fix: Better check of RPC type requests (#6927)

guessIsRPCReq() considers all POST requests as RPC but doesn't
check if this is an object operation API or not, which is actually
confusing bucket forwarder handler when it receives a new multipart
upload API which is a POST http request.

Due to this bug, users having a federated setup are not able to
upload a multipart object using an endpoint which doesn't actually
contain the specified bucket that will store the object.

Hence this commit will fix the described issue.

cmd/admin-handlers_test.go

@@ -38,7 +38,7 @@ import (
 
 var (
 	configJSON = []byte(`{
-  "version": "32",
+  "version": "33",
   "credential": {
     "accessKey": "minio",
     "secretKey": "minio123"
@@ -152,7 +152,6 @@ var (
         "streaming": {
           "enable": false,
           "clusterID": "",
-          "clientID": "",
           "async": false,
           "maxPubAcksInflight": 0
         }

cmd/api-response.go

@@ -575,7 +575,9 @@ func writeErrorResponse(w http.ResponseWriter, errorCode APIErrorCode, reqURL *u
 		// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Retry-After
 		w.Header().Set("Retry-After", "120")
 	case ErrAccessDenied:
-		if browser {
+		// The request is from browser and also if browser
+		// is enabled we need to redirect.
+		if browser && globalIsBrowserEnabled {
 			w.Header().Set("Location", minioReservedBucketPath+reqURL.Path)
 			w.WriteHeader(http.StatusTemporaryRedirect)
 			return

cmd/bucket-handlers.go

@@ -572,31 +572,34 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 		return
 	}
 
-	postPolicyForm, err := parsePostPolicyForm(string(policyBytes))
-	if err != nil {
-		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL, guessIsBrowserReq(r))
-		return
-	}
-
-	// Make sure formValues adhere to policy restrictions.
-	if apiErr = checkPostPolicy(formValues, postPolicyForm); apiErr != ErrNone {
-		writeErrorResponse(w, apiErr, r.URL, guessIsBrowserReq(r))
-		return
-	}
-
-	// Ensure that the object size is within expected range, also the file size
-	// should not exceed the maximum single Put size (5 GiB)
-	lengthRange := postPolicyForm.Conditions.ContentLengthRange
-	if lengthRange.Valid {
-		if fileSize < lengthRange.Min {
-			writeErrorResponse(w, toAPIErrorCode(ctx, errDataTooSmall), r.URL, guessIsBrowserReq(r))
+	// Handle policy if it is set.
+	if len(policyBytes) > 0 {
+		postPolicyForm, err := parsePostPolicyForm(string(policyBytes))
+		if err != nil {
+			writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL, guessIsBrowserReq(r))
 			return
 		}
 
-		if fileSize > lengthRange.Max || isMaxObjectSize(fileSize) {
-			writeErrorResponse(w, toAPIErrorCode(ctx, errDataTooLarge), r.URL, guessIsBrowserReq(r))
+		// Make sure formValues adhere to policy restrictions.
+		if apiErr = checkPostPolicy(formValues, postPolicyForm); apiErr != ErrNone {
+			writeErrorResponse(w, apiErr, r.URL, guessIsBrowserReq(r))
 			return
 		}
+
+		// Ensure that the object size is within expected range, also the file size
+		// should not exceed the maximum single Put size (5 GiB)
+		lengthRange := postPolicyForm.Conditions.ContentLengthRange
+		if lengthRange.Valid {
+			if fileSize < lengthRange.Min {
+				writeErrorResponse(w, toAPIErrorCode(ctx, errDataTooSmall), r.URL, guessIsBrowserReq(r))
+				return
+			}
+
+			if fileSize > lengthRange.Max || isMaxObjectSize(fileSize) {
+				writeErrorResponse(w, toAPIErrorCode(ctx, errDataTooLarge), r.URL, guessIsBrowserReq(r))
+				return
+			}
+		}
 	}
 
 	// Extract metadata to be saved from received Form.

cmd/bucket-notification-handlers.go

@@ -177,6 +177,10 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit
 		return
 	}
 
+	if !objAPI.IsListenBucketSupported() {
+		writeErrorResponse(w, ErrNotImplemented, r.URL, guessIsBrowserReq(r))
+		return
+	}
 	vars := mux.Vars(r)
 	bucketName := vars["bucket"]
 

cmd/common-main.go

@@ -221,14 +221,18 @@ func handleCommonEnvVars() {
 	minioEndpointsEnv, ok := os.LookupEnv("MINIO_PUBLIC_IPS")
 	if ok {
 		minioEndpoints := strings.Split(minioEndpointsEnv, ",")
-		globalDomainIPs = set.NewStringSet()
 		for i, ip := range minioEndpoints {
 			if net.ParseIP(ip) == nil {
 				logger.FatalIf(errInvalidArgument, "Unable to initialize Minio server with invalid MINIO_PUBLIC_IPS[%d]: %s", i, ip)
 			}
-			globalDomainIPs.Add(ip)
 		}
+		updateDomainIPs(set.CreateStringSet(minioEndpoints...))
+	} else {
+		// Add found interfaces IP address to global domain IPS,
+		// loopback addresses will be naturally dropped.
+		updateDomainIPs(localIP4)
 	}
+
 	if globalDomainName != "" && !globalDomainIPs.IsEmpty() && globalEtcdClient != nil {
 		var err error
 		globalDNSConfig, err = dns.NewCoreDNS(globalDomainName, globalDomainIPs, globalMinioPort, globalEtcdClient)

cmd/config-current.go

@@ -43,9 +43,9 @@ import (
 // 6. Make changes in config-current_test.go for any test change
 
 // Config version
-const serverConfigVersion = "32"
+const serverConfigVersion = "33"
 
