[dvasilas]

TLDR

#6346 fixed CLDSRV-910. But after the fix, a self-copy can corrupt objects already damaged by CLDSRV-910, with no way to recover them.

With this PR, a self-copy that cannot correctly decrypt the data fails with InternalError.

---

The original bug (CLDSRV-910)

Using a self-copy to re-encrypt an object under another master key changed only the master key in the object metadata and did not rewrite the data, which stayed encrypted under the old master key.
Reading such an object returned wrong content or an error.
The object could be repaired by a self-copy back to the old master key.

Problem

Since the CLDSRV-910 fix, a self-copy rewrites the data.
Here is what happens if a self-copy with another master key is done to an object damaged by CLDSRV-910.
The self-copy:

• Decrypts the data with the master key in the object metadata (the wrong one)
• Stores the wrong content
• Deletes the original data.
  The object can no longer be repaired.

This affects only objects damaged by CLDSRV-910.
Self-copy for objects not affected by CLDSRV-910 works as expected.

Fix

With this PR, a self-copy tries to decrypt one part of the data with 3 master keys: the master key in the object metadata, the master key recorded on the locations, and the destination master key.
It compares the MD5 of the decrypted part with the MD5 recorded for that part.
The copy reads the data with the first key that matches. If no key matches, the copy fails with InternalError and nothing is written.

For example, the data is encrypted under K1 and the metadata names K2.
K2 doesn't match; K1 does:

• A copy to K1 leaves the data as it is and records K1 in the metadata.
• A copy to another key, K3, decrypts the data with K1 and encrypts it under K3.

When the new check runs

This check runs only when

• The self-copy rewrites the data, and
• The locations record a master key.

This covers any object updated by a self-copy that didn't rewrite the data (this includes objects damaged by CLDSRV-910)
Other objects are rewritten as before, without the extra read.

---

Notes

• An encrypted object written before S3C 7.1 has no recorded MD5. If its locations record a master key, a self-copy that rewrites it now fails with InternalError.
• The check also covers a self-copy to another location constraint (x-amz-metadata-directive: REPLACE with x-amz-meta-scal-location-constraint). That copy always rewrites the data, so it replaced damaged objects with the wrong content before CLDSRV-910 too.

[bert-e]

Hello dvasilas,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
/after_pull_request	Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval	Bypass the pull request author's approval	⭐
/bypass_build_status	Bypass the build and test status	⭐
/bypass_commit_size	Bypass the check on the size of the changeset TBA	⭐
/bypass_incompatible_branch	Bypass the check on the source branch prefix	⭐
/bypass_jira_check	Bypass the Jira issue check	⭐
/bypass_peer_approval	Bypass the pull request peers' approval	⭐
/bypass_leader_approval	Bypass the pull request leaders' approval	⭐
/bypass_source_branch_lineage	Bypass the cross-branch contamination check	⭐
/approve	Instruct Bert-E that the author has approved the pull request.		✍️
/create_pull_requests	Allow the creation of integration pull requests.
/create_integration_branches	Allow the creation of integration branches.
/no_octopus	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity	Change review acceptance criteria from one reviewer at least to all reviewers
/wait	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
/help	Print Bert-E's manual in the pull request.
/status	Print Bert-E's current status in the pull request.
/clear	Remove all comments from Bert-E from the history TBA
/retry	Re-start a fresh build TBA
/build	Re-start a fresh build TBA
/force_reset	Delete integration branches & pull requests, and restart merge process from the beginning.
/reset	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

[bert-e]

Incorrect fix version

The Fix Version/s in issue CLDSRV-1056 contains:

• None

Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:

• 9.3.26

• 9.4.11

• 9.5.3

• 9.6.0

Please check the Fix Version/s of CLDSRV-1056, or the target
branch of this pull request.