Check for absence of checksum field and attributes. (#6298)

Fixes #6295

.gitignore

@@ -22,3 +22,4 @@ parts/
 prime/
 stage/
 .sia_temp/
+config.json

.travis.yml

@@ -8,6 +8,13 @@ dist: trusty
 
 language: go
 
+# this ensures PRs based on a local branch are not built twice
+# the downside is that a PR targeting a different branch is not built
+# but as a workaround you can add the branch to this list
+branches:
+  only:
+    - master
+
 matrix:
   include:
     - os: linux

Makefile

@@ -42,8 +42,8 @@ ineffassign:
 
 cyclo:
 	@echo "Running $@"
-	@${GOPATH}/bin/gocyclo -over 100 cmd
-	@${GOPATH}/bin/gocyclo -over 100 pkg
+	@${GOPATH}/bin/gocyclo -over 200 cmd
+	@${GOPATH}/bin/gocyclo -over 200 pkg
 
 deadcode:
 	@echo "Running $@"

browser/app/js/objects/ObjectActions.js

@@ -57,7 +57,7 @@ export class ObjectActions extends React.Component {
     })
   }
   render() {
-    const { object, showShareObjectModal } = this.props
+    const { object, showShareObjectModal, shareObjectName } = this.props
     return (
       <Dropdown id={`obj-actions-${object.name}`}>
         <Dropdown.Toggle noCaret className="fia-toggle" />
@@ -77,7 +77,8 @@ export class ObjectActions extends React.Component {
             <i className="fa fa-trash" />
           </a>
         </Dropdown.Menu>
-        {showShareObjectModal && <ShareObjectModal object={object} />}
+        {(showShareObjectModal && shareObjectName === object.name) &&
+          <ShareObjectModal object={object} />}
         {this.state.showDeleteConfirmation && (
           <DeleteObjectConfirmModal
             deleteObject={this.deleteObject.bind(this)}
@@ -92,7 +93,8 @@ export class ObjectActions extends React.Component {
 const mapStateToProps = (state, ownProps) => {
   return {
     object: ownProps.object,
-    showShareObjectModal: state.objects.shareObject.show
+    showShareObjectModal: state.objects.shareObject.show,
+    shareObjectName: state.objects.shareObject.object
   }
 }
 

browser/app/js/objects/__tests__/ObjectActions.test.js

@@ -88,8 +88,21 @@ describe("ObjectActions", () => {
         object={{ name: "obj1" }}
         currentPrefix={"pre1/"}
         showShareObjectModal={true}
+        shareObjectName={"obj1"}
       />
     )
     expect(wrapper.find("Connect(ShareObjectModal)").length).toBe(1)
   })
+
+  it("shouldn't render ShareObjectModal when the names of the objects don't match", () => {
+    const wrapper = shallow(
+      <ObjectActions
+        object={{ name: "obj1" }}
+        currentPrefix={"pre1/"}
+        showShareObjectModal={true}
+        shareObjectName={"obj2"}
+      />
+    )
+    expect(wrapper.find("Connect(ShareObjectModal)").length).toBe(0)
+  })
 })

browser/build.js

@@ -70,9 +70,9 @@ async.waterfall([
       commitId = stdout.replace('\n', '')
       if (commitId.length !== 40) throw new Error('commitId invalid : ' + commitId)
       assetsFileName = 'ui-assets.go';
-      var cmd = 'go-bindata-assetfs -pkg browser -nocompress=true production/...'
+      var cmd = 'go-bindata-assetfs -o bindata_assetfs.go -pkg browser -nocompress=true production/...'
       if (!isProduction) {
-        cmd = 'go-bindata-assetfs -pkg browser -nocompress=true dev/...'
+        cmd = 'go-bindata-assetfs -o bindata_assetfs.go -pkg browser -nocompress=true dev/...'
       }
       console.log('Running', cmd)
       exec(cmd, cb)

buildscripts/checkdeps.sh

@@ -89,11 +89,11 @@ check_minimum_version() {
 
 assert_is_supported_arch() {
     case "${ARCH}" in
-        x86_64 | amd64 | aarch64 | ppc64le | arm* )
+        x86_64 | amd64 | aarch64 | ppc64le | arm* | s390x )
             return
             ;;
         *)
-            echo "Arch '${ARCH}' is not supported. Supported Arch: [x86_64, amd64, aarch64, ppc64le, arm*]"
+            echo "Arch '${ARCH}' is not supported. Supported Arch: [x86_64, amd64, aarch64, ppc64le, arm*, s390x]"
             exit 1
     esac
 }

buildscripts/verify-build.sh

@@ -71,6 +71,8 @@ function start_minio_erasure_sets()
 function start_minio_dist_erasure_sets()
 {
     declare -a minio_pids
+    export MINIO_ACCESS_KEY=$ACCESS_KEY
+    export MINIO_SECRET_KEY=$SECRET_KEY
     "${MINIO[@]}" server --address=:9000 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9000.log" 2>&1 &
     minio_pids[0]=$!
     "${MINIO[@]}" server --address=:9001 "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets4" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets5" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets6" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets7" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets8" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets9" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets10" "http://127.0.0.1:9000${WORK_DIR}/dist-disk-sets11" "http://127.0.0.1:9001${WORK_DIR}/dist-disk-sets12" "http://127.0.0.1:9002${WORK_DIR}/dist-disk-sets13" "http://127.0.0.1:9003${WORK_DIR}/dist-disk-sets14" "http://127.0.0.1:9004${WORK_DIR}/dist-disk-sets15" "http://127.0.0.1:9005${WORK_DIR}/dist-disk-sets16" "http://127.0.0.1:9006${WORK_DIR}/dist-disk-sets17" "http://127.0.0.1:9007${WORK_DIR}/dist-disk-sets18" "http://127.0.0.1:9008${WORK_DIR}/dist-disk-sets19" "http://127.0.0.1:9009${WORK_DIR}/dist-disk-sets20" >"$WORK_DIR/dist-minio-9001.log" 2>&1 &
@@ -99,6 +101,8 @@ function start_minio_dist_erasure_sets()
 function start_minio_dist_erasure()
 {
     declare -a minio_pids
+    export MINIO_ACCESS_KEY=$ACCESS_KEY
+    export MINIO_SECRET_KEY=$SECRET_KEY
     "${MINIO[@]}" server --address=:9000 "http://127.0.0.1:9000${WORK_DIR}/dist-disk1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk4" >"$WORK_DIR/dist-minio-9000.log" 2>&1 &
     minio_pids[0]=$!
     "${MINIO[@]}" server --address=:9001 "http://127.0.0.1:9000${WORK_DIR}/dist-disk1" "http://127.0.0.1:9001${WORK_DIR}/dist-disk2" "http://127.0.0.1:9002${WORK_DIR}/dist-disk3" "http://127.0.0.1:9003${WORK_DIR}/dist-disk4" >"$WORK_DIR/dist-minio-9001.log" 2>&1 &

cmd/admin-handlers.go

@@ -21,10 +21,8 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io"
 	"net/http"
-	"net/url"
 	"sync"
 	"time"
 
@@ -37,8 +35,6 @@ import (
 )
 
 const (
-	minioConfigTmpFormat = "config-%s.json"
-
 	maxConfigJSONSize = 256 * 1024 // 256KiB
 )
 
@@ -47,11 +43,10 @@ type mgmtQueryKey string
 
 // Only valid query params for mgmt admin APIs.
 const (
-	mgmtBucket        mgmtQueryKey = "bucket"
-	mgmtPrefix        mgmtQueryKey = "prefix"
-	mgmtLockOlderThan mgmtQueryKey = "older-than"
-	mgmtClientToken   mgmtQueryKey = "clientToken"
-	mgmtForceStart    mgmtQueryKey = "forceStart"
+	mgmtBucket      mgmtQueryKey = "bucket"
+	mgmtPrefix      mgmtQueryKey = "prefix"
+	mgmtClientToken mgmtQueryKey = "clientToken"
+	mgmtForceStart  mgmtQueryKey = "forceStart"
 )
 
 var (
@@ -443,6 +438,15 @@ func (a adminAPIHandlers) HealHandler(w http.ResponseWriter, r *http.Request) {
 // GetConfigHandler - GET /minio/admin/v1/config
 // Get config.json of this minio setup.
 func (a adminAPIHandlers) GetConfigHandler(w http.ResponseWriter, r *http.Request) {
+	ctx := newContext(r, w, "GetConfigHandler")
+
+	// Get current object layer instance.
+	objectAPI := newObjectLayerFn()
+	if objectAPI == nil {
+		writeErrorResponseJSON(w, ErrServerNotInitialized, r.URL)
+		return
+	}
+
 	// Validate request signature.
 	adminAPIErr := checkAdminRequestAuthType(r, "")
 	if adminAPIErr != ErrNone {
@@ -450,26 +454,28 @@ func (a adminAPIHandlers) GetConfigHandler(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	// Take a read lock on minio/config.json. NB minio is a
-	// reserved bucket name and wouldn't conflict with normal
-	// object operations.
-	configLock := globalNSMutex.NewNSLock(minioReservedBucket, minioConfigFile)
-	if configLock.GetRLock(globalObjectTimeout) != nil {
-		writeErrorResponseJSON(w, ErrOperationTimedOut, r.URL)
-		return
-	}
-	defer configLock.RUnlock()
-
-	// Get config.json - in distributed mode, the configuration
-	// occurring on a quorum of the servers is returned.
-	configBytes, err := getPeerConfig(globalAdminPeers)
+	config, err := readServerConfig(ctx, objectAPI)
 	if err != nil {
-		logger.LogIf(context.Background(), err)
 		writeErrorResponseJSON(w, toAdminAPIErrCode(err), r.URL)
 		return
 	}
 
-	writeSuccessResponseJSON(w, configBytes)
+	configData, err := json.Marshal(config)
+	if err != nil {
+		logger.LogIf(ctx, err)
+		writeErrorResponseJSON(w, toAdminAPIErrCode(err), r.URL)
+		return
+	}
+
+	password := config.GetCredential().SecretKey
+	econfigData, err := madmin.EncryptServerConfigData(password, configData)
+	if err != nil {
+		logger.LogIf(ctx, err)
+		writeErrorResponseJSON(w, toAdminAPIErrCode(err), r.URL)
+		return
+	}
+
+	writeSuccessResponseJSON(w, econfigData)
 }
 
 // toAdminAPIErrCode - converts errXLWriteQuorum error to admin API
@@ -478,65 +484,15 @@ func toAdminAPIErrCode(err error) APIErrorCode {
 	switch err {
 	case errXLWriteQuorum:
 		return ErrAdminConfigNoQuorum
+	default:
+		return toAPIErrorCode(err)
 	}
-	return toAPIErrorCode(err)
-}
-
-// SetConfigResult - represents detailed results of a set-config
-// operation.
-type nodeSummary struct {
-	Name   string `json:"name"`
-	ErrSet bool   `json:"errSet"`
-	ErrMsg string `json:"errMsg"`
-}
-
-type setConfigResult struct {
-	NodeResults []nodeSummary `json:"nodeResults"`
-	Status      bool          `json:"status"`
-}
-
-// writeSetConfigResponse - writes setConfigResult value as json
-// depending on the status.
-func writeSetConfigResponse(w http.ResponseWriter, peers adminPeers,
-	errs []error, status bool, reqURL *url.URL) {
-
-	var nodeResults []nodeSummary
-	// Build nodeResults based on error values received during
-	// set-config operation.
-	for i := range errs {
-		nodeResults = append(nodeResults, nodeSummary{
-			Name:   peers[i].addr,
-			ErrSet: errs[i] != nil,
-			ErrMsg: fmt.Sprintf("%v", errs[i]),
-		})
-
-	}
-
-	result := setConfigResult{
-		Status:      status,
-		NodeResults: nodeResults,
-	}
-
-	// The following elaborate json encoding is to avoid escaping
-	// '<', '>' in <nil>. Note: json.Encoder.Encode() adds a
-	// gratuitous "\n".
-	var resultBuf bytes.Buffer
-	enc := json.NewEncoder(&resultBuf)
-	enc.SetEscapeHTML(false)
-	jsonErr := enc.Encode(result)
-	if jsonErr != nil {
-		writeErrorResponseJSON(w, toAPIErrorCode(jsonErr), reqURL)
-		return
-	}
-
-	writeSuccessResponseJSON(w, resultBuf.Bytes())
-	return
 }
 
 // SetConfigHandler - PUT /minio/admin/v1/config
 func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Request) {
+	ctx := newContext(r, w, "SetConfigHandler")
 
-	ctx := context.Background()
 	// Get current object layer instance.
 	objectAPI := newObjectLayerFn()
 	if objectAPI == nil {
@@ -544,12 +500,6 @@ func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	// Deny if WORM is enabled
-	if globalWORMEnabled {
-		writeErrorResponseJSON(w, ErrMethodNotAllowed, r.URL)
-		return
-	}
-
 	// Validate request signature.
 	adminAPIErr := checkAdminRequestAuthType(r, "")
 	if adminAPIErr != ErrNone {
@@ -571,7 +521,13 @@ func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	configBytes := configBuf[:n]
+	password := globalServerConfig.GetCredential().SecretKey
+	configBytes, err := madmin.DecryptServerConfigData(password, bytes.NewReader(configBuf[:n]))
+	if err != nil {
+		logger.LogIf(ctx, err)
+		writeErrorResponseJSON(w, ErrAdminConfigBadJSON, r.URL)
+		return
+	}
 
 	// Validate JSON provided in the request body: check the
 	// client has not sent JSON objects with duplicate keys.
@@ -600,58 +556,45 @@ func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Reques
 		}
 	}
 
-	if err := config.Validate(); err != nil {
+	if err = config.Validate(); err != nil {
 		writeCustomErrorResponseJSON(w, ErrAdminConfigBadJSON, err.Error(), r.URL)
 		return
 	}
 
-	// Write config received from request onto a temporary file on
-	// all nodes.
-	tmpFileName := fmt.Sprintf(minioConfigTmpFormat, mustGetUUID())
-	errs := writeTmpConfigPeers(globalAdminPeers, tmpFileName, configBytes)
-
-	// Check if the operation succeeded in quorum or more nodes.
-	rErr := reduceWriteQuorumErrs(ctx, errs, nil, len(globalAdminPeers)/2+1)
-	if rErr != nil {
-		writeSetConfigResponse(w, globalAdminPeers, errs, false, r.URL)
+	if err = saveServerConfig(objectAPI, &config); err != nil {
+		writeErrorResponseJSON(w, toAdminAPIErrCode(err), r.URL)
 		return
 	}
 
-	// Take a lock on minio/config.json. NB minio is a reserved
-	// bucket name and wouldn't conflict with normal object
-	// operations.
-	configLock := globalNSMutex.NewNSLock(minioReservedBucket, minioConfigFile)
-	if configLock.GetLock(globalObjectTimeout) != nil {
-		writeErrorResponseJSON(w, ErrOperationTimedOut, r.URL)
-		return
-	}
-	defer configLock.Unlock()
+	// Reply to the client before restarting minio server.
+	writeSuccessResponseHeadersOnly(w)
 
-	// Rename the temporary config file to config.json
-	errs = commitConfigPeers(globalAdminPeers, tmpFileName)
-	rErr = reduceWriteQuorumErrs(ctx, errs, nil, len(globalAdminPeers)/2+1)
-	if rErr != nil {
-		writeSetConfigResponse(w, globalAdminPeers, errs, false, r.URL)
-		return
-	}
-
-	// serverMux (cmd/server-mux.go) implements graceful shutdown,
-	// where all listeners are closed and process restart/shutdown
-	// happens after 5s or completion of all ongoing http
-	// requests, whichever is earlier.
-	writeSetConfigResponse(w, globalAdminPeers, errs, true, r.URL)
-
-	// Restart all node for the modified config to take effect.
 	sendServiceCmd(globalAdminPeers, serviceRestart)
 }
 
-// ConfigCredsHandler - POST /minio/admin/v1/config/credential
+// UpdateCredsHandler - POST /minio/admin/v1/config/credential
 // ----------
 // Update credentials in a minio server. In a distributed setup,
 // update all the servers in the cluster.
 func (a adminAPIHandlers) UpdateCredentialsHandler(w http.ResponseWriter,
 	r *http.Request) {
 
+	ctx := newContext(r, w, "UpdateCredentialsHandler")
+
+	// Get current object layer instance.
+	objectAPI := newObjectLayerFn()
+	if objectAPI == nil {
+		writeErrorResponseJSON(w, ErrServerNotInitialized, r.URL)
+		return
+	}
+
+	// Avoid setting new credentials when they are already passed
+	// by the environment. Deny if WORM is enabled.
+	if globalIsEnvCreds {
+		writeErrorResponseJSON(w, ErrMethodNotAllowed, r.URL)
+		return
+	}
+
 	// Authenticate request
 	adminAPIErr := checkAdminRequestAuthType(r, "")
 	if adminAPIErr != ErrNone {
@@ -659,18 +602,32 @@ func (a adminAPIHandlers) UpdateCredentialsHandler(w http.ResponseWriter,
 		return
 	}
 
-	// Avoid setting new credentials when they are already passed
-	// by the environment. Deny if WORM is enabled.
-	if globalIsEnvCreds || globalWORMEnabled {
-		writeErrorResponseJSON(w, ErrMethodNotAllowed, r.URL)
+	// Read configuration bytes from request body.
+	configBuf := make([]byte, maxConfigJSONSize+1)
+	n, err := io.ReadFull(r.Body, configBuf)
+	if err == nil {
+		// More than maxConfigSize bytes were available
+		writeErrorResponseJSON(w, ErrAdminConfigTooLarge, r.URL)
+		return
+	}
+	if err != io.ErrUnexpectedEOF {
+		logger.LogIf(ctx, err)
+		writeErrorResponseJSON(w, toAPIErrorCode(err), r.URL)
+		return
+	}
+
+	password := globalServerConfig.GetCredential().SecretKey
+	configBytes, err := madmin.DecryptServerConfigData(password, bytes.NewReader(configBuf[:n]))
+	if err != nil {
+		logger.LogIf(ctx, err)
+		writeErrorResponseJSON(w, ErrAdminConfigBadJSON, r.URL)
 		return
 	}
 
 	// Decode request body
 	var req madmin.SetCredsReq
-	err := json.NewDecoder(r.Body).Decode(&req)
-	if err != nil {
-		logger.LogIf(context.Background(), err)
+	if err = json.Unmarshal(configBytes, &req); err != nil {
+		logger.LogIf(ctx, err)
 		writeErrorResponseJSON(w, ErrRequestBodyParse, r.URL)
 		return
 	}
@@ -681,33 +638,25 @@ func (a adminAPIHandlers) UpdateCredentialsHandler(w http.ResponseWriter,
 		return
 	}
 
-	// Take a lock on minio/config.json. Prevents concurrent
-	// config file updates.
-	configLock := globalNSMutex.NewNSLock(minioReservedBucket, minioConfigFile)
-	if configLock.GetLock(globalObjectTimeout) != nil {
-		writeErrorResponseJSON(w, ErrOperationTimedOut, r.URL)
-		return
-	}
-	defer configLock.Unlock()
-
 	// Acquire lock before updating global configuration.
 	globalServerConfigMu.Lock()
 	defer globalServerConfigMu.Unlock()
 
 	// Update local credentials in memory.
 	globalServerConfig.SetCredential(creds)
-	if err = globalServerConfig.Save(getConfigFile()); err != nil {
-		writeErrorResponseJSON(w, ErrInternalError, r.URL)
+
+	if err = saveServerConfig(objectAPI, globalServerConfig); err != nil {
+		writeErrorResponseJSON(w, toAdminAPIErrCode(err), r.URL)
 		return
 	}
 
 	// Notify all other Minio peers to update credentials
-	for host, err := range globalNotificationSys.SetCredentials(creds) {
+	for host, err := range globalNotificationSys.LoadCredentials() {
 		reqInfo := (&logger.ReqInfo{}).AppendTags("peerAddress", host.String())
-		ctx := logger.SetReqInfo(context.Background(), reqInfo)
+		ctx := logger.SetReqInfo(ctx, reqInfo)
 		logger.LogIf(ctx, err)
 	}
 
-	// At this stage, the operation is successful, return 200 OK
-	w.WriteHeader(http.StatusOK)
+	// Reply to the client before restarting minio server.
+	writeSuccessResponseHeadersOnly(w)
 }

cmd/admin-handlers_test.go

@@ -26,7 +26,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
-	"os"
 	"strings"
 	"testing"
 	"time"
@@ -38,7 +37,7 @@ import (
 
 var (
 	configJSON = []byte(`{
-	"version": "27",
+	"version": "28",
 	"credential": {
 		"accessKey": "minio",
 		"secretKey": "minio123"
@@ -57,6 +56,22 @@ var (
 		"maxuse": 80,
 		"exclude": []
 	},
+	"kms": {
+		"vault": {
+			"endpoint": "",
+			"auth": {
+				"type": "",
+				"approle": {
+					"id": "",
+					"secret": ""
+				}
+			},
+			"key-id": {
+				"name": "",
+				"version": 0
+			}
+		}
+	},
 	"notify": {
 		"amqp": {
 			"1": {
@@ -193,17 +208,17 @@ func prepareAdminXLTestBed() (*adminXLTestBed, error) {
 	// reset global variables to start afresh.
 	resetTestGlobals()
 
-	// Initialize minio server config.
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		return nil, err
-	}
 	// Initializing objectLayer for HealFormatHandler.
 	objLayer, xlDirs, xlErr := initTestXLObjLayer()
 	if xlErr != nil {
 		return nil, xlErr
 	}
 
+	// Initialize minio server config.
+	if err := newTestConfig(globalMinioDefaultRegion, objLayer); err != nil {
+		return nil, err
+	}
+
 	// Initialize boot time
 	globalBootTime = UTCNow()
 
@@ -230,17 +245,15 @@ func prepareAdminXLTestBed() (*adminXLTestBed, error) {
 	registerAdminRouter(adminRouter)
 
 	return &adminXLTestBed{
-		configPath: rootPath,
-		xlDirs:     xlDirs,
-		objLayer:   objLayer,
-		router:     adminRouter,
+		xlDirs:   xlDirs,
+		objLayer: objLayer,
+		router:   adminRouter,
 	}, nil
 }
 
 // TearDown - method that resets the test bed for subsequent unit
 // tests to start afresh.
 func (atb *adminXLTestBed) TearDown() {
-	os.RemoveAll(atb.configPath)
 	removeRoots(atb.xlDirs)
 	resetTestGlobals()
 }
@@ -579,8 +592,14 @@ func TestServiceSetCreds(t *testing.T) {
 		if err != nil {
 			t.Fatalf("JSONify err: %v", err)
 		}
+
+		ebody, err := madmin.EncryptServerConfigData(credentials.SecretKey, body)
+		if err != nil {
+			t.Fatal(err)
+		}
+
 		// Construct setCreds request
-		req, err := getServiceCmdRequest(setCreds, credentials, body)
+		req, err := getServiceCmdRequest(setCreds, credentials, ebody)
 		if err != nil {
 			t.Fatalf("Failed to build service status request %v", err)
 		}
@@ -680,8 +699,14 @@ func TestSetConfigHandler(t *testing.T) {
 	queryVal := url.Values{}
 	queryVal.Set("config", "")
 
+	password := globalServerConfig.GetCredential().SecretKey
+	econfigJSON, err := madmin.EncryptServerConfigData(password, configJSON)
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	req, err := buildAdminRequest(queryVal, http.MethodPut, "/config",
-		int64(len(configJSON)), bytes.NewReader(configJSON))
+		int64(len(econfigJSON)), bytes.NewReader(econfigJSON))
 	if err != nil {
 		t.Fatalf("Failed to construct set-config object request - %v", err)
 	}
@@ -692,16 +717,6 @@ func TestSetConfigHandler(t *testing.T) {
 		t.Errorf("Expected to succeed but failed with %d", rec.Code)
 	}
 
-	result := setConfigResult{}
-	err = json.NewDecoder(rec.Body).Decode(&result)
-	if err != nil {
-		t.Fatalf("Failed to decode set config result json %v", err)
-	}
-
-	if !result.Status {
-		t.Error("Expected set-config to succeed, but failed")
-	}
-
 	// Check that a very large config file returns an error.
 	{
 		// Make a large enough config string
@@ -724,7 +739,7 @@ func TestSetConfigHandler(t *testing.T) {
 	// Check that a config with duplicate keys in an object return
 	// error.
 	{
-		invalidCfg := append(configJSON[:len(configJSON)-1], []byte(`, "version": "15"}`)...)
+		invalidCfg := append(econfigJSON[:len(econfigJSON)-1], []byte(`, "version": "15"}`)...)
 		req, err := buildAdminRequest(queryVal, http.MethodPut, "/config",
 			int64(len(invalidCfg)), bytes.NewReader(invalidCfg))
 		if err != nil {
@@ -822,81 +837,6 @@ func TestToAdminAPIErr(t *testing.T) {
 	}
 }
 
-func TestWriteSetConfigResponse(t *testing.T) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(rootPath)
-	testCases := []struct {
-		status bool
-		errs   []error
-	}{
-		// 1. all nodes returned success.
-		{
-			status: true,
-			errs:   []error{nil, nil, nil, nil},
-		},
-		// 2. some nodes returned errors.
-		{
-			status: false,
-			errs:   []error{errDiskNotFound, nil, errDiskAccessDenied, errFaultyDisk},
-		},
-	}
-
-	testPeers := []adminPeer{
-		{
-			addr: "localhost:9001",
-		},
-		{
-			addr: "localhost:9002",
-		},
-		{
-			addr: "localhost:9003",
-		},
-		{
-			addr: "localhost:9004",
-		},
-	}
-
-	testURL, err := url.Parse("http://dummy.com")
-	if err != nil {
-		t.Fatalf("Failed to parse a place-holder url")
-	}
-
-	var actualResult setConfigResult
-	for i, test := range testCases {
-		rec := httptest.NewRecorder()
-		writeSetConfigResponse(rec, testPeers, test.errs, test.status, testURL)
-		resp := rec.Result()
-		jsonBytes, err := ioutil.ReadAll(resp.Body)
-		if err != nil {
-			t.Fatalf("Test %d: Failed to read response %v", i+1, err)
-		}
-
-		err = json.Unmarshal(jsonBytes, &actualResult)
-		if err != nil {
-			t.Fatalf("Test %d: Failed to unmarshal json %v", i+1, err)
-		}
-		if actualResult.Status != test.status {
-			t.Errorf("Test %d: Expected status %v but received %v", i+1, test.status, actualResult.Status)
-		}
-		for p, res := range actualResult.NodeResults {
-			if res.Name != testPeers[p].addr {
-				t.Errorf("Test %d: Expected node name %s but received %s", i+1, testPeers[p].addr, res.Name)
-			}
-			expectedErrMsg := fmt.Sprintf("%v", test.errs[p])
-			if res.ErrMsg != expectedErrMsg {
-				t.Errorf("Test %d: Expected error %s but received %s", i+1, expectedErrMsg, res.ErrMsg)
-			}
-			expectedErrSet := test.errs[p] != nil
-			if res.ErrSet != expectedErrSet {
-				t.Errorf("Test %d: Expected ErrSet %v but received %v", i+1, expectedErrSet, res.ErrSet)
-			}
-		}
-	}
-}
-
 func mkHealStartReq(t *testing.T, bucket, prefix string,
 	opts madmin.HealOpts) *http.Request {
 

cmd/admin-router.go

@@ -63,9 +63,9 @@ func registerAdminRouter(router *mux.Router) {
 	/// Config operations
 
 	// Update credentials
-	adminV1Router.Methods(http.MethodPut).Path("/config/credential").HandlerFunc(httpTraceAll(adminAPI.UpdateCredentialsHandler))
+	adminV1Router.Methods(http.MethodPut).Path("/config/credential").HandlerFunc(httpTraceHdrs(adminAPI.UpdateCredentialsHandler))
 	// Get config
-	adminV1Router.Methods(http.MethodGet).Path("/config").HandlerFunc(httpTraceAll(adminAPI.GetConfigHandler))
+	adminV1Router.Methods(http.MethodGet).Path("/config").HandlerFunc(httpTraceHdrs(adminAPI.GetConfigHandler))
 	// Set config
-	adminV1Router.Methods(http.MethodPut).Path("/config").HandlerFunc(httpTraceAll(adminAPI.SetConfigHandler))
+	adminV1Router.Methods(http.MethodPut).Path("/config").HandlerFunc(httpTraceHdrs(adminAPI.SetConfigHandler))
 }

cmd/admin-rpc-client.go

@@ -19,7 +19,6 @@ package cmd
 import (
 	"context"
 	"crypto/tls"
-	"encoding/json"
 	"fmt"
 	"net"
 	"sort"
@@ -69,29 +68,6 @@ func (rpcClient *AdminRPCClient) GetConfig() ([]byte, error) {
 	return reply, err
 }
 
-// WriteTmpConfig - writes config file content to a temporary file on a remote node.
-func (rpcClient *AdminRPCClient) WriteTmpConfig(tmpFileName string, configBytes []byte) error {
-	args := WriteConfigArgs{
-		TmpFileName: tmpFileName,
-		Buf:         configBytes,
-	}
-	reply := VoidReply{}
-
-	err := rpcClient.Call(adminServiceName+".WriteTmpConfig", &args, &reply)
-	logger.LogIf(context.Background(), err)
-	return err
-}
-
-// CommitConfig - Move the new config in tmpFileName onto config.json on a remote node.
-func (rpcClient *AdminRPCClient) CommitConfig(tmpFileName string) error {
-	args := CommitConfigArgs{FileName: tmpFileName}
-	reply := VoidReply{}
-
-	err := rpcClient.Call(adminServiceName+".CommitConfig", &args, &reply)
-	logger.LogIf(context.Background(), err)
-	return err
-}
-
 // NewAdminRPCClient - returns new admin RPC client.
 func NewAdminRPCClient(host *xnet.Host) (*AdminRPCClient, error) {
 	scheme := "http"
@@ -136,8 +112,6 @@ type adminCmdRunner interface {
 	ReInitFormat(dryRun bool) error
 	ServerInfo() (ServerInfoData, error)
 	GetConfig() ([]byte, error)
-	WriteTmpConfig(tmpFileName string, configBytes []byte) error
-	CommitConfig(tmpFileName string) error
 }
 
 // adminPeer - represents an entity that implements admin API RPCs.
@@ -301,187 +275,3 @@ func getPeerUptimes(peers adminPeers) (time.Duration, error) {
 
 	return latestUptime, nil
 }
-
-// getPeerConfig - Fetches config.json from all nodes in the setup and
-// returns the one that occurs in a majority of them.
-func getPeerConfig(peers adminPeers) ([]byte, error) {
-	if !globalIsDistXL {
-		return peers[0].cmdRunner.GetConfig()
-	}
-
-	errs := make([]error, len(peers))
-	configs := make([][]byte, len(peers))
-
-	// Get config from all servers.
-	wg := sync.WaitGroup{}
-	for i, peer := range peers {
-		wg.Add(1)
-		go func(idx int, peer adminPeer) {
-			defer wg.Done()
-			configs[idx], errs[idx] = peer.cmdRunner.GetConfig()
-		}(i, peer)
-	}
-	wg.Wait()
-
-	// Find the maximally occurring config among peers in a
-	// distributed setup.
-
-	serverConfigs := make([]serverConfig, len(peers))
-	for i, configBytes := range configs {
-		if errs[i] != nil {
-			continue
-		}
-
-		// Unmarshal the received config files.
-		err := json.Unmarshal(configBytes, &serverConfigs[i])
-		if err != nil {
-			reqInfo := (&logger.ReqInfo{}).AppendTags("peerAddress", peers[i].addr)
-			ctx := logger.SetReqInfo(context.Background(), reqInfo)
-			logger.LogIf(ctx, err)
-			return nil, err
-		}
-	}
-
-	configJSON, err := getValidServerConfig(serverConfigs, errs)
-	if err != nil {
-		logger.LogIf(context.Background(), err)
-		return nil, err
-	}
-
-	// Return the config.json that was present quorum or more
-	// number of disks.
-	return json.Marshal(configJSON)
-}
-
-// getValidServerConfig - finds the server config that is present in
-// quorum or more number of servers.
-func getValidServerConfig(serverConfigs []serverConfig, errs []error) (scv serverConfig, e error) {
-	// majority-based quorum
-	quorum := len(serverConfigs)/2 + 1
-
-	// Count the number of disks a config.json was found in.
-	configCounter := make([]int, len(serverConfigs))
-
-	// We group equal serverConfigs by the lowest index of the
-	// same value;  e.g, let us take the following serverConfigs
-	// in a 4-node setup,
-	// serverConfigs == [c1, c2, c1, c1]
-	// configCounter == [3, 1, 0, 0]
-	// c1, c2 are the only distinct values that appear.  c1 is
-	// identified by 0, the lowest index it appears in and c2 is
-	// identified by 1. So, we need to find the number of times
-	// each of these distinct values occur.
-
-	// Invariants:
-
-	// 1. At the beginning of the i-th iteration, the number of
-	// unique configurations seen so far is equal to the number of
-	// non-zero counter values in config[:i].
-
-	// 2. At the beginning of the i-th iteration, the sum of
-	// elements of configCounter[:i] is equal to the number of
-	// non-error configurations seen so far.
-
-	// For each of the serverConfig ...
-	for i := range serverConfigs {
-		// Skip nodes where getConfig failed.
-		if errs[i] != nil {
-			continue
-		}
-		// Check if it is equal to any of the configurations
-		// seen so far. If j == i is reached then we have an
-		// unseen configuration.
-		for j := 0; j <= i; j++ {
-			if j < i && configCounter[j] == 0 {
-				// serverConfigs[j] is known to be
-				// equal to a value that was already
-				// seen. See example above for
-				// clarity.
-				continue
-			} else if j < i && serverConfigs[i].ConfigDiff(&serverConfigs[j]) == "" {
-				// serverConfigs[i] is equal to
-				// serverConfigs[j], update
-				// serverConfigs[j]'s counter since it
-				// is the lower index.
-				configCounter[j]++
-				break
-			} else if j == i {
-				// serverConfigs[i] is equal to no
-				// other value seen before. It is
-				// unique so far.
-				configCounter[i] = 1
-				break
-			} // else invariants specified above are violated.
-		}
-	}
-
-	// We find the maximally occurring server config and check if
-	// there is quorum.
-	var configJSON serverConfig
-	maxOccurrence := 0
-	for i, count := range configCounter {
-		if maxOccurrence < count {
-			maxOccurrence = count
-			configJSON = serverConfigs[i]
-		}
-	}
-
-	// If quorum nodes don't agree.
-	if maxOccurrence < quorum {
-		return scv, errXLWriteQuorum
-	}
-
-	return configJSON, nil
-}
-
-// Write config contents into a temporary file on all nodes.
-func writeTmpConfigPeers(peers adminPeers, tmpFileName string, configBytes []byte) []error {
-	// For a single-node minio server setup.
-	if !globalIsDistXL {
-		err := peers[0].cmdRunner.WriteTmpConfig(tmpFileName, configBytes)
-		return []error{err}
-	}
-
-	errs := make([]error, len(peers))
-
-	// Write config into temporary file on all nodes.
-	wg := sync.WaitGroup{}
-	for i, peer := range peers {
-		wg.Add(1)
-		go func(idx int, peer adminPeer) {
-			defer wg.Done()
-			errs[idx] = peer.cmdRunner.WriteTmpConfig(tmpFileName, configBytes)
-		}(i, peer)
-	}
-	wg.Wait()
-
-	// Return bytes written and errors (if any) during writing
-	// temporary config file.
-	return errs
-}
-
-// Move config contents from the given temporary file onto config.json
-// on all nodes.
-func commitConfigPeers(peers adminPeers, tmpFileName string) []error {
-	// For a single-node minio server setup.
-	if !globalIsDistXL {
-		return []error{peers[0].cmdRunner.CommitConfig(tmpFileName)}
-	}
-
-	errs := make([]error, len(peers))
-
-	// Rename temporary config file into configDir/config.json on
-	// all nodes.
-	wg := sync.WaitGroup{}
-	for i, peer := range peers {
-		wg.Add(1)
-		go func(idx int, peer adminPeer) {
-			defer wg.Done()
-			errs[idx] = peer.cmdRunner.CommitConfig(tmpFileName)
-		}(i, peer)
-	}
-	wg.Wait()
-
-	// Return errors (if any) received during rename.
-	return errs
-}

cmd/admin-rpc-server.go

@@ -69,31 +69,6 @@ func (receiver *adminRPCReceiver) ReInitFormat(args *ReInitFormatArgs, reply *Vo
 	return receiver.local.ReInitFormat(args.DryRun)
 }
 
-// WriteConfigArgs - wraps the bytes to be written and temporary file name.
-type WriteConfigArgs struct {
-	AuthArgs
-	TmpFileName string
-	Buf         []byte
-}
-
-// WriteTmpConfig - writes the supplied config contents onto the
-// supplied temporary file.
-func (receiver *adminRPCReceiver) WriteTmpConfig(args *WriteConfigArgs, reply *VoidReply) error {
-	return receiver.local.WriteTmpConfig(args.TmpFileName, args.Buf)
-}
-
-// CommitConfigArgs - wraps the config file name that needs to be
-// committed into config.json on this node.
-type CommitConfigArgs struct {
-	AuthArgs
-	FileName string
-}
-
-// CommitConfig - Renames the temporary file into config.json on this node.
-func (receiver *adminRPCReceiver) CommitConfig(args *CommitConfigArgs, reply *VoidReply) error {
-	return receiver.local.CommitConfig(args.FileName)
-}
-
 // NewAdminRPCServer - returns new admin RPC server.
 func NewAdminRPCServer() (*xrpc.Server, error) {
 	rpcServer := xrpc.NewServer()
@@ -108,5 +83,5 @@ func registerAdminRPCRouter(router *mux.Router) {
 	rpcServer, err := NewAdminRPCServer()
 	logger.FatalIf(err, "Unable to initialize Lock RPC Server", context.Background())
 	subrouter := router.PathPrefix(minioReservedBucketPath).Subrouter()
-	subrouter.Path(adminServiceSubPath).Handler(rpcServer)
+	subrouter.Path(adminServiceSubPath).HandlerFunc(httpTraceHdrs(rpcServer.ServeHTTP))
 }

cmd/admin-rpc_test.go

@@ -17,13 +17,8 @@
 package cmd
 
 import (
-	"encoding/json"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"reflect"
 	"testing"
 	"time"
 
@@ -172,81 +167,6 @@ func testAdminCmdRunnerGetConfig(t *testing.T, client adminCmdRunner) {
 	}
 }
 
-func testAdminCmdRunnerWriteTmpConfig(t *testing.T, client adminCmdRunner) {
-	tmpConfigDir := configDir
-	defer func() {
-		configDir = tmpConfigDir
-	}()
-
-	tempDir, err := ioutil.TempDir("", ".AdminCmdRunnerWriteTmpConfig.")
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-	defer os.RemoveAll(tempDir)
-	configDir = &ConfigDir{dir: tempDir}
-
-	testCases := []struct {
-		tmpFilename string
-		configBytes []byte
-		expectErr   bool
-	}{
-		{"config1.json", []byte(`{"version":"23","region":"us-west-1a"}`), false},
-		// Overwrite test.
-		{"config1.json", []byte(`{"version":"23","region":"us-west-1a","browser":"on"}`), false},
-		{"config2.json", []byte{}, false},
-		{"config3.json", nil, false},
-	}
-
-	for i, testCase := range testCases {
-		err := client.WriteTmpConfig(testCase.tmpFilename, testCase.configBytes)
-		expectErr := (err != nil)
-
-		if expectErr != testCase.expectErr {
-			t.Fatalf("case %v: expected: %v, got: %v", i+1, testCase.expectErr, expectErr)
-		}
-	}
-}
-
-func testAdminCmdRunnerCommitConfig(t *testing.T, client adminCmdRunner) {
-	tmpConfigDir := configDir
-	defer func() {
-		configDir = tmpConfigDir
-	}()
-
-	tempDir, err := ioutil.TempDir("", ".AdminCmdRunnerCommitConfig.")
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-	defer os.RemoveAll(tempDir)
-	configDir = &ConfigDir{dir: tempDir}
-	err = ioutil.WriteFile(filepath.Join(tempDir, "config.json"), []byte{}, os.ModePerm)
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-
-	err = client.WriteTmpConfig("config1.json", []byte(`{"version":"23","region":"us-west-1a"}`))
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-
-	testCases := []struct {
-		tmpFilename string
-		expectErr   bool
-	}{
-		{"config1.json", false},
-		{"config2.json", true},
-	}
-
-	for i, testCase := range testCases {
-		err := client.CommitConfig(testCase.tmpFilename)
-		expectErr := (err != nil)
-
-		if expectErr != testCase.expectErr {
-			t.Fatalf("case %v: expected: %v, got: %v", i+1, testCase.expectErr, expectErr)
-		}
-	}
-}
-
 func newAdminRPCHTTPServerClient(t *testing.T) (*httptest.Server, *AdminRPCClient, *serverConfig) {
 	rpcServer, err := NewAdminRPCServer()
 	if err != nil {
@@ -317,260 +237,3 @@ func TestAdminRPCClientGetConfig(t *testing.T) {
 
 	testAdminCmdRunnerGetConfig(t, rpcClient)
 }
-
-func TestAdminRPCClientWriteTmpConfig(t *testing.T) {
-	httpServer, rpcClient, prevGlobalServerConfig := newAdminRPCHTTPServerClient(t)
-	defer httpServer.Close()
-	defer func() {
-		globalServerConfig = prevGlobalServerConfig
-	}()
-
-	testAdminCmdRunnerWriteTmpConfig(t, rpcClient)
-}
-
-func TestAdminRPCClientCommitConfig(t *testing.T) {
-	httpServer, rpcClient, prevGlobalServerConfig := newAdminRPCHTTPServerClient(t)
-	defer httpServer.Close()
-	defer func() {
-		globalServerConfig = prevGlobalServerConfig
-	}()
-
-	testAdminCmdRunnerCommitConfig(t, rpcClient)
-}
-
-var (
-	config1 = []byte(`{
-	"version": "13",
-	"credential": {
-		"accessKey": "minio",
-		"secretKey": "minio123"
-	},
-	"region": "us-east-1",
-	"logger": {
-		"console": {
-			"enable": true,
-			"level": "debug"
-		},
-		"file": {
-			"enable": false,
-			"fileName": "",
-			"level": ""
-		}
-	},
-	"notify": {
-		"amqp": {
-			"1": {
-				"enable": false,
-				"url": "",
-				"exchange": "",
-				"routingKey": "",
-				"exchangeType": "",
-				"mandatory": false,
-				"immediate": false,
-				"durable": false,
-				"internal": false,
-				"noWait": false,
-				"autoDeleted": false
-			}
-		},
-		"nats": {
-			"1": {
-				"enable": false,
-				"address": "",
-				"subject": "",
-				"username": "",
-				"password": "",
-				"token": "",
-				"secure": false,
-				"pingInterval": 0,
-				"streaming": {
-					"enable": false,
-					"clusterID": "",
-					"clientID": "",
-					"async": false,
-					"maxPubAcksInflight": 0
-				}
-			}
-		},
-		"elasticsearch": {
-			"1": {
-				"enable": false,
-				"url": "",
-				"index": ""
-			}
-		},
-		"redis": {
-			"1": {
-				"enable": false,
-				"address": "",
-				"password": "",
-				"key": ""
-			}
-		},
-		"postgresql": {
-			"1": {
-				"enable": false,
-				"connectionString": "",
-				"table": "",
-				"host": "",
-				"port": "",
-				"user": "",
-				"password": "",
-				"database": ""
-			}
-		},
-		"kafka": {
-			"1": {
-				"enable": false,
-				"brokers": null,
-				"topic": ""
-			}
-		},
-		"webhook": {
-			"1": {
-				"enable": false,
-				"endpoint": ""
-			}
-		}
-	}
-}
-`)
-	// diff from config1 - amqp.Enable is True
-	config2 = []byte(`{
-	"version": "13",
-	"credential": {
-		"accessKey": "minio",
-		"secretKey": "minio123"
-	},
-	"region": "us-east-1",
-	"logger": {
-		"console": {
-			"enable": true,
-			"level": "debug"
-		},
-		"file": {
-			"enable": false,
-			"fileName": "",
-			"level": ""
-		}
-	},
-	"notify": {
-		"amqp": {
-			"1": {
-				"enable": true,
-				"url": "",
-				"exchange": "",
-				"routingKey": "",
-				"exchangeType": "",
-				"mandatory": false,
-				"immediate": false,
-				"durable": false,
-				"internal": false,
-				"noWait": false,
-				"autoDeleted": false
-			}
-		},
-		"nats": {
-			"1": {
-				"enable": false,
-				"address": "",
-				"subject": "",
-				"username": "",
-				"password": "",
-				"token": "",
-				"secure": false,
-				"pingInterval": 0,
-				"streaming": {
-					"enable": false,
-					"clusterID": "",
-					"clientID": "",
-					"async": false,
-					"maxPubAcksInflight": 0
-				}
-			}
-		},
-		"elasticsearch": {
-			"1": {
-				"enable": false,
-				"url": "",
-				"index": ""
-			}
-		},
-		"redis": {
-			"1": {
-				"enable": false,
-				"address": "",
-				"password": "",
-				"key": ""
-			}
-		},
-		"postgresql": {
-			"1": {
-				"enable": false,
-				"connectionString": "",
-				"table": "",
-				"host": "",
-				"port": "",
-				"user": "",
-				"password": "",
-				"database": ""
-			}
-		},
-		"kafka": {
-			"1": {
-				"enable": false,
-				"brokers": null,
-				"topic": ""
-			}
-		},
-		"webhook": {
-			"1": {
-				"enable": false,
-				"endpoint": ""
-			}
-		}
-	}
-}
-`)
-)
-
-// TestGetValidServerConfig - test for getValidServerConfig.
-func TestGetValidServerConfig(t *testing.T) {
-	var c1, c2 serverConfig
-	err := json.Unmarshal(config1, &c1)
-	if err != nil {
-		t.Fatalf("json unmarshal of %s failed: %v", string(config1), err)
-	}
-
-	err = json.Unmarshal(config2, &c2)
-	if err != nil {
-		t.Fatalf("json unmarshal of %s failed: %v", string(config2), err)
-	}
-
-	// Valid config.
-	noErrs := []error{nil, nil, nil, nil}
-	serverConfigs := []serverConfig{c1, c2, c1, c1}
-	validConfig, err := getValidServerConfig(serverConfigs, noErrs)
-	if err != nil {
-		t.Errorf("Expected a valid config but received %v instead", err)
-	}
-
-	if !reflect.DeepEqual(validConfig, c1) {
-		t.Errorf("Expected valid config to be %v but received %v", config1, validConfig)
-	}
-
-	// Invalid config - no quorum.
-	serverConfigs = []serverConfig{c1, c2, c2, c1}
-	_, err = getValidServerConfig(serverConfigs, noErrs)
-	if err != errXLWriteQuorum {
-		t.Errorf("Expected to fail due to lack of quorum but received %v", err)
-	}
-
-	// All errors
-	allErrs := []error{errDiskNotFound, errDiskNotFound, errDiskNotFound, errDiskNotFound}
-	serverConfigs = []serverConfig{{}, {}, {}, {}}
-	_, err = getValidServerConfig(serverConfigs, allErrs)
-	if err != errXLWriteQuorum {
-		t.Errorf("Expected to fail due to lack of quorum but received %v", err)
-	}
-}

cmd/api-datatypes.go

@@ -25,6 +25,87 @@ const (
 	responseRequestIDKey = "x-amz-request-id"
 )
 
+// CSVFileHeaderInfo -Can be either USE IGNORE OR NONE, defines what to do with
+// the first row
+type CSVFileHeaderInfo string
+
+// Constants for file header info.
+const (
+	CSVFileHeaderInfoNone   CSVFileHeaderInfo = "NONE"
+	CSVFileHeaderInfoIgnore                   = "IGNORE"
+	CSVFileHeaderInfoUse                      = "USE"
+)
+
+// SelectCompressionType - ONLY GZIP is supported
+type SelectCompressionType string
+
+// Constants for compression types under select API.
+const (
+	SelectCompressionNONE SelectCompressionType = "NONE"
+	SelectCompressionGZIP                       = "GZIP"
+	SelectCompressionBZIP                       = "BZIP2"
+)
+
+// CSVQuoteFields - Can be either Always or AsNeeded
+type CSVQuoteFields string
+
+// Constants for csv quote styles.
+const (
+	CSVQuoteFieldsAlways   CSVQuoteFields = "Always"
+	CSVQuoteFieldsAsNeeded                = "AsNeeded"
+)
+
+// QueryExpressionType - Currently can only be SQL
+type QueryExpressionType string
+
+// Constants for expression type.
+const (
+	QueryExpressionTypeSQL QueryExpressionType = "SQL"
+)
+
+// JSONType determines json input serialization type.
+type JSONType string
+
+// Constants for JSONTypes.
+const (
+	JSONDocumentType JSONType = "Document"
+	JSONStreamType            = "Stream"
+	JSONLinesType             = "Lines"
+)
+
+// ObjectSelectRequest - represents the input select body
+type ObjectSelectRequest struct {
+	XMLName            xml.Name `xml:"SelectObjectContentRequest" json:"-"`
+	Expression         string
+	ExpressionType     QueryExpressionType
+	InputSerialization struct {
+		CompressionType SelectCompressionType
+		CSV             *struct {
+			FileHeaderInfo       CSVFileHeaderInfo
+			RecordDelimiter      string
+			FieldDelimiter       string
+			QuoteCharacter       string
+			QuoteEscapeCharacter string
+			Comments             string
+		}
+		JSON *struct {
+			Type JSONType
+		}
+	}
+	OutputSerialization struct {
+		CSV *struct {
+			QuoteFields          CSVQuoteFields
+			RecordDelimiter      string
+			FieldDelimiter       string
+			QuoteCharacter       string
+			QuoteEscapeCharacter string
+		}
+		JSON *struct {
+			RecordDelimiter string
+		}
+	}
+}
+
 // ObjectIdentifier carries key name for the object to delete.
 type ObjectIdentifier struct {
 	ObjectName string `xml:"Key"`

cmd/api-errors.go

@@ -22,10 +22,12 @@ import (
 	"fmt"
 	"net/http"
 
+	"github.com/minio/minio/cmd/crypto"
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/dns"
 	"github.com/minio/minio/pkg/event"
 	"github.com/minio/minio/pkg/hash"
+	"github.com/minio/minio/pkg/s3select"
 )
 
 // APIError structure
@@ -127,8 +129,12 @@ const (
 	ErrMaximumExpires
 	ErrSlowDown
 	ErrInvalidPrefixMarker
+	ErrBadRequest
 	// Add new error codes here.
 
