snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/s3api/s3_validation_utils_require_test.go

@@ -0,0 +1,102 @@
+package s3api
+
+import "testing"
+
+func TestVerifyKeyCommitment_DefaultAcceptsMissing(t *testing.T) {
+	// Default behaviour mirrors AWS: a missing commitment field is treated
+	// as a legacy object and accepted. This is the cushion that lets
+	// operators upgrade without breaking pre-commitment uploads.
+	prev := requireKeyCommitment.Load()
+	t.Cleanup(func() { requireKeyCommitment.Store(prev) })
+	requireKeyCommitment.Store(false)
+
+	if err := VerifyKeyCommitment([]byte("k"), []byte("iv"), "AES256", nil); err != nil {
+		t.Fatalf("default path should accept missing commitment, got: %v", err)
+	}
+}
+
+func TestVerifyKeyCommitment_StrictRejectsMissing(t *testing.T) {
+	// Strict mode: any object whose metadata lacks the commitment field is
+	// rejected. Closes the silent-downgrade vector — an attacker who can
+	// strip the commitment from metadata can no longer bypass verification.
+	prev := requireKeyCommitment.Load()
+	t.Cleanup(func() { requireKeyCommitment.Store(prev) })
+	requireKeyCommitment.Store(true)
+
+	err := VerifyKeyCommitment([]byte("k"), []byte("iv"), "AES256", nil)
+	if err == nil {
+		t.Fatal("strict mode should reject missing commitment; got nil error")
+	}
+}
+
+func TestVerifyKeyCommitment_StrictAcceptsValidCommitment(t *testing.T) {
+	// Strict mode does not change the verification outcome for objects that
+	// do carry a commitment — the only behavioural delta is the missing
+	// case.
+	prev := requireKeyCommitment.Load()
+	t.Cleanup(func() { requireKeyCommitment.Store(prev) })
+	requireKeyCommitment.Store(true)
+
+	key := []byte("strict-mode-test-key")
+	// IV here is just an opaque input to the HMAC commitment; the test
+	// doesn't pass it into AES-CTR so it doesn't have to be the AES block
+	// size. The 16 bytes match the AES block size to keep the literal
+	// realistic.
+	iv := []byte("strict-mode-iv16")
+	commit := ComputeKeyCommitment(key, iv, "AES256")
+	if err := VerifyKeyCommitment(key, iv, "AES256", commit); err != nil {
+		t.Fatalf("strict mode should accept valid commitment, got: %v", err)
+	}
+}
+
+func TestVerifyKeyCommitment_RejectsTamperedKey(t *testing.T) {
+	// Real attack shape: an attacker who can mutate object metadata cannot
+	// craft a valid commitment without the original key. The verify path
+	// must catch it whether they tamper with the key, the IV, or the
+	// algorithm — all three are bound by the HMAC.
+	prev := requireKeyCommitment.Load()
+	t.Cleanup(func() { requireKeyCommitment.Store(prev) })
+	requireKeyCommitment.Store(false)
+
+	originalKey := []byte("legit-key-for-commitment")
+	iv := []byte("commitment-iv-16")
+	algo := "AES256"
+	commit := ComputeKeyCommitment(originalKey, iv, algo)
+
+	t.Run("tampered key", func(t *testing.T) {
+		if err := VerifyKeyCommitment([]byte("attacker-substituted-key"), iv, algo, commit); err == nil {
+			t.Fatal("verify must reject when the key changed but commitment did not")
+		}
+	})
+	t.Run("tampered IV", func(t *testing.T) {
+		if err := VerifyKeyCommitment(originalKey, []byte("attacker-iv-16!!"), algo, commit); err == nil {
+			t.Fatal("verify must reject when the IV changed but commitment did not")
+		}
+	})
+	t.Run("tampered algorithm", func(t *testing.T) {
+		if err := VerifyKeyCommitment(originalKey, iv, "AES128", commit); err == nil {
+			t.Fatal("verify must reject when the algorithm changed but commitment did not")
+		}
+	})
+	t.Run("tampered commitment", func(t *testing.T) {
+		bad := append([]byte{}, commit...)
+		bad[0] ^= 0x01
+		if err := VerifyKeyCommitment(originalKey, iv, algo, bad); err == nil {
+			t.Fatal("verify must reject when the commitment itself was flipped")
+		}
+	})
+}
+
+func TestSetRequireKeyCommitment(t *testing.T) {
+	prev := requireKeyCommitment.Load()
+	t.Cleanup(func() { requireKeyCommitment.Store(prev) })
+
+	SetRequireKeyCommitment(true)
+	if !requireKeyCommitment.Load() {
+		t.Fatal("SetRequireKeyCommitment(true) did not propagate to the atomic")
+	}
+	SetRequireKeyCommitment(false)
+	if requireKeyCommitment.Load() {
+		t.Fatal("SetRequireKeyCommitment(false) did not propagate to the atomic")
+	}
+}