This change let the server return the S3 error for a key rotation if the source key is not valid but equal to the destination key. This change also fixes the SSE-C error messages since AWS returns error messages ending with a '.'. Fixes #5625
Showing the changes to cmd/api-errors.go (1 of 2 files). Show all
Unified · Split
| @@ -138,6 +138,7 @@ const ( · 137 unmodified lines | ||
| 138 | 138 | ErrMissingSSECustomerKey |
| 139 | 139 | ErrMissingSSECustomerKeyMD5 |
| 140 | 140 | ErrSSECustomerKeyMD5Mismatch |
| 141 | + ErrInvalidSSECustomerParameters | |
| 141 | 142 | |
| 142 | 143 | // Bucket notification related errors. |
| 143 | 144 | ErrEventNotification |
| @@ -629,7 +630,7 @@ var errorCodeResponse = map[APIErrorCode]APIError{ · 485 unmodified lines | ||
| 629 | 630 | }, |
| 630 | 631 | ErrInsecureSSECustomerRequest: { |
| 631 | 632 | Code: "InvalidRequest", |
| 632 | − Description: errInsecureSSERequest.Error(), | |
| 633 | + Description: "Requests specifying Server Side Encryption with Customer provided keys must be made over a secure connection.", | |
| 633 | 634 | HTTPStatusCode: http.StatusBadRequest, |
| 634 | 635 | }, |
| 635 | 636 | ErrSSEMultipartEncrypted: { |
| @@ -639,7 +640,7 @@ var errorCodeResponse = map[APIErrorCode]APIError{ · 3 unmodified lines | ||
| 639 | 640 | }, |
| 640 | 641 | ErrSSEEncryptedObject: { |
| 641 | 642 | Code: "InvalidRequest", |
| 642 | − Description: errEncryptedObject.Error(), | |
| 643 | + Description: "The object was stored using a form of Server Side Encryption. The correct parameters must be provided to retrieve the object.", | |
| 643 | 644 | HTTPStatusCode: http.StatusBadRequest, |
| 644 | 645 | }, |
| 645 | 646 | ErrInvalidEncryptionParameters: { |
| @@ -649,27 +650,32 @@ var errorCodeResponse = map[APIErrorCode]APIError{ · 3 unmodified lines | ||
| 649 | 650 | }, |
| 650 | 651 | ErrInvalidSSECustomerAlgorithm: { |
| 651 | 652 | Code: "InvalidArgument", |
| 652 | − Description: errInvalidSSEAlgorithm.Error(), | |
| 653 | + Description: "Requests specifying Server Side Encryption with Customer provided keys must provide a valid encryption algorithm.", | |
| 653 | 654 | HTTPStatusCode: http.StatusBadRequest, |
| 654 | 655 | }, |
| 655 | 656 | ErrInvalidSSECustomerKey: { |
| 656 | 657 | Code: "InvalidArgument", |
| 657 | − Description: errInvalidSSEKey.Error(), | |
| 658 | + Description: "The secret key was invalid for the specified algorithm.", | |
| 658 | 659 | HTTPStatusCode: http.StatusBadRequest, |
| 659 | 660 | }, |
| 660 | 661 | ErrMissingSSECustomerKey: { |
| 661 | 662 | Code: "InvalidArgument", |
| 662 | − Description: errMissingSSEKey.Error(), | |
| 663 | + Description: "Requests specifying Server Side Encryption with Customer provided keys must provide an appropriate secret key.", | |
| 663 | 664 | HTTPStatusCode: http.StatusBadRequest, |
| 664 | 665 | }, |
| 665 | 666 | ErrMissingSSECustomerKeyMD5: { |
| 666 | 667 | Code: "InvalidArgument", |
| 667 | − Description: errMissingSSEKeyMD5.Error(), | |
| 668 | + Description: "Requests specifying Server Side Encryption with Customer provided keys must provide the client calculated MD5 of the secret key.", | |
| 668 | 669 | HTTPStatusCode: http.StatusBadRequest, |
| 669 | 670 | }, |
| 670 | 671 | ErrSSECustomerKeyMD5Mismatch: { |
| 671 | 672 | Code: "InvalidArgument", |
| 672 | − Description: errSSEKeyMD5Mismatch.Error(), | |
| 673 | + Description: "The calculated MD5 hash of the key did not match the hash that was provided.", | |
| 674 | + HTTPStatusCode: http.StatusBadRequest, | |
| 675 | + }, | |
| 676 | + ErrInvalidSSECustomerParameters: { | |
| 677 | + Code: "InvalidArgument", | |
| 678 | + Description: "The provided encryption parameters did not match the ones used originally.", | |
| 673 | 679 | HTTPStatusCode: http.StatusBadRequest, |
| 674 | 680 | }, |
| 675 | 681 | |
| @@ -884,6 +890,8 @@ func toAPIErrorCode(err error) (apiErr APIErrorCode) { · 208 unmodified lines | ||
| 884 | 890 | return ErrObjectTampered |
| 885 | 891 | case errEncryptedObject: |
| 886 | 892 | return ErrSSEEncryptedObject |
| 893 | + case errInvalidSSEParameters: | |
| 894 | + return ErrInvalidSSECustomerParameters | |
| 887 | 895 | case errSSEKeyMismatch: |
| 888 | 896 | return ErrAccessDenied // no access without correct key |
| 889 | 897 | } |