test for empty objects uploaded with SSE-C headers

[kannappanr]

upload a zero-size object with SSE-C headers. Perform copyobject.
Do key rotation on the copied object and try to access
the object.

Fixes minio/mint#257

[kannappanr]

blocked until minio/minio#5544 is merged

[aead]

LGTM

[harshavardhana]

you don't need coreClient @kannappanr - this test also should add CopyObject

[harshavardhana]

package main

import (
	"bytes"
	"crypto/md5"
	"crypto/tls"
	"encoding/base64"
	"fmt"
	"io/ioutil"
	"log"
	"net/http"
	"os"

	minio "github.com/minio/minio-go"
)

func main() {
	// Note: YOUR-ACCESSKEYID, YOUR-SECRETACCESSKEY, my-testfile, my-bucketname and
	// my-objectname are dummy values, please replace them with original values.

	// New returns an Amazon S3 compatible client object. API compatibility (v2 or v4) is automatically
	// determined based on the Endpoint value.
	minioClient, err := minio.New("127.0.0.1:9000", "minio", "minio123", true)
	if err != nil {
		log.Fatalln(err)
	}

	content := bytes.NewReader([]byte("hello, world"))
	key := []byte("32byteslongsecretkeymustprovided")
	h := md5.New()
	h.Write(key)
	encryptionKey := base64.StdEncoding.EncodeToString(key)
	encryptionKeyMD5 := base64.StdEncoding.EncodeToString(h.Sum(nil))

	// Amazon S3 does not store the encryption key you provide.
	// Instead S3 stores a randomly salted HMAC value of the
	// encryption key in order to validate future requests.
	// The salted HMAC value cannot be used to derive the value
	// of the encryption key or to decrypt the contents of the
	// encrypted object. That means, if you lose the encryption
	// key, you lose the object.
	var metadata = map[string]string{
		"x-amz-server-side-encryption-customer-algorithm": "AES256",
		"x-amz-server-side-encryption-customer-key":       encryptionKey,
		"x-amz-server-side-encryption-customer-key-MD5":   encryptionKeyMD5,
	}

	minioClient.SetCustomTransport(&http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
		}})

	minioClient.TraceOn(os.Stderr)
	// minioClient.TraceOn(os.Stderr) // Enable to debug.
	_, err = minioClient.PutObject("testbucket", "my-encrypted-object.txt", content, content.Size(), minio.PutObjectOptions{
		UserMetadata: metadata,
	})
	if err != nil {
		log.Fatalln(err)
	}

	sseInfo := minio.NewSSEInfo(key, "")
	dstInfo, err := minio.NewDestinationInfo("testbucket", "my-new-encrypted-object.txt", &sseInfo, nil)
	if err != nil {
		log.Fatalln(err)
	}
	srcInfo := minio.NewSourceInfo("testbucket", "my-encrypted-object.txt", &sseInfo)
	if err = minioClient.CopyObject(dstInfo, srcInfo); err != nil {
		log.Fatalln(err)
	}

	opts := minio.GetObjectOptions{}
	for k, v := range metadata {
		opts.Set(k, v)
	}
	opts.SetRange(2, 3)

	r, err := minioClient.GetObject("testbucket", "my-new-encrypted-object.txt", opts)
	if err != nil {
		log.Fatalln(err)
	}
	b, err := ioutil.ReadAll(r)
	fmt.Println(err)
	fmt.Println(string(b))

	// -- Key rotation block --
	rkey := []byte("32byteslongsecretkeymustgenerate")
	rsseInfo := minio.NewSSEInfo(rkey, "")
	dstInfo, err = minio.NewDestinationInfo("testbucket", "my-new-encrypted-object.txt", &rsseInfo, map[string]string{
		"test": "test",
	})
	if err != nil {
		log.Fatalln(err)
	}
	srcInfo = minio.NewSourceInfo("testbucket", "my-new-encrypted-object.txt", &sseInfo)
	if err = minioClient.CopyObject(dstInfo, srcInfo); err != nil {
		log.Fatalln(err)
	}

	h = md5.New()
	h.Write(rkey)
	encryptionKey = base64.StdEncoding.EncodeToString(rkey)
	encryptionKeyMD5 = base64.StdEncoding.EncodeToString(h.Sum(nil))

	// Amazon S3 does not store the encryption key you provide.
	// Instead S3 stores a randomly salted HMAC value of the
	// encryption key in order to validate future requests.
	// The salted HMAC value cannot be used to derive the value
	// of the encryption key or to decrypt the contents of the
	// encrypted object. That means, if you lose the encryption
	// key, you lose the object.
	metadata = map[string]string{
		"x-amz-server-side-encryption-customer-algorithm": "AES256",
		"x-amz-server-side-encryption-customer-key":       encryptionKey,
		"x-amz-server-side-encryption-customer-key-MD5":   encryptionKeyMD5,
	}

	opts = minio.GetObjectOptions{}
	for k, v := range metadata {
		opts.Set(k, v)
	}
	opts.SetRange(2, 3)

	r, err = minioClient.GetObject("testbucket", "my-new-encrypted-object.txt", opts)
	if err != nil {
		log.Fatalln(err)
	}
	b, err = ioutil.ReadAll(r)
	fmt.Println(err)
	fmt.Println(string(b))
}

Take a look at the code here we should also add test for key rotation as well.

[poornas]

should be MInio V4 client in the logError description

[poornas]

you are downloading the object here with SSE headers; comment needs to be changed.