Skip to content

Commit 4ca568b

Browse files
BourgoisMickaelBourgoisMickael
committed
(wip) fixup sse tests with hideArn
1 parent b34e3b1 commit 4ca568b

File tree

2 files changed

+36
-16
lines changed

2 files changed

+36
-16
lines changed

‎tests/functional/sse-kms-migration/arnPrefix.js‎

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,19 @@ const crypto = require('crypto');
1212
const constants = require('../../../constants');
1313
const log = new DummyRequestLogger();
1414
const { makeRequest } = require('../raw-node/utils/makeRequest');
15+
const { config } = require('../../../lib/Config');
16+
const { getKeyIdFromArn } = require('arsenal/build/lib/network/KMSInterface');
1517

1618
// use file to defined key in arn prefix, if no prefix mem is used
1719

1820
// copy part of aws-node-sdk/test/object/encryptionHeaders.js and add more tests
1921
// around SSE Key prefix and migration
2022
// always getObject to ensure decryption
2123

24+
function getKey(key) {
25+
return config.kmsHideScalityArn ? getKeyIdFromArn(key) : key;
26+
}
27+
2228
const testCases = [
2329
{
2430
name: 'algo-none',
@@ -52,8 +58,8 @@ const testCases = [
5258
];
5359
const testCasesObj = testCases.filter(tc => !tc.deleteSSE);
5460

55-
const config = getConfig('default', { signatureVersion: 'v4' });
56-
const s3 = new S3(config);
61+
const s3config = getConfig('default', { signatureVersion: 'v4' });
62+
const s3 = new S3(s3config);
5763
const bucketUtil = new BucketUtility();
5864

5965
function hydrateSSEConfig({ algo: SSEAlgorithm, masterKeyId: KMSMasterKeyID }) {
@@ -96,13 +102,17 @@ async function assertObjectSSE(Bucket, Key, objConf, obj, bktConf, bkt, VersionI
96102
// obj precedence over bkt
97103
assert.strictEqual(head.ServerSideEncryption, (objConf.algo || bktConf.algo));
98104
if (obj.kmsKey) {
99-
assert.strictEqual(head.SSEKMSKeyId, obj.kmsKeyInfo.masterKeyArn);
105+
assert.strictEqual(head.SSEKMSKeyId, getKey(obj.kmsKeyInfo.masterKeyArn));
100106
} else if (objConf.algo !== 'AES256' && bkt.kmsKey) {
101-
assert.strictEqual(head.SSEKMSKeyId, bkt.kmsKeyInfo.masterKeyArn);
107+
assert.strictEqual(head.SSEKMSKeyId, getKey(bkt.kmsKeyInfo.masterKeyArn));
102108
} else if (head.ServerSideEncryption === 'aws:kms') {
103109
// We differ from aws behavior and always return a
104110
// masterKeyId even when not explicitly configured.
105-
assert.match(head.SSEKMSKeyId, new RegExp(kms.arnPrefix));
111+
if (config.kmsHideScalityArn){
112+
assert.doesNotMatch(head.SSEKMSKeyId, new RegExp(kms.arnPrefix));
113+
} else {
114+
assert.match(head.SSEKMSKeyId, new RegExp(kms.arnPrefix));
115+
}
106116
} else {
107117
assert.strictEqual(head.SSEKMSKeyId, undefined);
108118
if (head.ServerSideEncryption === 'AES256') {
@@ -278,7 +288,7 @@ describe('SSE KMS arnPrefix', () => {
278288
if (bktConf.masterKeyId) {
279289
// arn prefixed even if not prefixed in input
280290
assert.strictEqual(sseMD.configuredMasterKeyId, bkt.kmsKeyInfo.masterKeyArn);
281-
assert.strictEqual(KMSMasterKeyID, bkt.kmsKeyInfo.masterKeyArn);
291+
assert.strictEqual(KMSMasterKeyID, getKey(bkt.kmsKeyInfo.masterKeyArn));
282292
}
283293
});
284294
}
@@ -438,7 +448,7 @@ describe('SSE KMS arnPrefix', () => {
438448
const head = await s3.headObject({ Bucket: copyBkt, Key: source }).promise();
439449
// hardcoded SSE for copy bucket
440450
assert.strictEqual(head.ServerSideEncryption, 'aws:kms');
441-
assert.strictEqual(head.SSEKMSKeyId, copyKmsKey);
451+
assert.strictEqual(head.SSEKMSKeyId, getKey(copyKmsKey));
442452

443453
const get = await s3.getObject({ Bucket: copyBkt, Key: source }).promise();
444454
assert.strictEqual(get.Body.toString(), objForCopy.body);
@@ -645,7 +655,7 @@ describe('ensure MPU use good SSE', () => {
645655
const mpu = await s3.createMultipartUpload({
646656
Bucket: mpuKmsBkt, Key: key, ServerSideEncryption: 'aws:kms', SSEKMSKeyId: mpuKms }).promise();
647657
assert.strictEqual(mpu.ServerSideEncryption, 'aws:kms');
648-
assert.strictEqual(mpu.SSEKMSKeyId, mpuKms);
658+
assert.strictEqual(mpu.SSEKMSKeyId, getKey(mpuKms));
649659

