing all other calls. Create minio meta volume,
 	// if it doesn't exist yet.
 	metaBucketPath := pathJoin(fsPath, minioMetaBucket)
+
 	if err := os.MkdirAll(metaBucketPath, 0777); err != nil {
 		return err
 	}
@@ -97,39 +96,14 @@ func initMetaVolumeFS(fsPath, fsUUID string) error {
 
 // NewFSObjectLayer - initialize new fs object layer.
 func NewFSObjectLayer(fsPath string) (ObjectLayer, error) {
+	ctx := context.Background()
 	if fsPath == "" {
 		return nil, errInvalidArgument
 	}
 
 	var err error
-	// Disallow relative paths, figure out absolute paths.
-	fsPath, err = filepath.Abs(fsPath)
-	if err != nil {
-		return nil, err
-	}
-
-	fi, err := os.Stat((fsPath))
-	if err == nil {
-		if !fi.IsDir() {
-			return nil, syscall.ENOTDIR
-		}
-	}
-	if os.IsNotExist(err) {
-		// Disk not found create it.
-		err = os.MkdirAll(fsPath, 0777)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	di, err := getDiskInfo((fsPath))
-	if err != nil {
-		return nil, err
-	}
-
-	// Check if disk has minimum required total space.
-	if err = checkDiskMinTotal(di); err != nil {
-		return nil, err
+	if fsPath, err = checkPathValid(fsPath); err != nil {
+		return nil, uiErrUnableToWriteInBackend(err)
 	}
 
 	// Assign a new UUID for FS minio mode. Each server instance
@@ -138,11 +112,11 @@ func NewFSObjectLayer(fsPath string) (ObjectLayer, error) {
 
 	// Initialize meta volume, if volume already exists ignores it.
 	if err = initMetaVolumeFS(fsPath, fsUUID); err != nil {
-		return nil, fmt.Errorf("Unable to initialize '.minio.sys' meta volume, %s", err)
+		return nil, err
 	}
 
 	// Initialize `format.json`, this function also returns.
-	rlk, err := initFormatFS(fsPath)
+	rlk, err := initFormatFS(ctx, fsPath)
 	if err != nil {
 		return nil, err
 	}
@@ -166,18 +140,17 @@ func NewFSObjectLayer(fsPath string) (ObjectLayer, error) {
 	// or cause changes on backend format.
 	fs.fsFormatRlk = rlk
 
-	// Initialize and load bucket policies.
-	fs.bucketPolicies, err = initBucketPolicies(fs)
-	if err != nil {
-		return nil, fmt.Errorf("Unable to load all bucket policies. %s", err)
-	}
-
 	// Initialize notification system.
 	if err = globalNotificationSys.Init(fs); err != nil {
-		return nil, fmt.Errorf("Unable to initialize event notification. %s", err)
+		return nil, uiErrUnableToReadFromBackend(err).Msg("Unable to initialize notification system")
 	}
 
-	go fs.cleanupStaleMultipartUploads(globalMultipartCleanupInterval, globalMultipartExpiry, globalServiceDoneCh)
+	// Initialize policy system.
+	if err = globalPolicySys.Init(fs); err != nil {
+		return nil, uiErrUnableToReadFromBackend(err).Msg("Unable to initialize policy system")
+	}
+
+	go fs.cleanupStaleMultipartUploads(ctx, globalMultipartCleanupInterval, globalMultipartExpiry, globalServiceDoneCh)
 
 	// Return successfully initialized object layer.
 	return fs, nil
@@ -188,13 +161,14 @@ func (fs *FSObjects) Shutdown(ctx context.Context) error {
 	fs.fsFormatRlk.Close()
 
 	// Cleanup and delete tmp uuid.
-	return fsRemoveAll(pathJoin(fs.fsPath, minioMetaTmpBucket, fs.fsUUID))
+	return fsRemoveAll(ctx, pathJoin(fs.fsPath, minioMetaTmpBucket, fs.fsUUID))
 }
 
 // StorageInfo - returns underlying storage statistics.
 func (fs *FSObjects) StorageInfo(ctx context.Context) StorageInfo {
 	info, err := getDiskInfo((fs.fsPath))
-	errorIf(err, "Unable to get disk info %#v", fs.fsPath)
+	logger.GetReqInfo(ctx).AppendTags("path", fs.fsPath)
+	logger.LogIf(ctx, err)
 	storageInfo := StorageInfo{
 		Total: info.Total,
 		Free:  info.Free,
@@ -220,22 +194,20 @@ func (fs *FSObjects) ClearLocks(ctx context.Context, info []VolumeLockInfo) erro
 // getBucketDir - will convert incoming bucket names to
 // corresponding valid bucket names on the backend in a platform
 // compatible way for all operating systems.
-func (fs *FSObjects) getBucketDir(bucket string) (string, error) {
-	// Verify if bucket is valid.
-	if !IsValidBucketName(bucket) {
-		return "", errors.Trace(BucketNameInvalid{Bucket: bucket})
+func (fs *FSObjects) getBucketDir(ctx context.Context, bucket string) (string, error) {
+	if bucket == "" || bucket == "." || bucket == ".." {
+		return "", errVolumeNotFound
 	}
-
 	bucketDir := pathJoin(fs.fsPath, bucket)
 	return bucketDir, nil
 }
 
-func (fs *FSObjects) statBucketDir(bucket string) (os.FileInfo, error) {
-	bucketDir, err := fs.getBucketDir(bucket)
+func (fs *FSObjects) statBucketDir(ctx context.Context, bucket string) (os.FileInfo, error) {
+	bucketDir, err := fs.getBucketDir(ctx, bucket)
 	if err != nil {
 		return nil, err
 	}
-	st, err := fsStatVolume(bucketDir)
+	st, err := fsStatVolume(ctx, bucketDir)
 	if err != nil {
 		return nil, err
 	}
@@ -250,12 +222,18 @@ func (fs *FSObjects) MakeBucketWithLocation(ctx context.Context, bucket, locatio
 		return err
 	}
 	defer bucketLock.Unlock()
-	bucketDir, err := fs.getBucketDir(bucket)
+	// Verify if bucket is valid.
+	if !IsValidBucketName(bucket) {
+		err := BucketNameInvalid{Bucket: bucket}
+		logger.LogIf(ctx, err)
+		return err
+	}
+	bucketDir, err := fs.getBucketDir(ctx, bucket)
 	if err != nil {
 		return toObjectErr(err, bucket)
 	}
 
-	if err = fsMkdir(bucketDir); err != nil {
+	if err = fsMkdir(ctx, bucketDir); err != nil {
 		return toObjectErr(err, bucket)
 	}
 
@@ -269,7 +247,7 @@ func (fs *FSObjects) GetBucketInfo(ctx context.Context, bucket string) (bi Bucke
 		return bi, e
 	}
 	defer bucketLock.RUnlock()
-	st, err := fs.statBucketDir(bucket)
+	st, err := fs.statBucketDir(ctx, bucket)
 	if err != nil {
 		return bi, toObjectErr(err, bucket)
 	}
@@ -285,12 +263,14 @@ func (fs *FSObjects) GetBucketInfo(ctx context.Context, bucket string) (bi Bucke
 // ListBuckets - list all s3 compatible buckets (directories) at fsPath.
 func (fs *FSObjects) ListBuckets(ctx context.Context) ([]BucketInfo, error) {
 	if err := checkPathLength(fs.fsPath); err != nil {
-		return nil, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return nil, err
 	}
 	var bucketInfos []BucketInfo
 	entries, err := readDir((fs.fsPath))
 	if err != nil {
-		return nil, toObjectErr(errors.Trace(errDiskNotFound))
+		logger.LogIf(ctx, errDiskNotFound)
+		return nil, toObjectErr(errDiskNotFound)
 	}
 
 	for _, entry := range entries {
@@ -299,7 +279,7 @@ func (fs *FSObjects) ListBuckets(ctx context.Context) ([]BucketInfo, error) {
 			continue
 		}
 		var fi os.FileInfo
-		fi, err = fsStatVolume(pathJoin(fs.fsPath, entry))
+		fi, err = fsStatVolume(ctx, pathJoin(fs.fsPath, entry))
 		// There seems like no practical reason to check for errors
 		// at this point, if there are indeed errors we can simply
 		// just ignore such buckets and list only those which
@@ -327,27 +307,28 @@ func (fs *FSObjects) ListBuckets(ctx context.Context) ([]BucketInfo, error) {
 func (fs *FSObjects) DeleteBucket(ctx context.Context, bucket string) error {
 	bucketLock := fs.nsMutex.NewNSLock(bucket, "")
 	if err := bucketLock.GetLock(globalObjectTimeout); err != nil {
+		logger.LogIf(ctx, err)
 		return err
 	}
 	defer bucketLock.Unlock()
-	bucketDir, err := fs.getBucketDir(bucket)
+	bucketDir, err := fs.getBucketDir(ctx, bucket)
 	if err != nil {
 		return toObjectErr(err, bucket)
 	}
 
 	// Attempt to delete regular bucket.
-	if err = fsRemoveDir(bucketDir); err != nil {
+	if err = fsRemoveDir(ctx, bucketDir); err != nil {
 		return toObjectErr(err, bucket)
 	}
 
 	// Cleanup all the bucket metadata.
 	minioMetadataBucketDir := pathJoin(fs.fsPath, minioMetaBucket, bucketMetaPrefix, bucket)
-	if err = fsRemoveAll(minioMetadataBucketDir); err != nil {
+	if err = fsRemoveAll(ctx, minioMetadataBucketDir); err != nil {
 		return toObjectErr(err, bucket)
 	}
 
 	// Delete all bucket metadata.
-	deleteBucketMetadata(bucket, fs)
+	deleteBucketMetadata(ctx, bucket, fs)
 
 	return nil
 }
@@ -380,7 +361,7 @@ func (fs *FSObjects) CopyObject(ctx context.Context, srcBucket, srcObject, dstBu
 		}
 		defer objectSRLock.RUnlock()
 	}
-	if _, err := fs.statBucketDir(srcBucket); err != nil {
+	if _, err := fs.statBucketDir(ctx, srcBucket); err != nil {
 		return oi, toObjectErr(err, srcBucket)
 	}
 
@@ -391,14 +372,15 @@ func (fs *FSObjects) CopyObject(ctx context.Context, srcBucket, srcObject, dstBu
 		fsMetaPath := pathJoin(fs.fsPath, minioMetaBucket, bucketMetaPrefix, srcBucket, srcObject, fs.metaJSONFile)
 		wlk, err := fs.rwPool.Write(fsMetaPath)
 		if err != nil {
-			return oi, toObjectErr(errors.Trace(err), srcBucket, srcObject)
+			logger.LogIf(ctx, err)
+			return oi, toObjectErr(err, srcBucket, srcObject)
 		}
 		// This close will allow for locks to be synchronized on `fs.json`.
 		defer wlk.Close()
 
 		// Save objects' metadata in `fs.json`.
 		fsMeta := newFSMetaV1()
-		if _, err = fsMeta.ReadFrom(wlk); err != nil {
+		if _, err = fsMeta.ReadFrom(ctx, wlk); err != nil {
 			return oi, toObjectErr(err, srcBucket, srcObject)
 		}
 
@@ -409,7 +391,7 @@ func (fs *FSObjects) CopyObject(ctx context.Context, srcBucket, srcObject, dstBu
 		}
 
 		// Stat the file to get file size.
-		fi, err := fsStatFile(pathJoin(fs.fsPath, srcBucket, srcObject))
+		fi, err := fsStatFile(ctx, pathJoin(fs.fsPath, srcBucket, srcObject))
 		if err != nil {
 			return oi, toObjectErr(err, srcBucket, srcObject)
 		}
@@ -419,20 +401,20 @@ func (fs *FSObjects) CopyObject(ctx context.Context, srcBucket, srcObject, dstBu
 	}
 
 	go func() {
-		if gerr := fs.getObject(srcBucket, srcObject, 0, srcInfo.Size, srcInfo.Writer, srcInfo.ETag, !cpSrcDstSame); gerr != nil {
+		if gerr := fs.getObject(ctx, srcBucket, srcObject, 0, srcInfo.Size, srcInfo.Writer, srcInfo.ETag, !cpSrcDstSame); gerr != nil {
 			if gerr = srcInfo.Writer.Close(); gerr != nil {
-				errorIf(gerr, "Unable to read the object %s/%s.", srcBucket, srcObject)
+				logger.LogIf(ctx, gerr)
 			}
 			return
 		}
 		// Close writer explicitly signalling we wrote all data.
 		if gerr := srcInfo.Writer.Close(); gerr != nil {
-			errorIf(gerr, "Unable to read the object %s/%s.", srcBucket, srcObject)
+			logger.LogIf(ctx, gerr)
 			return
 		}
 	}()
 
-	objInfo, err := fs.putObject(dstBucket, dstObject, srcInfo.Reader, srcInfo.UserDefined)
+	objInfo, err := fs.putObject(ctx, dstBucket, dstObject, srcInfo.Reader, srcInfo.UserDefined)
 	if err != nil {
 		return oi, toObjectErr(err, dstBucket, dstObject)
 	}
@@ -447,39 +429,43 @@ func (fs *FSObjects) CopyObject(ctx context.Context, srcBucket, srcObject, dstBu
 // startOffset indicates the starting read location of the object.
 // length indicates the total length of the object.
 func (fs *FSObjects) GetObject(ctx context.Context, bucket, object string, offset int64, length int64, writer io.Writer, etag string) (err error) {
-	if err = checkGetObjArgs(bucket, object); err != nil {
+	if err = checkGetObjArgs(ctx, bucket, object); err != nil {
 		return err
 	}
 
 	// Lock the object before reading.
 	objectLock := fs.nsMutex.NewNSLock(bucket, object)
 	if err := objectLock.GetRLock(globalObjectTimeout); err != nil {
+		logger.LogIf(ctx, err)
 		return err
 	}
 	defer objectLock.RUnlock()
-	return fs.getObject(bucket, object, offset, length, writer, etag, true)
+	return fs.getObject(ctx, bucket, object, offset, length, writer, etag, true)
 }
 
 // getObject - wrapper for GetObject
-func (fs *FSObjects) getObject(bucket, object string, offset int64, length int64, writer io.Writer, etag string, lock bool) (err error) {
-	if _, err = fs.statBucketDir(bucket); err != nil {
+func (fs *FSObjects) getObject(ctx context.Context, bucket, object string, offset int64, length int64, writer io.Writer, etag string, lock bool) (err error) {
+	if _, err = fs.statBucketDir(ctx, bucket); err != nil {
 		return toObjectErr(err, bucket)
 	}
 
 	// Offset cannot be negative.
 	if offset < 0 {
-		return toObjectErr(errors.Trace(errUnexpected), bucket, object)
+		logger.LogIf(ctx, errUnexpected)
+		return toObjectErr(errUnexpected, bucket, object)
 	}
 
 	// Writer cannot be nil.
 	if writer == nil {
-		return toObjectErr(errors.Trace(errUnexpected), bucket, object)
+		logger.LogIf(ctx, errUnexpected)
+		return toObjectErr(errUnexpected, bucket, object)
 	}
 
 	// If its a directory request, we return an empty body.
 	if hasSuffix(object, slashSeparator) {
 		_, err = writer.Write([]byte(""))
-		return toObjectErr(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return toObjectErr(err, bucket, object)
 	}
 
 	if bucket != minioMetaBucket {
@@ -487,25 +473,27 @@ func (fs *FSObjects) getObject(bucket, object string, offset int64, length int64
 		if lock {
 			_, err = fs.rwPool.Open(fsMetaPath)
 			if err != nil && err != errFileNotFound {
-				return toObjectErr(errors.Trace(err), bucket, object)
+				logger.LogIf(ctx, err)
+				return toObjectErr(err, bucket, object)
 			}
 			defer fs.rwPool.Close(fsMetaPath)
 		}
 	}
 
-	if etag != "" {
-		objEtag, perr := fs.getObjectETag(bucket, object, lock)
+	if etag != "" && etag != defaultEtag {
+		objEtag, perr := fs.getObjectETag(ctx, bucket, object, lock)
 		if perr != nil {
-			return toObjectErr(errors.Trace(perr), bucket, object)
+			return toObjectErr(perr, bucket, object)
 		}
 		if objEtag != etag {
-			return toObjectErr(errors.Trace(InvalidETag{}), bucket, object)
+			logger.LogIf(ctx, InvalidETag{})
+			return toObjectErr(InvalidETag{}, bucket, object)
 		}
 	}
 
 	// Read the object, doesn't exist returns an s3 compatible error.
 	fsObjPath := pathJoin(fs.fsPath, bucket, object)
-	reader, size, err := fsOpenFile(fsObjPath, offset)
+	reader, size, err := fsOpenFile(ctx, fsObjPath, offset)
 	if err != nil {
 		return toObjectErr(err, bucket, object)
 	}
@@ -523,31 +511,68 @@ func (fs *FSObjects) getObject(bucket, object string, offset int64, length int64
 
 	// Reply back invalid range if the input offset and length fall out of range.
 	if offset > size || offset+length > size {
-		return errors.Trace(InvalidRange{offset, length, size})
+		err = InvalidRange{offset, length, size}
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	// Allocate a staging buffer.
 	buf := make([]byte, int(bufSize))
 
 	_, err = io.CopyBuffer(writer, io.LimitReader(reader, length), buf)
+	logger.LogIf(ctx, err)
+	return toObjectErr(err, bucket, object)
+}
 
-	return toObjectErr(errors.Trace(err), bucket, object)
+// Create a new fs.json file, if the existing one is corrupt. Should happen very rarely.
+func (fs *FSObjects) createFsJSON(object, fsMetaPath string) error {
+	fsMeta := newFSMetaV1()
+	fsMeta.Meta = make(map[string]string)
+	fsMeta.Meta["etag"] = GenETag()
+	if objectExt := path.Ext(object); objectExt != "" {
+		if content, ok := mimedb.DB[strings.ToLower(strings.TrimPrefix(objectExt, "."))]; ok {
+			fsMeta.Meta["content-type"] = content.ContentType
+		} else {
+			fsMeta.Meta["content-type"] = "application/octet-stream"
+		}
+	}
+	wlk, werr := fs.rwPool.Create(fsMetaPath)
+	if werr == nil {
+		_, err := fsMeta.WriteTo(wlk)
+		wlk.Close()
+		return err
+	}
+	return werr
+}
+
+// Used to return default etag values when a pre-existing object's meta data is queried.
+func (fs *FSObjects) defaultFsJSON(object string) fsMetaV1 {
+	fsMeta := newFSMetaV1()
+	fsMeta.Meta = make(map[string]string)
+	fsMeta.Meta["etag"] = defaultEtag
+	if objectExt := path.Ext(object); objectExt != "" {
+		if content, ok := mimedb.DB[strings.ToLower(strings.TrimPrefix(objectExt, "."))]; ok {
+			fsMeta.Meta["content-type"] = content.ContentType
+		} else {
+			fsMeta.Meta["content-type"] = "application/octet-stream"
+		}
+	}
+	return fsMeta
 }
 
 // getObjectInfo - wrapper for reading object metadata and constructs ObjectInfo.
-func (fs *FSObjects) getObjectInfo(bucket, object string) (oi ObjectInfo, e error) {
+func (fs *FSObjects) getObjectInfo(ctx context.Context, bucket, object string) (oi ObjectInfo, e error) {
 	fsMeta := fsMetaV1{}
-	fi, err := fsStatDir(pathJoin(fs.fsPath, bucket, object))
-	if err != nil && errors.Cause(err) != errFileAccessDenied {
-		return oi, toObjectErr(err, bucket, object)
-	}
-	if fi != nil {
-		// If file found and request was with object ending with "/", consider it
-		// as directory and return object info
-		if hasSuffix(object, slashSeparator) {
-			return fsMeta.ToObjectInfo(bucket, object, fi), nil
+	if hasSuffix(object, slashSeparator) {
+		// Since we support PUT of a "directory" object, we allow HEAD.
+		if !fsIsDir(ctx, pathJoin(fs.fsPath, bucket, object)) {
+			return oi, errFileNotFound
 		}
-		return oi, toObjectErr(errFileNotFound, bucket, object)
+		fi, err := fsStatDir(ctx, pathJoin(fs.fsPath, bucket, object))
+		if err != nil {
+			return oi, err
+		}
+		return fsMeta.ToObjectInfo(bucket, object, fi), nil
 	}
 
 	fsMetaPath := pathJoin(fs.fsPath, minioMetaBucket, bucketMetaPrefix, bucket, object, fs.metaJSONFile)
@@ -557,33 +582,35 @@ func (fs *FSObjects) getObjectInfo(bucket, object string) (oi ObjectInfo, e erro
 	rlk, err := fs.rwPool.Open(fsMetaPath)
 	if err == nil {
 		// Read from fs metadata only if it exists.
-		defer fs.rwPool.Close(fsMetaPath)
-		if _, rerr := fsMeta.ReadFrom(rlk.LockedFile); rerr != nil {
-			// `fs.json` can be empty due to previously failed
-			// PutObject() transaction, if we arrive at such
-			// a situation we just ignore and continue.
-			if errors.Cause(rerr) != io.EOF {
-				return oi, toObjectErr(rerr, bucket, object)
-			}
+		_, rerr := fsMeta.ReadFrom(ctx, rlk.LockedFile)
+		fs.rwPool.Close(fsMetaPath)
+		if rerr != nil {
+			return oi, rerr
 		}
 	}
 
+	// Return a default etag and content-type based on the object's extension.
+	if err == errFileNotFound {
+		fsMeta = fs.defaultFsJSON(object)
+	}
+
 	// Ignore if `fs.json` is not available, this is true for pre-existing data.
 	if err != nil && err != errFileNotFound {
-		return oi, toObjectErr(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return oi, err
 	}
 
 	// Stat the file to get file size.
-	fi, err = fsStatFile(pathJoin(fs.fsPath, bucket, object))
+	fi, err := fsStatFile(ctx, pathJoin(fs.fsPath, bucket, object))
 	if err != nil {
-		return oi, toObjectErr(err, bucket, object)
+		return oi, err
 	}
 
 	return fsMeta.ToObjectInfo(bucket, object, fi), nil
 }
 
-// GetObjectInfo - reads object metadata and replies back ObjectInfo.
-func (fs *FSObjects) GetObjectInfo(ctx context.Context, bucket, object string) (oi ObjectInfo, e error) {
+// getObjectInfoWithLock - reads object metadata and replies back ObjectInfo.
+func (fs *FSObjects) getObjectInfoWithLock(ctx context.Context, bucket, object string) (oi ObjectInfo, e error) {
 	// Lock the object before reading.
 	objectLock := fs.nsMutex.NewNSLock(bucket, object)
 	if err := objectLock.GetRLock(globalObjectTimeout); err != nil {
@@ -591,27 +618,52 @@ func (fs *FSObjects) GetObjectInfo(ctx context.Context, bucket, object string) (
 	}
 	defer objectLock.RUnlock()
 
-	if err := checkGetObjArgs(bucket, object); err != nil {
+	if err := checkGetObjArgs(ctx, bucket, object); err != nil {
 		return oi, err
 	}
 
-	if _, err := fs.statBucketDir(bucket); err != nil {
+	if _, err := fs.statBucketDir(ctx, bucket); err != nil {
 		return oi, toObjectErr(err, bucket)
 	}
 
-	return fs.getObjectInfo(bucket, object)
+	if strings.HasSuffix(object, slashSeparator) && !fs.isObjectDir(bucket, object) {
+		return oi, errFileNotFound
+	}
+
+	return fs.getObjectInfo(ctx, bucket, object)
+}
+
+// GetObjectInfo - reads object metadata and replies back ObjectInfo.
+func (fs *FSObjects) GetObjectInfo(ctx context.Context, bucket, object string) (oi ObjectInfo, e error) {
+	oi, err := fs.getObjectInfoWithLock(ctx, bucket, object)
+	if err == errCorruptedFormat || err == io.EOF {
+		objectLock := fs.nsMutex.NewNSLock(bucket, object)
+		if err = objectLock.GetLock(globalObjectTimeout); err != nil {
+			return oi, toObjectErr(err, bucket, object)
+		}
+
+		fsMetaPath := pathJoin(fs.fsPath, minioMetaBucket, bucketMetaPrefix, bucket, object, fs.metaJSONFile)
+		err = fs.createFsJSON(object, fsMetaPath)
+		objectLock.Unlock()
+		if err != nil {
+			return oi, toObjectErr(err, bucket, object)
+		}
+
+		oi, err = fs.getObjectInfoWithLock(ctx, bucket, object)
+	}
+	return oi, toObjectErr(err, bucket, object)
 }
 
 // This function does the following check, suppose
 // object is "a/b/c/d", stat makes sure that objects ""a/b/c""
 // "a/b" and "a" do not exist.
-func (fs *FSObjects) parentDirIsObject(bucket, parent string) bool {
+func (fs *FSObjects) parentDirIsObject(ctx context.Context, bucket, parent string) bool {
 	var isParentDirObject func(string) bool
 	isParentDirObject = func(p string) bool {
 		if p == "." || p == "/" {
 			return false
 		}
-		if _, err := fsStatFile(pathJoin(fs.fsPath, bucket, p)); err == nil {
+		if fsIsFile(ctx, pathJoin(fs.fsPath, bucket, p)) {
 			// If there is already a file at prefix "p", return true.
 			return true
 		}
@@ -627,20 +679,21 @@ func (fs *FSObjects) parentDirIsObject(bucket, parent string) bool {
 // Additionally writes `fs.json` which carries the necessary metadata
 // for future object operations.
 func (fs *FSObjects) PutObject(ctx context.Context, bucket string, object string, data *hash.Reader, metadata map[string]string) (objInfo ObjectInfo, retErr error) {
-	if err := checkPutObjectArgs(bucket, object, fs, data.Size()); err != nil {
+	if err := checkPutObjectArgs(ctx, bucket, object, fs, data.Size()); err != nil {
 		return ObjectInfo{}, err
 	}
 	// Lock the object.
 	objectLock := fs.nsMutex.NewNSLock(bucket, object)
 	if err := objectLock.GetLock(globalObjectTimeout); err != nil {
+		logger.LogIf(ctx, err)
 		return objInfo, err
 	}
 	defer objectLock.Unlock()
-	return fs.putObject(bucket, object, data, metadata)
+	return fs.putObject(ctx, bucket, object, data, metadata)
 }
 
 // putObject - wrapper for PutObject
-func (fs *FSObjects) putObject(bucket string, object string, data *hash.Reader, metadata map[string]string) (objInfo ObjectInfo, retErr error) {
+func (fs *FSObjects) putObject(ctx context.Context, bucket string, object string, data *hash.Reader, metadata map[string]string) (objInfo ObjectInfo, retErr error) {
 	// No metadata is set, allocate a new one.
 	meta := make(map[string]string)
 	for k, v := range metadata {
@@ -649,7 +702,7 @@ func (fs *FSObjects) putObject(bucket string, object string, data *hash.Reader,
 	var err error
 
 	// Validate if bucket name is valid and exists.
-	if _, err = fs.statBucketDir(bucket); err != nil {
+	if _, err = fs.statBucketDir(ctx, bucket); err != nil {
 		return ObjectInfo{}, toObjectErr(err, bucket)
 	}
 
@@ -661,31 +714,35 @@ func (fs *FSObjects) putObject(bucket string, object string, data *hash.Reader,
 	// and return success.
 	if isObjectDir(object, data.Size()) {
 		// Check if an object is present as one of the parent dir.
-		if fs.parentDirIsObject(bucket, path.Dir(object)) {
-			return ObjectInfo{}, toObjectErr(errors.Trace(errFileAccessDenied), bucket, object)
+		if fs.parentDirIsObject(ctx, bucket, path.Dir(object)) {
+			logger.LogIf(ctx, errFileAccessDenied)
+			return ObjectInfo{}, toObjectErr(errFileAccessDenied, bucket, object)
 		}
 		if err = mkdirAll(pathJoin(fs.fsPath, bucket, object), 0777); err != nil {
+			logger.LogIf(ctx, err)
 			return ObjectInfo{}, toObjectErr(err, bucket, object)
 		}
 		var fi os.FileInfo
-		if fi, err = fsStatDir(pathJoin(fs.fsPath, bucket, object)); err != nil {
+		if fi, err = fsStatDir(ctx, pathJoin(fs.fsPath, bucket, object)); err != nil {
 			return ObjectInfo{}, toObjectErr(err, bucket, object)
 		}
 		return fsMeta.ToObjectInfo(bucket, object, fi), nil
 	}
 
-	if err = checkPutObjectArgs(bucket, object, fs, data.Size()); err != nil {
+	if err = checkPutObjectArgs(ctx, bucket, object, fs, data.Size()); err != nil {
 		return ObjectInfo{}, err
 	}
 
 	// Check if an object is present as one of the parent dir.
-	if fs.parentDirIsObject(bucket, path.Dir(object)) {
-		return ObjectInfo{}, toObjectErr(errors.Trace(errFileAccessDenied), bucket, object)
+	if fs.parentDirIsObject(ctx, bucket, path.Dir(object)) {
+		logger.LogIf(ctx, errFileAccessDenied)
+		return ObjectInfo{}, toObjectErr(errFileAccessDenied, bucket, object)
 	}
 
 	// Validate input data size and it can never be less than zero.
 	if data.Size() < 0 {
-		return ObjectInfo{}, errors.Trace(errInvalidArgument)
+		logger.LogIf(ctx, errInvalidArgument)
+		return ObjectInfo{}, errInvalidArgument
 	}
 
 	var wlk *lock.LockedFile
@@ -695,7 +752,8 @@ func (fs *FSObjects) putObject(bucket string, object string, data *hash.Reader,
 		fsMetaPath := pathJoin(bucketMetaDir, bucket, object, fs.metaJSONFile)
 		wlk, err = fs.rwPool.Create(fsMetaPath)
 		if err != nil {
-			return ObjectInfo{}, toObjectErr(errors.Trace(err), bucket, object)
+			logger.LogIf(ctx, err)
+			return ObjectInfo{}, toObjectErr(err, bucket, object)
 		}
 		// This close will allow for locks to be synchronized on `fs.json`.
 		defer wlk.Close()
@@ -703,7 +761,7 @@ func (fs *FSObjects) putObject(bucket string, object string, data *hash.Reader,
 			// Remove meta file when PutObject encounters any error
 			if retErr != nil {
 				tmpDir := pathJoin(fs.fsPath, minioMetaTmpBucket, fs.fsUUID)
-				fsRemoveMeta(bucketMetaDir, fsMetaPath, tmpDir)
+				fsRemoveMeta(ctx, bucketMetaDir, fsMetaPath, tmpDir)
 			}
 		}()
 	}
@@ -721,9 +779,9 @@ func (fs *FSObjects) putObject(bucket string, object string, data *hash.Reader,
 
 	buf := make([]byte, int(bufSize))
 	fsTmpObjPath := pathJoin(fs.fsPath, minioMetaTmpBucket, fs.fsUUID, tempObj)
-	bytesWritten, err := fsCreateFile(fsTmpObjPath, data, buf, data.Size())
+	bytesWritten, err := fsCreateFile(ctx, fsTmpObjPath, data, buf, data.Size())
 	if err != nil {
-		fsRemoveFile(fsTmpObjPath)
+		fsRemoveFile(ctx, fsTmpObjPath)
 		return ObjectInfo{}, toObjectErr(err, bucket, object)
 	}
 
@@ -732,24 +790,24 @@ func (fs *FSObjects) putObject(bucket string, object string, data *hash.Reader,
 	// Should return IncompleteBody{} error when reader has fewer
 	// bytes than specified in request header.
 	if bytesWritten < data.Size() {
-		fsRemoveFile(fsTmpObjPath)
-		return ObjectInfo{}, errors.Trace(IncompleteBody{})
+		fsRemoveFile(ctx, fsTmpObjPath)
+		return ObjectInfo{}, IncompleteBody{}
 	}
 
