Files
seaweedFS/weed/topology/volume_growth_reservation_test.go
Chris Lu 0abf70061b S3 API: Fix SSE-S3 decryption on object download (#7366)
* S3 API: Fix SSE-S3 decryption on object download

Fixes #7363

This commit adds missing SSE-S3 decryption support when downloading
objects from SSE-S3 encrypted buckets. Previously, SSE-S3 encrypted
objects were returned in their encrypted form, causing data corruption
and hash mismatches.

Changes:
- Updated detectPrimarySSEType() to detect SSE-S3 encrypted objects
  by examining chunk metadata and distinguishing SSE-S3 from SSE-KMS
- Added SSE-S3 handling in handleSSEResponse() to route to new handler
- Implemented handleSSES3Response() for both single-part and multipart
  SSE-S3 encrypted objects with proper decryption
- Implemented createMultipartSSES3DecryptedReader() for multipart
  objects with per-chunk decryption using stored IVs
- Updated addSSEHeadersToResponse() to include SSE-S3 response headers

The fix follows the existing SSE-C and SSE-KMS patterns, using the
envelope encryption architecture where each object's DEK is encrypted
with the KEK stored in the filer.

* Add comprehensive tests for SSE-S3 decryption

- TestSSES3EncryptionDecryption: basic encryption/decryption
- TestSSES3IsRequestInternal: request detection
- TestSSES3MetadataSerialization: metadata serialization/deserialization
- TestDetectPrimarySSETypeS3: SSE type detection for various scenarios
- TestAddSSES3HeadersToResponse: response header validation
- TestSSES3EncryptionWithBaseIV: multipart encryption with base IV
- TestSSES3WrongKeyDecryption: wrong key error handling
- TestSSES3KeyGeneration: key generation and uniqueness
- TestSSES3VariousSizes: encryption/decryption with various data sizes
- TestSSES3ResponseHeaders: response header correctness
- TestSSES3IsEncryptedInternal: metadata-based encryption detection
- TestSSES3InvalidMetadataDeserialization: error handling for invalid metadata
- TestGetSSES3Headers: header generation
- TestProcessSSES3Request: request processing
- TestGetSSES3KeyFromMetadata: key extraction from metadata
- TestSSES3EnvelopeEncryption: envelope encryption correctness
- TestValidateSSES3Key: key validation

All tests pass successfully, providing comprehensive coverage for the
SSE-S3 decryption fix.

* Address PR review comments

1. Fix resource leak in createMultipartSSES3DecryptedReader:
   - Wrap decrypted reader with closer to properly release resources
   - Ensure underlying chunkReader is closed when done

2. Handle mixed-encryption objects correctly:
   - Check chunk encryption type before attempting decryption
   - Pass through non-SSE-S3 chunks unmodified
   - Log encryption type for debugging

3. Improve SSE type detection logic:
   - Add explicit case for aws:kms algorithm
   - Handle unknown algorithms gracefully
   - Better documentation for tie-breaking precedence

4. Document tie-breaking behavior:
   - Clarify that mixed encryption indicates potential corruption
   - Explicit precedence order: SSE-C > SSE-KMS > SSE-S3

These changes address high-severity resource management issues and
improve robustness when handling edge cases and mixed-encryption
scenarios.

* Fix IV retrieval for small/inline SSE-S3 encrypted files

Critical bug fix: The previous implementation only looked for the IV in
chunk metadata, which would fail for small files stored inline (without
chunks).

Changes:
- Check object-level metadata (sseS3Key.IV) first for inline files
- Fallback to first chunk metadata only if object-level IV not found
- Improved error message to indicate both locations were checked

This ensures small SSE-S3 encrypted files (stored inline in entry.Content)
can be properly decrypted, as their IV is stored in the object-level
SeaweedFSSSES3Key metadata rather than in chunk metadata.

Fixes the high-severity issue identified in PR review.