+	// SSE-S3 related API errors
+	ErrInvalidEncryptionMethod
+
 	// Server-Side-Encryption (with Customer provided key) related API errors.
 	ErrInsecureSSECustomerRequest
 	ErrSSEMultipartEncrypted
@@ -140,6 +146,9 @@ const (
 	ErrMissingSSECustomerKeyMD5
 	ErrSSECustomerKeyMD5Mismatch
 	ErrInvalidSSECustomerParameters
+	ErrIncompatibleEncryptionMethod
+	ErrKMSNotConfigured
+	ErrKMSAuthFailure
 
 	// Bucket notification related errors.
 	ErrEventNotification
@@ -186,6 +195,7 @@ const (
 	ErrAdminCredentialsMismatch
 	ErrInsecureClientRequest
 	ErrObjectTampered
+
 	ErrHealNotImplemented
 	ErrHealNoSuchProcess
 	ErrHealInvalidClientToken
@@ -193,6 +203,93 @@ const (
 	ErrHealAlreadyRunning
 	ErrHealOverlappingPaths
 	ErrIncorrectContinuationToken
+
+	//S3 Select Errors
+	ErrEmptyRequestBody
+	ErrUnsupportedFunction
+	ErrInvalidExpressionType
+	ErrBusy
+	ErrUnauthorizedAccess
+	ErrExpressionTooLong
+	ErrIllegalSQLFunctionArgument
+	ErrInvalidKeyPath
+	ErrInvalidCompressionFormat
+	ErrInvalidFileHeaderInfo
+	ErrInvalidJSONType
+	ErrInvalidQuoteFields
+	ErrInvalidRequestParameter
+	ErrInvalidDataType
+	ErrInvalidTextEncoding
+	ErrInvalidDataSource
+	ErrInvalidTableAlias
+	ErrMissingRequiredParameter
+	ErrObjectSerializationConflict
+	ErrUnsupportedSQLOperation
+	ErrUnsupportedSQLStructure
+	ErrUnsupportedSyntax
+	ErrUnsupportedRangeHeader
+	ErrLexerInvalidChar
+	ErrLexerInvalidOperator
+	ErrLexerInvalidLiteral
+	ErrLexerInvalidIONLiteral
+	ErrParseExpectedDatePart
+	ErrParseExpectedKeyword
+	ErrParseExpectedTokenType
+	ErrParseExpected2TokenTypes
+	ErrParseExpectedNumber
+	ErrParseExpectedRightParenBuiltinFunctionCall
+	ErrParseExpectedTypeName
+	ErrParseExpectedWhenClause
+	ErrParseUnsupportedToken
+	ErrParseUnsupportedLiteralsGroupBy
+	ErrParseExpectedMember
+	ErrParseUnsupportedSelect
+	ErrParseUnsupportedCase
+	ErrParseUnsupportedCaseClause
+	ErrParseUnsupportedAlias
+	ErrParseUnsupportedSyntax
+	ErrParseUnknownOperator
+	ErrParseInvalidPathComponent
+	ErrParseMissingIdentAfterAt
+	ErrParseUnexpectedOperator
+	ErrParseUnexpectedTerm
+	ErrParseUnexpectedToken
+	ErrParseUnexpectedKeyword
+	ErrParseExpectedExpression
+	ErrParseExpectedLeftParenAfterCast
+	ErrParseExpectedLeftParenValueConstructor
+	ErrParseExpectedLeftParenBuiltinFunctionCall
+	ErrParseExpectedArgumentDelimiter
+	ErrParseCastArity
+	ErrParseInvalidTypeParam
+	ErrParseEmptySelect
+	ErrParseSelectMissingFrom
+	ErrParseExpectedIdentForGroupName
+	ErrParseExpectedIdentForAlias
+	ErrParseUnsupportedCallWithStar
+	ErrParseNonUnaryAgregateFunctionCall
+	ErrParseMalformedJoin
+	ErrParseExpectedIdentForAt
+	ErrParseAsteriskIsNotAloneInSelectList
+	ErrParseCannotMixSqbAndWildcardInSelectList
+	ErrParseInvalidContextForWildcardInSelectList
+	ErrIncorrectSQLFunctionArgumentType
+	ErrValueParseFailure
+	ErrEvaluatorInvalidArguments
+	ErrIntegerOverflow
+	ErrLikeInvalidInputs
+	ErrCastFailed
+	ErrInvalidCast
+	ErrEvaluatorInvalidTimestampFormatPattern
+	ErrEvaluatorInvalidTimestampFormatPatternSymbolForParsing
+	ErrEvaluatorTimestampFormatPatternDuplicateFields
+	ErrEvaluatorTimestampFormatPatternHourClockAmPmMismatch
+	ErrEvaluatorUnterminatedTimestampFormatPatternToken
+	ErrEvaluatorInvalidTimestampFormatPatternToken
+	ErrEvaluatorInvalidTimestampFormatPatternSymbol
+	ErrEvaluatorBindingDoesNotExist
+	ErrInvalidColumnIndex
+	ErrMissingHeaders
 )
 
 // error code to APIError structure, these fields carry respective
@@ -540,6 +637,11 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		Description:    "Invalid marker prefix combination",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrBadRequest: {
+		Code:           "BadRequest",
+		Description:    "400 BadRequest",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 
 	// FIXME: Actual XML error response also contains the header which missed in list of signed header parameters.
 	ErrUnsignedHeaders: {
@@ -629,6 +731,11 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		Description:    "Your metadata headers exceed the maximum allowed metadata size.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrInvalidEncryptionMethod: {
+		Code:           "InvalidRequest",
+		Description:    "The encryption method specified is not supported",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 	ErrInsecureSSECustomerRequest: {
 		Code:           "InvalidRequest",
 		Description:    "Requests specifying Server Side Encryption with Customer provided keys must be made over a secure connection.",
@@ -679,6 +786,21 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		Description:    "The provided encryption parameters did not match the ones used originally.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrIncompatibleEncryptionMethod: {
+		Code:           "InvalidArgument",
+		Description:    "Server side encryption specified with both SSE-C and SSE-S3 headers",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrKMSNotConfigured: {
+		Code:           "InvalidArgument",
+		Description:    "Server side encryption specified but KMS is not configured",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrKMSAuthFailure: {
+		Code:           "InvalidArgument",
+		Description:    "Server side encryption specified but KMS authorization failed",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 
 	/// S3 extensions.
 	ErrContentSHA256Mismatch: {
@@ -794,6 +916,7 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		Description:    "X-Amz-Expires must be less than a week (in seconds); that is, the given X-Amz-Expires must be less than 604800 seconds",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+
 	// Generic Invalid-Request error. Should be used for response errors only for unlikely
 	// corner case errors for which introducing new APIErrorCode is not worth it. LogIf()
 	// should be used to log the error at the source of the error for debugging purposes.
@@ -842,6 +965,432 @@ var errorCodeResponse = map[APIErrorCode]APIError{
 		Description:    "The continuation token provided is incorrect",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	//S3 Select API Errors
+	ErrEmptyRequestBody: {
+		Code:           "EmptyRequestBody",
+		Description:    "Request body cannot be empty.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrUnsupportedFunction: {
+		Code:           "UnsupportedFunction",
+		Description:    "Encountered an unsupported SQL function.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidDataSource: {
+		Code:           "InvalidDataSource",
+		Description:    "Invalid data source type. Only CSV and JSON are supported at this time.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidExpressionType: {
+		Code:           "InvalidExpressionType",
+		Description:    "The ExpressionType is invalid. Only SQL expressions are supported at this time.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrBusy: {
+		Code:           "Busy",
+		Description:    "The service is unavailable. Please retry.",
+		HTTPStatusCode: http.StatusServiceUnavailable,
+	},
+	ErrUnauthorizedAccess: {
+		Code:           "UnauthorizedAccess",
+		Description:    "You are not authorized to perform this operation",
+		HTTPStatusCode: http.StatusUnauthorized,
+	},
+	ErrExpressionTooLong: {
+		Code:           "ExpressionTooLong",
+		Description:    "The SQL expression is too long: The maximum byte-length for the SQL expression is 256 KB.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrIllegalSQLFunctionArgument: {
+		Code:           "IllegalSqlFunctionArgument",
+		Description:    "Illegal argument was used in the SQL function.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidKeyPath: {
+		Code:           "InvalidKeyPath",
+		Description:    "Key path in the SQL expression is invalid.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidCompressionFormat: {
+		Code:           "InvalidCompressionFormat",
+		Description:    "The file is not in a supported compression format. Only GZIP is supported at this time.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidFileHeaderInfo: {
+		Code:           "InvalidFileHeaderInfo",
+		Description:    "The FileHeaderInfo is invalid. Only NONE, USE, and IGNORE are supported.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidJSONType: {
+		Code:           "InvalidJsonType",
+		Description:    "The JsonType is invalid. Only DOCUMENT and LINES are supported at this time.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidQuoteFields: {
+		Code:           "InvalidQuoteFields",
+		Description:    "The QuoteFields is invalid. Only ALWAYS and ASNEEDED are supported.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidRequestParameter: {
+		Code:           "InvalidRequestParameter",
+		Description:    "The value of a parameter in SelectRequest element is invalid. Check the service API documentation and try again.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidDataType: {
+		Code:           "InvalidDataType",
+		Description:    "The SQL expression contains an invalid data type.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidTextEncoding: {
+		Code:           "InvalidTextEncoding",
+		Description:    "Invalid encoding type. Only UTF-8 encoding is supported at this time.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidTableAlias: {
+		Code:           "InvalidTableAlias",
+		Description:    "The SQL expression contains an invalid table alias.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrMissingRequiredParameter: {
+		Code:           "MissingRequiredParameter",
+		Description:    "The SelectRequest entity is missing a required parameter. Check the service documentation and try again.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrObjectSerializationConflict: {
+		Code:           "ObjectSerializationConflict",
+		Description:    "The SelectRequest entity can only contain one of CSV or JSON. Check the service documentation and try again.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrUnsupportedSQLOperation: {
+		Code:           "UnsupportedSqlOperation",
+		Description:    "Encountered an unsupported SQL operation.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrUnsupportedSQLStructure: {
+		Code:           "UnsupportedSqlStructure",
+		Description:    "Encountered an unsupported SQL structure. Check the SQL Reference.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrUnsupportedSyntax: {
+		Code:           "UnsupportedSyntax",
+		Description:    "Encountered invalid syntax.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrUnsupportedRangeHeader: {
+		Code:           "UnsupportedRangeHeader",
+		Description:    "Range header is not supported for this operation.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrLexerInvalidChar: {
+		Code:           "LexerInvalidChar",
+		Description:    "The SQL expression contains an invalid character.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrLexerInvalidOperator: {
+		Code:           "LexerInvalidOperator",
+		Description:    "The SQL expression contains an invalid literal.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrLexerInvalidLiteral: {
+		Code:           "LexerInvalidLiteral",
+		Description:    "The SQL expression contains an invalid operator.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrLexerInvalidIONLiteral: {
+		Code:           "LexerInvalidIONLiteral",
+		Description:    "The SQL expression contains an invalid operator.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedDatePart: {
+		Code:           "ParseExpectedDatePart",
+		Description:    "Did not find the expected date part in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedKeyword: {
+		Code:           "ParseExpectedKeyword",
+		Description:    "Did not find the expected keyword in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedTokenType: {
+		Code:           "ParseExpectedTokenType",
+		Description:    "Did not find the expected token in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpected2TokenTypes: {
+		Code:           "ParseExpected2TokenTypes",
+		Description:    "Did not find the expected token in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedNumber: {
+		Code:           "ParseExpectedNumber",
+		Description:    "Did not find the expected number in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedRightParenBuiltinFunctionCall: {
+		Code:           "ParseExpectedRightParenBuiltinFunctionCall",
+		Description:    "Did not find the expected right parenthesis character in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedTypeName: {
+		Code:           "ParseExpectedTypeName",
+		Description:    "Did not find the expected type name in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedWhenClause: {
+		Code:           "ParseExpectedWhenClause",
+		Description:    "Did not find the expected WHEN clause in the SQL expression. CASE is not supported.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnsupportedToken: {
+		Code:           "ParseUnsupportedToken",
+		Description:    "The SQL expression contains an unsupported token.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnsupportedLiteralsGroupBy: {
+		Code:           "ParseUnsupportedLiteralsGroupBy",
+		Description:    "The SQL expression contains an unsupported use of GROUP BY.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedMember: {
+		Code:           "ParseExpectedMember",
+		Description:    "The SQL expression contains an unsupported use of MEMBER.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnsupportedSelect: {
+		Code:           "ParseUnsupportedSelect",
+		Description:    "The SQL expression contains an unsupported use of SELECT.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnsupportedCase: {
+		Code:           "ParseUnsupportedCase",
+		Description:    "The SQL expression contains an unsupported use of CASE.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnsupportedCaseClause: {
+		Code:           "ParseUnsupportedCaseClause",
+		Description:    "The SQL expression contains an unsupported use of CASE.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnsupportedAlias: {
+		Code:           "ParseUnsupportedAlias",
+		Description:    "The SQL expression contains an unsupported use of ALIAS.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnsupportedSyntax: {
+		Code:           "ParseUnsupportedSyntax",
+		Description:    "The SQL expression contains unsupported syntax.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnknownOperator: {
+		Code:           "ParseUnknownOperator",
+		Description:    "The SQL expression contains an invalid operator.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseInvalidPathComponent: {
+		Code:           "ParseInvalidPathComponent",
+		Description:    "The SQL expression contains an invalid path component.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseMissingIdentAfterAt: {
+		Code:           "ParseMissingIdentAfterAt",
+		Description:    "Did not find the expected identifier after the @ symbol in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnexpectedOperator: {
+		Code:           "ParseUnexpectedOperator",
+		Description:    "The SQL expression contains an unexpected operator.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnexpectedTerm: {
+		Code:           "ParseUnexpectedTerm",
+		Description:    "The SQL expression contains an unexpected term.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnexpectedToken: {
+		Code:           "ParseUnexpectedToken",
+		Description:    "The SQL expression contains an unexpected token.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnexpectedKeyword: {
+		Code:           "ParseUnexpectedKeyword",
+		Description:    "The SQL expression contains an unexpected keyword.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedExpression: {
+		Code:           "ParseExpectedExpression",
+		Description:    "Did not find the expected SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedLeftParenAfterCast: {
+		Code:           "ParseExpectedLeftParenAfterCast",
+		Description:    "Did not find expected the left parenthesis in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedLeftParenValueConstructor: {
+		Code:           "ParseExpectedLeftParenValueConstructor",
+		Description:    "Did not find expected the left parenthesis in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedLeftParenBuiltinFunctionCall: {
+		Code:           "ParseExpectedLeftParenBuiltinFunctionCall",
+		Description:    "Did not find the expected left parenthesis in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedArgumentDelimiter: {
+		Code:           "ParseExpectedArgumentDelimiter",
+		Description:    "Did not find the expected argument delimiter in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseCastArity: {
+		Code:           "ParseCastArity",
+		Description:    "The SQL expression CAST has incorrect arity.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseInvalidTypeParam: {
+		Code:           "ParseInvalidTypeParam",
+		Description:    "The SQL expression contains an invalid parameter value.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseEmptySelect: {
+		Code:           "ParseEmptySelect",
+		Description:    "The SQL expression contains an empty SELECT.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseSelectMissingFrom: {
+		Code:           "ParseSelectMissingFrom",
+		Description:    "GROUP is not supported in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedIdentForGroupName: {
+		Code:           "ParseExpectedIdentForGroupName",
+		Description:    "GROUP is not supported in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedIdentForAlias: {
+		Code:           "ParseExpectedIdentForAlias",
+		Description:    "Did not find the expected identifier for the alias in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseUnsupportedCallWithStar: {
+		Code:           "ParseUnsupportedCallWithStar",
+		Description:    "Only COUNT with (*) as a parameter is supported in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseNonUnaryAgregateFunctionCall: {
+		Code:           "ParseNonUnaryAgregateFunctionCall",
+		Description:    "Only one argument is supported for aggregate functions in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseMalformedJoin: {
+		Code:           "ParseMalformedJoin",
+		Description:    "JOIN is not supported in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseExpectedIdentForAt: {
+		Code:           "ParseExpectedIdentForAt",
+		Description:    "Did not find the expected identifier for AT name in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseAsteriskIsNotAloneInSelectList: {
+		Code:           "ParseAsteriskIsNotAloneInSelectList",
+		Description:    "Other expressions are not allowed in the SELECT list when '*' is used without dot notation in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseCannotMixSqbAndWildcardInSelectList: {
+		Code:           "ParseCannotMixSqbAndWildcardInSelectList",
+		Description:    "Cannot mix [] and * in the same expression in a SELECT list in SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrParseInvalidContextForWildcardInSelectList: {
+		Code:           "ParseInvalidContextForWildcardInSelectList",
+		Description:    "Invalid use of * in SELECT list in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrIncorrectSQLFunctionArgumentType: {
+		Code:           "IncorrectSqlFunctionArgumentType",
+		Description:    "Incorrect type of arguments in function call in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrValueParseFailure: {
+		Code:           "ValueParseFailure",
+		Description:    "Time stamp parse failure in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrEvaluatorInvalidArguments: {
+		Code:           "EvaluatorInvalidArguments",
+		Description:    "Incorrect number of arguments in the function call in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrIntegerOverflow: {
+		Code:           "IntegerOverflow",
+		Description:    "Int overflow or underflow in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrLikeInvalidInputs: {
+		Code:           "LikeInvalidInputs",
+		Description:    "Invalid argument given to the LIKE clause in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrCastFailed: {
+		Code:           "CastFailed",
+		Description:    "Attempt to convert from one data type to another using CAST failed in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidCast: {
+		Code:           "InvalidCast",
+		Description:    "Attempt to convert from one data type to another using CAST failed in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrEvaluatorInvalidTimestampFormatPattern: {
+		Code:           "EvaluatorInvalidTimestampFormatPattern",
+		Description:    "Time stamp format pattern requires additional fields in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrEvaluatorInvalidTimestampFormatPatternSymbolForParsing: {
+		Code:           "EvaluatorInvalidTimestampFormatPatternSymbolForParsing",
+		Description:    "Time stamp format pattern contains a valid format symbol that cannot be applied to time stamp parsing in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrEvaluatorTimestampFormatPatternDuplicateFields: {
+		Code:           "EvaluatorTimestampFormatPatternDuplicateFields",
+		Description:    "Time stamp format pattern contains multiple format specifiers representing the time stamp field in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrEvaluatorTimestampFormatPatternHourClockAmPmMismatch: {
+		Code:           "EvaluatorUnterminatedTimestampFormatPatternToken",
+		Description:    "Time stamp format pattern contains unterminated token in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrEvaluatorUnterminatedTimestampFormatPatternToken: {
+		Code:           "EvaluatorInvalidTimestampFormatPatternToken",
+		Description:    "Time stamp format pattern contains an invalid token in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrEvaluatorInvalidTimestampFormatPatternToken: {
+		Code:           "EvaluatorInvalidTimestampFormatPatternToken",
+		Description:    "Time stamp format pattern contains an invalid token in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrEvaluatorInvalidTimestampFormatPatternSymbol: {
+		Code:           "EvaluatorInvalidTimestampFormatPatternSymbol",
+		Description:    "Time stamp format pattern contains an invalid symbol in the SQL expression.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrInvalidColumnIndex: {
+		Code:           "InvalidColumnIndex",
+		Description:    "Column index in the SQL expression is invalid.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrEvaluatorBindingDoesNotExist: {
+		Code:           "ErrEvaluatorBindingDoesNotExist",
+		Description:    "A column name or a path provided does not exist in the SQL expression",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrMissingHeaders: {
+		Code:           "MissingHeaders",
+		Description:    "Some headers in the query are missing from the file. Check the file and try again.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 	// Add your error structure here.
 }
 
@@ -866,17 +1415,19 @@ func toAPIErrorCode(err error) (apiErr APIErrorCode) {
 	case auth.ErrInvalidSecretKeyLength:
 		apiErr = ErrAdminInvalidSecretKey
 	// SSE errors
+	case crypto.ErrInvalidEncryptionMethod:
+		apiErr = ErrInvalidEncryptionMethod
 	case errInsecureSSERequest:
 		apiErr = ErrInsecureSSECustomerRequest
-	case errInvalidSSEAlgorithm:
+	case crypto.ErrInvalidCustomerAlgorithm:
 		apiErr = ErrInvalidSSECustomerAlgorithm
-	case errInvalidSSEKey:
+	case crypto.ErrInvalidCustomerKey:
 		apiErr = ErrInvalidSSECustomerKey
-	case errMissingSSEKey:
+	case crypto.ErrMissingCustomerKey:
 		apiErr = ErrMissingSSECustomerKey
-	case errMissingSSEKeyMD5:
+	case crypto.ErrMissingCustomerKeyMD5:
 		apiErr = ErrMissingSSECustomerKeyMD5
-	case errSSEKeyMD5Mismatch:
+	case crypto.ErrCustomerKeyMD5Mismatch:
 		apiErr = ErrSSECustomerKeyMD5Mismatch
 	case errObjectTampered:
 		apiErr = ErrObjectTampered
@@ -884,11 +1435,180 @@ func toAPIErrorCode(err error) (apiErr APIErrorCode) {
 		apiErr = ErrSSEEncryptedObject
 	case errInvalidSSEParameters:
 		apiErr = ErrInvalidSSECustomerParameters
-	case errSSEKeyMismatch:
+	case crypto.ErrInvalidCustomerKey:
 		apiErr = ErrAccessDenied // no access without correct key
+	case crypto.ErrIncompatibleEncryptionMethod:
+		apiErr = ErrIncompatibleEncryptionMethod
+	case errKMSNotConfigured:
+		apiErr = ErrKMSNotConfigured
+	case crypto.ErrKMSAuthLogin:
+		apiErr = ErrKMSAuthFailure
 	case context.Canceled, context.DeadlineExceeded:
 		apiErr = ErrOperationTimedOut
 	}
+	switch err {
+	case s3select.ErrBusy:
+		apiErr = ErrBusy
+	case s3select.ErrUnauthorizedAccess:
+		apiErr = ErrUnauthorizedAccess
+	case s3select.ErrExpressionTooLong:
+		apiErr = ErrExpressionTooLong
+	case s3select.ErrIllegalSQLFunctionArgument:
+		apiErr = ErrIllegalSQLFunctionArgument
+	case s3select.ErrInvalidKeyPath:
+		apiErr = ErrInvalidKeyPath
+	case s3select.ErrInvalidCompressionFormat:
+		apiErr = ErrInvalidCompressionFormat
+	case s3select.ErrInvalidFileHeaderInfo:
+		apiErr = ErrInvalidFileHeaderInfo
+	case s3select.ErrInvalidJSONType:
+		apiErr = ErrInvalidJSONType
+	case s3select.ErrInvalidQuoteFields:
+		apiErr = ErrInvalidQuoteFields
+	case s3select.ErrInvalidRequestParameter:
+		apiErr = ErrInvalidRequestParameter
+	case s3select.ErrInvalidDataType:
+		apiErr = ErrInvalidDataType
+	case s3select.ErrInvalidTextEncoding:
+		apiErr = ErrInvalidTextEncoding
+	case s3select.ErrInvalidTableAlias:
+		apiErr = ErrInvalidTableAlias
+	case s3select.ErrMissingRequiredParameter:
+		apiErr = ErrMissingRequiredParameter
+	case s3select.ErrObjectSerializationConflict:
+		apiErr = ErrObjectSerializationConflict
+	case s3select.ErrUnsupportedSQLOperation:
+		apiErr = ErrUnsupportedSQLOperation
+	case s3select.ErrUnsupportedSQLStructure:
+		apiErr = ErrUnsupportedSQLStructure
+	case s3select.ErrUnsupportedSyntax:
+		apiErr = ErrUnsupportedSyntax
+	case s3select.ErrUnsupportedRangeHeader:
+		apiErr = ErrUnsupportedRangeHeader
+	case s3select.ErrLexerInvalidChar:
+		apiErr = ErrLexerInvalidChar
+	case s3select.ErrLexerInvalidOperator:
+		apiErr = ErrLexerInvalidOperator
+	case s3select.ErrLexerInvalidLiteral:
+		apiErr = ErrLexerInvalidLiteral
+	case s3select.ErrLexerInvalidIONLiteral:
+		apiErr = ErrLexerInvalidIONLiteral
+	case s3select.ErrParseExpectedDatePart:
+		apiErr = ErrParseExpectedDatePart
+	case s3select.ErrParseExpectedKeyword:
+		apiErr = ErrParseExpectedKeyword
+	case s3select.ErrParseExpectedTokenType:
+		apiErr = ErrParseExpectedTokenType
+	case s3select.ErrParseExpected2TokenTypes:
+		apiErr = ErrParseExpected2TokenTypes
+	case s3select.ErrParseExpectedNumber:
+		apiErr = ErrParseExpectedNumber
+	case s3select.ErrParseExpectedRightParenBuiltinFunctionCall:
+		apiErr = ErrParseExpectedRightParenBuiltinFunctionCall
+	case s3select.ErrParseExpectedTypeName:
+		apiErr = ErrParseExpectedTypeName
+	case s3select.ErrParseExpectedWhenClause:
+		apiErr = ErrParseExpectedWhenClause
+	case s3select.ErrParseUnsupportedToken:
+		apiErr = ErrParseUnsupportedToken
+	case s3select.ErrParseUnsupportedLiteralsGroupBy:
+		apiErr = ErrParseUnsupportedLiteralsGroupBy
+	case s3select.ErrParseExpectedMember:
+		apiErr = ErrParseExpectedMember
+	case s3select.ErrParseUnsupportedSelect:
+		apiErr = ErrParseUnsupportedSelect
+	case s3select.ErrParseUnsupportedCase:
+		apiErr = ErrParseUnsupportedCase
+	case s3select.ErrParseUnsupportedCaseClause:
+		apiErr = ErrParseUnsupportedCaseClause
+	case s3select.ErrParseUnsupportedAlias:
+		apiErr = ErrParseUnsupportedAlias
+	case s3select.ErrParseUnsupportedSyntax:
+		apiErr = ErrParseUnsupportedSyntax
+	case s3select.ErrParseUnknownOperator:
+		apiErr = ErrParseUnknownOperator
+	case s3select.ErrParseInvalidPathComponent:
+		apiErr = ErrParseInvalidPathComponent
+	case s3select.ErrParseMissingIdentAfterAt:
+		apiErr = ErrParseMissingIdentAfterAt
+	case s3select.ErrParseUnexpectedOperator:
+		apiErr = ErrParseUnexpectedOperator
+	case s3select.ErrParseUnexpectedTerm:
+		apiErr = ErrParseUnexpectedTerm
+	case s3select.ErrParseUnexpectedToken:
+		apiErr = ErrParseUnexpectedToken
+	case s3select.ErrParseUnexpectedKeyword:
+		apiErr = ErrParseUnexpectedKeyword
+	case s3select.ErrParseExpectedExpression:
+		apiErr = ErrParseExpectedExpression
+	case s3select.ErrParseExpectedLeftParenAfterCast:
+		apiErr = ErrParseExpectedLeftParenAfterCast
+	case s3select.ErrParseExpectedLeftParenValueConstructor:
+		apiErr = ErrParseExpectedLeftParenValueConstructor
+	case s3select.ErrParseExpectedLeftParenBuiltinFunctionCall:
+		apiErr = ErrParseExpectedLeftParenBuiltinFunctionCall
+	case s3select.ErrParseExpectedArgumentDelimiter:
+		apiErr = ErrParseExpectedArgumentDelimiter
+	case s3select.ErrParseCastArity:
+		apiErr = ErrParseCastArity
+	case s3select.ErrParseInvalidTypeParam:
+		apiErr = ErrParseInvalidTypeParam
+	case s3select.ErrParseEmptySelect:
+		apiErr = ErrParseEmptySelect
+	case s3select.ErrParseSelectMissingFrom:
+		apiErr = ErrParseSelectMissingFrom
+	case s3select.ErrParseExpectedIdentForGroupName:
+		apiErr = ErrParseExpectedIdentForGroupName
+	case s3select.ErrParseExpectedIdentForAlias:
+		apiErr = ErrParseExpectedIdentForAlias
+	case s3select.ErrParseUnsupportedCallWithStar:
+		apiErr = ErrParseUnsupportedCallWithStar
+	case s3select.ErrParseNonUnaryAgregateFunctionCall:
+		apiErr = ErrParseNonUnaryAgregateFunctionCall
+	case s3select.ErrParseMalformedJoin:
+		apiErr = ErrParseMalformedJoin
+	case s3select.ErrParseExpectedIdentForAt:
+		apiErr = ErrParseExpectedIdentForAt
+	case s3select.ErrParseAsteriskIsNotAloneInSelectList:
+		apiErr = ErrParseAsteriskIsNotAloneInSelectList
+	case s3select.ErrParseCannotMixSqbAndWildcardInSelectList:
+		apiErr = ErrParseCannotMixSqbAndWildcardInSelectList
+	case s3select.ErrParseInvalidContextForWildcardInSelectList:
+		apiErr = ErrParseInvalidContextForWildcardInSelectList
+	case s3select.ErrIncorrectSQLFunctionArgumentType:
+		apiErr = ErrIncorrectSQLFunctionArgumentType
+	case s3select.ErrValueParseFailure:
+		apiErr = ErrValueParseFailure
+	case s3select.ErrIntegerOverflow:
+		apiErr = ErrIntegerOverflow
+	case s3select.ErrLikeInvalidInputs:
+		apiErr = ErrLikeInvalidInputs
+	case s3select.ErrCastFailed:
+		apiErr = ErrCastFailed
+	case s3select.ErrInvalidCast:
+		apiErr = ErrInvalidCast
+	case s3select.ErrEvaluatorInvalidTimestampFormatPattern:
+		apiErr = ErrEvaluatorInvalidTimestampFormatPattern
+	case s3select.ErrEvaluatorInvalidTimestampFormatPatternSymbolForParsing:
+		apiErr = ErrEvaluatorInvalidTimestampFormatPatternSymbolForParsing
+	case s3select.ErrEvaluatorTimestampFormatPatternDuplicateFields:
+		apiErr = ErrEvaluatorTimestampFormatPatternDuplicateFields
+	case s3select.ErrEvaluatorTimestampFormatPatternHourClockAmPmMismatch:
+		apiErr = ErrEvaluatorTimestampFormatPatternHourClockAmPmMismatch
+	case s3select.ErrEvaluatorUnterminatedTimestampFormatPatternToken:
+		apiErr = ErrEvaluatorUnterminatedTimestampFormatPatternToken
+	case s3select.ErrEvaluatorInvalidTimestampFormatPatternToken:
+		apiErr = ErrEvaluatorInvalidTimestampFormatPatternToken
+	case s3select.ErrEvaluatorInvalidTimestampFormatPatternSymbol:
+		apiErr = ErrEvaluatorInvalidTimestampFormatPatternSymbol
+	case s3select.ErrInvalidColumnIndex:
+		apiErr = ErrInvalidColumnIndex
+	case s3select.ErrEvaluatorBindingDoesNotExist:
+		apiErr = ErrEvaluatorBindingDoesNotExist
+	case s3select.ErrMissingHeaders:
+		apiErr = ErrMissingHeaders
+
+	}
 
 	if apiErr != ErrNone {
 		// If there was a match in the above switch case.
@@ -990,6 +1710,8 @@ func toAPIErrorCode(err error) (apiErr APIErrorCode) {
 		apiErr = ErrUnsupportedNotification
 	case BackendDown:
 		apiErr = ErrBackendDown
+	case crypto.Error:
+		apiErr = ErrObjectTampered
 	default:
 		apiErr = ErrInternalError
 	}

cmd/api-errors_test.go

@@ -20,6 +20,7 @@ import (
 	"errors"
 	"testing"
 
+	"github.com/minio/minio/cmd/crypto"
 	"github.com/minio/minio/pkg/hash"
 )
 
@@ -52,11 +53,11 @@ var toAPIErrorCodeTests = []struct {
 
 	// SSE-C errors
 	{err: errInsecureSSERequest, errCode: ErrInsecureSSECustomerRequest},
-	{err: errInvalidSSEAlgorithm, errCode: ErrInvalidSSECustomerAlgorithm},
-	{err: errMissingSSEKey, errCode: ErrMissingSSECustomerKey},
-	{err: errInvalidSSEKey, errCode: ErrInvalidSSECustomerKey},
-	{err: errMissingSSEKeyMD5, errCode: ErrMissingSSECustomerKeyMD5},
-	{err: errSSEKeyMD5Mismatch, errCode: ErrSSECustomerKeyMD5Mismatch},
+	{err: crypto.ErrInvalidCustomerAlgorithm, errCode: ErrInvalidSSECustomerAlgorithm},
+	{err: crypto.ErrMissingCustomerKey, errCode: ErrMissingSSECustomerKey},
+	{err: crypto.ErrInvalidCustomerKey, errCode: ErrInvalidSSECustomerKey},
+	{err: crypto.ErrMissingCustomerKeyMD5, errCode: ErrMissingSSECustomerKeyMD5},
+	{err: crypto.ErrCustomerKeyMD5Mismatch, errCode: ErrSSECustomerKeyMD5Mismatch},
 	{err: errObjectTampered, errCode: ErrObjectTampered},
 
 	{err: nil, errCode: ErrNone},

cmd/api-headers.go

@@ -100,6 +100,5 @@ func setObjectHeaders(w http.ResponseWriter, objInfo ObjectInfo, contentRange *h
 		// Override content-length
 		w.Header().Set("Content-Length", strconv.FormatInt(contentRange.getLength(), 10))
 		w.Header().Set("Content-Range", contentRange.String())
-		w.WriteHeader(http.StatusPartialContent)
 	}
 }

cmd/api-router.go

@@ -20,7 +20,6 @@ import (
 	"net/http"
 
 	"github.com/gorilla/mux"
-	"github.com/minio/minio/cmd/logger"
 )
 
 // objectAPIHandler implements and provides http handlers for S3 API.
@@ -31,14 +30,6 @@ type objectAPIHandlers struct {
 
 // registerAPIRouter - registers S3 compatible APIs.
 func registerAPIRouter(router *mux.Router) {
-	var err error
-	var cacheConfig = globalServerConfig.GetCacheConfig()
-	if len(cacheConfig.Drives) > 0 {
-		// initialize the new disk cache objects.
-		globalCacheObjectAPI, err = newServerCacheObjects(cacheConfig)
-		logger.FatalIf(err, "Unable to initialize disk caching")
-	}
-
 	// Initialize API.
 	api := objectAPIHandlers{
 		ObjectAPI: newObjectLayerFn,
@@ -71,6 +62,8 @@ func registerAPIRouter(router *mux.Router) {
 		bucket.Methods("DELETE").Path("/{object:.+}").HandlerFunc(httpTraceAll(api.AbortMultipartUploadHandler)).Queries("uploadId", "{uploadId:.*}")
 		// GetObjectACL - this is a dummy call.
 		bucket.Methods("GET").Path("/{object:.+}").HandlerFunc(httpTraceHdrs(api.GetObjectACLHandler)).Queries("acl", "")
+		// SelectObjectContent
+		bucket.Methods("POST").Path("/{object:.+}").HandlerFunc(httpTraceHdrs(api.SelectObjectContentHandler)).Queries("select", "").Queries("select-type", "2")
 		// GetObject
 		bucket.Methods("GET").Path("/{object:.+}").HandlerFunc(httpTraceHdrs(api.GetObjectHandler))
 		// CopyObject

cmd/auth-handler_test.go

@@ -344,11 +344,14 @@ func mustNewSignedBadMD5Request(method string, urlStr string, contentLength int6
 
 // Tests is requested authenticated function, tests replies for s3 errors.
 func TestIsReqAuthenticated(t *testing.T) {
-	path, err := newTestConfig(globalMinioDefaultRegion)
+	objLayer, fsDir, err := prepareFS()
 	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(fsDir)
+	if err = newTestConfig(globalMinioDefaultRegion, objLayer); err != nil {
 		t.Fatalf("unable initialize config file, %s", err)
 	}
-	defer os.RemoveAll(path)
 
 	creds, err := auth.CreateCredentials("myuser", "mypassword")
 	if err != nil {
@@ -384,11 +387,15 @@ func TestIsReqAuthenticated(t *testing.T) {
 	}
 }
 func TestCheckAdminRequestAuthType(t *testing.T) {
-	path, err := newTestConfig(globalMinioDefaultRegion)
+	objLayer, fsDir, err := prepareFS()
 	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(fsDir)
+
+	if err = newTestConfig(globalMinioDefaultRegion, objLayer); err != nil {
 		t.Fatalf("unable initialize config file, %s", err)
 	}
-	defer os.RemoveAll(path)
 
 	creds, err := auth.CreateCredentials("myuser", "mypassword")
 	if err != nil {

cmd/benchmark-utils_test.go

@@ -22,7 +22,6 @@ import (
 	"io/ioutil"
 	"math"
 	"math/rand"
-	"os"
 	"strconv"
 	"testing"
 
@@ -138,12 +137,6 @@ func runPutObjectPartBenchmark(b *testing.B, obj ObjectLayer, partSize int) {
 
 // creates XL/FS backend setup, obtains the object layer and calls the runPutObjectPartBenchmark function.
 func benchmarkPutObjectPart(b *testing.B, instanceType string, objSize int) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		b.Fatalf("Unable to initialize config. %s", err)
-	}
-	defer os.RemoveAll(rootPath)
-
 	// create a temp XL/FS backend.
 	objLayer, disks, err := prepareBenchmarkBackend(instanceType)
 	if err != nil {
@@ -151,18 +144,13 @@ func benchmarkPutObjectPart(b *testing.B, instanceType string, objSize int) {
 	}
 	// cleaning up the backend by removing all the directories and files created on function return.
 	defer removeRoots(disks)
+
 	// uses *testing.B and the object Layer to run the benchmark.
 	runPutObjectPartBenchmark(b, objLayer, objSize)
 }
 
 // creates XL/FS backend setup, obtains the object layer and calls the runPutObjectBenchmark function.
 func benchmarkPutObject(b *testing.B, instanceType string, objSize int) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		b.Fatalf("Unable to initialize config. %s", err)
-	}
-	defer os.RemoveAll(rootPath)
-
 	// create a temp XL/FS backend.
 	objLayer, disks, err := prepareBenchmarkBackend(instanceType)
 	if err != nil {
@@ -170,18 +158,13 @@ func benchmarkPutObject(b *testing.B, instanceType string, objSize int) {
 	}
 	// cleaning up the backend by removing all the directories and files created on function return.
 	defer removeRoots(disks)
+
 	// uses *testing.B and the object Layer to run the benchmark.
 	runPutObjectBenchmark(b, objLayer, objSize)
 }
 
 // creates XL/FS backend setup, obtains the object layer and runs parallel benchmark for put object.
 func benchmarkPutObjectParallel(b *testing.B, instanceType string, objSize int) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		b.Fatalf("Unable to initialize config. %s", err)
-	}
-	defer os.RemoveAll(rootPath)
-
 	// create a temp XL/FS backend.
 	objLayer, disks, err := prepareBenchmarkBackend(instanceType)
 	if err != nil {
@@ -189,6 +172,7 @@ func benchmarkPutObjectParallel(b *testing.B, instanceType string, objSize int)
 	}
 	// cleaning up the backend by removing all the directories and files created on function return.
 	defer removeRoots(disks)
+
 	// uses *testing.B and the object Layer to run the benchmark.
 	runPutObjectBenchmarkParallel(b, objLayer, objSize)
 }
@@ -196,16 +180,10 @@ func benchmarkPutObjectParallel(b *testing.B, instanceType string, objSize int)
 // Benchmark utility functions for ObjectLayer.GetObject().
 // Creates Object layer setup ( MakeBucket, PutObject) and then runs the benchmark.
 func runGetObjectBenchmark(b *testing.B, obj ObjectLayer, objSize int) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		b.Fatalf("Unable to initialize config. %s", err)
-	}
-	defer os.RemoveAll(rootPath)
-
 	// obtains random bucket name.
 	bucket := getRandomBucketName()
 	// create bucket.
-	err = obj.MakeBucketWithLocation(context.Background(), bucket, "")
+	err := obj.MakeBucketWithLocation(context.Background(), bucket, "")
 	if err != nil {
 		b.Fatal(err)
 	}
@@ -269,12 +247,6 @@ func generateBytesData(size int) []byte {
 
 // creates XL/FS backend setup, obtains the object layer and calls the runGetObjectBenchmark function.
 func benchmarkGetObject(b *testing.B, instanceType string, objSize int) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		b.Fatalf("Unable to initialize config. %s", err)
-	}
-	defer os.RemoveAll(rootPath)
-
 	// create a temp XL/FS backend.
 	objLayer, disks, err := prepareBenchmarkBackend(instanceType)
 	if err != nil {
@@ -282,18 +254,13 @@ func benchmarkGetObject(b *testing.B, instanceType string, objSize int) {
 	}
 	// cleaning up the backend by removing all the directories and files created.
 	defer removeRoots(disks)
+
 	//  uses *testing.B and the object Layer to run the benchmark.
 	runGetObjectBenchmark(b, objLayer, objSize)
 }
 
 // creates XL/FS backend setup, obtains the object layer and runs parallel benchmark for ObjectLayer.GetObject() .
 func benchmarkGetObjectParallel(b *testing.B, instanceType string, objSize int) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		b.Fatalf("Unable to initialize config. %s", err)
-	}
-	defer os.RemoveAll(rootPath)
-
 	// create a temp XL/FS backend.
 	objLayer, disks, err := prepareBenchmarkBackend(instanceType)
 	if err != nil {
@@ -301,6 +268,7 @@ func benchmarkGetObjectParallel(b *testing.B, instanceType string, objSize int)
 	}
 	// cleaning up the backend by removing all the directories and files created.
 	defer removeRoots(disks)
+
 	//  uses *testing.B and the object Layer to run the benchmark.
 	runGetObjectBenchmarkParallel(b, objLayer, objSize)
 }
@@ -308,16 +276,10 @@ func benchmarkGetObjectParallel(b *testing.B, instanceType string, objSize int)
 // Parallel benchmark utility functions for ObjectLayer.PutObject().
 // Creates Object layer setup ( MakeBucket ) and then runs the PutObject benchmark.
 func runPutObjectBenchmarkParallel(b *testing.B, obj ObjectLayer, objSize int) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		b.Fatalf("Unable to initialize config. %s", err)
-	}
-	defer os.RemoveAll(rootPath)
-
 	// obtains random bucket name.
 	bucket := getRandomBucketName()
 	// create bucket.
-	err = obj.MakeBucketWithLocation(context.Background(), bucket, "")
+	err := obj.MakeBucketWithLocation(context.Background(), bucket, "")
 	if err != nil {
 		b.Fatal(err)
 	}
@@ -359,16 +321,10 @@ func runPutObjectBenchmarkParallel(b *testing.B, obj ObjectLayer, objSize int) {
 // Parallel benchmark utility functions for ObjectLayer.GetObject().
 // Creates Object layer setup ( MakeBucket, PutObject) and then runs the benchmark.
 func runGetObjectBenchmarkParallel(b *testing.B, obj ObjectLayer, objSize int) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		b.Fatalf("Unable to initialize config. %s", err)
-	}
-	defer os.RemoveAll(rootPath)
-
 	// obtains random bucket name.
 	bucket := getRandomBucketName()
 	// create bucket.
-	err = obj.MakeBucketWithLocation(context.Background(), bucket, "")
+	err := obj.MakeBucketWithLocation(context.Background(), bucket, "")
 	if err != nil {
 		b.Fatal(err)
 	}

cmd/bitrot.go

@@ -0,0 +1,192 @@
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"hash"
+
+	"github.com/minio/highwayhash"
+	"github.com/minio/minio/cmd/logger"
+	"github.com/minio/sha256-simd"
+	"golang.org/x/crypto/blake2b"
+)
+
+// magic HH-256 key as HH-256 hash of the first 100 decimals of π as utf-8 string with a zero key.
+var magicHighwayHash256Key = []byte("\x4b\xe7\x34\xfa\x8e\x23\x8a\xcd\x26\x3e\x83\xe6\xbb\x96\x85\x52\x04\x0f\x93\x5d\xa3\x9f\x44\x14\x97\xe0\x9d\x13\x22\xde\x36\xa0")
+
+// BitrotAlgorithm specifies a algorithm used for bitrot protection.
+type BitrotAlgorithm uint
+
+const (
+	// SHA256 represents the SHA-256 hash function
+	SHA256 BitrotAlgorithm = 1 + iota
+	// HighwayHash256 represents the HighwayHash-256 hash function
+	HighwayHash256
+	// BLAKE2b512 represents the BLAKE2b-512 hash function
+	BLAKE2b512
+)
+
+// DefaultBitrotAlgorithm is the default algorithm used for bitrot protection.
+const (
+	DefaultBitrotAlgorithm = HighwayHash256
+)
+
+var bitrotAlgorithms = map[BitrotAlgorithm]string{
+	SHA256:         "sha256",
+	BLAKE2b512:     "blake2b",
+	HighwayHash256: "highwayhash256",
+}
+
+// New returns a new hash.Hash calculating the given bitrot algorithm.
+func (a BitrotAlgorithm) New() hash.Hash {
+	switch a {
+	case SHA256:
+		return sha256.New()
+	case BLAKE2b512:
+		b2, _ := blake2b.New512(nil) // New512 never returns an error if the key is nil
+		return b2
+	case HighwayHash256:
+		hh, _ := highwayhash.New(magicHighwayHash256Key) // New will never return error since key is 256 bit
+		return hh
+	default:
+		logger.CriticalIf(context.Background(), errors.New("Unsupported bitrot algorithm"))
+		return nil
+	}
+}
+
+// Available reports whether the given algorihm is available.
+func (a BitrotAlgorithm) Available() bool {
+	_, ok := bitrotAlgorithms[a]
+	return ok
+}
+
+// String returns the string identifier for a given bitrot algorithm.
+// If the algorithm is not supported String panics.
+func (a BitrotAlgorithm) String() string {
+	name, ok := bitrotAlgorithms[a]
+	if !ok {
+		logger.CriticalIf(context.Background(), errors.New("Unsupported bitrot algorithm"))
+	}
+	return name
+}
+
+// NewBitrotVerifier returns a new BitrotVerifier implementing the given algorithm.
+func NewBitrotVerifier(algorithm BitrotAlgorithm, checksum []byte) *BitrotVerifier {
+	return &BitrotVerifier{algorithm, checksum}
+}
+
+// BitrotVerifier can be used to verify protected data.
+type BitrotVerifier struct {
+	algorithm BitrotAlgorithm
+	sum       []byte
+}
+
+// BitrotAlgorithmFromString returns a bitrot algorithm from the given string representation.
+// It returns 0 if the string representation does not match any supported algorithm.
+// The zero value of a bitrot algorithm is never supported.
+func BitrotAlgorithmFromString(s string) (a BitrotAlgorithm) {
+	for alg, name := range bitrotAlgorithms {
+		if name == s {
+			return alg
+		}
+	}
+	return
+}
+
+// To read bit-rot verified data.
+type bitrotReader struct {
+	disk      StorageAPI
+	volume    string
+	filePath  string
+	verifier  *BitrotVerifier // Holds the bit-rot info
+	endOffset int64           // Affects the length of data requested in disk.ReadFile depending on Read()'s offset
+	buf       []byte          // Holds bit-rot verified data
+}
+
+// newBitrotReader returns bitrotReader.
+// Note that the buffer is allocated later in Read(). This is because we will know the buffer length only
+// during the bitrotReader.Read(). Depending on when parallelReader fails-over, the buffer length can be different.
+func newBitrotReader(disk StorageAPI, volume, filePath string, algo BitrotAlgorithm, endOffset int64, sum []byte) *bitrotReader {
+	return &bitrotReader{
+		disk:      disk,
+		volume:    volume,
+		filePath:  filePath,
+		verifier:  &BitrotVerifier{algo, sum},
+		endOffset: endOffset,
+		buf:       nil,
+	}
+}
+
+// ReadChunk returns requested data.
+func (b *bitrotReader) ReadChunk(offset int64, length int64) ([]byte, error) {
+	if b.buf == nil {
+		b.buf = make([]byte, b.endOffset-offset)
+		if _, err := b.disk.ReadFile(b.volume, b.filePath, offset, b.buf, b.verifier); err != nil {
+			logger.LogIf(context.Background(), err)
+			return nil, err
+		}
+	}
+	if int64(len(b.buf)) < length {
+		logger.LogIf(context.Background(), errLessData)
+		return nil, errLessData
+	}
+	retBuf := b.buf[:length]
+	b.buf = b.buf[length:]
+	return retBuf, nil
+}
+
+// To calculate the bit-rot of the written data.
+type bitrotWriter struct {
+	disk     StorageAPI
+	volume   string
+	filePath string
+	h        hash.Hash
+}
+
+// newBitrotWriter returns bitrotWriter.
+func newBitrotWriter(disk StorageAPI, volume, filePath string, algo BitrotAlgorithm) *bitrotWriter {
+	return &bitrotWriter{
+		disk:     disk,
+		volume:   volume,
+		filePath: filePath,
+		h:        algo.New(),
+	}
+}
+
+// Append appends the data and while calculating the hash.
+func (b *bitrotWriter) Append(buf []byte) error {
+	n, err := b.h.Write(buf)
+	if err != nil {
+		return err
+	}
+	if n != len(buf) {
+		logger.LogIf(context.Background(), errUnexpected)
+		return errUnexpected
+	}
+	if err = b.disk.AppendFile(b.volume, b.filePath, buf); err != nil {
+		logger.LogIf(context.Background(), err)
+		return err
+	}
+	return nil
+}
+
+// Sum returns bit-rot sum.
+func (b *bitrotWriter) Sum() []byte {
+	return b.h.Sum(nil)
+}

cmd/bitrot_test.go

@@ -0,0 +1,71 @@
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"io/ioutil"
+	"log"
+	"os"
+	"testing"
+)
+
+func TestBitrotReaderWriter(t *testing.T) {
+	tmpDir, err := ioutil.TempDir("", "")
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	volume := "testvol"
+	filePath := "testfile"
+
+	disk, err := newPosix(tmpDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	disk.MakeVol(volume)
+
+	writer := newBitrotWriter(disk, volume, filePath, HighwayHash256)
+
+	err = writer.Append([]byte("aaaaaaaaa"))
+	if err != nil {
+		log.Fatal(err)
+	}
+	err = writer.Append([]byte("a"))
+	if err != nil {
+		log.Fatal(err)
+	}
+	err = writer.Append([]byte("aaaaaaaaaa"))
+	if err != nil {
+		log.Fatal(err)
+	}
+	err = writer.Append([]byte("aaaaa"))
+	if err != nil {
+		log.Fatal(err)
+	}
+	err = writer.Append([]byte("aaaaaaaaaa"))
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	reader := newBitrotReader(disk, volume, filePath, HighwayHash256, 35, writer.Sum())
+
+	if _, err = reader.ReadChunk(0, 35); err != nil {
+		log.Fatal(err)
+	}
+}

cmd/bool-flag.go

@@ -56,11 +56,12 @@ func (bf *BoolFlag) UnmarshalJSON(data []byte) (err error) {
 
 // ParseBoolFlag - parses string into BoolFlag.
 func ParseBoolFlag(s string) (bf BoolFlag, err error) {
-	if s == "on" {
+	switch s {
+	case "on":
 		bf = true
-	} else if s == "off" {
+	case "off":
 		bf = false
-	} else {
+	default:
 		err = fmt.Errorf("invalid value ‘%s’ for BoolFlag", s)
 	}
 

cmd/bucket-handlers-listobjects.go

@@ -20,6 +20,8 @@ import (
 	"net/http"
 
 	"github.com/gorilla/mux"
+	"github.com/minio/minio/cmd/crypto"
+
 	"github.com/minio/minio/pkg/policy"
 )
 
@@ -100,7 +102,7 @@ func (api objectAPIHandlers) ListObjectsV2Handler(w http.ResponseWriter, r *http
 	}
 
 	for i := range listObjectsV2Info.Objects {
-		if listObjectsV2Info.Objects[i].IsEncrypted() {
+		if crypto.IsEncrypted(listObjectsV2Info.Objects[i].UserDefined) {
 			listObjectsV2Info.Objects[i].Size, err = listObjectsV2Info.Objects[i].DecryptedSize()
 			if err != nil {
 				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
@@ -166,7 +168,7 @@ func (api objectAPIHandlers) ListObjectsV1Handler(w http.ResponseWriter, r *http
 	}
 
 	for i := range listObjectsInfo.Objects {
-		if listObjectsInfo.Objects[i].IsEncrypted() {
+		if crypto.IsEncrypted(listObjectsInfo.Objects[i].UserDefined) {
 			listObjectsInfo.Objects[i].Size, err = listObjectsInfo.Objects[i].DecryptedSize()
 			if err != nil {
 				writeErrorResponse(w, toAPIErrorCode(err), r.URL)

cmd/bucket-handlers.go

@@ -32,6 +32,7 @@ import (
 	"github.com/gorilla/mux"
 
 	"github.com/minio/minio-go/pkg/set"
+	"github.com/minio/minio/cmd/crypto"
 	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/dns"
 	"github.com/minio/minio/pkg/event"
@@ -597,15 +598,17 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	}
 
 	if objectAPI.IsEncryptionSupported() {
-		if hasSSECustomerHeader(formValues) && !hasSuffix(object, slashSeparator) { // handle SSE-C requests
+		if hasServerSideEncryptionHeader(formValues) && !hasSuffix(object, slashSeparator) { // handle SSE-C and SSE-S3 requests
 			var reader io.Reader
 			var key []byte
-			key, err = ParseSSECustomerHeader(formValues)
-			if err != nil {
-				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-				return
+			if crypto.SSEC.IsRequested(formValues) {
+				key, err = ParseSSECustomerHeader(formValues)
+				if err != nil {
+					writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+					return
+				}
 			}
-			reader, err = newEncryptReader(hashReader, key, bucket, object, metadata)
+			reader, err = newEncryptReader(hashReader, key, bucket, object, metadata, crypto.S3.IsRequested(formValues))
 			if err != nil {
 				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 				return

cmd/common-main.go

@@ -17,7 +17,6 @@
 package cmd
 
 import (
-	"context"
 	"errors"
 	"net"
 	"os"
@@ -27,8 +26,8 @@ import (
 	"time"
 
 	etcd "github.com/coreos/etcd/clientv3"
-
 	"github.com/minio/cli"
+	"github.com/minio/minio/cmd/crypto"
 	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/dns"
@@ -48,39 +47,6 @@ func checkUpdate(mode string) {
 	}
 }
 
-// Initialize and load config from remote etcd or local config directory
-func initConfig() {
-	if globalEtcdClient != nil {
-		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
-		resp, err := globalEtcdClient.Get(ctx, getConfigFile())
-		cancel()
-		// This means there are no entries in etcd with config file
-		// So create a new config
-		if err == nil && resp.Count == 0 {
-			logger.FatalIf(newConfig(), "Unable to initialize minio config for the first time.")
-			logger.Info("Created minio configuration file successfully at %v", globalEtcdClient.Endpoints())
-		} else {
-			// This means there is an entry in etcd, update it if required and proceed
-			if err == nil && resp.Count > 0 {
-				logger.FatalIf(migrateConfig(), "Config migration failed.")
-				logger.FatalIf(loadConfig(), "Unable to load config version: '%s'.", serverConfigVersion)
-			} else {
-				logger.FatalIf(err, "Unable to load config version: '%s'.", serverConfigVersion)
-			}
-		}
-		return
-	}
-
-	if isFile(getConfigFile()) {
-		logger.FatalIf(migrateConfig(), "Config migration failed")
-		logger.FatalIf(loadConfig(), "Unable to load the configuration file")
-	} else {
-		// Config file does not exist, we create it fresh and return upon success.
-		logger.FatalIf(newConfig(), "Unable to initialize minio config for the first time")
-		logger.Info("Created minio configuration file successfully at " + getConfigDir())
-	}
-}
-
 // Load logger targets based on user's configuration
 func loadLoggers() {
 	if globalServerConfig.Logger.Console.Enabled {
@@ -99,9 +65,10 @@ func handleCommonCmdArgs(ctx *cli.Context) {
 
 	var configDir string
 
-	if ctx.IsSet("config-dir") {
+	switch {
+	case ctx.IsSet("config-dir"):
 		configDir = ctx.String("config-dir")
-	} else if ctx.GlobalIsSet("config-dir") {
+	case ctx.GlobalIsSet("config-dir"):
 		configDir = ctx.GlobalString("config-dir")
 		// cli package does not expose parent's "config-dir" option.  Below code is workaround.
 		if configDir == "" || configDir == getConfigDir() {
@@ -109,7 +76,7 @@ func handleCommonCmdArgs(ctx *cli.Context) {
 				configDir = ctx.Parent().GlobalString("config-dir")
 			}
 		}
-	} else {
+	default:
 		// Neither local nor global config-dir option is provided.  In this case, try to use
 		// default config directory.
 		configDir = getConfigDir()
@@ -147,6 +114,11 @@ func handleCommonEnvVars() {
 		globalActiveCred = cred
 	}
 