 	// Delete the temporary object in the case of a
 	// failure. If PutObject succeeds, then there would be
 	// nothing to delete.
-	defer fsRemoveFile(fsTmpObjPath)
+	defer fsRemoveFile(ctx, fsTmpObjPath)
 
 	// Entire object was written to the temp location, now it's safe to rename it to the actual location.
 	fsNSObjPath := pathJoin(fs.fsPath, bucket, object)
 	// Deny if WORM is enabled
 	if globalWORMEnabled {
-		if _, err = fsStatFile(fsNSObjPath); err == nil {
-			return ObjectInfo{}, errors.Trace(ObjectAlreadyExists{Bucket: bucket, Object: object})
+		if _, err = fsStatFile(ctx, fsNSObjPath); err == nil {
+			return ObjectInfo{}, ObjectAlreadyExists{Bucket: bucket, Object: object}
 		}
 	}
-	if err = fsRenameFile(fsTmpObjPath, fsNSObjPath); err != nil {
+	if err = fsRenameFile(ctx, fsTmpObjPath, fsNSObjPath); err != nil {
 		return ObjectInfo{}, toObjectErr(err, bucket, object)
 	}
 
@@ -761,7 +819,7 @@ func (fs *FSObjects) putObject(bucket string, object string, data *hash.Reader,
 	}
 
 	// Stat the file to fetch timestamp, size.
-	fi, err := fsStatFile(pathJoin(fs.fsPath, bucket, object))
+	fi, err := fsStatFile(ctx, pathJoin(fs.fsPath, bucket, object))
 	if err != nil {
 		return ObjectInfo{}, toObjectErr(err, bucket, object)
 	}
@@ -780,11 +838,11 @@ func (fs *FSObjects) DeleteObject(ctx context.Context, bucket, object string) er
 	}
 	defer objectLock.Unlock()
 
-	if err := checkDelObjArgs(bucket, object); err != nil {
+	if err := checkDelObjArgs(ctx, bucket, object); err != nil {
 		return err
 	}
 
-	if _, err := fs.statBucketDir(bucket); err != nil {
+	if _, err := fs.statBucketDir(ctx, bucket); err != nil {
 		return toObjectErr(err, bucket)
 	}
 
@@ -797,19 +855,20 @@ func (fs *FSObjects) DeleteObject(ctx context.Context, bucket, object string) er
 			defer rwlk.Close()
 		}
 		if lerr != nil && lerr != errFileNotFound {
-			return toObjectErr(errors.Trace(lerr), bucket, object)
+			logger.LogIf(ctx, lerr)
+			return toObjectErr(lerr, bucket, object)
 		}
 	}
 
 	// Delete the object.
-	if err := fsDeleteFile(pathJoin(fs.fsPath, bucket), pathJoin(fs.fsPath, bucket, object)); err != nil {
+	if err := fsDeleteFile(ctx, pathJoin(fs.fsPath, bucket), pathJoin(fs.fsPath, bucket, object)); err != nil {
 		return toObjectErr(err, bucket, object)
 	}
 
 	if bucket != minioMetaBucket {
 		// Delete the metadata object.
-		err := fsDeleteFile(minioMetaBucketDir, fsMetaPath)
-		if err != nil && errors.Cause(err) != errFileNotFound {
+		err := fsDeleteFile(ctx, minioMetaBucketDir, fsMetaPath)
+		if err != nil && err != errFileNotFound {
 			return toObjectErr(err, bucket, object)
 		}
 	}
@@ -834,9 +893,20 @@ func (fs *FSObjects) listDirFactory(isLeaf isLeafFunc) listDirFunc {
 	return listDir
 }
 
+// isObjectDir returns true if the specified bucket & prefix exists
+// and the prefix represents an empty directory. An S3 empty directory
+// is also an empty directory in the FS backend.
+func (fs *FSObjects) isObjectDir(bucket, prefix string) bool {
+	entries, err := readDirN(pathJoin(fs.fsPath, bucket, prefix), 1)
+	if err != nil {
+		return false
+	}
+	return len(entries) == 0
+}
+
 // getObjectETag is a helper function, which returns only the md5sum
 // of the file on the disk.
-func (fs *FSObjects) getObjectETag(bucket, entry string, lock bool) (string, error) {
+func (fs *FSObjects) getObjectETag(ctx context.Context, bucket, entry string, lock bool) (string, error) {
 	fsMetaPath := pathJoin(fs.fsPath, minioMetaBucket, bucketMetaPrefix, bucket, entry, fs.metaJSONFile)
 
 	var reader io.Reader
@@ -848,7 +918,8 @@ func (fs *FSObjects) getObjectETag(bucket, entry string, lock bool) (string, err
 		rlk, err := fs.rwPool.Open(fsMetaPath)
 		// Ignore if `fs.json` is not available, this is true for pre-existing data.
 		if err != nil && err != errFileNotFound {
-			return "", toObjectErr(errors.Trace(err), bucket, entry)
+			logger.LogIf(ctx, err)
+			return "", toObjectErr(err, bucket, entry)
 		}
 
 		// If file is not found, we don't need to proceed forward.
@@ -862,16 +933,17 @@ func (fs *FSObjects) getObjectETag(bucket, entry string, lock bool) (string, err
 		// Fetch the size of the underlying file.
 		fi, err = rlk.LockedFile.Stat()
 		if err != nil {
-			return "", toObjectErr(errors.Trace(err), bucket, entry)
+			logger.LogIf(ctx, err)
+			return "", toObjectErr(err, bucket, entry)
 		}
 
 		size = fi.Size()
 		reader = io.NewSectionReader(rlk.LockedFile, 0, fi.Size())
 	} else {
 		var err error
-		reader, size, err = fsOpenFile(fsMetaPath, 0)
+		reader, size, err = fsOpenFile(ctx, fsMetaPath, 0)
 		if err != nil {
-			return "", toObjectErr(errors.Trace(err), bucket, entry)
+			return "", toObjectErr(err, bucket, entry)
 		}
 	}
 
@@ -884,12 +956,14 @@ func (fs *FSObjects) getObjectETag(bucket, entry string, lock bool) (string, err
 
 	fsMetaBuf, err := ioutil.ReadAll(reader)
 	if err != nil {
-		return "", toObjectErr(errors.Trace(err), bucket, entry)
+		logger.LogIf(ctx, err)
+		return "", toObjectErr(err, bucket, entry)
 	}
 
 	// Check if FS metadata is valid, if not return error.
 	if !isFSMetaValid(parseFSVersion(fsMetaBuf)) {
-		return "", toObjectErr(errors.Trace(errCorruptedFormat), bucket, entry)
+		logger.LogIf(ctx, errCorruptedFormat)
+		return "", toObjectErr(errCorruptedFormat, bucket, entry)
 	}
 
 	return extractETag(parseFSMetaMap(fsMetaBuf)), nil
@@ -898,7 +972,7 @@ func (fs *FSObjects) getObjectETag(bucket, entry string, lock bool) (string, err
 // ListObjects - list all objects at prefix upto maxKeys., optionally delimited by '/'. Maintains the list pool
 // state for future re-entrant list requests.
 func (fs *FSObjects) ListObjects(ctx context.Context, bucket, prefix, marker, delimiter string, maxKeys int) (loi ListObjectsInfo, e error) {
-	if err := checkListObjsArgs(bucket, prefix, marker, delimiter, fs); err != nil {
+	if err := checkListObjsArgs(ctx, bucket, prefix, marker, delimiter, fs); err != nil {
 		return loi, err
 	}
 	// Marker is set validate pre-condition.
@@ -908,7 +982,7 @@ func (fs *FSObjects) ListObjects(ctx context.Context, bucket, prefix, marker, de
 			return ListObjectsInfo{}, e
 		}
 	}
-	if _, err := fs.statBucketDir(bucket); err != nil {
+	if _, err := fs.statBucketDir(ctx, bucket); err != nil {
 		return loi, err
 	}
 
@@ -942,10 +1016,11 @@ func (fs *FSObjects) ListObjects(ctx context.Context, bucket, prefix, marker, de
 		// Protect the entry from concurrent deletes, or renames.
 		objectLock := fs.nsMutex.NewNSLock(bucket, entry)
 		if err = objectLock.GetRLock(globalListingTimeout); err != nil {
+			logger.LogIf(ctx, err)
 			return ObjectInfo{}, err
 		}
 		defer objectLock.RUnlock()
-		return fs.getObjectInfo(bucket, entry)
+		return fs.getObjectInfo(ctx, bucket, entry)
 	}
 
 	heal := false // true only for xl.ListObjectsHeal()
@@ -958,8 +1033,15 @@ func (fs *FSObjects) ListObjects(ctx context.Context, bucket, prefix, marker, de
 			// object string does not end with "/".
 			return !hasSuffix(object, slashSeparator)
 		}
+		// Return true if the specified object is an empty directory
+		isLeafDir := func(bucket, object string) bool {
+			if !hasSuffix(object, slashSeparator) {
+				return false
+			}
+			return fs.isObjectDir(bucket, object)
+		}
 		listDir := fs.listDirFactory(isLeaf)
-		walkResultCh = startTreeWalk(bucket, prefix, marker, recursive, listDir, isLeaf, endWalkCh)
+		walkResultCh = startTreeWalk(ctx, bucket, prefix, marker, recursive, listDir, isLeaf, isLeafDir, endWalkCh)
 	}
 
 	var objInfos []ObjectInfo
@@ -977,14 +1059,13 @@ func (fs *FSObjects) ListObjects(ctx context.Context, bucket, prefix, marker, de
 		// For any walk error return right away.
 		if walkResult.err != nil {
 			// File not found is a valid case.
-			if errors.Cause(walkResult.err) == errFileNotFound {
+			if walkResult.err == errFileNotFound {
 				return loi, nil
 			}
 			return loi, toObjectErr(walkResult.err, bucket, prefix)
 		}
 		objInfo, err := entryToObjectInfo(walkResult.entry)
 		if err != nil {
-			errorIf(err, "Unable to fetch object info for %s", walkResult.entry)
 			return loi, nil
 		}
 		nextMarker = objInfo.Name
@@ -1005,7 +1086,7 @@ func (fs *FSObjects) ListObjects(ctx context.Context, bucket, prefix, marker, de
 	result := ListObjectsInfo{IsTruncated: !eof}
 	for _, objInfo := range objInfos {
 		result.NextMarker = objInfo.Name
-		if objInfo.IsDir {
+		if objInfo.IsDir && delimiter == slashSeparator {
 			result.Prefixes = append(result.Prefixes, objInfo.Name)
 			continue
 		}
@@ -1016,50 +1097,57 @@ func (fs *FSObjects) ListObjects(ctx context.Context, bucket, prefix, marker, de
 	return result, nil
 }
 
+// ReloadFormat - no-op for fs, Valid only for XL.
+func (fs *FSObjects) ReloadFormat(ctx context.Context, dryRun bool) error {
+	logger.LogIf(ctx, NotImplemented{})
+	return NotImplemented{}
+}
+
 // HealFormat - no-op for fs, Valid only for XL.
 func (fs *FSObjects) HealFormat(ctx context.Context, dryRun bool) (madmin.HealResultItem, error) {
-	return madmin.HealResultItem{}, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return madmin.HealResultItem{}, NotImplemented{}
 }
 
 // HealObject - no-op for fs. Valid only for XL.
 func (fs *FSObjects) HealObject(ctx context.Context, bucket, object string, dryRun bool) (
 	res madmin.HealResultItem, err error) {
-	return res, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return res, NotImplemented{}
 }
 
 // HealBucket - no-op for fs, Valid only for XL.
 func (fs *FSObjects) HealBucket(ctx context.Context, bucket string, dryRun bool) ([]madmin.HealResultItem,
 	error) {
-	return nil, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return nil, NotImplemented{}
 }
 
 // ListObjectsHeal - list all objects to be healed. Valid only for XL
 func (fs *FSObjects) ListObjectsHeal(ctx context.Context, bucket, prefix, marker, delimiter string, maxKeys int) (loi ListObjectsInfo, e error) {
-	return loi, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return loi, NotImplemented{}
 }
 
 // ListBucketsHeal - list all buckets to be healed. Valid only for XL
 func (fs *FSObjects) ListBucketsHeal(ctx context.Context) ([]BucketInfo, error) {
-	return []BucketInfo{}, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return []BucketInfo{}, NotImplemented{}
 }
 
 // SetBucketPolicy sets policy on bucket
-func (fs *FSObjects) SetBucketPolicy(ctx context.Context, bucket string, policy policy.BucketAccessPolicy) error {
-	return persistAndNotifyBucketPolicyChange(bucket, false, policy, fs)
+func (fs *FSObjects) SetBucketPolicy(ctx context.Context, bucket string, policy *policy.Policy) error {
+	return savePolicyConfig(fs, bucket, policy)
 }
 
 // GetBucketPolicy will get policy on bucket
-func (fs *FSObjects) GetBucketPolicy(ctx context.Context, bucket string) (policy.BucketAccessPolicy, error) {
-	policy := fs.bucketPolicies.GetBucketPolicy(bucket)
-	if reflect.DeepEqual(policy, emptyBucketPolicy) {
-		return ReadBucketPolicy(bucket, fs)
-	}
-	return policy, nil
+func (fs *FSObjects) GetBucketPolicy(ctx context.Context, bucket string) (*policy.Policy, error) {
+	return GetPolicyConfig(fs, bucket)
 }
 
 // DeleteBucketPolicy deletes all policies on bucket
 func (fs *FSObjects) DeleteBucketPolicy(ctx context.Context, bucket string) error {
-	return persistAndNotifyBucketPolicyChange(bucket, true, emptyBucketPolicy, fs)
+	return removePolicyConfig(ctx, fs, bucket)
 }
 
 // ListObjectsV2 lists all blobs in bucket filtered by prefix
@@ -1079,19 +1167,6 @@ func (fs *FSObjects) ListObjectsV2(ctx context.Context, bucket, prefix, continua
 	return listObjectsV2Info, err
 }
 
-// RefreshBucketPolicy refreshes cache policy with what's on disk.
-func (fs *FSObjects) RefreshBucketPolicy(ctx context.Context, bucket string) error {
-	policy, err := ReadBucketPolicy(bucket, fs)
-
-	if err != nil {
-		if reflect.DeepEqual(policy, emptyBucketPolicy) {
-			return fs.bucketPolicies.DeleteBucketPolicy(bucket)
-		}
-		return err
-	}
-	return fs.bucketPolicies.SetBucketPolicy(bucket, policy)
-}
-
 // IsNotificationSupported returns whether bucket notification is applicable for this layer.
 func (fs *FSObjects) IsNotificationSupported() bool {
 	return true

cmd/fs-v1_test.go

@@ -23,8 +23,6 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
-
-	"github.com/minio/minio/pkg/errors"
 )
 
 // Tests for if parent directory is object
@@ -91,7 +89,7 @@ func TestFSParentDirIsObject(t *testing.T) {
 		},
 	}
 	for i, testCase := range testCases {
-		gotValue := fs.parentDirIsObject(bucketName, testCase.objectName)
+		gotValue := fs.parentDirIsObject(context.Background(), bucketName, testCase.objectName)
 		if testCase.parentIsObject != gotValue {
 			t.Errorf("Test %d: Unexpected value returned got %t, expected %t", i+1, gotValue, testCase.parentIsObject)
 		}
@@ -168,7 +166,15 @@ func TestFSGetBucketInfo(t *testing.T) {
 	fs := obj.(*FSObjects)
 	bucketName := "bucket"
 
-	obj.MakeBucketWithLocation(context.Background(), bucketName, "")
+	err := obj.MakeBucketWithLocation(context.Background(), "a", "")
+	if !isSameType(err, BucketNameInvalid{}) {
+		t.Fatal("BucketNameInvalid error not returned")
+	}
+
+	err = obj.MakeBucketWithLocation(context.Background(), bucketName, "")
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	// Test with valid parameters
 	info, err := fs.GetBucketInfo(context.Background(), bucketName)
@@ -179,17 +185,17 @@ func TestFSGetBucketInfo(t *testing.T) {
 		t.Fatalf("wrong bucket name, expected: %s, found: %s", bucketName, info.Name)
 	}
 
-	// Test with inexistant bucket
+	// Test with non-existent bucket
 	_, err = fs.GetBucketInfo(context.Background(), "a")
-	if !isSameType(errors.Cause(err), BucketNameInvalid{}) {
-		t.Fatal("BucketNameInvalid error not returned")
+	if !isSameType(err, BucketNotFound{}) {
+		t.Fatal("BucketNotFound error not returned")
 	}
 
 	// Check for buckets and should get disk not found.
 	fs.fsPath = filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 
 	_, err = fs.GetBucketInfo(context.Background(), bucketName)
-	if !isSameType(errors.Cause(err), BucketNotFound{}) {
+	if !isSameType(err, BucketNotFound{}) {
 		t.Fatal("BucketNotFound error not returned")
 	}
 }
@@ -212,7 +218,7 @@ func TestFSPutObject(t *testing.T) {
 	if err == nil {
 		t.Fatal("Unexpected should fail here, bucket doesn't exist")
 	}
-	if _, ok := errors.Cause(err).(BucketNotFound); !ok {
+	if _, ok := err.(BucketNotFound); !ok {
 		t.Fatalf("Expected error type BucketNotFound, got %#v", err)
 	}
 
@@ -221,7 +227,7 @@ func TestFSPutObject(t *testing.T) {
 	if err == nil {
 		t.Fatal("Unexpected should fail here, bucket doesn't exist")
 	}
-	if _, ok := errors.Cause(err).(BucketNotFound); !ok {
+	if _, ok := err.(BucketNotFound); !ok {
 		t.Fatalf("Expected error type BucketNotFound, got %#v", err)
 	}
 
@@ -233,7 +239,7 @@ func TestFSPutObject(t *testing.T) {
 	if err == nil {
 		t.Fatal("Unexpected should fail here, backend corruption occurred")
 	}
-	if nerr, ok := errors.Cause(err).(PrefixAccessDenied); !ok {
+	if nerr, ok := err.(PrefixAccessDenied); !ok {
 		t.Fatalf("Expected PrefixAccessDenied, got %#v", err)
 	} else {
 		if nerr.Bucket != "bucket" {
@@ -248,7 +254,7 @@ func TestFSPutObject(t *testing.T) {
 	if err == nil {
 		t.Fatal("Unexpected should fail here, backned corruption occurred")
 	}
-	if nerr, ok := errors.Cause(err).(PrefixAccessDenied); !ok {
+	if nerr, ok := err.(PrefixAccessDenied); !ok {
 		t.Fatalf("Expected PrefixAccessDenied, got %#v", err)
 	} else {
 		if nerr.Bucket != "bucket" {
@@ -275,19 +281,19 @@ func TestFSDeleteObject(t *testing.T) {
 	obj.PutObject(context.Background(), bucketName, objectName, mustGetHashReader(t, bytes.NewReader([]byte("abcd")), int64(len("abcd")), "", ""), nil)
 
 	// Test with invalid bucket name
-	if err := fs.DeleteObject(context.Background(), "fo", objectName); !isSameType(errors.Cause(err), BucketNameInvalid{}) {
+	if err := fs.DeleteObject(context.Background(), "fo", objectName); !isSameType(err, BucketNameInvalid{}) {
 		t.Fatal("Unexpected error: ", err)
 	}
 	// Test with bucket does not exist
-	if err := fs.DeleteObject(context.Background(), "foobucket", "fooobject"); !isSameType(errors.Cause(err), BucketNotFound{}) {
+	if err := fs.DeleteObject(context.Background(), "foobucket", "fooobject"); !isSameType(err, BucketNotFound{}) {
 		t.Fatal("Unexpected error: ", err)
 	}
 	// Test with invalid object name
-	if err := fs.DeleteObject(context.Background(), bucketName, "\\"); !isSameType(errors.Cause(err), ObjectNameInvalid{}) {
+	if err := fs.DeleteObject(context.Background(), bucketName, "\\"); !isSameType(err, ObjectNameInvalid{}) {
 		t.Fatal("Unexpected error: ", err)
 	}
 	// Test with object does not exist.
-	if err := fs.DeleteObject(context.Background(), bucketName, "foooobject"); !isSameType(errors.Cause(err), ObjectNotFound{}) {
+	if err := fs.DeleteObject(context.Background(), bucketName, "foooobject"); !isSameType(err, ObjectNotFound{}) {
 		t.Fatal("Unexpected error: ", err)
 	}
 	// Test with valid condition
@@ -298,7 +304,7 @@ func TestFSDeleteObject(t *testing.T) {
 	// Delete object should err disk not found.
 	fs.fsPath = filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	if err := fs.DeleteObject(context.Background(), bucketName, objectName); err != nil {
-		if !isSameType(errors.Cause(err), BucketNotFound{}) {
+		if !isSameType(err, BucketNotFound{}) {
 			t.Fatal("Unexpected error: ", err)
 		}
 	}
@@ -321,11 +327,12 @@ func TestFSDeleteBucket(t *testing.T) {
 	}
 
 	// Test with an invalid bucket name
-	if err = fs.DeleteBucket(context.Background(), "fo"); !isSameType(errors.Cause(err), BucketNameInvalid{}) {
+	if err = fs.DeleteBucket(context.Background(), "fo"); !isSameType(err, BucketNotFound{}) {
 		t.Fatal("Unexpected error: ", err)
 	}
+
 	// Test with an inexistant bucket
-	if err = fs.DeleteBucket(context.Background(), "foobucket"); !isSameType(errors.Cause(err), BucketNotFound{}) {
+	if err = fs.DeleteBucket(context.Background(), "foobucket"); !isSameType(err, BucketNotFound{}) {
 		t.Fatal("Unexpected error: ", err)
 	}
 	// Test with a valid case
@@ -338,7 +345,7 @@ func TestFSDeleteBucket(t *testing.T) {
 	// Delete bucket should get error disk not found.
 	fs.fsPath = filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	if err = fs.DeleteBucket(context.Background(), bucketName); err != nil {
-		if !isSameType(errors.Cause(err), BucketNotFound{}) {
+		if !isSameType(err, BucketNotFound{}) {
 			t.Fatal("Unexpected error: ", err)
 		}
 	}
@@ -381,7 +388,7 @@ func TestFSListBuckets(t *testing.T) {
 	fs.fsPath = filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 
 	if _, err := fs.ListBuckets(context.Background()); err != nil {
-		if errors.Cause(err) != errDiskNotFound {
+		if err != errDiskNotFound {
 			t.Fatal("Unexpected error: ", err)
 		}
 	}
@@ -389,7 +396,7 @@ func TestFSListBuckets(t *testing.T) {
 	longPath := fmt.Sprintf("%0256d", 1)
 	fs.fsPath = longPath
 	if _, err := fs.ListBuckets(context.Background()); err != nil {
-		if errors.Cause(err) != errFileNameTooLong {
+		if err != errFileNameTooLong {
 			t.Fatal("Unexpected error: ", err)
 		}
 	}
@@ -402,7 +409,7 @@ func TestFSHealObject(t *testing.T) {
 
 	obj := initFSObjects(disk, t)
 	_, err := obj.HealObject(context.Background(), "bucket", "object", false)
-	if err == nil || !isSameType(errors.Cause(err), NotImplemented{}) {
+	if err == nil || !isSameType(err, NotImplemented{}) {
 		t.Fatalf("Heal Object should return NotImplemented error ")
 	}
 }
@@ -414,7 +421,7 @@ func TestFSListObjectsHeal(t *testing.T) {
 
 	obj := initFSObjects(disk, t)
 	_, err := obj.ListObjectsHeal(context.Background(), "bucket", "prefix", "marker", "delimiter", 1000)
-	if err == nil || !isSameType(errors.Cause(err), NotImplemented{}) {
+	if err == nil || !isSameType(err, NotImplemented{}) {
 		t.Fatalf("Heal Object should return NotImplemented error ")
 	}
 }

cmd/gateway-common.go

@@ -19,7 +19,6 @@ package cmd
 import (
 	"net/http"
 
-	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/hash"
 
 	minio "github.com/minio/minio-go"
@@ -31,12 +30,6 @@ var (
 
 	// MustGetUUID function alias.
 	MustGetUUID = mustGetUUID
-
-	// ErrorIf provides errorIf function alias.
-	ErrorIf = errorIf
-
-	// FatalIf provides fatalIf function alias.
-	FatalIf = fatalIf
 )
 
 // AnonErrToObjectErr - converts standard http codes into meaningful object layer errors.
@@ -262,16 +255,6 @@ func ErrorRespToObjectError(err error, params ...string) error {
 		return nil
 	}
 
-	e, ok := err.(*errors.Error)
-	if !ok {
-		// Code should be fixed if this function is called without doing traceError()
-		// Else handling different situations in this function makes this function complicated.
-		errorIf(err, "Expected type *Error")
-		return err
-	}
-
-	err = e.Cause
-
 	bucket := ""
 	object := ""
 	if len(params) >= 1 {
@@ -282,15 +265,14 @@ func ErrorRespToObjectError(err error, params ...string) error {
 	}
 
 	if isNetworkOrHostDown(err) {
-		e.Cause = BackendDown{}
-		return e
+		return BackendDown{}
 	}
 
 	minioErr, ok := err.(minio.ErrorResponse)
 	if !ok {
 		// We don't interpret non Minio errors. As minio errors will
 		// have StatusCode to help to convert to object errors.
-		return e
+		return err
 	}
 
 	switch minioErr.Code {
@@ -299,7 +281,7 @@ func ErrorRespToObjectError(err error, params ...string) error {
 	case "BucketNotEmpty":
 		err = BucketNotEmpty{}
 	case "NoSuchBucketPolicy":
-		err = PolicyNotFound{}
+		err = BucketPolicyNotFound{}
 	case "InvalidBucketName":
 		err = BucketNameInvalid{Bucket: bucket}
 	case "NoSuchBucket":
@@ -325,6 +307,5 @@ func ErrorRespToObjectError(err error, params ...string) error {
 		err = PartTooSmall{}
 	}
 
-	e.Cause = err
-	return e
+	return err
 }

cmd/gateway-main.go

@@ -17,6 +17,8 @@
 package cmd
 
 import (
+	"context"
+	"errors"
 	"fmt"
 	"net/url"
 	"os"
@@ -27,8 +29,8 @@ import (
 
 	"github.com/gorilla/mux"
 	"github.com/minio/cli"
-	"github.com/minio/minio/pkg/errors"
-	miniohttp "github.com/minio/minio/pkg/http"
+	xhttp "github.com/minio/minio/cmd/http"
+	"github.com/minio/minio/cmd/logger"
 )
 
 var (
@@ -100,12 +102,20 @@ func ValidateGatewayArguments(serverAddr, endpointAddr string) error {
 	return nil
 }
 
+func init() {
+	logger.Init(GOPATH)
+}
+
 // StartGateway - handler for 'minio gateway <name>'.
 func StartGateway(ctx *cli.Context, gw Gateway) {
 	if gw == nil {
-		fatalIf(errUnexpected, "Gateway implementation not initialized, exiting.")
+		logger.FatalIf(errUnexpected, "Gateway implementation not initialized")
 	}
 
+	// Disable logging until gateway initialization is complete, any
+	// error during initialization will be shown as a fatal message
+	logger.Disable = true
+
 	// Validate if we have access, secret set through environment.
 	gatewayName := gw.Name()
 	if ctx.Args().First() == "help" {
@@ -116,13 +126,13 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 	// enable json and quite modes if jason flag is turned on.
 	jsonFlag := ctx.IsSet("json") || ctx.GlobalIsSet("json")
 	if jsonFlag {
-		log.EnableJSON()
+		logger.EnableJSON()
 	}
 
 	// Get quiet flag from command line argument.
 	quietFlag := ctx.IsSet("quiet") || ctx.GlobalIsSet("quiet")
 	if quietFlag {
-		log.EnableQuiet()
+		logger.EnableQuiet()
 	}
 
 	// Fetch address option
@@ -139,73 +149,52 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 
 	// Validate if we have access, secret set through environment.
 	if !globalIsEnvCreds {
-		errorIf(fmt.Errorf("Access and secret keys not set"), "Access and Secret keys should be set through ENVs for backend [%s]", gatewayName)
+		reqInfo := (&logger.ReqInfo{}).AppendTags("gatewayName", gatewayName)
+		contxt := logger.SetReqInfo(context.Background(), reqInfo)
+		logger.LogIf(contxt, errors.New("Access and Secret keys should be set through ENVs for backend"))
 		cli.ShowCommandHelpAndExit(ctx, gatewayName, 1)
 	}
 
 	// Create certs path.
-	fatalIf(createConfigDir(), "Unable to create configuration directories.")
+	logger.FatalIf(createConfigDir(), "Unable to create configuration directories")
 
 	// Initialize gateway config.
 	initConfig()
 
-	// Init the error tracing module.
-	errors.Init(GOPATH, "github.com/minio/minio")
-
 	// Check and load SSL certificates.
 	var err error
 	globalPublicCerts, globalRootCAs, globalTLSCertificate, globalIsSSL, err = getSSLConfig()
-	fatalIf(err, "Invalid SSL certificate file")
+	logger.FatalIf(err, "Invalid SSL certificate file")
 
 	// Set system resources to maximum.
-	errorIf(setMaxResources(), "Unable to change resource limit")
+	logger.LogIf(context.Background(), setMaxResources())
 
 	initNSLock(false) // Enable local namespace lock.
 