* Clean up unused SSE metadata helper functions

Remove legacy SSE metadata helper functions that were never fully
implemented or used:

Removed unused functions:
- StoreSSECMetadata() / GetSSECMetadata()
- StoreSSEKMSMetadata() / GetSSEKMSMetadata()
- StoreSSES3Metadata() / GetSSES3Metadata()
- IsSSEEncrypted()
- GetSSEAlgorithm()

Removed unused constants:
- MetaSSEAlgorithm
- MetaSSECKeyMD5
- MetaSSEKMSKeyID
- MetaSSEKMSEncryptedKey
- MetaSSEKMSContext
- MetaSSES3KeyID

These functions were from an earlier design where IV and other metadata
would be stored in common entry.Extended keys. The actual implementations
use type-specific serialization:

- SSE-C: Uses StoreIVInMetadata()/GetIVFromMetadata() directly for IV
- SSE-KMS: Serializes entire SSEKMSKey structure as JSON (includes IV)
- SSE-S3: Serializes entire SSES3Key structure as JSON (includes IV)

This follows Option A: SSE-S3 uses envelope encryption pattern like
SSE-KMS, where IV is stored within the serialized key metadata rather
than in a separate metadata field.

Kept functions still in use:
- StoreIVInMetadata() - Used by SSE-C
- GetIVFromMetadata() - Used by SSE-C and streaming copy
- MetaSSEIV constant - Used by SSE-C

All tests pass after cleanup.

* Rename SSE metadata functions to clarify SSE-C specific usage

Renamed functions and constants to explicitly indicate they are SSE-C
specific, improving code clarity:

Renamed:
- MetaSSEIV → MetaSSECIV
- StoreIVInMetadata() → StoreSSECIVInMetadata()
- GetIVFromMetadata() → GetSSECIVFromMetadata()

Updated all usages across:
- s3api_key_rotation.go
- s3api_streaming_copy.go
- s3api_object_handlers_copy.go
- s3_sse_copy_test.go
- s3_sse_test_utils_test.go

Rationale:
These functions are exclusively used by SSE-C for storing/retrieving
the IV in entry.Extended metadata. SSE-KMS and SSE-S3 use different
approaches (IV stored in serialized key structures), so the generic
names were misleading. The new names make it clear these are part of
the SSE-C implementation.

All tests pass.

* Add integration tests for SSE-S3 end-to-end encryption/decryption

These integration tests cover the complete encrypt->store->decrypt cycle
that was missing from the original test suite. They would have caught
the IV retrieval bug for inline files.

Tests added:
- TestSSES3EndToEndSmallFile: Tests inline files (10, 50, 256 bytes)
  * Specifically tests the critical IV retrieval path for inline files
  * This test explicitly checks the bug we fixed where inline files
    couldn't retrieve their IV from object-level metadata

- TestSSES3EndToEndChunkedFile: Tests multipart encrypted files
  * Verifies per-chunk metadata serialization/deserialization
  * Tests that each chunk can be independently decrypted with its own IV

- TestSSES3EndToEndWithDetectPrimaryType: Tests type detection
  * Verifies inline vs chunked SSE-S3 detection
  * Ensures SSE-S3 is distinguished from SSE-KMS

Note: Full HTTP handler tests (PUT -> GET through actual handlers) would
require a complete mock server with filer connections, which is complex.
These tests focus on the critical decrypt path and data flow.

Why these tests are important:
- Unit tests alone don't catch integration issues
- The IV retrieval bug existed because there was no end-to-end test
- These tests simulate the actual storage/retrieval flow
- They verify the complete encryption architecture works correctly

All tests pass.

* Fix TestValidateSSES3Key expectations to match actual implementation

The ValidateSSES3Key function only validates that the key struct is not
nil, but doesn't validate the Key field contents or size. The test was
expecting validation that doesn't exist.

Updated test cases:
- Nil key struct → should error (correct)
- Valid key → should not error (correct)
- Invalid key size → should not error (validation doesn't check this)
- Nil key bytes → should not error (validation doesn't check this)

Added comments to clarify what the current validation actually checks.
This matches the behavior of ValidateSSEKMSKey and ValidateSSECKey
which also only check for nil struct, not field contents.

All SSE tests now pass.