-type serverConfig = serverConfigV32
+type serverConfig = serverConfigV33
 
 var (
 	// globalServerConfig server config.

cmd/config-current_test.go

@@ -188,7 +188,7 @@ func TestValidateConfig(t *testing.T) {
 		{`{"version": "` + v + `", "credential": { "accessKey": "minio", "secretKey": "minio123" }, "region": "us-east-1", "browser": "on", "notify": { "amqp": { "1": { "enable": true, "url": "", "exchange": "", "routingKey": "", "exchangeType": "", "mandatory": false, "immediate": false, "durable": false, "internal": false, "noWait": false, "autoDeleted": false }}}}`, false},
 
 		// Test 12 - Test NATS
-		{`{"version": "` + v + `", "credential": { "accessKey": "minio", "secretKey": "minio123" }, "region": "us-east-1", "browser": "on", "notify": { "nats": { "1": { "enable": true, "address": "", "subject": "", "username": "", "password": "", "token": "", "secure": false, "pingInterval": 0, "streaming": { "enable": false, "clusterID": "", "clientID": "", "async": false, "maxPubAcksInflight": 0 } } }}}`, false},
+		{`{"version": "` + v + `", "credential": { "accessKey": "minio", "secretKey": "minio123" }, "region": "us-east-1", "browser": "on", "notify": { "nats": { "1": { "enable": true, "address": "", "subject": "", "username": "", "password": "", "token": "", "secure": false, "pingInterval": 0, "streaming": { "enable": false, "clusterID": "", "async": false, "maxPubAcksInflight": 0 } } }}}`, false},
 
 		// Test 13 - Test ElasticSearch
 		{`{"version": "` + v + `", "credential": { "accessKey": "minio", "secretKey": "minio123" }, "region": "us-east-1", "browser": "on", "notify": { "elasticsearch": { "1": { "enable": true, "url": "", "index": "" } }}}`, false},

cmd/config-migrate.go

@@ -2455,7 +2455,7 @@ func migrateConfigToMinioSys(objAPI ObjectLayer) (err error) {
 	return saveServerConfig(context.Background(), objAPI, config)
 }
 
-// Migrates '.minio.sys/config.json' to v32.
+// Migrates '.minio.sys/config.json' to v33.
 func migrateMinioSysConfig(objAPI ObjectLayer) error {
 	configFile := path.Join(minioConfigPrefix, minioConfigFile)
 
@@ -2483,7 +2483,10 @@ func migrateMinioSysConfig(objAPI ObjectLayer) error {
 	if err := migrateV30ToV31MinioSys(objAPI); err != nil {
 		return err
 	}
-	return migrateV31ToV32MinioSys(objAPI)
+	if err := migrateV31ToV32MinioSys(objAPI); err != nil {
+		return err
+	}
+	return migrateV32ToV33MinioSys(objAPI)
 }
 
 func checkConfigVersion(objAPI ObjectLayer, configFile string, version string) (bool, []byte, error) {
@@ -2679,3 +2682,36 @@ func migrateV31ToV32MinioSys(objAPI ObjectLayer) error {
 	logger.Info(configMigrateMSGTemplate, configFile, "31", "32")
 	return nil
 }
+
+func migrateV32ToV33MinioSys(objAPI ObjectLayer) error {
+	configFile := path.Join(minioConfigPrefix, minioConfigFile)
+
+	ok, data, err := checkConfigVersion(objAPI, configFile, "32")
+	if err == errConfigNotFound {
+		return nil
+	} else if err != nil {
+		return fmt.Errorf("Unable to load config file. %v", err)
+	}
+	if !ok {
+		return nil
+	}
+
+	cfg := &serverConfigV33{}
+	if err = json.Unmarshal(data, cfg); err != nil {
+		return err
+	}
+
+	cfg.Version = "33"
+
+	data, err = json.Marshal(cfg)
+	if err != nil {
+		return err
+	}
+
+	if err = saveConfig(context.Background(), objAPI, configFile, data); err != nil {
+		return fmt.Errorf("Failed to migrate config from  32  to  33 . %v", err)
+	}
+
+	logger.Info(configMigrateMSGTemplate, configFile, "32", "33")
+	return nil
+}

cmd/config-migrate_test.go

@@ -159,8 +159,8 @@ func TestServerConfigMigrateInexistentConfig(t *testing.T) {
 	}
 }
 
-// Test if a config migration from v2 to v30 is successfully done
-func TestServerConfigMigrateV2toV30(t *testing.T) {
+// Test if a config migration from v2 to v33 is successfully done
+func TestServerConfigMigrateV2toV33(t *testing.T) {
 	rootPath, err := ioutil.TempDir(globalTestTmpDir, "minio-")
 	if err != nil {
 		t.Fatal(err)

cmd/config-versions.go

@@ -892,3 +892,47 @@ type serverConfigV32 struct {
 		// Add new external policy enforcements here.
 	} `json:"policy"`
 }
+
+// serverConfigV33 is just like version '32', removes clientID from NATS.
+type serverConfigV33 struct {
+	quick.Config `json:"-"` // ignore interfaces
+
+	Version string `json:"version"`
+
+	// S3 API configuration.
+	Credential auth.Credentials `json:"credential"`
+	Region     string           `json:"region"`
+	Worm       BoolFlag         `json:"worm"`
+
+	// Storage class configuration
+	StorageClass storageClassConfig `json:"storageclass"`
+
+	// Cache configuration
+	Cache CacheConfig `json:"cache"`
+
+	// KMS configuration
+	KMS crypto.KMSConfig `json:"kms"`
+
+	// Notification queue configuration.
+	Notify notifier `json:"notify"`
+
+	// Logger configuration
+	Logger loggerConfig `json:"logger"`
+
+	// Compression configuration
+	Compression compressionConfig `json:"compress"`
+
+	// OpenID configuration
+	OpenID struct {
+		// JWKS validator config.
+		JWKS validator.JWKSArgs `json:"jwks"`
+	} `json:"openid"`
+
+	// External policy enforcements.
+	Policy struct {
+		// OPA configuration.
+		OPA iampolicy.OpaArgs `json:"opa"`
+
+		// Add new external policy enforcements here.
+	} `json:"policy"`
+}

cmd/crypto/vault.go

@@ -193,7 +193,7 @@ func NewVault(kmsConf KMSConfig) (KMS, error) {
 		return nil, err
 	}
 