-	// Initialize notification system.
+	// Create new notification system.
 	globalNotificationSys, err = NewNotificationSys(globalServerConfig, EndpointList{})
-	fatalIf(err, "Unable to initialize notification system.")
+	logger.FatalIf(err, "Unable to create new notification system")
+
+	// Create new policy system.
+	globalPolicySys = NewPolicySys()
 
 	newObject, err := gw.NewGatewayLayer(globalServerConfig.GetCredential())
-	fatalIf(err, "Unable to initialize gateway layer")
+	logger.FatalIf(err, "Unable to initialize gateway layer")
 
 	router := mux.NewRouter().SkipClean(true)
 
+	// Add healthcheck router
+	registerHealthCheckRouter(router)
+
 	// Register web router when its enabled.
 	if globalIsBrowserEnabled {
-		fatalIf(registerWebRouter(router), "Unable to configure web browser")
+		logger.FatalIf(registerWebRouter(router), "Unable to configure web browser")
 	}
+
+	// Add API router.
 	registerAPIRouter(router)
 
-	var handlerFns = []HandlerFunc{
-		// Validate all the incoming paths.
-		setPathValidityHandler,
-		// Limits all requests size to a maximum fixed limit
-		setRequestSizeLimitHandler,
-		// Adds 'crossdomain.xml' policy handler to serve legacy flash clients.
-		setCrossDomainPolicy,
-		// Validates all incoming requests to have a valid date header.
-		// Redirect some pre-defined browser request paths to a static location prefix.
-		setBrowserRedirectHandler,
-		// Validates if incoming request is for restricted buckets.
-		setReservedBucketHandler,
-		// Adds cache control for all browser requests.
-		setBrowserCacheControlHandler,
-		// Validates all incoming requests to have a valid date header.
-		setTimeValidityHandler,
-		// CORS setting for all browser API requests.
-		setCorsHandler,
-		// Validates all incoming URL resources, for invalid/unsupported
-		// resources client receives a HTTP error.
-		setIgnoreResourcesHandler,
-		// Auth handler verifies incoming authorization headers and
-		// routes them accordingly. Client receives a HTTP error for
-		// invalid/unsupported signatures.
-		setAuthHandler,
-		// Add new handlers here.
-	}
-
-	globalHTTPServer = miniohttp.NewServer([]string{gatewayAddr}, registerHandlers(router, handlerFns...), globalTLSCertificate)
+	globalHTTPServer = xhttp.NewServer([]string{gatewayAddr}, registerHandlers(router, globalHandlers...), globalTLSCertificate)
 
 	// Start server, automatically configures TLS if certs are available.
 	go func() {
@@ -227,12 +216,15 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 
 		// Print a warning message if gateway is not ready for production before the startup banner.
 		if !gw.Production() {
-			log.Println(colorYellow("\n               *** Warning: Not Ready for Production ***"))
+			logger.StartupMessage(colorYellow("               *** Warning: Not Ready for Production ***"))
 		}
 
 		// Print gateway startup message.
 		printGatewayStartupMessage(getAPIEndpoints(gatewayAddr), gatewayName)
 	}
 
+	// Reenable logging
+	logger.Disable = false
+
 	handleSignals()
 }

cmd/gateway-startup-msg.go

@@ -20,6 +20,8 @@ import (
 	"context"
 	"fmt"
 	"strings"
+
+	"github.com/minio/minio/cmd/logger"
 )
 
 // Prints the formatted startup message.
@@ -54,12 +56,12 @@ func printGatewayCommonMsg(apiEndpoints []string) {
 
 	apiEndpointStr := strings.Join(apiEndpoints, "  ")
 	// Colorize the message and print.
-	log.Println(colorBlue("\nEndpoint: ") + colorBold(fmt.Sprintf(getFormatStr(len(apiEndpointStr), 1), apiEndpointStr)))
-	log.Println(colorBlue("AccessKey: ") + colorBold(fmt.Sprintf("%s ", cred.AccessKey)))
-	log.Println(colorBlue("SecretKey: ") + colorBold(fmt.Sprintf("%s ", cred.SecretKey)))
+	logger.StartupMessage(colorBlue("\nEndpoint: ") + colorBold(fmt.Sprintf(getFormatStr(len(apiEndpointStr), 1), apiEndpointStr)))
+	logger.StartupMessage(colorBlue("AccessKey: ") + colorBold(fmt.Sprintf("%s ", cred.AccessKey)))
+	logger.StartupMessage(colorBlue("SecretKey: ") + colorBold(fmt.Sprintf("%s ", cred.SecretKey)))
 
 	if globalIsBrowserEnabled {
-		log.Println(colorBlue("\nBrowser Access:"))
-		log.Println(fmt.Sprintf(getFormatStr(len(apiEndpointStr), 3), apiEndpointStr))
+		logger.StartupMessage(colorBlue("\nBrowser Access:"))
+		logger.StartupMessage(fmt.Sprintf(getFormatStr(len(apiEndpointStr), 3), apiEndpointStr))
 	}
 }

cmd/gateway-unsupported.go

@@ -20,10 +20,10 @@ import (
 	"context"
 	"time"
 
-	"github.com/minio/minio-go/pkg/policy"
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/hash"
 	"github.com/minio/minio/pkg/madmin"
+	"github.com/minio/minio/pkg/policy"
 )
 
 // GatewayUnsupported list of unsupported call stubs for gateway.
@@ -31,105 +31,130 @@ type GatewayUnsupported struct{}
 
 // ListMultipartUploads lists all multipart uploads.
 func (a GatewayUnsupported) ListMultipartUploads(ctx context.Context, bucket string, prefix string, keyMarker string, uploadIDMarker string, delimiter string, maxUploads int) (lmi ListMultipartsInfo, err error) {
-	return lmi, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return lmi, NotImplemented{}
 }
 
 // NewMultipartUpload upload object in multiple parts
 func (a GatewayUnsupported) NewMultipartUpload(ctx context.Context, bucket string, object string, metadata map[string]string) (uploadID string, err error) {
-	return "", errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return "", NotImplemented{}
 }
 
 // CopyObjectPart copy part of object to uploadID for another object
 func (a GatewayUnsupported) CopyObjectPart(ctx context.Context, srcBucket, srcObject, destBucket, destObject, uploadID string, partID int, startOffset, length int64, srcInfo ObjectInfo) (pi PartInfo, err error) {
-	return pi, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return pi, NotImplemented{}
 }
 
 // PutObjectPart puts a part of object in bucket
 func (a GatewayUnsupported) PutObjectPart(ctx context.Context, bucket string, object string, uploadID string, partID int, data *hash.Reader) (pi PartInfo, err error) {
-	return pi, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return pi, NotImplemented{}
 }
 
 // ListObjectParts returns all object parts for specified object in specified bucket
 func (a GatewayUnsupported) ListObjectParts(ctx context.Context, bucket string, object string, uploadID string, partNumberMarker int, maxParts int) (lpi ListPartsInfo, err error) {
-	return lpi, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return lpi, NotImplemented{}
 }
 
 // AbortMultipartUpload aborts a ongoing multipart upload
 func (a GatewayUnsupported) AbortMultipartUpload(ctx context.Context, bucket string, object string, uploadID string) error {
-	return errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return NotImplemented{}
 }
 
 // CompleteMultipartUpload completes ongoing multipart upload and finalizes object
 func (a GatewayUnsupported) CompleteMultipartUpload(ctx context.Context, bucket string, object string, uploadID string, uploadedParts []CompletePart) (oi ObjectInfo, err error) {
-	return oi, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return oi, NotImplemented{}
 }
 
 // SetBucketPolicy sets policy on bucket
-func (a GatewayUnsupported) SetBucketPolicy(ctx context.Context, bucket string, policyInfo policy.BucketAccessPolicy) error {
-	return errors.Trace(NotImplemented{})
+func (a GatewayUnsupported) SetBucketPolicy(ctx context.Context, bucket string, bucketPolicy *policy.Policy) error {
+	logger.LogIf(ctx, NotImplemented{})
+	return NotImplemented{}
 }
 
 // GetBucketPolicy will get policy on bucket
-func (a GatewayUnsupported) GetBucketPolicy(ctx context.Context, bucket string) (bal policy.BucketAccessPolicy, err error) {
-	return bal, errors.Trace(NotImplemented{})
+func (a GatewayUnsupported) GetBucketPolicy(ctx context.Context, bucket string) (bucketPolicy *policy.Policy, err error) {
+	logger.LogIf(ctx, NotImplemented{})
+	return nil, NotImplemented{}
 }
 
 // DeleteBucketPolicy deletes all policies on bucket
 func (a GatewayUnsupported) DeleteBucketPolicy(ctx context.Context, bucket string) error {
-	return errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return NotImplemented{}
+}
+
+// ReloadFormat - Not implemented stub.
+func (a GatewayUnsupported) ReloadFormat(ctx context.Context, dryRun bool) error {
+	return NotImplemented{}
 }
 
 // HealFormat - Not implemented stub
 func (a GatewayUnsupported) HealFormat(ctx context.Context, dryRun bool) (madmin.HealResultItem, error) {
-	return madmin.HealResultItem{}, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return madmin.HealResultItem{}, NotImplemented{}
 }
 
 // HealBucket - Not implemented stub
 func (a GatewayUnsupported) HealBucket(ctx context.Context, bucket string, dryRun bool) ([]madmin.HealResultItem, error) {
-	return nil, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return nil, NotImplemented{}
 }
 
 // ListBucketsHeal - Not implemented stub
 func (a GatewayUnsupported) ListBucketsHeal(ctx context.Context) (buckets []BucketInfo, err error) {
-	return nil, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return nil, NotImplemented{}
 }
 
 // HealObject - Not implemented stub
 func (a GatewayUnsupported) HealObject(ctx context.Context, bucket, object string, dryRun bool) (h madmin.HealResultItem, e error) {
-	return h, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return h, NotImplemented{}
 }
 
 // ListObjectsV2 - Not implemented stub
 func (a GatewayUnsupported) ListObjectsV2(ctx context.Context, bucket, prefix, continuationToken, delimiter string, maxKeys int, fetchOwner bool, startAfter string) (result ListObjectsV2Info, err error) {
-	return result, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return result, NotImplemented{}
 }
 
 // ListObjectsHeal - Not implemented stub
 func (a GatewayUnsupported) ListObjectsHeal(ctx context.Context, bucket, prefix, marker, delimiter string, maxKeys int) (loi ListObjectsInfo, e error) {
-	return loi, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return loi, NotImplemented{}
 }
 
 // CopyObject copies a blob from source container to destination container.
 func (a GatewayUnsupported) CopyObject(ctx context.Context, srcBucket string, srcObject string, destBucket string, destObject string,
 	srcInfo ObjectInfo) (objInfo ObjectInfo, err error) {
-	return objInfo, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return objInfo, NotImplemented{}
 }
 
 // Locking operations
 
 // ListLocks lists namespace locks held in object layer
 func (a GatewayUnsupported) ListLocks(ctx context.Context, bucket, prefix string, duration time.Duration) ([]VolumeLockInfo, error) {
-	return []VolumeLockInfo{}, errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return []VolumeLockInfo{}, NotImplemented{}
 }
 
 // ClearLocks clears namespace locks held in object layer
 func (a GatewayUnsupported) ClearLocks(ctx context.Context, info []VolumeLockInfo) error {
-	return errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return NotImplemented{}
 }
 
 // RefreshBucketPolicy refreshes cache policy with what's on disk.
 func (a GatewayUnsupported) RefreshBucketPolicy(ctx context.Context, bucket string) error {
-	return errors.Trace(NotImplemented{})
+	logger.LogIf(ctx, NotImplemented{})
+	return NotImplemented{}
 }
 
 // IsNotificationSupported returns whether bucket notification is applicable for this layer.

cmd/gateway/azure/gateway-azure.go

@@ -34,10 +34,12 @@ import (
 	"github.com/Azure/azure-sdk-for-go/storage"
 	humanize "github.com/dustin/go-humanize"
 	"github.com/minio/cli"
-	"github.com/minio/minio-go/pkg/policy"
+	miniogopolicy "github.com/minio/minio-go/pkg/policy"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
-	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/hash"
+	"github.com/minio/minio/pkg/policy"
+	"github.com/minio/minio/pkg/policy/condition"
 	sha256 "github.com/minio/sha256-simd"
 
 	minio "github.com/minio/minio/cmd"
@@ -49,6 +51,7 @@ const (
 	azureS3MinPartSize         = 5 * humanize.MiByte
 	metadataObjectNameTemplate = minio.GatewayMinioSysTmp + "multipart/v1/%s.%x/azure.json"
 	azureBackend               = "azure"
+	azureMarkerPrefix          = "{minio}"
 )
 
 func init() {
@@ -113,12 +116,18 @@ EXAMPLES:
 	})
 }
 
+// Returns true if marker was returned by Azure, i.e prefixed with
+// {minio}
+func isAzureMarker(marker string) bool {
+	return strings.HasPrefix(marker, azureMarkerPrefix)
+}
+
 // Handler for 'minio gateway azure' command line.
 func azureGatewayMain(ctx *cli.Context) {
 	// Validate gateway arguments.
 	host := ctx.Args().First()
 	// Validate gateway arguments.
-	minio.FatalIf(minio.ValidateGatewayArguments(ctx.GlobalString("address"), host), "Invalid argument")
+	logger.FatalIf(minio.ValidateGatewayArguments(ctx.GlobalString("address"), host), "Invalid argument")
 
 	minio.StartGateway(ctx, &Azure{host})
 }
@@ -181,11 +190,12 @@ func (g *Azure) Production() bool {
 // copied into BlobProperties.
 //
 // Header names are canonicalized as in http.Header.
-func s3MetaToAzureProperties(s3Metadata map[string]string) (storage.BlobMetadata,
+func s3MetaToAzureProperties(ctx context.Context, s3Metadata map[string]string) (storage.BlobMetadata,
 	storage.BlobProperties, error) {
 	for k := range s3Metadata {
 		if strings.Contains(k, "--") {
-			return storage.BlobMetadata{}, storage.BlobProperties{}, errors.Trace(minio.UnsupportedMetadata{})
+			logger.LogIf(ctx, minio.UnsupportedMetadata{})
+			return storage.BlobMetadata{}, storage.BlobProperties{}, minio.UnsupportedMetadata{}
 		}
 	}
 
@@ -300,15 +310,6 @@ func azureToObjectError(err error, params ...string) error {
 		return nil
 	}
 
-	e, ok := err.(*errors.Error)
-	if !ok {
-		// Code should be fixed if this function is called without doing errors.Trace()
-		// Else handling different situations in this function makes this function complicated.
-		minio.ErrorIf(err, "Expected type *Error")
-		return err
-	}
-
-	err = e.Cause
 	bucket := ""
 	object := ""
 	if len(params) >= 1 {
@@ -322,7 +323,7 @@ func azureToObjectError(err error, params ...string) error {
 	if !ok {
 		// We don't interpret non Azure errors. As azure errors will
 		// have StatusCode to help to convert to object errors.
-		return e
+		return err
 	}
 
 	switch azureErr.Code {
@@ -349,39 +350,44 @@ func azureToObjectError(err error, params ...string) error {
 			err = minio.BucketNameInvalid{Bucket: bucket}
 		}
 	}
-	e.Cause = err
-	return e
+	return err
 }
 
-// mustGetAzureUploadID - returns new upload ID which is hex encoded 8 bytes random value.
+// getAzureUploadID - returns new upload ID which is hex encoded 8 bytes random value.
 // this 8 byte restriction is needed because Azure block id has a restriction of length
 // upto 8 bytes.
-func mustGetAzureUploadID() string {
+func getAzureUploadID() (string, error) {
 	var id [8]byte
 
 	n, err := io.ReadFull(rand.Reader, id[:])
 	if err != nil {
-		panic(fmt.Errorf("unable to generate upload ID for azure. %s", err))
+		return "", err
 	}
 	if n != len(id) {
-		panic(fmt.Errorf("insufficient random data (expected: %d, read: %d)", len(id), n))
+		return "", fmt.Errorf("Unexpected random data size. Expected: %d, read: %d)", len(id), n)
 	}
 
-	return hex.EncodeToString(id[:])
+	return hex.EncodeToString(id[:]), nil
 }
 
 // checkAzureUploadID - returns error in case of given string is upload ID.
-func checkAzureUploadID(uploadID string) (err error) {
+func checkAzureUploadID(ctx context.Context, uploadID string) (err error) {
 	if len(uploadID) != 16 {
-		return errors.Trace(minio.MalformedUploadID{
+		logger.LogIf(ctx, minio.MalformedUploadID{
 			UploadID: uploadID,
 		})
+		return minio.MalformedUploadID{
+			UploadID: uploadID,
+		}
 	}
 
 	if _, err = hex.DecodeString(uploadID); err != nil {
-		return errors.Trace(minio.MalformedUploadID{
+		logger.LogIf(ctx, minio.MalformedUploadID{
 			UploadID: uploadID,
 		})
+		return minio.MalformedUploadID{
+			UploadID: uploadID,
+		}
 	}
 
 	return nil
@@ -434,30 +440,33 @@ func (a *azureObjects) StorageInfo(ctx context.Context) (si minio.StorageInfo) {
 
 // MakeBucketWithLocation - Create a new container on azure backend.
 func (a *azureObjects) MakeBucketWithLocation(ctx context.Context, bucket, location string) error {
-	container := a.client.GetContainerReference(bucket)
-	err := container.Create(&storage.CreateContainerOptions{
-		Access: storage.ContainerAccessTypePrivate,
-	})
-	return azureToObjectError(errors.Trace(err), bucket)
-}
-
-// GetBucketInfo - Get bucket metadata..
-func (a *azureObjects) GetBucketInfo(ctx context.Context, bucket string) (bi minio.BucketInfo, e error) {
 	// Verify if bucket (container-name) is valid.
 	// IsValidBucketName has same restrictions as container names mentioned
 	// in azure documentation, so we will simply use the same function here.
 	// Ref - https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata
 	if !minio.IsValidBucketName(bucket) {
-		return bi, errors.Trace(minio.BucketNameInvalid{Bucket: bucket})
+		logger.LogIf(ctx, minio.BucketNameInvalid{Bucket: bucket})
+		return minio.BucketNameInvalid{Bucket: bucket}
 	}
 
+	container := a.client.GetContainerReference(bucket)
+	err := container.Create(&storage.CreateContainerOptions{
+		Access: storage.ContainerAccessTypePrivate,
+	})
+	logger.LogIf(ctx, err)
+	return azureToObjectError(err, bucket)
+}
+
+// GetBucketInfo - Get bucket metadata..
+func (a *azureObjects) GetBucketInfo(ctx context.Context, bucket string) (bi minio.BucketInfo, e error) {
 	// Azure does not have an equivalent call, hence use
 	// ListContainers with prefix
 	resp, err := a.client.ListContainers(storage.ListContainersParameters{
 		Prefix: bucket,
 	})
 	if err != nil {
-		return bi, azureToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return bi, azureToObjectError(err, bucket)
 	}
 	for _, container := range resp.Containers {
 		if container.Name == bucket {
@@ -470,19 +479,22 @@ func (a *azureObjects) GetBucketInfo(ctx context.Context, bucket string) (bi min
 			} // else continue
 		}
 	}
-	return bi, errors.Trace(minio.BucketNotFound{Bucket: bucket})
+	logger.LogIf(ctx, minio.BucketNotFound{Bucket: bucket})
+	return bi, minio.BucketNotFound{Bucket: bucket}
 }
 
 // ListBuckets - Lists all azure containers, uses Azure equivalent ListContainers.
 func (a *azureObjects) ListBuckets(ctx context.Context) (buckets []minio.BucketInfo, err error) {
 	resp, err := a.client.ListContainers(storage.ListContainersParameters{})
 	if err != nil {
-		return nil, azureToObjectError(errors.Trace(err))
+		logger.LogIf(ctx, err)
+		return nil, azureToObjectError(err)
 	}
 	for _, container := range resp.Containers {
 		t, e := time.Parse(time.RFC1123, container.Properties.LastModified)
 		if e != nil {
-			return nil, errors.Trace(e)
+			logger.LogIf(ctx, e)
+			return nil, e
 		}
 		buckets = append(buckets, minio.BucketInfo{
 			Name:    container.Name,
@@ -495,58 +507,100 @@ func (a *azureObjects) ListBuckets(ctx context.Context) (buckets []minio.BucketI
 // DeleteBucket - delete a container on azure, uses Azure equivalent DeleteContainer.
 func (a *azureObjects) DeleteBucket(ctx context.Context, bucket string) error {
 	container := a.client.GetContainerReference(bucket)
-	return azureToObjectError(errors.Trace(container.Delete(nil)), bucket)
+	err := container.Delete(nil)
+	logger.LogIf(ctx, err)
+	return azureToObjectError(err, bucket)
 }
 
 // ListObjects - lists all blobs on azure with in a container filtered by prefix
 // and marker, uses Azure equivalent ListBlobs.
+// To accommodate S3-compatible applications using
+// ListObjectsV1 to use object keys as markers to control the
+// listing of objects, we use the following encoding scheme to
+// distinguish between Azure continuation tokens and application
+// supplied markers.
+//
+// - NextMarker in ListObjectsV1 response is constructed by
+//   prefixing "{minio}" to the Azure continuation token,
+//   e.g, "{minio}CgRvYmoz"
+//
+// - Application supplied markers are used as-is to list
+//   object keys that appear after it in the lexicographical order.
 func (a *azureObjects) ListObjects(ctx context.Context, bucket, prefix, marker, delimiter string, maxKeys int) (result minio.ListObjectsInfo, err error) {
 	var objects []minio.ObjectInfo
 	var prefixes []string
+
+	azureListMarker := ""
+	if isAzureMarker(marker) {
+		// If application is using Azure continuation token we should
+		// strip the azureTokenPrefix we added in the previous list response.
+		azureListMarker = strings.TrimPrefix(marker, azureMarkerPrefix)
+	}
+
 	container := a.client.GetContainerReference(bucket)
 	for len(objects) == 0 && len(prefixes) == 0 {
 		resp, err := container.ListBlobs(storage.ListBlobsParameters{
 			Prefix:     prefix,
-			Marker:     marker,
+			Marker:     azureListMarker,
 			Delimiter:  delimiter,
 			MaxResults: uint(maxKeys),
 		})
 		if err != nil {
-			return result, azureToObjectError(errors.Trace(err), bucket, prefix)
+			logger.LogIf(ctx, err)
+			return result, azureToObjectError(err, bucket, prefix)
 		}
 
-		for _, object := range resp.Blobs {
-			if strings.HasPrefix(object.Name, minio.GatewayMinioSysTmp) {
+		for _, blob := range resp.Blobs {
+			if delimiter == "" && strings.HasPrefix(blob.Name, minio.GatewayMinioSysTmp) {
+				// We filter out minio.GatewayMinioSysTmp entries in the recursive listing.
+				continue
+			}
+			if !isAzureMarker(marker) && blob.Name <= marker {
+				// If the application used ListObjectsV1 style marker then we
+				// skip all the entries till we reach the marker.
 				continue
 			}
 			objects = append(objects, minio.ObjectInfo{
 				Bucket:          bucket,
-				Name:            object.Name,
-				ModTime:         time.Time(object.Properties.LastModified),
-				Size:            object.Properties.ContentLength,
-				ETag:            minio.ToS3ETag(object.Properties.Etag),
-				ContentType:     object.Properties.ContentType,
-				ContentEncoding: object.Properties.ContentEncoding,
+				Name:            blob.Name,
+				ModTime:         time.Time(blob.Properties.LastModified),
+				Size:            blob.Properties.ContentLength,
+				ETag:            minio.ToS3ETag(blob.Properties.Etag),
+				ContentType:     blob.Properties.ContentType,
+				ContentEncoding: blob.Properties.ContentEncoding,
 			})
 		}
 
-		// Remove minio.sys.tmp prefix.
-		for _, prefix := range resp.BlobPrefixes {
-			if prefix != minio.GatewayMinioSysTmp {
-				prefixes = append(prefixes, prefix)
+		for _, blobPrefix := range resp.BlobPrefixes {
+			if blobPrefix == minio.GatewayMinioSysTmp {
+				// We don't do strings.HasPrefix(blob.Name, minio.GatewayMinioSysTmp) here so that
+				// we can use tools like mc to inspect the contents of minio.sys.tmp/
+				// It is OK to allow listing of minio.sys.tmp/ in non-recursive mode as it aids in debugging.
+				continue
 			}
+			if !isAzureMarker(marker) && blobPrefix <= marker {
+				// If the application used ListObjectsV1 style marker then we
+				// skip all the entries till we reach the marker.
+				continue
+			}
+			prefixes = append(prefixes, blobPrefix)
 		}
 
-		marker = resp.NextMarker
-		if resp.NextMarker == "" {
+		azureListMarker = resp.NextMarker
+		if azureListMarker == "" {
+			// Reached end of listing.
 			break
 		}
 	}
 
 	result.Objects = objects
 	result.Prefixes = prefixes
-	result.NextMarker = marker
-	result.IsTruncated = (marker != "")
+	if azureListMarker != "" {
+		// We add the {minio} prefix so that we know in the subsequent request that this
+		// marker is a azure continuation token and not ListObjectV1 marker.
+		result.NextMarker = azureMarkerPrefix + azureListMarker
+		result.IsTruncated = true
+	}
 	return result, nil
 }
 
@@ -580,7 +634,8 @@ func (a *azureObjects) ListObjectsV2(ctx context.Context, bucket, prefix, contin
 func (a *azureObjects) GetObject(ctx context.Context, bucket, object string, startOffset int64, length int64, writer io.Writer, etag string) error {
 	// startOffset cannot be negative.
 	if startOffset < 0 {
-		return azureToObjectError(errors.Trace(minio.InvalidRange{}), bucket, object)
+		logger.LogIf(ctx, minio.InvalidRange{})
+		return azureToObjectError(minio.InvalidRange{}, bucket, object)
 	}
 
 	blobRange := &storage.BlobRange{Start: uint64(startOffset)}
@@ -599,11 +654,13 @@ func (a *azureObjects) GetObject(ctx context.Context, bucket, object string, sta
 		})
 	}
 	if err != nil {
-		return azureToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return azureToObjectError(err, bucket, object)
 	}
 	_, err = io.Copy(writer, rc)
 	rc.Close()
-	return errors.Trace(err)
+	logger.LogIf(ctx, err)
+	return err
 }
 
 // GetObjectInfo - reads blob metadata properties and replies back minio.ObjectInfo,
@@ -612,7 +669,8 @@ func (a *azureObjects) GetObjectInfo(ctx context.Context, bucket, object string)
 	blob := a.client.GetContainerReference(bucket).GetBlobReference(object)
 	err = blob.GetProperties(nil)
 	if err != nil {
-		return objInfo, azureToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, azureToObjectError(err, bucket, object)
 	}
 
 	return minio.ObjectInfo{
@@ -631,13 +689,14 @@ func (a *azureObjects) GetObjectInfo(ctx context.Context, bucket, object string)
 // uses Azure equivalent CreateBlockBlobFromReader.
 func (a *azureObjects) PutObject(ctx context.Context, bucket, object string, data *hash.Reader, metadata map[string]string) (objInfo minio.ObjectInfo, err error) {
 	blob := a.client.GetContainerReference(bucket).GetBlobReference(object)
-	blob.Metadata, blob.Properties, err = s3MetaToAzureProperties(metadata)
+	blob.Metadata, blob.Properties, err = s3MetaToAzureProperties(ctx, metadata)
 	if err != nil {
 		return objInfo, azureToObjectError(err, bucket, object)
 	}
 	err = blob.CreateBlockBlobFromReader(data, nil)
 	if err != nil {
-		return objInfo, azureToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, azureToObjectError(err, bucket, object)
 	}
 	return a.GetObjectInfo(ctx, bucket, object)
 }
@@ -647,19 +706,32 @@ func (a *azureObjects) PutObject(ctx context.Context, bucket, object string, dat
 func (a *azureObjects) CopyObject(ctx context.Context, srcBucket, srcObject, destBucket, destObject string, srcInfo minio.ObjectInfo) (objInfo minio.ObjectInfo, err error) {
 	srcBlobURL := a.client.GetContainerReference(srcBucket).GetBlobReference(srcObject).GetURL()
 	destBlob := a.client.GetContainerReference(destBucket).GetBlobReference(destObject)
-	azureMeta, props, err := s3MetaToAzureProperties(srcInfo.UserDefined)
+	azureMeta, props, err := s3MetaToAzureProperties(ctx, srcInfo.UserDefined)
 	if err != nil {
 		return objInfo, azureToObjectError(err, srcBucket, srcObject)
 	}
 	destBlob.Metadata = azureMeta
 	err = destBlob.Copy(srcBlobURL, nil)
 	if err != nil {
-		return objInfo, azureToObjectError(errors.Trace(err), srcBucket, srcObject)
+		logger.LogIf(ctx, err)
+		return objInfo, azureToObjectError(err, srcBucket, srcObject)
+	}
+	// Azure will copy metadata from the source object when an empty metadata map is provided.
+	// To handle the case where the source object should be copied without its metadata,
+	// the metadata must be removed from the dest. object after the copy completes
+	if len(azureMeta) == 0 && len(destBlob.Metadata) != 0 {
+		destBlob.Metadata = azureMeta
+		err = destBlob.SetMetadata(nil)
+		if err != nil {
+			logger.LogIf(ctx, err)
+			return objInfo, azureToObjectError(err, srcBucket, srcObject)
+		}
 	}
 	destBlob.Properties = props
 	err = destBlob.SetProperties(nil)
 	if err != nil {
-		return objInfo, azureToObjectError(errors.Trace(err), srcBucket, srcObject)
+		logger.LogIf(ctx, err)
+		return objInfo, azureToObjectError(err, srcBucket, srcObject)
 	}
 	return a.GetObjectInfo(ctx, destBucket, destObject)
 }
@@ -670,7 +742,7 @@ func (a *azureObjects) DeleteObject(ctx context.Context, bucket, object string)
 	blob := a.client.GetContainerReference(bucket).GetBlobReference(object)
 	err := blob.Delete(nil)
 	if err != nil {
-		return azureToObjectError(errors.Trace(err), bucket, object)
+		return azureToObjectError(err, bucket, object)
 	}
 	return nil
 }
@@ -690,37 +762,45 @@ func getAzureMetadataObjectName(objectName, uploadID string) string {
 	return fmt.Sprintf(metadataObjectNameTemplate, uploadID, sha256.Sum256([]byte(objectName)))
 }
 
-func (a *azureObjects) checkUploadIDExists(bucketName, objectName, uploadID string) (err error) {
+func (a *azureObjects) checkUploadIDExists(ctx context.Context, bucketName, objectName, uploadID string) (err error) {
 	blob := a.client.GetContainerReference(bucketName).GetBlobReference(
 		getAzureMetadataObjectName(objectName, uploadID))
 	err = blob.GetMetadata(nil)
-	err = azureToObjectError(errors.Trace(err), bucketName, objectName)
+	logger.LogIf(ctx, err)
+	err = azureToObjectError(err, bucketName, objectName)
 	oerr := minio.ObjectNotFound{
 		Bucket: bucketName,
 		Object: objectName,
 	}
-	if errors.Cause(err) == oerr {
-		err = errors.Trace(minio.InvalidUploadID{
+	if err == oerr {
+		logger.LogIf(ctx, minio.InvalidUploadID{UploadID: uploadID})
+		err = minio.InvalidUploadID{
 			UploadID: uploadID,
-		})
+		}
 	}
 	return err
 }
 
 // NewMultipartUpload - Use Azure equivalent CreateBlockBlob.
 func (a *azureObjects) NewMultipartUpload(ctx context.Context, bucket, object string, metadata map[string]string) (uploadID string, err error) {
-	uploadID = mustGetAzureUploadID()
+	uploadID, err = getAzureUploadID()
+	if err != nil {
+		logger.LogIf(ctx, err)
+		return "", err
+	}
 	metadataObject := getAzureMetadataObjectName(object, uploadID)
 
 	var jsonData []byte
 	if jsonData, err = json.Marshal(azureMultipartMetadata{Name: object, Metadata: metadata}); err != nil {
-		return "", errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return "", err
 	}
 
 	blob := a.client.GetContainerReference(bucket).GetBlobReference(metadataObject)
 	err = blob.CreateBlockBlobFromReader(bytes.NewBuffer(jsonData), nil)
 	if err != nil {
-		return "", azureToObjectError(errors.Trace(err), bucket, metadataObject)
+		logger.LogIf(ctx, err)
+		return "", azureToObjectError(err, bucket, metadataObject)
 	}
 
 	return uploadID, nil
@@ -728,11 +808,11 @@ func (a *azureObjects) NewMultipartUpload(ctx context.Context, bucket, object st
 
 // PutObjectPart - Use Azure equivalent PutBlockWithLength.
 func (a *azureObjects) PutObjectPart(ctx context.Context, bucket, object, uploadID string, partID int, data *hash.Reader) (info minio.PartInfo, err error) {
-	if err = a.checkUploadIDExists(bucket, object, uploadID); err != nil {
+	if err = a.checkUploadIDExists(ctx, bucket, object, uploadID); err != nil {
 		return info, err
 	}
 
-	if err = checkAzureUploadID(uploadID); err != nil {
+	if err = checkAzureUploadID(ctx, uploadID); err != nil {
 		return info, err
 	}
 
@@ -756,7 +836,8 @@ func (a *azureObjects) PutObjectPart(ctx context.Context, bucket, object, upload
 		blob := a.client.GetContainerReference(bucket).GetBlobReference(object)
 		err = blob.PutBlockWithLength(id, uint64(subPartSize), io.LimitReader(data, subPartSize), nil)
 		if err != nil {
-			return info, azureToObjectError(errors.Trace(err), bucket, object)
+			logger.LogIf(ctx, err)
+			return info, azureToObjectError(err, bucket, object)
 		}
 		subPartNumber++
 	}
@@ -770,7 +851,7 @@ func (a *azureObjects) PutObjectPart(ctx context.Context, bucket, object, upload
 
 // ListObjectParts - Use Azure equivalent GetBlockList.
 func (a *azureObjects) ListObjectParts(ctx context.Context, bucket, object, uploadID string, partNumberMarker int, maxParts int) (result minio.ListPartsInfo, err error) {
-	if err = a.checkUploadIDExists(bucket, object, uploadID); err != nil {
+	if err = a.checkUploadIDExists(ctx, bucket, object, uploadID); err != nil {
 		return result, err
 	}
 