+	// In distributed setup users need to set ENVs always.
+	if !globalIsEnvCreds && globalIsDistXL {
+		logger.Fatal(uiErrEnvCredentialsMissingServer(nil), "Unable to start distributed server mode")
+	}
+
 	if browser := os.Getenv("MINIO_BROWSER"); browser != "" {
 		browserFlag, err := ParseBoolFlag(browser)
 		if err != nil {
@@ -279,4 +251,18 @@ func handleCommonEnvVars() {
 		globalIsEnvWORM = true
 		globalWORMEnabled = bool(wormFlag)
 	}
+
+	kmsConf, err := crypto.NewVaultConfig()
+	if err != nil {
+		logger.Fatal(err, "Unable to initialize hashicorp vault")
+	}
+	if kmsConf.Vault.Endpoint != "" {
+		kms, err := crypto.NewVault(kmsConf)
+		if err != nil {
+			logger.Fatal(err, "Unable to initialize KMS")
+		}
+		globalKMS = kms
+		globalKMSKeyID = kmsConf.Vault.Key.Name
+		globalKMSConfig = kmsConf
+	}
 }

cmd/config-current.go

@@ -24,12 +24,12 @@ import (
 	"sync"
 
 	"github.com/miekg/dns"
+	"github.com/minio/minio/cmd/crypto"
 	"github.com/minio/minio/cmd/logger"
 
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/event"
 	"github.com/minio/minio/pkg/event/target"
-	"github.com/minio/minio/pkg/quick"
 )
 
 // Steps to move from version N to version N+1
@@ -41,9 +41,9 @@ import (
 // 6. Make changes in config-current_test.go for any test change
 
 // Config version
-const serverConfigVersion = "27"
+const serverConfigVersion = "28"
 
-type serverConfig = serverConfigV27
+type serverConfig = serverConfigV28
 
 var (
 	// globalServerConfig server config.
@@ -64,11 +64,21 @@ func (s *serverConfig) SetRegion(region string) {
 
 // GetRegion get current region.
 func (s *serverConfig) GetRegion() string {
+	if globalIsEnvRegion {
+		return globalServerRegion
+	}
+	if s == nil {
+		return ""
+	}
 	return s.Region
 }
 
 // SetCredential sets new credential and returns the previous credential.
 func (s *serverConfig) SetCredential(creds auth.Credentials) (prevCred auth.Credentials) {
+	if creds.IsValid() && globalActiveCred.IsValid() {
+		globalActiveCred = creds
+	}
+
 	// Save previous credential.
 	prevCred = s.Credential
 
@@ -81,6 +91,9 @@ func (s *serverConfig) SetCredential(creds auth.Credentials) (prevCred auth.Cred
 
 // GetCredentials get current credentials.
 func (s *serverConfig) GetCredential() auth.Credentials {
+	if globalActiveCred.IsValid() {
+		return globalActiveCred
+	}
 	return s.Credential
 }
 
@@ -104,16 +117,34 @@ func (s *serverConfig) SetStorageClass(standardClass, rrsClass storageClass) {
 // GetStorageClass reads storage class fields from current config.
 // It returns the standard and reduced redundancy storage class struct
 func (s *serverConfig) GetStorageClass() (storageClass, storageClass) {
+	if globalIsStorageClass {
+		return globalStandardStorageClass, globalRRStorageClass
+	}
+	if s == nil {
+		return storageClass{}, storageClass{}
+	}
 	return s.StorageClass.Standard, s.StorageClass.RRS
 }
 
 // GetBrowser get current credentials.
 func (s *serverConfig) GetBrowser() bool {
+	if globalIsEnvWORM {
+		return globalWORMEnabled
+	}
+	if s == nil {
+		return true
+	}
 	return bool(s.Browser)
 }
 
 // GetWorm get current credentials.
 func (s *serverConfig) GetWorm() bool {
+	if globalIsEnvBrowser {
+		return globalIsBrowserEnabled
+	}
+	if s == nil {
+		return false
+	}
 	return bool(s.Worm)
 }
 
@@ -127,10 +158,24 @@ func (s *serverConfig) SetCacheConfig(drives, exclude []string, expiry int, maxu
 
 // GetCacheConfig gets the current cache config
 func (s *serverConfig) GetCacheConfig() CacheConfig {
+	if globalIsDiskCacheEnabled {
+		return CacheConfig{
+			Drives:  globalCacheDrives,
+			Exclude: globalCacheExcludes,
+			Expiry:  globalCacheExpiry,
+			MaxUse:  globalCacheMaxUse,
+		}
+	}
+	if s == nil {
+		return CacheConfig{}
+	}
 	return s.Cache
 }
 
 func (s *serverConfig) Validate() error {
+	if s == nil {
+		return nil
+	}
 	if s.Version != serverConfigVersion {
 		return fmt.Errorf("configuration version mismatch. Expected: ‘%s’, Got: ‘%s’", serverConfigVersion, s.Version)
 	}
@@ -208,19 +253,39 @@ func (s *serverConfig) Validate() error {
 	return nil
 }
 
-// Save config file to corresponding backend
-func Save(configFile string, data interface{}) error {
-	return quick.SaveConfig(data, configFile, globalEtcdClient)
-}
+func (s *serverConfig) loadFromEnvs() {
+	// If env is set override the credentials from config file.
+	if globalIsEnvCreds {
+		s.SetCredential(globalActiveCred)
+	}
 
-// Load config from backend
-func Load(configFile string, data interface{}) (quick.Config, error) {
-	return quick.LoadConfig(configFile, globalEtcdClient, data)
-}
+	if globalIsEnvBrowser {
+		s.SetBrowser(globalIsBrowserEnabled)
+	}
 
-// GetVersion gets config version from backend
-func GetVersion(configFile string) (string, error) {
-	return quick.GetVersion(configFile, globalEtcdClient)
+	if globalIsEnvWORM {
+		s.SetWorm(globalWORMEnabled)
+	}
+
+	if globalIsEnvRegion {
+		s.SetRegion(globalServerRegion)
+	}
+
+	if globalIsEnvDomainName {
+		s.Domain = globalDomainName
+	}
+
+	if globalIsStorageClass {
+		s.SetStorageClass(globalStandardStorageClass, globalRRStorageClass)
+	}
+
+	if globalIsDiskCacheEnabled {
+		s.SetCacheConfig(globalCacheDrives, globalCacheExcludes, globalCacheExpiry, globalCacheMaxUse)
+	}
+
+	if globalKMS != nil {
+		s.KMS = globalKMSConfig
+	}
 }
 
 // Returns the string describing a difference with the given
@@ -262,6 +327,8 @@ func (s *serverConfig) ConfigDiff(t *serverConfig) string {
 		return "MQTT Notification configuration differs"
 	case !reflect.DeepEqual(s.Logger, t.Logger):
 		return "Logger configuration differs"
+	case !reflect.DeepEqual(s.KMS, t.KMS):
+		return "KMS configuration differs"
 	case reflect.DeepEqual(s, t):
 		return ""
 	default:
@@ -290,6 +357,7 @@ func newServerConfig() *serverConfig {
 			Expiry:  globalCacheExpiry,
 			MaxUse:  globalCacheMaxUse,
 		},
+		KMS:    crypto.KMSConfig{},
 		Notify: notifier{},
 	}
 
@@ -327,153 +395,89 @@ func newServerConfig() *serverConfig {
 	return srvCfg
 }
 
-// newConfig - initialize a new server config, saves env parameters if
-// found, otherwise use default parameters
-func newConfig() error {
-	// Initialize server config.
-	srvCfg, err := newQuickConfig(newServerConfig())
-	if err != nil {
-		return err
-	}
-
-	// If env is set override the credentials from config file.
-	if globalIsEnvCreds {
-		srvCfg.SetCredential(globalActiveCred)
-	}
-
-	if globalIsEnvBrowser {
-		srvCfg.SetBrowser(globalIsBrowserEnabled)
-	}
-
-	if globalIsEnvWORM {
-		srvCfg.SetWorm(globalWORMEnabled)
-	}
-
-	if globalIsEnvRegion {
-		srvCfg.SetRegion(globalServerRegion)
-	}
-
-	if globalIsEnvDomainName {
-		srvCfg.Domain = globalDomainName
-	}
-
-	if globalIsStorageClass {
-		srvCfg.SetStorageClass(globalStandardStorageClass, globalRRStorageClass)
-	}
-
-	if globalIsDiskCacheEnabled {
-		srvCfg.SetCacheConfig(globalCacheDrives, globalCacheExcludes, globalCacheExpiry, globalCacheMaxUse)
-	}
-
-	// hold the mutex lock before a new config is assigned.
-	// Save the new config globally.
-	// unlock the mutex.
-	globalServerConfigMu.Lock()
-	globalServerConfig = srvCfg
-	globalServerConfigMu.Unlock()
-
-	// Save config into file.
-	return Save(getConfigFile(), globalServerConfig)
-}
-
-// newQuickConfig - initialize a new server config, with an allocated
-// quick.Config interface.
-func newQuickConfig(srvCfg *serverConfig) (*serverConfig, error) {
-	qcfg, err := quick.NewConfig(srvCfg, globalEtcdClient)
-	if err != nil {
-		return nil, err
-	}
-
-	srvCfg.Config = qcfg
-	return srvCfg, nil
-}
-
-// getValidConfig - returns valid server configuration
-func getValidConfig() (*serverConfig, error) {
-	srvCfg := &serverConfig{
-		Region:  globalMinioDefaultRegion,
-		Browser: true,
-	}
-
-	var err error
-	srvCfg, err = newQuickConfig(srvCfg)
-	if err != nil {
-		return nil, err
-	}
-
-	configFile := getConfigFile()
-	if err = srvCfg.Load(configFile); err != nil {
-		return nil, err
-	}
-
-	if err = srvCfg.Validate(); err != nil {
-		return nil, err
-	}
-
-	return srvCfg, nil
-}
-
-// loadConfig - loads a new config from disk, overrides params from env
-// if found and valid
-func loadConfig() error {
-	srvCfg, err := getValidConfig()
-	if err != nil {
-		return uiErrInvalidConfig(nil).Msg(err.Error())
-	}
-
-	// If env is set override the credentials from config file.
-	if globalIsEnvCreds {
-		srvCfg.SetCredential(globalActiveCred)
-	}
-
-	if globalIsEnvBrowser {
-		srvCfg.SetBrowser(globalIsBrowserEnabled)
-	}
-
-	if globalIsEnvRegion {
-		srvCfg.SetRegion(globalServerRegion)
-	}
-
-	if globalIsEnvDomainName {
-		srvCfg.Domain = globalDomainName
-	}
-
-	if globalIsStorageClass {
-		srvCfg.SetStorageClass(globalStandardStorageClass, globalRRStorageClass)
-	}
-
-	if globalIsDiskCacheEnabled {
-		srvCfg.SetCacheConfig(globalCacheDrives, globalCacheExcludes, globalCacheExpiry, globalCacheMaxUse)
-	}
-
-	// hold the mutex lock before a new config is assigned.
-	globalServerConfigMu.Lock()
-	globalServerConfig = srvCfg
+func (s *serverConfig) loadToCachedConfigs() {
 	if !globalIsEnvCreds {
-		globalActiveCred = globalServerConfig.GetCredential()
+		globalActiveCred = s.GetCredential()
 	}
 	if !globalIsEnvBrowser {
-		globalIsBrowserEnabled = globalServerConfig.GetBrowser()
+		globalIsBrowserEnabled = s.GetBrowser()
 	}
 	if !globalIsEnvWORM {
-		globalWORMEnabled = globalServerConfig.GetWorm()
+		globalWORMEnabled = s.GetWorm()
 	}
 	if !globalIsEnvRegion {
-		globalServerRegion = globalServerConfig.GetRegion()
+		globalServerRegion = s.GetRegion()
 	}
 	if !globalIsEnvDomainName {
-		globalDomainName = globalServerConfig.Domain
+		globalDomainName = s.Domain
 	}
 	if !globalIsStorageClass {
-		globalStandardStorageClass, globalRRStorageClass = globalServerConfig.GetStorageClass()
+		globalStandardStorageClass, globalRRStorageClass = s.GetStorageClass()
 	}
 	if !globalIsDiskCacheEnabled {
-		cacheConf := globalServerConfig.GetCacheConfig()
+		cacheConf := s.GetCacheConfig()
 		globalCacheDrives = cacheConf.Drives
 		globalCacheExcludes = cacheConf.Exclude
 		globalCacheExpiry = cacheConf.Expiry
 		globalCacheMaxUse = cacheConf.MaxUse
 	}
+	if globalKMS == nil {
+		globalKMSConfig = s.KMS
+		if kms, err := crypto.NewVault(globalKMSConfig); err == nil {
+			globalKMS = kms
+			globalKMSKeyID = globalKMSConfig.Vault.Key.Name
+		}
+	}
+}
+
+// newConfig - initialize a new server config, saves env parameters if
+// found, otherwise use default parameters
+func newConfig(objAPI ObjectLayer) error {
+	// Initialize server config.
+	srvCfg := newServerConfig()
+
+	// Override any values from ENVs.
+	srvCfg.loadFromEnvs()
+
+	// Load values to cached global values.
+	srvCfg.loadToCachedConfigs()
+
+	// hold the mutex lock before a new config is assigned.
+	globalServerConfigMu.Lock()
+	globalServerConfig = srvCfg
+	globalServerConfigMu.Unlock()
+
+	// Save config into file.
+	return saveServerConfig(objAPI, globalServerConfig)
+}
+
+// getValidConfig - returns valid server configuration
+func getValidConfig(objAPI ObjectLayer) (*serverConfig, error) {
+	srvCfg, err := readServerConfig(context.Background(), objAPI)
+	if err != nil {
+		return nil, err
+	}
+
+	return srvCfg, srvCfg.Validate()
+}
+
+// loadConfig - loads a new config from disk, overrides params from env
+// if found and valid
+func loadConfig(objAPI ObjectLayer) error {
+	srvCfg, err := getValidConfig(objAPI)
+	if err != nil {
+		return uiErrInvalidConfig(nil).Msg(err.Error())
+	}
+
+	// Override any values from ENVs.
+	srvCfg.loadFromEnvs()
+
+	// Load values to cached global values.
+	srvCfg.loadToCachedConfigs()
+
+	// hold the mutex lock before a new config is assigned.
+	globalServerConfigMu.Lock()
+	globalServerConfig = srvCfg
 	globalServerConfigMu.Unlock()
 
 	return nil
@@ -486,7 +490,9 @@ func loadConfig() error {
 // * Handle the configuration in this function to create/add into TargetList.
 func getNotificationTargets(config *serverConfig) *event.TargetList {
 	targetList := event.NewTargetList()
-
+	if config == nil {
+		return targetList
+	}
 	for id, args := range config.Notify.AMQP {
 		if args.Enable {
 			newTarget, err := target.NewAMQPTarget(id, args)

cmd/config-current_test.go

@@ -17,9 +17,8 @@
 package cmd
 
 import (
-	"io/ioutil"
 	"os"
-	"path/filepath"
+	"path"
 	"testing"
 
 	"github.com/minio/minio/pkg/auth"
@@ -27,12 +26,15 @@ import (
 )
 
 func TestServerConfig(t *testing.T) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
+	objLayer, fsDir, err := prepareFS()
 	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(fsDir)
+
+	if err = newTestConfig(globalMinioDefaultRegion, objLayer); err != nil {
 		t.Fatalf("Init Test config failed")
 	}
-	// remove the root directory after the test ends.
-	defer os.RemoveAll(rootPath)
 
 	if globalServerConfig.GetRegion() != globalMinioDefaultRegion {
 		t.Errorf("Expecting region `us-east-1` found %s", globalServerConfig.GetRegion())
@@ -49,16 +51,12 @@ func TestServerConfig(t *testing.T) {
 		t.Errorf("Expecting version %s found %s", globalServerConfig.GetVersion(), serverConfigVersion)
 	}
 
-	// Attempt to save.
-	if err := globalServerConfig.Save(getConfigFile()); err != nil {
+	if err := saveServerConfig(objLayer, globalServerConfig); err != nil {
 		t.Fatalf("Unable to save updated config file %s", err)
 	}
 
-	// Do this only once here.
-	setConfigDir(rootPath)
-
 	// Initialize server config.
-	if err := loadConfig(); err != nil {
+	if err := loadConfig(objLayer); err != nil {
 		t.Fatalf("Unable to initialize from updated config file %s", err)
 	}
 }
@@ -82,22 +80,24 @@ func TestServerConfigWithEnvs(t *testing.T) {
 
 	defer resetGlobalIsEnvs()
 
-	// Get test root.
-	rootPath, err := getTestRoot()
+	objLayer, fsDir, err := prepareFS()
 	if err != nil {
-		t.Error(err)
+		t.Fatal(err)
 	}
+	defer os.RemoveAll(fsDir)
+
+	if err = newTestConfig(globalMinioDefaultRegion, objLayer); err != nil {
+		t.Fatalf("Init Test config failed")
+	}
+
+	globalObjLayerMutex.Lock()
+	globalObjectAPI = objLayer
+	globalObjLayerMutex.Unlock()
 
 	serverHandleEnvVars()
 
-	// Do this only once here.
-	setConfigDir(rootPath)
-
 	// Init config
-	initConfig()
-
-	// remove the root directory after the test ends.
-	defer os.RemoveAll(rootPath)
+	initConfig(objLayer)
 
 	// Check if serverConfig has
 	if globalServerConfig.GetBrowser() {
@@ -127,16 +127,17 @@ func TestServerConfigWithEnvs(t *testing.T) {
 
 // Tests config validator..
 func TestValidateConfig(t *testing.T) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
+	objLayer, fsDir, err := prepareFS()
 	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(fsDir)
+
+	if err = newTestConfig(globalMinioDefaultRegion, objLayer); err != nil {
 		t.Fatalf("Init Test config failed")
 	}
 
-	// remove the root directory after the test ends.
-	defer os.RemoveAll(rootPath)
-
-	configPath := filepath.Join(rootPath, minioConfigFile)
-
+	configPath := path.Join(minioConfigPrefix, minioConfigFile)
 	v := serverConfigVersion
 
 	testCases := []struct {
@@ -226,14 +227,14 @@ func TestValidateConfig(t *testing.T) {
 	}
 
 	for i, testCase := range testCases {
-		if werr := ioutil.WriteFile(configPath, []byte(testCase.configData), 0700); werr != nil {
-			t.Fatal(werr)
+		if err = saveConfig(objLayer, configPath, []byte(testCase.configData)); err != nil {
+			t.Fatal(err)
 		}
-		_, verr := getValidConfig()
-		if testCase.shouldPass && verr != nil {
-			t.Errorf("Test %d, should pass but it failed with err = %v", i+1, verr)
+		_, err = getValidConfig(objLayer)
+		if testCase.shouldPass && err != nil {
+			t.Errorf("Test %d, should pass but it failed with err = %v", i+1, err)
 		}
-		if !testCase.shouldPass && verr == nil {
+		if !testCase.shouldPass && err == nil {
 			t.Errorf("Test %d, should fail but it succeeded.", i+1)
 		}
 	}

cmd/config-dir.go

@@ -28,9 +28,6 @@ const (
 	// Default minio configuration directory where below configuration files/directories are stored.
 	defaultMinioConfigDir = ".minio"
 
-	// Minio configuration file.
-	minioConfigFile = "config.json"
-
 	// Directory contains below files/directories for HTTPS configuration.
 	certsDir = "certs"
 

cmd/config-migrate.go

@@ -17,10 +17,13 @@
 package cmd
 
 import (
+	"context"
 	"fmt"
 	"os"
+	"path"
 	"path/filepath"
 
+	"github.com/minio/minio/cmd/crypto"
 	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/dns"
@@ -33,7 +36,22 @@ import (
 // DO NOT EDIT following message template, please open a github issue to discuss instead.
 var configMigrateMSGTemplate = "Configuration file %s migrated from version '%s' to '%s' successfully."
 
-// Migrates all config versions from "1" to "18".
+// Save config file to corresponding backend
+func Save(configFile string, data interface{}) error {
+	return quick.SaveConfig(data, configFile, globalEtcdClient)
+}
+
+// Load config from backend
+func Load(configFile string, data interface{}) (quick.Config, error) {
+	return quick.LoadConfig(configFile, globalEtcdClient, data)
+}
+
+// GetVersion gets config version from backend
+func GetVersion(configFile string) (string, error) {
+	return quick.GetVersion(configFile, globalEtcdClient)
+}
+
+// Migrates all config versions from "1" to "28".
 func migrateConfig() error {
 	// Purge all configs with version '1',
 	// this is a special case since version '1' used
@@ -45,6 +63,9 @@ func migrateConfig() error {
 	// Load only config version information.
 	version, err := GetVersion(getConfigFile())
 	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
 		return err
 	}
 
@@ -193,6 +214,11 @@ func migrateConfig() error {
 			return err
 		}
 		fallthrough
+	case "27":
+		if err = migrateV27ToV28(); err != nil {
+			return err
+		}
+		fallthrough
 	case serverConfigVersion:
 		// No migration needed. this always points to current version.
 		err = nil
@@ -2355,3 +2381,57 @@ func migrateV26ToV27() error {
 	logger.Info(configMigrateMSGTemplate, configFile, "26", "27")
 	return nil
 }
+
+func migrateV27ToV28() error {
+	configFile := getConfigFile()
+
+	// config V28 is backward compatible with V27, load the old
+	// config file in serverConfigV28 struct and initialize KMSConfig
+	srvConfig := &serverConfigV28{}
+	_, err := quick.LoadConfig(configFile, globalEtcdClient, srvConfig)
+	if os.IsNotExist(err) {
+		return nil
+	} else if err != nil {
+		return fmt.Errorf("Unable to load config file. %v", err)
+	}
+
+	if srvConfig.Version != "27" {
+		return nil
+	}
+
+	srvConfig.Version = "28"
+	srvConfig.KMS = crypto.KMSConfig{}
+	if err = quick.SaveConfig(srvConfig, configFile, globalEtcdClient); err != nil {
+		return fmt.Errorf("Failed to migrate config from ‘27’ to ‘28’. %v", err)
+	}
+
+	logger.Info(configMigrateMSGTemplate, configFile, "27", "28")
+	return nil
+}
+
+// Migrates '.minio.sys/config.json' v27 to v28.
+func migrateMinioSysConfig(objAPI ObjectLayer) error {
+	return migrateV27ToV28MinioSys(objAPI)
+}
+
+func migrateV27ToV28MinioSys(objAPI ObjectLayer) error {
+	configFile := path.Join(minioConfigPrefix, minioConfigFile)
+	srvConfig, err := readServerConfig(context.Background(), objAPI)
+	if err == errConfigNotFound {
+		return nil
+	} else if err != nil {
+		return fmt.Errorf("Unable to load config file. %v", err)
+	}
+	if srvConfig.Version != "27" {
+		return nil
+	}
+
+	srvConfig.Version = "28"
+	srvConfig.KMS = crypto.KMSConfig{}
+	if err = saveServerConfig(objAPI, srvConfig); err != nil {
+		return fmt.Errorf("Failed to migrate config from ‘27’ to ‘28’. %v", err)
+	}
+
+	logger.Info(configMigrateMSGTemplate, configFile, "27", "28")
+	return nil
+}

cmd/config-migrate_test.go

@@ -25,15 +25,26 @@ import (
 
 // Test if config v1 is purged
 func TestServerConfigMigrateV1(t *testing.T) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
+	objLayer, fsDir, err := prepareFS()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(fsDir)
+	err = newTestConfig(globalMinioDefaultRegion, objLayer)
 	if err != nil {
 		t.Fatalf("Init Test config failed")
 	}
-	// remove the root directory after the test ends.
+	rootPath, err := ioutil.TempDir(globalTestTmpDir, "minio-")
+	if err != nil {
+		t.Fatal(err)
+	}
 	defer os.RemoveAll(rootPath)
-
 	setConfigDir(rootPath)
 
+	globalObjLayerMutex.Lock()
+	globalObjectAPI = objLayer
+	globalObjLayerMutex.Unlock()
+
 	// Create a V1 config json file and store it
 	configJSON := "{ \"version\":\"1\", \"accessKeyId\":\"abcde\", \"secretAccessKey\":\"abcdefgh\"}"
 	configPath := rootPath + "/fsUsers.json"
@@ -45,13 +56,14 @@ func TestServerConfigMigrateV1(t *testing.T) {
 	if err := migrateConfig(); err != nil {
 		t.Fatal("Unexpected error: ", err)
 	}
+
 	// Check if config v1 is removed from filesystem
 	if _, err := os.Stat(configPath); err == nil || !os.IsNotExist(err) {
 		t.Fatal("Config V1 file is not purged")
 	}
 
 	// Initialize server config and check again if everything is fine
-	if err := loadConfig(); err != nil {
+	if err := loadConfig(objLayer); err != nil {
 		t.Fatalf("Unable to initialize from updated config file %s", err)
 	}
 }
@@ -59,20 +71,13 @@ func TestServerConfigMigrateV1(t *testing.T) {
 // Test if all migrate code returns nil when config file does not
 // exist
 func TestServerConfigMigrateInexistentConfig(t *testing.T) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
+	rootPath, err := ioutil.TempDir(globalTestTmpDir, "minio-")
 	if err != nil {
-		t.Fatalf("Init Test config failed")
+		t.Fatal(err)
 	}
-	// remove the root directory after the test ends.
 	defer os.RemoveAll(rootPath)
 
 	setConfigDir(rootPath)
-	configPath := rootPath + "/" + minioConfigFile
-
-	// Remove config file
-	if err := os.Remove(configPath); err != nil {
-		t.Fatal("Unexpected error: ", err)
-	}
 
 	if err := migrateV2ToV3(); err != nil {
 		t.Fatal("migrate v2 to v3 should succeed when no config file is found")
@@ -149,18 +154,30 @@ func TestServerConfigMigrateInexistentConfig(t *testing.T) {
 	if err := migrateV26ToV27(); err != nil {
 		t.Fatal("migrate v26 to v27 should succeed when no config file is found")
 	}
+	if err := migrateV27ToV28(); err != nil {
+		t.Fatal("migrate v27 to v28 should succeed when no config file is found")
+	}
 }
 
-// Test if a config migration from v2 to v27 is successfully done
-func TestServerConfigMigrateV2toV27(t *testing.T) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
+// Test if a config migration from v2 to v28 is successfully done
+func TestServerConfigMigrateV2toV28(t *testing.T) {
+	rootPath, err := ioutil.TempDir(globalTestTmpDir, "minio-")
 	if err != nil {
-		t.Fatalf("Init Test config failed")
+		t.Fatal(err)
 	}
-	// remove the root directory after the test ends.
 	defer os.RemoveAll(rootPath)
-
 	setConfigDir(rootPath)
+
+	objLayer, fsDir, err := prepareFS()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(fsDir)
+
+	globalObjLayerMutex.Lock()
+	globalObjectAPI = objLayer
+	globalObjLayerMutex.Unlock()
+
 	configPath := rootPath + "/" + minioConfigFile
 
 	// Create a corrupted config file
@@ -186,8 +203,12 @@ func TestServerConfigMigrateV2toV27(t *testing.T) {
 		t.Fatal("Unexpected error: ", err)
 	}
 
+	if err := migrateConfigToMinioSys(); err != nil {
+		t.Fatal("Unexpected error: ", err)
+	}
+
 	// Initialize server config and check again if everything is fine
-	if err := loadConfig(); err != nil {
+	if err := loadConfig(newObjectLayerFn()); err != nil {
 		t.Fatalf("Unable to initialize from updated config file %s", err)
 	}
 
@@ -208,13 +229,11 @@ func TestServerConfigMigrateV2toV27(t *testing.T) {
 
 // Test if all migrate code returns error with corrupted config files
 func TestServerConfigMigrateFaultyConfig(t *testing.T) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
+	rootPath, err := ioutil.TempDir(globalTestTmpDir, "minio-")
 	if err != nil {
-		t.Fatalf("Init Test config failed")
+		t.Fatal(err)
 	}
-	// remove the root directory after the test ends.
 	defer os.RemoveAll(rootPath)
-
 	setConfigDir(rootPath)
 	configPath := rootPath + "/" + minioConfigFile
 
@@ -299,17 +318,19 @@ func TestServerConfigMigrateFaultyConfig(t *testing.T) {
 	if err := migrateV26ToV27(); err == nil {
 		t.Fatal("migrateConfigV26ToV27() should fail with a corrupted json")
 	}
+
+	if err := migrateV27ToV28(); err == nil {
+		t.Fatal("migrateConfigV27ToV28() should fail with a corrupted json")
+	}
 }
 
 // Test if all migrate code returns error with corrupted config files
 func TestServerConfigMigrateCorruptedConfig(t *testing.T) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
+	rootPath, err := ioutil.TempDir(globalTestTmpDir, "minio-")
 	if err != nil {
-		t.Fatalf("Init Test config failed")
+		t.Fatal(err)
 	}
-	// remove the root directory after the test ends.
 	defer os.RemoveAll(rootPath)
-
 	setConfigDir(rootPath)
 	configPath := rootPath + "/" + minioConfigFile
 

cmd/config-versions.go

@@ -19,6 +19,7 @@ package cmd
 import (
 	"sync"
 
+	"github.com/minio/minio/cmd/crypto"
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/event/target"
 	"github.com/minio/minio/pkg/quick"
@@ -722,3 +723,36 @@ type serverConfigV27 struct {
 	// Logger configuration
 	Logger loggerConfig `json:"logger"`
 }
+
+// serverConfigV28 is just like version '27', additionally
+// storing KMS config
+//
+// IMPORTANT NOTE: When updating this struct make sure that
+// serverConfig.ConfigDiff() is updated as necessary.
+type serverConfigV28 struct {
+	quick.Config `json:"-"` // ignore interfaces
+
+	Version string `json:"version"`
+
+	// S3 API configuration.
+	Credential auth.Credentials `json:"credential"`
+	Region     string           `json:"region"`
+	Browser    BoolFlag         `json:"browser"`
+	Worm       BoolFlag         `json:"worm"`
+	Domain     string           `json:"domain"`
+
+	// Storage class configuration
+	StorageClass storageClassConfig `json:"storageclass"`
+
+	// Cache configuration
+	Cache CacheConfig `json:"cache"`
+
+	// KMS configuration
+	KMS crypto.KMSConfig `json:"kms"`
+
+	// Notification queue configuration.
+	Notify notifier `json:"notify"`
+
+	// Logger configuration
+	Logger loggerConfig `json:"logger"`
+}

cmd/config.go

@@ -0,0 +1,261 @@
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/ioutil"
+	"path"
+	"runtime"
+	"time"
+
+	"github.com/minio/minio/cmd/logger"
+	"github.com/minio/minio/pkg/hash"
+	"github.com/minio/minio/pkg/quick"
+)
+
+const (
+	minioConfigPrefix = "config"
+
+	// Minio configuration file.
+	minioConfigFile = "config.json"
+)
+
+func saveServerConfig(objAPI ObjectLayer, config *serverConfig) error {
+	if err := quick.CheckData(config); err != nil {
+		return err
+	}
+
+	data, err := json.Marshal(config)
+	if err != nil {
+		return err
+	}
+
+	configFile := path.Join(minioConfigPrefix, minioConfigFile)
+	if globalEtcdClient != nil {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+		_, err := globalEtcdClient.Put(ctx, configFile, string(data))
+		defer cancel()
+		return err
+	}
+
+	return saveConfig(objAPI, configFile, data)
+}
+
+func readConfigEtcd(configFile string) ([]byte, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	resp, err := globalEtcdClient.Get(ctx, configFile)
+	defer cancel()
+	if err != nil {
+		return nil, err
+	}
+	if resp.Count == 0 {
+		return nil, errConfigNotFound
+	}
+	for _, ev := range resp.Kvs {
+		if string(ev.Key) == configFile {
+			return ev.Value, nil
+		}
+	}
+	return nil, errConfigNotFound
+}
+
+func readServerConfig(ctx context.Context, objAPI ObjectLayer) (*serverConfig, error) {
+	var configData []byte
+	var err error
+	configFile := path.Join(minioConfigPrefix, minioConfigFile)
+	if globalEtcdClient != nil {
+		configData, err = readConfigEtcd(configFile)
+	} else {
+		var reader io.Reader
+		reader, err = readConfig(ctx, objAPI, configFile)
+		if err != nil {
+			return nil, err
+		}
+		configData, err = ioutil.ReadAll(reader)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	if runtime.GOOS == "windows" {
+		configData = bytes.Replace(configData, []byte("\r\n"), []byte("\n"), -1)
+	}
+
+	if err = quick.CheckDuplicateKeys(string(configData)); err != nil {
+		return nil, err
+	}
+
+	var config = &serverConfig{}
+	if err := json.Unmarshal(configData, config); err != nil {
+		return nil, err
+	}
+
+	if err := quick.CheckData(config); err != nil {
+		return nil, err
+	}
+
+	return config, nil
+}
+
+func checkServerConfigEtcd(configFile string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	resp, err := globalEtcdClient.Get(ctx, configFile)
+	defer cancel()
+	if err != nil {
+		return err
+	}
+	if resp.Count == 0 {
+		return errConfigNotFound
+	}
+	return nil
+}
+
+func checkServerConfig(ctx context.Context, objAPI ObjectLayer) error {
+	configFile := path.Join(minioConfigPrefix, minioConfigFile)
+	if globalEtcdClient != nil {
+		return checkServerConfigEtcd(configFile)
+	}
+
+	if _, err := objAPI.GetObjectInfo(ctx, minioMetaBucket, configFile); err != nil {
+		if isErrObjectNotFound(err) {
+			return errConfigNotFound
+		}
+		logger.GetReqInfo(ctx).AppendTags("configFile", configFile)
+		logger.LogIf(ctx, err)
+		return err
+	}
+	return nil
+}
+
+func saveConfig(objAPI ObjectLayer, configFile string, data []byte) error {
+	hashReader, err := hash.NewReader(bytes.NewReader(data), int64(len(data)), "", getSHA256Hash(data))
+	if err != nil {
+		return err
+	}
+
+	_, err = objAPI.PutObject(context.Background(), minioMetaBucket, configFile, hashReader, nil)
+	return err
+}
+
+var errConfigNotFound = errors.New("config file not found")
+
+func readConfig(ctx context.Context, objAPI ObjectLayer, configFile string) (*bytes.Buffer, error) {
+	var buffer bytes.Buffer
+	// Read entire content by setting size to -1
+	if err := objAPI.GetObject(ctx, minioMetaBucket, configFile, 0, -1, &buffer, ""); err != nil {
+		// Ignore if err is ObjectNotFound or IncompleteBody when bucket is not configured with notification
+		if isErrObjectNotFound(err) || isErrIncompleteBody(err) || isInsufficientReadQuorum(err) {
+			return nil, errConfigNotFound
+		}
+
+		logger.GetReqInfo(ctx).AppendTags("configFile", configFile)
+		logger.LogIf(ctx, err)
+		return nil, err
+	}
+
+	// Return config not found on empty content.
+	if buffer.Len() == 0 {
+		return nil, errConfigNotFound
+	}
+
+	return &buffer, nil
+}
+
+// ConfigSys - config system.
+type ConfigSys struct{}
+
+// Load - load config.json.
+func (sys *ConfigSys) Load(objAPI ObjectLayer) error {
+	return sys.Init(objAPI)
+}
+
+// Init - initializes config system from config.json.
+func (sys *ConfigSys) Init(objAPI ObjectLayer) error {
+	if objAPI == nil {
+		return errInvalidArgument
+	}
+	return initConfig(objAPI)
+}
+
+// NewConfigSys - creates new config system object.
+func NewConfigSys() *ConfigSys {
+	return &ConfigSys{}
+}
+
+// Migrates ${HOME}/.minio/config.json to '<export_path>/.minio.sys/config/config.json'
+func migrateConfigToMinioSys() error {
+	// Verify if backend already has the file.
+	if err := checkServerConfig(context.Background(), newObjectLayerFn()); err != errConfigNotFound {
+		return err
+	} // if errConfigNotFound proceed to migrate..
+
+	var config = &serverConfig{}
+	if _, err := Load(getConfigFile(), config); err != nil {
+		return err
+	}
+
+	return saveServerConfig(newObjectLayerFn(), config)
+}
+
+// Initialize and load config from remote etcd or local config directory
+func initConfig(objAPI ObjectLayer) error {
+	if objAPI == nil {
+		return errServerNotInitialized
+	}
+
+	if globalEtcdClient != nil {
+		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+		resp, err := globalEtcdClient.Get(ctx, getConfigFile())
+		cancel()
+		if err == nil && resp.Count > 0 {
+			return migrateConfig()
+		}
+	} else {
+		if isFile(getConfigFile()) {
+			if err := migrateConfig(); err != nil {
+				return err
+			}
+
+			// Migrates ${HOME}/.minio/config.json to '<export_path>/.minio.sys/config/config.json'
+			if err := migrateConfigToMinioSys(); err != nil {
+				return err
+			}
+		}
+	}
+
+	if err := checkServerConfig(context.Background(), objAPI); err != nil {
+		if err == errConfigNotFound {
+			// Config file does not exist, we create it fresh and return upon success.
+			if err = newConfig(objAPI); err != nil {
+				return err
+			}
+		} else {
+			return err
+		}
+	}
+
+	if err := migrateMinioSysConfig(objAPI); err != nil {
+		return err
+	}
+
+	return loadConfig(objAPI)
+}

cmd/crypto/config.go

@@ -0,0 +1,20 @@
+// Minio Cloud Storage, (C) 2015, 2016, 2017, 2018 Minio, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package crypto
+
+// KMSConfig has the KMS config for hashicorp vault
+type KMSConfig struct {
+	Vault VaultConfig `json:"vault"`
+}

cmd/crypto/error.go

@@ -47,6 +47,9 @@ var (
 	// computed MD5 sum. This means that the client provided either the wrong key for
 	// a certain MD5 checksum or the wrong MD5 for a certain key.
 	ErrCustomerKeyMD5Mismatch = errors.New("The provided SSE-C key MD5 does not match the computed MD5 of the SSE-C key")
+	// ErrIncompatibleEncryptionMethod indicates that both SSE-C headers and SSE-S3 headers were specified, and are incompatible
+	// The client needs to remove the SSE-S3 header or the SSE-C headers
+	ErrIncompatibleEncryptionMethod = errors.New("Server side encryption specified with both SSE-C and SSE-S3 headers")
 )
 
 var (

cmd/crypto/header.go

@@ -19,11 +19,22 @@ import (
 	"crypto/md5"
 	"encoding/base64"
 	"net/http"
+	"strings"
 )
 
 // SSEHeader is the general AWS SSE HTTP header key.
 const SSEHeader = "X-Amz-Server-Side-Encryption"
 
+const (
+	// SSEKmsID is the HTTP header key referencing the SSE-KMS
+	// key ID.
+	SSEKmsID = SSEHeader + "-Aws-Kms-Key-Id"
+
+	// SSEKmsContext is the HTTP header key referencing the
+	// SSE-KMS encryption context.
+	SSEKmsContext = SSEHeader + "-Context"
+)
+
 const (
 	// SSECAlgorithm is the HTTP header key referencing
 	// the SSE-C algorithm.
@@ -52,10 +63,16 @@ const (
 	SSECopyKeyMD5 = "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-Md5"
 )
 
-// SSEAlgorithmAES256 is the only supported value for the SSE-S3 or SSE-C algorithm header.
-// For SSE-S3 see: https://docs.aws.amazon.com/AmazonS3/latest/dev/SSEUsingRESTAPI.html
-// For SSE-C  see: https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html
-const SSEAlgorithmAES256 = "AES256"
+const (
+	// SSEAlgorithmAES256 is the only supported value for the SSE-S3 or SSE-C algorithm header.
+	// For SSE-S3 see: https://docs.aws.amazon.com/AmazonS3/latest/dev/SSEUsingRESTAPI.html
+	// For SSE-C  see: https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html
+	SSEAlgorithmAES256 = "AES256"
+
+	// SSEAlgorithmKMS is the value of 'X-Amz-Server-Side-Encryption' for SSE-KMS.
+	// See: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html
+	SSEAlgorithmKMS = "aws:kms"
+)
 
 // S3 represents AWS SSE-S3. It provides functionality to handle
 // SSE-S3 requests.
@@ -67,7 +84,7 @@ type s3 struct{}
 // the S3 client requests SSE-S3.
 func (s3) IsRequested(h http.Header) bool {
 	_, ok := h[SSEHeader]
-	return ok
+	return ok && strings.ToLower(h.Get(SSEHeader)) != SSEAlgorithmKMS // Return only true if the SSE header is specified and does not contain the SSE-KMS value
 }
 
 // ParseHTTP parses the SSE-S3 related HTTP headers and checks
@@ -79,6 +96,27 @@ func (s3) ParseHTTP(h http.Header) (err error) {
 	return
 }
 
+// S3KMS represents AWS SSE-KMS. It provides functionality to
+// handle SSE-KMS requests.
+var S3KMS = s3KMS{}
+
+type s3KMS struct{}
+
+// IsRequested returns true if the HTTP headers indicates that
+// the S3 client requests SSE-KMS.
+func (s3KMS) IsRequested(h http.Header) bool {
+	if _, ok := h[SSEKmsID]; ok {
+		return true
+	}
+	if _, ok := h[SSEKmsContext]; ok {
+		return true
+	}
+	if _, ok := h[SSEHeader]; ok {
+		return strings.ToUpper(h.Get(SSEHeader)) != SSEAlgorithmAES256 // Return only true if the SSE header is specified and does not contain the SSE-S3 value
+	}
+	return false
+}
+
 var (
 	// SSEC represents AWS SSE-C. It provides functionality to handle
 	// SSE-C requests.

cmd/crypto/header_test.go

@@ -19,14 +19,49 @@ import (
 	"testing"
 )
 
+var kmsIsRequestedTests = []struct {
+	Header   http.Header
+	Expected bool
+}{
+	{Header: http.Header{}, Expected: false},                                                                                     // 0
+	{Header: http.Header{"X-Amz-Server-Side-Encryption": []string{"aws:kms"}}, Expected: true},                                   // 1
+	{Header: http.Header{"X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id": []string{"0839-9047947-844842874-481"}}, Expected: true}, // 2
+	{Header: http.Header{"X-Amz-Server-Side-Encryption-Context": []string{"7PpPLAK26ONlVUGOWlusfg=="}}, Expected: true},          // 3
+	{
+		Header: http.Header{
+			"X-Amz-Server-Side-Encryption":                []string{""},
+			"X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id": []string{""},
+			"X-Amz-Server-Side-Encryption-Context":        []string{""},
+		},
+		Expected: true,
+	}, // 4
+	{
+		Header: http.Header{
+			"X-Amz-Server-Side-Encryption":                []string{"AES256"},
+			"X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id": []string{""},
+		},
+		Expected: true,
+	}, // 5
+	{Header: http.Header{"X-Amz-Server-Side-Encryption": []string{"AES256"}}, Expected: false}, // 6
+}
+
+func TestKMSIsRequested(t *testing.T) {
+	for i, test := range kmsIsRequestedTests {
+		if got := S3KMS.IsRequested(test.Header); got != test.Expected {
+			t.Errorf("Test %d: Wanted %v but got %v", i, test.Expected, got)
+		}
+	}
+}
+
 var s3IsRequestedTests = []struct {
 	Header   http.Header
 	Expected bool
 }{
-	{Header: http.Header{"X-Amz-Server-Side-Encryption": []string{"AES256"}}, Expected: true},  // 0
-	{Header: http.Header{"X-Amz-Server-Side-Encryption": []string{"AES-256"}}, Expected: true}, // 1
-	{Header: http.Header{"X-Amz-Server-Side-Encryption": []string{""}}, Expected: true},        // 2
-	{Header: http.Header{"X-Amz-Server-Side-Encryptio": []string{"AES256"}}, Expected: false},  // 3
+	{Header: http.Header{"X-Amz-Server-Side-Encryption": []string{"AES256"}}, Expected: true},         // 0
+	{Header: http.Header{"X-Amz-Server-Side-Encryption": []string{"AES-256"}}, Expected: true},        // 1
+	{Header: http.Header{"X-Amz-Server-Side-Encryption": []string{""}}, Expected: true},               // 2
+	{Header: http.Header{"X-Amz-Server-Side-Encryptio": []string{"AES256"}}, Expected: false},         // 3
+	{Header: http.Header{"X-Amz-Server-Side-Encryption": []string{SSEAlgorithmKMS}}, Expected: false}, // 4
 }
 
 func TestS3IsRequested(t *testing.T) {

cmd/crypto/key.go

@@ -87,7 +87,6 @@ func (key ObjectKey) Seal(extKey, iv [32]byte, domain, bucket, object string) Se
 	mac.Write([]byte(SealAlgorithm))
 	mac.Write([]byte(path.Join(bucket, object))) // use path.Join for canonical 'bucket/object'
 	mac.Sum(sealingKey[:0])
-
 	if n, err := sio.Encrypt(&encryptedKey, bytes.NewReader(key[:]), sio.Config{Key: sealingKey[:]}); n != 64 || err != nil {
 		logger.CriticalIf(context.Background(), errors.New("Unable to generate sealed key"))
 	}

cmd/crypto/vault.go

@@ -0,0 +1,256 @@
+// Minio Cloud Storage, (C) 2015, 2016, 2017, 2018 Minio, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package crypto
+
+import (
+	"bytes"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	vault "github.com/hashicorp/vault/api"
+)
+
+const (
+	// VaultEndpointEnv Vault endpoint environment variable
+	VaultEndpointEnv = "MINIO_SSE_VAULT_ENDPOINT"
+	// vaultAuthTypeEnv type of vault auth to be used
+	vaultAuthTypeEnv = "MINIO_SSE_VAULT_AUTH_TYPE"
+	// vaultAppRoleIDEnv  Vault AppRole ID environment variable
+	vaultAppRoleIDEnv = "MINIO_SSE_VAULT_APPROLE_ID"
+	// vaultAppSecretIDEnv Vault AppRole Secret environment variable
+	vaultAppSecretIDEnv = "MINIO_SSE_VAULT_APPROLE_SECRET"
+	// vaultKeyVersionEnv Vault Key Version environment variable
+	vaultKeyVersionEnv = "MINIO_SSE_VAULT_KEY_VERSION"
+	// vaultKeyNameEnv Vault Encryption Key Name environment variable
+	vaultKeyNameEnv = "MINIO_SSE_VAULT_KEY_NAME"
+)
+
+var (
+	//ErrKMSAuthLogin is raised when there is a failure authenticating to KMS
+	ErrKMSAuthLogin = errors.New("Vault service did not return auth info")
+)
+
+type vaultService struct {
+	config        *VaultConfig
+	client        *vault.Client
+	leaseDuration time.Duration
+}
+
+// return transit secret engine's path for generate data key operation
+func (v *vaultService) genDataKeyEndpoint(key string) string {
+	return "/transit/datakey/plaintext/" + key
+}
+
+// return transit secret engine's path for decrypt operation
+func (v *vaultService) decryptEndpoint(key string) string {
+	return "/transit/decrypt/" + key
+}
+
+// VaultKey represents vault encryption key-id name & version
+type VaultKey struct {
+	Name    string `json:"name"`
+	Version int    `json:"version"`
+}
+
+// VaultAuth represents vault auth type to use. For now, AppRole is the only supported
+// auth type.
+type VaultAuth struct {
+	Type    string       `json:"type"`
+	AppRole VaultAppRole `json:"approle"`
+}
+
+// VaultAppRole represents vault approle credentials
+type VaultAppRole struct {
+	ID     string `json:"id"`
+	Secret string `json:"secret"`
+}
+
+// VaultConfig holds config required to start vault service
+type VaultConfig struct {
+	Endpoint string    `json:"endpoint"`
+	Auth     VaultAuth `json:"auth"`
+	Key      VaultKey  `json:"key-id"`
+}
+
+// validate whether all required env variables needed to start vault service have
+// been set
+func validateVaultConfig(c *VaultConfig) error {
+	if c.Endpoint == "" {
+		return fmt.Errorf("Missing hashicorp vault endpoint - %s is empty", VaultEndpointEnv)
+	}
+	if strings.ToLower(c.Auth.Type) != "approle" {
+		return fmt.Errorf("Unsupported hashicorp vault auth type - %s", vaultAuthTypeEnv)
+	}
+	if c.Auth.AppRole.ID == "" {
+		return fmt.Errorf("Missing hashicorp vault AppRole ID - %s is empty", vaultAppRoleIDEnv)
+	}
+	if c.Auth.AppRole.Secret == "" {
+		return fmt.Errorf("Missing hashicorp vault AppSecret ID - %s is empty", vaultAppSecretIDEnv)
+	}
+	if c.Key.Name == "" {
+		return fmt.Errorf("Invalid value set in environment variable %s", vaultKeyNameEnv)
+	}
+	if c.Key.Version < 0 {
+		return fmt.Errorf("Invalid value set in environment variable %s", vaultKeyVersionEnv)
+	}
+
+	return nil
+}
+
+// authenticate to vault with app role id and app role secret, and get a client access token, lease duration
+func getVaultAccessToken(client *vault.Client, appRoleID, appSecret string) (token string, duration int, err error) {
+	data := map[string]interface{}{
+		"role_id":   appRoleID,
+		"secret_id": appSecret,
+	}
+	resp, e := client.Logical().Write("auth/approle/login", data)
+	if e != nil {
+		return token, duration, e
+	}
+	if resp.Auth == nil {
+		return token, duration, ErrKMSAuthLogin
+	}
+	return resp.Auth.ClientToken, resp.Auth.LeaseDuration, nil
+}
+
+// NewVaultConfig sets KMSConfig from environment
+// variables and performs validations.
+func NewVaultConfig() (KMSConfig, error) {
+	kc := KMSConfig{}
+	endpoint := os.Getenv(VaultEndpointEnv)
+	roleID := os.Getenv(vaultAppRoleIDEnv)
+	roleSecret := os.Getenv(vaultAppSecretIDEnv)
+	keyName := os.Getenv(vaultKeyNameEnv)
+	keyVersion := 0
+	authType := "approle"
+	if versionStr := os.Getenv(vaultKeyVersionEnv); versionStr != "" {
+		version, err := strconv.Atoi(versionStr)
+		if err != nil {
+			return kc, fmt.Errorf("Unable to parse %s value (`%s`)", vaultKeyVersionEnv, versionStr)
+		}
+		keyVersion = version
+	}
+	// return if none of the vault env variables are configured
+	if (endpoint == "") && (roleID == "") && (roleSecret == "") && (keyName == "") && (keyVersion == 0) {
+		return kc, nil
+	}
+	c := VaultConfig{
+		Endpoint: endpoint,
+		Auth: VaultAuth{
+			Type: authType,
+			AppRole: VaultAppRole{
+				ID:     roleID,
+				Secret: roleSecret,
+			},
+		},
+		Key: VaultKey{
+			Version: keyVersion,
+			Name:    keyName,
+		},
+	}
+	if err := validateVaultConfig(&c); err != nil {
+		return kc, err
+	}
+	kc.Vault = c
+	return kc, nil
+}
+
+// NewVault initializes Hashicorp Vault KMS by
+// authenticating to Vault with the credentials in KMSConfig,
+// and gets a client token for future api calls.
+func NewVault(kmsConf KMSConfig) (KMS, error) {
+	config := kmsConf.Vault
+	c, err := vault.NewClient(&vault.Config{
+		Address: config.Endpoint,
+	})
+	if err != nil {
+		return nil, err
+	}
+	accessToken, leaseDuration, err := getVaultAccessToken(c, config.Auth.AppRole.ID, config.Auth.AppRole.Secret)
+	if err != nil {
+		return nil, err
+	}
+	// authenticate and get the access token
+	c.SetToken(accessToken)
+	v := vaultService{client: c, config: &config, leaseDuration: time.Duration(leaseDuration)}
+	v.renewToken(c)
+	return &v, nil
+}
+
+func (v *vaultService) renewToken(c *vault.Client) {
+	retryDelay := 1 * time.Minute
+	go func() {
+		for {
+			s, err := c.Auth().Token().RenewSelf(int(v.leaseDuration))
+			if err != nil {
+				time.Sleep(retryDelay)
+				continue
+			}
+			nextRenew := s.Auth.LeaseDuration / 2
+			time.Sleep(time.Duration(nextRenew) * time.Second)
+		}
+	}()
+}
+
+// Generates a random plain text key, sealed plain text key from
+// Vault. It returns the plaintext key and sealed plaintext key on success
+func (v *vaultService) GenerateKey(keyID string, ctx Context) (key [32]byte, sealedKey []byte, err error) {
+	contextStream := new(bytes.Buffer)
+	ctx.WriteTo(contextStream)
+
+	payload := map[string]interface{}{
+		"context": base64.StdEncoding.EncodeToString(contextStream.Bytes()),
+	}
+	s, err1 := v.client.Logical().Write(v.genDataKeyEndpoint(keyID), payload)
+
+	if err1 != nil {
+		return key, sealedKey, err1
+	}
+	sealKey := s.Data["ciphertext"].(string)
+	plainKey, err := base64.StdEncoding.DecodeString(s.Data["plaintext"].(string))
+	if err != nil {
+		return key, sealedKey, err1
+	}
+	copy(key[:], []byte(plainKey))
+	return key, []byte(sealKey), nil
+}
+
+// unsealKMSKey unseals the sealedKey using the Vault master key
+// referenced by the keyID. The plain text key is returned on success.
+func (v *vaultService) UnsealKey(keyID string, sealedKey []byte, ctx Context) (key [32]byte, err error) {
+	contextStream := new(bytes.Buffer)
+	ctx.WriteTo(contextStream)
+	payload := map[string]interface{}{
+		"ciphertext": string(sealedKey),
+		"context":    base64.StdEncoding.EncodeToString(contextStream.Bytes()),
+	}
+	s, err1 := v.client.Logical().Write(v.decryptEndpoint(keyID), payload)
+	if err1 != nil {
+		return key, err1
+	}
+	base64Key := s.Data["plaintext"].(string)
+	plainKey, err1 := base64.StdEncoding.DecodeString(base64Key)
+	if err1 != nil {
+		return key, err1
+	}
+	copy(key[:], []byte(plainKey))
+
+	return key, nil
+}

cmd/disk-cache_test.go

@@ -19,7 +19,6 @@ package cmd
 import (
 	"bytes"
 	"context"
-	"os"
 	"reflect"
 	"testing"
 	"time"
@@ -28,21 +27,15 @@ import (
 )
 
 // Initialize cache FS objects.
-func initCacheFSObjects(disk string, cacheMaxUse int, t *testing.T) (*cacheFSObjects, error) {
-	newTestConfig(globalMinioDefaultRegion)
-	var err error
-	obj, err := newCacheFSObjects(disk, globalCacheExpiry, cacheMaxUse)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return obj, nil
+func initCacheFSObjects(disk string, cacheMaxUse int) (*cacheFSObjects, error) {
+	return newCacheFSObjects(disk, globalCacheExpiry, cacheMaxUse)
 }
 