-	if ns, ok := os.LookupEnv("VAULT_NAMESPACE"); ok {
+	if ns, ok := os.LookupEnv("MINIO_SSE_VAULT_NAMESPACE"); ok {
 		c.SetNamespace(ns)
 	}
 

cmd/dummy-object-layer_test.go

@@ -154,6 +154,9 @@ func (api *DummyObjectLayer) DeleteBucketPolicy(context.Context, string) (err er
 func (api *DummyObjectLayer) IsNotificationSupported() (b bool) {
 	return
 }
+func (api *DummyObjectLayer) IsListenBucketSupported() (b bool) {
+	return
+}
 
 func (api *DummyObjectLayer) IsEncryptionSupported() (b bool) {
 	return

cmd/endpoint.go

@@ -455,7 +455,12 @@ func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList,
 		return serverAddr, endpoints, setupType, err
 	}
 
-	updateDomainIPs(uniqueArgs)
+	_, dok := os.LookupEnv("MINIO_DOMAIN")
+	_, eok := os.LookupEnv("MINIO_ETCD_ENDPOINTS")
+	_, iok := os.LookupEnv("MINIO_PUBLIC_IPS")
+	if dok && eok && !iok {
+		updateDomainIPs(uniqueArgs)
+	}
 
 	setupType = DistXLSetupType
 	return serverAddr, endpoints, setupType, nil
@@ -509,21 +514,21 @@ func GetRemotePeers(endpoints EndpointList) []string {
 	return peerSet.ToSlice()
 }
 
-// In federated and distributed setup, update IP addresses of the hosts passed in command line
-// if MINIO_PUBLIC_IPS are not set manually
 func updateDomainIPs(endPoints set.StringSet) {
-	_, dok := os.LookupEnv("MINIO_DOMAIN")
-	_, eok := os.LookupEnv("MINIO_ETCD_ENDPOINTS")
-	_, iok := os.LookupEnv("MINIO_PUBLIC_IPS")
-	if dok && eok && !iok {
-		globalDomainIPs = set.NewStringSet()
-		for e := range endPoints {
-			host, _, _ := net.SplitHostPort(e)
-			ipList, _ := getHostIP4(host)
-			remoteIPList := ipList.FuncMatch(func(ip string, matchString string) bool {
-				return !strings.HasPrefix(ip, "127.")
-			}, "")
-			globalDomainIPs.Add(remoteIPList.ToSlice()[0])
+	ipList := set.NewStringSet()
+	for e := range endPoints {
+		host, _, err := net.SplitHostPort(e)
+		if err != nil {
+			if strings.Contains(err.Error(), "missing port in address") {
+				host = e
+			} else {
+				continue
+			}
 		}
+		IPs, _ := getHostIP4(host)
+		ipList = ipList.Union(IPs)
 	}
+	globalDomainIPs = ipList.FuncMatch(func(ip string, matchString string) bool {
+		return !strings.HasPrefix(ip, "127.")
+	}, "")
 }

cmd/fs-v1.go

@@ -1306,6 +1306,11 @@ func (fs *FSObjects) IsNotificationSupported() bool {
 	return true
 }
 
+// IsListenBucketSupported returns whether listen bucket notification is applicable for this layer.
+func (fs *FSObjects) IsListenBucketSupported() bool {
+	return true
+}
+
 // IsEncryptionSupported returns whether server side encryption is applicable for this layer.
 func (fs *FSObjects) IsEncryptionSupported() bool {
 	return true

cmd/gateway-main.go

@@ -196,6 +196,15 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 	// Add API router.
 	registerAPIRouter(router)
 
+	// Dummy endpoint representing gateway instance.
+	globalEndpoints = []Endpoint{{
+		URL:     &url.URL{Path: "/minio/gateway"},
+		IsLocal: true,
+	}}
+
+	// Initialize Admin Peers.
+	initGlobalAdminPeers(globalEndpoints)
+
 	var getCert certs.GetCertificateFunc
 	if globalTLSCerts != nil {
 		getCert = globalTLSCerts.GetCertificate
@@ -221,20 +230,24 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 
 	// Create a new config system.
 	globalConfigSys = NewConfigSys()
+	if globalEtcdClient != nil && gatewayName == "nas" {
+		// Initialize server config.
+		_ = globalConfigSys.Init(newObject)
+	} else {
+		// Initialize server config.
+		srvCfg := newServerConfig()
 
-	// Initialize server config.
-	srvCfg := newServerConfig()
+		// Override any values from ENVs.
+		srvCfg.loadFromEnvs()
 
-	// Override any values from ENVs.
-	srvCfg.loadFromEnvs()
+		// Load values to cached global values.
+		srvCfg.loadToCachedConfigs()
 
-	// Load values to cached global values.
-	srvCfg.loadToCachedConfigs()
-
-	// hold the mutex lock before a new config is assigned.
-	globalServerConfigMu.Lock()
-	globalServerConfig = srvCfg
-	globalServerConfigMu.Unlock()
+		// hold the mutex lock before a new config is assigned.
+		globalServerConfigMu.Lock()
+		globalServerConfig = srvCfg
+		globalServerConfigMu.Unlock()
+	}
 