650660
const part1 = await s3.uploadPart({
651661
UploadId: mpu.UploadId,
@@ -655,7 +665,7 @@ describe('ensure MPU use good SSE', () => {
655665
PartNumber: 1,
656666
}).promise();
657667
assert.strictEqual(part1.ServerSideEncryption, 'aws:kms');
658-
assert.strictEqual(part1.SSEKMSKeyId, mpuKms);
668+
assert.strictEqual(part1.SSEKMSKeyId, getKey(mpuKms));
659669
const complete = await s3.completeMultipartUpload({
660670
UploadId: mpu.UploadId,
661671
Bucket: mpuKmsBkt,
@@ -667,7 +677,7 @@ describe('ensure MPU use good SSE', () => {
667677
},
668678
}).promise();
669679
assert.strictEqual(complete.ServerSideEncryption, 'aws:kms');
670-
assert.strictEqual(complete.SSEKMSKeyId, mpuKms);
680+
assert.strictEqual(complete.SSEKMSKeyId, getKey(mpuKms));
671681
void await assertObjectSSE(mpuKmsBkt, key,
672682
{ algo: 'aws:kms', masterKeyId: true },
673683
{ kmsKey: mpuKms, kmsKeyInfo: { masterKeyId: mpuKms, masterKeyArn: mpuKms } },

‎tests/functional/sse-kms-migration/migration.js‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,19 @@ const assert = require('assert');
1010
const metadata = require('../../../lib/metadata/wrapper');
1111
const crypto = require('crypto');
1212
const log = new DummyRequestLogger();
13+
const { config } = require('../../../lib/Config');
14+
const { getKeyIdFromArn } = require('arsenal/build/lib/network/KMSInterface');
1315

1416
// use file to defined key in arn prefix, if no prefix mem is used
1517

1618
// copy part of aws-node-sdk/test/object/encryptionHeaders.js and add more tests
1719
// around SSE Key prefix and migration
1820
// always getObject to ensure decryption
1921

22+
function getKey(key) {
23+
return config.kmsHideScalityArn ? getKeyIdFromArn(key) : key;
24+
}
25+
2026
const testCases = [
2127
{
2228
name: 'algo-none',
@@ -50,8 +56,8 @@ const testCases = [
5056
];
5157
const testCasesObj = testCases.filter(tc => !tc.deleteSSE);
5258

53-
const config = getConfig('default', { signatureVersion: 'v4' });
54-
const s3 = new S3(config);
59+
const s3config = getConfig('default', { signatureVersion: 'v4' });
60+
const s3 = new S3(s3config);
5561
const bucketUtil = new BucketUtility();
5662

5763
// Fix for before migration run
@@ -134,13 +140,13 @@ async function assertObjectSSEMigration(Bucket, Key, objConf, obj, bktConf, bkt,
134140
}
135141

136142
if (obj.kmsKey) {
137-
assert.strictEqual(head.SSEKMSKeyId, expectedKey);
143+
assert.strictEqual(head.SSEKMSKeyId, getKey(expectedKey));
138144
} else if (objConf.algo !== 'AES256' && bkt.kmsKey) {
139-
assert.strictEqual(head.SSEKMSKeyId, expectedKey);
145+
assert.strictEqual(head.SSEKMSKeyId, getKey(expectedKey));
140146
} else if (head.ServerSideEncryption === 'aws:kms') {
141147
// We differ from aws behavior and always return a
142148
// masterKeyId even when not explicitly configured.
143-
assert.strictEqual(head.SSEKMSKeyId, expectedKey);
149+
assert.strictEqual(head.SSEKMSKeyId, getKey(expectedKey));
144150
} else {
145151
assert.strictEqual(head.SSEKMSKeyId, undefined);
146152
}
@@ -547,7 +553,11 @@ describe('SSE KMS migration', () => {
547553
const head = await s3.headObject({ Bucket: copyBkt, Key: source }).promise();
548554
// hardcoded SSE for copy bucket
549555
assert.strictEqual(head.ServerSideEncryption, 'aws:kms');
550-
assert.match(head.SSEKMSKeyId, /^arn:scality:kms/);
556+
if (config.kmsHideScalityArn) {
557+
assert.doesNotMatch(head.SSEKMSKeyId, /^arn:scality:kms/);
558+
} else {
559+
assert.match(head.SSEKMSKeyId, /^arn:scality:kms/);
560+
}
551561

552562
const get = await s3.getObject({ Bucket: copyBkt, Key: source }).promise();
553563
assert.strictEqual(get.Body.toString(), objForCopy.body);

0 commit comments

Comments
 (0)