@@ -787,7 +868,8 @@ func (a *azureObjects) ListObjectParts(ctx context.Context, bucket, object, uplo
 		return result, nil
 	}
 	if err != nil {
-		return result, azureToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return result, azureToObjectError(err, bucket, object)
 	}
 	// Build a sorted list of parts and return the requested entries.
 	partsMap := make(map[int]minio.PartInfo)
@@ -796,7 +878,8 @@ func (a *azureObjects) ListObjectParts(ctx context.Context, bucket, object, uplo
 		var parsedUploadID string
 		var md5Hex string
 		if partNumber, _, parsedUploadID, md5Hex, err = azureParseBlockID(block.Name); err != nil {
-			return result, azureToObjectError(errors.Trace(fmt.Errorf("Unexpected error")), bucket, object)
+			logger.LogIf(ctx, fmt.Errorf("Unexpected error"))
+			return result, azureToObjectError(fmt.Errorf("Unexpected error"), bucket, object)
 		}
 		if parsedUploadID != uploadID {
 			continue
@@ -813,7 +896,8 @@ func (a *azureObjects) ListObjectParts(ctx context.Context, bucket, object, uplo
 		if part.ETag != md5Hex {
 			// If two parts of same partNumber were uploaded with different contents
 			// return error as we won't be able to decide which the latest part is.
-			return result, azureToObjectError(errors.Trace(fmt.Errorf("Unexpected error")), bucket, object)
+			logger.LogIf(ctx, fmt.Errorf("Unexpected error"))
+			return result, azureToObjectError(fmt.Errorf("Unexpected error"), bucket, object)
 		}
 		part.Size += block.Size
 		partsMap[partNumber] = part
@@ -856,7 +940,7 @@ func (a *azureObjects) ListObjectParts(ctx context.Context, bucket, object, uplo
 // There is no corresponding API in azure to abort an incomplete upload. The uncommmitted blocks
 // gets deleted after one week.
 func (a *azureObjects) AbortMultipartUpload(ctx context.Context, bucket, object, uploadID string) (err error) {
-	if err = a.checkUploadIDExists(bucket, object, uploadID); err != nil {
+	if err = a.checkUploadIDExists(ctx, bucket, object, uploadID); err != nil {
 		return err
 	}
 
@@ -868,23 +952,25 @@ func (a *azureObjects) AbortMultipartUpload(ctx context.Context, bucket, object,
 // CompleteMultipartUpload - Use Azure equivalent PutBlockList.
 func (a *azureObjects) CompleteMultipartUpload(ctx context.Context, bucket, object, uploadID string, uploadedParts []minio.CompletePart) (objInfo minio.ObjectInfo, err error) {
 	metadataObject := getAzureMetadataObjectName(object, uploadID)
-	if err = a.checkUploadIDExists(bucket, object, uploadID); err != nil {
+	if err = a.checkUploadIDExists(ctx, bucket, object, uploadID); err != nil {
 		return objInfo, err
 	}
 
-	if err = checkAzureUploadID(uploadID); err != nil {
+	if err = checkAzureUploadID(ctx, uploadID); err != nil {
 		return objInfo, err
 	}
 
 	var metadataReader io.Reader
 	blob := a.client.GetContainerReference(bucket).GetBlobReference(metadataObject)
 	if metadataReader, err = blob.Get(nil); err != nil {
-		return objInfo, azureToObjectError(errors.Trace(err), bucket, metadataObject)
+		logger.LogIf(ctx, err)
+		return objInfo, azureToObjectError(err, bucket, metadataObject)
 	}
 
 	var metadata azureMultipartMetadata
 	if err = json.NewDecoder(metadataReader).Decode(&metadata); err != nil {
-		return objInfo, azureToObjectError(errors.Trace(err), bucket, metadataObject)
+		logger.LogIf(ctx, err)
+		return objInfo, azureToObjectError(err, bucket, metadataObject)
 	}
 
 	defer func() {
@@ -894,13 +980,15 @@ func (a *azureObjects) CompleteMultipartUpload(ctx context.Context, bucket, obje
 
 		blob := a.client.GetContainerReference(bucket).GetBlobReference(metadataObject)
 		derr := blob.Delete(nil)
-		minio.ErrorIf(derr, "unable to remove meta data object for upload ID %s", uploadID)
+		logger.GetReqInfo(ctx).AppendTags("uploadID", uploadID)
+		logger.LogIf(ctx, derr)
 	}()
 
 	objBlob := a.client.GetContainerReference(bucket).GetBlobReference(object)
 	resp, err := objBlob.GetBlockList(storage.BlockListTypeUncommitted, nil)
 	if err != nil {
-		return objInfo, azureToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, azureToObjectError(err, bucket, object)
 	}
 
 	getBlocks := func(partNumber int, etag string) (blocks []storage.Block, size int64, err error) {
@@ -936,7 +1024,8 @@ func (a *azureObjects) CompleteMultipartUpload(ctx context.Context, bucket, obje
 		var size int64
 		blocks, size, err = getBlocks(part.PartNumber, part.ETag)
 		if err != nil {
-			return objInfo, errors.Trace(err)
+			logger.LogIf(ctx, err)
+			return objInfo, err
 		}
 
 		allBlocks = append(allBlocks, blocks...)
@@ -946,30 +1035,39 @@ func (a *azureObjects) CompleteMultipartUpload(ctx context.Context, bucket, obje
 	// Error out if parts except last part sizing < 5MiB.
 	for i, size := range partSizes[:len(partSizes)-1] {
 		if size < azureS3MinPartSize {
-			return objInfo, errors.Trace(minio.PartTooSmall{
+			logger.LogIf(ctx, minio.PartTooSmall{
 				PartNumber: uploadedParts[i].PartNumber,
 				PartSize:   size,
 				PartETag:   uploadedParts[i].ETag,
 			})
+			return objInfo, minio.PartTooSmall{
+				PartNumber: uploadedParts[i].PartNumber,
+				PartSize:   size,
+				PartETag:   uploadedParts[i].ETag,
+			}
 		}
 	}
 
 	err = objBlob.PutBlockList(allBlocks, nil)
 	if err != nil {
-		return objInfo, azureToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, azureToObjectError(err, bucket, object)
 	}
 	if len(metadata.Metadata) > 0 {
-		objBlob.Metadata, objBlob.Properties, err = s3MetaToAzureProperties(metadata.Metadata)
+		objBlob.Metadata, objBlob.Properties, err = s3MetaToAzureProperties(ctx, metadata.Metadata)
 		if err != nil {
+			logger.LogIf(ctx, err)
 			return objInfo, azureToObjectError(err, bucket, object)
 		}
 		err = objBlob.SetProperties(nil)
 		if err != nil {
-			return objInfo, azureToObjectError(errors.Trace(err), bucket, object)
+			logger.LogIf(ctx, err)
+			return objInfo, azureToObjectError(err, bucket, object)
 		}
 		err = objBlob.SetMetadata(nil)
 		if err != nil {
-			return objInfo, azureToObjectError(errors.Trace(err), bucket, object)
+			logger.LogIf(ctx, err)
+			return objInfo, azureToObjectError(err, bucket, object)
 		}
 	}
 	return a.GetObjectInfo(ctx, bucket, object)
@@ -981,10 +1079,16 @@ func (a *azureObjects) CompleteMultipartUpload(ctx context.Context, bucket, obje
 // storage.ContainerAccessTypePrivate - none in minio terminology
 // As the common denominator for minio and azure is readonly and none, we support
 // these two policies at the bucket level.
-func (a *azureObjects) SetBucketPolicy(ctx context.Context, bucket string, policyInfo policy.BucketAccessPolicy) error {
-	var policies []minio.BucketAccessPolicy
+func (a *azureObjects) SetBucketPolicy(ctx context.Context, bucket string, bucketPolicy *policy.Policy) error {
+	policyInfo, err := minio.PolicyToBucketAccessPolicy(bucketPolicy)
+	if err != nil {
+		// This should not happen.
+		logger.LogIf(ctx, err)
+		return azureToObjectError(err, bucket)
+	}
 
-	for prefix, policy := range policy.GetPolicies(policyInfo.Statements, bucket, "") {
+	var policies []minio.BucketAccessPolicy
+	for prefix, policy := range miniogopolicy.GetPolicies(policyInfo.Statements, bucket, "") {
 		policies = append(policies, minio.BucketAccessPolicy{
 			Prefix: prefix,
 			Policy: policy,
@@ -992,40 +1096,63 @@ func (a *azureObjects) SetBucketPolicy(ctx context.Context, bucket string, polic
 	}
 	prefix := bucket + "/*" // For all objects inside the bucket.
 	if len(policies) != 1 {
-		return errors.Trace(minio.NotImplemented{})
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return minio.NotImplemented{}
 	}
 	if policies[0].Prefix != prefix {
-		return errors.Trace(minio.NotImplemented{})
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return minio.NotImplemented{}
 	}
-	if policies[0].Policy != policy.BucketPolicyReadOnly {
-		return errors.Trace(minio.NotImplemented{})
+	if policies[0].Policy != miniogopolicy.BucketPolicyReadOnly {
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return minio.NotImplemented{}
 	}
 	perm := storage.ContainerPermissions{
 		AccessType:     storage.ContainerAccessTypeContainer,
 		AccessPolicies: nil,
 	}
 	container := a.client.GetContainerReference(bucket)
-	err := container.SetPermissions(perm, nil)
-	return azureToObjectError(errors.Trace(err), bucket)
+	err = container.SetPermissions(perm, nil)
+	logger.LogIf(ctx, err)
+	return azureToObjectError(err, bucket)
 }
 
 // GetBucketPolicy - Get the container ACL and convert it to canonical []bucketAccessPolicy
-func (a *azureObjects) GetBucketPolicy(ctx context.Context, bucket string) (policy.BucketAccessPolicy, error) {
-	policyInfo := policy.BucketAccessPolicy{Version: "2012-10-17"}
+func (a *azureObjects) GetBucketPolicy(ctx context.Context, bucket string) (*policy.Policy, error) {
 	container := a.client.GetContainerReference(bucket)
 	perm, err := container.GetPermissions(nil)
 	if err != nil {
-		return policy.BucketAccessPolicy{}, azureToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return nil, azureToObjectError(err, bucket)
 	}
-	switch perm.AccessType {
-	case storage.ContainerAccessTypePrivate:
-		return policy.BucketAccessPolicy{}, errors.Trace(minio.PolicyNotFound{Bucket: bucket})
-	case storage.ContainerAccessTypeContainer:
-		policyInfo.Statements = policy.SetPolicy(policyInfo.Statements, policy.BucketPolicyReadOnly, bucket, "")
-	default:
-		return policy.BucketAccessPolicy{}, azureToObjectError(errors.Trace(minio.NotImplemented{}))
+
+	if perm.AccessType == storage.ContainerAccessTypePrivate {
+		logger.LogIf(ctx, minio.BucketPolicyNotFound{Bucket: bucket})
+		return nil, minio.BucketPolicyNotFound{Bucket: bucket}
+	} else if perm.AccessType != storage.ContainerAccessTypeContainer {
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return nil, azureToObjectError(minio.NotImplemented{})
 	}
-	return policyInfo, nil
+
+	return &policy.Policy{
+		Version: policy.DefaultVersion,
+		Statements: []policy.Statement{
+			policy.NewStatement(
+				policy.Allow,
+				policy.NewPrincipal("*"),
+				policy.NewActionSet(
+					policy.GetBucketLocationAction,
+					policy.ListBucketAction,
+					policy.GetObjectAction,
+				),
+				policy.NewResourceSet(
+					policy.NewResource(bucket, ""),
+					policy.NewResource(bucket, "*"),
+				),
+				condition.NewFunctions(),
+			),
+		},
+	}, nil
 }
 
 // DeleteBucketPolicy - Set the container ACL to "private"
@@ -1036,5 +1163,6 @@ func (a *azureObjects) DeleteBucketPolicy(ctx context.Context, bucket string) er
 	}
 	container := a.client.GetContainerReference(bucket)
 	err := container.SetPermissions(perm, nil)
-	return azureToObjectError(errors.Trace(err))
+	logger.LogIf(ctx, err)
+	return azureToObjectError(err)
 }

cmd/gateway/azure/gateway-azure_test.go

@@ -17,6 +17,7 @@
 package azure
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 	"reflect"
@@ -24,7 +25,6 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/storage"
 	minio "github.com/minio/minio/cmd"
-	"github.com/minio/minio/pkg/errors"
 )
 
 // Test canonical metadata.
@@ -55,7 +55,7 @@ func TestS3MetaToAzureProperties(t *testing.T) {
 		"X_Amz_Matdesc":    "{}",
 		"X_Amz_Iv":         "eWmyryl8kq+EVnnsE7jpOg==",
 	}
-	meta, _, err := s3MetaToAzureProperties(headers)
+	meta, _, err := s3MetaToAzureProperties(context.Background(), headers)
 	if err != nil {
 		t.Fatalf("Test failed, with %s", err)
 	}
@@ -65,8 +65,8 @@ func TestS3MetaToAzureProperties(t *testing.T) {
 	headers = map[string]string{
 		"invalid--meta": "value",
 	}
-	_, _, err = s3MetaToAzureProperties(headers)
-	if err = errors.Cause(err); err != nil {
+	_, _, err = s3MetaToAzureProperties(context.Background(), headers)
+	if err != nil {
 		if _, ok := err.(minio.UnsupportedMetadata); !ok {
 			t.Fatalf("Test failed with unexpected error %s, expected UnsupportedMetadata", err)
 		}
@@ -75,7 +75,7 @@ func TestS3MetaToAzureProperties(t *testing.T) {
 	headers = map[string]string{
 		"content-md5": "Dce7bmCX61zvxzP5QmfelQ==",
 	}
-	_, props, err := s3MetaToAzureProperties(headers)
+	_, props, err := s3MetaToAzureProperties(context.Background(), headers)
 	if err != nil {
 		t.Fatalf("Test failed, with %s", err)
 	}
@@ -137,53 +137,46 @@ func TestAzureToObjectError(t *testing.T) {
 			nil, nil, "", "",
 		},
 		{
-			errors.Trace(fmt.Errorf("Non azure error")),
+			fmt.Errorf("Non azure error"),
 			fmt.Errorf("Non azure error"), "", "",
 		},
 		{
 			storage.AzureStorageServiceError{
 				Code: "ContainerAlreadyExists",
-			}, storage.AzureStorageServiceError{
-				Code: "ContainerAlreadyExists",
-			}, "bucket", "",
+			}, minio.BucketExists{Bucket: "bucket"}, "bucket", "",
 		},
 		{
-			errors.Trace(storage.AzureStorageServiceError{
-				Code: "ContainerAlreadyExists",
-			}), minio.BucketExists{Bucket: "bucket"}, "bucket", "",
-		},
-		{
-			errors.Trace(storage.AzureStorageServiceError{
+			storage.AzureStorageServiceError{
 				Code: "InvalidResourceName",
-			}), minio.BucketNameInvalid{Bucket: "bucket."}, "bucket.", "",
+			}, minio.BucketNameInvalid{Bucket: "bucket."}, "bucket.", "",
 		},
 		{
-			errors.Trace(storage.AzureStorageServiceError{
+			storage.AzureStorageServiceError{
 				Code: "RequestBodyTooLarge",
-			}), minio.PartTooBig{}, "", "",
+			}, minio.PartTooBig{}, "", "",
 		},
 		{
-			errors.Trace(storage.AzureStorageServiceError{
+			storage.AzureStorageServiceError{
 				Code: "InvalidMetadata",
-			}), minio.UnsupportedMetadata{}, "", "",
+			}, minio.UnsupportedMetadata{}, "", "",
 		},
 		{
-			errors.Trace(storage.AzureStorageServiceError{
+			storage.AzureStorageServiceError{
 				StatusCode: http.StatusNotFound,
-			}), minio.ObjectNotFound{
+			}, minio.ObjectNotFound{
 				Bucket: "bucket",
 				Object: "object",
 			}, "bucket", "object",
 		},
 		{
-			errors.Trace(storage.AzureStorageServiceError{
+			storage.AzureStorageServiceError{
 				StatusCode: http.StatusNotFound,
-			}), minio.BucketNotFound{Bucket: "bucket"}, "bucket", "",
+			}, minio.BucketNotFound{Bucket: "bucket"}, "bucket", "",
 		},
 		{
-			errors.Trace(storage.AzureStorageServiceError{
+			storage.AzureStorageServiceError{
 				StatusCode: http.StatusBadRequest,
-			}), minio.BucketNameInvalid{Bucket: "bucket."}, "bucket.", "",
+			}, minio.BucketNameInvalid{Bucket: "bucket."}, "bucket.", "",
 		},
 	}
 	for i, testCase := range testCases {
@@ -307,7 +300,7 @@ func TestCheckAzureUploadID(t *testing.T) {
 	}
 
 	for _, uploadID := range invalidUploadIDs {
-		if err := checkAzureUploadID(uploadID); err == nil {
+		if err := checkAzureUploadID(context.Background(), uploadID); err == nil {
 			t.Fatalf("%s: expected: <error>, got: <nil>", uploadID)
 		}
 	}
@@ -318,7 +311,7 @@ func TestCheckAzureUploadID(t *testing.T) {
 	}
 
 	for _, uploadID := range validUploadIDs {
-		if err := checkAzureUploadID(uploadID); err != nil {
+		if err := checkAzureUploadID(context.Background(), uploadID); err != nil {
 			t.Fatalf("%s: expected: <nil>, got: %s", uploadID, err)
 		}
 	}

cmd/gateway/b2/gateway-b2.go

@@ -30,10 +30,12 @@ import (
 
 	b2 "github.com/minio/blazer/base"
 	"github.com/minio/cli"
-	"github.com/minio/minio-go/pkg/policy"
+	miniogopolicy "github.com/minio/minio-go/pkg/policy"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
-	"github.com/minio/minio/pkg/errors"
 	h2 "github.com/minio/minio/pkg/hash"
+	"github.com/minio/minio/pkg/policy"
+	"github.com/minio/minio/pkg/policy/condition"
 
 	minio "github.com/minio/minio/cmd"
 )
@@ -126,10 +128,9 @@ func (g *B2) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, error)
 	}, nil
 }
 
-// Production - Ready for production use?
+// Production - Ready for production use.
 func (g *B2) Production() bool {
-	// Not ready for production use just yet.
-	return false
+	return true
 }
 
 // b2Object implements gateway for Minio and BackBlaze B2 compatible object storage servers.
@@ -146,16 +147,6 @@ func b2ToObjectError(err error, params ...string) error {
 	if err == nil {
 		return nil
 	}
-
-	e, ok := err.(*errors.Error)
-	if !ok {
-		// Code should be fixed if this function is called without doing errors.Trace()
-		// Else handling different situations in this function makes this function complicated.
-		minio.ErrorIf(err, "Expected type *Error")
-		return err
-	}
-
-	err = e.Cause
 	bucket := ""
 	object := ""
 	uploadID := ""
@@ -177,7 +168,7 @@ func b2ToObjectError(err error, params ...string) error {
 	if statusCode == 0 {
 		// We don't interpret non B2 errors. B2 errors have statusCode
 		// to help us convert them to S3 object errors.
-		return e
+		return err
 	}
 
 	switch code {
@@ -192,6 +183,15 @@ func b2ToObjectError(err error, params ...string) error {
 		} else if bucket != "" {
 			err = minio.BucketNotFound{Bucket: bucket}
 		}
+	case "bad_json":
+		if object != "" {
+			err = minio.ObjectNameInvalid{
+				Bucket: bucket,
+				Object: object,
+			}
+		} else if bucket != "" {
+			err = minio.BucketNameInvalid{Bucket: bucket}
+		}
 	case "bad_bucket_id":
 		err = minio.BucketNotFound{Bucket: bucket}
 	case "file_not_present", "not_found":
@@ -208,8 +208,7 @@ func b2ToObjectError(err error, params ...string) error {
 		err = minio.InvalidUploadID{UploadID: uploadID}
 	}
 
-	e.Cause = err
-	return e
+	return err
 }
 
 // Shutdown saves any gateway metadata to disk
@@ -230,7 +229,8 @@ func (l *b2Objects) MakeBucketWithLocation(ctx context.Context, bucket, location
 
 	// All buckets are set to private by default.
 	_, err := l.b2Client.CreateBucket(l.ctx, bucket, bucketTypePrivate, nil, nil)
-	return b2ToObjectError(errors.Trace(err), bucket)
+	logger.LogIf(ctx, err)
+	return b2ToObjectError(err, bucket)
 }
 
 func (l *b2Objects) reAuthorizeAccount(ctx context.Context) error {
@@ -271,14 +271,16 @@ func (l *b2Objects) listBuckets(ctx context.Context, err error) ([]*b2.Bucket, e
 func (l *b2Objects) Bucket(ctx context.Context, bucket string) (*b2.Bucket, error) {
 	bktList, err := l.listBuckets(ctx, nil)
 	if err != nil {
-		return nil, b2ToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return nil, b2ToObjectError(err, bucket)
 	}
 	for _, bkt := range bktList {
 		if bkt.Name == bucket {
 			return bkt, nil
 		}
 	}
-	return nil, errors.Trace(minio.BucketNotFound{Bucket: bucket})
+	logger.LogIf(ctx, minio.BucketNotFound{Bucket: bucket})
+	return nil, minio.BucketNotFound{Bucket: bucket}
 }
 
 // GetBucketInfo gets bucket metadata..
@@ -315,7 +317,8 @@ func (l *b2Objects) DeleteBucket(ctx context.Context, bucket string) error {
 		return err
 	}
 	err = bkt.DeleteBucket(l.ctx)
-	return b2ToObjectError(errors.Trace(err), bucket)
+	logger.LogIf(ctx, err)
+	return b2ToObjectError(err, bucket)
 }
 
 // ListObjects lists all objects in B2 bucket filtered by prefix, returns upto at max 1000 entries at a time.
@@ -326,7 +329,8 @@ func (l *b2Objects) ListObjects(ctx context.Context, bucket string, prefix strin
 	}
 	files, next, lerr := bkt.ListFileNames(l.ctx, maxKeys, marker, prefix, delimiter)
 	if lerr != nil {
-		return loi, b2ToObjectError(errors.Trace(lerr), bucket)
+		logger.LogIf(ctx, lerr)
+		return loi, b2ToObjectError(lerr, bucket)
 	}
 	loi.IsTruncated = next != ""
 	loi.NextMarker = next
@@ -359,7 +363,8 @@ func (l *b2Objects) ListObjectsV2(ctx context.Context, bucket, prefix, continuat
 	}
 	files, next, lerr := bkt.ListFileNames(l.ctx, maxKeys, continuationToken, prefix, delimiter)
 	if lerr != nil {
-		return loi, b2ToObjectError(errors.Trace(lerr), bucket)
+		logger.LogIf(ctx, lerr)
+		return loi, b2ToObjectError(lerr, bucket)
 	}
 	loi.IsTruncated = next != ""
 	loi.ContinuationToken = continuationToken
@@ -396,11 +401,13 @@ func (l *b2Objects) GetObject(ctx context.Context, bucket string, object string,
 	}
 	reader, err := bkt.DownloadFileByName(l.ctx, object, startOffset, length)
 	if err != nil {
-		return b2ToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return b2ToObjectError(err, bucket, object)
 	}
 	defer reader.Close()
 	_, err = io.Copy(writer, reader)
-	return b2ToObjectError(errors.Trace(err), bucket, object)
+	logger.LogIf(ctx, err)
+	return b2ToObjectError(err, bucket, object)
 }
 
 // GetObjectInfo reads object info and replies back ObjectInfo
@@ -411,12 +418,14 @@ func (l *b2Objects) GetObjectInfo(ctx context.Context, bucket string, object str
 	}
 	f, err := bkt.DownloadFileByName(l.ctx, object, 0, 1)
 	if err != nil {
-		return objInfo, b2ToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, b2ToObjectError(err, bucket, object)
 	}
 	f.Close()
 	fi, err := bkt.File(f.ID, object).GetFileInfo(l.ctx)
 	if err != nil {
-		return objInfo, b2ToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, b2ToObjectError(err, bucket, object)
 	}
 	return minio.ObjectInfo{
 		Bucket:      bucket,
@@ -504,20 +513,23 @@ func (l *b2Objects) PutObject(ctx context.Context, bucket string, object string,
 	var u *b2.URL
 	u, err = bkt.GetUploadURL(l.ctx)
 	if err != nil {
-		return objInfo, b2ToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, b2ToObjectError(err, bucket, object)
 	}
 
 	hr := newB2Reader(data, data.Size())
 	var f *b2.File
 	f, err = u.UploadFile(l.ctx, hr, int(hr.Size()), object, contentType, sha1AtEOF, metadata)
 	if err != nil {
-		return objInfo, b2ToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, b2ToObjectError(err, bucket, object)
 	}
 
 	var fi *b2.FileInfo
 	fi, err = f.GetFileInfo(l.ctx)
 	if err != nil {
-		return objInfo, b2ToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, b2ToObjectError(err, bucket, object)
 	}
 
 	return minio.ObjectInfo{
@@ -539,12 +551,14 @@ func (l *b2Objects) DeleteObject(ctx context.Context, bucket string, object stri
 	}
 	reader, err := bkt.DownloadFileByName(l.ctx, object, 0, 1)
 	if err != nil {
-		return b2ToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return b2ToObjectError(err, bucket, object)
 	}
 	io.Copy(ioutil.Discard, reader)
 	reader.Close()
 	err = bkt.File(reader.ID, object).DeleteFileVersion(l.ctx)
-	return b2ToObjectError(errors.Trace(err), bucket, object)
+	logger.LogIf(ctx, err)
+	return b2ToObjectError(err, bucket, object)
 }
 
 // ListMultipartUploads lists all multipart uploads.
@@ -563,7 +577,8 @@ func (l *b2Objects) ListMultipartUploads(ctx context.Context, bucket string, pre
 	}
 	largeFiles, nextMarker, err := bkt.ListUnfinishedLargeFiles(l.ctx, uploadIDMarker, maxUploads)
 	if err != nil {
-		return lmi, b2ToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return lmi, b2ToObjectError(err, bucket)
 	}
 	lmi = minio.ListMultipartsInfo{
 		MaxUploads: maxUploads,
@@ -598,7 +613,8 @@ func (l *b2Objects) NewMultipartUpload(ctx context.Context, bucket string, objec
 	delete(metadata, "content-type")
 	lf, err := bkt.StartLargeFile(l.ctx, object, contentType, metadata)
 	if err != nil {
-		return uploadID, b2ToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return uploadID, b2ToObjectError(err, bucket, object)
 	}
 
 	return lf.ID, nil
@@ -613,13 +629,15 @@ func (l *b2Objects) PutObjectPart(ctx context.Context, bucket string, object str
 
 	fc, err := bkt.File(uploadID, object).CompileParts(0, nil).GetUploadPartURL(l.ctx)
 	if err != nil {
-		return pi, b2ToObjectError(errors.Trace(err), bucket, object, uploadID)
+		logger.LogIf(ctx, err)
+		return pi, b2ToObjectError(err, bucket, object, uploadID)
 	}
 
 	hr := newB2Reader(data, data.Size())
 	sha1, err := fc.UploadPart(l.ctx, hr, sha1AtEOF, int(hr.Size()), partID)
 	if err != nil {
-		return pi, b2ToObjectError(errors.Trace(err), bucket, object, uploadID)
+		logger.LogIf(ctx, err)
+		return pi, b2ToObjectError(err, bucket, object, uploadID)
 	}
 
 	return minio.PartInfo{
@@ -647,7 +665,8 @@ func (l *b2Objects) ListObjectParts(ctx context.Context, bucket string, object s
 	partNumberMarker++
 	partsList, next, err := bkt.File(uploadID, object).ListParts(l.ctx, partNumberMarker, maxParts)
 	if err != nil {
-		return lpi, b2ToObjectError(errors.Trace(err), bucket, object, uploadID)
+		logger.LogIf(ctx, err)
+		return lpi, b2ToObjectError(err, bucket, object, uploadID)
 	}
 	if next != 0 {
 		lpi.IsTruncated = true
@@ -670,7 +689,8 @@ func (l *b2Objects) AbortMultipartUpload(ctx context.Context, bucket string, obj
 		return err
 	}
 	err = bkt.File(uploadID, object).CompileParts(0, nil).CancelLargeFile(l.ctx)
-	return b2ToObjectError(errors.Trace(err), bucket, object, uploadID)
+	logger.LogIf(ctx, err)
+	return b2ToObjectError(err, bucket, object, uploadID)
 }
 
 // CompleteMultipartUpload completes ongoing multipart upload and finalizes object, uses B2's LargeFile upload API.
@@ -684,7 +704,8 @@ func (l *b2Objects) CompleteMultipartUpload(ctx context.Context, bucket string,
 		// B2 requires contigous part numbers starting with 1, they do not support
 		// hand picking part numbers, we return an S3 compatible error instead.
 		if i+1 != uploadedPart.PartNumber {
-			return oi, b2ToObjectError(errors.Trace(minio.InvalidPart{}), bucket, object, uploadID)
+			logger.LogIf(ctx, minio.InvalidPart{})
+			return oi, b2ToObjectError(minio.InvalidPart{}, bucket, object, uploadID)
 		}
 
 		// Trim "-1" suffix in ETag as PutObjectPart() treats B2 returned SHA1 as ETag.
@@ -692,7 +713,8 @@ func (l *b2Objects) CompleteMultipartUpload(ctx context.Context, bucket string,
 	}
 
 	if _, err = bkt.File(uploadID, object).CompileParts(0, hashes).FinishLargeFile(l.ctx); err != nil {
-		return oi, b2ToObjectError(errors.Trace(err), bucket, object, uploadID)
+		logger.LogIf(ctx, err)
+		return oi, b2ToObjectError(err, bucket, object, uploadID)
 	}
 
 	return l.GetObjectInfo(ctx, bucket, object)
@@ -702,10 +724,15 @@ func (l *b2Objects) CompleteMultipartUpload(ctx context.Context, bucket string,
 // bucketType.AllPublic - bucketTypeReadOnly means that anybody can download the files is the bucket;
 // bucketType.AllPrivate - bucketTypePrivate means that you need an authorization token to download them.
 // Default is AllPrivate for all buckets.
-func (l *b2Objects) SetBucketPolicy(ctx context.Context, bucket string, policyInfo policy.BucketAccessPolicy) error {
-	var policies []minio.BucketAccessPolicy
+func (l *b2Objects) SetBucketPolicy(ctx context.Context, bucket string, bucketPolicy *policy.Policy) error {
+	policyInfo, err := minio.PolicyToBucketAccessPolicy(bucketPolicy)
+	if err != nil {
+		// This should not happen.
+		return b2ToObjectError(err, bucket)
+	}
 
-	for prefix, policy := range policy.GetPolicies(policyInfo.Statements, bucket, "") {
+	var policies []minio.BucketAccessPolicy
+	for prefix, policy := range miniogopolicy.GetPolicies(policyInfo.Statements, bucket, "") {
 		policies = append(policies, minio.BucketAccessPolicy{
 			Prefix: prefix,
 			Policy: policy,
@@ -713,13 +740,16 @@ func (l *b2Objects) SetBucketPolicy(ctx context.Context, bucket string, policyIn
 	}
 	prefix := bucket + "/*" // For all objects inside the bucket.
 	if len(policies) != 1 {
-		return errors.Trace(minio.NotImplemented{})
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return minio.NotImplemented{}
 	}
 	if policies[0].Prefix != prefix {
-		return errors.Trace(minio.NotImplemented{})
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return minio.NotImplemented{}
 	}
-	if policies[0].Policy != policy.BucketPolicyReadOnly {
-		return errors.Trace(minio.NotImplemented{})
+	if policies[0].Policy != miniogopolicy.BucketPolicyReadOnly {
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return minio.NotImplemented{}
 	}
 	bkt, err := l.Bucket(ctx, bucket)
 	if err != nil {
@@ -727,25 +757,45 @@ func (l *b2Objects) SetBucketPolicy(ctx context.Context, bucket string, policyIn
 	}
 	bkt.Type = bucketTypeReadOnly
 	_, err = bkt.Update(l.ctx)
-	return b2ToObjectError(errors.Trace(err))
+	logger.LogIf(ctx, err)
+	return b2ToObjectError(err)
 }
 