 	// Load logger subsystem
 	loadLoggers()
@@ -257,7 +270,7 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 	globalIAMSys = NewIAMSys()
 	if globalEtcdClient != nil {
 		// Initialize IAM sys.
-		go globalIAMSys.Init(newObject)
+		_ = globalIAMSys.Init(newObject)
 	}
 
 	// Create new policy system.
@@ -268,7 +281,9 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 
 	// Create new notification system.
 	globalNotificationSys = NewNotificationSys(globalServerConfig, globalEndpoints)
-
+	if globalEtcdClient != nil && newObject.IsNotificationSupported() {
+		_ = globalNotificationSys.Init(newObject)
+	}
 	// Once endpoints are finalized, initialize the new object api.
 	globalObjLayerMutex.Lock()
 	globalObjectAPI = newObject

cmd/gateway-startup-msg.go

@@ -61,6 +61,7 @@ func printGatewayCommonMsg(apiEndpoints []string) {
 		logger.StartupMessage(colorBlue("AccessKey: ") + colorBold(fmt.Sprintf("%s ", cred.AccessKey)))
 		logger.StartupMessage(colorBlue("SecretKey: ") + colorBold(fmt.Sprintf("%s ", cred.SecretKey)))
 	}
+	printEventNotifiers()
 
 	if globalIsBrowserEnabled {
 		logger.StartupMessage(colorBlue("\nBrowser Access:"))

cmd/gateway-unsupported.go

@@ -132,6 +132,11 @@ func (a GatewayUnsupported) IsNotificationSupported() bool {
 	return false
 }
 
+// IsListenBucketSupported returns whether listen bucket notification is applicable for this layer.
+func (a GatewayUnsupported) IsListenBucketSupported() bool {
+	return false
+}
+
 // IsEncryptionSupported returns whether server side encryption is applicable for this layer.
 func (a GatewayUnsupported) IsEncryptionSupported() bool {
 	return false

cmd/gateway/nas/gateway-nas.go

@@ -108,7 +108,7 @@ func (g *NAS) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, error)
 	if err != nil {
 		return nil, err
 	}
-	return &nasObjects{newObject.(*minio.FSObjects)}, nil
+	return &nasObjects{newObject}, nil
 }
 
 // Production - nas gateway is production ready.
@@ -116,17 +116,12 @@ func (g *NAS) Production() bool {
 	return true
 }
 
+// IsListenBucketSupported returns whether listen bucket notification is applicable for this gateway.
+func (g *NAS) IsListenBucketSupported() bool {
+	return false
+}
+
 // nasObjects implements gateway for Minio and S3 compatible object storage servers.
 type nasObjects struct {
-	*minio.FSObjects
-}
-
-// IsNotificationSupported returns whether notifications are applicable for this layer.
-func (l *nasObjects) IsNotificationSupported() bool {
-	return false
-}
-
-// IsCompressionSupported returns whether compression is applicable for this layer.
-func (l *nasObjects) IsCompressionSupported() bool {
-	return false
+	minio.ObjectLayer
 }

cmd/generic-handlers.go

@@ -228,7 +228,8 @@ func guessIsRPCReq(req *http.Request) bool {
 	if req == nil {
 		return false
 	}
-	return req.Method == http.MethodPost
+	return req.Method == http.MethodPost &&
+		strings.HasPrefix(req.URL.Path, minioReservedBucketPath+"/")
 }
 
 func (h redirectHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {

cmd/generic-handlers_test.go

@@ -78,9 +78,16 @@ func TestGuessIsRPC(t *testing.T) {
 	if guessIsRPCReq(nil) {
 		t.Fatal("Unexpected return for nil request")
 	}
+
+	u, err := url.Parse("http://localhost:9000/minio/lock")
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	r := &http.Request{
 		Proto:  "HTTP/1.0",
 		Method: http.MethodPost,
+		URL:    u,
 	}
 	if !guessIsRPCReq(r) {
 		t.Fatal("Test shouldn't fail for a possible net/rpc request.")

cmd/object-api-interface.go

@@ -94,6 +94,7 @@ type ObjectLayer interface {
 
 	// Supported operations check
 	IsNotificationSupported() bool
+	IsListenBucketSupported() bool
 	IsEncryptionSupported() bool
 
 	// Compression support check.

cmd/prepare-storage.go

@@ -128,6 +128,15 @@ func connectLoadInitFormats(retryCount int, firstDisk bool, endpoints EndpointLi
 	}
 	defer closeStorageDisks(storageDisks)
 
+	// Attempt to load all `format.json` from all disks.
+	formatConfigs, sErrs := loadFormatXLAll(storageDisks)
+	// Check if we have
+	for i, sErr := range sErrs {
+		if _, ok := formatCriticalErrors[sErr]; ok {
+			return nil, fmt.Errorf("Disk %s: %s", endpoints[i], sErr)
+		}
+	}
+
 	// Connect to all storage disks, a connection failure will be
 	// only logged after some retries.
 	for _, disk := range storageDisks {
@@ -139,15 +148,6 @@ func connectLoadInitFormats(retryCount int, firstDisk bool, endpoints EndpointLi
 		}
 	}
 