 // inits diskCache struct for nDisks
 func initDiskCaches(drives []string, cacheMaxUse int, t *testing.T) (*diskCache, error) {
 	var cfs []*cacheFSObjects
 	for _, d := range drives {
-		obj, err := initCacheFSObjects(d, cacheMaxUse, t)
+		obj, err := initCacheFSObjects(d, cacheMaxUse)
 		if err != nil {
 			return nil, err
 		}
@@ -131,11 +124,6 @@ func TestGetCacheFSMaxUse(t *testing.T) {
 
 // test wildcard patterns for excluding entries from cache
 func TestCacheExclusion(t *testing.T) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(rootPath)
 	fsDirs, err := getRandomDisks(1)
 	if err != nil {
 		t.Fatal(err)

cmd/encryption-v1.go

@@ -17,13 +17,10 @@
 package cmd
 
 import (
-	"bytes"
 	"context"
 	"crypto/hmac"
-	"crypto/md5"
 	"crypto/rand"
 	"crypto/subtle"
-	"encoding/base64"
 	"encoding/binary"
 	"errors"
 	"io"
@@ -31,6 +28,7 @@ import (
 	"path"
 	"strconv"
 
+	"github.com/minio/minio/cmd/crypto"
 	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/ioutil"
 	sha256 "github.com/minio/sha256-simd"
@@ -41,34 +39,12 @@ var (
 	// AWS errors for invalid SSE-C requests.
 	errInsecureSSERequest   = errors.New("SSE-C requests require TLS connections")
 	errEncryptedObject      = errors.New("The object was stored using a form of SSE")
-	errInvalidSSEAlgorithm  = errors.New("The SSE-C algorithm is not valid")
-	errMissingSSEKey        = errors.New("The SSE-C request is missing the customer key")
-	errInvalidSSEKey        = errors.New("The SSE-C key is invalid")
-	errMissingSSEKeyMD5     = errors.New("The SSE-C request is missing the customer key MD5")
-	errSSEKeyMD5Mismatch    = errors.New("The key MD5 does not match the SSE-C key")
-	errSSEKeyMismatch       = errors.New("The SSE-C key is not correct")                  // access denied
 	errInvalidSSEParameters = errors.New("The SSE-C key for key-rotation is not correct") // special access denied
-
+	errKMSNotConfigured     = errors.New("KMS not configured for a server side encrypted object")
 	// Additional Minio errors for SSE-C requests.
 	errObjectTampered = errors.New("The requested object was modified and may be compromised")
 )
 
-const (
-	// SSECustomerAlgorithm is the AWS SSE-C algorithm HTTP header key.
-	SSECustomerAlgorithm = "X-Amz-Server-Side-Encryption-Customer-Algorithm"
-	// SSECustomerKey is the AWS SSE-C encryption key HTTP header key.
-	SSECustomerKey = "X-Amz-Server-Side-Encryption-Customer-Key"
-	// SSECustomerKeyMD5 is the AWS SSE-C encryption key MD5 HTTP header key.
-	SSECustomerKeyMD5 = "X-Amz-Server-Side-Encryption-Customer-Key-MD5"
-
-	// SSECopyCustomerAlgorithm is the AWS SSE-C algorithm HTTP header key for CopyObject API.
-	SSECopyCustomerAlgorithm = "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Algorithm"
-	// SSECopyCustomerKey is the AWS SSE-C encryption key HTTP header key for CopyObject API.
-	SSECopyCustomerKey = "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key"
-	// SSECopyCustomerKeyMD5 is the AWS SSE-C encryption key MD5 HTTP header key for CopyObject API.
-	SSECopyCustomerKeyMD5 = "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-MD5"
-)
-
 const (
 	// SSECustomerKeySize is the size of valid client provided encryption keys in bytes.
 	// Currently AWS supports only AES256. So the SSE-C key size is fixed to 32 bytes.
@@ -77,9 +53,6 @@ const (
 	// SSEIVSize is the size of the IV data
 	SSEIVSize = 32 // 32 bytes
 
-	// SSECustomerAlgorithmAES256 the only valid S3 SSE-C encryption algorithm identifier.
-	SSECustomerAlgorithmAES256 = "AES256"
-
 	// SSE dare package block size.
 	sseDAREPackageBlockSize = 64 * 1024 // 64KiB bytes
 
@@ -88,63 +61,6 @@ const (
 
 )
 
-// SSE-C key derivation, key verification and key update:
-// H: Hash function [32 = |H(m)|]
-// AE: authenticated encryption scheme, AD: authenticated decryption scheme [m = AD(k, AE(k, m))]
-//
-// Key derivation:
-// 	 Input:
-// 		key     := 32 bytes              # client provided key
-// 		Re, Rm  := 32 bytes, 32 bytes    # uniformly random
-//
-//   Seal:
-// 		k       := H(key || Re)          # object encryption key
-// 		r       := H(Rm)                 # save as object metadata [ServerSideEncryptionIV]
-//		KeK     := H(key || r)           # key encryption key
-// 		K       := AE(KeK, k)            # save as object metadata [ServerSideEncryptionSealedKey]
-// ------------------------------------------------------------------------------------------------
-// Key verification:
-// 	 Input:
-// 		key     := 32 bytes              # client provided key
-// 		r       := 32 bytes              # object metadata [ServerSideEncryptionIV]
-// 		K       := 32 bytes              # object metadata [ServerSideEncryptionSealedKey]
-//
-//   Open:
-//		KeK     := H(key || r)           # key encryption key
-//		k       := AD(Kek, K)            # object encryption key
-// -------------------------------------------------------------------------------------------------
-// Key update:
-// 	 Input:
-// 		key     := 32 bytes              # old client provided key
-// 		key'    := 32 bytes              # new client provided key
-// 		Rm      := 32 bytes              # uniformly random
-// 		r       := 32 bytes              # object metadata [ServerSideEncryptionIV]
-// 		K       := 32 bytes              # object metadata [ServerSideEncryptionSealedKey]
-//
-//   Update:
-//      1. open:
-//			KeK     := H(key || r)       # key encryption key
-//			k       := AD(Kek, K)        # object encryption key
-//      2. seal:
-//			r'      := H(Rm)			 # save as object metadata [ServerSideEncryptionIV]
-//			KeK'    := H(key' || r')	 # new key encryption key
-// 			K'      := AE(KeK', k)       # save as object metadata [ServerSideEncryptionSealedKey]
-
-const (
-	// ServerSideEncryptionIV is a 32 byte randomly generated IV used to derive an
-	// unique key encryption key from the client provided key. The combination of this value
-	// and the client-provided key MUST be unique.
-	ServerSideEncryptionIV = ReservedMetadataPrefix + "Server-Side-Encryption-Iv"
-
-	// ServerSideEncryptionSealAlgorithm identifies a combination of a cryptographic hash function and
-	// an authenticated en/decryption scheme to seal the object encryption key.
-	ServerSideEncryptionSealAlgorithm = ReservedMetadataPrefix + "Server-Side-Encryption-Seal-Algorithm"
-
-	// ServerSideEncryptionSealedKey is the sealed object encryption key. The sealed key can be decrypted
-	// by the key encryption key derived from the client provided key and the server-side-encryption IV.
-	ServerSideEncryptionSealedKey = ReservedMetadataPrefix + "Server-Side-Encryption-Sealed-Key"
-)
-
 const (
 	// SSESealAlgorithmDareSha256 specifies DARE as authenticated en/decryption scheme and SHA256 as cryptographic
 	// hash function. The key derivation of DARE-SHA256 is not optimal and does not include the object path.
@@ -154,27 +70,17 @@ const (
 	// SSESealAlgorithmDareV2HmacSha256 specifies DAREv2 as authenticated en/decryption scheme and SHA256 as cryptographic
 	// hash function for the HMAC PRF.
 	SSESealAlgorithmDareV2HmacSha256 = "DAREv2-HMAC-SHA256"
-
-	// SSEDomain specifies the domain for the derived key - in this case the
-	// key should be used for SSE-C.
-	SSEDomain = "SSE-C"
 )
 
-// hasSSECustomerHeader returns true if the given HTTP header
-// contains server-side-encryption with customer provided key fields.
-func hasSSECustomerHeader(header http.Header) bool {
-	return header.Get(SSECustomerAlgorithm) != "" || header.Get(SSECustomerKey) != "" || header.Get(SSECustomerKeyMD5) != ""
-}
-
-// hasSSECopyCustomerHeader returns true if the given HTTP header
-// contains copy source server-side-encryption with customer provided key fields.
-func hasSSECopyCustomerHeader(header http.Header) bool {
-	return header.Get(SSECopyCustomerAlgorithm) != "" || header.Get(SSECopyCustomerKey) != "" || header.Get(SSECopyCustomerKeyMD5) != ""
+// hasServerSideEncryptionHeader returns true if the given HTTP header
+// contains server-side-encryption.
+func hasServerSideEncryptionHeader(header http.Header) bool {
+	return crypto.S3.IsRequested(header) || crypto.SSEC.IsRequested(header)
 }
 
 // ParseSSECopyCustomerRequest parses the SSE-C header fields of the provided request.
 // It returns the client provided key on success.
-func ParseSSECopyCustomerRequest(r *http.Request) (key []byte, err error) {
+func ParseSSECopyCustomerRequest(r *http.Request, metadata map[string]string) (key []byte, err error) {
 	if !globalIsSSL { // minio only supports HTTP or HTTPS requests not both at the same time
 		// we cannot use r.TLS == nil here because Go's http implementation reflects on
 		// the net.Conn and sets the TLS field of http.Request only if it's an tls.Conn.
@@ -182,36 +88,11 @@ func ParseSSECopyCustomerRequest(r *http.Request) (key []byte, err error) {
 		// will always fail -> r.TLS is always nil even for TLS requests.
 		return nil, errInsecureSSERequest
 	}
-	header := r.Header
-	if algorithm := header.Get(SSECopyCustomerAlgorithm); algorithm != SSECustomerAlgorithmAES256 {
-		return nil, errInvalidSSEAlgorithm
+	if crypto.S3.IsEncrypted(metadata) && crypto.SSECopy.IsRequested(r.Header) {
+		return nil, crypto.ErrIncompatibleEncryptionMethod
 	}
-	if header.Get(SSECopyCustomerKey) == "" {
-		return nil, errMissingSSEKey
-	}
-	if header.Get(SSECopyCustomerKeyMD5) == "" {
-		return nil, errMissingSSEKeyMD5
-	}
-
-	key, err = base64.StdEncoding.DecodeString(header.Get(SSECopyCustomerKey))
-	if err != nil {
-		return nil, errInvalidSSEKey
-	}
-
-	if len(key) != SSECustomerKeySize {
-		return nil, errInvalidSSEKey
-	}
-	// Make sure we purged the keys from http headers by now.
-	header.Del(SSECopyCustomerKey)
-
-	keyMD5, err := base64.StdEncoding.DecodeString(header.Get(SSECopyCustomerKeyMD5))
-	if err != nil {
-		return nil, errSSEKeyMD5Mismatch
-	}
-	if md5Sum := md5.Sum(key); !bytes.Equal(md5Sum[:], keyMD5) {
-		return nil, errSSEKeyMD5Mismatch
-	}
-	return key, nil
+	k, err := crypto.SSECopy.ParseHTTP(r.Header)
+	return k[:], err
 }
 
 // ParseSSECustomerRequest parses the SSE-C header fields of the provided request.
@@ -230,228 +111,176 @@ func ParseSSECustomerHeader(header http.Header) (key []byte, err error) {
 		// will always fail -> r.TLS is always nil even for TLS requests.
 		return nil, errInsecureSSERequest
 	}
-	if algorithm := header.Get(SSECustomerAlgorithm); algorithm != SSECustomerAlgorithmAES256 {
-		return nil, errInvalidSSEAlgorithm
-	}
-	if header.Get(SSECustomerKey) == "" {
-		return nil, errMissingSSEKey
-	}
-	if header.Get(SSECustomerKeyMD5) == "" {
-		return nil, errMissingSSEKeyMD5
+	if crypto.S3.IsRequested(header) && crypto.SSEC.IsRequested(header) {
+		return key, crypto.ErrIncompatibleEncryptionMethod
 	}
 
-	key, err = base64.StdEncoding.DecodeString(header.Get(SSECustomerKey))
-	if err != nil {
-		return nil, errInvalidSSEKey
-	}
-
-	if len(key) != SSECustomerKeySize {
-		return nil, errInvalidSSEKey
-	}
-	// Make sure we purged the keys from http headers by now.
-	header.Del(SSECustomerKey)
-
-	keyMD5, err := base64.StdEncoding.DecodeString(header.Get(SSECustomerKeyMD5))
-	if err != nil {
-		return nil, errSSEKeyMD5Mismatch
-	}
-	if md5Sum := md5.Sum(key); !bytes.Equal(md5Sum[:], keyMD5) {
-		return nil, errSSEKeyMD5Mismatch
-	}
-	return key, nil
+	k, err := crypto.SSEC.ParseHTTP(header)
+	return k[:], err
 }
 
 // This function rotates old to new key.
 func rotateKey(oldKey []byte, newKey []byte, bucket, object string, metadata map[string]string) error {
-	delete(metadata, SSECustomerKey) // make sure we do not save the key by accident
+	delete(metadata, crypto.SSECKey) // make sure we do not save the key by accident
 
-	algorithm := metadata[ServerSideEncryptionSealAlgorithm]
-	if algorithm != SSESealAlgorithmDareSha256 && algorithm != SSESealAlgorithmDareV2HmacSha256 {
-		return errObjectTampered
-	}
-	iv, err := base64.StdEncoding.DecodeString(metadata[ServerSideEncryptionIV])
-	if err != nil || len(iv) != SSEIVSize {
-		return errObjectTampered
-	}
-	sealedKey, err := base64.StdEncoding.DecodeString(metadata[ServerSideEncryptionSealedKey])
-	if err != nil || len(sealedKey) != 64 {
-		return errObjectTampered
-	}
-
-	var (
-		minDAREVersion   byte
-		keyEncryptionKey [32]byte
-	)
-	switch algorithm {
+	switch {
 	default:
 		return errObjectTampered
-	case SSESealAlgorithmDareSha256: // legacy key-encryption-key derivation
-		minDAREVersion = sio.Version10
-		sha := sha256.New()
-		sha.Write(oldKey)
-		sha.Write(iv)
-		sha.Sum(keyEncryptionKey[:0])
-	case SSESealAlgorithmDareV2HmacSha256: // key-encryption-key derivation - See: crypto/doc.go
-		minDAREVersion = sio.Version20
-		mac := hmac.New(sha256.New, oldKey)
-		mac.Write(iv)
-		mac.Write([]byte(SSEDomain))
-		mac.Write([]byte(SSESealAlgorithmDareV2HmacSha256))
-		mac.Write([]byte(path.Join(bucket, object)))
-		mac.Sum(keyEncryptionKey[:0])
-	}
-
-	objectEncryptionKey := bytes.NewBuffer(nil) // decrypt object encryption key
-	n, err := sio.Decrypt(objectEncryptionKey, bytes.NewReader(sealedKey), sio.Config{
-		MinVersion: minDAREVersion,
-		Key:        keyEncryptionKey[:],
-	})
-	if n != 32 || err != nil { // Either the provided key does not match or the object was tampered.
-		if subtle.ConstantTimeCompare(oldKey, newKey) == 1 {
-			return errInvalidSSEParameters // AWS returns special error for equal but invalid keys.
+	case crypto.SSEC.IsEncrypted(metadata):
+		sealedKey, err := crypto.SSEC.ParseMetadata(metadata)
+		if err != nil {
+			return err
 		}
-		return errSSEKeyMismatch // To provide strict AWS S3 compatibility we return: access denied.
-	}
-	if subtle.ConstantTimeCompare(oldKey, newKey) == 1 && algorithm != SSESealAlgorithmDareSha256 {
-		return nil // we don't need to rotate keys if newKey == oldKey but we may have to upgrade KDF algorithm
-	}
 
-	mac := hmac.New(sha256.New, newKey) // key-encryption-key derivation - See: crypto/doc.go
-	mac.Write(iv)
-	mac.Write([]byte(SSEDomain))
-	mac.Write([]byte(SSESealAlgorithmDareV2HmacSha256))
-	mac.Write([]byte(path.Join(bucket, object)))
-	mac.Sum(keyEncryptionKey[:0])
+		var objectKey crypto.ObjectKey
+		var extKey [32]byte
+		copy(extKey[:], oldKey)
+		if err = objectKey.Unseal(extKey, sealedKey, crypto.SSEC.String(), bucket, object); err != nil {
+			if subtle.ConstantTimeCompare(oldKey, newKey) == 1 {
+				return errInvalidSSEParameters // AWS returns special error for equal but invalid keys.
+			}
+			return crypto.ErrInvalidCustomerKey // To provide strict AWS S3 compatibility we return: access denied.
 
-	sealedKeyW := bytes.NewBuffer(nil) // sealedKey := 16 byte header + 32 byte payload + 16 byte tag
-	n, err = sio.Encrypt(sealedKeyW, bytes.NewReader(objectEncryptionKey.Bytes()), sio.Config{
-		Key: keyEncryptionKey[:],
-	})
-	if n != 64 || err != nil {
-		return errors.New("failed to seal object encryption key") // if this happens there's a bug in the code (may panic ?)
+		}
+		if subtle.ConstantTimeCompare(oldKey, newKey) == 1 && sealedKey.Algorithm == crypto.SealAlgorithm {
+			return nil // don't rotate on equal keys if seal algorithm is latest
+		}
+		copy(extKey[:], newKey)
+		sealedKey = objectKey.Seal(extKey, sealedKey.IV, crypto.SSEC.String(), bucket, object)
+		return nil
 	}
-
-	metadata[ServerSideEncryptionIV] = base64.StdEncoding.EncodeToString(iv[:])
-	metadata[ServerSideEncryptionSealAlgorithm] = SSESealAlgorithmDareV2HmacSha256
-	metadata[ServerSideEncryptionSealedKey] = base64.StdEncoding.EncodeToString(sealedKeyW.Bytes())
-	return nil
 }
 
-func newEncryptMetadata(key []byte, bucket, object string, metadata map[string]string) ([]byte, error) {
-	delete(metadata, SSECustomerKey) // make sure we do not save the key by accident
-	// See crypto/doc.go for detailed description
-	nonce := make([]byte, 32+SSEIVSize) // generate random values for key derivation
-	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
-		return nil, err
+func newEncryptMetadata(key []byte, bucket, object string, metadata map[string]string, sseS3 bool) ([]byte, error) {
+	delete(metadata, crypto.SSECKey) // make sure we do not save the key by accident
+
+	var sealedKey crypto.SealedKey
+	if sseS3 {
+		if globalKMS == nil {
+			return nil, errKMSNotConfigured
+		}
+		key, encKey, err := globalKMS.GenerateKey(globalKMSKeyID, crypto.Context{bucket: path.Join(bucket, object)})
+		if err != nil {
+			return nil, err
+		}
+
+		objectKey := crypto.GenerateKey(key, rand.Reader)
+		sealedKey = objectKey.Seal(key, crypto.GenerateIV(rand.Reader), crypto.S3.String(), bucket, object)
+		crypto.S3.CreateMetadata(metadata, globalKMSKeyID, encKey, sealedKey)
+		return objectKey[:], nil
 	}
-	sha := sha256.New() // derive object encryption key
-	sha.Write(key)
-	sha.Write(nonce[:32])
-	objectEncryptionKey := sha.Sum(nil)
+	var extKey [32]byte
+	copy(extKey[:], key)
+	objectKey := crypto.GenerateKey(extKey, rand.Reader)
+	sealedKey = objectKey.Seal(extKey, crypto.GenerateIV(rand.Reader), crypto.SSEC.String(), bucket, object)
+	crypto.SSEC.CreateMetadata(metadata, sealedKey)
+	return objectKey[:], nil
 
-	iv := sha256.Sum256(nonce[32:]) // key-encryption-key derivation - See: crypto/doc.go
-	mac := hmac.New(sha256.New, key)
-	mac.Write(iv[:])
-	mac.Write([]byte(SSEDomain))
-	mac.Write([]byte(SSESealAlgorithmDareV2HmacSha256))
-	mac.Write([]byte(path.Join(bucket, object)))
-	keyEncryptionKey := mac.Sum(nil)
-
-	sealedKey := bytes.NewBuffer(nil) // sealedKey := 16 byte header + 32 byte payload + 16 byte tag
-	n, err := sio.Encrypt(sealedKey, bytes.NewReader(objectEncryptionKey), sio.Config{
-		Key: keyEncryptionKey,
-	})
-	if n != 64 || err != nil {
-		return nil, errors.New("failed to seal object encryption key") // if this happens there's a bug in the code (may panic ?)
-	}
-
-	metadata[ServerSideEncryptionIV] = base64.StdEncoding.EncodeToString(iv[:])
-	metadata[ServerSideEncryptionSealAlgorithm] = SSESealAlgorithmDareV2HmacSha256
-	metadata[ServerSideEncryptionSealedKey] = base64.StdEncoding.EncodeToString(sealedKey.Bytes())
-
-	return objectEncryptionKey, nil
 }
 
-func newEncryptReader(content io.Reader, key []byte, bucket, object string, metadata map[string]string) (io.Reader, error) {
-	objectEncryptionKey, err := newEncryptMetadata(key, bucket, object, metadata)
+func newEncryptReader(content io.Reader, key []byte, bucket, object string, metadata map[string]string, sseS3 bool) (io.Reader, error) {
+	objectEncryptionKey, err := newEncryptMetadata(key, bucket, object, metadata, sseS3)
 	if err != nil {
 		return nil, err
 	}
 
-	reader, err := sio.EncryptReader(content, sio.Config{Key: objectEncryptionKey})
+	reader, err := sio.EncryptReader(content, sio.Config{Key: objectEncryptionKey[:], MinVersion: sio.Version20})
 	if err != nil {
-		return nil, errInvalidSSEKey
+		return nil, crypto.ErrInvalidCustomerKey
 	}
 
 	return reader, nil
 }
 
+// set new encryption metadata from http request headers for SSE-C and generated key from KMS in the case of
+// SSE-S3
+func setEncryptionMetadata(r *http.Request, bucket, object string, metadata map[string]string) (err error) {
+	var (
+		key []byte
+	)
+	if crypto.SSEC.IsRequested(r.Header) {
+		key, err = ParseSSECustomerRequest(r)
+		if err != nil {
+			return
+		}
+	}
+	_, err = newEncryptMetadata(key, bucket, object, metadata, crypto.S3.IsRequested(r.Header))
+	return
+}
+
 // EncryptRequest takes the client provided content and encrypts the data
 // with the client provided key. It also marks the object as client-side-encrypted
 // and sets the correct headers.
 func EncryptRequest(content io.Reader, r *http.Request, bucket, object string, metadata map[string]string) (io.Reader, error) {
-	key, err := ParseSSECustomerRequest(r)
-	if err != nil {
-		return nil, err
+
+	var (
+		key []byte
+		err error
+	)
+	if crypto.S3.IsRequested(r.Header) && crypto.SSEC.IsRequested(r.Header) {
+		return nil, crypto.ErrIncompatibleEncryptionMethod
 	}
-	return newEncryptReader(content, key, bucket, object, metadata)
+	if crypto.SSEC.IsRequested(r.Header) {
+		key, err = ParseSSECustomerRequest(r)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return newEncryptReader(content, key, bucket, object, metadata, crypto.S3.IsRequested(r.Header))
 }
 
 // DecryptCopyRequest decrypts the object with the client provided key. It also removes
 // the client-side-encryption metadata from the object and sets the correct headers.
 func DecryptCopyRequest(client io.Writer, r *http.Request, bucket, object string, metadata map[string]string) (io.WriteCloser, error) {
-	key, err := ParseSSECopyCustomerRequest(r)
-	if err != nil {
-		return nil, err
+	var (
+		key []byte
+		err error
+	)
+	if crypto.SSECopy.IsRequested(r.Header) {
+		key, err = ParseSSECopyCustomerRequest(r, metadata)
+		if err != nil {
+			return nil, err
+		}
 	}
-	delete(metadata, SSECopyCustomerKey) // make sure we do not save the key by accident
+	delete(metadata, crypto.SSECopyKey) // make sure we do not save the key by accident
 	return newDecryptWriter(client, key, bucket, object, 0, metadata)
 }
 
 func decryptObjectInfo(key []byte, bucket, object string, metadata map[string]string) ([]byte, error) {
-	iv, err := base64.StdEncoding.DecodeString(metadata[ServerSideEncryptionIV])
-	if err != nil || len(iv) != SSEIVSize {
-		return nil, errObjectTampered
-	}
-	sealedKey, err := base64.StdEncoding.DecodeString(metadata[ServerSideEncryptionSealedKey])
-	if err != nil || len(sealedKey) != 64 {
-		return nil, errObjectTampered
-	}
-
-	var (
-		minDAREVersion   byte
-		keyEncryptionKey [32]byte
-	)
-	switch algorithm := metadata[ServerSideEncryptionSealAlgorithm]; algorithm {
+	switch {
 	default:
 		return nil, errObjectTampered
-	case SSESealAlgorithmDareSha256: // legacy key-encryption-key derivation
-		minDAREVersion = sio.Version10
-		sha := sha256.New()
-		sha.Write(key)
-		sha.Write(iv)
-		sha.Sum(keyEncryptionKey[:0])
-	case SSESealAlgorithmDareV2HmacSha256: // key-encryption-key derivation - See: crypto/doc.go
-		minDAREVersion = sio.Version20
-		mac := hmac.New(sha256.New, key)
-		mac.Write(iv)
-		mac.Write([]byte(SSEDomain))
-		mac.Write([]byte(SSESealAlgorithmDareV2HmacSha256))
-		mac.Write([]byte(path.Join(bucket, object)))
-		mac.Sum(keyEncryptionKey[:0])
-	}
+	case crypto.S3.IsEncrypted(metadata):
+		if globalKMS == nil {
+			return nil, errKMSNotConfigured
+		}
+		keyID, kmsKey, sealedKey, err := crypto.S3.ParseMetadata(metadata)
 
-	objectEncryptionKey := bytes.NewBuffer(nil) // decrypt object encryption key
-	n, err := sio.Decrypt(objectEncryptionKey, bytes.NewReader(sealedKey), sio.Config{
-		MinVersion: minDAREVersion,
-		Key:        keyEncryptionKey[:],
-	})
-	if n != 32 || err != nil {
-		// Either the provided key does not match or the object was tampered.
-		// To provide strict AWS S3 compatibility we return: access denied.
-		return nil, errSSEKeyMismatch
+		if err != nil {
+			return nil, err
+		}
+		extKey, err := globalKMS.UnsealKey(keyID, kmsKey, crypto.Context{bucket: path.Join(bucket, object)})
+		if err != nil {
+			return nil, err
+		}
+		var objectKey crypto.ObjectKey
+		if err = objectKey.Unseal(extKey, sealedKey, crypto.S3.String(), bucket, object); err != nil {
+			return nil, err
+		}
+		return objectKey[:], nil
+	case crypto.SSEC.IsEncrypted(metadata):
+		var extKey [32]byte
+		copy(extKey[:], key)
+		sealedKey, err := crypto.SSEC.ParseMetadata(metadata)
+		if err != nil {
+			return nil, err
+		}
+		var objectKey crypto.ObjectKey
+		if err = objectKey.Unseal(extKey, sealedKey, crypto.SSEC.String(), bucket, object); err != nil {
+			return nil, err
+		}
+		return objectKey[:], nil
 	}
-	return objectEncryptionKey.Bytes(), nil
 }
 
 func newDecryptWriter(client io.Writer, key []byte, bucket, object string, seqNumber uint32, metadata map[string]string) (io.WriteCloser, error) {
@@ -468,29 +297,35 @@ func newDecryptWriterWithObjectKey(client io.Writer, objectEncryptionKey []byte,
 		SequenceNumber: seqNumber,
 	})
 	if err != nil {
-		return nil, errInvalidSSEKey
+		return nil, crypto.ErrInvalidCustomerKey
 	}
-
-	delete(metadata, ServerSideEncryptionIV)
-	delete(metadata, ServerSideEncryptionSealAlgorithm)
-	delete(metadata, ServerSideEncryptionSealedKey)
-	delete(metadata, ReservedMetadataPrefix+"Encrypted-Multipart")
+	delete(metadata, crypto.SSEIV)
+	delete(metadata, crypto.SSESealAlgorithm)
+	delete(metadata, crypto.SSECSealedKey)
+	delete(metadata, crypto.SSEMultipart)
+	delete(metadata, crypto.S3SealedKey)
+	delete(metadata, crypto.S3KMSSealedKey)
+	delete(metadata, crypto.S3KMSKeyID)
 	return writer, nil
 }
 
 // DecryptRequestWithSequenceNumber decrypts the object with the client provided key. It also removes
 // the client-side-encryption metadata from the object and sets the correct headers.
 func DecryptRequestWithSequenceNumber(client io.Writer, r *http.Request, bucket, object string, seqNumber uint32, metadata map[string]string) (io.WriteCloser, error) {
+	if crypto.S3.IsEncrypted(metadata) {
+		return newDecryptWriter(client, nil, bucket, object, seqNumber, metadata)
+	}
+
 	key, err := ParseSSECustomerRequest(r)
 	if err != nil {
 		return nil, err
 	}
-	delete(metadata, SSECustomerKey) // make sure we do not save the key by accident
+	delete(metadata, crypto.SSECKey) // make sure we do not save the key by accident
 	return newDecryptWriter(client, key, bucket, object, seqNumber, metadata)
 }
 
-// DecryptRequest decrypts the object with the client provided key. It also removes
-// the client-side-encryption metadata from the object and sets the correct headers.
+// DecryptRequest decrypts the object with client provided key for SSE-C and SSE-S3. It also removes
+// the encryption metadata from the object and sets the correct headers.
 func DecryptRequest(client io.Writer, r *http.Request, bucket, object string, metadata map[string]string) (io.WriteCloser, error) {
 	return DecryptRequestWithSequenceNumber(client, r, bucket, object, 0, metadata)
 }
@@ -527,11 +362,15 @@ func (w *DecryptBlocksWriter) buildDecrypter(partID int) error {
 	var key []byte
 	var err error
 	if w.copySource {
-		w.req.Header.Set(SSECopyCustomerKey, w.customerKeyHeader)
-		key, err = ParseSSECopyCustomerRequest(w.req)
+		if crypto.SSEC.IsEncrypted(w.metadata) {
+			w.req.Header.Set(crypto.SSECopyKey, w.customerKeyHeader)
+			key, err = ParseSSECopyCustomerRequest(w.req, w.metadata)
+		}
 	} else {
-		w.req.Header.Set(SSECustomerKey, w.customerKeyHeader)
-		key, err = ParseSSECustomerRequest(w.req)
+		if crypto.SSEC.IsEncrypted(w.metadata) {
+			w.req.Header.Set(crypto.SSECKey, w.customerKeyHeader)
+			key, err = ParseSSECustomerRequest(w.req)
+		}
 	}
 	if err != nil {
 		return err
@@ -551,9 +390,9 @@ func (w *DecryptBlocksWriter) buildDecrypter(partID int) error {
 
 	// make sure we do not save the key by accident
 	if w.copySource {
-		delete(m, SSECopyCustomerKey)
+		delete(m, crypto.SSECopyKey)
 	} else {
-		delete(m, SSECustomerKey)
+		delete(m, crypto.SSECKey)
 	}
 
 	// make sure to provide a NopCloser such that a Close
@@ -643,7 +482,7 @@ func DecryptBlocksRequest(client io.Writer, r *http.Request, bucket, object stri
 	var seqNumber uint32
 	var encStartOffset, encLength int64
 
-	if len(objInfo.Parts) == 0 || !objInfo.IsEncryptedMultipart() {
+	if len(objInfo.Parts) == 0 || !crypto.IsMultiPart(objInfo.UserDefined) {
 		seqNumber, encStartOffset, encLength = getEncryptedSinglePartOffsetLength(startOffset, length, objInfo)
 
 		var writer io.WriteCloser
@@ -694,7 +533,7 @@ func DecryptBlocksRequest(client io.Writer, r *http.Request, bucket, object stri
 		req:               r,
 		bucket:            bucket,
 		object:            object,
-		customerKeyHeader: r.Header.Get(SSECustomerKey),
+		customerKeyHeader: r.Header.Get(crypto.SSECKey),
 		copySource:        copySource,
 	}
 
@@ -705,13 +544,18 @@ func DecryptBlocksRequest(client io.Writer, r *http.Request, bucket, object stri
 	}
 
 	// Purge all the encryption headers.
-	delete(objInfo.UserDefined, ServerSideEncryptionIV)
-	delete(objInfo.UserDefined, ServerSideEncryptionSealAlgorithm)
-	delete(objInfo.UserDefined, ServerSideEncryptionSealedKey)
-	delete(objInfo.UserDefined, ReservedMetadataPrefix+"Encrypted-Multipart")
+	delete(objInfo.UserDefined, crypto.SSEIV)
+	delete(objInfo.UserDefined, crypto.SSESealAlgorithm)
+	delete(objInfo.UserDefined, crypto.SSECSealedKey)
+	delete(objInfo.UserDefined, crypto.SSEMultipart)
 
+	if crypto.S3.IsEncrypted(objInfo.UserDefined) {
+		delete(objInfo.UserDefined, crypto.S3SealedKey)
+		delete(objInfo.UserDefined, crypto.S3KMSKeyID)
+		delete(objInfo.UserDefined, crypto.S3KMSSealedKey)
+	}
 	if w.copySource {
-		w.customerKeyHeader = r.Header.Get(SSECopyCustomerKey)
+		w.customerKeyHeader = r.Header.Get(crypto.SSECopyKey)
 	}
 
 	if err := w.buildDecrypter(w.parts[w.partIndex].Number); err != nil {
@@ -793,48 +637,14 @@ func getEncryptedSinglePartOffsetLength(offset, length int64, objInfo ObjectInfo
 	return seqNumber, encOffset, encLength
 }
 
-// IsEncryptedMultipart - is the encrypted content multiparted?
-func (o *ObjectInfo) IsEncryptedMultipart() bool {
-	_, ok := o.UserDefined[ReservedMetadataPrefix+"Encrypted-Multipart"]
-	return ok
-}
-
-// IsEncrypted returns true if the object is marked as encrypted.
-func (o *ObjectInfo) IsEncrypted() bool {
-	if _, ok := o.UserDefined[ServerSideEncryptionIV]; ok {
-		return true
-	}
-	if _, ok := o.UserDefined[ServerSideEncryptionSealAlgorithm]; ok {
-		return true
-	}
-	if _, ok := o.UserDefined[ServerSideEncryptionSealedKey]; ok {
-		return true
-	}
-	return false
-}
-
-// IsEncrypted returns true if the object is marked as encrypted.
-func (li *ListPartsInfo) IsEncrypted() bool {
-	if _, ok := li.UserDefined[ServerSideEncryptionIV]; ok {
-		return true
-	}
-	if _, ok := li.UserDefined[ServerSideEncryptionSealAlgorithm]; ok {
-		return true
-	}
-	if _, ok := li.UserDefined[ServerSideEncryptionSealedKey]; ok {
-		return true
-	}
-	return false
-}
-
 // DecryptedSize returns the size of the object after decryption in bytes.
 // It returns an error if the object is not encrypted or marked as encrypted
 // but has an invalid size.
 func (o *ObjectInfo) DecryptedSize() (int64, error) {
-	if !o.IsEncrypted() {
+	if !crypto.IsEncrypted(o.UserDefined) {
 		return 0, errors.New("Cannot compute decrypted size of an unencrypted object")
 	}
-	if len(o.Parts) == 0 || !o.IsEncryptedMultipart() {
+	if len(o.Parts) == 0 || !crypto.IsMultiPart(o.UserDefined) {
 		size, err := sio.DecryptedSize(uint64(o.Size))
 		if err != nil {
 			err = errObjectTampered // assign correct error type
@@ -880,10 +690,11 @@ func DecryptCopyObjectInfo(info *ObjectInfo, headers http.Header) (apiErr APIErr
 	if info.IsDir {
 		return ErrNone, false
 	}
-	if apiErr, encrypted = ErrNone, info.IsEncrypted(); !encrypted && hasSSECopyCustomerHeader(headers) {
+	if apiErr, encrypted = ErrNone, crypto.IsEncrypted(info.UserDefined); !encrypted && crypto.SSECopy.IsRequested(headers) {
 		apiErr = ErrInvalidEncryptionParameters
 	} else if encrypted {
-		if !hasSSECopyCustomerHeader(headers) {
+		if (!crypto.SSECopy.IsRequested(headers) && crypto.SSEC.IsEncrypted(info.UserDefined)) ||
+			(crypto.SSECopy.IsRequested(headers) && crypto.S3.IsEncrypted(info.UserDefined)) {
 			apiErr = ErrSSEEncryptedObject
 			return
 		}
@@ -907,10 +718,16 @@ func DecryptObjectInfo(info *ObjectInfo, headers http.Header) (apiErr APIErrorCo
 	if info.IsDir {
 		return ErrNone, false
 	}
-	if apiErr, encrypted = ErrNone, info.IsEncrypted(); !encrypted && hasSSECustomerHeader(headers) {
+	// disallow X-Amz-Server-Side-Encryption header on HEAD and GET
+	if crypto.S3.IsRequested(headers) {
+		apiErr = ErrInvalidEncryptionParameters
+		return
+	}
+	if apiErr, encrypted = ErrNone, crypto.IsEncrypted(info.UserDefined); !encrypted && crypto.SSEC.IsRequested(headers) {
 		apiErr = ErrInvalidEncryptionParameters
 	} else if encrypted {
-		if !hasSSECustomerHeader(headers) {
+		if (crypto.SSEC.IsEncrypted(info.UserDefined) && !crypto.SSEC.IsRequested(headers)) ||
+			(crypto.S3.IsEncrypted(info.UserDefined) && crypto.SSEC.IsRequested(headers)) {
 			apiErr = ErrSSEEncryptedObject
 			return
 		}

cmd/encryption-v1_test.go

@@ -18,21 +18,52 @@ package cmd
 
 import (
 	"bytes"
+	"encoding/base64"
 	"net/http"
 	"testing"
+
+	"github.com/minio/minio/cmd/crypto"
 )
 
+var hasServerSideEncryptionHeaderTests = []struct {
+	headers    map[string]string
+	sseRequest bool
+}{
+	{headers: map[string]string{crypto.SSECAlgorithm: "AES256", crypto.SSECKey: "key", crypto.SSECKeyMD5: "md5"}, sseRequest: true},                             // 0
+	{headers: map[string]string{crypto.SSECAlgorithm: "AES256"}, sseRequest: true},                                                                              // 1
+	{headers: map[string]string{crypto.SSECKey: "key"}, sseRequest: true},                                                                                       // 2
+	{headers: map[string]string{crypto.SSECKeyMD5: "md5"}, sseRequest: true},                                                                                    // 3
+	{headers: map[string]string{}, sseRequest: false},                                                                                                           // 4
+	{headers: map[string]string{crypto.SSECopyAlgorithm + " ": "AES256", " " + crypto.SSECopyKey: "key", crypto.SSECopyKeyMD5 + " ": "md5"}, sseRequest: false}, // 5
+	{headers: map[string]string{crypto.SSECopyAlgorithm: "", crypto.SSECopyKey: "", crypto.SSECopyKeyMD5: ""}, sseRequest: false},                               // 6
+	{headers: map[string]string{crypto.SSEHeader: ""}, sseRequest: true},                                                                                        // 6
+}
+
+func TestHasServerSideEncryptionHeader(t *testing.T) {
+	for i, test := range hasServerSideEncryptionHeaderTests {
+		headers := http.Header{}
+		for k, v := range test.headers {
+			headers.Set(k, v)
+		}
+		if hasServerSideEncryptionHeader(headers) != test.sseRequest {
+			t.Errorf("Test %d: Expected hasServerSideEncryptionHeader to return %v", i, test.sseRequest)
+		}
+	}
+}
+
 var hasSSECopyCustomerHeaderTests = []struct {
 	headers    map[string]string
 	sseRequest bool
 }{
-	{headers: map[string]string{SSECopyCustomerAlgorithm: "AES256", SSECopyCustomerKey: "key", SSECopyCustomerKeyMD5: "md5"}, sseRequest: true},                    // 0
-	{headers: map[string]string{SSECopyCustomerAlgorithm: "AES256"}, sseRequest: true},                                                                             // 1
-	{headers: map[string]string{SSECopyCustomerKey: "key"}, sseRequest: true},                                                                                      // 2
-	{headers: map[string]string{SSECopyCustomerKeyMD5: "md5"}, sseRequest: true},                                                                                   // 3
-	{headers: map[string]string{}, sseRequest: false},                                                                                                              // 4
-	{headers: map[string]string{SSECopyCustomerAlgorithm + " ": "AES256", " " + SSECopyCustomerKey: "key", SSECopyCustomerKeyMD5 + " ": "md5"}, sseRequest: false}, // 5
-	{headers: map[string]string{SSECopyCustomerAlgorithm: "", SSECopyCustomerKey: "", SSECopyCustomerKeyMD5: ""}, sseRequest: false},                               // 6
+	{headers: map[string]string{crypto.SSECopyAlgorithm: "AES256", crypto.SSECopyKey: "key", crypto.SSECopyKeyMD5: "md5"}, sseRequest: true},                    // 0
+	{headers: map[string]string{crypto.SSECopyAlgorithm: "AES256"}, sseRequest: true},                                                                           // 1
+	{headers: map[string]string{crypto.SSECopyKey: "key"}, sseRequest: true},                                                                                    // 2
+	{headers: map[string]string{crypto.SSECopyKeyMD5: "md5"}, sseRequest: true},                                                                                 // 3
+	{headers: map[string]string{}, sseRequest: false},                                                                                                           // 4
+	{headers: map[string]string{crypto.SSECopyAlgorithm + " ": "AES256", " " + crypto.SSECopyKey: "key", crypto.SSECopyKeyMD5 + " ": "md5"}, sseRequest: false}, // 5
+	{headers: map[string]string{crypto.SSECopyAlgorithm: "", crypto.SSECopyKey: "", crypto.SSECopyKeyMD5: ""}, sseRequest: true},                                // 6
+	{headers: map[string]string{crypto.SSEHeader: ""}, sseRequest: false},                                                                                       // 7
+
 }
 
 func TestIsSSECopyCustomerRequest(t *testing.T) {
@@ -41,8 +72,8 @@ func TestIsSSECopyCustomerRequest(t *testing.T) {
 		for k, v := range test.headers {
 			headers.Set(k, v)
 		}
-		if hasSSECopyCustomerHeader(headers) != test.sseRequest {
-			t.Errorf("Test %d: Expected hasSSECopyCustomerHeader to return %v", i, test.sseRequest)
+		if crypto.SSECopy.IsRequested(headers) != test.sseRequest {
+			t.Errorf("Test %d: Expected crypto.SSECopy.IsRequested to return %v", i, test.sseRequest)
 		}
 	}
 }
@@ -51,13 +82,15 @@ var hasSSECustomerHeaderTests = []struct {
 	headers    map[string]string
 	sseRequest bool
 }{
-	{headers: map[string]string{SSECustomerAlgorithm: "AES256", SSECustomerKey: "key", SSECustomerKeyMD5: "md5"}, sseRequest: true},                    // 0
-	{headers: map[string]string{SSECustomerAlgorithm: "AES256"}, sseRequest: true},                                                                     // 1
-	{headers: map[string]string{SSECustomerKey: "key"}, sseRequest: true},                                                                              // 2
-	{headers: map[string]string{SSECustomerKeyMD5: "md5"}, sseRequest: true},                                                                           // 3
+	{headers: map[string]string{crypto.SSECAlgorithm: "AES256", crypto.SSECKey: "key", crypto.SSECKeyMD5: "md5"}, sseRequest: true},                    // 0
+	{headers: map[string]string{crypto.SSECAlgorithm: "AES256"}, sseRequest: true},                                                                     // 1
+	{headers: map[string]string{crypto.SSECKey: "key"}, sseRequest: true},                                                                              // 2
+	{headers: map[string]string{crypto.SSECKeyMD5: "md5"}, sseRequest: true},                                                                           // 3
 	{headers: map[string]string{}, sseRequest: false},                                                                                                  // 4
-	{headers: map[string]string{SSECustomerAlgorithm + " ": "AES256", " " + SSECustomerKey: "key", SSECustomerKeyMD5 + " ": "md5"}, sseRequest: false}, // 5
-	{headers: map[string]string{SSECustomerAlgorithm: "", SSECustomerKey: "", SSECustomerKeyMD5: ""}, sseRequest: false},                               // 6
+	{headers: map[string]string{crypto.SSECAlgorithm + " ": "AES256", " " + crypto.SSECKey: "key", crypto.SSECKeyMD5 + " ": "md5"}, sseRequest: false}, // 5
+	{headers: map[string]string{crypto.SSECAlgorithm: "", crypto.SSECKey: "", crypto.SSECKeyMD5: ""}, sseRequest: false},                               // 6
+	{headers: map[string]string{crypto.SSEHeader: ""}, sseRequest: false},                                                                              // 7
+
 }
 
 func TesthasSSECustomerHeader(t *testing.T) {
@@ -66,7 +99,7 @@ func TesthasSSECustomerHeader(t *testing.T) {
 		for k, v := range test.headers {
 			headers.Set(k, v)
 		}
-		if hasSSECustomerHeader(headers) != test.sseRequest {
+		if crypto.SSEC.IsRequested(headers) != test.sseRequest {
 			t.Errorf("Test %d: Expected hasSSECustomerHeader to return %v", i, test.sseRequest)
 		}
 	}
@@ -79,75 +112,84 @@ var parseSSECustomerRequestTests = []struct {
 }{
 	{
 		headers: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 0
-			SSECustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 0
+			crypto.SSECKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
 		useTLS: true, err: nil,
 	},
 	{
 		headers: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 1
-			SSECustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 1
+			crypto.SSECKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
 		useTLS: false, err: errInsecureSSERequest,
 	},
 	{
 		headers: map[string]string{
-			SSECustomerAlgorithm: "AES 256",
-			SSECustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 2
-			SSECustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+			crypto.SSECAlgorithm: "AES 256",
+			crypto.SSECKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 2
+			crypto.SSECKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
-		useTLS: true, err: errInvalidSSEAlgorithm,
+		useTLS: true, err: crypto.ErrInvalidCustomerAlgorithm,
 	},
 	{
 		headers: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "NjE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 3
-			SSECustomerKeyMD5:    "H+jq/LwEOEO90YtiTuNFVw==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "NjE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 3
+			crypto.SSECKeyMD5:    "H+jq/LwEOEO90YtiTuNFVw==",
 		},
-		useTLS: true, err: errSSEKeyMD5Mismatch,
+		useTLS: true, err: crypto.ErrCustomerKeyMD5Mismatch,
 	},
 	{
 		headers: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       " jE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 4
-			SSECustomerKeyMD5:    "H+jq/LwEOEO90YtiTuNFVw==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       " jE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 4
+			crypto.SSECKeyMD5:    "H+jq/LwEOEO90YtiTuNFVw==",
 		},
-		useTLS: true, err: errInvalidSSEKey,
+		useTLS: true, err: crypto.ErrInvalidCustomerKey,
 	},
 	{
 		headers: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "NjE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 5
-			SSECustomerKeyMD5:    " +jq/LwEOEO90YtiTuNFVw==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "NjE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 5
+			crypto.SSECKeyMD5:    " +jq/LwEOEO90YtiTuNFVw==",
 		},
-		useTLS: true, err: errSSEKeyMD5Mismatch,
+		useTLS: true, err: crypto.ErrCustomerKeyMD5Mismatch,
 	},
 	{
 		headers: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "vFQ9ScFOF6Tu/BfzMS+rVMvlZGJHi5HmGJenJfrfKI45", // 6
-			SSECustomerKeyMD5:    "9KPgDdZNTHimuYCwnJTp5g==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "vFQ9ScFOF6Tu/BfzMS+rVMvlZGJHi5HmGJenJfrfKI45", // 6
+			crypto.SSECKeyMD5:    "9KPgDdZNTHimuYCwnJTp5g==",
 		},
-		useTLS: true, err: errInvalidSSEKey,
+		useTLS: true, err: crypto.ErrInvalidCustomerKey,
 	},
 	{
 		headers: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "", // 7
-			SSECustomerKeyMD5:    "9KPgDdZNTHimuYCwnJTp5g==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "", // 7
+			crypto.SSECKeyMD5:    "9KPgDdZNTHimuYCwnJTp5g==",
 		},
-		useTLS: true, err: errMissingSSEKey,
+		useTLS: true, err: crypto.ErrMissingCustomerKey,
 	},
 	{
 		headers: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "vFQ9ScFOF6Tu/BfzMS+rVMvlZGJHi5HmGJenJfrfKI45", // 8
-			SSECustomerKeyMD5:    "",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "vFQ9ScFOF6Tu/BfzMS+rVMvlZGJHi5HmGJenJfrfKI45", // 8
+			crypto.SSECKeyMD5:    "",
 		},
-		useTLS: true, err: errMissingSSEKeyMD5,
+		useTLS: true, err: crypto.ErrMissingCustomerKeyMD5,
+	},
+	{
+		headers: map[string]string{
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "vFQ9ScFOF6Tu/BfzMS+rVMvlZGJHi5HmGJenJfrfKI45", // 8
+			crypto.SSECKeyMD5:    "",
+			crypto.SSEHeader:     "",
+		},
+		useTLS: true, err: crypto.ErrIncompatibleEncryptionMethod,
 	},
 }
 
@@ -166,8 +208,8 @@ func TestParseSSECustomerRequest(t *testing.T) {
 		if err != test.err {
 			t.Errorf("Test %d: Parse returned: %v want: %v", i, err, test.err)
 		}
-		key := request.Header.Get(SSECustomerKey)
-		if (err == nil || err == errSSEKeyMD5Mismatch) && key != "" {
+		key := request.Header.Get(crypto.SSECKey)
+		if (err == nil || err == crypto.ErrCustomerKeyMD5Mismatch) && key != "" {
 			t.Errorf("Test %d: Client key survived parsing - found key: %v", i, key)
 		}
 
@@ -175,81 +217,100 @@ func TestParseSSECustomerRequest(t *testing.T) {
 }
 
 var parseSSECopyCustomerRequestTests = []struct {
-	headers map[string]string
-	useTLS  bool
-	err     error
+	headers  map[string]string
+	metadata map[string]string
+	useTLS   bool
+	err      error
 }{
 	{
 		headers: map[string]string{
-			SSECopyCustomerAlgorithm: "AES256",
-			SSECopyCustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 0
-			SSECopyCustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+			crypto.SSECopyAlgorithm: "AES256",
+			crypto.SSECopyKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 0
+			crypto.SSECopyKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
-		useTLS: true, err: nil,
+		metadata: map[string]string{},
+		useTLS:   true, err: nil,
 	},
 	{
 		headers: map[string]string{
-			SSECopyCustomerAlgorithm: "AES256",
-			SSECopyCustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 1
-			SSECopyCustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+			crypto.SSECopyAlgorithm: "AES256",
+			crypto.SSECopyKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 0
+			crypto.SSECopyKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
-		useTLS: false, err: errInsecureSSERequest,
+		metadata: map[string]string{"X-Minio-Internal-Server-Side-Encryption-S3-Sealed-Key": base64.StdEncoding.EncodeToString(make([]byte, 64))},
+		useTLS:   true, err: crypto.ErrIncompatibleEncryptionMethod,
 	},
 	{
 		headers: map[string]string{
-			SSECopyCustomerAlgorithm: "AES 256",
-			SSECopyCustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 2
-			SSECopyCustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+			crypto.SSECopyAlgorithm: "AES256",
+			crypto.SSECopyKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 1
+			crypto.SSECopyKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
-		useTLS: true, err: errInvalidSSEAlgorithm,
+		metadata: map[string]string{},
+		useTLS:   false, err: errInsecureSSERequest,
 	},
 	{
 		headers: map[string]string{
-			SSECopyCustomerAlgorithm: "AES256",
-			SSECopyCustomerKey:       "NjE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 3
-			SSECopyCustomerKeyMD5:    "H+jq/LwEOEO90YtiTuNFVw==",
+			crypto.SSECopyAlgorithm: "AES 256",
+			crypto.SSECopyKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=", // 2
+			crypto.SSECopyKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
-		useTLS: true, err: errSSEKeyMD5Mismatch,
+		metadata: map[string]string{},
+		useTLS:   true, err: crypto.ErrInvalidCustomerAlgorithm,
 	},
 	{
 		headers: map[string]string{
-			SSECopyCustomerAlgorithm: "AES256",
-			SSECopyCustomerKey:       " jE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 4
-			SSECopyCustomerKeyMD5:    "H+jq/LwEOEO90YtiTuNFVw==",
+			crypto.SSECopyAlgorithm: "AES256",
+			crypto.SSECopyKey:       "NjE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 3
+			crypto.SSECopyKeyMD5:    "H+jq/LwEOEO90YtiTuNFVw==",
 		},
-		useTLS: true, err: errInvalidSSEKey,
+		metadata: map[string]string{},
+		useTLS:   true, err: crypto.ErrCustomerKeyMD5Mismatch,
 	},
 	{
 		headers: map[string]string{
-			SSECopyCustomerAlgorithm: "AES256",
-			SSECopyCustomerKey:       "NjE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 5
-			SSECopyCustomerKeyMD5:    " +jq/LwEOEO90YtiTuNFVw==",
+			crypto.SSECopyAlgorithm: "AES256",
+			crypto.SSECopyKey:       " jE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 4
+			crypto.SSECopyKeyMD5:    "H+jq/LwEOEO90YtiTuNFVw==",
 		},
-		useTLS: true, err: errSSEKeyMD5Mismatch,
+		metadata: map[string]string{},
+		useTLS:   true, err: crypto.ErrInvalidCustomerKey,
 	},
 	{
 		headers: map[string]string{
-			SSECopyCustomerAlgorithm: "AES256",
-			SSECopyCustomerKey:       "vFQ9ScFOF6Tu/BfzMS+rVMvlZGJHi5HmGJenJfrfKI45", // 6
-			SSECopyCustomerKeyMD5:    "9KPgDdZNTHimuYCwnJTp5g==",
+			crypto.SSECopyAlgorithm: "AES256",
+			crypto.SSECopyKey:       "NjE0SL87s+ZhYtaTrg5eI5cjhCQLGPVMKenPG2bCJFw=", // 5
+			crypto.SSECopyKeyMD5:    " +jq/LwEOEO90YtiTuNFVw==",
 		},
-		useTLS: true, err: errInvalidSSEKey,
+		metadata: map[string]string{},
+		useTLS:   true, err: crypto.ErrCustomerKeyMD5Mismatch,
 	},
 	{
 		headers: map[string]string{
-			SSECopyCustomerAlgorithm: "AES256",
-			SSECopyCustomerKey:       "", // 7
-			SSECopyCustomerKeyMD5:    "9KPgDdZNTHimuYCwnJTp5g==",
+			crypto.SSECopyAlgorithm: "AES256",
+			crypto.SSECopyKey:       "vFQ9ScFOF6Tu/BfzMS+rVMvlZGJHi5HmGJenJfrfKI45", // 6
+			crypto.SSECopyKeyMD5:    "9KPgDdZNTHimuYCwnJTp5g==",
 		},
-		useTLS: true, err: errMissingSSEKey,
+		metadata: map[string]string{},
+		useTLS:   true, err: crypto.ErrInvalidCustomerKey,
 	},
 	{
 		headers: map[string]string{
-			SSECopyCustomerAlgorithm: "AES256",
-			SSECopyCustomerKey:       "vFQ9ScFOF6Tu/BfzMS+rVMvlZGJHi5HmGJenJfrfKI45", // 8
-			SSECopyCustomerKeyMD5:    "",
+			crypto.SSECopyAlgorithm: "AES256",
+			crypto.SSECopyKey:       "", // 7
+			crypto.SSECopyKeyMD5:    "9KPgDdZNTHimuYCwnJTp5g==",
 		},
-		useTLS: true, err: errMissingSSEKeyMD5,
+		metadata: map[string]string{},
+		useTLS:   true, err: crypto.ErrMissingCustomerKey,
+	},
+	{
+		headers: map[string]string{
+			crypto.SSECopyAlgorithm: "AES256",
+			crypto.SSECopyKey:       "vFQ9ScFOF6Tu/BfzMS+rVMvlZGJHi5HmGJenJfrfKI45", // 8
+			crypto.SSECopyKeyMD5:    "",
+		},
+		metadata: map[string]string{},
+		useTLS:   true, err: crypto.ErrMissingCustomerKeyMD5,
 	},
 }
 
