snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/s3api/s3api_encrypted_volume_copy_test.go

@@ -0,0 +1,270 @@
+package s3api
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// TestCreateDestinationChunkPreservesEncryption tests that createDestinationChunk preserves CipherKey and IsCompressed
+func TestCreateDestinationChunkPreservesEncryption(t *testing.T) {
+	s3a := &S3ApiServer{}
+
+	testCases := []struct {
+		name             string
+		sourceChunk      *filer_pb.FileChunk
+		expectedOffset   int64
+		expectedSize     uint64
+		shouldPreserveCK bool
+		shouldPreserveIC bool
+	}{
+		{
+			name: "Encrypted and compressed chunk",
+			sourceChunk: &filer_pb.FileChunk{
+				Offset:       0,
+				Size:         1024,
+				CipherKey:    []byte("test-cipher-key-1234567890123456"),
+				IsCompressed: true,
+				ETag:         "test-etag",
+			},
+			expectedOffset:   0,
+			expectedSize:     1024,
+			shouldPreserveCK: true,
+			shouldPreserveIC: true,
+		},
+		{
+			name: "Only encrypted chunk",
+			sourceChunk: &filer_pb.FileChunk{
+				Offset:       1024,
+				Size:         2048,
+				CipherKey:    []byte("test-cipher-key-1234567890123456"),
+				IsCompressed: false,
+				ETag:         "test-etag-2",
+			},
+			expectedOffset:   1024,
+			expectedSize:     2048,
+			shouldPreserveCK: true,
+			shouldPreserveIC: false,
+		},
+		{
+			name: "Only compressed chunk",
+			sourceChunk: &filer_pb.FileChunk{
+				Offset:       2048,
+				Size:         512,
+				CipherKey:    nil,
+				IsCompressed: true,
+				ETag:         "test-etag-3",
+			},
+			expectedOffset:   2048,
+			expectedSize:     512,
+			shouldPreserveCK: false,
+			shouldPreserveIC: true,
+		},
+		{
+			name: "Unencrypted and uncompressed chunk",
+			sourceChunk: &filer_pb.FileChunk{
+				Offset:       4096,
+				Size:         1024,
+				CipherKey:    nil,
+				IsCompressed: false,
+				ETag:         "test-etag-4",
+			},
+			expectedOffset:   4096,
+			expectedSize:     1024,
+			shouldPreserveCK: false,
+			shouldPreserveIC: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			dstChunk := s3a.createDestinationChunk(tc.sourceChunk, tc.expectedOffset, tc.expectedSize)
+
+			// Verify offset and size
+			if dstChunk.Offset != tc.expectedOffset {
+				t.Errorf("Expected offset %d, got %d", tc.expectedOffset, dstChunk.Offset)
+			}
+			if dstChunk.Size != tc.expectedSize {
+				t.Errorf("Expected size %d, got %d", tc.expectedSize, dstChunk.Size)
+			}
+
+			// Verify CipherKey preservation
+			if tc.shouldPreserveCK {
+				if !bytes.Equal(dstChunk.CipherKey, tc.sourceChunk.CipherKey) {
+					t.Errorf("CipherKey not preserved: expected %v, got %v", tc.sourceChunk.CipherKey, dstChunk.CipherKey)
+				}
+			} else {
+				if len(dstChunk.CipherKey) > 0 {
+					t.Errorf("Expected no CipherKey, got %v", dstChunk.CipherKey)
+				}
+			}
+
+			// Verify IsCompressed preservation
+			if dstChunk.IsCompressed != tc.shouldPreserveIC {
+				t.Errorf("IsCompressed not preserved: expected %v, got %v", tc.shouldPreserveIC, dstChunk.IsCompressed)
+			}
+
+			// Verify ETag preservation
+			if dstChunk.ETag != tc.sourceChunk.ETag {
+				t.Errorf("ETag not preserved: expected %s, got %s", tc.sourceChunk.ETag, dstChunk.ETag)
+			}
+		})
+	}
+}
+
+// TestEncryptedVolumeCopyScenario documents the expected behavior for encrypted volumes (issue #7530)
+func TestEncryptedVolumeCopyScenario(t *testing.T) {
+	t.Run("Scenario: Copy file on encrypted volume with multiple chunks", func(t *testing.T) {
+		// Scenario description for issue #7530:
+		// 1. Volume is started with -filer.encryptVolumeData
+		// 2. File is uploaded via S3 (automatically encrypted, multiple chunks)
+		// 3. File is copied/renamed via S3 CopyObject
+		// 4. Copied file should be readable
+		//
+		// The bug was that IsCompressed flag was not preserved during copy,
+		// causing the upload logic to potentially double-compress the data,
+		// making the copied file unreadable.