-	// Attempt to load all `format.json` from all disks.
-	formatConfigs, sErrs := loadFormatXLAll(storageDisks)
-	// Check if we have
-	for i, sErr := range sErrs {
-		if _, ok := formatCriticalErrors[sErr]; ok {
-			return nil, fmt.Errorf("Disk %s: %s", endpoints[i], sErr)
-		}
-	}
-
 	// Pre-emptively check if one of the formatted disks
 	// is invalid. This function returns success for the
 	// most part unless one of the formats is not consistent

cmd/server-main.go

@@ -381,7 +381,7 @@ func serverMain(ctx *cli.Context) {
 
 	// Initialize notification system.
 	if err = globalNotificationSys.Init(newObject); err != nil {
-		logger.Fatal(err, "Unable to initialize notification system")
+		logger.LogIf(context.Background(), err)
 	}
 
 	globalObjLayerMutex.Lock()

cmd/setup-type.go

@@ -28,6 +28,9 @@ const (
 
 	// DistXLSetupType - Distributed XL setup type enum.
 	DistXLSetupType
+
+	// GatewaySetupType - gateway setup type enum.
+	GatewaySetupType
 )
 
 func (setupType SetupType) String() string {
@@ -38,6 +41,8 @@ func (setupType SetupType) String() string {
 		return globalMinioModeXL
 	case DistXLSetupType:
 		return globalMinioModeDistXL
+	case GatewaySetupType:
+		return globalMinioModeGatewayPrefix
 	}
 
 	return ""

cmd/storage-rest-server.go

@@ -377,7 +377,7 @@ func registerStorageRESTHandlers(router *mux.Router, endpoints EndpointList) {
 			Queries(restQueries(storageRESTVolume, storageRESTFilePath)...)
 		subrouter.Methods(http.MethodPost).Path("/" + storageRESTMethodRenameFile).HandlerFunc(httpTraceHdrs(server.RenameFileHandler)).
 			Queries(restQueries(storageRESTSrcVolume, storageRESTSrcPath, storageRESTDstVolume, storageRESTDstPath)...)
-
-		subrouter.NotFoundHandler = http.HandlerFunc(httpTraceAll(notFoundHandler))
 	}
+
+	router.NotFoundHandler = http.HandlerFunc(httpTraceAll(notFoundHandler))
 }

cmd/xl-sets.go

@@ -516,6 +516,11 @@ func (s *xlSets) IsNotificationSupported() bool {
 	return s.getHashedSet("").IsNotificationSupported()
 }
 
+// IsListenBucketSupported returns whether listen bucket notification is applicable for this layer.
+func (s *xlSets) IsListenBucketSupported() bool {
+	return true
+}
+
 // IsEncryptionSupported returns whether server side encryption is applicable for this layer.
 func (s *xlSets) IsEncryptionSupported() bool {
 	return s.getHashedSet("").IsEncryptionSupported()

cmd/xl-v1-bucket.go

@@ -294,6 +294,11 @@ func (xl xlObjects) IsNotificationSupported() bool {
 	return true
 }
 
+// IsListenBucketSupported returns whether listen bucket notification is applicable for this layer.
+func (xl xlObjects) IsListenBucketSupported() bool {
+	return true
+}
+
 // IsEncryptionSupported returns whether server side encryption is applicable for this layer.
 func (xl xlObjects) IsEncryptionSupported() bool {
 	return true

docs/config/config.sample.json

@@ -1,5 +1,5 @@
 {
-	"version": "31",
+	"version": "33",
 	"credential": {
 		"accessKey": "36J9X8EZI4KEV1G7EHXA",
 		"secretKey": "ECk2uqOoNqvtJIMQ3WYugvmNPL_-zm3WcRqP5vUM",
@@ -115,7 +115,6 @@
 				"streaming": {
 					"enable": false,
 					"clusterID": "",
-					"clientID": "",
 					"async": false,
 					"maxPubAcksInflight": 0
 				}