* Improve ValidateSSES3Key to properly validate key contents

Enhanced the validation function from only checking nil struct to
comprehensive validation of all key fields:

Validations added:
1. Key bytes not nil
2. Key size exactly 32 bytes (SSES3KeySize)
3. Algorithm must be "AES256" (SSES3Algorithm)
4. Key ID must not be empty
5. IV length must be 16 bytes if set (optional - set during encryption)

Test improvements (10 test cases):
- Nil key struct
- Valid key without IV
- Valid key with IV
- Invalid key size (too small)
- Invalid key size (too large)
- Nil key bytes
- Empty key ID
- Invalid algorithm
- Invalid IV length
- Empty IV (allowed - set during encryption)

This matches the robustness of SSE-C and SSE-KMS validation and will
catch configuration errors early rather than failing during
encryption/decryption.

All SSE tests pass.

* Replace custom string helper functions with strings.Contains

Address Gemini Code Assist review feedback:
- Remove custom contains() and findSubstring() helper functions
- Use standard library strings.Contains() instead
- Add strings import

This makes the code more idiomatic and easier to maintain by using
the standard library instead of reimplementing functionality.

Changes:
- Added "strings" to imports
- Replaced contains(err.Error(), tc.errorMsg) with strings.Contains(err.Error(), tc.errorMsg)
- Removed 15 lines of custom helper code

All tests pass.

* filer fix reading and writing SSE-S3 headers

* filter out seaweedfs internal headers

* Update weed/s3api/s3api_object_handlers.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update weed/s3api/s3_validation_utils.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update s3api_streaming_copy.go

* remove fallback

* remove redundant check

* refactor

* remove extra object fetching

* in case object is not found

* Correct Version Entry for SSE Routing

* Proper Error Handling for SSE Entry Fetching

* Eliminated All Redundant Lookups

* Removed brittle “exactly 5 successes/failures” assertions. Added invariant checks

total recorded attempts equals request count,
successes never exceed capacity,
failures cover remaining attempts,
final AvailableSpace matches capacity - successes.