 // GetBucketPolicy, returns the current bucketType from B2 backend and convert
 // it into S3 compatible bucket policy info.
-func (l *b2Objects) GetBucketPolicy(ctx context.Context, bucket string) (policy.BucketAccessPolicy, error) {
-	policyInfo := policy.BucketAccessPolicy{Version: "2012-10-17"}
+func (l *b2Objects) GetBucketPolicy(ctx context.Context, bucket string) (*policy.Policy, error) {
 	bkt, err := l.Bucket(ctx, bucket)
 	if err != nil {
-		return policyInfo, err
-	}
-	if bkt.Type == bucketTypeReadOnly {
-		policyInfo.Statements = policy.SetPolicy(policyInfo.Statements, policy.BucketPolicyReadOnly, bucket, "")
-		return policyInfo, nil
+		return nil, err
 	}
+
 	// bkt.Type can also be snapshot, but it is only allowed through B2 browser console,
 	// just return back as policy not found for all cases.
 	// CreateBucket always sets the value to allPrivate by default.
-	return policy.BucketAccessPolicy{}, errors.Trace(minio.PolicyNotFound{Bucket: bucket})
+	if bkt.Type != bucketTypeReadOnly {
+		logger.LogIf(ctx, minio.BucketPolicyNotFound{Bucket: bucket})
+		return nil, minio.BucketPolicyNotFound{Bucket: bucket}
+	}
+
+	return &policy.Policy{
+		Version: policy.DefaultVersion,
+		Statements: []policy.Statement{
+			policy.NewStatement(
+				policy.Allow,
+				policy.NewPrincipal("*"),
+				policy.NewActionSet(
+					policy.GetBucketLocationAction,
+					policy.ListBucketAction,
+					policy.GetObjectAction,
+				),
+				policy.NewResourceSet(
+					policy.NewResource(bucket, ""),
+					policy.NewResource(bucket, "*"),
+				),
+				condition.NewFunctions(),
+			),
+		},
+	}, nil
 }
 
 // DeleteBucketPolicy - resets the bucketType of bucket on B2 to 'allPrivate'.
@@ -756,5 +806,6 @@ func (l *b2Objects) DeleteBucketPolicy(ctx context.Context, bucket string) error
 	}
 	bkt.Type = bucketTypePrivate
 	_, err = bkt.Update(l.ctx)
-	return b2ToObjectError(errors.Trace(err))
+	logger.LogIf(ctx, err)
+	return b2ToObjectError(err)
 }

cmd/gateway/b2/gateway-b2_test.go

@@ -21,7 +21,6 @@ import (
 	"testing"
 
 	b2 "github.com/minio/blazer/base"
-	"github.com/minio/minio/pkg/errors"
 
 	minio "github.com/minio/minio/cmd"
 )
@@ -40,70 +39,70 @@ func TestB2ObjectError(t *testing.T) {
 			[]string{}, fmt.Errorf("Not *Error"), fmt.Errorf("Not *Error"),
 		},
 		{
-			[]string{}, errors.Trace(fmt.Errorf("Non B2 Error")), fmt.Errorf("Non B2 Error"),
+			[]string{}, fmt.Errorf("Non B2 Error"), fmt.Errorf("Non B2 Error"),
 		},
 		{
-			[]string{"bucket"}, errors.Trace(b2.Error{
+			[]string{"bucket"}, b2.Error{
 				StatusCode: 1,
 				Code:       "duplicate_bucket_name",
-			}), minio.BucketAlreadyOwnedByYou{
+			}, minio.BucketAlreadyOwnedByYou{
 				Bucket: "bucket",
 			},
 		},
 		{
-			[]string{"bucket"}, errors.Trace(b2.Error{
+			[]string{"bucket"}, b2.Error{
 				StatusCode: 1,
 				Code:       "bad_request",
-			}), minio.BucketNotFound{
+			}, minio.BucketNotFound{
 				Bucket: "bucket",
 			},
 		},
 		{
-			[]string{"bucket", "object"}, errors.Trace(b2.Error{
+			[]string{"bucket", "object"}, b2.Error{
 				StatusCode: 1,
 				Code:       "bad_request",
-			}), minio.ObjectNameInvalid{
+			}, minio.ObjectNameInvalid{
 				Bucket: "bucket",
 				Object: "object",
 			},
 		},
 		{
-			[]string{"bucket"}, errors.Trace(b2.Error{
+			[]string{"bucket"}, b2.Error{
 				StatusCode: 1,
 				Code:       "bad_bucket_id",
-			}), minio.BucketNotFound{Bucket: "bucket"},
+			}, minio.BucketNotFound{Bucket: "bucket"},
 		},
 		{
-			[]string{"bucket", "object"}, errors.Trace(b2.Error{
+			[]string{"bucket", "object"}, b2.Error{
 				StatusCode: 1,
 				Code:       "file_not_present",
-			}), minio.ObjectNotFound{
+			}, minio.ObjectNotFound{
 				Bucket: "bucket",
 				Object: "object",
 			},
 		},
 		{
-			[]string{"bucket", "object"}, errors.Trace(b2.Error{
+			[]string{"bucket", "object"}, b2.Error{
 				StatusCode: 1,
 				Code:       "not_found",
-			}), minio.ObjectNotFound{
+			}, minio.ObjectNotFound{
 				Bucket: "bucket",
 				Object: "object",
 			},
 		},
 		{
-			[]string{"bucket"}, errors.Trace(b2.Error{
+			[]string{"bucket"}, b2.Error{
 				StatusCode: 1,
 				Code:       "cannot_delete_non_empty_bucket",
-			}), minio.BucketNotEmpty{
+			}, minio.BucketNotEmpty{
 				Bucket: "bucket",
 			},
 		},
 		{
-			[]string{"bucket", "object", "uploadID"}, errors.Trace(b2.Error{
+			[]string{"bucket", "object", "uploadID"}, b2.Error{
 				StatusCode: 1,
 				Message:    "No active upload for",
-			}), minio.InvalidUploadID{
+			}, minio.InvalidUploadID{
 				UploadID: "uploadID",
 			},
 		},

cmd/gateway/gcs/gateway-gcs.go

@@ -33,10 +33,12 @@ import (
 	"cloud.google.com/go/storage"
 	humanize "github.com/dustin/go-humanize"
 	"github.com/minio/cli"
-	"github.com/minio/minio-go/pkg/policy"
+	miniogopolicy "github.com/minio/minio-go/pkg/policy"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
-	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/hash"
+	"github.com/minio/minio/pkg/policy"
+	"github.com/minio/minio/pkg/policy/condition"
 
 	"google.golang.org/api/googleapi"
 	"google.golang.org/api/iterator"
@@ -154,11 +156,13 @@ EXAMPLES:
 func gcsGatewayMain(ctx *cli.Context) {
 	projectID := ctx.Args().First()
 	if projectID == "" && os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") == "" {
-		minio.ErrorIf(errGCSProjectIDNotFound, "project-id should be provided as argument or GOOGLE_APPLICATION_CREDENTIALS should be set with path to credentials.json")
+		logger.LogIf(context.Background(), errGCSProjectIDNotFound)
 		cli.ShowCommandHelpAndExit(ctx, "gcs", 1)
 	}
 	if projectID != "" && !isValidGCSProjectIDFormat(projectID) {
-		minio.ErrorIf(errGCSInvalidProjectID, "Unable to start GCS gateway with %s", ctx.Args().First())
+		reqInfo := (&logger.ReqInfo{}).AppendTags("projectID", ctx.Args().First())
+		contxt := logger.SetReqInfo(context.Background(), reqInfo)
+		logger.LogIf(contxt, errGCSInvalidProjectID)
 		cli.ShowCommandHelpAndExit(ctx, "gcs", 1)
 	}
 
@@ -208,9 +212,9 @@ func (g *GCS) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, error)
 	return gcs, nil
 }
 
-// Production - FIXME: GCS is not production ready yet.
+// Production - GCS gateway is production ready.
 func (g *GCS) Production() bool {
-	return false
+	return true
 }
 
 // Stored in gcs.json - Contents of this file is not used anywhere. It can be
@@ -237,16 +241,6 @@ func gcsToObjectError(err error, params ...string) error {
 		return nil
 	}
 
-	e, ok := err.(*errors.Error)
-	if !ok {
-		// Code should be fixed if this function is called without doing errors.Trace()
-		// Else handling different situations in this function makes this function complicated.
-		minio.ErrorIf(err, "Expected type *Error")
-		return err
-	}
-
-	err = e.Cause
-
 	bucket := ""
 	object := ""
 	uploadID := ""
@@ -266,8 +260,7 @@ func gcsToObjectError(err error, params ...string) error {
 		err = minio.BucketNotFound{
 			Bucket: bucket,
 		}
-		e.Cause = err
-		return e
+		return err
 	case "storage: object doesn't exist":
 		if uploadID != "" {
 			err = minio.InvalidUploadID{
@@ -279,21 +272,18 @@ func gcsToObjectError(err error, params ...string) error {
 				Object: object,
 			}
 		}
-		e.Cause = err
-		return e
+		return err
 	}
 
 	googleAPIErr, ok := err.(*googleapi.Error)
 	if !ok {
 		// We don't interpret non Minio errors. As minio errors will
 		// have StatusCode to help to convert to object errors.
-		e.Cause = err
-		return e
+		return err
 	}
 
 	if len(googleAPIErr.Errors) == 0 {
-		e.Cause = err
-		return e
+		return err
 	}
 
 	reason := googleAPIErr.Errors[0].Reason
@@ -337,8 +327,7 @@ func gcsToObjectError(err error, params ...string) error {
 		err = fmt.Errorf("Unsupported error reason: %s", reason)
 	}
 
-	e.Cause = err
-	return e
+	return err
 }
 
 // gcsProjectIDRegex defines a valid gcs project id format
@@ -381,7 +370,9 @@ func (l *gcsGateway) CleanupGCSMinioSysTmpBucket(bucket string) {
 		attrs, err := it.Next()
 		if err != nil {
 			if err != iterator.Done {
-				minio.ErrorIf(err, "Object listing error on bucket %s during purging of old files in minio.sys.tmp", bucket)
+				reqInfo := &logger.ReqInfo{BucketName: bucket}
+				ctx := logger.SetReqInfo(context.Background(), reqInfo)
+				logger.LogIf(ctx, err)
 			}
 			return
 		}
@@ -389,7 +380,9 @@ func (l *gcsGateway) CleanupGCSMinioSysTmpBucket(bucket string) {
 			// Delete files older than 2 weeks.
 			err := l.client.Bucket(bucket).Object(attrs.Name).Delete(l.ctx)
 			if err != nil {
-				minio.ErrorIf(err, "Unable to delete %s/%s during purging of old files in minio.sys.tmp", bucket, attrs.Name)
+				reqInfo := &logger.ReqInfo{BucketName: bucket, ObjectName: attrs.Name}
+				ctx := logger.SetReqInfo(context.Background(), reqInfo)
+				logger.LogIf(ctx, err)
 				return
 			}
 		}
@@ -404,7 +397,8 @@ func (l *gcsGateway) CleanupGCSMinioSysTmp() {
 			attrs, err := it.Next()
 			if err != nil {
 				if err != iterator.Done {
-					minio.ErrorIf(err, "Bucket listing error during purging of old files in minio.sys.tmp")
+					ctx := logger.SetReqInfo(context.Background(), &logger.ReqInfo{})
+					logger.LogIf(ctx, err)
 				}
 				break
 			}
@@ -438,15 +432,16 @@ func (l *gcsGateway) MakeBucketWithLocation(ctx context.Context, bucket, locatio
 	err := bkt.Create(l.ctx, l.projectID, &storage.BucketAttrs{
 		Location: location,
 	})
-
-	return gcsToObjectError(errors.Trace(err), bucket)
+	logger.LogIf(ctx, err)
+	return gcsToObjectError(err, bucket)
 }
 
 // GetBucketInfo - Get bucket metadata..
 func (l *gcsGateway) GetBucketInfo(ctx context.Context, bucket string) (minio.BucketInfo, error) {
 	attrs, err := l.client.Bucket(bucket).Attrs(l.ctx)
 	if err != nil {
-		return minio.BucketInfo{}, gcsToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return minio.BucketInfo{}, gcsToObjectError(err, bucket)
 	}
 
 	return minio.BucketInfo{
@@ -467,7 +462,8 @@ func (l *gcsGateway) ListBuckets(ctx context.Context) (buckets []minio.BucketInf
 		}
 
 		if ierr != nil {
-			return buckets, gcsToObjectError(errors.Trace(ierr))
+			logger.LogIf(ctx, ierr)
+			return buckets, gcsToObjectError(ierr)
 		}
 
 		buckets = append(buckets, minio.BucketInfo{
@@ -495,7 +491,8 @@ func (l *gcsGateway) DeleteBucket(ctx context.Context, bucket string) error {
 			break
 		}
 		if err != nil {
-			return gcsToObjectError(errors.Trace(err))
+			logger.LogIf(ctx, err)
+			return gcsToObjectError(err)
 		}
 		if objAttrs.Prefix == minio.GatewayMinioSysTmp {
 			gcsMinioPathFound = true
@@ -505,7 +502,8 @@ func (l *gcsGateway) DeleteBucket(ctx context.Context, bucket string) error {
 		break
 	}
 	if nonGCSMinioPathFound {
-		return gcsToObjectError(errors.Trace(minio.BucketNotEmpty{}))
+		logger.LogIf(ctx, minio.BucketNotEmpty{})
+		return gcsToObjectError(minio.BucketNotEmpty{})
 	}
 	if gcsMinioPathFound {
 		// Remove minio.sys.tmp before deleting the bucket.
@@ -516,16 +514,19 @@ func (l *gcsGateway) DeleteBucket(ctx context.Context, bucket string) error {
 				break
 			}
 			if err != nil {
-				return gcsToObjectError(errors.Trace(err))
+				logger.LogIf(ctx, err)
+				return gcsToObjectError(err)
 			}
 			err = l.client.Bucket(bucket).Object(objAttrs.Name).Delete(l.ctx)
 			if err != nil {
-				return gcsToObjectError(errors.Trace(err))
+				logger.LogIf(ctx, err)
+				return gcsToObjectError(err)
 			}
 		}
 	}
 	err := l.client.Bucket(bucket).Delete(l.ctx)
-	return gcsToObjectError(errors.Trace(err), bucket)
+	logger.LogIf(ctx, err)
+	return gcsToObjectError(err, bucket)
 }
 
 func toGCSPageToken(name string) string {
@@ -571,8 +572,8 @@ func (l *gcsGateway) ListObjects(ctx context.Context, bucket string, prefix stri
 	// supplied markers.
 	//
 	// - NextMarker in ListObjectsV1 response is constructed by
-	//   prefixing "##minio" to the GCS continuation token,
-	//   e.g, "##minioCgRvYmoz"
+	//   prefixing "{minio}" to the GCS continuation token,
+	//   e.g, "{minio}CgRvYmoz"
 	//
 	// - Application supplied markers are used as-is to list
 	//   object keys that appear after it in the lexicographical order.
@@ -607,7 +608,8 @@ func (l *gcsGateway) ListObjects(ctx context.Context, bucket string, prefix stri
 			break
 		}
 		if err != nil {
-			return minio.ListObjectsInfo{}, gcsToObjectError(errors.Trace(err), bucket, prefix)
+			logger.LogIf(ctx, err)
+			return minio.ListObjectsInfo{}, gcsToObjectError(err, bucket, prefix)
 		}
 
 		nextMarker = toGCSPageToken(attrs.Name)
@@ -689,7 +691,8 @@ func (l *gcsGateway) ListObjectsV2(ctx context.Context, bucket, prefix, continua
 		}
 
 		if err != nil {
-			return minio.ListObjectsV2Info{}, gcsToObjectError(errors.Trace(err), bucket, prefix)
+			logger.LogIf(ctx, err)
+			return minio.ListObjectsV2Info{}, gcsToObjectError(err, bucket, prefix)
 		}
 
 		if attrs.Prefix == minio.GatewayMinioSysTmp {
@@ -733,18 +736,21 @@ func (l *gcsGateway) GetObject(ctx context.Context, bucket string, key string, s
 	// if we want to mimic S3 behavior exactly, we need to verify if bucket exists first,
 	// otherwise gcs will just return object not exist in case of non-existing bucket
 	if _, err := l.client.Bucket(bucket).Attrs(l.ctx); err != nil {
-		return gcsToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return gcsToObjectError(err, bucket)
 	}
 
 	object := l.client.Bucket(bucket).Object(key)
 	r, err := object.NewRangeReader(l.ctx, startOffset, length)
 	if err != nil {
-		return gcsToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return gcsToObjectError(err, bucket, key)
 	}
 	defer r.Close()
 
 	if _, err := io.Copy(writer, r); err != nil {
-		return gcsToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return gcsToObjectError(err, bucket, key)
 	}
 
 	return nil
@@ -754,29 +760,70 @@ func (l *gcsGateway) GetObject(ctx context.Context, bucket string, key string, s
 func fromGCSAttrsToObjectInfo(attrs *storage.ObjectAttrs) minio.ObjectInfo {
 	// All google cloud storage objects have a CRC32c hash, whereas composite objects may not have a MD5 hash
 	// Refer https://cloud.google.com/storage/docs/hashes-etags. Use CRC32C for ETag
+	metadata := make(map[string]string)
+	for k, v := range attrs.Metadata {
+		metadata[k] = v
+	}
+	if attrs.ContentType != "" {
+		metadata["content-type"] = attrs.ContentType
+	}
+	if attrs.ContentEncoding != "" {
+		metadata["content-encoding"] = attrs.ContentEncoding
+	}
+	if attrs.CacheControl != "" {
+		metadata["cache-control"] = attrs.CacheControl
+	}
+	if attrs.ContentDisposition != "" {
+		metadata["content-disposition"] = attrs.ContentDisposition
+	}
+	if attrs.ContentLanguage != "" {
+		metadata["content-language"] = attrs.ContentLanguage
+	}
 	return minio.ObjectInfo{
 		Name:            attrs.Name,
 		Bucket:          attrs.Bucket,
 		ModTime:         attrs.Updated,
 		Size:            attrs.Size,
 		ETag:            minio.ToS3ETag(fmt.Sprintf("%d", attrs.CRC32C)),
-		UserDefined:     attrs.Metadata,
+		UserDefined:     metadata,
 		ContentType:     attrs.ContentType,
 		ContentEncoding: attrs.ContentEncoding,
 	}
 }
 
+// applyMetadataToGCSAttrs applies metadata to a GCS ObjectAttrs instance
+func applyMetadataToGCSAttrs(metadata map[string]string, attrs *storage.ObjectAttrs) {
+	attrs.ContentType = metadata["content-type"]
+	attrs.ContentEncoding = metadata["content-encoding"]
+	attrs.CacheControl = metadata["cache-control"]
+	attrs.ContentDisposition = metadata["content-disposition"]
+	attrs.ContentLanguage = metadata["content-language"]
+
+	attrs.Metadata = make(map[string]string)
+	for k, v := range metadata {
+		attrs.Metadata[k] = v
+	}
+	// Filter metadata which is stored as a unique attribute
+	for _, key := range []string{
+		"content-type", "content-encoding", "cache-control", "content-disposition", "content-language",
+	} {
+		delete(attrs.Metadata, key)
+	}
+}
+
 // GetObjectInfo - reads object info and replies back ObjectInfo
 func (l *gcsGateway) GetObjectInfo(ctx context.Context, bucket string, object string) (minio.ObjectInfo, error) {
 	// if we want to mimic S3 behavior exactly, we need to verify if bucket exists first,
 	// otherwise gcs will just return object not exist in case of non-existing bucket
 	if _, err := l.client.Bucket(bucket).Attrs(l.ctx); err != nil {
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return minio.ObjectInfo{}, gcsToObjectError(err, bucket)
 	}
 
 	attrs, err := l.client.Bucket(bucket).Object(object).Attrs(l.ctx)
 	if err != nil {
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, object)
 	}
 
 	return fromGCSAttrsToObjectInfo(attrs), nil
@@ -787,21 +834,25 @@ func (l *gcsGateway) PutObject(ctx context.Context, bucket string, key string, d
 	// if we want to mimic S3 behavior exactly, we need to verify if bucket exists first,
 	// otherwise gcs will just return object not exist in case of non-existing bucket
 	if _, err := l.client.Bucket(bucket).Attrs(l.ctx); err != nil {
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return minio.ObjectInfo{}, gcsToObjectError(err, bucket)
 	}
 
 	object := l.client.Bucket(bucket).Object(key)
 
 	w := object.NewWriter(l.ctx)
-
-	w.ContentType = metadata["content-type"]
-	w.ContentEncoding = metadata["content-encoding"]
-	w.Metadata = metadata
+	// Disable "chunked" uploading in GCS client if the size of the data to be uploaded is below
+	// the current chunk-size of the writer. This avoids an unnecessary memory allocation.
+	if data.Size() < int64(w.ChunkSize) {
+		w.ChunkSize = 0
+	}
+	applyMetadataToGCSAttrs(metadata, &w.ObjectAttrs)
 
 	if _, err := io.Copy(w, data); err != nil {
 		// Close the object writer upon error.
 		w.CloseWithError(err)
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key)
 	}
 
 	// Close the object writer upon success.
@@ -809,7 +860,8 @@ func (l *gcsGateway) PutObject(ctx context.Context, bucket string, key string, d
 
 	attrs, err := object.Attrs(l.ctx)
 	if err != nil {
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key)
 	}
 
 	return fromGCSAttrsToObjectInfo(attrs), nil
@@ -823,11 +875,12 @@ func (l *gcsGateway) CopyObject(ctx context.Context, srcBucket string, srcObject
 	dst := l.client.Bucket(destBucket).Object(destObject)
 
 	copier := dst.CopierFrom(src)
-	copier.ObjectAttrs.Metadata = srcInfo.UserDefined
+	applyMetadataToGCSAttrs(srcInfo.UserDefined, &copier.ObjectAttrs)
 
 	attrs, err := copier.Run(l.ctx)
 	if err != nil {
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), destBucket, destObject)
+		logger.LogIf(ctx, err)
+		return minio.ObjectInfo{}, gcsToObjectError(err, destBucket, destObject)
 	}
 
 	return fromGCSAttrsToObjectInfo(attrs), nil
@@ -837,7 +890,8 @@ func (l *gcsGateway) CopyObject(ctx context.Context, srcBucket string, srcObject
 func (l *gcsGateway) DeleteObject(ctx context.Context, bucket string, object string) error {
 	err := l.client.Bucket(bucket).Object(object).Delete(l.ctx)
 	if err != nil {
-		return gcsToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return gcsToObjectError(err, bucket, object)
 	}
 
 	return nil
@@ -854,16 +908,15 @@ func (l *gcsGateway) NewMultipartUpload(ctx context.Context, bucket string, key
 	w := l.client.Bucket(bucket).Object(meta).NewWriter(l.ctx)
 	defer w.Close()
 
-	w.ContentType = metadata["content-type"]
-	w.ContentEncoding = metadata["content-encoding"]
-	w.Metadata = metadata
+	applyMetadataToGCSAttrs(metadata, &w.ObjectAttrs)
 
 	if err = json.NewEncoder(w).Encode(gcsMultipartMetaV1{
 		gcsMinioMultipartMetaCurrentVersion,
 		bucket,
 		key,
 	}); err != nil {
-		return "", gcsToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return "", gcsToObjectError(err, bucket, key)
 	}
 	return uploadID, nil
 }
@@ -883,7 +936,8 @@ func (l *gcsGateway) ListMultipartUploads(ctx context.Context, bucket string, pr
 // an object layer compatible error upon any error.
 func (l *gcsGateway) checkUploadIDExists(ctx context.Context, bucket string, key string, uploadID string) error {
 	_, err := l.client.Bucket(bucket).Object(gcsMultipartMetaName(uploadID)).Attrs(l.ctx)
-	return gcsToObjectError(errors.Trace(err), bucket, key, uploadID)
+	logger.LogIf(ctx, err)
+	return gcsToObjectError(err, bucket, key, uploadID)
 }
 
 // PutObjectPart puts a part of object in bucket
@@ -904,7 +958,8 @@ func (l *gcsGateway) PutObjectPart(ctx context.Context, bucket string, key strin
 	if _, err := io.Copy(w, data); err != nil {
 		// Make sure to close object writer upon error.
 		w.Close()
-		return minio.PartInfo{}, gcsToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return minio.PartInfo{}, gcsToObjectError(err, bucket, key)
 	}
 	// Make sure to close the object writer upon success.
 	w.Close()
@@ -923,7 +978,7 @@ func (l *gcsGateway) ListObjectParts(ctx context.Context, bucket string, key str
 }
 
 // Called by AbortMultipartUpload and CompleteMultipartUpload for cleaning up.
-func (l *gcsGateway) cleanupMultipartUpload(bucket, key, uploadID string) error {
+func (l *gcsGateway) cleanupMultipartUpload(ctx context.Context, bucket, key, uploadID string) error {
 	prefix := fmt.Sprintf("%s/%s/", gcsMinioMultipartPathV1, uploadID)
 
 	// iterate through all parts and delete them
@@ -935,7 +990,8 @@ func (l *gcsGateway) cleanupMultipartUpload(bucket, key, uploadID string) error
 			break
 		}
 		if err != nil {
-			return gcsToObjectError(errors.Trace(err), bucket, key)
+			logger.LogIf(ctx, err)
+			return gcsToObjectError(err, bucket, key)
 		}
 
 		object := l.client.Bucket(bucket).Object(attrs.Name)
@@ -951,7 +1007,7 @@ func (l *gcsGateway) AbortMultipartUpload(ctx context.Context, bucket string, ke
 	if err := l.checkUploadIDExists(ctx, bucket, key, uploadID); err != nil {
 		return err
 	}
-	return l.cleanupMultipartUpload(bucket, key, uploadID)
+	return l.cleanupMultipartUpload(ctx, bucket, key, uploadID)
 }
 
 // CompleteMultipartUpload completes ongoing multipart upload and finalizes object
@@ -968,23 +1024,27 @@ func (l *gcsGateway) CompleteMultipartUpload(ctx context.Context, bucket string,
 
 	partZeroAttrs, err := object.Attrs(l.ctx)
 	if err != nil {
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), bucket, key, uploadID)
+		logger.LogIf(ctx, err)
+		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key, uploadID)
 	}
 
 	r, err := object.NewReader(l.ctx)
 	if err != nil {
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key)
 	}
 	defer r.Close()
 
 	// Check version compatibility of the meta file before compose()
 	multipartMeta := gcsMultipartMetaV1{}
 	if err = json.NewDecoder(r).Decode(&multipartMeta); err != nil {
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key)
 	}
 
 	if multipartMeta.Version != gcsMinioMultipartMetaCurrentVersion {
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(errGCSFormat), bucket, key)
+		logger.LogIf(ctx, errGCSFormat)
+		return minio.ObjectInfo{}, gcsToObjectError(errGCSFormat, bucket, key)
 	}
 
 	// Validate if the gcs.json stores valid entries for the bucket and key.
@@ -1001,7 +1061,8 @@ func (l *gcsGateway) CompleteMultipartUpload(ctx context.Context, bucket string,
 			uploadedPart.PartNumber, uploadedPart.ETag)))
 		partAttr, pErr := l.client.Bucket(bucket).Object(gcsMultipartDataName(uploadID, uploadedPart.PartNumber, uploadedPart.ETag)).Attrs(l.ctx)
 		if pErr != nil {
-			return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(pErr), bucket, key, uploadID)
+			logger.LogIf(ctx, pErr)
+			return minio.ObjectInfo{}, gcsToObjectError(pErr, bucket, key, uploadID)
 		}
 		partSizes[i] = partAttr.Size
 	}
@@ -1009,11 +1070,16 @@ func (l *gcsGateway) CompleteMultipartUpload(ctx context.Context, bucket string,
 	// Error out if parts except last part sizing < 5MiB.
 	for i, size := range partSizes[:len(partSizes)-1] {
 		if size < 5*humanize.MiByte {
-			return minio.ObjectInfo{}, errors.Trace(minio.PartTooSmall{
+			logger.LogIf(ctx, minio.PartTooSmall{
 				PartNumber: uploadedParts[i].PartNumber,
 				PartSize:   size,
 				PartETag:   uploadedParts[i].ETag,
 			})
+			return minio.ObjectInfo{}, minio.PartTooSmall{
+				PartNumber: uploadedParts[i].PartNumber,
+				PartSize:   size,
+				PartETag:   uploadedParts[i].ETag,
+			}
 		}
 	}
 
@@ -1040,7 +1106,8 @@ func (l *gcsGateway) CompleteMultipartUpload(ctx context.Context, bucket string,
 			composer.Metadata = partZeroAttrs.Metadata
 
 			if _, err = composer.Run(l.ctx); err != nil {
-				return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), bucket, key)
+				logger.LogIf(ctx, err)
+				return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key)
 			}
 		}
 
@@ -1050,22 +1117,33 @@ func (l *gcsGateway) CompleteMultipartUpload(ctx context.Context, bucket string,
 
 	composer := l.client.Bucket(bucket).Object(key).ComposerFrom(parts...)
 	composer.ContentType = partZeroAttrs.ContentType
+	composer.ContentEncoding = partZeroAttrs.ContentEncoding
+	composer.CacheControl = partZeroAttrs.CacheControl
+	composer.ContentDisposition = partZeroAttrs.ContentDisposition
+	composer.ContentLanguage = partZeroAttrs.ContentLanguage
 	composer.Metadata = partZeroAttrs.Metadata
 	attrs, err := composer.Run(l.ctx)
 	if err != nil {
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key)
 	}
-	if err = l.cleanupMultipartUpload(bucket, key, uploadID); err != nil {
-		return minio.ObjectInfo{}, gcsToObjectError(errors.Trace(err), bucket, key)
+	if err = l.cleanupMultipartUpload(ctx, bucket, key, uploadID); err != nil {
+		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key)
 	}
 	return fromGCSAttrsToObjectInfo(attrs), nil
 }
 
 // SetBucketPolicy - Set policy on bucket
-func (l *gcsGateway) SetBucketPolicy(ctx context.Context, bucket string, policyInfo policy.BucketAccessPolicy) error {
-	var policies []minio.BucketAccessPolicy
+func (l *gcsGateway) SetBucketPolicy(ctx context.Context, bucket string, bucketPolicy *policy.Policy) error {
+	policyInfo, err := minio.PolicyToBucketAccessPolicy(bucketPolicy)
+	if err != nil {
+		// This should not happen.
+		logger.LogIf(ctx, err)
+		return gcsToObjectError(err, bucket)
+	}
 
-	for prefix, policy := range policy.GetPolicies(policyInfo.Statements, bucket, "") {
+	var policies []minio.BucketAccessPolicy
+	for prefix, policy := range miniogopolicy.GetPolicies(policyInfo.Statements, bucket, "") {
 		policies = append(policies, minio.BucketAccessPolicy{
 			Prefix: prefix,
 			Policy: policy,
@@ -1075,67 +1153,108 @@ func (l *gcsGateway) SetBucketPolicy(ctx context.Context, bucket string, policyI
 	prefix := bucket + "/*" // For all objects inside the bucket.
 