docs/kms/README.md

@@ -69,9 +69,9 @@ Optionally set `MINIO_SSE_VAULT_CAPATH` as the path to a directory of PEM-encode
 export MINIO_SSE_VAULT_CAPATH=/home/user/custom-pems
 ```
 
-Optionally set `VAULT_NAMESPACE` if AppRole and Transit Secrets engine have been scoped to Vault Namespace
+Optionally set `MINIO_SSE_VAULT_NAMESPACE` if AppRole and Transit Secrets engine have been scoped to Vault Namespace
 ```
-export VAULT_NAMESPACE=ns1
+export MINIO_SSE_VAULT_NAMESPACE=ns1
 ```
 ### 4. Test your setup
 

docs/orchestration/docker-compose/docker-compose.yaml

@@ -5,7 +5,7 @@ version: '2'
 # 9001 through 9004.
 services:
  minio1:
-  image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+  image: minio/minio:RELEASE.2018-11-30T03-56-59Z
   volumes:
    - data1:/data
   ports:
@@ -15,7 +15,7 @@ services:
    MINIO_SECRET_KEY: minio123
   command: server http://minio1/data http://minio2/data http://minio3/data http://minio4/data 
  minio2:
-  image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+  image: minio/minio:RELEASE.2018-11-30T03-56-59Z
   volumes:
    - data2:/data
   ports:
@@ -25,7 +25,7 @@ services:
    MINIO_SECRET_KEY: minio123
   command: server http://minio1/data http://minio2/data http://minio3/data http://minio4/data 
  minio3:
-  image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+  image: minio/minio:RELEASE.2018-11-30T03-56-59Z
   volumes:
    - data3:/data
   ports:
@@ -35,7 +35,7 @@ services:
    MINIO_SECRET_KEY: minio123
   command: server http://minio1/data http://minio2/data http://minio3/data http://minio4/data 
  minio4:
-  image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+  image: minio/minio:RELEASE.2018-11-30T03-56-59Z
   volumes:
    - data4:/data
   ports:

docs/orchestration/docker-swarm/docker-compose-secrets.yaml

@@ -2,7 +2,7 @@ version: '3.1'
 
 services:
   minio1:
-    image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio1
     volumes:
       - minio1-data:/export
@@ -24,7 +24,7 @@ services:
       - access_key
 
   minio2:
-    image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio2
     volumes:
       - minio2-data:/export
@@ -46,7 +46,7 @@ services:
       - access_key
 
   minio3:
-    image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio3
     volumes:
       - minio3-data:/export
@@ -68,7 +68,7 @@ services:
       - access_key
 
   minio4:
-    image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio4
     volumes:
       - minio4-data:/export

docs/orchestration/docker-swarm/docker-compose.yaml

@@ -2,7 +2,7 @@ version: '3'
 
 services:
   minio1:
-    image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio1
     volumes:
       - minio1-data:/export
@@ -24,7 +24,7 @@ services:
     command: server http://minio1/export http://minio2/export http://minio3/export http://minio4/export
 
   minio2:
-    image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio2
     volumes:
       - minio2-data:/export
@@ -46,7 +46,7 @@ services:
     command: server http://minio1/export http://minio2/export http://minio3/export http://minio4/export
 
   minio3:
-    image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio3
     volumes:
       - minio3-data:/export
@@ -68,7 +68,7 @@ services:
     command: server http://minio1/export http://minio2/export http://minio3/export http://minio4/export
 
   minio4:
-    image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio4
     volumes:
       - minio4-data:/export

docs/orchestration/kubernetes/minio-distributed-daemonset.yaml

@@ -30,7 +30,7 @@ spec:
           value: "minio"
         - name: MINIO_SECRET_KEY
           value: "minio123"
-        image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+        image: minio/minio:RELEASE.2018-11-30T03-56-59Z
         # Unfortunately you must manually define each server. Perhaps autodiscovery via DNS can be implemented in the future.
         args:
         - server

docs/orchestration/kubernetes/minio-distributed-statefulset.yaml

@@ -21,7 +21,7 @@ spec:
           value: "minio"
         - name: MINIO_SECRET_KEY
           value: "minio123"
-        image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+        image: minio/minio:RELEASE.2018-11-30T03-56-59Z
         args:
         - server
         - http://minio-0.minio.default.svc.cluster.local/data

docs/orchestration/kubernetes/minio-gcs-gateway-deployment.yaml

@@ -21,7 +21,7 @@ spec:
       containers:
       - name: minio
         # Pulls the default Minio image from Docker Hub
-        image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+        image: minio/minio:RELEASE.2018-11-30T03-56-59Z
         args:
         - gateway
         - gcs

docs/orchestration/kubernetes/minio-standalone-deployment.yaml

@@ -29,7 +29,7 @@ spec:
         - name: data 
           mountPath: "/data"
         # Pulls the lastest Minio image from Docker Hub
-        image: minio/minio:RELEASE.2018-11-22T02-51-56Z
+        image: minio/minio:RELEASE.2018-11-30T03-56-59Z
         args:
         - server
         - /data

docs/tls/README.md

@@ -1,90 +1,149 @@
 # How to secure access to Minio server with TLS [![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io)
 
-This document explains how to configure Minio server with TLS certificates on Linux and Windows platforms.
+This guide explains how to configure Minio Server with TLS certificates on Linux and Windows platforms.
 
-## 1. Prerequisites
+1. [Install Minio Server](#install-minio-server) 
+2. [Use an Existing Key and Certificate with Minio](#use-an-existing-key-and-certificate-with-minio) 
+3. [Generate and use Self-signed Keys and Certificates with Minio](#generate-use-self-signed-keys-certificates) 
+4. [Install Certificates from Third-party CAs](#install-certificates-from-third-party-cas)
 
-Download Minio server from [here](https://docs.minio.io/docs/minio-quickstart-guide)
+## <a name="install-minio-server"></a>1. Install Minio Server
 
-## 2. Existing certificates
+Install Minio Server using the instructions in the [Minio Quickstart Guide](http://docs.minio.io/docs/minio-quickstart-guide).
 
-If you have already acquired private keys and public certificates, copy them under `certs` directory in your Minio config directory. By default config directory is `${HOME}/.minio/` or `%%USERPROFILE%%\.minio\` (based on your operating system). Note that the file should be named as `private.key` and `public.crt` for key and certificate respectively.
+## <a name="use-an-existing-key-and-certificate-with-minio"></a>2. Use an Existing Key and Certificate with Minio 
 
-If the certificate is signed by a certificate authority (CA), `public.crt` should be the concatenation of the server's certificate, any intermediates, and the CA's root certificate.
+This section describes how to use a private key and public certificate that have been obtained from a certificate authority (CA). If these files have not been obtained, skip to [3. Generate Self-signed Certificates](#generate-use-self-signed-keys-certificates) or generate them with [Let's Encrypt](https://letsencrypt.org) using these instructions: [https://docs.minio.io/docs/generate-let-s-encypt-certificate-using-concert-for-minio](https://docs.minio.io/docs/).
 
-If you're looking to generate CA certificate for Minio using Let's Encrypt, follow the docs [here](https://docs.minio.io/docs/generate-let-s-encypt-certificate-using-concert-for-minio).
+Copy the existing private key and public certificate to the `certs` directory within the Minio configuration directory. The default configuration directory is:
+* **Linux:** `${HOME}/.minio/`
+* **Windows:** `%%USERPROFILE%%\.minio\`
 
-## 3. Generate self-signed certificates
+**Note:** 
+* The key and certificate files must be appended with `.key` and `.crt`, respectively.
+* A certificate signed by a CA contains information about the issued identity (e.g. name, expiry, public key) and any intermediate certificates. The root CA is not included.
 
-Before generating your self-signed certificate, note that
+## <a name="generate-use-self-signed-keys-certificates"></a>3. Generate and use Self-signed Keys and Certificates with Minio
 
-- Minio supports only key/certificate in PEM format on Linux.
-- Minio supports only key/certificate in PEM format on Windows. We don't support PFX certificates currently.
+This section describes how to generate a self-signed certificate using various tools:
 
-### Using generate_cert.go
+3.1 [Use generate_cert.go to Generate a Certificate](#using-go) 
+3.2 [Use OpenSSL to Generate a Certificate](#using-open-ssl) 
+3.3 [Use OpenSSL (with IP address) to Generate a Certificate](#using-open-ssl-with-ip) 
+3.4 [Use GnuTLS (for Windows) to Generate a Certificate](#using-gnu-tls)
 
-Download [generate_cert.go](https://golang.org/src/crypto/tls/generate_cert.go?m=text). This is a simple go tool to generate self-signed certificates.
+**Note:**
+* Minio only supports keys and certificates in PEM format on Linux and Windows.
+* Minio doesn't currently support PFX certificates.
 
-`generate_cert.go` already provides SAN certificates with DNS and IP entries:
+### <a name="using-go"></a>3.1 Use generate_cert.go to Generate a Certificate
+
+Download [`generate_cert.go`](https://golang.org/src/crypto/tls/generate_cert.go?m=text).
+
+`generate_cert.go` is a simple *Go* tool to generate self-signed certificates, and provides SAN certificates with DNS and IP entries:
 