* refactor

* fix test

* Fixed Broken Fallback Logic

* refactor

* Better Error for Encryption Type Mismatch

* refactor

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-10-23 20:10:12 -07:00

304 lines
9.5 KiB
Go

package topology
import (
"sync"
"sync/atomic"
"testing"
"time"
"github.com/seaweedfs/seaweedfs/weed/sequence"
"github.com/seaweedfs/seaweedfs/weed/storage/needle"
"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
"github.com/seaweedfs/seaweedfs/weed/storage/types"
)
// MockGrpcDialOption simulates grpc connection for testing
type MockGrpcDialOption struct{}
// simulateVolumeAllocation mocks the volume allocation process
func simulateVolumeAllocation(server *DataNode, vid needle.VolumeId, option *VolumeGrowOption) error {
// Simulate some processing time
time.Sleep(time.Millisecond * 10)
return nil
}
func TestVolumeGrowth_ReservationBasedAllocation(t *testing.T) {
// Create test topology with single server for predictable behavior
topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
// Create data center and rack
dc := NewDataCenter("dc1")
topo.LinkChildNode(dc)
rack := NewRack("rack1")
dc.LinkChildNode(rack)
// Create single data node with limited capacity
dn := NewDataNode("server1")
rack.LinkChildNode(dn)
// Set up disk with limited capacity (only 5 volumes)
disk := NewDisk(types.HardDriveType.String())
disk.diskUsages.getOrCreateDisk(types.HardDriveType).maxVolumeCount = 5
dn.LinkChildNode(disk)
// Test volume growth with reservation
vg := NewDefaultVolumeGrowth()
rp, _ := super_block.NewReplicaPlacementFromString("000") // Single copy (no replicas)
option := &VolumeGrowOption{
Collection: "test",
ReplicaPlacement: rp,
DiskType: types.HardDriveType,
}
// Try to create volumes and verify reservations work
for i := 0; i < 5; i++ {
servers, reservation, err := vg.findEmptySlotsForOneVolume(topo, option, true)
if err != nil {
t.Errorf("Failed to find slots with reservation on iteration %d: %v", i, err)
continue
}
if len(servers) != 1 {
t.Errorf("Expected 1 server for replica placement 000, got %d", len(servers))
}
if len(reservation.reservationIds) != 1 {
t.Errorf("Expected 1 reservation ID, got %d", len(reservation.reservationIds))
}
// Verify the reservation is on our expected server
server := servers[0]
if server != dn {
t.Errorf("Expected volume to be allocated on server1, got %s", server.Id())
}
// Check available space before and after reservation
availableBeforeCreation := server.AvailableSpaceFor(option)
expectedBefore := int64(5 - i)
if availableBeforeCreation != expectedBefore {
t.Errorf("Iteration %d: Expected %d base available space, got %d", i, expectedBefore, availableBeforeCreation)
}
// Simulate successful volume creation
// Acquire lock briefly to access children map, then release before updating
dn.RLock()
disk := dn.children[NodeId(types.HardDriveType.String())].(*Disk)
dn.RUnlock()
deltaDiskUsage := &DiskUsageCounts{
volumeCount: 1,
}
disk.UpAdjustDiskUsageDelta(types.HardDriveType, deltaDiskUsage)
// Release reservation after successful creation
reservation.releaseAllReservations()
// Verify available space after creation
availableAfterCreation := server.AvailableSpaceFor(option)
expectedAfter := int64(5 - i - 1)
if availableAfterCreation != expectedAfter {
t.Errorf("Iteration %d: Expected %d available space after creation, got %d", i, expectedAfter, availableAfterCreation)
}
}
// After 5 volumes, should have no more capacity
_, _, err := vg.findEmptySlotsForOneVolume(topo, option, true)
if err == nil {
t.Error("Expected volume allocation to fail when server is at capacity")
}
}
func TestVolumeGrowth_ConcurrentAllocationPreventsRaceCondition(t *testing.T) {
// Create test topology with very limited capacity
topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
dc := NewDataCenter("dc1")
topo.LinkChildNode(dc)
rack := NewRack("rack1")
dc.LinkChildNode(rack)
// Single data node with capacity for only 5 volumes
dn := NewDataNode("server1")
rack.LinkChildNode(dn)
disk := NewDisk(types.HardDriveType.String())
disk.diskUsages.getOrCreateDisk(types.HardDriveType).maxVolumeCount = 5
dn.LinkChildNode(disk)
vg := NewDefaultVolumeGrowth()
rp, _ := super_block.NewReplicaPlacementFromString("000") // Single copy (no replicas)
option := &VolumeGrowOption{
Collection: "test",
ReplicaPlacement: rp,
DiskType: types.HardDriveType,
}
// Simulate concurrent volume creation attempts
const concurrentRequests = 10
var wg sync.WaitGroup
var successCount, failureCount atomic.Int32
var commitMutex sync.Mutex // Ensures atomic commit of volume creation + reservation release
for i := 0; i < concurrentRequests; i++ {
wg.Add(1)
go func(requestId int) {
defer wg.Done()
_, reservation, err := vg.findEmptySlotsForOneVolume(topo, option, true)