 	if len(policies) != 1 {
-		return errors.Trace(minio.NotImplemented{})
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return minio.NotImplemented{}
 	}
 	if policies[0].Prefix != prefix {
-		return errors.Trace(minio.NotImplemented{})
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return minio.NotImplemented{}
 	}
 
 	acl := l.client.Bucket(bucket).ACL()
-	if policies[0].Policy == policy.BucketPolicyNone {
+	if policies[0].Policy == miniogopolicy.BucketPolicyNone {
 		if err := acl.Delete(l.ctx, storage.AllUsers); err != nil {
-			return gcsToObjectError(errors.Trace(err), bucket)
+			logger.LogIf(ctx, err)
+			return gcsToObjectError(err, bucket)
 		}
 		return nil
 	}
 
 	var role storage.ACLRole
 	switch policies[0].Policy {
-	case policy.BucketPolicyReadOnly:
+	case miniogopolicy.BucketPolicyReadOnly:
 		role = storage.RoleReader
-	case policy.BucketPolicyWriteOnly:
+	case miniogopolicy.BucketPolicyWriteOnly:
 		role = storage.RoleWriter
 	default:
-		return errors.Trace(minio.NotImplemented{})
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return minio.NotImplemented{}
 	}
 
 	if err := acl.Set(l.ctx, storage.AllUsers, role); err != nil {
-		return gcsToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return gcsToObjectError(err, bucket)
 	}
 
 	return nil
 }
 
 // GetBucketPolicy - Get policy on bucket
-func (l *gcsGateway) GetBucketPolicy(ctx context.Context, bucket string) (policy.BucketAccessPolicy, error) {
+func (l *gcsGateway) GetBucketPolicy(ctx context.Context, bucket string) (*policy.Policy, error) {
 	rules, err := l.client.Bucket(bucket).ACL().List(l.ctx)
 	if err != nil {
-		return policy.BucketAccessPolicy{}, gcsToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return nil, gcsToObjectError(err, bucket)
 	}
-	policyInfo := policy.BucketAccessPolicy{Version: "2012-10-17"}
+
+	var readOnly, writeOnly bool
 	for _, r := range rules {
 		if r.Entity != storage.AllUsers || r.Role == storage.RoleOwner {
 			continue
 		}
+
 		switch r.Role {
 		case storage.RoleReader:
-			policyInfo.Statements = policy.SetPolicy(policyInfo.Statements, policy.BucketPolicyReadOnly, bucket, "")
+			readOnly = true
 		case storage.RoleWriter:
-			policyInfo.Statements = policy.SetPolicy(policyInfo.Statements, policy.BucketPolicyWriteOnly, bucket, "")
+			writeOnly = true
 		}
 	}
-	// Return NoSuchBucketPolicy error, when policy is not set
-	if len(policyInfo.Statements) == 0 {
-		return policy.BucketAccessPolicy{}, gcsToObjectError(errors.Trace(minio.PolicyNotFound{}), bucket)
+
+	actionSet := policy.NewActionSet()
+	if readOnly {
+		actionSet.Add(policy.GetBucketLocationAction)
+		actionSet.Add(policy.ListBucketAction)
+		actionSet.Add(policy.GetObjectAction)
 	}
-	return policyInfo, nil
+	if writeOnly {
+		actionSet.Add(policy.GetBucketLocationAction)
+		actionSet.Add(policy.ListBucketMultipartUploadsAction)
+		actionSet.Add(policy.AbortMultipartUploadAction)
+		actionSet.Add(policy.DeleteObjectAction)
+		actionSet.Add(policy.ListMultipartUploadPartsAction)
+		actionSet.Add(policy.PutObjectAction)
+	}
+
+	// Return NoSuchBucketPolicy error, when policy is not set
+	if len(actionSet) == 0 {
+		logger.LogIf(ctx, minio.BucketPolicyNotFound{})
+		return nil, gcsToObjectError(minio.BucketPolicyNotFound{}, bucket)
+	}
+
+	return &policy.Policy{
+		Version: policy.DefaultVersion,
+		Statements: []policy.Statement{
+			policy.NewStatement(
+				policy.Allow,
+				policy.NewPrincipal("*"),
+				actionSet,
+				policy.NewResourceSet(
+					policy.NewResource(bucket, ""),
+					policy.NewResource(bucket, "*"),
+				),
+				condition.NewFunctions(),
+			),
+		},
+	}, nil
 }
 
 // DeleteBucketPolicy - Delete all policies on bucket
 func (l *gcsGateway) DeleteBucketPolicy(ctx context.Context, bucket string) error {
 	// This only removes the storage.AllUsers policies
 	if err := l.client.Bucket(bucket).ACL().Delete(l.ctx, storage.AllUsers); err != nil {
-		return gcsToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return gcsToObjectError(err, bucket)
 	}
 
 	return nil

cmd/gateway/gcs/gateway-gcs_test.go

@@ -24,7 +24,6 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/minio/minio/pkg/errors"
 	"google.golang.org/api/googleapi"
 
 	miniogo "github.com/minio/minio-go"
@@ -237,14 +236,14 @@ func TestGCSToObjectError(t *testing.T) {
 		},
 		{
 			[]string{"bucket"},
-			errors.Trace(fmt.Errorf("storage: bucket doesn't exist")),
+			fmt.Errorf("storage: bucket doesn't exist"),
 			minio.BucketNotFound{
 				Bucket: "bucket",
 			},
 		},
 		{
 			[]string{"bucket", "object"},
-			errors.Trace(fmt.Errorf("storage: object doesn't exist")),
+			fmt.Errorf("storage: object doesn't exist"),
 			minio.ObjectNotFound{
 				Bucket: "bucket",
 				Object: "object",
@@ -252,76 +251,76 @@ func TestGCSToObjectError(t *testing.T) {
 		},
 		{
 			[]string{"bucket", "object", "uploadID"},
-			errors.Trace(fmt.Errorf("storage: object doesn't exist")),
+			fmt.Errorf("storage: object doesn't exist"),
 			minio.InvalidUploadID{
 				UploadID: "uploadID",
 			},
 		},
 		{
 			[]string{},
-			errors.Trace(fmt.Errorf("Unknown error")),
+			fmt.Errorf("Unknown error"),
 			fmt.Errorf("Unknown error"),
 		},
 		{
 			[]string{"bucket", "object"},
-			errors.Trace(&googleapi.Error{
+			&googleapi.Error{
 				Message: "No list of errors",
-			}),
+			},
 			&googleapi.Error{
 				Message: "No list of errors",
 			},
 		},
 		{
 			[]string{"bucket", "object"},
-			errors.Trace(&googleapi.Error{
+			&googleapi.Error{
 				Errors: []googleapi.ErrorItem{{
 					Reason:  "conflict",
 					Message: "You already own this bucket. Please select another name.",
 				}},
-			}),
+			},
 			minio.BucketAlreadyOwnedByYou{
 				Bucket: "bucket",
 			},
 		},
 		{
 			[]string{"bucket", "object"},
-			errors.Trace(&googleapi.Error{
+			&googleapi.Error{
 				Errors: []googleapi.ErrorItem{{
 					Reason:  "conflict",
 					Message: "Sorry, that name is not available. Please try a different one.",
 				}},
-			}),
+			},
 			minio.BucketAlreadyExists{
 				Bucket: "bucket",
 			},
 		},
 		{
 			[]string{"bucket", "object"},
-			errors.Trace(&googleapi.Error{
+			&googleapi.Error{
 				Errors: []googleapi.ErrorItem{{
 					Reason: "conflict",
 				}},
-			}),
+			},
 			minio.BucketNotEmpty{Bucket: "bucket"},
 		},
 		{
 			[]string{"bucket"},
-			errors.Trace(&googleapi.Error{
+			&googleapi.Error{
 				Errors: []googleapi.ErrorItem{{
 					Reason: "notFound",
 				}},
-			}),
+			},
 			minio.BucketNotFound{
 				Bucket: "bucket",
 			},
 		},
 		{
 			[]string{"bucket", "object"},
-			errors.Trace(&googleapi.Error{
+			&googleapi.Error{
 				Errors: []googleapi.ErrorItem{{
 					Reason: "notFound",
 				}},
-			}),
+			},
 			minio.ObjectNotFound{
 				Bucket: "bucket",
 				Object: "object",
@@ -329,22 +328,22 @@ func TestGCSToObjectError(t *testing.T) {
 		},
 		{
 			[]string{"bucket"},
-			errors.Trace(&googleapi.Error{
+			&googleapi.Error{
 				Errors: []googleapi.ErrorItem{{
 					Reason: "invalid",
 				}},
-			}),
+			},
 			minio.BucketNameInvalid{
 				Bucket: "bucket",
 			},
 		},
 		{
 			[]string{"bucket", "object"},
-			errors.Trace(&googleapi.Error{
+			&googleapi.Error{
 				Errors: []googleapi.ErrorItem{{
 					Reason: "forbidden",
 				}},
-			}),
+			},
 			minio.PrefixAccessDenied{
 				Bucket: "bucket",
 				Object: "object",
@@ -352,11 +351,11 @@ func TestGCSToObjectError(t *testing.T) {
 		},
 		{
 			[]string{"bucket", "object"},
-			errors.Trace(&googleapi.Error{
+			&googleapi.Error{
 				Errors: []googleapi.ErrorItem{{
 					Reason: "keyInvalid",
 				}},
-			}),
+			},
 			minio.PrefixAccessDenied{
 				Bucket: "bucket",
 				Object: "object",
@@ -364,11 +363,11 @@ func TestGCSToObjectError(t *testing.T) {
 		},
 		{
 			[]string{"bucket", "object"},
-			errors.Trace(&googleapi.Error{
+			&googleapi.Error{
 				Errors: []googleapi.ErrorItem{{
 					Reason: "required",
 				}},
-			}),
+			},
 			minio.PrefixAccessDenied{
 				Bucket: "bucket",
 				Object: "object",
@@ -376,11 +375,11 @@ func TestGCSToObjectError(t *testing.T) {
 		},
 		{
 			[]string{"bucket", "object"},
-			errors.Trace(&googleapi.Error{
+			&googleapi.Error{
 				Errors: []googleapi.ErrorItem{{
 					Reason: "unknown",
 				}},
-			}),
+			},
 			fmt.Errorf("Unsupported error reason: unknown"),
 		},
 	}

cmd/gateway/manta/gateway-manta.go

@@ -33,8 +33,8 @@ import (
 	"github.com/joyent/triton-go/storage"
 	"github.com/minio/cli"
 	minio "github.com/minio/minio/cmd"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
-	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/hash"
 )
 
@@ -118,7 +118,7 @@ func mantaGatewayMain(ctx *cli.Context) {
 	// Validate gateway arguments.
 	host := ctx.Args().First()
 	// Validate gateway arguments.
-	minio.FatalIf(minio.ValidateGatewayArguments(ctx.GlobalString("address"), host), "Invalid argument")
+	logger.FatalIf(minio.ValidateGatewayArguments(ctx.GlobalString("address"), host), "Invalid argument")
 
 	minio.StartGateway(ctx, &Manta{host})
 }
@@ -139,6 +139,7 @@ func (g *Manta) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, erro
 	var err error
 	var signer authentication.Signer
 	var endpoint = defaultMantaURL
+	ctx := context.Background()
 
 	if g.host != "" {
 		endpoint, _, err = minio.ParseGatewayEndpoint(g.host)
@@ -163,7 +164,8 @@ func (g *Manta) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, erro
 		}
 		signer, err = authentication.NewSSHAgentSigner(input)
 		if err != nil {
-			return nil, errors.Trace(err)
+			logger.LogIf(ctx, err)
+			return nil, err
 		}
 	} else {
 		var keyBytes []byte
@@ -200,7 +202,8 @@ func (g *Manta) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, erro
 
 		signer, err = authentication.NewPrivateKeySigner(input)
 		if err != nil {
-			return nil, errors.Trace(err)
+			logger.LogIf(ctx, err)
+			return nil, err
 		}
 	}
 
@@ -222,9 +225,9 @@ func (g *Manta) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, erro
 	}, nil
 }
 
-// Production - Manta is not production ready.
+// Production - Manta is production ready.
 func (g *Manta) Production() bool {
-	return false
+	return true
 }
 
 // tritonObjects - Implements Object layer for Triton Manta storage
@@ -352,7 +355,8 @@ func (t *tritonObjects) ListObjects(ctx context.Context, bucket, prefix, marker,
 		if terrors.IsResourceNotFoundError(err) {
 			return result, nil
 		}
-		return result, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return result, err
 	}
 
 	for _, obj := range objs.Entries {
@@ -362,7 +366,8 @@ func (t *tritonObjects) ListObjects(ctx context.Context, bucket, prefix, marker,
 			input.DirectoryName = path.Join(mantaRoot, bucket, prefix)
 			objs, err = t.client.Dir().List(ctx, input)
 			if err != nil {
-				return result, errors.Trace(err)
+				logger.LogIf(ctx, err)
+				return result, err
 			}
 			break
 		}
@@ -428,7 +433,8 @@ func (t *tritonObjects) ListObjectsV2(ctx context.Context, bucket, prefix, conti
 		if terrors.IsResourceNotFoundError(err) {
 			return result, nil
 		}
-		return result, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return result, err
 	}
 
 	for _, obj := range objs.Entries {
@@ -436,7 +442,8 @@ func (t *tritonObjects) ListObjectsV2(ctx context.Context, bucket, prefix, conti
 			input.DirectoryName = path.Join(mantaRoot, bucket, prefix)
 			objs, err = t.client.Dir().List(ctx, input)
 			if err != nil {
-				return result, errors.Trace(err)
+				logger.LogIf(ctx, err)
+				return result, err
 			}
 			break
 		}
@@ -479,7 +486,8 @@ func (t *tritonObjects) ListObjectsV2(ctx context.Context, bucket, prefix, conti
 func (t *tritonObjects) GetObject(ctx context.Context, bucket, object string, startOffset int64, length int64, writer io.Writer, etag string) error {
 	// Start offset cannot be negative.
 	if startOffset < 0 {
-		return errors.Trace(fmt.Errorf("Unexpected error"))
+		logger.LogIf(ctx, fmt.Errorf("Unexpected error"))
+		return fmt.Errorf("Unexpected error")
 	}
 
 	output, err := t.client.Objects().Get(ctx, &storage.GetObjectInput{
@@ -555,11 +563,13 @@ func (t *tritonObjects) PutObject(ctx context.Context, bucket, object string, da
 		ObjectReader: dummySeeker{data},
 		ForceInsert:  true,
 	}); err != nil {
-		return objInfo, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return objInfo, err
 	}
 	if err = data.Verify(); err != nil {
 		t.DeleteObject(ctx, bucket, object)
-		return objInfo, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return objInfo, err
 	}
 
 	return t.GetObjectInfo(ctx, bucket, object)
@@ -574,7 +584,8 @@ func (t *tritonObjects) CopyObject(ctx context.Context, srcBucket, srcObject, de
 		SourcePath: path.Join(mantaRoot, srcBucket, srcObject),
 		LinkPath:   path.Join(mantaRoot, destBucket, destObject),
 	}); err != nil {
-		return objInfo, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return objInfo, err
 	}
 
 	return t.GetObjectInfo(ctx, destBucket, destObject)
@@ -587,7 +598,8 @@ func (t *tritonObjects) DeleteObject(ctx context.Context, bucket, object string)
 	if err := t.client.Objects().Delete(ctx, &storage.DeleteObjectInput{
 		ObjectPath: path.Join(mantaRoot, bucket, object),
 	}); err != nil {
-		return errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return err
 	}
 
 	return nil

cmd/gateway/nas/gateway-nas.go

@@ -20,9 +20,9 @@ import (
 	"context"
 
 	"github.com/minio/cli"
-	"github.com/minio/minio-go/pkg/policy"
 	minio "github.com/minio/minio/cmd"
 	"github.com/minio/minio/pkg/auth"
+	"github.com/minio/minio/pkg/policy"
 )
 
 const (
@@ -132,6 +132,6 @@ func (l *nasObjects) IsNotificationSupported() bool {
 }
 
 // GetBucketPolicy will get policy on bucket
-func (l *nasObjects) GetBucketPolicy(ctx context.Context, bucket string) (policy.BucketAccessPolicy, error) {
-	return minio.ReadBucketPolicy(bucket, l)
+func (l *nasObjects) GetBucketPolicy(ctx context.Context, bucket string) (*policy.Policy, error) {
+	return minio.GetPolicyConfig(l, bucket)
 }

cmd/gateway/oss/gateway-oss.go

@@ -30,11 +30,13 @@ import (
 	"github.com/dustin/go-humanize"
 
 	"github.com/minio/cli"
-	"github.com/minio/minio-go/pkg/policy"
+	miniogopolicy "github.com/minio/minio-go/pkg/policy"
 	minio "github.com/minio/minio/cmd"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
-	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/hash"
+	"github.com/minio/minio/pkg/policy"
+	"github.com/minio/minio/pkg/policy/condition"
 )
 
 const (
@@ -113,7 +115,7 @@ func ossGatewayMain(ctx *cli.Context) {
 
 	// Validate gateway arguments.
 	host := ctx.Args().First()
-	minio.FatalIf(minio.ValidateGatewayArguments(ctx.GlobalString("address"), host), "Invalid argument")
+	logger.FatalIf(minio.ValidateGatewayArguments(ctx.GlobalString("address"), host), "Invalid argument")
 
 	minio.StartGateway(ctx, &OSS{host})
 }
@@ -149,9 +151,9 @@ func (g *OSS) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, error)
 	}, nil
 }
 
-// Production - oss is not production ready yet.
+// Production - oss is production ready.
 func (g *OSS) Production() bool {
-	return false
+	return true
 }
 
 // appendS3MetaToOSSOptions converts metadata meant for S3 PUT/COPY
@@ -161,7 +163,7 @@ func (g *OSS) Production() bool {
 // `X-Amz-Meta-` prefix and converted into `X-Oss-Meta-`.
 //
 // Header names are canonicalized as in http.Header.
-func appendS3MetaToOSSOptions(opts []oss.Option, s3Metadata map[string]string) ([]oss.Option, error) {
+func appendS3MetaToOSSOptions(ctx context.Context, opts []oss.Option, s3Metadata map[string]string) ([]oss.Option, error) {
 	if opts == nil {
 		opts = make([]oss.Option, 0, len(s3Metadata))
 	}
@@ -173,7 +175,8 @@ func appendS3MetaToOSSOptions(opts []oss.Option, s3Metadata map[string]string) (
 			metaKey := k[len("X-Amz-Meta-"):]
 			// NOTE(timonwong): OSS won't allow headers with underscore(_).
 			if strings.Contains(metaKey, "_") {
-				return nil, errors.Trace(minio.UnsupportedMetadata{})
+				logger.LogIf(ctx, minio.UnsupportedMetadata{})
+				return nil, minio.UnsupportedMetadata{}
 			}
 			opts = append(opts, oss.Meta(metaKey, v))
 		case k == "X-Amz-Acl":
@@ -271,15 +274,6 @@ func ossToObjectError(err error, params ...string) error {
 		return nil
 	}
 
-	e, ok := err.(*errors.Error)
-	if !ok {
-		// Code should be fixed if this function is called without doing errors.Trace()
-		// Else handling different situations in this function makes this function complicated.
-		minio.ErrorIf(err, "Expected type *Error")
-		return err
-	}
-
-	err = e.Cause
 	bucket := ""
 	object := ""
 	uploadID := ""
@@ -298,7 +292,7 @@ func ossToObjectError(err error, params ...string) error {
 	if !ok {
 		// We don't interpret non OSS errors. As oss errors will
 		// have StatusCode to help to convert to object errors.
-		return e
+		return err
 	}
 
 	switch ossErr.Code {
@@ -330,8 +324,7 @@ func ossToObjectError(err error, params ...string) error {
 		err = minio.InvalidPart{}
 	}
 
-	e.Cause = err
-	return e
+	return err
 }
 
 // ossObjects implements gateway for Aliyun Object Storage Service.
@@ -366,22 +359,21 @@ func ossIsValidBucketName(bucket string) bool {
 // MakeBucketWithLocation creates a new container on OSS backend.
 func (l *ossObjects) MakeBucketWithLocation(ctx context.Context, bucket, location string) error {
 	if !ossIsValidBucketName(bucket) {
-		return errors.Trace(minio.BucketNameInvalid{Bucket: bucket})
+		logger.LogIf(ctx, minio.BucketNameInvalid{Bucket: bucket})
+		return minio.BucketNameInvalid{Bucket: bucket}
 	}
 
 	err := l.Client.CreateBucket(bucket)
-	return ossToObjectError(errors.Trace(err), bucket)
+	logger.LogIf(ctx, err)
+	return ossToObjectError(err, bucket)
 }
 
 // ossGeBucketInfo gets bucket metadata.
-func ossGeBucketInfo(client *oss.Client, bucket string) (bi minio.BucketInfo, err error) {
-	if !ossIsValidBucketName(bucket) {
-		return bi, errors.Trace(minio.BucketNameInvalid{Bucket: bucket})
-	}
-
+func ossGeBucketInfo(ctx context.Context, client *oss.Client, bucket string) (bi minio.BucketInfo, err error) {
 	bgir, err := client.GetBucketInfo(bucket)
 	if err != nil {
-		return bi, ossToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return bi, ossToObjectError(err, bucket)
 	}
 
 	return minio.BucketInfo{
@@ -392,7 +384,7 @@ func ossGeBucketInfo(client *oss.Client, bucket string) (bi minio.BucketInfo, er
 
 // GetBucketInfo gets bucket metadata.
 func (l *ossObjects) GetBucketInfo(ctx context.Context, bucket string) (bi minio.BucketInfo, err error) {
-	return ossGeBucketInfo(l.Client, bucket)
+	return ossGeBucketInfo(ctx, l.Client, bucket)
 }
 
 // ListBuckets lists all OSS buckets.
@@ -401,7 +393,8 @@ func (l *ossObjects) ListBuckets(ctx context.Context) (buckets []minio.BucketInf
 	for {
 		lbr, err := l.Client.ListBuckets(marker)
 		if err != nil {
-			return nil, ossToObjectError(errors.Trace(err))
+			logger.LogIf(ctx, err)
+			return nil, ossToObjectError(err)
 		}
 
 		for _, bi := range lbr.Buckets {
@@ -424,7 +417,8 @@ func (l *ossObjects) ListBuckets(ctx context.Context) (buckets []minio.BucketInf
 func (l *ossObjects) DeleteBucket(ctx context.Context, bucket string) error {
 	err := l.Client.DeleteBucket(bucket)
 	if err != nil {
-		return ossToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return ossToObjectError(err, bucket)
 	}
 	return nil
 }
@@ -462,10 +456,11 @@ func fromOSSClientListObjectsResult(bucket string, lor oss.ListObjectsResult) mi
 }
 
 // ossListObjects lists all blobs in OSS bucket filtered by prefix.
-func ossListObjects(client *oss.Client, bucket, prefix, marker, delimiter string, maxKeys int) (loi minio.ListObjectsInfo, err error) {
+func ossListObjects(ctx context.Context, client *oss.Client, bucket, prefix, marker, delimiter string, maxKeys int) (loi minio.ListObjectsInfo, err error) {
 	buck, err := client.Bucket(bucket)
 	if err != nil {
-		return loi, ossToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return loi, ossToObjectError(err, bucket)
 	}
 
 	// maxKeys should default to 1000 or less.
@@ -475,19 +470,20 @@ func ossListObjects(client *oss.Client, bucket, prefix, marker, delimiter string
 
 	lor, err := buck.ListObjects(oss.Prefix(prefix), oss.Marker(marker), oss.Delimiter(delimiter), oss.MaxKeys(maxKeys))
 	if err != nil {
-		return loi, ossToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return loi, ossToObjectError(err, bucket)
 	}
 
 	return fromOSSClientListObjectsResult(bucket, lor), nil
 }
 
 // ossListObjectsV2 lists all blobs in OSS bucket filtered by prefix.
-func ossListObjectsV2(client *oss.Client, bucket, prefix, continuationToken, delimiter string, maxKeys int,
+func ossListObjectsV2(ctx context.Context, client *oss.Client, bucket, prefix, continuationToken, delimiter string, maxKeys int,
 	fetchOwner bool, startAfter string) (loi minio.ListObjectsV2Info, err error) {
 	// fetchOwner and startAfter are not supported and unused.
 	marker := continuationToken
 
-	resultV1, err := ossListObjects(client, bucket, prefix, marker, delimiter, maxKeys)
+	resultV1, err := ossListObjects(ctx, client, bucket, prefix, marker, delimiter, maxKeys)
 	if err != nil {
 		return loi, err
 	}
@@ -503,13 +499,13 @@ func ossListObjectsV2(client *oss.Client, bucket, prefix, continuationToken, del
 
 // ListObjects lists all blobs in OSS bucket filtered by prefix.
 func (l *ossObjects) ListObjects(ctx context.Context, bucket, prefix, marker, delimiter string, maxKeys int) (loi minio.ListObjectsInfo, err error) {
-	return ossListObjects(l.Client, bucket, prefix, marker, delimiter, maxKeys)
+	return ossListObjects(ctx, l.Client, bucket, prefix, marker, delimiter, maxKeys)
 }
 
 // ListObjectsV2 lists all blobs in OSS bucket filtered by prefix
 func (l *ossObjects) ListObjectsV2(ctx context.Context, bucket, prefix, continuationToken, delimiter string, maxKeys int,
 	fetchOwner bool, startAfter string) (loi minio.ListObjectsV2Info, err error) {
-	return ossListObjectsV2(l.Client, bucket, prefix, continuationToken, delimiter, maxKeys, fetchOwner, startAfter)
+	return ossListObjectsV2(ctx, l.Client, bucket, prefix, continuationToken, delimiter, maxKeys, fetchOwner, startAfter)
 }
 
 // ossGetObject reads an object on OSS. Supports additional
@@ -518,14 +514,16 @@ func (l *ossObjects) ListObjectsV2(ctx context.Context, bucket, prefix, continua
 //
 // startOffset indicates the starting read location of the object.
 // length indicates the total length of the object.
-func ossGetObject(client *oss.Client, bucket, key string, startOffset, length int64, writer io.Writer, etag string) error {
+func ossGetObject(ctx context.Context, client *oss.Client, bucket, key string, startOffset, length int64, writer io.Writer, etag string) error {
 	if length < 0 && length != -1 {
-		return ossToObjectError(errors.Trace(fmt.Errorf("Invalid argument")), bucket, key)
+		logger.LogIf(ctx, fmt.Errorf("Invalid argument"))
+		return ossToObjectError(fmt.Errorf("Invalid argument"), bucket, key)
 	}
 
 	bkt, err := client.Bucket(bucket)
 	if err != nil {
-		return ossToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return ossToObjectError(err, bucket, key)
 	}
 
 	var opts []oss.Option
@@ -535,12 +533,14 @@ func ossGetObject(client *oss.Client, bucket, key string, startOffset, length in
 
 	object, err := bkt.GetObject(key, opts...)
 	if err != nil {
-		return ossToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return ossToObjectError(err, bucket, key)
 	}
 	defer object.Close()
 
 	if _, err := io.Copy(writer, object); err != nil {
-		return ossToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return ossToObjectError(err, bucket, key)
 	}
 	return nil
 }
@@ -552,7 +552,7 @@ func ossGetObject(client *oss.Client, bucket, key string, startOffset, length in
 // startOffset indicates the starting read location of the object.
 // length indicates the total length of the object.
 func (l *ossObjects) GetObject(ctx context.Context, bucket, key string, startOffset, length int64, writer io.Writer, etag string) error {
-	return ossGetObject(l.Client, bucket, key, startOffset, length, writer, etag)
+	return ossGetObject(ctx, l.Client, bucket, key, startOffset, length, writer, etag)
 }
 
 func translatePlainError(err error) error {
@@ -569,15 +569,17 @@ func translatePlainError(err error) error {
 }
 
 // ossGetObjectInfo reads object info and replies back ObjectInfo.
-func ossGetObjectInfo(client *oss.Client, bucket, object string) (objInfo minio.ObjectInfo, err error) {
+func ossGetObjectInfo(ctx context.Context, client *oss.Client, bucket, object string) (objInfo minio.ObjectInfo, err error) {
 	bkt, err := client.Bucket(bucket)
 	if err != nil {
-		return objInfo, ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, ossToObjectError(err, bucket, object)
 	}
 
 	header, err := bkt.GetObjectDetailedMeta(object)
 	if err != nil {
-		return objInfo, ossToObjectError(errors.Trace(translatePlainError(err)), bucket, object)
+		logger.LogIf(ctx, translatePlainError(err))
+		return objInfo, ossToObjectError(translatePlainError(err), bucket, object)
 	}
 
 	// Build S3 metadata from OSS metadata
@@ -600,40 +602,43 @@ func ossGetObjectInfo(client *oss.Client, bucket, object string) (objInfo minio.
 