 ```sh
 go run generate_cert.go -ca --host "10.10.0.3"
 ```
 
-### Using OpenSSL
+A response similar to this one should be displayed:
 
-**Generate the private key**:
+```
+2018/11/21 10:16:18 wrote cert.pem
+2018/11/21 10:16:18 wrote key.pem
+```
+
+Rename `cert.pem` to `public.crt` and `key.pem` to `private.key`.
+
+### <a name="using-open-ssl"></a>3.2 Use OpenSSL to Generate a Certificate
+
+Use one of the following methods to generate a certificate using `openssl`:
+
+* 3.2.1 [Generate a private key with ECDSA](#generate-private-key-with-ecdsa) 
+* 3.2.2 [Generate a private key with RSA](#generate-private-key-with-rsa)
+* 3.2.3 [Generate a self-signed certificate](#generate-a-self-signed-certificate)
+
+
+#### 3.2.1 <a name="generate-private-key-with-ecdsa"></a>Generate a private key with ECDSA.
+
+Use the following command to generate a private key with ECDSA:
 
-1. **ECDSA:**  
 ```sh
 openssl ecparam -genkey -name prime256v1 | openssl ec -out private.key
 ```
-or protect the private key additionally with a password:  
+
+A response similar to this one should be displayed:
+
+```
+read EC key
+writing EC key
+```
+
+Alternatively, use the following command to generate a private ECDSA key protected by a password:
+
 ```sh
 openssl ecparam -genkey -name prime256v1 | openssl ec -aes256 -out private.key -passout pass:PASSWORD
 ```
 
-Notice that the NIST curves P-384 and P-521 are not supported yet.
+**Note:** NIST curves P-384 and P-521 are not currently supported.
+
+#### 3.2.2 <a name="generate-private-key-with-rsa"></a>Generate a private key with RSA.
+
+Use the following command to generate a private key with RSA:
 
-2. **RSA:**
 ```sh
 openssl genrsa -out private.key 2048
 ```  
-or protect the private key additionally with a password:  
+A response similar to this one should be displayed:
+
+```
+Generating RSA private key, 2048 bit long modulus
+............................................+++
+...........+++
+e is 65537 (0x10001)
+```
+
+Alternatively, use the following command to generate a private RSA key protected by a password:
+
 ```sh
 openssl genrsa -aes256 -out private.key 2048 -passout pass:PASSWORD
 ```
 
-If a password-protected private key is used the password must be provided through the environment variable `MINIO_CERT_PASSWD`:
-```sh
-export MINIO_CERT_PASSWD=PASSWORD
-``` 
-Please use your own password instead of PASSWORD.
+**Note:** When using a password-protected private key, the password must be provided through the environment variable `MINIO_CERT_PASSWD` using the following command:
+
+```sh
+export MINIO_CERT_PASSWD=<PASSWORD>
+``` 
+
+The default OpenSSL format for private encrypted keys is PKCS-8, but Minio only supports PKCS-1. An RSA key that has been formatted with PKCS-8 can be converted to PKCS-1 using the following command:
 
-**Notice:**  
-The OpenSSL default format for encrypted private keys is PKCS-8. Minio only supports PKCS-1 encrypted private keys.
-An encrypted private PKCS-8 formated RSA key can be converted to an encrypted private PKCS-1 formated RSA key by:
 ```sh
 openssl rsa -in private-pkcs8-key.key -aes256 -passout pass:PASSWORD -out private.key
 ```  
 
-**Generate the self-signed certificate**:
+#### <a name="generate-a-self-signed-certificate"></a>3.2.3 Generate a self-signed certificate.
 
-Generate self-signed certificate using the below command (remember to replace `<domain.com>` with your actual domain name)
+Use the following command to generate a self-signed certificate and enter a passphrase when prompted:
 
 ```sh
 openssl req -new -x509 -days 3650 -key private.key -out public.crt -subj "/C=US/ST=state/L=location/O=organization/CN=<domain.com>"
 ```
 
-Generate self-signed wildcard certificate using the below command. This certificate will be valid for all the sub-domains under `domain.com`. Wildcard certificates come in handy while deploying distributed Minio instances where there may be multiple sub-domains under a single domain, with each one running a separate Minio instance.
+**Note:** Replace `<domain.com>` with the development domain name.
+
+Alternatively, use the command below to generate a self-signed wildcard certificate that is valid for all subdomains under `<domain.com>`. Wildcard certificates are useful for deploying distributed Minio instances, where each instance runs on a subdomain under a single parent domain.
 