+
+		sourceChunks := []*filer_pb.FileChunk{
+			{
+				FileId:       "1,abc123",
+				Offset:       0,
+				Size:         4194304,
+				CipherKey:    util.GenCipherKey(), // Simulates encrypted volume
+				IsCompressed: true,                // Simulates compression
+				ETag:         "etag1",
+			},
+			{
+				FileId:       "2,def456",
+				Offset:       4194304,
+				Size:         4194304,
+				CipherKey:    util.GenCipherKey(),
+				IsCompressed: true,
+				ETag:         "etag2",
+			},
+		}
+
+		s3a := &S3ApiServer{}
+
+		// Verify that createDestinationChunk preserves all necessary metadata
+		for i, srcChunk := range sourceChunks {
+			dstChunk := s3a.createDestinationChunk(srcChunk, srcChunk.Offset, srcChunk.Size)
+
+			// Critical checks for issue #7530
+			if !dstChunk.IsCompressed {
+				t.Errorf("Chunk %d: IsCompressed flag MUST be preserved to prevent double-compression", i)
+			}
+			if !bytes.Equal(dstChunk.CipherKey, srcChunk.CipherKey) {
+				t.Errorf("Chunk %d: CipherKey MUST be preserved for encrypted volumes", i)
+			}
+			if dstChunk.Offset != srcChunk.Offset {
+				t.Errorf("Chunk %d: Offset must be preserved", i)
+			}
+			if dstChunk.Size != srcChunk.Size {
+				t.Errorf("Chunk %d: Size must be preserved", i)
+			}
+			if dstChunk.ETag != srcChunk.ETag {
+				t.Errorf("Chunk %d: ETag must be preserved", i)
+			}
+		}
+
+		t.Log("✓ All chunk metadata properly preserved for encrypted volume copy scenario")
+	})
+}
+
+// A volume-encrypted source must take the re-encrypting UploadPartCopy path:
+// the raw chunk copy slices ciphertext the destination's whole-chunk cipher key
+// can no longer decrypt, and reports the part's ETag from chunks that carry
+// none (issue #10968).
+func TestSourceEntryIsEncryptedForVolumeCipher(t *testing.T) {
+	testCases := []struct {
+		name  string
+		entry *filer_pb.Entry
+		want  bool
+	}{
+		{
+			name:  "nil entry",
+			entry: nil,
+		},
+		{
+			name: "plaintext chunks",
+			entry: &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{
+				{FileId: "1,abc123", Size: 1024, ETag: "etag1"},
+			}},
+		},
+		{
+			name: "volume-encrypted chunk",
+			entry: &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{
+				{FileId: "1,abc123", Size: 1024, CipherKey: util.GenCipherKey()},
+			}},
+			want: true,
+		},
+		{
+			name: "volume-encrypted second chunk",
+			entry: &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{
+				{FileId: "1,abc123", Size: 1024, ETag: "etag1"},
+				{FileId: "2,def456", Offset: 1024, Size: 1024, CipherKey: util.GenCipherKey()},
+			}},
+			want: true,
+		},
+		{
+			name: "SSE-S3 chunk",
+			entry: &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{
+				{FileId: "1,abc123", Size: 1024, SseType: filer_pb.SSEType_SSE_S3},
+			}},
+			want: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := sourceEntryIsEncrypted(tc.entry); got != tc.want {
+				t.Errorf("sourceEntryIsEncrypted = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// A ranged part copy asks the chunk stream for its slice; reading the whole
+// object and discarding the prefix would make an N-part copy read the source
+// N/2 times over.
+func TestGetEncryptedStreamFromVolumesRangesInlineContent(t *testing.T) {
+	s3a := &S3ApiServer{}
+	entry := &filer_pb.Entry{Content: []byte("0123456789")}
+
+	testCases := []struct {
+		name   string
+		offset int64
+		size   int64
+		want   string
+	}{
+		{name: "whole content", size: 10, want: "0123456789"},
+		{name: "leading slice", size: 4, want: "0123"},
+		{name: "middle slice", offset: 3, size: 4, want: "3456"},
+		{name: "trailing slice", offset: 6, size: 4, want: "6789"},
+		{name: "size past the end", offset: 8, size: 10, want: "89"},
+		{name: "offset past the end", offset: 10, size: 4},
+		{name: "empty range", size: 0},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			reader, err := s3a.getEncryptedStreamFromVolumes(context.Background(), entry, tc.offset, tc.size)
+			if err != nil {
+				t.Fatalf("getEncryptedStreamFromVolumes: %v", err)
+			}
+			defer reader.Close()
+			got, err := io.ReadAll(reader)
+			if err != nil {
+				t.Fatalf("read: %v", err)
+			}
+			if string(got) != tc.want {
+				t.Errorf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}