 // GetObjectInfo reads object info and replies back ObjectInfo.
 func (l *ossObjects) GetObjectInfo(ctx context.Context, bucket, object string) (objInfo minio.ObjectInfo, err error) {
-	return ossGetObjectInfo(l.Client, bucket, object)
+	return ossGetObjectInfo(ctx, l.Client, bucket, object)
 }
 
 // ossPutObject creates a new object with the incoming data.
-func ossPutObject(client *oss.Client, bucket, object string, data *hash.Reader, metadata map[string]string) (objInfo minio.ObjectInfo, err error) {
+func ossPutObject(ctx context.Context, client *oss.Client, bucket, object string, data *hash.Reader, metadata map[string]string) (objInfo minio.ObjectInfo, err error) {
 	bkt, err := client.Bucket(bucket)
 	if err != nil {
-		return objInfo, ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, ossToObjectError(err, bucket, object)
 	}
 
 	// Build OSS metadata
-	opts, err := appendS3MetaToOSSOptions(nil, metadata)
+	opts, err := appendS3MetaToOSSOptions(ctx, nil, metadata)
 	if err != nil {
 		return objInfo, ossToObjectError(err, bucket, object)
 	}
 
 	err = bkt.PutObject(object, data, opts...)
 	if err != nil {
-		return objInfo, ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, ossToObjectError(err, bucket, object)
 	}
 
-	return ossGetObjectInfo(client, bucket, object)
+	return ossGetObjectInfo(ctx, client, bucket, object)
 }
 
 // PutObject creates a new object with the incoming data.
 func (l *ossObjects) PutObject(ctx context.Context, bucket, object string, data *hash.Reader, metadata map[string]string) (objInfo minio.ObjectInfo, err error) {
-	return ossPutObject(l.Client, bucket, object, data, metadata)
+	return ossPutObject(ctx, l.Client, bucket, object, data, metadata)
 }
 
 // CopyObject copies an object from source bucket to a destination bucket.
 func (l *ossObjects) CopyObject(ctx context.Context, srcBucket, srcObject, dstBucket, dstObject string, srcInfo minio.ObjectInfo) (objInfo minio.ObjectInfo, err error) {
 	bkt, err := l.Client.Bucket(srcBucket)
 	if err != nil {
-		return objInfo, ossToObjectError(errors.Trace(err), srcBucket, srcObject)
+		logger.LogIf(ctx, err)
+		return objInfo, ossToObjectError(err, srcBucket, srcObject)
 	}
 
 	opts := make([]oss.Option, 0, len(srcInfo.UserDefined)+1)
@@ -644,13 +649,14 @@ func (l *ossObjects) CopyObject(ctx context.Context, srcBucket, srcObject, dstBu
 	opts = append(opts, oss.MetadataDirective(oss.MetaReplace))
 
 	// Build OSS metadata
-	opts, err = appendS3MetaToOSSOptions(opts, srcInfo.UserDefined)
+	opts, err = appendS3MetaToOSSOptions(ctx, opts, srcInfo.UserDefined)
 	if err != nil {
 		return objInfo, ossToObjectError(err, srcBucket, srcObject)
 	}
 
 	if _, err = bkt.CopyObjectTo(dstBucket, dstObject, srcObject, opts...); err != nil {
-		return objInfo, ossToObjectError(errors.Trace(err), srcBucket, srcObject)
+		logger.LogIf(ctx, err)
+		return objInfo, ossToObjectError(err, srcBucket, srcObject)
 	}
 	return l.GetObjectInfo(ctx, dstBucket, dstObject)
 }
@@ -659,12 +665,14 @@ func (l *ossObjects) CopyObject(ctx context.Context, srcBucket, srcObject, dstBu
 func (l *ossObjects) DeleteObject(ctx context.Context, bucket, object string) error {
 	bkt, err := l.Client.Bucket(bucket)
 	if err != nil {
-		return ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return ossToObjectError(err, bucket, object)
 	}
 
 	err = bkt.DeleteObject(object)
 	if err != nil {
-		return ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return ossToObjectError(err, bucket, object)
 	}
 	return nil
 }
@@ -701,13 +709,15 @@ func fromOSSClientListMultipartsInfo(lmur oss.ListMultipartUploadResult) minio.L
 func (l *ossObjects) ListMultipartUploads(ctx context.Context, bucket, prefix, keyMarker, uploadIDMarker, delimiter string, maxUploads int) (lmi minio.ListMultipartsInfo, err error) {
 	bkt, err := l.Client.Bucket(bucket)
 	if err != nil {
-		return lmi, ossToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return lmi, ossToObjectError(err, bucket)
 	}
 
 	lmur, err := bkt.ListMultipartUploads(oss.Prefix(prefix), oss.KeyMarker(keyMarker), oss.UploadIDMarker(uploadIDMarker),
 		oss.Delimiter(delimiter), oss.MaxUploads(maxUploads))
 	if err != nil {
-		return lmi, ossToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return lmi, ossToObjectError(err, bucket)
 	}
 
 	return fromOSSClientListMultipartsInfo(lmur), nil
@@ -717,18 +727,20 @@ func (l *ossObjects) ListMultipartUploads(ctx context.Context, bucket, prefix, k
 func (l *ossObjects) NewMultipartUpload(ctx context.Context, bucket, object string, metadata map[string]string) (uploadID string, err error) {
 	bkt, err := l.Client.Bucket(bucket)
 	if err != nil {
-		return uploadID, ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return uploadID, ossToObjectError(err, bucket, object)
 	}
 
 	// Build OSS metadata
-	opts, err := appendS3MetaToOSSOptions(nil, metadata)
+	opts, err := appendS3MetaToOSSOptions(ctx, nil, metadata)
 	if err != nil {
 		return uploadID, ossToObjectError(err, bucket, object)
 	}
 
 	lmur, err := bkt.InitiateMultipartUpload(object, opts...)
 	if err != nil {
-		return uploadID, ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return uploadID, ossToObjectError(err, bucket, object)
 	}
 
 	return lmur.UploadID, nil
@@ -738,7 +750,8 @@ func (l *ossObjects) NewMultipartUpload(ctx context.Context, bucket, object stri
 func (l *ossObjects) PutObjectPart(ctx context.Context, bucket, object, uploadID string, partID int, data *hash.Reader) (pi minio.PartInfo, err error) {
 	bkt, err := l.Client.Bucket(bucket)
 	if err != nil {
-		return pi, ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return pi, ossToObjectError(err, bucket, object)
 	}
 
 	imur := oss.InitiateMultipartUploadResult{
@@ -749,7 +762,8 @@ func (l *ossObjects) PutObjectPart(ctx context.Context, bucket, object, uploadID
 	size := data.Size()
 	up, err := bkt.UploadPart(imur, data, size, partID)
 	if err != nil {
-		return pi, ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return pi, ossToObjectError(err, bucket, object)
 	}
 
 	return minio.PartInfo{
@@ -820,11 +834,12 @@ func (l *ossObjects) CopyObjectPart(ctx context.Context, srcBucket, srcObject, d
 
 	bkt, err := l.Client.Bucket(destBucket)
 	if err != nil {
-		return p, ossToObjectError(errors.Trace(err), destBucket)
+		logger.LogIf(ctx, err)
+		return p, ossToObjectError(err, destBucket)
 	}
 
 	// Build OSS metadata
-	opts, err := appendS3MetaToOSSOptions(nil, srcInfo.UserDefined)
+	opts, err := appendS3MetaToOSSOptions(ctx, nil, srcInfo.UserDefined)
 	if err != nil {
 		return p, ossToObjectError(err, srcBucket, srcObject)
 	}
@@ -835,7 +850,8 @@ func (l *ossObjects) CopyObjectPart(ctx context.Context, srcBucket, srcObject, d
 	}, srcBucket, srcObject, startOffset, length, partID, opts...)
 
 	if err != nil {
-		return p, ossToObjectError(errors.Trace(err), srcBucket, srcObject)
+		logger.LogIf(ctx, err)
+		return p, ossToObjectError(err, srcBucket, srcObject)
 	}
 
 	p.PartNumber = completePart.PartNumber
@@ -847,7 +863,8 @@ func (l *ossObjects) CopyObjectPart(ctx context.Context, srcBucket, srcObject, d
 func (l *ossObjects) ListObjectParts(ctx context.Context, bucket, object, uploadID string, partNumberMarker, maxParts int) (lpi minio.ListPartsInfo, err error) {
 	lupr, err := ossListObjectParts(l.Client, bucket, object, uploadID, partNumberMarker, maxParts)
 	if err != nil {
-		return lpi, ossToObjectError(errors.Trace(err), bucket, object, uploadID)
+		logger.LogIf(ctx, err)
+		return lpi, ossToObjectError(err, bucket, object, uploadID)
 	}
 
 	return fromOSSClientListPartsInfo(lupr, partNumberMarker), nil
@@ -857,7 +874,8 @@ func (l *ossObjects) ListObjectParts(ctx context.Context, bucket, object, upload
 func (l *ossObjects) AbortMultipartUpload(ctx context.Context, bucket, object, uploadID string) error {
 	bkt, err := l.Client.Bucket(bucket)
 	if err != nil {
-		return ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return ossToObjectError(err, bucket, object)
 	}
 
 	err = bkt.AbortMultipartUpload(oss.InitiateMultipartUploadResult{
@@ -866,7 +884,8 @@ func (l *ossObjects) AbortMultipartUpload(ctx context.Context, bucket, object, u
 		UploadID: uploadID,
 	})
 	if err != nil {
-		return ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return ossToObjectError(err, bucket, object)
 	}
 	return nil
 }
@@ -876,7 +895,8 @@ func (l *ossObjects) CompleteMultipartUpload(ctx context.Context, bucket, object
 	client := l.Client
 	bkt, err := client.Bucket(bucket)
 	if err != nil {
-		return oi, ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return oi, ossToObjectError(err, bucket, object)
 	}
 
 	// Error out if uploadedParts except last part sizing < 5MiB.
@@ -886,7 +906,8 @@ func (l *ossObjects) CompleteMultipartUpload(ctx context.Context, bucket, object
 	for lupr.IsTruncated {
 		lupr, err = ossListObjectParts(client, bucket, object, uploadID, partNumberMarker, ossMaxParts)
 		if err != nil {
-			return oi, ossToObjectError(errors.Trace(err), bucket, object, uploadID)
+			logger.LogIf(ctx, err)
+			return oi, ossToObjectError(err, bucket, object, uploadID)
 		}
 
 		uploadedParts := lupr.UploadedParts
@@ -900,11 +921,16 @@ func (l *ossObjects) CompleteMultipartUpload(ctx context.Context, bucket, object
 
 		for _, part := range uploadedParts {
 			if part.Size < ossS3MinPartSize {
-				return oi, errors.Trace(minio.PartTooSmall{
+				logger.LogIf(ctx, minio.PartTooSmall{
 					PartNumber: part.PartNumber,
 					PartSize:   int64(part.Size),
 					PartETag:   minio.ToS3ETag(part.ETag),
 				})
+				return oi, minio.PartTooSmall{
+					PartNumber: part.PartNumber,
+					PartSize:   int64(part.Size),
+					PartETag:   minio.ToS3ETag(part.ETag),
+				}
 			}
 		}
 
@@ -926,7 +952,8 @@ func (l *ossObjects) CompleteMultipartUpload(ctx context.Context, bucket, object
 
 	_, err = bkt.CompleteMultipartUpload(imur, parts)
 	if err != nil {
-		return oi, ossToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return oi, ossToObjectError(err, bucket, object)
 	}
 
 	return l.GetObjectInfo(ctx, bucket, object)
@@ -937,33 +964,43 @@ func (l *ossObjects) CompleteMultipartUpload(ctx context.Context, bucket, object
 // oss.ACLPublicReadWrite: readwrite in minio terminology
 // oss.ACLPublicRead: readonly in minio terminology
 // oss.ACLPrivate: none in minio terminology
-func (l *ossObjects) SetBucketPolicy(ctx context.Context, bucket string, policyInfo policy.BucketAccessPolicy) error {
-	bucketPolicies := policy.GetPolicies(policyInfo.Statements, bucket, "")
+func (l *ossObjects) SetBucketPolicy(ctx context.Context, bucket string, bucketPolicy *policy.Policy) error {
+	policyInfo, err := minio.PolicyToBucketAccessPolicy(bucketPolicy)
+	if err != nil {
+		// This should not happen.
+		return ossToObjectError(err, bucket)
+	}
+
+	bucketPolicies := miniogopolicy.GetPolicies(policyInfo.Statements, bucket, "")
 	if len(bucketPolicies) != 1 {
-		return errors.Trace(minio.NotImplemented{})
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return minio.NotImplemented{}
 	}
 
 	prefix := bucket + "/*" // For all objects inside the bucket.
 	for policyPrefix, bucketPolicy := range bucketPolicies {
 		if policyPrefix != prefix {
-			return errors.Trace(minio.NotImplemented{})
+			logger.LogIf(ctx, minio.NotImplemented{})
+			return minio.NotImplemented{}
 		}
 
 		var acl oss.ACLType
 		switch bucketPolicy {
-		case policy.BucketPolicyNone:
+		case miniogopolicy.BucketPolicyNone:
 			acl = oss.ACLPrivate
-		case policy.BucketPolicyReadOnly:
+		case miniogopolicy.BucketPolicyReadOnly:
 			acl = oss.ACLPublicRead
-		case policy.BucketPolicyReadWrite:
+		case miniogopolicy.BucketPolicyReadWrite:
 			acl = oss.ACLPublicReadWrite
 		default:
-			return errors.Trace(minio.NotImplemented{})
+			logger.LogIf(ctx, minio.NotImplemented{})
+			return minio.NotImplemented{}
 		}
 
 		err := l.Client.SetBucketACL(bucket, acl)
 		if err != nil {
-			return ossToObjectError(errors.Trace(err), bucket)
+			logger.LogIf(ctx, err)
+			return ossToObjectError(err, bucket)
 		}
 	}
 
@@ -971,33 +1008,68 @@ func (l *ossObjects) SetBucketPolicy(ctx context.Context, bucket string, policyI
 }
 
 // GetBucketPolicy will get policy on bucket.
-func (l *ossObjects) GetBucketPolicy(ctx context.Context, bucket string) (policy.BucketAccessPolicy, error) {
+func (l *ossObjects) GetBucketPolicy(ctx context.Context, bucket string) (*policy.Policy, error) {
 	result, err := l.Client.GetBucketACL(bucket)
 	if err != nil {
-		return policy.BucketAccessPolicy{}, ossToObjectError(errors.Trace(err))
+		logger.LogIf(ctx, err)
+		return nil, ossToObjectError(err)
 	}
 
-	policyInfo := policy.BucketAccessPolicy{Version: "2012-10-17"}
+	var readOnly, readWrite bool
 	switch result.ACL {
 	case string(oss.ACLPrivate):
 		// By default, all buckets starts with a "private" policy.
-		return policy.BucketAccessPolicy{}, ossToObjectError(errors.Trace(minio.PolicyNotFound{}), bucket)
+		logger.LogIf(ctx, minio.BucketPolicyNotFound{})
+		return nil, ossToObjectError(minio.BucketPolicyNotFound{}, bucket)
 	case string(oss.ACLPublicRead):
-		policyInfo.Statements = policy.SetPolicy(policyInfo.Statements, policy.BucketPolicyReadOnly, bucket, "")
+		readOnly = true
 	case string(oss.ACLPublicReadWrite):
-		policyInfo.Statements = policy.SetPolicy(policyInfo.Statements, policy.BucketPolicyReadWrite, bucket, "")
+		readWrite = true
 	default:
-		return policy.BucketAccessPolicy{}, errors.Trace(minio.NotImplemented{})
+		logger.LogIf(ctx, minio.NotImplemented{})
+		return nil, minio.NotImplemented{}
 	}
 
-	return policyInfo, nil
+	actionSet := policy.NewActionSet()
+	if readOnly {
+		actionSet.Add(policy.GetBucketLocationAction)
+		actionSet.Add(policy.ListBucketAction)
+		actionSet.Add(policy.GetObjectAction)
+	}
+	if readWrite {
+		actionSet.Add(policy.GetBucketLocationAction)
+		actionSet.Add(policy.ListBucketAction)
+		actionSet.Add(policy.GetObjectAction)
+		actionSet.Add(policy.ListBucketMultipartUploadsAction)
+		actionSet.Add(policy.AbortMultipartUploadAction)
+		actionSet.Add(policy.DeleteObjectAction)
+		actionSet.Add(policy.ListMultipartUploadPartsAction)
+		actionSet.Add(policy.PutObjectAction)
+	}
+
+	return &policy.Policy{
+		Version: policy.DefaultVersion,
+		Statements: []policy.Statement{
+			policy.NewStatement(
+				policy.Allow,
+				policy.NewPrincipal("*"),
+				actionSet,
+				policy.NewResourceSet(
+					policy.NewResource(bucket, ""),
+					policy.NewResource(bucket, "*"),
+				),
+				condition.NewFunctions(),
+			),
+		},
+	}, nil
 }
 
 // DeleteBucketPolicy deletes all policies on bucket.
 func (l *ossObjects) DeleteBucketPolicy(ctx context.Context, bucket string) error {
 	err := l.Client.SetBucketACL(bucket, oss.ACLPrivate)
 	if err != nil {
-		return ossToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return ossToObjectError(err, bucket)
 	}
 	return nil
 }

cmd/gateway/oss/gateway-oss_test.go

@@ -17,6 +17,7 @@
 package oss
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 	"reflect"
@@ -25,13 +26,12 @@ import (
 	"github.com/aliyun/aliyun-oss-go-sdk/oss"
 
 	minio "github.com/minio/minio/cmd"
-	"github.com/minio/minio/pkg/errors"
 )
 
 func ossErrResponse(code string) error {
-	return errors.Trace(oss.ServiceError{
+	return oss.ServiceError{
 		Code: code,
-	})
+	}
 }
 
 func TestOSSToObjectError(t *testing.T) {
@@ -103,8 +103,8 @@ func TestOSSToObjectError(t *testing.T) {
 
 	for i, tc := range testCases {
 		actualErr := ossToObjectError(tc.inputErr, tc.bucket, tc.object)
-		if e, ok := actualErr.(*errors.Error); ok && e.Cause != tc.expectedErr {
-			t.Errorf("Test case %d: Expected error '%v' but received error '%v'", i+1, tc.expectedErr, e.Cause)
+		if actualErr != nil && tc.expectedErr != nil && actualErr.Error() != tc.expectedErr.Error() {
+			t.Errorf("Test case %d: Expected error '%v' but received error '%v'", i+1, tc.expectedErr, actualErr)
 		}
 	}
 }
@@ -116,8 +116,8 @@ func TestS3MetaToOSSOptions(t *testing.T) {
 	headers = map[string]string{
 		"x-amz-meta-invalid_meta": "value",
 	}
-	_, err = appendS3MetaToOSSOptions(nil, headers)
-	if err = errors.Cause(err); err != nil {
+	_, err = appendS3MetaToOSSOptions(context.Background(), nil, headers)
+	if err != nil {
 		if _, ok := err.(minio.UnsupportedMetadata); !ok {
 			t.Fatalf("Test failed with unexpected error %s, expected UnsupportedMetadata", err)
 		}
@@ -133,7 +133,7 @@ func TestS3MetaToOSSOptions(t *testing.T) {
 		"X-Amz-Meta-X-Amz-Matdesc": "{}",
 		"X-Amz-Meta-X-Amz-Iv":      "eWmyryl8kq+EVnnsE7jpOg==",
 	}
-	opts, err := appendS3MetaToOSSOptions(nil, headers)
+	opts, err := appendS3MetaToOSSOptions(context.Background(), nil, headers)
 	if err != nil {
 		t.Fatalf("Test failed, with %s", err)
 	}

cmd/gateway/s3/gateway-s3.go

@@ -18,15 +18,17 @@ package s3
 
 import (
 	"context"
+	"encoding/json"
 	"io"
+	"strings"
 
 	"github.com/minio/cli"
 	miniogo "github.com/minio/minio-go"
-	"github.com/minio/minio-go/pkg/policy"
 	"github.com/minio/minio-go/pkg/s3utils"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
-	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/hash"
+	"github.com/minio/minio/pkg/policy"
 
 	minio "github.com/minio/minio/cmd"
 )
@@ -101,7 +103,7 @@ func s3GatewayMain(ctx *cli.Context) {
 	// Validate gateway arguments.
 	host := ctx.Args().First()
 	// Validate gateway arguments.
-	minio.FatalIf(minio.ValidateGatewayArguments(ctx.GlobalString("address"), host), "Invalid argument")
+	logger.FatalIf(minio.ValidateGatewayArguments(ctx.GlobalString("address"), host), "Invalid argument")
 
 	minio.StartGateway(ctx, &S3{host})
 }
@@ -147,9 +149,9 @@ func (g *S3) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, error)
 	}, nil
 }
 
-// Production - s3 gateway is not production ready.
+// Production - s3 gateway is production ready.
 func (g *S3) Production() bool {
-	return false
+	return true
 }
 
 // s3Objects implements gateway for Minio and S3 compatible object storage servers.
@@ -171,15 +173,6 @@ func (l *s3Objects) StorageInfo(ctx context.Context) (si minio.StorageInfo) {
 
 // MakeBucket creates a new container on S3 backend.
 func (l *s3Objects) MakeBucketWithLocation(ctx context.Context, bucket, location string) error {
-	err := l.Client.MakeBucket(bucket, location)
-	if err != nil {
-		return minio.ErrorRespToObjectError(errors.Trace(err), bucket)
-	}
-	return err
-}
-
-// GetBucketInfo gets bucket metadata..
-func (l *s3Objects) GetBucketInfo(ctx context.Context, bucket string) (bi minio.BucketInfo, e error) {
 	// Verify if bucket name is valid.
 	// We are using a separate helper function here to validate bucket
 	// names instead of IsValidBucketName() because there is a possibility
@@ -188,12 +181,24 @@ func (l *s3Objects) GetBucketInfo(ctx context.Context, bucket string) (bi minio.
 	// access to these buckets.
 	// Ref - http://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html
 	if s3utils.CheckValidBucketName(bucket) != nil {
-		return bi, errors.Trace(minio.BucketNameInvalid{Bucket: bucket})
+		logger.LogIf(ctx, minio.BucketNameInvalid{Bucket: bucket})
+		return minio.BucketNameInvalid{Bucket: bucket}
 	}
 
+	err := l.Client.MakeBucket(bucket, location)
+	if err != nil {
+		logger.LogIf(ctx, err)
+		return minio.ErrorRespToObjectError(err, bucket)
+	}
+	return err
+}
+
+// GetBucketInfo gets bucket metadata..
+func (l *s3Objects) GetBucketInfo(ctx context.Context, bucket string) (bi minio.BucketInfo, e error) {
 	buckets, err := l.Client.ListBuckets()
 	if err != nil {
-		return bi, minio.ErrorRespToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return bi, minio.ErrorRespToObjectError(err, bucket)
 	}
 
 	for _, bi := range buckets {
@@ -207,14 +212,16 @@ func (l *s3Objects) GetBucketInfo(ctx context.Context, bucket string) (bi minio.
 		}, nil
 	}
 
-	return bi, errors.Trace(minio.BucketNotFound{Bucket: bucket})
+	logger.LogIf(ctx, minio.BucketNotFound{Bucket: bucket})
+	return bi, minio.BucketNotFound{Bucket: bucket}
 }
 
 // ListBuckets lists all S3 buckets
 func (l *s3Objects) ListBuckets(ctx context.Context) ([]minio.BucketInfo, error) {
 	buckets, err := l.Client.ListBuckets()
 	if err != nil {
-		return nil, minio.ErrorRespToObjectError(errors.Trace(err))
+		logger.LogIf(ctx, err)
+		return nil, minio.ErrorRespToObjectError(err)
 	}
 
 	b := make([]minio.BucketInfo, len(buckets))
@@ -232,7 +239,8 @@ func (l *s3Objects) ListBuckets(ctx context.Context) ([]minio.BucketInfo, error)
 func (l *s3Objects) DeleteBucket(ctx context.Context, bucket string) error {
 	err := l.Client.RemoveBucket(bucket)
 	if err != nil {
-		return minio.ErrorRespToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return minio.ErrorRespToObjectError(err, bucket)
 	}
 	return nil
 }
@@ -241,7 +249,8 @@ func (l *s3Objects) DeleteBucket(ctx context.Context, bucket string) error {
 func (l *s3Objects) ListObjects(ctx context.Context, bucket string, prefix string, marker string, delimiter string, maxKeys int) (loi minio.ListObjectsInfo, e error) {
 	result, err := l.Client.ListObjects(bucket, prefix, marker, delimiter, maxKeys)
 	if err != nil {
-		return loi, minio.ErrorRespToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return loi, minio.ErrorRespToObjectError(err, bucket)
 	}
 
 	return minio.FromMinioClientListBucketResult(bucket, result), nil
@@ -251,7 +260,8 @@ func (l *s3Objects) ListObjects(ctx context.Context, bucket string, prefix strin
 func (l *s3Objects) ListObjectsV2(ctx context.Context, bucket, prefix, continuationToken, delimiter string, maxKeys int, fetchOwner bool, startAfter string) (loi minio.ListObjectsV2Info, e error) {
 	result, err := l.Client.ListObjectsV2(bucket, prefix, continuationToken, fetchOwner, delimiter, maxKeys)
 	if err != nil {
-		return loi, minio.ErrorRespToObjectError(errors.Trace(err), bucket)
+		logger.LogIf(ctx, err)
+		return loi, minio.ErrorRespToObjectError(err, bucket)
 	}
 
 	return minio.FromMinioClientListBucketV2Result(bucket, result), nil
@@ -265,23 +275,27 @@ func (l *s3Objects) ListObjectsV2(ctx context.Context, bucket, prefix, continuat
 // length indicates the total length of the object.
 func (l *s3Objects) GetObject(ctx context.Context, bucket string, key string, startOffset int64, length int64, writer io.Writer, etag string) error {
 	if length < 0 && length != -1 {
-		return minio.ErrorRespToObjectError(errors.Trace(minio.InvalidRange{}), bucket, key)
+		logger.LogIf(ctx, minio.InvalidRange{})
+		return minio.ErrorRespToObjectError(minio.InvalidRange{}, bucket, key)
 	}
 
 	opts := miniogo.GetObjectOptions{}
 	if startOffset >= 0 && length >= 0 {
 		if err := opts.SetRange(startOffset, startOffset+length-1); err != nil {
-			return minio.ErrorRespToObjectError(errors.Trace(err), bucket, key)
+			logger.LogIf(ctx, err)
+			return minio.ErrorRespToObjectError(err, bucket, key)
 		}
 	}
 	object, _, err := l.Client.GetObject(bucket, key, opts)
 	if err != nil {
-		return minio.ErrorRespToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return minio.ErrorRespToObjectError(err, bucket, key)
 	}
 	defer object.Close()
 
 	if _, err := io.Copy(writer, object); err != nil {
-		return minio.ErrorRespToObjectError(errors.Trace(err), bucket, key)
+		logger.LogIf(ctx, err)
+		return minio.ErrorRespToObjectError(err, bucket, key)
 	}
 	return nil
 }
@@ -290,7 +304,8 @@ func (l *s3Objects) GetObject(ctx context.Context, bucket string, key string, st
 func (l *s3Objects) GetObjectInfo(ctx context.Context, bucket string, object string) (objInfo minio.ObjectInfo, err error) {
 	oi, err := l.Client.StatObject(bucket, object, miniogo.StatObjectOptions{})
 	if err != nil {
-		return minio.ObjectInfo{}, minio.ErrorRespToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return minio.ObjectInfo{}, minio.ErrorRespToObjectError(err, bucket, object)
 	}
 
 	return minio.FromMinioClientObjectInfo(bucket, oi), nil
@@ -300,7 +315,8 @@ func (l *s3Objects) GetObjectInfo(ctx context.Context, bucket string, object str
 func (l *s3Objects) PutObject(ctx context.Context, bucket string, object string, data *hash.Reader, metadata map[string]string) (objInfo minio.ObjectInfo, err error) {
 	oi, err := l.Client.PutObject(bucket, object, data, data.Size(), data.MD5Base64String(), data.SHA256HexString(), minio.ToMinioClientMetadata(metadata))
 	if err != nil {
-		return objInfo, minio.ErrorRespToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return objInfo, minio.ErrorRespToObjectError(err, bucket, object)
 	}
 
 	return minio.FromMinioClientObjectInfo(bucket, oi), nil
@@ -315,7 +331,8 @@ func (l *s3Objects) CopyObject(ctx context.Context, srcBucket string, srcObject
 	srcInfo.UserDefined["x-amz-metadata-directive"] = "REPLACE"
 	srcInfo.UserDefined["x-amz-copy-source-if-match"] = srcInfo.ETag
 	if _, err = l.Client.CopyObject(srcBucket, srcObject, dstBucket, dstObject, srcInfo.UserDefined); err != nil {
-		return objInfo, minio.ErrorRespToObjectError(errors.Trace(err), srcBucket, srcObject)
+		logger.LogIf(ctx, err)
+		return objInfo, minio.ErrorRespToObjectError(err, srcBucket, srcObject)
 	}
 	return l.GetObjectInfo(ctx, dstBucket, dstObject)
 }
@@ -324,7 +341,8 @@ func (l *s3Objects) CopyObject(ctx context.Context, srcBucket string, srcObject
 func (l *s3Objects) DeleteObject(ctx context.Context, bucket string, object string) error {
 	err := l.Client.RemoveObject(bucket, object)
 	if err != nil {
-		return minio.ErrorRespToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return minio.ErrorRespToObjectError(err, bucket, object)
 	}
 
 	return nil
@@ -346,7 +364,8 @@ func (l *s3Objects) NewMultipartUpload(ctx context.Context, bucket string, objec
 	opts := miniogo.PutObjectOptions{UserMetadata: metadata}
 	uploadID, err = l.Client.NewMultipartUpload(bucket, object, opts)
 	if err != nil {
-		return uploadID, minio.ErrorRespToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return uploadID, minio.ErrorRespToObjectError(err, bucket, object)
 	}
 	return uploadID, nil
 }
@@ -355,7 +374,8 @@ func (l *s3Objects) NewMultipartUpload(ctx context.Context, bucket string, objec
 func (l *s3Objects) PutObjectPart(ctx context.Context, bucket string, object string, uploadID string, partID int, data *hash.Reader) (pi minio.PartInfo, e error) {
 	info, err := l.Client.PutObjectPart(bucket, object, uploadID, partID, data, data.Size(), data.MD5Base64String(), data.SHA256HexString())
 	if err != nil {
-		return pi, minio.ErrorRespToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return pi, minio.ErrorRespToObjectError(err, bucket, object)
 	}
 
 	return minio.FromMinioClientObjectPart(info), nil
@@ -372,7 +392,8 @@ func (l *s3Objects) CopyObjectPart(ctx context.Context, srcBucket, srcObject, de
 	completePart, err := l.Client.CopyObjectPart(srcBucket, srcObject, destBucket, destObject,
 		uploadID, partID, startOffset, length, srcInfo.UserDefined)
 	if err != nil {
-		return p, minio.ErrorRespToObjectError(errors.Trace(err), srcBucket, srcObject)
+		logger.LogIf(ctx, err)
+		return p, minio.ErrorRespToObjectError(err, srcBucket, srcObject)
 	}
 	p.PartNumber = completePart.PartNumber
 	p.ETag = completePart.ETag
@@ -392,41 +413,55 @@ func (l *s3Objects) ListObjectParts(ctx context.Context, bucket string, object s
 // AbortMultipartUpload aborts a ongoing multipart upload
 func (l *s3Objects) AbortMultipartUpload(ctx context.Context, bucket string, object string, uploadID string) error {
 	err := l.Client.AbortMultipartUpload(bucket, object, uploadID)
-	return minio.ErrorRespToObjectError(errors.Trace(err), bucket, object)
+	logger.LogIf(ctx, err)
+	return minio.ErrorRespToObjectError(err, bucket, object)
 }
 
 // CompleteMultipartUpload completes ongoing multipart upload and finalizes object
 func (l *s3Objects) CompleteMultipartUpload(ctx context.Context, bucket string, object string, uploadID string, uploadedParts []minio.CompletePart) (oi minio.ObjectInfo, e error) {
 	err := l.Client.CompleteMultipartUpload(bucket, object, uploadID, minio.ToMinioClientCompleteParts(uploadedParts))
 	if err != nil {
-		return oi, minio.ErrorRespToObjectError(errors.Trace(err), bucket, object)
+		logger.LogIf(ctx, err)
+		return oi, minio.ErrorRespToObjectError(err, bucket, object)
 	}
 
 	return l.GetObjectInfo(ctx, bucket, object)
 }
 
 // SetBucketPolicy sets policy on bucket
-func (l *s3Objects) SetBucketPolicy(ctx context.Context, bucket string, policyInfo policy.BucketAccessPolicy) error {
-	if err := l.Client.PutBucketPolicy(bucket, policyInfo); err != nil {
-		return minio.ErrorRespToObjectError(errors.Trace(err), bucket, "")
+func (l *s3Objects) SetBucketPolicy(ctx context.Context, bucket string, bucketPolicy *policy.Policy) error {
+	data, err := json.Marshal(bucketPolicy)
+	if err != nil {
+		// This should not happen.
+		logger.LogIf(ctx, err)
+		return minio.ErrorRespToObjectError(err, bucket)
+	}
+
+	if err := l.Client.SetBucketPolicy(bucket, string(data)); err != nil {
+		logger.LogIf(ctx, err)
+		return minio.ErrorRespToObjectError(err, bucket)
 	}
 
 	return nil
 }
 
 // GetBucketPolicy will get policy on bucket
-func (l *s3Objects) GetBucketPolicy(ctx context.Context, bucket string) (policy.BucketAccessPolicy, error) {
-	policyInfo, err := l.Client.GetBucketPolicy(bucket)
+func (l *s3Objects) GetBucketPolicy(ctx context.Context, bucket string) (*policy.Policy, error) {
+	data, err := l.Client.GetBucketPolicy(bucket)
 	if err != nil {
-		return policy.BucketAccessPolicy{}, minio.ErrorRespToObjectError(errors.Trace(err), bucket, "")
+		logger.LogIf(ctx, err)
+		return nil, minio.ErrorRespToObjectError(err, bucket)
 	}
-	return policyInfo, nil
+
+	bucketPolicy, err := policy.ParseConfig(strings.NewReader(data), bucket)
+	return bucketPolicy, minio.ErrorRespToObjectError(err, bucket)
 }
 