@@ -264,12 +325,12 @@ func TestParseSSECopyCustomerRequest(t *testing.T) {
 		request.Header = headers
 		globalIsSSL = test.useTLS
 
-		_, err := ParseSSECopyCustomerRequest(request)
+		_, err := ParseSSECopyCustomerRequest(request, test.metadata)
 		if err != test.err {
 			t.Errorf("Test %d: Parse returned: %v want: %v", i, err, test.err)
 		}
-		key := request.Header.Get(SSECopyCustomerKey)
-		if (err == nil || err == errSSEKeyMD5Mismatch) && key != "" {
+		key := request.Header.Get(crypto.SSECopyKey)
+		if (err == nil || err == crypto.ErrCustomerKeyMD5Mismatch) && key != "" {
 			t.Errorf("Test %d: Client key survived parsing - found key: %v", i, key)
 		}
 	}
@@ -281,20 +342,20 @@ var encryptRequestTests = []struct {
 }{
 	{
 		header: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
-			SSECustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
+			crypto.SSECKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
 		metadata: map[string]string{},
 	},
 	{
 		header: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
-			SSECustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
+			crypto.SSECKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
 		metadata: map[string]string{
-			SSECustomerKey: "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
+			crypto.SSECKey: "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
 		},
 	},
 }
@@ -309,19 +370,20 @@ func TestEncryptRequest(t *testing.T) {
 			req.Header.Set(k, v)
 		}
 		_, err := EncryptRequest(content, req, "bucket", "object", test.metadata)
+
 		if err != nil {
 			t.Fatalf("Test %d: Failed to encrypt request: %v", i, err)
 		}
-		if key, ok := test.metadata[SSECustomerKey]; ok {
+		if key, ok := test.metadata[crypto.SSECKey]; ok {
 			t.Errorf("Test %d: Client provided key survived in metadata - key: %s", i, key)
 		}
-		if kdf, ok := test.metadata[ServerSideEncryptionSealAlgorithm]; !ok {
+		if kdf, ok := test.metadata[crypto.SSESealAlgorithm]; !ok {
 			t.Errorf("Test %d: ServerSideEncryptionKDF must be part of metadata: %v", i, kdf)
 		}
-		if iv, ok := test.metadata[ServerSideEncryptionIV]; !ok {
-			t.Errorf("Test %d: ServerSideEncryptionIV must be part of metadata: %v", i, iv)
+		if iv, ok := test.metadata[crypto.SSEIV]; !ok {
+			t.Errorf("Test %d: crypto.SSEIV must be part of metadata: %v", i, iv)
 		}
-		if mac, ok := test.metadata[ServerSideEncryptionSealedKey]; !ok {
+		if mac, ok := test.metadata[crypto.SSECSealedKey]; !ok {
 			t.Errorf("Test %d: ServerSideEncryptionKeyMAC must be part of metadata: %v", i, mac)
 		}
 	}
@@ -337,14 +399,14 @@ var decryptRequestTests = []struct {
 		bucket: "bucket",
 		object: "object",
 		header: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "MzJieXRlc2xvbmdzZWNyZXRrZXltdXN0cHJvdmlkZWQ=",
-			SSECustomerKeyMD5:    "7PpPLAK26ONlVUGOWlusfg==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "MzJieXRlc2xvbmdzZWNyZXRrZXltdXN0cHJvdmlkZWQ=",
+			crypto.SSECKeyMD5:    "7PpPLAK26ONlVUGOWlusfg==",
 		},
 		metadata: map[string]string{
-			ServerSideEncryptionSealAlgorithm: SSESealAlgorithmDareSha256,
-			ServerSideEncryptionIV:            "7nQqotA8xgrPx6QK7Ap3GCfjKitqJSrGP7xzgErSJlw=",
-			ServerSideEncryptionSealedKey:     "EAAfAAAAAAD7v1hQq3PFRUHsItalxmrJqrOq6FwnbXNarxOOpb8jTWONPPKyM3Gfjkjyj6NCf+aB/VpHCLCTBA==",
+			crypto.SSESealAlgorithm: SSESealAlgorithmDareSha256,
+			crypto.SSEIV:            "7nQqotA8xgrPx6QK7Ap3GCfjKitqJSrGP7xzgErSJlw=",
+			crypto.SSECSealedKey:    "EAAfAAAAAAD7v1hQq3PFRUHsItalxmrJqrOq6FwnbXNarxOOpb8jTWONPPKyM3Gfjkjyj6NCf+aB/VpHCLCTBA==",
 		},
 		shouldFail: false,
 	},
@@ -352,14 +414,14 @@ var decryptRequestTests = []struct {
 		bucket: "bucket",
 		object: "object",
 		header: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "MzJieXRlc2xvbmdzZWNyZXRrZXltdXN0cHJvdmlkZWQ=",
-			SSECustomerKeyMD5:    "7PpPLAK26ONlVUGOWlusfg==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "MzJieXRlc2xvbmdzZWNyZXRrZXltdXN0cHJvdmlkZWQ=",
+			crypto.SSECKeyMD5:    "7PpPLAK26ONlVUGOWlusfg==",
 		},
 		metadata: map[string]string{
-			ServerSideEncryptionSealAlgorithm: SSESealAlgorithmDareV2HmacSha256,
-			ServerSideEncryptionIV:            "qEqmsONcorqlcZXJxaw32H04eyXyXwUgjHzlhkaIYrU=",
-			ServerSideEncryptionSealedKey:     "IAAfAIM14ugTGcM/dIrn4iQMrkl1sjKyeBQ8FBEvRebYj8vWvxG+0cJRpC6NXRU1wJN50JaUOATjO7kz0wZ2mA==",
+			crypto.SSESealAlgorithm: SSESealAlgorithmDareV2HmacSha256,
+			crypto.SSEIV:            "qEqmsONcorqlcZXJxaw32H04eyXyXwUgjHzlhkaIYrU=",
+			crypto.SSECSealedKey:    "IAAfAIM14ugTGcM/dIrn4iQMrkl1sjKyeBQ8FBEvRebYj8vWvxG+0cJRpC6NXRU1wJN50JaUOATjO7kz0wZ2mA==",
 		},
 		shouldFail: false,
 	},
@@ -367,14 +429,14 @@ var decryptRequestTests = []struct {
 		bucket: "bucket",
 		object: "object",
 		header: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
-			SSECustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
+			crypto.SSECKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
 		metadata: map[string]string{
-			ServerSideEncryptionSealAlgorithm: "HMAC-SHA3",
-			ServerSideEncryptionIV:            "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
-			ServerSideEncryptionSealedKey:     "SY5E9AvI2tI7/nUrUAssIGE32Hcs4rR9z/CUuPqu5N4=",
+			crypto.SSESealAlgorithm: "HMAC-SHA3",
+			crypto.SSEIV:            "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
+			crypto.SSECSealedKey:    "SY5E9AvI2tI7/nUrUAssIGE32Hcs4rR9z/CUuPqu5N4=",
 		},
 		shouldFail: true,
 	},
@@ -382,14 +444,14 @@ var decryptRequestTests = []struct {
 		bucket: "bucket",
 		object: "object",
 		header: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
-			SSECustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
+			crypto.SSECKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
 		metadata: map[string]string{
-			ServerSideEncryptionSealAlgorithm: SSESealAlgorithmDareSha256,
-			ServerSideEncryptionIV:            "RrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
-			ServerSideEncryptionSealedKey:     "SY5E9AvI2tI7/nUrUAssIGE32Hcs4rR9z/CUuPqu5N4=",
+			crypto.SSESealAlgorithm: SSESealAlgorithmDareSha256,
+			crypto.SSEIV:            "RrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
+			crypto.SSECSealedKey:    "SY5E9AvI2tI7/nUrUAssIGE32Hcs4rR9z/CUuPqu5N4=",
 		},
 		shouldFail: true,
 	},
@@ -397,14 +459,14 @@ var decryptRequestTests = []struct {
 		bucket: "bucket",
 		object: "object",
 		header: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
-			SSECustomerKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "XAm0dRrJsEsyPb1UuFNezv1bl9hxuYsgUVC/MUctE2k=",
+			crypto.SSECKeyMD5:    "bY4wkxQejw9mUJfo72k53A==",
 		},
 		metadata: map[string]string{
-			ServerSideEncryptionSealAlgorithm: SSESealAlgorithmDareSha256,
-			ServerSideEncryptionIV:            "XAm0dRrJsEsyPb1UuFNezv1bl9ehxuYsgUVC/MUctE2k=",
-			ServerSideEncryptionSealedKey:     "SY5E9AvI2tI7/nUrUAssIGE32Hds4rR9z/CUuPqu5N4=",
+			crypto.SSESealAlgorithm: SSESealAlgorithmDareSha256,
+			crypto.SSEIV:            "XAm0dRrJsEsyPb1UuFNezv1bl9ehxuYsgUVC/MUctE2k=",
+			crypto.SSECSealedKey:    "SY5E9AvI2tI7/nUrUAssIGE32Hds4rR9z/CUuPqu5N4=",
 		},
 		shouldFail: true,
 	},
@@ -412,14 +474,14 @@ var decryptRequestTests = []struct {
 		bucket: "bucket",
 		object: "object-2",
 		header: map[string]string{
-			SSECustomerAlgorithm: "AES256",
-			SSECustomerKey:       "MzJieXRlc2xvbmdzZWNyZXRrZXltdXN0cHJvdmlkZWQ=",
-			SSECustomerKeyMD5:    "7PpPLAK26ONlVUGOWlusfg==",
+			crypto.SSECAlgorithm: "AES256",
+			crypto.SSECKey:       "MzJieXRlc2xvbmdzZWNyZXRrZXltdXN0cHJvdmlkZWQ=",
+			crypto.SSECKeyMD5:    "7PpPLAK26ONlVUGOWlusfg==",
 		},
 		metadata: map[string]string{
-			ServerSideEncryptionSealAlgorithm: SSESealAlgorithmDareV2HmacSha256,
-			ServerSideEncryptionIV:            "qEqmsONcorqlcZXJxaw32H04eyXyXwUgjHzlhkaIYrU=",
-			ServerSideEncryptionSealedKey:     "IAAfAIM14ugTGcM/dIrn4iQMrkl1sjKyeBQ8FBEvRebYj8vWvxG+0cJRpC6NXRU1wJN50JaUOATjO7kz0wZ2mA==",
+			crypto.SSESealAlgorithm: SSESealAlgorithmDareV2HmacSha256,
+			crypto.SSEIV:            "qEqmsONcorqlcZXJxaw32H04eyXyXwUgjHzlhkaIYrU=",
+			crypto.SSECSealedKey:    "IAAfAIM14ugTGcM/dIrn4iQMrkl1sjKyeBQ8FBEvRebYj8vWvxG+0cJRpC6NXRU1wJN50JaUOATjO7kz0wZ2mA==",
 		},
 		shouldFail: true,
 	},
@@ -441,16 +503,16 @@ func TestDecryptRequest(t *testing.T) {
 		if err == nil && test.shouldFail {
 			t.Fatalf("Test %d: should fail but passed", i)
 		}
-		if key, ok := test.metadata[SSECustomerKey]; ok {
+		if key, ok := test.metadata[crypto.SSECKey]; ok {
 			t.Errorf("Test %d: Client provided key survived in metadata - key: %s", i, key)
 		}
-		if kdf, ok := test.metadata[ServerSideEncryptionSealAlgorithm]; ok && !test.shouldFail {
+		if kdf, ok := test.metadata[crypto.SSESealAlgorithm]; ok && !test.shouldFail {
 			t.Errorf("Test %d: ServerSideEncryptionKDF should not be part of metadata: %v", i, kdf)
 		}
-		if iv, ok := test.metadata[ServerSideEncryptionIV]; ok && !test.shouldFail {
-			t.Errorf("Test %d: ServerSideEncryptionIV should not be part of metadata: %v", i, iv)
+		if iv, ok := test.metadata[crypto.SSEIV]; ok && !test.shouldFail {
+			t.Errorf("Test %d: crypto.SSEIV should not be part of metadata: %v", i, iv)
 		}
-		if mac, ok := test.metadata[ServerSideEncryptionSealedKey]; ok && !test.shouldFail {
+		if mac, ok := test.metadata[crypto.SSECSealedKey]; ok && !test.shouldFail {
 			t.Errorf("Test %d: ServerSideEncryptionKeyMAC should not be part of metadata: %v", i, mac)
 		}
 	}
@@ -467,28 +529,28 @@ var decryptObjectInfoTests = []struct {
 		expErr:  ErrNone,
 	},
 	{
-		info:    ObjectInfo{Size: 100, UserDefined: map[string]string{ServerSideEncryptionSealAlgorithm: SSESealAlgorithmDareSha256}},
-		headers: http.Header{SSECustomerAlgorithm: []string{SSECustomerAlgorithmAES256}},
+		info:    ObjectInfo{Size: 100, UserDefined: map[string]string{crypto.SSESealAlgorithm: SSESealAlgorithmDareSha256}},
+		headers: http.Header{crypto.SSECAlgorithm: []string{crypto.SSEAlgorithmAES256}},
 		expErr:  ErrNone,
 	},
 	{
-		info:    ObjectInfo{Size: 0, UserDefined: map[string]string{ServerSideEncryptionSealAlgorithm: SSESealAlgorithmDareSha256}},
-		headers: http.Header{SSECustomerAlgorithm: []string{SSECustomerAlgorithmAES256}},
+		info:    ObjectInfo{Size: 0, UserDefined: map[string]string{crypto.SSESealAlgorithm: SSESealAlgorithmDareSha256}},
+		headers: http.Header{crypto.SSECAlgorithm: []string{crypto.SSEAlgorithmAES256}},
 		expErr:  ErrNone,
 	},
 	{
-		info:    ObjectInfo{Size: 100, UserDefined: map[string]string{ServerSideEncryptionSealAlgorithm: SSESealAlgorithmDareSha256}},
+		info:    ObjectInfo{Size: 100, UserDefined: map[string]string{crypto.SSECSealedKey: "EAAfAAAAAAD7v1hQq3PFRUHsItalxmrJqrOq6FwnbXNarxOOpb8jTWONPPKyM3Gfjkjyj6NCf+aB/VpHCLCTBA=="}},
 		headers: http.Header{},
 		expErr:  ErrSSEEncryptedObject,
 	},
 	{
 		info:    ObjectInfo{Size: 100, UserDefined: map[string]string{}},
-		headers: http.Header{SSECustomerAlgorithm: []string{SSECustomerAlgorithmAES256}},
+		headers: http.Header{crypto.SSECAlgorithm: []string{crypto.SSEAlgorithmAES256}},
 		expErr:  ErrInvalidEncryptionParameters,
 	},
 	{
-		info:    ObjectInfo{Size: 31, UserDefined: map[string]string{ServerSideEncryptionSealAlgorithm: SSESealAlgorithmDareSha256}},
-		headers: http.Header{SSECustomerAlgorithm: []string{SSECustomerAlgorithmAES256}},
+		info:    ObjectInfo{Size: 31, UserDefined: map[string]string{crypto.SSESealAlgorithm: SSESealAlgorithmDareSha256}},
+		headers: http.Header{crypto.SSECAlgorithm: []string{crypto.SSEAlgorithmAES256}},
 		expErr:  ErrObjectTampered,
 	},
 }
@@ -497,7 +559,7 @@ func TestDecryptObjectInfo(t *testing.T) {
 	for i, test := range decryptObjectInfoTests {
 		if err, encrypted := DecryptObjectInfo(&test.info, test.headers); err != test.expErr {
 			t.Errorf("Test %d: Decryption returned wrong error code: got %d , want %d", i, err, test.expErr)
-		} else if enc := test.info.IsEncrypted(); encrypted && enc != encrypted {
+		} else if enc := crypto.IsEncrypted(test.info.UserDefined); encrypted && enc != encrypted {
 			t.Errorf("Test %d: Decryption thinks object is encrypted but it is not", i)
 		} else if !encrypted && enc != encrypted {
 			t.Errorf("Test %d: Decryption thinks object is not encrypted but it is", i)

cmd/endpoint-ellipses.go

@@ -18,6 +18,8 @@ package cmd
 
 import (
 	"fmt"
+	"os"
+	"strconv"
 	"strings"
 
 	"github.com/minio/minio-go/pkg/set"
@@ -69,10 +71,26 @@ func getSetIndexes(args []string, totalSizes []uint64) (setIndexes [][]uint64, e
 		return nil, errInvalidArgument
 	}
 
+	// isValidSetSize - checks whether given count is a valid set size for erasure coding.
+	isValidSetSize := func(count uint64) bool {
+		return (count >= setSizes[0] && count <= setSizes[len(setSizes)-1] && count%2 == 0)
+	}
+
+	var customSetDriveCount uint64
+	if v := os.Getenv("MINIO_ERASURE_SET_DRIVE_COUNT"); v != "" {
+		customSetDriveCount, err = strconv.ParseUint(v, 10, 64)
+		if err != nil {
+			return nil, uiErrInvalidErasureSetSize(err)
+		}
+		if !isValidSetSize(customSetDriveCount) {
+			return nil, uiErrInvalidErasureSetSize(nil)
+		}
+	}
+
 	setIndexes = make([][]uint64, len(totalSizes))
 	for _, totalSize := range totalSizes {
 		// Check if totalSize has minimum range upto setSize
-		if totalSize < setSizes[0] {
+		if totalSize < setSizes[0] || totalSize < customSetDriveCount {
 			return nil, uiErrInvalidNumberOfErasureEndpoints(nil)
 		}
 	}
@@ -95,9 +113,24 @@ func getSetIndexes(args []string, totalSizes []uint64) (setIndexes [][]uint64, e
 		setSize = commonSize
 	}
 
-	// isValidSetSize - checks whether given count is a valid set size for erasure coding.
-	isValidSetSize := func(count uint64) bool {
-		return (count >= setSizes[0] && count <= setSizes[len(setSizes)-1] && count%2 == 0)
+	possibleSetCounts := func(setSize uint64) (ss []uint64) {
+		for _, s := range setSizes {
+			if setSize%s == 0 {
+				ss = append(ss, s)
+			}
+		}
+		return ss
+	}
+
+	if customSetDriveCount > 0 {
+		msg := fmt.Sprintf("Invalid set drive count, leads to non-uniform distribution for the given number of disks. Possible values for custom set count are %d", possibleSetCounts(setSize))
+		if customSetDriveCount > setSize {
+			return nil, uiErrInvalidErasureSetSize(nil).Msg(msg)
+		}
+		if setSize%customSetDriveCount != 0 {
+			return nil, uiErrInvalidErasureSetSize(nil).Msg(msg)
+		}
+		setSize = customSetDriveCount
 	}
 
 	// Check whether setSize is with the supported range.

cmd/endpoint-ellipses_test.go

@@ -18,6 +18,7 @@ package cmd
 
 import (
 	"fmt"
+	"os"
 	"reflect"
 	"testing"
 
@@ -84,6 +85,65 @@ func TestGetDivisibleSize(t *testing.T) {
 	}
 }
 
+// Test tests calculating set indexes with ENV override for drive count.
+func TestGetSetIndexesEnvOverride(t *testing.T) {
+	testCases := []struct {
+		args        []string
+		totalSizes  []uint64
+		indexes     [][]uint64
+		envOverride string
+		success     bool
+	}{
+		{
+			[]string{"data{1...64}"},
+			[]uint64{64},
+			[][]uint64{{8, 8, 8, 8, 8, 8, 8, 8}},
+			"8",
+			true,
+		},
+		{
+			[]string{"data{1...60}"},
+			nil,
+			nil,
+			"8",
+			false,
+		},
+		{
+			[]string{"data{1...64}"},
+			nil,
+			nil,
+			"-1",
+			false,
+		},
+		{
+			[]string{"data{1...64}"},
+			nil,
+			nil,
+			"2",
+			false,
+		},
+	}
+
+	for i, testCase := range testCases {
+		t.Run(fmt.Sprintf("Test%d", i+1), func(t *testing.T) {
+			if err := os.Setenv("MINIO_ERASURE_SET_DRIVE_COUNT", testCase.envOverride); err != nil {
+				t.Fatal(err)
+			}
+			gotIndexes, err := getSetIndexes(testCase.args, testCase.totalSizes)
+			if err != nil && testCase.success {
+				t.Errorf("Expected success but failed instead %s", err)
+			}
+			if err == nil && !testCase.success {
+				t.Errorf("Expected failure but passed instead")
+			}
+			if !reflect.DeepEqual(testCase.indexes, gotIndexes) {
+				t.Errorf("Expected %v, got %v", testCase.indexes, gotIndexes)
+			}
+			os.Unsetenv("MINIO_ERASURE_SET_DRIVE_COUNT")
+		})
+	}
+}
+
 // Test tests calculating set indexes.
 func TestGetSetIndexes(t *testing.T) {
 	testCases := []struct {

cmd/erasure-createfile.go

@@ -18,85 +18,92 @@ package cmd
 
 import (
 	"context"
-	"hash"
 	"io"
 
+	"sync"
+
 	"github.com/minio/minio/cmd/logger"
 )
 
-// CreateFile creates a new bitrot encoded file spread over all available disks. CreateFile will create
-// the file at the given volume and path. It will read from src until an io.EOF occurs. The given algorithm will
-// be used to protect the erasure encoded file.
-func (s *ErasureStorage) CreateFile(ctx context.Context, src io.Reader, volume, path string, buffer []byte, algorithm BitrotAlgorithm, writeQuorum int) (f ErasureFileInfo, err error) {
-	if !algorithm.Available() {
-		logger.LogIf(ctx, errBitrotHashAlgoInvalid)
-		return f, errBitrotHashAlgoInvalid
-	}
-	f.Checksums = make([][]byte, len(s.disks))
-	hashers := make([]hash.Hash, len(s.disks))
-	for i := range hashers {
-		hashers[i] = algorithm.New()
-	}
-	errChans, errs := make([]chan error, len(s.disks)), make([]error, len(s.disks))
-	for i := range errChans {
-		errChans[i] = make(chan error, 1) // create buffered channel to let finished go-routines die early
-	}
+// Writes in parallel to bitrotWriters
+type parallelWriter struct {
+	writers     []*bitrotWriter
+	writeQuorum int
+	errs        []error
+}
 
-	var blocks [][]byte
-	var n = len(buffer)
-	for n == len(buffer) {
-		n, err = io.ReadFull(src, buffer)
-		if n == 0 && err == io.EOF {
-			if f.Size != 0 { // don't write empty block if we have written to the disks
-				break
-			}
-			blocks = make([][]byte, len(s.disks)) // write empty block
-		} else if err == nil || (n > 0 && err == io.ErrUnexpectedEOF) {
-			blocks, err = s.ErasureEncode(ctx, buffer[:n])
-			if err != nil {
-				return f, err
-			}
-		} else {
-			logger.LogIf(ctx, err)
-			return f, err
-		}
+// Append appends data to bitrotWriters in parallel.
+func (p *parallelWriter) Append(ctx context.Context, blocks [][]byte) error {
+	var wg sync.WaitGroup
 
-		for i := range errChans { // span workers
-			go erasureAppendFile(ctx, s.disks[i], volume, path, hashers[i], blocks[i], errChans[i])
-		}
-		for i := range errChans { // wait until all workers are finished
-			errs[i] = <-errChans[i]
-		}
-		if err = reduceWriteQuorumErrs(ctx, errs, objectOpIgnoredErrs, writeQuorum); err != nil {
-			return f, err
-		}
-		s.disks = evalDisks(s.disks, errs)
-		f.Size += int64(n)
-	}
-
-	f.Algorithm = algorithm
-	for i, disk := range s.disks {
-		if disk == OfflineDisk {
+	for i := range p.writers {
+		if p.writers[i] == nil {
+			p.errs[i] = errDiskNotFound
 			continue
 		}
-		f.Checksums[i] = hashers[i].Sum(nil)
+
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			p.errs[i] = p.writers[i].Append(blocks[i])
+			if p.errs[i] != nil {
+				p.writers[i] = nil
+			}
+		}(i)
 	}
-	return f, nil
+	wg.Wait()
+
+	// If nilCount >= p.writeQuorum, we return nil. This is because HealFile() uses
+	// CreateFile with p.writeQuorum=1 to accommodate healing of single disk.
+	// i.e if we do no return here in such a case, reduceWriteQuorumErrs() would
+	// return a quorum error to HealFile().
+	nilCount := 0
+	for _, err := range p.errs {
+		if err == nil {
+			nilCount++
+		}
+	}
+	if nilCount >= p.writeQuorum {
+		return nil
+	}
+	return reduceWriteQuorumErrs(ctx, p.errs, objectOpIgnoredErrs, p.writeQuorum)
 }
 
-// erasureAppendFile appends the content of buf to the file on the given disk and updates computes
-// the hash of the written data. It sends the write error (or nil) over the error channel.
-func erasureAppendFile(ctx context.Context, disk StorageAPI, volume, path string, hash hash.Hash, buf []byte, errChan chan<- error) {
-	if disk == OfflineDisk {
-		logger.LogIf(ctx, errDiskNotFound)
-		errChan <- errDiskNotFound
-		return
+// CreateFile reads from the reader, erasure-encodes the data and writes to the writers.
+func (s *ErasureStorage) CreateFile(ctx context.Context, src io.Reader, writers []*bitrotWriter, buf []byte, quorum int) (total int64, err error) {
+	writer := &parallelWriter{
+		writers:     writers,
+		writeQuorum: quorum,
+		errs:        make([]error, len(writers)),
 	}
-	err := disk.AppendFile(volume, path, buf)
-	if err != nil {
-		errChan <- err
-		return
+
+	for {
+		var blocks [][]byte
+		n, err := io.ReadFull(src, buf)
+		if err != nil && err != io.EOF && err != io.ErrUnexpectedEOF {
+			logger.LogIf(ctx, err)
+			return 0, err
+		}
+		eof := err == io.EOF || err == io.ErrUnexpectedEOF
+		if n == 0 && total != 0 {
+			// Reached EOF, nothing more to be done.
+			break
+		}
+		// We take care of the situation where if n == 0 and total == 0 by creating empty data and parity files.
+		blocks, err = s.ErasureEncode(ctx, buf[:n])
+		if err != nil {
+			logger.LogIf(ctx, err)
+			return 0, err
+		}
+
+		if err = writer.Append(ctx, blocks); err != nil {
+			logger.LogIf(ctx, err)
+			return 0, err
+		}
+		total += int64(n)
+		if eof {
+			break
+		}
 	}
-	hash.Write(buf)
-	errChan <- err
+	return total, nil
 }

cmd/erasure-createfile_test.go

@@ -54,15 +54,14 @@ var erasureCreateFileTests = []struct {
 	{dataBlocks: 7, onDisks: 14, offDisks: 7, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 0, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: true},                 // 9
 	{dataBlocks: 8, onDisks: 16, offDisks: 8, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 0, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: true},                 // 10
 	{dataBlocks: 5, onDisks: 10, offDisks: 3, blocksize: int64(oneMiByte), data: oneMiByte, offset: 0, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},                  // 11
-	{dataBlocks: 6, onDisks: 12, offDisks: 5, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 102, algorithm: 0, shouldFail: true, shouldFailQuorum: false},                                    // 12
-	{dataBlocks: 3, onDisks: 6, offDisks: 1, blocksize: int64(blockSizeV1), data: oneMiByte, offset: oneMiByte / 2, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},     // 13
-	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(oneMiByte / 2), data: oneMiByte, offset: oneMiByte/2 + 1, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false}, // 14
-	{dataBlocks: 4, onDisks: 8, offDisks: 0, blocksize: int64(oneMiByte - 1), data: oneMiByte, offset: oneMiByte - 1, algorithm: BLAKE2b512, shouldFail: false, shouldFailQuorum: false},               // 15
-	{dataBlocks: 8, onDisks: 12, offDisks: 2, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 2, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},                // 16
-	{dataBlocks: 8, onDisks: 10, offDisks: 1, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 0, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},                // 17
-	{dataBlocks: 10, onDisks: 14, offDisks: 0, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 17, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},              // 18
-	{dataBlocks: 2, onDisks: 6, offDisks: 2, blocksize: int64(oneMiByte), data: oneMiByte, offset: oneMiByte / 2, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},       // 19
-	{dataBlocks: 10, onDisks: 16, offDisks: 8, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 0, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: true},                // 20
+	{dataBlocks: 3, onDisks: 6, offDisks: 1, blocksize: int64(blockSizeV1), data: oneMiByte, offset: oneMiByte / 2, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},     // 12
+	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(oneMiByte / 2), data: oneMiByte, offset: oneMiByte/2 + 1, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false}, // 13
+	{dataBlocks: 4, onDisks: 8, offDisks: 0, blocksize: int64(oneMiByte - 1), data: oneMiByte, offset: oneMiByte - 1, algorithm: BLAKE2b512, shouldFail: false, shouldFailQuorum: false},               // 14
+	{dataBlocks: 8, onDisks: 12, offDisks: 2, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 2, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},                // 15
+	{dataBlocks: 8, onDisks: 10, offDisks: 1, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 0, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},                // 16
+	{dataBlocks: 10, onDisks: 14, offDisks: 0, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 17, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},              // 17
+	{dataBlocks: 2, onDisks: 6, offDisks: 2, blocksize: int64(oneMiByte), data: oneMiByte, offset: oneMiByte / 2, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},       // 18
+	{dataBlocks: 10, onDisks: 16, offDisks: 8, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 0, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: true},                // 19
 }
 
 func TestErasureCreateFile(t *testing.T) {
@@ -71,7 +70,8 @@ func TestErasureCreateFile(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Test %d: failed to create test setup: %v", i, err)
 		}
-		storage, err := NewErasureStorage(context.Background(), setup.disks, test.dataBlocks, test.onDisks-test.dataBlocks, test.blocksize)
+		disks := setup.disks
+		storage, err := NewErasureStorage(context.Background(), test.dataBlocks, test.onDisks-test.dataBlocks, test.blocksize)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create ErasureStorage: %v", i, err)
@@ -83,25 +83,43 @@ func TestErasureCreateFile(t *testing.T) {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to generate random test data: %v", i, err)
 		}
-		file, err := storage.CreateFile(context.Background(), bytes.NewReader(data[test.offset:]), "testbucket", "object", buffer, test.algorithm, test.dataBlocks+1)
+		writers := make([]*bitrotWriter, len(disks))
+		for i, disk := range disks {
+			if disk == OfflineDisk {
+				continue
+			}
+			writers[i] = newBitrotWriter(disk, "testbucket", "object", test.algorithm)
+		}
+		n, err := storage.CreateFile(context.Background(), bytes.NewReader(data[test.offset:]), writers, buffer, storage.dataBlocks+1)
 		if err != nil && !test.shouldFail {
 			t.Errorf("Test %d: should pass but failed with: %v", i, err)
 		}
 		if err == nil && test.shouldFail {
 			t.Errorf("Test %d: should fail but it passed", i)
 		}
-
-		if err == nil {
-			if length := int64(len(data[test.offset:])); file.Size != length {
-				t.Errorf("Test %d: invalid number of bytes written: got: #%d want #%d", i, file.Size, length)
+		for i, w := range writers {
+			if w == nil {
+				disks[i] = OfflineDisk
 			}
-			for j := range storage.disks[:test.offDisks] {
-				storage.disks[j] = badDisk{nil}
+		}
+		if err == nil {
+			if length := int64(len(data[test.offset:])); n != length {
+				t.Errorf("Test %d: invalid number of bytes written: got: #%d want #%d", i, n, length)
+			}
+			writers := make([]*bitrotWriter, len(disks))
+			for i, disk := range disks {
+				if disk == nil {
+					continue
+				}
+				writers[i] = newBitrotWriter(disk, "testbucket", "object2", test.algorithm)
+			}
+			for j := range disks[:test.offDisks] {
+				writers[j].disk = badDisk{nil}
 			}
 			if test.offDisks > 0 {
-				storage.disks[0] = OfflineDisk
+				writers[0] = nil
 			}
-			file, err = storage.CreateFile(context.Background(), bytes.NewReader(data[test.offset:]), "testbucket", "object2", buffer, test.algorithm, test.dataBlocks+1)
+			n, err = storage.CreateFile(context.Background(), bytes.NewReader(data[test.offset:]), writers, buffer, storage.dataBlocks+1)
 			if err != nil && !test.shouldFailQuorum {
 				t.Errorf("Test %d: should pass but failed with: %v", i, err)
 			}
@@ -109,8 +127,8 @@ func TestErasureCreateFile(t *testing.T) {
 				t.Errorf("Test %d: should fail but it passed", i)
 			}
 			if err == nil {
-				if length := int64(len(data[test.offset:])); file.Size != length {
-					t.Errorf("Test %d: invalid number of bytes written: got: #%d want #%d", i, file.Size, length)
+				if length := int64(len(data[test.offset:])); n != length {
+					t.Errorf("Test %d: invalid number of bytes written: got: #%d want #%d", i, n, length)
 				}
 			}
 		}
@@ -126,25 +144,33 @@ func benchmarkErasureWrite(data, parity, dataDown, parityDown int, size int64, b
 		b.Fatalf("failed to create test setup: %v", err)
 	}
 	defer setup.Remove()
-	storage, err := NewErasureStorage(context.Background(), setup.disks, data, parity, blockSizeV1)
+	storage, err := NewErasureStorage(context.Background(), data, parity, blockSizeV1)
 	if err != nil {
 		b.Fatalf("failed to create ErasureStorage: %v", err)
 	}
+	disks := setup.disks
 	buffer := make([]byte, blockSizeV1, 2*blockSizeV1)
 	content := make([]byte, size)
 
 	for i := 0; i < dataDown; i++ {
-		storage.disks[i] = OfflineDisk
+		disks[i] = OfflineDisk
 	}
 	for i := data; i < data+parityDown; i++ {
-		storage.disks[i] = OfflineDisk
+		disks[i] = OfflineDisk
 	}
 
 	b.ResetTimer()
 	b.SetBytes(size)
 	b.ReportAllocs()
 	for i := 0; i < b.N; i++ {
-		_, err := storage.CreateFile(context.Background(), bytes.NewReader(content), "testbucket", "object", buffer, DefaultBitrotAlgorithm, data+1)
+		writers := make([]*bitrotWriter, len(disks))
+		for i, disk := range disks {
+			if disk == OfflineDisk {
+				continue
+			}
+			writers[i] = newBitrotWriter(disk, "testbucket", "object", DefaultBitrotAlgorithm)
+		}
+		_, err := storage.CreateFile(context.Background(), bytes.NewReader(content), writers, buffer, storage.dataBlocks+1)
 		if err != nil {
 			panic(err)
 		}

cmd/erasure-healfile.go

@@ -18,171 +18,31 @@ package cmd
 
 import (
 	"context"
-	"fmt"
-	"hash"
-	"strings"
+	"io"
 
 	"github.com/minio/minio/cmd/logger"
 )
 
-// HealFile tries to reconstruct an erasure-coded file spread over all
-// available disks. HealFile will read the valid parts of the file,
-// reconstruct the missing data and write the reconstructed parts back
-// to `staleDisks` at the destination `dstVol/dstPath/`. Parts are
-// verified against the given BitrotAlgorithm and checksums.
-//
-// `staleDisks` is a slice of disks where each non-nil entry has stale
-// or no data, and so will be healed.
-//
-// It is required that `s.disks` have a (read-quorum) majority of
-// disks with valid data for healing to work.
-//
-// In addition, `staleDisks` and `s.disks` must have the same ordering
-// of disks w.r.t. erasure coding of the object.
-//
-// Errors when writing to `staleDisks` are not propagated as long as
-// writes succeed for at least one disk. This allows partial healing
-// despite stale disks being faulty.
-//
-// It returns bitrot checksums for the non-nil staleDisks on which
-// healing succeeded.
-func (s ErasureStorage) HealFile(ctx context.Context, staleDisks []StorageAPI, volume, path string, blocksize int64,
-	dstVol, dstPath string, size int64, alg BitrotAlgorithm, checksums [][]byte) (
-	f ErasureFileInfo, err error) {
-
-	if !alg.Available() {
-		logger.LogIf(ctx, errBitrotHashAlgoInvalid)
-		return f, errBitrotHashAlgoInvalid
-	}
-
-	// Initialization
-	f.Checksums = make([][]byte, len(s.disks))
-	hashers := make([]hash.Hash, len(s.disks))
-	verifiers := make([]*BitrotVerifier, len(s.disks))
-	for i, disk := range s.disks {
-		switch {
-		case staleDisks[i] != nil:
-			hashers[i] = alg.New()
-		case disk == nil:
-			// disregard unavailable disk
-			continue
-		default:
-			verifiers[i] = NewBitrotVerifier(alg, checksums[i])
+// HealFile heals the shard files on non-nil writers. Note that the quorum passed is 1
+// as healing should continue even if it has been successful healing only one shard file.
+func (s ErasureStorage) HealFile(ctx context.Context, readers []*bitrotReader, writers []*bitrotWriter, size int64) error {
+	r, w := io.Pipe()
+	go func() {
+		if err := s.ReadFile(ctx, w, readers, 0, size, size); err != nil {
+			w.CloseWithError(err)
+			return
 		}
-	}
-	writeErrors := make([]error, len(s.disks))
-
-	// Read part file data on each disk
-	chunksize := ceilFrac(blocksize, int64(s.dataBlocks))
-	numBlocks := ceilFrac(size, blocksize)
-
-	readLen := chunksize * (numBlocks - 1)
-
-	lastChunkSize := chunksize
-	hasSmallerLastBlock := size%blocksize != 0
-	if hasSmallerLastBlock {
-		lastBlockLen := size % blocksize
-		lastChunkSize = ceilFrac(lastBlockLen, int64(s.dataBlocks))
-	}
-	readLen += lastChunkSize
-	var buffers [][]byte
-	buffers, _, err = s.readConcurrent(ctx, volume, path, 0, readLen, verifiers)
+		w.Close()
+	}()
+	buf := make([]byte, s.blockSize)
+	// quorum is 1 because CreateFile should continue writing as long as we are writing to even 1 disk.
+	n, err := s.CreateFile(ctx, r, writers, buf, 1)
 	if err != nil {
-		return f, err
+		return err
 	}
-
-	// Scan part files on disk, block-by-block reconstruct it and
-	// write to stale disks.
-	blocks := make([][]byte, len(s.disks))
-
-	if numBlocks > 1 {
-		// Allocate once for all the equal length blocks. The
-		// last block may have a different length - allocation
-		// for this happens inside the for loop below.
-		for i := range blocks {
-			if len(buffers[i]) == 0 {
-				blocks[i] = make([]byte, chunksize)
-			}
-		}
+	if n != size {
+		logger.LogIf(ctx, errLessData)
+		return errLessData
 	}
-
-	var buffOffset int64
-	for blockNumber := int64(0); blockNumber < numBlocks; blockNumber++ {
-		if blockNumber == numBlocks-1 && lastChunkSize != chunksize {
-			for i := range blocks {
-				if len(buffers[i]) == 0 {
-					blocks[i] = make([]byte, lastChunkSize)
-				}
-			}
-		}
-
-		for i := range blocks {
-			if len(buffers[i]) == 0 {
-				blocks[i] = blocks[i][0:0]
-			}
-		}
-
-		csize := chunksize
-		if blockNumber == numBlocks-1 {
-			csize = lastChunkSize
-		}
-		for i := range blocks {
-			if len(buffers[i]) != 0 {
-				blocks[i] = buffers[i][buffOffset : buffOffset+csize]
-			}
-		}
-		buffOffset += csize
-
-		if err = s.ErasureDecodeDataAndParityBlocks(ctx, blocks); err != nil {
-			return f, err
-		}
-
-		// write computed shards as chunks on file in each
-		// stale disk
-		writeSucceeded := false
-		for i, disk := range staleDisks {
-			// skip nil disk or disk that had error on
-			// previous write
-			if disk == nil || writeErrors[i] != nil {
-				continue
-			}
-
-			writeErrors[i] = disk.AppendFile(dstVol, dstPath, blocks[i])
-			if writeErrors[i] == nil {
-				hashers[i].Write(blocks[i])
-				writeSucceeded = true
-			}
-		}
-
-		// If all disks had write errors we quit.
-		if !writeSucceeded {
-			// build error from all write errors
-			err := joinWriteErrors(writeErrors)
-			logger.LogIf(ctx, err)
-			return f, err
-		}
-	}
-
-	// copy computed file hashes into output variable
-	f.Size = size
-	f.Algorithm = alg
-	for i, disk := range staleDisks {
-		if disk == nil || writeErrors[i] != nil {
-			continue
-		}
-		f.Checksums[i] = hashers[i].Sum(nil)
-	}
-	return f, nil
-}
-
-func joinWriteErrors(errs []error) error {
-	msgs := []string{}
-	for i, err := range errs {
-		if err == nil {
-			continue
-		}
-		msgs = append(msgs, fmt.Sprintf("disk %d: %v", i+1, err))
-	}
-	return fmt.Errorf("all stale disks had write errors during healing: %s",
-		strings.Join(msgs, ", "))
+	return nil
 }

cmd/erasure-healfile_test.go

@@ -21,7 +21,6 @@ import (
 	"context"
 	"crypto/rand"
 	"io"
-	"reflect"
 	"testing"
 )
 
@@ -56,11 +55,9 @@ var erasureHealFileTests = []struct {
 	{dataBlocks: 7, disks: 14, offDisks: 6, badDisks: 1, badStaleDisks: 0, blocksize: int64(blockSizeV1), size: oneMiByte, algorithm: DefaultBitrotAlgorithm, shouldFail: false},  // 14
 	{dataBlocks: 8, disks: 16, offDisks: 4, badDisks: 5, badStaleDisks: 0, blocksize: int64(blockSizeV1), size: oneMiByte, algorithm: DefaultBitrotAlgorithm, shouldFail: true},   // 15
 	{dataBlocks: 2, disks: 4, offDisks: 1, badDisks: 0, badStaleDisks: 0, blocksize: int64(blockSizeV1), size: oneMiByte, algorithm: DefaultBitrotAlgorithm, shouldFail: false},   // 16
-	{dataBlocks: 2, disks: 4, offDisks: 0, badDisks: 0, badStaleDisks: 0, blocksize: int64(blockSizeV1), size: oneMiByte, algorithm: 0, shouldFail: true},                         // 17
-	{dataBlocks: 12, disks: 16, offDisks: 2, badDisks: 1, badStaleDisks: 0, blocksize: int64(blockSizeV1), size: oneMiByte, algorithm: DefaultBitrotAlgorithm, shouldFail: false}, // 18
-	{dataBlocks: 6, disks: 8, offDisks: 1, badDisks: 0, badStaleDisks: 0, blocksize: int64(blockSizeV1), size: oneMiByte, algorithm: BLAKE2b512, shouldFail: false},               // 19
-	{dataBlocks: 7, disks: 10, offDisks: 1, badDisks: 0, badStaleDisks: 0, blocksize: int64(blockSizeV1), size: oneMiByte, algorithm: 0, shouldFail: true},                        // 20
-	{dataBlocks: 2, disks: 4, offDisks: 1, badDisks: 0, badStaleDisks: 0, blocksize: int64(blockSizeV1), size: oneMiByte * 64, algorithm: SHA256, shouldFail: false},              // 21
+	{dataBlocks: 12, disks: 16, offDisks: 2, badDisks: 1, badStaleDisks: 0, blocksize: int64(blockSizeV1), size: oneMiByte, algorithm: DefaultBitrotAlgorithm, shouldFail: false}, // 17
+	{dataBlocks: 6, disks: 8, offDisks: 1, badDisks: 0, badStaleDisks: 0, blocksize: int64(blockSizeV1), size: oneMiByte, algorithm: BLAKE2b512, shouldFail: false},               // 18
+	{dataBlocks: 2, disks: 4, offDisks: 1, badDisks: 0, badStaleDisks: 0, blocksize: int64(blockSizeV1), size: oneMiByte * 64, algorithm: SHA256, shouldFail: false},              // 19
 }
 
 func TestErasureHealFile(t *testing.T) {
@@ -75,7 +72,8 @@ func TestErasureHealFile(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Test %d: failed to setup XL environment: %v", i, err)
 		}
-		storage, err := NewErasureStorage(context.Background(), setup.disks, test.dataBlocks, test.disks-test.dataBlocks, test.blocksize)
+		disks := setup.disks
+		storage, err := NewErasureStorage(context.Background(), test.dataBlocks, test.disks-test.dataBlocks, test.blocksize)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create ErasureStorage: %v", i, err)
@@ -85,36 +83,50 @@ func TestErasureHealFile(t *testing.T) {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create random test data: %v", i, err)
 		}
-		algorithm := test.algorithm
-		if !algorithm.Available() {
-			algorithm = DefaultBitrotAlgorithm
-		}
 		buffer := make([]byte, test.blocksize, 2*test.blocksize)
-		file, err := storage.CreateFile(context.Background(), bytes.NewReader(data), "testbucket", "testobject", buffer, algorithm, test.dataBlocks+1)
+		writers := make([]*bitrotWriter, len(disks))
+		for i, disk := range disks {
+			writers[i] = newBitrotWriter(disk, "testbucket", "testobject", test.algorithm)
+		}
+		_, err = storage.CreateFile(context.Background(), bytes.NewReader(data), writers, buffer, storage.dataBlocks+1)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create random test data: %v", i, err)
 		}
 
+		readers := make([]*bitrotReader, len(disks))
+		for i, disk := range disks {
+			shardFilesize := getErasureShardFileSize(test.blocksize, test.size, storage.dataBlocks)
+			readers[i] = newBitrotReader(disk, "testbucket", "testobject", test.algorithm, shardFilesize, writers[i].Sum())
+		}
+
 		// setup stale disks for the test case
-		staleDisks := make([]StorageAPI, len(storage.disks))
-		copy(staleDisks, storage.disks)
-		for j := 0; j < len(storage.disks); j++ {
+		staleDisks := make([]StorageAPI, len(disks))
+		copy(staleDisks, disks)
+		for j := 0; j < len(staleDisks); j++ {
 			if j < test.offDisks {
-				storage.disks[j] = OfflineDisk
+				readers[j] = nil
 			} else {
 				staleDisks[j] = nil
 			}
 		}
 		for j := 0; j < test.badDisks; j++ {
-			storage.disks[test.offDisks+j] = badDisk{nil}
+			readers[test.offDisks+j].disk = badDisk{nil}
 		}
 		for j := 0; j < test.badStaleDisks; j++ {
 			staleDisks[j] = badDisk{nil}
 		}
 
+		staleWriters := make([]*bitrotWriter, len(staleDisks))
+		for i, disk := range staleDisks {
+			if disk == nil {
+				continue
+			}
+			staleWriters[i] = newBitrotWriter(disk, "testbucket", "testobject", test.algorithm)
+		}
+
 		// test case setup is complete - now call Healfile()
-		info, err := storage.HealFile(context.Background(), staleDisks, "testbucket", "testobject", test.blocksize, "testbucket", "healedobject", test.size, test.algorithm, file.Checksums)
+		err = storage.HealFile(context.Background(), readers, staleWriters, test.size)
 		if err != nil && !test.shouldFail {
 			t.Errorf("Test %d: should pass but it failed with: %v", i, err)
 		}
@@ -122,19 +134,13 @@ func TestErasureHealFile(t *testing.T) {
 			t.Errorf("Test %d: should fail but it passed", i)
 		}
 		if err == nil {
-			if info.Size != test.size {
-				t.Errorf("Test %d: healed wrong number of bytes: got: #%d want: #%d", i, info.Size, test.size)
-			}
-			if info.Algorithm != test.algorithm {
-				t.Errorf("Test %d: healed with wrong algorithm: got: %v want: %v", i, info.Algorithm, test.algorithm)
-			}
 			// Verify that checksums of staleDisks
 			// match expected values
-			for i, disk := range staleDisks {
-				if disk == nil || info.Checksums[i] == nil {
+			for i := range staleWriters {
+				if staleWriters[i] == nil {
 					continue
 				}
-				if !reflect.DeepEqual(info.Checksums[i], file.Checksums[i]) {
+				if !bytes.Equal(staleWriters[i].Sum(), writers[i].Sum()) {
 					t.Errorf("Test %d: heal returned different bitrot checksums", i)
 				}
 			}

cmd/erasure-readfile.go

@@ -23,214 +23,166 @@ import (
 	"github.com/minio/minio/cmd/logger"
 )
 
-type errIdx struct {
-	idx int
-	err error
+// Reads in parallel from bitrotReaders.
+type parallelReader struct {
+	readers       []*bitrotReader
+	dataBlocks    int
+	offset        int64
+	shardSize     int64
+	shardFileSize int64
 }
 
-func (s ErasureStorage) readConcurrent(ctx context.Context, volume, path string, offset, length int64,
-	verifiers []*BitrotVerifier) (buffers [][]byte, needsReconstruction bool,
-	err error) {
+// newParallelReader returns parallelReader.
+func newParallelReader(readers []*bitrotReader, dataBlocks int, offset int64, fileSize int64, blocksize int64) *parallelReader {
+	shardSize := ceilFrac(blocksize, int64(dataBlocks))
+	shardFileSize := getErasureShardFileSize(blocksize, fileSize, dataBlocks)
+	return &parallelReader{
+		readers,
+		dataBlocks,
+		(offset / blocksize) * shardSize,
+		shardSize,
+		shardFileSize,
+	}
+}
 
-	errChan := make(chan errIdx)
-	stageBuffers := make([][]byte, len(s.disks))
-	buffers = make([][]byte, len(s.disks))
-
-	readDisk := func(i int) {
-		stageBuffers[i] = make([]byte, length)
-		disk := s.disks[i]
-		if disk == OfflineDisk {
-			logger.LogIf(ctx, errDiskNotFound)
-			errChan <- errIdx{i, errDiskNotFound}
-			return
+// Returns if buf can be erasure decoded.
+func (p *parallelReader) canDecode(buf [][]byte) bool {
+	bufCount := 0
+	for _, b := range buf {
+		if b != nil {
+			bufCount++
 		}
-		_, rerr := disk.ReadFile(volume, path, offset, stageBuffers[i], verifiers[i])
-		errChan <- errIdx{i, rerr}
+	}
+	return bufCount >= p.dataBlocks
+}
+
+// Read reads from bitrotReaders in parallel. Returns p.dataBlocks number of bufs.
+func (p *parallelReader) Read() ([][]byte, error) {
+	type errIdx struct {
+		idx int
+		buf []byte
+		err error
 	}
 
-	var finishedCount, successCount, launchIndex int
+	errCh := make(chan errIdx)
+	currReaderIndex := 0
+	newBuf := make([][]byte, len(p.readers))
 
-	for ; launchIndex < s.dataBlocks; launchIndex++ {
-		go readDisk(launchIndex)
+	if p.offset+p.shardSize > p.shardFileSize {
+		p.shardSize = p.shardFileSize - p.offset
 	}
-	for finishedCount < launchIndex {
-		select {
-		case errVal := <-errChan:
-			finishedCount++
-			if errVal.err != nil {
-				// TODO: meaningfully log the disk read error
 