 ```sh
 openssl req -new -x509 -days 3650 -key private.key -out public.crt -subj "/C=US/ST=state/L=location/O=organization/CN=<*.domain.com>"
 ```
 
-### Using OpenSSL (with IP address)
+### <a name="using-open-ssl-with-ip"></a>3.3 Use OpenSSL (with IP address) to Generate a Certificate
 
-Create a file called `openssl.conf` and add the below text in the file. Note that you'll need to change the `IP.1` field to point to correct IP address.
+This section describes how to specify an IP address to `openssl` when generating a certificate.
+
+#### 3.3.1 Create a configuration file.
+
+Create a file named `openssl.conf` with the content below. Change `IP.1` to point to the correct IP address:
 
 ```sh
 [req]
@@ -107,31 +166,43 @@ subjectAltName = @alt_names
 IP.1 = 127.0.0.1
 ```
 
-Then run
+#### 3.3.2 Run `openssl` and specify the configuration file:
 
 ```sh
 openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout private.key -out public.crt -config openssl.conf
 ```
 
-### Using GnuTLS (for Windows)
+### <a name="using-gnu-tls"></a>3.4 Use GnuTLS (for Windows) to Generate a Certificate
 
-Download and decompress the Windows version of GnuTLS from [here](http://www.gnutls.org/download.html)
+This section describes how to use GnuTLS on Windows to generate a certificate.
 
-Make sure to add extracted GnuTLS binary path to your system path.
+#### 3.4.1 Install and configure GnuTLS.
+Download and decompress the Windows version of GnuTLS from [here](http://www.gnutls.org/download.html).
+
+Use PowerShell to add the path of the extracted GnuTLS binary to the system path:
 
 ```
 setx path "%path%;C:\Users\MyUser\Downloads\gnutls-3.4.9-w64\bin"
 ```
 
-You may need to restart your powershell console for this to take affect.
+**Note:** PowerShell may need to be restarted for this change to take effect.
 
-- Run the following command to create `private.key`
+#### 3.4.2 Generate a private key:
+Run the following command to generate a private `.key` file:
 
 ```
 certtool.exe --generate-privkey --outfile private.key
 ```
 
-- Create a file `cert.cnf` with all the necessary information to generate a certificate.
+A response similar to this one should be displayed:
+
+```
+Generating a 3072 bit RSA private key...
+```
+
+####3.4.3 Generate a public certificate:
+
+Create a file called `cert.cnf` with the content below. This file contains all of the information necessary to generate a certificate using `certtool.exe`:
 
 ```
 # X.509 Certificate options
@@ -173,15 +244,17 @@ tls_www_server
 encryption_key
 ```
 
-Generate public certificate
+Run `certtool.exe` and specify the configuration file to generate a certificate:
 
 ```
 certtool.exe --generate-self-signed --load-privkey private.key --template cert.cnf --outfile public.crt
 ```
 
-## 4. Install third-party CAs
+## <a name="install-certificates-from-third-party-cas"></a>4. Install Certificates from Third-party CAs
 
-Minio can be configured to connect to other servers, whether Minio nodes or servers like NATs, Redis. If these servers use certificates that are not registered in one of the known certificates authorities, you can make Minio server trust these CAs by dropping these certificates under Minio config path (`~/.minio/certs/CAs/` on Linux or `C:\Users\<Username>\.minio\certs\CAs` on Windows).
+Minio can connect to other servers, including Minio nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to Minio Server by placing these certificates under one of the following Minio configuration paths:
+* **Linux:** `~/.minio/certs/CAs/`
+* **Windows**: `C:\Users\<Username>\.minio\certs\CAs`
 
 # Explore Further
 * [TLS Configuration for Minio server on Kubernetes](https://github.com/minio/minio/tree/master/docs/tls/kubernetes)

pkg/event/target/nats.go

@@ -40,7 +40,6 @@ type NATSArgs struct {
 	Streaming    struct {
 		Enable             bool   `json:"enable"`
 		ClusterID          string `json:"clusterID"`
-		ClientID           string `json:"clientID"`
 		Async              bool   `json:"async"`
 		MaxPubAcksInflight int    `json:"maxPubAcksInflight"`
 	} `json:"streaming"`
@@ -64,9 +63,6 @@ func (n NATSArgs) Validate() error {
 		if n.Streaming.ClusterID == "" {
 			return errors.New("empty cluster id")
 		}
-		if n.Streaming.ClientID == "" {
-			return errors.New("empty client id")
-		}
 	}
 
 	return nil
@@ -128,6 +124,7 @@ func (target *NATSTarget) Close() (err error) {
 func NewNATSTarget(id string, args NATSArgs) (*NATSTarget, error) {
 	var natsConn *nats.Conn
 	var stanConn stan.Conn
+	var clientID string
 	var err error
 
 	if args.Streaming.Enable {
@@ -137,12 +134,9 @@ func NewNATSTarget(id string, args NATSArgs) (*NATSTarget, error) {
 		}
 		addressURL := scheme + "://" + args.Username + ":" + args.Password + "@" + args.Address.String()
 
-		clientID := args.Streaming.ClientID
-		if clientID == "" {
-			clientID, err = getNewUUID()
-			if err != nil {
-				return nil, err
-			}
+		clientID, err = getNewUUID()
+		if err != nil {
+			return nil, err
 		}
 
 		connOpts := []stan.Option{stan.NatsURL(addressURL)}

pkg/madmin/examples/set-config.go

@@ -75,7 +75,6 @@ var configJSON = []byte(`{
 				"streaming": {
 					"enable": false,
 					"clusterID": "",
-					"clientID": "",
 					"async": false,
 					"maxPubAcksInflight": 0
 				}