 // DeleteBucketPolicy deletes all policies on bucket
 func (l *s3Objects) DeleteBucketPolicy(ctx context.Context, bucket string) error {
-	if err := l.Client.PutBucketPolicy(bucket, policy.BucketAccessPolicy{}); err != nil {
-		return minio.ErrorRespToObjectError(errors.Trace(err), bucket, "")
+	if err := l.Client.SetBucketPolicy(bucket, ""); err != nil {
+		logger.LogIf(ctx, err)
+		return minio.ErrorRespToObjectError(err, bucket, "")
 	}
 	return nil
 }

cmd/gateway/s3/gateway-s3_test.go

@@ -21,7 +21,6 @@ import (
 	"testing"
 
 	miniogo "github.com/minio/minio-go"
-	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/hash"
 
 	minio "github.com/minio/minio/cmd"
@@ -53,7 +52,7 @@ func TestS3ToObjectError(t *testing.T) {
 		},
 		{
 			inputErr:    errResponse("NoSuchBucketPolicy"),
-			expectedErr: minio.PolicyNotFound{},
+			expectedErr: minio.BucketPolicyNotFound{},
 		},
 		{
 			inputErr:    errResponse("NoSuchBucket"),
@@ -110,18 +109,12 @@ func TestS3ToObjectError(t *testing.T) {
 			inputErr:    fmt.Errorf("not a minio.ErrorResponse"),
 			expectedErr: fmt.Errorf("not a minio.ErrorResponse"),
 		},
-		// Special test case for error value that is not of
-		// type (*Error)
-		{
-			inputErr:    fmt.Errorf("not a *Error"),
-			expectedErr: fmt.Errorf("not a *Error"),
-		},
 	}
 
 	for i, tc := range testCases {
-		actualErr := minio.ErrorRespToObjectError(errors.Trace(tc.inputErr), tc.bucket, tc.object)
-		if e, ok := actualErr.(*errors.Error); ok && e.Cause.Error() != tc.expectedErr.Error() {
-			t.Errorf("Test case %d: Expected error %v but received error %v", i+1, tc.expectedErr, e)
+		actualErr := minio.ErrorRespToObjectError(tc.inputErr, tc.bucket, tc.object)
+		if actualErr != nil && tc.expectedErr != nil && actualErr.Error() != tc.expectedErr.Error() {
+			t.Errorf("Test case %d: Expected error %v but received error %v", i+1, tc.expectedErr, actualErr)
 		}
 	}
 }

cmd/gateway/sia/gateway-sia.go

@@ -24,7 +24,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"log"
 	"net/http"
 	"net/url"
 	"os"
@@ -38,8 +37,8 @@ import (
 	"github.com/minio/cli"
 	"github.com/minio/minio-go/pkg/set"
 	minio "github.com/minio/minio/cmd"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
-	"github.com/minio/minio/pkg/errors"
 	"github.com/minio/minio/pkg/hash"
 )
 
@@ -112,7 +111,7 @@ func siaGatewayMain(ctx *cli.Context) {
 	// Validate gateway arguments.
 	host := ctx.Args().First()
 	// Validate gateway arguments.
-	minio.FatalIf(minio.ValidateGatewayArguments(ctx.GlobalString("address"), host), "Invalid argument")
+	logger.FatalIf(minio.ValidateGatewayArguments(ctx.GlobalString("address"), host), "Invalid argument")
 
 	minio.StartGateway(ctx, &Sia{host})
 }
@@ -164,9 +163,11 @@ func (g *Sia) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, error)
 	colorBlue := color.New(color.FgBlue).SprintfFunc()
 	colorBold := color.New(color.Bold).SprintFunc()
 
-	log.Println(colorBlue("\nSia Gateway Configuration:"))
-	log.Println(colorBlue("  Sia Daemon API Address:") + colorBold(fmt.Sprintf(" %s\n", sia.Address)))
-	log.Println(colorBlue("  Sia Temp Directory:") + colorBold(fmt.Sprintf(" %s\n", sia.TempDir)))
+	formatStr := "%" + fmt.Sprintf("%ds", len(sia.Address)+7)
+	logger.StartupMessage(colorBlue("\nSia Configuration:"))
+	logger.StartupMessage(colorBlue("  API Address:") + colorBold(fmt.Sprintf(formatStr, sia.Address)))
+	logger.StartupMessage(colorBlue("  Staging Directory:") + colorBold(fmt.Sprintf(" %s", sia.TempDir)))
+
 	return sia, nil
 }
 
@@ -217,10 +218,11 @@ func (s MethodNotSupported) Error() string {
 // apiGet wraps a GET request with a status code check, such that if the GET does
 // not return 2xx, the error will be read and returned. The response body is
 // not closed.
-func apiGet(addr, call, apiPassword string) (*http.Response, error) {
+func apiGet(ctx context.Context, addr, call, apiPassword string) (*http.Response, error) {
 	req, err := http.NewRequest("GET", "http://"+addr+call, nil)
 	if err != nil {
-		return nil, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return nil, err
 	}
 	req.Header.Set("User-Agent", "Sia-Agent")
 	if apiPassword != "" {
@@ -228,15 +230,18 @@ func apiGet(addr, call, apiPassword string) (*http.Response, error) {
 	}
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
-		return nil, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return nil, err
 	}
 	if resp.StatusCode == http.StatusNotFound {
 		resp.Body.Close()
+		logger.LogIf(ctx, MethodNotSupported{call})
 		return nil, MethodNotSupported{call}
 	}
 	if non2xx(resp.StatusCode) {
 		err := decodeError(resp)
 		resp.Body.Close()
+		logger.LogIf(ctx, err)
 		return nil, err
 	}
 	return resp, nil
@@ -245,7 +250,7 @@ func apiGet(addr, call, apiPassword string) (*http.Response, error) {
 // apiPost wraps a POST request with a status code check, such that if the POST
 // does not return 2xx, the error will be read and returned. The response body
 // is not closed.
-func apiPost(addr, call, vals, apiPassword string) (*http.Response, error) {
+func apiPost(ctx context.Context, addr, call, vals, apiPassword string) (*http.Response, error) {
 	req, err := http.NewRequest("POST", "http://"+addr+call, strings.NewReader(vals))
 	if err != nil {
 		return nil, err
@@ -257,7 +262,8 @@ func apiPost(addr, call, vals, apiPassword string) (*http.Response, error) {
 	}
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
-		return nil, errors.Trace(err)
+		logger.LogIf(ctx, err)
+		return nil, err
 	}
 
 	if resp.StatusCode == http.StatusNotFound {
@@ -275,8 +281,8 @@ func apiPost(addr, call, vals, apiPassword string) (*http.Response, error) {
 
 // post makes an API call and discards the response. An error is returned if
 // the response status is not 2xx.
-func post(addr, call, vals, apiPassword string) error {
-	resp, err := apiPost(addr, call, vals, apiPassword)
+func post(ctx context.Context, addr, call, vals, apiPassword string) error {
+	resp, err := apiPost(ctx, addr, call, vals, apiPassword)
 	if err != nil {
 		return err
 	}
@@ -285,24 +291,26 @@ func post(addr, call, vals, apiPassword string) error {
 }
 
 // list makes a lists all the uploaded files, decodes the json response.
-func list(addr string, apiPassword string, obj *renterFiles) error {
-	resp, err := apiGet(addr, "/renter/files", apiPassword)
+func list(ctx context.Context, addr string, apiPassword string, obj *renterFiles) error {
+	resp, err := apiGet(ctx, addr, "/renter/files", apiPassword)
 	if err != nil {
 		return err
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode == http.StatusNoContent {
+		logger.LogIf(ctx, fmt.Errorf("Expecting a response, but API returned %s", resp.Status))
 		return fmt.Errorf("Expecting a response, but API returned %s", resp.Status)
 	}
-
-	return json.NewDecoder(resp.Body).Decode(obj)
+	err = json.NewDecoder(resp.Body).Decode(obj)
+	logger.LogIf(ctx, err)
+	return err
 }
 
 // get makes an API call and discards the response. An error is returned if the
 // responsee status is not 2xx.
-func get(addr, call, apiPassword string) error {
-	resp, err := apiGet(addr, call, apiPassword)
+func get(ctx context.Context, addr, call, apiPassword string) error {
+	resp, err := apiGet(ctx, addr, call, apiPassword)
 	if err != nil {
 		return err
 	}
@@ -336,7 +344,7 @@ func (s *siaObjects) MakeBucketWithLocation(ctx context.Context, bucket, locatio
 
 	sha256sum := sha256.Sum256([]byte(bucket))
 	var siaObj = path.Join(s.RootDir, bucket, hex.EncodeToString(sha256sum[:]))
-	return post(s.Address, "/renter/upload/"+siaObj, "source="+srcFile, s.password)
+	return post(ctx, s.Address, "/renter/upload/"+siaObj, "source="+srcFile, s.password)
 }
 
 // GetBucketInfo gets bucket metadata.
@@ -347,7 +355,7 @@ func (s *siaObjects) GetBucketInfo(ctx context.Context, bucket string) (bi minio
 	dstFile := path.Join(s.TempDir, minio.MustGetUUID())
 	defer os.Remove(dstFile)
 
-	if err := get(s.Address, "/renter/download/"+siaObj+"?destination="+url.QueryEscape(dstFile), s.password); err != nil {
+	if err := get(ctx, s.Address, "/renter/download/"+siaObj+"?destination="+url.QueryEscape(dstFile), s.password); err != nil {
 		return bi, err
 	}
 	return minio.BucketInfo{Name: bucket}, nil
@@ -355,7 +363,7 @@ func (s *siaObjects) GetBucketInfo(ctx context.Context, bucket string) (bi minio
 
 // ListBuckets will detect and return existing buckets on Sia.
 func (s *siaObjects) ListBuckets(ctx context.Context) (buckets []minio.BucketInfo, err error) {
-	sObjs, serr := s.listRenterFiles("")
+	sObjs, serr := s.listRenterFiles(ctx, "")
 	if serr != nil {
 		return buckets, serr
 	}
@@ -388,11 +396,11 @@ func (s *siaObjects) DeleteBucket(ctx context.Context, bucket string) error {
 	sha256sum := sha256.Sum256([]byte(bucket))
 	var siaObj = path.Join(s.RootDir, bucket, hex.EncodeToString(sha256sum[:]))
 
-	return post(s.Address, "/renter/delete/"+siaObj, "", s.password)
+	return post(ctx, s.Address, "/renter/delete/"+siaObj, "", s.password)
 }
 
 func (s *siaObjects) ListObjects(ctx context.Context, bucket string, prefix string, marker string, delimiter string, maxKeys int) (loi minio.ListObjectsInfo, err error) {
-	siaObjs, siaErr := s.listRenterFiles(bucket)
+	siaObjs, siaErr := s.listRenterFiles(ctx, bucket)
 	if siaErr != nil {
 		return loi, siaErr
 	}
@@ -429,7 +437,7 @@ func (s *siaObjects) GetObject(ctx context.Context, bucket string, object string
 	defer os.Remove(dstFile)
 
 	var siaObj = path.Join(s.RootDir, bucket, object)
-	if err := get(s.Address, "/renter/download/"+siaObj+"?destination="+url.QueryEscape(dstFile), s.password); err != nil {
+	if err := get(ctx, s.Address, "/renter/download/"+siaObj+"?destination="+url.QueryEscape(dstFile), s.password); err != nil {
 		return err
 	}
 
@@ -459,11 +467,16 @@ func (s *siaObjects) GetObject(ctx context.Context, bucket string, object string
 
 	// Reply back invalid range if the input offset and length fall out of range.
 	if startOffset > size || startOffset+length > size {
-		return errors.Trace(minio.InvalidRange{
+		logger.LogIf(ctx, minio.InvalidRange{
 			OffsetBegin:  startOffset,
 			OffsetEnd:    length,
 			ResourceSize: size,
 		})
+		return minio.InvalidRange{
+			OffsetBegin:  startOffset,
+			OffsetEnd:    length,
+			ResourceSize: size,
+		}
 	}
 
 	// Allocate a staging buffer.
@@ -476,10 +489,10 @@ func (s *siaObjects) GetObject(ctx context.Context, bucket string, object string
 
 // findSiaObject retrieves the siaObjectInfo for the Sia object with the given
 // Sia path name.
-func (s *siaObjects) findSiaObject(bucket, object string) (siaObjectInfo, error) {
+func (s *siaObjects) findSiaObject(ctx context.Context, bucket, object string) (siaObjectInfo, error) {
 	siaPath := path.Join(s.RootDir, bucket, object)
 
-	sObjs, err := s.listRenterFiles("")
+	sObjs, err := s.listRenterFiles(ctx, "")
 	if err != nil {
 		return siaObjectInfo{}, err
 	}
@@ -489,16 +502,19 @@ func (s *siaObjects) findSiaObject(bucket, object string) (siaObjectInfo, error)
 			return sObj, nil
 		}
 	}
-
-	return siaObjectInfo{}, errors.Trace(minio.ObjectNotFound{
+	logger.LogIf(ctx, minio.ObjectNotFound{
 		Bucket: bucket,
 		Object: object,
 	})
+	return siaObjectInfo{}, minio.ObjectNotFound{
+		Bucket: bucket,
+		Object: object,
+	}
 }
 
 // GetObjectInfo reads object info and replies back ObjectInfo
 func (s *siaObjects) GetObjectInfo(ctx context.Context, bucket string, object string) (minio.ObjectInfo, error) {
-	so, err := s.findSiaObject(bucket, object)
+	so, err := s.findSiaObject(ctx, bucket, object)
 	if err != nil {
 		return minio.ObjectInfo{}, err
 	}
@@ -527,11 +543,11 @@ func (s *siaObjects) PutObject(ctx context.Context, bucket string, object string
 		return objInfo, err
 	}
 
-	if err = post(s.Address, "/renter/upload/"+path.Join(s.RootDir, bucket, object), "source="+srcFile, s.password); err != nil {
+	if err = post(ctx, s.Address, "/renter/upload/"+path.Join(s.RootDir, bucket, object), "source="+srcFile, s.password); err != nil {
 		os.Remove(srcFile)
 		return objInfo, err
 	}
-	defer s.deleteTempFileWhenUploadCompletes(srcFile, bucket, object)
+	defer s.deleteTempFileWhenUploadCompletes(ctx, srcFile, bucket, object)
 
 	return minio.ObjectInfo{
 		Name:    object,
@@ -546,7 +562,7 @@ func (s *siaObjects) PutObject(ctx context.Context, bucket string, object string
 func (s *siaObjects) DeleteObject(ctx context.Context, bucket string, object string) error {
 	// Tell Sia daemon to delete the object
 	var siaObj = path.Join(s.RootDir, bucket, object)
-	return post(s.Address, "/renter/delete/"+siaObj, "", s.password)
+	return post(ctx, s.Address, "/renter/delete/"+siaObj, "", s.password)
 }
 
 // siaObjectInfo represents object info stored on Sia
@@ -565,10 +581,10 @@ type renterFiles struct {
 }
 
 // listRenterFiles will return a list of existing objects in the bucket provided
-func (s *siaObjects) listRenterFiles(bucket string) (siaObjs []siaObjectInfo, err error) {
+func (s *siaObjects) listRenterFiles(ctx context.Context, bucket string) (siaObjs []siaObjectInfo, err error) {
 	// Get list of all renter files
 	var rf renterFiles
-	if err = list(s.Address, s.password, &rf); err != nil {
+	if err = list(ctx, s.Address, s.password, &rf); err != nil {
 		return siaObjs, err
 	}
 
@@ -592,16 +608,15 @@ func (s *siaObjects) listRenterFiles(bucket string) (siaObjs []siaObjectInfo, er
 // deleteTempFileWhenUploadCompletes checks the status of a Sia file upload
 // until it reaches 100% upload progress, then deletes the local temp copy from
 // the filesystem.
-func (s *siaObjects) deleteTempFileWhenUploadCompletes(tempFile string, bucket, object string) {
+func (s *siaObjects) deleteTempFileWhenUploadCompletes(ctx context.Context, tempFile string, bucket, object string) {
 	var soi siaObjectInfo
 	// Wait until 100% upload instead of 1x redundancy because if we delete
 	// after 1x redundancy, the user has to pay the cost of other hosts
 	// redistributing the file.
 	for soi.UploadProgress < 100.0 {
 		var err error
-		soi, err = s.findSiaObject(bucket, object)
+		soi, err = s.findSiaObject(ctx, bucket, object)
 		if err != nil {
-			minio.ErrorIf(err, "Unable to find file uploaded to Sia path %s/%s", bucket, object)
 			break
 		}
 

cmd/generic-handlers.go

@@ -25,6 +25,7 @@ import (
 	"time"
 
 	humanize "github.com/dustin/go-humanize"
+	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/sys"
 	"github.com/rs/cors"
 	"golang.org/x/time/rate"
@@ -205,6 +206,17 @@ func guessIsHealthCheckReq(req *http.Request) bool {
 			req.URL.Path == healthCheckPathPrefix+healthCheckReadinessPath)
 }
 
+// guessIsMetricsReq - returns true if incoming request looks
+// like metrics request
+func guessIsMetricsReq(req *http.Request) bool {
+	if req == nil {
+		return false
+	}
+	aType := getRequestAuthType(req)
+	return aType == authTypeAnonymous &&
+		req.URL.Path == minioReservedBucketPath+prometheusMetricsPath
+}
+
 // guessIsRPCReq - returns true if the request is for an RPC endpoint.
 func guessIsRPCReq(req *http.Request) bool {
 	if req == nil {
@@ -275,7 +287,7 @@ func setReservedBucketHandler(h http.Handler) http.Handler {
 
 func (h minioReservedBucketHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	switch {
-	case guessIsRPCReq(r), guessIsBrowserReq(r), guessIsHealthCheckReq(r), isAdminReq(r):
+	case guessIsRPCReq(r), guessIsBrowserReq(r), guessIsHealthCheckReq(r), guessIsMetricsReq(r), isAdminReq(r):
 		// Allow access to reserved buckets
 	default:
 		// For all other requests reject access to reserved
@@ -408,6 +420,11 @@ func setIgnoreResourcesHandler(h http.Handler) http.Handler {
 // Checks requests for not implemented Bucket resources
 func ignoreNotImplementedBucketResources(req *http.Request) bool {
 	for name := range req.URL.Query() {
+		// Enable GetBucketACL dummy call specifically.
+		if name == "acl" && req.Method == http.MethodGet {
+			return false
+		}
+
 		if notimplementedBucketResourceNames[name] {
 			return true
 		}
@@ -418,6 +435,10 @@ func ignoreNotImplementedBucketResources(req *http.Request) bool {
 // Checks requests for not implemented Object resources
 func ignoreNotImplementedObjectResources(req *http.Request) bool {
 	for name := range req.URL.Query() {
+		// Enable GetObjectACL dummy call specifically.
+		if name == "acl" && req.Method == http.MethodGet {
+			return false
+		}
 		if notimplementedObjectResourceNames[name] {
 			return true
 		}
@@ -437,6 +458,9 @@ var notimplementedBucketResourceNames = map[string]bool{
 	"requestPayment": true,
 	"versioning":     true,
 	"website":        true,
+	"inventory":      true,
+	"metrics":        true,
+	"accelerate":     true,
 }
 
 // List of not implemented object queries
@@ -444,6 +468,9 @@ var notimplementedObjectResourceNames = map[string]bool{
 	"torrent": true,
 	"acl":     true,
 	"policy":  true,
+	"tagging": true,
+	"restore": true,
+	"select":  true,
 }
 
 // Resource handler ServeHTTP() wrapper
@@ -591,9 +618,7 @@ func (h pathValidityHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 // cancelled immediately.
 func setRateLimitHandler(h http.Handler) http.Handler {
 	_, maxLimit, err := sys.GetMaxOpenFileLimit()
-	if err != nil {
-		panic(err)
-	}
+	logger.CriticalIf(context.Background(), err)
 	// Burst value is set to 1 to allow only maxOpenFileLimit
 	// requests to happen at once.
 	l := rate.NewLimiter(rate.Limit(maxLimit), 1)
@@ -625,3 +650,18 @@ func (l rateLimit) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	l.handler.ServeHTTP(w, r)
 }
+
+type securityHeaderHandler struct {
+	handler http.Handler
+}
+
+func addSecurityHeaders(h http.Handler) http.Handler {
+	return securityHeaderHandler{handler: h}
+}
+
+func (s securityHeaderHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	header := w.Header()
+	header.Set("X-XSS-Protection", "\"1; mode=block\"")              // Prevents against XSS attacks
+	header.Set("Content-Security-Policy", "block-all-mixed-content") // prevent mixed (HTTP / HTTPS content)
+	s.handler.ServeHTTP(w, r)
+}

cmd/globals.go

@@ -25,8 +25,8 @@ import (
 
 	humanize "github.com/dustin/go-humanize"
 	"github.com/fatih/color"
+	xhttp "github.com/minio/minio/cmd/http"
 	"github.com/minio/minio/pkg/auth"
-	miniohttp "github.com/minio/minio/pkg/http"
 )
 
 // minio configuration related constants.
@@ -76,6 +76,9 @@ const (
 	globalMultipartExpiry = time.Hour * 24 * 14 // 2 weeks.
 	// Cleanup interval when the stale multipart cleanup is initiated.
 	globalMultipartCleanupInterval = time.Hour * 24 // 24 hrs.
+
+	// Limit of location constraint XML for unauthenticted PUT bucket operations.
+	maxLocationConstraintSize = 3 * humanize.MiByte
 )
 
 var (
@@ -120,6 +123,7 @@ var (
 	globalMinioHost = ""
 
 	globalNotificationSys *NotificationSys
+	globalPolicySys       *PolicySys
 
 	// CA root certificates, a nil value means system certs pool will be used
 	globalRootCAs *x509.CertPool
@@ -129,7 +133,7 @@ var (
 
 	globalTLSCertificate *tls.Certificate
 
-	globalHTTPServer        *miniohttp.Server
+	globalHTTPServer        *xhttp.Server
 	globalHTTPServerErrorCh = make(chan error)
 	globalOSSignalCh        = make(chan os.Signal, 1)
 
@@ -188,10 +192,12 @@ var (
 
 // global colors.
 var (
-	colorBold   = color.New(color.Bold).SprintFunc()
-	colorBlue   = color.New(color.FgBlue).SprintfFunc()
-	colorYellow = color.New(color.FgYellow).SprintfFunc()
-	colorRed    = color.New(color.FgRed).SprintfFunc()
+	colorBold     = color.New(color.Bold).SprintFunc()
+	colorRed      = color.New(color.FgRed).SprintfFunc()
+	colorBlue     = color.New(color.FgBlue).SprintfFunc()
+	colorYellow   = color.New(color.FgYellow).SprintfFunc()
+	colorBgYellow = color.New(color.BgYellow).SprintfFunc()
+	colorBlack    = color.New(color.FgBlack).SprintfFunc()
 )
 
 // Returns minio global information, as a key value map.

cmd/handler-utils.go

@@ -17,6 +17,7 @@
 package cmd
 
 import (
+	"context"
 	"io"
 	"mime/multipart"
 	"net"
@@ -24,7 +25,7 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/minio/minio/pkg/errors"
+	"github.com/minio/minio/cmd/logger"
 	httptracer "github.com/minio/minio/pkg/handlers"
 )
 
@@ -36,7 +37,7 @@ func parseLocationConstraint(r *http.Request) (location string, s3Error APIError
 	locationConstraint := createBucketLocationConfiguration{}
 	err := xmlDecoder(r.Body, &locationConstraint, r.ContentLength)
 	if err != nil && err != io.EOF {
-		errorIf(err, "Unable to xml decode location constraint")
+		logger.LogIf(context.Background(), err)
 		// Treat all other failures as XML parsing errors.
 		return "", ErrMalformedXML
 	} // else for both err as nil or io.EOF
@@ -113,9 +114,10 @@ var userMetadataKeyPrefixes = []string{
 }
 
 // extractMetadataFromHeader extracts metadata from HTTP header.
-func extractMetadataFromHeader(header http.Header) (map[string]string, error) {
+func extractMetadataFromHeader(ctx context.Context, header http.Header) (map[string]string, error) {
 	if header == nil {
-		return nil, errors.Trace(errInvalidArgument)
+		logger.LogIf(ctx, errInvalidArgument)
+		return nil, errInvalidArgument
 	}
 	metadata := make(map[string]string)
 
@@ -134,7 +136,8 @@ func extractMetadataFromHeader(header http.Header) (map[string]string, error) {
 	// Go through all other headers for any additional headers that needs to be saved.
 	for key := range header {
 		if key != http.CanonicalHeaderKey(key) {
-			return nil, errors.Trace(errInvalidArgument)
+			logger.LogIf(ctx, errInvalidArgument)
+			return nil, errInvalidArgument
 		}
 		for _, prefix := range userMetadataKeyPrefixes {
 			if strings.HasPrefix(key, prefix) {
@@ -187,12 +190,13 @@ func trimAwsChunkedContentEncoding(contentEnc string) (trimmedContentEnc string)
 }
 
 // Validate form field size for s3 specification requirement.
-func validateFormFieldSize(formValues http.Header) error {
+func validateFormFieldSize(ctx context.Context, formValues http.Header) error {
 	// Iterate over form values
 	for k := range formValues {
 		// Check if value's field exceeds S3 limit
 		if int64(len(formValues.Get(k))) > maxFormFieldSize {
-			return errors.Trace(errSizeUnexpected)
+			logger.LogIf(ctx, errSizeUnexpected)
+			return errSizeUnexpected
 		}
 	}
 
@@ -201,7 +205,7 @@ func validateFormFieldSize(formValues http.Header) error {
 }
 
 // Extract form fields and file data from a HTTP POST Policy
-func extractPostPolicyFormValues(form *multipart.Form) (filePart io.ReadCloser, fileName string, fileSize int64, formValues http.Header, err error) {
+func extractPostPolicyFormValues(ctx context.Context, form *multipart.Form) (filePart io.ReadCloser, fileName string, fileSize int64, formValues http.Header, err error) {
 	/// HTML Form values
 	fileName = ""
 
@@ -212,7 +216,7 @@ func extractPostPolicyFormValues(form *multipart.Form) (filePart io.ReadCloser,
 	}
 
 	// Validate form values.
-	if err = validateFormFieldSize(formValues); err != nil {
+	if err = validateFormFieldSize(ctx, formValues); err != nil {
 		return nil, "", 0, nil, err
 	}
 
@@ -221,7 +225,8 @@ func extractPostPolicyFormValues(form *multipart.Form) (filePart io.ReadCloser,
 		canonicalFormName := http.CanonicalHeaderKey(k)
 		if canonicalFormName == "File" {
 			if len(v) == 0 {
-				return nil, "", 0, nil, errors.Trace(errInvalidArgument)
+				logger.LogIf(ctx, errInvalidArgument)
+				return nil, "", 0, nil, errInvalidArgument
 			}
 			// Fetch fileHeader which has the uploaded file information
 			fileHeader := v[0]
@@ -230,17 +235,20 @@ func extractPostPolicyFormValues(form *multipart.Form) (filePart io.ReadCloser,
 			// Open the uploaded part
 			filePart, err = fileHeader.Open()
 			if err != nil {
-				return nil, "", 0, nil, errors.Trace(err)
+				logger.LogIf(ctx, err)
+				return nil, "", 0, nil, err
 			}
 			// Compute file size
 			fileSize, err = filePart.(io.Seeker).Seek(0, 2)
 			if err != nil {
-				return nil, "", 0, nil, errors.Trace(err)
+				logger.LogIf(ctx, err)
+				return nil, "", 0, nil, err
 			}
 			// Reset Seek to the beginning
 			_, err = filePart.(io.Seeker).Seek(0, 0)
 			if err != nil {
-				return nil, "", 0, nil, errors.Trace(err)
+				logger.LogIf(ctx, err)
+				return nil, "", 0, nil, err
 			}
 			// File found and ready for reading
 			break
@@ -276,7 +284,10 @@ func getResource(path string, host string, domain string) (string, error) {
 		// In bucket.mydomain.com:9000, strip out :9000
 		var err error
 		if host, _, err = net.SplitHostPort(host); err != nil {
-			errorIf(err, "Unable to split %s", host)
+			reqInfo := (&logger.ReqInfo{}).AppendTags("host", host)
+			reqInfo.AppendTags("path", path)
+			ctx := logger.SetReqInfo(context.Background(), reqInfo)
+			logger.LogIf(ctx, err)
 			return "", err
 		}
 	}

cmd/handler-utils_test.go

@@ -18,6 +18,7 @@ package cmd
 
 import (
 	"bytes"
+	"context"
 	"encoding/xml"
 	"io/ioutil"
 	"net/http"
@@ -25,8 +26,6 @@ import (
 	"reflect"
 	"strings"
 	"testing"
-
-	"github.com/minio/minio/pkg/errors"
 )
 
 // Tests validate bucket LocationConstraint.
@@ -114,9 +113,9 @@ func TestValidateFormFieldSize(t *testing.T) {
 
 	// Run validate form field size check under all test cases.
 	for i, testCase := range testCases {
-		err := validateFormFieldSize(testCase.header)
+		err := validateFormFieldSize(context.Background(), testCase.header)
 		if err != nil {
-			if errors.Cause(err).Error() != testCase.err.Error() {
+			if err.Error() != testCase.err.Error() {
 				t.Errorf("Test %d: Expected error %s, got %s", i+1, testCase.err, err)
 			}
 		}
@@ -180,7 +179,7 @@ func TestExtractMetadataHeaders(t *testing.T) {
 
 	// Validate if the extracting headers.
 	for i, testCase := range testCases {
-		metadata, err := extractMetadataFromHeader(testCase.header)
+		metadata, err := extractMetadataFromHeader(context.Background(), testCase.header)
 		if err != nil && !testCase.shouldFail {
 			t.Fatalf("Test %d failed to extract metadata: %v", i+1, err)
 		}

cmd/hasher.go

@@ -18,7 +18,6 @@ package cmd
 
 import (
 	"crypto/md5"
-	"encoding/base64"
 	"encoding/hex"
 
 	"github.com/minio/sha256-simd"
@@ -47,8 +46,3 @@ func getMD5Sum(data []byte) []byte {
 func getMD5Hash(data []byte) string {
 	return hex.EncodeToString(getMD5Sum(data))
 }
-
-// getMD5HashBase64 returns MD5 hash in base64 encoding of given data.
-func getMD5HashBase64(data []byte) string {
-	return base64.StdEncoding.EncodeToString(getMD5Sum(data))
-}

cmd/healthcheck-router.go

@@ -19,7 +19,7 @@ package cmd
 import (
 	"net/http"
 
-	router "github.com/gorilla/mux"
+	"github.com/gorilla/mux"
 )
 
 const (
@@ -30,10 +30,10 @@ const (
 )
 
 // registerHealthCheckRouter - add handler functions for liveness and readiness routes.
-func registerHealthCheckRouter(mux *router.Router) {
+func registerHealthCheckRouter(router *mux.Router) {
 
 	// Healthcheck router
-	healthRouter := mux.NewRoute().PathPrefix(healthCheckPathPrefix).Subrouter()
+	healthRouter := router.PathPrefix(healthCheckPathPrefix).Subrouter()
 
 	// Liveness handler
 	healthRouter.Methods(http.MethodGet).Path(healthCheckLivenessPath).HandlerFunc(LivenessCheckHandler)

cmd/http-stats.go

@@ -21,6 +21,8 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
+
 	"go.uber.org/atomic"
 )
 
@@ -188,6 +190,10 @@ func (st *HTTPStats) updateStats(r *http.Request, w *httpResponseRecorder, durat
 			st.successDELETEs.Duration.Add(durationSecs)
 		}
 	}
+	// Increment the prometheus http request count with appropriate label
+	httpRequests.With(prometheus.Labels{"request_type": r.Method}).Inc()
+	// Increment the prometheus http request response histogram with appropriate label
+	httpRequestsDuration.With(prometheus.Labels{"request_type": r.Method}).Observe(durationSecs)
 }
 
 // Prepare new HTTPStats structure