-				// A disk failed to return data, so we
-				// request an additional disk if possible
-				if launchIndex < s.dataBlocks+s.parityBlocks {
-					needsReconstruction = true
-					// requiredBlocks++
-					go readDisk(launchIndex)
-					launchIndex++
-				}
-			} else {
-				successCount++
-				buffers[errVal.idx] = stageBuffers[errVal.idx]
-				stageBuffers[errVal.idx] = nil
+	read := func(currReaderIndex int) {
+		b, err := p.readers[currReaderIndex].ReadChunk(p.offset, p.shardSize)
+		errCh <- errIdx{currReaderIndex, b, err}
+	}
+
+	readerCount := 0
+	for _, r := range p.readers {
+		if r != nil {
+			readerCount++
+		}
+	}
+	if readerCount < p.dataBlocks {
+		return nil, errXLReadQuorum
+	}
+
+	readerCount = 0
+	for i, r := range p.readers {
+		if r == nil {
+			continue
+		}
+		go read(i)
+		readerCount++
+		if readerCount == p.dataBlocks {
+			currReaderIndex = i + 1
+			break
+		}
+	}
+
+	for errVal := range errCh {
+		if errVal.err == nil {
+			newBuf[errVal.idx] = errVal.buf
+			if p.canDecode(newBuf) {
+				p.offset += int64(p.shardSize)
+				return newBuf, nil
 			}
+			continue
 		}
+		p.readers[errVal.idx] = nil
+		for currReaderIndex < len(p.readers) {
+			if p.readers[currReaderIndex] != nil {
+				break
+			}
+			currReaderIndex++
+		}
+
+		if currReaderIndex == len(p.readers) {
+			break
+		}
+		go read(currReaderIndex)
+		currReaderIndex++
 	}
-	if successCount != s.dataBlocks {
-		// Not enough disks returns data.
-		err = errXLReadQuorum
-		logger.LogIf(ctx, err)
-	}
-	return
+
+	return nil, errXLReadQuorum
 }
 
-// ReadFile reads as much data as requested from the file under the
-// given volume and path and writes the data to the provided writer.
-// The algorithm and the keys/checksums are used to verify the
-// integrity of the given file. ReadFile will read data from the given
-// offset up to the given length. If parts of the file are corrupted
-// ReadFile tries to reconstruct the data.
-func (s ErasureStorage) ReadFile(ctx context.Context, writer io.Writer, volume, path string, offset,
-	length, totalLength int64, checksums [][]byte, algorithm BitrotAlgorithm,
-	blocksize int64) (f ErasureFileInfo, err error) {
-
+// ReadFile reads from readers, reconstructs data if needed and writes the data to the writer.
+func (s ErasureStorage) ReadFile(ctx context.Context, writer io.Writer, readers []*bitrotReader, offset, length, totalLength int64) error {
 	if offset < 0 || length < 0 {
-		logger.LogIf(ctx, errUnexpected)
-		return f, errUnexpected
+		logger.LogIf(ctx, errInvalidArgument)
+		return errInvalidArgument
 	}
 	if offset+length > totalLength {
-		logger.LogIf(ctx, errUnexpected)
-		return f, errUnexpected
+		logger.LogIf(ctx, errInvalidArgument)
+		return errInvalidArgument
 	}
-	if !algorithm.Available() {
-		logger.LogIf(ctx, errBitrotHashAlgoInvalid)
-		return f, errBitrotHashAlgoInvalid
-	}
-
-	f.Checksums = make([][]byte, len(s.disks))
-	verifiers := make([]*BitrotVerifier, len(s.disks))
-	for i, disk := range s.disks {
-		if disk == OfflineDisk {
-			continue
-		}
-		verifiers[i] = NewBitrotVerifier(algorithm, checksums[i])
-	}
-
-	chunksize := ceilFrac(blocksize, int64(s.dataBlocks))
-
-	// We read all whole-blocks of erasure coded data containing
-	// the requested data range.
-	//
-	// The start index of the erasure coded block containing the
-	// `offset` byte of data is:
-	partDataStartIndex := (offset / blocksize) * chunksize
-	// The start index of the erasure coded block containing the
-	// (last) byte of data at the index `offset + length - 1` is:
-	blockStartIndex := ((offset + length - 1) / blocksize) * chunksize
-	// However, we need the end index of the e.c. block containing
-	// the last byte - we need to check if that block is the last
-	// block in the part (in that case, it may be have a different
-	// chunk size)
-	isLastBlock := (totalLength-1)/blocksize == (offset+length-1)/blocksize
-	var partDataEndIndex int64
-	if isLastBlock {
-		lastBlockChunkSize := chunksize
-		if totalLength%blocksize != 0 {
-			lastBlockChunkSize = ceilFrac(totalLength%blocksize, int64(s.dataBlocks))
-		}
-		partDataEndIndex = blockStartIndex + lastBlockChunkSize - 1
-	} else {
-		partDataEndIndex = blockStartIndex + chunksize - 1
-	}
-
-	// Thus, the length of data to be read from the part file(s) is:
-	partDataLength := partDataEndIndex - partDataStartIndex + 1
-	// The calculation above does not apply when length == 0:
 	if length == 0 {
-		partDataLength = 0
+		return nil
 	}
 
-	var buffers [][]byte
-	var needsReconstruction bool
-	buffers, needsReconstruction, err = s.readConcurrent(ctx, volume, path,
-		partDataStartIndex, partDataLength, verifiers)
-	if err != nil {
-		// Could not read enough disks.
-		return
-	}
+	reader := newParallelReader(readers, s.dataBlocks, offset, totalLength, s.blockSize)
 
-	numChunks := ceilFrac(partDataLength, chunksize)
-	blocks := make([][]byte, len(s.disks))
+	startBlock := offset / s.blockSize
+	endBlock := (offset + length) / s.blockSize
 
-	if needsReconstruction && numChunks > 1 {
-		// Allocate once for all the equal length blocks. The
-		// last block may have a different length - allocation
-		// for this happens inside the for loop below.
-		for i := range blocks {
-			if len(buffers[i]) == 0 {
-				blocks[i] = make([]byte, chunksize)
-			}
+	var bytesWritten int64
+	for block := startBlock; block <= endBlock; block++ {
+		var blockOffset, blockLength int64
+		switch {
+		case startBlock == endBlock:
+			blockOffset = offset % s.blockSize
+			blockLength = length
+		case block == startBlock:
+			blockOffset = offset % s.blockSize
+			blockLength = s.blockSize - blockOffset
+		case block == endBlock:
+			blockOffset = 0
+			blockLength = (offset + length) % s.blockSize
+		default:
+			blockOffset = 0
+			blockLength = s.blockSize
 		}
-	}
-
-	var buffOffset int64
-	for chunkNumber := int64(0); chunkNumber < numChunks; chunkNumber++ {
-		if chunkNumber == numChunks-1 && partDataLength%chunksize != 0 {
-			chunksize = partDataLength % chunksize
-			// We allocate again as the last chunk has a
-			// different size.
-			for i := range blocks {
-				if len(buffers[i]) == 0 {
-					blocks[i] = make([]byte, chunksize)
-				}
-			}
+		if blockLength == 0 {
+			break
 		}
-
-		for i := range blocks {
-			if len(buffers[i]) == 0 {
-				blocks[i] = blocks[i][0:0]
-			}
-		}
-
-		for i := range blocks {
-			if len(buffers[i]) != 0 {
-				blocks[i] = buffers[i][buffOffset : buffOffset+chunksize]
-			}
-		}
-		buffOffset += chunksize
-
-		if needsReconstruction {
-			if err = s.ErasureDecodeDataBlocks(blocks); err != nil {
-				logger.LogIf(ctx, err)
-				return f, err
-			}
-		}
-
-		var writeStart int64
-		if chunkNumber == 0 {
-			writeStart = offset % blocksize
-		}
-
-		writeLength := blocksize - writeStart
-		if chunkNumber == numChunks-1 {
-			lastBlockLength := (offset + length) % blocksize
-			if lastBlockLength != 0 {
-				writeLength = lastBlockLength - writeStart
-			}
-		}
-		n, err := writeDataBlocks(ctx, writer, blocks, s.dataBlocks, writeStart, writeLength)
+		bufs, err := reader.Read()
 		if err != nil {
-			return f, err
+			return err
 		}
-
-		f.Size += n
-	}
-
-	f.Algorithm = algorithm
-	for i, disk := range s.disks {
-		if disk == OfflineDisk || buffers[i] == nil {
-			continue
+		if err = s.ErasureDecodeDataBlocks(bufs); err != nil {
+			logger.LogIf(ctx, err)
+			return err
 		}
-		f.Checksums[i] = verifiers[i].Sum(nil)
+		n, err := writeDataBlocks(ctx, writer, bufs, s.dataBlocks, blockOffset, blockLength)
+		if err != nil {
+			return err
+		}
+		bytesWritten += n
 	}
-	return f, nil
+	if bytesWritten != length {
+		logger.LogIf(ctx, errLessData)
+		return errLessData
+	}
+	return nil
 }

cmd/erasure-readfile_test.go

@@ -19,11 +19,12 @@ package cmd
 import (
 	"bytes"
 	"context"
-	crand "crypto/rand"
 	"io"
 	"math/rand"
 	"testing"
 
+	crand "crypto/rand"
+
 	humanize "github.com/dustin/go-humanize"
 )
 
@@ -66,19 +67,18 @@ var erasureReadFileTests = []struct {
 	{dataBlocks: 8, onDisks: 16, offDisks: 7, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 0, length: oneMiByte, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},                                            // 23
 	{dataBlocks: 2, onDisks: 4, offDisks: 1, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 0, length: oneMiByte, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},                                             // 24
 	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 0, length: oneMiByte, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},                                             // 25
-	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(blockSizeV1), data: oneMiByte, offset: 0, length: oneMiByte, algorithm: 0, shouldFail: true, shouldFailQuorum: false},                                                                   // 26
-	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(blockSizeV1) + 1, offset: 0, length: int64(blockSizeV1) + 1, algorithm: BLAKE2b512, shouldFail: false, shouldFailQuorum: false},                               // 27
-	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 12, length: int64(blockSizeV1) + 17, algorithm: BLAKE2b512, shouldFail: false, shouldFailQuorum: false},                             // 28
-	{dataBlocks: 3, onDisks: 6, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 1023, length: int64(blockSizeV1) + 1024, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},             // 29
-	{dataBlocks: 4, onDisks: 8, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 11, length: int64(blockSizeV1) + 2*1024, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},             // 30
-	{dataBlocks: 6, onDisks: 12, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 512, length: int64(blockSizeV1) + 8*1024, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},           // 31
-	{dataBlocks: 8, onDisks: 16, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: int64(blockSizeV1), length: int64(blockSizeV1) - 1, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false}, // 32
-	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(oneMiByte), offset: -1, length: 3, algorithm: DefaultBitrotAlgorithm, shouldFail: true, shouldFailQuorum: false},                                              // 33
-	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(oneMiByte), offset: 1024, length: -1, algorithm: DefaultBitrotAlgorithm, shouldFail: true, shouldFailQuorum: false},                                           // 34
-	{dataBlocks: 4, onDisks: 6, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(blockSizeV1), offset: 0, length: int64(blockSizeV1), algorithm: BLAKE2b512, shouldFail: false, shouldFailQuorum: false},                                       // 35
-	{dataBlocks: 4, onDisks: 6, offDisks: 1, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 12, length: int64(blockSizeV1) + 17, algorithm: BLAKE2b512, shouldFail: false, shouldFailQuorum: false},                             // 36
-	{dataBlocks: 4, onDisks: 6, offDisks: 3, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 1023, length: int64(blockSizeV1) + 1024, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: true},              // 37
-	{dataBlocks: 8, onDisks: 12, offDisks: 4, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 11, length: int64(blockSizeV1) + 2*1024, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},            // 38
+	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(blockSizeV1) + 1, offset: 0, length: int64(blockSizeV1) + 1, algorithm: BLAKE2b512, shouldFail: false, shouldFailQuorum: false},                               // 26
+	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 12, length: int64(blockSizeV1) + 17, algorithm: BLAKE2b512, shouldFail: false, shouldFailQuorum: false},                             // 27
+	{dataBlocks: 3, onDisks: 6, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 1023, length: int64(blockSizeV1) + 1024, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},             // 28
+	{dataBlocks: 4, onDisks: 8, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 11, length: int64(blockSizeV1) + 2*1024, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},             // 29
+	{dataBlocks: 6, onDisks: 12, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 512, length: int64(blockSizeV1) + 8*1024, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},           // 30
+	{dataBlocks: 8, onDisks: 16, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: int64(blockSizeV1), length: int64(blockSizeV1) - 1, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false}, // 31
+	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(oneMiByte), offset: -1, length: 3, algorithm: DefaultBitrotAlgorithm, shouldFail: true, shouldFailQuorum: false},                                              // 32
+	{dataBlocks: 2, onDisks: 4, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(oneMiByte), offset: 1024, length: -1, algorithm: DefaultBitrotAlgorithm, shouldFail: true, shouldFailQuorum: false},                                           // 33
+	{dataBlocks: 4, onDisks: 6, offDisks: 0, blocksize: int64(blockSizeV1), data: int64(blockSizeV1), offset: 0, length: int64(blockSizeV1), algorithm: BLAKE2b512, shouldFail: false, shouldFailQuorum: false},                                       // 34
+	{dataBlocks: 4, onDisks: 6, offDisks: 1, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 12, length: int64(blockSizeV1) + 17, algorithm: BLAKE2b512, shouldFail: false, shouldFailQuorum: false},                             // 35
+	{dataBlocks: 4, onDisks: 6, offDisks: 3, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 1023, length: int64(blockSizeV1) + 1024, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: true},              // 36
+	{dataBlocks: 8, onDisks: 12, offDisks: 4, blocksize: int64(blockSizeV1), data: int64(2 * blockSizeV1), offset: 11, length: int64(blockSizeV1) + 2*1024, algorithm: DefaultBitrotAlgorithm, shouldFail: false, shouldFailQuorum: false},            // 37
 }
 
 func TestErasureReadFile(t *testing.T) {
@@ -87,29 +87,54 @@ func TestErasureReadFile(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Test %d: failed to create test setup: %v", i, err)
 		}
-		storage, err := NewErasureStorage(context.Background(), setup.disks, test.dataBlocks, test.onDisks-test.dataBlocks, test.blocksize)
+		storage, err := NewErasureStorage(context.Background(), test.dataBlocks, test.onDisks-test.dataBlocks, test.blocksize)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create ErasureStorage: %v", i, err)
 		}
-
+		disks := setup.disks
 		data := make([]byte, test.data)
 		if _, err = io.ReadFull(crand.Reader, data); err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to generate random test data: %v", i, err)
 		}
+
 		writeAlgorithm := test.algorithm
 		if !test.algorithm.Available() {
 			writeAlgorithm = DefaultBitrotAlgorithm
 		}
 		buffer := make([]byte, test.blocksize, 2*test.blocksize)
-		file, err := storage.CreateFile(context.Background(), bytes.NewReader(data[:]), "testbucket", "object", buffer, writeAlgorithm, test.dataBlocks+1)
+		writers := make([]*bitrotWriter, len(disks))
+		for i, disk := range disks {
+			writers[i] = newBitrotWriter(disk, "testbucket", "object", writeAlgorithm)
+		}
+		n, err := storage.CreateFile(context.Background(), bytes.NewReader(data[:]), writers, buffer, storage.dataBlocks+1)
 		if err != nil {
 			setup.Remove()
 			t.Fatalf("Test %d: failed to create erasure test file: %v", i, err)
 		}
+		if n != test.data {
+			setup.Remove()
+			t.Fatalf("Test %d: failed to create erasure test file", i)
+		}
+		for i, w := range writers {
+			if w == nil {
+				disks[i] = nil
+			}
+		}
+
+		// Get the checksums of the current part.
+		bitrotReaders := make([]*bitrotReader, len(disks))
+		for index, disk := range disks {
+			if disk == OfflineDisk {
+				continue
+			}
+			endOffset := getErasureShardFileEndOffset(test.offset, test.length, test.data, test.blocksize, storage.dataBlocks)
+			bitrotReaders[index] = newBitrotReader(disk, "testbucket", "object", writeAlgorithm, endOffset, writers[index].Sum())
+		}
+
 		writer := bytes.NewBuffer(nil)
-		readInfo, err := storage.ReadFile(context.Background(), writer, "testbucket", "object", test.offset, test.length, test.data, file.Checksums, test.algorithm, test.blocksize)
+		err = storage.ReadFile(context.Background(), writer, bitrotReaders, test.offset, test.length, test.data)
 		if err != nil && !test.shouldFail {
 			t.Errorf("Test %d: should pass but failed with: %v", i, err)
 		}
@@ -117,25 +142,32 @@ func TestErasureReadFile(t *testing.T) {
 			t.Errorf("Test %d: should fail but it passed", i)
 		}
 		if err == nil {
-			if readInfo.Size != test.length {
-				t.Errorf("Test %d: read returns wrong number of bytes: got: #%d want: #%d", i, readInfo.Size, test.length)
-			}
-			if readInfo.Algorithm != test.algorithm {
-				t.Errorf("Test %d: read returns wrong algorithm: got: %v want: %v", i, readInfo.Algorithm, test.algorithm)
-			}
 			if content := writer.Bytes(); !bytes.Equal(content, data[test.offset:test.offset+test.length]) {
 				t.Errorf("Test %d: read retruns wrong file content", i)
 			}
 		}
+		for i, r := range bitrotReaders {
+			if r == nil {
+				disks[i] = OfflineDisk
+			}
+		}
 		if err == nil && !test.shouldFail {
-			writer.Reset()
-			for j := range storage.disks[:test.offDisks] {
-				storage.disks[j] = badDisk{nil}
+			bitrotReaders = make([]*bitrotReader, len(disks))
+			for index, disk := range disks {
+				if disk == OfflineDisk {
+					continue
+				}
+				endOffset := getErasureShardFileEndOffset(test.offset, test.length, test.data, test.blocksize, storage.dataBlocks)
+				bitrotReaders[index] = newBitrotReader(disk, "testbucket", "object", writeAlgorithm, endOffset, writers[index].Sum())
+			}
+			for j := range disks[:test.offDisks] {
+				bitrotReaders[j].disk = badDisk{nil}
 			}
 			if test.offDisks > 0 {
-				storage.disks[0] = OfflineDisk
+				bitrotReaders[0] = nil
 			}
-			readInfo, err = storage.ReadFile(context.Background(), writer, "testbucket", "object", test.offset, test.length, test.data, file.Checksums, test.algorithm, test.blocksize)
+			writer.Reset()
+			err = storage.ReadFile(context.Background(), writer, bitrotReaders, test.offset, test.length, test.data)
 			if err != nil && !test.shouldFailQuorum {
 				t.Errorf("Test %d: should pass but failed with: %v", i, err)
 			}
@@ -143,12 +175,6 @@ func TestErasureReadFile(t *testing.T) {
 				t.Errorf("Test %d: should fail but it passed", i)
 			}
 			if !test.shouldFailQuorum {
-				if readInfo.Size != test.length {
-					t.Errorf("Test %d: read returns wrong number of bytes: got: #%d want: #%d", i, readInfo.Size, test.length)
-				}
-				if readInfo.Algorithm != test.algorithm {
-					t.Errorf("Test %d: read returns wrong algorithm: got: %v want: %v", i, readInfo.Algorithm, test.algorithm)
-				}
 				if content := writer.Bytes(); !bytes.Equal(content, data[test.offset:test.offset+test.length]) {
 					t.Errorf("Test %d: read retruns wrong file content", i)
 				}
@@ -174,8 +200,8 @@ func TestErasureReadFileRandomOffsetLength(t *testing.T) {
 		return
 	}
 	defer setup.Remove()
-
-	storage, err := NewErasureStorage(context.Background(), setup.disks, dataBlocks, parityBlocks, blockSize)
+	disks := setup.disks
+	storage, err := NewErasureStorage(context.Background(), dataBlocks, parityBlocks, blockSize)
 	if err != nil {
 		t.Fatalf("failed to create ErasureStorage: %v", err)
 	}
@@ -187,17 +213,25 @@ func TestErasureReadFileRandomOffsetLength(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	writers := make([]*bitrotWriter, len(disks))
+	for i, disk := range disks {
+		if disk == nil {
+			continue
+		}
+		writers[i] = newBitrotWriter(disk, "testbucket", "object", DefaultBitrotAlgorithm)
+	}
+
 	// 10000 iterations with random offsets and lengths.
 	iterations := 10000
 
 	// Create a test file to read from.
 	buffer := make([]byte, blockSize, 2*blockSize)
-	file, err := storage.CreateFile(context.Background(), bytes.NewReader(data), "testbucket", "testobject", buffer, DefaultBitrotAlgorithm, dataBlocks+1)
+	n, err := storage.CreateFile(context.Background(), bytes.NewReader(data), writers, buffer, storage.dataBlocks+1)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if file.Size != length {
-		t.Errorf("erasureCreateFile returned %d, expected %d", file.Size, length)
+	if n != length {
+		t.Errorf("erasureCreateFile returned %d, expected %d", n, length)
 	}
 
 	// To generate random offset/length.
@@ -212,7 +246,16 @@ func TestErasureReadFileRandomOffsetLength(t *testing.T) {
 
 		expected := data[offset : offset+readLen]
 
-		_, err = storage.ReadFile(context.Background(), buf, "testbucket", "testobject", offset, readLen, length, file.Checksums, DefaultBitrotAlgorithm, blockSize)
+		// Get the checksums of the current part.
+		bitrotReaders := make([]*bitrotReader, len(disks))
+		for index, disk := range disks {
+			if disk == OfflineDisk {
+				continue
+			}
+			endOffset := getErasureShardFileEndOffset(offset, readLen, length, blockSize, storage.dataBlocks)
+			bitrotReaders[index] = newBitrotReader(disk, "testbucket", "object", DefaultBitrotAlgorithm, endOffset, writers[index].Sum())
+		}
+		err = storage.ReadFile(context.Background(), buf, bitrotReaders, offset, readLen, length)
 		if err != nil {
 			t.Fatal(err, offset, readLen)
 		}
@@ -232,31 +275,47 @@ func benchmarkErasureRead(data, parity, dataDown, parityDown int, size int64, b
 		b.Fatalf("failed to create test setup: %v", err)
 	}
 	defer setup.Remove()
-	storage, err := NewErasureStorage(context.Background(), setup.disks, data, parity, blockSizeV1)
+	disks := setup.disks
+	storage, err := NewErasureStorage(context.Background(), data, parity, blockSizeV1)
 	if err != nil {
 		b.Fatalf("failed to create ErasureStorage: %v", err)
 	}
 
+	writers := make([]*bitrotWriter, len(disks))
+	for i, disk := range disks {
+		if disk == nil {
+			continue
+		}
+		writers[i] = newBitrotWriter(disk, "testbucket", "object", DefaultBitrotAlgorithm)
+	}
+
 	content := make([]byte, size)
 	buffer := make([]byte, blockSizeV1, 2*blockSizeV1)
-	file, err := storage.CreateFile(context.Background(), bytes.NewReader(content), "testbucket", "object", buffer, DefaultBitrotAlgorithm, data+1)
+	_, err = storage.CreateFile(context.Background(), bytes.NewReader(content), writers, buffer, storage.dataBlocks+1)
 	if err != nil {
 		b.Fatalf("failed to create erasure test file: %v", err)
 	}
-	checksums := file.Checksums
 
 	for i := 0; i < dataDown; i++ {
-		storage.disks[i] = OfflineDisk
+		writers[i] = nil
 	}
 	for i := data; i < data+parityDown; i++ {
-		storage.disks[i] = OfflineDisk
+		writers[i] = nil
 	}
 
 	b.ResetTimer()
 	b.SetBytes(size)
 	b.ReportAllocs()
 	for i := 0; i < b.N; i++ {
-		if file, err = storage.ReadFile(context.Background(), bytes.NewBuffer(content[:0]), "testbucket", "object", 0, size, size, checksums, DefaultBitrotAlgorithm, blockSizeV1); err != nil {
+		bitrotReaders := make([]*bitrotReader, len(disks))
+		for index, disk := range disks {
+			if writers[index] == nil {
+				continue
+			}
+			endOffset := getErasureShardFileEndOffset(0, size, size, storage.blockSize, storage.dataBlocks)
+			bitrotReaders[index] = newBitrotReader(disk, "testbucket", "object", DefaultBitrotAlgorithm, endOffset, writers[index].Sum())
+		}
+		if err = storage.ReadFile(context.Background(), bytes.NewBuffer(content[:0]), bitrotReaders, 0, size, size); err != nil {
 			panic(err)
 		}
 	}

cmd/erasure-utils.go

@@ -104,3 +104,25 @@ func writeDataBlocks(ctx context.Context, dst io.Writer, enBlocks [][]byte, data
 	// Success.
 	return totalWritten, nil
 }
+
+// Returns shard-file size.
+func getErasureShardFileSize(blockSize int64, totalLength int64, dataBlocks int) int64 {
+	shardSize := ceilFrac(int64(blockSize), int64(dataBlocks))
+	numShards := totalLength / int64(blockSize)
+	lastBlockSize := totalLength % int64(blockSize)
+	lastShardSize := ceilFrac(lastBlockSize, int64(dataBlocks))
+	return shardSize*numShards + lastShardSize
+}
+
+// Returns the endOffset till which bitrotReader should read data using disk.ReadFile()
+// partOffset, partLength and partSize are values of the object's part file.
+func getErasureShardFileEndOffset(partOffset int64, partLength int64, partSize int64, erasureBlockSize int64, dataBlocks int) int64 {
+	shardSize := ceilFrac(erasureBlockSize, int64(dataBlocks))
+	shardFileSize := getErasureShardFileSize(erasureBlockSize, partSize, dataBlocks)
+	endShard := (partOffset + int64(partLength)) / erasureBlockSize
+	endOffset := endShard*shardSize + shardSize
+	if endOffset > shardFileSize {
+		endOffset = shardFileSize
+	}
+	return endOffset
+}

cmd/erasure.go

@@ -18,8 +18,6 @@ package cmd
 
 import (
 	"context"
-	"crypto/subtle"
-	"hash"
 
 	"github.com/klauspost/reedsolomon"
 	"github.com/minio/minio/cmd/logger"
@@ -28,43 +26,36 @@ import (
 // OfflineDisk represents an unavailable disk.
 var OfflineDisk StorageAPI // zero value is nil
 
-// ErasureFileInfo contains information about an erasure file operation (create, read, heal).
-type ErasureFileInfo struct {
-	Size      int64
-	Algorithm BitrotAlgorithm
-	Checksums [][]byte
-}
-
-// ErasureStorage represents an array of disks.
-// The disks contain erasure coded and bitrot-protected data.
+// ErasureStorage - erasure encoding details.
 type ErasureStorage struct {
-	disks                    []StorageAPI
 	erasure                  reedsolomon.Encoder
 	dataBlocks, parityBlocks int
+	blockSize                int64
 }
 
-// NewErasureStorage creates a new ErasureStorage. The storage erasure codes and protects all data written to
-// the disks.
-func NewErasureStorage(ctx context.Context, disks []StorageAPI, dataBlocks, parityBlocks int, blockSize int64) (s ErasureStorage, err error) {
-	shardsize := (int(blockSize) + dataBlocks - 1) / dataBlocks
+// NewErasureStorage creates a new ErasureStorage.
+func NewErasureStorage(ctx context.Context, dataBlocks, parityBlocks int, blockSize int64) (s ErasureStorage, err error) {
+	shardsize := int(ceilFrac(blockSize, int64(dataBlocks)))
 	erasure, err := reedsolomon.New(dataBlocks, parityBlocks, reedsolomon.WithAutoGoroutines(shardsize))
 	if err != nil {
 		logger.LogIf(ctx, err)
 		return s, err
 	}
 	s = ErasureStorage{
-		disks:        make([]StorageAPI, len(disks)),
 		erasure:      erasure,
 		dataBlocks:   dataBlocks,
 		parityBlocks: parityBlocks,
+		blockSize:    blockSize,
 	}
-	copy(s.disks, disks)
 	return
 }
 
 // ErasureEncode encodes the given data and returns the erasure-coded data.
 // It returns an error if the erasure coding failed.
 func (s *ErasureStorage) ErasureEncode(ctx context.Context, data []byte) ([][]byte, error) {
+	if len(data) == 0 {
+		return make([][]byte, s.dataBlocks+s.parityBlocks), nil
+	}
 	encoded, err := s.erasure.Split(data)
 	if err != nil {
 		logger.LogIf(ctx, err)
@@ -81,6 +72,16 @@ func (s *ErasureStorage) ErasureEncode(ctx context.Context, data []byte) ([][]by
 // It only decodes the data blocks but does not verify them.
 // It returns an error if the decoding failed.
 func (s *ErasureStorage) ErasureDecodeDataBlocks(data [][]byte) error {
+	needsReconstruction := false
+	for _, b := range data[:s.dataBlocks] {
+		if b == nil {
+			needsReconstruction = true
+			break
+		}
+	}
+	if !needsReconstruction {
+		return nil
+	}
 	if err := s.erasure.ReconstructData(data); err != nil {
 		return err
 	}
@@ -96,27 +97,3 @@ func (s *ErasureStorage) ErasureDecodeDataAndParityBlocks(ctx context.Context, d
 	}
 	return nil
 }
-
-// NewBitrotVerifier returns a new BitrotVerifier implementing the given algorithm.
-func NewBitrotVerifier(algorithm BitrotAlgorithm, checksum []byte) *BitrotVerifier {
-	return &BitrotVerifier{algorithm.New(), algorithm, checksum, false}
-}
-
-// BitrotVerifier can be used to verify protected data.
-type BitrotVerifier struct {
-	hash.Hash
-
-	algorithm BitrotAlgorithm
-	sum       []byte
-	verified  bool
-}
-
-// Verify returns true iff the computed checksum of the verifier matches the the checksum provided when the verifier
-// was created.
-func (v *BitrotVerifier) Verify() bool {
-	v.verified = true
-	return subtle.ConstantTimeCompare(v.Sum(nil), v.sum) == 1
-}
-
-// IsVerified returns true iff Verify was called at least once.
-func (v *BitrotVerifier) IsVerified() bool { return v.verified }

cmd/erasure_test.go

@@ -52,8 +52,7 @@ func TestErasureDecode(t *testing.T) {
 		buffer := make([]byte, len(data), 2*len(data))
 		copy(buffer, data)
 
-		disks := make([]StorageAPI, test.dataBlocks+test.parityBlocks)
-		storage, err := NewErasureStorage(context.Background(), disks, test.dataBlocks, test.parityBlocks, blockSizeV1)
+		storage, err := NewErasureStorage(context.Background(), test.dataBlocks, test.parityBlocks, blockSizeV1)
 		if err != nil {
 			t.Fatalf("Test %d: failed to create erasure storage: %v", i, err)
 		}

cmd/format-xl.go

@@ -21,7 +21,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
-	"os"
 	"reflect"
 	"sync"
 
@@ -267,10 +266,11 @@ func formatXLMigrateV2ToV3(export string) error {
 		return err
 	}
 
-	if err = os.RemoveAll(pathJoin(export, minioMetaMultipartBucket)); err != nil {
+	if err = removeAll(pathJoin(export, minioMetaMultipartBucket)); err != nil {
 		return err
 	}
-	if err = os.MkdirAll(pathJoin(export, minioMetaMultipartBucket), 0755); err != nil {
+
+	if err = mkdirAll(pathJoin(export, minioMetaMultipartBucket), 0755); err != nil {
 		return err
 	}
 

cmd/fs-v1-helpers.go

@@ -64,7 +64,7 @@ func fsRemoveAll(ctx context.Context, dirPath string) (err error) {
 		return err
 	}
 
-	if err = os.RemoveAll(dirPath); err != nil {
+	if err = removeAll(dirPath); err != nil {
 		if os.IsPermission(err) {
 			logger.LogIf(ctx, errVolumeAccessDenied)
 			return errVolumeAccessDenied
@@ -121,23 +121,25 @@ func fsMkdir(ctx context.Context, dirPath string) (err error) {
 	}
 
 	if err = os.Mkdir((dirPath), 0777); err != nil {
-		if os.IsExist(err) {
+		switch {
+		case os.IsExist(err):
 			return errVolumeExists
-		} else if os.IsPermission(err) {
+		case os.IsPermission(err):
 			logger.LogIf(ctx, errDiskAccessDenied)
 			return errDiskAccessDenied
-		} else if isSysErrNotDir(err) {
+		case isSysErrNotDir(err):
 			// File path cannot be verified since
 			// one of the parents is a file.
 			logger.LogIf(ctx, errDiskAccessDenied)
 			return errDiskAccessDenied
-		} else if isSysErrPathNotFound(err) {
+		case isSysErrPathNotFound(err):
 			// Add specific case for windows.
 			logger.LogIf(ctx, errDiskAccessDenied)
 			return errDiskAccessDenied
+		default:
+			logger.LogIf(ctx, err)
+			return err
 		}
-		logger.LogIf(ctx, err)
-		return err
 	}
 
 	return nil
@@ -343,7 +345,9 @@ func fsCreateFile(ctx context.Context, filePath string, reader io.Reader, buf []
 	if buf != nil {
 		bytesWritten, err = io.CopyBuffer(writer, reader, buf)
 		if err != nil {
-			logger.LogIf(ctx, err)
+			if err != io.ErrUnexpectedEOF {
+				logger.LogIf(ctx, err)
+			}
 			return 0, err
 		}
 	} else {

cmd/fs-v1-multipart_test.go

@@ -90,23 +90,18 @@ func TestNewMultipartUploadFaultyDisk(t *testing.T) {
 
 // TestPutObjectPartFaultyDisk - test PutObjectPart with faulty disks
 func TestPutObjectPartFaultyDisk(t *testing.T) {
-	root, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(root)
-
 	// Prepare for tests
 	disk := filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	defer os.RemoveAll(disk)
 	obj := initFSObjects(disk, t)
+
 	fs := obj.(*FSObjects)
 	bucketName := "bucket"
 	objectName := "object"
 	data := []byte("12345")
 	dataLen := int64(len(data))
 
-	if err = obj.MakeBucketWithLocation(context.Background(), bucketName, ""); err != nil {
+	if err := obj.MakeBucketWithLocation(context.Background(), bucketName, ""); err != nil {
 		t.Fatal("Cannot create bucket, err: ", err)
 	}
 

cmd/fs-v1-rwpool.go

@@ -93,18 +93,20 @@ func (fsi *fsIOPool) Open(path string) (*lock.RLockedFile, error) {
 		// Open file for reading with read lock.
 		newRlkFile, err := lock.RLockedOpenFile(path)
 		if err != nil {
-			if os.IsNotExist(err) {
+			switch {
+			case os.IsNotExist(err):
 				return nil, errFileNotFound
-			} else if os.IsPermission(err) {
+			case os.IsPermission(err):
 				return nil, errFileAccessDenied
-			} else if isSysErrIsDir(err) {
+			case isSysErrIsDir(err):
 				return nil, errIsNotRegular
-			} else if isSysErrNotDir(err) {
+			case isSysErrNotDir(err):
 				return nil, errFileAccessDenied
-			} else if isSysErrPathNotFound(err) {
+			case isSysErrPathNotFound(err):
 				return nil, errFileNotFound
+			default:
+				return nil, err
 			}
-			return nil, err
 		}
 
 		/// Save new reader on the map.
@@ -148,14 +150,16 @@ func (fsi *fsIOPool) Write(path string) (wlk *lock.LockedFile, err error) {
 
 	wlk, err = lock.LockedOpenFile(path, os.O_RDWR, 0666)
 	if err != nil {
-		if os.IsNotExist(err) {
+		switch {
+		case os.IsNotExist(err):
 			return nil, errFileNotFound
-		} else if os.IsPermission(err) {
+		case os.IsPermission(err):
 			return nil, errFileAccessDenied
-		} else if isSysErrIsDir(err) {
+		case isSysErrIsDir(err):
 			return nil, errIsNotRegular
+		default:
+			return nil, err
 		}
-		return nil, err
 	}
 	return wlk, nil
 }
@@ -175,14 +179,16 @@ func (fsi *fsIOPool) Create(path string) (wlk *lock.LockedFile, err error) {
 	// Attempt to create the file.
 	wlk, err = lock.LockedOpenFile(path, os.O_RDWR|os.O_CREATE, 0666)
 	if err != nil {
-		if os.IsPermission(err) {
+		switch {
+		case os.IsPermission(err):
 			return nil, errFileAccessDenied
-		} else if isSysErrIsDir(err) {
+		case isSysErrIsDir(err):
 			return nil, errIsNotRegular
-		} else if isSysErrPathNotFound(err) {
+		case isSysErrPathNotFound(err):
 			return nil, errFileAccessDenied
+		default:
+			return nil, err
 		}
-		return nil, err
 	}
 
 	// Success.

cmd/fs-v1_test.go

@@ -26,12 +26,6 @@ import (
 
 // Tests for if parent directory is object
 func TestFSParentDirIsObject(t *testing.T) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(rootPath)
-
 	obj, disk, err := prepareFS()
 	if err != nil {
 		t.Fatal(err)
@@ -120,12 +114,6 @@ func TestNewFS(t *testing.T) {
 // TestFSShutdown - initialize a new FS object layer then calls
 // Shutdown to check returned results
 func TestFSShutdown(t *testing.T) {
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(rootPath)
-
 	bucketName := "testbucket"
 	objectName := "object"
 	// Create and return an fsObject with its path in the disk
@@ -133,6 +121,7 @@ func TestFSShutdown(t *testing.T) {
 		disk := filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 		obj := initFSObjects(disk, t)
 		fs := obj.(*FSObjects)
+
 		objectContent := "12345"
 		obj.MakeBucketWithLocation(context.Background(), bucketName, "")
 		obj.PutObject(context.Background(), bucketName, objectName, mustGetHashReader(t, bytes.NewReader([]byte(objectContent)), int64(len(objectContent)), "", ""), nil)

cmd/gateway-main.go

@@ -22,7 +22,6 @@ import (
 	"net/url"
 	"os"
 	"os/signal"
-	"runtime"
 	"strings"
 	"syscall"
 
@@ -83,17 +82,6 @@ func ValidateGatewayArguments(serverAddr, endpointAddr string) error {
 		return err
 	}
 
-	if runtime.GOOS == "darwin" {
-		_, port := mustSplitHostPort(serverAddr)
-		// On macOS, if a process already listens on LOCALIPADDR:PORT, net.Listen() falls back
-		// to IPv6 address i.e minio will start listening on IPv6 address whereas another
-		// (non-)minio process is listening on IPv4 of given port.
-		// To avoid this error situation we check for port availability only for macOS.
-		if err := checkPortAvailability(port); err != nil {
-			return err
-		}
-	}
-
 	if endpointAddr != "" {
 		// Reject the endpoint if it points to the gateway handler itself.
 		sameTarget, err := sameLocalAddrs(endpointAddr, serverAddr)
@@ -148,19 +136,41 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 	// Handle common env vars.
 	handleCommonEnvVars()
 
+	// On macOS, if a process already listens on LOCALIPADDR:PORT, net.Listen() falls back
+	// to IPv6 address ie minio will start listening on IPv6 address whereas another
+	// (non-)minio process is listening on IPv4 of given port.
+	// To avoid this error situation we check for port availability.
+	logger.FatalIf(checkPortAvailability(globalMinioPort), "Unable to start the server")
+
 	// Validate if we have access, secret set through environment.
 	if !globalIsEnvCreds {
-		logger.Fatal(uiErrEnvCredentialsMissing(nil), "Unable to start gateway")
+		logger.Fatal(uiErrEnvCredentialsMissingGateway(nil), "Unable to start gateway")
 	}
 
 	// Create certs path.
 	logger.FatalIf(createConfigDir(), "Unable to create configuration directories")
 
-	// Initialize gateway config.
-	initConfig()
+	// Initialize server config.
+	srvCfg := newServerConfig()
 
-	// Load logger subsystem
-	loadLoggers()
+	// Override any values from ENVs.
+	srvCfg.loadFromEnvs()
+
+	// Load values to cached global values.
+	srvCfg.loadToCachedConfigs()
+
+	// hold the mutex lock before a new config is assigned.
+	globalServerConfigMu.Lock()
+	globalServerConfig = srvCfg
+	globalServerConfigMu.Unlock()
+
+	var cacheConfig = globalServerConfig.GetCacheConfig()
+	if len(cacheConfig.Drives) > 0 {
+		var err error
+		// initialize the new disk cache objects.
+		globalCacheObjectAPI, err = newServerCacheObjects(cacheConfig)
+		logger.FatalIf(err, "Unable to initialize disk caching")
+	}
 
 	// Check and load SSL certificates.
 	var err error
@@ -217,12 +227,7 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 		logger.FatalIf(err, "Unable to initialize gateway backend")
 	}
 
-	if gw.Name() != "nas" {
-		// Initialize policy sys for all gateways. NAS gateway already
-		// initializes policy sys internally, avoid double initialization.
-		// Additionally also don't block the initialization of gateway.
-		go globalPolicySys.Init(newObject)
-	}
+	go globalPolicySys.Init(newObject)
 
 	// Once endpoints are finalized, initialize the new object api.
 	globalObjLayerMutex.Lock()

cmd/gateway-startup-msg_test.go

@@ -23,11 +23,14 @@ import (
 
 // Test printing Gateway common message.
 func TestPrintGatewayCommonMessage(t *testing.T) {
-	root, err := newTestConfig(globalMinioDefaultRegion)
+	obj, fsDir, err := prepareFS()
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer os.RemoveAll(root)
+	defer os.RemoveAll(fsDir)
+	if err = newTestConfig(globalMinioDefaultRegion, obj); err != nil {
+		t.Fatal(err)
+	}
 
 	apiEndpoints := []string{"http://127.0.0.1:9000"}
 	printGatewayCommonMsg(apiEndpoints)
@@ -35,11 +38,14 @@ func TestPrintGatewayCommonMessage(t *testing.T) {
 
 // Test print gateway startup message.
 func TestPrintGatewayStartupMessage(t *testing.T) {
-	root, err := newTestConfig(globalMinioDefaultRegion)
+	obj, fsDir, err := prepareFS()
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer os.RemoveAll(root)
+	defer os.RemoveAll(fsDir)
+	if err = newTestConfig(globalMinioDefaultRegion, obj); err != nil {
+		t.Fatal(err)
+	}
 
 	apiEndpoints := []string{"http://127.0.0.1:9000"}
 	printGatewayStartupMessage(apiEndpoints, "azure")

cmd/gateway/azure/gateway-azure.go

@@ -193,7 +193,6 @@ func s3MetaToAzureProperties(ctx context.Context, s3Metadata map[string]string)
 	storage.BlobProperties, error) {
 	for k := range s3Metadata {
 		if strings.Contains(k, "--") {
-			logger.LogIf(ctx, minio.UnsupportedMetadata{})
 			return storage.BlobMetadata{}, storage.BlobProperties{}, minio.UnsupportedMetadata{}
 		}
 	}
@@ -377,18 +376,12 @@ func getAzureUploadID() (string, error) {
 // checkAzureUploadID - returns error in case of given string is upload ID.
 func checkAzureUploadID(ctx context.Context, uploadID string) (err error) {
 	if len(uploadID) != 16 {
-		logger.LogIf(ctx, minio.MalformedUploadID{
-			UploadID: uploadID,
-		})
 		return minio.MalformedUploadID{
 			UploadID: uploadID,
 		}
 	}
 
 	if _, err = hex.DecodeString(uploadID); err != nil {
-		logger.LogIf(ctx, minio.MalformedUploadID{
-			UploadID: uploadID,
-		})
 		return minio.MalformedUploadID{
 			UploadID: uploadID,
 		}
@@ -449,7 +442,6 @@ func (a *azureObjects) MakeBucketWithLocation(ctx context.Context, bucket, locat
 	// in azure documentation, so we will simply use the same function here.
 	// Ref - https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata
 	if !minio.IsValidBucketName(bucket) {
-		logger.LogIf(ctx, minio.BucketNameInvalid{Bucket: bucket})
 		return minio.BucketNameInvalid{Bucket: bucket}
 	}
 
@@ -457,7 +449,6 @@ func (a *azureObjects) MakeBucketWithLocation(ctx context.Context, bucket, locat
 	err := container.Create(&storage.CreateContainerOptions{
 		Access: storage.ContainerAccessTypePrivate,
 	})
-	logger.LogIf(ctx, err)
 	return azureToObjectError(err, bucket)
 }
 
@@ -469,7 +460,6 @@ func (a *azureObjects) GetBucketInfo(ctx context.Context, bucket string) (bi min
 		Prefix: bucket,
 	})
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return bi, azureToObjectError(err, bucket)
 	}
 	for _, container := range resp.Containers {
@@ -490,7 +480,6 @@ func (a *azureObjects) GetBucketInfo(ctx context.Context, bucket string) (bi min
 func (a *azureObjects) ListBuckets(ctx context.Context) (buckets []minio.BucketInfo, err error) {
 	resp, err := a.client.ListContainers(storage.ListContainersParameters{})
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return nil, azureToObjectError(err)
 	}
 	for _, container := range resp.Containers {
@@ -511,7 +500,6 @@ func (a *azureObjects) ListBuckets(ctx context.Context) (buckets []minio.BucketI
 func (a *azureObjects) DeleteBucket(ctx context.Context, bucket string) error {
 	container := a.client.GetContainerReference(bucket)
 	err := container.Delete(nil)
-	logger.LogIf(ctx, err)
 	return azureToObjectError(err, bucket)
 }
 
@@ -549,7 +537,6 @@ func (a *azureObjects) ListObjects(ctx context.Context, bucket, prefix, marker,
 			MaxResults: uint(maxKeys),
 		})
 		if err != nil {
-			logger.LogIf(ctx, err)
 			return result, azureToObjectError(err, bucket, prefix)
 		}
 
@@ -637,7 +624,6 @@ func (a *azureObjects) ListObjectsV2(ctx context.Context, bucket, prefix, contin
 func (a *azureObjects) GetObject(ctx context.Context, bucket, object string, startOffset int64, length int64, writer io.Writer, etag string) error {
 	// startOffset cannot be negative.
 	if startOffset < 0 {
-		logger.LogIf(ctx, minio.InvalidRange{})
 		return azureToObjectError(minio.InvalidRange{}, bucket, object)
 	}
 
@@ -657,7 +643,6 @@ func (a *azureObjects) GetObject(ctx context.Context, bucket, object string, sta
 		})
 	}
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return azureToObjectError(err, bucket, object)
 	}
 	_, err = io.Copy(writer, rc)
@@ -672,7 +657,6 @@ func (a *azureObjects) GetObjectInfo(ctx context.Context, bucket, object string)
 	blob := a.client.GetContainerReference(bucket).GetBlobReference(object)
 	err = blob.GetProperties(nil)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return objInfo, azureToObjectError(err, bucket, object)
 	}
 
@@ -698,7 +682,6 @@ func (a *azureObjects) PutObject(ctx context.Context, bucket, object string, dat
 	}
 	err = blob.CreateBlockBlobFromReader(data, nil)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return objInfo, azureToObjectError(err, bucket, object)
 	}
 	return a.GetObjectInfo(ctx, bucket, object)
@@ -716,7 +699,6 @@ func (a *azureObjects) CopyObject(ctx context.Context, srcBucket, srcObject, des
 	destBlob.Metadata = azureMeta
 	err = destBlob.Copy(srcBlobURL, nil)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return objInfo, azureToObjectError(err, srcBucket, srcObject)
 	}
 	// Azure will copy metadata from the source object when an empty metadata map is provided.
@@ -726,14 +708,12 @@ func (a *azureObjects) CopyObject(ctx context.Context, srcBucket, srcObject, des
 		destBlob.Metadata = azureMeta
 		err = destBlob.SetMetadata(nil)
 		if err != nil {
-			logger.LogIf(ctx, err)
 			return objInfo, azureToObjectError(err, srcBucket, srcObject)
 		}
 	}
 	destBlob.Properties = props
 	err = destBlob.SetProperties(nil)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return objInfo, azureToObjectError(err, srcBucket, srcObject)
 	}
 	return a.GetObjectInfo(ctx, destBucket, destObject)
@@ -769,14 +749,12 @@ func (a *azureObjects) checkUploadIDExists(ctx context.Context, bucketName, obje
 	blob := a.client.GetContainerReference(bucketName).GetBlobReference(
 		getAzureMetadataObjectName(objectName, uploadID))
 	err = blob.GetMetadata(nil)
-	logger.LogIf(ctx, err)
 	err = azureToObjectError(err, bucketName, objectName)
 	oerr := minio.ObjectNotFound{
 		Bucket: bucketName,
 		Object: objectName,
 	}
 	if err == oerr {
-		logger.LogIf(ctx, minio.InvalidUploadID{UploadID: uploadID})
 		err = minio.InvalidUploadID{
 			UploadID: uploadID,
 		}
@@ -802,7 +780,6 @@ func (a *azureObjects) NewMultipartUpload(ctx context.Context, bucket, object st
 	blob := a.client.GetContainerReference(bucket).GetBlobReference(metadataObject)
 	err = blob.CreateBlockBlobFromReader(bytes.NewBuffer(jsonData), nil)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return "", azureToObjectError(err, bucket, metadataObject)
 	}
 
@@ -839,7 +816,6 @@ func (a *azureObjects) PutObjectPart(ctx context.Context, bucket, object, upload
 		blob := a.client.GetContainerReference(bucket).GetBlobReference(object)
 		err = blob.PutBlockWithLength(id, uint64(subPartSize), io.LimitReader(data, subPartSize), nil)
 		if err != nil {
-			logger.LogIf(ctx, err)
 			return info, azureToObjectError(err, bucket, object)
 		}
 		subPartNumber++
@@ -871,7 +847,6 @@ func (a *azureObjects) ListObjectParts(ctx context.Context, bucket, object, uplo
 		return result, nil
 	}
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return result, azureToObjectError(err, bucket, object)
 	}
 	// Build a sorted list of parts and return the requested entries.
@@ -881,7 +856,6 @@ func (a *azureObjects) ListObjectParts(ctx context.Context, bucket, object, uplo
 		var parsedUploadID string
 		var md5Hex string
 		if partNumber, _, parsedUploadID, md5Hex, err = azureParseBlockID(block.Name); err != nil {
-			logger.LogIf(ctx, fmt.Errorf("Unexpected error"))
 			return result, azureToObjectError(fmt.Errorf("Unexpected error"), bucket, object)
 		}
 		if parsedUploadID != uploadID {
@@ -899,7 +873,6 @@ func (a *azureObjects) ListObjectParts(ctx context.Context, bucket, object, uplo
 		if part.ETag != md5Hex {
 			// If two parts of same partNumber were uploaded with different contents
 			// return error as we won't be able to decide which the latest part is.
-			logger.LogIf(ctx, fmt.Errorf("Unexpected error"))
 			return result, azureToObjectError(fmt.Errorf("Unexpected error"), bucket, object)
 		}
 		part.Size += block.Size
@@ -966,7 +939,6 @@ func (a *azureObjects) CompleteMultipartUpload(ctx context.Context, bucket, obje
 	var metadataReader io.Reader
 	blob := a.client.GetContainerReference(bucket).GetBlobReference(metadataObject)
 	if metadataReader, err = blob.Get(nil); err != nil {
-		logger.LogIf(ctx, err)
 		return objInfo, azureToObjectError(err, bucket, metadataObject)
 	}
 
@@ -990,7 +962,6 @@ func (a *azureObjects) CompleteMultipartUpload(ctx context.Context, bucket, obje
 	objBlob := a.client.GetContainerReference(bucket).GetBlobReference(object)
 	resp, err := objBlob.GetBlockList(storage.BlockListTypeUncommitted, nil)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return objInfo, azureToObjectError(err, bucket, object)
 	}
 
@@ -1038,11 +1009,6 @@ func (a *azureObjects) CompleteMultipartUpload(ctx context.Context, bucket, obje
 	// Error out if parts except last part sizing < 5MiB.
 	for i, size := range partSizes[:len(partSizes)-1] {
 		if size < azureS3MinPartSize {
-			logger.LogIf(ctx, minio.PartTooSmall{
-				PartNumber: uploadedParts[i].PartNumber,
-				PartSize:   size,
-				PartETag:   uploadedParts[i].ETag,
-			})
 			return objInfo, minio.PartTooSmall{
 				PartNumber: uploadedParts[i].PartNumber,
 				PartSize:   size,
@@ -1053,23 +1019,19 @@ func (a *azureObjects) CompleteMultipartUpload(ctx context.Context, bucket, obje
 
 	err = objBlob.PutBlockList(allBlocks, nil)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return objInfo, azureToObjectError(err, bucket, object)
 	}
 	if len(metadata.Metadata) > 0 {
 		objBlob.Metadata, objBlob.Properties, err = s3MetaToAzureProperties(ctx, metadata.Metadata)
 		if err != nil {
-			logger.LogIf(ctx, err)
 			return objInfo, azureToObjectError(err, bucket, object)
 		}
 		err = objBlob.SetProperties(nil)
 		if err != nil {
-			logger.LogIf(ctx, err)
 			return objInfo, azureToObjectError(err, bucket, object)
 		}
 		err = objBlob.SetMetadata(nil)
 		if err != nil {
-			logger.LogIf(ctx, err)
 			return objInfo, azureToObjectError(err, bucket, object)
 		}
 	}
@@ -1099,15 +1061,12 @@ func (a *azureObjects) SetBucketPolicy(ctx context.Context, bucket string, bucke
 	}
 	prefix := bucket + "/*" // For all objects inside the bucket.
 	if len(policies) != 1 {
-		logger.LogIf(ctx, minio.NotImplemented{})
 		return minio.NotImplemented{}
 	}
 	if policies[0].Prefix != prefix {
-		logger.LogIf(ctx, minio.NotImplemented{})
 		return minio.NotImplemented{}
 	}
 	if policies[0].Policy != miniogopolicy.BucketPolicyReadOnly {
-		logger.LogIf(ctx, minio.NotImplemented{})
 		return minio.NotImplemented{}
 	}
 	perm := storage.ContainerPermissions{
@@ -1116,7 +1075,6 @@ func (a *azureObjects) SetBucketPolicy(ctx context.Context, bucket string, bucke
 	}
 	container := a.client.GetContainerReference(bucket)
 	err = container.SetPermissions(perm, nil)
-	logger.LogIf(ctx, err)
 	return azureToObjectError(err, bucket)
 }
 
@@ -1125,14 +1083,12 @@ func (a *azureObjects) GetBucketPolicy(ctx context.Context, bucket string) (*pol
 	container := a.client.GetContainerReference(bucket)
 	perm, err := container.GetPermissions(nil)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return nil, azureToObjectError(err, bucket)
 	}
 
 	if perm.AccessType == storage.ContainerAccessTypePrivate {
 		return nil, minio.BucketPolicyNotFound{Bucket: bucket}
 	} else if perm.AccessType != storage.ContainerAccessTypeContainer {
-		logger.LogIf(ctx, minio.NotImplemented{})
 		return nil, azureToObjectError(minio.NotImplemented{})
 	}
 
