From 330acb9742c731ea5a6b86da68a83f444fd8c990 Mon Sep 17 00:00:00 2001 From: Jeremy Gaither Date: Thu, 2 Mar 2017 15:29:04 -0600 Subject: [PATCH 1/6] BUGFIX Do not check ETag for SSE KMS * ETags do not match when using KMS, by design. See http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html --- lib/index.js | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/lib/index.js b/lib/index.js index 526f5f1..1a9185e 100644 --- a/lib/index.js +++ b/lib/index.js @@ -220,9 +220,9 @@ Client.prototype.uploadFile = function(params) { s3Params = { Bucket: s3Params.Bucket, Key: encodeSpecialCharacters(s3Params.Key), - SSECustomerAlgorithm: s3Params.SSECustomerAlgorithm, - SSECustomerKey: s3Params.SSECustomerKey, - SSECustomerKeyMD5: s3Params.SSECustomerKeyMD5, + ServerSideEncryption: s3Params.ServerSideEncryption, + SSEKMSKeyId: s3Params.SSEKMSKeyId, + Metadata: s3Params.Metadata }; queueAllParts(data.UploadId, multipartUploadSize); }); @@ -315,11 +315,13 @@ Client.prototype.uploadFile = function(params) { } pend.wait(function() { if (fatalError) return; - if (!compareMultipartETag(data.ETag, multipartETag)) { - errorOccurred = true; - uploader.progressAmount -= overallDelta; - cb(new Error("ETag does not match MD5 checksum")); - return; + if (!s3Params.ServerSideEncryption) { + if (!compareMultipartETag(data.ETag, multipartETag)) { + errorOccurred = true; + uploader.progressAmount -= overallDelta; + cb(new Error("ETag does not match MD5 checksum")); + return; + } } part.ETag = data.ETag; cb(null, data); @@ -411,9 +413,11 @@ Client.prototype.uploadFile = function(params) { } pend.wait(function() { if (fatalError) return; - if (!compareMultipartETag(data.ETag, localFileStat.multipartETag)) { - cb(new Error("ETag does not match MD5 checksum")); - return; + if (s3Params.ServerSideEncryption !== 'aws:kms') { + if (!compareMultipartETag(data.ETag, localFileStat.multipartETag)) { + cb(new Error("ETag does not match MD5 checksum")); + return; + } } cb(null, data); }); From 829c79041289bfdf6621bccb0693b7e8dcfa133d Mon Sep 17 00:00:00 2001 From: Jeremy Gaither Date: Thu, 2 Mar 2017 15:34:22 -0600 Subject: [PATCH 2/6] BUGFIX Do not check ETag for SSE KMS * ETags do not match when using KMS, by design. See http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html --- lib/index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/index.js b/lib/index.js index 1a9185e..17ed390 100644 --- a/lib/index.js +++ b/lib/index.js @@ -315,7 +315,7 @@ Client.prototype.uploadFile = function(params) { } pend.wait(function() { if (fatalError) return; - if (!s3Params.ServerSideEncryption) { + if (s3Params.ServerSideEncryption !== 'aws:kms') { if (!compareMultipartETag(data.ETag, multipartETag)) { errorOccurred = true; uploader.progressAmount -= overallDelta; From bdb3fb35e5539a310de1b73e2bb704f644157aac Mon Sep 17 00:00:00 2001 From: Jeremy Gaither Date: Fri, 3 Mar 2017 13:46:48 -0600 Subject: [PATCH 3/6] add debug for kms download --- lib/index.js | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/index.js b/lib/index.js index 17ed390..0f68a87 100644 --- a/lib/index.js +++ b/lib/index.js @@ -511,6 +511,7 @@ Client.prototype.downloadFile = function(params) { handleError(new Error("Downloaded size does not match Content-Length")); return; } + console.log('DEBUG headers', headers); if (eTagCount === 1 && !multipartETag.anyMatch(eTag)) { handleError(new Error("ETag does not match MD5 checksum")); return; From 8bb07ae6374ddd427a8e99aa3116b92b76dcc3a5 Mon Sep 17 00:00:00 2001 From: Jeremy Gaither Date: Fri, 3 Mar 2017 13:55:58 -0600 Subject: [PATCH 4/6] Don't check etag on kms download --- lib/index.js | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/lib/index.js b/lib/index.js index 0f68a87..948f41a 100644 --- a/lib/index.js +++ b/lib/index.js @@ -511,10 +511,11 @@ Client.prototype.downloadFile = function(params) { handleError(new Error("Downloaded size does not match Content-Length")); return; } - console.log('DEBUG headers', headers); - if (eTagCount === 1 && !multipartETag.anyMatch(eTag)) { - handleError(new Error("ETag does not match MD5 checksum")); - return; + if (headers['x-amz-server-side-encryption'] !