if err != nil {
failureCount.Add(1)
t.Logf("Request %d failed as expected: %v", requestId, err)
} else {
successCount.Add(1)
t.Logf("Request %d succeeded, got reservation", requestId)
// Simulate completion: increment volume count BEFORE releasing reservation
if reservation != nil {
commitMutex.Lock()
// First, increment the volume count to reflect the created volume
// Acquire lock briefly to access children map, then release before updating
dn.RLock()
disk := dn.children[NodeId(types.HardDriveType.String())].(*Disk)
dn.RUnlock()
deltaDiskUsage := &DiskUsageCounts{
volumeCount: 1,
}
disk.UpAdjustDiskUsageDelta(types.HardDriveType, deltaDiskUsage)
// Then release the reservation
reservation.releaseAllReservations()
commitMutex.Unlock()
}
}
}(i)
}
wg.Wait()
// Collect results
successes := successCount.Load()
failures := failureCount.Load()
total := successes + failures
if total != concurrentRequests {
t.Fatalf("Expected %d total attempts recorded, got %d", concurrentRequests, total)
}
// At most the available capacity should succeed
const capacity = 5
if successes > capacity {
t.Errorf("Expected no more than %d successful reservations, got %d", capacity, successes)
}
// We should see at least the remaining attempts fail
minExpectedFailures := concurrentRequests - capacity
if failures < int32(minExpectedFailures) {
t.Errorf("Expected at least %d failed reservations, got %d", minExpectedFailures, failures)
}
// Verify final state matches the number of successful allocations
finalAvailable := dn.AvailableSpaceFor(option)
expectedAvailable := int64(capacity - successes)
if finalAvailable != expectedAvailable {
t.Errorf("Expected %d available space after allocations, got %d", expectedAvailable, finalAvailable)
}
t.Logf("Concurrent test completed: %d successes, %d failures", successes, failures)
}
func TestVolumeGrowth_ReservationFailureRollback(t *testing.T) {
// Create topology with multiple servers, but limited total capacity
topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
dc := NewDataCenter("dc1")
topo.LinkChildNode(dc)
rack := NewRack("rack1")
dc.LinkChildNode(rack)
// Create two servers with different available capacity
dn1 := NewDataNode("server1")
dn2 := NewDataNode("server2")
rack.LinkChildNode(dn1)
rack.LinkChildNode(dn2)
// Server 1: 5 available slots
disk1 := NewDisk(types.HardDriveType.String())
disk1.diskUsages.getOrCreateDisk(types.HardDriveType).maxVolumeCount = 5
dn1.LinkChildNode(disk1)
// Server 2: 0 available slots (full)
disk2 := NewDisk(types.HardDriveType.String())
diskUsage2 := disk2.diskUsages.getOrCreateDisk(types.HardDriveType)
diskUsage2.maxVolumeCount = 5
diskUsage2.volumeCount = 5
dn2.LinkChildNode(disk2)
vg := NewDefaultVolumeGrowth()
rp, _ := super_block.NewReplicaPlacementFromString("010") // requires 2 replicas
option := &VolumeGrowOption{
Collection: "test",
ReplicaPlacement: rp,
DiskType: types.HardDriveType,
}
// This should fail because we can't satisfy replica requirements
// (need 2 servers but only 1 has space)
_, _, err := vg.findEmptySlotsForOneVolume(topo, option, true)
if err == nil {
t.Error("Expected reservation to fail due to insufficient replica capacity")
}
// Verify no reservations are left hanging
available1 := dn1.AvailableSpaceForReservation(option)
if available1 != 5 {
t.Errorf("Expected server1 to have all capacity available after failed reservation, got %d", available1)
}
available2 := dn2.AvailableSpaceForReservation(option)
if available2 != 0 {
t.Errorf("Expected server2 to have no capacity available, got %d", available2)
}
}
func TestVolumeGrowth_ReservationTimeout(t *testing.T) {
dn := NewDataNode("server1")
diskType := types.HardDriveType
// Set up capacity
diskUsage := dn.diskUsages.getOrCreateDisk(diskType)
diskUsage.maxVolumeCount = 5
// Create a reservation
reservationId, success := dn.TryReserveCapacity(diskType, 2)
if !success {
t.Fatal("Expected successful reservation")
}
// Manually set the reservation time to simulate old reservation
dn.capacityReservations.Lock()
if reservation, exists := dn.capacityReservations.reservations[reservationId]; exists {
reservation.createdAt = time.Now().Add(-10 * time.Minute)
}
dn.capacityReservations.Unlock()
// Try another reservation - this should trigger cleanup and succeed
_, success = dn.TryReserveCapacity(diskType, 3)
if !success {
t.Error("Expected reservation to succeed after cleanup of expired reservation")
}
// Original reservation should be cleaned up
option := &VolumeGrowOption{DiskType: diskType}
available := dn.AvailableSpaceForReservation(option)
if available != 2 { // 5 - 3 = 2
t.Errorf("Expected 2 available slots after cleanup and new reservation, got %d", available)
}
}