@@ -1165,6 +1121,5 @@ func (a *azureObjects) DeleteBucketPolicy(ctx context.Context, bucket string) er
 	}
 	container := a.client.GetContainerReference(bucket)
 	err := container.SetPermissions(perm, nil)
-	logger.LogIf(ctx, err)
 	return azureToObjectError(err)
 }

cmd/gateway/gcs/gateway-gcs.go

@@ -23,8 +23,8 @@ import (
 	"fmt"
 	"io"
 	"io/ioutil"
-
 	"math"
+	"net/http"
 	"os"
 	"regexp"
 	"strings"
@@ -768,22 +768,27 @@ func fromGCSAttrsToObjectInfo(attrs *storage.ObjectAttrs) minio.ObjectInfo {
 	// Refer https://cloud.google.com/storage/docs/hashes-etags. Use CRC32C for ETag
 	metadata := make(map[string]string)
 	for k, v := range attrs.Metadata {
+		k = http.CanonicalHeaderKey(k)
+		// Translate the GCS custom metadata prefix
+		if strings.HasPrefix(k, "X-Goog-Meta-") {
+			k = strings.Replace(k, "X-Goog-Meta-", "X-Amz-Meta-", 1)
+		}
 		metadata[k] = v
 	}
 	if attrs.ContentType != "" {
-		metadata["content-type"] = attrs.ContentType
+		metadata["Content-Type"] = attrs.ContentType
 	}
 	if attrs.ContentEncoding != "" {
-		metadata["content-encoding"] = attrs.ContentEncoding
+		metadata["Content-Encoding"] = attrs.ContentEncoding
 	}
 	if attrs.CacheControl != "" {
-		metadata["cache-control"] = attrs.CacheControl
+		metadata["Cache-Control"] = attrs.CacheControl
 	}
 	if attrs.ContentDisposition != "" {
-		metadata["content-disposition"] = attrs.ContentDisposition
+		metadata["Content-Disposition"] = attrs.ContentDisposition
 	}
 	if attrs.ContentLanguage != "" {
-		metadata["content-language"] = attrs.ContentLanguage
+		metadata["Content-Language"] = attrs.ContentLanguage
 	}
 	return minio.ObjectInfo{
 		Name:            attrs.Name,
@@ -799,21 +804,25 @@ func fromGCSAttrsToObjectInfo(attrs *storage.ObjectAttrs) minio.ObjectInfo {
 
 // applyMetadataToGCSAttrs applies metadata to a GCS ObjectAttrs instance
 func applyMetadataToGCSAttrs(metadata map[string]string, attrs *storage.ObjectAttrs) {
-	attrs.ContentType = metadata["content-type"]
-	attrs.ContentEncoding = metadata["content-encoding"]
-	attrs.CacheControl = metadata["cache-control"]
-	attrs.ContentDisposition = metadata["content-disposition"]
-	attrs.ContentLanguage = metadata["content-language"]
-
 	attrs.Metadata = make(map[string]string)
 	for k, v := range metadata {
-		attrs.Metadata[k] = v
-	}
-	// Filter metadata which is stored as a unique attribute
-	for _, key := range []string{
-		"content-type", "content-encoding", "cache-control", "content-disposition", "content-language",
-	} {
-		delete(attrs.Metadata, key)
+		k = http.CanonicalHeaderKey(k)
+		switch {
+		case strings.HasPrefix(k, "X-Amz-Meta-"):
+			// Translate the S3 user-defined metadata prefix
+			k = strings.Replace(k, "X-Amz-Meta-", "x-goog-meta-", 1)
+			attrs.Metadata[k] = v
+		case k == "Content-Type":
+			attrs.ContentType = v
+		case k == "Content-Encoding":
+			attrs.ContentEncoding = v
+		case k == "Cache-Control":
+			attrs.CacheControl = v
+		case k == "Content-Disposition":
+			attrs.ContentDisposition = v
+		case k == "Content-Language":
+			attrs.ContentLanguage = v
+		}
 	}
 }
 

cmd/gateway/gcs/gateway-gcs_test.go

@@ -23,7 +23,9 @@ import (
 	"path"
 	"reflect"
 	"testing"
+	"time"
 
+	"cloud.google.com/go/storage"
 	"google.golang.org/api/googleapi"
 
 	miniogo "github.com/minio/minio-go"
@@ -393,3 +395,105 @@ func TestGCSToObjectError(t *testing.T) {
 		}
 	}
 }
+
+func TestS3MetaToGCSAttributes(t *testing.T) {
+	headers := map[string]string{
+		"accept-encoding":          "gzip",
+		"content-encoding":         "gzip",
+		"cache-control":            "age: 3600",
+		"content-disposition":      "dummy",
+		"content-type":             "application/javascript",
+		"Content-Language":         "en",
+		"X-Amz-Meta-Hdr":           "value",
+		"X-Amz-Meta-X-Amz-Key":     "hu3ZSqtqwn+aL4V2VhAeov4i+bG3KyCtRMSXQFRHXOk=",
+		"X-Amz-Meta-X-Amz-Matdesc": "{}",
+		"X-Amz-Meta-X-Amz-Iv":      "eWmyryl8kq+EVnnsE7jpOg==",
+	}
+	// Only X-Amz-Meta- prefixed entries will be returned in
+	// Metadata (without the prefix!)
+	expectedHeaders := map[string]string{
+		"x-goog-meta-Hdr":           "value",
+		"x-goog-meta-X-Amz-Key":     "hu3ZSqtqwn+aL4V2VhAeov4i+bG3KyCtRMSXQFRHXOk=",
+		"x-goog-meta-X-Amz-Matdesc": "{}",
+		"x-goog-meta-X-Amz-Iv":      "eWmyryl8kq+EVnnsE7jpOg==",
+	}
+
+	attrs := storage.ObjectAttrs{}
+	applyMetadataToGCSAttrs(headers, &attrs)
+
+	if !reflect.DeepEqual(attrs.Metadata, expectedHeaders) {
+		t.Fatalf("Test failed, expected %#v, got %#v", expectedHeaders, attrs.Metadata)
+	}
+
+	if attrs.CacheControl != headers["cache-control"] {
+		t.Fatalf("Test failed with Cache-Control mistmatch, expected %s, got %s", headers["cache-control"], attrs.CacheControl)
+	}
+	if attrs.ContentDisposition != headers["content-disposition"] {
+		t.Fatalf("Test failed with Content-Disposition mistmatch, expected %s, got %s", headers["content-disposition"], attrs.ContentDisposition)
+	}
+	if attrs.ContentEncoding != headers["content-encoding"] {
+		t.Fatalf("Test failed with Content-Encoding mistmatch, expected %s, got %s", headers["content-encoding"], attrs.ContentEncoding)
+	}
+	if attrs.ContentLanguage != headers["Content-Language"] {
+		t.Fatalf("Test failed with Content-Language mistmatch, expected %s, got %s", headers["Content-Language"], attrs.ContentLanguage)
+	}
+	if attrs.ContentType != headers["content-type"] {
+		t.Fatalf("Test failed with Content-Type mistmatch, expected %s, got %s", headers["content-type"], attrs.ContentType)
+	}
+}
+
+func TestGCSAttrsToObjectInfo(t *testing.T) {
+	metadata := map[string]string{
+		"x-goog-meta-Hdr":           "value",
+		"x-goog-meta-x_amz_key":     "hu3ZSqtqwn+aL4V2VhAeov4i+bG3KyCtRMSXQFRHXOk=",
+		"x-goog-meta-x-amz-matdesc": "{}",
+		"x-goog-meta-X-Amz-Iv":      "eWmyryl8kq+EVnnsE7jpOg==",
+	}
+	expectedMeta := map[string]string{
+		"X-Amz-Meta-Hdr":           "value",
+		"X-Amz-Meta-X_amz_key":     "hu3ZSqtqwn+aL4V2VhAeov4i+bG3KyCtRMSXQFRHXOk=",
+		"X-Amz-Meta-X-Amz-Matdesc": "{}",
+		"X-Amz-Meta-X-Amz-Iv":      "eWmyryl8kq+EVnnsE7jpOg==",
+		"Cache-Control":            "max-age: 3600",
+		"Content-Disposition":      "dummy",
+		"Content-Encoding":         "gzip",
+		"Content-Language":         "en",
+		"Content-Type":             "application/javascript",
+	}
+
+	attrs := storage.ObjectAttrs{
+		Name:               "test-obj",
+		Bucket:             "test-bucket",
+		Updated:            time.Now(),
+		Size:               123,
+		CRC32C:             45312398,
+		CacheControl:       "max-age: 3600",
+		ContentDisposition: "dummy",
+		ContentEncoding:    "gzip",
+		ContentLanguage:    "en",
+		ContentType:        "application/javascript",
+		Metadata:           metadata,
+	}
+	expectedETag := minio.ToS3ETag(fmt.Sprintf("%d", attrs.CRC32C))
+
+	objInfo := fromGCSAttrsToObjectInfo(&attrs)
+	if !reflect.DeepEqual(objInfo.UserDefined, expectedMeta) {
+		t.Fatalf("Test failed, expected %#v, got %#v", expectedMeta, objInfo.UserDefined)
+	}
+
+	if objInfo.Name != attrs.Name {
+		t.Fatalf("Test failed with Name mistmatch, expected %s, got %s", attrs.Name, objInfo.Name)
+	}
+	if objInfo.Bucket != attrs.Bucket {
+		t.Fatalf("Test failed with Bucket mistmatch, expected %s, got %s", attrs.Bucket, objInfo.Bucket)
+	}
+	if objInfo.ModTime != attrs.Updated {
+		t.Fatalf("Test failed with ModTime mistmatch, expected %s, got %s", attrs.Updated, objInfo.ModTime)
+	}
+	if objInfo.Size != attrs.Size {
+		t.Fatalf("Test failed with Size mistmatch, expected %d, got %d", attrs.Size, objInfo.Size)
+	}
+	if objInfo.ETag != expectedETag {
+		t.Fatalf("Test failed with ETag mistmatch, expected %s, got %s", expectedETag, objInfo.ETag)
+	}
+}

cmd/gateway/s3/gateway-s3.go

@@ -223,13 +223,11 @@ func (l *s3Objects) MakeBucketWithLocation(ctx context.Context, bucket, location
 	// access to these buckets.
 	// Ref - http://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html
 	if s3utils.CheckValidBucketName(bucket) != nil {
-		logger.LogIf(ctx, minio.BucketNameInvalid{Bucket: bucket})
 		return minio.BucketNameInvalid{Bucket: bucket}
 	}
 
 	err := l.Client.MakeBucket(bucket, location)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return minio.ErrorRespToObjectError(err, bucket)
 	}
 	return err
@@ -239,7 +237,6 @@ func (l *s3Objects) MakeBucketWithLocation(ctx context.Context, bucket, location
 func (l *s3Objects) GetBucketInfo(ctx context.Context, bucket string) (bi minio.BucketInfo, e error) {
 	buckets, err := l.Client.ListBuckets()
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return bi, minio.ErrorRespToObjectError(err, bucket)
 	}
 
@@ -261,7 +258,6 @@ func (l *s3Objects) GetBucketInfo(ctx context.Context, bucket string) (bi minio.
 func (l *s3Objects) ListBuckets(ctx context.Context) ([]minio.BucketInfo, error) {
 	buckets, err := l.Client.ListBuckets()
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return nil, minio.ErrorRespToObjectError(err)
 	}
 
@@ -280,7 +276,6 @@ func (l *s3Objects) ListBuckets(ctx context.Context) ([]minio.BucketInfo, error)
 func (l *s3Objects) DeleteBucket(ctx context.Context, bucket string) error {
 	err := l.Client.RemoveBucket(bucket)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return minio.ErrorRespToObjectError(err, bucket)
 	}
 	return nil
@@ -290,7 +285,6 @@ func (l *s3Objects) DeleteBucket(ctx context.Context, bucket string) error {
 func (l *s3Objects) ListObjects(ctx context.Context, bucket string, prefix string, marker string, delimiter string, maxKeys int) (loi minio.ListObjectsInfo, e error) {
 	result, err := l.Client.ListObjects(bucket, prefix, marker, delimiter, maxKeys)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return loi, minio.ErrorRespToObjectError(err, bucket)
 	}
 
@@ -301,7 +295,6 @@ func (l *s3Objects) ListObjects(ctx context.Context, bucket string, prefix strin
 func (l *s3Objects) ListObjectsV2(ctx context.Context, bucket, prefix, continuationToken, delimiter string, maxKeys int, fetchOwner bool, startAfter string) (loi minio.ListObjectsV2Info, e error) {
 	result, err := l.Client.ListObjectsV2(bucket, prefix, continuationToken, fetchOwner, delimiter, maxKeys, startAfter)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return loi, minio.ErrorRespToObjectError(err, bucket)
 	}
 
@@ -316,7 +309,6 @@ func (l *s3Objects) ListObjectsV2(ctx context.Context, bucket, prefix, continuat
 // length indicates the total length of the object.
 func (l *s3Objects) GetObject(ctx context.Context, bucket string, key string, startOffset int64, length int64, writer io.Writer, etag string) error {
 	if length < 0 && length != -1 {
-		logger.LogIf(ctx, minio.InvalidRange{})
 		return minio.ErrorRespToObjectError(minio.InvalidRange{}, bucket, key)
 	}
 
@@ -329,7 +321,6 @@ func (l *s3Objects) GetObject(ctx context.Context, bucket string, key string, st
 	}
 	object, _, err := l.Client.GetObject(bucket, key, opts)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return minio.ErrorRespToObjectError(err, bucket, key)
 	}
 	defer object.Close()
@@ -345,7 +336,6 @@ func (l *s3Objects) GetObject(ctx context.Context, bucket string, key string, st
 func (l *s3Objects) GetObjectInfo(ctx context.Context, bucket string, object string) (objInfo minio.ObjectInfo, err error) {
 	oi, err := l.Client.StatObject(bucket, object, miniogo.StatObjectOptions{})
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return minio.ObjectInfo{}, minio.ErrorRespToObjectError(err, bucket, object)
 	}
 
@@ -356,7 +346,6 @@ func (l *s3Objects) GetObjectInfo(ctx context.Context, bucket string, object str
 func (l *s3Objects) PutObject(ctx context.Context, bucket string, object string, data *hash.Reader, metadata map[string]string) (objInfo minio.ObjectInfo, err error) {
 	oi, err := l.Client.PutObject(bucket, object, data, data.Size(), data.MD5Base64String(), data.SHA256HexString(), minio.ToMinioClientMetadata(metadata))
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return objInfo, minio.ErrorRespToObjectError(err, bucket, object)
 	}
 
@@ -372,7 +361,6 @@ func (l *s3Objects) CopyObject(ctx context.Context, srcBucket string, srcObject
 	srcInfo.UserDefined["x-amz-metadata-directive"] = "REPLACE"
 	srcInfo.UserDefined["x-amz-copy-source-if-match"] = srcInfo.ETag
 	if _, err = l.Client.CopyObject(srcBucket, srcObject, dstBucket, dstObject, srcInfo.UserDefined); err != nil {
-		logger.LogIf(ctx, err)
 		return objInfo, minio.ErrorRespToObjectError(err, srcBucket, srcObject)
 	}
 	return l.GetObjectInfo(ctx, dstBucket, dstObject)
@@ -382,7 +370,6 @@ func (l *s3Objects) CopyObject(ctx context.Context, srcBucket string, srcObject
 func (l *s3Objects) DeleteObject(ctx context.Context, bucket string, object string) error {
 	err := l.Client.RemoveObject(bucket, object)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return minio.ErrorRespToObjectError(err, bucket, object)
 	}
 
@@ -405,7 +392,6 @@ func (l *s3Objects) NewMultipartUpload(ctx context.Context, bucket string, objec
 	opts := miniogo.PutObjectOptions{UserMetadata: metadata}
 	uploadID, err = l.Client.NewMultipartUpload(bucket, object, opts)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return uploadID, minio.ErrorRespToObjectError(err, bucket, object)
 	}
 	return uploadID, nil
@@ -415,7 +401,6 @@ func (l *s3Objects) NewMultipartUpload(ctx context.Context, bucket string, objec
 func (l *s3Objects) PutObjectPart(ctx context.Context, bucket string, object string, uploadID string, partID int, data *hash.Reader) (pi minio.PartInfo, e error) {
 	info, err := l.Client.PutObjectPart(bucket, object, uploadID, partID, data, data.Size(), data.MD5Base64String(), data.SHA256HexString())
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return pi, minio.ErrorRespToObjectError(err, bucket, object)
 	}
 
@@ -433,7 +418,6 @@ func (l *s3Objects) CopyObjectPart(ctx context.Context, srcBucket, srcObject, de
 	completePart, err := l.Client.CopyObjectPart(srcBucket, srcObject, destBucket, destObject,
 		uploadID, partID, startOffset, length, srcInfo.UserDefined)
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return p, minio.ErrorRespToObjectError(err, srcBucket, srcObject)
 	}
 	p.PartNumber = completePart.PartNumber
@@ -454,7 +438,6 @@ func (l *s3Objects) ListObjectParts(ctx context.Context, bucket string, object s
 // AbortMultipartUpload aborts a ongoing multipart upload
 func (l *s3Objects) AbortMultipartUpload(ctx context.Context, bucket string, object string, uploadID string) error {
 	err := l.Client.AbortMultipartUpload(bucket, object, uploadID)
-	logger.LogIf(ctx, err)
 	return minio.ErrorRespToObjectError(err, bucket, object)
 }
 
@@ -462,7 +445,6 @@ func (l *s3Objects) AbortMultipartUpload(ctx context.Context, bucket string, obj
 func (l *s3Objects) CompleteMultipartUpload(ctx context.Context, bucket string, object string, uploadID string, uploadedParts []minio.CompletePart) (oi minio.ObjectInfo, e error) {
 	err := l.Client.CompleteMultipartUpload(bucket, object, uploadID, minio.ToMinioClientCompleteParts(uploadedParts))
 	if err != nil {
-		logger.LogIf(ctx, err)
 		return oi, minio.ErrorRespToObjectError(err, bucket, object)
 	}
 
@@ -479,7 +461,6 @@ func (l *s3Objects) SetBucketPolicy(ctx context.Context, bucket string, bucketPo
 	}
 
 	if err := l.Client.SetBucketPolicy(bucket, string(data)); err != nil {
-		logger.LogIf(ctx, err)
 		return minio.ErrorRespToObjectError(err, bucket)
 	}
 
@@ -500,7 +481,6 @@ func (l *s3Objects) GetBucketPolicy(ctx context.Context, bucket string) (*policy
 // DeleteBucketPolicy deletes all policies on bucket
 func (l *s3Objects) DeleteBucketPolicy(ctx context.Context, bucket string) error {
 	if err := l.Client.SetBucketPolicy(bucket, ""); err != nil {
-		logger.LogIf(ctx, err)
 		return minio.ErrorRespToObjectError(err, bucket, "")
 	}
 	return nil

cmd/gateway/sia/gateway-sia.go

@@ -19,7 +19,6 @@ package sia
 import (
 	"bytes"
 	"context"
-	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -40,6 +39,7 @@ import (
 	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/hash"
+	"github.com/minio/sha256-simd"
 )
 
 const (

cmd/generic-handlers.go

@@ -475,7 +475,6 @@ var notimplementedObjectResourceNames = map[string]bool{
 	"policy":  true,
 	"tagging": true,
 	"restore": true,
-	"select":  true,
 }
 
 // Resource handler ServeHTTP() wrapper

cmd/generic-handlers_test.go

@@ -20,6 +20,8 @@ import (
 	"net/http"
 	"strconv"
 	"testing"
+
+	"github.com/minio/minio/cmd/crypto"
 )
 
 // Tests getRedirectLocation function for all its criteria.
@@ -153,15 +155,15 @@ var containsReservedMetadataTests = []struct {
 		header: http.Header{"X-Minio-Key": []string{"value"}},
 	},
 	{
-		header:     http.Header{ServerSideEncryptionIV: []string{"iv"}},
+		header:     http.Header{crypto.SSEIV: []string{"iv"}},
 		shouldFail: true,
 	},
 	{
-		header:     http.Header{ServerSideEncryptionSealAlgorithm: []string{SSESealAlgorithmDareSha256}},
+		header:     http.Header{crypto.SSESealAlgorithm: []string{SSESealAlgorithmDareSha256}},
 		shouldFail: true,
 	},
 	{
-		header:     http.Header{ServerSideEncryptionSealedKey: []string{"mac"}},
+		header:     http.Header{crypto.SSECSealedKey: []string{"mac"}},
 		shouldFail: true,
 	},
 	{

cmd/globals.go

@@ -18,15 +18,18 @@ package cmd
 
 import (
 	"crypto/x509"
+	"fmt"
 	"os"
 	"runtime"
 	"time"
 
+	isatty "github.com/mattn/go-isatty"
 	"github.com/minio/minio-go/pkg/set"
 
 	etcd "github.com/coreos/etcd/clientv3"
 	humanize "github.com/dustin/go-humanize"
 	"github.com/fatih/color"
+	"github.com/minio/minio/cmd/crypto"
 	xhttp "github.com/minio/minio/cmd/http"
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/certs"
@@ -124,6 +127,9 @@ var (
 	// Holds the host that was passed using --address
 	globalMinioHost = ""
 
+	// globalConfigSys server config system.
+	globalConfigSys *ConfigSys
+
 	globalNotificationSys *NotificationSys
 	globalPolicySys       *PolicySys
 
@@ -214,17 +220,83 @@ var (
 	// Usage check interval value.
 	globalUsageCheckInterval = globalDefaultUsageCheckInterval
 
+	// KMS key id
+	globalKMSKeyID string
+	// Allocated KMS
+	globalKMS crypto.KMS
+	// KMS config
+	globalKMSConfig crypto.KMSConfig
 	// Add new variable global values here.
 )
 
 // global colors.
 var (
-	colorBold     = color.New(color.Bold).SprintFunc()
-	colorRed      = color.New(color.FgRed).SprintfFunc()
-	colorBlue     = color.New(color.FgBlue).SprintfFunc()
-	colorYellow   = color.New(color.FgYellow).SprintfFunc()
-	colorBgYellow = color.New(color.BgYellow).SprintfFunc()
-	colorBlack    = color.New(color.FgBlack).SprintfFunc()
+	// Check if we stderr, stdout are dumb terminals, we do not apply
+	// ansi coloring on dumb terminals.
+	isTerminal = func() bool {
+		return isatty.IsTerminal(os.Stdout.Fd()) && isatty.IsTerminal(os.Stderr.Fd())
+	}
+
+	colorBold = func() func(a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.Bold).SprintFunc()
+		}
+		return fmt.Sprint
+	}()
+	colorRed = func() func(format string, a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.FgRed).SprintfFunc()
+		}
+		return fmt.Sprintf
+	}()
+	colorBlue = func() func(format string, a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.FgBlue).SprintfFunc()
+		}
+		return fmt.Sprintf
+	}()
+	colorYellow = func() func(format string, a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.FgYellow).SprintfFunc()
+		}
+		return fmt.Sprintf
+	}()
+	colorCyanBold = func() func(a ...interface{}) string {
+		if isTerminal() {
+			color.New(color.FgCyan, color.Bold).SprintFunc()
+		}
+		return fmt.Sprint
+	}()
+	colorYellowBold = func() func(format string, a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.FgYellow, color.Bold).SprintfFunc()
+		}
+		return fmt.Sprintf
+	}()
+	colorBgYellow = func() func(format string, a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.BgYellow).SprintfFunc()
+		}
+		return fmt.Sprintf
+	}()
+	colorBlack = func() func(format string, a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.FgBlack).SprintfFunc()
+		}
+		return fmt.Sprintf
+	}()
+	colorGreenBold = func() func(format string, a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.FgGreen, color.Bold).SprintfFunc()
+		}
+		return fmt.Sprintf
+	}()
+	colorRedBold = func() func(format string, a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.FgRed, color.Bold).SprintfFunc()
+		}
+		return fmt.Sprintf
+	}()
 )
 
 // Returns minio global information, as a key value map.

cmd/handler-utils_test.go

@@ -30,11 +30,14 @@ import (
 
 // Tests validate bucket LocationConstraint.
 func TestIsValidLocationContraint(t *testing.T) {
-	path, err := newTestConfig(globalMinioDefaultRegion)
+	obj, fsDir, err := prepareFS()
 	if err != nil {
-		t.Fatalf("unable initialize config file, %s", err)
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(fsDir)
+	if err = newTestConfig(globalMinioDefaultRegion, obj); err != nil {
+		t.Fatal(err)
 	}
-	defer os.RemoveAll(path)
 
 	// Test with corrupted XML
 	malformedReq := &http.Request{

cmd/http/listen_nix.go

@@ -0,0 +1,29 @@
+// +build linux darwin dragonfly freebsd netbsd openbsd rumprun
+
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package http
+
+import "github.com/valyala/tcplisten"
+
+var cfg = &tcplisten.Config{
+	DeferAccept: true,
+	FastOpen:    true,
+}
+
+// Unix listener with special TCP options.
+var listen = cfg.NewListener

cmd/http/listen_others.go

@@ -0,0 +1,24 @@
+// +build windows plan9
+
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package http
+
+import "net"
+
+// Windows, plan9 specific listener.
+var listen = net.Listen

cmd/http/listener.go

@@ -300,6 +300,7 @@ func newHTTPListener(serverAddrs []string,
 	updateBytesWrittenFunc func(int)) (listener *httpListener, err error) {
 
 	var tcpListeners []*net.TCPListener
+
 	// Close all opened listeners on error
 	defer func() {
 		if err == nil {
@@ -314,7 +315,7 @@ func newHTTPListener(serverAddrs []string,
 
 	for _, serverAddr := range serverAddrs {
 		var l net.Listener
-		if l, err = net.Listen("tcp", serverAddr); err != nil {
+		if l, err = listen("tcp4", serverAddr); err != nil {
 			return nil, err
 		}
 

cmd/http/listener_test.go

@@ -197,11 +197,23 @@ func TestIsHTTPMethod(t *testing.T) {
 func TestNewHTTPListener(t *testing.T) {
 	errMsg := ": no such host"
 
-	remoteAddrErrMsg := "listen tcp 93.184.216.34:65432: bind: cannot assign requested address"
+	remoteAddrErrMsgIP := "cannot bind to \"93.184.216.34:65432\": cannot assign requested address"
 	if runtime.GOOS == "windows" {
-		remoteAddrErrMsg = "listen tcp 93.184.216.34:65432: bind: The requested address is not valid in its context."
-	} else if runtime.GOOS == "darwin" {
-		remoteAddrErrMsg = "listen tcp 93.184.216.34:65432: bind: can't assign requested address"
+		remoteAddrErrMsgIP = "listen tcp 93.184.216.34:65432: bind: The requested address is not valid in its context."
+	}
+	remoteAddrErrMsgHost := "cannot bind to \"example.org:65432\": cannot assign requested address"
+	if runtime.GOOS == "windows" {
+		remoteAddrErrMsgHost = "listen tcp 93.184.216.34:65432: bind: The requested address is not valid in its context."
+	}
+
+	remoteMissingErr := "address unknown-host: missing port in address"
+	if runtime.GOOS == "windows" {
+		remoteMissingErr = "listen tcp: address unknown-host: missing port in address"
+	}
+
+	remoteUnknownErr := "lookup unknown-host" + errMsg
+	if runtime.GOOS == "wpindows" {
+		remoteUnknownErr = "listen tcp: lookup unknown-host" + errMsg
 	}
 
 	tlsConfig := getTLSConfig(t)
@@ -217,12 +229,12 @@ func TestNewHTTPListener(t *testing.T) {
 		errorLogFunc           func(context.Context, error)
 		expectedErr            error
 	}{
-		{[]string{"93.184.216.34:65432"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New(remoteAddrErrMsg)},
-		{[]string{"example.org:65432"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New(remoteAddrErrMsg)},
-		{[]string{"unknown-host"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New("listen tcp: address unknown-host: missing port in address")},
-		{[]string{"unknown-host:65432"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New("listen tcp: lookup unknown-host" + errMsg)},
-		{[]string{"localhost:65432", "93.184.216.34:65432"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New(remoteAddrErrMsg)},
-		{[]string{"localhost:65432", "unknown-host:65432"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New("listen tcp: lookup unknown-host" + errMsg)},
+		{[]string{"93.184.216.34:65432"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New(remoteAddrErrMsgIP)},
+		{[]string{"example.org:65432"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New(remoteAddrErrMsgHost)},
+		{[]string{"unknown-host"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New(remoteMissingErr)},
+		{[]string{"unknown-host:65432"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New(remoteUnknownErr)},
+		{[]string{"localhost:65432", "93.184.216.34:65432"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New(remoteAddrErrMsgIP)},
+		{[]string{"localhost:65432", "unknown-host:65432"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, errors.New(remoteUnknownErr)},
 		{[]string{"localhost:0"}, nil, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, nil},
 		{[]string{"localhost:0"}, tlsConfig, time.Duration(0), time.Duration(0), time.Duration(0), nil, nil, nil, nil},
 	}

cmd/httprange.go

@@ -89,7 +89,8 @@ func parseRequestRange(rangeString string, resourceSize int64) (hrange *httpRang
 	}
 
 	// rangeString contains first and last byte positions. eg. "bytes=2-5"
-	if offsetBegin > -1 && offsetEnd > -1 {
+	switch {
+	case offsetBegin > -1 && offsetEnd > -1:
 		if offsetBegin > offsetEnd {
 			// Last byte position is not greater than first byte position. eg. "bytes=5-2"
 			return nil, fmt.Errorf("'%s' does not have valid range value", rangeString)
@@ -103,7 +104,7 @@ func parseRequestRange(rangeString string, resourceSize int64) (hrange *httpRang
 		if offsetEnd >= resourceSize {
 			offsetEnd = resourceSize - 1
 		}
-	} else if offsetBegin > -1 {
+	case offsetBegin > -1:
 		// rangeString contains only first byte position. eg. "bytes=8-"
 		if offsetBegin >= resourceSize {
 			// First byte position should not be >= resourceSize.
@@ -111,7 +112,7 @@ func parseRequestRange(rangeString string, resourceSize int64) (hrange *httpRang
 		}
 
 		offsetEnd = resourceSize - 1
-	} else if offsetEnd > -1 {
+	case offsetEnd > -1:
 		// rangeString contains only last byte position. eg. "bytes=-3"
 		if offsetEnd == 0 {
 			// Last byte position should not be zero eg. "bytes=-0"
@@ -125,7 +126,7 @@ func parseRequestRange(rangeString string, resourceSize int64) (hrange *httpRang
 		}
 
 		offsetEnd = resourceSize - 1
-	} else {
+	default:
 		// rangeString contains first and last byte positions missing. eg. "bytes=-"
 		return nil, fmt.Errorf("'%s' does not have valid range value", rangeString)
 	}

cmd/jwt_test.go

@@ -25,11 +25,15 @@ import (
 )
 
 func testAuthenticate(authType string, t *testing.T) {
-	testPath, err := newTestConfig(globalMinioDefaultRegion)
+	obj, fsDir, err := prepareFS()
 	if err != nil {
-		t.Fatalf("unable initialize config file, %s", err)
+		t.Fatal(err)
 	}
-	defer os.RemoveAll(testPath)
+	defer os.RemoveAll(fsDir)
+	if err = newTestConfig(globalMinioDefaultRegion, obj); err != nil {
+		t.Fatal(err)
+	}
+
 	cred, err := auth.GetNewCredentials()
 	if err != nil {
 		t.Fatalf("Error getting new credentials: %s", err)
@@ -92,11 +96,14 @@ func TestAuthenticateURL(t *testing.T) {
 
 // Tests web request authenticator.
 func TestWebRequestAuthenticate(t *testing.T) {
-	testPath, err := newTestConfig(globalMinioDefaultRegion)
+	obj, fsDir, err := prepareFS()
 	if err != nil {
-		t.Fatalf("unable initialize config file, %s", err)
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(fsDir)
+	if err = newTestConfig(globalMinioDefaultRegion, obj); err != nil {
+		t.Fatal(err)
 	}
-	defer os.RemoveAll(testPath)
 
 	creds := globalServerConfig.GetCredential()
 	token, err := getTokenString(creds.AccessKey, creds.SecretKey)
@@ -143,11 +150,14 @@ func TestWebRequestAuthenticate(t *testing.T) {
 }
 
 func BenchmarkAuthenticateNode(b *testing.B) {
-	testPath, err := newTestConfig(globalMinioDefaultRegion)
+	obj, fsDir, err := prepareFS()
 	if err != nil {
-		b.Fatalf("unable initialize config file, %s", err)
+		b.Fatal(err)
+	}
+	defer os.RemoveAll(fsDir)
+	if err = newTestConfig(globalMinioDefaultRegion, obj); err != nil {
+		b.Fatal(err)
 	}
-	defer os.RemoveAll(testPath)
 
 	creds := globalServerConfig.GetCredential()
 	b.ResetTimer()
@@ -158,11 +168,14 @@ func BenchmarkAuthenticateNode(b *testing.B) {
 }
 
 func BenchmarkAuthenticateWeb(b *testing.B) {
-	testPath, err := newTestConfig(globalMinioDefaultRegion)
+	obj, fsDir, err := prepareFS()
 	if err != nil {
-		b.Fatalf("unable initialize config file, %s", err)
+		b.Fatal(err)
+	}
+	defer os.RemoveAll(fsDir)
+	if err = newTestConfig(globalMinioDefaultRegion, obj); err != nil {
+		b.Fatal(err)
 	}
-	defer os.RemoveAll(testPath)
 
 	creds := globalServerConfig.GetCredential()
 	b.ResetTimer()

cmd/local-admin-client.go

@@ -20,11 +20,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-
-	"github.com/minio/minio/cmd/logger"
 )
 
 // localAdminClient - represents admin operation to be executed locally.
@@ -85,28 +80,3 @@ func (lc localAdminClient) GetConfig() ([]byte, error) {
 
 	return json.Marshal(globalServerConfig)
 }
-
-// WriteTmpConfig - writes config file content to a temporary file on
-// the local server.
-func (lc localAdminClient) WriteTmpConfig(tmpFileName string, configBytes []byte) error {
-	tmpConfigFile := filepath.Join(getConfigDir(), tmpFileName)
-	err := ioutil.WriteFile(tmpConfigFile, configBytes, 0666)
-	reqInfo := (&logger.ReqInfo{}).AppendTags("tmpConfigFile", tmpConfigFile)
-	ctx := logger.SetReqInfo(context.Background(), reqInfo)
-	logger.LogIf(ctx, err)
-	return err
-}
-
-// CommitConfig - Move the new config in tmpFileName onto config.json
-// on a local node.
-func (lc localAdminClient) CommitConfig(tmpFileName string) error {
-	configFile := getConfigFile()
-	tmpConfigFile := filepath.Join(getConfigDir(), tmpFileName)
-
-	err := os.Rename(tmpConfigFile, configFile)
-	reqInfo := (&logger.ReqInfo{}).AppendTags("tmpConfigFile", tmpConfigFile)
-	reqInfo.AppendTags("configFile", configFile)
-	ctx := logger.SetReqInfo(context.Background(), reqInfo)
-	logger.LogIf(ctx, err)
-	return err
-}

cmd/local-admin-client_test.go

@@ -35,11 +35,3 @@ func TestLocalAdminClientServerInfo(t *testing.T) {
 func TestLocalAdminClientGetConfig(t *testing.T) {
 	testAdminCmdRunnerGetConfig(t, &localAdminClient{})
 }
-
-func TestLocalAdminClientWriteTmpConfig(t *testing.T) {
-	testAdminCmdRunnerWriteTmpConfig(t, &localAdminClient{})
-}
-
-func TestLocalAdminClientCommitConfig(t *testing.T) {
-	testAdminCmdRunnerCommitConfig(t, &localAdminClient{})
-}

cmd/lock-rpc-server.go

@@ -192,5 +192,5 @@ func registerDistNSLockRouter(router *mux.Router) {
 	go startLockMaintenance(globalLockServer)
 
 	subrouter := router.PathPrefix(minioReservedBucketPath).Subrouter()
-	subrouter.Path(lockServiceSubPath).Handler(rpcServer)
+	subrouter.Path(lockServiceSubPath).HandlerFunc(httpTraceHdrs(rpcServer.ServeHTTP))
 }

cmd/lock-rpc-server_test.go

@@ -44,8 +44,11 @@ func testLockEquality(lriLeft, lriRight []lockRequesterInfo) bool {
 
 // Helper function to create a lock server for testing
 func createLockTestServer(t *testing.T) (string, *lockRPCReceiver, string) {
-	testPath, err := newTestConfig(globalMinioDefaultRegion)
+	obj, fsDir, err := prepareFS()
 	if err != nil {
+		t.Fatal(err)
+	}
+	if err = newTestConfig(globalMinioDefaultRegion, obj); err != nil {
 		t.Fatalf("unable initialize config file, %s", err)
 	}
 
@@ -61,7 +64,7 @@ func createLockTestServer(t *testing.T) (string, *lockRPCReceiver, string) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	return testPath, locker, token
+	return fsDir, locker, token
 }
 
 // Test Lock functionality
@@ -470,11 +473,14 @@ func TestLockServerInit(t *testing.T) {
 		return
 	}
 
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
+	obj, fsDir, err := prepareFS()
 	if err != nil {
-		t.Fatalf("Init Test config failed")
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(fsDir)
+	if err = newTestConfig(globalMinioDefaultRegion, obj); err != nil {
+		t.Fatalf("unable initialize config file, %s", err)
 	}
-	defer os.RemoveAll(rootPath)
 
 	currentIsDistXL := globalIsDistXL
 	currentLockServer := globalLockServer

cmd/logger/logger.go

@@ -47,6 +47,11 @@ const (
 
 const loggerTimeFormat string = "15:04:05 MST 01/02/2006"
 
+// List of error strings to be ignored by LogIf
+const (
+	diskNotFoundError = "disk not found"
+)
+
 var matchingFuncNames = [...]string{
 	"http.HandlerFunc.ServeHTTP",
 	"cmd.serverMain",
@@ -94,13 +99,14 @@ type Console interface {
 }
 
 func consoleLog(console Console, msg string, args ...interface{}) {
-	if jsonFlag {
+	switch {
+	case jsonFlag:
 		// Strip escape control characters from json message
 		msg = ansiRE.ReplaceAllLiteralString(msg, "")
 		console.json(msg, args...)
-	} else if quiet {
+	case quiet:
 		console.quiet(msg, args...)
-	} else {
+	default:
 		console.pretty(msg, args...)
 	}
 }
@@ -266,17 +272,36 @@ func getTrace(traceLevel int) []string {
 	return trace
 }
 
-// LogIf prints a detailed error message during
+// LogAlwaysIf prints a detailed error message during
 // the execution of the server.
-func LogIf(ctx context.Context, err error) {
-	if Disable {
+func LogAlwaysIf(ctx context.Context, err error) {
+	if err == nil {
 		return
 	}
 
+	logIf(ctx, err)
+}
+
+// LogIf prints a detailed error message during
+// the execution of the server, if it is not an
+// ignored error.
+func LogIf(ctx context.Context, err error) {
 	if err == nil {
 		return
 	}
 
+	if err.Error() != diskNotFoundError {
+		logIf(ctx, err)
+	}
+}
+
+// logIf prints a detailed error message during
+// the execution of the server.
+func logIf(ctx context.Context, err error) {
+	if Disable {
+		return
+	}
+
 	req := GetReqInfo(ctx)
 
 	if req == nil {

cmd/logger/utils.go

@@ -18,17 +18,45 @@ package logger
 
 import (
 	"fmt"
+	"os"
 	"regexp"
 
 	"github.com/fatih/color"
+	isatty "github.com/mattn/go-isatty"
 )
 
 // Global colors.
 var (
-	colorBold    = color.New(color.Bold).SprintFunc()
-	colorFgRed   = color.New(color.FgRed).SprintfFunc()
-	colorBgRed   = color.New(color.BgRed).SprintfFunc()
-	colorFgWhite = color.New(color.FgWhite).SprintfFunc()
+	// Check if we stderr, stdout are dumb terminals, we do not apply
+	// ansi coloring on dumb terminals.
+	isTerminal = func() bool {
+		return isatty.IsTerminal(os.Stdout.Fd()) && isatty.IsTerminal(os.Stderr.Fd())
+	}
+
+	colorBold = func() func(a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.Bold).SprintFunc()
+		}
+		return fmt.Sprint
+	}()
+	colorFgRed = func() func(format string, a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.FgRed).SprintfFunc()
+		}
+		return fmt.Sprintf
+	}()
+	colorBgRed = func() func(format string, a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.BgRed).SprintfFunc()
+		}
+		return fmt.Sprintf
+	}()
+	colorFgWhite = func() func(format string, a ...interface{}) string {
+		if isTerminal() {
+			return color.New(color.FgWhite).SprintfFunc()
+		}
+		return fmt.Sprintf
+	}()
 )
 
 var ansiRE = regexp.MustCompile("(\x1b[^m]*m)")
@@ -40,15 +68,21 @@ func ansiEscape(format string, args ...interface{}) {
 }
 
 func ansiMoveRight(n int) {
-	ansiEscape("[%dC", n)
+	if isTerminal() {
+		ansiEscape("[%dC", n)
+	}
 }
 
 func ansiSaveAttributes() {
-	ansiEscape("7")
+	if isTerminal() {
+		ansiEscape("7")
+	}
 }
 
 func ansiRestoreAttributes() {
-	ansiEscape("8")
+	if isTerminal() {
+		ansiEscape("8")
+	}
 }
 
 func uniqueEntries(paths []string) []string {

cmd/namespace-lock.go

@@ -133,31 +133,31 @@ type nsLockMap struct {
 	// Indicates if namespace is part of a distributed setup.
 	isDistXL     bool
 	lockMap      map[nsParam]*nsLock
-	lockMapMutex sync.Mutex
+	lockMapMutex sync.RWMutex
 }
 
 // Lock the namespace resource.
 func (n *nsLockMap) lock(volume, path string, lockSource, opsID string, readLock bool, timeout time.Duration) (locked bool) {
 	var nsLk *nsLock
-	n.lockMapMutex.Lock()
 
+	n.lockMapMutex.Lock()
 	param := nsParam{volume, path}
 	nsLk, found := n.lockMap[param]
 	if !found {
-		nsLk = &nsLock{
+		n.lockMap[param] = &nsLock{
 			RWLockerSync: func() RWLockerSync {
 				if n.isDistXL {
 					return dsync.NewDRWMutex(pathJoin(volume, path), globalDsync)
 				}
 				return &lsync.LRWMutex{}
 			}(),
-			ref: 0,
+			ref: 1,
 		}
-		n.lockMap[param] = nsLk
+		nsLk = n.lockMap[param]
+	} else {
+		// Update ref count here to avoid multiple races.
+		nsLk.ref++
 	}
-	nsLk.ref++ // Update ref count here to avoid multiple races.
-
-	// Unlock map before Locking NS which might block.
 	n.lockMapMutex.Unlock()
 
 	// Locking here will block (until timeout).
@@ -168,44 +168,44 @@ func (n *nsLockMap) lock(volume, path string, lockSource, opsID string, readLock
 	}
 
 	if !locked { // We failed to get the lock
+
+		// Decrement ref count since we failed to get the lock
 		n.lockMapMutex.Lock()
-		defer n.lockMapMutex.Unlock()
-
-		nsLk.ref-- // Decrement ref count since we failed to get the lock
-
+		nsLk.ref--
 		if nsLk.ref == 0 {
 			// Remove from the map if there are no more references.
 			delete(n.lockMap, param)
 		}
+		n.lockMapMutex.Unlock()
 	}
 	return
 }
 
 // Unlock the namespace resource.
 func (n *nsLockMap) unlock(volume, path, opsID string, readLock bool) {
-	// nsLk.Unlock() will not block, hence locking the map for the
-	// entire function is fine.
-	n.lockMapMutex.Lock()
-	defer n.lockMapMutex.Unlock()
-
 	param := nsParam{volume, path}
-	if nsLk, found := n.lockMap[param]; found {
-		if readLock {
-			nsLk.RUnlock()
-		} else {
-			nsLk.Unlock()
-		}
-		if nsLk.ref == 0 {
-			logger.LogIf(context.Background(), errors.New("Namespace reference count cannot be 0"))
-		}
-		if nsLk.ref != 0 {
-			nsLk.ref--
-		}
+	n.lockMapMutex.RLock()
+	nsLk, found := n.lockMap[param]
+	n.lockMapMutex.RUnlock()
+	if !found {
+		return
+	}
+	if readLock {
+		nsLk.RUnlock()
+	} else {
+		nsLk.Unlock()
+	}
+	n.lockMapMutex.Lock()
+	if nsLk.ref == 0 {
+		logger.LogIf(context.Background(), errors.New("Namespace reference count cannot be 0"))
+	} else {
+		nsLk.ref--
 		if nsLk.ref == 0 {
 			// Remove from the map if there are no more references.
 			delete(n.lockMap, param)
 		}
 	}
+	n.lockMapMutex.Unlock()
 }
 
 // Lock - locks the given resource for writes, using a previously

cmd/notification.go

@@ -17,11 +17,9 @@
 package cmd
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"encoding/xml"
-	"errors"
 	"fmt"
 	"net/url"
 	"path"
@@ -29,9 +27,7 @@ import (
 	"time"
 
 	"github.com/minio/minio/cmd/logger"
-	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/event"
-	"github.com/minio/minio/pkg/hash"
 	xnet "github.com/minio/minio/pkg/net"
 	"github.com/minio/minio/pkg/policy"
 )
@@ -85,8 +81,8 @@ func (sys *NotificationSys) DeleteBucket(ctx context.Context, bucketName string)
 	}()
 }
 
-// SetCredentials - calls SetCredentials RPC call on all peers.
-func (sys *NotificationSys) SetCredentials(credentials auth.Credentials) map[xnet.Host]error {
+// LoadCredentials - calls LoadCredentials RPC call on all peers.
+func (sys *NotificationSys) LoadCredentials() map[xnet.Host]error {
 	errors := make(map[xnet.Host]error)
 	var wg sync.WaitGroup
 	for addr, client := range sys.peerRPCClientMap {
@@ -95,7 +91,7 @@ func (sys *NotificationSys) SetCredentials(credentials auth.Credentials) map[xne
 			defer wg.Done()
 			// Try to set credentials in three attempts.
 			for i := 0; i < 3; i++ {
-				err := client.SetCredentials(credentials)
+				err := client.LoadCredentials()
 				if err == nil {
 					break
 				}
@@ -529,41 +525,6 @@ func sendEvent(args eventArgs) {
 	}()
 }
 
-func saveConfig(objAPI ObjectLayer, configFile string, data []byte) error {
-	hashReader, err := hash.NewReader(bytes.NewReader(data), int64(len(data)), "", getSHA256Hash(data))
-	if err != nil {
-		return err
-	}
-
-	_, err = objAPI.PutObject(context.Background(), minioMetaBucket, configFile, hashReader, nil)
-	return err
-}
-
-var errConfigNotFound = errors.New("config file not found")
-
-func readConfig(ctx context.Context, objAPI ObjectLayer, configFile string) (*bytes.Buffer, error) {
-	var buffer bytes.Buffer
-	// Read entire content by setting size to -1
-	err := objAPI.GetObject(ctx, minioMetaBucket, configFile, 0, -1, &buffer, "")
-	if err != nil {
-		// Ignore if err is ObjectNotFound or IncompleteBody when bucket is not configured with notification
-		if isErrObjectNotFound(err) || isErrIncompleteBody(err) || isInsufficientReadQuorum(err) {
-			return nil, errConfigNotFound
-		}
-
-		logger.GetReqInfo(ctx).AppendTags("configFile", configFile)
-		logger.LogIf(ctx, err)
-		return nil, err
-	}
-
-	// Return NoSuchNotifications on empty content.
-	if buffer.Len() == 0 {
-		return nil, errNoSuchNotifications
-	}
-
-	return &buffer, nil
-}
-
 func readNotificationConfig(ctx context.Context, objAPI ObjectLayer, bucketName string) (*event.Config, error) {
 	// Construct path to notification.xml for the given bucket.
 	configFile := path.Join(bucketConfigPrefix, bucketName, bucketNotificationConfig)

cmd/object-api-errors.go

@@ -314,10 +314,15 @@ func (e InvalidUploadID) Error() string {
 }
 
 // InvalidPart One or more of the specified parts could not be found
-type InvalidPart struct{}
+type InvalidPart struct {
+	PartNumber int
+	ExpETag    string
+	GotETag    string
+}
 
 func (e InvalidPart) Error() string {
-	return "One or more of the specified parts could not be found. The part may not have been uploaded, or the specified entity tag may not match the part's entity tag."
+	return fmt.Sprintf("Specified part could not be found. PartNumber %d, Expected %s, got %s",
+		e.PartNumber, e.ExpETag, e.GotETag)
 }
 
 // PartTooSmall - error if part size is less than 5MB.
@@ -375,20 +380,14 @@ func (e BackendDown) Error() string {
 
 // isErrIncompleteBody - Check if error type is IncompleteBody.
 func isErrIncompleteBody(err error) bool {
-	switch err.(type) {
-	case IncompleteBody:
-		return true
-	}
-	return false
+	_, ok := err.(IncompleteBody)
+	return ok
 }
 
 // isErrObjectNotFound - Check if error type is ObjectNotFound.
 func isErrObjectNotFound(err error) bool {
-	switch err.(type) {
-	case ObjectNotFound:
-		return true
-	}
-	return false
+	_, ok := err.(ObjectNotFound)
+	return ok
 }
 
 // isInsufficientReadQuorum - Check if error type is InsufficientReadQuorum.

cmd/object-api-input-checks.go

@@ -196,11 +196,6 @@ func checkPutObjectArgs(ctx context.Context, bucket, object string, obj ObjectLa
 		hasPrefix(object, slashSeparator) ||
 		(hasSuffix(object, slashSeparator) && size != 0) ||
 		!IsValidObjectPrefix(object) {
-		logger.LogIf(ctx, ObjectNameInvalid{
-			Bucket: bucket,
-			Object: object,
-		})
-
 		return ObjectNameInvalid{
 			Bucket: bucket,
 			Object: object,

cmd/object-api-listobjects_test.go

@@ -592,13 +592,7 @@ func BenchmarkListObjects(b *testing.B) {
 		b.Fatal(err)
 	}
 	defer os.RemoveAll(directory)
-	// initialize the root directory.
-	rootPath, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
-		b.Fatalf("Unable to initialize config. %s", err)
-	}
 
-	defer os.RemoveAll(rootPath)
 	// Create the obj.
 	obj := initFSObjectsB(directory, b)
 

cmd/object-api-multipart_test.go

@@ -19,8 +19,10 @@ package cmd
 import (
 	"bytes"
 	"context"
+	"encoding/hex"
 	"fmt"
 	"os"
+	"reflect"
 	"strings"
 	"testing"
 
@@ -1877,8 +1879,8 @@ func testObjectCompleteMultipartUpload(obj ObjectLayer, instanceType string, t T
 		// Asserting for Invalid UploadID (Test number 9).
 		{bucketNames[0], objectNames[0], "abc", []CompletePart{}, "", InvalidUploadID{UploadID: "abc"}, false},
 		// Test case with invalid Part Etag (Test number 10-11).
-		{bucketNames[0], objectNames[0], uploadIDs[0], []CompletePart{{ETag: "abc"}}, "", fmt.Errorf("encoding/hex: odd length hex string"), false},
-		{bucketNames[0], objectNames[0], uploadIDs[0], []CompletePart{{ETag: "abcz"}}, "", fmt.Errorf("encoding/hex: invalid byte: U+007A 'z'"), false},
+		{bucketNames[0], objectNames[0], uploadIDs[0], []CompletePart{{ETag: "abc"}}, "", hex.ErrLength, false},
+		{bucketNames[0], objectNames[0], uploadIDs[0], []CompletePart{{ETag: "abcz"}}, "", hex.InvalidByteError(00), false},
 		// Part number 0 doesn't exist, expecting InvalidPart error (Test number 12).
 		{bucketNames[0], objectNames[0], uploadIDs[0], []CompletePart{{ETag: "abcd", PartNumber: 0}}, "", InvalidPart{}, false},
 		// // Upload and PartNumber exists, But a deliberate ETag mismatch is introduced (Test number 13).
@@ -1909,7 +1911,7 @@ func testObjectCompleteMultipartUpload(obj ObjectLayer, instanceType string, t T
 		}
 		// Failed as expected, but does it fail for the expected reason.
 		if actualErr != nil && !testCase.shouldPass {
-			if !strings.Contains(actualErr.Error(), testCase.expectedErr.Error()) {
+			if reflect.TypeOf(actualErr) != reflect.TypeOf(testCase.expectedErr) {
 				t.Errorf("Test %d: %s: Expected to fail with error \"%s\", but instead failed with error \"%s\"", i+1, instanceType, testCase.expectedErr, actualErr)
 			}
 		}

cmd/object-handlers.go

@@ -30,9 +30,11 @@ import (
 	"net/url"
 	"sort"
 	"strconv"
+	"strings"
 
 	"github.com/gorilla/mux"
 	miniogo "github.com/minio/minio-go"
+	"github.com/minio/minio/cmd/crypto"
 	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/dns"
 	"github.com/minio/minio/pkg/event"
@@ -40,6 +42,7 @@ import (
 	"github.com/minio/minio/pkg/hash"
 	"github.com/minio/minio/pkg/ioutil"
 	"github.com/minio/minio/pkg/policy"
+	"github.com/minio/minio/pkg/s3select"
 	sha256 "github.com/minio/sha256-simd"
 	"github.com/minio/sio"
 )
@@ -63,13 +66,13 @@ func setHeadGetRespHeaders(w http.ResponseWriter, reqParams url.Values) {
 	}
 }
 