== 'aws:kms' ) { + if (eTagCount === 1 && !multipartETag.anyMatch(eTag)) { + handleError(new Error("ETag does not match MD5 checksum")); + return; + } } cb(); }); @@ -830,9 +831,11 @@ Client.prototype.downloadBuffer = function(s3Params) { handleError(new Error("Downloaded size does not match Content-Length")); return; } - if (eTagCount === 1 && !multipartETag.anyMatch(eTag)) { - handleError(new Error("ETag does not match MD5 checksum")); - return; + if (headers['x-amz-server-side-encryption'] !== 'aws:kms' ) { + if (eTagCount === 1 && !multipartETag.anyMatch(eTag)) { + handleError(new Error("ETag does not match MD5 checksum")); + return; + } } cb(); }); From 4c43a7aeb20073932ff48fc14209fd2bfa94cff2 Mon Sep 17 00:00:00 2001 From: Jeremy Gaither Date: Fri, 3 Mar 2017 14:10:39 -0600 Subject: [PATCH 5/6] support customer key --- lib/index.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/index.js b/lib/index.js index 948f41a..b549617 100644 --- a/lib/index.js +++ b/lib/index.js @@ -220,6 +220,9 @@ Client.prototype.uploadFile = function(params) { s3Params = { Bucket: s3Params.Bucket, Key: encodeSpecialCharacters(s3Params.Key), + SSECustomerAlgorithm: s3Params.SSECustomerAlgorithm, + SSECustomerKey: s3Params.SSECustomerKey, + SSECustomerKeyMD5: s3Params.SSECustomerKeyMD5, ServerSideEncryption: s3Params.ServerSideEncryption, SSEKMSKeyId: s3Params.SSEKMSKeyId, Metadata: s3Params.Metadata From 4825979108b59e2fa5ff74d72d338a37c13c517c Mon Sep 17 00:00:00 2001 From: Chris Brown Date: Tue, 2 Jan 2018 13:07:02 +0000 Subject: [PATCH 6/6] Removed illegal parameters from Upload Part call --- lib/index.js | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/lib/index.js b/lib/index.js index b549617..06fae2d 100644 --- a/lib/index.js +++ b/lib/index.js @@ -137,6 +137,7 @@ Client.prototype.uploadFile = function(params) { var defaultContentType = params.defaultContentType || 'application/octet-stream'; s3Params.ContentType = mime.lookup(localFile, defaultContentType); } + var sse = s3Params.ServerSideEncryption; var fatalError = false; var localFileSlicer = null; var parts = []; @@ -222,10 +223,7 @@ Client.prototype.uploadFile = function(params) { Key: encodeSpecialCharacters(s3Params.Key), SSECustomerAlgorithm: s3Params.SSECustomerAlgorithm, SSECustomerKey: s3Params.SSECustomerKey, - SSECustomerKeyMD5: s3Params.SSECustomerKeyMD5, - ServerSideEncryption: s3Params.ServerSideEncryption, - SSEKMSKeyId: s3Params.SSEKMSKeyId, - Metadata: s3Params.Metadata + SSECustomerKeyMD5: s3Params.SSECustomerKeyMD5 }; queueAllParts(data.UploadId, multipartUploadSize); }); @@ -318,7 +316,7 @@ Client.prototype.uploadFile = function(params) { } pend.wait(function() { if (fatalError) return; - if (s3Params.ServerSideEncryption !== 'aws:kms') { + if (sse !== 'aws:kms') { if (!compareMultipartETag(data.ETag, multipartETag)) { errorOccurred = true; uploader.progressAmount -= overallDelta; @@ -416,7 +414,7 @@ Client.prototype.uploadFile = function(params) { } pend.wait(function() { if (fatalError) return; - if (s3Params.ServerSideEncryption !== 'aws:kms') { + if (sse !== 'aws:kms') { if (!compareMultipartETag(data.ETag, localFileStat.multipartETag)) { cb(new Error("ETag does not match MD5 checksum")); return;