-// GetObjectHandler - GET Object
+// SelectObjectContentHandler - GET Object?select
 // ----------
-// This implementation of the GET operation retrieves object. To use GET,
-// you must have READ access to the object.
-func (api objectAPIHandlers) GetObjectHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "GetObject")
-
+// This implementation of the GET operation retrieves object content based
+// on an SQL expression. In the request, along with the sql expression, you must
+// also specify a data serialization format (JSON, CSV) of the object.
+func (api objectAPIHandlers) SelectObjectContentHandler(w http.ResponseWriter, r *http.Request) {
+	ctx := newContext(r, w, "SelectObject")
 	var object, bucket string
 	vars := mux.Vars(r)
 	bucket = vars["bucket"]
@@ -87,6 +90,193 @@ func (api objectAPIHandlers) GetObjectHandler(w http.ResponseWriter, r *http.Req
 		getObjectInfo = api.CacheAPI().GetObjectInfo
 	}
 
+	if s3Error := checkRequestAuthType(ctx, r, policy.GetObjectAction, bucket, object); s3Error != ErrNone {
+		if getRequestAuthType(r) == authTypeAnonymous {
+			// As per "Permission" section in
+			// https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectGET.html If
+			// the object you request does not exist, the error Amazon S3 returns
+			// depends on whether you also have the s3:ListBucket permission. * If you
+			// have the s3:ListBucket permission on the bucket, Amazon S3 will return
+			// an HTTP status code 404 ("no such key") error. * if you don’t have the
+			// s3:ListBucket permission, Amazon S3 will return an HTTP status code 403
+			// ("access denied") error.`
+			if globalPolicySys.IsAllowed(policy.Args{
+				Action:          policy.ListBucketAction,
+				BucketName:      bucket,
+				ConditionValues: getConditionValues(r, ""),
+				IsOwner:         false,
+			}) {
+				_, err := getObjectInfo(ctx, bucket, object)
+				if toAPIErrorCode(err) == ErrNoSuchKey {
+					s3Error = ErrNoSuchKey
+				}
+			}
+		}
+		writeErrorResponse(w, s3Error, r.URL)
+		return
+	}
+	if r.ContentLength <= 0 {
+		writeErrorResponse(w, ErrEmptyRequestBody, r.URL)
+		return
+	}
+	var selectReq ObjectSelectRequest
+	if err := xmlDecoder(r.Body, &selectReq, r.ContentLength); err != nil {
+		writeErrorResponse(w, ErrMalformedXML, r.URL)
+		return
+	}
+
+	objInfo, err := getObjectInfo(ctx, bucket, object)
+	if err != nil {
+		writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+		return
+	}
+	// Get request range.
+	rangeHeader := r.Header.Get("Range")
+	if rangeHeader != "" {
+		writeErrorResponse(w, ErrUnsupportedRangeHeader, r.URL)
+		return
+	}
+
+	if selectReq.InputSerialization.CompressionType == SelectCompressionGZIP {
+		if !strings.Contains(objInfo.ContentType, "gzip") {
+			writeErrorResponse(w, ErrInvalidDataSource, r.URL)
+			return
+		}
+	}
+	if selectReq.InputSerialization.CompressionType == SelectCompressionBZIP {
+		if !strings.Contains(objInfo.ContentType, "bzip") {
+			writeErrorResponse(w, ErrInvalidDataSource, r.URL)
+			return
+		}
+	}
+	if selectReq.InputSerialization.CompressionType == SelectCompressionNONE ||
+		selectReq.InputSerialization.CompressionType == "" {
+		selectReq.InputSerialization.CompressionType = SelectCompressionNONE
+		if !strings.Contains(objInfo.ContentType, "text/csv") {
+			writeErrorResponse(w, ErrInvalidDataSource, r.URL)
+			return
+		}
+	}
+	if !strings.EqualFold(string(selectReq.ExpressionType), "SQL") {
+		writeErrorResponse(w, ErrInvalidExpressionType, r.URL)
+		return
+	}
+	if len(selectReq.Expression) >= s3select.MaxExpressionLength {
+		writeErrorResponse(w, ErrExpressionTooLong, r.URL)
+		return
+	}
+	if selectReq.InputSerialization.CSV.FileHeaderInfo != CSVFileHeaderInfoUse &&
+		selectReq.InputSerialization.CSV.FileHeaderInfo != CSVFileHeaderInfoNone &&
+		selectReq.InputSerialization.CSV.FileHeaderInfo != CSVFileHeaderInfoIgnore &&
+		selectReq.InputSerialization.CSV.FileHeaderInfo != "" {
+		writeErrorResponse(w, ErrInvalidFileHeaderInfo, r.URL)
+		return
+	}
+	if selectReq.OutputSerialization.CSV.QuoteFields != CSVQuoteFieldsAlways &&
+		selectReq.OutputSerialization.CSV.QuoteFields != CSVQuoteFieldsAsNeeded &&
+		selectReq.OutputSerialization.CSV.QuoteFields != "" {
+		writeErrorResponse(w, ErrInvalidQuoteFields, r.URL)
+		return
+	}
+
+	getObject := objectAPI.GetObject
+	if api.CacheAPI() != nil && !crypto.SSEC.IsRequested(r.Header) {
+		getObject = api.CacheAPI().GetObject
+	}
+
+	reader, pipewriter := io.Pipe()
+
+	// Get the object.
+	var startOffset int64
+	length := objInfo.Size
+
+	var writer io.Writer
+	writer = pipewriter
+	if objectAPI.IsEncryptionSupported() {
+		if crypto.SSEC.IsRequested(r.Header) {
+			// Response writer should be limited early on for decryption upto required length,
+			// additionally also skipping mod(offset)64KiB boundaries.
+			writer = ioutil.LimitedWriter(writer, startOffset%(64*1024), length)
+
+			writer, startOffset, length, err = DecryptBlocksRequest(writer, r, bucket,
+				object, startOffset, length, objInfo, false)
+			if err != nil {
+				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+				return
+			}
+		}
+	}
+	go func() {
+		defer reader.Close()
+		if gerr := getObject(ctx, bucket, object, 0, objInfo.Size, writer, objInfo.ETag); gerr != nil {
+			pipewriter.CloseWithError(gerr)
+			return
+		}
+		pipewriter.Close() // Close writer explicitly signaling we wrote all data.
+	}()
+
+	//s3select //Options
+	if selectReq.OutputSerialization.CSV.FieldDelimiter == "" {
+		selectReq.OutputSerialization.CSV.FieldDelimiter = ","
+	}
+	if selectReq.InputSerialization.CSV.FileHeaderInfo == "" {
+		selectReq.InputSerialization.CSV.FileHeaderInfo = CSVFileHeaderInfoNone
+	}
+	if selectReq.InputSerialization.CSV != nil {
+		options := &s3select.Options{
+			HasHeader:            selectReq.InputSerialization.CSV.FileHeaderInfo != CSVFileHeaderInfoNone,
+			FieldDelimiter:       selectReq.InputSerialization.CSV.FieldDelimiter,
+			Comments:             selectReq.InputSerialization.CSV.Comments,
+			Name:                 "S3Object", // Default table name for all objects
+			ReadFrom:             reader,
+			Compressed:           string(selectReq.InputSerialization.CompressionType),
+			Expression:           selectReq.Expression,
+			OutputFieldDelimiter: selectReq.OutputSerialization.CSV.FieldDelimiter,
+			StreamSize:           objInfo.Size,
+			HeaderOpt:            selectReq.InputSerialization.CSV.FileHeaderInfo == CSVFileHeaderInfoUse,
+		}
+		s3s, err := s3select.NewInput(options)
+		if err != nil {
+			writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+			return
+		}
+		_, _, _, _, _, _, err = s3s.ParseSelect(selectReq.Expression)
+		if err != nil {
+			writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+			return
+		}
+		if err = s3s.Execute(w); err != nil {
+			logger.LogIf(ctx, err)
+		}
+	}
+}
+
+// GetObjectHandler - GET Object
+// ----------
+// This implementation of the GET operation retrieves object. To use GET,
+// you must have READ access to the object.
+func (api objectAPIHandlers) GetObjectHandler(w http.ResponseWriter, r *http.Request) {
+	ctx := newContext(r, w, "GetObject")
+
+	objectAPI := api.ObjectAPI()
+	if objectAPI == nil {
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		return
+	}
+	if crypto.S3.IsRequested(r.Header) || crypto.S3KMS.IsRequested(r.Header) { // If SSE-S3 or SSE-KMS present -> AWS fails with undefined error
+		writeErrorResponse(w, ErrBadRequest, r.URL)
+		return
+	}
+
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+	object := vars["object"]
+
+	getObjectInfo := objectAPI.GetObjectInfo
+	if api.CacheAPI() != nil {
+		getObjectInfo = api.CacheAPI().GetObjectInfo
+	}
+
 	if s3Error := checkRequestAuthType(ctx, r, policy.GetObjectAction, bucket, object); s3Error != ErrNone {
 		if getRequestAuthType(r) == authTypeAnonymous {
 			// As per "Permission" section in https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectGET.html
@@ -155,7 +345,8 @@ func (api objectAPIHandlers) GetObjectHandler(w http.ResponseWriter, r *http.Req
 	var writer io.Writer
 	writer = w
 	if objectAPI.IsEncryptionSupported() {
-		if hasSSECustomerHeader(r.Header) {
+		s3Encrypted := crypto.S3.IsEncrypted(objInfo.UserDefined)
+		if crypto.SSEC.IsRequested(r.Header) || s3Encrypted {
 			// Response writer should be limited early on for decryption upto required length,
 			// additionally also skipping mod(offset)64KiB boundaries.
 			writer = ioutil.LimitedWriter(writer, startOffset%(64*1024), length)
@@ -165,24 +356,34 @@ func (api objectAPIHandlers) GetObjectHandler(w http.ResponseWriter, r *http.Req
 				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 				return
 			}
-
-			w.Header().Set(SSECustomerAlgorithm, r.Header.Get(SSECustomerAlgorithm))
-			w.Header().Set(SSECustomerKeyMD5, r.Header.Get(SSECustomerKeyMD5))
+			if s3Encrypted {
+				w.Header().Set(crypto.SSEHeader, crypto.SSEAlgorithmAES256)
+			} else {
+				w.Header().Set(crypto.SSECAlgorithm, r.Header.Get(crypto.SSECAlgorithm))
+				w.Header().Set(crypto.SSECKeyMD5, r.Header.Get(crypto.SSECKeyMD5))
+			}
 		}
 	}
 
 	setObjectHeaders(w, objInfo, hrange)
 	setHeadGetRespHeaders(w, r.URL.Query())
-	httpWriter := ioutil.WriteOnClose(writer)
 
 	getObject := objectAPI.GetObject
-	if api.CacheAPI() != nil && !hasSSECustomerHeader(r.Header) {
+	if api.CacheAPI() != nil && !crypto.SSEC.IsRequested(r.Header) && !crypto.S3.IsEncrypted(objInfo.UserDefined) {
 		getObject = api.CacheAPI().GetObject
 	}
 
+	statusCodeWritten := false
+	httpWriter := ioutil.WriteOnClose(writer)
+
+	if hrange != nil && hrange.offsetBegin > -1 {
+		statusCodeWritten = true
+		w.WriteHeader(http.StatusPartialContent)
+	}
+
 	// Reads the object at startOffset and writes to mw.
 	if err = getObject(ctx, bucket, object, startOffset, length, httpWriter, objInfo.ETag); err != nil {
-		if !httpWriter.HasWritten() { // write error response only if no data has been written to client yet
+		if !httpWriter.HasWritten() && !statusCodeWritten { // write error response only if no data or headers has been written to client yet
 			writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 		}
 		httpWriter.Close()
@@ -190,7 +391,7 @@ func (api objectAPIHandlers) GetObjectHandler(w http.ResponseWriter, r *http.Req
 	}
 
 	if err = httpWriter.Close(); err != nil {
-		if !httpWriter.HasWritten() { // write error response only if no data has been written to client yet
+		if !httpWriter.HasWritten() && !statusCodeWritten { // write error response only if no data or headers has been written to client yet
 			writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 			return
 		}
@@ -220,16 +421,19 @@ func (api objectAPIHandlers) GetObjectHandler(w http.ResponseWriter, r *http.Req
 func (api objectAPIHandlers) HeadObjectHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "HeadObject")
 
-	var object, bucket string
-	vars := mux.Vars(r)
-	bucket = vars["bucket"]
-	object = vars["object"]
-
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
 		writeErrorResponseHeadersOnly(w, ErrServerNotInitialized)
 		return
 	}
+	if crypto.S3.IsRequested(r.Header) || crypto.S3KMS.IsRequested(r.Header) { // If SSE-S3 or SSE-KMS present -> AWS fails with undefined error
+		writeErrorResponse(w, ErrBadRequest, r.URL)
+		return
+	}
+
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+	object := vars["object"]
 
 	getObjectInfo := objectAPI.GetObjectInfo
 	if api.CacheAPI() != nil {
@@ -269,12 +473,17 @@ func (api objectAPIHandlers) HeadObjectHandler(w http.ResponseWriter, r *http.Re
 			writeErrorResponse(w, apiErr, r.URL)
 			return
 		} else if encrypted {
+			s3Encrypted := crypto.S3.IsEncrypted(objInfo.UserDefined)
 			if _, err = DecryptRequest(w, r, bucket, object, objInfo.UserDefined); err != nil {
 				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 				return
 			}
-			w.Header().Set(SSECustomerAlgorithm, r.Header.Get(SSECustomerAlgorithm))
-			w.Header().Set(SSECustomerKeyMD5, r.Header.Get(SSECustomerKeyMD5))
+			if s3Encrypted {
+				w.Header().Set(crypto.SSEHeader, crypto.SSEAlgorithmAES256)
+			} else {
+				w.Header().Set(crypto.SSECAlgorithm, r.Header.Get(crypto.SSECAlgorithm))
+				w.Header().Set(crypto.SSECKeyMD5, r.Header.Get(crypto.SSECKeyMD5))
+			}
 		}
 	}
 
@@ -343,14 +552,19 @@ func getCpObjMetadataFromHeader(ctx context.Context, r *http.Request, userMeta m
 func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "CopyObject")
 
-	vars := mux.Vars(r)
-	dstBucket := vars["bucket"]
-	dstObject := vars["object"]
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
 		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
 		return
 	}
+	if !objectAPI.IsEncryptionSupported() && crypto.S3KMS.IsRequested(r.Header) {
+		writeErrorResponse(w, ErrNotImplemented, r.URL) // SSE-KMS is not supported
+		return
+	}
+
+	vars := mux.Vars(r)
+	dstBucket := vars["bucket"]
+	dstObject := vars["object"]
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.PutObjectAction, dstBucket, dstObject); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
@@ -438,10 +652,14 @@ func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Re
 	var encMetadata = make(map[string]string)
 	if objectAPI.IsEncryptionSupported() {
 		var oldKey, newKey []byte
-		sseCopyC := hasSSECopyCustomerHeader(r.Header)
-		sseC := hasSSECustomerHeader(r.Header)
-		if sseC {
-			newKey, err = ParseSSECustomerRequest(r)
+		sseCopyS3 := crypto.S3.IsEncrypted(srcInfo.UserDefined)
+		sseCopyC := crypto.SSECopy.IsRequested(r.Header)
+		sseC := crypto.SSEC.IsRequested(r.Header)
+		sseS3 := crypto.S3.IsRequested(r.Header)
+		if sseC || sseS3 {
+			if sseC {
+				newKey, err = ParseSSECustomerRequest(r)
+			}
 			if err != nil {
 				pipeWriter.CloseWithError(err)
 				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
@@ -453,7 +671,7 @@ func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Re
 		// otherwise we proceed to encrypt/decrypt.
 		if sseCopyC && sseC && cpSrcDstSame {
 			// Get the old key which needs to be rotated.
-			oldKey, err = ParseSSECopyCustomerRequest(r)
+			oldKey, err = ParseSSECopyCustomerRequest(r, srcInfo.UserDefined)
 			if err != nil {
 				pipeWriter.CloseWithError(err)
 				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
@@ -471,7 +689,7 @@ func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Re
 			// Since we are rotating the keys, make sure to update the metadata.
 			srcInfo.metadataOnly = true
 		} else {
-			if sseCopyC {
+			if sseCopyC || sseCopyS3 {
 				// Source is encrypted make sure to save the encrypted size.
 				writer = ioutil.LimitedWriter(writer, 0, srcInfo.Size)
 				writer, srcInfo.Size, err = DecryptAllBlocksCopyRequest(writer, r, srcBucket, srcObject, srcInfo)
@@ -484,12 +702,12 @@ func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Re
 				// we are creating a new object at this point, even
 				// if source and destination are same objects.
 				srcInfo.metadataOnly = false
-				if sseC {
+				if sseC || sseS3 {
 					size = srcInfo.Size
 				}
 			}
-			if sseC {
-				reader, err = newEncryptReader(reader, newKey, dstBucket, dstObject, encMetadata)
+			if sseC || sseS3 {
+				reader, err = newEncryptReader(reader, newKey, dstBucket, dstObject, encMetadata, sseS3)
 				if err != nil {
 					pipeWriter.CloseWithError(err)
 					writeErrorResponse(w, toAPIErrorCode(err), r.URL)
@@ -499,10 +717,11 @@ func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Re
 				// we are creating a new object at this point, even
 				// if source and destination are same objects.
 				srcInfo.metadataOnly = false
-				if !sseCopyC {
+				if !sseCopyC && !sseCopyS3 {
 					size = srcInfo.EncryptedSize()
 				}
 			}
+
 			srcInfo.Reader, err = hash.NewReader(reader, size, "", "") // do not try to verify encrypted content
 			if err != nil {
 				pipeWriter.CloseWithError(err)
@@ -512,7 +731,6 @@ func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Re
 		}
 	}
 	srcInfo.Writer = writer
-
 	srcInfo.UserDefined, err = getCpObjMetadataFromHeader(ctx, r, srcInfo.UserDefined)
 	if err != nil {
 		pipeWriter.CloseWithError(err)
@@ -531,7 +749,7 @@ func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Re
 	// metadataOnly is true indicating that we are not overwriting the object.
 	// if encryption is enabled we do not need explicit "REPLACE" metadata to
 	// be enabled as well - this is to allow for key-rotation.
-	if !isMetadataReplace(r.Header) && srcInfo.metadataOnly && !srcInfo.IsEncrypted() {
+	if !isMetadataReplace(r.Header) && srcInfo.metadataOnly && !crypto.SSEC.IsEncrypted(srcInfo.UserDefined) {
 		pipeWriter.CloseWithError(fmt.Errorf("invalid copy dest"))
 		// If x-amz-metadata-directive is not set to REPLACE then we need
 		// to error out if source and destination are same.
@@ -645,10 +863,8 @@ func (api objectAPIHandlers) PutObjectHandler(w http.ResponseWriter, r *http.Req
 		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
 		return
 	}
-
-	// X-Amz-Copy-Source shouldn't be set for this call.
-	if _, ok := r.Header["X-Amz-Copy-Source"]; ok {
-		writeErrorResponse(w, ErrInvalidCopySource, r.URL)
+	if !objectAPI.IsEncryptionSupported() && crypto.S3KMS.IsRequested(r.Header) {
+		writeErrorResponse(w, ErrNotImplemented, r.URL) // SSE-KMS is not supported
 		return
 	}
 
@@ -656,6 +872,12 @@ func (api objectAPIHandlers) PutObjectHandler(w http.ResponseWriter, r *http.Req
 	bucket := vars["bucket"]
 	object := vars["object"]
 
+	// X-Amz-Copy-Source shouldn't be set for this call.
+	if _, ok := r.Header["X-Amz-Copy-Source"]; ok {
+		writeErrorResponse(w, ErrInvalidCopySource, r.URL)
+		return
+	}
+
 	// Validate storage class metadata if present
 	if _, ok := r.Header[amzStorageClassCanonical]; ok {
 		if !isValidStorageClassMeta(r.Header.Get(amzStorageClassCanonical)) {
@@ -787,7 +1009,7 @@ func (api objectAPIHandlers) PutObjectHandler(w http.ResponseWriter, r *http.Req
 	}
 
 	if objectAPI.IsEncryptionSupported() {
-		if hasSSECustomerHeader(r.Header) && !hasSuffix(object, slashSeparator) { // handle SSE-C requests
+		if hasServerSideEncryptionHeader(r.Header) && !hasSuffix(object, slashSeparator) { // handle SSE requests
 			reader, err = EncryptRequest(hashReader, r, bucket, object, metadata)
 			if err != nil {
 				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
@@ -802,7 +1024,7 @@ func (api objectAPIHandlers) PutObjectHandler(w http.ResponseWriter, r *http.Req
 		}
 	}
 
-	if api.CacheAPI() != nil && !hasSSECustomerHeader(r.Header) {
+	if api.CacheAPI() != nil && !hasServerSideEncryptionHeader(r.Header) {
 		putObject = api.CacheAPI().PutObject
 	}
 
@@ -815,9 +1037,12 @@ func (api objectAPIHandlers) PutObjectHandler(w http.ResponseWriter, r *http.Req
 
 	w.Header().Set("ETag", "\""+objInfo.ETag+"\"")
 	if objectAPI.IsEncryptionSupported() {
-		if hasSSECustomerHeader(r.Header) {
-			w.Header().Set(SSECustomerAlgorithm, r.Header.Get(SSECustomerAlgorithm))
-			w.Header().Set(SSECustomerKeyMD5, r.Header.Get(SSECustomerKeyMD5))
+		if crypto.S3.IsEncrypted(objInfo.UserDefined) {
+			w.Header().Set(crypto.SSEHeader, crypto.SSEAlgorithmAES256)
+		}
+		if crypto.SSEC.IsRequested(r.Header) {
+			w.Header().Set(crypto.SSECAlgorithm, r.Header.Get(crypto.SSECAlgorithm))
+			w.Header().Set(crypto.SSECKeyMD5, r.Header.Get(crypto.SSECKeyMD5))
 		}
 	}
 
@@ -847,16 +1072,19 @@ func (api objectAPIHandlers) PutObjectHandler(w http.ResponseWriter, r *http.Req
 func (api objectAPIHandlers) NewMultipartUploadHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "NewMultipartUpload")
 
-	var object, bucket string
-	vars := mux.Vars(r)
-	bucket = vars["bucket"]
-	object = vars["object"]
-
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
 		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
 		return
 	}
+	if !objectAPI.IsEncryptionSupported() && crypto.S3KMS.IsRequested(r.Header) {
+		writeErrorResponse(w, ErrNotImplemented, r.URL) // SSE-KMS is not supported
+		return
+	}
+
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+	object := vars["object"]
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.PutObjectAction, bucket, object); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
@@ -882,18 +1110,11 @@ func (api objectAPIHandlers) NewMultipartUploadHandler(w http.ResponseWriter, r
 	var encMetadata = map[string]string{}
 
 	if objectAPI.IsEncryptionSupported() {
-		if hasSSECustomerHeader(r.Header) {
-			key, err := ParseSSECustomerRequest(r)
-			if err != nil {
+		if hasServerSideEncryptionHeader(r.Header) {
+			if err := setEncryptionMetadata(r, bucket, object, encMetadata); err != nil {
 				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 				return
 			}
-			_, err = newEncryptMetadata(key, bucket, object, encMetadata)
-			if err != nil {
-				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-				return
-			}
-
 			// Set this for multipart only operations, we need to differentiate during
 			// decryption if the file was actually multipart or not.
 			encMetadata[ReservedMetadataPrefix+"Encrypted-Multipart"] = ""
@@ -914,7 +1135,7 @@ func (api objectAPIHandlers) NewMultipartUploadHandler(w http.ResponseWriter, r
 	}
 
 	newMultipartUpload := objectAPI.NewMultipartUpload
-	if api.CacheAPI() != nil {
+	if api.CacheAPI() != nil && !hasServerSideEncryptionHeader(r.Header) {
 		newMultipartUpload = api.CacheAPI().NewMultipartUpload
 	}
 	uploadID, err := newMultipartUpload(ctx, bucket, object, metadata)
@@ -934,15 +1155,19 @@ func (api objectAPIHandlers) NewMultipartUploadHandler(w http.ResponseWriter, r
 func (api objectAPIHandlers) CopyObjectPartHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "CopyObjectPart")
 
-	vars := mux.Vars(r)
-	dstBucket := vars["bucket"]
-	dstObject := vars["object"]
-
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
 		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
 		return
 	}
+	if !objectAPI.IsEncryptionSupported() && crypto.S3KMS.IsRequested(r.Header) {
+		writeErrorResponse(w, ErrNotImplemented, r.URL) // SSE-KMS is not supported
+		return
+	}
+
+	vars := mux.Vars(r)
+	dstBucket := vars["bucket"]
+	dstObject := vars["object"]
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.PutObjectAction, dstBucket, dstObject); s3Error != ErrNone {
 		writeErrorResponse(w, s3Error, r.URL)
@@ -1052,8 +1277,9 @@ func (api objectAPIHandlers) CopyObjectPartHandler(w http.ResponseWriter, r *htt
 			writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 			return
 		}
-		sseCopyC := hasSSECopyCustomerHeader(r.Header)
-		if sseCopyC {
+		sseCopyC := crypto.SSECopy.IsRequested(r.Header)
+		sseCopyS3 := crypto.S3.IsEncrypted(srcInfo.UserDefined)
+		if sseCopyC || sseCopyS3 {
 			// Response writer should be limited early on for decryption upto required length,
 			// additionally also skipping mod(offset)64KiB boundaries.
 			writer = ioutil.LimitedWriter(writer, startOffset%(64*1024), length)
@@ -1064,19 +1290,20 @@ func (api objectAPIHandlers) CopyObjectPartHandler(w http.ResponseWriter, r *htt
 				return
 			}
 		}
-		if li.IsEncrypted() {
-			if !hasSSECustomerHeader(r.Header) {
+		if crypto.IsEncrypted(li.UserDefined) {
+			if !hasServerSideEncryptionHeader(r.Header) {
 				writeErrorResponse(w, ErrSSEMultipartEncrypted, r.URL)
 				return
 			}
 			var key []byte
-			key, err = ParseSSECustomerRequest(r)
-			if err != nil {
-				pipeWriter.CloseWithError(err)
-				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-				return
+			if crypto.SSEC.IsRequested(r.Header) {
+				key, err = ParseSSECustomerRequest(r)
+				if err != nil {
+					pipeWriter.CloseWithError(err)
+					writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+					return
+				}
 			}
-
 			var objectEncryptionKey []byte
 			objectEncryptionKey, err = decryptObjectInfo(key, dstBucket, dstObject, li.UserDefined)
 			if err != nil {
@@ -1133,14 +1360,19 @@ func (api objectAPIHandlers) CopyObjectPartHandler(w http.ResponseWriter, r *htt
 func (api objectAPIHandlers) PutObjectPartHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "PutObjectPart")
 
-	vars := mux.Vars(r)
-	bucket := vars["bucket"]
-	object := vars["object"]
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
 		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
 		return
 	}
+	if !objectAPI.IsEncryptionSupported() && crypto.S3KMS.IsRequested(r.Header) {
+		writeErrorResponse(w, ErrNotImplemented, r.URL) // SSE-KMS is not supported
+		return
+	}
+
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+	object := vars["object"]
 
 	// X-Amz-Copy-Source shouldn't be set for this call.
 	if _, ok := r.Header["X-Amz-Copy-Source"]; ok {
@@ -1269,16 +1501,18 @@ func (api objectAPIHandlers) PutObjectPartHandler(w http.ResponseWriter, r *http
 			writeErrorResponse(w, toAPIErrorCode(err), r.URL)
 			return
 		}
-		if li.IsEncrypted() {
-			if !hasSSECustomerHeader(r.Header) {
+		if crypto.IsEncrypted(li.UserDefined) {
+			if !hasServerSideEncryptionHeader(r.Header) {
 				writeErrorResponse(w, ErrSSEMultipartEncrypted, r.URL)
 				return
 			}
 			var key []byte
-			key, err = ParseSSECustomerRequest(r)
-			if err != nil {
-				writeErrorResponse(w, toAPIErrorCode(err), r.URL)
-				return
+			if crypto.SSEC.IsRequested(r.Header) {
+				key, err = ParseSSECustomerRequest(r)
+				if err != nil {
+					writeErrorResponse(w, toAPIErrorCode(err), r.URL)
+					return
+				}
 			}
 
 			// Calculating object encryption key
@@ -1312,7 +1546,7 @@ func (api objectAPIHandlers) PutObjectPartHandler(w http.ResponseWriter, r *http
 	}
 
 	putObjectPart := objectAPI.PutObjectPart
-	if api.CacheAPI() != nil {
+	if api.CacheAPI() != nil && !hasServerSideEncryptionHeader(r.Header) {
 		putObjectPart = api.CacheAPI().PutObjectPart
 	}
 	partInfo, err := putObjectPart(ctx, bucket, object, uploadID, partID, hashReader)

cmd/os-reliable.go

@@ -22,6 +22,53 @@ import (
 	"path"
 )
 
+// Wrapper functions to os.RemoveAll, which calls reliableRemoveAll
+// this is to ensure that if there is a racy parent directory
+// create in between we can simply retry the operation.
+func removeAll(dirPath string) (err error) {
+	if dirPath == "" {
+		return errInvalidArgument
+	}
+
+	if err = checkPathLength(dirPath); err != nil {
+		return err
+	}
+
+	if err = reliableRemoveAll(dirPath); err != nil {
+		switch {
+		case isSysErrNotDir(err):
+			// File path cannot be verified since one of
+			// the parents is a file.
+			return errFileAccessDenied
+		case isSysErrPathNotFound(err):
+			// This is a special case should be handled only for
+			// windows, because windows API does not return "not a
+			// directory" error message. Handle this specifically
+			// here.
+			return errFileAccessDenied
+		}
+	}
+	return err
+}
+
+// Reliably retries os.RemoveAll if for some reason os.RemoveAll returns
+// syscall.ENOTEMPTY (children has files).
+func reliableRemoveAll(dirPath string) (err error) {
+	i := 0
+	for {
+		// Removes all the directories and files.
+		if err = os.RemoveAll(dirPath); err != nil {
+			// Retry only for the first retryable error.
+			if isSysErrNotEmpty(err) && i == 0 {
+				i++
+				continue
+			}
+		}
+		break
+	}
+	return err
+}
+
 // Wrapper functions to os.MkdirAll, which calls reliableMkdirAll
 // this is to ensure that if there is a racy parent directory
 // delete in between we can simply retry the operation.
@@ -83,20 +130,23 @@ func renameAll(srcFilePath, dstFilePath string) (err error) {
 	}
 
 	if err = reliableRename(srcFilePath, dstFilePath); err != nil {
-		if isSysErrNotDir(err) {
+		switch {
+		case isSysErrNotDir(err):
 			return errFileAccessDenied
-		} else if isSysErrPathNotFound(err) {
+		case isSysErrPathNotFound(err):
 			// This is a special case should be handled only for
 			// windows, because windows API does not return "not a
 			// directory" error message. Handle this specifically here.
 			return errFileAccessDenied
-		} else if isSysErrCrossDevice(err) {
+		case isSysErrCrossDevice(err):
 			return fmt.Errorf("%s (%s)->(%s)", errCrossDeviceLink, srcFilePath, dstFilePath)
-		} else if os.IsNotExist(err) {
+		case os.IsNotExist(err):
 			return errFileNotFound
+		default:
+			return err
 		}
 	}
-	return err
+	return nil
 }
 
 // Reliably retries os.RenameAll if for some reason os.RenameAll returns

cmd/peer-rpc-client.go

@@ -21,7 +21,6 @@ import (
 	"crypto/tls"
 
 	"github.com/minio/minio/cmd/logger"
-	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/event"
 	xnet "github.com/minio/minio/pkg/net"
 	"github.com/minio/minio/pkg/policy"
@@ -116,9 +115,9 @@ func (rpcClient *PeerRPCClient) SendEvent(bucketName string, targetID, remoteTar
 	return err
 }
 
-// SetCredentials - calls set credentials RPC.
-func (rpcClient *PeerRPCClient) SetCredentials(credentials auth.Credentials) error {
-	args := SetCredentialsArgs{Credentials: credentials}
+// LoadCredentials - calls load credentials RPC.
+func (rpcClient *PeerRPCClient) LoadCredentials() error {
+	args := AuthArgs{}
 	reply := VoidReply{}
 
 	return rpcClient.Call(peerServiceName+".SetCredentials", &args, &reply)

cmd/peer-rpc-server.go

@@ -24,7 +24,6 @@ import (
 	"github.com/gorilla/mux"
 	"github.com/minio/minio/cmd/logger"
 	xrpc "github.com/minio/minio/cmd/rpc"
-	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/event"
 	xnet "github.com/minio/minio/pkg/net"
 	"github.com/minio/minio/pkg/policy"
@@ -158,35 +157,21 @@ func (receiver *peerRPCReceiver) SendEvent(args *SendEventArgs, reply *bool) err
 	return nil
 }
 
-// SetCredentialsArgs - set credentials RPC arguments.
-type SetCredentialsArgs struct {
-	AuthArgs
-	Credentials auth.Credentials
-}
+// LoadCredentials - handles load credentials RPC call.
+func (receiver *peerRPCReceiver) LoadCredentials(args *AuthArgs, reply *VoidReply) error {
+	// Construct path to config.json for the given bucket.
+	configFile := path.Join(bucketConfigPrefix, minioConfigFile)
+	transactionConfigFile := configFile + ".transaction"
 
-// SetCredentials - handles set credentials RPC call.
-func (receiver *peerRPCReceiver) SetCredentials(args *SetCredentialsArgs, reply *VoidReply) error {
-	if !args.Credentials.IsValid() {
-		return fmt.Errorf("invalid credentials passed")
-	}
-
-	// Acquire lock before updating global configuration.
-	globalServerConfigMu.Lock()
-	defer globalServerConfigMu.Unlock()
-
-	// Update credentials in memory
-	prevCred := globalServerConfig.SetCredential(args.Credentials)
-
-	// Save credentials to config file
-	if err := globalServerConfig.Save(getConfigFile()); err != nil {
-		// As saving configurstion failed, restore previous credential in memory.
-		globalServerConfig.SetCredential(prevCred)
-
-		logger.LogIf(context.Background(), err)
+	// As object layer's GetObject() and PutObject() take respective lock on minioMetaBucket
+	// and configFile, take a transaction lock to avoid race.
+	objLock := globalNSMutex.NewNSLock(minioMetaBucket, transactionConfigFile)
+	if err := objLock.GetRLock(globalOperationTimeout); err != nil {
 		return err
 	}
+	objLock.RUnlock()
 
-	return nil
+	return globalConfigSys.Load(newObjectLayerFn())
 }
 
 // NewPeerRPCServer - returns new peer RPC server.
@@ -203,5 +188,5 @@ func registerPeerRPCRouter(router *mux.Router) {
 	rpcServer, err := NewPeerRPCServer()
 	logger.FatalIf(err, "Unable to initialize peer RPC Server", context.Background())
 	subrouter := router.PathPrefix(minioReservedBucketPath).Subrouter()
-	subrouter.Path(peerServiceSubPath).Handler(rpcServer)
+	subrouter.Path(peerServiceSubPath).HandlerFunc(httpTraceHdrs(rpcServer.ServeHTTP))
 }

cmd/posix-errors.go

@@ -27,13 +27,9 @@ func isSysErrNoSys(err error) bool {
 	if err == syscall.ENOSYS {
 		return true
 	}
-	if pathErr, ok := err.(*os.PathError); ok {
-		switch pathErr.Err {
-		case syscall.ENOSYS:
-			return true
-		}
-	}
-	return false
+	pathErr, ok := err.(*os.PathError)
+	return ok && pathErr.Err == syscall.ENOSYS
+
 }
 
 // Not supported error
@@ -41,13 +37,9 @@ func isSysErrOpNotSupported(err error) bool {
 	if err == syscall.EOPNOTSUPP {
 		return true
 	}
-	if pathErr, ok := err.(*os.PathError); ok {
-		switch pathErr.Err {
-		case syscall.EOPNOTSUPP:
-			return true
-		}
-	}
-	return false
+	pathErr, ok := err.(*os.PathError)
+	return ok && pathErr.Err == syscall.EOPNOTSUPP
+
 }
 
 // No space left on device error
@@ -55,13 +47,8 @@ func isSysErrNoSpace(err error) bool {
 	if err == syscall.ENOSPC {
 		return true
 	}
-	if pathErr, ok := err.(*os.PathError); ok {
-		switch pathErr.Err {
-		case syscall.ENOSPC:
-			return true
-		}
-	}
-	return false
+	pathErr, ok := err.(*os.PathError)
+	return ok && pathErr.Err == syscall.ENOSPC
 }
 
 // Input/output error
@@ -69,13 +56,8 @@ func isSysErrIO(err error) bool {
 	if err == syscall.EIO {
 		return true
 	}
-	if pathErr, ok := err.(*os.PathError); ok {
-		switch pathErr.Err {
-		case syscall.EIO:
-			return true
-		}
-	}
-	return false
+	pathErr, ok := err.(*os.PathError)
+	return ok && pathErr.Err == syscall.EIO
 }
 
 // Check if the given error corresponds to EISDIR (is a directory).
@@ -83,13 +65,9 @@ func isSysErrIsDir(err error) bool {
 	if err == syscall.EISDIR {
 		return true
 	}
-	if pathErr, ok := err.(*os.PathError); ok {
-		switch pathErr.Err {
-		case syscall.EISDIR:
-			return true
-		}
-	}
-	return false
+	pathErr, ok := err.(*os.PathError)
+	return ok && pathErr.Err == syscall.EISDIR
+
 }
 
 // Check if the given error corresponds to ENOTDIR (is not a directory).
@@ -97,13 +75,8 @@ func isSysErrNotDir(err error) bool {
 	if err == syscall.ENOTDIR {
 		return true
 	}
-	if pathErr, ok := err.(*os.PathError); ok {
-		switch pathErr.Err {
-		case syscall.ENOTDIR:
-			return true
-		}
-	}
-	return false
+	pathErr, ok := err.(*os.PathError)
+	return ok && pathErr.Err == syscall.ENOTDIR
 }
 
 // Check if the given error corresponds to the ENAMETOOLONG (name too long).
@@ -111,13 +84,8 @@ func isSysErrTooLong(err error) bool {
 	if err == syscall.ENAMETOOLONG {
 		return true
 	}
-	if pathErr, ok := err.(*os.PathError); ok {
-		switch pathErr.Err {
-		case syscall.ENAMETOOLONG:
-			return true
-		}
-	}
-	return false
+	pathErr, ok := err.(*os.PathError)
+	return ok && pathErr.Err == syscall.ENAMETOOLONG
 }
 
 // Check if the given error corresponds to ENOTEMPTY for unix
@@ -133,8 +101,7 @@ func isSysErrNotEmpty(err error) bool {
 				return true
 			}
 		}
-		switch pathErr.Err {
-		case syscall.ENOTEMPTY:
+		if pathErr.Err == syscall.ENOTEMPTY {
 			return true
 		}
 	}
@@ -161,15 +128,11 @@ func isSysErrHandleInvalid(err error) bool {
 		return false
 	}
 	// Check if err contains ERROR_INVALID_HANDLE errno
-	if errno, ok := err.(syscall.Errno); ok && errno == 0x6 {
-		return true
-	}
-	return false
+	errno, ok := err.(syscall.Errno)
+	return ok && errno == 0x6
 }
 
 func isSysErrCrossDevice(err error) bool {
-	if e, ok := err.(*os.LinkError); ok {
-		return e.Err == syscall.EXDEV
-	}
-	return false
+	e, ok := err.(*os.LinkError)
+	return ok && e.Err == syscall.EXDEV
 }

cmd/posix-list-dir_plan9.go

@@ -1,7 +1,7 @@
-// +build !linux,!darwin,!openbsd,!freebsd,!netbsd
+// +build plan9
 
 /*
- * Minio Cloud Storage, (C) 2016 Minio, Inc.
+ * Minio Cloud Storage, (C) 2016, 2017, 2018 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

cmd/posix-list-dir_unix.go

@@ -1,7 +1,7 @@
-// +build linux darwin freebsd netbsd openbsd
+// +build darwin dragonfly freebsd linux nacl netbsd openbsd solaris
 
 /*
- * Minio Cloud Storage, (C) 2016 Minio, Inc.
+ * Minio Cloud Storage, (C) 2016, 2017, 2018 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -90,9 +90,9 @@ func parseDirents(dirPath string, buf []byte) (entries []string, err error) {
 				return nil, err
 			}
 			if fi.IsDir() {
-				entries = append(entries, fi.Name()+slashSeparator)
+				entries = append(entries, name+slashSeparator)
 			} else if fi.Mode().IsRegular() {
-				entries = append(entries, fi.Name())
+				entries = append(entries, name)
 			}
 		default:
 			// Skip entries which are not file or directory.

cmd/posix-list-dir_windows.go

@@ -0,0 +1,111 @@
+// +build windows
+
+/*
+ * Minio Cloud Storage, (C) 2016, 2017, 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cmd
+
+import (
+	"os"
+	"path"
+	"strings"
+	"syscall"
+)
+
+// Return all the entries at the directory dirPath.
+func readDir(dirPath string) (entries []string, err error) {
+	return readDirN(dirPath, -1)
+}
+
+// Return N entries at the directory dirPath. If count is -1, return all entries
+func readDirN(dirPath string, count int) (entries []string, err error) {
+	d, err := os.Open(dirPath)
+	if err != nil {
+		// File is really not found.
+		if os.IsNotExist(err) {
+			return nil, errFileNotFound
+		}
+
+		// File path cannot be verified since one of the parents is a file.
+		if strings.Contains(err.Error(), "not a directory") {
+			return nil, errFileNotFound
+		}
+		return nil, err
+	}
+	defer d.Close()
+
+	st, err := d.Stat()
+	if err != nil {
+		return nil, err
+	}
+	// Not a directory return error.
+	if !st.IsDir() {
+		return nil, errFileAccessDenied
+	}
+
+	data := &syscall.Win32finddata{}
+
+	remaining := count
+	done := false
+	for !done {
+		e := syscall.FindNextFile(syscall.Handle(d.Fd()), data)
+		if e != nil {
+			if e == syscall.ERROR_NO_MORE_FILES {
+				break
+			} else {
+				err = &os.PathError{
+					Op:   "FindNextFile",
+					Path: dirPath,
+					Err:  e,
+				}
+				return
+			}
+		}
+		name := syscall.UTF16ToString(data.FileName[0:])
+		if name == "." || name == ".." { // Useless names
+			continue
+		}
+		switch {
+		case data.FileAttributes&syscall.FILE_ATTRIBUTE_REPARSE_POINT != 0:
+			// If its symbolic link, follow the link using os.Stat()
+			var fi os.FileInfo
+			fi, err = os.Stat(path.Join(dirPath, name))
+			if err != nil {
+				// If file does not exist, we continue and skip it.
+				// Could happen if it was deleted in the middle while
+				// this list was being performed.
+				if os.IsNotExist(err) {
+					continue
+				}
+				return nil, err
+			}
+			if fi.IsDir() {
+				entries = append(entries, name+slashSeparator)
+			} else if fi.Mode().IsRegular() {
+				entries = append(entries, name)
+			}
+		case data.FileAttributes&syscall.FILE_ATTRIBUTE_DIRECTORY != 0:
+			entries = append(entries, name+slashSeparator)
+		default:
+			entries = append(entries, name)
+		}
+		if remaining > 0 {
+			remaining--
+			done = remaining == 0
+		}
+	}
+	return entries, nil
+}

cmd/posix.go

@@ -31,6 +31,8 @@ import (
 	"syscall"
 	"time"
 
+	"bytes"
+
 	humanize "github.com/dustin/go-humanize"
 	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/disk"
@@ -329,14 +331,16 @@ func (s *posix) checkDiskFound() (err error) {
 	}
 	_, err = os.Stat(s.diskPath)
 	if err != nil {
-		if os.IsNotExist(err) {
+		switch {
+		case os.IsNotExist(err):
 			return errDiskNotFound
-		} else if isSysErrTooLong(err) {
+		case isSysErrTooLong(err):
 			return errFileNameTooLong
-		} else if isSysErrIO(err) {
+		case isSysErrIO(err):
 			return errFaultyDisk
+		default:
+			return err
 		}
-		return err
 	}
 	return nil
 }
@@ -597,16 +601,18 @@ func (s *posix) DeleteVol(volume string) (err error) {
 	}
 	err = os.Remove((volumeDir))
 	if err != nil {
-		if os.IsNotExist(err) {
+		switch {
+		case os.IsNotExist(err):
 			return errVolumeNotFound
-		} else if isSysErrNotEmpty(err) {
+		case isSysErrNotEmpty(err):
 			return errVolumeNotEmpty
-		} else if os.IsPermission(err) {
+		case os.IsPermission(err):
 			return errDiskAccessDenied
-		} else if isSysErrIO(err) {
+		case isSysErrIO(err):
 			return errFaultyDisk
+		default:
+			return err
 		}
-		return err
 	}
 	return nil
 }
@@ -732,13 +738,19 @@ func (s *posix) ReadAll(volume, path string) (buf []byte, err error) {
 //
 // Additionally ReadFile also starts reading from an offset. ReadFile
 // semantics are same as io.ReadFull.
-func (s *posix) ReadFile(volume, path string, offset int64, buffer []byte, verifier *BitrotVerifier) (n int64, err error) {
+func (s *posix) ReadFile(volume, path string, offset int64, buffer []byte, verifier *BitrotVerifier) (int64, error) {
+	var n int
+	var err error
 	defer func() {
 		if err == errFaultyDisk {
 			atomic.AddInt32(&s.ioErrCount, 1)
 		}
 	}()
 
+	if offset < 0 {
+		return 0, errInvalidArgument
+	}
+
 	if atomic.LoadInt32(&s.ioErrCount) > maxAllowedIOError {
 		return 0, errFaultyDisk
 	}
@@ -771,16 +783,18 @@ func (s *posix) ReadFile(volume, path string, offset int64, buffer []byte, verif
 	// Open the file for reading.
 	file, err := os.Open((filePath))
 	if err != nil {
-		if os.IsNotExist(err) {
+		switch {
+		case os.IsNotExist(err):
 			return 0, errFileNotFound
-		} else if os.IsPermission(err) {
+		case os.IsPermission(err):
 			return 0, errFileAccessDenied
-		} else if isSysErrNotDir(err) {
+		case isSysErrNotDir(err):
 			return 0, errFileAccessDenied
-		} else if isSysErrIO(err) {
+		case isSysErrIO(err):
 			return 0, errFaultyDisk
+		default:
+			return 0, err
 		}
-		return 0, err
 	}
 
 	// Close the file descriptor.
@@ -797,35 +811,36 @@ func (s *posix) ReadFile(volume, path string, offset int64, buffer []byte, verif
 		return 0, errIsNotRegular
 	}
 
-	if verifier != nil {
-		bufp := s.pool.Get().(*[]byte)
-		defer s.pool.Put(bufp)
-
-		if offset != 0 {
-			if _, err = io.CopyBuffer(verifier, io.LimitReader(file, offset), *bufp); err != nil {
-				return 0, err
-			}
-		}
-		if _, err = file.Read(buffer); err != nil {
-			return 0, err
-		}
-		if _, err = verifier.Write(buffer); err != nil {
-			return 0, err
-		}
-		if _, err = io.CopyBuffer(verifier, file, *bufp); err != nil {
-			return 0, err
-		}
-		if !verifier.Verify() {
-			return 0, hashMismatchError{hex.EncodeToString(verifier.sum), hex.EncodeToString(verifier.Sum(nil))}
-		}
-		return int64(len(buffer)), err
+	if verifier == nil {
+		n, err = file.ReadAt(buffer, offset)
+		return int64(n), err
 	}
 
-	m, err := file.ReadAt(buffer, offset)
-	if m > 0 && m < len(buffer) {
-		err = io.ErrUnexpectedEOF
+	bufp := s.pool.Get().(*[]byte)
+	defer s.pool.Put(bufp)
+
+	h := verifier.algorithm.New()
+	if _, err = io.CopyBuffer(h, io.LimitReader(file, offset), *bufp); err != nil {
+		return 0, err
 	}
-	return int64(m), err
+
+	if n, err = io.ReadFull(file, buffer); err != nil {
+		return int64(n), err
+	}
+
+	if _, err = h.Write(buffer); err != nil {
+		return 0, err
+	}
+
+	if _, err = io.CopyBuffer(h, file, *bufp); err != nil {
+		return 0, err
+	}
+
+	if bytes.Compare(h.Sum(nil), verifier.sum) != 0 {
+		return 0, hashMismatchError{hex.EncodeToString(verifier.sum), hex.EncodeToString(h.Sum(nil))}
+	}
+
+	return int64(len(buffer)), nil
 }
 
 func (s *posix) createFile(volume, path string) (f *os.File, err error) {
@@ -880,14 +895,16 @@ func (s *posix) createFile(volume, path string) (f *os.File, err error) {
 	w, err := os.OpenFile(filePath, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0666)
 	if err != nil {
 		// File path cannot be verified since one of the parents is a file.
-		if isSysErrNotDir(err) {
+		switch {
+		case isSysErrNotDir(err):
 			return nil, errFileAccessDenied
-		} else if os.IsPermission(err) {
+		case os.IsPermission(err):
 			return nil, errFileAccessDenied
-		} else if isSysErrIO(err) {
+		case isSysErrIO(err):
 			return nil, errFaultyDisk
+		default:
+			return nil, err
 		}
-		return nil, err
 	}
 
 	return w, nil

cmd/posix_test.go

@@ -1140,7 +1140,7 @@ func TestPosixReadFile(t *testing.T) {
 
 	// Create all files needed during testing.
 	appendFiles := testCases[:4]
-
+	v := NewBitrotVerifier(SHA256, getSHA256Sum([]byte("hello, world")))
 	// Create test files for further reading.
 	for i, appendFile := range appendFiles {
 		err = posixStorage.AppendFile(volume, appendFile.fileName, []byte("hello, world"))
@@ -1149,21 +1149,11 @@ func TestPosixReadFile(t *testing.T) {
 		}
 	}
 
-	// Check PathError specially.
 	{
 		buf := make([]byte, 5)
-		if _, err = posixStorage.ReadFile(volume, "myobject", -1, buf, nil); err != nil {
-			isPathError := false
-			switch err.(type) {
-			case *os.PathError:
-				isPathError = true
-			}
-
-			if !isPathError {
-				t.Fatalf("expected: <os.PathError>, got: %v", err)
-			}
-		} else {
-			t.Fatalf("expected: <os.PathError>, got: <nil>")
+		// Test for negative offset.
+		if _, err = posixStorage.ReadFile(volume, "myobject", -1, buf, v); err == nil {
+			t.Fatalf("expected: error, got: <nil>")
 		}
 	}
 
@@ -1172,7 +1162,7 @@ func TestPosixReadFile(t *testing.T) {
 		var n int64
 		// Common read buffer.
 		var buf = make([]byte, testCase.bufSize)
-		n, err = posixStorage.ReadFile(testCase.volume, testCase.fileName, testCase.offset, buf, nil)
+		n, err = posixStorage.ReadFile(testCase.volume, testCase.fileName, testCase.offset, buf, v)
 		if err != nil && testCase.expectedErr != nil {
 			// Validate if the type string of the errors are an exact match.
 			if err.Error() != testCase.expectedErr.Error() {
@@ -1201,7 +1191,7 @@ func TestPosixReadFile(t *testing.T) {
 			// results. In this scenario return 'n' is always lesser than the input buffer.
 			if err == io.ErrUnexpectedEOF {
 				if !bytes.Equal(testCase.expectedBuf, buf[:n]) {
-					t.Errorf("Case: %d %#v, expected: \"%s\", got: \"%s\"", i+1, testCase, string(testCase.expectedBuf), string(buf[:testCase.bufSize]))
+					t.Errorf("Case: %d %#v, expected: \"%s\", got: \"%s\"", i+1, testCase, string(testCase.expectedBuf), string(buf[:n]))
 				}
 				if n > int64(len(buf)) {
 					t.Errorf("Case: %d %#v, expected: %d, got: %d", i+1, testCase, testCase.bufSize, n)
@@ -1245,7 +1235,7 @@ func TestPosixReadFile(t *testing.T) {
 
 		// Common read buffer.
 		var buf = make([]byte, 10)
-		if _, err = posixStorage.ReadFile("mybucket", "myobject", 0, buf, nil); err != errFileAccessDenied {
+		if _, err = posixStorage.ReadFile("mybucket", "myobject", 0, buf, v); err != errFileAccessDenied {
 			t.Errorf("expected: %s, got: %s", errFileAccessDenied, err)
 		}
 	}

cmd/post-policy_test.go

@@ -26,7 +26,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
-	"os"
 	"testing"
 	"time"
 
@@ -118,11 +117,9 @@ func TestPostPolicyBucketHandler(t *testing.T) {
 
 // testPostPolicyBucketHandler - Tests validate post policy handler uploading objects.
 func testPostPolicyBucketHandler(obj ObjectLayer, instanceType string, t TestErrHandler) {
-	root, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
+	if err := newTestConfig(globalMinioDefaultRegion, obj); err != nil {
 		t.Fatalf("Initializing config.json failed")
 	}
-	defer os.RemoveAll(root)
 
 	// get random bucket name.
 	bucketName := getRandomBucketName()
@@ -139,7 +136,7 @@ func testPostPolicyBucketHandler(obj ObjectLayer, instanceType string, t TestErr
 	// objectNames[0].
 	// uploadIds [0].
 	// Create bucket before initiating NewMultipartUpload.
-	err = obj.MakeBucketWithLocation(context.Background(), bucketName, "")
+	err := obj.MakeBucketWithLocation(context.Background(), bucketName, "")
 	if err != nil {
 		// Failed to create newbucket, abort.
 		t.Fatalf("%s : %s", instanceType, err.Error())
@@ -420,11 +417,9 @@ func TestPostPolicyBucketHandlerRedirect(t *testing.T) {
 
 // testPostPolicyBucketHandlerRedirect tests POST Object when success_action_redirect is specified
 func testPostPolicyBucketHandlerRedirect(obj ObjectLayer, instanceType string, t TestErrHandler) {
-	root, err := newTestConfig(globalMinioDefaultRegion)
-	if err != nil {
+	if err := newTestConfig(globalMinioDefaultRegion, obj); err != nil {
 		t.Fatalf("Initializing config.json failed")
 	}
-	defer os.RemoveAll(root)
 
 	// get random bucket name.
 	bucketName := getRandomBucketName()